@camstack/addon-pipeline 1.2.301 → 1.2.303

package/dist/recorder/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-BUs7H-fe.js");
-const require_node = require("../node-DxVMyys-.js");
+const require_dist = require("../dist-CyWAhtbJ.js");
+const require_node = require("../node-BDrkzYiH.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
@@ -15,6 +15,8 @@ node_path = require_chunk.__toESM(node_path);
 let node_child_process = require("node:child_process");
 let node_fs_promises = require("node:fs/promises");
 let _camstack_system_addon_utils = require("@camstack/system/addon-utils");
+let node_v8 = require("node:v8");
+node_v8 = require_chunk.__toESM(node_v8);
 //#region src/recorder/event-capture.ts
 /**
 * La sottoscrizione motion del recorder: bus → `onTrigger(deviceId, atMs)`.
@@ -466,6 +468,11 @@ var MFRA_RETAIN_MS = 26 * 36e5;
 function isMfraTableServable(startMs, nowMs) {
 	return startMs >= nowMs - MFRA_RETAIN_MS;
 }
+/** A `{ timeTicks, moofOffset }` object on a 64-bit V8 without pointer
+*  compression (Node): header + two fields + the array slot pointing at it,
+*  ~48 B, plus a 16 B HeapNumber when a value passes 2³¹. An ESTIMATE, rounded
+*  up — the order of magnitude is the point, not the byte. */
+var MFRA_SAMPLE_APPROX_BYTES = 64;
 /**
 * The RAM store the directory reads. Keys are `(deviceId, profile, startMs)`
 * — exactly how a directory row identifies a segment. Insertion is
@@ -509,6 +516,20 @@ var MfraTableStore = class {
 	get size() {
 		return this.tables.size;
 	}
+	/**
+	* Entries and seek samples held, for the recorder census. The byte figure is
+	* an ESTIMATE — {@link MFRA_SAMPLE_APPROX_BYTES} per sample object — and is
+	* named as one; it is the order of magnitude that matters here.
+	*/
+	memoryCensus() {
+		let samples = 0;
+		for (const entry of this.tables.values()) samples += entry.table.samples.length;
+		return {
+			entries: this.tables.size,
+			samples,
+			approxBytes: samples * MFRA_SAMPLE_APPROX_BYTES
+		};
+	}
 	/** Insertion order is time order, so the expired prefix is contiguous. */
 	prune() {
 		const cutoff = this.now() - MFRA_RETAIN_MS;
@@ -4219,6 +4240,24 @@ var CalendarIndex = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/**
+	* Entry counts for the recorder census. `hourSegs` is unbounded (it is
+	* invalidated on eviction and relocation, never aged), so its segment total
+	* is the number that says whether this cache is where the heap went.
+	*/
+	memoryCensus() {
+		let days = 0;
+		for (const perDay of this.byDevice.values()) days += perDay.size;
+		let hourSegments = 0;
+		for (const segments of this.hourSegs.values()) hourSegments += segments.length;
+		return {
+			devices: this.byDevice.size,
+			days,
+			hourKeys: this.hourSegs.size,
+			hourSegments,
+			inFlight: this.inFlight.size + this.segsInFlight.size
+		};
+	}
 	mapFor(deviceId) {
 		let m = this.byDevice.get(deviceId);
 		if (!m) {
@@ -6582,6 +6621,14 @@ var ExportEngine = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/** Entry counts, for the recorder census. */
+	memoryCensus() {
+		return {
+			queued: this.queue.length,
+			active: this.active.size,
+			cancelled: this.cancelled.size
+		};
+	}
 	/** Queue a persisted `queued` record for rendering. */
 	enqueue(id) {
 		if (this.queue.includes(id) || this.active.has(id)) return;
@@ -9970,6 +10017,19 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* the recorder happens to be placing that hour on.
 	*/
 	refusedWriterHours = /* @__PURE__ */ new Set();
+	/** Entry counts of the in-process maps, for the recorder census. */
+	memoryCensus() {
+		let accountedPaths = 0;
+		for (const paths of this.accounted.values()) accountedPaths += paths.size;
+		return {
+			lanes: this.lanes.size,
+			writerHours: this.writerHours.size,
+			accountedHours: this.accounted.size,
+			accountedPaths,
+			refused: this.refused.size,
+			refusedWriterHours: this.refusedWriterHours.size
+		};
+	}
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.store = deps.store;
@@ -12557,7 +12617,11 @@ function startPeriodicPass(deps) {
 		}
 		const began = now();
 		startedAt = began;
-		deps.run().catch((err) => {
+		const probe = deps.heapProbe;
+		(probe === void 0 ? deps.run() : probe.track({
+			kind: "pass",
+			name: deps.name
+		}, deps.run)).catch((err) => {
 			deps.logger.warn("recorder: pass failed", { meta: {
 				pass: deps.name,
 				error: err instanceof Error ? err.message : String(err)
@@ -13252,6 +13316,15 @@ var PlacementService = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/** Entry counts of the per-location/per-camera state, for the recorder census. */
+	memoryCensus() {
+		return {
+			verified: this.verified.size,
+			unusable: this.unusable.size,
+			capacityFaults: this.capacityFaults.size,
+			allUnusableReported: this.allUnusableReported.size
+		};
+	}
 	get probeDeps() {
 		return this.deps.probe ?? fsVolumeProbeDeps;
 	}
@@ -14115,34 +14188,50 @@ function releaseTrigger(state, source, atMs, mergeGapMs) {
 		firstMs: since,
 		lastMs: Math.max(since, atMs)
 	};
-	const windows = triggerWindowsFor(state, source);
-	const newest = windows[windows.length - 1];
-	const merged = newest !== void 0 && span.firstMs - newest.lastMs <= mergeGapMs ? [...windows.slice(0, -1), {
-		firstMs: Math.min(newest.firstMs, span.firstMs),
-		lastMs: Math.max(newest.lastMs, span.lastMs)
-	}] : [...windows, span];
+	const merged = foldSpanInOrder(triggerWindowsFor(state, source), span, mergeGapMs);
 	const evicted = Math.max(0, merged.length - 32);
 	return withWindows(withHeld(state, held), source, evicted > 0 ? merged.slice(evicted) : merged);
 }
 /**
-* Fold one qualifying trigger into the history, immutably. It EXTENDS the newest
-* window when it lands within `postBufferSec` of it (same episode — the recorder
-* never stopped in between), and opens a new one otherwise.
+* Fold one span into a window list, immutably, keeping the list's INVARIANT:
+* sorted by `firstMs`, and no two windows within `mergeGapMs` of each other
+* (each is its own episode). The span EXTENDS every window it lies within the
+* merge gap of — possibly bridging two — and is otherwise INSERTED at its place
+* in time.
+*
+* Never "appended as the newest": the history is read from its end by the live
+* gate ({@link latestTriggerMs}) and by the evictor, so a span older than the
+* newest window appended after it made the newest trigger go BACKWARDS, and the
+* live gate tore down a writer whose episode was still open (D194, 2026-09-28).
+* The coalesce pass is the standard interval merge over the sorted list, so it
+* also heals a list that an older build left out of order.
+*/
+function foldSpanInOrder(windows, span, mergeGapMs) {
+	return [...windows, span].toSorted((a, b) => a.firstMs - b.firstMs).reduce((acc, w) => {
+		const prev = acc[acc.length - 1];
+		if (prev !== void 0 && w.firstMs - prev.lastMs <= mergeGapMs) return [...acc.slice(0, -1), {
+			firstMs: prev.firstMs,
+			lastMs: Math.max(prev.lastMs, w.lastMs)
+		}];
+		return [...acc, w];
+	}, []);
+}
+/**
+* Fold one qualifying trigger into the history, immutably. It EXTENDS the
+* window it lands within `postBufferSec` of (same episode — the recorder never
+* stopped in between), and opens a new one otherwise, IN TIME ORDER.
 *
 * An out-of-order trigger (`atMs` older than the newest window's `lastMs`, which
-* a bus lag spike can produce) never rewinds `lastMs`: it widens `firstMs` if it
-* predates the episode, so the keep span can only ever grow.
+* a bus lag spike or a durable row older than the bus edge can produce) never
+* rewinds anything: it widens `firstMs` of the episode it belongs to, or opens
+* its own window BEFORE the newer ones. The keep span can only ever grow, and
+* the newest trigger can only ever move forward.
 */
 function recordTrigger(state, source, atMs, mergeGapMs) {
-	const windows = triggerWindowsFor(state, source);
-	const newest = windows[windows.length - 1];
-	const merged = newest !== void 0 && atMs - newest.lastMs <= mergeGapMs && atMs >= newest.firstMs - mergeGapMs ? [...windows.slice(0, -1), {
-		firstMs: Math.min(newest.firstMs, atMs),
-		lastMs: Math.max(newest.lastMs, atMs)
-	}] : [...windows, {
+	const merged = foldSpanInOrder(triggerWindowsFor(state, source), {
 		firstMs: atMs,
 		lastMs: atMs
-	}];
+	}, mergeGapMs);
 	const evicted = Math.max(0, merged.length - 32);
 	return {
 		state: withWindows(state, source, evicted > 0 ? merged.slice(evicted) : merged),
@@ -14166,10 +14255,18 @@ function pruneTriggerHistory(state, postMs, nowMs) {
 	}
 	return changed ? withHeld({ windows: next }, state.held) : state;
 }
-/** Most recent trigger for a source, or null when none is retained. */
+/**
+* Most recent trigger for a source, or null when none is retained.
+*
+* The MAXIMUM `lastMs`, not the last element's: the list is kept in time order
+* ({@link recordTrigger}), but the live gate tearing a writer down is the one
+* outcome that destroys footage, so it does not rest on an ordering invariant
+* alone (D194, 2026-09-28).
+*/
 function latestTriggerMs(state, source) {
 	const windows = triggerWindowsFor(state, source);
-	return windows[windows.length - 1]?.lastMs ?? null;
+	if (windows.length === 0) return null;
+	return windows.reduce((max, w) => Math.max(max, w.lastMs), Number.NEGATIVE_INFINITY);
 }
 /**
 * Is an `events` band's live demand window open at `atMs`? True iff a trigger
@@ -14334,7 +14431,7 @@ function foldDurableTriggers(state, source, timestamps, mergeGapMs) {
 		const folded = recordTrigger(next, source, atMs, mergeGapMs);
 		evicted += folded.evicted;
 		const after = triggerWindowsFor(folded.state, source);
-		if (folded.evicted > 0 || after.length !== before.length || after.some((w, i) => w.firstMs !== before[i]?.firstMs || w.lastMs !== before[i]?.lastMs)) recovered++;
+		if (after.length !== before.length || after.some((w, i) => w.firstMs !== before[i]?.firstMs || w.lastMs !== before[i]?.lastMs)) recovered++;
 		next = folded.state;
 	}
 	return {
@@ -14929,6 +15026,35 @@ function planFinalizations(body, processed, forceFinal = false) {
 		rolledOffToMs: spanKnown ? front : null
 	};
 }
+/** The last entry of one playlist body, as {@link DrainedPlaylist} names it;
+*  `null` when the body has no epoch-named last entry (nothing to vouch for). */
+function playlistTail(body) {
+	const entries = parseLivePlaylist(body);
+	const last = entries[entries.length - 1];
+	if (last === void 0) return null;
+	const startMs = parseEpochStartMs(last.segPath);
+	if (startMs === null) return null;
+	return {
+		lastSegStartMs: startMs,
+		lastMediaSequence: parseMediaSequence(body) + entries.length - 1
+	};
+}
+/**
+* Did everything a plan says rolled off belong to a predecessor run that a
+* watcher of this process already accounted for? Pure. All three must hold:
+*  - a predecessor was DRAINED here, by a final pass that read its playlist;
+*  - the body read now is NOT NEWER than the one it drained (last entry no
+*    later, sequence no higher) — so it is that playlist, not one a foreign or
+*    later writer produced since, whose roll-off nobody has seen;
+*  - the body's front predates THIS writer — so none of it is this writer's.
+*/
+function rolledOffIsDrainedPredecessor(input) {
+	const { drained, bodyTail } = input;
+	return drained !== null && bodyTail !== null && bodyTail.lastSegStartMs <= drained.lastSegStartMs && bodyTail.lastMediaSequence <= drained.lastMediaSequence && input.rolledOffToMs !== null && classifyMissingEntry({
+		segmentStartMs: input.rolledOffToMs,
+		writerStartedMs: input.writerStartedMs
+	}) === "stale-previous-run";
+}
 /**
 * Start polling `<outDir>/live.m3u8`. Returns a handle whose `stop()`
 * cancels the timer. Errors during a tick are swallowed (logged at debug)
@@ -14936,6 +15062,8 @@ function planFinalizations(body, processed, forceFinal = false) {
 */
 function startSegmentWatcher(deps) {
 	const playlistPath = node_path.default.join(deps.outDir, "live.m3u8");
+	const drained = deps.drainedPredecessor ?? null;
+	let lastReadTail = null;
 	const now = () => deps.now?.() ?? Date.now();
 	let processed = 0;
 	let stopped = false;
@@ -14944,17 +15072,34 @@ function startSegmentWatcher(deps) {
 	let pendingIndex = -1;
 	let pendingSinceMs = 0;
 	const tick = async (forceFinal = false) => {
-		if (stopped || ticking) return;
+		if (stopped || ticking) return "unreadable";
 		ticking = true;
 		try {
 			let body;
 			try {
 				body = await node_fs.promises.readFile(playlistPath, "utf8");
 			} catch {
-				return;
+				return "unreadable";
 			}
+			const bodyTail = playlistTail(body);
+			lastReadTail = bodyTail;
 			const plan = planFinalizations(body, processed, forceFinal);
-			if (plan.rolledOff > 0) {
+			if (plan.rolledOff > 0 && rolledOffIsDrainedPredecessor({
+				rolledOffToMs: plan.rolledOffToMs,
+				writerStartedMs: deps.writerStartedMs,
+				bodyTail,
+				drained
+			})) deps.logger.debug("segment playlist is the drained previous run — no roll-off to report", {
+				tags: { deviceId: deps.deviceId },
+				meta: {
+					rolledOff: plan.rolledOff,
+					processed,
+					frontMs: plan.rolledOffToMs,
+					writerStartedMs: deps.writerStartedMs,
+					drainedLastSegStartMs: drained?.lastSegStartMs
+				}
+			});
+			else if (plan.rolledOff > 0) {
 				deps.logger.warn("segment playlist rolled past entries this watcher had not handled", {
 					tags: { deviceId: deps.deviceId },
 					meta: {
@@ -15007,6 +15152,7 @@ function startSegmentWatcher(deps) {
 				pendingSinceMs = 0;
 			}
 			processed = index;
+			return "read";
 		} finally {
 			ticking = false;
 		}
@@ -15033,7 +15179,7 @@ function startSegmentWatcher(deps) {
 		},
 		flush: async () => {
 			await currentTick;
-			await startTick(true);
+			if (await startTick(true) === "read" && lastReadTail !== null) deps.onDrained?.(lastReadTail);
 		}
 	};
 }
@@ -15056,6 +15202,16 @@ function startSegmentWatcher(deps) {
 * recorded fragment's audio can be read in-process (mp4box) and pushed straight
 * to the Opus sender with no per-fragment ffmpeg spawn on playback.
 */
+/**
+* The `-segment_list` path a writer for `outDir` is given — spelled in ONE
+* place, because it is also how a writer is RECOGNISED in the process table.
+* The staging-directory guard (D667) looks for exactly this argv pair before
+* it lets a second ffmpeg start in the same directory; a spelling that drifted
+* between the two would make every predecessor invisible to it.
+*/
+function segmentListPath(outDir) {
+	return `${outDir}/live.m3u8`;
+}
 /** ffmpeg argv: pull RTSP (TCP), copy video / transcode audio to Opus, write
 *  fragmented-mp4 segments named by epoch seconds FLAT under `outDir`, plus a
 *  rolling `live.m3u8` playlist. The recorder segment-watcher tails the
@@ -15095,7 +15251,7 @@ function buildPassthroughArgs(a) {
 		"-strftime",
 		"1",
 		"-segment_list",
-		`${a.outDir}/live.m3u8`,
+		segmentListPath(a.outDir),
 		"-segment_list_type",
 		"m3u8",
 		"-segment_list_size",
@@ -15148,7 +15304,7 @@ var RESTART_WINDOW_MS = 60 * 6e4;
 */
 var MAX_RESTARTS_IN_WINDOW = 15;
 /** Grace between the SIGTERM in stop() and the escalated SIGKILL. */
-var KILL_GRACE_MS = 500;
+var KILL_GRACE_MS$1 = 500;
 /** Supervises one passthrough ffmpeg for a single (camera, profile). */
 var SegmentWriter = class {
 	cfg;
@@ -15172,10 +15328,25 @@ var SegmentWriter = class {
 	* storm cannot accumulate claims for children that are already gone.
 	*/
 	costClaim = require_node.NO_COST_CLAIM;
+	/**
+	* The pid of a generation `stop()` has signalled but whose `exit` has not
+	* fired. `proc` is dropped at the signal; this keeps the pid readable until
+	* the child is really gone, so the staging guard (D667) still knows it is
+	* this runner's writer and not a predecessor's.
+	*/
+	exitingPid = void 0;
 	constructor(cfg, deps) {
 		this.cfg = cfg;
 		this.deps = deps;
 	}
+	/**
+	* The pid of the ffmpeg this writer is supervising right now, or undefined
+	* between generations. Read by the staging-directory guard (D667) so a
+	* writer the controller is TRACKING is never mistaken for a predecessor's.
+	*/
+	get pid() {
+		return this.proc?.pid ?? this.exitingPid;
+	}
 	start() {
 		if (this.stopped || this.proc) return;
 		const args = buildPassthroughArgs(this.cfg);
@@ -15232,6 +15403,7 @@ var SegmentWriter = class {
 		this.resolveExit?.();
 		this.resolveExit = null;
 		this.proc = null;
+		this.exitingPid = void 0;
 		if (this.stopped) return;
 		const now = Date.now();
 		const ranMs = now - this.startedAt;
@@ -15345,6 +15517,7 @@ var SegmentWriter = class {
 		const exitWait = this.exitWait;
 		this.proc = null;
 		if (!proc) return;
+		if (proc.exitCode !== void 0 || proc.signalCode !== void 0) this.exitingPid = proc.pid;
 		try {
 			proc.kill("SIGTERM");
 		} catch {}
@@ -15352,7 +15525,7 @@ var SegmentWriter = class {
 			if (proc.exitCode === null && proc.signalCode === null) try {
 				proc.kill("SIGKILL");
 			} catch {}
-		}, KILL_GRACE_MS).unref?.();
+		}, KILL_GRACE_MS$1).unref?.();
 		if (proc.exitCode === void 0 && proc.signalCode === void 0) return;
 		await exitWait;
 	}
@@ -15680,10 +15853,16 @@ var RecordingController = class {
 	/** Every attach admitted before a maintenance pause. The pause waits these
 	* promises before it snapshots/drains active writers. */
 	attachingTasks = /* @__PURE__ */ new Map();
-	/** `deviceId:profile` keys whose current attach has already logged its first
-	*  segment — the measurement is per ATTACH, not per segment. Cleared on
-	*  teardown with the rest of the per-attach state. */
-	firstSegmentSeen = /* @__PURE__ */ new Set();
+	/**
+	* The drain ledger: per staging directory (resolved `outDir`), what the last
+	* watcher of THIS process drained there (`segment-watcher.ts`
+	* `DrainedPlaylist`). Consumed by the next watcher on that directory, so a
+	* fresh watcher reading its predecessor's playlist does not report a roll-off
+	* that predecessor already handled or reported. Per process by design: after
+	* a runner respawn it is empty and the roll-off IS reported (D521). At most
+	* one entry per location × device × profile directory.
+	*/
+	drainedPlaylists = /* @__PURE__ */ new Map();
 	/**
 	* Monotonic attach counter, the last component of the CONSUMER TAG this
 	* recorder puts on its RTSP dial (`recorder/<deviceId>/<profile>/<n>`).
@@ -15744,6 +15923,13 @@ var RecordingController = class {
 	* healthy device every 30s.
 	*/
 	skippedProfiles = /* @__PURE__ */ new Map();
+	/**
+	* Writers being torn down whose ffmpeg may not have exited yet. They left
+	* {@link active} when the teardown began, but their pid is still ours until
+	* the child's `exit` fires — without this set the staging guard (D667) would
+	* reap this runner's own exiting writer and log it as a predecessor's.
+	*/
+	retiring = /* @__PURE__ */ new Set();
 	restore = null;
 	/**
 	* One pending wake-up per device, armed for the exact instant its recording
@@ -15846,6 +16032,10 @@ var RecordingController = class {
 		});
 		return out;
 	}
+	/** Entries in the drain ledger — for the memory census. */
+	get drainedLedgerSize() {
+		return this.drainedPlaylists.size;
+	}
 	/**
 	* Boot restore: seed the readiness-gated queue with every persisted device and
 	* (re)evaluate each on every `stream-broker` ready transition. Also arms the
@@ -15878,7 +16068,8 @@ var RecordingController = class {
 				slowAfterMs: passSlowAfterMs(LIVENESS_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
-				run: () => this.checkIdleWriters()
+				run: () => this.checkIdleWriters(),
+				...this.deps.heapProbe !== void 0 ? { heapProbe: this.deps.heapProbe } : {}
 			});
 			this.placementPass = startPeriodicPass({
 				name: "placement",
@@ -15886,7 +16077,8 @@ var RecordingController = class {
 				slowAfterMs: passSlowAfterMs(PLACEMENT_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
-				run: () => this.replanPlacement()
+				run: () => this.replanPlacement(),
+				...this.deps.heapProbe !== void 0 ? { heapProbe: this.deps.heapProbe } : {}
 			});
 			this.reconcilePass = startPeriodicPass({
 				name: "reconcile",
@@ -15894,7 +16086,8 @@ var RecordingController = class {
 				slowAfterMs: passSlowAfterMs(RECONCILE_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
-				run: () => this.reconcile()
+				run: () => this.reconcile(),
+				...this.deps.heapProbe !== void 0 ? { heapProbe: this.deps.heapProbe } : {}
 			});
 		}
 		await this.restore.start(ids.map((id) => [id, true]));
@@ -16294,7 +16487,6 @@ var RecordingController = class {
 		for (const r of stalled) {
 			this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
 			this.attachRetained.delete(idleKey(deviceId, r.profile));
-			this.firstSegmentSeen.delete(idleKey(deviceId, r.profile));
 		}
 		this.active.set(deviceId, [...keep]);
 		const skipped = this.skippedProfiles.get(deviceId) ?? /* @__PURE__ */ new Set();
@@ -16645,6 +16837,7 @@ var RecordingController = class {
 		if (profiles.length === 0) throw new Error(`recorder controller: no assigned broker sources for device ${deviceId}`);
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
 		const bandAudio = bandAudioAt(config, new Date(this.now()));
+		await this.sweepDeviceStaging(deviceId, segmentSeconds);
 		const recordings = [];
 		const failed = [];
 		for (const profile of profiles) try {
@@ -16712,6 +16905,7 @@ var RecordingController = class {
 		const have = new Set(current.map((r) => r.profile));
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
 		const bandAudio = bandAudioAt(config, new Date(this.now()));
+		await this.sweepDeviceStaging(deviceId, segmentSeconds);
 		const added = [];
 		for (const profile of [...skipped]) {
 			if (have.has(profile)) {
@@ -16759,6 +16953,143 @@ var RecordingController = class {
 		return require_dist.resolveRecordingProfiles(require_dist.selectAssignedProfileSlots(await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.listAllProfileSlots.query(void 0, require_dist.nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "listAllProfileSlots")), deviceId).map((slot) => slot.profile), override);
 	}
 	/**
+	* Entry counts of every long-lived container this controller holds, for the
+	* recorder's 5-minute census line. Sizes only — no walk of anything that
+	* grows with the archive.
+	*/
+	memoryCensus() {
+		let writers = 0;
+		for (const recordings of this.active.values()) writers += recordings.length;
+		let skippedProfiles = 0;
+		for (const skipped of this.skippedProfiles.values()) skippedProfiles += skipped.size;
+		return {
+			activeDevices: this.active.size,
+			writers,
+			attaching: this.attaching.size,
+			attachingTasks: this.attachingTasks.size,
+			drainedPlaylists: this.drainedPlaylists.size,
+			batteryWakes: this.batteryWakes.size,
+			triggers: this.triggers.size,
+			signalConfirmedAt: this.signalConfirmedAt.size,
+			signalContradictions: this.signalContradictions.size,
+			lastSegmentAt: this.lastSegmentAt.size,
+			attachRetained: this.attachRetained.size,
+			unrecordableReported: this.unrecordableReported.size,
+			skippedProfileDevices: this.skippedProfiles.size,
+			skippedProfiles
+		};
+	}
+	/**
+	* Pids of every ffmpeg this controller started and has not seen exit —
+	* the live writers and the ones still being torn down. Never reaped by the
+	* staging guard (D667).
+	*/
+	ownedWriterPids() {
+		const pids = /* @__PURE__ */ new Set();
+		const add = (writer) => {
+			const pid = writer.pid;
+			if (pid !== void 0) pids.add(pid);
+		};
+		for (const recordings of this.active.values()) for (const recording of recordings) add(recording.writer);
+		for (const writer of this.retiring) add(writer);
+		return pids;
+	}
+	/**
+	* Every staging directory of this camera, on every location, in ONE table
+	* read and one SIGTERM → SIGKILL window (D667) — so an attach of three
+	* profiles does not pay three reaps in series. The per-spawn claim below
+	* still runs; after this it is one cached read.
+	*/
+	async sweepDeviceStaging(deviceId, segmentSeconds) {
+		const guard = this.deps.stagingGuard;
+		if (guard === void 0) return;
+		const result = await guard.sweep({
+			roots: this.deps.locations().map((location) => location.root),
+			deviceId,
+			ownPids: this.ownedWriterPids()
+		});
+		if (result.outcome !== "swept" || result.reaped.length === 0) return;
+		const liveDirs = new Set((this.active.get(deviceId) ?? []).map((r) => r.outDir));
+		await this.recoverReaped(result.reaped.filter((writer) => !liveDirs.has(writer.target.outDir)), segmentSeconds);
+	}
+	/**
+	* Collect what each reaped writer left in its directory before a new writer
+	* is spawned into it (D667). Logged per directory with the counts, and a
+	* directory that could not be recovered says so — its segments stay staged
+	* for the next boot.
+	*/
+	async recoverReaped(reaped, segmentSeconds) {
+		const cutoffMs = this.now();
+		const dirs = /* @__PURE__ */ new Map();
+		for (const writer of reaped) dirs.set(writer.target.outDir, writer);
+		for (const writer of dirs.values()) {
+			const { target } = writer;
+			const location = this.deps.locations().find((l) => l.root === target.root);
+			const recover = this.deps.recoverStagingDirectory;
+			if (location === void 0 || recover === void 0) {
+				this.deps.logger.warn("recorder: a reaped writer’s segments were left in staging — recovered at the next boot", {
+					tags: { deviceId: target.deviceId },
+					meta: {
+						profile: target.profile,
+						dir: target.outDir,
+						reason: location === void 0 ? "location-unknown" : "no-recovery-wired"
+					}
+				});
+				continue;
+			}
+			try {
+				const report = await recover({
+					deviceId: target.deviceId,
+					profile: target.profile,
+					locationId: location.id,
+					locationRoot: location.root,
+					dir: target.outDir,
+					cutoffMs,
+					segmentSeconds
+				});
+				this.deps.logger.info("recorder: recovered a reaped writer’s segments before re-attaching", {
+					tags: { deviceId: target.deviceId },
+					meta: {
+						profile: target.profile,
+						dir: target.outDir,
+						pid: writer.pid,
+						...report
+					}
+				});
+			} catch (err) {
+				this.deps.logger.warn("recorder: recovering a reaped writer’s segments failed — left in staging for the next boot", {
+					tags: { deviceId: target.deviceId },
+					meta: {
+						profile: target.profile,
+						dir: target.outDir,
+						error: require_dist.errMsg(err)
+					}
+				});
+			}
+		}
+	}
+	/**
+	* Make sure nobody else is writing `outDir` before a writer is spawned into
+	* it (D667). A predecessor runner that died without a shutdown (V8 OOM,
+	* SIGKILL) leaves its ffmpeg writers running, and a second writer in the
+	* same directory rewrites the first one's playlist — 13 minutes and 169
+	* writer churns on 2026-09-28. The guard reaps such a writer; one it cannot
+	* remove is a refusal, and a refusal throws so no writer is spawned.
+	*/
+	async claimStagingDirectory(deviceId, profile, root, outDir, segmentSeconds) {
+		const guard = this.deps.stagingGuard;
+		if (guard === void 0) return;
+		const result = await guard.claim({
+			deviceId,
+			profile,
+			root,
+			outDir,
+			ownPids: this.ownedWriterPids()
+		});
+		if (result.outcome === "clear" && result.reaped.length > 0) await this.recoverReaped(result.reaped, segmentSeconds);
+		if (result.outcome === "refused") throw new Error(`staging directory ${outDir} still has ${result.survivors.length} foreign writer(s) (pids ${result.survivors.map((proc) => proc.pid).join(",")}) — refusing to co-write`);
+	}
+	/**
 	* Attach one (device, profile): acquire the broker source, mkdir the staging
 	* outDir UNDER the profile's placement root (same-fs relocate — see
 	* {@link STAGING_DIR_NAME}), spawn the SegmentWriter, and start the watcher
@@ -16767,6 +17098,10 @@ var RecordingController = class {
 	async attachProfile(deviceId, profile, segmentSeconds, audio) {
 		const attachProfileStartMs = this.now();
 		const placement = await this.resolvePlacement(deviceId, profile);
+		const placementDoneMs = this.now();
+		const outDir = node_path.default.join(placement.root, STAGING_DIR_NAME, String(deviceId), profile);
+		await this.claimStagingDirectory(deviceId, profile, placement.root, outDir, segmentSeconds);
+		const claimDoneMs = this.now();
 		const source = await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.getStreamWithCodec.mutate({
 			deviceId,
 			video: "copy",
@@ -16786,8 +17121,6 @@ var RecordingController = class {
 				url: source.url
 			}
 		});
-		const placementDoneMs = this.now();
-		const outDir = node_path.default.join(placement.root, STAGING_DIR_NAME, String(deviceId), profile);
 		await node_fs.promises.mkdir(outDir, { recursive: true });
 		const mkdirDoneMs = this.now();
 		const deviceLog = this.deps.logger.withTags({ deviceId });
@@ -16820,18 +17153,27 @@ var RecordingController = class {
 				profile,
 				consumer: consumerTag,
 				placementMs: placementDoneMs - attachProfileStartMs,
-				getStreamMs: streamAcquiredMs - placementDoneMs,
+				claimMs: claimDoneMs - placementDoneMs,
+				getStreamMs: streamAcquiredMs - claimDoneMs,
 				mkdirMs: mkdirDoneMs - streamAcquiredMs,
 				attachProfileMs: writerStartedMs - attachProfileStartMs,
 				segmentSeconds
 			}
 		});
 		this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
+		let firstSegmentSeen = false;
+		const drainKey = node_path.default.resolve(outDir);
+		const drainedPredecessor = this.drainedPlaylists.get(drainKey) ?? null;
+		this.drainedPlaylists.delete(drainKey);
 		return {
 			profile,
 			writer,
 			watcher: startSegmentWatcher({
 				outDir,
+				drainedPredecessor,
+				onDrained: (drained) => {
+					this.drainedPlaylists.set(drainKey, drained);
+				},
 				deviceId,
 				writerStartedMs,
 				now: () => this.now(),
@@ -16841,8 +17183,8 @@ var RecordingController = class {
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
-					if (startMs >= writerStartedMs - 1e3 && !this.firstSegmentSeen.has(idleKey(deviceId, profile))) {
-						this.firstSegmentSeen.add(idleKey(deviceId, profile));
+					if (startMs >= writerStartedMs - 1e3 && !firstSegmentSeen) {
+						firstSegmentSeen = true;
 						this.deps.logger.info("recorder: first segment of this attach", {
 							tags: { deviceId },
 							meta: {
@@ -16966,8 +17308,11 @@ var RecordingController = class {
 	async teardownProfile(deviceId, r) {
 		const teardownStartMs = Date.now();
 		try {
+			this.retiring.add(r.writer);
 			await r.writer.stopAndWait();
-		} catch {}
+		} catch {} finally {
+			this.retiring.delete(r.writer);
+		}
 		const writerStopMs = Date.now() - teardownStartMs;
 		try {
 			await r.watcher.flush?.();
@@ -17016,7 +17361,6 @@ var RecordingController = class {
 		for (const r of recordings) {
 			this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
 			this.attachRetained.delete(idleKey(deviceId, r.profile));
-			this.firstSegmentSeen.delete(idleKey(deviceId, r.profile));
 		}
 		await Promise.all(recordings.map((r) => this.teardownProfile(deviceId, r)));
 		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
@@ -17675,7 +18019,11 @@ var RedundancySweeper = class {
 	start() {
 		if (this.timer !== null) return;
 		this.timer = setInterval(() => {
-			this.sweep();
+			const probe = this.deps.heapProbe;
+			probe === void 0 ? this.sweep() : probe.track({
+				kind: "pass",
+				name: "redundancy"
+			}, () => this.sweep());
 		}, this.deps.intervalMs);
 		this.timer.unref?.();
 	}
@@ -17818,7 +18166,11 @@ var RetentionSweeper = class {
 	start() {
 		if (this.timer !== null) return;
 		const tick = () => {
-			this.sweep();
+			const probe = this.deps.heapProbe;
+			probe === void 0 ? this.sweep() : probe.track({
+				kind: "pass",
+				name: "retention"
+			}, () => this.sweep());
 		};
 		tick();
 		this.timer = setInterval(tick, this.deps.intervalMs);
@@ -17913,6 +18265,799 @@ var RECORDER_RETIRED_ROOT_KEYS = [
 	}
 ];
 //#endregion
+//#region src/recorder/addon/heap-delta.ts
+/**
+* Name the unit of work that grows the recorder's heap.
+*
+* Every recorder lifetime has the same shape (findings 2026-09-28): ~50 MB for
+* five minutes, then one SILENT, CPU-bound phase of 4.5–7 minutes that builds
+* ~2.3 GB — ~910 MB of it in `large_object_space` — and holds it. The
+* large-object floor doubled at one boot (2026-09-03 06:56Z, 458 → 914 MB),
+* the first to show a second recording location. Nothing logs during the
+* phase, so nothing says which pass or which inbound call builds it, and a
+* heap snapshot is not allowed on this host.
+*
+* So every periodic pass, every boot phase and every inbound cap method is
+* wrapped here: two cheap heap reads (`v8.getHeapStatistics` and
+* `v8.getHeapSpaceStatistics` — a handful of counters, no heap walk), and ONE
+* line when the unit grew the heap or the large-object space by at least
+* `deltaBytes`, or ran for at least `durationMs`. Silent otherwise.
+*
+* Two things this line is NOT, and a reader must not take it for:
+*
+* - **Not exclusive.** The delta is over the unit's WALL window, so concurrent
+*   work that interleaves with it is counted too. `inFlight` on the line is the
+*   MOST other measured units that were open at any moment DURING this one —
+*   a long pass that started alone and was overlapped by forty cap calls
+*   reports 40, not 0. `inFlight: 0` is the only reading that pins the delta
+*   on this unit (unmeasured work — a transport decode, a timer — can still
+*   interleave).
+* - **Not retention.** `heapUsed` includes garbage no GC has collected yet, so
+*   a unit that ALLOCATES 50 MB of transient reads is named even though it
+*   keeps none of it. A unit named on several passes in a row while the heap
+*   floor rises is a builder; one named once is only a candidate.
+*/
+var MIB = 1024 * 1024;
+var DEFAULT_HEAP_DELTA_THRESHOLDS = {
+	deltaBytes: 50 * MIB,
+	durationMs: 5e3
+};
+/**
+* Whether one unit of work is worth a line. GROWTH only: a unit that happened
+* to straddle a major GC shows a large negative delta that says nothing about
+* what it retained, and the question being asked is who BUILDS the heap.
+*/
+function judgeHeapDelta(before, after, durationMs, thresholds) {
+	const heapDeltaBytes = before !== null && after !== null ? after.heapUsedBytes - before.heapUsedBytes : null;
+	const losBefore = before?.largeObjectBytes ?? null;
+	const losAfter = after?.largeObjectBytes ?? null;
+	const largeObjectDeltaBytes = losBefore !== null && losAfter !== null ? losAfter - losBefore : null;
+	const reasons = [];
+	if (heapDeltaBytes !== null && heapDeltaBytes >= thresholds.deltaBytes) reasons.push("heap");
+	if (largeObjectDeltaBytes !== null && largeObjectDeltaBytes >= thresholds.deltaBytes) reasons.push("large-object-space");
+	if (durationMs >= thresholds.durationMs) reasons.push("duration");
+	return {
+		reasons,
+		heapDeltaBytes,
+		largeObjectDeltaBytes
+	};
+}
+/** V8's own counters. `null` if V8 refuses — the caller logs nulls, not zeros. */
+function readV8HeapSample() {
+	try {
+		const heapUsedBytes = node_v8.default.getHeapStatistics().used_heap_size;
+		const los = node_v8.default.getHeapSpaceStatistics().find((space) => space.space_name === "large_object_space");
+		return {
+			heapUsedBytes,
+			largeObjectBytes: los === void 0 ? null : los.space_used_size
+		};
+	} catch {
+		return null;
+	}
+}
+function mb(bytes) {
+	return bytes === null ? null : Math.round(bytes / MIB);
+}
+function isPromiseLike(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+var HeapDeltaProbe = class {
+	deps;
+	/** Open units → the most OTHER units seen open at once while it ran. */
+	peers = /* @__PURE__ */ new Map();
+	seq = 0;
+	sampler;
+	now;
+	thresholds;
+	constructor(deps) {
+		this.deps = deps;
+		this.sampler = deps.sampler ?? readV8HeapSample;
+		this.now = deps.now ?? (() => Date.now());
+		this.thresholds = deps.thresholds ?? DEFAULT_HEAP_DELTA_THRESHOLDS;
+	}
+	async track(unit, run) {
+		const open = this.begin();
+		let failed = false;
+		try {
+			return await run();
+		} catch (err) {
+			failed = true;
+			throw err;
+		} finally {
+			this.end(unit, open, failed);
+		}
+	}
+	/**
+	* The same provider, with every method measured. A `Proxy` rather than a
+	* rebuilt object so the capability's own type passes through untouched —
+	* no method is re-declared, and none can be forgotten when the cap grows
+	* one. `this` stays the original object, so a class with private state
+	* keeps working.
+	*/
+	wrapProvider(capability, provider) {
+		const cache = /* @__PURE__ */ new Map();
+		return new Proxy(provider, { get: (target, prop) => {
+			const value = Reflect.get(target, prop, target);
+			if (typeof value !== "function" || typeof prop === "symbol" || prop in Object.prototype) return value;
+			const cached = cache.get(prop);
+			if (cached !== void 0 && cached.original === value) return cached.wrapped;
+			const unit = {
+				kind: "cap-method",
+				name: `${capability}.${prop}`
+			};
+			const wrapped = (...args) => this.call(unit, () => Reflect.apply(value, target, args));
+			cache.set(prop, {
+				original: value,
+				wrapped
+			});
+			return wrapped;
+		} });
+	}
+	call(unit, invoke) {
+		const open = this.begin();
+		let result;
+		try {
+			result = invoke();
+		} catch (err) {
+			this.end(unit, open, true);
+			throw err;
+		}
+		if (!isPromiseLike(result)) {
+			this.end(unit, open, false);
+			return result;
+		}
+		return Promise.resolve(result).then((value) => {
+			this.end(unit, open, false);
+			return value;
+		}, (err) => {
+			this.end(unit, open, true);
+			throw err;
+		});
+	}
+	begin() {
+		const id = ++this.seq;
+		const others = this.peers.size;
+		for (const [peer, most] of this.peers) this.peers.set(peer, Math.max(most, others));
+		this.peers.set(id, others);
+		return {
+			id,
+			sample: this.sampler(),
+			at: this.now()
+		};
+	}
+	end(unit, open, failed) {
+		const inFlight = this.peers.get(open.id) ?? 0;
+		this.peers.delete(open.id);
+		const durationMs = this.now() - open.at;
+		const after = this.sampler();
+		const verdict = judgeHeapDelta(open.sample, after, durationMs, this.thresholds);
+		if (verdict.reasons.length === 0) return;
+		this.deps.logger.info("recorder: unit of work moved the heap", { meta: {
+			kind: unit.kind,
+			name: unit.name,
+			reasons: verdict.reasons,
+			durationMs,
+			heapBeforeMb: mb(open.sample?.heapUsedBytes ?? null),
+			heapAfterMb: mb(after?.heapUsedBytes ?? null),
+			heapDeltaMb: mb(verdict.heapDeltaBytes),
+			losBeforeMb: mb(open.sample?.largeObjectBytes ?? null),
+			losAfterMb: mb(after?.largeObjectBytes ?? null),
+			losDeltaMb: mb(verdict.largeObjectDeltaBytes),
+			inFlight,
+			failed
+		} });
+	}
+};
+//#endregion
+//#region src/recorder/addon/process-table.ts
+/**
+* Read this host's process table — just enough to recognise an ffmpeg writer
+* by its argv — and signal a pid.
+*
+* Both halves sit behind a small named interface so the staging-directory
+* guard (`staging-writer-guard.ts`, D667) can be driven by a fake in a unit
+* test and by the real OS in production, with no cast in between.
+*
+* Linux reads `/proc/<pid>/cmdline` (exact argv, NUL-separated) and
+* `/proc/<pid>/stat` (ppid, start time). macOS has no `/proc`, so it runs
+* `ps -axww -o pid=,ppid=,etime=,command=` — the recorder also runs on the
+* Mac agent. Any other platform gets no lister, and the guard says so.
+*/
+/**
+* Linux `USER_HZ` — the unit of `starttime` in `/proc/<pid>/stat`. It is part
+* of the userspace ABI and 100 on every architecture Linux ships, which is why
+* `procps` itself hard-codes the fallback.
+*/
+var LINUX_USER_HZ = 100;
+/** Field index of `starttime` counted from the field AFTER the `(comm)` one. */
+var STAT_STARTTIME_INDEX = 19;
+var STAT_PPID_INDEX = 1;
+/** `ps` is one short fork; a table that takes longer than this is a sick host. */
+var PS_TIMEOUT_MS = 5e3;
+var PS_MAX_BUFFER = 16 * 1024 * 1024;
+function errorCode(err) {
+	if (err instanceof Error && "code" in err && typeof err.code === "string") return err.code;
+}
+/** `ppid` and `starttime` out of a `/proc/<pid>/stat` body. The `comm` field
+*  may itself contain spaces and parentheses, so fields are counted from the
+*  LAST `)`. */
+function parseLinuxStat(body) {
+	const close = body.lastIndexOf(")");
+	if (close < 0) return {
+		ppid: null,
+		startTicks: null
+	};
+	const fields = body.slice(close + 1).trim().split(/\s+/);
+	const ppid = Number(fields[STAT_PPID_INDEX]);
+	const start = Number(fields[STAT_STARTTIME_INDEX]);
+	return {
+		ppid: Number.isInteger(ppid) ? ppid : null,
+		startTicks: Number.isFinite(start) ? start : null
+	};
+}
+/** The `/proc` reader. `procRoot` is injectable for a test over a fake tree. */
+function createLinuxProcessLister(procRoot = "/proc") {
+	return { async list(marker) {
+		const entries = await node_fs.promises.readdir(procRoot);
+		const uptimeSec = await node_fs.promises.readFile(`${procRoot}/uptime`, "utf8").then((body) => Number(body.split(/\s+/)[0])).catch(() => NaN);
+		const out = [];
+		for (const entry of entries) {
+			const pid = Number(entry);
+			if (!Number.isInteger(pid) || pid <= 0) continue;
+			let raw;
+			try {
+				raw = await node_fs.promises.readFile(`${procRoot}/${entry}/cmdline`, "utf8");
+			} catch {
+				continue;
+			}
+			if (raw.length === 0 || !raw.includes(marker)) continue;
+			const argv = raw.split("\0");
+			if (argv[argv.length - 1] === "") argv.pop();
+			const stat = await node_fs.promises.readFile(`${procRoot}/${entry}/stat`, "utf8").then(parseLinuxStat).catch(() => ({
+				ppid: null,
+				startTicks: null
+			}));
+			const ageMs = stat.startTicks !== null && Number.isFinite(uptimeSec) ? Math.max(0, Math.round((uptimeSec - stat.startTicks / LINUX_USER_HZ) * 1e3)) : null;
+			out.push({
+				pid,
+				ppid: stat.ppid,
+				argv,
+				command: argv.join(" "),
+				ageMs
+			});
+		}
+		return out;
+	} };
+}
+/** `[[dd-]hh:]mm:ss` → ms; `null` for anything else. */
+function parsePsElapsed(etime) {
+	const match = /^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+)$/.exec(etime.trim());
+	if (match === null) return null;
+	const [, days, hours, minutes, seconds] = match;
+	return (Number(days ?? 0) * 86400 + Number(hours ?? 0) * 3600 + Number(minutes) * 60 + Number(seconds)) * 1e3;
+}
+/** Parse `ps -o pid=,ppid=,etime=,command=` output, keeping lines that contain `marker`. */
+function parsePsTable(stdout, marker) {
+	const out = [];
+	for (const line of stdout.split("\n")) {
+		if (!line.includes(marker)) continue;
+		const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+		if (match === null) continue;
+		const [, pid, ppid, etime, command] = match;
+		out.push({
+			pid: Number(pid),
+			ppid: Number(ppid),
+			argv: null,
+			command: command ?? "",
+			ageMs: parsePsElapsed(etime ?? "")
+		});
+	}
+	return out;
+}
+/** The macOS (BSD `ps`) reader. `-ww` so a long staging path is never cut. */
+function createPsProcessLister(psPath = "ps") {
+	return { list(marker) {
+		return new Promise((resolve, reject) => {
+			(0, node_child_process.execFile)(psPath, [
+				"-axww",
+				"-o",
+				"pid=,ppid=,etime=,command="
+			], {
+				timeout: PS_TIMEOUT_MS,
+				maxBuffer: PS_MAX_BUFFER
+			}, (err, stdout) => {
+				if (err) {
+					reject(err);
+					return;
+				}
+				resolve(parsePsTable(stdout, marker));
+			});
+		});
+	} };
+}
+/** The lister for this platform, or `null` where there is none (Windows). */
+function createProcessLister(platform = process.platform) {
+	if (platform === "linux") return createLinuxProcessLister();
+	if (platform === "darwin" || platform === "freebsd" || platform === "openbsd") return createPsProcessLister();
+	return null;
+}
+/** `process.kill`, with the errno turned into an answer instead of a throw. */
+var nodeProcessSignaller = { send(pid, signal) {
+	try {
+		process.kill(pid, signal);
+		return "sent";
+	} catch (err) {
+		const code = errorCode(err);
+		if (code === "ESRCH") return "gone";
+		if (code === "EPERM") return "denied";
+		return "failed";
+	}
+} };
+//#endregion
+//#region src/recorder/addon/staging-writer-match.ts
+/**
+* Recognise a recorder writer in the process table (D667).
+*
+* A writer is recognised by the ARGV it was started with. Two parts decide it:
+* the executable is an ffmpeg, and `-segment_list` names a staging playlist.
+* The directory is what makes it a rival, not the binary: another node's
+* writers are in another pid namespace or on another host, and a writer of a
+* different directory is not competing for this one.
+*
+* Linux gives the exact argv, so every comparison there is exact. macOS `ps`
+* gives one space-joined string, so the match is a substring with a boundary
+* check on both sides. A profile name therefore may not contain a space. The
+* recorder's are `high`, `mid` and `low`.
+*/
+/** The argv flag every recorder writer carries, used to narrow the table read. */
+var SEGMENT_LIST_FLAG = "-segment_list";
+/**
+* True when the process was started from an executable whose name contains
+* `marker`. Without this, a `pgrep -f`, a `grep` or an `sh -c` wrapper that
+* merely mentions the playlist would be signalled on macOS, where the argv
+* cannot be told apart from the command text.
+*/
+function isWriterExecutable(proc, marker) {
+	if (proc.argv !== null) {
+		const exe = proc.argv[0];
+		return exe !== void 0 && node_path.default.basename(exe).includes(marker);
+	}
+	const flagAt = proc.command.indexOf(" -");
+	const exe = flagAt < 0 ? proc.command : proc.command.slice(0, flagAt);
+	return node_path.default.basename(exe).includes(marker);
+}
+/** True when this process was started as a writer of `playlistPath`. */
+function writesPlaylist(proc, playlistPath) {
+	if (proc.argv !== null) {
+		for (let i = 0; i < proc.argv.length - 1; i++) if (proc.argv[i] === "-segment_list" && proc.argv[i + 1] === playlistPath) return true;
+		return false;
+	}
+	const needle = `${SEGMENT_LIST_FLAG} ${playlistPath}`;
+	let from = 0;
+	for (;;) {
+		const at = proc.command.indexOf(needle, from);
+		if (at < 0) return false;
+		const before = at === 0 ? " " : proc.command[at - 1];
+		const after = proc.command[at + needle.length];
+		if (before === " " && (after === void 0 || after === " ")) return true;
+		from = at + 1;
+	}
+}
+var TAIL = /^(\d+)\/([^/\s]+)\/live\.m3u8$/;
+var TAIL_IN_COMMAND = /^(\d+)\/([^/\s]+)\/live\.m3u8(?= |$)/;
+function targetFromTail(root, tail, pattern) {
+	const match = pattern.exec(tail);
+	if (match === null) return null;
+	const deviceId = Number(match[1]);
+	const profile = match[2];
+	if (!Number.isSafeInteger(deviceId) || profile === void 0) return null;
+	return {
+		deviceId,
+		profile,
+		root,
+		outDir: node_path.default.join(root, STAGING_DIR_NAME, String(deviceId), profile)
+	};
+}
+/**
+* The staging directory this process writes, when it writes one under any of
+* `roots` — `<root>/.rec-tmp/<deviceId>/<profile>/live.m3u8`, nothing looser.
+* Used by the sweeps, which do not know in advance which directories hold an
+* orphan.
+*/
+function stagingTargetOf(proc, roots) {
+	for (const root of roots) {
+		const prefix = `${node_path.default.join(root, STAGING_DIR_NAME)}/`;
+		if (proc.argv !== null) {
+			for (let i = 0; i < proc.argv.length - 1; i++) {
+				const value = proc.argv[i + 1];
+				if (proc.argv[i] !== "-segment_list" || value === void 0) continue;
+				if (!value.startsWith(prefix)) continue;
+				const target = targetFromTail(root, value.slice(prefix.length), TAIL);
+				if (target !== null) return target;
+			}
+			continue;
+		}
+		const needle = `${SEGMENT_LIST_FLAG} ${prefix}`;
+		let from = 0;
+		for (;;) {
+			const at = proc.command.indexOf(needle, from);
+			if (at < 0) break;
+			if ((at === 0 ? " " : proc.command[at - 1]) === " ") {
+				const target = targetFromTail(root, proc.command.slice(at + needle.length), TAIL_IN_COMMAND);
+				if (target !== null) return target;
+			}
+			from = at + 1;
+		}
+	}
+	return null;
+}
+/** A table read this recent is good enough for a claim. Foreign writers only
+*  come from a predecessor, which exists before the read — and every signal
+*  this guard sends invalidates the cache. */
+var CLAIM_LIST_MAX_AGE_MS = 1e3;
+/** Two sightings of one pid whose start times differ by more than this are two
+*  processes: `ps` reports elapsed time in whole seconds. */
+var SAME_START_TOLERANCE_MS = 2e3;
+var POLL_MS = 100;
+function errMsg(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+function ageSec(ageMs) {
+	return ageMs === null ? null : Math.round(ageMs / 1e3);
+}
+var StagingWriterReaper = class {
+	deps;
+	refusals = /* @__PURE__ */ new Map();
+	cache = null;
+	inflight = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async claim(request) {
+		const target = {
+			deviceId: request.deviceId,
+			profile: request.profile,
+			root: request.root,
+			outDir: request.outDir
+		};
+		const held = this.heldRecord(request.outDir);
+		if (held !== null) {
+			const survivor = {
+				target,
+				pid: held.pid,
+				ppid: null,
+				ageMs: null,
+				reason: "held"
+			};
+			this.logHeld(survivor, held);
+			return {
+				outcome: "refused",
+				survivors: [survivor]
+			};
+		}
+		let rows;
+		try {
+			rows = await this.list(this.deps.now() - CLAIM_LIST_MAX_AGE_MS);
+		} catch (err) {
+			this.deps.logger.warn("recorder: could not read the process table — spawning a writer WITHOUT checking its staging directory for another writer", {
+				tags: { deviceId: request.deviceId },
+				meta: {
+					profile: request.profile,
+					outDir: request.outDir,
+					error: errMsg(err)
+				}
+			});
+			return {
+				outcome: "unverified",
+				error: errMsg(err)
+			};
+		}
+		const playlist = segmentListPath(request.outDir);
+		const candidates = rows.filter((proc) => this.isForeignWriter(proc, request.ownPids) && writesPlaylist(proc, playlist)).map((proc) => ({
+			proc,
+			target
+		}));
+		if (candidates.length === 0) {
+			this.forgetRefusal(target);
+			return {
+				outcome: "clear",
+				reaped: []
+			};
+		}
+		const outcome = await this.reap(candidates);
+		if (outcome.refused.length > 0) return {
+			outcome: "refused",
+			survivors: outcome.refused
+		};
+		return {
+			outcome: "clear",
+			reaped: outcome.reaped
+		};
+	}
+	async sweep(request) {
+		const startedMs = this.deps.now();
+		const tags = request.deviceId === null ? void 0 : { deviceId: request.deviceId };
+		let rows;
+		try {
+			rows = await this.list(startedMs);
+		} catch (err) {
+			this.deps.logger.warn("recorder: could not read the process table — a previous runner’s writers cannot be swept", {
+				...tags ? { tags } : {},
+				meta: {
+					roots: request.roots,
+					error: errMsg(err)
+				}
+			});
+			return {
+				outcome: "unverified",
+				error: errMsg(err)
+			};
+		}
+		const candidates = [];
+		for (const proc of rows) {
+			if (!this.isForeignWriter(proc, request.ownPids)) continue;
+			const target = stagingTargetOf(proc, request.roots);
+			if (target === null) continue;
+			if (request.deviceId !== null && target.deviceId !== request.deviceId) continue;
+			candidates.push({
+				proc,
+				target
+			});
+		}
+		const outcome = candidates.length === 0 ? {
+			reaped: [],
+			refused: []
+		} : await this.reap(candidates);
+		if (request.deviceId === null) this.deps.logger.info("recorder: boot sweep for a previous runner’s writers", { meta: {
+			roots: request.roots,
+			found: candidates.length,
+			reaped: outcome.reaped.length,
+			refused: outcome.refused.length,
+			ms: this.deps.now() - startedMs
+		} });
+		return {
+			outcome: "swept",
+			reaped: outcome.reaped,
+			refused: outcome.refused
+		};
+	}
+	isForeignWriter(proc, ownPids) {
+		return proc.pid !== this.deps.selfPid && !ownPids.has(proc.pid) && isWriterExecutable(proc, this.deps.executableMarker ?? "ffmpeg");
+	}
+	/**
+	* One SIGTERM → SIGKILL window for every candidate at once. Candidates whose
+	* directory is held are refused without a signal.
+	*/
+	async reap(candidates) {
+		const started = this.deps.now();
+		const refused = [];
+		const active = [];
+		for (const candidate of candidates) {
+			const held = this.heldRecord(candidate.target.outDir);
+			if (held === null) {
+				active.push(candidate);
+				continue;
+			}
+			const survivor = this.refusedOf(candidate, "held");
+			this.logHeld(survivor, held);
+			refused.push(survivor);
+		}
+		const terminated = this.signalAll(active, "SIGTERM", refused);
+		let signalled = terminated;
+		const killed = /* @__PURE__ */ new Set();
+		if (terminated.length > 0) {
+			const afterTerm = await this.waitGone(terminated, this.deps.termGraceMs ?? 2e3);
+			if (afterTerm === null) {
+				for (const candidate of terminated) refused.push(this.refusedOf(candidate, "table-unreadable"));
+				signalled = [];
+			} else if (afterTerm.length > 0) {
+				const toKill = this.signalAll(afterTerm, "SIGKILL", refused);
+				for (const candidate of toKill) killed.add(candidate.proc.pid);
+				if (toKill.length > 0) {
+					const afterKill = await this.waitGone(toKill, this.deps.killGraceMs ?? 1e3);
+					const reason = afterKill === null ? "table-unreadable" : "survived";
+					for (const candidate of afterKill ?? toKill) refused.push(this.refusedOf(candidate, reason));
+				}
+			}
+		}
+		const waitedMs = this.deps.now() - started;
+		const refusedPids = new Set(refused.map((writer) => writer.pid));
+		const reaped = [];
+		for (const candidate of signalled) {
+			if (refusedPids.has(candidate.proc.pid)) continue;
+			const writer = {
+				target: candidate.target,
+				pid: candidate.proc.pid,
+				ppid: candidate.proc.ppid,
+				ageMs: candidate.proc.ageMs,
+				signal: killed.has(candidate.proc.pid) ? "SIGKILL" : "SIGTERM",
+				waitedMs
+			};
+			reaped.push(writer);
+			this.logReaped(writer);
+		}
+		for (const writer of refused) if (writer.reason !== "held") this.recordRefusal(writer, waitedMs);
+		return {
+			reaped,
+			refused
+		};
+	}
+	/**
+	* Send `signal` to each candidate. A candidate the kernel refuses (EPERM) is
+	* refused at once — waiting out a grace for a signal that was never
+	* delivered cannot change anything. Returns the ones worth waiting for.
+	*/
+	signalAll(candidates, signal, refused) {
+		if (candidates.length === 0) return [];
+		const pending = [];
+		for (const candidate of candidates) if (this.deps.signaller.send(candidate.proc.pid, signal) === "denied") refused.push(this.refusedOf(candidate, "denied"));
+		else pending.push(candidate);
+		this.cache = null;
+		return pending;
+	}
+	/**
+	* Poll until none of `targets` is still writing its playlist, or the grace
+	* runs out. Returns who is left, or `null` when the table could not be read
+	* twice in a row. A zombie or a recycled pid is "gone" by this test, because
+	* it is the ARGV that makes a writer, not the pid.
+	*/
+	async waitGone(targets, graceMs) {
+		const deadline = this.deps.now() + graceMs;
+		for (;;) {
+			await this.deps.sleep(this.deps.pollMs ?? POLL_MS);
+			const rows = await this.freshRowsOrNull();
+			if (rows === null) return null;
+			const left = targets.filter((candidate) => rows.some((proc) => proc.pid === candidate.proc.pid && isWriterExecutable(proc, this.deps.executableMarker ?? "ffmpeg") && writesPlaylist(proc, segmentListPath(candidate.target.outDir))));
+			if (left.length === 0 || this.deps.now() >= deadline) return left;
+		}
+	}
+	/** One fresh read, and ONE retry after a poll interval. */
+	async freshRowsOrNull() {
+		for (let attempt = 0; attempt < 2; attempt++) try {
+			return await this.list(this.deps.now());
+		} catch {
+			if (attempt === 0) await this.deps.sleep(this.deps.pollMs ?? POLL_MS);
+		}
+		return null;
+	}
+	/**
+	* The process table, read at or after `notBeforeMs`. Concurrent callers
+	* share one read in flight, so eight attaches at boot cost one `ps`, not
+	* eight.
+	*/
+	async list(notBeforeMs) {
+		if (this.cache !== null && this.cache.at >= notBeforeMs) return this.cache.rows;
+		if (this.inflight !== null && this.inflight.startedAt >= notBeforeMs) return (await this.inflight.promise).rows;
+		const startedAt = this.deps.now();
+		const promise = this.deps.lister.list(SEGMENT_LIST_FLAG).then((rows) => ({
+			at: startedAt,
+			rows
+		}));
+		const entry = {
+			startedAt,
+			promise
+		};
+		this.inflight = entry;
+		try {
+			const listing = await promise;
+			if (this.cache === null || this.cache.at <= listing.at) this.cache = listing;
+			return listing.rows;
+		} finally {
+			if (this.inflight === entry) this.inflight = null;
+		}
+	}
+	refusedOf(candidate, reason) {
+		return {
+			target: candidate.target,
+			pid: candidate.proc.pid,
+			ppid: candidate.proc.ppid,
+			ageMs: candidate.proc.ageMs,
+			reason
+		};
+	}
+	heldRecord(outDir) {
+		const record = this.refusals.get(outDir);
+		if (record === void 0) return null;
+		const retryMs = this.deps.refusalRetryMs ?? 6e4;
+		return this.deps.now() - record.lastAttemptMs < retryMs ? record : null;
+	}
+	startedAtOf(ageMs) {
+		return ageMs === null ? null : this.deps.now() - ageMs;
+	}
+	/** ERROR on a new refusal state, DEBUG on a repeat of the same one. */
+	recordRefusal(writer, waitedMs) {
+		const now = this.deps.now();
+		const startedAtMs = this.startedAtOf(writer.ageMs);
+		const previous = this.refusals.get(writer.target.outDir);
+		const same = previous !== void 0 && previous.pid === writer.pid && previous.reason === writer.reason && (previous.startedAtMs === null || startedAtMs === null || Math.abs(previous.startedAtMs - startedAtMs) <= SAME_START_TOLERANCE_MS);
+		const attempts = same ? previous.attempts + 1 : 1;
+		this.refusals = new Map(this.refusals).set(writer.target.outDir, {
+			pid: writer.pid,
+			startedAtMs,
+			reason: writer.reason,
+			firstMs: same ? previous.firstMs : now,
+			lastAttemptMs: now,
+			attempts
+		});
+		const extras = {
+			tags: { deviceId: writer.target.deviceId },
+			meta: {
+				profile: writer.target.profile,
+				pid: writer.pid,
+				ppid: writer.ppid,
+				ageSec: ageSec(writer.ageMs),
+				reason: writer.reason,
+				attempts,
+				waitedMs,
+				retryInMs: this.deps.refusalRetryMs ?? 6e4,
+				outDir: writer.target.outDir
+			}
+		};
+		if (same) {
+			this.deps.logger.debug("recorder: staging directory still refused — same foreign writer", extras);
+			return;
+		}
+		this.deps.logger.error("recorder: REFUSED to spawn a writer — another writer on this staging directory could not be removed", extras);
+	}
+	logHeld(writer, record) {
+		this.deps.logger.debug("recorder: staging directory held after a refusal — not retried yet", {
+			tags: { deviceId: writer.target.deviceId },
+			meta: {
+				profile: writer.target.profile,
+				pid: record.pid,
+				reason: record.reason,
+				attempts: record.attempts,
+				heldForMs: this.deps.now() - record.firstMs,
+				outDir: writer.target.outDir
+			}
+		});
+	}
+	forgetRefusal(target) {
+		const record = this.refusals.get(target.outDir);
+		if (record === void 0) return;
+		const next = new Map(this.refusals);
+		next.delete(target.outDir);
+		this.refusals = next;
+		this.deps.logger.info("recorder: staging directory no longer refused — the foreign writer is gone", {
+			tags: { deviceId: target.deviceId },
+			meta: {
+				profile: target.profile,
+				pid: record.pid,
+				attempts: record.attempts,
+				refusedForMs: this.deps.now() - record.firstMs,
+				outDir: target.outDir
+			}
+		});
+	}
+	logReaped(writer) {
+		if (this.refusals.has(writer.target.outDir)) this.forgetRefusal(writer.target);
+		this.deps.logger.warn("recorder: reaped a predecessor writer on this staging directory — one writer per directory", {
+			tags: { deviceId: writer.target.deviceId },
+			meta: {
+				profile: writer.target.profile,
+				pid: writer.pid,
+				ppid: writer.ppid,
+				ageSec: ageSec(writer.ageMs),
+				signal: writer.signal,
+				waitedMs: writer.waitedMs,
+				outDir: writer.target.outDir
+			}
+		});
+	}
+};
+//#endregion
+//#region src/recorder/addon/staging-boot.ts
+async function runStagingBoot(steps) {
+	const stagingIsQuiescent = await steps.reapPredecessorWriters();
+	const bootMs = steps.now();
+	await steps.startWritePath();
+	if (!stagingIsQuiescent) return;
+	(async () => {
+		await steps.recoverStagedOrphans(bootMs);
+		await steps.sweepUnassignedStaging();
+	})();
+}
+//#endregion
 //#region src/recorder/loop-pacer.ts
 var DEFAULT_BUSY_LAG_MS = 25;
 var DEFAULT_BACKOFF_STEP_MS = 25;
@@ -19134,6 +20279,13 @@ var MFRA_GATE_LIMIT = 64;
 var EXPORTS_PREFIX = "exports";
 /** How often the export janitor sweeps expired exports. */
 var EXPORT_SWEEP_INTERVAL_MS = 5 * 6e4;
+/**
+* The staging plan keeps anything named within 1 s before its cutoff for the
+* live writer (`PREVIOUS_RUN_SKEW_MS`). A reaped directory has no live writer
+* yet, so the cutoff is moved forward by exactly that much: everything the
+* reaped writer named up to the reap is collected.
+*/
+var REAPED_RECOVERY_SKEW_MS = 1e3;
 /** How often the retention sweep prunes footage past each camera's per-device
 *  age/size policy. Retention is NOT time-critical (footage ages out over days,
 *  and the disk-pressure eviction path already bounds the worst case), so an
@@ -19335,6 +20487,17 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	* behind scrub's `locateSegment` and expired its 8 s budget (2026-08-22).
 	*/
 	calendarInstance = null;
+	heapProbeInstance = null;
+	/**
+	* Names the pass, boot phase or inbound cap method that grows the heap.
+	* Every recorder lifetime builds ~2.3 GB in one silent phase 3–5 min after
+	* boot and nothing has ever said which unit of work does it (see
+	* `heap-delta.ts`). LAZY for the same reason as {@link calendar}.
+	*/
+	get heapProbe() {
+		this.heapProbeInstance ??= new HeapDeltaProbe({ logger: this.ctx.logger });
+		return this.heapProbeInstance;
+	}
 	/** LAZY: a field initialiser runs before `initialize()` assigns `ctx`, and
 	*  reading `this.ctx` there throws — the same trap that bit the playback tier. */
 	get calendar() {
@@ -19453,6 +20616,9 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	/** The `recording` cap provider — retained so the periodic retention sweep can
 	*  call its `pruneFootage`. Null until built in `onInitialize`. */
 	recordingProvider = null;
+	/** One writer per staging directory (D667). `null` where the platform has
+	*  no process table (Windows) — said once at startup. */
+	stagingGuard = null;
 	/** Periodic footage-retention sweep (owns its timer + single-flight guard).
 	*  Constructed + started in `onHubReachable`, stopped on shutdown. */
 	retentionSweeper = null;
@@ -19636,7 +20802,20 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			usedOnLocation: async (locationId) => (await this.segmentHours?.accountingForLocations(new Set([locationId])))?.bytes ?? 0,
 			dailyBytesFor: (deviceId, profile) => this.dailyBytesFor(deviceId, profile)
 		});
+		const processLister = createProcessLister();
+		if (processLister === null) this.ctx.logger.warn("recorder: no process table on this platform — orphaned writers cannot be detected; boot staging mutation is disabled", { meta: { platform: process.platform } });
+		this.stagingGuard = processLister === null ? null : new StagingWriterReaper({
+			lister: processLister,
+			signaller: nodeProcessSignaller,
+			logger: this.ctx.logger,
+			selfPid: process.pid,
+			sleep: (ms) => require_dist.sleep(ms),
+			now: () => Date.now()
+		});
 		this.controller = new RecordingController({
+			...this.stagingGuard !== null ? { stagingGuard: this.stagingGuard } : {},
+			recoverStagingDirectory: (input) => this.recoverReapedDirectory(input),
+			heapProbe: this.heapProbe,
 			api: this.ctx.api,
 			logger: this.ctx.logger,
 			nodeId: this.nodeId,
@@ -20106,30 +21285,30 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		const providers = [
 			{
 				capability: require_dist.recordingArchiveCapability,
-				provider: recordingProvider
+				provider: this.heapProbe.wrapProvider(require_dist.recordingArchiveCapability.name, recordingProvider)
 			},
 			{
 				capability: require_dist.recordingCapability,
-				provider: recordingSourceProvider
+				provider: this.heapProbe.wrapProvider(require_dist.recordingCapability.name, recordingSourceProvider)
 			},
 			{
 				capability: require_dist.videoclipsCapability,
-				provider: createRecorderVideoclipsProvider({
+				provider: this.heapProbe.wrapProvider(require_dist.videoclipsCapability.name, createRecorderVideoclipsProvider({
 					api: this.ctx.api,
 					logger: this.ctx.logger
-				})
+				}))
 			},
 			{
 				capability: require_dist.storageEvictableCapability,
-				provider: evictableProvider
+				provider: this.heapProbe.wrapProvider(require_dist.storageEvictableCapability.name, evictableProvider)
 			},
 			{
 				capability: require_dist.storageOccupancyCapability,
-				provider: evictableProvider
+				provider: this.heapProbe.wrapProvider(require_dist.storageOccupancyCapability.name, evictableProvider)
 			},
 			{
 				capability: require_dist.recordingExportCapability,
-				provider: exportProvider
+				provider: this.heapProbe.wrapProvider(require_dist.recordingExportCapability.name, exportProvider)
 			},
 			{
 				capability: require_dist.loadContributionCapability,
@@ -20289,14 +21468,28 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			recursive: true,
 			force: true
 		}).catch(() => {});
-		await this.sweepUnassignedStaging();
-		const stagingBootMs = Date.now();
-		try {
-			await this.controller?.start();
-		} catch (err) {
-			this.ctx.logger.warn("recorder: controller start failed", { meta: { error: require_dist.errMsg(err) } });
-		}
-		this.recoverStagedOrphans(stagingBootMs);
+		await runStagingBoot({
+			reapPredecessorWriters: () => this.heapProbe.track({
+				kind: "boot-phase",
+				name: "staging-writer-sweep"
+			}, () => this.reapPredecessorWriters()),
+			sweepUnassignedStaging: () => this.heapProbe.track({
+				kind: "boot-phase",
+				name: "staging-unassigned-sweep"
+			}, () => this.sweepUnassignedStaging()),
+			startWritePath: async () => {
+				try {
+					await this.controller?.start();
+				} catch (err) {
+					this.ctx.logger.warn("recorder: controller start failed", { meta: { error: require_dist.errMsg(err) } });
+				}
+			},
+			recoverStagedOrphans: (bootMs) => this.heapProbe.track({
+				kind: "boot-phase",
+				name: "staging-recovery"
+			}, () => this.recoverStagedOrphans(bootMs)),
+			now: () => Date.now()
+		});
 		if (this.locationRefresher === null) this.locationRefresher = new LocationRefresher({
 			logger: this.ctx.logger,
 			refresh: () => this.refreshLocations()
@@ -20376,7 +21569,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			this.controller?.onSignalLevel(parsed.deviceId, { kind: "signal" }, level.data.active, atMs);
 		});
 		try {
-			await this.segmentHours?.load();
+			await this.heapProbe.track({
+				kind: "boot-phase",
+				name: "ledger-load"
+			}, async () => {
+				await this.segmentHours?.load();
+			});
 		} catch (err) {
 			this.ctx.logger.warn("recorder: segment-hour ledger load failed — hours stay unknown until a read walks them", { meta: { error: require_dist.errMsg(err) } });
 		}
@@ -20388,20 +21586,27 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			return;
 		}
 		this.applySensorTriggerBindings(configs);
-		this.warmToday([...configs.keys()]);
+		this.heapProbe.track({
+			kind: "boot-phase",
+			name: "warm-today"
+		}, () => this.warmToday([...configs.keys()]));
 		this.ctx.logger.info("recorder: full-archive index walk skipped", { meta: {
 			reason: "on-demand-windows",
 			ledgerHours: this.segmentHours?.snapshot().length ?? 0,
 			deviceCount: configs.size
 		} });
-		this.cleanupLegacyThumbsDirs();
+		this.heapProbe.track({
+			kind: "boot-phase",
+			name: "legacy-thumbs-cleanup"
+		}, () => this.cleanupLegacyThumbsDirs());
 		await this.bootstrapExports();
 		const provider = this.recordingProvider;
 		if (provider && this.retentionSweeper === null) this.retentionSweeper = new RetentionSweeper({
 			prune: (deviceId) => provider.pruneFootage({ deviceId }),
 			readConfigs: () => readDeviceConfigs(this.configStore()),
 			logger: this.ctx.logger,
-			intervalMs: RETENTION_SWEEP_INTERVAL_MS
+			intervalMs: RETENTION_SWEEP_INTERVAL_MS,
+			heapProbe: this.heapProbe
 		});
 		this.retentionSweeper?.start();
 		const store = this.segmentStore;
@@ -20411,7 +21616,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			evict: (locationId, rows) => store.evict(locationId, rows),
 			logger: this.ctx.logger,
 			intervalMs: REDUNDANCY_SWEEP_INTERVAL_MS,
-			lookbackMs: REDUNDANCY_SWEEP_LOOKBACK_MS
+			lookbackMs: REDUNDANCY_SWEEP_LOOKBACK_MS,
+			heapProbe: this.heapProbe
 		});
 		this.redundancySweeper?.start();
 		const ledger = this.segmentHours;
@@ -20436,6 +21642,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				name: "ghost-location-reconcile",
 				intervalMs: GHOST_LOCATION_SWEEP_INTERVAL_MS,
 				slowAfterMs: GHOST_LOCATION_SWEEP_SLOW_AFTER_MS,
+				heapProbe: this.heapProbe,
 				run: async () => {
 					await sweeper.sweep();
 				},
@@ -20463,6 +21670,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				intervalMs: HOUR_ADOPTION_INTERVAL_MS,
 				firstRunDelayMs: HOUR_ADOPTION_FIRST_RUN_DELAY_MS,
 				slowAfterMs: HOUR_ADOPTION_SLOW_AFTER_MS,
+				heapProbe: this.heapProbe,
 				run: async () => {
 					if (await runAdoptionCatchUp({
 						locationIds: this.resolvedLocations.map((location) => location.id),
@@ -20591,7 +21799,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		if (this.exportSweepTimer === null) {
 			const sweep = () => {
 				this.logIndexCensus();
-				sweepExpiredExports(Date.now(), this.exportJanitorDeps()).catch((err) => {
+				this.heapProbe.track({
+					kind: "pass",
+					name: "export-expiry"
+				}, () => sweepExpiredExports(Date.now(), this.exportJanitorDeps())).catch((err) => {
 					this.ctx.logger.warn("recorder: export expiry sweep failed", { meta: { error: require_dist.errMsg(err) } });
 				});
 			};
@@ -20638,7 +21849,13 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				incrementalInserts: views.incrementalInserts,
 				rowsReused: reuse.rowsReused,
 				rowsAllocated: reuse.rowsAllocated,
-				ledgerHours: this.segmentHours?.snapshot().length ?? 0
+				ledgerHours: this.segmentHours?.snapshot().length ?? 0,
+				calendar: this.calendarInstance?.memoryCensus() ?? null,
+				mfra: this.mfraTables.memoryCensus(),
+				ledger: this.segmentHours?.memoryCensus() ?? null,
+				placement: this.placement?.memoryCensus() ?? null,
+				exports: this.exportEngine?.memoryCensus() ?? null,
+				controller: this.controller?.memoryCensus() ?? null
 			}
 		});
 	}
@@ -20950,6 +22167,66 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		}
 	}
 	/**
+	* Boot sweep for a previous runner's writers (D667): every foreign ffmpeg
+	* writing under any location's `.rec-tmp`, whether or not its camera will be
+	* attached again. On re-entry (`onHubReachable` again) the controller's own
+	* writers are live and excluded by pid.
+	*/
+	async reapPredecessorWriters() {
+		const guard = this.stagingGuard;
+		if (guard === null) return false;
+		const result = await guard.sweep({
+			roots: this.resolvedLocations.map((location) => location.root),
+			deviceId: null,
+			ownPids: this.controller?.ownedWriterPids() ?? /* @__PURE__ */ new Set()
+		});
+		if (result.outcome === "unverified") {
+			this.ctx.logger.warn("recorder: staging mutation skipped at boot — the predecessor-writer sweep was unverified", { meta: { roots: this.resolvedLocations.map((location) => location.root) } });
+			return false;
+		}
+		if (result.refused.length === 0) return true;
+		this.ctx.logger.warn("recorder: staging mutation skipped at boot — a known predecessor writer remains", { meta: {
+			refused: result.refused.length,
+			roots: this.resolvedLocations.map((location) => location.root)
+		} });
+		return false;
+	}
+	/**
+	* Collect what a reaped writer left in one staging directory, before the
+	* controller spawns a new writer there (D667). The reaped writer's playlist
+	* is NOT consulted: it names that writer's last entries, and nobody is left
+	* to finalize them.
+	*/
+	async recoverReapedDirectory(input) {
+		const report = await recoverStagingOrphans(input.dir, {
+			writerStartedMs: input.cutoffMs + REAPED_RECOVERY_SKEW_MS,
+			segmentSeconds: input.segmentSeconds
+		}, {
+			listDir: nodeStagingIo.listDir,
+			readPlaylist: async () => null,
+			finalize: async (orphan, absPath) => {
+				const store = this.segmentStore;
+				if (store === null) throw new Error("recorder is shutting down");
+				await store.onFinalized({
+					deviceId: input.deviceId,
+					profile: input.profile,
+					locationId: input.locationId,
+					locationRoot: input.locationRoot,
+					flatAbsPath: absPath,
+					startMs: orphan.startMs,
+					durMs: orphan.durMs
+				});
+			},
+			logger: this.ctx.logger.withTags({ deviceId: input.deviceId }),
+			shouldStop: () => this.segmentStore === null
+		});
+		return {
+			found: report.found,
+			recovered: report.recovered,
+			failed: report.failed
+		};
+	}
+	/**
 	* Boot sweep: remove the `.rec-tmp` staging tree from every recordings root
 	* NOTHING is assigned to any more. Staging lives under the placement root, so
 	* a root that has just been drained, opted out or deleted from the plan keeps
@@ -20957,8 +22234,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	* no retention pass will ever see (`.rec-tmp` is invisible to the hydrate
 	* walk by design). Same shape as the `.scrub-packs` sweep above.
 	*
-	* Only roots with ZERO assignments are touched, and only at boot, before any
-	* writer attaches — a root in use always has an assignment naming it.
+	* Only roots with ZERO assignments are touched, and only on the boot chain,
+	* after orphan recovery. The placement read happens here, after the
+	* controller has attached, so any root a new writer uses is named by an
+	* assignment and cannot be swept.
 	*/
 	async sweepUnassignedStaging() {
 		let assigned;