@camstack/addon-pipeline 1.2.214 → 1.2.217

package/dist/{process-memory-CddpCDWL.mjs → process-memory-Dw3CGS3D.mjs}

@@ -1,4 +1,4 @@
-import { mt as parseProcStatus } from "./dist-DttqKvsQ.mjs";
+import { mt as parseProcStatus } from "./dist-DgeXZfwn.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-BRdyl5fE.js → process-memory-ENqmiiis.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DoHcimdu.js");
+const require_dist = require("./dist-D7hxiBnC.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/recorder/index.js

@@ -2,11 +2,10 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DoHcimdu.js");
-const require_node = require("../node-6uF72wri.js");
+const require_dist = require("../dist-D7hxiBnC.js");
+const require_node = require("../node-DDhmPcOx.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-B1Difcnq.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
@@ -1334,27 +1333,6 @@ var RecordingIndex = class {
 		return [...out.values()];
 	}
 	/**
-	* WHICH devices hold footage on any of `locationIds` — the census, without
-	* the archive.
-	*
-	* `getStorageUsage` used to answer this with `segmentsOnLocation(id)` per
-	* location: a full multi-device COPY of every row on the disk plus a sort of
-	* it (294 k rows on the live hub), to read one number off each row and throw
-	* the array away. This visits each device only until its first matching row.
-	* Same membership rule as before — a device is listed when at least one of
-	* its rows sits on one of the given locations, so footage stranded on a
-	* location id that no longer resolves stays invisible here exactly as it was.
-	* @residency archive-shaped
-	*/
-	deviceIdsOnLocations(locationIds) {
-		const out = /* @__PURE__ */ new Set();
-		for (const [deviceId, m] of this.byDevice) for (const s of m.values()) if (locationIds.has(s.locationId)) {
-			out.add(deviceId);
-			break;
-		}
-		return out;
-	}
-	/**
 	* Every RESIDENT segment on a storage location, across devices, oldest-first.
 	*
 	* ## The one that bit (D295)
@@ -6867,6 +6845,81 @@ function buildRecordingDeviceSchema() {
 		}]
 	}] };
 }
+//#endregion
+//#region src/recorder/addon/device-storage-usage.ts
+/**
+* Gap between the per-camera sum and the per-volume total that is worth
+* saying out loud, as a share of the volume total.
+*
+* The two are aggregations of the SAME hour rows over the same location set —
+* one folded per camera, one summed in SQL — so in a healthy recorder they
+* agree to the byte. A few tenths of a percent is a write landing between the
+* two reads; 97% (60.5 GB against 1.9 TB) is the defect this file closes,
+* rebuilt somewhere new.
+*/
+var USAGE_MISMATCH_SHARE = .02;
+/** Floor under {@link USAGE_MISMATCH_SHARE} so a nearly empty disk does not
+*  warn on a single in-flight segment. */
+var USAGE_MISMATCH_FLOOR_BYTES = 1e9;
+/**
+* One row per camera the ARCHIVE holds footage for on `locationIds`, biggest
+* first (deviceId breaks a tie, so two consecutive calls compare).
+*
+* A node with no ledger REFUSES (D295 rule 3): empty rows, `read:
+* 'unavailable'`, and a line saying so. Falling back to the index would answer
+* the same question with the wrong quantity and look exactly like a correct
+* answer, which is how this shipped in the first place.
+*/
+function buildDeviceUsage(input) {
+	if (input.archive === null) {
+		input.logger.warn("recorder: no hour ledger on this node — the per-camera storage rows are UNANSWERED, not empty", { meta: { locations: [...input.locationIds].toSorted().join(",") } });
+		return {
+			devices: [],
+			totalUsedBytes: 0,
+			read: "unavailable"
+		};
+	}
+	const devices = [];
+	let totalUsedBytes = 0;
+	for (const [deviceId, archived] of input.archive) {
+		const resident = input.resident(deviceId);
+		totalUsedBytes += archived.bytes;
+		devices.push({
+			deviceId,
+			usedBytes: archived.bytes,
+			oldestMs: archived.oldestMs,
+			segments: archived.segments,
+			residentBytes: resident.bytes,
+			residentOldestMs: resident.oldestMs
+		});
+	}
+	return {
+		devices: devices.toSorted((a, b) => b.usedBytes - a.usedBytes || a.deviceId - b.deviceId),
+		totalUsedBytes,
+		read: "archive"
+	};
+}
+/**
+* Say it when the per-camera sum and the per-volume total disagree.
+*
+* The "I saw N of M" rule of D295, applied to a REPORT: these two numbers are
+* the same rows counted two ways, so a gap means one of the two reads saw a
+* fraction of the archive — and the whole point of D418 is that a page which
+* shows both without comparing them lets a 97% gap read as a fact about the
+* disks.
+*/
+function warnOnUsageMismatch(logger, deviceBytes, volumeBytes, read) {
+	if (read !== "archive") return;
+	if (volumeBytes === 0) return;
+	const gap = Math.abs(volumeBytes - deviceBytes);
+	if (gap <= USAGE_MISMATCH_FLOOR_BYTES) return;
+	if (gap <= volumeBytes * USAGE_MISMATCH_SHARE) return;
+	logger.warn("recorder: the per-camera storage sum disagrees with the per-volume total — one of the two reads saw a fraction of the archive", { meta: {
+		deviceBytes,
+		volumeBytes,
+		gap
+	} });
+}
 /** The placement-store key for one (camera, profile). Mirrors `assignmentKey`
 *  in `placement-store.ts`; kept local so this module stays dependency-free. */
 function sourceKey(source) {
@@ -7454,18 +7507,15 @@ function buildRecordingProvider(deps) {
 		getPlaybackManifest: ({ deviceId, fromMs, toMs }) => buildPlaybackManifest(deps, codecCache, deviceId, fromMs, toMs),
 		getStorageUsage: async () => {
 			const locations = deps.locations();
-			const devices = [];
-			const seenDevices = deps.index.deviceIdsOnLocations(new Set(locations.map((l) => l.id)));
-			let totalUsedBytes = 0;
-			for (const deviceId of seenDevices) {
-				const accounting = deps.index.accounting(deviceId);
-				totalUsedBytes += accounting.bytes;
-				devices.push({
-					deviceId,
-					usedBytes: accounting.bytes,
-					oldestMs: accounting.oldestMs
-				});
-			}
+			const locationIds = new Set(locations.map((l) => l.id));
+			const deviceUsage = buildDeviceUsage({
+				locationIds,
+				archive: deps.archiveDeviceUsage?.(locationIds) ?? null,
+				resident: (deviceId) => deps.index.accounting(deviceId),
+				logger: deps.logger
+			});
+			const devices = deviceUsage.devices;
+			const totalUsedBytes = deviceUsage.totalUsedBytes;
 			const byPhysical = /* @__PURE__ */ new Map();
 			for (const loc of locations) {
 				const key = physicalRootKey(loc.root);
@@ -7494,11 +7544,12 @@ function buildRecordingProvider(deps) {
 					totalBytes: cap.totalBytes
 				};
 			}));
-			devices.sort((a, b) => b.usedBytes - a.usedBytes);
+			warnOnUsageMismatch(deps.logger, totalUsedBytes, locationUsages.reduce((sum, l) => sum + l.usedBytes, 0), deviceUsage.read);
 			return {
 				nodeId: deps.nodeId,
 				totalUsedBytes,
-				devices,
+				devices: [...devices],
+				devicesRead: deviceUsage.read,
 				locations: locationUsages
 			};
 		},
@@ -8392,6 +8443,14 @@ var DurableLedger = class DurableLedger {
 //#endregion
 //#region src/recorder/addon/segment-hour-ledger.ts
 var HOUR_MS$3 = 36e5;
+/** `Math.min` where a missing left operand means "nothing yet", not `NaN`. */
+function minOf(a, b) {
+	return a === null ? b : Math.min(a, b);
+}
+/** `Math.max` with the same rule as {@link minOf}. */
+function maxOf(a, b) {
+	return a === null ? b : Math.max(a, b);
+}
 var macrotask$1 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
@@ -9042,7 +9101,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*
 	* The reader repairs the durable index it just reconstructed, so the next
 	* cold read of this hour is a point read instead of another `readdir`
-	* (`docs/design/2026-08-29-scrypted-nvr-recording-model.md` §4.2). Two
+	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2). Two
 	* constraints, both enforced by the caller and re-stated here because
 	* getting either wrong turns a READ into durable damage: the hour must be
 	* CLOSED (a live hour's directory races the writer, so a walk of it is a
@@ -9275,6 +9334,53 @@ var SegmentHourLedger = class SegmentHourLedger {
 		for (const row of this.ledger.snapshot()) if (locationIds.has(row.locationId)) out.add(row.deviceId);
 		return out;
 	}
+	/**
+	* Bytes / segments / oldest / newest per CAMERA on these locations — the
+	* per-camera half of the storage page, answered by the ARCHIVE (D418).
+	*
+	* ## Why the T1 fold and not `census({ deviceId })` per camera
+	*
+	* `census` is the right authority for a SCOPE, and it cannot express this
+	* scope: {@link SegmentHourLedger.predicate} takes ONE `locationId`, so
+	* "camera 615 across the three resolvable volumes" is three aggregates, and
+	* `census({ deviceId })` alone would silently count footage stranded on a
+	* location id that no longer resolves — bytes no volume row on the same page
+	* accounts for. Per camera per volume that is `cameras × volumes` SQL
+	* aggregates for one operator click, and it grows with the fleet.
+	*
+	* The T1 hour summary answers all of them in ONE pass with no I/O, exactly
+	* as {@link devicesWithFootage} and {@link profilesWithFootage} already do,
+	* and it is the same rows `accountingForLocations` sums in SQL — the mirror
+	* is write-behind, so it is never BEHIND the store. The cost is one pass
+	* over the hour rows the mirror holds — O(writers × profiles × hours), ~19 k
+	* on the live hub (see {@link REPAIR_MAX_ROWS}) against 98 445 segments,
+	* i.e. it does NOT scale with the segment count — and it is capped for good
+	* by {@link SEGMENT_HOUR_SUMMARY_LIMIT}, the mirror's own ceiling.
+	*
+	* ## What an empty answer means
+	*
+	* The same thing it means for {@link devicesWithFootage}: "the mirror knows
+	* no hour here" — which is also what a ledger whose load failed reports. The
+	* caller must not render that as "no camera has footage"; `getStorageUsage`
+	* cross-checks the per-camera sum against the volume aggregate and SAYS so
+	* when the two disagree.
+	*/
+	usageByDevice(locationIds) {
+		const out = /* @__PURE__ */ new Map();
+		if (locationIds.size === 0) return out;
+		for (const row of this.ledger.snapshot()) {
+			if (!locationIds.has(row.locationId)) continue;
+			const empty = row.segments === 0;
+			const prev = out.get(row.deviceId);
+			out.set(row.deviceId, {
+				bytes: (prev?.bytes ?? 0) + row.bytes,
+				segments: (prev?.segments ?? 0) + row.segments,
+				oldestMs: empty ? prev?.oldestMs ?? null : minOf(prev?.oldestMs ?? null, row.minStartMs),
+				newestMs: empty ? prev?.newestMs ?? null : maxOf(prev?.newestMs ?? null, row.maxStartMs)
+			});
+		}
+		return out;
+	}
 	async oldestSegmentsScoped(locationIds, deviceIds, targetBytes) {
 		const ids = [...locationIds];
 		if (ids.length === 0 || targetBytes <= 0) return {
@@ -14534,7 +14640,7 @@ var RecordingController = class {
 	/**
 	* The ADAPTIVE attach bound. A transient `spawn ffmpeg` failure (EAGAIN) is
 	* the host saying it cannot fork right now, and the answer is to attach
-	* FEWER cameras at once — not to serialise them, which `e2fa17a2b` removed
+	* FEWER cameras at once — not to serialise them, which removed
 	* for good reason. Every bounded-parallel attach in this file reads it.
 	*/
 	spawnPressure;
@@ -16039,7 +16145,7 @@ function selectRedundantSegments(segs) {
 * The pruner that used to remove it, `runRedundancyJanitor`, was reachable ONLY
 * from `runFullArchiveWalk`, which was reachable only from
 * `scheduleDeferredFullWalk`, which had no caller at all — so on 2026-08-27
-* (commit `9308428b4`) all three were deleted together as dead code. That was
+* all three were deleted together as dead code. That was
 * correct about the walk and left the system with **no duplicate pruner
 * whatsoever**. The precedent for letting this class of waste run unattended is
 * the 179 GB of stranded staging segments in `staging-reconcile.ts`.
@@ -16983,11 +17089,15 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	/**
 	* Stops the GC-attributing stall monitor armed in {@link onInitialize}.
 	*
-	* REUSED, not re-implemented, and not promoted: `startEventLoopStallMonitor`
-	* already ships inside `@camstack/addon-pipeline` — the same bundle as this
-	* addon — and moving it into `@camstack/system` would duplicate a mechanism
-	* that already exists (forbidden) or relocate it across a package boundary,
-	* which is a refactor with a slower ship chain, not a measurement.
+	* REUSED, never re-implemented. It used to live next door in this bundle;
+	* on 2026-09-09 it moved to `@camstack/system/addon-utils` (the subpath, never
+	* the barrel — that one drags the kernel into the runner) because two more
+	* processes that do NOT share this bundle needed it — `pipeline-analytics` and
+	* hub-main — and a per-bundle copy is how two diagnostics end up disagreeing
+	* about the same freeze. The cost of the move is a slower ship chain: this
+	* import is host-resolved, so a `camstack deploy` of this addon onto a hub
+	* whose server closure predates the export fails to load. Deploy order is
+	* closure first, addons second. See D417.
 	*/
 	stopStallMonitor = null;
 	/**
@@ -17188,7 +17298,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		} });
 	}
 	async onInitialize() {
-		this.stopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor(this.ctx.logger);
+		this.stopStallMonitor = (0, _camstack_system_addon_utils.startEventLoopStallMonitor)(this.ctx.logger);
 		const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
 		this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
 		const configuredNode = this.config.recordingNodeId;
@@ -17446,6 +17556,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
+			archiveDeviceUsage: (locationIds) => this.segmentHours?.usageByDevice(locationIds) ?? null,
 			archive: () => this.segmentHours,
 			ledgerWalk: this.ledgerWalkReconciler(),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),

package/dist/recorder/index.mjs

@@ -1,15 +1,14 @@
-import { At as storageEvictableCapability, Ct as recordingSignalCapability, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Et as resolveLocationMode, Gt as DeviceFeature, H as deriveBatteryPresence, It as errMsg, Jt as hydrateSchema, Kt as DeviceType, Nt as stripRetiredBandPreBufferSec, Ot as resolveRecordingProfiles, P as batteryCapability, Q as evictionPolicyOfLocation, Qt as nodePin, R as customAction, St as recordingExportCapability, T as RECORDING_EXPORT_MAX_READ_BYTES, Ut as BaseAddon, V as defineCustomActions, W as deriveRecordingMode, Y as evaluateSensorEdge, Z as evictionPolicyForMode, an as boolean, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dn as preprocess, dt as modeMayWrite, et as gbToBytes, fn as record, g as ExportRecordSchema, hn as EventCategory, i as BatteryStatusSchema, in as array, it as loadContributionCapability, jt as storageOccupancyCapability, ln as number, lt as mayWriteToLocation, nn as sleep$1, pn as string, rn as _enum, rt as isFirstLevelMacroClass, tn as selectAssignedProfileSlots, un as object, ut as migrateLegacyDeviceSignalConfig, x as OpsLogEntrySchema, xt as recordingCapability } from "../dist-DttqKvsQ.mjs";
-import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-NtM7__8q.mjs";
+import { At as storageEvictableCapability, Ct as recordingSignalCapability, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Et as resolveLocationMode, Gt as DeviceFeature, H as deriveBatteryPresence, It as errMsg, Jt as hydrateSchema, Kt as DeviceType, Nt as stripRetiredBandPreBufferSec, Ot as resolveRecordingProfiles, P as batteryCapability, Q as evictionPolicyOfLocation, Qt as nodePin, R as customAction, St as recordingExportCapability, T as RECORDING_EXPORT_MAX_READ_BYTES, Ut as BaseAddon, V as defineCustomActions, W as deriveRecordingMode, Y as evaluateSensorEdge, Z as evictionPolicyForMode, an as boolean, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dn as preprocess, dt as modeMayWrite, et as gbToBytes, fn as record, g as ExportRecordSchema, hn as EventCategory, i as BatteryStatusSchema, in as array, it as loadContributionCapability, jt as storageOccupancyCapability, ln as number, lt as mayWriteToLocation, nn as sleep$1, pn as string, rn as _enum, rt as isFirstLevelMacroClass, tn as selectAssignedProfileSlots, un as object, ut as migrateLegacyDeviceSignalConfig, x as OpsLogEntrySchema, xt as recordingCapability } from "../dist-DgeXZfwn.mjs";
+import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-C9GcBrwk.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { c as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-DWe2kInY.mjs";
-import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { open } from "node:fs/promises";
-import { contentTypeFor, createFileDataPlaneHandler, parseRangeHeader } from "@camstack/system/addon-utils";
+import { contentTypeFor, createFileDataPlaneHandler, parseRangeHeader, startEventLoopStallMonitor } from "@camstack/system/addon-utils";
 //#region src/recorder/event-capture.ts
 /**
 * La sottoscrizione motion del recorder: bus → `onTrigger(deviceId, atMs)`.
@@ -1329,27 +1328,6 @@ var RecordingIndex = class {
 		return [...out.values()];
 	}
 	/**
-	* WHICH devices hold footage on any of `locationIds` — the census, without
-	* the archive.
-	*
-	* `getStorageUsage` used to answer this with `segmentsOnLocation(id)` per
-	* location: a full multi-device COPY of every row on the disk plus a sort of
-	* it (294 k rows on the live hub), to read one number off each row and throw
-	* the array away. This visits each device only until its first matching row.
-	* Same membership rule as before — a device is listed when at least one of
-	* its rows sits on one of the given locations, so footage stranded on a
-	* location id that no longer resolves stays invisible here exactly as it was.
-	* @residency archive-shaped
-	*/
-	deviceIdsOnLocations(locationIds) {
-		const out = /* @__PURE__ */ new Set();
-		for (const [deviceId, m] of this.byDevice) for (const s of m.values()) if (locationIds.has(s.locationId)) {
-			out.add(deviceId);
-			break;
-		}
-		return out;
-	}
-	/**
 	* Every RESIDENT segment on a storage location, across devices, oldest-first.
 	*
 	* ## The one that bit (D295)
@@ -6861,6 +6839,81 @@ function buildRecordingDeviceSchema() {
 		}]
 	}] };
 }
+//#endregion
+//#region src/recorder/addon/device-storage-usage.ts
+/**
+* Gap between the per-camera sum and the per-volume total that is worth
+* saying out loud, as a share of the volume total.
+*
+* The two are aggregations of the SAME hour rows over the same location set —
+* one folded per camera, one summed in SQL — so in a healthy recorder they
+* agree to the byte. A few tenths of a percent is a write landing between the
+* two reads; 97% (60.5 GB against 1.9 TB) is the defect this file closes,
+* rebuilt somewhere new.
+*/
+var USAGE_MISMATCH_SHARE = .02;
+/** Floor under {@link USAGE_MISMATCH_SHARE} so a nearly empty disk does not
+*  warn on a single in-flight segment. */
+var USAGE_MISMATCH_FLOOR_BYTES = 1e9;
+/**
+* One row per camera the ARCHIVE holds footage for on `locationIds`, biggest
+* first (deviceId breaks a tie, so two consecutive calls compare).
+*
+* A node with no ledger REFUSES (D295 rule 3): empty rows, `read:
+* 'unavailable'`, and a line saying so. Falling back to the index would answer
+* the same question with the wrong quantity and look exactly like a correct
+* answer, which is how this shipped in the first place.
+*/
+function buildDeviceUsage(input) {
+	if (input.archive === null) {
+		input.logger.warn("recorder: no hour ledger on this node — the per-camera storage rows are UNANSWERED, not empty", { meta: { locations: [...input.locationIds].toSorted().join(",") } });
+		return {
+			devices: [],
+			totalUsedBytes: 0,
+			read: "unavailable"
+		};
+	}
+	const devices = [];
+	let totalUsedBytes = 0;
+	for (const [deviceId, archived] of input.archive) {
+		const resident = input.resident(deviceId);
+		totalUsedBytes += archived.bytes;
+		devices.push({
+			deviceId,
+			usedBytes: archived.bytes,
+			oldestMs: archived.oldestMs,
+			segments: archived.segments,
+			residentBytes: resident.bytes,
+			residentOldestMs: resident.oldestMs
+		});
+	}
+	return {
+		devices: devices.toSorted((a, b) => b.usedBytes - a.usedBytes || a.deviceId - b.deviceId),
+		totalUsedBytes,
+		read: "archive"
+	};
+}
+/**
+* Say it when the per-camera sum and the per-volume total disagree.
+*
+* The "I saw N of M" rule of D295, applied to a REPORT: these two numbers are
+* the same rows counted two ways, so a gap means one of the two reads saw a
+* fraction of the archive — and the whole point of D418 is that a page which
+* shows both without comparing them lets a 97% gap read as a fact about the
+* disks.
+*/
+function warnOnUsageMismatch(logger, deviceBytes, volumeBytes, read) {
+	if (read !== "archive") return;
+	if (volumeBytes === 0) return;
+	const gap = Math.abs(volumeBytes - deviceBytes);
+	if (gap <= USAGE_MISMATCH_FLOOR_BYTES) return;
+	if (gap <= volumeBytes * USAGE_MISMATCH_SHARE) return;
+	logger.warn("recorder: the per-camera storage sum disagrees with the per-volume total — one of the two reads saw a fraction of the archive", { meta: {
+		deviceBytes,
+		volumeBytes,
+		gap
+	} });
+}
 /** The placement-store key for one (camera, profile). Mirrors `assignmentKey`
 *  in `placement-store.ts`; kept local so this module stays dependency-free. */
 function sourceKey(source) {
@@ -7448,18 +7501,15 @@ function buildRecordingProvider(deps) {
 		getPlaybackManifest: ({ deviceId, fromMs, toMs }) => buildPlaybackManifest(deps, codecCache, deviceId, fromMs, toMs),
 		getStorageUsage: async () => {
 			const locations = deps.locations();
-			const devices = [];
-			const seenDevices = deps.index.deviceIdsOnLocations(new Set(locations.map((l) => l.id)));
-			let totalUsedBytes = 0;
-			for (const deviceId of seenDevices) {
-				const accounting = deps.index.accounting(deviceId);
-				totalUsedBytes += accounting.bytes;
-				devices.push({
-					deviceId,
-					usedBytes: accounting.bytes,
-					oldestMs: accounting.oldestMs
-				});
-			}
+			const locationIds = new Set(locations.map((l) => l.id));
+			const deviceUsage = buildDeviceUsage({
+				locationIds,
+				archive: deps.archiveDeviceUsage?.(locationIds) ?? null,
+				resident: (deviceId) => deps.index.accounting(deviceId),
+				logger: deps.logger
+			});
+			const devices = deviceUsage.devices;
+			const totalUsedBytes = deviceUsage.totalUsedBytes;
 			const byPhysical = /* @__PURE__ */ new Map();
 			for (const loc of locations) {
 				const key = physicalRootKey(loc.root);
@@ -7488,11 +7538,12 @@ function buildRecordingProvider(deps) {
 					totalBytes: cap.totalBytes
 				};
 			}));
-			devices.sort((a, b) => b.usedBytes - a.usedBytes);
+			warnOnUsageMismatch(deps.logger, totalUsedBytes, locationUsages.reduce((sum, l) => sum + l.usedBytes, 0), deviceUsage.read);
 			return {
 				nodeId: deps.nodeId,
 				totalUsedBytes,
-				devices,
+				devices: [...devices],
+				devicesRead: deviceUsage.read,
 				locations: locationUsages
 			};
 		},
@@ -8386,6 +8437,14 @@ var DurableLedger = class DurableLedger {
 //#endregion
 //#region src/recorder/addon/segment-hour-ledger.ts
 var HOUR_MS$3 = 36e5;
+/** `Math.min` where a missing left operand means "nothing yet", not `NaN`. */
+function minOf(a, b) {
+	return a === null ? b : Math.min(a, b);
+}
+/** `Math.max` with the same rule as {@link minOf}. */
+function maxOf(a, b) {
+	return a === null ? b : Math.max(a, b);
+}
 var macrotask$1 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
@@ -9036,7 +9095,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*
 	* The reader repairs the durable index it just reconstructed, so the next
 	* cold read of this hour is a point read instead of another `readdir`
-	* (`docs/design/2026-08-29-scrypted-nvr-recording-model.md` §4.2). Two
+	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2). Two
 	* constraints, both enforced by the caller and re-stated here because
 	* getting either wrong turns a READ into durable damage: the hour must be
 	* CLOSED (a live hour's directory races the writer, so a walk of it is a
@@ -9269,6 +9328,53 @@ var SegmentHourLedger = class SegmentHourLedger {
 		for (const row of this.ledger.snapshot()) if (locationIds.has(row.locationId)) out.add(row.deviceId);
 		return out;
 	}
+	/**
+	* Bytes / segments / oldest / newest per CAMERA on these locations — the
+	* per-camera half of the storage page, answered by the ARCHIVE (D418).
+	*
+	* ## Why the T1 fold and not `census({ deviceId })` per camera
+	*
+	* `census` is the right authority for a SCOPE, and it cannot express this
+	* scope: {@link SegmentHourLedger.predicate} takes ONE `locationId`, so
+	* "camera 615 across the three resolvable volumes" is three aggregates, and
+	* `census({ deviceId })` alone would silently count footage stranded on a
+	* location id that no longer resolves — bytes no volume row on the same page
+	* accounts for. Per camera per volume that is `cameras × volumes` SQL
+	* aggregates for one operator click, and it grows with the fleet.
+	*
+	* The T1 hour summary answers all of them in ONE pass with no I/O, exactly
+	* as {@link devicesWithFootage} and {@link profilesWithFootage} already do,
+	* and it is the same rows `accountingForLocations` sums in SQL — the mirror
+	* is write-behind, so it is never BEHIND the store. The cost is one pass
+	* over the hour rows the mirror holds — O(writers × profiles × hours), ~19 k
+	* on the live hub (see {@link REPAIR_MAX_ROWS}) against 98 445 segments,
+	* i.e. it does NOT scale with the segment count — and it is capped for good
+	* by {@link SEGMENT_HOUR_SUMMARY_LIMIT}, the mirror's own ceiling.
+	*
+	* ## What an empty answer means
+	*
+	* The same thing it means for {@link devicesWithFootage}: "the mirror knows
+	* no hour here" — which is also what a ledger whose load failed reports. The
+	* caller must not render that as "no camera has footage"; `getStorageUsage`
+	* cross-checks the per-camera sum against the volume aggregate and SAYS so
+	* when the two disagree.
+	*/
+	usageByDevice(locationIds) {
+		const out = /* @__PURE__ */ new Map();
+		if (locationIds.size === 0) return out;
+		for (const row of this.ledger.snapshot()) {
+			if (!locationIds.has(row.locationId)) continue;
+			const empty = row.segments === 0;
+			const prev = out.get(row.deviceId);
+			out.set(row.deviceId, {
+				bytes: (prev?.bytes ?? 0) + row.bytes,
+				segments: (prev?.segments ?? 0) + row.segments,
+				oldestMs: empty ? prev?.oldestMs ?? null : minOf(prev?.oldestMs ?? null, row.minStartMs),
+				newestMs: empty ? prev?.newestMs ?? null : maxOf(prev?.newestMs ?? null, row.maxStartMs)
+			});
+		}
+		return out;
+	}
 	async oldestSegmentsScoped(locationIds, deviceIds, targetBytes) {
 		const ids = [...locationIds];
 		if (ids.length === 0 || targetBytes <= 0) return {
@@ -14528,7 +14634,7 @@ var RecordingController = class {
 	/**
 	* The ADAPTIVE attach bound. A transient `spawn ffmpeg` failure (EAGAIN) is
 	* the host saying it cannot fork right now, and the answer is to attach
-	* FEWER cameras at once — not to serialise them, which `e2fa17a2b` removed
+	* FEWER cameras at once — not to serialise them, which removed
 	* for good reason. Every bounded-parallel attach in this file reads it.
 	*/
 	spawnPressure;
@@ -16033,7 +16139,7 @@ function selectRedundantSegments(segs) {
 * The pruner that used to remove it, `runRedundancyJanitor`, was reachable ONLY
 * from `runFullArchiveWalk`, which was reachable only from
 * `scheduleDeferredFullWalk`, which had no caller at all — so on 2026-08-27
-* (commit `9308428b4`) all three were deleted together as dead code. That was
+* all three were deleted together as dead code. That was
 * correct about the walk and left the system with **no duplicate pruner
 * whatsoever**. The precedent for letting this class of waste run unattended is
 * the 179 GB of stranded staging segments in `staging-reconcile.ts`.
@@ -16977,11 +17083,15 @@ var RecorderV2Addon = class extends BaseAddon {
 	/**
 	* Stops the GC-attributing stall monitor armed in {@link onInitialize}.
 	*
-	* REUSED, not re-implemented, and not promoted: `startEventLoopStallMonitor`
-	* already ships inside `@camstack/addon-pipeline` — the same bundle as this
-	* addon — and moving it into `@camstack/system` would duplicate a mechanism
-	* that already exists (forbidden) or relocate it across a package boundary,
-	* which is a refactor with a slower ship chain, not a measurement.
+	* REUSED, never re-implemented. It used to live next door in this bundle;
+	* on 2026-09-09 it moved to `@camstack/system/addon-utils` (the subpath, never
+	* the barrel — that one drags the kernel into the runner) because two more
+	* processes that do NOT share this bundle needed it — `pipeline-analytics` and
+	* hub-main — and a per-bundle copy is how two diagnostics end up disagreeing
+	* about the same freeze. The cost of the move is a slower ship chain: this
+	* import is host-resolved, so a `camstack deploy` of this addon onto a hub
+	* whose server closure predates the export fails to load. Deploy order is
+	* closure first, addons second. See D417.
 	*/
 	stopStallMonitor = null;
 	/**
@@ -17440,6 +17550,7 @@ var RecorderV2Addon = class extends BaseAddon {
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
+			archiveDeviceUsage: (locationIds) => this.segmentHours?.usageByDevice(locationIds) ?? null,
 			archive: () => this.segmentHours,
 			ledgerWalk: this.ledgerWalkReconciler(),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),

package/dist/{segment-demux-js-CsFtPVzH.mjs → segment-demux-js-BGbKlotF.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { It as errMsg } from "./dist-DttqKvsQ.mjs";
+import { It as errMsg } from "./dist-DgeXZfwn.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{segment-demux-js-CkJPdyDH.js → segment-demux-js-sLs8mbZQ.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DoHcimdu.js");
+const require_dist = require("./dist-D7hxiBnC.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {