@camstack/addon-pipeline 1.2.196 → 1.2.198

package/dist/recorder/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-HG5geL9t.js");
-const require_node = require("../node--my8JTOW.js");
+const require_dist = require("../dist-BxP0SvPz.js");
+const require_node = require("../node-BIKrNEtS.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
-const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
+const require_prebuffer = require("../prebuffer-DqdeLSsk.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
@@ -3884,6 +3884,31 @@ var CalendarIndex = class {
 //#endregion
 //#region src/recorder/addon/config-store.ts
 /**
+* Per-device recording-config persistence for the recorder addon.
+*
+* ONE ROW PER CAMERA in `recorder:recording-configs`, through
+* {@link RowMapStore}. Asking what camera 617 records is a primary-key lookup;
+* saving its config writes that row and touches no other.
+*
+* ## What this replaced, and why
+*
+* Until the 2026-08-19 flatten every camera's `RecordingConfig` lived in ONE
+* key of the recorder's `addon-settings` / `root` blob — a row that was 201 833
+* bytes on the reference hub, because the ops-log and the export history shared
+* it. So `loadDeviceConfig(617)` read and `JSON.parse`d 201 KB, and
+* `saveDeviceConfig` read that, merged, and rewrote it. The staging walk did it
+* once per device and lost 45–267 s of a boot to it (2026-08-18); teaching the
+* walk to read the map once capped the symptom, and this removes the cause.
+*
+* ## Failure direction
+*
+* `RecordingConfigSchema` rejects unknown keys so a stale caller fails loudly,
+* but a row written by an older build may still carry retired ones — `.strip()`
+* drops them. And validation is now PER ROW: one unparseable camera costs that
+* camera, where the blob's single `safeParse` took every camera down to the
+* empty fallback (= the whole fleet silently unconfigured).
+*/
+/**
 * @durable class=config owner=recorder
 *   write="one row per camera, written by `saveDeviceConfig` (the `recording` cap's
 *     setConfig / band authoring) — the only writer"
@@ -3893,7 +3918,7 @@ var CalendarIndex = class {
 var RECORDING_CONFIGS_COLLECTION = "recorder:recording-configs";
 var RECORDING_CONFIGS_SPEC = {
 	collection: RECORDING_CONFIGS_COLLECTION,
-	schema: require_dist.RecordingConfigSchema.strip(),
+	schema: require_dist.preprocess((raw) => require_dist.migrateLegacyDeviceSignalConfig(raw).value, require_dist.RecordingConfigSchema.strip()).transform((config) => require_dist.stripRetiredBandPreBufferSec(config).config),
 	columns: [
 		{
 			name: "deviceId",
@@ -3925,7 +3950,7 @@ var DEFAULT_DEVICE_CONFIG = {
 };
 /** Build the handle. `declare()` MUST run once at boot before any read/write. */
 function recordingConfigsState(store, logger) {
-	return new require_retire_root_keys.RowMapStore({
+	return new require_prebuffer.RowMapStore({
 		spec: RECORDING_CONFIGS_SPEC,
 		store,
 		logger
@@ -3959,7 +3984,10 @@ async function loadDeviceConfig(state, deviceId) {
 */
 function deviceIdsWithLostBands(configs) {
 	const lost = [];
-	for (const [deviceId, config] of configs) if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	for (const [deviceId, config] of configs) {
+		if (config.deviceDecision === true) continue;
+		if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	}
 	return lost.toSorted((a, b) => a - b);
 }
 /** Boot-time check: log the {@link deviceIdsWithLostBands} once, if any. */
@@ -3969,6 +3997,48 @@ async function warnLostBands(state, logger) {
 	logger.warn(`recording config: device(s) ${lost.join(", ")} claim a recording mode but have NO bands — a pre-retirement config that lost its legacy authoring fields. Nothing is recorded for them until their bands are re-authored.`);
 }
 /**
+* Persist the D371→D380 shape for every stored row — the migration, in code,
+* run once per boot and IDEMPOTENT: a second run finds no legacy key and
+* writes nothing.
+*
+* It reads the rows RAW ({@link RowMapStore.readAllRaw}) on purpose. The read
+* schema already migrates in memory, so by the time `readAll` answers there is
+* nothing left to recognise — and the retired key is stripped by a non-strict
+* `z.object`, so the migration would look like it had nothing to do on exactly
+* the row it exists for.
+*
+* Both outcomes are logged, because both change what a camera records and
+* silence would read as "nothing happened" — which is what a stripped key
+* looks like from the outside.
+*/
+async function migrateLegacyDeviceSignalRows(state, logger) {
+	const migrated = [];
+	const stripped = [];
+	for (const [key, raw] of await state.readAllRaw()) {
+		const outcome = require_dist.migrateLegacyDeviceSignalConfig(raw);
+		if (!outcome.migrated && !outcome.strippedOnly) continue;
+		const deviceId = Number(key);
+		if (!Number.isInteger(deviceId)) continue;
+		const parsed = require_dist.RecordingConfigSchema.strip().safeParse(outcome.value);
+		if (!parsed.success) {
+			logger.warn("recording config: legacy device-signal row could not be migrated", {
+				tags: { deviceId },
+				meta: { error: parsed.error.message }
+			});
+			continue;
+		}
+		await saveDeviceConfig(state, deviceId, parsed.data);
+		if (outcome.migrated) migrated.push(deviceId);
+		else stripped.push(deviceId);
+	}
+	if (migrated.length > 0) logger.info("recording config: migrated to the on-device-decision mode (the retired band trigger)", { meta: { deviceIds: migrated } });
+	if (stripped.length > 0) logger.warn("recording config: a band mixed the retired device-signal trigger with others — the key was dropped and the band kept. These cameras no longer follow their own signal until the on-device-decision mode is selected for them.", { meta: { deviceIds: stripped } });
+	return {
+		migrated,
+		stripped
+	};
+}
+/**
 * Persist (insert or replace) a device's config — ONE row. Validates against
 * `RecordingConfigSchema` at the boundary (untrusted cap input). Returns the
 * validated config that was persisted.
@@ -5171,7 +5241,7 @@ var RECORDING_EXPORTS_SPEC = {
 };
 /** Build the handle. `declare()` MUST run once at boot before any read/write. */
 function recordingExportsState(store, logger) {
-	return new require_retire_root_keys.RowMapStore({
+	return new require_prebuffer.RowMapStore({
 		spec: RECORDING_EXPORTS_SPEC,
 		store,
 		logger
@@ -11014,7 +11084,7 @@ var RECORDING_OPS_LOG_SPEC = {
 };
 /** Build the handle. `declare()` MUST run once at boot before any read/write. */
 function recordingOpsLogState(store, logger) {
-	return new require_retire_root_keys.RowMapStore({
+	return new require_prebuffer.RowMapStore({
 		spec: RECORDING_OPS_LOG_SPEC,
 		store,
 		logger
@@ -12462,6 +12532,13 @@ function bandActiveAt(band, date) {
 	if (s > e) return applies(wd) && t >= s || applies(prevWd) && t < e;
 	return applies(wd);
 }
+/**
+* The band covering `date`, or null. GENERIC over the band type so the caller
+* gets back exactly what it put in: the recorder decides on `EffectiveBand`s
+* (`band-decision.ts`), which carry the one non-authored fact — that the DEVICE
+* decides — and a return type widened to `RecordingBand` would erase it right
+* where the gates read it.
+*/
 function activeBandAt(config, date) {
 	return config.bands.find((b) => bandActiveAt(b, date)) ?? null;
 }
@@ -12486,18 +12563,57 @@ function activeBandAt(config, date) {
 * unit-testable without ffmpeg, the broker, the event bus, or a real wall clock.
 */
 /**
-* THE one place a band's pre/post buffers are read. An ABSENT field takes
-* {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an explicit value — including `0` —
-* is honoured verbatim.
-*
-* Both callers below used to inline `?? 0`, which read "the operator omitted the
-* field" as "the operator asked for a zero-length window". For the live gate
-* that is not a policy, it is an impossibility: nothing can ever be recorded.
-* Two cameras sat in exactly that state.
+* THE band a `deviceDecision` config decides through: always on (every day,
+* `start === end` — the band engine's always-on shape), `events`, and listening
+* to exactly one source, the camera's own level.
+*
+* Its buffers are the canonical pad ({@link DEFAULT_EVENTS_BAND_BUFFER_SEC}),
+* not per-camera knobs: this mode's whole contract with the operator is ONE
+* flag. The pad only ever retains footage around an episode the device itself
+* delimited, so there is nothing here for an operator to tune.
+*/
+var DEVICE_DECISION_BAND = Object.freeze({
+	days: [],
+	start: "00:00",
+	end: "00:00",
+	mode: "events",
+	deviceSignal: true,
+	postBufferSec: require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec
+});
+/**
+* THE bands the recorder decides on for a config — the ONE place
+* `config.bands` is turned into what the gates read.
+*
+* `deviceDecision` resolves to {@link DEVICE_DECISION_BAND} and to nothing
+* else; every other config is its own authored bands, byte for byte. Because
+* the schema makes the two exclusive, this is a choice and never a merge.
+*/
+function effectiveBands(config) {
+	if (config.deviceDecision === true) return [DEVICE_DECISION_BAND];
+	return config.bands ?? [];
+}
+/**
+* THE one place a band's buffers are read.
+*
+* `postMs` is the LIVE demand window and stays a per-band setting: it decides
+* how long a writer keeps running, which is a policy about this camera at this
+* hour. An ABSENT field takes {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an
+* explicit value — including `0` — is honoured verbatim, because both callers
+* used to inline `?? 0` and read "the operator omitted the field" as "the
+* operator asked for a zero-length window", which for the live gate is not a
+* policy but an impossibility. Two cameras sat in exactly that state.
+*
+* `preMs` is NOT a setting any more (D381). It is the retroactive KEEP bound —
+* which already-written segments survive a trigger — and its only correct
+* value was ever "at least as wide as the widest history the broker can hand
+* the writer". So it IS that ceiling, read from the one place that defines it:
+* a keep gate can no longer be configured narrower than the media it is
+* supposed to keep, which is the disagreement D191 was written against and
+* which a per-band number could only ever warn about.
 */
 function resolveBandBufferMs(band) {
 	return {
-		preMs: (band.preBufferSec ?? require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.preBufferSec) * 1e3,
+		preMs: require_prebuffer.PREBUFFER_MAX_MS,
 		postMs: (band.postBufferSec ?? require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec) * 1e3
 	};
 }
@@ -12526,6 +12642,9 @@ function triggerKey(source) {
 		case "signal": return "signal";
 	}
 }
+/** The single source {@link DEVICE_DECISION_BAND} listens to, shared so the
+*  band never allocates a new one per call. */
+var SIGNAL_SOURCES = Object.freeze([{ kind: "signal" }]);
 /**
 * LE sorgenti che questa banda ascolta — l'unico posto dove i `triggers` di
 * una banda diventano `TriggerSource[]`.
@@ -12541,6 +12660,7 @@ function triggerKey(source) {
 * denuncia invece di restare zitto.
 */
 function bandTriggerSources(band) {
+	if (band.deviceSignal === true) return SIGNAL_SOURCES;
 	const t = band.triggers;
 	if (t === void 0) return [];
 	const sources = [];
@@ -12554,7 +12674,6 @@ function bandTriggerSources(band) {
 		kind: "sensor",
 		sourceDeviceId
 	});
-	if (t.deviceSignal === true) sources.push({ kind: "signal" });
 	return sources;
 }
 /**
@@ -12740,8 +12859,8 @@ function eventsBandDemanded(band, triggers, atMs) {
 */
 function shouldRecordAt(config, triggers, at) {
 	if (!config.enabled) return false;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return false;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return false;
 	const band = activeBandAt({ bands }, at);
 	if (!band) return false;
 	if (band.mode === "continuous") return true;
@@ -12996,8 +13115,8 @@ function candidateEdgesMs(bands, nowMs) {
 * costs one wasted wake-up and never costs footage.
 */
 function nextBandEdgeMs(config, nowMs) {
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const current = activeBandAt({ bands }, new Date(nowMs));
 	const candidates = [...new Set(candidateEdgesMs(bands, nowMs))].filter((ms) => ms > nowMs).toSorted((a, b) => a - b);
 	for (const ms of candidates) if (activeBandAt({ bands }, new Date(ms)) !== current) return ms;
@@ -13032,8 +13151,8 @@ function eventsWindowCloseMs(band, triggers, nowMs) {
 function nextDecisionChangeAt(input) {
 	const { config, triggers, nowMs } = input;
 	if (!config.enabled) return null;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const band = activeBandAt({ bands }, new Date(nowMs));
 	const edgeMs = nextBandEdgeMs(config, nowMs);
 	const closeMs = band === null ? null : eventsWindowCloseMs(band, triggers, nowMs);
@@ -14503,7 +14622,7 @@ var RecordingController = class {
 			const config = await this.deps.loadConfig(deviceId);
 			if (config.enabled !== true) return;
 			const nowMs = this.now();
-			const band = activeBandAt({ bands: config.bands ?? [] }, new Date(nowMs));
+			const band = activeBandAt({ bands: effectiveBands(config) }, new Date(nowMs));
 			if (!band || band.mode !== "events") return;
 			const { postMs } = resolveBandBufferMs(band);
 			const sinceMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
@@ -14910,7 +15029,7 @@ var RecordingController = class {
 		if (this.stopped) return;
 		let band;
 		try {
-			band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 		} catch (err) {
 			this.deps.logger.warn("recorder: audio trigger qualification skipped — config read failed", {
 				tags: { deviceId },
@@ -14935,7 +15054,7 @@ var RecordingController = class {
 	*/
 	async postBufferMsFor(deviceId, atMs) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 			if (band) return resolveBandBufferMs(band).postMs;
 		} catch (err) {
 			this.deps.logger.warn("recorder: trigger history using the DEFAULT post-buffer — config read failed", {
@@ -15026,7 +15145,7 @@ var RecordingController = class {
 	reportUnrecordable(deviceId, config) {
 		if (!config.enabled) return;
 		if (this.unrecordableReported.has(deviceId)) return;
-		const bands = config.bands ?? [];
+		const bands = effectiveBands(config);
 		if (bands.length === 0) {
 			this.unrecordableReported.add(deviceId);
 			this.deps.logger.warn("recorder: device is enabled but has no recording bands — nothing will ever be recorded", { tags: { deviceId } });
@@ -15363,7 +15482,7 @@ var RecordingController = class {
 	*/
 	async handleFinalizedSegment(deviceId, profile, placement, attach, startMs, durMs, flatAbsPath) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(startMs + durMs));
 			const triggers = this.triggersFor(deviceId);
 			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, triggers, attach)) {
 				this.reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs);
@@ -17367,7 +17486,9 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				watchIntervalMs: this.config.watchIntervalMs
 			}
 		});
-		warnLostBands(this.configStore(), this.ctx.logger);
+		migrateLegacyDeviceSignalRows(this.configStore(), this.ctx.logger).catch((err) => {
+			this.ctx.logger.warn("recorder: device-signal config migration failed", { meta: { error: require_dist.errMsg(err) } });
+		}).then(() => warnLostBands(this.configStore(), this.ctx.logger));
 		const providers = [
 			{
 				capability: require_dist.recordingCapability,
@@ -18289,7 +18410,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*/
 	async purgeFlattenedSettingsKeys() {
 		try {
-			await require_retire_root_keys.retireRootKeys({
+			await require_prebuffer.retireRootKeys({
 				store: this.ctx.api.settingsStore,
 				addonId: RECORDER_ADDON_ID,
 				logger: this.ctx.logger,

package/dist/recorder/index.mjs

@@ -1,9 +1,9 @@
-import { $t as number, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Et as errMsg, Ft as DeviceFeature, Gt as selectAssignedProfileSlots, H as deriveBatteryPresence, Ht as nodePin, It as DeviceType, Jt as array, Kt as sleep$1, Nt as BaseAddon, P as batteryCapability, R as customAction, Rt as hydrateSchema, St as storageEvictableCapability, T as RECORDING_EXPORT_MAX_READ_BYTES, V as defineCustomActions, W as deriveRecordingMode, Y as evaluateSensorEdge, Yt as boolean, bt as resolveRecordingProfiles, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as object, et as isFirstLevelMacroClass, g as ExportRecordSchema, gt as recordingSignalCapability, ht as recordingExportCapability, i as BatteryStatusSchema, in as EventCategory, mt as recordingCapability, nn as string, qt as _enum, tn as record, tt as loadContributionCapability, x as OpsLogEntrySchema } from "../dist-mYDK58Jp.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-xRsaPwBa.mjs";
+import { Bt as hydrateSchema, Ct as storageEvictableCapability, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Ft as BaseAddon, H as deriveBatteryPresence, Jt as sleep$1, Lt as DeviceFeature, Ot as errMsg, P as batteryCapability, R as customAction, Rt as DeviceType, T as RECORDING_EXPORT_MAX_READ_BYTES, Tt as stripRetiredBandPreBufferSec, V as defineCustomActions, W as deriveRecordingMode, Wt as nodePin, Xt as array, Y as evaluateSensorEdge, Yt as _enum, Zt as boolean, _t as recordingSignalCapability, an as string, at as migrateLegacyDeviceSignalConfig, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, et as isFirstLevelMacroClass, g as ExportRecordSchema, gt as recordingExportCapability, ht as recordingCapability, i as BatteryStatusSchema, in as record, nn as object, qt as selectAssignedProfileSlots, rn as preprocess, sn as EventCategory, tn as number, tt as loadContributionCapability, x as OpsLogEntrySchema, xt as resolveRecordingProfiles } from "../dist-oFIHnD88.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-B4zETsJ9.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
-import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DMolfhsP.mjs";
+import { a as retireRootKeys, o as RowMapStore, t as PREBUFFER_MAX_MS } from "../prebuffer-DmBYRQWg.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";
 import path from "node:path";
@@ -3879,6 +3879,31 @@ var CalendarIndex = class {
 //#endregion
 //#region src/recorder/addon/config-store.ts
 /**
+* Per-device recording-config persistence for the recorder addon.
+*
+* ONE ROW PER CAMERA in `recorder:recording-configs`, through
+* {@link RowMapStore}. Asking what camera 617 records is a primary-key lookup;
+* saving its config writes that row and touches no other.
+*
+* ## What this replaced, and why
+*
+* Until the 2026-08-19 flatten every camera's `RecordingConfig` lived in ONE
+* key of the recorder's `addon-settings` / `root` blob — a row that was 201 833
+* bytes on the reference hub, because the ops-log and the export history shared
+* it. So `loadDeviceConfig(617)` read and `JSON.parse`d 201 KB, and
+* `saveDeviceConfig` read that, merged, and rewrote it. The staging walk did it
+* once per device and lost 45–267 s of a boot to it (2026-08-18); teaching the
+* walk to read the map once capped the symptom, and this removes the cause.
+*
+* ## Failure direction
+*
+* `RecordingConfigSchema` rejects unknown keys so a stale caller fails loudly,
+* but a row written by an older build may still carry retired ones — `.strip()`
+* drops them. And validation is now PER ROW: one unparseable camera costs that
+* camera, where the blob's single `safeParse` took every camera down to the
+* empty fallback (= the whole fleet silently unconfigured).
+*/
+/**
 * @durable class=config owner=recorder
 *   write="one row per camera, written by `saveDeviceConfig` (the `recording` cap's
 *     setConfig / band authoring) — the only writer"
@@ -3888,7 +3913,7 @@ var CalendarIndex = class {
 var RECORDING_CONFIGS_COLLECTION = "recorder:recording-configs";
 var RECORDING_CONFIGS_SPEC = {
 	collection: RECORDING_CONFIGS_COLLECTION,
-	schema: RecordingConfigSchema.strip(),
+	schema: preprocess((raw) => migrateLegacyDeviceSignalConfig(raw).value, RecordingConfigSchema.strip()).transform((config) => stripRetiredBandPreBufferSec(config).config),
 	columns: [
 		{
 			name: "deviceId",
@@ -3954,7 +3979,10 @@ async function loadDeviceConfig(state, deviceId) {
 */
 function deviceIdsWithLostBands(configs) {
 	const lost = [];
-	for (const [deviceId, config] of configs) if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	for (const [deviceId, config] of configs) {
+		if (config.deviceDecision === true) continue;
+		if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	}
 	return lost.toSorted((a, b) => a - b);
 }
 /** Boot-time check: log the {@link deviceIdsWithLostBands} once, if any. */
@@ -3964,6 +3992,48 @@ async function warnLostBands(state, logger) {
 	logger.warn(`recording config: device(s) ${lost.join(", ")} claim a recording mode but have NO bands — a pre-retirement config that lost its legacy authoring fields. Nothing is recorded for them until their bands are re-authored.`);
 }
 /**
+* Persist the D371→D380 shape for every stored row — the migration, in code,
+* run once per boot and IDEMPOTENT: a second run finds no legacy key and
+* writes nothing.
+*
+* It reads the rows RAW ({@link RowMapStore.readAllRaw}) on purpose. The read
+* schema already migrates in memory, so by the time `readAll` answers there is
+* nothing left to recognise — and the retired key is stripped by a non-strict
+* `z.object`, so the migration would look like it had nothing to do on exactly
+* the row it exists for.
+*
+* Both outcomes are logged, because both change what a camera records and
+* silence would read as "nothing happened" — which is what a stripped key
+* looks like from the outside.
+*/
+async function migrateLegacyDeviceSignalRows(state, logger) {
+	const migrated = [];
+	const stripped = [];
+	for (const [key, raw] of await state.readAllRaw()) {
+		const outcome = migrateLegacyDeviceSignalConfig(raw);
+		if (!outcome.migrated && !outcome.strippedOnly) continue;
+		const deviceId = Number(key);
+		if (!Number.isInteger(deviceId)) continue;
+		const parsed = RecordingConfigSchema.strip().safeParse(outcome.value);
+		if (!parsed.success) {
+			logger.warn("recording config: legacy device-signal row could not be migrated", {
+				tags: { deviceId },
+				meta: { error: parsed.error.message }
+			});
+			continue;
+		}
+		await saveDeviceConfig(state, deviceId, parsed.data);
+		if (outcome.migrated) migrated.push(deviceId);
+		else stripped.push(deviceId);
+	}
+	if (migrated.length > 0) logger.info("recording config: migrated to the on-device-decision mode (the retired band trigger)", { meta: { deviceIds: migrated } });
+	if (stripped.length > 0) logger.warn("recording config: a band mixed the retired device-signal trigger with others — the key was dropped and the band kept. These cameras no longer follow their own signal until the on-device-decision mode is selected for them.", { meta: { deviceIds: stripped } });
+	return {
+		migrated,
+		stripped
+	};
+}
+/**
 * Persist (insert or replace) a device's config — ONE row. Validates against
 * `RecordingConfigSchema` at the boundary (untrusted cap input). Returns the
 * validated config that was persisted.
@@ -12456,6 +12526,13 @@ function bandActiveAt(band, date) {
 	if (s > e) return applies(wd) && t >= s || applies(prevWd) && t < e;
 	return applies(wd);
 }
+/**
+* The band covering `date`, or null. GENERIC over the band type so the caller
+* gets back exactly what it put in: the recorder decides on `EffectiveBand`s
+* (`band-decision.ts`), which carry the one non-authored fact — that the DEVICE
+* decides — and a return type widened to `RecordingBand` would erase it right
+* where the gates read it.
+*/
 function activeBandAt(config, date) {
 	return config.bands.find((b) => bandActiveAt(b, date)) ?? null;
 }
@@ -12480,18 +12557,57 @@ function activeBandAt(config, date) {
 * unit-testable without ffmpeg, the broker, the event bus, or a real wall clock.
 */
 /**
-* THE one place a band's pre/post buffers are read. An ABSENT field takes
-* {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an explicit value — including `0` —
-* is honoured verbatim.
-*
-* Both callers below used to inline `?? 0`, which read "the operator omitted the
-* field" as "the operator asked for a zero-length window". For the live gate
-* that is not a policy, it is an impossibility: nothing can ever be recorded.
-* Two cameras sat in exactly that state.
+* THE band a `deviceDecision` config decides through: always on (every day,
+* `start === end` — the band engine's always-on shape), `events`, and listening
+* to exactly one source, the camera's own level.
+*
+* Its buffers are the canonical pad ({@link DEFAULT_EVENTS_BAND_BUFFER_SEC}),
+* not per-camera knobs: this mode's whole contract with the operator is ONE
+* flag. The pad only ever retains footage around an episode the device itself
+* delimited, so there is nothing here for an operator to tune.
+*/
+var DEVICE_DECISION_BAND = Object.freeze({
+	days: [],
+	start: "00:00",
+	end: "00:00",
+	mode: "events",
+	deviceSignal: true,
+	postBufferSec: DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec
+});
+/**
+* THE bands the recorder decides on for a config — the ONE place
+* `config.bands` is turned into what the gates read.
+*
+* `deviceDecision` resolves to {@link DEVICE_DECISION_BAND} and to nothing
+* else; every other config is its own authored bands, byte for byte. Because
+* the schema makes the two exclusive, this is a choice and never a merge.
+*/
+function effectiveBands(config) {
+	if (config.deviceDecision === true) return [DEVICE_DECISION_BAND];
+	return config.bands ?? [];
+}
+/**
+* THE one place a band's buffers are read.
+*
+* `postMs` is the LIVE demand window and stays a per-band setting: it decides
+* how long a writer keeps running, which is a policy about this camera at this
+* hour. An ABSENT field takes {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an
+* explicit value — including `0` — is honoured verbatim, because both callers
+* used to inline `?? 0` and read "the operator omitted the field" as "the
+* operator asked for a zero-length window", which for the live gate is not a
+* policy but an impossibility. Two cameras sat in exactly that state.
+*
+* `preMs` is NOT a setting any more (D381). It is the retroactive KEEP bound —
+* which already-written segments survive a trigger — and its only correct
+* value was ever "at least as wide as the widest history the broker can hand
+* the writer". So it IS that ceiling, read from the one place that defines it:
+* a keep gate can no longer be configured narrower than the media it is
+* supposed to keep, which is the disagreement D191 was written against and
+* which a per-band number could only ever warn about.
 */
 function resolveBandBufferMs(band) {
 	return {
-		preMs: (band.preBufferSec ?? DEFAULT_EVENTS_BAND_BUFFER_SEC.preBufferSec) * 1e3,
+		preMs: PREBUFFER_MAX_MS,
 		postMs: (band.postBufferSec ?? DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec) * 1e3
 	};
 }
@@ -12520,6 +12636,9 @@ function triggerKey(source) {
 		case "signal": return "signal";
 	}
 }
+/** The single source {@link DEVICE_DECISION_BAND} listens to, shared so the
+*  band never allocates a new one per call. */
+var SIGNAL_SOURCES = Object.freeze([{ kind: "signal" }]);
 /**
 * LE sorgenti che questa banda ascolta — l'unico posto dove i `triggers` di
 * una banda diventano `TriggerSource[]`.
@@ -12535,6 +12654,7 @@ function triggerKey(source) {
 * denuncia invece di restare zitto.
 */
 function bandTriggerSources(band) {
+	if (band.deviceSignal === true) return SIGNAL_SOURCES;
 	const t = band.triggers;
 	if (t === void 0) return [];
 	const sources = [];
@@ -12548,7 +12668,6 @@ function bandTriggerSources(band) {
 		kind: "sensor",
 		sourceDeviceId
 	});
-	if (t.deviceSignal === true) sources.push({ kind: "signal" });
 	return sources;
 }
 /**
@@ -12734,8 +12853,8 @@ function eventsBandDemanded(band, triggers, atMs) {
 */
 function shouldRecordAt(config, triggers, at) {
 	if (!config.enabled) return false;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return false;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return false;
 	const band = activeBandAt({ bands }, at);
 	if (!band) return false;
 	if (band.mode === "continuous") return true;
@@ -12990,8 +13109,8 @@ function candidateEdgesMs(bands, nowMs) {
 * costs one wasted wake-up and never costs footage.
 */
 function nextBandEdgeMs(config, nowMs) {
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const current = activeBandAt({ bands }, new Date(nowMs));
 	const candidates = [...new Set(candidateEdgesMs(bands, nowMs))].filter((ms) => ms > nowMs).toSorted((a, b) => a - b);
 	for (const ms of candidates) if (activeBandAt({ bands }, new Date(ms)) !== current) return ms;
@@ -13026,8 +13145,8 @@ function eventsWindowCloseMs(band, triggers, nowMs) {
 function nextDecisionChangeAt(input) {
 	const { config, triggers, nowMs } = input;
 	if (!config.enabled) return null;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const band = activeBandAt({ bands }, new Date(nowMs));
 	const edgeMs = nextBandEdgeMs(config, nowMs);
 	const closeMs = band === null ? null : eventsWindowCloseMs(band, triggers, nowMs);
@@ -14497,7 +14616,7 @@ var RecordingController = class {
 			const config = await this.deps.loadConfig(deviceId);
 			if (config.enabled !== true) return;
 			const nowMs = this.now();
-			const band = activeBandAt({ bands: config.bands ?? [] }, new Date(nowMs));
+			const band = activeBandAt({ bands: effectiveBands(config) }, new Date(nowMs));
 			if (!band || band.mode !== "events") return;
 			const { postMs } = resolveBandBufferMs(band);
 			const sinceMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
@@ -14904,7 +15023,7 @@ var RecordingController = class {
 		if (this.stopped) return;
 		let band;
 		try {
-			band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 		} catch (err) {
 			this.deps.logger.warn("recorder: audio trigger qualification skipped — config read failed", {
 				tags: { deviceId },
@@ -14929,7 +15048,7 @@ var RecordingController = class {
 	*/
 	async postBufferMsFor(deviceId, atMs) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 			if (band) return resolveBandBufferMs(band).postMs;
 		} catch (err) {
 			this.deps.logger.warn("recorder: trigger history using the DEFAULT post-buffer — config read failed", {
@@ -15020,7 +15139,7 @@ var RecordingController = class {
 	reportUnrecordable(deviceId, config) {
 		if (!config.enabled) return;
 		if (this.unrecordableReported.has(deviceId)) return;
-		const bands = config.bands ?? [];
+		const bands = effectiveBands(config);
 		if (bands.length === 0) {
 			this.unrecordableReported.add(deviceId);
 			this.deps.logger.warn("recorder: device is enabled but has no recording bands — nothing will ever be recorded", { tags: { deviceId } });
@@ -15357,7 +15476,7 @@ var RecordingController = class {
 	*/
 	async handleFinalizedSegment(deviceId, profile, placement, attach, startMs, durMs, flatAbsPath) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(startMs + durMs));
 			const triggers = this.triggersFor(deviceId);
 			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, triggers, attach)) {
 				this.reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs);
@@ -17361,7 +17480,9 @@ var RecorderV2Addon = class extends BaseAddon {
 				watchIntervalMs: this.config.watchIntervalMs
 			}
 		});
-		warnLostBands(this.configStore(), this.ctx.logger);
+		migrateLegacyDeviceSignalRows(this.configStore(), this.ctx.logger).catch((err) => {
+			this.ctx.logger.warn("recorder: device-signal config migration failed", { meta: { error: errMsg(err) } });
+		}).then(() => warnLostBands(this.configStore(), this.ctx.logger));
 		const providers = [
 			{
 				capability: recordingCapability,

package/dist/{segment-demux-js-CBynn9Gh.js → segment-demux-js-DLwL1vmq.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-HG5geL9t.js");
+const require_dist = require("./dist-BxP0SvPz.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {