@camstack/addon-pipeline 1.2.49 → 1.2.51

package/dist/pipeline-runner/index.mjs

@@ -1,6 +1,6 @@
-import { $ as errMsg, A as deriveDetailCropRect, At as EventCategory, Ct as lazy, D as customAction, Et as object, H as pickNativeLeaseOverride, Ot as string, Tt as number, V as pickDetailCropConvention, W as pipelineRunnerCapability, at as BaseAddon, bt as array, k as defineCustomActions, l as DEVICE_BACKEND_TO_FORMAT, lt as createEvent, mt as nodePin, s as DEFAULT_DETAIL_CROP_CONVENTION, wt as literal, xt as boolean, yt as _enum } from "../dist-CLJKoYEP.mjs";
-import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-B6dqQjiX.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-BxPNiino.mjs";
+import { A as defineCustomActions, Dt as object, Et as number, G as pipelineRunnerCapability, H as pickDetailCropConvention, O as customAction, St as boolean, Tt as literal, U as pickNativeLeaseOverride, bt as _enum, et as errMsg, ht as nodePin, j as deriveDetailCropRect, jt as EventCategory, kt as string, ot as BaseAddon, s as DEFAULT_DETAIL_CROP_CONVENTION, u as DEVICE_BACKEND_TO_FORMAT, ut as createEvent, wt as lazy, xt as array } from "../dist-Dkvk5ykl.mjs";
+import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-BvtjRcal.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-B0c3i2km.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { n as profileForStreamId, t as isRemoteRestream } from "../remote-restream-BeHi78PZ.mjs";
@@ -1816,116 +1816,6 @@ var CropConventionSource = class {
 	}
 };
 //#endregion
-//#region src/pipeline-runner/native-lease-settings-source.ts
-/**
-* Where the runner gets the cluster-wide native-frame LEASE knobs.
-*
-* ## Why a settings read and not the attach config
-*
-* Identical reasoning to `crop-convention-source.ts`, and worth restating
-* because the temptation is the same: `RunnerCameraConfig` is the obvious
-* orchestrator→runner channel and it is the wrong one. Eleven call sites build
-* one; a cluster-wide constant threaded through eleven builders eventually
-* reaches ten of them, and the cameras attached by the forgotten builder just
-* quietly run a different lease window. Instead the runner reads the OWNER
-* addon's global settings directly, hub-routed by `AddonCallGateway`, so an
-* agent runner transparently reads the hub-central store with no placement
-* branching.
-*
-* ## Deliberately NOT node-scoped
-*
-* The read passes no `nodeId`. With one, `addon-settings` would project that
-* node's scoped value and two nodes could hold different lease windows for the
-* same camera — so whether a stored crop is native pixels or the ≤640 fallback
-* would depend on where the balancer happened to place it, which is invisible
-* from the stored media.
-*
-* ## What it hands out
-*
-* A {@link NativeLeaseSettingsOverride} — only the knobs the operator SET. The
-* decode worker resolves the rest (env var, then the shipped default); see
-* `session-decode/native-lease-config.ts` for the precedence. Handing out a
-* fully-resolved triple here would erase the "operator set nothing" state and
-* with it the env-var escape hatch.
-*/
-/**
-* The addon whose GLOBAL settings own the knobs. `pipeline-orchestrator` is
-* hub-resident and neutral — the same owner as the detail-crop convention and
-* the per-node decoder-backend selector.
-*/
-var NATIVE_LEASE_OWNER_ADDON_ID = "pipeline-orchestrator";
-/**
-* Whether two overrides name the same knobs with the same values.
-*
-* **Every knob has to appear here.** This is the equality that decides whether
-* a re-read is ADOPTED at all: a knob missing from the comparison is read from
-* the hub, judged identical, and discarded, so the operator's change never
-* reaches a decode worker and nothing anywhere says so. `admission` shipped
-* missing from this list and did exactly that — the setting was stored, the
-* hub served it, the runner fetched it, and every worker kept spawning with the
-* old value.
-*/
-function sameOverride(a, b) {
-	return a.ttlMs === b.ttlMs && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission;
-}
-/**
-* TTL-cached read of the cluster native-lease knobs.
-*
-* {@link current} is synchronous because the fork that consumes it is;
-* {@link refresh} is what talks to the hub, and the runner awaits it on the
-* path that precedes a decode-worker spawn.
-*/
-var NativeLeaseSettingsSource = class {
-	override = {};
-	lastReadAtMs = Number.NEGATIVE_INFINITY;
-	inFlight = null;
-	logger;
-	now;
-	ttlMs;
-	constructor(options) {
-		this.logger = options.logger;
-		this.now = options.now ?? (() => Date.now());
-		this.ttlMs = options.ttlMs ?? 3e4;
-	}
-	/** The operator's overrides as last read — `{}` until a read lands. */
-	current() {
-		return this.override;
-	}
-	/**
-	* Re-read if the cached value has expired. Concurrent callers share one
-	* in-flight read; a failure keeps the LAST KNOWN value rather than reverting
-	* to `{}`, because a revert would silently hand the next-spawned workers a
-	* different RAM profile than the ones already running.
-	*/
-	async refresh(api) {
-		if (api === void 0) return this.override;
-		if (this.now() - this.lastReadAtMs < this.ttlMs) return this.override;
-		this.inFlight ??= this.read(api).finally(() => {
-			this.inFlight = null;
-		});
-		await this.inFlight;
-		return this.override;
-	}
-	async read(api) {
-		try {
-			const next = pickNativeLeaseOverride(await api.addonSettings.getGlobalSettings.query({ addonId: NATIVE_LEASE_OWNER_ADDON_ID }));
-			this.lastReadAtMs = this.now();
-			if (sameOverride(next, this.override)) return;
-			this.logger.info("native lease settings changed — applies to NEW decode sessions", { meta: {
-				from: { ...this.override },
-				to: { ...next }
-			} });
-			this.override = next;
-		} catch (err) {
-			this.logger.warn("native lease settings read failed — keeping the last known value", { meta: {
-				owner: NATIVE_LEASE_OWNER_ADDON_ID,
-				inUse: { ...this.override },
-				error: err instanceof Error ? err.message : String(err)
-			} });
-		}
-	}
-};
-//#endregion
 //#region src/pipeline-runner/detail-subtree.ts
 /** Did the native-lease fetch report a miss (rather than return pixels)? */
 function isNativeCropMiss(fetch) {
@@ -2500,6 +2390,116 @@ function resolveNativeCropSource(isFullFrame, nativeHit) {
 	return isFullFrame ? "ram-fullframe" : "miss";
 }
 //#endregion
+//#region src/pipeline-runner/native-lease-settings-source.ts
+/**
+* Where the runner gets the cluster-wide native-frame LEASE knobs.
+*
+* ## Why a settings read and not the attach config
+*
+* Identical reasoning to `crop-convention-source.ts`, and worth restating
+* because the temptation is the same: `RunnerCameraConfig` is the obvious
+* orchestrator→runner channel and it is the wrong one. Eleven call sites build
+* one; a cluster-wide constant threaded through eleven builders eventually
+* reaches ten of them, and the cameras attached by the forgotten builder just
+* quietly run a different lease window. Instead the runner reads the OWNER
+* addon's global settings directly, hub-routed by `AddonCallGateway`, so an
+* agent runner transparently reads the hub-central store with no placement
+* branching.
+*
+* ## Deliberately NOT node-scoped
+*
+* The read passes no `nodeId`. With one, `addon-settings` would project that
+* node's scoped value and two nodes could hold different lease windows for the
+* same camera — so whether a stored crop is native pixels or the ≤640 fallback
+* would depend on where the balancer happened to place it, which is invisible
+* from the stored media.
+*
+* ## What it hands out
+*
+* A {@link NativeLeaseSettingsOverride} — only the knobs the operator SET. The
+* decode worker resolves the rest (env var, then the shipped default); see
+* `session-decode/native-lease-config.ts` for the precedence. Handing out a
+* fully-resolved triple here would erase the "operator set nothing" state and
+* with it the env-var escape hatch.
+*/
+/**
+* The addon whose GLOBAL settings own the knobs. `pipeline-orchestrator` is
+* hub-resident and neutral — the same owner as the detail-crop convention and
+* the per-node decoder-backend selector.
+*/
+var NATIVE_LEASE_OWNER_ADDON_ID = "pipeline-orchestrator";
+/**
+* Whether two overrides name the same knobs with the same values.
+*
+* **Every knob has to appear here.** This is the equality that decides whether
+* a re-read is ADOPTED at all: a knob missing from the comparison is read from
+* the hub, judged identical, and discarded, so the operator's change never
+* reaches a decode worker and nothing anywhere says so. `admission` shipped
+* missing from this list and did exactly that — the setting was stored, the
+* hub served it, the runner fetched it, and every worker kept spawning with the
+* old value.
+*/
+function sameOverride(a, b) {
+	return a.ttlMs === b.ttlMs && a.budgetMb === b.budgetMb && a.activityMs === b.activityMs && a.admission === b.admission;
+}
+/**
+* TTL-cached read of the cluster native-lease knobs.
+*
+* {@link current} is synchronous because the fork that consumes it is;
+* {@link refresh} is what talks to the hub, and the runner awaits it on the
+* path that precedes a decode-worker spawn.
+*/
+var NativeLeaseSettingsSource = class {
+	override = {};
+	lastReadAtMs = Number.NEGATIVE_INFINITY;
+	inFlight = null;
+	logger;
+	now;
+	ttlMs;
+	constructor(options) {
+		this.logger = options.logger;
+		this.now = options.now ?? (() => Date.now());
+		this.ttlMs = options.ttlMs ?? 3e4;
+	}
+	/** The operator's overrides as last read — `{}` until a read lands. */
+	current() {
+		return this.override;
+	}
+	/**
+	* Re-read if the cached value has expired. Concurrent callers share one
+	* in-flight read; a failure keeps the LAST KNOWN value rather than reverting
+	* to `{}`, because a revert would silently hand the next-spawned workers a
+	* different RAM profile than the ones already running.
+	*/
+	async refresh(api) {
+		if (api === void 0) return this.override;
+		if (this.now() - this.lastReadAtMs < this.ttlMs) return this.override;
+		this.inFlight ??= this.read(api).finally(() => {
+			this.inFlight = null;
+		});
+		await this.inFlight;
+		return this.override;
+	}
+	async read(api) {
+		try {
+			const next = pickNativeLeaseOverride(await api.addonSettings.getGlobalSettings.query({ addonId: NATIVE_LEASE_OWNER_ADDON_ID }));
+			this.lastReadAtMs = this.now();
+			if (sameOverride(next, this.override)) return;
+			this.logger.info("native lease settings changed — applies to NEW decode sessions", { meta: {
+				from: { ...this.override },
+				to: { ...next }
+			} });
+			this.override = next;
+		} catch (err) {
+			this.logger.warn("native lease settings read failed — keeping the last known value", { meta: {
+				owner: NATIVE_LEASE_OWNER_ADDON_ID,
+				inUse: { ...this.override },
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+};
+//#endregion
 //#region src/pipeline-runner/frame-governor.ts
 var FrameGovernor = class {
 	config;
@@ -4978,7 +4978,20 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 		if (resolved.tier === "native" && resolved.pixels !== null) return this.encodeNativeCropResult(resolved.pixels, resolved.tier, input.encodeJpeg);
 		if (resolved.tier !== "ram-fullframe") return null;
 		const crop = this.retainedFrames?.crop(input.handle, input.bbox, input.maxWidth);
-		if (!crop) return null;
+		if (!crop) {
+			this.ctx?.logger.warn("native full-frame miss — the retained store no longer holds this frame", {
+				tags: { deviceId: this.nativeCropRegistry.deviceIdFor(input.handle) ?? -1 },
+				meta: {
+					handle: `${input.handle.shmId}#${input.handle.slot}#${input.handle.seq}`,
+					handleNodeId: input.handle.nodeId,
+					nativeMissReason: resolved.missReason,
+					nativeHandleAgeMs: resolved.handleAgeMs,
+					maxWidth: input.maxWidth ?? null,
+					hint: "both the native lease and the retained-frame window have closed for this frame — the detail dispatch that asked for it produces NO crop"
+				}
+			});
+			return null;
+		}
 		return this.encodeNativeCropResult({
 			bytes: crop.bytes,
 			width: crop.width,

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-J2DeRZAN.js");
+const require_dist = require("../dist-BsBEe_rX.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_addon_utils = require("../addon-utils-DveoBR6G.js");
 let node_crypto = require("node:crypto");
@@ -3489,12 +3489,56 @@ function activeBandAt(config, date) {
 //#endregion
 //#region src/recorder/addon/band-decision.ts
 /**
+* Pure glue between a device's `RecordingConfig` and the v2 band engine: decide
+* whether recording should currently be running, and which finalized segments
+* an `events` band retains.
+*
+* The decision is enabled AND the band active at `now` (per the v2
+* `activeBandAt`/`bandActiveAt`) demands recording: a `continuous` band always
+* demands; an `events` band demands only within `postBufferSec` of a qualifying
+* trigger (B3). No bands / disabled => not recording.
+*
+* `preBufferSec` is retroactive — it is NOT a live-demand input; it retains
+* already-recorded segments BEFORE a trigger at keep/discard time
+* ({@link segmentRetainedForEvents}). This mirrors the old recorder's proven
+* policy split (start-on-trigger live gate + retroactive pre-buffer keep).
+*
+* Kept pure (clock + trigger state injected) so the attach/detach decision is
+* unit-testable without ffmpeg, the broker, the event bus, or a real wall clock.
+*/
+/**
+* THE one place a band's pre/post buffers are read. An ABSENT field takes
+* {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an explicit value — including `0` —
+* is honoured verbatim.
+*
+* Both callers below used to inline `?? 0`, which read "the operator omitted the
+* field" as "the operator asked for a zero-length window". For the live gate
+* that is not a policy, it is an impossibility: nothing can ever be recorded.
+* Two cameras sat in exactly that state.
+*/
+function resolveBandBufferMs(band) {
+	return {
+		preMs: (band.preBufferSec ?? require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.preBufferSec) * 1e3,
+		postMs: (band.postBufferSec ?? require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec) * 1e3
+	};
+}
+/**
+* Can this band EVER open a live recording window? False for an `events` band
+* whose resolved post-buffer is zero (only reachable by authoring an explicit
+* `0`) or which lists no trigger at all: both are "enabled, and records nothing,
+* forever". The recorder warns on it rather than dropping the device silently.
+*/
+function eventsBandCanEverDemand(band) {
+	if (band.mode !== "events") return true;
+	return (band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0) && resolveBandBufferMs(band).postMs > 0;
+}
+/**
 * Is an `events` band's live demand window open at `atMs`? True iff a trigger
 * the band listens for fired within `postBufferSec` of now. `preBufferSec` is
 * deliberately NOT consulted here (see file header).
 */
 function eventsBandDemanded(band, triggers, atMs) {
-	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const { postMs } = resolveBandBufferMs(band);
 	const fresh = (lastMs) => lastMs != null && atMs - lastMs <= postMs;
 	if (band.triggers?.motion && fresh(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && fresh(triggers.lastAudioMs)) return true;
@@ -3521,8 +3565,7 @@ function shouldRecordAt(config, triggers, at) {
 * This is where `preBufferSec` retroactively retains pre-trigger footage.
 */
 function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
-	const preMs = (band.preBufferSec ?? 0) * 1e3;
-	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const { preMs, postMs } = resolveBandBufferMs(band);
 	const overlaps = (lastMs) => lastMs != null && segStartMs <= lastMs + postMs && segEndMs >= lastMs - preMs;
 	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
@@ -4055,6 +4098,12 @@ var RecordingController = class {
 	* alive, which is the only question here.
 	*/
 	lastSegmentAt = /* @__PURE__ */ new Map();
+	/**
+	* Devices already named by {@link reportUnrecordable} — one warn per device
+	* per "enabled but can never record" episode, re-armed as soon as the device
+	* records again.
+	*/
+	unrecordableReported = /* @__PURE__ */ new Set();
 	restore = null;
 	tickTimer = null;
 	stopped = false;
@@ -4231,10 +4280,12 @@ var RecordingController = class {
 		if (this.stopped) return;
 		const config = await this.deps.loadConfig(deviceId);
 		if (!shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()))) {
+			this.reportUnrecordable(deviceId, config);
 			await this.detachDevice(deviceId);
 			this.restore?.remove(deviceId);
 			return;
 		}
+		this.unrecordableReported.delete(deviceId);
 		if (this.active.has(deviceId)) return;
 		if (this.attaching.has(deviceId)) return;
 		this.attaching.add(deviceId);
@@ -4245,6 +4296,42 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Name the `!wantRecording` drop when the device is ENABLED but its config can
+	* never produce footage — the branch that hid this bug. Two shapes qualify,
+	* and both mean "the operator asked for recording and will get none, forever":
+	* an enabled config with no bands at all, and an `events` band that cannot
+	* open a live window (no trigger listed, or an explicit `postBufferSec: 0`).
+	*
+	* NOT reported: a band that simply does not cover `now` (a night-only band at
+	* noon), or an events band waiting for its next trigger. Those are the
+	* feature working.
+	*
+	* One line per device until it records again ({@link unrecordableReported} is
+	* cleared the moment `wantRecording` turns true), so the 30 s tick cannot turn
+	* this into a log flood.
+	*/
+	reportUnrecordable(deviceId, config) {
+		if (!config.enabled) return;
+		if (this.unrecordableReported.has(deviceId)) return;
+		const bands = config.bands ?? [];
+		if (bands.length === 0) {
+			this.unrecordableReported.add(deviceId);
+			this.deps.logger.warn("recorder: device is enabled but has no recording bands — nothing will ever be recorded", { tags: { deviceId } });
+			return;
+		}
+		const band = activeBandAt({ bands }, new Date(this.now()));
+		if (band === null || eventsBandCanEverDemand(band)) return;
+		this.unrecordableReported.add(deviceId);
+		this.deps.logger.warn("recorder: events band can never open a recording window — nothing will ever be recorded", {
+			tags: { deviceId },
+			meta: {
+				postBufferSec: band.postBufferSec,
+				triggers: band.triggers,
+				reason: band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0 ? "postBufferSec is 0" : "no trigger configured"
+			}
+		});
+	}
+	/**
 	* The attach body — extracted so the {@link attaching} in-flight guard in
 	* `evaluateDevice` wraps it cleanly. Resolves the profiles, spawns a
 	* SegmentWriter + watcher per profile, and records the set in `active`. A throw

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, At as EventCategory, Dt as record, G as recordingCapability, K as recordingExportCapability, Ot as string, Y as storageEvictableCapability, _t as selectAssignedProfileSlots, at as BaseAddon, bt as array, ct as DeviceType, f as ExportRecordSchema, g as OpsLogEntrySchema, j as deriveRecordingMode, mt as nodePin, u as EVENT_PAD_MS, ut as hydrateSchema, y as RecordingConfigSchema } from "../dist-CLJKoYEP.mjs";
+import { K as recordingCapability, M as deriveRecordingMode, Ot as record, X as storageEvictableCapability, _ as OpsLogEntrySchema, b as RecordingConfigSchema, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, dt as hydrateSchema, et as errMsg, ht as nodePin, jt as EventCategory, kt as string, lt as DeviceType, ot as BaseAddon, p as ExportRecordSchema, q as recordingExportCapability, vt as selectAssignedProfileSlots, xt as array } from "../dist-Dkvk5ykl.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-QuxtOdK1.mjs";
 import { randomUUID } from "node:crypto";
@@ -3487,12 +3487,56 @@ function activeBandAt(config, date) {
 //#endregion
 //#region src/recorder/addon/band-decision.ts
 /**
+* Pure glue between a device's `RecordingConfig` and the v2 band engine: decide
+* whether recording should currently be running, and which finalized segments
+* an `events` band retains.
+*
+* The decision is enabled AND the band active at `now` (per the v2
+* `activeBandAt`/`bandActiveAt`) demands recording: a `continuous` band always
+* demands; an `events` band demands only within `postBufferSec` of a qualifying
+* trigger (B3). No bands / disabled => not recording.
+*
+* `preBufferSec` is retroactive — it is NOT a live-demand input; it retains
+* already-recorded segments BEFORE a trigger at keep/discard time
+* ({@link segmentRetainedForEvents}). This mirrors the old recorder's proven
+* policy split (start-on-trigger live gate + retroactive pre-buffer keep).
+*
+* Kept pure (clock + trigger state injected) so the attach/detach decision is
+* unit-testable without ffmpeg, the broker, the event bus, or a real wall clock.
+*/
+/**
+* THE one place a band's pre/post buffers are read. An ABSENT field takes
+* {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an explicit value — including `0` —
+* is honoured verbatim.
+*
+* Both callers below used to inline `?? 0`, which read "the operator omitted the
+* field" as "the operator asked for a zero-length window". For the live gate
+* that is not a policy, it is an impossibility: nothing can ever be recorded.
+* Two cameras sat in exactly that state.
+*/
+function resolveBandBufferMs(band) {
+	return {
+		preMs: (band.preBufferSec ?? DEFAULT_EVENTS_BAND_BUFFER_SEC.preBufferSec) * 1e3,
+		postMs: (band.postBufferSec ?? DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec) * 1e3
+	};
+}
+/**
+* Can this band EVER open a live recording window? False for an `events` band
+* whose resolved post-buffer is zero (only reachable by authoring an explicit
+* `0`) or which lists no trigger at all: both are "enabled, and records nothing,
+* forever". The recorder warns on it rather than dropping the device silently.
+*/
+function eventsBandCanEverDemand(band) {
+	if (band.mode !== "events") return true;
+	return (band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0) && resolveBandBufferMs(band).postMs > 0;
+}
+/**
 * Is an `events` band's live demand window open at `atMs`? True iff a trigger
 * the band listens for fired within `postBufferSec` of now. `preBufferSec` is
 * deliberately NOT consulted here (see file header).
 */
 function eventsBandDemanded(band, triggers, atMs) {
-	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const { postMs } = resolveBandBufferMs(band);
 	const fresh = (lastMs) => lastMs != null && atMs - lastMs <= postMs;
 	if (band.triggers?.motion && fresh(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && fresh(triggers.lastAudioMs)) return true;
@@ -3519,8 +3563,7 @@ function shouldRecordAt(config, triggers, at) {
 * This is where `preBufferSec` retroactively retains pre-trigger footage.
 */
 function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
-	const preMs = (band.preBufferSec ?? 0) * 1e3;
-	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const { preMs, postMs } = resolveBandBufferMs(band);
 	const overlaps = (lastMs) => lastMs != null && segStartMs <= lastMs + postMs && segEndMs >= lastMs - preMs;
 	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
@@ -4053,6 +4096,12 @@ var RecordingController = class {
 	* alive, which is the only question here.
 	*/
 	lastSegmentAt = /* @__PURE__ */ new Map();
+	/**
+	* Devices already named by {@link reportUnrecordable} — one warn per device
+	* per "enabled but can never record" episode, re-armed as soon as the device
+	* records again.
+	*/
+	unrecordableReported = /* @__PURE__ */ new Set();
 	restore = null;
 	tickTimer = null;
 	stopped = false;
@@ -4229,10 +4278,12 @@ var RecordingController = class {
 		if (this.stopped) return;
 		const config = await this.deps.loadConfig(deviceId);
 		if (!shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()))) {
+			this.reportUnrecordable(deviceId, config);
 			await this.detachDevice(deviceId);
 			this.restore?.remove(deviceId);
 			return;
 		}
+		this.unrecordableReported.delete(deviceId);
 		if (this.active.has(deviceId)) return;
 		if (this.attaching.has(deviceId)) return;
 		this.attaching.add(deviceId);
@@ -4243,6 +4294,42 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Name the `!wantRecording` drop when the device is ENABLED but its config can
+	* never produce footage — the branch that hid this bug. Two shapes qualify,
+	* and both mean "the operator asked for recording and will get none, forever":
+	* an enabled config with no bands at all, and an `events` band that cannot
+	* open a live window (no trigger listed, or an explicit `postBufferSec: 0`).
+	*
+	* NOT reported: a band that simply does not cover `now` (a night-only band at
+	* noon), or an events band waiting for its next trigger. Those are the
+	* feature working.
+	*
+	* One line per device until it records again ({@link unrecordableReported} is
+	* cleared the moment `wantRecording` turns true), so the 30 s tick cannot turn
+	* this into a log flood.
+	*/
+	reportUnrecordable(deviceId, config) {
+		if (!config.enabled) return;
+		if (this.unrecordableReported.has(deviceId)) return;
+		const bands = config.bands ?? [];
+		if (bands.length === 0) {
+			this.unrecordableReported.add(deviceId);
+			this.deps.logger.warn("recorder: device is enabled but has no recording bands — nothing will ever be recorded", { tags: { deviceId } });
+			return;
+		}
+		const band = activeBandAt({ bands }, new Date(this.now()));
+		if (band === null || eventsBandCanEverDemand(band)) return;
+		this.unrecordableReported.add(deviceId);
+		this.deps.logger.warn("recorder: events band can never open a recording window — nothing will ever be recorded", {
+			tags: { deviceId },
+			meta: {
+				postBufferSec: band.postBufferSec,
+				triggers: band.triggers,
+				reason: band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0 ? "postBufferSec is 0" : "no trigger configured"
+			}
+		});
+	}
+	/**
 	* The attach body — extracted so the {@link attaching} in-flight guard in
 	* `evaluateDevice` wraps it cleanly. Resolves the profiles, spawns a
 	* SegmentWriter + watcher per profile, and records the set in `active`. A throw

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_worker_protocol = require("../worker-protocol-CNi5srgV.js");
+const require_worker_protocol = require("../worker-protocol-CWhkLkHx.js");
 let node_url = require("node:url");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
@@ -343,7 +343,7 @@ var LeaseActivityGate = class {
 	windowMs;
 	now;
 	armedUntil = 0;
-	disabled = false;
+	disabledUntil = 0;
 	constructor(windowMs, now = Date.now) {
 		this.windowMs = windowMs;
 		this.now = now;
@@ -354,23 +354,44 @@ var LeaseActivityGate = class {
 		this.armedUntil = this.now() + this.windowMs;
 	}
 	/**
-	* Force the gate closed regardless of demand — for a download path that has
-	* PROVEN broken this dial (an add/receive failure). Rebuilding the vaapi
-	* filtergraph per failing frame both leaks (node-av reclaims hw pools only
-	* by process exit) and burns GPU churn, so a broken path stays off until
-	* {@link reset} (the next dial). Overrides `windowMs: 0` too.
+	* Force the gate closed regardless of demand for `cooldownMs` — for a
+	* download path that has PROVEN broken (an add/receive failure). Rebuilding
+	* the vaapi filtergraph per failing frame both leaks (node-av reclaims hw
+	* pools only by process exit) and burns GPU churn, so a broken path must stay
+	* off. Overrides `windowMs: 0` too.
+	*
+	* ## Why this is a COOLDOWN and not a latch
+	*
+	* It was a latch (`disable()`), held until {@link reset} — i.e. until the next
+	* DIAL. On a continuously recording camera a dial lasts hours, so two EIO
+	* `hwdownload` failures killed the native lease for the whole session and
+	* every detail dispatch's rung-1 crop missed for as long as it ran. That is
+	* the 93-97% `nativeCropMisses` measured on 2026-08-08: dev 618 had 24 dials
+	* disabled in a single day, and dev 592 serviced ~15 crop requests/s for
+	* 500 s with a `leaseOffered` delta of exactly 0 — `arm()` firing constantly
+	* against a gate that could never reopen.
+	*
+	* The OOM guard the latch existed for is preserved by the cooldown's LENGTH,
+	* not by its permanence: one filtergraph rebuild per cooldown instead of one
+	* per frame. The caller escalates `cooldownMs` on repeated failures, so a
+	* genuinely broken dial converges on the old behaviour while a transient GPU
+	* fault recovers on its own.
+	*
+	* A later call always wins, even a shorter one: the caller escalates
+	* monotonically, and "the most recent failure decides" is the only rule that
+	* stays true if it ever stops.
 	*/
-	disable() {
-		this.disabled = true;
+	disableFor(cooldownMs) {
+		this.disabledUntil = this.now() + cooldownMs;
 	}
-	/** New dial: clear the broken flag AND any stale demand (caller re-arms explicitly). */
+	/** New dial: clear the cooldown AND any stale demand (caller re-arms explicitly). */
 	reset() {
-		this.disabled = false;
+		this.disabledUntil = 0;
 		this.armedUntil = 0;
 	}
 	/** Whether lease capture should run for the current frame. */
 	get active() {
-		if (this.disabled) return false;
+		if (this.now() < this.disabledUntil) return false;
 		if (this.windowMs === 0) return true;
 		return this.now() < this.armedUntil;
 	}
@@ -856,6 +877,25 @@ var NATIVE_LEASE_TTL_MS = NATIVE_LEASE_KNOBS.values.ttlMs;
 */
 var NATIVE_LEASE_ACTIVITY_WINDOW_MS = NATIVE_LEASE_KNOBS.values.activityMs;
 /**
+* How long lease capture stays off after the download path proves broken, and
+* the ceiling that backoff climbs to. Doubling from the base, so the Nth
+* failure in a dial costs `base × 2^(N-2)` — 60 s, 120 s, 240 s … capped.
+*
+* These replace a latch that was held for the REST OF THE DIAL. On a
+* continuously recording camera a dial is hours, and the 2026-08-08 harvest
+* measured what that costs: dev 618 at 93% `nativeCropMisses` across 24
+* disabled dials, dev 592 with a `leaseOffered` delta of 0 over 500 s while
+* answering ~15 crop requests/s. Every one of those misses is a detail
+* dispatch whose rung-1 native crop could never resolve.
+*
+* The bound that mattered is still bounded: the OOM the latch was written for
+* came from rebuilding a vaapi filtergraph PER FAILING FRAME (~25/s), and one
+* rebuild per cooldown is three orders of magnitude below that — while a
+* transient GPU fault now recovers without waiting for a re-dial.
+*/
+var LEASE_DOWNLOAD_COOLDOWN_BASE_MS = 6e4;
+var LEASE_DOWNLOAD_COOLDOWN_MAX_MS = 6e5;
+/**
 * `pinnedRgbCrop` — pinned-color RGB24 native-crop retention. DEFAULT **ON**
 * (2026-07-20 rollout); set `CAMSTACK_SESSION_PINNED_RGB_CROP=0` to opt out.
 *
@@ -1549,7 +1589,11 @@ var DecodeWorkerChild = class {
 			this.nativeLeaseDownloadFilter = null;
 			this.nativeLeaseDownloadFilterKey = "";
 			this.leaseDownloadFailuresThisDial++;
-			if (this.leaseDownloadFailuresThisDial >= 2) this.leaseGate.disable();
+			if (this.leaseDownloadFailuresThisDial >= 2) {
+				const cooldownMs = Math.min(LEASE_DOWNLOAD_COOLDOWN_MAX_MS, LEASE_DOWNLOAD_COOLDOWN_BASE_MS * 2 ** (this.leaseDownloadFailuresThisDial - 2));
+				this.leaseGate.disableFor(cooldownMs);
+				this.emitStderr(`decode-worker-child: native lease capture OFF for ${cooldownMs}ms — ${this.leaseDownloadFailuresThisDial} download failures this dial; native crops will MISS until it expires (detail dispatches fall back to the retained full frame)\n`);
+			}
 			return null;
 		}
 	}