@camstack/addon-pipeline 1.2.254 → 1.2.256

package/dist/recorder/index.mjs

@@ -1,5 +1,5 @@
-import { $t as hydrateSchema, C as OpsLogEntrySchema, Ct as recordingExportCapability, D as RECORDING_EXPORT_MAX_READ_BYTES, Dt as resolveLocationMode, H as deriveBatteryPresence, I as batteryCapability, Kt as DeviceFeature, Lt as errMsg, Mt as storageOccupancyCapability, O as RecordingConfigSchema, Pt as stripRetiredBandPreBufferSec, Q as evictionPolicyOfLocation, St as recordingCapability, W as deriveRecordingMode, Wt as BaseAddon, Xt as customAction, Y as evaluateSensorEdge, Z as evictionPolicyForMode, Zt as defineCustomActions, _n as record, bn as EventCategory, cn as _enum, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as modeMayWrite, et as gbToBytes, g as ExportRecordSchema, gn as preprocess, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, jt as storageEvictableCapability, k as RecordingSignalStatusSchema, kt as resolveRecordingProfiles, ln as array, lt as mayWriteToLocation, mn as number, on as selectAssignedProfileSlots, qt as DeviceType, rn as nodePin, rt as isFirstLevelMacroClass, sn as sleep$1, un as boolean, ut as migrateLegacyDeviceSignalConfig, vn as string, wt as recordingSignalCapability } from "../dist-CkGvx3Fy.mjs";
-import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-Dwlty0jj.mjs";
+import { $t as hydrateSchema, C as OpsLogEntrySchema, Ct as recordingExportCapability, D as RECORDING_EXPORT_MAX_READ_BYTES, Dt as resolveLocationMode, H as deriveBatteryPresence, I as batteryCapability, Kt as DeviceFeature, Lt as errMsg, Mt as storageOccupancyCapability, O as RecordingConfigSchema, Pt as stripRetiredBandPreBufferSec, Q as evictionPolicyOfLocation, St as recordingCapability, W as deriveRecordingMode, Wt as BaseAddon, Xt as customAction, Y as evaluateSensorEdge, Z as evictionPolicyForMode, Zt as defineCustomActions, _n as record, bn as EventCategory, cn as _enum, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as modeMayWrite, et as gbToBytes, g as ExportRecordSchema, gn as preprocess, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, jt as storageEvictableCapability, k as RecordingSignalStatusSchema, kt as resolveRecordingProfiles, ln as array, lt as mayWriteToLocation, mn as number, on as selectAssignedProfileSlots, qt as DeviceType, rn as nodePin, rt as isFirstLevelMacroClass, sn as sleep$1, un as boolean, ut as migrateLegacyDeviceSignalConfig, vn as string, wt as recordingSignalCapability } from "../dist-MJ4ji7um.mjs";
+import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-DdXmHLK4.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { c as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-D2VT97-U.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
@@ -814,14 +814,14 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$8 = 36e5;
+var HOUR_MS$9 = 36e5;
 /** A device walked end-to-end. Cheaper and clearer than inserting every hour of
 *  the retention window into the set. */
 var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$8) * HOUR_MS$8;
-	for (let h = first; h < toMs; h += HOUR_MS$8) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$9) * HOUR_MS$9;
+	for (let h = first; h < toMs; h += HOUR_MS$9) yield h;
 }
 /**
 * Index of the first element whose `startMs` is GREATER than `startMs` (upper
@@ -1115,7 +1115,7 @@ var RecordingIndex = class {
 			changed = true;
 		}
 		if (changed) this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$8);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$9);
 	}
 	/**
 	* Insert/replace one finalized segment (idempotent by path).
@@ -1761,11 +1761,11 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	const p2 = (n) => String(n).padStart(2, "0");
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
-var HOUR_MS$7 = 36e5;
+var HOUR_MS$8 = 36e5;
 async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger, ledger, options) {
 	const verify = options?.verifyClosedHours === true;
 	if (!verify && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
-	const liveHour = Math.floor(Date.now() / HOUR_MS$7) * HOUR_MS$7;
+	const liveHour = Math.floor(Date.now() / HOUR_MS$8) * HOUR_MS$8;
 	/** Per (locationId, profile, hour): what the LEDGER claimed, for the diff. */
 	const claimed = /* @__PURE__ */ new Map();
 	const claimKey = (locationId, hour) => `${locationId}:${hour}`;
@@ -1815,15 +1815,15 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			});
 			continue;
 		}
-		const first = Math.floor(fromMs / HOUR_MS$7) * HOUR_MS$7;
+		const first = Math.floor(fromMs / HOUR_MS$8) * HOUR_MS$8;
 		const reuseBefore = index.hydrateReuseStats();
 		let hoursRead = 0;
 		let repaired = 0;
 		let forgottenSegments = 0;
 		let forgottenHours = 0;
 		let sealed = 0;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$7) {
-			if (!verify && hour < liveHour && !unsealed.has(hour) && index.hydrationOf(deviceId, hour, hour + HOUR_MS$7) === "hydrated") continue;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$8) {
+			if (!verify && hour < liveHour && !unsealed.has(hour) && index.hydrationOf(deviceId, hour, hour + HOUR_MS$8) === "hydrated") continue;
 			for (const profile of profiles) {
 				const rel = hourDirRelPath(deviceId, profile, hour);
 				let files;
@@ -1836,7 +1836,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 				const locationId = locationForHydratedProfile(aliases, profile).id;
 				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
 				index.hydrateHour(deviceId, locationId, hour, relPaths);
-				if (ledger === void 0 || relPaths.length === 0 || hour + HOUR_MS$7 > Date.now()) continue;
+				if (ledger === void 0 || relPaths.length === 0 || hour + HOUR_MS$8 > Date.now()) continue;
 				const claimedHere = claimed.get(claimKey(locationId, hour));
 				const outcome = await ledger.adoptWalkedHour(deviceId, profile, locationId, hour, relPaths);
 				if (outcome === null) continue;
@@ -1919,7 +1919,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 */
 var DEFAULT_THROTTLE_MBPS = 40;
 /** The durable index's bucket, and therefore this mover's batch. */
-var HOUR_MS$6 = 36e5;
+var HOUR_MS$7 = 36e5;
 /** Progress callback cadence (files) — cheap enough to fire often. */
 var PROGRESS_EVERY_FILES = 25;
 /** Free space a destination must keep when it declares no `config.minFreePercent`
@@ -2616,7 +2616,7 @@ function profilesOfClass(footageClass) {
 function groupByHour(rows) {
 	const out = /* @__PURE__ */ new Map();
 	for (const row of rows) {
-		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$6)}`;
+		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$7)}`;
 		const found = out.get(key);
 		if (found) found.push(row);
 		else out.set(key, [row]);
@@ -3844,7 +3844,7 @@ async function profileHasFootage(root, deviceId, profile) {
 //#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
-var HOUR_MS$5 = 36e5;
+var HOUR_MS$6 = 36e5;
 /**
 * UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
 *
@@ -3882,8 +3882,8 @@ var RANGE_MERGE_GAP_MS$1 = 5e3;
 * deploy gap). Unknown hours still fall through to one directory read.
 */
 function hourSegmentsFromIndex(index, deviceId, profile, hourStartMs) {
-	const hour = Math.floor(hourStartMs / HOUR_MS$5) * HOUR_MS$5;
-	const hourEnd = hour + HOUR_MS$5;
+	const hour = Math.floor(hourStartMs / HOUR_MS$6) * HOUR_MS$6;
+	const hourEnd = hour + HOUR_MS$6;
 	if (index.hydrationOf(deviceId, hour, hourEnd) !== "hydrated") return null;
 	const rows = [];
 	for (const s of index.segmentsStartingIn(deviceId, profile, hour, hourEnd)) rows.push({
@@ -4042,7 +4042,7 @@ var CalendarIndex = class {
 		}));
 		const days = /* @__PURE__ */ new Set();
 		for (const { day, hours } of perDay) for (const h of hours) {
-			const at = day + h * HOUR_MS$5;
+			const at = day + h * HOUR_MS$6;
 			if (at < fromMs || at >= toMs) continue;
 			days.add(localDayStart(at, tzOffsetMinutes));
 		}
@@ -4104,7 +4104,7 @@ var CalendarIndex = class {
 		const day = utcDayOf(utcDayMs);
 		for (let h = 0; h < 24; h++) {
 			await this.awaitQuiet();
-			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$5, true);
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$6, true);
 		}
 	}
 	/**
@@ -4125,7 +4125,7 @@ var CalendarIndex = class {
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
 		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
-		const hour = Math.floor(hourStartMs / HOUR_MS$5) * HOUR_MS$5;
+		const hour = Math.floor(hourStartMs / HOUR_MS$6) * HOUR_MS$6;
 		const fromIndex = this.deps.indexHour?.(deviceId, profile, hour);
 		if (fromIndex !== null && fromIndex !== void 0) return {
 			segments: fromIndex,
@@ -4133,7 +4133,7 @@ var CalendarIndex = class {
 		};
 		const key = `${deviceId}:${profile}:${hour}`;
 		const now = this.deps.now?.() ?? Date.now();
-		const isCurrentHour = hour === Math.floor(now / HOUR_MS$5) * HOUR_MS$5;
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$6) * HOUR_MS$6;
 		const cached = this.hourSegs.get(key);
 		if (cached !== void 0) {
 			if (!isCurrentHour) return {
@@ -4197,7 +4197,7 @@ var CalendarIndex = class {
 	*/
 	async dayRanges(deviceId, profile, utcDayMs) {
 		const day = utcDayOf(utcDayMs);
-		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$5), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$6), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
 	}
 	/**
 	* Exact ranges of `[fromMs, toMs)`, scanning ONLY the hours the window
@@ -4211,9 +4211,9 @@ var CalendarIndex = class {
 	*/
 	async rangesIn(deviceId, profile, fromMs, toMs) {
 		if (toMs <= fromMs) return [];
-		const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
+		const first = Math.floor(fromMs / HOUR_MS$6) * HOUR_MS$6;
 		const hours = [];
-		for (let hour = first; hour < toMs; hour += HOUR_MS$5) hours.push(hour);
+		for (let hour = first; hour < toMs; hour += HOUR_MS$6) hours.push(hour);
 		const perHour = await mapBounded(hours, READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour));
 		const ranges = [];
 		for (const r of mergeRanges(perHour.flat(), RANGE_MERGE_GAP_MS$1)) {
@@ -4765,7 +4765,7 @@ function handleStoreCensusAction(census, logger, input) {
 }
 //#endregion
 //#region src/recorder/addon/directory-handler.ts
-var HOUR_MS$4 = 36e5;
+var HOUR_MS$5 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
 *  would walk the archive on the read path — the thing this replaces. */
 var MAX_WINDOW_MS = 32 * 864e5;
@@ -4812,9 +4812,9 @@ function withDirectoryRoute(deps, next) {
 				return;
 			}
 			const rows = [];
-			const firstHour = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
+			const firstHour = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
 			let hydrated = true;
-			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$4) {
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$5) {
 				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
 				if (!complete) hydrated = false;
 				for (const s of segments) {
@@ -8565,7 +8565,7 @@ var DurableLedger = class DurableLedger {
 };
 //#endregion
 //#region src/recorder/addon/segment-hour-ledger.ts
-var HOUR_MS$3 = 36e5;
+var HOUR_MS$4 = 36e5;
 /** `Math.min` where a missing left operand means "nothing yet", not `NaN`. */
 function minOf(a, b) {
 	return a === null ? b : Math.min(a, b);
@@ -8704,6 +8704,27 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 		]
 	})
 ];
+/**
+* How far into an hour a writer's first finalize may land and the writer still
+* be the party that KNOWS what the hour holds (D521).
+*
+* A seal is a claim of completeness. A writer that was running across the hour
+* boundary produces its first in-hour segment within ONE segment length of the
+* boundary — the segment that straddles it belongs to the previous hour by its
+* `startMs`. So the grace is one segment length at the longest anyone
+* configures here (60 s), plus 30 s for a keyframe-cut segment overrunning its
+* nominal `-segment_time` (ffmpeg cuts on the next GOP, never on the clock).
+*
+* It is a guess, and this is the shape of being wrong in each direction.
+* TIGHTER: a normal rollover stops sealing, every hour of the archive is walked
+* once by its first reader, and D451's "at rest nothing is unsealed" is undone
+* — at ~3.6 ms per hour directory cold, affordable but pointless. LOOSER: a
+* runner respawn inside the window seals an hour it entered late, which is
+* exactly the 2026-09-17 defect; the observed hole there was ~29 minutes, so
+* anything under a few minutes would have caught it and 90 s is the smallest
+* number that does not fire on a legitimate rollover.
+*/
+var WRITER_HOUR_ENTRY_GRACE_MS = 9e4;
 /** The identity of the {@link hourAggregate} fold — an hour holding nothing. */
 var EMPTY_HOUR_AGGREGATE = {
 	bytes: 0,
@@ -8924,7 +8945,7 @@ var EMPTY_ACCOUNTING = {
 	newestMs: null
 };
 function hourStartMs(startMs) {
-	return Math.floor(startMs / HOUR_MS$3) * HOUR_MS$3;
+	return Math.floor(startMs / HOUR_MS$4) * HOUR_MS$4;
 }
 function segmentHourKey(deviceId, profile, locationId, hour) {
 	return `${deviceId}|${profile}|${locationId}|${hour}`;
@@ -8941,6 +8962,11 @@ function hourOf(row) {
 function writerKey(deviceId, profile) {
 	return `${deviceId}|${profile}`;
 }
+/** One writer's hour, WITHOUT the location — the identity a loss is reported
+*  against by a party that only knows the camera, the profile and the clock. */
+function writerHourKey(deviceId, profile, hour) {
+	return `${deviceId}|${profile}|${hour}`;
+}
 function detailOf(row) {
 	return {
 		locationId: row.locationId,
@@ -9087,6 +9113,13 @@ var SegmentHourLedger = class SegmentHourLedger {
 	writerHours = /* @__PURE__ */ new Map();
 	/** Hour keys a write was REFUSED for in this process — never sealed by it. */
 	refused = /* @__PURE__ */ new Set();
+	/**
+	* `${deviceId}|${profile}|${hourStartMs}` a LOSS was reported for, location
+	* left out on purpose: the party that sees the loss (the playlist watcher)
+	* knows the camera and the profile and has no business knowing which disk
+	* the recorder happens to be placing that hour on.
+	*/
+	refusedWriterHours = /* @__PURE__ */ new Set();
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.store = deps.store;
@@ -9297,6 +9330,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*
 	* `null` when the row is known and its detail could not be read: nothing
 	* is written from a row whose paths are not resident.
+	*
+	* @seal-authority closed-hour-listing — a directory read of an hour that is
+	* OVER is the one complete answer there is; the caller guarantees the hour is
+	* closed (D451, D521).
 	*/
 	async adoptWalkedHour(deviceId, profile, locationId, hour, paths) {
 		const key = segmentHourKey(deviceId, profile, locationId, hour);
@@ -9381,11 +9418,65 @@ var SegmentHourLedger = class SegmentHourLedger {
 	markRefused(row) {
 		this.refused.add(hourOf(row).key);
 	}
+	/**
+	* Segments a writer produced that never reached {@link recordSegment} — the
+	* watcher's `rolledOff`, the one moment the system KNOWS work was skipped.
+	*
+	* Every hour the loss spans is refused the seal, whatever else this process
+	* believes about them: the ownership grace answers "was I here", and this
+	* answers "did I get everything while I was". Camera 615's respawned writer
+	* passed the first question for the hour it entered at the top and still held
+	* a row short by 175 segments.
+	*
+	* Returns how many hours were marked, so the caller's line reports what its
+	* report bought rather than that it was made.
+	*/
+	markHoursRefused(span) {
+		if (!Number.isFinite(span.fromMs) || !Number.isFinite(span.toMs)) return 0;
+		const first = hourStartMs(Math.min(span.fromMs, span.toMs));
+		const last = hourStartMs(Math.max(span.fromMs, span.toMs));
+		let marked = 0;
+		for (let hour = first; hour <= last && marked < 24; hour += HOUR_MS$4) {
+			this.refusedWriterHours.add(writerHourKey(span.deviceId, span.profile, hour));
+			marked += 1;
+		}
+		if (marked === 0) return 0;
+		this.logger.warn("recorder: segments this writer produced never reached the hour ledger — these hours stay UNSEALED and a reader walks them", {
+			tags: { deviceId: span.deviceId },
+			meta: {
+				profile: span.profile,
+				fromMs: first,
+				toMs: last,
+				hours: marked,
+				segments: span.count,
+				boundHours: 24
+			}
+		});
+		return marked;
+	}
 	/** One write: the row as held, flagged sealed. Serialised on its key so it
-	*  cannot land over an append that read the row before it. */
+	*  cannot land over an append that read the row before it.
+	*
+	*  @seal-authority writer-owned-hour — the writer that LEAVES the hour, and
+	*  only when it entered within {@link WRITER_HOUR_ENTRY_GRACE_MS} of the
+	*  hour's start and no loss was reported against it (D521). */
 	async sealHour(target) {
 		await this.serialized(target.key, async () => {
-			if (this.refused.has(target.key)) {
+			const enteredAfterMs = target.entryMs - target.hourStartMs;
+			if (enteredAfterMs > 9e4) {
+				this.logger.warn("recorder: hour left unsealed — this writer entered it late, so it cannot claim the hour is complete", {
+					tags: { deviceId: target.deviceId },
+					meta: {
+						profile: target.profile,
+						locationId: target.locationId,
+						hourStartMs: target.hourStartMs,
+						enteredAfterMs,
+						graceMs: WRITER_HOUR_ENTRY_GRACE_MS
+					}
+				});
+				return;
+			}
+			if (this.refused.has(target.key) || this.refusedWriterHours.has(writerHourKey(target.deviceId, target.profile, target.hourStartMs))) {
 				this.logger.warn("recorder: hour left unsealed — a ledger write for it was refused, so its row is short and a reader must walk it", {
 					tags: { deviceId: target.deviceId },
 					meta: {
@@ -9405,9 +9496,15 @@ var SegmentHourLedger = class SegmentHourLedger {
 		});
 	}
 	/**
-	* Remember which hour this writer is on; when it MOVES FORWARD, seal the
-	* hour it left. Backwards is a late finalize (a recovered orphan, a replay)
-	* into an hour already accounted for, and seals nothing.
+	* Remember which hour this writer is on — and how far into it this process
+	* ARRIVED ({@link WriterHour.entryMs}, the first finalize's own start) —
+	* and when it MOVES FORWARD, seal the hour it left. Backwards is a late
+	* finalize (a recovered orphan, a replay) into an hour already accounted for,
+	* and seals nothing.
+	*
+	* The entry stamp is kept from the FIRST finalize into the hour and never
+	* refreshed: the question the seal has to answer is "was this writer here
+	* when the hour began", and the last segment of the hour cannot answer it.
 	*/
 	noteWriter(next) {
 		const id = writerKey(next.deviceId, next.profile);
@@ -9524,7 +9621,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/** The hour a write path may touch: current + previous. Materialised at boot
 	*  so {@link recordSegment}'s dedup gate answers from RAM (D49). */
 	async materializeLiveTail() {
-		const oldest = hourStartMs(this.now()) - (LIVE_TAIL_HOURS - 1) * HOUR_MS$3;
+		const oldest = hourStartMs(this.now()) - (LIVE_TAIL_HOURS - 1) * HOUR_MS$4;
 		const keys = [];
 		for (const row of this.ledger.snapshot()) if (row.hourStartMs >= oldest && !row.pathsResident) keys.push(row.key);
 		return (await this.materialize(keys)).length;
@@ -10032,7 +10129,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 			deviceId: row.deviceId,
 			profile: row.profile,
 			locationId: row.locationId,
-			hourStartMs: hour
+			hourStartMs: hour,
+			entryMs: row.startMs
 		});
 		await this.serialized(key, async () => {
 			if (!this.ledger.has(key)) {
@@ -10418,7 +10516,7 @@ function locationKey(deviceId, locationId) {
 * Work it does not finish is left for the next pass and REPORTED, never
 * silently dropped.
 */
-var HOUR_MS$2 = 36e5;
+var HOUR_MS$3 = 36e5;
 /**
 * Group resolved locations by PHYSICAL root, so two aliases of one disk are
 * probed once and a `true` from each is not mistaken for the file existing in
@@ -10527,7 +10625,7 @@ var GhostLocationSweeper = class {
 				refused: null
 			};
 		}
-		const liveTailFrom = this.deps.now() - HOUR_MS$2;
+		const liveTailFrom = this.deps.now() - HOUR_MS$3;
 		let examined = 0;
 		let probes = 0;
 		let repointedHours = 0;
@@ -11109,7 +11207,7 @@ function createRecordingConfigMirror(deps) {
 }
 //#endregion
 //#region src/recorder/addon/ledger-walk-reconcile.ts
-var HOUR_MS$1 = 36e5;
+var HOUR_MS$2 = 36e5;
 /** Every reason at zero, so a reason that never fired reports as zero rather
 *  than absent and the summary shape is constant between passes. */
 function zeroReasons() {
@@ -11205,7 +11303,7 @@ var LedgerWalkReconciler = class {
 			ledger,
 			apply,
 			anchor: anchor.volumeId,
-			liveTailFrom: hourStartMs(this.deps.now()) - 1 * HOUR_MS$1,
+			liveTailFrom: hourStartMs(this.deps.now()) - 1 * HOUR_MS$2,
 			maxHours: this.deps.maxHours ?? 4096,
 			byDevice: /* @__PURE__ */ new Map(),
 			skippedByReason: zeroReasons(),
@@ -11838,6 +11936,240 @@ function pendingMovesSignature(moves) {
 	return moves.map((m) => `${String(m.deviceId)}:${m.profile}>${m.plannedFor}`).join(",");
 }
 //#endregion
+//#region src/recorder/addon/hour-adoption-sweep.ts
+var HOUR_MS$1 = 36e5;
+/** The profile trees a camera directory is allowed to have. Everything else
+*  under it (`events/`, the retired `strips/`) has no hour tree worth probing. */
+var PROFILES = [
+	"high",
+	"mid",
+	"low"
+];
+function isTwoDigit(name) {
+	return /^\d{2}$/.test(name);
+}
+/** One directory level in a stable order. Lexicographic, not numeric: it is the
+*  CURSOR's order, and zero-padded path components (`09`, `17`) already sort
+*  chronologically — device ids do not, and do not need to. */
+function inCursorOrder(names) {
+	return [...names].toSorted();
+}
+/**
+* One add-only pass over one location's hour directories.
+*
+* Never throws: a directory that cannot be read is counted and the pass
+* continues; a precondition failure is a named refusal and the pass does
+* nothing at all.
+*/
+var HourAdoptionSweeper = class {
+	deps;
+	/** Where the last bounded pass stopped (`rel` of the last hour it walked).
+	*  In RAM: a restart re-walks from the top, which costs listings and can
+	*  never cost footage. */
+	cursor = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async sweep(request) {
+		const location = this.deps.locations().find((candidate) => candidate.id === request.locationId);
+		if (location === void 0) return this.refusedReport(request.locationId, "location-unknown");
+		if (!locationMayBeRead(location)) return this.refusedReport(location.id, "location-unreadable");
+		const ledger = this.deps.ledger();
+		if (ledger === null) {
+			this.deps.logger.warn("recorder: hour adoption REFUSED — this node holds no durable hour ledger, so there is nothing to adopt into", { meta: { locationId: location.id } });
+			return this.refusedReport(location.id, "no-ledger");
+		}
+		const liveTailFrom = hourStartMs(this.deps.now()) - 1 * HOUR_MS$1;
+		const maxHours = this.deps.maxHours ?? 512;
+		const resume = this.cursor;
+		const byDevice = /* @__PURE__ */ new Map();
+		let listings = 0;
+		let hoursAdopted = 0;
+		let hoursRefusedByLedger = 0;
+		let hoursSkippedLive = 0;
+		let hoursSkippedEmpty = 0;
+		let listingErrors = 0;
+		let segmentsAdded = 0;
+		let hoursCreated = 0;
+		let bounded = false;
+		let last = null;
+		for await (const candidate of this.candidates(location, () => {
+			listingErrors += 1;
+		})) {
+			if (resume !== null && candidate.rel <= resume) continue;
+			if (candidate.hourStartMs >= liveTailFrom) {
+				hoursSkippedLive += 1;
+				continue;
+			}
+			if (listings >= maxHours) {
+				bounded = true;
+				break;
+			}
+			let names;
+			try {
+				names = await this.deps.listDir(`${location.root}/${candidate.rel}`);
+			} catch (err) {
+				listingErrors += 1;
+				this.deps.logger.debug("recorder: hour adoption could not list an hour directory", {
+					tags: { deviceId: candidate.deviceId },
+					meta: {
+						locationId: location.id,
+						rel: candidate.rel,
+						error: errMsg(err)
+					}
+				});
+				continue;
+			}
+			listings += 1;
+			last = candidate.rel;
+			if (listings % 8 === 0) await this.deps.pace();
+			const paths = (names ?? []).filter((name) => name.endsWith(".m4s")).map((name) => `${candidate.rel}/${name}`);
+			if (paths.length === 0) {
+				hoursSkippedEmpty += 1;
+				continue;
+			}
+			const outcome = await ledger.adoptWalkedHour(candidate.deviceId, candidate.profile, location.id, candidate.hourStartMs, paths);
+			if (outcome === null) {
+				hoursRefusedByLedger += 1;
+				continue;
+			}
+			hoursAdopted += 1;
+			segmentsAdded += outcome.added;
+			if (outcome.created) hoursCreated += 1;
+			const tally = byDevice.get(candidate.deviceId) ?? {
+				hoursAdopted: 0,
+				segmentsAdded: 0,
+				hoursCreated: 0
+			};
+			tally.hoursAdopted += 1;
+			tally.segmentsAdded += outcome.added;
+			if (outcome.created) tally.hoursCreated += 1;
+			byDevice.set(candidate.deviceId, tally);
+			if (outcome.added > 0) this.deps.logger.warn("recorder: adopted segments the durable hour row did not name — this hour was under-reported to every reader", {
+				tags: { deviceId: candidate.deviceId },
+				meta: {
+					locationId: location.id,
+					profile: candidate.profile,
+					hourStartMs: candidate.hourStartMs,
+					added: outcome.added,
+					created: outcome.created,
+					onDisk: paths.length
+				}
+			});
+		}
+		this.cursor = bounded ? last ?? resume : null;
+		const report = {
+			locationId: location.id,
+			refused: null,
+			listings,
+			hoursAdopted,
+			hoursRefusedByLedger,
+			hoursSkippedLive,
+			hoursSkippedEmpty,
+			listingErrors,
+			segmentsAdded,
+			hoursCreated,
+			bounded,
+			byDevice: [...byDevice.entries()].map(([deviceId, tally]) => ({
+				deviceId,
+				...tally
+			})).toSorted((a, b) => a.deviceId - b.deviceId)
+		};
+		this.report(report);
+		return report;
+	}
+	/**
+	* Every hour directory under this location, in cursor order.
+	*
+	* Sorted at each level so the cursor is a total order over a tree two passes
+	* see differently: a camera added between passes appears in its place rather
+	* than at the end, and is picked up by the pass after the cursor resets.
+	*/
+	async *candidates(location, onError) {
+		const devices = await this.list(location.root, onError);
+		for (const device of inCursorOrder(devices.filter((name) => /^\d+$/.test(name)))) {
+			const deviceId = Number(device);
+			if (!Number.isSafeInteger(deviceId)) continue;
+			const present = new Set(await this.list(`${location.root}/${device}`, onError));
+			for (const profile of PROFILES) {
+				if (!present.has(profile)) continue;
+				const base = `${device}/${profile}`;
+				for (const year of inCursorOrder((await this.list(`${location.root}/${base}`, onError)).filter((n) => /^\d{4}$/.test(n)))) for (const month of inCursorOrder((await this.list(`${location.root}/${base}/${year}`, onError)).filter(isTwoDigit))) for (const day of inCursorOrder((await this.list(`${location.root}/${base}/${year}/${month}`, onError)).filter(isTwoDigit))) {
+					const dayDir = `${base}/${year}/${month}/${day}`;
+					for (const hour of inCursorOrder((await this.list(`${location.root}/${dayDir}`, onError)).filter(isTwoDigit))) {
+						const startMs = Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hour));
+						if (!Number.isFinite(startMs)) continue;
+						yield {
+							deviceId,
+							profile,
+							hourStartMs: startMs,
+							rel: `${dayDir}/${hour}`
+						};
+					}
+				}
+			}
+		}
+	}
+	/** One directory's names; `[]` for a directory that is not there, and `[]`
+	*  plus a counted error for one that could not be read. */
+	async list(absDir, onError) {
+		try {
+			return await this.deps.listDir(absDir) ?? [];
+		} catch (err) {
+			onError();
+			this.deps.logger.debug("recorder: hour adoption could not list a directory", { meta: {
+				dir: absDir,
+				error: errMsg(err)
+			} });
+			return [];
+		}
+	}
+	refusedReport(locationId, refused) {
+		return {
+			locationId,
+			refused,
+			listings: 0,
+			hoursAdopted: 0,
+			hoursRefusedByLedger: 0,
+			hoursSkippedLive: 0,
+			hoursSkippedEmpty: 0,
+			listingErrors: 0,
+			segmentsAdded: 0,
+			hoursCreated: 0,
+			bounded: false,
+			byDevice: []
+		};
+	}
+	/** One line per camera that gained something, then one for the pass — a pass
+	*  that found nothing must still be distinguishable from one that never ran. */
+	report(report) {
+		for (const device of report.byDevice) {
+			if (device.segmentsAdded === 0 && device.hoursCreated === 0) continue;
+			this.deps.logger.info("recorder: hour adoption — camera summary", {
+				tags: { deviceId: device.deviceId },
+				meta: {
+					locationId: report.locationId,
+					hoursAdopted: device.hoursAdopted,
+					segmentsAdded: device.segmentsAdded,
+					hoursCreated: device.hoursCreated
+				}
+			});
+		}
+		this.deps.logger.info("recorder: hour adoption pass complete", { meta: {
+			locationId: report.locationId,
+			listings: report.listings,
+			hoursAdopted: report.hoursAdopted,
+			hoursRefusedByLedger: report.hoursRefusedByLedger,
+			hoursSkippedLive: report.hoursSkippedLive,
+			hoursSkippedEmpty: report.hoursSkippedEmpty,
+			listingErrors: report.listingErrors,
+			segmentsAdded: report.segmentsAdded,
+			hoursCreated: report.hoursCreated,
+			bounded: report.bounded
+		} });
+	}
+};
+//#endregion
 //#region src/recorder/addon/periodic-pass.ts
 function startPeriodicPass(deps) {
 	const now = () => deps.now?.() ?? Date.now();
@@ -14197,11 +14529,16 @@ function planFinalizations(body, processed, forceFinal = false) {
 			durMs
 		});
 	}
+	const front = entries.length > 0 ? parseEpochStartMs(entries[0].segPath) : null;
+	const longestDurMs = entries.reduce((longest, entry) => Math.max(longest, Math.round(entry.durSeconds * 1e3)), 0);
+	const spanKnown = rolledOff > 0 && front !== null && longestDurMs > 0;
 	return {
 		toHandle,
 		from: hw,
 		processed: Math.max(hw, finalizable),
-		rolledOff
+		rolledOff,
+		rolledOffFromMs: spanKnown ? front - rolledOff * longestDurMs : null,
+		rolledOffToMs: spanKnown ? front : null
 	};
 }
 /**
@@ -14229,11 +14566,24 @@ function startSegmentWatcher(deps) {
 				return;
 			}
 			const plan = planFinalizations(body, processed, forceFinal);
-			if (plan.rolledOff > 0) deps.logger.warn("segment playlist rolled past entries this watcher had not handled", { meta: {
-				rolledOff: plan.rolledOff,
-				processed,
-				from: plan.from
-			} });
+			if (plan.rolledOff > 0) {
+				deps.logger.warn("segment playlist rolled past entries this watcher had not handled", {
+					tags: { deviceId: deps.deviceId },
+					meta: {
+						rolledOff: plan.rolledOff,
+						processed,
+						from: plan.from,
+						fromMs: plan.rolledOffFromMs,
+						toMs: plan.rolledOffToMs
+					}
+				});
+				deps.onSegmentsMissed?.({
+					deviceId: deps.deviceId,
+					count: plan.rolledOff,
+					fromMs: plan.rolledOffFromMs,
+					toMs: plan.rolledOffToMs
+				});
+			}
 			let index = plan.from;
 			for (const { entry, durMs } of plan.toHandle) {
 				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger, deps.writerStartedMs) === "pending") {
@@ -14243,11 +14593,14 @@ function startSegmentWatcher(deps) {
 							waitedMs,
 							boundMs: 3e4
 						})) {
-							deps.logger.warn("segment file never landed — skipping", { meta: {
-								seg: entry.segPath,
-								waitedMs,
-								boundMs: PENDING_GRACE_MS
-							} });
+							deps.logger.warn("segment file never landed — skipping", {
+								tags: { deviceId: deps.deviceId },
+								meta: {
+									seg: entry.segPath,
+									waitedMs,
+									boundMs: PENDING_GRACE_MS
+								}
+							});
 							pendingIndex = -1;
 							pendingSinceMs = 0;
 							index++;
@@ -16085,8 +16438,12 @@ var RecordingController = class {
 			writer,
 			watcher: startSegmentWatcher({
 				outDir,
+				deviceId,
 				writerStartedMs,
 				now: () => this.now(),
+				onSegmentsMissed: (missed) => {
+					this.deps.onSegmentsMissed?.(missed, profile);
+				},
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
@@ -17428,6 +17785,20 @@ var GHOST_LOCATION_PROBE_PAUSE_MS = 50;
 * hung an SSH session on 2026-08-29.
 */
 var LEDGER_WALK_PAUSE_MS = 100;
+/**
+* How often the ADD-only hour adoption pass runs (D521).
+*
+* Daily, for the same reason the ghost sweep is daily: it spends `readdir`
+* syscalls on the array every live read competes for, and the damage it repairs
+* is made by a writer teardown — an event measured in days, not minutes. It
+* does NOT run at boot (`startPeriodicPass` fires on the interval only), which
+* is when the staging reconcile, the ledger load and the first retention sweep
+* are already contending for that array.
+*/
+var HOUR_ADOPTION_INTERVAL_MS = 1440 * 6e4;
+/** An adoption pass longer than this is reported with its duration. Bounded
+*  work (512 hour listings, paced) — minutes is normal, an hour is not. */
+var HOUR_ADOPTION_SLOW_AFTER_MS = 10 * 6e4;
 /** What the per-volume usage row reports when the hour ledger is unavailable:
 *  nothing measured, rather than a total counted off a partial RAM index. */
 var EMPTY_ARCHIVE_ACCOUNTING = {
@@ -17652,6 +18023,7 @@ var RecorderV2Addon = class extends BaseAddon {
 	/** Daily ghost-location reconcile: durable hour rows stamped with a location
 	*  the storage record no longer has. Armed in `onHubReachable`. */
 	ghostLocationPass = null;
+	hourAdoptionPass = null;
 	/** Reversible migration pause lease; never reflected in RecordingConfig. */
 	storageMigrationLeaseId = null;
 	/**
@@ -17893,6 +18265,27 @@ var RecorderV2Addon = class extends BaseAddon {
 			onWriterClosed: async (deviceId, profile) => {
 				await this.segmentHours?.sealWriter(deviceId, profile);
 			},
+			onSegmentsMissed: (missed, profile) => {
+				const ledger = this.segmentHours;
+				if (ledger === null) return;
+				if (missed.fromMs === null || missed.toMs === null) {
+					this.ctx.logger.warn("recorder: segments were missed but the playlist named no span — NO hour could be held unsealed for them", {
+						tags: { deviceId: missed.deviceId },
+						meta: {
+							profile,
+							segments: missed.count
+						}
+					});
+					return;
+				}
+				ledger.markHoursRefused({
+					deviceId: missed.deviceId,
+					profile,
+					fromMs: missed.fromMs,
+					toMs: missed.toMs,
+					count: missed.count
+				});
+			},
 			spawn,
 			costRegistry: this.costRegistry,
 			segmentSeconds: this.config.segmentSeconds,
@@ -18258,6 +18651,8 @@ var RecorderV2Addon = class extends BaseAddon {
 		this.redundancySweeper = null;
 		this.ghostLocationPass?.stop();
 		this.ghostLocationPass = null;
+		this.hourAdoptionPass?.stop();
+		this.hourAdoptionPass = null;
 		this.exportEngine = null;
 		this.recordingProvider = null;
 	}
@@ -18509,6 +18904,32 @@ var RecorderV2Addon = class extends BaseAddon {
 				logger: this.ctx.logger
 			});
 		}
+		if (this.hourAdoptionPass === null) {
+			const adopter = new HourAdoptionSweeper({
+				ledger: () => this.segmentHours,
+				locations: () => this.resolvedLocations,
+				listDir: async (absDir) => {
+					try {
+						return await promises.readdir(absDir);
+					} catch (err) {
+						if (err.code === "ENOENT") return null;
+						throw err;
+					}
+				},
+				logger: this.ctx.logger,
+				now: () => Date.now(),
+				pace: () => sleep$1(LEDGER_WALK_PAUSE_MS)
+			});
+			this.hourAdoptionPass = startPeriodicPass({
+				name: "hour-adoption",
+				intervalMs: HOUR_ADOPTION_INTERVAL_MS,
+				slowAfterMs: HOUR_ADOPTION_SLOW_AFTER_MS,
+				run: async () => {
+					for (const location of this.resolvedLocations) await adopter.sweep({ locationId: location.id });
+				},
+				logger: this.ctx.logger
+			});
+		}
 	}
 	/**
 	* Print one window of detection-trigger health.