@camstack/addon-pipeline 1.2.50 → 1.2.52

package/dist/{event-loop-stall-monitor-B_EOn2Q1.js → event-loop-stall-monitor-DSPDQYjc.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Ci2-N-XC.js");
+const require_dist = require("./dist-CzFJeiG1.js");
 let node_perf_hooks = require("node:perf_hooks");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/{event-loop-stall-monitor-DUSB3ymZ.mjs → event-loop-stall-monitor-PxIaVeyh.mjs}

@@ -1,4 +1,4 @@
-import { L as hfModelUrl, a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS } from "./dist-hRt5QB5i.mjs";
+import { R as hfModelUrl, a as COCO_TO_MACRO, i as COCO_80_LABELS, r as AUDIO_MACRO_LABELS } from "./dist-gB3o0cyM.mjs";
 import { PerformanceObserver } from "node:perf_hooks";
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-Ci2-N-XC.js");
+const require_dist = require("../dist-CzFJeiG1.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { B as motionDetectionCapability, I as evaluateZoneRules, at as BaseAddon, ct as DeviceType, ut as hydrateSchema } from "../dist-hRt5QB5i.mjs";
+import { L as evaluateZoneRules, V as motionDetectionCapability, dt as hydrateSchema, lt as DeviceType, ot as BaseAddon } from "../dist-gB3o0cyM.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/pipeline-runner/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-Ci2-N-XC.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-B_EOn2Q1.js");
-const require_worker_protocol = require("../worker-protocol-CxpdncMB.js");
+const require_dist = require("../dist-CzFJeiG1.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DSPDQYjc.js");
+const require_worker_protocol = require("../worker-protocol-BQlELGzv.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
@@ -543,11 +543,35 @@ function cropRgb(frame, bbox, maxWidth) {
 /** How long to wait after `kill()` before escalating to `kill('SIGKILL')`. */
 var SIGKILL_FALLBACK_MS = 1e3;
 /**
-* Default timeout for the `pull` round-trip preceding the FIRST delivered
-* frame. Task 0 live-measured cold-start (restream dial + hwaccel context +
-* keyframe wait) at 5-8s, so this must tolerate a slow-but-healthy start.
+* How often the cold-start wait REPORTS that it is still waiting. Task 0
+* live-measured cold-start (restream dial + hwaccel context + keyframe wait) at
+* 5-8s, so this must tolerate a slow-but-healthy start.
+*
+* It is no longer the point at which the session is abandoned — see
+* {@link DEFAULT_FIRST_FRAME_MAX_WAIT_MS}.
 */
 var DEFAULT_FIRST_FRAME_TIMEOUT_MS = 2e4;
+/**
+* Hard ceiling on the TOTAL wait for the FIRST frame of a dial.
+*
+* The first decodable frame is not a fixed cost: it is one IDR interval plus
+* every GOP the decoder has to discard. Measured on device 618 (2560x1440
+* h264, 8.0 s IDR interval, `Invalid NAL unit` / `corrupt decoded frame` in its
+* bitstream), dial → first decoded frame over the broker's own muted restream
+* was 1.8 / 6.5 / 7.0 / 7.2 / 9.2 / 10.0 / 10.8 / 12.9 / 14.9 / 20.0 / 30.3 /
+* >40 s across 12 trials — against a healthy 587's 2.0 s ± 0.02.
+*
+* Abandoning at 20 s was therefore not a timeout, it was a coin flip, and the
+* recovery made it worse: ending the session RE-DIALS, which throws the
+* accumulated wait away and re-pays the RTSP setup + probe from zero, and two
+* ends inside 60 s DETACH the camera. That loop cost 618 25.9% of its assigned
+* decode airtime in one day (325 of 1257 ten-second windows delivered nothing).
+*
+* The wait is bounded instead of deadlined: the worker keeps the outstanding
+* `pull` latched, so re-arming costs nothing but the wait, and the ceiling is
+* what stops a genuinely dead input from holding a spawn permit forever.
+*/
+var DEFAULT_FIRST_FRAME_MAX_WAIT_MS = 45e3;
 /** Default timeout for every `pull` round-trip AFTER the first frame arrives. */
 var DEFAULT_FRAME_TIMEOUT_MS = 1e4;
 /** Narrow an 'exit' payload to {@link WorkerExitInfo} (fakes may emit undefined). */
@@ -567,8 +591,10 @@ function toError(err) {
 var SessionDecodeSession = class {
 	child;
 	logger;
+	deviceId;
 	firstFrameTimeoutMs;
 	frameTimeoutMs;
+	firstFrameMaxWaitMs;
 	pendingPull = null;
 	pendingToBuffers = /* @__PURE__ */ new Map();
 	/** Outstanding `nativeCrop` requests, keyed by the monotonic `requestId`. */
@@ -580,11 +606,15 @@ var SessionDecodeSession = class {
 	sigkillTimer = null;
 	pullTimeoutTimer = null;
 	firstFrameReceived = false;
-	constructor(child, logger, firstFrameTimeoutMs, frameTimeoutMs) {
+	/** `Date.now()` of the FIRST `pull` — the origin of the cold-start ceiling. */
+	firstPullAt = 0;
+	constructor(child, logger, deviceId, firstFrameTimeoutMs, frameTimeoutMs, firstFrameMaxWaitMs) {
 		this.child = child;
 		this.logger = logger;
+		this.deviceId = deviceId;
 		this.firstFrameTimeoutMs = firstFrameTimeoutMs;
 		this.frameTimeoutMs = frameTimeoutMs;
+		this.firstFrameMaxWaitMs = firstFrameMaxWaitMs;
 		this.child.on("message", (m) => this.handleMessage(m));
 		this.child.on("exit", (m) => this.handleExit(toWorkerExitInfo(m)));
 	}
@@ -604,6 +634,7 @@ var SessionDecodeSession = class {
 	*/
 	pullNext() {
 		if (this.exited) return Promise.resolve({ kind: "ended" });
+		if (this.firstPullAt === 0) this.firstPullAt = Date.now();
 		return new Promise((resolve, reject) => {
 			this.pendingPull = {
 				resolve,
@@ -785,25 +816,63 @@ var SessionDecodeSession = class {
 	}
 	/**
 	* Fires when a `pull` round-trip outlives its liveness timeout — the child
-	* stopped producing frames WITHOUT exiting (a hung decode). Settles the
-	* outstanding pull as `ended` (not a throw) so the consumer's async
-	* generator resumes cleanly, runs its `finally`, and tears the child down
-	* via {@link teardown} — which sends `stop`, `kill()`s, and arms the 1s
-	* SIGKILL fallback.
+	* has not produced a frame and has not exited.
+	*
+	* BEFORE the first frame this is not yet a failure. The worker latches the
+	* outstanding `pull` (`decode-worker-child.handlePull` sets `pendingPull` and
+	* delivers on the next decoded frame), so re-arming the timer costs nothing
+	* but the wait and the session keeps the dial, the RTSP setup and the probe
+	* it has already paid for. Only the {@link firstFrameMaxWaitMs} ceiling ends
+	* it — see that constant for the measurement that set it.
+	*
+	* AFTER the first frame the deadline is unchanged: a steady stream that stops
+	* is a hung decode, and ending settles the outstanding pull as `ended` (not a
+	* throw) so the consumer's async generator resumes cleanly, runs its
+	* `finally`, and tears the child down via {@link teardown}.
+	*
+	* Every line here carries `tags: { deviceId }` and a `reason`, because
+	* "detaching" a camera is the loudest dropped work in this path and an
+	* operator has to be able to answer "why did 618 stop" from the logs alone.
 	*/
 	handlePullTimeout(timeoutMs) {
 		this.pullTimeoutTimer = null;
 		const waiter = this.pendingPull;
 		if (!waiter) return;
+		const waitedMs = this.firstPullAt === 0 ? timeoutMs : Date.now() - this.firstPullAt;
+		if (!this.firstFrameReceived && waitedMs < this.firstFrameMaxWaitMs) {
+			this.logger.warn("session-decode-coordinator: still waiting for its first decodable frame — holding the dial", {
+				tags: { deviceId: this.deviceId },
+				meta: {
+					waitedMs,
+					reportEveryMs: timeoutMs,
+					maxWaitMs: this.firstFrameMaxWaitMs,
+					hint: "long IDR interval or a discarded GOP looks exactly like this"
+				}
+			});
+			this.armPullTimeout();
+			return;
+		}
 		this.pendingPull = null;
-		this.logger.warn(`session-decode-coordinator: decode worker produced no frame within ${timeoutMs}ms — ending session`, { meta: {
-			timeoutMs,
-			firstFrameReceived: this.firstFrameReceived
-		} });
+		const reason = this.firstFrameReceived ? "stalled-after-first-frame" : "no-first-frame";
+		this.logger.warn(this.firstFrameReceived ? "session-decode-coordinator: gave up waiting for the next frame — ending session" : "session-decode-coordinator: gave up waiting for the first decodable frame — ending session", {
+			tags: { deviceId: this.deviceId },
+			meta: {
+				reason,
+				waitedMs,
+				timeoutMs,
+				...this.firstFrameReceived ? {} : { maxWaitMs: this.firstFrameMaxWaitMs }
+			}
+		});
 		waiter.resolve({ kind: "ended" });
 	}
+	/**
+	* Arm the next round-trip deadline. Before the first frame the timer is
+	* clamped to what is LEFT of the ceiling, so the give-up lands exactly on
+	* {@link firstFrameMaxWaitMs} instead of on the next report boundary past it
+	* — otherwise a 45 s ceiling reported every 20 s would really give up at 60 s.
+	*/
 	armPullTimeout() {
-		const timeoutMs = this.firstFrameReceived ? this.frameTimeoutMs : this.firstFrameTimeoutMs;
+		const timeoutMs = this.firstFrameReceived ? this.frameTimeoutMs : Math.max(1, Math.min(this.firstFrameTimeoutMs, this.firstFrameMaxWaitMs - (this.firstPullAt === 0 ? 0 : Date.now() - this.firstPullAt)));
 		this.pullTimeoutTimer = setTimeout(() => this.handlePullTimeout(timeoutMs), timeoutMs);
 		this.pullTimeoutTimer.unref?.();
 	}
@@ -925,8 +994,9 @@ function buildFrameImage(session, reply) {
 function createSessionDecodeCoordinator(deps) {
 	const firstFrameTimeoutMs = deps.firstFrameTimeoutMs ?? DEFAULT_FIRST_FRAME_TIMEOUT_MS;
 	const frameTimeoutMs = deps.frameTimeoutMs ?? DEFAULT_FRAME_TIMEOUT_MS;
+	const firstFrameMaxWaitMs = Math.max(deps.firstFrameMaxWaitMs ?? DEFAULT_FIRST_FRAME_MAX_WAIT_MS, firstFrameTimeoutMs);
 	return { async *generateVideoFrames(source, opts) {
-		const session = new SessionDecodeSession(deps.fork(source), deps.logger, firstFrameTimeoutMs, frameTimeoutMs);
+		const session = new SessionDecodeSession(deps.fork(source), deps.logger, source.deviceId, firstFrameTimeoutMs, frameTimeoutMs, firstFrameMaxWaitMs);
 		session.start(source, opts);
 		try {
 			while (true) {

package/dist/pipeline-runner/index.mjs

@@ -1,6 +1,6 @@
-import { $ as errMsg, A as deriveDetailCropRect, At as EventCategory, Ct as lazy, D as customAction, Et as object, H as pickNativeLeaseOverride, Ot as string, Tt as number, V as pickDetailCropConvention, W as pipelineRunnerCapability, at as BaseAddon, bt as array, k as defineCustomActions, l as DEVICE_BACKEND_TO_FORMAT, lt as createEvent, mt as nodePin, s as DEFAULT_DETAIL_CROP_CONVENTION, wt as literal, xt as boolean, yt as _enum } from "../dist-hRt5QB5i.mjs";
-import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-DUSB3ymZ.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-D_6eAFbv.mjs";
+import { A as defineCustomActions, Dt as object, Et as number, G as pipelineRunnerCapability, H as pickDetailCropConvention, O as customAction, St as boolean, Tt as literal, U as pickNativeLeaseOverride, bt as _enum, et as errMsg, ht as nodePin, j as deriveDetailCropRect, jt as EventCategory, kt as string, ot as BaseAddon, s as DEFAULT_DETAIL_CROP_CONVENTION, u as DEVICE_BACKEND_TO_FORMAT, ut as createEvent, wt as lazy, xt as array } from "../dist-gB3o0cyM.mjs";
+import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-PxIaVeyh.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-BhhX7J4-.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { n as profileForStreamId, t as isRemoteRestream } from "../remote-restream-BeHi78PZ.mjs";
@@ -536,11 +536,35 @@ function cropRgb(frame, bbox, maxWidth) {
 /** How long to wait after `kill()` before escalating to `kill('SIGKILL')`. */
 var SIGKILL_FALLBACK_MS = 1e3;
 /**
-* Default timeout for the `pull` round-trip preceding the FIRST delivered
-* frame. Task 0 live-measured cold-start (restream dial + hwaccel context +
-* keyframe wait) at 5-8s, so this must tolerate a slow-but-healthy start.
+* How often the cold-start wait REPORTS that it is still waiting. Task 0
+* live-measured cold-start (restream dial + hwaccel context + keyframe wait) at
+* 5-8s, so this must tolerate a slow-but-healthy start.
+*
+* It is no longer the point at which the session is abandoned — see
+* {@link DEFAULT_FIRST_FRAME_MAX_WAIT_MS}.
 */
 var DEFAULT_FIRST_FRAME_TIMEOUT_MS = 2e4;
+/**
+* Hard ceiling on the TOTAL wait for the FIRST frame of a dial.
+*
+* The first decodable frame is not a fixed cost: it is one IDR interval plus
+* every GOP the decoder has to discard. Measured on device 618 (2560x1440
+* h264, 8.0 s IDR interval, `Invalid NAL unit` / `corrupt decoded frame` in its
+* bitstream), dial → first decoded frame over the broker's own muted restream
+* was 1.8 / 6.5 / 7.0 / 7.2 / 9.2 / 10.0 / 10.8 / 12.9 / 14.9 / 20.0 / 30.3 /
+* >40 s across 12 trials — against a healthy 587's 2.0 s ± 0.02.
+*
+* Abandoning at 20 s was therefore not a timeout, it was a coin flip, and the
+* recovery made it worse: ending the session RE-DIALS, which throws the
+* accumulated wait away and re-pays the RTSP setup + probe from zero, and two
+* ends inside 60 s DETACH the camera. That loop cost 618 25.9% of its assigned
+* decode airtime in one day (325 of 1257 ten-second windows delivered nothing).
+*
+* The wait is bounded instead of deadlined: the worker keeps the outstanding
+* `pull` latched, so re-arming costs nothing but the wait, and the ceiling is
+* what stops a genuinely dead input from holding a spawn permit forever.
+*/
+var DEFAULT_FIRST_FRAME_MAX_WAIT_MS = 45e3;
 /** Default timeout for every `pull` round-trip AFTER the first frame arrives. */
 var DEFAULT_FRAME_TIMEOUT_MS = 1e4;
 /** Narrow an 'exit' payload to {@link WorkerExitInfo} (fakes may emit undefined). */
@@ -560,8 +584,10 @@ function toError(err) {
 var SessionDecodeSession = class {
 	child;
 	logger;
+	deviceId;
 	firstFrameTimeoutMs;
 	frameTimeoutMs;
+	firstFrameMaxWaitMs;
 	pendingPull = null;
 	pendingToBuffers = /* @__PURE__ */ new Map();
 	/** Outstanding `nativeCrop` requests, keyed by the monotonic `requestId`. */
@@ -573,11 +599,15 @@ var SessionDecodeSession = class {
 	sigkillTimer = null;
 	pullTimeoutTimer = null;
 	firstFrameReceived = false;
-	constructor(child, logger, firstFrameTimeoutMs, frameTimeoutMs) {
+	/** `Date.now()` of the FIRST `pull` — the origin of the cold-start ceiling. */
+	firstPullAt = 0;
+	constructor(child, logger, deviceId, firstFrameTimeoutMs, frameTimeoutMs, firstFrameMaxWaitMs) {
 		this.child = child;
 		this.logger = logger;
+		this.deviceId = deviceId;
 		this.firstFrameTimeoutMs = firstFrameTimeoutMs;
 		this.frameTimeoutMs = frameTimeoutMs;
+		this.firstFrameMaxWaitMs = firstFrameMaxWaitMs;
 		this.child.on("message", (m) => this.handleMessage(m));
 		this.child.on("exit", (m) => this.handleExit(toWorkerExitInfo(m)));
 	}
@@ -597,6 +627,7 @@ var SessionDecodeSession = class {
 	*/
 	pullNext() {
 		if (this.exited) return Promise.resolve({ kind: "ended" });
+		if (this.firstPullAt === 0) this.firstPullAt = Date.now();
 		return new Promise((resolve, reject) => {
 			this.pendingPull = {
 				resolve,
@@ -778,25 +809,63 @@ var SessionDecodeSession = class {
 	}
 	/**
 	* Fires when a `pull` round-trip outlives its liveness timeout — the child
-	* stopped producing frames WITHOUT exiting (a hung decode). Settles the
-	* outstanding pull as `ended` (not a throw) so the consumer's async
-	* generator resumes cleanly, runs its `finally`, and tears the child down
-	* via {@link teardown} — which sends `stop`, `kill()`s, and arms the 1s
-	* SIGKILL fallback.
+	* has not produced a frame and has not exited.
+	*
+	* BEFORE the first frame this is not yet a failure. The worker latches the
+	* outstanding `pull` (`decode-worker-child.handlePull` sets `pendingPull` and
+	* delivers on the next decoded frame), so re-arming the timer costs nothing
+	* but the wait and the session keeps the dial, the RTSP setup and the probe
+	* it has already paid for. Only the {@link firstFrameMaxWaitMs} ceiling ends
+	* it — see that constant for the measurement that set it.
+	*
+	* AFTER the first frame the deadline is unchanged: a steady stream that stops
+	* is a hung decode, and ending settles the outstanding pull as `ended` (not a
+	* throw) so the consumer's async generator resumes cleanly, runs its
+	* `finally`, and tears the child down via {@link teardown}.
+	*
+	* Every line here carries `tags: { deviceId }` and a `reason`, because
+	* "detaching" a camera is the loudest dropped work in this path and an
+	* operator has to be able to answer "why did 618 stop" from the logs alone.
 	*/
 	handlePullTimeout(timeoutMs) {
 		this.pullTimeoutTimer = null;
 		const waiter = this.pendingPull;
 		if (!waiter) return;
+		const waitedMs = this.firstPullAt === 0 ? timeoutMs : Date.now() - this.firstPullAt;
+		if (!this.firstFrameReceived && waitedMs < this.firstFrameMaxWaitMs) {
+			this.logger.warn("session-decode-coordinator: still waiting for its first decodable frame — holding the dial", {
+				tags: { deviceId: this.deviceId },
+				meta: {
+					waitedMs,
+					reportEveryMs: timeoutMs,
+					maxWaitMs: this.firstFrameMaxWaitMs,
+					hint: "long IDR interval or a discarded GOP looks exactly like this"
+				}
+			});
+			this.armPullTimeout();
+			return;
+		}
 		this.pendingPull = null;
-		this.logger.warn(`session-decode-coordinator: decode worker produced no frame within ${timeoutMs}ms — ending session`, { meta: {
-			timeoutMs,
-			firstFrameReceived: this.firstFrameReceived
-		} });
+		const reason = this.firstFrameReceived ? "stalled-after-first-frame" : "no-first-frame";
+		this.logger.warn(this.firstFrameReceived ? "session-decode-coordinator: gave up waiting for the next frame — ending session" : "session-decode-coordinator: gave up waiting for the first decodable frame — ending session", {
+			tags: { deviceId: this.deviceId },
+			meta: {
+				reason,
+				waitedMs,
+				timeoutMs,
+				...this.firstFrameReceived ? {} : { maxWaitMs: this.firstFrameMaxWaitMs }
+			}
+		});
 		waiter.resolve({ kind: "ended" });
 	}
+	/**
+	* Arm the next round-trip deadline. Before the first frame the timer is
+	* clamped to what is LEFT of the ceiling, so the give-up lands exactly on
+	* {@link firstFrameMaxWaitMs} instead of on the next report boundary past it
+	* — otherwise a 45 s ceiling reported every 20 s would really give up at 60 s.
+	*/
 	armPullTimeout() {
-		const timeoutMs = this.firstFrameReceived ? this.frameTimeoutMs : this.firstFrameTimeoutMs;
+		const timeoutMs = this.firstFrameReceived ? this.frameTimeoutMs : Math.max(1, Math.min(this.firstFrameTimeoutMs, this.firstFrameMaxWaitMs - (this.firstPullAt === 0 ? 0 : Date.now() - this.firstPullAt)));
 		this.pullTimeoutTimer = setTimeout(() => this.handlePullTimeout(timeoutMs), timeoutMs);
 		this.pullTimeoutTimer.unref?.();
 	}
@@ -918,8 +987,9 @@ function buildFrameImage(session, reply) {
 function createSessionDecodeCoordinator(deps) {
 	const firstFrameTimeoutMs = deps.firstFrameTimeoutMs ?? DEFAULT_FIRST_FRAME_TIMEOUT_MS;
 	const frameTimeoutMs = deps.frameTimeoutMs ?? DEFAULT_FRAME_TIMEOUT_MS;
+	const firstFrameMaxWaitMs = Math.max(deps.firstFrameMaxWaitMs ?? DEFAULT_FIRST_FRAME_MAX_WAIT_MS, firstFrameTimeoutMs);
 	return { async *generateVideoFrames(source, opts) {
-		const session = new SessionDecodeSession(deps.fork(source), deps.logger, firstFrameTimeoutMs, frameTimeoutMs);
+		const session = new SessionDecodeSession(deps.fork(source), deps.logger, source.deviceId, firstFrameTimeoutMs, frameTimeoutMs, firstFrameMaxWaitMs);
 		session.start(source, opts);
 		try {
 			while (true) {

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-Ci2-N-XC.js");
+const require_dist = require("../dist-CzFJeiG1.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_addon_utils = require("../addon-utils-DveoBR6G.js");
 let node_crypto = require("node:crypto");
@@ -3489,12 +3489,56 @@ function activeBandAt(config, date) {
 //#endregion
 //#region src/recorder/addon/band-decision.ts
 /**
+* Pure glue between a device's `RecordingConfig` and the v2 band engine: decide
+* whether recording should currently be running, and which finalized segments
+* an `events` band retains.
+*
+* The decision is enabled AND the band active at `now` (per the v2
+* `activeBandAt`/`bandActiveAt`) demands recording: a `continuous` band always
+* demands; an `events` band demands only within `postBufferSec` of a qualifying
+* trigger (B3). No bands / disabled => not recording.
+*
+* `preBufferSec` is retroactive — it is NOT a live-demand input; it retains
+* already-recorded segments BEFORE a trigger at keep/discard time
+* ({@link segmentRetainedForEvents}). This mirrors the old recorder's proven
+* policy split (start-on-trigger live gate + retroactive pre-buffer keep).
+*
+* Kept pure (clock + trigger state injected) so the attach/detach decision is
+* unit-testable without ffmpeg, the broker, the event bus, or a real wall clock.
+*/
+/**
+* THE one place a band's pre/post buffers are read. An ABSENT field takes
+* {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an explicit value — including `0` —
+* is honoured verbatim.
+*
+* Both callers below used to inline `?? 0`, which read "the operator omitted the
+* field" as "the operator asked for a zero-length window". For the live gate
+* that is not a policy, it is an impossibility: nothing can ever be recorded.
+* Two cameras sat in exactly that state.
+*/
+function resolveBandBufferMs(band) {
+	return {
+		preMs: (band.preBufferSec ?? require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.preBufferSec) * 1e3,
+		postMs: (band.postBufferSec ?? require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec) * 1e3
+	};
+}
+/**
+* Can this band EVER open a live recording window? False for an `events` band
+* whose resolved post-buffer is zero (only reachable by authoring an explicit
+* `0`) or which lists no trigger at all: both are "enabled, and records nothing,
+* forever". The recorder warns on it rather than dropping the device silently.
+*/
+function eventsBandCanEverDemand(band) {
+	if (band.mode !== "events") return true;
+	return (band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0) && resolveBandBufferMs(band).postMs > 0;
+}
+/**
 * Is an `events` band's live demand window open at `atMs`? True iff a trigger
 * the band listens for fired within `postBufferSec` of now. `preBufferSec` is
 * deliberately NOT consulted here (see file header).
 */
 function eventsBandDemanded(band, triggers, atMs) {
-	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const { postMs } = resolveBandBufferMs(band);
 	const fresh = (lastMs) => lastMs != null && atMs - lastMs <= postMs;
 	if (band.triggers?.motion && fresh(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && fresh(triggers.lastAudioMs)) return true;
@@ -3521,8 +3565,7 @@ function shouldRecordAt(config, triggers, at) {
 * This is where `preBufferSec` retroactively retains pre-trigger footage.
 */
 function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
-	const preMs = (band.preBufferSec ?? 0) * 1e3;
-	const postMs = (band.postBufferSec ?? 0) * 1e3;
+	const { preMs, postMs } = resolveBandBufferMs(band);
 	const overlaps = (lastMs) => lastMs != null && segStartMs <= lastMs + postMs && segEndMs >= lastMs - preMs;
 	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
@@ -4055,6 +4098,12 @@ var RecordingController = class {
 	* alive, which is the only question here.
 	*/
 	lastSegmentAt = /* @__PURE__ */ new Map();
+	/**
+	* Devices already named by {@link reportUnrecordable} — one warn per device
+	* per "enabled but can never record" episode, re-armed as soon as the device
+	* records again.
+	*/
+	unrecordableReported = /* @__PURE__ */ new Set();
 	restore = null;
 	tickTimer = null;
 	stopped = false;
@@ -4231,10 +4280,12 @@ var RecordingController = class {
 		if (this.stopped) return;
 		const config = await this.deps.loadConfig(deviceId);
 		if (!shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()))) {
+			this.reportUnrecordable(deviceId, config);
 			await this.detachDevice(deviceId);
 			this.restore?.remove(deviceId);
 			return;
 		}
+		this.unrecordableReported.delete(deviceId);
 		if (this.active.has(deviceId)) return;
 		if (this.attaching.has(deviceId)) return;
 		this.attaching.add(deviceId);
@@ -4245,6 +4296,42 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Name the `!wantRecording` drop when the device is ENABLED but its config can
+	* never produce footage — the branch that hid this bug. Two shapes qualify,
+	* and both mean "the operator asked for recording and will get none, forever":
+	* an enabled config with no bands at all, and an `events` band that cannot
+	* open a live window (no trigger listed, or an explicit `postBufferSec: 0`).
+	*
+	* NOT reported: a band that simply does not cover `now` (a night-only band at
+	* noon), or an events band waiting for its next trigger. Those are the
+	* feature working.
+	*
+	* One line per device until it records again ({@link unrecordableReported} is
+	* cleared the moment `wantRecording` turns true), so the 30 s tick cannot turn
+	* this into a log flood.
+	*/
+	reportUnrecordable(deviceId, config) {
+		if (!config.enabled) return;
+		if (this.unrecordableReported.has(deviceId)) return;
+		const bands = config.bands ?? [];
+		if (bands.length === 0) {
+			this.unrecordableReported.add(deviceId);
+			this.deps.logger.warn("recorder: device is enabled but has no recording bands — nothing will ever be recorded", { tags: { deviceId } });
+			return;
+		}
+		const band = activeBandAt({ bands }, new Date(this.now()));
+		if (band === null || eventsBandCanEverDemand(band)) return;
+		this.unrecordableReported.add(deviceId);
+		this.deps.logger.warn("recorder: events band can never open a recording window — nothing will ever be recorded", {
+			tags: { deviceId },
+			meta: {
+				postBufferSec: band.postBufferSec,
+				triggers: band.triggers,
+				reason: band.triggers?.motion === true || band.triggers?.audioThresholdDbfs !== void 0 ? "postBufferSec is 0" : "no trigger configured"
+			}
+		});
+	}
+	/**
 	* The attach body — extracted so the {@link attaching} in-flight guard in
 	* `evaluateDevice` wraps it cleanly. Resolves the profiles, spawns a
 	* SegmentWriter + watcher per profile, and records the set in `active`. A throw