@camstack/addon-pipeline 1.2.19 → 1.2.28

package/dist/recorder/index.js

@@ -1,13 +1,1542 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DKqOqH5j.js");
+const require_dist = require("../dist-DUHlZcWd.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_model_download_service_Cp9f4dk6 = require("../model-download-service-Cp9f4dk6-fsdDExML.js");
-const require_fmp4_keyframes = require("../fmp4-keyframes-5s8T9Mng.js");
 let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_crypto = require("node:crypto");
+let node_fs_promises = require("node:fs/promises");
+//#region src/recorder/addon/calendar-scan.ts
+/**
+* The top two rungs of the hydration ladder: which DAYS have footage, and which
+* HOURS of a day — answered from the directory tree, without a segment index.
+*
+* WHY THIS EXISTS
+* ───────────────
+* `getDaysWithRecordings` and `getAvailability` answer from
+* `index.segments(deviceId)`, so the date selector — the first thing an operator
+* sees — cannot resolve until the archive-wide walk has finished. Measured on
+* the live archive (device 590, `low`): that walk is **68,457 ms over 258,449
+* files**, while the questions it is being asked cost
+*
+*   which days of a month   28 entries   1 ms
+*   which hours of a day      8 entries   1 ms
+*
+* The cheapest question in the product was waiting on the most expensive data in
+* it. These read the rung that answers, and nothing below it.
+*
+* THE TRAP, AND WHY IT IS NOT PAID FOR WITH READS
+* ───────────────────────────────────────────────
+* Directory existence is NOT footage: on the real archive **15 of 28 day
+* directories are empty**, because retention deletes files and leaves the tree
+* behind. Trusting existence would put fifteen phantom days in the selector.
+*
+* But the shape of that garbage matters. Measured: those 15 day directories
+* hold NO entries at all — they are shells — and of 261 hour directories
+* exactly ONE is empty. So the answer does not need a read inside every hour;
+* it needs the NAMES one level down, which is a single read per directory:
+*
+*   readdir(month) → day names        1 read
+*   readdir(day)   → hour names       1 read per day
+*
+* 14 reads for a 13-day month, against the 41 an inside-every-hour probe costs,
+* and against 258,449 files for an archive walk.
+*
+* The residual — an hour directory emptied but not removed — is SELF-HEALED
+* rather than worked around: a directory found empty while scanning is deleted
+* on the spot. Retention stops accumulating shells, the existing ones clear as
+* they are visited, and no second code path exists to tolerate them.
+*/
+var p2 = (n) => String(n).padStart(2, "0");
+/**
+* Preference order for the ONE profile availability is read from.
+*
+* Availability is a single bar: it answers "was anything recorded", not "at
+* what quality". Enumerating every profile triples the reads for an identical
+* answer — measured 75 reads / 16,028 ms against 25 / 1,489 ms for a cold day.
+*
+* Lowest first because it is the smallest and the one always recorded (the
+* scrub reads it too, so its directories are the ones already warm). A device
+* that records only `high` still answers — the pick is over what EXISTS.
+*
+* The trade, stated: a device whose profile set CHANGED mid-history has hours
+* only under a profile this does not pick, and those hours would not show. That
+* is a configuration change, not a recording gap, and reading three profiles
+* for ever is the wrong price for it.
+*/
+var PROFILE_PREFERENCE = [
+	"low",
+	"mid",
+	"high"
+];
+/**
+* The lowest profile this device actually RECORDS to, or null when it has none.
+*
+* Non-emptiness, not existence: a `low` directory left behind by a config
+* change would otherwise be picked over the `high` that holds the footage, and
+* the whole camera would read as having none. One shallow read per candidate,
+* at most three, and the answer is stable for a session.
+*/
+async function availabilityProfile(root, deviceId) {
+	const present = await profilesOf(root, deviceId);
+	if (present.length === 0) return null;
+	const ordered = [...PROFILE_PREFERENCE.filter((p) => present.includes(p)), ...present.filter((p) => !PROFILE_PREFERENCE.includes(p))];
+	for (const p of ordered) if ((await listDir(node_path.default.join(root, String(deviceId), p))).length > 0) return p;
+	return null;
+}
+/** The canonical recording profiles — the ONLY `<deviceId>/` subdirectories
+*  that hold segments. The camera dir also hosts per-camera artifacts that are
+*  NOT profiles (`strips/`, `events/`); a walker that trusts readdir would
+*  offer them as playable profiles. */
+var KNOWN_PROFILES = new Set([
+	"high",
+	"mid",
+	"low"
+]);
+/** `<root>/<deviceId>/` PROFILE subdirectories. Empty when absent. */
+async function profilesOf(root, deviceId) {
+	try {
+		return (await node_fs.promises.readdir(node_path.default.join(root, String(deviceId)))).filter((e) => KNOWN_PROFILES.has(e));
+	} catch {
+		return [];
+	}
+}
+async function listDir(abs) {
+	try {
+		return await node_fs.promises.readdir(abs);
+	} catch {
+		return [];
+	}
+}
+/**
+* Remove a directory that turned out to be empty. Best-effort by design: it is
+* housekeeping on a read path, so a failure (a racing writer recreating it, a
+* read-only mount) must never affect the answer.
+*/
+async function reapIfEmpty(abs, entries) {
+	if (entries.length > 0) return;
+	try {
+		await node_fs.promises.rmdir(abs);
+	} catch {}
+}
+/**
+* Hours (0–23) of a day that hold footage, ascending — ONE read per day.
+*
+* The hour directory's NAME is the evidence. Reading inside each one to confirm
+* would cost a read per hour (nine for a typical day, 117 for a month) to
+* correct a case measured at **1 in 261**: an hour emptied by retention whose
+* directory survives.
+*
+* That residual is not tolerated, it is HEALED ONE RUNG DOWN: the segment scan
+* (`hydrateWindowFromStorage`) reads inside an hour when someone actually seeks
+* into it, and reaps it if it is empty. So each rung pays only its own cost, and
+* the garbage clears where a read was happening anyway. A day whose only hour is
+* such a shell shows in the selector until someone opens it — the smallest
+* wrong answer available, and self-correcting.
+*/
+async function hoursWithFootage(root, deviceId, year, month, day, knownProfile) {
+	const hours = /* @__PURE__ */ new Set();
+	const profile = knownProfile ?? await availabilityProfile(root, deviceId);
+	if (profile !== null) {
+		const dayDir = node_path.default.join(root, String(deviceId), profile, String(year), p2(month), p2(day));
+		for (const hour of await listDir(dayDir)) {
+			const n = Number(hour);
+			if (Number.isInteger(n)) hours.add(n);
+		}
+	}
+	return [...hours].sort((a, b) => a - b);
+}
+/** `<startMs>-<durMs>-<bytes>.m4s` — the name is the record. */
+var SEGMENT_NAME = /^(\d+)-(\d+)-(\d+)\.m4s$/;
+/**
+* The segments of ONE hour, from their names — one directory read.
+*
+* This is the exact granularity the progressive timeline needs, and it costs
+* what the coarse answer costs: measured on the live archive, a cold hour is
+* **61 ms** and holds ~350 segments. A whole day on one profile is 25 reads,
+* 1,489 ms cold and 19 ms warm.
+*
+* ONE profile, not all three. The timeline draws a single bar, so per-profile
+* detail buys nothing and triples the reads — 75 against 25, measured at
+* 16,028 ms against 1,489 ms.
+*
+* Hour granularity is NOT a substitute for this. A real day on this archive has
+* 88 gaps over a second, including one of **1,011 s**: rendering the hour that
+* contains it as solid would hide seventeen minutes of missing footage.
+*/
+async function segmentsOfHour(root, deviceId, profile, hourStartMs) {
+	const d = new Date(hourStartMs);
+	const dir = node_path.default.join(root, String(deviceId), profile, String(d.getUTCFullYear()), p2(d.getUTCMonth() + 1), p2(d.getUTCDate()), p2(d.getUTCHours()));
+	const entries = await listDir(dir);
+	if (entries.length === 0) {
+		await reapIfEmpty(dir, entries);
+		return [];
+	}
+	const out = [];
+	for (const name of entries) {
+		const m = SEGMENT_NAME.exec(name);
+		if (m) out.push({
+			startMs: Number(m[1]),
+			durMs: Number(m[2]),
+			bytes: Number(m[3])
+		});
+	}
+	return out.sort((a, b) => a.startMs - b.startMs);
+}
+/**
+* Whether this device records `profile` at all — a shallow non-emptiness check,
+* same contract as {@link availabilityProfile} but for one named profile. Lets
+* the directory route serve the profile the client asked for when it exists,
+* and fall back to the availability pick when it does not.
+*/
+async function profileHasFootage(root, deviceId, profile) {
+	return (await listDir(node_path.default.join(root, String(deviceId), profile))).length > 0;
+}
+//#endregion
+//#region src/recorder/merge-ranges.ts
+function mergeRanges(segments, gapToleranceMs) {
+	if (segments.length === 0) return [];
+	const sorted = [...segments].toSorted((a, b) => a.startMs - b.startMs);
+	const out = [];
+	let curStart = sorted[0].startMs;
+	let curEnd = sorted[0].startMs + sorted[0].durMs;
+	for (let i = 1; i < sorted.length; i++) {
+		const s = sorted[i];
+		if (s.startMs <= curEnd + gapToleranceMs) curEnd = Math.max(curEnd, s.startMs + s.durMs);
+		else {
+			out.push({
+				startMs: curStart,
+				endMs: curEnd
+			});
+			curStart = s.startMs;
+			curEnd = s.startMs + s.durMs;
+		}
+	}
+	out.push({
+		startMs: curStart,
+		endMs: curEnd
+	});
+	return out;
+}
+//#endregion
+//#region src/recorder/addon/calendar-index.ts
+var DAY_MS$3 = 864e5;
+var HOUR_MS$4 = 36e5;
+/**
+* UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
+*
+* The cap returns local-midnight epochs, not date strings, so the shift has to
+* survive the round trip: add the offset to land in local time, floor to the
+* day, then subtract it to get back to a real instant.
+*/
+function localDayStart(epochMs, tzOffsetMinutes) {
+	const off = tzOffsetMinutes * 6e4;
+	return Math.floor((epochMs + off) / DAY_MS$3) * DAY_MS$3 - off;
+}
+/** Midnight UTC of the day containing `epochMs`. */
+function utcDayOf(epochMs) {
+	return Math.floor(epochMs / DAY_MS$3) * DAY_MS$3;
+}
+/**
+* Gap below which two segments are ONE range.
+*
+* Adjacent segments are written back-to-back but their recorded durations
+* under-cover the span to the next start by a few ms of rounding, so a
+* tolerance of 0 splits continuous footage into one range PER SEGMENT —
+* hundreds an hour. Measured on a real day: 88 gaps over a second, of which ~80
+* are that 1–2 s jitter. The ones that matter survive: 15 s, 23 s, and 1,011 s.
+*/
+var RANGE_MERGE_GAP_MS$1 = 5e3;
+/**
+* How long the CURRENT hour's answer may be reused.
+*
+* Not caching it at all was the first instinct — it is still being written, so
+* a cached answer could hide a segment that just landed. But the timeline polls,
+* and re-reading the live hour on every poll made a query that is normally 65 ms
+* spike to 2,405 ms whenever that read met a contended moment on the array
+* (measured: 65, 65, 65, 2405, 226).
+*
+* Segments land every 8–12 s, so three seconds of staleness at the live edge
+* cannot hide a whole one — and the live view owns "now" regardless. Past hours
+* stay cached indefinitely; only this one expires.
+*/
+var CURRENT_HOUR_TTL_MS = 3e3;
+/**
+* How quiet the disk must be before background work takes another read.
+*
+* Background reads do not block the event loop — they are async I/O — they
+* block the ARRAY: a real request's own read queues behind them. Measured, when
+* a startup warm was still running: a directory query that costs 0.2 s took
+* **38 s**.
+*
+* That startup warm is gone (it bet on what would be asked, and the cache
+* already covers the second query). What remains is `warmAdjacent`, which is a
+* prediction from an ACTION the operator took — and it still yields.
+*/
+var BACKGROUND_QUIET_MS = 300;
+/** How often the warm re-checks whether the foreground has gone quiet. */
+var BACKGROUND_POLL_MS = 100;
+/**
+* Directory reads in flight for one query.
+*
+* A day is 24 independent reads and a month ~32; issued one after another they
+* measured seconds, because each pays the array's full latency. Bounded,
+* because an unbounded fan-out across devices and days becomes exactly the
+* contention it is meant to avoid — that is what the startup warm did.
+*/
+var READ_CONCURRENCY = 8;
+/** `Promise.all` with a ceiling on how many run at once. */
+async function mapBounded(items, limit, fn) {
+	const out = new Array(items.length);
+	let next = 0;
+	const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+		for (;;) {
+			const i = next++;
+			const item = items[i];
+			if (item === void 0) return;
+			out[i] = await fn(item);
+		}
+	});
+	await Promise.all(workers);
+	return out;
+}
+var CalendarIndex = class {
+	deps;
+	/** `deviceId` → (UTC day ms → hours). Absent = never scanned. */
+	byDevice = /* @__PURE__ */ new Map();
+	/** Scans in flight, so a burst of queries costs one walk. */
+	inFlight = /* @__PURE__ */ new Map();
+	/** `deviceId:profile:hourMs` → that hour's segments. The exact rung. */
+	hourSegs = /* @__PURE__ */ new Map();
+	segsInFlight = /* @__PURE__ */ new Map();
+	/** When each CURRENT-hour entry was read, for {@link CURRENT_HOUR_TTL_MS}. */
+	segsReadAt = /* @__PURE__ */ new Map();
+	/** The profile availability reads from, resolved once per device. */
+	profileFor = /* @__PURE__ */ new Map();
+	/** `deviceId:profile` → whether the device records that profile, resolved
+	*  once. Same stability trade as {@link profileFor}: a config change that
+	*  adds a profile mid-session is picked up on restart, not on a timer. */
+	recordsProfile = /* @__PURE__ */ new Map();
+	recordsInFlight = /* @__PURE__ */ new Map();
+	/** When the last FOREGROUND scan ran, so background work can yield to it. */
+	lastForegroundAt = 0;
+	profileInFlight = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	mapFor(deviceId) {
+		let m = this.byDevice.get(deviceId);
+		if (!m) {
+			m = /* @__PURE__ */ new Map();
+			this.byDevice.set(deviceId, m);
+		}
+		return m;
+	}
+	/**
+	* Hours of one UTC day that hold footage.
+	*
+	* Cached, EXCEPT the day containing "now": its last hour is still being
+	* written, so a cached answer would hide footage that has just appeared.
+	*/
+	async hoursOfUtcDay(deviceId, utcDayMs, background = false) {
+		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
+		const day = utcDayOf(utcDayMs);
+		const isToday = day === utcDayOf(this.deps.now?.() ?? Date.now());
+		const cached = this.mapFor(deviceId).get(day);
+		if (cached !== void 0 && !isToday) return cached;
+		const key = `${deviceId}:${day}`;
+		const running = this.inFlight.get(key);
+		if (running) return running;
+		const scan = this.scanDay(deviceId, day);
+		this.inFlight.set(key, scan);
+		try {
+			const hours = await scan;
+			this.mapFor(deviceId).set(day, hours);
+			return hours;
+		} finally {
+			if (this.inFlight.get(key) === scan) this.inFlight.delete(key);
+		}
+	}
+	async scanDay(deviceId, utcDayMs) {
+		const d = new Date(utcDayMs);
+		const scan = this.deps.scanHours ?? hoursWithFootage;
+		const profile = await this.availabilityProfileFor(deviceId) ?? void 0;
+		const merged = /* @__PURE__ */ new Set();
+		for (const root of this.deps.roots()) try {
+			const hours = await scan(root, deviceId, d.getUTCFullYear(), d.getUTCMonth() + 1, d.getUTCDate(), profile);
+			for (const h of hours) merged.add(h);
+		} catch (err) {
+			this.deps.logger.warn("calendar: day scan failed", {
+				tags: { deviceId },
+				meta: {
+					root,
+					utcDayMs,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return [...merged].sort((a, b) => a - b);
+	}
+	/**
+	* The operator's LOCAL days in `[fromMs, toMs)` that hold footage.
+	*
+	* Widened by a UTC day at each end: a local day at either edge is fed by a
+	* UTC day outside the range (23:30Z on the 28th is the 29th in CEST).
+	*/
+	async localDays(deviceId, fromMs, toMs, tzOffsetMinutes) {
+		const first = utcDayOf(fromMs) - DAY_MS$3;
+		const last = utcDayOf(toMs) + DAY_MS$3;
+		const wanted = [];
+		for (let day = first; day <= last; day += DAY_MS$3) wanted.push(day);
+		const perDay = await mapBounded(wanted, READ_CONCURRENCY, async (day) => ({
+			day,
+			hours: await this.hoursOfUtcDay(deviceId, day)
+		}));
+		const days = /* @__PURE__ */ new Set();
+		for (const { day, hours } of perDay) for (const h of hours) {
+			const at = day + h * HOUR_MS$4;
+			if (at < fromMs || at >= toMs) continue;
+			days.add(localDayStart(at, tzOffsetMinutes));
+		}
+		return [...days].sort((a, b) => a - b);
+	}
+	/**
+	* Drop what eviction changed. Retention is the ONLY thing that makes a past
+	* day stop holding footage, and it runs in this process — which is why these
+	* entries can be cached indefinitely rather than expired on a timer.
+	*/
+	/** Full reset — a relocation re-pointed index rows across locations, so
+	*  every cached day/hour derivation may now be stale. Cheap: the caches
+	*  rebuild lazily on the next question. */
+	invalidateAll() {
+		this.byDevice.clear();
+		this.hourSegs.clear();
+	}
+	invalidate(deviceId, atMs) {
+		const day = utcDayOf(atMs);
+		this.byDevice.get(deviceId)?.delete(day);
+		const prefix = `${deviceId}:`;
+		for (const key of [...this.hourSegs.keys()]) {
+			if (!key.startsWith(prefix)) continue;
+			if (utcDayOf(Number(key.slice(key.lastIndexOf(":") + 1))) === day) this.hourSegs.delete(key);
+		}
+	}
+	/**
+	* Scan a span in the background so the first screen is already answered.
+	*
+	* Startup runs this instead of waiting on the archive-wide walk: ~13 cold
+	* directory reads per month against 258,449 files, and it answers the
+	* question the operator actually asks first.
+	*
+	* Also used to warm the days ADJACENT to one being viewed — changing day is a
+	* single click and the operator expects the summary to be there. That warm
+	* belongs in the background: at ~650 ms per cold read, doing it inline would
+	* only move the wait.
+	*/
+	async warm(deviceId, fromMs, toMs) {
+		for (let day = utcDayOf(fromMs); day <= utcDayOf(toMs); day += DAY_MS$3) {
+			await this.awaitQuiet();
+			await this.hoursOfUtcDay(deviceId, day, true);
+		}
+	}
+	/**
+	* Hold background work until the foreground has been quiet.
+	*
+	* This is the whole point of the background flag: warming must never be the
+	* reason an operator's query waits on the array.
+	*/
+	async awaitQuiet() {
+		for (;;) {
+			if ((this.deps.now?.() ?? Date.now()) - this.lastForegroundAt >= BACKGROUND_QUIET_MS) return;
+			await new Promise((r) => setTimeout(r, BACKGROUND_POLL_MS));
+		}
+	}
+	/** A day's exact ranges, taken as BACKGROUND work — yields to any query. */
+	async warmDayRanges(deviceId, profile, utcDayMs) {
+		const day = utcDayOf(utcDayMs);
+		for (let h = 0; h < 24; h++) {
+			await this.awaitQuiet();
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$4, true);
+		}
+	}
+	/**
+	* The segments of one hour, exact, cached.
+	*
+	* As with days, the CURRENT hour is never cached: it is still being written.
+	*/
+	async segmentsOf(deviceId, profile, hourStartMs, background = false) {
+		return (await this.segmentsOfChecked(deviceId, profile, hourStartMs, background)).segments;
+	}
+	/**
+	* `segmentsOf`, stating whether the answer is COMPLETE — every root's
+	* directory was actually read. A root that throws yields a partial answer,
+	* and a partial answer must never be cached (it would serve a root's missing
+	* footage as "none" until eviction) nor claimed as looked-at on the wire:
+	* the directory route's `hydrated` flag derives from this, so the client
+	* retries instead of caching a gap.
+	*/
+	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
+		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
+		const hour = Math.floor(hourStartMs / HOUR_MS$4) * HOUR_MS$4;
+		const key = `${deviceId}:${profile}:${hour}`;
+		const now = this.deps.now?.() ?? Date.now();
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$4) * HOUR_MS$4;
+		const cached = this.hourSegs.get(key);
+		if (cached !== void 0) {
+			if (!isCurrentHour) return {
+				segments: cached,
+				complete: true
+			};
+			if (now - (this.segsReadAt.get(key) ?? 0) < CURRENT_HOUR_TTL_MS) return {
+				segments: cached,
+				complete: true
+			};
+		}
+		const running = this.segsInFlight.get(key);
+		if (running) return running;
+		const scan = (async () => {
+			const read = this.deps.scanSegments ?? segmentsOfHour;
+			const merged = [];
+			let complete = true;
+			for (const root of this.deps.roots()) try {
+				merged.push(...await read(root, deviceId, profile, hour));
+			} catch (err) {
+				complete = false;
+				this.deps.logger.warn("calendar: hour scan failed", {
+					tags: { deviceId },
+					meta: {
+						root,
+						hour,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			}
+			return {
+				segments: merged.sort((a, b) => a.startMs - b.startMs),
+				complete
+			};
+		})();
+		this.segsInFlight.set(key, scan);
+		try {
+			const { segments, complete } = await scan;
+			if (complete) {
+				this.hourSegs.set(key, segments);
+				this.segsReadAt.set(key, this.deps.now?.() ?? Date.now());
+			}
+			return {
+				segments,
+				complete
+			};
+		} finally {
+			if (this.segsInFlight.get(key) === scan) this.segsInFlight.delete(key);
+		}
+	}
+	/**
+	* Exact availability ranges for a UTC day — what the progressive timeline
+	* draws.
+	*
+	* ONE profile. The timeline is a single bar, so per-profile detail buys
+	* nothing and triples the reads: measured 75 reads / 16,028 ms against 25
+	* reads / 1,489 ms cold, 19 ms warm.
+	*
+	* Hour granularity cannot stand in for this: a real day holds a 1,011 s gap,
+	* and the hour containing it would render solid.
+	*/
+	async dayRanges(deviceId, profile, utcDayMs) {
+		const day = utcDayOf(utcDayMs);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$4), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+	}
+	/**
+	* Warm the days either side of the one being viewed, in the BACKGROUND.
+	*
+	* Changing day is one click and the operator expects the timeline to be
+	* there. At ~1.5 s for a cold day this belongs off the critical path — doing
+	* it inline would only move the wait onto the day they are already looking at.
+	*/
+	warmAdjacent(deviceId, profile, utcDayMs) {
+		const day = utcDayOf(utcDayMs);
+		for (const d of [day - DAY_MS$3, day + DAY_MS$3]) this.warmDayRanges(deviceId, profile, d).catch(() => {});
+	}
+	/**
+	* The lowest profile the device actually records to, resolved once.
+	*
+	* De-duplicated in flight, not merely cached: the day sweep now runs eight
+	* reads at a time and they ALL ask for the profile before the first answer
+	* lands, so a cache alone let the pick run eight times. Parallelism found it.
+	*/
+	async availabilityProfileFor(deviceId) {
+		const cached = this.profileFor.get(deviceId);
+		if (cached !== void 0) return cached;
+		const running = this.profileInFlight.get(deviceId);
+		if (running) return running;
+		const resolve = (async () => {
+			for (const root of this.deps.roots()) {
+				const pick = await (this.deps.pickProfile ?? availabilityProfile)(root, deviceId);
+				if (pick !== null) {
+					this.profileFor.set(deviceId, pick);
+					return pick;
+				}
+			}
+			return null;
+		})();
+		this.profileInFlight.set(deviceId, resolve);
+		try {
+			return await resolve;
+		} finally {
+			if (this.profileInFlight.get(deviceId) === resolve) this.profileInFlight.delete(deviceId);
+		}
+	}
+	/**
+	* The profile the directory serves for a request: the one ASKED for when the
+	* device records it, else the availability pick. The CSD1 payload states
+	* which was served, so a fallback is visible to the client, never silent.
+	*/
+	async servedProfileFor(deviceId, requested) {
+		if (requested === void 0 || requested === "") return this.availabilityProfileFor(deviceId);
+		const key = `${deviceId}:${requested}`;
+		const cached = this.recordsProfile.get(key);
+		if (cached !== void 0) return cached ? requested : this.availabilityProfileFor(deviceId);
+		const running = this.recordsInFlight.get(key);
+		return (running !== void 0 ? await running : await (async () => {
+			const probe = (async () => {
+				const check = this.deps.hasProfile ?? profileHasFootage;
+				for (const root of this.deps.roots()) if (await check(root, deviceId, requested)) return true;
+				return false;
+			})();
+			this.recordsInFlight.set(key, probe);
+			try {
+				const r = await probe;
+				this.recordsProfile.set(key, r);
+				return r;
+			} finally {
+				if (this.recordsInFlight.get(key) === probe) this.recordsInFlight.delete(key);
+			}
+		})()) ? requested : this.availabilityProfileFor(deviceId);
+	}
+};
+//#endregion
+//#region src/recorder/segment-directory.ts
+/**
+* The playback data-plane's client path, shared with the embed so neither side
+* needs a round trip to DISCOVER it: the directory and the segment bytes both
+* live under `<path>/<deviceId>/…`, reverse-proxied by the hub. The recorder
+* addon asserts it serves at exactly this path.
+*/
+var PLAYBACK_PLANE_PATH = "/addon/recorder/playback";
+/** v2 adds the optional per-row mfra table (a zero sample-count = absent).
+*  The decoder accepts both; the halves ship together in this package, so no
+*  deployed client ever sees a version it cannot read. */
+var VERSION = 2;
+/** LEB128, unsigned. Every value here is a non-negative integer. */
+function writeVarint$1(out, value) {
+	let v = Math.max(0, Math.trunc(value));
+	while (v >= 128) {
+		out.push(v & 127 | 128);
+		v = Math.floor(v / 128);
+	}
+	out.push(v);
+}
+/**
+* Encode a window of segments.
+*
+* `rows` MUST be ascending by `startMs` — the deltas are meaningless otherwise,
+* and a caller that hands over an unsorted list would produce a payload that
+* decodes into plausible nonsense.
+*/
+function encodeDirectory(payload) {
+	const out = [];
+	out.push(67, 83, 68, 49);
+	out.push(VERSION);
+	out.push(payload.hydrated ? 1 : 0);
+	const profile = new TextEncoder().encode(payload.profile);
+	writeVarint$1(out, profile.length);
+	for (const b of profile) out.push(b);
+	writeVarint$1(out, payload.asOfMs);
+	writeVarint$1(out, payload.rows.length);
+	let prevStart = 0;
+	for (const r of payload.rows) {
+		writeVarint$1(out, r.startMs - prevStart);
+		writeVarint$1(out, r.durMs);
+		writeVarint$1(out, r.bytes);
+		prevStart = r.startMs;
+		const mfra = r.mfra;
+		if (mfra === void 0 || mfra.samples.length === 0) {
+			writeVarint$1(out, 0);
+			continue;
+		}
+		writeVarint$1(out, mfra.samples.length);
+		writeVarint$1(out, mfra.trackId);
+		writeVarint$1(out, mfra.mfraOffset);
+		let prevTicks = 0;
+		let prevMoof = 0;
+		for (const s of mfra.samples) {
+			writeVarint$1(out, s.timeTicks - prevTicks);
+			writeVarint$1(out, s.moofOffset - prevMoof);
+			prevTicks = s.timeTicks;
+			prevMoof = s.moofOffset;
+		}
+	}
+	return Uint8Array.from(out);
+}
+//#endregion
+//#region src/recorder/addon/directory-handler.ts
+var HOUR_MS$3 = 36e5;
+/** A window wider than this is refused: it is a client bug, and answering it
+*  would walk the archive on the read path — the thing this replaces. */
+var MAX_WINDOW_MS = 32 * 864e5;
+/** `/<deviceId>/directory` — the rest of the prefix belongs to the file handler. */
+var DIRECTORY_PATH = /^\/(\d+)\/directory$/;
+/**
+* Wrap a file handler so the `/directory` path is answered from memory and
+* everything else falls through unchanged.
+*/
+function withDirectoryRoute(deps, next) {
+	return async (req, res) => {
+		const raw = req.url ?? "/";
+		const qs = raw.indexOf("?");
+		const pathname = qs === -1 ? raw : raw.slice(0, qs);
+		const match = DIRECTORY_PATH.exec(pathname);
+		if (!match) {
+			await next(req, res);
+			return;
+		}
+		const deviceId = Number(match[1]);
+		const params = new URLSearchParams(qs === -1 ? "" : raw.slice(qs + 1));
+		const fromMs = Number(params.get("from"));
+		const toMs = Number(params.get("to"));
+		if (!Number.isFinite(fromMs) || !Number.isFinite(toMs) || toMs <= fromMs) {
+			res.statusCode = 400;
+			res.end("directory: from/to required");
+			return;
+		}
+		if (toMs - fromMs > MAX_WINDOW_MS) {
+			res.statusCode = 400;
+			res.end("directory: window too wide");
+			return;
+		}
+		const requested = params.get("profile") ?? void 0;
+		try {
+			const profile = await deps.source.servedProfileFor(deviceId, requested);
+			if (profile === null) {
+				sendDirectory(res, {
+					profile: "",
+					hydrated: false,
+					asOfMs: 0,
+					rows: []
+				});
+				return;
+			}
+			const rows = [];
+			const firstHour = Math.floor(fromMs / HOUR_MS$3) * HOUR_MS$3;
+			let hydrated = true;
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$3) {
+				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
+				if (!complete) hydrated = false;
+				for (const s of segments) {
+					if (s.startMs + s.durMs <= fromMs || s.startMs >= toMs) continue;
+					const mfra = deps.mfraFor?.(deviceId, profile, s.startMs);
+					rows.push({
+						startMs: s.startMs,
+						durMs: s.durMs,
+						bytes: s.bytes,
+						...mfra ? { mfra } : {}
+					});
+				}
+			}
+			rows.sort((a, b) => a.startMs - b.startMs);
+			sendDirectory(res, {
+				profile,
+				hydrated,
+				asOfMs: deps.now?.() ?? Date.now(),
+				rows
+			});
+			deps.onLog?.("directory:served", {
+				deviceId,
+				profile,
+				requested: requested ?? null,
+				rows: rows.length,
+				hydrated
+			});
+		} catch (err) {
+			deps.onLog?.("directory:failed", {
+				deviceId,
+				error: err instanceof Error ? err.message : String(err)
+			});
+			res.statusCode = 500;
+			res.end("directory: failed");
+		}
+	};
+}
+function sendDirectory(res, payload) {
+	const body = encodeDirectory(payload);
+	res.statusCode = 200;
+	res.setHeader("content-type", "application/octet-stream");
+	res.setHeader("content-length", String(body.length));
+	res.setHeader("content-encoding", "identity");
+	res.setHeader("cache-control", "private, max-age=2");
+	res.end(Buffer.from(body));
+}
+//#endregion
+//#region src/recorder/init-info.ts
+/** Walk sibling boxes in [from, to), yielding [type, start, end]. */
+function* boxes$1(buf, view, from, to) {
+	let p = from;
+	while (p + 8 <= to) {
+		const size = view.getUint32(p);
+		if (size < 8) return;
+		const type = String.fromCharCode(buf[p + 4], buf[p + 5], buf[p + 6], buf[p + 7]);
+		const end = p + size;
+		if (end > to) return;
+		yield [
+			type,
+			p,
+			end
+		];
+		p = end;
+	}
+}
+/** FullBox version byte sits right after the 8-byte box header. */
+function versionOf(buf, boxStart) {
+	return buf[boxStart + 8] ?? 0;
+}
+/**
+* Parse `moov` for the video track's id and timescale.
+*
+* Returns null when the bytes hold no usable `moov` — a truncated read, or a
+* response that was not the segment head at all. The caller's answer to null is
+* to fall back to fetching the whole segment, which is slow but correct; a
+* guessed timescale would be fast and wrong.
+*/
+function parseInitInfo(bytes) {
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	for (const [type, start, end] of boxes$1(bytes, view, 0, bytes.length)) {
+		if (type !== "moov") continue;
+		for (const [t2, s2, e2] of boxes$1(bytes, view, start + 8, end)) {
+			if (t2 !== "trak") continue;
+			const found = readTrak(bytes, view, s2, e2);
+			if (found) return {
+				...found,
+				initEnd: end
+			};
+		}
+	}
+	return null;
+}
+/** A single `trak`: its id, its timescale, and whether it is the video one. */
+function readTrak(bytes, view, start, end) {
+	let trackId = null;
+	let timescale = null;
+	let isVideo = false;
+	for (const [t3, s3, e3] of boxes$1(bytes, view, start + 8, end)) if (t3 === "tkhd") trackId = view.getUint32(s3 + 12 + (versionOf(bytes, s3) === 1 ? 16 : 8));
+	else if (t3 === "mdia") {
+		for (const [t4, s4, e4] of boxes$1(bytes, view, s3 + 8, e3)) if (t4 === "mdhd") timescale = view.getUint32(s4 + 12 + (versionOf(bytes, s4) === 1 ? 16 : 8));
+		else if (t4 === "hdlr") {
+			const h = s4 + 16;
+			if (h + 4 <= e4) isVideo = String.fromCharCode(bytes[h], bytes[h + 1], bytes[h + 2], bytes[h + 3]) === "vide";
+		}
+	}
+	if (!isVideo || trackId === null || timescale === null || timescale <= 0) return null;
+	return {
+		videoTrackId: trackId,
+		videoTimescale: timescale
+	};
+}
+//#endregion
+//#region src/recorder/mfra-index.ts
+/** Thrown when a tail does not contain a usable index. */
+var MfraParseError = class extends Error {
+	needBytes;
+	constructor(message, needBytes) {
+		super(message);
+		this.needBytes = needBytes;
+		this.name = "MfraParseError";
+	}
+};
+var MFRO_BOX_SIZE = 16;
+function asDataView(tail) {
+	return new DataView(tail.buffer, tail.byteOffset, tail.byteLength);
+}
+/** Index of the last occurrence of a 4-char box type in `buf`. */
+function lastIndexOfType(buf, type) {
+	const a = type.charCodeAt(0);
+	const b = type.charCodeAt(1);
+	const c = type.charCodeAt(2);
+	const d = type.charCodeAt(3);
+	for (let i = buf.length - 4; i >= 0; i--) if (buf[i] === a && buf[i + 1] === b && buf[i + 2] === c && buf[i + 3] === d) return i;
+	return -1;
+}
+/**
+* How many tail bytes to request on the first try. Comfortably covers the
+* observed index sizes (a handful of sync samples) without a second round trip;
+* `MfraParseError.needBytes` asks for more on the rare segment that exceeds it.
+*/
+var DEFAULT_TAIL_BYTES = 2048;
+/**
+* Position of the `tfra` for `trackId` (or the first one when unspecified).
+*
+* Walks the `mfra`'s children properly rather than scanning for the ASCII
+* `tfra`: a byte scan cannot tell one table from the next, and picking "the
+* first match" is what made track selection accidental.
+*/
+function findTfra(mfra, mv, trackId) {
+	let p = 8;
+	while (p + 8 <= mfra.length) {
+		const size = mv.getUint32(p);
+		if (size < 8 || p + size > mfra.length) break;
+		if (String.fromCharCode(mfra[p + 4], mfra[p + 5], mfra[p + 6], mfra[p + 7]) === "tfra") {
+			if (trackId === void 0 || mv.getUint32(p + 12) === trackId) return p + 4;
+		}
+		p += size;
+	}
+	return -1;
+}
+/**
+* Parse a segment's trailing bytes into its sync-sample table.
+*
+* @param tail  the LAST `tail.length` bytes of the segment
+* @param fileSize  the segment's total size, needed to turn positions inside
+*                  the tail into absolute file offsets
+*/
+function parseMfra(tail, fileSize, opts = {}) {
+	if (tail.length < MFRO_BOX_SIZE) throw new MfraParseError("tail too short to contain mfro", DEFAULT_TAIL_BYTES);
+	const view = asDataView(tail);
+	const mfroPos = lastIndexOfType(tail, "mfro");
+	if (mfroPos < 0) throw new MfraParseError("no mfro box in tail");
+	const mfraSize = view.getUint32(mfroPos + 8);
+	if (mfraSize <= 0 || mfraSize > fileSize) throw new MfraParseError(`implausible mfra size ${mfraSize}`);
+	if (mfraSize > tail.length) throw new MfraParseError(`mfra spans ${mfraSize} bytes, tail has ${tail.length}`, mfraSize);
+	const mfraStart = tail.length - mfraSize;
+	const mfra = tail.subarray(mfraStart);
+	const mfraOffset = fileSize - mfraSize;
+	const mv = asDataView(mfra);
+	const tfraPos = findTfra(mfra, mv, opts.trackId);
+	if (tfraPos < 0) throw new MfraParseError(opts.trackId === void 0 ? "no tfra box inside mfra" : `no tfra box for track ${opts.trackId}`);
+	let p = tfraPos + 4;
+	const version = mfra[p] ?? 0;
+	p += 4;
+	const trackId = mv.getUint32(p);
+	p += 4;
+	const sizes = mv.getUint32(p);
+	p += 4;
+	const lenTraf = (sizes >> 4 & 3) + 1;
+	const lenTrun = (sizes >> 2 & 3) + 1;
+	const lenSample = (sizes & 3) + 1;
+	const count = mv.getUint32(p);
+	p += 4;
+	const samples = [];
+	for (let i = 0; i < count; i++) {
+		let timeTicks;
+		let moofOffset;
+		if (version === 1) {
+			timeTicks = Number(mv.getBigUint64(p));
+			p += 8;
+			moofOffset = Number(mv.getBigUint64(p));
+			p += 8;
+		} else {
+			timeTicks = mv.getUint32(p);
+			p += 4;
+			moofOffset = mv.getUint32(p);
+			p += 4;
+		}
+		p += lenTraf + lenTrun + lenSample;
+		if (p > mfra.length) throw new MfraParseError(`tfra declares ${count} entries but the box ends early`);
+		samples.push({
+			timeTicks,
+			moofOffset
+		});
+	}
+	if (samples.length === 0) throw new MfraParseError("tfra has no entries");
+	return {
+		samples,
+		mfraOffset,
+		trackId
+	};
+}
+//#endregion
+//#region src/recorder/mfra-capture.ts
+/**
+* Capture a segment's sync-sample table at FINALIZE, while the file is still
+* in page cache, and keep it in RAM for the directory to serve.
+*
+* WHY AT FINALIZE
+* ───────────────
+* The tables are tiny (2–4 sync samples), but they are NOT in RAM: serving
+* them lazily from the read path would cost ~350 tail reads per hour per
+* camera on a contended array. At finalize the segment was written
+* milliseconds ago — both reads (a 4 KB head for the video track id, a 2 KB
+* tail for the `tfra`) come from page cache and cost microseconds.
+*
+* Rows finalized before this process booted have no table; the client falls
+* back to fetching the tail itself — same mechanism, one extra round trip.
+*/
+/** Bytes of the head that reliably contain `ftyp` + `moov` (mirrors the client). */
+var HEAD_BYTES = 4096;
+/**
+* Read `absPath`'s video sync-sample table. `fileBytes` is the segment's total
+* size (already stat-ed by the finalize path). Throws on a segment without a
+* parsable index — the caller records nothing and the client falls back.
+*/
+async function readMfraTable(absPath, fileBytes) {
+	const fh = await (0, node_fs_promises.open)(absPath, "r");
+	try {
+		const head = new Uint8Array(Math.min(HEAD_BYTES, fileBytes));
+		await fh.read(head, 0, head.length, 0);
+		const info = parseInitInfo(head);
+		let tailLen = Math.min(DEFAULT_TAIL_BYTES, fileBytes);
+		for (let attempt = 0;; attempt++) {
+			const tail = new Uint8Array(tailLen);
+			await fh.read(tail, 0, tailLen, fileBytes - tailLen);
+			try {
+				const idx = parseMfra(tail, fileBytes, info === null ? {} : { trackId: info.videoTrackId });
+				return {
+					table: {
+						trackId: idx.trackId,
+						mfraOffset: idx.mfraOffset,
+						samples: idx.samples
+					},
+					videoTimescale: info?.videoTimescale ?? null
+				};
+			} catch (err) {
+				if (err instanceof MfraParseError && err.needBytes && attempt === 0) {
+					tailLen = Math.min(err.needBytes + 64, fileBytes);
+					continue;
+				}
+				throw err;
+			}
+		}
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Wall-clock instants for a segment's keyframes: `-skip_frame nokey` emits
+* them in decode order, so frame i IS sync sample i. Without a timescale the
+* samples are spread evenly — a degraded position beats a missing thumbnail.
+*/
+function keyframeInstants(startMs, durMs, captured) {
+	const { samples } = captured.table;
+	const first = samples[0]?.timeTicks ?? 0;
+	const ts = captured.videoTimescale;
+	return samples.map((s, i) => {
+		if (ts !== null && ts > 0) return Math.round(startMs + (s.timeTicks - first) / ts * 1e3);
+		return Math.round(startMs + i / samples.length * durMs);
+	});
+}
+/** How long a table stays served. Directory asks are for recent footage far
+*  more often than not, and a bounded window keeps this store O(day), not
+*  O(uptime): ~30 bytes a segment ⇒ a day across 20 cameras is a few MB. */
+var RETAIN_MS = 26 * 36e5;
+/**
+* The RAM store the directory reads. Keys are `(deviceId, profile, startMs)`
+* — exactly how a directory row identifies a segment. Insertion is
+* time-ordered (segments finalize as they are written), so pruning walks the
+* oldest entries only.
+*/
+var MfraTableStore = class {
+	now;
+	tables = /* @__PURE__ */ new Map();
+	constructor(now = () => Date.now()) {
+		this.now = now;
+	}
+	key(deviceId, profile, startMs) {
+		return `${deviceId}:${profile}:${startMs}`;
+	}
+	record(deviceId, profile, startMs, table) {
+		this.tables.set(this.key(deviceId, profile, startMs), {
+			startMs,
+			table
+		});
+		this.prune();
+	}
+	/**
+	* The table for one directory row, or undefined (pre-boot segment / capture
+	* failed / pruned). Eviction needs no hook here: a table only ever ATTACHES
+	* to a row the directory scan actually found on disk, so a deleted segment's
+	* entry is dead weight the TTL reclaims, never a wrong answer.
+	*/
+	get(deviceId, profile, startMs) {
+		return this.tables.get(this.key(deviceId, profile, startMs))?.table;
+	}
+	get size() {
+		return this.tables.size;
+	}
+	/** Insertion order is time order, so the expired prefix is contiguous. */
+	prune() {
+		const cutoff = this.now() - RETAIN_MS;
+		for (const [key, entry] of this.tables) {
+			if (entry.startMs >= cutoff) break;
+			this.tables.delete(key);
+		}
+	}
+};
+//#endregion
+//#region src/recorder/strip-format.ts
+/**
+* The thumbnail STRIP — the fast-drag depth of the scrub ladder.
+*
+* One append-only file per camera-hour holds every keyframe of the LOW
+* recording as a JPEG at the low profile's NATIVE resolution. A fast drag
+* crosses an hour in seconds and wants ~20 scattered stills; without the strip
+* that is 20 keyframe reads in 20 different segments under latest-wins —
+* structurally incapable of painting a flow. With it, the positions a drag
+* crosses are a handful of ~25–40 KB ranged reads from ONE file, painted at
+* the capped cadence.
+*
+* TWO wire shapes live here, both halves in one module so they cannot drift:
+*
+*  - the STRIP FILE (`CSS1`): [magic][version] then records of
+*    [u32 jpegLen][u64 tsMs][jpeg]. Self-describing, so the index is
+*    derivable from the file alone after a restart.
+*  - the STRIP INDEX (`CSI1`): the varint answer to "what instants does this
+*    hour hold, and which bytes paint each one" — served from RAM, consumed by
+*    the client to turn a cursor position into one ranged read.
+*/
+/** 'CSS1' — camstack strip, v1. */
+var FILE_MAGIC = new Uint8Array([
+	67,
+	83,
+	83,
+	49
+]);
+var FILE_VERSION = 1;
+var STRIP_FILE_HEADER_BYTES = FILE_MAGIC.length + 1;
+function stripFileHeader() {
+	const out = new Uint8Array(STRIP_FILE_HEADER_BYTES);
+	out.set(FILE_MAGIC, 0);
+	out[FILE_MAGIC.length] = FILE_VERSION;
+	return out;
+}
+function encodeStripRecord(tsMs, jpeg) {
+	const out = new Uint8Array(12 + jpeg.length);
+	const view = new DataView(out.buffer);
+	view.setUint32(0, jpeg.length);
+	view.setBigUint64(4, BigInt(Math.trunc(tsMs)));
+	out.set(jpeg, 12);
+	return out;
+}
+/**
+* Walk a strip file's bytes into its entry list. Tolerates a TRUNCATED final
+* record (a crash mid-append) by stopping at it — everything before is intact
+* because records are append-only.
+*/
+function parseStripEntries(bytes) {
+	if (bytes.length < STRIP_FILE_HEADER_BYTES) return [];
+	for (let i = 0; i < FILE_MAGIC.length; i++) if (bytes[i] !== FILE_MAGIC[i]) throw new Error("CSS1: bad magic");
+	if (bytes[FILE_MAGIC.length] !== FILE_VERSION) throw new Error(`CSS1: unsupported version ${String(bytes[FILE_MAGIC.length])}`);
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	const entries = [];
+	let p = STRIP_FILE_HEADER_BYTES;
+	while (p + 12 <= bytes.length) {
+		const len = view.getUint32(p);
+		const tsMs = Number(view.getBigUint64(p + 4));
+		const offset = p + 12;
+		if (offset + len > bytes.length) break;
+		entries.push({
+			tsMs,
+			offset,
+			bytes: len
+		});
+		p = offset + len;
+	}
+	return entries;
+}
+var INDEX_VERSION = 1;
+function writeVarint(out, value) {
+	let v = Math.max(0, Math.trunc(value));
+	while (v >= 128) {
+		out.push(v & 127 | 128);
+		v = Math.floor(v / 128);
+	}
+	out.push(v);
+}
+/** Entries MUST be ascending by tsMs and offset — append order guarantees it. */
+function encodeStripIndex(entries) {
+	const out = [];
+	out.push(67, 83, 73, 49);
+	out.push(INDEX_VERSION);
+	writeVarint(out, entries.length);
+	let prevTs = 0;
+	let prevOffset = 0;
+	for (const e of entries) {
+		writeVarint(out, e.tsMs - prevTs);
+		writeVarint(out, e.offset - prevOffset);
+		writeVarint(out, e.bytes);
+		prevTs = e.tsMs;
+		prevOffset = e.offset;
+	}
+	return Uint8Array.from(out);
+}
+//#endregion
+//#region src/recorder/strip-store.ts
+/**
+* The strip files on disk: append at finalize, index on demand.
+*
+* Layout: `<location root>/<deviceId>/strips/YYYY/MM/DD/HH.strip` — rooted
+* under the CAMERA directory like every other per-camera artifact (segments,
+* event media). The profile walkers (`profilesOf`, `hydrateWindowFromStorage`)
+* whitelist the canonical profile names, so `strips/` (and `events/`) sitting
+* next to `high|mid|low/` is never offered as a playable profile.
+*
+* Appends are serialized per file (a per-key promise chain): two segments of
+* the same hour finalizing close together must not interleave their records.
+*/
+var HOUR_MS$2 = 36e5;
+/** Location-relative path of one camera-hour's strip. */
+function stripRelPath(deviceId, hourStartMs) {
+	const d = /* @__PURE__ */ new Date(Math.floor(hourStartMs / HOUR_MS$2) * HOUR_MS$2);
+	const p2 = (n) => String(n).padStart(2, "0");
+	return node_path.default.join(String(deviceId), "strips", String(d.getUTCFullYear()), p2(d.getUTCMonth() + 1), p2(d.getUTCDate()), `${p2(d.getUTCHours())}.strip`);
+}
+var StripStore = class {
+	rootFor;
+	/** Per-file append chain — see the header comment. */
+	appending = /* @__PURE__ */ new Map();
+	/** Parsed entries per file, invalidated when the SIZE moves (append-only
+	*  files: same size ⟹ same content). */
+	indexCache = /* @__PURE__ */ new Map();
+	constructor(rootFor) {
+		this.rootFor = rootFor;
+	}
+	/** Absolute path for a camera-hour, or null before locations resolve. */
+	absPathFor(deviceId, hourStartMs) {
+		const root = this.rootFor();
+		if (root === null) return null;
+		return node_path.default.join(root, stripRelPath(deviceId, hourStartMs));
+	}
+	/** Append thumbnails (one segment's keyframes — same hour by construction). */
+	async append(deviceId, thumbs) {
+		const first = thumbs[0];
+		if (first === void 0) return;
+		const abs = this.absPathFor(deviceId, first.tsMs);
+		if (abs === null) return;
+		const run = (this.appending.get(abs) ?? Promise.resolve()).then(async () => {
+			await node_fs.promises.mkdir(node_path.default.dirname(abs), { recursive: true });
+			let created = false;
+			try {
+				await node_fs.promises.access(abs);
+			} catch {
+				created = true;
+			}
+			const parts = created ? [stripFileHeader()] : [];
+			for (const t of thumbs) parts.push(encodeStripRecord(t.tsMs, t.jpeg));
+			await node_fs.promises.appendFile(abs, Buffer.concat(parts.map((p) => Buffer.from(p))));
+			this.indexCache.delete(abs);
+		});
+		this.appending.set(abs, run.catch(() => {}));
+		try {
+			await run;
+		} finally {
+			if (this.appending.get(abs) === run) this.appending.delete(abs);
+		}
+	}
+	/**
+	* The entry list for a camera-hour, or null when the hour has no strip.
+	* Cached by file size — append-only files cannot change under a same-size
+	* cache.
+	*/
+	async index(deviceId, hourStartMs) {
+		const abs = this.absPathFor(deviceId, hourStartMs);
+		if (abs === null) return null;
+		let size;
+		try {
+			size = (await node_fs.promises.stat(abs)).size;
+		} catch {
+			return null;
+		}
+		const cached = this.indexCache.get(abs);
+		if (cached && cached.size === size) return cached.entries;
+		const entries = parseStripEntries(new Uint8Array(await node_fs.promises.readFile(abs)));
+		this.indexCache.set(abs, {
+			size,
+			entries
+		});
+		return entries;
+	}
+	/** A regeneration clears the device's whole strip tree first. */
+	async removeDevice(deviceId) {
+		const root = this.rootFor();
+		if (root === null) return;
+		for (const key of [...this.indexCache.keys()]) if (key.includes(node_path.default.join(String(deviceId), "strips") + node_path.default.sep)) this.indexCache.delete(key);
+		await node_fs.promises.rm(node_path.default.join(root, String(deviceId), "strips"), {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+	/** Eviction removed an hour's footage — its strip goes with it. */
+	async removeHour(deviceId, hourStartMs) {
+		const abs = this.absPathFor(deviceId, hourStartMs);
+		if (abs === null) return;
+		this.indexCache.delete(abs);
+		await node_fs.promises.rm(abs, { force: true }).catch(() => {});
+	}
+};
+//#endregion
+//#region src/recorder/strip-capture.ts
+/**
+* Keyframe thumbnails from a JUST-FINALIZED low segment — one short-lived
+* ffmpeg per segment, `-skip_frame nokey`, so only the 2–4 keyframes are ever
+* decoded (~15 ms of CPU on a 360p segment still sitting in page cache).
+*
+* WHY NOT A SECOND OUTPUT ON THE RECORDER'S FFMPEG
+* ────────────────────────────────────────────────
+* The write path is the one process that must never be destabilised, and an
+* image pipe has no per-frame PTS — pairing frames to instants would need NUT
+* parsing or stderr scraping. At finalize the mfra capture has ALREADY read
+* the sync-sample table: `-skip_frame nokey` emits keyframes in decode order,
+* so frame i IS sample i and the timestamps come for free. A failed capture
+* costs one hour's drag a thumbnail, nothing else.
+*
+* Bounded: at most `MAX_CONCURRENT` ffmpegs, and a backlog beyond
+* `MAX_QUEUED` drops the OLDEST waiting job — the strip is a best-effort
+* accelerator, and a stampede of finalizes (20 cameras, one segment cadence)
+* must never queue decode work behind the array.
+*/
+var MAX_CONCURRENT = 2;
+var MAX_QUEUED = 32;
+/** A one-shot decode of 2–4 keyframes must never wedge a slot. */
+var TIMEOUT_MS = 15e3;
+/** Split an MJPEG byte stream into its JPEGs on SOI markers (FFD8 FFE0/DB…).
+*  ffmpeg's image2pipe emits baseline JPEGs back to back; scanning for the
+*  next SOI right after an EOI is unambiguous for its output. */
+function splitJpegs(stream) {
+	const out = [];
+	let start = -1;
+	for (let i = 0; i + 1 < stream.length; i++) if (stream[i] === 255 && stream[i + 1] === 216 && (start === -1 || wasEoi(stream, i))) {
+		if (start !== -1) out.push(stream.subarray(start, i));
+		start = i;
+	}
+	if (start !== -1) out.push(stream.subarray(start));
+	return out;
+}
+/** Whether the two bytes immediately before `i` are an EOI — the only place a
+*  new SOI can legitimately begin inside a concatenated stream. */
+function wasEoi(stream, i) {
+	return i >= 2 && stream[i - 2] === 255 && stream[i - 1] === 217;
+}
+var StripCapture = class {
+	deps;
+	queue = [];
+	running = 0;
+	constructor(deps = {}) {
+		this.deps = deps;
+	}
+	/**
+	* The segment's keyframe JPEGs in decode order, or null when the capture was
+	* dropped (backlog) or failed. Never throws — the strip is best-effort.
+	*/
+	capture(absPath) {
+		return new Promise((resolve) => {
+			this.queue.push({
+				absPath,
+				resolve
+			});
+			while (this.queue.length > MAX_QUEUED) {
+				const dropped = this.queue.shift();
+				dropped?.resolve(null);
+				this.deps.onLog?.("strip:dropped", { path: dropped?.absPath ?? "" });
+			}
+			this.pump();
+		});
+	}
+	pump() {
+		while (this.running < MAX_CONCURRENT) {
+			const job = this.queue.shift();
+			if (job === void 0) return;
+			this.running++;
+			(this.deps.runFfmpeg ?? this.runFfmpeg)(job.absPath).then((stream) => job.resolve(splitJpegs(stream))).catch((err) => {
+				this.deps.onLog?.("strip:capture-failed", {
+					path: job.absPath,
+					error: err instanceof Error ? err.message : String(err)
+				});
+				job.resolve(null);
+			}).finally(() => {
+				this.running--;
+				this.pump();
+			});
+		}
+	}
+	runFfmpeg = (absPath) => {
+		return new Promise((resolve, reject) => {
+			const child = (0, node_child_process.spawn)(this.deps.ffmpegPath ?? "ffmpeg", [
+				"-hide_banner",
+				"-loglevel",
+				"error",
+				"-skip_frame",
+				"nokey",
+				"-i",
+				absPath,
+				"-c:v",
+				"mjpeg",
+				"-q:v",
+				"7",
+				"-f",
+				"image2pipe",
+				"-"
+			], { stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			] });
+			const chunks = [];
+			const errChunks = [];
+			const timer = setTimeout(() => {
+				child.kill("SIGKILL");
+				reject(/* @__PURE__ */ new Error(`strip capture timed out after ${TIMEOUT_MS}ms`));
+			}, TIMEOUT_MS);
+			timer.unref?.();
+			child.stdout.on("data", (c) => chunks.push(c));
+			child.stderr.on("data", (c) => errChunks.push(c));
+			child.on("error", (err) => {
+				clearTimeout(timer);
+				reject(err);
+			});
+			child.on("close", (code) => {
+				clearTimeout(timer);
+				if (code === 0) resolve(new Uint8Array(Buffer.concat(chunks)));
+				else reject(/* @__PURE__ */ new Error(`ffmpeg exited ${String(code)}: ${Buffer.concat(errChunks).toString("utf8").slice(0, 300)}`));
+			});
+		});
+	};
+};
+//#endregion
+//#region src/recorder/addon/strip-routes.ts
+/**
+* The strip's two questions, answered on the playback plane:
+*
+*   `GET /<deviceId>/strip-index?hour=<hourStartMs>` → `CSI1` (what instants
+*       the hour holds, and which bytes paint each one)
+*   `GET /<deviceId>/strip?hour=<hourStartMs>` + `Range` → the strip file's
+*       bytes (the client asks for exactly the records it needs)
+*
+* Same prefix, same auth, same fetch seam as the segments and the directory —
+* one plane, one credential path. The strip files live under `<deviceId>/strips/`
+* (the per-camera layout; the profile walkers whitelist high|mid|low so the
+* availability pick never misreads it), and these routes are their only door.
+*/
+var INDEX_PATH = /^\/(\d+)\/strip-index$/;
+var FILE_PATH = /^\/(\d+)\/strip$/;
+/** `bytes=a-b` → [a, b] clamped to `size`, or null (serve the whole file). */
+function parseRange(header, size) {
+	if (!header) return null;
+	const m = /^bytes=(\d+)-(\d+)?$/.exec(header);
+	if (!m) return null;
+	const start = Number(m[1]);
+	const end = m[2] === void 0 ? size - 1 : Math.min(Number(m[2]), size - 1);
+	if (start > end || start >= size) return null;
+	return [start, end];
+}
+function withStripRoutes(deps, next) {
+	return async (req, res) => {
+		const raw = req.url ?? "/";
+		const qs = raw.indexOf("?");
+		const pathname = qs === -1 ? raw : raw.slice(0, qs);
+		const params = new URLSearchParams(qs === -1 ? "" : raw.slice(qs + 1));
+		const asIndex = INDEX_PATH.exec(pathname);
+		const asFile = asIndex === null ? FILE_PATH.exec(pathname) : null;
+		if (asIndex === null && asFile === null) {
+			await next(req, res);
+			return;
+		}
+		const deviceId = Number((asIndex ?? asFile)[1]);
+		const hour = Number(params.get("hour"));
+		if (!Number.isFinite(hour) || hour <= 0) {
+			res.statusCode = 400;
+			res.end("strip: hour required");
+			return;
+		}
+		try {
+			if (asIndex !== null) {
+				const entries = await deps.store.index(deviceId, hour);
+				if (entries === null) {
+					res.statusCode = 204;
+					res.end();
+					return;
+				}
+				const body = encodeStripIndex(entries);
+				res.statusCode = 200;
+				res.setHeader("content-type", "application/octet-stream");
+				res.setHeader("content-length", String(body.length));
+				res.setHeader("content-encoding", "identity");
+				const immutable = hour + 36e5 < Date.now();
+				res.setHeader("cache-control", immutable ? "private, max-age=31536000, immutable" : "private, max-age=2");
+				res.end(Buffer.from(body));
+				deps.onLog?.("strip:index-served", {
+					deviceId,
+					hour,
+					entries: entries.length
+				});
+				return;
+			}
+			const abs = deps.store.absPathFor(deviceId, hour);
+			if (abs === null) {
+				res.statusCode = 204;
+				res.end();
+				return;
+			}
+			let size;
+			try {
+				size = (await node_fs.promises.stat(abs)).size;
+			} catch {
+				res.statusCode = 204;
+				res.end();
+				return;
+			}
+			const range = parseRange(req.headers.range, size);
+			const [start, end] = range ?? [0, size - 1];
+			res.statusCode = range === null ? 200 : 206;
+			res.setHeader("content-type", "application/octet-stream");
+			res.setHeader("content-length", String(end - start + 1));
+			res.setHeader("accept-ranges", "bytes");
+			res.setHeader("content-encoding", "identity");
+			if (range !== null) res.setHeader("content-range", `bytes ${start}-${end}/${size}`);
+			const stream = (0, node_fs.createReadStream)(abs, {
+				start,
+				end
+			});
+			stream.on("error", () => res.destroy());
+			stream.pipe(res);
+		} catch (err) {
+			deps.onLog?.("strip:failed", {
+				deviceId,
+				hour,
+				error: err instanceof Error ? err.message : String(err)
+			});
+			res.statusCode = 500;
+			res.end("strip: failed");
+		}
+	};
+}
+//#endregion
+//#region src/recorder/addon/strip-actions.ts
+/**
+* Recorder custom actions: strip regeneration.
+*
+* `regenerateStrips` clears a camera's thumbnail strips and rebuilds them from
+* the low segments already on disk — which is also the BACKFILL for footage
+* recorded before strips existed (or before the operator opted the camera in).
+*
+* A custom action, not a cap method: the generated AppRouter sits at
+* TypeScript's expansion limit, so caps cannot gain methods (docs/roadmap.md).
+*/
+var RegenerateStripsInputSchema = require_dist.object({
+	deviceId: require_dist.number().int().nonnegative(),
+	/** Days back from now to rebuild (default {@link REGEN_DEFAULT_DAYS}). */
+	days: require_dist.number().int().positive().max(60).optional()
+});
+var RegenerateStripsResultSchema = require_dist.object({
+	/** False when a regeneration for this device is already running. */
+	started: require_dist.boolean(),
+	/** Segments queued for thumbnail extraction (0 when not started). */
+	segments: require_dist.number()
+});
+var recorderStripActions = require_dist.defineCustomActions({ regenerateStrips: require_dist.customAction(RegenerateStripsInputSchema, RegenerateStripsResultSchema, { kind: "mutation" }) });
+//#endregion
 //#region src/recorder/segment-path.ts
 function segmentRelPath(deviceId, profile, startMs, durMs, bytes) {
 	if (profile.includes("/")) throw new Error(`segmentRelPath: profile must not contain '/': ${profile}`);
@@ -28,43 +1557,24 @@ function parseSegmentPath(relPath) {
 	};
 }
 //#endregion
-//#region src/recorder/merge-ranges.ts
-function mergeRanges(segments, gapToleranceMs) {
-	if (segments.length === 0) return [];
-	const sorted = [...segments].toSorted((a, b) => a.startMs - b.startMs);
-	const out = [];
-	let curStart = sorted[0].startMs;
-	let curEnd = sorted[0].startMs + sorted[0].durMs;
-	for (let i = 1; i < sorted.length; i++) {
-		const s = sorted[i];
-		if (s.startMs <= curEnd + gapToleranceMs) curEnd = Math.max(curEnd, s.startMs + s.durMs);
-		else {
-			out.push({
-				startMs: curStart,
-				endMs: curEnd
-			});
-			curStart = s.startMs;
-			curEnd = s.startMs + s.durMs;
-		}
-	}
-	out.push({
-		startMs: curStart,
-		endMs: curEnd
-	});
-	return out;
-}
-//#endregion
 //#region src/recorder/recording-index.ts
-/**
-* In-memory footage index, keyed by deviceId → (relativePath → SegmentRow).
-* The framework `storage` cap's `list()` is the ground truth: `hydrateDevice`
-* rebuilds a camera's set from a `list()` result, and `addSegment`/`removeSegments`
-* keep it write-through on finalize/evict. Because every row is derived from a
-* segment path (which encodes start/dur/bytes), the index can never drift from
-* disk. No SQLite, no persistence of its own.
-*/
+/** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
+*  already gives us — so "have I walked this?" costs one Set lookup. */
+var HOUR_MS$1 = 36e5;
+/** A device walked end-to-end. Cheaper and clearer than inserting every hour of
+*  the retention window into the set. */
+var ALL_HOURS = Symbol("all-hours");
+/** The hour buckets a half-open span touches. */
+function* hourBuckets(fromMs, toMs) {
+	const first = Math.floor(fromMs / HOUR_MS$1) * HOUR_MS$1;
+	for (let h = first; h < toMs; h += HOUR_MS$1) yield h;
+}
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
+	/** Hour buckets this device has been walked for; `ALL_HOURS` after a full
+	*  hydrate. Empty = nothing has been looked at, which is NOT the same as
+	*  "there is nothing" — see {@link hydrationOf}. */
+	walked = /* @__PURE__ */ new Map();
 	mapFor(deviceId) {
 		let m = this.byDevice.get(deviceId);
 		if (!m) {
@@ -94,6 +1604,63 @@ var RecordingIndex = class {
 			});
 		}
 	}
+	/**
+	* Whether the index has WALKED `[fromMs, toMs)` for a device.
+	*
+	* The distinction this exists for: an hour that was walked and held nothing is
+	* a real gap in the footage; an hour that was never walked is not, and must
+	* not be reported as one. Hydration takes minutes over a >1M-file archive, so
+	* for most of that time the honest answer is `unknown`.
+	*/
+	hydrationOf(deviceId, fromMs, toMs) {
+		const w = this.walked.get(deviceId);
+		if (w === void 0) return "unknown";
+		if (w === ALL_HOURS) return "hydrated";
+		let seen = 0;
+		let total = 0;
+		for (const h of hourBuckets(fromMs, toMs)) {
+			total++;
+			if (w.has(h)) seen++;
+		}
+		if (total === 0 || seen === total) return "hydrated";
+		return seen === 0 ? "unknown" : "partial";
+	}
+	/** Record that `[fromMs, toMs)` has been walked, whatever it contained. */
+	markHydrated(deviceId, fromMs, toMs) {
+		const w = this.walked.get(deviceId);
+		if (w === ALL_HOURS) return;
+		const set = w ?? /* @__PURE__ */ new Set();
+		for (const h of hourBuckets(fromMs, toMs)) set.add(h);
+		this.walked.set(deviceId, set);
+	}
+	/** Record that the device was walked end-to-end (the background full walk). */
+	markHydratedAll(deviceId) {
+		this.walked.set(deviceId, ALL_HOURS);
+	}
+	/**
+	* Merge one hour's segments for a location, and mark that hour walked.
+	*
+	* MERGES, unlike {@link hydrateDevice}, which replaces a whole location —
+	* right for the full walk, catastrophic for an incremental one, where
+	* hydrating hour 5 would erase hours 0–4.
+	*/
+	hydrateHour(deviceId, locationId, hourStartMs, relPaths) {
+		const m = this.mapFor(deviceId);
+		for (const path of relPaths) {
+			const p = parseSegmentPath(path);
+			if (!p || p.deviceId !== deviceId) continue;
+			m.set(path, {
+				deviceId: p.deviceId,
+				profile: p.profile,
+				startMs: p.startMs,
+				durMs: p.durMs,
+				bytes: p.bytes,
+				path,
+				locationId
+			});
+		}
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$1);
+	}
 	/** Insert/replace one finalized segment (idempotent by path). */
 	addSegment(s) {
 		this.mapFor(s.deviceId).set(s.path, s);
@@ -308,6 +1875,7 @@ var SegmentStore = class SegmentStore {
 			locationId: input.locationId
 		};
 		this.deps.index.addSegment(row);
+		this.deps.onIndexed?.(row, toAbs);
 		return row;
 	}
 	/**
@@ -364,9 +1932,46 @@ var SegmentStore = class SegmentStore {
 				});
 			}
 		}
-		if (removed.length > 0) this.deps.index.removeSegments(removed);
+		if (removed.length > 0) {
+			this.deps.index.removeSegments(removed);
+			for (const r of rows) this.deps.onEvicted?.(r.deviceId, r.startMs);
+		}
+		await this.pruneEmptyAncestors(location, [...byBucket.keys()]);
 		return reclaimed;
 	}
+	/**
+	* Walk up from each emptied hour directory removing ancestors that are now
+	* empty, so that **a directory's existence means footage**.
+	*
+	* Hours were already removed when fully evicted; days were not. Measured on
+	* the live archive: 15 of 28 day directories held nothing at all, while only
+	* 1 of 261 hour directories did. Those shells are why the date selector could
+	* not simply read `.../YYYY/MM/` and answer — the cheapest possible question
+	* needed a confirming read inside every day.
+	*
+	* Only ever `rmdir`, never a recursive delete: an ancestor that still holds
+	* anything must survive, and the failure of a non-empty `rmdir` IS the guard.
+	* Stops at the profile level — `<deviceId>/<profile>/` are structural.
+	*/
+	async pruneEmptyAncestors(location, bucketDirs) {
+		const prune = this.deps.removeDirIfEmpty;
+		if (!prune) return;
+		const seen = /* @__PURE__ */ new Set();
+		for (const bucket of bucketDirs) {
+			if (bucket === "") continue;
+			const parts = bucket.split("/");
+			for (let depth = parts.length - 1; depth > 2; depth--) {
+				const dir = parts.slice(0, depth).join("/");
+				if (seen.has(dir)) break;
+				seen.add(dir);
+				try {
+					await prune(location, dir);
+				} catch {
+					break;
+				}
+			}
+		}
+	}
 	/** Hour of one UTC hour-bucket in ms. */
 	static HOUR_MS = 36e5;
 	/**
@@ -451,9 +2056,15 @@ var StorageEvictableProvider = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
-	/** The eviction domain of `locationId` — aliases sharing its disk, else itself. */
+	/** The eviction domain of `locationId` — aliases sharing its disk, else
+	*  itself — MINUS read-only members (drain mode: their bytes are neither
+	*  reported evictable nor selected as victims). */
 	domainOf(locationId) {
-		return this.deps.resolveDomain?.(locationId) ?? new Set([locationId]);
+		const domain = this.deps.resolveDomain?.(locationId) ?? new Set([locationId]);
+		if (!this.deps.isReadOnly) return domain;
+		const writable = /* @__PURE__ */ new Set();
+		for (const id of domain) if (!this.deps.isReadOnly(id)) writable.add(id);
+		return writable;
 	}
 	async getEvictableUsage(input) {
 		return { bytes: this.deps.index.accountingForLocations(this.domainOf(input.locationId)).bytes };
@@ -849,14 +2460,22 @@ function buildRecordingDeviceSchema() {
 * logging); {@link recordingConfigsState} adapts a raw store slice for test
 * fakes. Same store key, same persisted blob shape as before.
 *
-* On read the legacy `mode`/`schedules`/`triggers` fields are derived once into
-* the authoritative `bands` via `migrateConfigToBands`, then persisted, so the
-* UI reads `bands` directly forever after.
+* `bands` is the ONLY authored recording intent (the legacy
+* mode/schedules/triggers/rules authoring surface was retired 2026-07-30); on
+* save `mode` is stamped as their derived summary for cheap consumers.
 */
 /** The addon-store key holding the deviceId → RecordingConfig map. */
 var RECORDING_CONFIGS_KEY = "recordingConfigs";
-/** Persisted shape: stringified numeric deviceId → full RecordingConfig. */
-var RecordingConfigsBlobSchema = require_dist.record(require_dist.string(), require_dist.RecordingConfigSchema);
+/**
+* Persisted shape: stringified numeric deviceId → full RecordingConfig.
+*
+* READ is forgiving where the wire contract is strict: `RecordingConfigSchema`
+* rejects unknown keys so a stale caller fails loudly, but a blob written by an
+* older build may still carry retired keys — and one unparseable device would
+* take the WHOLE blob down to the empty fallback (= every camera silently
+* unconfigured). `.strip()` drops them instead.
+*/
+var RecordingConfigsBlobSchema = require_dist.record(require_dist.string(), require_dist.RecordingConfigSchema.strip());
 /** Cold-start default for a camera that has never been configured: disabled, no bands. */
 var DEFAULT_DEVICE_CONFIG = {
 	enabled: false,
@@ -878,21 +2497,31 @@ async function readDeviceConfigs(state) {
 	return map;
 }
 /**
-* The persisted config for a device with `bands` guaranteed materialized.
-* Legacy blobs (mode/schedules/triggers, no bands) are migrated into bands and
-* re-persisted so the stored shape converges on the authoritative model. An
-* unconfigured device returns {@link DEFAULT_DEVICE_CONFIG}.
+* The persisted config for a device — `bands` is always materialized (the
+* schema defaults it to `[]`). An unconfigured device returns
+* {@link DEFAULT_DEVICE_CONFIG}.
 */
 async function loadDeviceConfig(state, deviceId) {
-	const stored = (await readDeviceConfigs(state)).get(deviceId);
-	if (!stored) return DEFAULT_DEVICE_CONFIG;
-	if (stored.bands) return stored;
-	const migrated = {
-		...stored,
-		bands: require_dist.migrateConfigToBands(stored)
-	};
-	await saveDeviceConfig(state, deviceId, migrated);
-	return migrated;
+	return (await readDeviceConfigs(state)).get(deviceId) ?? DEFAULT_DEVICE_CONFIG;
+}
+/**
+* The devices whose stored config claims to record (`enabled` + a non-`off`
+* derived `mode`) but has no band left — the one shape this store cannot
+* repair. It can only come from a pre-retirement blob whose legacy authoring
+* fields were stripped on read: the camera records NOTHING until its bands are
+* re-authored, so the recorder shouts about it once at boot
+* ({@link warnLostBands}) instead of failing silently.
+*/
+function deviceIdsWithLostBands(configs) {
+	const lost = [];
+	for (const [deviceId, config] of configs) if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	return lost.toSorted((a, b) => a - b);
+}
+/** Boot-time check: log the {@link deviceIdsWithLostBands} once, if any. */
+async function warnLostBands(state, logger) {
+	const lost = deviceIdsWithLostBands(await readDeviceConfigs(state));
+	if (lost.length === 0) return;
+	logger.warn(`recording config: device(s) ${lost.join(", ")} claim a recording mode but have NO bands — a pre-retirement config that lost its legacy authoring fields. Nothing is recorded for them until their bands are re-authored.`);
 }
 /**
 * Persist (insert or replace) a device's config. Validates against
@@ -900,22 +2529,71 @@ async function loadDeviceConfig(state, deviceId) {
 * validated config that was persisted.
 */
 async function saveDeviceConfig(state, deviceId, config) {
-	const validated = require_dist.RecordingConfigSchema.parse(config);
+	const parsed = require_dist.RecordingConfigSchema.parse(config);
+	const validated = {
+		...parsed,
+		mode: parsed.enabled ? activeModeForConfig(parsed) : "off"
+	};
 	const map = await readDeviceConfigs(state);
 	map.set(deviceId, validated);
 	await state.set(serialize(map));
 	return validated;
 }
 /**
-* Determine the active recording mode for a config's bands — the value the
-* `recording` cap status reports. `continuous` wins when any band records
-* continuously, else `events` when any band exists, else `off`.
+* The active recording mode for a config's bands — the value the `recording`
+* cap status reports. Thin alias over the canonical {@link deriveRecordingMode}
+* in `@camstack/types`, which the settings UI derives from too.
 */
 function activeModeForConfig(config) {
-	const bands = config.bands ?? [];
-	if (!config.enabled || bands.length === 0) return "off";
-	if (bands.some((b) => b.mode === "continuous")) return "continuous";
-	return "events";
+	return require_dist.deriveRecordingMode(config);
+}
+//#endregion
+//#region src/recorder/addon/eviction-domain.ts
+/**
+* Eviction-DOMAIN resolution for recordings locations.
+*
+* Recordings locations are operator-configurable and MAY alias one physical
+* filesystem root: today `recordings:default` + `recordingsLow:default` both
+* resolve to `/recordings`, but an operator could also point two locations at a
+* symlink or bind-mount of the same disk. Locations sharing a physical root
+* MUST evict as one oldest-first pool — otherwise disk-pressure relief on one
+* alias deletes the newest footage while the other alias still holds the old
+* (the age-partition data-loss bug).
+*
+* The domain key is the location root's PHYSICAL identity: `fs.realpathSync` of
+* the lexically-resolved path, which collapses symlinks and `.`/`..` so aliases
+* reaching one disk share a key — a plain `path.resolve` string compare would
+* miss a symlinked/bind-aliased path and silently re-introduce the partition.
+* When realpath THROWS (the root is missing at boot — a disk not yet mounted)
+* we fall back to the lexically-resolved path string: distinct-but-unmounted
+* roots then stay distinct domains. That fallback can only ever OVER-partition
+* (treat one disk as two), never MERGE two different disks — the safe failure
+* mode for a data-loss guard.
+*/
+/**
+* The physical-device key of a location root: `realpath` of the resolved path,
+* or the resolved path string itself when realpath throws (root missing).
+*/
+function physicalRootKey(root, realpath = node_fs.realpathSync) {
+	const resolved = node_path.default.resolve(root);
+	try {
+		return realpath(resolved);
+	} catch {
+		return resolved;
+	}
+}
+/**
+* The eviction DOMAIN of `locationId`: the set of location ids (INCLUDING
+* itself) whose roots share `locationId`'s physical root key. An unknown
+* `locationId` (not present in `locations`) is its own singleton domain.
+*/
+function resolveEvictionDomain(locations, locationId, realpath = node_fs.realpathSync) {
+	const self = locations.find((l) => l.id === locationId);
+	if (!self) return new Set([locationId]);
+	const selfKey = physicalRootKey(self.root, realpath);
+	const domain = new Set([locationId]);
+	for (const l of locations) if (physicalRootKey(l.root, realpath) === selfKey) domain.add(l.id);
+	return domain;
 }
 //#endregion
 //#region src/recorder/addon/recording-provider.ts
@@ -995,35 +2673,73 @@ async function probeVariantCodec(readPrefix, cache, deviceId, profile, firstPres
 *
 * Absolute resolution is the SAME idiom as the scrub path's
 * `resolveSegmentAbsPath`: `<root for the row's locationId>/<relative path>`.
-* A row whose location is unknown, or whose file has been evicted since the
-* index row was written, is skipped so the playlist never references a
-* non-existent segment.
+* A row whose location is unknown is skipped — it cannot be addressed at all.
+* Whether the FILES are verified depends on the caller: export ('absolute')
+* checks every one, playback does not. See the comment at the branch.
 */
 async function collectRangeSegments(deps, deviceId, profile, fromMs, toMs, uriMode) {
+	if (deps.index.hydrationOf(deviceId, fromMs, toMs) !== "hydrated") await deps.hydrateWindow?.(deviceId, fromMs, toMs);
+	const hydration = deps.index.hydrationOf(deviceId, fromMs, toMs);
 	const rootById = new Map(deps.locations().map((l) => [l.id, l.root]));
-	const rows = deps.index.segments(deviceId, profile).filter((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs).toSorted((a, b) => a.startMs - b.startMs);
-	const segments = [];
-	let firstPresentAbs = null;
-	for (const s of rows) {
-		const rel = segmentRelPath(deviceId, profile, s.startMs, s.durMs, s.bytes);
+	const candidates = deps.index.segments(deviceId, profile).filter((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs).toSorted((a, b) => a.startMs - b.startMs).flatMap((s) => {
 		const root = rootById.get(s.locationId);
-		if (root === void 0) continue;
-		const abs = node_path.default.join(root, rel);
-		try {
-			await node_fs.promises.stat(abs);
-		} catch {
-			continue;
+		if (root === void 0) return [];
+		const rel = segmentRelPath(deviceId, profile, s.startMs, s.durMs, s.bytes);
+		return [{
+			row: s,
+			rel,
+			abs: node_path.default.join(root, rel)
+		}];
+	});
+	const statFile = deps.statFile ?? ((abs) => node_fs.promises.stat(abs));
+	const toSegment = (c) => ({
+		uri: uriMode === "absolute" ? c.abs : c.rel.split("/").slice(1).join("/"),
+		startMs: c.row.startMs,
+		durMs: c.row.durMs
+	});
+	if (uriMode === "absolute") {
+		const present = Array.from({ length: candidates.length }, () => false);
+		for (let i = 0; i < candidates.length; i += STAT_BATCH) {
+			const batch = candidates.slice(i, i + STAT_BATCH);
+			const results = await Promise.all(batch.map(async (c) => {
+				try {
+					await statFile(c.abs);
+					return true;
+				} catch {
+					return false;
+				}
+			}));
+			for (let j = 0; j < results.length; j++) present[i + j] = results[j] ?? false;
 		}
-		if (firstPresentAbs === null) firstPresentAbs = abs;
-		segments.push({
-			uri: uriMode === "absolute" ? abs : rel.split("/").slice(1).join("/"),
-			startMs: s.startMs,
-			durMs: s.durMs
-		});
+		const segments = [];
+		let firstPresentAbs = null;
+		for (let i = 0; i < candidates.length; i++) {
+			if (!present[i]) continue;
+			const c = candidates[i];
+			if (c === void 0) continue;
+			if (firstPresentAbs === null) firstPresentAbs = c.abs;
+			segments.push(toSegment(c));
+		}
+		return {
+			segments,
+			firstPresentAbs,
+			hydration
+		};
+	}
+	let firstPresentAbs = null;
+	for (let i = 0; i < candidates.length && i < CODEC_PROBE_SCAN_LIMIT; i++) {
+		const c = candidates[i];
+		if (c === void 0) continue;
+		try {
+			await statFile(c.abs);
+			firstPresentAbs = c.abs;
+			break;
+		} catch {}
 	}
 	return {
-		segments,
-		firstPresentAbs
+		segments: candidates.map(toSegment),
+		firstPresentAbs,
+		hydration
 	};
 }
 /**
@@ -1035,6 +2751,14 @@ async function collectRangeSegments(deps, deviceId, profile, fromMs, toMs, uriMo
 * URIs are relative so the master + variants + segments form a self-contained
 * tree the player resolves against the master URL.
 */
+/** How many segments to try before giving up on finding one present file for
+*  the CODECS probe. Bounded so a device whose index rows outlive its files
+*  cannot turn this back into a per-segment scan. */
+var CODEC_PROBE_SCAN_LIMIT = 8;
+/** Concurrent `stat` fan-out width for the EXPORT path, which must verify every
+*  file. High enough to hide per-call latency on a contended array, low enough
+*  not to starve the recorder's own writes. */
+var STAT_BATCH = 64;
 async function buildPlaybackManifest(deps, codecCache, deviceId, fromMs, toMs) {
 	const base = deps.playbackBaseUrl();
 	if (base === null) return noPlayback(deviceId);
@@ -1128,6 +2852,29 @@ function buildRecordingProvider(deps) {
 			return statusFor(deps, deviceId, await loadDeviceConfig(deps.configStore, deviceId));
 		},
 		getAvailability: async ({ deviceId, fromMs, toMs }) => {
+			const calendar = deps.calendar;
+			if (calendar) {
+				const profile = await calendar.availabilityProfileFor(deviceId);
+				if (profile === null) return {
+					deviceId,
+					ranges: []
+				};
+				const ranges = [];
+				const firstDay = Math.floor(fromMs / DAY_MS) * DAY_MS;
+				for (let day = firstDay; day < toMs; day += DAY_MS) for (const r of await calendar.dayRanges(deviceId, profile, day)) {
+					if (r.endMs <= fromMs || r.startMs >= toMs) continue;
+					ranges.push({
+						profile,
+						startMs: r.startMs,
+						endMs: r.endMs
+					});
+				}
+				calendar.warmAdjacent(deviceId, profile, firstDay);
+				return {
+					deviceId,
+					ranges
+				};
+			}
 			return {
 				deviceId,
 				ranges: [...new Set(deps.index.segments(deviceId).map((s) => s.profile))].flatMap((profile) => deps.index.ranges(deviceId, profile, fromMs, toMs, RANGE_MERGE_GAP_MS).map((r) => ({
@@ -1138,6 +2885,11 @@ function buildRecordingProvider(deps) {
 			};
 		},
 		getDaysWithRecordings: async ({ deviceId, fromMs, toMs, tzOffsetMinutes }) => {
+			const calendar = deps.calendar;
+			if (calendar) return {
+				deviceId,
+				days: await calendar.localDays(deviceId, fromMs, toMs, tzOffsetMinutes)
+			};
 			return {
 				deviceId,
 				days: distinctRecordingDays(deps.index.segments(deviceId).map((s) => s.startMs), fromMs, toMs, tzOffsetMinutes)
@@ -1158,11 +2910,21 @@ function buildRecordingProvider(deps) {
 					usedBytes
 				});
 			}
-			const locationUsages = await Promise.all(locations.map(async (loc) => {
-				const cap = await deps.capacity(loc.root);
+			const byPhysical = /* @__PURE__ */ new Map();
+			for (const loc of locations) {
+				const key = physicalRootKey(loc.root);
+				const group = byPhysical.get(key);
+				if (group) group.push(loc);
+				else byPhysical.set(key, [loc]);
+			}
+			const locationUsages = await Promise.all([...byPhysical.values()].map(async (group) => {
+				const first = group[0];
+				const cap = await deps.capacity(first.root);
+				const ids = group.map((l) => l.id);
 				return {
-					locationId: loc.id,
-					usedBytes: deps.index.accountingForLocation(loc.id).bytes,
+					locationId: first.id,
+					locationIds: ids,
+					usedBytes: deps.index.accountingForLocations(new Set(ids)).bytes,
 					availableBytes: cap.availableBytes,
 					totalBytes: cap.totalBytes
 				};
@@ -1270,6 +3032,20 @@ function buildRecordingProvider(deps) {
 			deviceId,
 			limit
 		}) ?? [],
+		renderClip: async (input) => {
+			if (!deps.clipRender) throw new Error("clip rendering unavailable on this node");
+			return deps.clipRender(input);
+		},
+		renderGif: async (input) => {
+			if (!deps.gifRender) throw new Error("gif rendering unavailable on this node");
+			return deps.gifRender(input);
+		},
+		relocateFootage: async (input) => {
+			if (!deps.relocate) throw new Error("relocation unavailable on this node");
+			return { jobId: deps.relocate.start(input) };
+		},
+		getRelocateStatus: async () => deps.relocate?.list() ?? [],
+		cancelRelocate: async ({ jobId }) => ({ cancelled: deps.relocate?.cancel(jobId) ?? false }),
 		getDeviceSettingsContribution: async ({ deviceId }) => {
 			if (deps.isCameraDevice && !await deps.isCameraDevice(deviceId)) return null;
 			return require_dist.hydrateSchema(buildRecordingDeviceSchema(), {});
@@ -1871,14 +3647,17 @@ var RECORDING_LOCATION_TYPES = new Set(["recordings", "recordingsLow"]);
 /**
 * Route a recording profile to its storage location by the location's declared
 * `type`: the `low` profile prefers the `recordingsLow` location, every other
-* profile the `recordings` location. Falls back to the first resolved location
-* when the preferred type is absent (both types alias one disk today, so the
-* split is free-and-future-proof). Throws when no locations resolved.
+* profile the `recordings` location. READ-ONLY locations are never write
+* targets (the drain model): when the preferred type has only read-only
+* instances, any writable recordings-type location serves. Throws when NO
+* writable location exists — recording cannot start, and that must be loud.
 */
 function resolvePlacement(locations, profile) {
 	if (locations.length === 0) throw new Error("recorder controller: no recordings storage locations resolved");
+	const writable = locations.filter((l) => !l.readOnly);
+	if (writable.length === 0) throw new Error("recorder controller: every recordings location is read-only — nowhere to write");
 	const preferType = profile === "low" ? "recordingsLow" : "recordings";
-	return locations.find((l) => l.type === preferType) ?? locations[0];
+	return writable.find((l) => l.type === preferType) ?? writable[0];
 }
 /**
 * Resolve every recordings storage location (`recordings` + `recordingsLow`)
@@ -1894,7 +3673,8 @@ async function resolveRecordingsLocations(api, logger) {
 			root: await api.storage.resolve.query({
 				location: l.id,
 				relativePath: ""
-			})
+			}),
+			readOnly: l.config["readOnly"] === true
 		})));
 	} catch (err) {
 		logger.warn("recorder: listLocations failed — no recordings locations resolved", { meta: { error: require_dist.errMsg(err) } });
@@ -1929,54 +3709,61 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 		index.hydrateDevice(deviceId, loc.id, relPaths);
 	}
 }
-//#endregion
-//#region src/recorder/addon/eviction-domain.ts
+/** `<deviceId>/<profile>/YYYY/MM/DD/HH` for an hour bucket (paths are UTC). */
+function hourDirRelPath(deviceId, profile, hourStartMs) {
+	const d = new Date(hourStartMs);
+	const p2 = (n) => String(n).padStart(2, "0");
+	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
+}
+var HOUR_MS = 36e5;
 /**
-* Eviction-DOMAIN resolution for recordings locations.
+* Hydrate ONLY the hours a window spans, instead of walking the archive.
 *
-* Recordings locations are operator-configurable and MAY alias one physical
-* filesystem root: today `recordings:default` + `recordingsLow:default` both
-* resolve to `/recordings`, but an operator could also point two locations at a
-* symlink or bind-mount of the same disk. Locations sharing a physical root
-* MUST evict as one oldest-first pool — otherwise disk-pressure relief on one
-* alias deletes the newest footage while the other alias still holds the old
-* (the age-partition data-loss bug).
+* `hydrateDeviceFromStorage` is a recursive `readdir` over the whole device
+* subtree — ">1M files and takes minutes" per its own comment. Until it lands,
+* every read of past footage sees an empty index, which the server reports as
+* "no footage": measured after a deploy, a camera-day held 7 segments and grew
+* only at the rate of NEW writes for ~9 minutes.
 *
-* The domain key is the location root's PHYSICAL identity: `fs.realpathSync` of
-* the lexically-resolved path, which collapses symlinks and `.`/`..` so aliases
-* reaching one disk share a key — a plain `path.resolve` string compare would
-* miss a symlinked/bind-aliased path and silently re-introduce the partition.
-* When realpath THROWS (the root is missing at boot — a disk not yet mounted)
-* we fall back to the lexically-resolved path string: distinct-but-unmounted
-* roots then stay distinct domains. That fallback can only ever OVER-partition
-* (treat one disk as two), never MERGE two different disks — the safe failure
-* mode for a data-loss guard.
-*/
-/**
-* The physical-device key of a location root: `realpath` of the resolved path,
-* or the resolved path string itself when realpath throws (root missing).
+* The path convention makes the window addressable directly: one SHALLOW
+* `readdir` per (profile, hour), ~450 entries each. A day is ~72 of them. The
+* background full walk still runs, for the consumers that need the whole
+* archive (footprint, eviction domains, retention).
+*
+* Hours already walked are skipped, so a drag across an hour costs nothing the
+* second time.
 */
-function physicalRootKey(root, realpath = node_fs.realpathSync) {
-	const resolved = node_path.default.resolve(root);
-	try {
-		return realpath(resolved);
-	} catch {
-		return resolved;
+async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger) {
+	if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
+	for (const loc of locations) {
+		const deviceDir = node_path.default.join(loc.root, String(deviceId));
+		let profiles;
+		try {
+			profiles = (await node_fs.promises.readdir(deviceDir)).filter((e) => e === "high" || e === "mid" || e === "low");
+		} catch (err) {
+			if (err.code !== "ENOENT") logger.warn("recorder: hydrateWindow profile listing failed", {
+				tags: { deviceId },
+				meta: {
+					locationId: loc.id,
+					error: require_dist.errMsg(err)
+				}
+			});
+			continue;
+		}
+		const first = Math.floor(fromMs / HOUR_MS) * HOUR_MS;
+		for (let hour = first; hour < toMs; hour += HOUR_MS) for (const profile of profiles) {
+			const rel = hourDirRelPath(deviceId, profile, hour);
+			let files;
+			try {
+				files = await node_fs.promises.readdir(node_path.default.join(loc.root, rel));
+			} catch {
+				continue;
+			}
+			index.hydrateHour(deviceId, loc.id, hour, files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`));
+		}
+		index.markHydrated(deviceId, fromMs, toMs);
 	}
 }
-/**
-* The eviction DOMAIN of `locationId`: the set of location ids (INCLUDING
-* itself) whose roots share `locationId`'s physical root key. An unknown
-* `locationId` (not present in `locations`) is its own singleton domain.
-*/
-function resolveEvictionDomain(locations, locationId, realpath = node_fs.realpathSync) {
-	const self = locations.find((l) => l.id === locationId);
-	if (!self) return new Set([locationId]);
-	const selfKey = physicalRootKey(self.root, realpath);
-	const domain = new Set([locationId]);
-	for (const l of locations) if (physicalRootKey(l.root, realpath) === selfKey) domain.add(l.id);
-	return domain;
-}
 //#endregion
 //#region src/recorder/band-engine.ts
 function toMin(hhmm) {
@@ -2470,9 +4257,34 @@ var SegmentWriter = class {
 * handle (`useCapability(...).call(fn)`) — no bespoke retry/backoff, the
 * `ReadinessRegistry` is the single source of truth.
 */
-var DEFAULT_WATCH_INTERVAL_MS = 2e3;
-/** Periodic re-evaluation to catch band boundaries crossed with no config change. */
-var TICK_MS = 3e4;
+var DEFAULT_WATCH_INTERVAL_MS = 2e3;
+/** Periodic re-evaluation to catch band boundaries crossed with no config change. */
+var TICK_MS = 3e4;
+/**
+* Floor for "this writer is pinned but producing nothing".
+*
+* The give-up path only fires when ffmpeg EXITS. On 2026-07-29 the opposite
+* happened on 590 + 617: after a deploy the writers pinned the broker and hung
+* — process alive, no exit, no error, no retry — and ~68 minutes of recording
+* were lost while `evaluateDevice` kept short-circuiting at "already recording
+* — converged". A supervisor that only watches for termination cannot see
+* silence.
+*/
+var WRITER_IDLE_MIN_MS = 9e4;
+/**
+* The bound also scales with segment length, so a camera on long segments is
+* not declared dead while its FIRST segment is still legitimately being
+* written. Three segments' worth is comfortably past any single hiccup.
+*/
+var WRITER_IDLE_SEGMENT_MULTIPLIER = 3;
+/** How long a writer may go without finalizing a segment before it is recovered. */
+function writerIdleBoundMs(segmentSeconds) {
+	return Math.max(WRITER_IDLE_MIN_MS, segmentSeconds * 1e3 * WRITER_IDLE_SEGMENT_MULTIPLIER);
+}
+/** Key for the per-(device, profile) liveness stamp. */
+function idleKey(deviceId, profile) {
+	return `${deviceId}:${profile}`;
+}
 /**
 * Staging dir name, created UNDER each recordings location root
 * (`<locationRoot>/.rec-tmp/<deviceId>/<profile>`). Per-location staging means
@@ -2498,6 +4310,14 @@ var RecordingController = class {
 	attaching = /* @__PURE__ */ new Set();
 	/** Latest qualifying trigger timestamps per device — drives `events`-band gating. */
 	triggers = /* @__PURE__ */ new Map();
+	/**
+	* Last sign of life per `deviceId:profile` — seeded at attach (so the grace
+	* window starts at the pin, not at the first segment) and stamped on every
+	* finalize. Read by {@link checkIdleWriters}. Stamped BEFORE the keep/discard
+	* policy runs: a discarded `events`-band segment still proves the writer is
+	* alive, which is the only question here.
+	*/
+	lastSegmentAt = /* @__PURE__ */ new Map();
 	restore = null;
 	tickTimer = null;
 	stopped = false;
@@ -2541,6 +4361,8 @@ var RecordingController = class {
 	}
 	/** Re-evaluate every currently-tracked OR active device on the periodic tick. */
 	async tick() {
+		if (this.stopped) return;
+		await this.checkIdleWriters();
 		if (this.stopped) return;
 		const ids = new Set(this.active.keys());
 		let persisted = [];
@@ -2591,6 +4413,42 @@ var RecordingController = class {
 			});
 		}
 	}
+	/**
+	* Find writers that hold a broker pin but have finalized nothing for longer
+	* than their idle bound, and recover them through the same detach +
+	* re-evaluate path a give-up takes.
+	*
+	* The counterpart to `onGaveUp`: that one fires when ffmpeg EXITS, this one
+	* when it does not exit and does not work. Both must exist — a branch that
+	* drops work has to say so, and the 2026-07-29 loss said nothing at all.
+	*/
+	async checkIdleWriters() {
+		const now = this.now();
+		const stalled = [];
+		for (const [deviceId, recordings] of this.active) for (const r of recordings) {
+			const since = this.lastSegmentAt.get(idleKey(deviceId, r.profile));
+			if (since === void 0) continue;
+			const idleMs = now - since;
+			const boundMs = writerIdleBoundMs(r.segmentSeconds);
+			if (idleMs > boundMs) stalled.push({
+				deviceId,
+				profile: r.profile,
+				idleMs,
+				boundMs
+			});
+		}
+		const devices = new Set(stalled.map((s) => s.deviceId));
+		for (const s of stalled) this.deps.logger.warn("recorder: writer pinned but no segment finalized — re-pinning", {
+			tags: { deviceId: s.deviceId },
+			meta: {
+				profile: s.profile,
+				idleMs: s.idleMs,
+				boundMs: s.boundMs,
+				segmentSeconds: this.active.get(s.deviceId)?.find((r) => r.profile === s.profile)?.segmentSeconds
+			}
+		});
+		for (const deviceId of devices) await this.recoverWriterGaveUp(deviceId);
+	}
 	/** Current trigger state for a device (cold default = no triggers seen). */
 	triggersFor(deviceId) {
 		return this.triggers.get(deviceId) ?? {
@@ -2711,6 +4569,7 @@ var RecordingController = class {
 			}
 		});
 		writer.start();
+		this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
 		return {
 			profile,
 			writer,
@@ -2718,12 +4577,14 @@ var RecordingController = class {
 				outDir,
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: (startMs, durMs, flatAbsPath) => {
+					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
 					this.handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath);
 				},
 				logger: deviceLog
 			}),
 			pipelineKey: source.pipelineKey,
-			outDir
+			outDir,
+			segmentSeconds
 		};
 	}
 	/**
@@ -2795,6 +4656,7 @@ var RecordingController = class {
 		const recordings = this.active.get(deviceId);
 		if (!recordings) return;
 		this.active.delete(deviceId);
+		for (const r of recordings) this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
 		for (const r of recordings) await this.teardownProfile(deviceId, r);
 		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
 			tags: { deviceId },
@@ -2841,7 +4703,7 @@ function makeBrokerCall(handle) {
 *
 * Owns its own timer + single-flight guard so a slow sweep is never overlapped
 * by the next tick — the same subsystem-owns-its-timer shape as the
-* scrub-pack prune. Pure over injected deps (config read + prune + logger +
+* export janitor. Pure over injected deps (config read + prune + logger +
 * clock via `setInterval`), so it is unit-testable with fake timers and a mock
 * `prune`. Every pass is best-effort: a per-device prune failure is logged and
 * never aborts the rest, and the sweep never throws.
@@ -2943,195 +4805,380 @@ var RetentionSweeper = class {
 	}
 };
 //#endregion
-//#region src/recorder/addon/recording-hub-host.ts
+//#region src/recorder/relocate-engine.ts
 /**
-* Resolve the host a REMOTE recording node should use to dial the hub-only
-* stream-broker's restream port.
+* Footage relocation engine (entity-routing spec, Phase 4) — the mover half
+* of disk decommissioning: mark the old location read-only (Phase 2), then
+* relocate its footage here, then delete the location.
 *
-* The implementation was promoted to the package-shared
-* `src/shared/hub-hostname.ts` in P2d (cross-node Phase 2) so the
-* pipeline-runner's remote-source leg shares the exact same resolver instead
-* of copying it. This module keeps the recorder-facing name as a thin alias —
-* resolution order and semantics are unchanged (operator override first, then
-* the host extracted from `CAMSTACK_HUB_URL`).
+* Mechanics, per file: throttled copy → size-verify → delete source → index
+* re-point. The copy is `copy-if-absent` (an equal-size destination is
+* adopted, not re-copied), so cancel/crash/re-run RESUMES instead of
+* restarting. Throttling is file-level pacing (segments are ~1–8 MB /
+* ~4 s, so per-file granularity bounds the rate tightly enough) — the drain
+* is a background chore that must never starve live writers.
+*
+* Runs INSIDE the recorder process — container uid, same-uid files, no host
+* chown trap (see docs/history 2026-07-29).
 */
-var resolveRecordingHubHostname = require_hub_hostname.resolveHubHostname;
-//#endregion
-//#region src/recorder/scrub/scrub-pack-format.ts
-function encodeScrubPack(header, samples) {
-	const frames = [];
-	let offset = 0;
-	for (const s of samples) {
-		frames.push({
-			ts: s.ts,
-			offset,
-			size: s.data.byteLength
-		});
-		offset += s.data.byteLength;
-	}
-	const full = {
-		v: 1,
-		codec: header.codec,
-		description: header.description,
-		frames
-	};
-	const headerBytes = new TextEncoder().encode(JSON.stringify(full));
-	const out = new Uint8Array(4 + headerBytes.byteLength + offset);
-	new DataView(out.buffer).setUint32(0, headerBytes.byteLength, true);
-	out.set(headerBytes, 4);
-	let cursor = 4 + headerBytes.byteLength;
-	for (const s of samples) {
-		out.set(s.data, cursor);
-		cursor += s.data.byteLength;
-	}
-	return out;
-}
-function decodeScrubPackHeader(buf) {
-	if (buf.byteLength < 4) throw new Error("scrub pack: truncated (no length prefix)");
-	const headerLen = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(0, true);
-	if (headerLen <= 0 || 4 + headerLen > buf.byteLength) throw new Error(`scrub pack: bogus header length ${headerLen}`);
-	const json = new TextDecoder().decode(buf.subarray(4, 4 + headerLen));
-	const header = JSON.parse(json);
-	if (header.v !== 1) throw new Error(`scrub pack: unsupported version ${String(header.v)}`);
-	if (!Array.isArray(header.frames)) throw new Error("scrub pack: malformed header (frames)");
+var DEFAULT_THROTTLE_MBPS = 40;
+/** Progress callback cadence (files) — cheap enough to fire often. */
+var PROGRESS_EVERY_FILES = 25;
+function snapshot(j) {
 	return {
-		header,
-		payloadOffset: 4 + headerLen
+		jobId: j.jobId,
+		state: j.state,
+		fromLocationId: j.fromLocationId,
+		toLocationId: j.toLocationId,
+		deviceId: j.deviceId,
+		entities: [...j.entities],
+		filesMoved: j.filesMoved,
+		bytesMoved: j.bytesMoved,
+		filesTotal: j.filesTotal,
+		startedAt: j.startedAt,
+		finishedAt: j.finishedAt,
+		error: j.error
 	};
 }
-//#endregion
-//#region src/recorder/scrub/scrub-pack-service.ts
-var SCRUB_WINDOW_MS = 6e4;
-function utcDay(ms) {
-	return new Date(ms).toISOString().slice(0, 10);
+/** One file's move: copy-if-absent → verify size → delete source. Returns the
+*  bytes that MOVED (0 when the destination was already complete). */
+async function moveFile(src, dst, srcBytes) {
+	let copied = 0;
+	let dstBytes = null;
+	try {
+		dstBytes = (await node_fs.promises.stat(dst)).size;
+	} catch {
+		dstBytes = null;
+	}
+	if (dstBytes !== srcBytes) {
+		await node_fs.promises.mkdir(node_path.default.dirname(dst), { recursive: true });
+		await node_fs.promises.copyFile(src, dst);
+		const after = await node_fs.promises.stat(dst);
+		if (after.size !== srcBytes) throw new Error(`relocate verify failed: ${dst} is ${after.size}B, expected ${srcBytes}B`);
+		copied = srcBytes;
+	}
+	await node_fs.promises.rm(src, { force: true });
+	return copied;
 }
-var ScrubPackService = class {
+var RelocateEngine = class {
 	deps;
-	inflight = /* @__PURE__ */ new Map();
+	jobs = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 	}
-	async getOrBuild(deviceId, windowStartMs) {
-		const key = `${deviceId}/${windowStartMs}`;
-		const pending = this.inflight.get(key);
-		if (pending) return pending;
-		const run = this.getOrBuildInner(deviceId, windowStartMs).finally(() => this.inflight.delete(key));
-		this.inflight.set(key, run);
-		return run;
-	}
-	resolveCacheDir() {
-		const c = this.deps.cacheDir;
-		return typeof c === "function" ? c() : c;
-	}
-	cachePath(deviceId, windowStartMs) {
-		return node_path.default.join(this.resolveCacheDir(), String(deviceId), utcDay(windowStartMs), `${windowStartMs}.pack`);
+	list() {
+		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
+	}
+	cancel(jobId) {
+		const job = this.jobs.get(jobId);
+		if (!job || job.state !== "running") return false;
+		job.cancelRequested = true;
+		return true;
+	}
+	/** Start a relocation. Throws on invalid locations or when a job is already
+	*  running (single-flight — two movers on one disk thrash both). */
+	start(input) {
+		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a relocation is already running (${j.jobId})`);
+		const locs = this.deps.locations();
+		const from = locs.find((l) => l.id === input.fromLocationId);
+		const to = locs.find((l) => l.id === input.toLocationId);
+		if (!from) throw new Error(`unknown source location: ${input.fromLocationId}`);
+		if (!to) throw new Error(`unknown target location: ${input.toLocationId}`);
+		if (from.id === to.id) throw new Error("source and target locations are identical");
+		if (from.root === to.root) throw new Error("source and target locations share one root — nothing to move");
+		if (to.readOnly) throw new Error(`target location is read-only: ${to.id}`);
+		const job = {
+			jobId: this.deps.newId(),
+			state: "running",
+			fromLocationId: from.id,
+			toLocationId: to.id,
+			deviceId: input.deviceId ?? null,
+			entities: input.entities ? [...input.entities] : ["segments", "strips"],
+			filesMoved: 0,
+			bytesMoved: 0,
+			filesTotal: null,
+			startedAt: this.deps.now(),
+			finishedAt: null,
+			error: null,
+			cancelRequested: false
+		};
+		this.jobs.set(job.jobId, job);
+		this.run(job, from, to, input.throttleMbps ?? DEFAULT_THROTTLE_MBPS);
+		return job.jobId;
 	}
-	async getOrBuildInner(deviceId, windowStartMs) {
-		const now = (this.deps.now ?? Date.now)();
-		const immutable = windowStartMs + SCRUB_WINDOW_MS < now;
-		const cacheFile = this.cachePath(deviceId, windowStartMs);
-		if (immutable) try {
-			const cached = new Uint8Array(await node_fs.promises.readFile(cacheFile));
-			try {
-				decodeScrubPackHeader(cached);
-			} catch {
-				this.deps.logger.debug("scrub pack: corrupt cache — rebuilding", { meta: { cacheFile } });
-				await node_fs.promises.rm(cacheFile, { force: true }).catch(() => {});
-				throw new Error("corrupt cache");
-			}
-			return {
-				pack: cached,
-				immutable
-			};
-		} catch {}
-		const end = windowStartMs + SCRUB_WINDOW_MS;
-		const rows = this.deps.listLowSegments(deviceId).filter((r) => r.startMs < end && r.startMs + r.durMs > windowStartMs).sort((a, b) => a.startMs - b.startMs);
-		if (rows.length === 0) return null;
-		let codec = null;
-		let description = null;
-		const samples = [];
-		for (const row of rows) {
-			let bytes;
-			try {
-				bytes = await this.deps.readSegmentBytes(row);
-			} catch (err) {
-				this.deps.logger.debug("scrub pack: segment read failed — skipping", { meta: {
-					relPath: row.path,
-					error: String(err)
-				} });
-				continue;
+	async run(job, from, to, throttleMbps) {
+		const sleep = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+		const bytesPerMs = throttleMbps * 1024 * 1024 / 1e3;
+		try {
+			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).sort((a, b) => a.startMs - b.startMs);
+			const stripFiles = job.entities.includes("strips") ? await listStripFiles(from.root, job.deviceId) : [];
+			job.filesTotal = segRows.length + stripFiles.length;
+			for (const row of segRows) {
+				if (job.cancelRequested) break;
+				await this.moveSegment(row, from, to);
+				job.filesMoved++;
+				job.bytesMoved += row.bytes;
+				if (job.filesMoved % PROGRESS_EVERY_FILES === 0) this.deps.onProgress?.(snapshot(job));
+				await sleep(row.bytes / bytesPerMs);
 			}
-			const extracted = await require_fmp4_keyframes.extractKeyframes(bytes, row.startMs);
-			if (!extracted) continue;
-			if (codec === null) {
-				codec = extracted.codec;
-				description = extracted.description;
-			} else if (extracted.codec !== codec) {
-				this.deps.logger.warn("scrub pack: mid-window codec change — dropping segment", { meta: {
-					relPath: row.path,
-					expected: codec,
-					got: extracted.codec
-				} });
-				continue;
+			for (const rel of stripFiles) {
+				if (job.cancelRequested) break;
+				const src = node_path.default.join(from.root, rel);
+				const bytes = (await node_fs.promises.stat(src)).size;
+				await moveFile(src, node_path.default.join(to.root, rel), bytes);
+				job.filesMoved++;
+				job.bytesMoved += bytes;
+				await sleep(bytes / bytesPerMs);
 			}
-			for (const k of extracted.keyframes) if (k.ts >= windowStartMs && k.ts < end) samples.push(k);
-		}
-		if (codec === null || description === null || samples.length === 0) return null;
-		samples.sort((a, b) => a.ts - b.ts);
-		const pack = encodeScrubPack({
-			codec,
-			description: Buffer.from(description).toString("base64")
-		}, samples);
-		if (immutable) try {
-			await node_fs.promises.mkdir(node_path.default.dirname(cacheFile), { recursive: true });
-			const tmpFile = `${cacheFile}.tmp`;
-			await node_fs.promises.writeFile(tmpFile, pack);
-			await node_fs.promises.rename(tmpFile, cacheFile);
+			job.state = job.cancelRequested ? "cancelled" : "done";
 		} catch (err) {
-			this.deps.logger.debug("scrub pack: cache write failed (serving anyway)", { meta: {
-				cacheFile,
-				error: String(err)
+			job.state = "failed";
+			job.error = err instanceof Error ? err.message : String(err);
+			this.deps.logger.warn("relocate job failed", { meta: {
+				jobId: job.jobId,
+				error: job.error
 			} });
+		} finally {
+			job.finishedAt = this.deps.now();
+			this.deps.onFinished?.(snapshot(job));
 		}
-		return {
-			pack,
-			immutable
-		};
 	}
-	/** Remove per-device day directories older than the retention horizon. */
-	async prune(retentionDays) {
-		const cutoff = (this.deps.now ?? Date.now)() - retentionDays * 864e5;
-		const cacheDir = this.resolveCacheDir();
-		let deviceDirs = [];
+	/** Move one segment file and re-point its index row to the target location
+	*  (same location-relative path — the layout is identical on every root). */
+	async moveSegment(row, from, to) {
+		await moveFile(node_path.default.join(from.root, row.path), node_path.default.join(to.root, row.path), row.bytes);
+		this.deps.index.removeSegments([row.path]);
+		this.deps.index.addSegment({
+			...row,
+			locationId: to.id
+		});
+	}
+};
+/** The location-relative strip files under `<root>/<dev>/strips/…`, optionally
+*  scoped to one device. Missing dirs are data (no strips), not failures. */
+async function listStripFiles(root, deviceId) {
+	const devices = [];
+	if (deviceId !== null) devices.push(String(deviceId));
+	else try {
+		for (const e of await node_fs.promises.readdir(root)) if (/^\d+$/.test(e)) devices.push(e);
+	} catch {
+		return [];
+	}
+	const out = [];
+	for (const dev of devices) {
+		const stripDir = node_path.default.join(root, dev, "strips");
+		let entries;
 		try {
-			deviceDirs = await node_fs.promises.readdir(cacheDir);
+			entries = await node_fs.promises.readdir(stripDir, { recursive: true });
 		} catch {
-			return;
+			continue;
 		}
-		for (const dev of deviceDirs) {
-			const devPath = node_path.default.join(cacheDir, dev);
-			let days = [];
-			try {
-				days = await node_fs.promises.readdir(devPath);
-			} catch {
-				continue;
-			}
-			for (const day of days) {
-				const dayMs = Date.parse(`${day}T00:00:00Z`);
-				if (Number.isFinite(dayMs) && dayMs < cutoff) await node_fs.promises.rm(node_path.default.join(devPath, day), {
-					recursive: true,
-					force: true
-				}).catch(() => {});
+		for (const e of entries) if (e.endsWith(".strip")) out.push(node_path.default.join(dev, "strips", e.split(node_path.default.sep).join("/")));
+	}
+	return out;
+}
+//#endregion
+//#region src/recorder/addon/footage-render.ts
+/**
+* One-shot media render FROM RECORDED FOOTAGE (notification attachments).
+*
+* Shared core behind `renderGif` and `renderClip`: both cut the same window out
+* of the same `low` profile through the export machinery's per-render source
+* playlist (absolute segment URIs — the ONLY playlist shape ffmpeg can consume,
+* see export-source-playlist.ts), pipe it through ONE ffmpeg invocation, and
+* return the bytes. Everything is transient: playlist and output are deleted on
+* every outcome.
+*
+* Fail-closed by construction: no footage covering the window ⇒ it throws, and
+* the caller (a notification rule) simply ships no attachment. A camera that is
+* not recording therefore cannot produce a clip — which is exactly why the
+* frame-ring plane (roadmap Phase 5) still matters for cameras with no
+* recording. It is NOT a prerequisite for the cameras that do record.
+*/
+var RENDER_TIMEOUT_MS = 3e4;
+/**
+* A notification clip must sit AROUND the moment it describes. Sliding the
+* window back to the last finalized segment made the attachment exist, but it
+* showed the seconds BEFORE the trigger — an operator watching it sees the
+* approach and not the event, which is worse than a short wait (operator,
+* 2026-07-30). The caller therefore asks for the window it wants and the
+* renderer refuses until the footage covering it exists; the DISPATCHER waits
+* (the outbox already retries with backoff) and gives up into a still-only
+* notification rather than delaying delivery indefinitely.
+*/
+var FOOTAGE_NOT_READY = "footage-not-yet-finalized";
+/**
+* GIF for the widest notifier reach (every backend that takes an image takes a
+* gif); `fps` decimates and lanczos downscales.
+*/
+async function renderGif(renderDeps, input) {
+	const out = await renderFootage(renderDeps, input, "gif", (playlistPath, outPath) => [
+		"-y",
+		"-i",
+		playlistPath,
+		"-vf",
+		`fps=${input.fps},scale=${input.maxWidth}:-2:flags=lanczos`,
+		"-loop",
+		"0",
+		"-f",
+		"gif",
+		outPath
+	]);
+	return {
+		gifBase64: out.bytes.toString("base64"),
+		fromMs: out.fromMs,
+		toMs: out.toMs
+	};
+}
+/**
+* MP4 clip — the "send a clip, not a gif" attachment. Re-encodes rather than
+* stream-copying: a concat of segments whose encoder parameters differ (a
+* profile switch, a broker redial) produces an mp4 no player will scrub, and a
+* notification attachment that will not play is worse than none. `faststart`
+* puts the moov up front so a chat client can play it without the whole file.
+*/
+async function renderClip(renderDeps, input) {
+	const out = await renderFootage(renderDeps, input, "mp4", (playlistPath, outPath) => [
+		"-y",
+		"-i",
+		playlistPath,
+		"-vf",
+		`scale=${input.maxWidth}:-2:flags=lanczos`,
+		"-c:v",
+		"libx264",
+		"-preset",
+		"veryfast",
+		"-crf",
+		"28",
+		"-profile:v",
+		"main",
+		"-pix_fmt",
+		"yuv420p",
+		"-movflags",
+		"+faststart",
+		"-an",
+		"-f",
+		"mp4",
+		outPath
+	]);
+	return {
+		clipBase64: out.bytes.toString("base64"),
+		mime: "video/mp4",
+		fromMs: out.fromMs,
+		toMs: out.toMs,
+		bytes: out.bytes.byteLength
+	};
+}
+/** The shared playlist → ffmpeg → bytes pipeline. */
+async function renderFootage(renderDeps, input, ext, buildArgs) {
+	const now = renderDeps.now ?? Date.now;
+	const fromMs = input.aroundMs - input.preRollSec * 1e3;
+	const toMs = input.aroundMs + input.postRollSec * 1e3;
+	if (!Number.isFinite(fromMs) || !Number.isFinite(toMs) || toMs <= fromMs) throw new Error(`invalid ${ext} window [${fromMs}, ${toMs}) for device ${input.deviceId} — aroundMs=${input.aroundMs} preRollSec=${input.preRollSec} postRollSec=${input.postRollSec}`);
+	const renderId = `${ext}-${now()}-${Math.floor(Math.random() * 1e6)}`;
+	const availableEnd = latestFinalizedEnd(renderDeps, input.deviceId);
+	if (availableEnd === null || availableEnd < toMs) throw new Error(`${FOOTAGE_NOT_READY}: [${fromMs}, ${toMs}) for device ${input.deviceId} — finalized footage ends at ${availableEnd ?? "never"}`);
+	const window = {
+		fromMs,
+		toMs
+	};
+	const playlist = await writeExportSourcePlaylist({
+		deps: renderDeps.deps,
+		exportsDir: renderDeps.exportsDir,
+		exportId: renderId,
+		deviceId: input.deviceId,
+		profile: "low",
+		fromMs: window.fromMs,
+		toMs: window.toMs
+	});
+	if (playlist === null) throw new Error(`no footage covers [${window.fromMs}, ${window.toMs}) for device ${input.deviceId}`);
+	const outPath = node_path.default.join(node_path.default.dirname(playlist), `${renderId}.${ext}`);
+	try {
+		await runFfmpeg(renderDeps, buildArgs(playlist, outPath), ext);
+		const bytes = await node_fs.promises.readFile(outPath);
+		if (bytes.byteLength === 0) throw new Error(`${ext} render produced an empty file`);
+		return {
+			bytes,
+			fromMs: window.fromMs,
+			toMs: window.toMs
+		};
+	} finally {
+		await node_fs.promises.rm(playlist, { force: true }).catch(() => {});
+		await node_fs.promises.rm(outPath, { force: true }).catch(() => {});
+	}
+}
+/** The end of the newest FINALIZED `low` segment, or null when none exists. */
+function latestFinalizedEnd(renderDeps, deviceId) {
+	const rows = renderDeps.deps.index.segments(deviceId, "low");
+	let end = null;
+	for (const s of rows) {
+		const candidate = s.startMs + s.durMs;
+		if (end === null || candidate > end) end = candidate;
+	}
+	return end;
+}
+/**
+* Run one ffmpeg and GUARANTEE the child is gone before the promise settles.
+*
+* The previous shape leaked on two paths: a `spawn` error (`ENOENT`, a bad
+* path) rejected while a process could still be alive, and a `close` with a
+* non-zero code rejected without ever reaping stdio. These renders fire on
+* every notification with a gif or clip, so a leak here is a slow accumulation
+* of ffmpeg processes on the recording node — the kind that shows up days later
+* as "the hub got slow" (operator, 2026-07-30).
+*
+* `settle` is idempotent and always kills first: killing an already-exited pid
+* throws ESRCH, which is swallowed, so the cost of being wrong is nothing while
+* the cost of NOT killing is a zombie per render.
+*/
+function runFfmpeg(renderDeps, args, ext) {
+	return new Promise((resolve, reject) => {
+		const proc = renderDeps.spawn(renderDeps.ffmpegPath ?? "ffmpeg", args);
+		let done = false;
+		let timer = null;
+		const settle = (err) => {
+			if (done) return;
+			done = true;
+			if (timer !== null) {
+				clearTimeout(timer);
+				timer = null;
 			}
+			if (proc.exitCode === null && proc.signalCode === null) try {
+				proc.kill("SIGKILL");
+			} catch {}
 			try {
-				if ((await node_fs.promises.readdir(devPath)).length === 0) await node_fs.promises.rm(devPath, {
-					recursive: true,
-					force: true
-				}).catch(() => {});
+				proc.stderr?.removeAllListeners();
+				proc.stdout?.destroy();
+				proc.stderr?.destroy();
 			} catch {}
-		}
-	}
-};
+			if (err === null) resolve();
+			else reject(err);
+		};
+		timer = setTimeout(() => settle(/* @__PURE__ */ new Error(`${ext} render timed out`)), RENDER_TIMEOUT_MS);
+		let stderrTail = "";
+		proc.stderr?.on("data", (c) => {
+			stderrTail = (stderrTail + c.toString()).slice(-400);
+		});
+		proc.on("error", (err) => settle(err instanceof Error ? err : new Error(String(err))));
+		proc.on("close", (code) => {
+			settle(code === 0 ? null : /* @__PURE__ */ new Error(`ffmpeg ${ext} render exited ${code}: ${stderrTail}`));
+		});
+	});
+}
+//#endregion
+//#region src/recorder/addon/recording-hub-host.ts
+/**
+* Resolve the host a REMOTE recording node should use to dial the hub-only
+* stream-broker's restream port.
+*
+* The implementation was promoted to the package-shared
+* `src/shared/hub-hostname.ts` in P2d (cross-node Phase 2) so the
+* pipeline-runner's remote-source leg shares the exact same resolver instead
+* of copying it. This module keeps the recorder-facing name as a thin alias —
+* resolution order and semantics are unchanged (operator override first, then
+* the host extracted from `CAMSTACK_HUB_URL`).
+*/
+var resolveRecordingHubHostname = require_hub_hostname.resolveHubHostname;
 //#endregion
 //#region src/recorder/still/still-source.ts
 /**
@@ -3329,9 +5376,6 @@ var MARKER_PAD_POST_MS = require_dist.EVENT_PAD_MS.postMs;
 *  form the hub reverse-proxy client path `/addon/recorder/playback`. */
 var RECORDER_ADDON_ID = "recorder";
 var PLAYBACK_PREFIX = "playback";
-/** Data-plane prefix for keyframe-only scrub packs →
-*  `/addon/recorder/scrub/<deviceId>/<windowStartSec>`. */
-var SCRUB_PREFIX = "scrub";
 /** Data-plane prefix for on-demand single stills →
 *  `/addon/recorder/still/<deviceId>/<epochSec>`. */
 var STILL_PREFIX = "still";
@@ -3345,19 +5389,6 @@ var EXPORT_SWEEP_INTERVAL_MS = 5 * 6e4;
 *  hourly cadence keeps the storage.list/evict cost negligible while honouring
 *  the recording-spec §6 periodic retention. */
 var RETENTION_SWEEP_INTERVAL_MS = 60 * 6e4;
-/** Scrub-pack cache prune cadence — mirrors the thumbnail service's own prune
-*  tick (6h) + initial delay (10min off boot churn). Packs are a rebuild-on-
-*  demand cache, so a slow sweep is plenty. */
-var SCRUB_PRUNE_TICK_MS = 6 * 36e5;
-var SCRUB_PRUNE_INITIAL_DELAY_MS = 10 * 6e4;
-/** Retention horizon for the scrub-pack cache (days). Packs are a keyframe-only
-*  CACHE derived from the LOW footage — never primary data — so a pruned window
-*  simply rebuilds on the next request while its segments still exist. A fixed,
-*  generous horizon (comfortably past any typical per-device footage max-age)
-*  reclaims disk from truly-old orphaned packs without racing footage retention.
-*  The recorder has no single global footage max-age (it is per-device), so a
-*  fixed cache horizon is the correct scope here. */
-var SCRUB_PACK_RETENTION_DAYS = 90;
 /** Grace after a completed download before a `deleteAfterDownload` file is removed. */
 var EXPORT_DELETE_GRACE_MS = 6e4;
 /** Only `.mp4` export ids matching this shape are servable (traversal guard). */
@@ -3376,7 +5407,36 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*  playback, runs no controller. Resolved in `onInitialize`. */
 	isRecordingNode = true;
 	index = new RecordingIndex();
+	/**
+	* The calendar rungs — which days, which hours, and a day's exact ranges.
+	*
+	* Separate from `RecordingIndex` on purpose: that one is the SEGMENT model
+	* (retention, eviction, footprint) and is hydrated by a walk that takes
+	* minutes. The calendar answers what a screen asks and is built from
+	* directory names, so the first screen no longer waits on the walk.
+	*/
+	calendarInstance = null;
+	/** LAZY: a field initialiser runs before `initialize()` assigns `ctx`, and
+	*  reading `this.ctx` there throws — the same trap that bit the playback tier. */
+	get calendar() {
+		this.calendarInstance ??= new CalendarIndex({
+			roots: () => this.resolvedLocations.map((l) => l.root),
+			logger: this.ctx.logger
+		});
+		return this.calendarInstance;
+	}
 	segmentStore = null;
+	/** Sync-sample tables captured at finalize, served by the directory so a
+	*  playback seek needs no mfra tail fetch. RAM-only, TTL-bounded. */
+	mfraTables = new MfraTableStore();
+	/** Keyframe thumbnail strips (fast-drag scrub depth), one file per
+	*  camera-hour under the LOW recordings root. */
+	stripStore = new StripStore(() => {
+		const writable = this.resolvedLocations.filter((l) => !l.readOnly);
+		return (writable.find((l) => l.type === "recordingsLow") ?? writable[0])?.root ?? null;
+	});
+	/** Bounded one-shot ffmpeg pool feeding the strip at finalize. */
+	stripCapture = new StripCapture({ onLog: (msg, data) => this.ctx.logger.debug(msg, { meta: data }) });
 	/** Continuous + events band write-path controller (ffmpeg writers + watchers). */
 	controller = null;
 	/** Per-device motion/audio markers for playback (B3 events feed the controller). */
@@ -3389,13 +5449,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	playbackBaseUrl = null;
 	/** On-demand single-still decode service (export-dialog frame previews). Null
 	*  on non-recording nodes / when the data-plane serve fails. */
-	/** Keyframe-only scrub-pack service (built + served in onInitialize). Null on
-	*  non-recording nodes / when the data-plane serve fails. */
-	scrubPackService = null;
-	/** Periodic scrub-pack cache prune timer + its one-shot initial delay. Cleared
-	*  on shutdown. */
-	scrubPruneTimer = null;
-	scrubPruneInitialTimer = null;
 	/** Render engine for recording exports. Null on non-recording nodes. */
 	exportEngine = null;
 	/** Periodic export-expiry sweep timer. Cleared on shutdown. */
@@ -3455,6 +5508,38 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 					force: true
 				});
 			},
+			onEvicted: (deviceId, atMs) => {
+				this.calendar.invalidate(deviceId, atMs);
+				this.stripStore.removeHour(deviceId, atMs);
+			},
+			onIndexed: (row, absPath) => {
+				readMfraTable(absPath, row.bytes).then(async (captured) => {
+					this.mfraTables.record(row.deviceId, row.profile, row.startMs, captured.table);
+					if (row.profile !== "low") return;
+					if ((await loadDeviceConfig(this.configStore(), row.deviceId)).stripsEnabled !== true) return;
+					const jpegs = await this.stripCapture.capture(absPath);
+					if (jpegs === null || jpegs.length === 0) return;
+					const instants = keyframeInstants(row.startMs, row.durMs, captured);
+					const thumbs = jpegs.slice(0, instants.length).map((jpeg, i) => ({
+						tsMs: instants[i] ?? row.startMs,
+						jpeg
+					}));
+					await this.stripStore.append(row.deviceId, thumbs);
+				}).catch((err) => {
+					this.ctx.logger.debug("mfra/strip capture failed", {
+						tags: { deviceId: row.deviceId },
+						meta: {
+							path: row.path,
+							error: require_dist.errMsg(err)
+						}
+					});
+				});
+			},
+			removeDirIfEmpty: async (locationId, relDir) => {
+				const loc = this.resolvedLocations.find((l) => l.id === locationId);
+				if (!loc) throw new Error(`recorder: unknown recordings location ${locationId}`);
+				await node_fs.promises.rmdir(node_path.default.join(loc.root, relDir));
+			},
 			logger: { warn: (message, extras) => {
 				if (isSegmentStoreLogExtras(extras)) this.ctx.logger.warn(message, {
 					tags: extras.tags,
@@ -3490,6 +5575,32 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			newId: () => (0, node_crypto.randomUUID)(),
 			logger: this.ctx.logger.child("ops-log")
 		});
+		const relocateEngine = new RelocateEngine({
+			index: this.index,
+			locations: () => this.resolvedLocations,
+			logger: this.ctx.logger.child("relocate"),
+			now: () => Date.now(),
+			newId: () => (0, node_crypto.randomUUID)(),
+			onFinished: (job) => {
+				opsLog.append({
+					op: "relocate",
+					reason: "operator",
+					deviceId: job.deviceId,
+					itemsAffected: job.filesMoved,
+					bytesReclaimed: 0,
+					detail: `${job.state}: ${job.fromLocationId} → ${job.toLocationId} (${job.bytesMoved} bytes${job.error ? `; ${job.error}` : ""})`
+				});
+				this.calendar.invalidateAll();
+			},
+			onProgress: (job) => {
+				this.ctx.logger.info("relocate progress", { meta: {
+					jobId: job.jobId,
+					filesMoved: job.filesMoved,
+					filesTotal: job.filesTotal,
+					bytesMoved: job.bytesMoved
+				} });
+			}
+		});
 		const recordingDeps = {
 			index: this.index,
 			segmentStore: this.segmentStore,
@@ -3497,10 +5608,23 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			logger: this.ctx.logger,
 			configStore: this.configStore(),
 			opsLog,
+			relocate: relocateEngine,
+			gifRender: (input) => renderGif({
+				deps: recordingDeps,
+				exportsDir: node_path.default.join(this.ctx.dataDir, EXPORTS_PREFIX),
+				spawn: node_child_process.spawn
+			}, input),
+			clipRender: (input) => renderClip({
+				deps: recordingDeps,
+				exportsDir: node_path.default.join(this.ctx.dataDir, EXPORTS_PREFIX),
+				spawn: node_child_process.spawn
+			}, input),
 			locations: () => this.resolvedLocations,
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),
+			calendar: this.calendar,
+			hydrateWindow: (deviceId, fromMs, toMs) => hydrateWindowFromStorage(this.index, deviceId, fromMs, toMs, this.resolvedLocations, this.ctx.logger),
 			onConfigChanged: (deviceId) => this.controller?.onConfigChanged(deviceId) ?? Promise.resolve(),
 			dataDir: this.ctx.dataDir,
 			playbackBaseUrl: () => this.playbackBaseUrl,
@@ -3519,28 +5643,39 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			index: this.index,
 			store: this.segmentStore,
 			resolveDomain: (locationId) => this.locationDomain(locationId),
+			isReadOnly: (locationId) => this.resolvedLocations.find((l) => l.id === locationId)?.readOnly === true,
 			onEvicted: (summaries) => {
-				for (const s of summaries) this.ctx.eventBus.emit({
-					id: (0, node_crypto.randomUUID)(),
-					timestamp: /* @__PURE__ */ new Date(),
-					source: {
-						type: "device",
-						id: s.deviceId,
-						addonId: this.ctx.id,
-						deviceId: s.deviceId,
-						nodeId: this.nodeId
-					},
-					category: require_dist.EventCategory.RecordingRetentionCompleted,
-					data: {
+				for (const s of summaries) {
+					opsLog.append({
+						op: "prune",
+						reason: "quota",
 						deviceId: s.deviceId,
-						locationId: s.locationId,
-						segments: s.segments,
-						bytes: s.bytes,
-						fromMs: s.fromMs,
-						toMs: s.toMs,
-						trigger: "disk-pressure"
-					}
-				});
+						itemsAffected: s.segments,
+						bytesReclaimed: s.bytes,
+						detail: `disk-pressure evicted [${new Date(s.fromMs).toISOString()}, ${new Date(s.toMs).toISOString()}) on ${s.locationId}`
+					});
+					this.ctx.eventBus.emit({
+						id: (0, node_crypto.randomUUID)(),
+						timestamp: /* @__PURE__ */ new Date(),
+						source: {
+							type: "device",
+							id: s.deviceId,
+							addonId: this.ctx.id,
+							deviceId: s.deviceId,
+							nodeId: this.nodeId
+						},
+						category: require_dist.EventCategory.RecordingRetentionCompleted,
+						data: {
+							deviceId: s.deviceId,
+							locationId: s.locationId,
+							segments: s.segments,
+							bytes: s.bytes,
+							fromMs: s.fromMs,
+							toMs: s.toMs,
+							trigger: "disk-pressure"
+						}
+					});
+				}
 			}
 		});
 		const exportsState = this.exportsStore();
@@ -3583,13 +5718,22 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			downloadUrlFor: (id) => `/addon/${RECORDER_ADDON_ID}/${EXPORTS_PREFIX}/${id}.mp4`
 		});
 		try {
-			const handler = require_model_download_service_Cp9f4dk6.createFileDataPlaneHandler({ getRoots: () => this.playbackRoots() });
+			const handler = withStripRoutes({
+				store: this.stripStore,
+				onLog: (msg, meta) => this.ctx.logger.debug(msg, { meta })
+			}, withDirectoryRoute({
+				source: this.calendar,
+				mfraFor: (deviceId, profile, startMs) => this.mfraTables.get(deviceId, profile, startMs),
+				onLog: (msg, meta) => this.ctx.logger.debug(msg, { meta })
+			}, require_model_download_service_Cp9f4dk6.createFileDataPlaneHandler({ getRoots: () => this.playbackRoots() })));
 			const served = await this.ctx.dataPlane?.serve({
 				prefix: PLAYBACK_PREFIX,
 				access: "authenticated",
 				handler
 			});
-			this.playbackBaseUrl = served ? `/addon/${RECORDER_ADDON_ID}/${PLAYBACK_PREFIX}` : null;
+			const clientPath = `/addon/${RECORDER_ADDON_ID}/${PLAYBACK_PREFIX}`;
+			if (clientPath !== "/addon/recorder/playback") throw new Error(`recorder playback path drifted: serving ${clientPath}, clients use ${PLAYBACK_PLANE_PATH}`);
+			this.playbackBaseUrl = served ? clientPath : null;
 			this.ctx.logger.info("recorder playback data-plane served", { meta: {
 				clientBase: this.playbackBaseUrl ?? "(no dataPlane facility)",
 				internal: served?.baseUrl
@@ -3597,37 +5741,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("recorder playback data-plane failed to serve", { meta: { error: require_dist.errMsg(err) } });
 		}
-		try {
-			const scrubService = new ScrubPackService({
-				listLowSegments: (deviceId) => this.index.segments(deviceId, "low"),
-				readSegmentBytes: async (row) => {
-					const abs = this.resolveSegmentAbsPath(row);
-					return new Uint8Array(await node_fs.promises.readFile(abs));
-				},
-				cacheDir: () => this.resolveScrubCacheRoot(),
-				logger: this.ctx.logger.child("ScrubPacks")
-			});
-			this.scrubPackService = scrubService;
-			const served = await this.ctx.dataPlane?.serve({
-				prefix: SCRUB_PREFIX,
-				access: "authenticated",
-				handler: (req, res) => this.serveScrubPack(scrubService, req, res)
-			});
-			this.scrubPruneInitialTimer = setTimeout(() => {
-				this.scrubPackService?.prune(SCRUB_PACK_RETENTION_DAYS);
-			}, SCRUB_PRUNE_INITIAL_DELAY_MS);
-			this.scrubPruneInitialTimer.unref?.();
-			this.scrubPruneTimer = setInterval(() => {
-				this.scrubPackService?.prune(SCRUB_PACK_RETENTION_DAYS);
-			}, SCRUB_PRUNE_TICK_MS);
-			this.scrubPruneTimer.unref?.();
-			this.ctx.logger.info("recorder scrub-pack data-plane served", { meta: {
-				clientBase: served ? `/addon/${RECORDER_ADDON_ID}/${SCRUB_PREFIX}` : "(no dataPlane)",
-				internal: served?.baseUrl
-			} });
-		} catch (err) {
-			this.ctx.logger.warn("scrub-pack data-plane serve failed", { meta: { error: require_dist.errMsg(err) } });
-		}
 		try {
 			const stillService = new StillFrameService({
 				listLowSegments: (deviceId) => this.index.segments(deviceId, "low"),
@@ -3666,20 +5779,25 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				watchIntervalMs: this.config.watchIntervalMs
 			}
 		});
-		return { providers: [
-			{
-				capability: require_dist.recordingCapability,
-				provider: recordingProvider
-			},
-			{
-				capability: require_dist.storageEvictableCapability,
-				provider: evictableProvider
-			},
-			{
-				capability: require_dist.recordingExportCapability,
-				provider: exportProvider
-			}
-		] };
+		warnLostBands(this.configStore(), this.ctx.logger);
+		return {
+			providers: [
+				{
+					capability: require_dist.recordingCapability,
+					provider: recordingProvider
+				},
+				{
+					capability: require_dist.storageEvictableCapability,
+					provider: evictableProvider
+				},
+				{
+					capability: require_dist.recordingExportCapability,
+					provider: exportProvider
+				}
+			],
+			customActions: recorderStripActions,
+			actionHandlers: { regenerateStrips: async (input) => this.regenerateStrips(RegenerateStripsInputSchema.parse(input)) }
+		};
 	}
 	async onShutdown() {
 		this.eventUnsub?.();
@@ -3687,15 +5805,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		await this.controller?.stop();
 		this.controller = null;
 		this.segmentStore = null;
-		if (this.scrubPruneInitialTimer !== null) {
-			clearTimeout(this.scrubPruneInitialTimer);
-			this.scrubPruneInitialTimer = null;
-		}
-		if (this.scrubPruneTimer !== null) {
-			clearInterval(this.scrubPruneTimer);
-			this.scrubPruneTimer = null;
-		}
-		this.scrubPackService = null;
 		if (this.exportSweepTimer !== null) {
 			clearInterval(this.exportSweepTimer);
 			this.exportSweepTimer = null;
@@ -3742,6 +5851,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			recursive: true,
 			force: true
 		}).catch(() => {});
+		for (const loc of this.resolvedLocations) node_fs.promises.rm(node_path.default.join(loc.root, ".scrub-packs"), {
+			recursive: true,
+			force: true
+		}).catch(() => {});
 		try {
 			await this.controller?.start();
 		} catch (err) {
@@ -3763,7 +5876,9 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			this.ctx.logger.warn("recorder: reading persisted device configs failed — skipping hydrate", { meta: { error: require_dist.errMsg(err) } });
 			return;
 		}
+		this.warmToday([...configs.keys()]);
 		for (const deviceId of configs.keys()) await hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, this.resolvedLocations, this.ctx.logger);
+		for (const deviceId of configs.keys()) this.index.markHydratedAll(deviceId);
 		this.ctx.logger.info("recorder: hydrated index from storage", { meta: {
 			deviceCount: configs.size,
 			locationCount: this.resolvedLocations.length
@@ -3981,6 +6096,27 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	/** Durable handle config-store reads/writes the deviceId→config blob on —
 	*  the sanctioned `BaseAddon.state()` wrapper (same key, same blob shape;
 	*  adds the read-retry budget + parse-warning logging over the raw slice). */
+	/**
+	* Fill TODAY's exact ranges, per camera, as background work.
+	*
+	* Deliberately the smallest useful prediction: the day the operator opens.
+	* Anything wider was a bet that cost more than it bought.
+	*/
+	async warmToday(deviceIds) {
+		const now = Date.now();
+		const dayMs = 1440 * 60 * 1e3;
+		const started = now;
+		for (const deviceId of deviceIds) try {
+			const profile = await this.calendar.availabilityProfileFor(deviceId);
+			if (profile === null) continue;
+			await this.calendar.warmDayRanges(deviceId, profile, now);
+			await this.calendar.warmDayRanges(deviceId, profile, now - dayMs);
+		} catch {}
+		this.ctx.logger.info("recorder: today warmed", { meta: {
+			devices: deviceIds.length,
+			ms: Date.now() - started
+		} });
+	}
 	configStore() {
 		return this.state(RECORDING_CONFIGS_KEY, RecordingConfigsBlobSchema, {});
 	}
@@ -4030,63 +6166,72 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		if (loc === void 0) throw new Error(`recorder scrub: unknown recordings location ${row.locationId}`);
 		return node_path.default.join(loc.root, row.path);
 	}
+	/** Devices with a strip regeneration in flight — one at a time per device. */
+	stripRegenRunning = /* @__PURE__ */ new Set();
 	/**
-	* Cache root for the scrub packs — a hidden `.scrub-packs` dir UNDER a
-	* recordings storage root (the `recordingsLow` location the packs derive from,
-	* else the first resolved location). Packs are a regenerable keyframe cache of
-	* the LOW segments; keeping them beside the recordings (a top-level mount, NOT
-	* backed up) — instead of in `addons-data` — keeps the backup perimeter pure
-	* operator state so it can be tarred whole with no exclusion list. See ADR-0027.
-	*
-	* Resolved lazily: `resolvedLocations` is only populated in `onHubReachable`,
-	* after the ScrubPackService is constructed in `onInitialize`. getOrBuild/prune
-	* run only at request time / on a delayed timer, by when locations are ready.
-	*/
-	resolveScrubCacheRoot() {
-		const loc = this.resolvedLocations.find((l) => l.type === "recordingsLow") ?? this.resolvedLocations[0];
-		if (loc === void 0) return node_path.default.join(this.ctx.dataDir, "scrub-packs");
-		return node_path.default.join(loc.root, ".scrub-packs");
-	}
-	/**
-	* Scrub-pack request handler: `GET /<deviceId>/<windowStartSec>` →
-	* `application/octet-stream` pack | 204 (no footage) | 400 (bad path / window
-	* not aligned to `SCRUB_WINDOW_MS`) | 500. Immutable (fully past) windows carry
-	* a 1-year immutable cache header; the still-open current window is `no-store`.
+	* Clear one camera's strips and rebuild them from the low segments on disk —
+	* the backfill for footage recorded before strips were enabled. Walks the
+	* RECENT window (default {@link REGEN_DEFAULT_DAYS} days), newest hour
+	* first, so the part scrubbing actually visits is ready soonest. Background;
+	* the one-shot ffmpeg pool bounds the decode concurrency.
 	*/
-	async serveScrubPack(service, req, res) {
-		const m = /^\/(\d+)\/(\d+)$/.exec(req.url?.split("?")[0] ?? "");
-		if (!m) {
-			res.writeHead(400).end();
-			return;
-		}
-		const deviceId = Number(m[1]);
-		const windowStartMs = Number(m[2]) * 1e3;
-		if (windowStartMs % 6e4 !== 0) {
-			res.writeHead(400).end();
-			return;
-		}
-		try {
-			const built = await service.getOrBuild(deviceId, windowStartMs);
-			if (!built) {
-				res.writeHead(204).end();
-				return;
+	async regenerateStrips(input) {
+		const { deviceId } = input;
+		if (this.stripRegenRunning.has(deviceId)) return {
+			started: false,
+			segments: 0
+		};
+		const days = input.days ?? 3;
+		const cutoff = Date.now() - days * 864e5;
+		const rows = this.index.segments(deviceId, "low").filter((r) => r.startMs >= cutoff).toSorted((a, b) => b.startMs - a.startMs);
+		this.stripRegenRunning.add(deviceId);
+		await this.stripStore.removeDevice(deviceId);
+		(async () => {
+			let done = 0;
+			let failed = 0;
+			for (const row of rows) {
+				try {
+					const abs = this.resolveSegmentAbsPath(row);
+					const captured = await readMfraTable(abs, row.bytes);
+					const jpegs = await this.stripCapture.capture(abs);
+					if (jpegs === null || jpegs.length === 0) {
+						failed++;
+						continue;
+					}
+					const instants = keyframeInstants(row.startMs, row.durMs, captured);
+					const thumbs = jpegs.slice(0, instants.length).map((jpeg, i) => ({
+						tsMs: instants[i] ?? row.startMs,
+						jpeg
+					}));
+					await this.stripStore.append(deviceId, thumbs);
+					done++;
+				} catch {
+					failed++;
+				}
+				if ((done + failed) % 500 === 0) this.ctx.logger.info("strip regeneration progress", {
+					tags: { deviceId },
+					meta: {
+						done,
+						failed,
+						total: rows.length
+					}
+				});
 			}
-			res.writeHead(200, {
-				"content-type": "application/octet-stream",
-				"content-length": built.pack.byteLength,
-				"cache-control": built.immutable ? "private, max-age=31536000, immutable" : "no-store"
-			});
-			res.end(Buffer.from(built.pack));
-		} catch (err) {
-			this.ctx.logger.warn("scrub pack request failed", {
+			this.stripRegenRunning.delete(deviceId);
+			this.ctx.logger.info("strip regeneration complete", {
 				tags: { deviceId },
 				meta: {
-					windowStartMs,
-					error: require_dist.errMsg(err)
+					done,
+					failed,
+					total: rows.length,
+					days
 				}
 			});
-			res.writeHead(500).end();
-		}
+		})();
+		return {
+			started: true,
+			segments: rows.length
+		};
 	}
 	/**
 	* Dedicated export MP4 download handler. Resolves `<exportId>.mp4` to a `ready`
@@ -4174,4 +6319,5 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	}
 };
 //#endregion
-module.exports = RecorderV2Addon;
+exports.customActions = recorderStripActions;
+exports.default = RecorderV2Addon;