@camstack/addon-pipeline 1.2.307 → 1.2.309

package/dist/{process-memory-Bz3oIMzl.mjs → process-memory-BvwauBlX.mjs}

@@ -1,4 +1,4 @@
-import { kt as parseProcStatus } from "./dist-DdVMFlJ6.mjs";
+import { At as parseProcStatus } from "./dist-B3_sbBDM.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-TQXG7qrJ.js → process-memory-DGTVVYlX.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-emK7D4bc.js");
-const require_dist = require("./dist-CyJWk-_f.js");
+const require_dist = require("./dist-BLf0YjAa.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/recorder/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-CyJWk-_f.js");
-const require_node = require("../node-HsWG5fGp.js");
+const require_dist = require("../dist-BLf0YjAa.js");
+const require_node = require("../node-Vwf2PuIT.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
@@ -3450,7 +3450,20 @@ var StillFrameService = class {
 			return null;
 		}
 		try {
-			const jpeg = await this.decodeFrame(abs, source.offsetSec);
+			let bin;
+			try {
+				bin = await this.deps.resolveFfmpeg();
+			} catch (err) {
+				this.deps.logger.error("still: refused — no pinned ffmpeg on this node (D540)", {
+					tags: { deviceId },
+					meta: {
+						epochMs,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+				return null;
+			}
+			const jpeg = await this.decodeFrame(bin, abs, source.offsetSec);
 			if (jpeg === null || jpeg.byteLength === 0) return null;
 			return {
 				jpeg,
@@ -3461,7 +3474,7 @@ var StillFrameService = class {
 		}
 	}
 	/** Run ONE ffmpeg input-seek + single-frame decode; JPEG bytes on stdout. */
-	decodeFrame(absPath, offsetSec) {
+	decodeFrame(bin, absPath, offsetSec) {
 		const args = [
 			"-hide_banner",
 			"-loglevel",
@@ -3477,7 +3490,6 @@ var StillFrameService = class {
 			"pipe:1"
 		];
 		const spawn = this.deps.spawn ?? node_child_process.spawn;
-		const bin = this.deps.ffmpegPath ?? "ffmpeg";
 		return new Promise((resolve) => {
 			let child;
 			try {
@@ -7549,15 +7561,32 @@ var ExportEngine = class {
 			} catch {}
 		}
 	}
-	runFfmpeg(id, deviceId, args, progress) {
+	async runFfmpeg(id, deviceId, args, progress) {
+		let ffmpegPath;
+		try {
+			ffmpegPath = await this.deps.resolveFfmpeg();
+		} catch (err) {
+			const reason = `no pinned ffmpeg on this node (D540): ${err instanceof Error ? err.message : String(err)}`;
+			this.deps.logger.error("export render refused — no pinned ffmpeg on this node (D540)", {
+				tags: { deviceId },
+				meta: {
+					exportId: id,
+					error: reason
+				}
+			});
+			return {
+				code: null,
+				stderrTail: [reason]
+			};
+		}
 		this.deps.logger.debug("export ffmpeg argv", { meta: {
 			exportId: id,
 			args
 		} });
 		const stallMs = this.deps.stallMs ?? 9e4;
 		const faststartStallMs = this.deps.faststartStallMs ?? 9e5;
-		return new Promise((resolve) => {
-			const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
+		return await new Promise((resolve) => {
+			const proc = this.deps.spawn(ffmpegPath, args);
 			this.active.set(id, proc);
 			const stderrTail = [];
 			let stallTimer = null;
@@ -9459,6 +9488,17 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 	const toMs = input.aroundMs + input.postRollSec * 1e3;
 	if (!Number.isFinite(fromMs) || !Number.isFinite(toMs) || toMs <= fromMs) throw new Error(`invalid ${ext} window [${fromMs}, ${toMs}) for device ${input.deviceId} — aroundMs=${input.aroundMs} preRollSec=${input.preRollSec} postRollSec=${input.postRollSec}`);
 	const renderId = `${ext}-${now()}-${Math.floor(Math.random() * 1e6)}`;
+	let ffmpegPath;
+	try {
+		ffmpegPath = await renderDeps.resolveFfmpeg();
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		renderDeps.deps.logger.error(`${ext} render refused — no pinned ffmpeg on this node (D540)`, {
+			tags: { deviceId: input.deviceId },
+			meta: { error: reason }
+		});
+		throw new Error(`${ext} render refused for device ${input.deviceId}: no pinned ffmpeg — ${reason}`, { cause: err });
+	}
 	const availableEnd = latestFinalizedEnd(renderDeps, input.deviceId);
 	if (availableEnd === null || availableEnd < toMs) throw new Error(`${FOOTAGE_NOT_READY}: [${fromMs}, ${toMs}) for device ${input.deviceId} — finalized footage ends at ${availableEnd ?? "never"}`);
 	const window = {
@@ -9477,7 +9517,7 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 	if (playlist === null) throw new Error(`no footage covers [${window.fromMs}, ${window.toMs}) for device ${input.deviceId}`);
 	const outPath = node_path.default.join(node_path.default.dirname(playlist.path), `${renderId}.${ext}`);
 	try {
-		await runFfmpeg(renderDeps, buildArgs(playlist.path, outPath), ext);
+		await runFfmpeg(renderDeps, ffmpegPath, buildArgs(playlist.path, outPath), ext);
 		const bytes = await node_fs.promises.readFile(outPath);
 		if (bytes.byteLength === 0) throw new Error(`${ext} render produced an empty file`);
 		return {
@@ -9514,9 +9554,9 @@ function latestFinalizedEnd(renderDeps, deviceId) {
 * throws ESRCH, which is swallowed, so the cost of being wrong is nothing while
 * the cost of NOT killing is a zombie per render.
 */
-function runFfmpeg(renderDeps, args, ext) {
+function runFfmpeg(renderDeps, ffmpegPath, args, ext) {
 	return new Promise((resolve, reject) => {
-		const proc = renderDeps.spawn(renderDeps.ffmpegPath ?? "ffmpeg", args);
+		const proc = renderDeps.spawn(ffmpegPath, args);
 		let done = false;
 		let timer = null;
 		const settle = (err) => {
@@ -15658,6 +15698,26 @@ function buildPassthroughArgs(a) {
 	];
 }
 //#endregion
+//#region src/recorder/addon/dial-refusal.ts
+var METHOD_FAILED = /\bmethod ([A-Z_]+) failed: (\d{3})\b/;
+function isHandshakeMethod(method) {
+	return method === "OPTIONS" || method === "DESCRIBE" || method === "SETUP" || method === "PLAY";
+}
+/** The refusal named in this generation's stderr tail, or `null` when there is none. */
+function readDialRefusal(stderrTail) {
+	for (let i = stderrTail.length - 1; i >= 0; i--) {
+		const match = METHOD_FAILED.exec(stderrTail[i] ?? "");
+		if (match === null) continue;
+		const method = match[1] ?? "";
+		if (!isHandshakeMethod(method)) return null;
+		return {
+			method,
+			status: Number(match[2])
+		};
+	}
+	return null;
+}
+//#endregion
 //#region src/recorder/addon/segment-writer.ts
 /** Max CONSECUTIVE rapid restarts before giving up (reset by a stable run). */
 var MAX_RESTARTS = 10;
@@ -15716,6 +15776,12 @@ var SegmentWriter = class {
 	* half-pruned window.
 	*/
 	restartWindow = [];
+	/**
+	* Consecutive generations the source refused at the handshake (D685). Reset
+	* by any generation that was not refused. Only read for the log line — the
+	* rapid breaker is what bounds a source that never comes back.
+	*/
+	refusedInARow = 0;
 	restartTimer = null;
 	startedAt = 0;
 	exitWait = null;
@@ -15748,7 +15814,7 @@ var SegmentWriter = class {
 	start() {
 		if (this.stopped || this.proc) return;
 		const args = buildPassthroughArgs(this.cfg);
-		const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
+		const proc = this.deps.spawn(this.deps.ffmpegPath, args);
 		this.proc = proc;
 		this.exitWait = new Promise((resolve) => {
 			this.resolveExit = resolve;
@@ -15805,10 +15871,13 @@ var SegmentWriter = class {
 		if (this.stopped) return;
 		const now = Date.now();
 		const ranMs = now - this.startedAt;
-		if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
-		this.restartWindow = [...this.restartWindow.filter((at) => at > now - RESTART_WINDOW_MS), now];
+		const refusal = termination.reason === "exit" ? readDialRefusal(stderrTail) : null;
+		this.refusedInARow = refusal === null ? 0 : this.refusedInARow + 1;
+		if (ranMs >= STABLE_RUN_MS && refusal === null) this.restarts = 0;
+		const liveWindow = this.restartWindow.filter((at) => at > now - RESTART_WINDOW_MS);
+		this.restartWindow = refusal === null ? [...liveWindow, now] : liveWindow;
 		const restartsInWindow = this.restartWindow.length;
-		if (termination.reason === "exit") this.deps.logger.warn("SegmentWriter ffmpeg exited", {
+		if (termination.reason === "exit" && refusal === null) this.deps.logger.warn("SegmentWriter ffmpeg exited", {
 			tags: { deviceId: this.deps.deviceId },
 			meta: {
 				outDir: this.cfg.outDir,
@@ -15880,6 +15949,39 @@ var SegmentWriter = class {
 		}
 		this.restarts++;
 		const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
+		if (refusal !== null) this.logDeferredRedial(refusal, delayMs, ranMs, restartsInWindow);
+		else this.logRestarting(termination, delayMs, ranMs, restartsInWindow);
+		this.restartTimer = setTimeout(() => {
+			this.restartTimer = null;
+			this.start();
+		}, delayMs);
+	}
+	/**
+	* A refused dial, named — every one of them, per camera. The FIRST of a run
+	* is a WARN (the source just went away under a live writer); the rest are
+	* the same outage continuing and go out at INFO with the running count.
+	*/
+	logDeferredRedial(refusal, delayMs, ranMs, restartsInWindow) {
+		const payload = {
+			tags: { deviceId: this.deps.deviceId },
+			meta: {
+				outDir: this.cfg.outDir,
+				method: refusal.method,
+				status: refusal.status,
+				refusedInARow: this.refusedInARow,
+				attempt: this.restarts,
+				delayMs,
+				ranMs,
+				restartsInWindow
+			}
+		};
+		if (this.refusedInARow === 1) {
+			this.deps.logger.warn("SegmentWriter dial refused — source not published, re-dialling", payload);
+			return;
+		}
+		this.deps.logger.info("SegmentWriter dial still refused — re-dial deferred", payload);
+	}
+	logRestarting(termination, delayMs, ranMs, restartsInWindow) {
 		this.deps.logger.info("SegmentWriter restarting", {
 			tags: { deviceId: this.deps.deviceId },
 			meta: {
@@ -15891,10 +15993,6 @@ var SegmentWriter = class {
 				reason: termination.reason
 			}
 		});
-		this.restartTimer = setTimeout(() => {
-			this.restartTimer = null;
-			this.start();
-		}, delayMs);
 	}
 	stop() {
 		this.stopAndWait();
@@ -17495,6 +17593,19 @@ var RecordingController = class {
 	*/
 	async attachProfile(deviceId, profile, segmentSeconds, audio) {
 		const attachProfileStartMs = this.now();
+		let ffmpegPath;
+		try {
+			ffmpegPath = await this.deps.resolveFfmpeg();
+		} catch (err) {
+			this.deps.logger.error("recorder: writer refused — no pinned ffmpeg on this node (D540)", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					error: require_dist.errMsg(err)
+				}
+			});
+			throw new Error(`recorder: no pinned ffmpeg for device ${deviceId}/${profile}`);
+		}
 		const placement = await this.resolvePlacement(deviceId, profile);
 		const placementDoneMs = this.now();
 		const outDir = node_path.default.join(placement.root, STAGING_DIR_NAME, String(deviceId), profile);
@@ -17530,6 +17641,7 @@ var RecordingController = class {
 			consumerTag
 		}, {
 			spawn: this.deps.spawn,
+			ffmpegPath,
 			logger: deviceLog,
 			deviceId,
 			claimCost: (pid) => this.deps.costRegistry?.claim({
@@ -20823,6 +20935,14 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	* because those children were this process's children.
 	*/
 	costRegistry = new require_node.ChildCostRegistry();
+	/**
+	* This node's PINNED ffmpeg (D540), asked once and shared by every child the
+	* recorder spawns: segment writers, exports, gif/clip renders and stills.
+	* Each of those used to take an optional path that no one passed, and fell
+	* back to a bare `'ffmpeg'` — the HOST's binary. It rejects rather than
+	* naming PATH; each site logs its refusal per camera.
+	*/
+	pinnedFfmpeg = require_dist.memoizePinnedFfmpeg(() => this.ctx.deps.ensureFfmpeg());
 	/** True when THIS node is the designated recording node (`recordingNodeId`).
 	*  Every other node stays fully inert — registers no providers, serves no
 	*  playback, runs no controller. Resolved in `onInitialize`. */
@@ -21216,6 +21336,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			now: () => Date.now()
 		});
 		this.controller = new RecordingController({
+			resolveFfmpeg: this.pinnedFfmpeg,
 			...this.stagingGuard !== null ? { stagingGuard: this.stagingGuard } : {},
 			recoverStagingDirectory: (input) => this.recoverReapedDirectory(input),
 			heapProbe: this.heapProbe,
@@ -21363,12 +21484,14 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			gifRender: (input) => renderGif({
 				deps: recordingDeps,
 				exportsDir: this.exportsDirOrThrow(),
-				spawn: node_child_process.spawn
+				spawn: node_child_process.spawn,
+				resolveFfmpeg: this.pinnedFfmpeg
 			}, input),
 			clipRender: (input) => renderClip({
 				deps: recordingDeps,
 				exportsDir: this.exportsDirOrThrow(),
-				spawn: node_child_process.spawn
+				spawn: node_child_process.spawn,
+				resolveFfmpeg: this.pinnedFfmpeg
 			}, input),
 			locations: () => this.resolvedLocations,
 			refreshLocations: () => this.refreshLocations(),
@@ -21497,6 +21620,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		};
 		this.exportEngine = new ExportEngine({
 			spawn: node_child_process.spawn,
+			resolveFfmpeg: this.pinnedFfmpeg,
 			logger: this.ctx.logger.child("export"),
 			state: exportsState,
 			resolvePlaylist: async (rec) => {
@@ -21649,7 +21773,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			const stillService = new StillFrameService({
 				lowSegmentsAt: (deviceId, epochMs) => this.index.segmentsOverlapping(deviceId, "low", epochMs, epochMs + 1),
 				resolveAbsPath: (row) => this.resolveSegmentAbsPath(row),
-				logger: this.ctx.logger.child("Still")
+				logger: this.ctx.logger.child("Still"),
+				resolveFfmpeg: this.pinnedFfmpeg
 			});
 			const served = await this.ctx.dataPlane?.serve({
 				prefix: STILL_PREFIX,

package/dist/recorder/index.mjs

@@ -1,5 +1,5 @@
-import { $t as videoclipsCapability, An as array, B as VISIT_MERGE_GAP_MS, Ct as mayReadLocation, Dn as selectAssignedProfileSlots, Et as modeMayWrite, F as RECORDING_SOURCE_CAMSTACK_ADDON, Fn as number, Gt as resolveRecordingProfiles, I as RecordingConfigSchema, In as object, It as recordingArchiveCapability, J as clipExportFailure, Jt as storageEvictableCapability, K as batteryCapability, L as RecordingSignalStatusSchema, Ln as preprocess, Lt as recordingCapability, N as RECORDING_EXPORT_MAX_READ_BYTES, On as sleep$1, P as RECORDING_SOURCE_CAMSTACK, Rn as record, Rt as recordingExportCapability, S as ExportRecordSchema, Tt as migrateLegacyDeviceSignalConfig, Ut as resolveLocationMode, Vn as EventCategory, Vt as resolveCreateExportSubject, Y as clipExportFailureOf, Yt as storageOccupancyCapability, Zt as stripRetiredBandPreBufferSec, _n as customAction, a as BatteryStatusSchema, an as evaluateSensorEdge, b as EVENT_PAD_MS, bn as hydrateSchema, cn as DeviceFeature, ct as evictionPolicyForMode, et as deriveBatteryPresence, fn as BaseAddon, g as DEFAULT_EVENTS_BAND_BUFFER_SEC, jn as boolean, k as OpsLogEntrySchema, kn as _enum, ln as DeviceType, lt as evictionPolicyOfLocation, nt as deriveRecordingMode, o as CLIP_BROKER_PACED_RATES, pt as gbToBytes, un as errMsg$1, ut as exportSubjectOf, vn as defineCustomActions, vt as isFirstLevelMacroClass, wn as nodePin, wt as mayWriteToLocation, y as EVENT_OWNER_TYPES, yt as loadContributionCapability, z as VIDEOCLIPS_MAX_OFFER_BYTES, zn as string, zt as recordingSignalCapability } from "../dist-DdVMFlJ6.mjs";
-import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-COu_tHy4.mjs";
+import { An as _enum, B as VISIT_MERGE_GAP_MS, Bn as string, Bt as recordingSignalCapability, Ct as mayReadLocation, Dt as modeMayWrite, Et as migrateLegacyDeviceSignalConfig, F as RECORDING_SOURCE_CAMSTACK_ADDON, Hn as EventCategory, Ht as resolveCreateExportSubject, I as RecordingConfigSchema, In as number, J as clipExportFailure, K as batteryCapability, Kt as resolveRecordingProfiles, L as RecordingSignalStatusSchema, Ln as object, Lt as recordingArchiveCapability, Mn as boolean, N as RECORDING_EXPORT_MAX_READ_BYTES, On as selectAssignedProfileSlots, P as RECORDING_SOURCE_CAMSTACK, Qt as stripRetiredBandPreBufferSec, Rn as preprocess, Rt as recordingCapability, S as ExportRecordSchema, Tn as nodePin, Tt as memoizePinnedFfmpeg, Wt as resolveLocationMode, Xt as storageOccupancyCapability, Y as clipExportFailureOf, Yt as storageEvictableCapability, a as BatteryStatusSchema, b as EVENT_PAD_MS, ct as evictionPolicyForMode, dn as errMsg$1, en as videoclipsCapability, et as deriveBatteryPresence, g as DEFAULT_EVENTS_BAND_BUFFER_SEC, jn as array, k as OpsLogEntrySchema, kn as sleep$1, ln as DeviceFeature, lt as evictionPolicyOfLocation, nt as deriveRecordingMode, o as CLIP_BROKER_PACED_RATES, on as evaluateSensorEdge, pn as BaseAddon, pt as gbToBytes, un as DeviceType, ut as exportSubjectOf, vn as customAction, vt as isFirstLevelMacroClass, wt as mayWriteToLocation, xn as hydrateSchema, y as EVENT_OWNER_TYPES, yn as defineCustomActions, yt as loadContributionCapability, z as VIDEOCLIPS_MAX_OFFER_BYTES, zn as record, zt as recordingExportCapability } from "../dist-B3_sbBDM.mjs";
+import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-DJFKTJ0B.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { d as PREBUFFER_MAX_MS, l as withRecordingIntent, r as RECORDING_PRE_ROLL_REQUEST_MS } from "../restream-intent-DyGmLAU9.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
@@ -3443,7 +3443,20 @@ var StillFrameService = class {
 			return null;
 		}
 		try {
-			const jpeg = await this.decodeFrame(abs, source.offsetSec);
+			let bin;
+			try {
+				bin = await this.deps.resolveFfmpeg();
+			} catch (err) {
+				this.deps.logger.error("still: refused — no pinned ffmpeg on this node (D540)", {
+					tags: { deviceId },
+					meta: {
+						epochMs,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+				return null;
+			}
+			const jpeg = await this.decodeFrame(bin, abs, source.offsetSec);
 			if (jpeg === null || jpeg.byteLength === 0) return null;
 			return {
 				jpeg,
@@ -3454,7 +3467,7 @@ var StillFrameService = class {
 		}
 	}
 	/** Run ONE ffmpeg input-seek + single-frame decode; JPEG bytes on stdout. */
-	decodeFrame(absPath, offsetSec) {
+	decodeFrame(bin, absPath, offsetSec) {
 		const args = [
 			"-hide_banner",
 			"-loglevel",
@@ -3470,7 +3483,6 @@ var StillFrameService = class {
 			"pipe:1"
 		];
 		const spawn$1 = this.deps.spawn ?? spawn;
-		const bin = this.deps.ffmpegPath ?? "ffmpeg";
 		return new Promise((resolve) => {
 			let child;
 			try {
@@ -7541,15 +7553,32 @@ var ExportEngine = class {
 			} catch {}
 		}
 	}
-	runFfmpeg(id, deviceId, args, progress) {
+	async runFfmpeg(id, deviceId, args, progress) {
+		let ffmpegPath;
+		try {
+			ffmpegPath = await this.deps.resolveFfmpeg();
+		} catch (err) {
+			const reason = `no pinned ffmpeg on this node (D540): ${err instanceof Error ? err.message : String(err)}`;
+			this.deps.logger.error("export render refused — no pinned ffmpeg on this node (D540)", {
+				tags: { deviceId },
+				meta: {
+					exportId: id,
+					error: reason
+				}
+			});
+			return {
+				code: null,
+				stderrTail: [reason]
+			};
+		}
 		this.deps.logger.debug("export ffmpeg argv", { meta: {
 			exportId: id,
 			args
 		} });
 		const stallMs = this.deps.stallMs ?? 9e4;
 		const faststartStallMs = this.deps.faststartStallMs ?? 9e5;
-		return new Promise((resolve) => {
-			const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
+		return await new Promise((resolve) => {
+			const proc = this.deps.spawn(ffmpegPath, args);
 			this.active.set(id, proc);
 			const stderrTail = [];
 			let stallTimer = null;
@@ -9451,6 +9480,17 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 	const toMs = input.aroundMs + input.postRollSec * 1e3;
 	if (!Number.isFinite(fromMs) || !Number.isFinite(toMs) || toMs <= fromMs) throw new Error(`invalid ${ext} window [${fromMs}, ${toMs}) for device ${input.deviceId} — aroundMs=${input.aroundMs} preRollSec=${input.preRollSec} postRollSec=${input.postRollSec}`);
 	const renderId = `${ext}-${now()}-${Math.floor(Math.random() * 1e6)}`;
+	let ffmpegPath;
+	try {
+		ffmpegPath = await renderDeps.resolveFfmpeg();
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		renderDeps.deps.logger.error(`${ext} render refused — no pinned ffmpeg on this node (D540)`, {
+			tags: { deviceId: input.deviceId },
+			meta: { error: reason }
+		});
+		throw new Error(`${ext} render refused for device ${input.deviceId}: no pinned ffmpeg — ${reason}`, { cause: err });
+	}
 	const availableEnd = latestFinalizedEnd(renderDeps, input.deviceId);
 	if (availableEnd === null || availableEnd < toMs) throw new Error(`${FOOTAGE_NOT_READY}: [${fromMs}, ${toMs}) for device ${input.deviceId} — finalized footage ends at ${availableEnd ?? "never"}`);
 	const window = {
@@ -9469,7 +9509,7 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 	if (playlist === null) throw new Error(`no footage covers [${window.fromMs}, ${window.toMs}) for device ${input.deviceId}`);
 	const outPath = path.join(path.dirname(playlist.path), `${renderId}.${ext}`);
 	try {
-		await runFfmpeg(renderDeps, buildArgs(playlist.path, outPath), ext);
+		await runFfmpeg(renderDeps, ffmpegPath, buildArgs(playlist.path, outPath), ext);
 		const bytes = await promises.readFile(outPath);
 		if (bytes.byteLength === 0) throw new Error(`${ext} render produced an empty file`);
 		return {
@@ -9506,9 +9546,9 @@ function latestFinalizedEnd(renderDeps, deviceId) {
 * throws ESRCH, which is swallowed, so the cost of being wrong is nothing while
 * the cost of NOT killing is a zombie per render.
 */
-function runFfmpeg(renderDeps, args, ext) {
+function runFfmpeg(renderDeps, ffmpegPath, args, ext) {
 	return new Promise((resolve, reject) => {
-		const proc = renderDeps.spawn(renderDeps.ffmpegPath ?? "ffmpeg", args);
+		const proc = renderDeps.spawn(ffmpegPath, args);
 		let done = false;
 		let timer = null;
 		const settle = (err) => {
@@ -15650,6 +15690,26 @@ function buildPassthroughArgs(a) {
 	];
 }
 //#endregion
+//#region src/recorder/addon/dial-refusal.ts
+var METHOD_FAILED = /\bmethod ([A-Z_]+) failed: (\d{3})\b/;
+function isHandshakeMethod(method) {
+	return method === "OPTIONS" || method === "DESCRIBE" || method === "SETUP" || method === "PLAY";
+}
+/** The refusal named in this generation's stderr tail, or `null` when there is none. */
+function readDialRefusal(stderrTail) {
+	for (let i = stderrTail.length - 1; i >= 0; i--) {
+		const match = METHOD_FAILED.exec(stderrTail[i] ?? "");
+		if (match === null) continue;
+		const method = match[1] ?? "";
+		if (!isHandshakeMethod(method)) return null;
+		return {
+			method,
+			status: Number(match[2])
+		};
+	}
+	return null;
+}
+//#endregion
 //#region src/recorder/addon/segment-writer.ts
 /** Max CONSECUTIVE rapid restarts before giving up (reset by a stable run). */
 var MAX_RESTARTS = 10;
@@ -15708,6 +15768,12 @@ var SegmentWriter = class {
 	* half-pruned window.
 	*/
 	restartWindow = [];
+	/**
+	* Consecutive generations the source refused at the handshake (D685). Reset
+	* by any generation that was not refused. Only read for the log line — the
+	* rapid breaker is what bounds a source that never comes back.
+	*/
+	refusedInARow = 0;
 	restartTimer = null;
 	startedAt = 0;
 	exitWait = null;
@@ -15740,7 +15806,7 @@ var SegmentWriter = class {
 	start() {
 		if (this.stopped || this.proc) return;
 		const args = buildPassthroughArgs(this.cfg);
-		const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
+		const proc = this.deps.spawn(this.deps.ffmpegPath, args);
 		this.proc = proc;
 		this.exitWait = new Promise((resolve) => {
 			this.resolveExit = resolve;
@@ -15797,10 +15863,13 @@ var SegmentWriter = class {
 		if (this.stopped) return;
 		const now = Date.now();
 		const ranMs = now - this.startedAt;
-		if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
-		this.restartWindow = [...this.restartWindow.filter((at) => at > now - RESTART_WINDOW_MS), now];
+		const refusal = termination.reason === "exit" ? readDialRefusal(stderrTail) : null;
+		this.refusedInARow = refusal === null ? 0 : this.refusedInARow + 1;
+		if (ranMs >= STABLE_RUN_MS && refusal === null) this.restarts = 0;
+		const liveWindow = this.restartWindow.filter((at) => at > now - RESTART_WINDOW_MS);
+		this.restartWindow = refusal === null ? [...liveWindow, now] : liveWindow;
 		const restartsInWindow = this.restartWindow.length;
-		if (termination.reason === "exit") this.deps.logger.warn("SegmentWriter ffmpeg exited", {
+		if (termination.reason === "exit" && refusal === null) this.deps.logger.warn("SegmentWriter ffmpeg exited", {
 			tags: { deviceId: this.deps.deviceId },
 			meta: {
 				outDir: this.cfg.outDir,
@@ -15872,6 +15941,39 @@ var SegmentWriter = class {
 		}
 		this.restarts++;
 		const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
+		if (refusal !== null) this.logDeferredRedial(refusal, delayMs, ranMs, restartsInWindow);
+		else this.logRestarting(termination, delayMs, ranMs, restartsInWindow);
+		this.restartTimer = setTimeout(() => {
+			this.restartTimer = null;
+			this.start();
+		}, delayMs);
+	}
+	/**
+	* A refused dial, named — every one of them, per camera. The FIRST of a run
+	* is a WARN (the source just went away under a live writer); the rest are
+	* the same outage continuing and go out at INFO with the running count.
+	*/
+	logDeferredRedial(refusal, delayMs, ranMs, restartsInWindow) {
+		const payload = {
+			tags: { deviceId: this.deps.deviceId },
+			meta: {
+				outDir: this.cfg.outDir,
+				method: refusal.method,
+				status: refusal.status,
+				refusedInARow: this.refusedInARow,
+				attempt: this.restarts,
+				delayMs,
+				ranMs,
+				restartsInWindow
+			}
+		};
+		if (this.refusedInARow === 1) {
+			this.deps.logger.warn("SegmentWriter dial refused — source not published, re-dialling", payload);
+			return;
+		}
+		this.deps.logger.info("SegmentWriter dial still refused — re-dial deferred", payload);
+	}
+	logRestarting(termination, delayMs, ranMs, restartsInWindow) {
 		this.deps.logger.info("SegmentWriter restarting", {
 			tags: { deviceId: this.deps.deviceId },
 			meta: {
@@ -15883,10 +15985,6 @@ var SegmentWriter = class {
 				reason: termination.reason
 			}
 		});
-		this.restartTimer = setTimeout(() => {
-			this.restartTimer = null;
-			this.start();
-		}, delayMs);
 	}
 	stop() {
 		this.stopAndWait();
@@ -17487,6 +17585,19 @@ var RecordingController = class {
 	*/
 	async attachProfile(deviceId, profile, segmentSeconds, audio) {
 		const attachProfileStartMs = this.now();
+		let ffmpegPath;
+		try {
+			ffmpegPath = await this.deps.resolveFfmpeg();
+		} catch (err) {
+			this.deps.logger.error("recorder: writer refused — no pinned ffmpeg on this node (D540)", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					error: errMsg$1(err)
+				}
+			});
+			throw new Error(`recorder: no pinned ffmpeg for device ${deviceId}/${profile}`);
+		}
 		const placement = await this.resolvePlacement(deviceId, profile);
 		const placementDoneMs = this.now();
 		const outDir = path.join(placement.root, STAGING_DIR_NAME, String(deviceId), profile);
@@ -17522,6 +17633,7 @@ var RecordingController = class {
 			consumerTag
 		}, {
 			spawn: this.deps.spawn,
+			ffmpegPath,
 			logger: deviceLog,
 			deviceId,
 			claimCost: (pid) => this.deps.costRegistry?.claim({
@@ -20815,6 +20927,14 @@ var RecorderV2Addon = class extends BaseAddon {
 	* because those children were this process's children.
 	*/
 	costRegistry = new ChildCostRegistry();
+	/**
+	* This node's PINNED ffmpeg (D540), asked once and shared by every child the
+	* recorder spawns: segment writers, exports, gif/clip renders and stills.
+	* Each of those used to take an optional path that no one passed, and fell
+	* back to a bare `'ffmpeg'` — the HOST's binary. It rejects rather than
+	* naming PATH; each site logs its refusal per camera.
+	*/
+	pinnedFfmpeg = memoizePinnedFfmpeg(() => this.ctx.deps.ensureFfmpeg());
 	/** True when THIS node is the designated recording node (`recordingNodeId`).
 	*  Every other node stays fully inert — registers no providers, serves no
 	*  playback, runs no controller. Resolved in `onInitialize`. */
@@ -21208,6 +21328,7 @@ var RecorderV2Addon = class extends BaseAddon {
 			now: () => Date.now()
 		});
 		this.controller = new RecordingController({
+			resolveFfmpeg: this.pinnedFfmpeg,
 			...this.stagingGuard !== null ? { stagingGuard: this.stagingGuard } : {},
 			recoverStagingDirectory: (input) => this.recoverReapedDirectory(input),
 			heapProbe: this.heapProbe,
@@ -21355,12 +21476,14 @@ var RecorderV2Addon = class extends BaseAddon {
 			gifRender: (input) => renderGif({
 				deps: recordingDeps,
 				exportsDir: this.exportsDirOrThrow(),
-				spawn
+				spawn,
+				resolveFfmpeg: this.pinnedFfmpeg
 			}, input),
 			clipRender: (input) => renderClip({
 				deps: recordingDeps,
 				exportsDir: this.exportsDirOrThrow(),
-				spawn
+				spawn,
+				resolveFfmpeg: this.pinnedFfmpeg
 			}, input),
 			locations: () => this.resolvedLocations,
 			refreshLocations: () => this.refreshLocations(),
@@ -21489,6 +21612,7 @@ var RecorderV2Addon = class extends BaseAddon {
 		};
 		this.exportEngine = new ExportEngine({
 			spawn,
+			resolveFfmpeg: this.pinnedFfmpeg,
 			logger: this.ctx.logger.child("export"),
 			state: exportsState,
 			resolvePlaylist: async (rec) => {
@@ -21641,7 +21765,8 @@ var RecorderV2Addon = class extends BaseAddon {
 			const stillService = new StillFrameService({
 				lowSegmentsAt: (deviceId, epochMs) => this.index.segmentsOverlapping(deviceId, "low", epochMs, epochMs + 1),
 				resolveAbsPath: (row) => this.resolveSegmentAbsPath(row),
-				logger: this.ctx.logger.child("Still")
+				logger: this.ctx.logger.child("Still"),
+				resolveFfmpeg: this.pinnedFfmpeg
 			});
 			const served = await this.ctx.dataPlane?.serve({
 				prefix: STILL_PREFIX,