@camstack/addon-pipeline 1.2.165 → 1.2.166

package/dist/audio-analyzer/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-15qysRyR.js");
-const require_process_memory = require("../process-memory-CJHwbMAy.js");
+const require_dist = require("../dist-DzDy7GQy.js");
+const require_process_memory = require("../process-memory-DxEFct9z.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/audio-analyzer/index.mjs

@@ -1,6 +1,6 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { A as audioAnalysisCapability, It as hydrateSchema, S as PoolMemoryWatchdog, _t as resolvePoolMemoryPolicy, j as audioAnalyzerCapability, jt as BaseAddon, n as AUDIO_BACKEND_CHOICES, nt as mapAudioLabelToMacro, s as DEFAULT_AUDIO_ANALYZER_CONFIG, v as HF_BASE_URL, wt as errMsg } from "../dist-Bz00AHCy.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BosDzc_U.mjs";
+import { A as audioAnalysisCapability, It as hydrateSchema, S as PoolMemoryWatchdog, _t as resolvePoolMemoryPolicy, j as audioAnalyzerCapability, jt as BaseAddon, n as AUDIO_BACKEND_CHOICES, nt as mapAudioLabelToMacro, s as DEFAULT_AUDIO_ANALYZER_CONFIG, v as HF_BASE_URL, wt as errMsg } from "../dist-D58lTgkb.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BKFQtEwX.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { downloadFile } from "@camstack/system/addon-utils";

package/dist/detection-pipeline/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-15qysRyR.js");
-const require_node = require("../node-BdjJPTLk.js");
-const require_local_frame_registry = require("../local-frame-registry-BnimNHwT.js");
-const require_lazy_sharp = require("../lazy-sharp-CusvUEdy.js");
+const require_dist = require("../dist-DzDy7GQy.js");
+const require_node = require("../node-jFu0Gq80.js");
+const require_local_frame_registry = require("../local-frame-registry-BApB7L10.js");
+const require_lazy_sharp = require("../lazy-sharp-BbFUtott.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
-const require_process_memory = require("../process-memory-CJHwbMAy.js");
+const require_process_memory = require("../process-memory-DxEFct9z.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/detection-pipeline/index.mjs

@@ -1,10 +1,10 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { Bt as nodePin, Ft as createEvent, It as hydrateSchema, Kt as array, O as YAMNET_TO_MACRO, Q as inferModelProvider, Qt as object, S as PoolMemoryWatchdog, St as supportedRuntimes$1, Vt as parseJsonUnknown, W as detectionPipelineCapability, Wt as sleep, Y as evaluateZoneRules, _t as resolvePoolMemoryPolicy, at as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, ct as pickClusterStepSettings, dt as pipelineExecutorCapability, en as string, et as loadContributionCapability, ht as resolveClusterStepModelId, jt as BaseAddon, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, q as enumerateInferenceDevices, st as pickClusterStepModels, t as APPLE_SA_TO_MACRO, tn as union, wt as errMsg, yt as runtimeDevices$1, z as defaultDeviceFor$1 } from "../dist-Bz00AHCy.mjs";
-import { a as readProcessCost } from "../node-CpW6WY9n.mjs";
-import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep, t as localFrameRegistry, u as landmarkPrecisionVerdict } from "../local-frame-registry-B7cPLEW-.mjs";
+import { Bt as nodePin, Ft as createEvent, It as hydrateSchema, Kt as array, O as YAMNET_TO_MACRO, Q as inferModelProvider, Qt as object, S as PoolMemoryWatchdog, St as supportedRuntimes$1, Vt as parseJsonUnknown, W as detectionPipelineCapability, Wt as sleep, Y as evaluateZoneRules, _t as resolvePoolMemoryPolicy, at as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, ct as pickClusterStepSettings, dt as pipelineExecutorCapability, en as string, et as loadContributionCapability, ht as resolveClusterStepModelId, jt as BaseAddon, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, q as enumerateInferenceDevices, st as pickClusterStepModels, t as APPLE_SA_TO_MACRO, tn as union, wt as errMsg, yt as runtimeDevices$1, z as defaultDeviceFor$1 } from "../dist-D58lTgkb.mjs";
+import { a as readProcessCost } from "../node-CLOpRiqg.mjs";
+import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep, t as localFrameRegistry, u as landmarkPrecisionVerdict } from "../local-frame-registry-Bsubr_k_.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BosDzc_U.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-BKFQtEwX.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { spawn } from "node:child_process";

package/dist/{dist-Bz00AHCy.mjs → dist-D58lTgkb.mjs}

@@ -8948,7 +8948,8 @@ var OpsLogReasonSchema = _enum([
 	"quota",
 	"manual",
 	"operator",
-	"maintenance"
+	"maintenance",
+	"orphaned-device"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = object({
@@ -14642,10 +14643,39 @@ var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
 	data: record(string(), unknown())
 });
+/** What a migration actually did, per switch. `unreachable` is a first-class
+*  answer: a camera that could not be asked is not a camera that was silenced. */
+var MigrateSwitchOutcomeSchema = _enum([
+	"off",
+	"on",
+	"not-offered",
+	"unreachable"
+]);
+var MigrateSwitchReportSchema = object({
+	deviceId: number(),
+	switchId: CameraSwitchIdSchema,
+	outcome: MigrateSwitchOutcomeSchema,
+	detail: string().optional()
+});
+var MigrateDeviceResultSchema = object({
+	sourceId: number(),
+	targetId: number(),
+	switches: array(MigrateSwitchReportSchema).readonly(),
+	/** Switches that could NOT be turned off on the source. Empty is the only
+	*  value meaning the replaced hardware is quiet. */
+	sourceStillLive: array(CameraSwitchIdSchema).readonly(),
+	swapped: boolean()
+});
 method(object({
 	addonId: string(),
 	stableId: string()
-}), object({ id: number() }), { kind: "mutation" }), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
+}), object({ id: number() }), { kind: "mutation" }), method(object({
+	sourceId: number(),
+	targetId: number()
+}), MigrateDeviceResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
 	deviceId: number(),
 	name: string()
 }), _void(), {
@@ -33424,6 +33454,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.migrateDevice": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.persistConfig": {
 		capName: "device-manager",
 		capScope: "system",

package/dist/{dist-15qysRyR.js → dist-DzDy7GQy.js}

@@ -8971,7 +8971,8 @@ var OpsLogReasonSchema = _enum([
 	"quota",
 	"manual",
 	"operator",
-	"maintenance"
+	"maintenance",
+	"orphaned-device"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = object({
@@ -14665,10 +14666,39 @@ var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
 	data: record(string(), unknown())
 });
+/** What a migration actually did, per switch. `unreachable` is a first-class
+*  answer: a camera that could not be asked is not a camera that was silenced. */
+var MigrateSwitchOutcomeSchema = _enum([
+	"off",
+	"on",
+	"not-offered",
+	"unreachable"
+]);
+var MigrateSwitchReportSchema = object({
+	deviceId: number(),
+	switchId: CameraSwitchIdSchema,
+	outcome: MigrateSwitchOutcomeSchema,
+	detail: string().optional()
+});
+var MigrateDeviceResultSchema = object({
+	sourceId: number(),
+	targetId: number(),
+	switches: array(MigrateSwitchReportSchema).readonly(),
+	/** Switches that could NOT be turned off on the source. Empty is the only
+	*  value meaning the replaced hardware is quiet. */
+	sourceStillLive: array(CameraSwitchIdSchema).readonly(),
+	swapped: boolean()
+});
 method(object({
 	addonId: string(),
 	stableId: string()
-}), object({ id: number() }), { kind: "mutation" }), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
+}), object({ id: number() }), { kind: "mutation" }), method(object({
+	sourceId: number(),
+	targetId: number()
+}), MigrateDeviceResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
 	deviceId: number(),
 	name: string()
 }), _void(), {
@@ -33447,6 +33477,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.migrateDevice": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.persistConfig": {
 		capName: "device-manager",
 		capScope: "system",

package/dist/{lazy-sharp-CusvUEdy.js → lazy-sharp-BbFUtott.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-15qysRyR.js");
+const require_dist = require("./dist-DzDy7GQy.js");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path);
 let node_url = require("node:url");

package/dist/{local-frame-registry-BnimNHwT.js → local-frame-registry-BApB7L10.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-15qysRyR.js");
+const require_dist = require("./dist-DzDy7GQy.js");
 let node_crypto = require("node:crypto");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/{local-frame-registry-B7cPLEW-.mjs → local-frame-registry-Bsubr_k_.mjs}

@@ -1,4 +1,4 @@
-import { M as audioKindId, Z as hfModelUrl, a as COCO_80_LABELS, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS } from "./dist-Bz00AHCy.mjs";
+import { M as audioKindId, Z as hfModelUrl, a as COCO_80_LABELS, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS } from "./dist-D58lTgkb.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-15qysRyR.js");
-const require_lazy_sharp = require("../lazy-sharp-CusvUEdy.js");
+const require_dist = require("../dist-DzDy7GQy.js");
+const require_lazy_sharp = require("../lazy-sharp-BbFUtott.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 //#region src/motion-wasm/wasm-motion-detector.ts

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, Pt as DeviceType, Y as evaluateZoneRules, it as motionDetectionCapability, jt as BaseAddon } from "../dist-Bz00AHCy.mjs";
+import { It as hydrateSchema, Pt as DeviceType, Y as evaluateZoneRules, it as motionDetectionCapability, jt as BaseAddon } from "../dist-D58lTgkb.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{node-CpW6WY9n.mjs → node-CLOpRiqg.mjs}

@@ -1,4 +1,4 @@
-import { Dt as buildFfmpegArgs, Et as Fmp4BoxSplitter, kt as isSoftwareDecode, wt as errMsg } from "./dist-Bz00AHCy.mjs";
+import { Dt as buildFfmpegArgs, Et as Fmp4BoxSplitter, kt as isSoftwareDecode, wt as errMsg } from "./dist-D58lTgkb.mjs";
 import { randomUUID } from "node:crypto";
 import "node:fs";
 import "node:path";

package/dist/{node-BdjJPTLk.js → node-jFu0Gq80.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-15qysRyR.js");
+const require_dist = require("./dist-DzDy7GQy.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);

package/dist/pipeline-runner/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-15qysRyR.js");
-const require_node = require("../node-BdjJPTLk.js");
-const require_local_frame_registry = require("../local-frame-registry-BnimNHwT.js");
-const require_worker_protocol = require("../worker-protocol-DczDySjo.js");
+const require_dist = require("../dist-DzDy7GQy.js");
+const require_node = require("../node-jFu0Gq80.js");
+const require_local_frame_registry = require("../local-frame-registry-BApB7L10.js");
+const require_worker_protocol = require("../worker-protocol-BSKMHGDG.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_lazy_sharp = require("../lazy-sharp-CusvUEdy.js");
+const require_lazy_sharp = require("../lazy-sharp-BbFUtott.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");

package/dist/pipeline-runner/index.mjs

@@ -1,7 +1,7 @@
-import { B as defineCustomActions, Bt as nodePin, Ft as createEvent, Gt as _enum, H as deriveDetailCropRect, Kt as array, L as customAction, Qt as object, X as failureContributionCapability, Xt as literal, Yt as lazy, Zt as number, _ as FailureCounters, en as string, et as loadContributionCapability, ft as pipelineRunnerCapability, jt as BaseAddon, lt as pickDetailCropConvention, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, p as DEFAULT_NATIVE_LEASE_SETTINGS, qt as boolean, u as DEFAULT_DETAIL_CROP_CONVENTION, ut as pickNativeLeaseOverride, wt as errMsg } from "../dist-Bz00AHCy.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CpW6WY9n.mjs";
-import { c as getStepDefinition, n as resolveFrameViewGeometry, t as localFrameRegistry } from "../local-frame-registry-B7cPLEW-.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-B2RCeDwS.mjs";
+import { B as defineCustomActions, Bt as nodePin, Ft as createEvent, Gt as _enum, H as deriveDetailCropRect, Kt as array, L as customAction, Qt as object, X as failureContributionCapability, Xt as literal, Yt as lazy, Zt as number, _ as FailureCounters, en as string, et as loadContributionCapability, ft as pipelineRunnerCapability, jt as BaseAddon, lt as pickDetailCropConvention, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, p as DEFAULT_NATIVE_LEASE_SETTINGS, qt as boolean, u as DEFAULT_DETAIL_CROP_CONVENTION, ut as pickNativeLeaseOverride, wt as errMsg } from "../dist-D58lTgkb.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CLOpRiqg.mjs";
+import { c as getStepDefinition, n as resolveFrameViewGeometry, t as localFrameRegistry } from "../local-frame-registry-Bsubr_k_.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-l0Mqtqka.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { n as withDetectionIntent } from "../restream-intent-B4BXZra7.mjs";

package/dist/{process-memory-BosDzc_U.mjs → process-memory-BKFQtEwX.mjs}

@@ -1,4 +1,4 @@
-import { ot as parseProcStatus } from "./dist-Bz00AHCy.mjs";
+import { ot as parseProcStatus } from "./dist-D58lTgkb.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-CJHwbMAy.js → process-memory-DxEFct9z.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-15qysRyR.js");
+const require_dist = require("./dist-DzDy7GQy.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/recorder/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-15qysRyR.js");
-const require_node = require("../node-BdjJPTLk.js");
+const require_dist = require("../dist-DzDy7GQy.js");
+const require_node = require("../node-jFu0Gq80.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
@@ -3002,21 +3002,145 @@ function selectEvictionsByBytes(segments, targetBytes) {
 	}
 	return out;
 }
+var OrphanDeviceLane = class {
+	deps;
+	/** deviceId → consecutive ANSWERED reads that did not contain it. */
+	absenceStreak = /* @__PURE__ */ new Map();
+	/** The verdict the last answered read reached, reused inside the gap. */
+	confirmed = /* @__PURE__ */ new Set();
+	/** When a read was last TAKEN (answered or not) — the gap is a rate limit on
+	*  asking, not on believing. */
+	lastReadAtMs = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Of the devices that hold footage here, which ones has the registry
+	* confirmed — twice, on reads taken apart in time — that it no longer knows?
+	*
+	* Never throws: every failure returns the empty set, which is "evict the way
+	* this repo evicted before the lane existed".
+	*/
+	async confirmedOrphans(footageDevices) {
+		if (footageDevices.size === 0) return /* @__PURE__ */ new Set();
+		const now = this.deps.now?.() ?? Date.now();
+		const minGap = this.deps.minGapMs ?? 3e4;
+		if (this.lastReadAtMs !== null && now - this.lastReadAtMs < minGap) return intersect(this.confirmed, footageDevices);
+		const read = await this.readOnce();
+		this.lastReadAtMs = now;
+		const known = this.trustedDeviceIds(read, footageDevices);
+		if (known === null) return intersect(this.confirmed, footageDevices);
+		this.advanceStreaks(known, footageDevices);
+		const confirmed = /* @__PURE__ */ new Set();
+		for (const [deviceId, streak] of this.absenceStreak) if (streak >= 2) confirmed.add(deviceId);
+		this.confirmed = confirmed;
+		return intersect(confirmed, footageDevices);
+	}
+	/** The read, with a throw folded into the union rather than escaping. */
+	async readOnce() {
+		try {
+			return await this.deps.readRegistry();
+		} catch (err) {
+			return {
+				status: "unanswered",
+				detail: err instanceof Error ? err.message : String(err)
+			};
+		}
+	}
+	/**
+	* Rules 1-3: the device ids this read may be believed about, or `null` when
+	* it may not be believed at all.
+	*
+	* Every refusal is SAID — a lane that silently declines to run is
+	* indistinguishable from one nobody wired, and this branch drops work (the
+	* operator's ordering) on purpose.
+	*/
+	trustedDeviceIds(read, footageDevices) {
+		if (read.status === "unanswered") {
+			this.deps.logger.warn("recorder: dead-device eviction lane disarmed — the device registry did not answer; evicting oldest-first only", { meta: {
+				detail: read.detail,
+				footageDevices: footageDevices.size
+			} });
+			return null;
+		}
+		if (read.deviceIds.size === 0) {
+			this.deps.logger.warn("recorder: dead-device eviction lane disarmed — the device enumeration came back empty, which an empty store snapshot also looks like", { meta: { footageDevices: footageDevices.size } });
+			return null;
+		}
+		let recognised = 0;
+		for (const deviceId of footageDevices) if (read.deviceIds.has(deviceId)) recognised += 1;
+		if (recognised === 0) {
+			this.deps.logger.warn("recorder: dead-device eviction lane disarmed — the registry knows NONE of the cameras holding footage here, which is a defect report and not a fleet-wide deletion", { meta: {
+				footageDevices: footageDevices.size,
+				registryDevices: read.deviceIds.size
+			} });
+			return null;
+		}
+		return read.deviceIds;
+	}
+	/** Rules 4 and 5, plus the bound: the map only ever holds devices that hold
+	*  footage right now, so it cannot outgrow the archive. */
+	advanceStreaks(known, footageDevices) {
+		for (const deviceId of this.absenceStreak.keys()) if (!footageDevices.has(deviceId)) this.absenceStreak.delete(deviceId);
+		for (const deviceId of footageDevices) {
+			if (known.has(deviceId)) {
+				this.absenceStreak.delete(deviceId);
+				continue;
+			}
+			const streak = (this.absenceStreak.get(deviceId) ?? 0) + 1;
+			this.absenceStreak.set(deviceId, streak);
+			if (streak === 2) this.deps.logger.warn("recorder: camera confirmed gone by two independent registry reads — its footage is now evicted before anything chosen by age", {
+				tags: { deviceId },
+				meta: { confirmations: streak }
+			});
+		}
+	}
+};
+function intersect(a, b) {
+	const out = /* @__PURE__ */ new Set();
+	for (const value of a) if (b.has(value)) out.add(value);
+	return out;
+}
 //#endregion
 //#region src/recorder/storage-evictable-provider.ts
 /**
 * Implements the `storage-evictable` cap surface for recording footage. The core
 * StoragePressureManager owns the trigger (per-location free-space monitoring); this
-* provider decides WHAT footage is expendable (oldest-first, no pinning) and deletes it
-* via `SegmentStore.evict`, which removes the file through the `storage` cap and de-indexes.
+* provider decides WHAT footage is expendable and deletes it via `SegmentStore.evict`,
+* which removes the file through the `storage` cap and de-indexes.
+*
+* ## Two tiers, one budget
+*
+* Footage of a camera the registry no longer knows is chosen BEFORE any age
+* comparison; within that tier, and in everything after it, still oldest-first.
+* The operator's rule is "when the disk fills, lose the dead cameras first",
+* and it applies under disk pressure ONLY — there is deliberately no
+* time-based sweep of dead-device footage, so a camera that is gone keeps its
+* footage until the space is actually needed.
+*
+* This changes the ORDER and not the amount: the two tiers share one
+* `targetBytes` budget, the second is asked only for what the first left
+* uncovered, and nothing is selected that plain oldest-first would not have
+* been willing to select eventually.
+*
+* The dead-device tier is gated by {@link OrphanDeviceLane} — a registry read
+* that fails, comes back empty, or contradicts itself arms nothing, and the
+* round degrades to exactly the oldest-first behaviour that predates the tier.
 *
 * The cap's `locationId` is used directly as the storage `location` (identity); see Plan 2d
 * notes. Wiring this class to the cap + the SegmentStore happens in Plan 2e.
 */
 var StorageEvictableProvider = class {
 	deps;
+	orphanLane;
 	constructor(deps) {
 		this.deps = deps;
+		this.orphanLane = new OrphanDeviceLane({
+			readRegistry: deps.deviceRegistry,
+			logger: deps.logger,
+			...deps.now !== void 0 ? { now: deps.now } : {},
+			...deps.orphanConfirmGapMs !== void 0 ? { minGapMs: deps.orphanConfirmGapMs } : {}
+		});
 	}
 	/** The eviction domain of `locationId` — aliases sharing its disk, else
 	*  itself — MINUS read-only members (drain mode: their bytes are neither
@@ -3056,8 +3180,19 @@ var StorageEvictableProvider = class {
 				exhausted: true
 			};
 		}
-		const oldest = await archive.oldestSegments(this.domainOf(input.locationId), input.targetBytes);
-		const victims = selectEvictionsByBytes(oldest.rows, input.targetBytes);
+		const domain = this.domainOf(input.locationId);
+		const orphans = await this.orphanLane.confirmedOrphans(archive.devicesWithFootage(domain));
+		const orphanVictims = orphans.size === 0 ? [] : selectEvictionsByBytes((await archive.oldestSegmentsForDevices(domain, orphans, input.targetBytes)).rows, input.targetBytes);
+		const orphanBytes = orphanVictims.reduce((sum, v) => sum + v.bytes, 0);
+		const remainingBytes = input.targetBytes - orphanBytes;
+		const oldest = remainingBytes > 0 ? await archive.oldestSegments(domain, remainingBytes) : {
+			rows: [],
+			exhausted: false
+		};
+		const taken = new Set(orphanVictims.map((v) => v.path));
+		const ageCandidates = oldest.rows.filter((r) => !taken.has(r.path));
+		const ageVictims = selectEvictionsByBytes(ageCandidates, remainingBytes);
+		const victims = [...orphanVictims, ...ageVictims];
 		const byLocation = /* @__PURE__ */ new Map();
 		for (const v of victims) {
 			const group = byLocation.get(v.locationId);
@@ -3066,8 +3201,8 @@ var StorageEvictableProvider = class {
 		}
 		let reclaimedBytes = 0;
 		for (const [locationId, rows] of byLocation) reclaimedBytes += await this.deps.store.evict(locationId, rows);
-		if (reclaimedBytes > 0 && this.deps.onEvicted) this.deps.onEvicted(summarizeEvictionsByDevice(victims));
-		const exhausted = oldest.exhausted && victims.length >= oldest.rows.length;
+		if (reclaimedBytes > 0 && this.deps.onEvicted) this.deps.onEvicted(summarizeEvictionsByDevice(victims, orphans));
+		const exhausted = oldest.exhausted && ageVictims.length >= ageCandidates.length;
 		return {
 			reclaimedBytes,
 			exhausted
@@ -3077,8 +3212,14 @@ var StorageEvictableProvider = class {
 /** Group an eviction round's victims into per-(device, location) summaries (bytes
 * come from the pre-delete selection — partial delete failures may overstate
 * slightly). A domain round can span aliased locations, so each victim is bucketed
-* by its OWN `locationId` (not a single round-level location). */
-function summarizeEvictionsByDevice(victims) {
+* by its OWN `locationId` (not a single round-level location).
+*
+* `orphanDeviceIds` is the round's CONFIRMED-gone set and it decides each
+* summary's {@link EvictionReason}. Required rather than defaulted: the reason
+* is what the operator reads in the activity history, and a caller that forgot
+* to pass it would file every eviction as `oldest-first` — the one wrong
+* answer nothing downstream could detect. */
+function summarizeEvictionsByDevice(victims, orphanDeviceIds) {
 	const byKey = /* @__PURE__ */ new Map();
 	for (const v of victims) {
 		const key = `${v.deviceId}${v.locationId}`;
@@ -3089,11 +3230,11 @@ function summarizeEvictionsByDevice(victims) {
 			segments: 1,
 			bytes: v.bytes,
 			fromMs: v.startMs,
-			toMs: v.startMs + v.durMs
+			toMs: v.startMs + v.durMs,
+			reason: orphanDeviceIds.has(v.deviceId) ? "orphaned-device" : "oldest-first"
 		});
 		else byKey.set(key, {
-			deviceId: v.deviceId,
-			locationId: v.locationId,
+			...cur,
 			segments: cur.segments + 1,
 			bytes: cur.bytes + v.bytes,
 			fromMs: Math.min(cur.fromMs, v.startMs),
@@ -8922,6 +9063,49 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* able to say truthfully.
 	*/
 	async oldestSegments(locationIds, targetBytes) {
+		return this.oldestSegmentsScoped(locationIds, null, targetBytes);
+	}
+	/**
+	* {@link oldestSegments}, narrowed to a set of cameras.
+	*
+	* The disk-pressure evictor's dead-device tier needs the oldest footage OF
+	* THE CAMERAS THAT NO LONGER EXIST, which is a different question from the
+	* oldest footage on the disk: an orphan's newest hour has to be reachable
+	* even when a live camera holds every one of the oldest ones. The narrowing
+	* is a `deviceId IN (…)` on the same statement, so it stays ONE ordered,
+	* bounded, paged read and never a per-device merge.
+	*
+	* The device set is the CALLER's business — this method neither knows nor
+	* checks what makes a device evictable. Refuses an empty set rather than
+	* compiling to "every camera", for the same reason
+	* {@link SegmentHourLedger.predicate} refuses an empty scope.
+	*/
+	async oldestSegmentsForDevices(locationIds, deviceIds, targetBytes) {
+		if (deviceIds.size === 0) return {
+			rows: [],
+			exhausted: true
+		};
+		return this.oldestSegmentsScoped(locationIds, [...deviceIds], targetBytes);
+	}
+	/**
+	* Every camera the ledger holds an hour for on these locations.
+	*
+	* Answered from T1 — the always-resident hour summary, which carries
+	* `deviceId` and `locationId` — exactly like {@link profilesWithFootage},
+	* and for the same reason: this is an O(writers × days) question and it must
+	* cost no I/O. It runs on the disk-pressure path, where an I/O that fails
+	* would have to be turned into a verdict.
+	*
+	* An EMPTY answer is "the mirror knows no hour here", which is also what a
+	* ledger whose load failed reports — so the caller must treat it as "decide
+	* nothing", never as "no camera owns this footage".
+	*/
+	devicesWithFootage(locationIds) {
+		const out = /* @__PURE__ */ new Set();
+		for (const row of this.ledger.snapshot()) if (locationIds.has(row.locationId)) out.add(row.deviceId);
+		return out;
+	}
+	async oldestSegmentsScoped(locationIds, deviceIds, targetBytes) {
 		const ids = [...locationIds];
 		if (ids.length === 0 || targetBytes <= 0) return {
 			rows: [],
@@ -8936,7 +9120,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
 				columns: OLDEST_PROBE_COLUMNS,
 				filter: {
-					whereIn: { locationId: ids },
+					whereIn: deviceIds === null ? { locationId: ids } : {
+						locationId: ids,
+						deviceId: deviceIds
+					},
 					orderBy: {
 						field: "hourStartMs",
 						direction: "asc"
@@ -16660,15 +16847,40 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			store: this.segmentStore,
 			resolveDomain: (locationId) => this.locationDomain(locationId),
 			isReadOnly: (locationId) => this.resolvedLocations.find((l) => l.id === locationId)?.readOnly === true,
+			deviceRegistry: async () => {
+				try {
+					const devices = await this.ctx.api.deviceManager.listAll.query({ projection: "slim" });
+					return {
+						status: "answered",
+						deviceIds: new Set(devices.map((d) => d.id))
+					};
+				} catch (err) {
+					return {
+						status: "unanswered",
+						detail: err instanceof Error ? err.message : String(err)
+					};
+				}
+			},
 			onEvicted: (summaries) => {
 				for (const s of summaries) {
+					const opReason = s.reason === "orphaned-device" ? "orphaned-device" : "quota";
 					opsLog.append({
 						op: "prune",
-						reason: "quota",
+						reason: opReason,
 						deviceId: s.deviceId,
 						itemsAffected: s.segments,
 						bytesReclaimed: s.bytes,
-						detail: `disk-pressure evicted [${new Date(s.fromMs).toISOString()}, ${new Date(s.toMs).toISOString()}) on ${s.locationId}`
+						detail: `disk-pressure evicted [${new Date(s.fromMs).toISOString()}, ${new Date(s.toMs).toISOString()}) on ${s.locationId} — ${s.reason}`
+					});
+					if (s.reason === "orphaned-device") this.ctx.logger.info("recorder: disk-pressure evicted footage of a camera that no longer exists — chosen ahead of older footage of live cameras", {
+						tags: { deviceId: s.deviceId },
+						meta: {
+							locationId: s.locationId,
+							segments: s.segments,
+							bytes: s.bytes,
+							fromMs: s.fromMs,
+							toMs: s.toMs
+						}
 					});
 					this.ctx.eventBus.emit({
 						id: (0, node_crypto.randomUUID)(),
@@ -16688,7 +16900,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 							bytes: s.bytes,
 							fromMs: s.fromMs,
 							toMs: s.toMs,
-							trigger: "disk-pressure"
+							trigger: "disk-pressure",
+							reason: s.reason
 						}
 					});
 				}

package/dist/recorder/index.mjs

@@ -1,5 +1,5 @@
-import { $ as isFirstLevelMacroClass, $t as record, B as defineCustomActions, Bt as nodePin, E as RecordingConfigSchema, Gt as _enum, It as hydrateSchema, J as evaluateSensorEdge, Kt as array, L as customAction, N as batteryCapability, Nt as DeviceFeature, Pt as DeviceType, Qt as object, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as selectAssignedProfileSlots, V as deriveBatteryPresence, Wt as sleep$1, Zt as number, bt as storageEvictableCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as string, et as loadContributionCapability, g as ExportRecordSchema, i as BatteryStatusSchema, jt as BaseAddon, mt as recordingExportCapability, nn as EventCategory, pt as recordingCapability, qt as boolean, vt as resolveRecordingProfiles, wt as errMsg, x as OpsLogEntrySchema } from "../dist-Bz00AHCy.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CpW6WY9n.mjs";
+import { $ as isFirstLevelMacroClass, $t as record, B as defineCustomActions, Bt as nodePin, E as RecordingConfigSchema, Gt as _enum, It as hydrateSchema, J as evaluateSensorEdge, Kt as array, L as customAction, N as batteryCapability, Nt as DeviceFeature, Pt as DeviceType, Qt as object, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as selectAssignedProfileSlots, V as deriveBatteryPresence, Wt as sleep$1, Zt as number, bt as storageEvictableCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as string, et as loadContributionCapability, g as ExportRecordSchema, i as BatteryStatusSchema, jt as BaseAddon, mt as recordingExportCapability, nn as EventCategory, pt as recordingCapability, qt as boolean, vt as resolveRecordingProfiles, wt as errMsg, x as OpsLogEntrySchema } from "../dist-D58lTgkb.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CLOpRiqg.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
@@ -2997,21 +2997,145 @@ function selectEvictionsByBytes(segments, targetBytes) {
 	}
 	return out;
 }
+var OrphanDeviceLane = class {
+	deps;
+	/** deviceId → consecutive ANSWERED reads that did not contain it. */
+	absenceStreak = /* @__PURE__ */ new Map();
+	/** The verdict the last answered read reached, reused inside the gap. */
+	confirmed = /* @__PURE__ */ new Set();
+	/** When a read was last TAKEN (answered or not) — the gap is a rate limit on
+	*  asking, not on believing. */
+	lastReadAtMs = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Of the devices that hold footage here, which ones has the registry
+	* confirmed — twice, on reads taken apart in time — that it no longer knows?
+	*
+	* Never throws: every failure returns the empty set, which is "evict the way
+	* this repo evicted before the lane existed".
+	*/
+	async confirmedOrphans(footageDevices) {
+		if (footageDevices.size === 0) return /* @__PURE__ */ new Set();
+		const now = this.deps.now?.() ?? Date.now();
+		const minGap = this.deps.minGapMs ?? 3e4;
+		if (this.lastReadAtMs !== null && now - this.lastReadAtMs < minGap) return intersect(this.confirmed, footageDevices);
+		const read = await this.readOnce();
+		this.lastReadAtMs = now;
+		const known = this.trustedDeviceIds(read, footageDevices);
+		if (known === null) return intersect(this.confirmed, footageDevices);
+		this.advanceStreaks(known, footageDevices);
+		const confirmed = /* @__PURE__ */ new Set();
+		for (const [deviceId, streak] of this.absenceStreak) if (streak >= 2) confirmed.add(deviceId);
+		this.confirmed = confirmed;
+		return intersect(confirmed, footageDevices);
+	}
+	/** The read, with a throw folded into the union rather than escaping. */
+	async readOnce() {
+		try {
+			return await this.deps.readRegistry();
+		} catch (err) {
+			return {
+				status: "unanswered",
+				detail: err instanceof Error ? err.message : String(err)
+			};
+		}
+	}
+	/**
+	* Rules 1-3: the device ids this read may be believed about, or `null` when
+	* it may not be believed at all.
+	*
+	* Every refusal is SAID — a lane that silently declines to run is
+	* indistinguishable from one nobody wired, and this branch drops work (the
+	* operator's ordering) on purpose.
+	*/
+	trustedDeviceIds(read, footageDevices) {
+		if (read.status === "unanswered") {
+			this.deps.logger.warn("recorder: dead-device eviction lane disarmed — the device registry did not answer; evicting oldest-first only", { meta: {
+				detail: read.detail,
+				footageDevices: footageDevices.size
+			} });
+			return null;
+		}
+		if (read.deviceIds.size === 0) {
+			this.deps.logger.warn("recorder: dead-device eviction lane disarmed — the device enumeration came back empty, which an empty store snapshot also looks like", { meta: { footageDevices: footageDevices.size } });
+			return null;
+		}
+		let recognised = 0;
+		for (const deviceId of footageDevices) if (read.deviceIds.has(deviceId)) recognised += 1;
+		if (recognised === 0) {
+			this.deps.logger.warn("recorder: dead-device eviction lane disarmed — the registry knows NONE of the cameras holding footage here, which is a defect report and not a fleet-wide deletion", { meta: {
+				footageDevices: footageDevices.size,
+				registryDevices: read.deviceIds.size
+			} });
+			return null;
+		}
+		return read.deviceIds;
+	}
+	/** Rules 4 and 5, plus the bound: the map only ever holds devices that hold
+	*  footage right now, so it cannot outgrow the archive. */
+	advanceStreaks(known, footageDevices) {
+		for (const deviceId of this.absenceStreak.keys()) if (!footageDevices.has(deviceId)) this.absenceStreak.delete(deviceId);
+		for (const deviceId of footageDevices) {
+			if (known.has(deviceId)) {
+				this.absenceStreak.delete(deviceId);
+				continue;
+			}
+			const streak = (this.absenceStreak.get(deviceId) ?? 0) + 1;
+			this.absenceStreak.set(deviceId, streak);
+			if (streak === 2) this.deps.logger.warn("recorder: camera confirmed gone by two independent registry reads — its footage is now evicted before anything chosen by age", {
+				tags: { deviceId },
+				meta: { confirmations: streak }
+			});
+		}
+	}
+};
+function intersect(a, b) {
+	const out = /* @__PURE__ */ new Set();
+	for (const value of a) if (b.has(value)) out.add(value);
+	return out;
+}
 //#endregion
 //#region src/recorder/storage-evictable-provider.ts
 /**
 * Implements the `storage-evictable` cap surface for recording footage. The core
 * StoragePressureManager owns the trigger (per-location free-space monitoring); this
-* provider decides WHAT footage is expendable (oldest-first, no pinning) and deletes it
-* via `SegmentStore.evict`, which removes the file through the `storage` cap and de-indexes.
+* provider decides WHAT footage is expendable and deletes it via `SegmentStore.evict`,
+* which removes the file through the `storage` cap and de-indexes.
+*
+* ## Two tiers, one budget
+*
+* Footage of a camera the registry no longer knows is chosen BEFORE any age
+* comparison; within that tier, and in everything after it, still oldest-first.
+* The operator's rule is "when the disk fills, lose the dead cameras first",
+* and it applies under disk pressure ONLY — there is deliberately no
+* time-based sweep of dead-device footage, so a camera that is gone keeps its
+* footage until the space is actually needed.
+*
+* This changes the ORDER and not the amount: the two tiers share one
+* `targetBytes` budget, the second is asked only for what the first left
+* uncovered, and nothing is selected that plain oldest-first would not have
+* been willing to select eventually.
+*
+* The dead-device tier is gated by {@link OrphanDeviceLane} — a registry read
+* that fails, comes back empty, or contradicts itself arms nothing, and the
+* round degrades to exactly the oldest-first behaviour that predates the tier.
 *
 * The cap's `locationId` is used directly as the storage `location` (identity); see Plan 2d
 * notes. Wiring this class to the cap + the SegmentStore happens in Plan 2e.
 */
 var StorageEvictableProvider = class {
 	deps;
+	orphanLane;
 	constructor(deps) {
 		this.deps = deps;
+		this.orphanLane = new OrphanDeviceLane({
+			readRegistry: deps.deviceRegistry,
+			logger: deps.logger,
+			...deps.now !== void 0 ? { now: deps.now } : {},
+			...deps.orphanConfirmGapMs !== void 0 ? { minGapMs: deps.orphanConfirmGapMs } : {}
+		});
 	}
 	/** The eviction domain of `locationId` — aliases sharing its disk, else
 	*  itself — MINUS read-only members (drain mode: their bytes are neither
@@ -3051,8 +3175,19 @@ var StorageEvictableProvider = class {
 				exhausted: true
 			};
 		}
-		const oldest = await archive.oldestSegments(this.domainOf(input.locationId), input.targetBytes);
-		const victims = selectEvictionsByBytes(oldest.rows, input.targetBytes);
+		const domain = this.domainOf(input.locationId);
+		const orphans = await this.orphanLane.confirmedOrphans(archive.devicesWithFootage(domain));
+		const orphanVictims = orphans.size === 0 ? [] : selectEvictionsByBytes((await archive.oldestSegmentsForDevices(domain, orphans, input.targetBytes)).rows, input.targetBytes);
+		const orphanBytes = orphanVictims.reduce((sum, v) => sum + v.bytes, 0);
+		const remainingBytes = input.targetBytes - orphanBytes;
+		const oldest = remainingBytes > 0 ? await archive.oldestSegments(domain, remainingBytes) : {
+			rows: [],
+			exhausted: false
+		};
+		const taken = new Set(orphanVictims.map((v) => v.path));
+		const ageCandidates = oldest.rows.filter((r) => !taken.has(r.path));
+		const ageVictims = selectEvictionsByBytes(ageCandidates, remainingBytes);
+		const victims = [...orphanVictims, ...ageVictims];
 		const byLocation = /* @__PURE__ */ new Map();
 		for (const v of victims) {
 			const group = byLocation.get(v.locationId);
@@ -3061,8 +3196,8 @@ var StorageEvictableProvider = class {
 		}
 		let reclaimedBytes = 0;
 		for (const [locationId, rows] of byLocation) reclaimedBytes += await this.deps.store.evict(locationId, rows);
-		if (reclaimedBytes > 0 && this.deps.onEvicted) this.deps.onEvicted(summarizeEvictionsByDevice(victims));
-		const exhausted = oldest.exhausted && victims.length >= oldest.rows.length;
+		if (reclaimedBytes > 0 && this.deps.onEvicted) this.deps.onEvicted(summarizeEvictionsByDevice(victims, orphans));
+		const exhausted = oldest.exhausted && ageVictims.length >= ageCandidates.length;
 		return {
 			reclaimedBytes,
 			exhausted
@@ -3072,8 +3207,14 @@ var StorageEvictableProvider = class {
 /** Group an eviction round's victims into per-(device, location) summaries (bytes
 * come from the pre-delete selection — partial delete failures may overstate
 * slightly). A domain round can span aliased locations, so each victim is bucketed
-* by its OWN `locationId` (not a single round-level location). */
-function summarizeEvictionsByDevice(victims) {
+* by its OWN `locationId` (not a single round-level location).
+*
+* `orphanDeviceIds` is the round's CONFIRMED-gone set and it decides each
+* summary's {@link EvictionReason}. Required rather than defaulted: the reason
+* is what the operator reads in the activity history, and a caller that forgot
+* to pass it would file every eviction as `oldest-first` — the one wrong
+* answer nothing downstream could detect. */
+function summarizeEvictionsByDevice(victims, orphanDeviceIds) {
 	const byKey = /* @__PURE__ */ new Map();
 	for (const v of victims) {
 		const key = `${v.deviceId}${v.locationId}`;
@@ -3084,11 +3225,11 @@ function summarizeEvictionsByDevice(victims) {
 			segments: 1,
 			bytes: v.bytes,
 			fromMs: v.startMs,
-			toMs: v.startMs + v.durMs
+			toMs: v.startMs + v.durMs,
+			reason: orphanDeviceIds.has(v.deviceId) ? "orphaned-device" : "oldest-first"
 		});
 		else byKey.set(key, {
-			deviceId: v.deviceId,
-			locationId: v.locationId,
+			...cur,
 			segments: cur.segments + 1,
 			bytes: cur.bytes + v.bytes,
 			fromMs: Math.min(cur.fromMs, v.startMs),
@@ -8916,6 +9057,49 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* able to say truthfully.
 	*/
 	async oldestSegments(locationIds, targetBytes) {
+		return this.oldestSegmentsScoped(locationIds, null, targetBytes);
+	}
+	/**
+	* {@link oldestSegments}, narrowed to a set of cameras.
+	*
+	* The disk-pressure evictor's dead-device tier needs the oldest footage OF
+	* THE CAMERAS THAT NO LONGER EXIST, which is a different question from the
+	* oldest footage on the disk: an orphan's newest hour has to be reachable
+	* even when a live camera holds every one of the oldest ones. The narrowing
+	* is a `deviceId IN (…)` on the same statement, so it stays ONE ordered,
+	* bounded, paged read and never a per-device merge.
+	*
+	* The device set is the CALLER's business — this method neither knows nor
+	* checks what makes a device evictable. Refuses an empty set rather than
+	* compiling to "every camera", for the same reason
+	* {@link SegmentHourLedger.predicate} refuses an empty scope.
+	*/
+	async oldestSegmentsForDevices(locationIds, deviceIds, targetBytes) {
+		if (deviceIds.size === 0) return {
+			rows: [],
+			exhausted: true
+		};
+		return this.oldestSegmentsScoped(locationIds, [...deviceIds], targetBytes);
+	}
+	/**
+	* Every camera the ledger holds an hour for on these locations.
+	*
+	* Answered from T1 — the always-resident hour summary, which carries
+	* `deviceId` and `locationId` — exactly like {@link profilesWithFootage},
+	* and for the same reason: this is an O(writers × days) question and it must
+	* cost no I/O. It runs on the disk-pressure path, where an I/O that fails
+	* would have to be turned into a verdict.
+	*
+	* An EMPTY answer is "the mirror knows no hour here", which is also what a
+	* ledger whose load failed reports — so the caller must treat it as "decide
+	* nothing", never as "no camera owns this footage".
+	*/
+	devicesWithFootage(locationIds) {
+		const out = /* @__PURE__ */ new Set();
+		for (const row of this.ledger.snapshot()) if (locationIds.has(row.locationId)) out.add(row.deviceId);
+		return out;
+	}
+	async oldestSegmentsScoped(locationIds, deviceIds, targetBytes) {
 		const ids = [...locationIds];
 		if (ids.length === 0 || targetBytes <= 0) return {
 			rows: [],
@@ -8930,7 +9114,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
 				columns: OLDEST_PROBE_COLUMNS,
 				filter: {
-					whereIn: { locationId: ids },
+					whereIn: deviceIds === null ? { locationId: ids } : {
+						locationId: ids,
+						deviceId: deviceIds
+					},
 					orderBy: {
 						field: "hourStartMs",
 						direction: "asc"
@@ -16654,15 +16841,40 @@ var RecorderV2Addon = class extends BaseAddon {
 			store: this.segmentStore,
 			resolveDomain: (locationId) => this.locationDomain(locationId),
 			isReadOnly: (locationId) => this.resolvedLocations.find((l) => l.id === locationId)?.readOnly === true,
+			deviceRegistry: async () => {
+				try {
+					const devices = await this.ctx.api.deviceManager.listAll.query({ projection: "slim" });
+					return {
+						status: "answered",
+						deviceIds: new Set(devices.map((d) => d.id))
+					};
+				} catch (err) {
+					return {
+						status: "unanswered",
+						detail: err instanceof Error ? err.message : String(err)
+					};
+				}
+			},
 			onEvicted: (summaries) => {
 				for (const s of summaries) {
+					const opReason = s.reason === "orphaned-device" ? "orphaned-device" : "quota";
 					opsLog.append({
 						op: "prune",
-						reason: "quota",
+						reason: opReason,
 						deviceId: s.deviceId,
 						itemsAffected: s.segments,
 						bytesReclaimed: s.bytes,
-						detail: `disk-pressure evicted [${new Date(s.fromMs).toISOString()}, ${new Date(s.toMs).toISOString()}) on ${s.locationId}`
+						detail: `disk-pressure evicted [${new Date(s.fromMs).toISOString()}, ${new Date(s.toMs).toISOString()}) on ${s.locationId} — ${s.reason}`
+					});
+					if (s.reason === "orphaned-device") this.ctx.logger.info("recorder: disk-pressure evicted footage of a camera that no longer exists — chosen ahead of older footage of live cameras", {
+						tags: { deviceId: s.deviceId },
+						meta: {
+							locationId: s.locationId,
+							segments: s.segments,
+							bytes: s.bytes,
+							fromMs: s.fromMs,
+							toMs: s.toMs
+						}
 					});
 					this.ctx.eventBus.emit({
 						id: randomUUID(),
@@ -16682,7 +16894,8 @@ var RecorderV2Addon = class extends BaseAddon {
 							bytes: s.bytes,
 							fromMs: s.fromMs,
 							toMs: s.toMs,
-							trigger: "disk-pressure"
+							trigger: "disk-pressure",
+							reason: s.reason
 						}
 					});
 				}

package/dist/{segment-demux-js-CmaBsM0K.mjs → segment-demux-js-6FaY07xG.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { wt as errMsg } from "./dist-Bz00AHCy.mjs";
+import { wt as errMsg } from "./dist-D58lTgkb.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{segment-demux-js-DoH8TCnt.js → segment-demux-js-DQ3u40kJ.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-15qysRyR.js");
+const require_dist = require("./dist-DzDy7GQy.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-DczDySjo.js");
-const require_lazy_sharp = require("../lazy-sharp-CusvUEdy.js");
+const require_worker_protocol = require("../worker-protocol-BSKMHGDG.js");
+const require_lazy_sharp = require("../lazy-sharp-BbFUtott.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.

package/dist/session-decode/decode-worker-child.mjs

@@ -1,4 +1,4 @@
-import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-B2RCeDwS.mjs";
+import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-l0Mqtqka.mjs";
 import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 //#region src/session-decode/color-conversion.ts
 /**

package/dist/stream-broker/{_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-BtUtinHp.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-DuGUF2qi.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.55",
+		version: "1.2.56",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.135",
+		version: "1.2.136",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.101",
+		version: "1.2.102",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",

package/dist/stream-broker/demux-worker-child.js

@@ -1,4 +1,4 @@
-const require_segment_demux_js = require("../segment-demux-js-DoH8TCnt.js");
+const require_segment_demux_js = require("../segment-demux-js-DQ3u40kJ.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/stream-broker/recorded/demux-worker-child.ts
 /**

package/dist/stream-broker/demux-worker-child.mjs

@@ -1,4 +1,4 @@
-import { t as demuxSegmentFullJs } from "../segment-demux-js-CmaBsM0K.mjs";
+import { t as demuxSegmentFullJs } from "../segment-demux-js-6FaY07xG.mjs";
 import { parentPort } from "node:worker_threads";
 //#region src/stream-broker/recorded/demux-worker-child.ts
 /**

package/dist/stream-broker/{hostInit-BD_TFj7O.mjs → hostInit-BL2C-Ru6.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.135",
+				version: "1.2.136",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.55",
+				version: "1.2.56",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.101",
+				version: "1.2.102",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/stream-broker/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-15qysRyR.js");
-const require_node = require("../node-BdjJPTLk.js");
+const require_dist = require("../dist-DzDy7GQy.js");
+const require_node = require("../node-jFu0Gq80.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
-const require_segment_demux_js = require("../segment-demux-js-DoH8TCnt.js");
+const require_segment_demux_js = require("../segment-demux-js-DQ3u40kJ.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 let node_fs = require("node:fs");

package/dist/stream-broker/index.mjs

@@ -1,10 +1,10 @@
 import { r as __toESM } from "../chunk-DnnnRqeS.mjs";
-import { $t as record, At as BOOT_RECOVERY_BACKOFF_MS, Bt as nodePin, C as RATE_CONTROL_RELAXED, Ct as webrtcSessionCapability, D as RingBuffer, Dt as buildFfmpegArgs$1, F as createHwAccelCache, Ft as createEvent, G as egressTranscodeSharingKey, Gt as _enum, Ht as parseProfileBrokerId, I as createLogChannelsProvider, Jt as discriminatedUnion, K as egressTransportFromRequest, Kt as array, Lt as isEvent, Mt as CAM_PROFILE_ORDER, N as batteryCapability, Nt as DeviceFeature, Ot as invocationFromEncodeProfile, P as cameraStreamsCapability, Pt as DeviceType, Qt as object, R as declareLogChannel, Rt as makeProfileBrokerId, Tt as AUDIO_PRESETS, V as deriveBatteryPresence, Xt as literal, Zt as number, en as string, et as loadContributionCapability, gt as resolveEgressDecodeHwAccel, h as EncodeProfileSchema, i as BatteryStatusSchema, jt as BaseAddon, k as addonWidgetsSourceCapability, kt as isSoftwareDecode, nn as EventCategory, qt as boolean, rt as maskUrlCredentials, tn as union, tt as logChannelsCapability, w as RATE_CONTROL_TIGHT, wt as errMsg, xt as streamBrokerCapability, zt as makeSourceBrokerId } from "../dist-Bz00AHCy.mjs";
-import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-CpW6WY9n.mjs";
+import { $t as record, At as BOOT_RECOVERY_BACKOFF_MS, Bt as nodePin, C as RATE_CONTROL_RELAXED, Ct as webrtcSessionCapability, D as RingBuffer, Dt as buildFfmpegArgs$1, F as createHwAccelCache, Ft as createEvent, G as egressTranscodeSharingKey, Gt as _enum, Ht as parseProfileBrokerId, I as createLogChannelsProvider, Jt as discriminatedUnion, K as egressTransportFromRequest, Kt as array, Lt as isEvent, Mt as CAM_PROFILE_ORDER, N as batteryCapability, Nt as DeviceFeature, Ot as invocationFromEncodeProfile, P as cameraStreamsCapability, Pt as DeviceType, Qt as object, R as declareLogChannel, Rt as makeProfileBrokerId, Tt as AUDIO_PRESETS, V as deriveBatteryPresence, Xt as literal, Zt as number, en as string, et as loadContributionCapability, gt as resolveEgressDecodeHwAccel, h as EncodeProfileSchema, i as BatteryStatusSchema, jt as BaseAddon, k as addonWidgetsSourceCapability, kt as isSoftwareDecode, nn as EventCategory, qt as boolean, rt as maskUrlCredentials, tn as union, tt as logChannelsCapability, w as RATE_CONTROL_TIGHT, wt as errMsg, xt as streamBrokerCapability, zt as makeSourceBrokerId } from "../dist-D58lTgkb.mjs";
+import { i as NO_COST_CLAIM, n as Fmp4FragmentChild, r as Fmp4FragmentPlane, t as ChildCostRegistry } from "../node-CLOpRiqg.mjs";
 import { t as parseRestreamPath } from "../restream-intent-B4BXZra7.mjs";
 import { n as profileForStreamId } from "../remote-restream-BeHi78PZ.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DMolfhsP.mjs";
-import { i as require_mp4box_all, n as demuxSegmentPreferJs, r as runFfmpegOnce, t as demuxSegmentFullJs } from "../segment-demux-js-CmaBsM0K.mjs";
+import { i as require_mp4box_all, n as demuxSegmentPreferJs, r as runFfmpegOnce, t as demuxSegmentFullJs } from "../segment-demux-js-6FaY07xG.mjs";
 import { createRequire } from "node:module";
 import * as crypto$1 from "node:crypto";
 import crypto, { createHash, randomBytes, randomUUID } from "node:crypto";

package/dist/stream-broker/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-BtUtinHp.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-DuGUF2qi.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/dist/{worker-protocol-DczDySjo.js → worker-protocol-BSKMHGDG.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-15qysRyR.js");
+const require_dist = require("./dist-DzDy7GQy.js");
 //#region src/session-decode/native-lease-config.ts
 /**
 * Resolution of the native-frame hold / tile knobs for one decode worker.

package/dist/{worker-protocol-B2RCeDwS.mjs → worker-protocol-l0Mqtqka.mjs}

@@ -1,4 +1,4 @@
-import { b as NativeLeaseSettingsSchema, p as DEFAULT_NATIVE_LEASE_SETTINGS, y as NativeLeaseAdmissionSchema } from "./dist-Bz00AHCy.mjs";
+import { b as NativeLeaseSettingsSchema, p as DEFAULT_NATIVE_LEASE_SETTINGS, y as NativeLeaseAdmissionSchema } from "./dist-D58lTgkb.mjs";
 //#region src/session-decode/native-lease-config.ts
 /**
 * Resolution of the native-frame hold / tile knobs for one decode worker.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.165",
+  "version": "1.2.166",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",