@camstack/addon-pipeline 1.2.215 → 1.2.218

package/dist/recorder/index.mjs

@@ -1,5 +1,5 @@
-import { At as storageEvictableCapability, Ct as recordingSignalCapability, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Et as resolveLocationMode, Gt as DeviceFeature, H as deriveBatteryPresence, It as errMsg, Jt as hydrateSchema, Kt as DeviceType, Nt as stripRetiredBandPreBufferSec, Ot as resolveRecordingProfiles, P as batteryCapability, Q as evictionPolicyOfLocation, Qt as nodePin, R as customAction, St as recordingExportCapability, T as RECORDING_EXPORT_MAX_READ_BYTES, Ut as BaseAddon, V as defineCustomActions, W as deriveRecordingMode, Y as evaluateSensorEdge, Z as evictionPolicyForMode, an as boolean, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dn as preprocess, dt as modeMayWrite, et as gbToBytes, fn as record, g as ExportRecordSchema, hn as EventCategory, i as BatteryStatusSchema, in as array, it as loadContributionCapability, jt as storageOccupancyCapability, ln as number, lt as mayWriteToLocation, nn as sleep$1, pn as string, rn as _enum, rt as isFirstLevelMacroClass, tn as selectAssignedProfileSlots, un as object, ut as migrateLegacyDeviceSignalConfig, x as OpsLogEntrySchema, xt as recordingCapability } from "../dist-DttqKvsQ.mjs";
-import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-NtM7__8q.mjs";
+import { At as storageEvictableCapability, Ct as recordingSignalCapability, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Et as resolveLocationMode, Gt as DeviceFeature, H as deriveBatteryPresence, It as errMsg, Jt as hydrateSchema, Kt as DeviceType, Nt as stripRetiredBandPreBufferSec, Ot as resolveRecordingProfiles, P as batteryCapability, Q as evictionPolicyOfLocation, Qt as nodePin, R as customAction, St as recordingExportCapability, T as RECORDING_EXPORT_MAX_READ_BYTES, Ut as BaseAddon, V as defineCustomActions, W as deriveRecordingMode, Y as evaluateSensorEdge, Z as evictionPolicyForMode, an as boolean, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dn as preprocess, dt as modeMayWrite, et as gbToBytes, fn as record, g as ExportRecordSchema, hn as EventCategory, i as BatteryStatusSchema, in as array, it as loadContributionCapability, jt as storageOccupancyCapability, ln as number, lt as mayWriteToLocation, nn as sleep$1, pn as string, rn as _enum, rt as isFirstLevelMacroClass, tn as selectAssignedProfileSlots, un as object, ut as migrateLegacyDeviceSignalConfig, x as OpsLogEntrySchema, xt as recordingCapability } from "../dist-Dl6GntEh.mjs";
+import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CEyw52D2.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { c as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-DWe2kInY.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
@@ -1328,27 +1328,6 @@ var RecordingIndex = class {
 		return [...out.values()];
 	}
 	/**
-	* WHICH devices hold footage on any of `locationIds` — the census, without
-	* the archive.
-	*
-	* `getStorageUsage` used to answer this with `segmentsOnLocation(id)` per
-	* location: a full multi-device COPY of every row on the disk plus a sort of
-	* it (294 k rows on the live hub), to read one number off each row and throw
-	* the array away. This visits each device only until its first matching row.
-	* Same membership rule as before — a device is listed when at least one of
-	* its rows sits on one of the given locations, so footage stranded on a
-	* location id that no longer resolves stays invisible here exactly as it was.
-	* @residency archive-shaped
-	*/
-	deviceIdsOnLocations(locationIds) {
-		const out = /* @__PURE__ */ new Set();
-		for (const [deviceId, m] of this.byDevice) for (const s of m.values()) if (locationIds.has(s.locationId)) {
-			out.add(deviceId);
-			break;
-		}
-		return out;
-	}
-	/**
 	* Every RESIDENT segment on a storage location, across devices, oldest-first.
 	*
 	* ## The one that bit (D295)
@@ -3833,6 +3812,40 @@ async function segmentsOfHour(root, deviceId, profile, hourStartMs) {
 * the directory route serve the profile the client asked for when it exists,
 * and fall back to the availability pick when it does not.
 */
+/**
+* EVERY profile this camera holds footage in, across every root.
+*
+* {@link availabilityProfile} deliberately returns ONE — the timeline is a
+* single bar. That is right for the bar and wrong for the ANSWER: on
+* 2026-09-10 `getAvailability` reported twenty `high` ranges for camera 615
+* and the conclusion drawn was that this deployment records no `low` at all,
+* while `/media-fast/recordingsLow/615/low/` held 14 GB on a different
+* location (D433).
+*
+* Unions across roots for exactly that reason: `high` and `low` do not share a
+* location here, so a per-root answer sees one of them.
+*
+* Non-emptiness, not existence — the same rule {@link availabilityProfile}
+* keeps, so a directory left behind by a config change is not offered. And
+* only {@link KNOWN_PROFILES}: the camera dir also hosts `events/` and the
+* retired `strips/` trees, which a walker that trusts readdir would present as
+* playable.
+*
+* `list` is injectable for the test; production passes the module's own
+* directory read.
+*/
+async function profilesWithFootage(roots, deviceId, list = listDir) {
+	const found = /* @__PURE__ */ new Set();
+	for (const root of roots) {
+		const entries = await list(path.join(root, String(deviceId)));
+		for (const entry of entries) {
+			if (!KNOWN_PROFILES$1.has(entry)) continue;
+			if (found.has(entry)) continue;
+			if ((await list(path.join(root, String(deviceId), entry))).length > 0) found.add(entry);
+		}
+	}
+	return [...found].sort();
+}
 async function profileHasFootage(root, deviceId, profile) {
 	return (await listDir(path.join(root, String(deviceId), profile))).length > 0;
 }
@@ -3954,6 +3967,8 @@ var CalendarIndex = class {
 	segsReadAt = /* @__PURE__ */ new Map();
 	/** The profile availability reads from, resolved once per device. */
 	profileFor = /* @__PURE__ */ new Map();
+	profilesFor = /* @__PURE__ */ new Map();
+	profilesInFlight = /* @__PURE__ */ new Map();
 	/** `deviceId:profile` → whether the device records that profile, resolved
 	*  once. Same stability trade as {@link profileFor}: a config change that
 	*  adds a profile mid-session is picked up on restart, not on a timer. */
@@ -4236,6 +4251,31 @@ var CalendarIndex = class {
 	* reads at a time and they ALL ask for the profile before the first answer
 	* lands, so a cache alone let the pick run eight times. Parallelism found it.
 	*/
+	/**
+	* Every profile this camera holds footage in, across every root — cached
+	* like the pick, because it is the same shallow read (D433).
+	*
+	* {@link availabilityProfileFor} answers with ONE; this says what the one
+	* was chosen FROM, so a caller cannot mistake the timeline's single bar for
+	* the whole archive.
+	*/
+	async profilesWithFootageFor(deviceId) {
+		const cached = this.profilesFor.get(deviceId);
+		if (cached !== void 0) return cached;
+		const running = this.profilesInFlight.get(deviceId);
+		if (running) return running;
+		const resolve = (async () => {
+			const found = await profilesWithFootage(this.deps.roots(), deviceId);
+			this.profilesFor.set(deviceId, found);
+			return found;
+		})();
+		this.profilesInFlight.set(deviceId, resolve);
+		try {
+			return await resolve;
+		} finally {
+			if (this.profilesInFlight.get(deviceId) === resolve) this.profilesInFlight.delete(deviceId);
+		}
+	}
 	async availabilityProfileFor(deviceId) {
 		const cached = this.profileFor.get(deviceId);
 		if (cached !== void 0) return cached;
@@ -5879,6 +5919,8 @@ var TIME_RE = /time=(\d+):(\d+):(\d+(?:\.\d+)?)/;
 * whatever ffmpeg build is installed.
 */
 var EXPORT_MIN_PLAUSIBLE_BYTES = 1024;
+/** ffmpeg's own announcement of that pass — the only signal it gives. */
+var FASTSTART_RE = /Starting second pass: moving the moov atom/i;
 /** Expected OUTPUT duration (seconds) for progress scaling. */
 function expectedOutSeconds(rec) {
 	const rangeSec = Math.max(.001, (rec.toMs - rec.fromMs) / 1e3);
@@ -6188,6 +6230,7 @@ var ExportEngine = class {
 			args
 		} });
 		const stallMs = this.deps.stallMs ?? 9e4;
+		const faststartStallMs = this.deps.faststartStallMs ?? 9e5;
 		return new Promise((resolve) => {
 			const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
 			this.active.set(id, proc);
@@ -6199,14 +6242,16 @@ var ExportEngine = class {
 					stallTimer = null;
 				}
 			};
+			let budgetMs = stallMs;
 			const armStall = () => {
 				clearStall();
+				const armedFor = budgetMs;
 				stallTimer = setTimeout(() => {
-					stderrTail.push(`ffmpeg stalled: no progress for ${stallMs}ms`);
+					stderrTail.push(`ffmpeg stalled: no progress for ${armedFor}ms`);
 					try {
 						proc.kill("SIGKILL");
 					} catch {}
-				}, stallMs);
+				}, armedFor);
 			};
 			armStall();
 			proc.stderr?.on("data", (chunk) => {
@@ -6217,6 +6262,10 @@ var ExportEngine = class {
 						stderrTail.push(trimmed);
 						if (stderrTail.length > STDERR_TAIL_LINES$1) stderrTail.shift();
 					}
+					if (FASTSTART_RE.test(line)) {
+						budgetMs = faststartStallMs;
+						armStall();
+					}
 					const m = TIME_RE.exec(line);
 					if (m) {
 						armStall();
@@ -6860,6 +6909,81 @@ function buildRecordingDeviceSchema() {
 		}]
 	}] };
 }
+//#endregion
+//#region src/recorder/addon/device-storage-usage.ts
+/**
+* Gap between the per-camera sum and the per-volume total that is worth
+* saying out loud, as a share of the volume total.
+*
+* The two are aggregations of the SAME hour rows over the same location set —
+* one folded per camera, one summed in SQL — so in a healthy recorder they
+* agree to the byte. A few tenths of a percent is a write landing between the
+* two reads; 97% (60.5 GB against 1.9 TB) is the defect this file closes,
+* rebuilt somewhere new.
+*/
+var USAGE_MISMATCH_SHARE = .02;
+/** Floor under {@link USAGE_MISMATCH_SHARE} so a nearly empty disk does not
+*  warn on a single in-flight segment. */
+var USAGE_MISMATCH_FLOOR_BYTES = 1e9;
+/**
+* One row per camera the ARCHIVE holds footage for on `locationIds`, biggest
+* first (deviceId breaks a tie, so two consecutive calls compare).
+*
+* A node with no ledger REFUSES (D295 rule 3): empty rows, `read:
+* 'unavailable'`, and a line saying so. Falling back to the index would answer
+* the same question with the wrong quantity and look exactly like a correct
+* answer, which is how this shipped in the first place.
+*/
+function buildDeviceUsage(input) {
+	if (input.archive === null) {
+		input.logger.warn("recorder: no hour ledger on this node — the per-camera storage rows are UNANSWERED, not empty", { meta: { locations: [...input.locationIds].toSorted().join(",") } });
+		return {
+			devices: [],
+			totalUsedBytes: 0,
+			read: "unavailable"
+		};
+	}
+	const devices = [];
+	let totalUsedBytes = 0;
+	for (const [deviceId, archived] of input.archive) {
+		const resident = input.resident(deviceId);
+		totalUsedBytes += archived.bytes;
+		devices.push({
+			deviceId,
+			usedBytes: archived.bytes,
+			oldestMs: archived.oldestMs,
+			segments: archived.segments,
+			residentBytes: resident.bytes,
+			residentOldestMs: resident.oldestMs
+		});
+	}
+	return {
+		devices: devices.toSorted((a, b) => b.usedBytes - a.usedBytes || a.deviceId - b.deviceId),
+		totalUsedBytes,
+		read: "archive"
+	};
+}
+/**
+* Say it when the per-camera sum and the per-volume total disagree.
+*
+* The "I saw N of M" rule of D295, applied to a REPORT: these two numbers are
+* the same rows counted two ways, so a gap means one of the two reads saw a
+* fraction of the archive — and the whole point of D418 is that a page which
+* shows both without comparing them lets a 97% gap read as a fact about the
+* disks.
+*/
+function warnOnUsageMismatch(logger, deviceBytes, volumeBytes, read) {
+	if (read !== "archive") return;
+	if (volumeBytes === 0) return;
+	const gap = Math.abs(volumeBytes - deviceBytes);
+	if (gap <= USAGE_MISMATCH_FLOOR_BYTES) return;
+	if (gap <= volumeBytes * USAGE_MISMATCH_SHARE) return;
+	logger.warn("recorder: the per-camera storage sum disagrees with the per-volume total — one of the two reads saw a fraction of the archive", { meta: {
+		deviceBytes,
+		volumeBytes,
+		gap
+	} });
+}
 /** The placement-store key for one (camera, profile). Mirrors `assignmentKey`
 *  in `placement-store.ts`; kept local so this module stays dependency-free. */
 function sourceKey(source) {
@@ -7319,13 +7443,15 @@ function buildRecordingProvider(deps) {
 	* and by the batch alike — the batch collapses the TRANSPORT, and sharing the
 	* function is what makes that literally true instead of aspirational.
 	*/
-	const availabilityFor = async (deviceId, fromMs, toMs) => {
+	const availabilityFor = async (deviceId, fromMs, toMs, requestedProfile) => {
 		const calendar = deps.calendar;
 		if (calendar) {
-			const profile = await calendar.availabilityProfileFor(deviceId);
+			const profilesWithFootage = await calendar.profilesWithFootageFor(deviceId);
+			const profile = await calendar.servedProfileFor(deviceId, requestedProfile);
 			if (profile === null) return {
 				deviceId,
-				ranges: []
+				ranges: [],
+				profilesWithFootage: [...profilesWithFootage]
 			};
 			const ranges = [];
 			for (const r of await calendar.rangesIn(deviceId, profile, fromMs, toMs)) ranges.push({
@@ -7335,16 +7461,20 @@ function buildRecordingProvider(deps) {
 			});
 			return {
 				deviceId,
-				ranges
+				ranges,
+				profilesWithFootage: [...profilesWithFootage]
 			};
 		}
+		const profiles = new Set(deps.index.segments(deviceId).map((s) => s.profile));
+		const asked = requestedProfile !== void 0 && profiles.has(requestedProfile);
 		return {
 			deviceId,
-			ranges: [...new Set(deps.index.segments(deviceId).map((s) => s.profile))].flatMap((profile) => deps.index.ranges(deviceId, profile, fromMs, toMs, RANGE_MERGE_GAP_MS).map((r) => ({
+			ranges: [...profiles].filter((p) => !asked || p === requestedProfile).flatMap((profile) => deps.index.ranges(deviceId, profile, fromMs, toMs, RANGE_MERGE_GAP_MS).map((r) => ({
 				profile,
 				startMs: r.startMs,
 				endMs: r.endMs
-			})))
+			}))),
+			profilesWithFootage: [...profiles].sort()
 		};
 	};
 	/** The per-camera day read. Same rule as {@link availabilityFor}: one body. */
@@ -7374,7 +7504,7 @@ function buildRecordingProvider(deps) {
 		getStatus: async ({ deviceId }) => {
 			return statusFor(deps, deviceId, await loadDeviceConfig(deps.configStore, deviceId));
 		},
-		getAvailability: ({ deviceId, fromMs, toMs }) => availabilityFor(deviceId, fromMs, toMs),
+		getAvailability: ({ deviceId, fromMs, toMs, profile }) => availabilityFor(deviceId, fromMs, toMs, profile),
 		/**
 		* `getAvailability` for a SET of cameras. Same body per camera, run
 		* concurrently; only the transport collapses.
@@ -7388,11 +7518,12 @@ function buildRecordingProvider(deps) {
 			refuseOverCap("getAvailabilityBatch", deviceIds.length);
 			return Promise.all(deviceIds.map(async (deviceId) => {
 				try {
-					const { ranges } = await availabilityFor(deviceId, fromMs, toMs);
+					const { ranges, profilesWithFootage } = await availabilityFor(deviceId, fromMs, toMs);
 					return {
 						deviceId,
 						read: "read",
-						ranges
+						ranges,
+						profilesWithFootage
 					};
 				} catch (err) {
 					deps.logger.warn("recording availability could not be read", {
@@ -7406,7 +7537,8 @@ function buildRecordingProvider(deps) {
 					return {
 						deviceId,
 						read: "unreadable",
-						ranges: []
+						ranges: [],
+						profilesWithFootage: []
 					};
 				}
 			}));
@@ -7447,18 +7579,15 @@ function buildRecordingProvider(deps) {
 		getPlaybackManifest: ({ deviceId, fromMs, toMs }) => buildPlaybackManifest(deps, codecCache, deviceId, fromMs, toMs),
 		getStorageUsage: async () => {
 			const locations = deps.locations();
-			const devices = [];
-			const seenDevices = deps.index.deviceIdsOnLocations(new Set(locations.map((l) => l.id)));
-			let totalUsedBytes = 0;
-			for (const deviceId of seenDevices) {
-				const accounting = deps.index.accounting(deviceId);
-				totalUsedBytes += accounting.bytes;
-				devices.push({
-					deviceId,
-					usedBytes: accounting.bytes,
-					oldestMs: accounting.oldestMs
-				});
-			}
+			const locationIds = new Set(locations.map((l) => l.id));
+			const deviceUsage = buildDeviceUsage({
+				locationIds,
+				archive: deps.archiveDeviceUsage?.(locationIds) ?? null,
+				resident: (deviceId) => deps.index.accounting(deviceId),
+				logger: deps.logger
+			});
+			const devices = deviceUsage.devices;
+			const totalUsedBytes = deviceUsage.totalUsedBytes;
 			const byPhysical = /* @__PURE__ */ new Map();
 			for (const loc of locations) {
 				const key = physicalRootKey(loc.root);
@@ -7487,11 +7616,12 @@ function buildRecordingProvider(deps) {
 					totalBytes: cap.totalBytes
 				};
 			}));
-			devices.sort((a, b) => b.usedBytes - a.usedBytes);
+			warnOnUsageMismatch(deps.logger, totalUsedBytes, locationUsages.reduce((sum, l) => sum + l.usedBytes, 0), deviceUsage.read);
 			return {
 				nodeId: deps.nodeId,
 				totalUsedBytes,
-				devices,
+				devices: [...devices],
+				devicesRead: deviceUsage.read,
 				locations: locationUsages
 			};
 		},
@@ -8385,6 +8515,14 @@ var DurableLedger = class DurableLedger {
 //#endregion
 //#region src/recorder/addon/segment-hour-ledger.ts
 var HOUR_MS$3 = 36e5;
+/** `Math.min` where a missing left operand means "nothing yet", not `NaN`. */
+function minOf(a, b) {
+	return a === null ? b : Math.min(a, b);
+}
+/** `Math.max` with the same rule as {@link minOf}. */
+function maxOf(a, b) {
+	return a === null ? b : Math.max(a, b);
+}
 var macrotask$1 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
@@ -9035,7 +9173,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*
 	* The reader repairs the durable index it just reconstructed, so the next
 	* cold read of this hour is a point read instead of another `readdir`
-	* (`docs/design/2026-08-29-scrypted-nvr-recording-model.md` §4.2). Two
+	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2). Two
 	* constraints, both enforced by the caller and re-stated here because
 	* getting either wrong turns a READ into durable damage: the hour must be
 	* CLOSED (a live hour's directory races the writer, so a walk of it is a
@@ -9268,6 +9406,53 @@ var SegmentHourLedger = class SegmentHourLedger {
 		for (const row of this.ledger.snapshot()) if (locationIds.has(row.locationId)) out.add(row.deviceId);
 		return out;
 	}
+	/**
+	* Bytes / segments / oldest / newest per CAMERA on these locations — the
+	* per-camera half of the storage page, answered by the ARCHIVE (D418).
+	*
+	* ## Why the T1 fold and not `census({ deviceId })` per camera
+	*
+	* `census` is the right authority for a SCOPE, and it cannot express this
+	* scope: {@link SegmentHourLedger.predicate} takes ONE `locationId`, so
+	* "camera 615 across the three resolvable volumes" is three aggregates, and
+	* `census({ deviceId })` alone would silently count footage stranded on a
+	* location id that no longer resolves — bytes no volume row on the same page
+	* accounts for. Per camera per volume that is `cameras × volumes` SQL
+	* aggregates for one operator click, and it grows with the fleet.
+	*
+	* The T1 hour summary answers all of them in ONE pass with no I/O, exactly
+	* as {@link devicesWithFootage} and {@link profilesWithFootage} already do,
+	* and it is the same rows `accountingForLocations` sums in SQL — the mirror
+	* is write-behind, so it is never BEHIND the store. The cost is one pass
+	* over the hour rows the mirror holds — O(writers × profiles × hours), ~19 k
+	* on the live hub (see {@link REPAIR_MAX_ROWS}) against 98 445 segments,
+	* i.e. it does NOT scale with the segment count — and it is capped for good
+	* by {@link SEGMENT_HOUR_SUMMARY_LIMIT}, the mirror's own ceiling.
+	*
+	* ## What an empty answer means
+	*
+	* The same thing it means for {@link devicesWithFootage}: "the mirror knows
+	* no hour here" — which is also what a ledger whose load failed reports. The
+	* caller must not render that as "no camera has footage"; `getStorageUsage`
+	* cross-checks the per-camera sum against the volume aggregate and SAYS so
+	* when the two disagree.
+	*/
+	usageByDevice(locationIds) {
+		const out = /* @__PURE__ */ new Map();
+		if (locationIds.size === 0) return out;
+		for (const row of this.ledger.snapshot()) {
+			if (!locationIds.has(row.locationId)) continue;
+			const empty = row.segments === 0;
+			const prev = out.get(row.deviceId);
+			out.set(row.deviceId, {
+				bytes: (prev?.bytes ?? 0) + row.bytes,
+				segments: (prev?.segments ?? 0) + row.segments,
+				oldestMs: empty ? prev?.oldestMs ?? null : minOf(prev?.oldestMs ?? null, row.minStartMs),
+				newestMs: empty ? prev?.newestMs ?? null : maxOf(prev?.newestMs ?? null, row.maxStartMs)
+			});
+		}
+		return out;
+	}
 	async oldestSegmentsScoped(locationIds, deviceIds, targetBytes) {
 		const ids = [...locationIds];
 		if (ids.length === 0 || targetBytes <= 0) return {
@@ -14527,7 +14712,7 @@ var RecordingController = class {
 	/**
 	* The ADAPTIVE attach bound. A transient `spawn ffmpeg` failure (EAGAIN) is
 	* the host saying it cannot fork right now, and the answer is to attach
-	* FEWER cameras at once — not to serialise them, which `e2fa17a2b` removed
+	* FEWER cameras at once — not to serialise them, which removed
 	* for good reason. Every bounded-parallel attach in this file reads it.
 	*/
 	spawnPressure;
@@ -16032,7 +16217,7 @@ function selectRedundantSegments(segs) {
 * The pruner that used to remove it, `runRedundancyJanitor`, was reachable ONLY
 * from `runFullArchiveWalk`, which was reachable only from
 * `scheduleDeferredFullWalk`, which had no caller at all — so on 2026-08-27
-* (commit `9308428b4`) all three were deleted together as dead code. That was
+* all three were deleted together as dead code. That was
 * correct about the walk and left the system with **no duplicate pruner
 * whatsoever**. The precedent for letting this class of waste run unattended is
 * the 179 GB of stranded staging segments in `staging-reconcile.ts`.
@@ -17443,6 +17628,7 @@ var RecorderV2Addon = class extends BaseAddon {
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
+			archiveDeviceUsage: (locationIds) => this.segmentHours?.usageByDevice(locationIds) ?? null,
 			archive: () => this.segmentHours,
 			ledgerWalk: this.ledgerWalkReconciler(),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),

package/dist/{segment-demux-js-CsFtPVzH.mjs → segment-demux-js-B278aBtB.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { It as errMsg } from "./dist-DttqKvsQ.mjs";
+import { It as errMsg } from "./dist-Dl6GntEh.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{segment-demux-js-CkJPdyDH.js → segment-demux-js-D7bjzY8M.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DoHcimdu.js");
+const require_dist = require("./dist-BbvtiBNc.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-BWO2WNjw.js");
-const require_lazy_sharp = require("../lazy-sharp-BeeQGCUu.js");
+const require_worker_protocol = require("../worker-protocol-C4rh5uiS.js");
+const require_lazy_sharp = require("../lazy-sharp-L9Lcr62v.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.
@@ -323,44 +323,6 @@ var FrameSlot = class {
 	}
 };
 //#endregion
-//#region src/session-decode/media-clock.ts
-/**
-* Convert a container pts to milliseconds.
-*
-* Returns `null` — never a fabricated `0` — for a time base that cannot
-* describe a duration. A zero here would place every frame of the session at
-* the anchor, i.e. a whole burst of detections sharing one instant, which is
-* exactly the kind of plausible-looking wrong timestamp this module exists to
-* refuse. The caller degrades to the wall clock instead.
-*/
-function ptsToMs(pts, timeBase) {
-	if (!Number.isFinite(timeBase.num) || !Number.isFinite(timeBase.den)) return null;
-	if (timeBase.num <= 0 || timeBase.den <= 0) return null;
-	return Number(pts) * timeBase.num * 1e3 / timeBase.den;
-}
-/** Anchor the session's media clock on its first decoded frame. */
-function anchorMediaClock(input) {
-	const preRoll = Number.isFinite(input.preRollMs) && input.preRollMs > 0 ? input.preRollMs : 0;
-	return {
-		firstPtsMs: input.firstPtsMs,
-		wallAtFirstPts: input.nowWall - preRoll
-	};
-}
-/**
-* The wall clock at which the frame with `ptsMs` was shot.
-*
-* Clamped to `nowWall`: a container whose pts runs past the anchor (a clock
-* jump, a source whose pts is not wall-clock-shaped, a re-dial that reset it)
-* must never produce a track that starts in the FUTURE. A future `firstSeen`
-* sorts a track ahead of everything, and no later pass can detect that it is
-* wrong. Clamping loses precision on a pathological source and keeps the
-* ordering property every consumer relies on.
-*/
-function mediaWallClockOf(anchor, ptsMs, nowWall) {
-	const shotAt = anchor.wallAtFirstPts + (ptsMs - anchor.firstPtsMs);
-	return shotAt > nowWall ? nowWall : shotAt;
-}
-//#endregion
 //#region src/session-decode/lease-activity-gate.ts
 /**
 * Demand-driven gate for the native-frame lease capture (see
@@ -545,6 +507,56 @@ var LeaseAdmissionLedger = class {
 	}
 };
 //#endregion
+//#region src/session-decode/media-clock.ts
+/**
+* Convert a container pts to milliseconds.
+*
+* Returns `null` — never a fabricated `0` — for a time base that cannot
+* describe a duration. A zero here would place every frame of the session at
+* the anchor, i.e. a whole burst of detections sharing one instant, which is
+* exactly the kind of plausible-looking wrong timestamp this module exists to
+* refuse. The caller degrades to the wall clock instead.
+*/
+function ptsToMs(pts, timeBase) {
+	if (!Number.isFinite(timeBase.num) || !Number.isFinite(timeBase.den)) return null;
+	if (timeBase.num <= 0 || timeBase.den <= 0) return null;
+	return Number(pts) * timeBase.num * 1e3 / timeBase.den;
+}
+/** Anchor the session's media clock on its first decoded frame. */
+function anchorMediaClock(input) {
+	const preRoll = Number.isFinite(input.preRollMs) && input.preRollMs > 0 ? input.preRollMs : 0;
+	return {
+		firstPtsMs: input.firstPtsMs,
+		wallAtFirstPts: input.nowWall - preRoll
+	};
+}
+/**
+* The wall clock at which the frame with `ptsMs` was shot.
+*
+* Clamped to `nowWall`: a container whose pts runs past the anchor (a clock
+* jump, a source whose pts is not wall-clock-shaped, a re-dial that reset it)
+* must never produce a track that starts in the FUTURE. A future `firstSeen`
+* sorts a track ahead of everything, and no later pass can detect that it is
+* wrong. Clamping loses precision on a pathological source and keeps the
+* ordering property every consumer relies on.
+*/
+function mediaWallClockOf(anchor, ptsMs, nowWall) {
+	const shotAt = anchor.wallAtFirstPts + (ptsMs - anchor.firstPtsMs);
+	return shotAt > nowWall ? nowWall : shotAt;
+}
+/**
+* The anchor for a frame of dial `dialSeq`: the current one while the dial is
+* the same, a fresh one — anchored on THIS frame — the moment the dial changes.
+* Pure; the caller keeps the returned value and passes it back next frame.
+*/
+function mediaClockForDial(current, dialSeq, input) {
+	if (current !== null && current.dialSeq === dialSeq) return current;
+	return {
+		dialSeq,
+		anchor: anchorMediaClock(input)
+	};
+}
+//#endregion
 //#region src/session-decode/native-frame-ring.ts
 /**
 * A hard-capped, insertion-ordered map from worker frameId → retained frame.
@@ -2136,7 +2148,7 @@ var DecodeWorkerChild = class {
 	lastColorProvenanceKeyByPath = /* @__PURE__ */ new Map();
 	/** Per-frame color provenance logging (opt-in; the transition marker is always on). */
 	colorDebug = process.env["CAMSTACK_DECODE_COLOR_DEBUG"] === "1";
-	/** Scrypted-style throughput counters (plain integers, no per-frame allocation). */
+	/** Throughput counters (plain integers, no per-frame allocation). */
 	framesDecoded = 0;
 	/** Releases that found a held frame / that found nothing to release. */
 	leaseReleased = 0;
@@ -2202,6 +2214,7 @@ var DecodeWorkerChild = class {
 	* frame arrives, or forever on a source whose pts cannot be read — in which
 	* case every frame falls back to the wall clock, exactly as before.
 	*/
+	/** Anchored per DIAL (see `mediaClockForDial`): a re-dial is a new pts epoch. */
 	mediaClock = null;
 	/** History this dial asked the broker for; `0` ⇒ there is no burst. */
 	preRollMs = 0;
@@ -2217,7 +2230,7 @@ var DecodeWorkerChild = class {
 	/**
 	* The latest-wins decoded-frame slot + reserved-for-`toBuffer` holder +
 	* pending-pull flag — extracted to `FrameSlot` (Epic C P2 Task 2 / I2) so
-	* the reserve-on-pull invariant (`e3c78a9b`) is unit-tested without
+	* the reserve-on-pull invariant is unit-tested without
 	* node-av. See that file's doc comment for the full semantics.
 	*/
 	frames = new FrameSlot({ retainSuperseded: (frameId, frame) => this.captureNativeFrame(frameId, frame) });
@@ -3225,16 +3238,16 @@ var DecodeWorkerChild = class {
 	mediaWallClockOfFrame(frame, now) {
 		const ptsMs = this.frameMediaPtsMs(frame);
 		if (ptsMs === null) return now;
-		if (!this.mediaClock) {
+		if (this.mediaClock === null || this.mediaClock.dialSeq !== this.dialSeq) {
 			const servedPreRollMs = 0;
 			if (this.preRollMs > 0) this.emitStderr(`[decode] pre-roll requested ${this.preRollMs}ms but the SERVED span does not reach this worker — burst suppressed, clock anchored at now (D411 follow-up)`);
-			this.mediaClock = anchorMediaClock({
+			this.mediaClock = mediaClockForDial(this.mediaClock, this.dialSeq, {
 				firstPtsMs: ptsMs,
 				preRollMs: servedPreRollMs,
 				nowWall: now
 			});
 		}
-		return mediaWallClockOf(this.mediaClock, ptsMs, now);
+		return mediaWallClockOf(this.mediaClock.anchor, ptsMs, now);
 	}
 	/** This frame's pts in ms, or `null` when the source cannot express one. */
 	frameMediaPtsMs(frame) {