@camstack/addon-pipeline 1.2.219 → 1.2.220

package/dist/recorder/index.js

@@ -2,15 +2,16 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-wtNhtVVo.js");
-const require_node = require("../node-BduNi21Z.js");
+const require_chunk = require("../chunk-emK7D4bc.js");
+const require_dist = require("../dist-ByPsWlTa.js");
+const require_node = require("../node-CNPnaux4.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-B1Difcnq.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
-node_path = require_dist.__toESM(node_path);
+node_path = require_chunk.__toESM(node_path);
 let node_child_process = require("node:child_process");
 let node_fs_promises = require("node:fs/promises");
 let _camstack_system_addon_utils = require("@camstack/system/addon-utils");
@@ -1773,51 +1774,20 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
 var HOUR_MS$7 = 36e5;
-/**
-* Hydrate ONLY the hours a window spans, instead of walking the archive.
-*
-* `hydrateDeviceFromStorage` is a recursive `readdir` over the whole device
-* subtree — ">1M files and takes minutes" per its own comment. Until it lands,
-* every read of past footage sees an empty index, which the server reports as
-* "no footage": measured after a deploy, a camera-day held 7 segments and grew
-* only at the rate of NEW writes for ~9 minutes.
-*
-* The path convention makes the window addressable directly: one SHALLOW
-* `readdir` per (profile, hour), ~450 entries each. A day is ~72 of them. The
-* background full walk still runs, for the consumers that need the whole
-* archive (footprint, eviction domains, retention).
-*
-* Hours already walked are skipped, so a drag across an hour costs nothing the
-* second time.
-*
-* ## The ledger is the first stop for a CLOSED hour (D287)
-*
-* Boot no longer replays the archive into the index, so a ledger-known hour
-* arrives here `unknown` and pays ONE point read of its hour row instead of a
-* `readdir` — measured at ~650 ms per hour directory on the live share under
-* load, against the array the scrub feeder is competing for. Hours the ledger
-* does not know, and every hour if the read fails, fall through to the walk
-* exactly as before: the failure direction is toward the disk, never toward an
-* hour that renders empty because nobody read it.
-*
-* **The live hour is never served from the ledger.** It is the one hour whose
-* durable row is knowably behind the disk: a segment finalized after the last
-* persist and before a crash is on the array and not in the row. Boot used to
-* mark every ledger hour `hydrated`, which made that tail invisible to
-* playback and the timeline FOREVER, not merely under-reported. Excluding the
-* live hour costs exactly one hour-directory read per process — the walk marks
-* it, so the second reader pays nothing — and it is what turns a lost tail
-* back into a recoverable one.
-*
-* A CLOSED hour already walked is skipped, which is what makes that exclusion
-* affordable: without it, every window touching the live hour would re-walk
-* all of its hours. The past is immutable, so re-reading a closed hour
-* directory can only ever return what the index already holds; eviction
-* removes rows through the index directly.
-*/
-async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger, ledger) {
-	if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
+async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger, ledger, options) {
+	const verify = options?.verifyClosedHours === true;
+	if (!verify && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
 	const liveHour = Math.floor(Date.now() / HOUR_MS$7) * HOUR_MS$7;
+	/** Per (locationId, profile, hour): what the LEDGER claimed, for the diff. */
+	const claimed = /* @__PURE__ */ new Map();
+	const claimKey = (locationId, hour) => `${locationId}:${hour}`;
+	/**
+	* Closed hours the ledger answered for with a row nobody SEALED (D451): what
+	* a writer had persisted when it was last heard from, which is a legitimate
+	* answer and not a complete one. Each is read from the array once and the
+	* row is unioned and sealed, so the second reader pays a point read.
+	*/
+	const unsealed = /* @__PURE__ */ new Set();
 	if (ledger !== void 0) {
 		const startedMs = Date.now();
 		const hours = await ledger.detailForWindow(deviceId, fromMs, toMs);
@@ -1826,6 +1796,8 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 		for (const hour of hours) {
 			if (hour.hourStartMs >= liveHour) continue;
 			index.hydrateHour(deviceId, hour.locationId, hour.hourStartMs, hour.paths);
+			claimed.set(claimKey(hour.locationId, hour.hourStartMs), hour.paths.length);
+			if (!hour.sealed) unsealed.add(hour.hourStartMs);
 			segments += hour.paths.length;
 			served += 1;
 		}
@@ -1834,10 +1806,11 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			meta: {
 				hours: served,
 				segments,
+				unsealedHours: unsealed.size,
 				ms: Date.now() - startedMs
 			}
 		});
-		if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
+		if (!verify && unsealed.size === 0 && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
 	}
 	for (const [root, aliases] of aliasesByRoot(locations)) {
 		const deviceDir = node_path.default.join(root, String(deviceId));
@@ -1858,8 +1831,11 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 		const reuseBefore = index.hydrateReuseStats();
 		let hoursRead = 0;
 		let repaired = 0;
+		let forgottenSegments = 0;
+		let forgottenHours = 0;
+		let sealed = 0;
 		for (let hour = first; hour < toMs; hour += HOUR_MS$7) {
-			if (hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$7) === "hydrated") continue;
+			if (!verify && hour < liveHour && !unsealed.has(hour) && index.hydrationOf(deviceId, hour, hour + HOUR_MS$7) === "hydrated") continue;
 			for (const profile of profiles) {
 				const rel = hourDirRelPath(deviceId, profile, hour);
 				let files;
@@ -1872,13 +1848,35 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 				const locationId = locationForHydratedProfile(aliases, profile).id;
 				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
 				index.hydrateHour(deviceId, locationId, hour, relPaths);
-				if (ledger !== void 0 && relPaths.length > 0 && hour + HOUR_MS$7 <= Date.now() && !ledger.knowsHour(deviceId, profile, locationId, hour)) {
-					repaired += 1;
-					await ledger.adoptRebuiltHour(deviceId, profile, locationId, hour, relPaths);
+				if (ledger === void 0 || relPaths.length === 0 || hour + HOUR_MS$7 > Date.now()) continue;
+				const claimedHere = claimed.get(claimKey(locationId, hour));
+				const outcome = await ledger.adoptWalkedHour(deviceId, profile, locationId, hour, relPaths);
+				if (outcome === null) continue;
+				if (outcome.created) repaired += 1;
+				else if (claimedHere !== void 0 && outcome.added > 0) {
+					forgottenSegments += outcome.added;
+					forgottenHours += 1;
 				}
+				if (outcome.sealedNow) sealed += 1;
 			}
 		}
 		index.markHydrated(deviceId, fromMs, toMs);
+		if (verify || forgottenSegments > 0) {
+			const message = "recorder: verified the hour ledger against the array";
+			const entry = {
+				tags: { deviceId },
+				meta: {
+					root,
+					hoursRead,
+					forgottenSegments,
+					forgottenHours,
+					sealed,
+					verify
+				}
+			};
+			if (forgottenSegments > 0) logger.warn(message, entry);
+			else logger.info(message, entry);
+		}
 		if (hoursRead === 0) continue;
 		const reuseAfter = index.hydrateReuseStats();
 		const reused = reuseAfter.rowsReused - reuseBefore.rowsReused;
@@ -1889,6 +1887,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 				root,
 				hoursRead,
 				repaired,
+				sealed,
 				reused,
 				allocated
 			}
@@ -7154,7 +7153,8 @@ async function probeVariantCodec(readPrefix, cache, deviceId, profile, firstPres
 * checks every one, playback does not. See the comment at the branch.
 */
 async function collectRangeSegments(deps, deviceId, profile, fromMs, toMs, uriMode) {
-	if (deps.index.hydrationOf(deviceId, fromMs, toMs) !== "hydrated") await deps.hydrateWindow?.(deviceId, fromMs, toMs);
+	const verifyClosedHours = uriMode === "absolute";
+	if (verifyClosedHours || deps.index.hydrationOf(deviceId, fromMs, toMs) !== "hydrated") await deps.hydrateWindow?.(deviceId, fromMs, toMs, verifyClosedHours);
 	const hydration = deps.index.hydrationOf(deviceId, fromMs, toMs);
 	const rootById = new Map(deps.locations().map((l) => [l.id, l.root]));
 	const candidates = deps.index.segmentsOverlapping(deviceId, profile, fromMs, toMs).flatMap((s) => {
@@ -8534,7 +8534,7 @@ var macrotask$1 = () => new Promise((resolve) => {
 });
 /**
 * @durable class=mirror owner=recorder
-*   write="write-behind on every finalized segment (hour-row upsert); eviction drops paths; the archive walk reconciles disk into the row set"
+*   write="write-behind on every finalized segment (hour-row upsert, serialised per hour); the writer SEALS the hour it leaves (one write per hour); a disk walk of a closed hour unions what it found and seals; eviction drops paths"
 *   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
 */
 var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
@@ -8603,7 +8603,17 @@ var RECORDING_SEGMENT_HOURS_COLUMNS = [
 		type: "INTEGER",
 		notNull: true,
 		defaultValue: 0
-	}
+	},
+	(
+	/** {@link SegmentHourRow.sealed}, as 0/1. A row written before the column
+	*  existed reads 0 — unsealed — which is the direction that costs one
+	*  directory read, never a missing hour. */
+	{
+		name: "sealed",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	})
 ];
 var RECORDING_SEGMENT_HOURS_INDEXES = [
 	{
@@ -8621,6 +8631,32 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 	{
 		name: "idx_recorder_segment_hours_loc_hour",
 		columns: ["locationId", "hourStartMs"]
+	}),
+	(
+	/**
+	* The accounting read: `SUM(bytes)`, `SUM(segments)`, `MIN(minStartMs)`,
+	* `MAX(maxStartMs)` over `locationId IN (…)` — one row back, and with this
+	* index not one table row read to produce it (D447).
+	*
+	* `idx_recorder_segment_hours_loc_hour` finds the same range, but the four
+	* aggregates live in the table row, next to `paths` — up to 360 segment
+	* paths of ~80 characters per hour — so the eviction index served the
+	* accounting read at the price of ~30 KB of table page per hour row. On the
+	* live hub that was `durationMs=1001…2902` once a MINUTE on
+	* `hub/sqlite-settings` (174 slow-call WARNs in ten hours on 2026-09-10/11),
+	* every one of them holding the thread every configuration read in the
+	* cluster waits on. The index is ~50 bytes a row over ~19 k rows — nothing —
+	* and the first declare after it ships builds it in well under a second.
+	*/
+	{
+		name: "idx_recorder_segment_hours_loc_accounting",
+		columns: [
+			"locationId",
+			"bytes",
+			"segments",
+			"minStartMs",
+			"maxStartMs"
+		]
 	})
 ];
 /** The identity of the {@link hourAggregate} fold — an hour holding nothing. */
@@ -8679,6 +8715,7 @@ function hourAggregate(paths) {
 function segmentHourRow(base) {
 	return {
 		...base,
+		sealed: base.sealed ?? false,
 		pathsResident: true,
 		...hourAggregate(base.paths)
 	};
@@ -8791,7 +8828,8 @@ var SEGMENT_HOUR_SUMMARY_COLUMNS = [
 	"bytes",
 	"segments",
 	"minStartMs",
-	"maxStartMs"
+	"maxStartMs",
+	"sealed"
 ];
 /** Summary rows folded into the mirror between yields. */
 var LOAD_CHUNK = 5e3;
@@ -8853,6 +8891,19 @@ function hourOf(row) {
 		key: segmentHourKey(row.deviceId, row.profile, row.locationId, hour)
 	};
 }
+/** The identity of one writer: a camera's profile. Location is not part of it —
+*  a relocated writer is the same writer on a new root. */
+function writerKey(deviceId, profile) {
+	return `${deviceId}|${profile}`;
+}
+function detailOf(row) {
+	return {
+		locationId: row.locationId,
+		hourStartMs: row.hourStartMs,
+		paths: row.paths,
+		sealed: row.sealed
+	};
+}
 /**
 * The `hourStartMs` of one probe record.
 *
@@ -8890,9 +8941,15 @@ function rowToValue(row) {
 		bytes: row.bytes,
 		segments: row.segments,
 		minStartMs: row.minStartMs,
-		maxStartMs: row.maxStartMs
+		maxStartMs: row.maxStartMs,
+		sealed: row.sealed ? 1 : 0
 	};
 }
+/** The stored 0/1 (or a boolean from a fake) as the flag. Anything else —
+*  including the absence a pre-D451 row shows — is unsealed. */
+function sealedOf(raw) {
+	return raw === 1 || raw === true;
+}
 function recordToRow(key, data) {
 	const deviceId = Number(data["deviceId"]);
 	const profile = data["profile"];
@@ -8911,7 +8968,8 @@ function recordToRow(key, data) {
 		profile,
 		locationId,
 		hourStartMs: hour,
-		paths: raw
+		paths: raw,
+		sealed: sealedOf(data["sealed"])
 	});
 }
 /** The paths of a summary row: one shared empty array, never a per-row
@@ -8946,6 +9004,7 @@ function summaryToRow(key, data) {
 		hourStartMs: hour,
 		paths: NO_PATHS,
 		pathsResident: false,
+		sealed: sealedOf(data["sealed"]),
 		bytes: finiteOr0(data["bytes"]),
 		segments: finiteOr0(data["segments"]),
 		minStartMs: finiteOr0(data["minStartMs"]),
@@ -8976,6 +9035,16 @@ var SegmentHourLedger = class SegmentHourLedger {
 	loadChunk;
 	yieldBetween;
 	rowCap;
+	/**
+	* One lane per hour key: every mutation of a row runs after the previous one
+	* on the same key has finished. Two appends that both read the row and both
+	* wrote it back used to keep only the second — the sparse rows D451 found.
+	*/
+	lanes = /* @__PURE__ */ new Map();
+	/** Per (device, profile): the hour its writer last appended to. */
+	writerHours = /* @__PURE__ */ new Map();
+	/** Hour keys a write was REFUSED for in this process — never sealed by it. */
+	refused = /* @__PURE__ */ new Set();
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.store = deps.store;
@@ -9158,59 +9227,172 @@ var SegmentHourLedger = class SegmentHourLedger {
 			if (row.deviceId !== deviceId) continue;
 			if (row.hourStartMs < first || row.hourStartMs >= toMs) continue;
 			if (row.pathsResident) {
-				out.push({
-					locationId: row.locationId,
-					hourStartMs: row.hourStartMs,
-					paths: row.paths
-				});
+				out.push(detailOf(row));
 				continue;
 			}
 			wanted.push(row.key);
 		}
-		for (const row of await this.materialize(wanted, deviceId)) out.push({
-			locationId: row.locationId,
-			hourStartMs: row.hourStartMs,
-			paths: row.paths
-		});
+		for (const row of await this.materialize(wanted, deviceId)) out.push(detailOf(row));
 		return out;
 	}
 	/**
-	* Adopt an hour the storage walk rebuilt and the ledger never held.
+	* Union a CLOSED hour the storage walk read into its row, and SEAL it.
 	*
 	* The reader repairs the durable index it just reconstructed, so the next
 	* cold read of this hour is a point read instead of another `readdir`
-	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2). Two
-	* constraints, both enforced by the caller and re-stated here because
-	* getting either wrong turns a READ into durable damage: the hour must be
-	* CLOSED (a live hour's directory races the writer, so a walk of it is a
-	* lower bound, not the truth), and the ledger must hold no row for it (an
-	* existing row is the authority; replacing it with a walk's view is the
-	* D148 prune this ledger refuses to do on its own evidence).
+	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2), and it
+	* seals the row because a directory read of a closed hour is the one
+	* complete answer there is. The caller guarantees the hour is CLOSED — a
+	* live hour's directory races its writer, so a walk of it is a lower bound.
+	*
+	* A row the ledger already holds is UNIONED, never replaced: the walk can
+	* only add (D148) — a path the row names and the directory lacks stays,
+	* because "the reader did not see it" is not evidence it is gone. This is
+	* the repair D445 described and did not perform: its predecessor returned
+	* on any known key, so a row known INCOMPLETELY — the only kind that needs
+	* repairing — was exactly the row it refused to touch, and the export's
+	* `forgottenSegments=9758` was counted again the next morning.
+	*
+	* `null` when the row is known and its detail could not be read: nothing
+	* is written from a row whose paths are not resident.
 	*/
-	async adoptRebuiltHour(deviceId, profile, locationId, hour, paths) {
+	async adoptWalkedHour(deviceId, profile, locationId, hour, paths) {
 		const key = segmentHourKey(deviceId, profile, locationId, hour);
-		if (paths.length === 0 || this.ledger.has(key)) return;
-		const row = segmentHourRow({
-			key,
-			deviceId,
-			profile,
-			locationId,
-			hourStartMs: hour,
-			paths: uniquePaths(paths)
+		return this.serialized(key, async () => {
+			if (!this.ledger.has(key)) {
+				if (paths.length === 0) return {
+					created: false,
+					added: 0,
+					sealedNow: false
+				};
+				const row = segmentHourRow({
+					key,
+					deviceId,
+					profile,
+					locationId,
+					hourStartMs: hour,
+					paths: uniquePaths(paths),
+					sealed: true
+				});
+				await this.ledger.put(row);
+				this.logger.info("recorder: adopted a closed hour the disk walk rebuilt and the ledger never held", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						locationId,
+						hourStartMs: hour,
+						segments: row.segments,
+						bytes: row.bytes
+					}
+				});
+				return {
+					created: true,
+					added: row.paths.length,
+					sealedNow: true
+				};
+			}
+			const held = await this.resident(key, deviceId);
+			if (held === null) return null;
+			const union = uniquePaths([...held.paths, ...paths]);
+			const added = union.length - held.paths.length;
+			if (added === 0 && held.sealed) return {
+				created: false,
+				added: 0,
+				sealedNow: false
+			};
+			await this.ledger.put(segmentHourRow({
+				...held,
+				paths: union,
+				sealed: true
+			}));
+			return {
+				created: false,
+				added,
+				sealedNow: !held.sealed
+			};
 		});
-		await this.ledger.put(row);
-		this.logger.info("recorder: adopted a closed hour the disk walk rebuilt and the ledger never held", {
-			tags: { deviceId },
-			meta: {
-				profile,
-				locationId,
-				hourStartMs: hour,
-				segments: row.segments,
-				bytes: row.bytes
+	}
+	/**
+	* The writer of `(deviceId, profile)` stopped gracefully: seal the hour it
+	* was appending to. One write, and only if the row has every finalize this
+	* ledger was handed for it.
+	*/
+	async sealWriter(deviceId, profile) {
+		const last = this.writerHours.get(writerKey(deviceId, profile));
+		if (last === void 0) return;
+		await this.sealHour(last);
+	}
+	/**
+	* Every mutation queued so far has landed — including the seals a rollover
+	* fires without waiting. Awaited at shutdown so the hour a writer just
+	* closed is sealed before the process is gone.
+	*/
+	async flush() {
+		while (this.lanes.size > 0) await Promise.all([...this.lanes.values()]);
+	}
+	/**
+	* A finalize this ledger was NEVER handed — the fire-and-forget lane refused
+	* it. The hour's row is short by that path and this process is the only
+	* party that knows, so the hour must not be sealed by it; a reader walks it
+	* once instead, which is exactly what an unsealed row is for.
+	*/
+	markRefused(row) {
+		this.refused.add(hourOf(row).key);
+	}
+	/** One write: the row as held, flagged sealed. Serialised on its key so it
+	*  cannot land over an append that read the row before it. */
+	async sealHour(target) {
+		await this.serialized(target.key, async () => {
+			if (this.refused.has(target.key)) {
+				this.logger.warn("recorder: hour left unsealed — a ledger write for it was refused, so its row is short and a reader must walk it", {
+					tags: { deviceId: target.deviceId },
+					meta: {
+						profile: target.profile,
+						locationId: target.locationId,
+						hourStartMs: target.hourStartMs
+					}
+				});
+				return;
 			}
+			const held = await this.resident(target.key, target.deviceId);
+			if (held === null || held.sealed) return;
+			await this.ledger.put({
+				...held,
+				sealed: true
+			});
 		});
 	}
 	/**
+	* Remember which hour this writer is on; when it MOVES FORWARD, seal the
+	* hour it left. Backwards is a late finalize (a recovered orphan, a replay)
+	* into an hour already accounted for, and seals nothing.
+	*/
+	noteWriter(next) {
+		const id = writerKey(next.deviceId, next.profile);
+		const last = this.writerHours.get(id);
+		if (last !== void 0 && last.key === next.key) return;
+		if (last === void 0 || next.hourStartMs > last.hourStartMs) this.writerHours.set(id, next);
+		if (last !== void 0 && next.hourStartMs > last.hourStartMs) this.sealHour(last);
+	}
+	/**
+	* Run `fn` after every mutation already queued on `key`.
+	*
+	* A row is read, appended to and written back with awaits in between; two
+	* such runs on one key interleave, and the second write carries a paths
+	* array that never saw the first — the write-behind's own lost update. The
+	* lane makes "read, append, write" one step per key. A rejected step must
+	* not poison the lane: the next step still runs.
+	*/
+	serialized(key, fn) {
+		const run = (this.lanes.get(key) ?? Promise.resolve()).then(fn, fn);
+		const settled = run.then(() => void 0, () => void 0);
+		this.lanes.set(key, settled);
+		settled.then(() => {
+			if (this.lanes.get(key) === settled) this.lanes.delete(key);
+		});
+		return run;
+	}
+	/**
 	* Fetch whole rows for `keys` and promote them in the mirror.
 	*
 	* Paged and yielding: an export window can name thousands of hours, and one
@@ -9803,30 +9985,40 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*/
 	async recordSegment(row) {
 		const { key, hourStartMs: hour } = hourOf(row);
-		if (!this.ledger.has(key)) {
-			await this.ledger.put(segmentHourRow({
-				key,
-				deviceId: row.deviceId,
-				profile: row.profile,
-				locationId: row.locationId,
-				hourStartMs: hour,
-				paths: [row.path]
-			}));
-			return;
-		}
-		const held = await this.resident(key, row.deviceId);
-		if (held === null) {
-			this.logger.warn("recorder: hour detail unavailable — this finalized segment is NOT in the durable hour row yet", {
-				tags: { deviceId: row.deviceId },
-				meta: {
+		this.noteWriter({
+			key,
+			deviceId: row.deviceId,
+			profile: row.profile,
+			locationId: row.locationId,
+			hourStartMs: hour
+		});
+		await this.serialized(key, async () => {
+			if (!this.ledger.has(key)) {
+				await this.ledger.put(segmentHourRow({
 					key,
-					path: row.path
-				}
-			});
-			return;
-		}
-		if (held.paths.includes(row.path)) return;
-		await this.ledger.put(appendSegmentPath(held, row.path));
+					deviceId: row.deviceId,
+					profile: row.profile,
+					locationId: row.locationId,
+					hourStartMs: hour,
+					paths: [row.path]
+				}));
+				return;
+			}
+			const held = await this.resident(key, row.deviceId);
+			if (held === null) {
+				this.refused.add(key);
+				this.logger.warn("recorder: hour detail unavailable — this finalized segment is NOT in the durable hour row yet", {
+					tags: { deviceId: row.deviceId },
+					meta: {
+						key,
+						path: row.path
+					}
+				});
+				return;
+			}
+			if (held.paths.includes(row.path)) return;
+			await this.ledger.put(appendSegmentPath(held, row.path));
+		});
 	}
 	/**
 	* Eviction confirmed these paths are gone from disk. Drop them; forget the
@@ -10002,7 +10194,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 				profile: seg.profile,
 				locationId: seg.locationId,
 				hourStartMs: hour,
-				paths: [seg.path]
+				paths: [seg.path],
+				sealed: hour !== currentHour
 			}));
 			else fromIndex.set(key, appendSegmentPath(existing, seg.path));
 		}
@@ -15927,6 +16120,17 @@ var RecordingController = class {
 				flushMs: Date.now() - teardownStartMs - writerStopMs
 			}
 		});
+		try {
+			await this.deps.onWriterClosed?.(deviceId, r.profile);
+		} catch (err) {
+			this.deps.logger.warn("recorder: sealing the closed writer’s hour failed — it stays unsealed", {
+				tags: { deviceId },
+				meta: {
+					profile: r.profile,
+					error: require_dist.errMsg(err)
+				}
+			});
+		}
 		try {
 			r.watcher.stop();
 		} catch {}
@@ -17443,10 +17647,13 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			},
 			onIndexed: (row, absPath) => {
 				const ledger = this.segmentHours;
-				if (ledger && !this.ledgerWriteGate.run(() => ledger.recordSegment(row))) this.ctx.logger.debug("recorder: hour-ledger write dropped — lane saturated; the archive walk reconciles this hour", {
-					tags: { deviceId: row.deviceId },
-					meta: { path: row.path }
-				});
+				if (ledger && !this.ledgerWriteGate.run(() => ledger.recordSegment(row))) {
+					ledger.markRefused(row);
+					this.ctx.logger.debug("recorder: hour-ledger write dropped — lane saturated; the hour stays unsealed and a reader walks it", {
+						tags: { deviceId: row.deviceId },
+						meta: { path: row.path }
+					});
+				}
 				if (!isMfraTableServable(row.startMs, Date.now())) return;
 				if (!this.mfraCaptureGate.run(async () => {
 					try {
@@ -17574,6 +17781,9 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			locations: () => this.resolvedLocations,
 			placeProfile: (deviceId, profile) => this.placeProfile(deviceId, profile),
 			onPlacementTick: (deviceIds) => this.recomputePlacement(deviceIds),
+			onWriterClosed: async (deviceId, profile) => {
+				await this.segmentHours?.sealWriter(deviceId, profile);
+			},
 			spawn: node_child_process.spawn,
 			costRegistry: this.costRegistry,
 			segmentSeconds: this.config.segmentSeconds,
@@ -17643,7 +17853,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			},
 			calendar: this.calendar,
 			mfraFor: (deviceId, profile, startMs) => this.mfraTables.get(deviceId, profile, startMs),
-			hydrateWindow: (deviceId, fromMs, toMs) => hydrateWindowFromStorage(this.index, deviceId, fromMs, toMs, this.resolvedLocations, this.ctx.logger, this.segmentHours ?? void 0),
+			hydrateWindow: (deviceId, fromMs, toMs, verifyClosedHours) => hydrateWindowFromStorage(this.index, deviceId, fromMs, toMs, this.resolvedLocations, this.ctx.logger, this.segmentHours ?? void 0, { verifyClosedHours: verifyClosedHours === true }),
 			onConfigChanged: async (deviceId) => {
 				await this.refreshSensorTriggerBindings();
 				await (this.controller?.onConfigChanged(deviceId) ?? Promise.resolve());
@@ -17923,6 +18133,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.locationRefresher?.dispose();
 		this.locationRefresher = null;
 		await this.controller?.stop();
+		await this.segmentHours?.flush();
 		this.controller = null;
 		this.segmentStore = null;
 		if (this.exportSweepTimer !== null) {