@camstack/addon-pipeline 1.2.304 → 1.2.305

package/dist/recorder/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-CyWAhtbJ.js");
-const require_node = require("../node-BDrkzYiH.js");
+const require_dist = require("../dist-D4lbkRUh.js");
+const require_node = require("../node-BMmRQfH_.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
@@ -840,15 +840,15 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$9 = 36e5;
+var HOUR_MS$11 = 36e5;
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$9) * HOUR_MS$9;
-	for (let h = first; h < toMs; h += HOUR_MS$9) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$11) * HOUR_MS$11;
+	for (let h = first; h < toMs; h += HOUR_MS$11) yield h;
 }
 /** The hour bucket a segment belongs to — the same one its path encodes. */
 function hourOf$1(startMs) {
-	return Math.floor(startMs / HOUR_MS$9) * HOUR_MS$9;
+	return Math.floor(startMs / HOUR_MS$11) * HOUR_MS$11;
 }
 /** The production bound. See {@link RecordingIndexBudget} for the measurement. */
 var DEFAULT_RECORDING_INDEX_BUDGET = {
@@ -1226,8 +1226,8 @@ var RecordingIndex = class {
 		const w = this.walked.get(deviceId);
 		if (w === void 0 || w.size === 0) return;
 		const tick = ++this.useTick;
-		if (Math.ceil(Math.max(0, toMs - fromMs) / HOUR_MS$9) > w.size) {
-			for (const h of w.keys()) if (h < toMs && h + HOUR_MS$9 > fromMs) w.set(h, tick);
+		if (Math.ceil(Math.max(0, toMs - fromMs) / HOUR_MS$11) > w.size) {
+			for (const h of w.keys()) if (h < toMs && h + HOUR_MS$11 > fromMs) w.set(h, tick);
 			return;
 		}
 		for (const h of hourBuckets(fromMs, toMs)) if (w.has(h)) w.set(h, tick);
@@ -1264,7 +1264,7 @@ var RecordingIndex = class {
 		if (rows <= budget.residentRowBudget && hours <= budget.residentHourBudget) return;
 		const rowTarget = Math.floor(budget.residentRowBudget * budget.evictToFraction);
 		const hourTarget = Math.floor(budget.residentHourBudget * budget.evictToFraction);
-		const pinnedFrom = hourOf$1(deps.now()) - Math.max(0, budget.pinnedTailHours - 1) * HOUR_MS$9;
+		const pinnedFrom = hourOf$1(deps.now()) - Math.max(0, budget.pinnedTailHours - 1) * HOUR_MS$11;
 		const counts = this.hourHistogram();
 		const candidates = [];
 		for (const [deviceId, byHour] of counts) {
@@ -1386,7 +1386,7 @@ var RecordingIndex = class {
 			changed = true;
 		}
 		if (changed) this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$9);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$11);
 		this.enforceResidency();
 	}
 	/**
@@ -1411,7 +1411,7 @@ var RecordingIndex = class {
 		const dropped = [];
 		for (const [path, row] of m) {
 			if (row.locationId !== locationId) continue;
-			if (Math.floor(row.startMs / HOUR_MS$9) * HOUR_MS$9 !== hourStartMs) continue;
+			if (Math.floor(row.startMs / HOUR_MS$11) * HOUR_MS$11 !== hourStartMs) continue;
 			if (keep.has(path)) continue;
 			dropped.push(path);
 		}
@@ -2074,11 +2074,11 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	const p2 = (n) => String(n).padStart(2, "0");
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
-var HOUR_MS$8 = 36e5;
+var HOUR_MS$10 = 36e5;
 async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger, ledger, options) {
 	const verify = options?.verifyClosedHours === true;
 	if (!verify && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
-	const liveHour = Math.floor(Date.now() / HOUR_MS$8) * HOUR_MS$8;
+	const liveHour = Math.floor(Date.now() / HOUR_MS$10) * HOUR_MS$10;
 	for (const [root, aliases] of aliasesByRoot(locations)) {
 		const deviceDir = node_path.default.join(root, String(deviceId));
 		let profiles;
@@ -2094,15 +2094,15 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			});
 			continue;
 		}
-		const first = Math.floor(fromMs / HOUR_MS$8) * HOUR_MS$8;
+		const first = Math.floor(fromMs / HOUR_MS$10) * HOUR_MS$10;
 		const reuseBefore = index.hydrateReuseStats();
 		let hoursRead = 0;
 		let repaired = 0;
 		let forgottenSegments = 0;
 		let forgottenHours = 0;
 		let sealed = 0;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$8) {
-			if (!verify && hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$8) === "hydrated") continue;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$10) {
+			if (!verify && hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$10) === "hydrated") continue;
 			for (const profile of profiles) {
 				const rel = hourDirRelPath(deviceId, profile, hour);
 				let files;
@@ -2115,7 +2115,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 				const locationId = locationForHydratedProfile(aliases, profile).id;
 				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
 				index.hydrateHour(deviceId, locationId, hour, relPaths);
-				if (ledger === void 0 || relPaths.length === 0 || hour + HOUR_MS$8 > Date.now()) continue;
+				if (ledger === void 0 || relPaths.length === 0 || hour + HOUR_MS$10 > Date.now()) continue;
 				const outcome = await ledger.adoptWalkedHour(deviceId, profile, locationId, hour, relPaths);
 				if (outcome === null) continue;
 				if (outcome.created) repaired += 1;
@@ -2197,7 +2197,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 */
 var DEFAULT_THROTTLE_MBPS = 40;
 /** The durable index's bucket, and therefore this mover's batch. */
-var HOUR_MS$7 = 36e5;
+var HOUR_MS$9 = 36e5;
 /** Progress callback cadence (files) — cheap enough to fire often. */
 var PROGRESS_EVERY_FILES = 25;
 /** Free space a destination must keep when it declares no `config.minFreePercent`
@@ -2886,7 +2886,7 @@ function profilesOfClass(footageClass) {
 function groupByHour(rows) {
 	const out = /* @__PURE__ */ new Map();
 	for (const row of rows) {
-		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$7)}`;
+		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$9)}`;
 		const found = out.get(key);
 		if (found) found.push(row);
 		else out.set(key, [row]);
@@ -4110,6 +4110,231 @@ async function profileHasFootage(root, deviceId, profile) {
 	return (await listDir(node_path.default.join(root, String(deviceId), profile))).length > 0;
 }
 //#endregion
+//#region src/recorder/addon/calendar-hour-cache.ts
+var HOUR_MS$8 = 36e5;
+var HOURS_PER_DAY = 24;
+/**
+* The production bound: the RAM index's own (`DEFAULT_RECORDING_INDEX_BUDGET`,
+* 250 000 rows / 20 000 walked hours, measured at 698 B/row). The calendar
+* holds a 3-scalar `HourSegment` per segment where the index holds a full row,
+* so the same counts are a SMALLER heap here — see
+* {@link CALENDAR_SEGMENT_APPROX_BYTES}.
+*/
+var DEFAULT_CALENDAR_HOUR_BUDGET = {
+	hourBudget: DEFAULT_RECORDING_INDEX_BUDGET.residentHourBudget,
+	segmentBudget: DEFAULT_RECORDING_INDEX_BUDGET.residentRowBudget,
+	evictToFraction: DEFAULT_RECORDING_INDEX_BUDGET.evictToFraction
+};
+/** Every empty hour shares this one array: a gap costs a slot, not an object. */
+var EMPTY_HOUR = Object.freeze([]);
+/** Hours since the epoch — a Smi, where `hourMs` would be a HeapNumber. */
+function hourIndexOf(epochMs) {
+	return Math.floor(epochMs / HOUR_MS$8);
+}
+var CalendarHourCache = class {
+	budget;
+	byDevice = /* @__PURE__ */ new Map();
+	/** Least recently used first — `Set` iteration order is insertion order. */
+	lru = /* @__PURE__ */ new Set();
+	segmentCount = 0;
+	emptyCount = 0;
+	stampedCount = 0;
+	evictedCount = 0;
+	constructor(budget = DEFAULT_CALENDAR_HOUR_BUDGET) {
+		this.budget = budget;
+	}
+	/** The cached segments of one hour, or `undefined` when not cached. */
+	get(deviceId, profile, hourMs) {
+		const entry = this.entryOf(deviceId, profile, hourMs);
+		if (entry === void 0) return void 0;
+		this.lru.delete(entry);
+		this.lru.add(entry);
+		return entry.segments;
+	}
+	/** When this hour was read AS THE CURRENT HOUR, or `undefined`. */
+	readAtOf(deviceId, profile, hourMs) {
+		return this.entryOf(deviceId, profile, hourMs)?.readAtMs ?? void 0;
+	}
+	/**
+	* Store one COMPLETE scan. `currentReadAtMs` is set only when the hour was
+	* the current one at store time; a later store of the closed hour passes
+	* `null` and so drops the stamp with the entry it replaces.
+	*/
+	set(deviceId, profile, hourMs, segments, currentReadAtMs) {
+		const hourIndex = hourIndexOf(hourMs);
+		this.remove(deviceId, profile, hourIndex);
+		const entry = {
+			deviceId,
+			profile,
+			hourIndex,
+			segments: segments.length === 0 ? EMPTY_HOUR : segments,
+			readAtMs: currentReadAtMs
+		};
+		this.profileMap(deviceId, profile).set(hourIndex, entry);
+		this.lru.add(entry);
+		if (entry.segments.length === 0) this.emptyCount += 1;
+		else this.segmentCount += entry.segments.length;
+		if (entry.readAtMs !== null) this.stampedCount += 1;
+		this.enforceBudget();
+	}
+	/**
+	* Drop one camera's UTC day, every profile — what eviction changed. The read
+	* stamps go with their hours; there is no second map to sweep.
+	*/
+	invalidateDay(deviceId, utcDayMs) {
+		const firstHour = hourIndexOf(utcDayMs);
+		const profiles = this.byDevice.get(deviceId);
+		if (profiles === void 0) return;
+		for (const profile of [...profiles.keys()]) for (let h = 0; h < HOURS_PER_DAY; h++) this.remove(deviceId, profile, firstHour + h);
+	}
+	/** Full reset — a relocation re-pointed rows across locations. */
+	clear() {
+		this.byDevice.clear();
+		this.lru.clear();
+		this.segmentCount = 0;
+		this.emptyCount = 0;
+		this.stampedCount = 0;
+	}
+	census() {
+		const hours = this.lru.size;
+		return {
+			hourKeys: hours - this.emptyCount,
+			emptyHours: this.emptyCount,
+			hourSegments: this.segmentCount,
+			segsReadAtKeys: this.stampedCount,
+			evictedHours: this.evictedCount,
+			approxBytes: hours * 128 + this.segmentCount * 72 + this.stampedCount * 16
+		};
+	}
+	entryOf(deviceId, profile, hourMs) {
+		return this.byDevice.get(deviceId)?.get(profile)?.get(hourIndexOf(hourMs));
+	}
+	profileMap(deviceId, profile) {
+		let profiles = this.byDevice.get(deviceId);
+		if (profiles === void 0) {
+			profiles = /* @__PURE__ */ new Map();
+			this.byDevice.set(deviceId, profiles);
+		}
+		let hours = profiles.get(profile);
+		if (hours === void 0) {
+			hours = /* @__PURE__ */ new Map();
+			profiles.set(profile, hours);
+		}
+		return hours;
+	}
+	/** Remove one hour and its stamp; prune empty parents. */
+	remove(deviceId, profile, hourIndex) {
+		const profiles = this.byDevice.get(deviceId);
+		const hours = profiles?.get(profile);
+		const entry = hours?.get(hourIndex);
+		if (profiles === void 0 || hours === void 0 || entry === void 0) return;
+		hours.delete(hourIndex);
+		if (hours.size === 0) profiles.delete(profile);
+		if (profiles.size === 0) this.byDevice.delete(deviceId);
+		this.lru.delete(entry);
+		if (entry.segments.length === 0) this.emptyCount -= 1;
+		else this.segmentCount -= entry.segments.length;
+		if (entry.readAtMs !== null) this.stampedCount -= 1;
+	}
+	enforceBudget() {
+		const { hourBudget, segmentBudget, evictToFraction } = this.budget;
+		if (this.lru.size <= hourBudget && this.segmentCount <= segmentBudget) return;
+		const hourTarget = Math.floor(hourBudget * evictToFraction);
+		const segmentTarget = Math.floor(segmentBudget * evictToFraction);
+		for (const entry of this.lru) {
+			if (this.lru.size <= hourTarget && this.segmentCount <= segmentTarget) return;
+			this.remove(entry.deviceId, entry.profile, entry.hourIndex);
+			this.evictedCount += 1;
+		}
+	}
+};
+//#endregion
+//#region src/recorder/addon/calendar-window.ts
+var HOUR_MS$7 = 36e5;
+/**
+* The widest walk one call may make AFTER the clamp: a leap year of hours.
+*
+* Evidence, not taste. The widest in-repo caller is the viewer's month
+* calendar (~33 days); the rest ask a day or a clip window (liveness 24 h,
+* videoclips' since/until, a timelapse window, a timeline day). The one that
+* asked for more wanted a single number the ledger already holds (D674). The
+* archives it would still admit are past what this system keeps: the 28 TB
+* projection is ~47 k hour rows, ~2,000 hours (~82 days) per camera/profile
+* pair at ~24 pairs, and the live hub held 3.3 days. (The ledger's load CAP,
+* `SEGMENT_HOUR_SUMMARY_LIMIT` = 250,000 rows, is ~10 k hours per pair — a
+* bound on memory, not a claim about retention; the clamp only ever narrows a
+* walk further.) A walk this wide costs ~130 B of garbage per hour warm
+* (measured: ~65 MB for 497,408 hours), so ~1.1 MB at the cap.
+*/
+var CALENDAR_MAX_WALK_HOURS = 366 * 24;
+var UNKNOWN_ARCHIVE_FLOOR = { known: false };
+/** A walk the calendar will not make. Surfaces as `read: 'unreadable'`. */
+var CalendarWindowRefusedError = class extends Error {
+	deviceId;
+	hours;
+	maxHours;
+	floorKnown;
+	name = "CalendarWindowRefusedError";
+	constructor(deviceId, hours, maxHours, floorKnown) {
+		super(`calendar: refused a ${String(hours)}-hour walk for device ${String(deviceId)} (cap ${String(maxHours)} h, archive floor ${floorKnown ? "known" : "UNKNOWN"}) — ask the archive (recordingArchive.getStorageUsage) for whole-archive facts`);
+		this.deviceId = deviceId;
+		this.hours = hours;
+		this.maxHours = maxHours;
+		this.floorKnown = floorKnown;
+	}
+};
+/**
+* Clamp `[fromMs, toMs)` to the hours that can hold footage and refuse it when
+* it is still wider than `maxHours`. `null` = nothing left to walk.
+*
+* The writer's current hour and the one it just left are never clamped away:
+* the ledger is write-behind, so a camera's first segments may be on disk (and
+* in the RAM index) a moment before the ledger holds their hour.
+*/
+function calendarWalk(deviceId, fromMs, toMs, nowMs, floor, maxHours = CALENDAR_MAX_WALK_HOURS) {
+	const currentHour = Math.floor(nowMs / HOUR_MS$7) * HOUR_MS$7;
+	const liveFloor = currentHour - HOUR_MS$7;
+	const floorHour = floor.known ? Math.min(floor.oldestHourMs, liveFloor) : Number.NEGATIVE_INFINITY;
+	const firstHourMs = Math.max(Math.floor(fromMs / HOUR_MS$7) * HOUR_MS$7, floorHour);
+	const endMs = Math.min(toMs, currentHour + HOUR_MS$7);
+	if (endMs <= firstHourMs || toMs <= fromMs) return null;
+	const hours = Math.ceil((endMs - firstHourMs) / HOUR_MS$7);
+	if (hours > maxHours) throw new CalendarWindowRefusedError(deviceId, hours, maxHours, floor.known);
+	return {
+		firstHourMs,
+		endMs,
+		hours
+	};
+}
+/** Per-camera archive floors, one ledger fold per {@link ARCHIVE_FLOOR_TTL_MS}. */
+var ArchiveFloorReader = class {
+	source;
+	now;
+	folded = null;
+	constructor(source, now = () => Date.now()) {
+		this.source = source;
+		this.now = now;
+	}
+	floorOf(deviceId) {
+		const ledger = this.source();
+		if (ledger === null) return UNKNOWN_ARCHIVE_FLOOR;
+		if (!ledger.isComplete()) {
+			ledger.retryLoadIfUnanswered();
+			return UNKNOWN_ARCHIVE_FLOOR;
+		}
+		const nowMs = this.now();
+		if (this.folded === null || nowMs - this.folded.atMs >= 6e4) this.folded = {
+			atMs: nowMs,
+			floors: ledger.oldestHourByDevice()
+		};
+		const oldestHourMs = this.folded.floors.get(deviceId);
+		return oldestHourMs === void 0 ? UNKNOWN_ARCHIVE_FLOOR : {
+			known: true,
+			oldestHourMs
+		};
+	}
+};
+//#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
 var HOUR_MS$6 = 36e5;
@@ -4172,7 +4397,9 @@ function hourSegmentsFromIndex(index, deviceId, profile, hourStartMs) {
 *
 * Segments land every 8–12 s, so three seconds of staleness at the live edge
 * cannot hide a whole one — and the live view owns "now" regardless. Past hours
-* stay cached indefinitely; only this one expires.
+* stay cached until eviction or the rung's bound (D674) drops them; only this
+* one expires — and it is read once more after it closes, so its last minutes
+* are never served from a stamp taken while it was still being written.
 */
 var CURRENT_HOUR_TTL_MS = 3e3;
 /**
@@ -4214,17 +4441,20 @@ async function mapBounded(items, limit, fn) {
 	await Promise.all(workers);
 	return out;
 }
+/** Estimated bytes per cached UTC day on the day rung (map slot + a short
+*  array of hour numbers). */
+var DAY_RUNG_APPROX_BYTES = 96;
 var CalendarIndex = class {
 	deps;
 	/** `deviceId` → (UTC day ms → hours). Absent = never scanned. */
 	byDevice = /* @__PURE__ */ new Map();
 	/** Scans in flight, so a burst of queries costs one walk. */
 	inFlight = /* @__PURE__ */ new Map();
-	/** `deviceId:profile:hourMs` → that hour's segments. The exact rung. */
-	hourSegs = /* @__PURE__ */ new Map();
+	/** The exact rung: device → profile → hour → segments, bounded (D674). */
+	hours;
+	/** Hour scans in flight, keyed like the rung — so a burst costs one read. */
 	segsInFlight = /* @__PURE__ */ new Map();
-	/** When each CURRENT-hour entry was read, for {@link CURRENT_HOUR_TTL_MS}. */
-	segsReadAt = /* @__PURE__ */ new Map();
+	segsInFlightCount = 0;
 	/** The profile availability reads from, resolved once per device. */
 	profileFor = /* @__PURE__ */ new Map();
 	profilesFor = /* @__PURE__ */ new Map();
@@ -4239,25 +4469,36 @@ var CalendarIndex = class {
 	profileInFlight = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
+		this.hours = new CalendarHourCache(deps.hourBudget ?? DEFAULT_CALENDAR_HOUR_BUDGET);
 	}
 	/**
-	* Entry counts for the recorder census. `hourSegs` is unbounded (it is
-	* invalidated on eviction and relocation, never aged), so its segment total
-	* is the number that says whether this cache is where the heap went.
+	* Entry counts and an estimated byte total for the recorder census. The
+	* exact rung is bounded (D674); `evictedHours` says whether the bound bites.
 	*/
 	memoryCensus() {
 		let days = 0;
 		for (const perDay of this.byDevice.values()) days += perDay.size;
-		let hourSegments = 0;
-		for (const segments of this.hourSegs.values()) hourSegments += segments.length;
+		const hours = this.hours.census();
 		return {
 			devices: this.byDevice.size,
 			days,
-			hourKeys: this.hourSegs.size,
-			hourSegments,
-			inFlight: this.inFlight.size + this.segsInFlight.size
+			...hours,
+			approxBytes: hours.approxBytes + days * DAY_RUNG_APPROX_BYTES,
+			inFlight: this.inFlight.size + this.segsInFlightCount
 		};
 	}
+	nowMs() {
+		return this.deps.now?.() ?? Date.now();
+	}
+	/**
+	* The hours a walk over `[fromMs, toMs)` may visit — clamped to the archive
+	* floor and the live edge, REFUSED above the cap (see `calendar-window.ts`).
+	* Throws {@link CalendarWindowRefusedError}; the provider turns that into
+	* `read: 'unreadable'` and logs it.
+	*/
+	walkOf(deviceId, fromMs, toMs) {
+		return calendarWalk(deviceId, fromMs, toMs, this.nowMs(), this.deps.archiveFloor?.(deviceId) ?? UNKNOWN_ARCHIVE_FLOOR, this.deps.maxWalkHours ?? 8784);
+	}
 	mapFor(deviceId) {
 		let m = this.byDevice.get(deviceId);
 		if (!m) {
@@ -4318,8 +4559,10 @@ var CalendarIndex = class {
 	* UTC day outside the range (23:30Z on the 28th is the 29th in CEST).
 	*/
 	async localDays(deviceId, fromMs, toMs, tzOffsetMinutes) {
-		const first = utcDayOf(fromMs) - DAY_MS$3;
-		const last = utcDayOf(toMs) + DAY_MS$3;
+		const walk = this.walkOf(deviceId, utcDayOf(fromMs) - DAY_MS$3, utcDayOf(toMs) + 2 * DAY_MS$3);
+		if (walk === null) return [];
+		const first = utcDayOf(walk.firstHourMs);
+		const last = utcDayOf(walk.endMs - 1);
 		const wanted = [];
 		for (let day = first; day <= last; day += DAY_MS$3) wanted.push(day);
 		const perDay = await mapBounded(wanted, READ_CONCURRENCY, async (day) => ({
@@ -4344,16 +4587,12 @@ var CalendarIndex = class {
 	*  rebuild lazily on the next question. */
 	invalidateAll() {
 		this.byDevice.clear();
-		this.hourSegs.clear();
+		this.hours.clear();
 	}
 	invalidate(deviceId, atMs) {
 		const day = utcDayOf(atMs);
 		this.byDevice.get(deviceId)?.delete(day);
-		const prefix = `${deviceId}:`;
-		for (const key of this.hourSegs.keys()) {
-			if (!key.startsWith(prefix)) continue;
-			if (utcDayOf(Number(key.slice(key.lastIndexOf(":") + 1))) === day) this.hourSegs.delete(key);
-		}
+		this.hours.invalidateDay(deviceId, day);
 	}
 	/**
 	* Scan a span in the background so the first screen is already answered.
@@ -4411,28 +4650,28 @@ var CalendarIndex = class {
 	* retries instead of caching a gap.
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
-		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
+		if (!background) this.lastForegroundAt = this.nowMs();
 		const hour = Math.floor(hourStartMs / HOUR_MS$6) * HOUR_MS$6;
 		const fromIndex = this.deps.indexHour?.(deviceId, profile, hour);
 		if (fromIndex !== null && fromIndex !== void 0) return {
 			segments: fromIndex,
 			complete: true
 		};
-		const key = `${deviceId}:${profile}:${hour}`;
-		const now = this.deps.now?.() ?? Date.now();
+		const now = this.nowMs();
 		const isCurrentHour = hour === Math.floor(now / HOUR_MS$6) * HOUR_MS$6;
-		const cached = this.hourSegs.get(key);
+		const cached = this.hours.get(deviceId, profile, hour);
 		if (cached !== void 0) {
-			if (!isCurrentHour) return {
+			const readAt = this.hours.readAtOf(deviceId, profile, hour);
+			if (!isCurrentHour && readAt === void 0) return {
 				segments: cached,
 				complete: true
 			};
-			if (now - (this.segsReadAt.get(key) ?? 0) < CURRENT_HOUR_TTL_MS) return {
+			if (isCurrentHour && now - (readAt ?? 0) < CURRENT_HOUR_TTL_MS) return {
 				segments: cached,
 				complete: true
 			};
 		}
-		const running = this.segsInFlight.get(key);
+		const running = this.inFlightScan(deviceId, profile, hour);
 		if (running) return running;
 		const scan = (async () => {
 			const read = this.deps.scanSegments ?? segmentsOfHour;
@@ -4456,21 +4695,46 @@ var CalendarIndex = class {
 				complete
 			};
 		})();
-		this.segsInFlight.set(key, scan);
+		this.trackScan(deviceId, profile, hour, scan);
 		try {
 			const { segments, complete } = await scan;
-			if (complete) {
-				this.hourSegs.set(key, segments);
-				this.segsReadAt.set(key, this.deps.now?.() ?? Date.now());
-			}
+			const storedAt = this.nowMs();
+			const liveHour = Math.floor(storedAt / HOUR_MS$6) * HOUR_MS$6;
+			if (complete && hour <= liveHour) this.hours.set(deviceId, profile, hour, segments, hour === liveHour ? storedAt : null);
 			return {
 				segments,
 				complete
 			};
 		} finally {
-			if (this.segsInFlight.get(key) === scan) this.segsInFlight.delete(key);
+			this.untrackScan(deviceId, profile, hour, scan);
 		}
 	}
+	inFlightScan(deviceId, profile, hour) {
+		return this.segsInFlight.get(deviceId)?.get(profile)?.get(hour) ?? null;
+	}
+	trackScan(deviceId, profile, hour, scan) {
+		let profiles = this.segsInFlight.get(deviceId);
+		if (profiles === void 0) {
+			profiles = /* @__PURE__ */ new Map();
+			this.segsInFlight.set(deviceId, profiles);
+		}
+		let hours = profiles.get(profile);
+		if (hours === void 0) {
+			hours = /* @__PURE__ */ new Map();
+			profiles.set(profile, hours);
+		}
+		hours.set(hour, scan);
+		this.segsInFlightCount += 1;
+	}
+	untrackScan(deviceId, profile, hour, scan) {
+		const profiles = this.segsInFlight.get(deviceId);
+		const hours = profiles?.get(profile);
+		if (profiles === void 0 || hours === void 0 || hours.get(hour) !== scan) return;
+		hours.delete(hour);
+		this.segsInFlightCount -= 1;
+		if (hours.size === 0) profiles.delete(profile);
+		if (profiles.size === 0) this.segsInFlight.delete(deviceId);
+	}
 	/**
 	* Exact availability ranges for a UTC day — what the progressive timeline
 	* draws.
@@ -4498,9 +4762,10 @@ var CalendarIndex = class {
 	*/
 	async rangesIn(deviceId, profile, fromMs, toMs) {
 		if (toMs <= fromMs) return [];
-		const first = Math.floor(fromMs / HOUR_MS$6) * HOUR_MS$6;
+		const walk = this.walkOf(deviceId, fromMs, toMs);
+		if (walk === null) return [];
 		const hours = [];
-		for (let hour = first; hour < toMs; hour += HOUR_MS$6) hours.push(hour);
+		for (let hour = walk.firstHourMs; hour < walk.endMs; hour += HOUR_MS$6) hours.push(hour);
 		const perHour = await mapBounded(hours, READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour));
 		const ranges = [];
 		for (const r of mergeRanges(perHour.flat(), RANGE_MERGE_GAP_MS$1)) {
@@ -4606,6 +4871,115 @@ var CalendarIndex = class {
 	}
 };
 //#endregion
+//#region src/recorder/addon/device-storage-usage.ts
+/**
+* Gap between the per-camera sum and the per-volume total that is worth
+* saying out loud, as a share of the volume total.
+*
+* The two are aggregations of the SAME hour rows over the same location set —
+* one folded per camera, one summed in SQL — so in a healthy recorder they
+* agree to the byte. A few tenths of a percent is a write landing between the
+* two reads; 97% (60.5 GB against 1.9 TB) is the defect this file closes,
+* rebuilt somewhere new.
+*/
+var USAGE_MISMATCH_SHARE = .02;
+/** Floor under {@link USAGE_MISMATCH_SHARE} so a nearly empty disk does not
+*  warn on a single in-flight segment. */
+var USAGE_MISMATCH_FLOOR_BYTES = 1e9;
+/**
+* One row per camera the ARCHIVE holds footage for on `locationIds`, biggest
+* first (deviceId breaks a tie, so two consecutive calls compare).
+*
+* A node with no ledger REFUSES (D295 rule 3): empty rows, `read:
+* 'unavailable'`, and a line saying so. Falling back to the index would answer
+* the same question with the wrong quantity and look exactly like a correct
+* answer, which is how this shipped in the first place.
+*/
+function buildDeviceUsage(input) {
+	if (input.archive === null) {
+		input.logger.warn("recorder: the hour ledger is absent or not loaded on this node — the per-camera storage rows are UNANSWERED, not empty", { meta: { locations: [...input.locationIds].toSorted().join(",") } });
+		return {
+			devices: [],
+			totalUsedBytes: 0,
+			read: "unavailable"
+		};
+	}
+	const devices = [];
+	let totalUsedBytes = 0;
+	for (const [deviceId, archived] of input.archive) {
+		const resident = input.resident(deviceId);
+		totalUsedBytes += archived.bytes;
+		devices.push({
+			deviceId,
+			usedBytes: archived.bytes,
+			oldestMs: archived.oldestMs,
+			segments: archived.segments,
+			residentBytes: resident.bytes,
+			residentOldestMs: resident.oldestMs
+		});
+	}
+	return {
+		devices: devices.toSorted((a, b) => b.usedBytes - a.usedBytes || a.deviceId - b.deviceId),
+		totalUsedBytes,
+		read: "archive"
+	};
+}
+/**
+* Say it when the per-camera sum and the per-volume total disagree.
+*
+* The "I saw N of M" rule of D295, applied to a REPORT: these two numbers are
+* the same rows counted two ways, so a gap means one of the two reads saw a
+* fraction of the archive — and the whole point of D418 is that a page which
+* shows both without comparing them lets a 97% gap read as a fact about the
+* disks.
+*/
+function warnOnUsageMismatch(logger, deviceBytes, volumeBytes, read) {
+	if (read !== "archive") return;
+	if (volumeBytes === 0) return;
+	const gap = Math.abs(volumeBytes - deviceBytes);
+	if (gap <= USAGE_MISMATCH_FLOOR_BYTES) return;
+	if (gap <= volumeBytes * USAGE_MISMATCH_SHARE) return;
+	logger.warn("recorder: the per-camera storage sum disagrees with the per-volume total — one of the two reads saw a fraction of the archive", { meta: {
+		deviceBytes,
+		volumeBytes,
+		gap
+	} });
+}
+/**
+* The per-camera archive rows, or `null` — a REFUSAL — when they would not be
+* the archive (D674, review C1).
+*
+* The recorder registers its providers before `onHubReachable` loads the
+* ledger, and a failed load used to last the runner's life. In both windows the
+* mirror holds only the rows written since boot, and `usageByDevice` folded
+* them into a confident `devicesRead: 'archive'` answer — which the retention
+* floor reads, so every follow-recordings camera was swept on a floor that was
+* too young. Now:
+*
+*  - no ledger, or a load that has not answered (including mid-load) ⇒ `null`,
+*    and an unanswered load is retried (bounded, never awaited);
+*  - no resolved location yet ⇒ `null`: an empty id set folds to "no camera
+*    has footage", which is not what an unresolved location means.
+*/
+function archiveDeviceUsageOf(ledger, locationIds) {
+	if (ledger === null) return null;
+	if (!ledger.hasLoaded()) {
+		ledger.retryLoadIfUnanswered();
+		return null;
+	}
+	if (locationIds.size === 0) return null;
+	return ledger.usageByDevice(locationIds);
+}
+/**
+* Is an `archive` answer WHOLE — may a camera ABSENT from it be read as "no
+* footage"? Only when the ledger loaded without hitting its row cap and at
+* least one location resolved. The storage-usage response carries this as
+* `complete` (D674, review M2).
+*/
+function archiveUsageComplete(ledger, locationIds) {
+	return ledger !== null && ledger.isComplete() && locationIds.size > 0;
+}
+//#endregion
 //#region src/recorder/addon/config-store.ts
 /**
 * Per-device recording-config persistence for the recorder addon.
@@ -7891,81 +8265,6 @@ function buildRecordingDeviceSchema() {
 		}]
 	}] };
 }
-//#endregion
-//#region src/recorder/addon/device-storage-usage.ts
-/**
-* Gap between the per-camera sum and the per-volume total that is worth
-* saying out loud, as a share of the volume total.
-*
-* The two are aggregations of the SAME hour rows over the same location set —
-* one folded per camera, one summed in SQL — so in a healthy recorder they
-* agree to the byte. A few tenths of a percent is a write landing between the
-* two reads; 97% (60.5 GB against 1.9 TB) is the defect this file closes,
-* rebuilt somewhere new.
-*/
-var USAGE_MISMATCH_SHARE = .02;
-/** Floor under {@link USAGE_MISMATCH_SHARE} so a nearly empty disk does not
-*  warn on a single in-flight segment. */
-var USAGE_MISMATCH_FLOOR_BYTES = 1e9;
-/**
-* One row per camera the ARCHIVE holds footage for on `locationIds`, biggest
-* first (deviceId breaks a tie, so two consecutive calls compare).
-*
-* A node with no ledger REFUSES (D295 rule 3): empty rows, `read:
-* 'unavailable'`, and a line saying so. Falling back to the index would answer
-* the same question with the wrong quantity and look exactly like a correct
-* answer, which is how this shipped in the first place.
-*/
-function buildDeviceUsage(input) {
-	if (input.archive === null) {
-		input.logger.warn("recorder: no hour ledger on this node — the per-camera storage rows are UNANSWERED, not empty", { meta: { locations: [...input.locationIds].toSorted().join(",") } });
-		return {
-			devices: [],
-			totalUsedBytes: 0,
-			read: "unavailable"
-		};
-	}
-	const devices = [];
-	let totalUsedBytes = 0;
-	for (const [deviceId, archived] of input.archive) {
-		const resident = input.resident(deviceId);
-		totalUsedBytes += archived.bytes;
-		devices.push({
-			deviceId,
-			usedBytes: archived.bytes,
-			oldestMs: archived.oldestMs,
-			segments: archived.segments,
-			residentBytes: resident.bytes,
-			residentOldestMs: resident.oldestMs
-		});
-	}
-	return {
-		devices: devices.toSorted((a, b) => b.usedBytes - a.usedBytes || a.deviceId - b.deviceId),
-		totalUsedBytes,
-		read: "archive"
-	};
-}
-/**
-* Say it when the per-camera sum and the per-volume total disagree.
-*
-* The "I saw N of M" rule of D295, applied to a REPORT: these two numbers are
-* the same rows counted two ways, so a gap means one of the two reads saw a
-* fraction of the archive — and the whole point of D418 is that a page which
-* shows both without comparing them lets a 97% gap read as a fact about the
-* disks.
-*/
-function warnOnUsageMismatch(logger, deviceBytes, volumeBytes, read) {
-	if (read !== "archive") return;
-	if (volumeBytes === 0) return;
-	const gap = Math.abs(volumeBytes - deviceBytes);
-	if (gap <= USAGE_MISMATCH_FLOOR_BYTES) return;
-	if (gap <= volumeBytes * USAGE_MISMATCH_SHARE) return;
-	logger.warn("recorder: the per-camera storage sum disagrees with the per-volume total — one of the two reads saw a fraction of the archive", { meta: {
-		deviceBytes,
-		volumeBytes,
-		gap
-	} });
-}
 /** The placement-store key for one (camera, profile). Mirrors `assignmentKey`
 *  in `placement-store.ts`; kept local so this module stays dependency-free. */
 function sourceKey(source) {
@@ -8598,6 +8897,7 @@ function buildRecordingProvider(deps) {
 				totalUsedBytes,
 				devices: [...devices],
 				devicesRead: deviceUsage.read,
+				complete: deviceUsage.read === "archive" && (deps.archiveUsageComplete?.(locationIds) ?? false),
 				locations: locationUsages
 			};
 		},
@@ -9822,6 +10122,10 @@ var CENSUS_FIELDS = [
 ];
 /** Summary rows folded into the mirror between yields. */
 var LOAD_CHUNK = 5e3;
+/** Minimum spacing between ledger load attempts after a failure (D674). */
+var LEDGER_LOAD_RETRY_MS = 6e4;
+/** Spacing of the retries after the fast ones — slower, never stopped. */
+var LEDGER_LOAD_SLOW_RETRY_MS = 10 * 6e4;
 /** The four scalars an accounting answer is made of, asked in one statement. */
 var ACCOUNTING_FIELDS = [
 	{
@@ -10017,6 +10321,22 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* the recorder happens to be placing that hour on.
 	*/
 	refusedWriterHours = /* @__PURE__ */ new Set();
+	/**
+	* Has a {@link load} ANSWERED — its query returned AND every row it returned
+	* is staged? Before that the mirror is "not read yet" (or, mid-load, a
+	* fraction), never "the archive is empty". `load` swallows its failure, so a
+	* reader that must tell the two apart (the calendar's window floor, the
+	* storage-usage rows a retention floor is read from — D674) asks here.
+	*/
+	loaded = false;
+	/** The last successful load returned {@link rowCap} rows: hours past the cap
+	*  are UNKNOWN, so the mirror is an answer but not a WHOLE one. */
+	loadHitRowCap = false;
+	/** Load attempts made, boot included — the retry is bounded (D674). */
+	loadAttempts = 0;
+	lastLoadAttemptMs = null;
+	loadInFlight = null;
+	loadRetriesExhaustedReported = false;
 	/** Entry counts of the in-process maps, for the recorder census. */
 	memoryCensus() {
 		let accountedPaths = 0;
@@ -10065,17 +10385,70 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* seed the index (D523).
 	*/
 	async load() {
+		this.loadInFlight ??= this.loadOnce().finally(() => {
+			this.loadInFlight = null;
+		});
+		return this.loadInFlight;
+	}
+	/**
+	* Retry a load that has not answered — rate-limited, logged, never abandoned
+	* (D674).
+	*
+	* A failed boot load used to last the runner's life: every reader then saw
+	* only the rows written since boot, and `getStorageUsage` labelled them the
+	* archive. Readers call this and never wait on it (it is fire-and-forget at
+	* every call site); at most one attempt per {@link LEDGER_LOAD_RETRY_MS} for
+	* the first {@link LEDGER_LOAD_MAX_ATTEMPTS}, then one per
+	* {@link LEDGER_LOAD_SLOW_RETRY_MS}; the slowdown is said once.
+	*/
+	retryLoadIfUnanswered() {
+		if (this.loaded || this.loadInFlight !== null) return;
+		const slow = this.loadAttempts >= 10;
+		if (slow && !this.loadRetriesExhaustedReported) {
+			this.loadRetriesExhaustedReported = true;
+			this.logger.warn("recorder: segment-hour ledger still not loaded — retrying at the slow interval; archive-wide answers stay REFUSED until it loads", { meta: {
+				attempts: this.loadAttempts,
+				slowRetryMs: LEDGER_LOAD_SLOW_RETRY_MS
+			} });
+		}
+		const spacing = slow ? LEDGER_LOAD_SLOW_RETRY_MS : LEDGER_LOAD_RETRY_MS;
+		const now = this.now();
+		if (this.lastLoadAttemptMs !== null && now - this.lastLoadAttemptMs < spacing) return;
+		if (!slow) this.logger.info("recorder: retrying the segment-hour ledger load", { meta: {
+			attempt: this.loadAttempts + 1,
+			fastAttempts: 10
+		} });
+		this.load();
+	}
+	/**
+	* Is the mirror a WHOLE answer about the archive: loaded, and not cut at the
+	* row cap? The storage-usage rows and the calendar floor are only facts about
+	* the archive when this is true.
+	*/
+	isComplete() {
+		return this.loaded && !this.loadHitRowCap;
+	}
+	async loadOnce() {
 		const startedMs = this.now();
+		this.loadAttempts += 1;
+		this.lastLoadAttemptMs = startedMs;
 		let records;
 		try {
 			records = await this.store.query.query({
 				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				filter: { limit: this.rowCap }
+				filter: {
+					limit: this.rowCap,
+					orderBy: {
+						field: "hourStartMs",
+						direction: "desc"
+					}
+				}
 			});
 		} catch (err) {
 			this.logger.warn("recorder: segment-hour ledger load failed — keeping the hours already held", { meta: {
 				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
 				held: this.ledger.size,
+				attempt: this.loadAttempts,
 				error: String(err)
 			} });
 			return this.ledger.snapshot();
@@ -10091,10 +10464,12 @@ var SegmentHourLedger = class SegmentHourLedger {
 					skipped += 1;
 					continue;
 				}
-				this.ledger.stage(row);
+				if (!this.ledger.has(row.key)) this.ledger.stage(row);
 			}
 			if (end < records.length) await this.yieldBetween();
 		}
+		this.loaded = true;
+		this.loadHitRowCap = records.length >= this.rowCap;
 		if (skipped > 0) this.logger.warn("recorder: segment-hour rows skipped as malformed — they gate NOTHING", { meta: {
 			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
 			skipped
@@ -10116,6 +10491,31 @@ var SegmentHourLedger = class SegmentHourLedger {
 	snapshot() {
 		return this.ledger.snapshot();
 	}
+	/** Whether a {@link load} has answered and staged every row it returned —
+	*  see {@link loaded}. {@link isComplete} is the stronger question. */
+	hasLoaded() {
+		return this.loaded;
+	}
+	/**
+	* The OLDEST hour the archive holds per camera, across every profile and
+	* every location — the floor below which no hour can hold footage (D674).
+	*
+	* Every row counts, including one whose segments were all dropped and that
+	* the prune has not yet forgotten: an older floor only walks a few more
+	* hours, while a floor that is too YOUNG hides footage. One fold, no I/O —
+	* the same shape as {@link devicesWithFootage}. Meaningful only after
+	* {@link isComplete}; even then a camera ABSENT from the map is unknown to
+	* the calendar (an hour not adopted yet is on disk and absent here), never a
+	* known "no footage" (D674).
+	*/
+	oldestHourByDevice() {
+		const out = /* @__PURE__ */ new Map();
+		for (const row of this.ledger.snapshot()) {
+			const held = out.get(row.deviceId);
+			if (held === void 0 || row.hourStartMs < held) out.set(row.deviceId, row.hourStartMs);
+		}
+		return out;
+	}
 	/**
 	* Which profiles each of these cameras has footage for IN THE ARCHIVE.
 	*
@@ -20501,12 +20901,17 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	/** LAZY: a field initialiser runs before `initialize()` assigns `ctx`, and
 	*  reading `this.ctx` there throws — the same trap that bit the playback tier. */
 	get calendar() {
-		this.calendarInstance ??= new CalendarIndex({
+		this.calendarInstance ??= this.buildCalendar();
+		return this.calendarInstance;
+	}
+	buildCalendar() {
+		const floors = new ArchiveFloorReader(() => this.segmentHours);
+		return new CalendarIndex({
 			roots: () => this.resolvedLocations.map((l) => l.root),
 			logger: this.ctx.logger,
-			indexHour: (deviceId, profile, hourStartMs) => hourSegmentsFromIndex(this.index, deviceId, profile, hourStartMs)
+			indexHour: (deviceId, profile, hourStartMs) => hourSegmentsFromIndex(this.index, deviceId, profile, hourStartMs),
+			archiveFloor: (deviceId) => floors.floorOf(deviceId)
 		});
-		return this.calendarInstance;
 	}
 	segmentStore = null;
 	/** Sync-sample tables captured at finalize, served by the directory so a
@@ -20971,7 +21376,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
-			archiveDeviceUsage: (locationIds) => this.segmentHours?.usageByDevice(locationIds) ?? null,
+			archiveDeviceUsage: (locationIds) => archiveDeviceUsageOf(this.segmentHours, locationIds),
+			archiveUsageComplete: (locationIds) => archiveUsageComplete(this.segmentHours, locationIds),
 			archive: () => this.segmentHours,
 			ledgerWalk: this.ledgerWalkReconciler(),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),