@camstack/addon-pipeline 1.2.257 → 1.2.258

package/dist/recorder/index.mjs

@@ -1,7 +1,7 @@
-import { $t as hydrateSchema, C as OpsLogEntrySchema, Ct as recordingExportCapability, D as RECORDING_EXPORT_MAX_READ_BYTES, Dt as resolveLocationMode, H as deriveBatteryPresence, I as batteryCapability, Kt as DeviceFeature, Lt as errMsg, Mt as storageOccupancyCapability, O as RecordingConfigSchema, Pt as stripRetiredBandPreBufferSec, Q as evictionPolicyOfLocation, St as recordingCapability, W as deriveRecordingMode, Wt as BaseAddon, Xt as customAction, Y as evaluateSensorEdge, Z as evictionPolicyForMode, Zt as defineCustomActions, _n as record, bn as EventCategory, cn as _enum, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as modeMayWrite, et as gbToBytes, g as ExportRecordSchema, gn as preprocess, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, jt as storageEvictableCapability, k as RecordingSignalStatusSchema, kt as resolveRecordingProfiles, ln as array, lt as mayWriteToLocation, mn as number, on as selectAssignedProfileSlots, qt as DeviceType, rn as nodePin, rt as isFirstLevelMacroClass, sn as sleep$1, un as boolean, ut as migrateLegacyDeviceSignalConfig, vn as string, wt as recordingSignalCapability } from "../dist-xsaGDCOu.mjs";
-import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-Fv4ByT36.mjs";
+import { $t as hydrateSchema, C as OpsLogEntrySchema, Ct as recordingExportCapability, D as RECORDING_EXPORT_MAX_READ_BYTES, Dt as resolveLocationMode, H as deriveBatteryPresence, I as batteryCapability, Kt as DeviceFeature, Lt as errMsg, Mt as storageOccupancyCapability, O as RecordingConfigSchema, Pt as stripRetiredBandPreBufferSec, Q as evictionPolicyOfLocation, St as recordingCapability, W as deriveRecordingMode, Wt as BaseAddon, Xt as customAction, Y as evaluateSensorEdge, Z as evictionPolicyForMode, Zt as defineCustomActions, _n as record, bn as EventCategory, cn as _enum, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as modeMayWrite, et as gbToBytes, g as ExportRecordSchema, gn as preprocess, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, jt as storageEvictableCapability, k as RecordingSignalStatusSchema, kt as resolveRecordingProfiles, ln as array, lt as mayWriteToLocation, mn as number, on as selectAssignedProfileSlots, qt as DeviceType, rn as nodePin, rt as isFirstLevelMacroClass, sn as sleep$1, un as boolean, ut as migrateLegacyDeviceSignalConfig, vn as string, wt as recordingSignalCapability } from "../dist-D3w2fwD4.mjs";
+import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-IHGNrWH9.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { c as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-D2VT97-U.mjs";
+import { l as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-CgyZI565.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";
@@ -814,14 +814,22 @@ function parseSegmentPath(relPath) {
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
 var HOUR_MS$9 = 36e5;
-/** A device walked end-to-end. Cheaper and clearer than inserting every hour of
-*  the retention window into the set. */
-var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
 	const first = Math.floor(fromMs / HOUR_MS$9) * HOUR_MS$9;
 	for (let h = first; h < toMs; h += HOUR_MS$9) yield h;
 }
+/** The hour bucket a segment belongs to — the same one its path encodes. */
+function hourOf$1(startMs) {
+	return Math.floor(startMs / HOUR_MS$9) * HOUR_MS$9;
+}
+/** The production bound. See {@link RecordingIndexBudget} for the measurement. */
+var DEFAULT_RECORDING_INDEX_BUDGET = {
+	residentRowBudget: 25e4,
+	residentHourBudget: 2e4,
+	evictToFraction: .8,
+	pinnedTailHours: 2
+};
 /**
 * Index of the first element whose `startMs` is GREATER than `startMs` (upper
 * bound). Inserting there keeps equal-start rows in arrival order — exactly
@@ -869,10 +877,35 @@ var RecordingIndex = class {
 	/** See {@link HydrateReuseStats}. */
 	rowsReused = 0;
 	rowsAllocated = 0;
-	/** Hour buckets this device has been walked for; `ALL_HOURS` after a full
-	*  hydrate. Empty = nothing has been looked at, which is NOT the same as
-	*  "there is nothing" — see {@link hydrationOf}. */
+	/**
+	* Hour buckets this device has been walked for → when anything last ASKED
+	* about that hour ({@link useTick}, 0 = never since the walk). Empty =
+	* nothing has been looked at, which is NOT the same as "there is nothing" —
+	* see {@link hydrationOf}.
+	*
+	* The tick is the eviction order, and it lives here rather than in a side
+	* map because an evicted hour must lose its marker in the SAME operation
+	* that loses its rows: a walked marker outliving its rows would report
+	* `hydrated` over an hour the index no longer holds, which is the one
+	* failure a forgetting index must not have.
+	*
+	* There used to be an `ALL_HOURS` sentinel here for a device walked
+	* end-to-end. It had no production caller (2026-08-30 census) and a bounded
+	* index can never truthfully claim it, so it is gone.
+	*/
 	walked = /* @__PURE__ */ new Map();
+	/** Monotonic "somebody asked" counter. Only ever compared, never read out. */
+	useTick = 0;
+	/** `null` until {@link armResidency}. An unarmed index never evicts. */
+	residencyDeps = null;
+	evictedRows = 0;
+	evictedHours = 0;
+	evictionPasses = 0;
+	/** Hours dropped per device, for the life of the process. One number per
+	*  camera — the input to {@link droppedDuringWalk}, nothing else. */
+	evictedHoursByDevice = /* @__PURE__ */ new Map();
+	/** {@link evictedHoursByDevice} as it stood when a whole-device walk began. */
+	walkBaseline = /* @__PURE__ */ new Map();
 	/**
 	* Upper bound on the `durMs` of any row the index holds — the ONLY thing that
 	* turns "walk the whole sorted view" into "walk backwards a bounded number of
@@ -1046,7 +1079,9 @@ var RecordingIndex = class {
 	* Deliberately NOT delete-all-then-reinsert: the archive walk re-reports rows
 	* this index already holds, with freshly built path strings, and dropping the
 	* held rows first would make those fresh strings the permanent ones — a
-	* second copy of the whole archive's paths. See {@link retainedPathStrings}.
+	* second copy of the whole archive's paths. See {@link RecordingIndex.rowFor}
+	* for the measurement (`retainedPathStrings`, which this used to point at,
+	* never existed — a leftover that read as a verification, removed 2026-09-17).
 	* @residency mutation
 	*/
 	hydrateDevice(deviceId, locationId, relPaths) {
@@ -1060,6 +1095,7 @@ var RecordingIndex = class {
 		}
 		for (const [path, existing] of m) if (existing.locationId === locationId && !seen.has(path)) m.delete(path);
 		this.invalidateSorted(deviceId);
+		this.enforceResidency();
 	}
 	/**
 	* Whether the index has WALKED `[fromMs, toMs)` for a device.
@@ -1073,7 +1109,6 @@ var RecordingIndex = class {
 	hydrationOf(deviceId, fromMs, toMs) {
 		const w = this.walked.get(deviceId);
 		if (w === void 0) return "unknown";
-		if (w === ALL_HOURS) return "hydrated";
 		let seen = 0;
 		let total = 0;
 		for (const h of hourBuckets(fromMs, toMs)) {
@@ -1085,15 +1120,225 @@ var RecordingIndex = class {
 	}
 	/** Record that `[fromMs, toMs)` has been walked, whatever it contained. @residency mutation */
 	markHydrated(deviceId, fromMs, toMs) {
+		let w = this.walked.get(deviceId);
+		if (w === void 0) {
+			w = /* @__PURE__ */ new Map();
+			this.walked.set(deviceId, w);
+		}
+		const tick = ++this.useTick;
+		for (const h of hourBuckets(fromMs, toMs)) w.set(h, tick);
+	}
+	/**
+	* Bound this index, and give it somewhere to SAY what it dropped.
+	*
+	* Called once, from the recorder addon's initialize — `ctx.logger` does not
+	* exist when the field is constructed. Until it runs the index never evicts,
+	* which is honest for the pre-init window (it holds nothing) and is the one
+	* state in which {@link ResidencyCensus.budget} is `null`.
+	* @residency mutation
+	*/
+	armResidency(deps) {
+		this.residencyDeps = deps;
+		this.enforceResidency();
+	}
+	/**
+	* A whole-device walk is starting: remember how much this index had already
+	* forgotten about that camera, so {@link droppedDuringWalk} can say whether
+	* the walk's result is a COMPLETE view of what it read.
+	* @residency mutation
+	*/
+	beginWalk(deviceId) {
+		this.walkBaseline.set(deviceId, this.evictedHoursByDevice.get(deviceId) ?? 0);
+	}
+	/**
+	* Did this index drop anything for `deviceId` since {@link beginWalk}?
+	*
+	* The one question a PRUNE has to ask. An hour the index dropped is
+	* indistinguishable, from the outside, from an hour disk no longer has — so
+	* a consumer that deletes durable state on the index's silence must refuse
+	* when the answer is `true`. `false` when nobody called `beginWalk`: an
+	* unarmed index never drops, and a caller that never announced a walk is
+	* asking about one that did not happen.
+	* @residency resident-scoped
+	*/
+	droppedDuringWalk(deviceId) {
+		const baseline = this.walkBaseline.get(deviceId);
+		if (baseline === void 0) return false;
+		return (this.evictedHoursByDevice.get(deviceId) ?? 0) > baseline;
+	}
+	/** What is held, what was let go, and under which bound. @residency resident-scoped */
+	residency() {
+		return {
+			residentRows: this.residentRowCount(),
+			residentHours: this.residentHourCount(),
+			evictedRows: this.evictedRows,
+			evictedHours: this.evictedHours,
+			evictionPasses: this.evictionPasses,
+			budget: this.residencyDeps?.budget ?? null
+		};
+	}
+	residentRowCount() {
+		let n = 0;
+		for (const m of this.byDevice.values()) n += m.size;
+		return n;
+	}
+	residentHourCount() {
+		let n = 0;
+		for (const w of this.walked.values()) n += w.size;
+		return n;
+	}
+	/**
+	* Note that something ASKED about `[fromMs, toMs)` — the only input to the
+	* eviction order.
+	*
+	* Walks whichever side is smaller: a read whose span is wider than the
+	* device's whole walked map (a month-wide `ranges`, an availability sweep)
+	* would otherwise iterate one hour at a time across the span.
+	*/
+	touch(deviceId, fromMs, toMs) {
 		const w = this.walked.get(deviceId);
-		if (w === ALL_HOURS) return;
-		const set = w ?? /* @__PURE__ */ new Set();
-		for (const h of hourBuckets(fromMs, toMs)) set.add(h);
-		this.walked.set(deviceId, set);
+		if (w === void 0 || w.size === 0) return;
+		const tick = ++this.useTick;
+		if (Math.ceil(Math.max(0, toMs - fromMs) / HOUR_MS$9) > w.size) {
+			for (const h of w.keys()) if (h < toMs && h + HOUR_MS$9 > fromMs) w.set(h, tick);
+			return;
+		}
+		for (const h of hourBuckets(fromMs, toMs)) if (w.has(h)) w.set(h, tick);
 	}
-	/** Record that the device was walked end-to-end (the background full walk). @residency mutation */
-	markHydratedAll(deviceId) {
-		this.walked.set(deviceId, ALL_HOURS);
+	/**
+	* Drop the least-recently-asked-about hours until the index is back inside
+	* its budget.
+	*
+	* ## What a dropped hour costs, and why that is safe
+	*
+	* The directory is the authority for which segments exist — every row here
+	* is derived from a path the walk read, and `hydrateHour` /
+	* `hydrateWindowFromStorage` rebuild it from one shallow `readdir` (or one
+	* ledger point read). So a drop costs a re-read, never a segment. The
+	* property that makes it costs-a-read rather than loses-a-segment is that
+	* the walked marker goes with the rows: `hydrationOf` then answers `unknown`
+	* and the reader walks. A marker left behind would answer `hydrated` over an
+	* hour holding nothing, which is exactly the silent gap this class spent
+	* D295 learning not to report.
+	*
+	* ## What is never a candidate
+	*
+	* The live tail ({@link RecordingIndexBudget.pinnedTailHours}). Those hours
+	* are write-through from the writer (`addSegment`), not walked, and a
+	* `readdir` of an hour a writer is still filling cannot give back what it
+	* had — D445's lost tail, from the other direction.
+	*/
+	enforceResidency() {
+		const deps = this.residencyDeps;
+		if (deps === null) return;
+		const { budget } = deps;
+		let rows = this.residentRowCount();
+		let hours = this.residentHourCount();
+		if (rows <= budget.residentRowBudget && hours <= budget.residentHourBudget) return;
+		const rowTarget = Math.floor(budget.residentRowBudget * budget.evictToFraction);
+		const hourTarget = Math.floor(budget.residentHourBudget * budget.evictToFraction);
+		const pinnedFrom = hourOf$1(deps.now()) - Math.max(0, budget.pinnedTailHours - 1) * HOUR_MS$9;
+		const counts = this.hourHistogram();
+		const candidates = [];
+		for (const [deviceId, byHour] of counts) {
+			const walkedHours = this.walked.get(deviceId);
+			for (const [hourStartMs, count] of byHour) {
+				if (hourStartMs >= pinnedFrom) continue;
+				candidates.push({
+					deviceId,
+					hourStartMs,
+					rows: count,
+					lastUse: walkedHours?.get(hourStartMs) ?? 0
+				});
+			}
+		}
+		candidates.sort((a, b) => a.lastUse - b.lastUse || a.hourStartMs - b.hourStartMs);
+		const victims = /* @__PURE__ */ new Map();
+		let droppedRows = 0;
+		let droppedHours = 0;
+		for (const c of candidates) {
+			if (rows <= rowTarget && hours <= hourTarget) break;
+			let forDevice = victims.get(c.deviceId);
+			if (!forDevice) {
+				forDevice = /* @__PURE__ */ new Set();
+				victims.set(c.deviceId, forDevice);
+			}
+			forDevice.add(c.hourStartMs);
+			rows -= c.rows;
+			droppedRows += c.rows;
+			if (this.walked.get(c.deviceId)?.has(c.hourStartMs) === true) {
+				hours -= 1;
+				droppedHours += 1;
+			}
+		}
+		if (victims.size === 0) return;
+		this.evictionPasses += 1;
+		this.evictedRows += droppedRows;
+		this.evictedHours += droppedHours;
+		for (const [deviceId, hoursToDrop] of victims) this.dropHours(deviceId, hoursToDrop, rows, budget, deps.logger);
+	}
+	/** `deviceId → hourStartMs → resident rows`, including hours walked and found
+	*  empty (count 0) — those hold no rows and would otherwise never be dropped,
+	*  leaving the walked map to grow without bound on its own. */
+	hourHistogram() {
+		const out = /* @__PURE__ */ new Map();
+		for (const [deviceId, m] of this.byDevice) {
+			const byHour = /* @__PURE__ */ new Map();
+			for (const s of m.values()) {
+				const h = hourOf$1(s.startMs);
+				byHour.set(h, (byHour.get(h) ?? 0) + 1);
+			}
+			out.set(deviceId, byHour);
+		}
+		for (const [deviceId, w] of this.walked) {
+			let byHour = out.get(deviceId);
+			if (!byHour) {
+				byHour = /* @__PURE__ */ new Map();
+				out.set(deviceId, byHour);
+			}
+			for (const h of w.keys()) if (!byHour.has(h)) byHour.set(h, 0);
+		}
+		return out;
+	}
+	/** Delete one device's victim hours — rows and walked markers together — and
+	*  say so. A structure that silently forgets is how this class of bug hides. */
+	dropHours(deviceId, hoursToDrop, residentRowsAfter, budget, logger) {
+		const m = this.byDevice.get(deviceId);
+		let droppedRows = 0;
+		if (m) {
+			for (const [path, s] of m) {
+				if (!hoursToDrop.has(hourOf$1(s.startMs))) continue;
+				m.delete(path);
+				droppedRows += 1;
+			}
+			if (m.size === 0) this.byDevice.delete(deviceId);
+		}
+		const w = this.walked.get(deviceId);
+		if (w) {
+			for (const h of hoursToDrop) w.delete(h);
+			if (w.size === 0) this.walked.delete(deviceId);
+		}
+		this.invalidateSorted(deviceId);
+		this.evictedHoursByDevice.set(deviceId, (this.evictedHoursByDevice.get(deviceId) ?? 0) + hoursToDrop.size);
+		let oldestHourMs = Infinity;
+		let newestHourMs = -Infinity;
+		for (const h of hoursToDrop) {
+			if (h < oldestHourMs) oldestHourMs = h;
+			if (h > newestHourMs) newestHourMs = h;
+		}
+		logger.info("recorder: index dropped resident hours — over the residency budget", {
+			tags: { deviceId },
+			meta: {
+				hours: hoursToDrop.size,
+				rows: droppedRows,
+				oldestHourMs,
+				newestHourMs,
+				residentRowsAfter,
+				rowBudget: budget.residentRowBudget,
+				hourBudget: budget.residentHourBudget,
+				costOfRecovery: "readdir-per-hour"
+			}
+		});
 	}
 	/**
 	* Merge one hour's segments for a location, and mark that hour walked.
@@ -1115,6 +1360,7 @@ var RecordingIndex = class {
 		}
 		if (changed) this.invalidateSorted(deviceId);
 		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$9);
+		this.enforceResidency();
 	}
 	/**
 	* Make one hour of ONE location exactly `relPaths` — merge what is there and
@@ -1145,6 +1391,7 @@ var RecordingIndex = class {
 		for (const path of dropped) m.delete(path);
 		if (dropped.length > 0) this.invalidateSorted(deviceId);
 		this.hydrateHour(deviceId, locationId, hourStartMs, relPaths);
+		this.enforceResidency();
 		return dropped;
 	}
 	/**
@@ -1169,6 +1416,7 @@ var RecordingIndex = class {
 			return;
 		}
 		this.insertIntoSortedViews(s);
+		this.enforceResidency();
 	}
 	/** Remove segments by relative path, routing each path to the correct device map via its encoded deviceId. @residency mutation */
 	removeSegments(paths) {
@@ -1196,6 +1444,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	segmentsStartingIn(deviceId, profile, fromMs, toMs) {
+		this.touch(deviceId, fromMs, toMs);
 		const segs = this.sortedSegments(deviceId, profile);
 		let lo = 0;
 		let hi = segs.length;
@@ -1224,6 +1473,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	segmentStartingAt(deviceId, profile, startMs) {
+		this.touch(deviceId, startMs, startMs + 1);
 		const segs = this.sortedSegments(deviceId, profile);
 		const at = segs[lowerBoundByStart(segs, startMs)];
 		return at !== void 0 && at.startMs === startMs ? at : null;
@@ -1247,6 +1497,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	segmentsOverlapping(deviceId, profile, fromMs, toMs) {
+		this.touch(deviceId, fromMs - this.maxDurMs, toMs);
 		const segs = this.sortedSegments(deviceId, profile);
 		const end = lowerBoundByStart(segs, toMs);
 		let head = lowerBoundByStart(segs, fromMs);
@@ -1408,6 +1659,7 @@ var RecordingIndex = class {
 	}
 	/** The segment whose [startMs, startMs+durMs) window contains `epochMs`, or null if `epochMs` falls in a gap / there is no footage. @residency resident-scoped */
 	segmentAt(deviceId, profile, epochMs) {
+		this.touch(deviceId, epochMs - this.maxDurMs, epochMs + 1);
 		return this.segmentAtIn(this.sortedSegments(deviceId, profile), epochMs);
 	}
 	/**
@@ -1417,6 +1669,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	nearestCoveredEdge(deviceId, profile, epochMs) {
+		this.touch(deviceId, epochMs - this.maxDurMs, epochMs + 1);
 		const segs = this.sortedSegments(deviceId, profile);
 		if (segs.length === 0) return null;
 		if (this.segmentAtIn(segs, epochMs) !== null) return epochMs;
@@ -1470,6 +1723,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	coveredEdgeBefore(deviceId, profile, epochMs) {
+		this.touch(deviceId, epochMs - this.maxDurMs, epochMs + 1);
 		const segs = this.sortedSegments(deviceId, profile);
 		let best = null;
 		for (let i = upperBoundByStart(segs, epochMs) - 1; i >= 0; i--) {
@@ -1482,6 +1736,7 @@ var RecordingIndex = class {
 	}
 	/** @residency resident-scoped */
 	ranges(deviceId, profile, fromMs, toMs, gapToleranceMs) {
+		this.touch(deviceId, fromMs, toMs);
 		return mergeRanges(this.sortedSegments(deviceId, profile).filter((s) => s.startMs + s.durMs > fromMs && s.startMs < toMs), gapToleranceMs).map((r) => ({
 			startMs: Math.max(r.startMs, fromMs),
 			endMs: Math.min(r.endMs, toMs)
@@ -1716,6 +1971,7 @@ async function resolveRecordingsLocations(api, logger) {
 async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger, options = {}) {
 	const yieldBetween = options.yieldBetween ?? macrotask$3;
 	const chunkSize = options.chunkSize ?? HYDRATE_CHUNK;
+	index.beginWalk(deviceId);
 	for (const [root, aliases] of aliasesByRoot(locations)) {
 		const deviceDir = path.join(root, String(deviceId));
 		const startedMs = Date.now();
@@ -10049,10 +10305,16 @@ var SegmentHourLedger = class SegmentHourLedger {
 			else fromIndex.set(key, appendSegmentPath(existing, seg.path));
 		}
 		const refused = this.refusedPrunes(walked, fromIndex);
+		const trimmed = /* @__PURE__ */ new Set();
+		for (const deviceId of walked) {
+			if (!index.droppedDuringWalk(deviceId)) continue;
+			trimmed.add(deviceId);
+			this.logger.warn("recorder: ledger prune REFUSED — the RAM index dropped hours during this walk, so its silence is not evidence", { tags: { deviceId } });
+		}
 		for (const row of this.ledger.snapshot()) {
 			if (!walked.has(row.deviceId)) continue;
 			const disk = fromIndex.get(row.key);
-			const additiveOnly = row.hourStartMs === currentHour || refused.devices.has(row.deviceId) || refused.locations.has(locationKey(row.deviceId, row.locationId));
+			const additiveOnly = row.hourStartMs === currentHour || trimmed.has(row.deviceId) || refused.devices.has(row.deviceId) || refused.locations.has(locationKey(row.deviceId, row.locationId));
 			if (disk === void 0) {
 				if (additiveOnly) continue;
 				await this.ledger.forget(row.key);
@@ -17790,6 +18052,11 @@ var RecorderV2Addon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		this.stopStallMonitor = startEventLoopStallMonitor(this.ctx.logger);
+		this.index.armResidency({
+			logger: this.ctx.logger,
+			now: () => Date.now(),
+			budget: DEFAULT_RECORDING_INDEX_BUDGET
+		});
 		const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
 		this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
 		const configuredNode = this.config.recordingNodeId;
@@ -18785,9 +19052,16 @@ var RecorderV2Addon = class extends BaseAddon {
 		const census = this.index.sortedViewCensus();
 		const views = this.index.sortedViewStats();
 		const reuse = this.index.hydrateReuseStats();
+		const residency = this.index.residency();
 		this.ctx.logger.info("recorder: index census", {
 			...census.largestDeviceId > 0 ? { tags: { deviceId: census.largestDeviceId } } : {},
 			meta: {
+				residentRows: residency.residentRows,
+				residentHours: residency.residentHours,
+				rowBudget: residency.budget?.residentRowBudget ?? null,
+				evictedRows: residency.evictedRows,
+				evictedHours: residency.evictedHours,
+				evictionPasses: residency.evictionPasses,
 				sortedViews: census.views,
 				rowSlots: census.rowSlots,
 				largestViewRows: census.largestRows,

package/dist/{restream-intent-VVJiUAkh.js → restream-intent-B0GOuR-F.js}

@@ -66,6 +66,45 @@ function capPreRollRequestMs(requestedMs, retainedMs) {
 	if (!Number.isFinite(requestedMs) || requestedMs <= 0) return 0;
 	return Math.min(requestedMs, retained);
 }
+//#endregion
+//#region src/stream-broker/rtsp/restream-intent.ts
+/**
+* The dial DECLARATION a restream consumer makes on the RTSP path: what it is,
+* and how much retained history it asks for.
+*
+* The restreamer's join rules key on what kind of consumer is joining, and the
+* only thing an RTSP dial can carry before a session exists is its path. Today
+* that path already encodes one bit — `/muted`, "video only, and I am a local
+* decoder loopback" — and `RtspRestreamer.servePendingSessionsRtp` uses it to
+* withhold the catch-up burst from anything muted whose burst is older than
+* `LIVE_EDGE_MAX_SPAN_MS`.
+*
+* That rule was measured for re-clocked consumers (a HomeKit leg that is an
+* ffmpeg copy of this restream) which have ~zero decode headroom and never
+* drain a 2-3 s backlog. A per-session DETECTION decode is the opposite: it
+* decodes at source rate and publishes throttled by the FrameSlot, so it drains
+* the burst and starts producing frames immediately — and on a ~2 s-GOP camera
+* the withhold instead makes ~3 dials in 4 wait for the next live IDR, which is
+* the dominant term in the blind ramp between motion and the first inferenced
+* frame.
+*
+* So detection says so, in a SECOND path suffix rather than by widening the
+* meaning of `isMuted()`. Every other muted consumer keeps today's behaviour
+* byte-for-byte, because none of them dials this path.
+*
+* Writer and reader live in this one module on purpose: a suffix written by the
+* decode dial and parsed by the listen server has no test that catches them
+* drifting apart if they are declared in two files.
+*
+* The AMOUNT is the second half of the declaration, and it is a D382 addition.
+* D381 made the broker the only thing that decides how much history exists and
+* left the consumer's ask implicit — so declaring an intent, which detection
+* does for the live-edge exemption above, meant being handed the whole retained
+* window. An unstated amount is ZERO here: history reaches a consumer that
+* named a number and nobody else.
+*/
+/** Path suffix for the audio-free variant of a restream token. */
+var MUTED_PATH_SUFFIX = "/muted";
 /**
 * Path suffix for the audio-free variant dialed by a DETECTION decode session.
 * Muted in every respect (no audio, still `isMuted()`), plus exempt from the
@@ -84,6 +123,23 @@ var DETECTION_MUTED_PATH_SUFFIX = "/muted-detection";
 */
 var RECORDING_PATH_SUFFIX = "/recording";
 /**
+* The SENTRY counterpart of a profile's restream.
+*
+* Every profile gets one, exactly as every profile gets a `/muted`: a consumer
+* dials `<token>/sentry` instead of `<token>` and is asking for the stream
+* WITHOUT asking for the camera. It is fed the last picture while the camera
+* sleeps, and the real media the moment something wakes it.
+*
+* A separate path and not a flag, for the reason `/muted` is one: the choice
+* belongs to the URL a consumer was given, so a Frigate configured once keeps
+* asking for the same thing without a per-session negotiation, and a consumer
+* that was given the ordinary URL cannot accidentally be served a still image.
+*
+* D382 in one line: the ask is explicit and absent means zero. A path with no
+* suffix is live intent and behaves exactly as it always has.
+*/
+var SENTRY_PATH_SUFFIX = "/sentry";
+/**
 * Path segment prefix carrying the AMOUNT of retained history a dial asks for.
 *
 * A path segment and not a query string: the listen server matches the request
@@ -249,6 +305,34 @@ function withRecordingIntent(restreamUrl, requestMs) {
 	if (rest.endsWith("/recording")) return `${rest}${requestSegment(requestMs)}`;
 	return `${rest}${RECORDING_PATH_SUFFIX}${requestSegment(requestMs)}`;
 }
+/**
+* Rewrite an acquired restream URL into the SENTRY dial — the counterpart of
+* {@link withDetectionIntent} and {@link withRecordingIntent}, and the one the
+* sentry path shipped without.
+*
+* "sentryMuted", which is what the operator asked a composite camera to take
+* from a battery source, is not a second intent: {@link SENTRY_PATH_SUFFIX} is
+* already muted by construction (`parseRestreamPath` answers `muted: true` for
+* it, because an `m=audio` nobody fills stalls a consumer for the hours a
+* camera may sit asleep). So this REPLACES whatever the url declared rather
+* than appending to it — `<token>/muted/sentry` would parse back to the token
+* `<token>/muted`, a lookup that finds nothing and says nothing.
+*
+* The pre-roll request is dropped for the same reason the sentry declares none:
+* there is no history in a still picture, and D382 says the ask is explicit.
+*
+* Idempotent. Safe on any of the url shapes the broker hands out.
+*/
+function withSentryIntent(restreamUrl) {
+	const { rest } = splitRequest(restreamUrl);
+	for (const suffix of [
+		SENTRY_PATH_SUFFIX,
+		RECORDING_PATH_SUFFIX,
+		DETECTION_MUTED_PATH_SUFFIX,
+		MUTED_PATH_SUFFIX
+	]) if (rest.endsWith(suffix)) return `${rest.slice(0, -suffix.length)}${SENTRY_PATH_SUFFIX}`;
+	return `${rest}${SENTRY_PATH_SUFFIX}`;
+}
 //#endregion
 Object.defineProperty(exports, "DETECTION_PRE_ROLL_REQUEST_MS", {
 	enumerable: true,
@@ -316,3 +400,9 @@ Object.defineProperty(exports, "withRecordingIntent", {
 		return withRecordingIntent;
 	}
 });
+Object.defineProperty(exports, "withSentryIntent", {
+	enumerable: true,
+	get: function() {
+		return withSentryIntent;
+	}
+});