@camstack/addon-pipeline 1.2.6 → 1.2.8

package/dist/recorder/index.mjs

@@ -1,11 +1,10 @@
-import { F as recordingExportCapability, H as errMsg, I as resolveScrubThumbnailGeometry, J as hydrateSchema, K as DeviceType, P as recordingCapability, R as storageEvictableCapability, U as BaseAddon, Y as isEvent, c as EVENT_PAD_MS, dt as string, et as selectAssignedProfileSlots, f as OpsLogEntrySchema, j as nodePin, k as migrateConfigToBands, p as RecordingConfigSchema, pt as EventCategory, rt as array, u as ExportRecordSchema, ut as record } from "../dist-Bw_V5L0r.mjs";
-import { n as computeSheetGeometry, r as resolveHubHostname, t as allTilePlacements } from "../sheet-geometry-DcpuGTCm.mjs";
-import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../model-download-service-Cp9f4dk6-CwUb5v3Y.mjs";
+import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../model-download-service-Cp9f4dk6-WO-foD7W.mjs";
+import { $ as selectAssignedProfileSlots, F as recordingExportCapability, G as DeviceType, H as BaseAddon, L as storageEvictableCapability, P as recordingCapability, V as errMsg, c as EVENT_PAD_MS, f as OpsLogEntrySchema, ft as EventCategory, j as nodePin, k as migrateConfigToBands, lt as record, nt as array, p as RecordingConfigSchema, q as hydrateSchema, u as ExportRecordSchema, ut as string } from "../dist-owmpaeIY.mjs";
+import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
+import { t as extractKeyframes } from "../fmp4-keyframes-qOgJBjMO.mjs";
 import { spawn } from "node:child_process";
-import sharp from "sharp";
-import { createReadStream, promises } from "node:fs";
+import { createReadStream, promises, realpathSync } from "node:fs";
 import path from "node:path";
-import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
 //#region src/recorder/segment-path.ts
 function segmentRelPath(deviceId, profile, startMs, durMs, bytes) {
@@ -141,6 +140,43 @@ var RecordingIndex = class {
 		for (const m of this.byDevice.values()) for (const s of m.values()) if (s.locationId === locationId) out.push(s);
 		return out.toSorted((a, b) => a.startMs - b.startMs);
 	}
+	/**
+	* All segments across a SET of storage locations (one eviction DOMAIN — the
+	* locations that alias one physical filesystem root), oldest-first across the
+	* whole pool. This is the correct unit for byte-eviction: two location ids over
+	* the same disk must be reclaimed as ONE oldest-first stream, never partitioned.
+	*/
+	segmentsOnLocations(locationIds) {
+		const out = [];
+		for (const m of this.byDevice.values()) for (const s of m.values()) if (locationIds.has(s.locationId)) out.push(s);
+		return out.toSorted((a, b) => a.startMs - b.startMs);
+	}
+	/** Aggregate accounting across a SET of storage locations (one eviction domain). */
+	accountingForLocations(locationIds) {
+		let bytes = 0;
+		let count = 0;
+		let oldestMs = Infinity;
+		let newestMs = -Infinity;
+		for (const m of this.byDevice.values()) for (const s of m.values()) {
+			if (!locationIds.has(s.locationId)) continue;
+			bytes += s.bytes;
+			count += 1;
+			if (s.startMs < oldestMs) oldestMs = s.startMs;
+			if (s.startMs > newestMs) newestMs = s.startMs;
+		}
+		if (count === 0) return {
+			bytes: 0,
+			count: 0,
+			oldestMs: null,
+			newestMs: null
+		};
+		return {
+			bytes,
+			count,
+			oldestMs,
+			newestMs
+		};
+	}
 	/** Aggregate accounting for a storage location across every device. */
 	accountingForLocation(locationId) {
 		let bytes = 0;
@@ -413,18 +449,60 @@ var StorageEvictableProvider = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/** The eviction domain of `locationId` — aliases sharing its disk, else itself. */
+	domainOf(locationId) {
+		return this.deps.resolveDomain?.(locationId) ?? new Set([locationId]);
+	}
 	async getEvictableUsage(input) {
-		return { bytes: this.deps.index.accountingForLocation(input.locationId).bytes };
+		return { bytes: this.deps.index.accountingForLocations(this.domainOf(input.locationId)).bytes };
 	}
 	async evict(input) {
-		const onLocation = this.deps.index.segmentsOnLocation(input.locationId);
-		const victims = selectEvictionsByBytes(onLocation, input.targetBytes);
+		const onDomain = this.deps.index.segmentsOnLocations(this.domainOf(input.locationId));
+		const victims = selectEvictionsByBytes(onDomain, input.targetBytes);
+		const byLocation = /* @__PURE__ */ new Map();
+		for (const v of victims) {
+			const group = byLocation.get(v.locationId);
+			if (group) group.push(v);
+			else byLocation.set(v.locationId, [v]);
+		}
+		let reclaimedBytes = 0;
+		for (const [locationId, rows] of byLocation) reclaimedBytes += await this.deps.store.evict(locationId, rows);
+		if (reclaimedBytes > 0 && this.deps.onEvicted) this.deps.onEvicted(summarizeEvictionsByDevice(victims));
+		const exhausted = victims.length >= onDomain.length;
 		return {
-			reclaimedBytes: await this.deps.store.evict(input.locationId, victims),
-			exhausted: victims.length >= onLocation.length
+			reclaimedBytes,
+			exhausted
 		};
 	}
 };
+/** Group an eviction round's victims into per-(device, location) summaries (bytes
+* come from the pre-delete selection — partial delete failures may overstate
+* slightly). A domain round can span aliased locations, so each victim is bucketed
+* by its OWN `locationId` (not a single round-level location). */
+function summarizeEvictionsByDevice(victims) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const v of victims) {
+		const key = `${v.deviceId}${v.locationId}`;
+		const cur = byKey.get(key);
+		if (cur === void 0) byKey.set(key, {
+			deviceId: v.deviceId,
+			locationId: v.locationId,
+			segments: 1,
+			bytes: v.bytes,
+			fromMs: v.startMs,
+			toMs: v.startMs + v.durMs
+		});
+		else byKey.set(key, {
+			deviceId: v.deviceId,
+			locationId: v.locationId,
+			segments: cur.segments + 1,
+			bytes: cur.bytes + v.bytes,
+			fromMs: Math.min(cur.fromMs, v.startMs),
+			toMs: Math.max(cur.toMs, v.startMs + v.durMs)
+		});
+	}
+	return [...byKey.values()];
+}
 //#endregion
 //#region src/recorder/redundant-segments.ts
 /**
@@ -1692,6 +1770,18 @@ async function markDownloaded(id, now, deps, scheduleDelete, graceMs) {
 /** The two recordings location types the recorder addon writes/reads. */
 var RECORDING_LOCATION_TYPES = new Set(["recordings", "recordingsLow"]);
 /**
+* Route a recording profile to its storage location by the location's declared
+* `type`: the `low` profile prefers the `recordingsLow` location, every other
+* profile the `recordings` location. Falls back to the first resolved location
+* when the preferred type is absent (both types alias one disk today, so the
+* split is free-and-future-proof). Throws when no locations resolved.
+*/
+function resolvePlacement(locations, profile) {
+	if (locations.length === 0) throw new Error("recorder controller: no recordings storage locations resolved");
+	const preferType = profile === "low" ? "recordingsLow" : "recordings";
+	return locations.find((l) => l.type === preferType) ?? locations[0];
+}
+/**
 * Resolve every recordings storage location (`recordings` + `recordingsLow`)
 * to `{ id, root }`. Returns an empty list when the storage cap is unreachable
 * or no recordings location exists — callers degrade rather than crash.
@@ -1701,6 +1791,7 @@ async function resolveRecordingsLocations(api, logger) {
 		const recordings = (await api.storage.listLocations.query({})).filter((l) => RECORDING_LOCATION_TYPES.has(l.type));
 		return Promise.all(recordings.map(async (l) => ({
 			id: l.id,
+			type: l.type,
 			root: await api.storage.resolve.query({
 				location: l.id,
 				relativePath: ""
@@ -1740,6 +1831,54 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 	}
 }
 //#endregion
+//#region src/recorder/addon/eviction-domain.ts
+/**
+* Eviction-DOMAIN resolution for recordings locations.
+*
+* Recordings locations are operator-configurable and MAY alias one physical
+* filesystem root: today `recordings:default` + `recordingsLow:default` both
+* resolve to `/recordings`, but an operator could also point two locations at a
+* symlink or bind-mount of the same disk. Locations sharing a physical root
+* MUST evict as one oldest-first pool — otherwise disk-pressure relief on one
+* alias deletes the newest footage while the other alias still holds the old
+* (the age-partition data-loss bug).
+*
+* The domain key is the location root's PHYSICAL identity: `fs.realpathSync` of
+* the lexically-resolved path, which collapses symlinks and `.`/`..` so aliases
+* reaching one disk share a key — a plain `path.resolve` string compare would
+* miss a symlinked/bind-aliased path and silently re-introduce the partition.
+* When realpath THROWS (the root is missing at boot — a disk not yet mounted)
+* we fall back to the lexically-resolved path string: distinct-but-unmounted
+* roots then stay distinct domains. That fallback can only ever OVER-partition
+* (treat one disk as two), never MERGE two different disks — the safe failure
+* mode for a data-loss guard.
+*/
+/**
+* The physical-device key of a location root: `realpath` of the resolved path,
+* or the resolved path string itself when realpath throws (root missing).
+*/
+function physicalRootKey(root, realpath = realpathSync) {
+	const resolved = path.resolve(root);
+	try {
+		return realpath(resolved);
+	} catch {
+		return resolved;
+	}
+}
+/**
+* The eviction DOMAIN of `locationId`: the set of location ids (INCLUDING
+* itself) whose roots share `locationId`'s physical root key. An unknown
+* `locationId` (not present in `locations`) is its own singleton domain.
+*/
+function resolveEvictionDomain(locations, locationId, realpath = realpathSync) {
+	const self = locations.find((l) => l.id === locationId);
+	if (!self) return new Set([locationId]);
+	const selfKey = physicalRootKey(self.root, realpath);
+	const domain = new Set([locationId]);
+	for (const l of locations) if (physicalRootKey(l.root, realpath) === selfKey) domain.add(l.id);
+	return domain;
+}
+//#endregion
 //#region src/recorder/band-engine.ts
 function toMin(hhmm) {
 	const [h, m] = hhmm.split(":");
@@ -2521,16 +2660,13 @@ var RecordingController = class {
 		}
 	}
 	/**
-	* Resolve the storage location a profile writes to: `low` → the recordingsLow
-	* location when present, every other profile → the recordings location. Falls
-	* back to the first resolved location when the preferred type is absent — both
-	* types resolve to the same path today, so the split is free-and-future-proof.
+	* Resolve the storage location a profile writes to. Delegates to the pure
+	* `resolvePlacement` in `roots.ts`, which matches on the location's declared
+	* `type` (`recordings` / `recordingsLow`) rather than its `<type>:<instance>`
+	* id — so `low` correctly routes to `recordingsLow`.
 	*/
 	resolvePlacement(profile) {
-		const locations = this.deps.locations();
-		if (locations.length === 0) throw new Error("recorder controller: no recordings storage locations resolved");
-		const preferLow = profile === "low";
-		return locations.find((l) => preferLow ? l.id === "recordingsLow" : l.id === "recordings") ?? locations[0];
+		return resolvePlacement(this.deps.locations(), profile);
 	}
 	/** Stop one profile's writer + watcher and release its broker lease. */
 	async teardownProfile(deviceId, r) {
@@ -2603,8 +2739,8 @@ function makeBrokerCall(handle) {
 * sweeper only decides WHICH devices to prune and WHEN).
 *
 * Owns its own timer + single-flight guard so a slow sweep is never overlapped
-* by the next tick — the same subsystem-owns-its-timer shape as
-* `ThumbnailService`. Pure over injected deps (config read + prune + logger +
+* by the next tick — the same subsystem-owns-its-timer shape as the
+* scrub-pack prune. Pure over injected deps (config read + prune + logger +
 * clock via `setInterval`), so it is unit-testable with fake timers and a mock
 * `prune`. Every pass is best-effort: a per-device prune failure is logged and
 * never aborts the rest, and the sweep never throws.
@@ -2720,943 +2856,324 @@ var RetentionSweeper = class {
 */
 var resolveRecordingHubHostname = resolveHubHostname;
 //#endregion
-//#region src/thumbnails/thumb-index.ts
-/**
-* Build the index + geometry for a window's samples. Samples are sorted by
-* capture time; each gets a row-major placement. Throws when there are no
-* samples (an empty window is never written).
-*/
-function buildThumbnailIndex(input) {
-	if (input.samples.length === 0) throw new Error("buildThumbnailIndex: no samples");
-	const tileWidth = input.tileWidth ?? 480;
-	const tileHeight = input.tileHeight ?? 270;
-	const maxCols = input.maxCols ?? 10;
-	const ordered = [...input.samples].sort((a, b) => a.t - b.t);
-	const geometry = computeSheetGeometry(ordered.length, {
-		tileWidth,
-		tileHeight,
-		maxCols
-	});
-	const placements = allTilePlacements(ordered.length, geometry);
-	const tiles = ordered.map((s, i) => {
-		const p = placements[i];
-		return {
-			t: s.t,
-			x: p.x,
-			y: p.y
-		};
-	});
+//#region src/recorder/scrub/scrub-pack-format.ts
+function encodeScrubPack(header, samples) {
+	const frames = [];
+	let offset = 0;
+	for (const s of samples) {
+		frames.push({
+			ts: s.ts,
+			offset,
+			size: s.data.byteLength
+		});
+		offset += s.data.byteLength;
+	}
+	const full = {
+		v: 1,
+		codec: header.codec,
+		description: header.description,
+		frames
+	};
+	const headerBytes = new TextEncoder().encode(JSON.stringify(full));
+	const out = new Uint8Array(4 + headerBytes.byteLength + offset);
+	new DataView(out.buffer).setUint32(0, headerBytes.byteLength, true);
+	out.set(headerBytes, 4);
+	let cursor = 4 + headerBytes.byteLength;
+	for (const s of samples) {
+		out.set(s.data, cursor);
+		cursor += s.data.byteLength;
+	}
+	return out;
+}
+function decodeScrubPackHeader(buf) {
+	if (buf.byteLength < 4) throw new Error("scrub pack: truncated (no length prefix)");
+	const headerLen = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(0, true);
+	if (headerLen <= 0 || 4 + headerLen > buf.byteLength) throw new Error(`scrub pack: bogus header length ${headerLen}`);
+	const json = new TextDecoder().decode(buf.subarray(4, 4 + headerLen));
+	const header = JSON.parse(json);
+	if (header.v !== 1) throw new Error(`scrub pack: unsupported version ${String(header.v)}`);
+	if (!Array.isArray(header.frames)) throw new Error("scrub pack: malformed header (frames)");
 	return {
-		index: {
-			version: 1,
-			deviceId: input.deviceId,
-			windowStartMs: input.windowStartMs,
-			windowMs: input.windowMs,
-			intervalMs: input.intervalMs,
-			tileWidth,
-			tileHeight,
-			cols: geometry.cols,
-			rows: geometry.rows,
-			sheet: `sheet-${input.windowStartMs}.jpg`,
-			source: input.source,
-			tiles
-		},
-		geometry,
-		orderedSamples: ordered
+		header,
+		payloadOffset: 4 + headerLen
 	};
 }
 //#endregion
-//#region src/thumbnails/thumb-window.ts
-/**
-* Thumbnail window + on-disk path math — pure, UTC-aligned, deterministic.
-*
-* A thumbnail "window" is a fixed UTC-aligned span (default 5 min). Every
-* timestamp maps to exactly one window; the window start, its UTC bucket
-* (Y/M/D/H like the segment store), and the sheet/index filenames are all
-* derived from it with NO state — so the recorder writes and the viewer reads
-* the SAME deterministic path from a bare timestamp (no directory listing, no
-* cap round-trip).
-*/
-/** Default window span — 5 minutes. */
-var DEFAULT_WINDOW_MS = 3e5;
-/** Zero-padded 2-digit. */
-function p2(n) {
-	return String(n).padStart(2, "0");
+//#region src/recorder/scrub/scrub-pack-service.ts
+var SCRUB_WINDOW_MS = 6e4;
+function utcDay(ms) {
+	return new Date(ms).toISOString().slice(0, 10);
 }
-/** UTC-aligned window start (epoch ms) containing `t`. */
-function windowStartFor(t, windowMs = DEFAULT_WINDOW_MS) {
-	if (!Number.isFinite(t)) throw new Error(`windowStartFor: t must be finite, got ${t}`);
-	if (!(windowMs > 0)) throw new Error(`windowStartFor: windowMs must be > 0, got ${windowMs}`);
-	return Math.floor(t / windowMs) * windowMs;
-}
-/** UTC `Y/M/D/H` bucket dir (relative) for a window start — mirrors
-*  `segmentRelPath`'s bucketing so thumbs co-locate with the same hour tree. */
-function bucketDir(windowStartMs) {
-	const d = new Date(windowStartMs);
-	return `${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
-}
-/** Sheet image filename for a window start. */
-function sheetFileName(windowStartMs) {
-	return `sheet-${windowStartMs}.jpg`;
-}
-/** Index sidecar filename for a window start. */
-function indexFileName(windowStartMs) {
-	return `index-${windowStartMs}.json`;
-}
-/**
-* Device-relative directory (under the thumbs root) for a window:
-* `<deviceId>/<Y>/<M>/<D>/<H>`. The device is the top segment (thumbs are
-* profile-agnostic, unlike segments which nest under a profile).
-*/
-function windowRelDir(deviceId, windowStartMs) {
-	return `${deviceId}/${bucketDir(windowStartMs)}`;
-}
-//#endregion
-//#region src/thumbnails/thumbnail-sink.ts
-var ThumbnailSink = class {
+var ScrubPackService = class {
 	deps;
-	now;
-	open = /* @__PURE__ */ new Map();
-	lastFlushed = /* @__PURE__ */ new Map();
-	/** In-flight flush promises per device — chained so a device never composes
-	*  two windows concurrently (ordering + bounded work). */
-	flushChain = /* @__PURE__ */ new Map();
+	inflight = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
-		this.now = deps.now ?? (() => Date.now());
-	}
-	/** Accept a sampled thumb. Rolls over (flushes) the device's open window when
-	*  a strictly-later window's sample arrives. */
-	add(deviceId, sample) {
-		const windowStartMs = windowStartFor(sample.capturedAt, this.deps.windowMs);
-		const lastFlushed = this.lastFlushed.get(deviceId);
-		if (lastFlushed !== void 0 && windowStartMs <= lastFlushed) return;
-		let cur = this.open.get(deviceId);
-		if (cur && windowStartMs > cur.windowStartMs) {
-			this.scheduleFlush(deviceId, cur);
-			this.open.delete(deviceId);
-			cur = void 0;
-		}
-		if (cur && windowStartMs < cur.windowStartMs) return;
-		if (!cur) {
-			cur = {
-				windowStartMs,
-				samples: []
-			};
-			this.open.set(deviceId, cur);
-		}
-		if (cur.samples.length < this.deps.maxTilesPerWindow) cur.samples.push(sample);
-	}
-	/** Flush every open window whose end + grace has passed (idle cameras). */
-	flushExpired() {
-		const now = this.now();
-		for (const [deviceId, win] of [...this.open]) if (now - (win.windowStartMs + this.deps.windowMs) >= this.deps.idleGraceMs) {
-			this.scheduleFlush(deviceId, win);
-			this.open.delete(deviceId);
-		}
 	}
-	/** Flush all open windows (shutdown). Returns when every flush settles. */
-	async flushAll() {
-		for (const [deviceId, win] of [...this.open]) {
-			this.scheduleFlush(deviceId, win);
-			this.open.delete(deviceId);
+	async getOrBuild(deviceId, windowStartMs) {
+		const key = `${deviceId}/${windowStartMs}`;
+		const pending = this.inflight.get(key);
+		if (pending) return pending;
+		const run = this.getOrBuildInner(deviceId, windowStartMs).finally(() => this.inflight.delete(key));
+		this.inflight.set(key, run);
+		return run;
+	}
+	cachePath(deviceId, windowStartMs) {
+		return path.join(this.deps.cacheDir, String(deviceId), utcDay(windowStartMs), `${windowStartMs}.pack`);
+	}
+	async getOrBuildInner(deviceId, windowStartMs) {
+		const now = (this.deps.now ?? Date.now)();
+		const immutable = windowStartMs + SCRUB_WINDOW_MS < now;
+		const cacheFile = this.cachePath(deviceId, windowStartMs);
+		if (immutable) try {
+			const cached = new Uint8Array(await promises.readFile(cacheFile));
+			try {
+				decodeScrubPackHeader(cached);
+			} catch {
+				this.deps.logger.debug("scrub pack: corrupt cache — rebuilding", { meta: { cacheFile } });
+				await promises.rm(cacheFile, { force: true }).catch(() => {});
+				throw new Error("corrupt cache");
+			}
+			return {
+				pack: cached,
+				immutable
+			};
+		} catch {}
+		const end = windowStartMs + SCRUB_WINDOW_MS;
+		const rows = this.deps.listLowSegments(deviceId).filter((r) => r.startMs < end && r.startMs + r.durMs > windowStartMs).sort((a, b) => a.startMs - b.startMs);
+		if (rows.length === 0) return null;
+		let codec = null;
+		let description = null;
+		const samples = [];
+		for (const row of rows) {
+			let bytes;
+			try {
+				bytes = await this.deps.readSegmentBytes(row);
+			} catch (err) {
+				this.deps.logger.debug("scrub pack: segment read failed — skipping", { meta: {
+					relPath: row.path,
+					error: String(err)
+				} });
+				continue;
+			}
+			const extracted = await extractKeyframes(bytes, row.startMs);
+			if (!extracted) continue;
+			if (codec === null) {
+				codec = extracted.codec;
+				description = extracted.description;
+			} else if (extracted.codec !== codec) {
+				this.deps.logger.warn("scrub pack: mid-window codec change — dropping segment", { meta: {
+					relPath: row.path,
+					expected: codec,
+					got: extracted.codec
+				} });
+				continue;
+			}
+			for (const k of extracted.keyframes) if (k.ts >= windowStartMs && k.ts < end) samples.push(k);
+		}
+		if (codec === null || description === null || samples.length === 0) return null;
+		samples.sort((a, b) => a.ts - b.ts);
+		const pack = encodeScrubPack({
+			codec,
+			description: Buffer.from(description).toString("base64")
+		}, samples);
+		if (immutable) try {
+			await promises.mkdir(path.dirname(cacheFile), { recursive: true });
+			const tmpFile = `${cacheFile}.tmp`;
+			await promises.writeFile(tmpFile, pack);
+			await promises.rename(tmpFile, cacheFile);
+		} catch (err) {
+			this.deps.logger.debug("scrub pack: cache write failed (serving anyway)", { meta: {
+				cacheFile,
+				error: String(err)
+			} });
 		}
-		await Promise.all([...this.flushChain.values()]);
-	}
-	/** Test/diagnostic: number of open windows. */
-	get openWindowCount() {
-		return this.open.size;
-	}
-	scheduleFlush(deviceId, win) {
-		const next = (this.flushChain.get(deviceId) ?? Promise.resolve()).then(() => this.doFlush(deviceId, win)).catch((err) => {
-			this.deps.logger.warn("thumbnail sink: window flush failed", {
-				tags: { deviceId },
-				meta: {
-					windowStartMs: win.windowStartMs,
-					error: err instanceof Error ? err.message : err
-				}
-			});
-		});
-		this.flushChain.set(deviceId, next);
-		this.lastFlushed.set(deviceId, Math.max(this.lastFlushed.get(deviceId) ?? -1, win.windowStartMs));
-	}
-	async doFlush(deviceId, win) {
-		if (win.samples.length === 0) return;
-		const preset = await this.deps.resolvePreset(deviceId);
-		const ordered = [...win.samples].sort((a, b) => a.capturedAt - b.capturedAt);
-		const built = buildThumbnailIndex({
-			deviceId,
-			windowStartMs: win.windowStartMs,
-			windowMs: this.deps.windowMs,
-			intervalMs: this.deps.intervalMs,
-			source: this.deps.source,
-			tileWidth: preset.tileWidth,
-			tileHeight: preset.tileHeight,
-			maxCols: this.deps.maxCols,
-			samples: ordered.map((s) => ({ t: s.capturedAt }))
-		});
-		const placements = allTilePlacements(ordered.length, built.geometry);
-		const sheetBytes = await this.deps.compose({
-			tiles: ordered.map((s) => s.jpeg),
-			placements,
-			geometry: built.geometry,
-			quality: preset.quality
-		});
-		await this.deps.persist({
-			deviceId,
-			windowStartMs: win.windowStartMs,
-			relDir: windowRelDir(deviceId, win.windowStartMs),
-			sheetName: sheetFileName(win.windowStartMs),
-			sheetBytes,
-			indexName: indexFileName(win.windowStartMs),
-			index: built.index
-		});
-	}
-};
-//#endregion
-//#region src/thumbnails/sheet-composer.ts
-/**
-* Resize each tile to the uniform tile size and composite onto a black canvas
-* at its placement. Returns the sheet JPEG bytes. Throws if tiles/placements
-* lengths disagree.
-*/
-async function composeSheet(sharp, input) {
-	const { tiles, placements, geometry } = input;
-	if (tiles.length !== placements.length) throw new Error(`composeSheet: tiles(${tiles.length}) != placements(${placements.length})`);
-	if (tiles.length === 0) throw new Error("composeSheet: no tiles");
-	const entries = (await Promise.all(tiles.map((t) => sharp(t).resize(geometry.tileWidth, geometry.tileHeight, {
-		fit: "cover",
-		position: "centre"
-	}).jpeg({ quality: input.quality ?? 72 }).toBuffer()))).map((buf, i) => {
-		const p = placements[i];
 		return {
-			input: buf,
-			left: p.x,
-			top: p.y
+			pack,
+			immutable
 		};
-	});
-	return sharp({ create: {
-		width: geometry.sheetWidth,
-		height: geometry.sheetHeight,
-		channels: 3,
-		background: {
-			r: 0,
-			g: 0,
-			b: 0
-		}
-	} }).composite(entries).jpeg({ quality: input.quality ?? 72 }).toBuffer();
-}
-//#endregion
-//#region src/thumbnails/thumbnail-persister.ts
-/**
-* Thumbnail disk persister — writes a window's sheet JPEG + index JSON
-* write-once under `<thumbsRoot>/<dev>/Y/M/D/H/`. Small fs wrapper the recorder
-* wires with a real root; kept separate so the sink stays fs-free and testable.
-*/
-/** Root dir thumbs are written under for a location (`<locationRoot>/.thumbs`). */
-var THUMBS_SUBDIR = ".thumbs";
-/**
-* Persist one window. Writes are best-effort atomic (write to a `.tmp` then
-* rename) so a crash mid-write never leaves a truncated sheet a viewer would
-* cache as `immutable`. Idempotent: an existing sheet is left as-is (write-once).
-*/
-async function persistThumbnailWindow(thumbsRoot, req) {
-	const dir = path.join(thumbsRoot, req.relDir);
-	await promises.mkdir(dir, { recursive: true });
-	const sheetPath = path.join(dir, req.sheetName);
-	const indexPath = path.join(dir, req.indexName);
-	await Promise.all([writeOnce(sheetPath, req.sheetBytes), writeOnce(indexPath, Buffer.from(JSON.stringify(req.index)))]);
-}
-async function writeOnce(absPath, bytes) {
-	try {
-		await promises.access(absPath);
-		return;
-	} catch {}
-	const tmp = `${absPath}.tmp-${process.pid}-${Date.now()}`;
-	await promises.writeFile(tmp, bytes);
-	try {
-		await promises.rename(tmp, absPath);
-	} catch (err) {
-		await promises.rm(tmp, { force: true }).catch(() => {});
-		throw err;
 	}
-}
-var HOUR_MS = 36e5;
-/**
-* Buckets whose whole hour ends before the retention cutoff. Cutoff = the
-* device's oldest indexed segment (thumbs live exactly as long as footage),
-* or `now - fallback` when the device has no segments.
-*/
-function planThumbPrune(input) {
-	const cutoffMs = input.oldestSegmentStartMs ?? input.nowMs - 2592e6;
-	return input.buckets.filter((b) => b.hourStartMs + HOUR_MS <= cutoffMs);
-}
-/**
-* Parse a `Y/M/D/H` relative bucket path (as walked under a device dir) into
-* its UTC hour start. Returns null for anything that isn't a valid bucket
-* (staging debris, foreign files) so the janitor never deletes what it does
-* not understand.
-*/
-function parseHourBucket(relYmdh) {
-	const m = /^(\d{4})\/(\d{2})\/(\d{2})\/(\d{2})$/.exec(relYmdh);
-	if (!m) return null;
-	const [, y, mo, d, h] = m;
-	const year = Number(y);
-	const month = Number(mo);
-	const day = Number(d);
-	const hour = Number(h);
-	if (month < 1 || month > 12 || day < 1 || day > 31 || hour > 23) return null;
-	const t = Date.UTC(year, month - 1, day, hour);
-	const dt = new Date(t);
-	if (dt.getUTCFullYear() !== year || dt.getUTCMonth() !== month - 1 || dt.getUTCDate() !== day || dt.getUTCHours() !== hour) return null;
-	return t;
-}
-//#endregion
-//#region src/thumbnails/thumbs-media-handler.ts
-var IMMUTABLE = "public, max-age=31536000, immutable";
-/** Reject traversal / absolute / NUL and normalise leading slashes. Returns the
-*  safe rel path or null. Exported for unit coverage. */
-function sanitizeThumbsPath(url) {
-	const qIdx = url.indexOf("?");
-	const raw = qIdx === -1 ? url : url.slice(0, qIdx);
-	let rel;
-	try {
-		rel = decodeURIComponent(raw.replace(/^\/+/, ""));
-	} catch {
-		return null;
-	}
-	if (rel.length === 0) return null;
-	if (rel.includes("\0")) return null;
-	if (rel.startsWith("/")) return null;
-	if (rel.split("/").some((seg) => seg === ".." || seg === ".")) return null;
-	if (!/\.(jpe?g|json)$/i.test(rel)) return null;
-	return rel;
-}
-/** Content type for a thumbs file by extension. */
-function thumbsContentType(relPath) {
-	if (/\.json$/i.test(relPath)) return "application/json";
-	return "image/jpeg";
-}
-function createThumbsMediaHandler(deps) {
-	return async (req, res) => {
-		if (req.method !== "GET" && req.method !== "HEAD") {
-			res.writeHead(405, { allow: "GET, HEAD" }).end();
-			return;
-		}
-		const rel = sanitizeThumbsPath(req.url ?? "/");
-		if (rel === null) {
-			res.writeHead(404).end();
-			return;
-		}
-		const etag = `"${rel}"`;
-		if (req.headers["if-none-match"] === etag) {
-			res.writeHead(304, {
-				etag,
-				"cache-control": IMMUTABLE
-			}).end();
-			return;
-		}
-		let file;
+	/** Remove per-device day directories older than the retention horizon. */
+	async prune(retentionDays) {
+		const cutoff = (this.deps.now ?? Date.now)() - retentionDays * 864e5;
+		let deviceDirs = [];
 		try {
-			file = await deps.getFile(rel);
+			deviceDirs = await promises.readdir(this.deps.cacheDir);
 		} catch {
-			const body = "Internal server error";
-			res.writeHead(500, {
-				"content-type": "text/plain",
-				"content-length": String(Buffer.byteLength(body))
-			});
-			if (req.method === "HEAD") res.end();
-			else res.end(body);
 			return;
 		}
-		if (file === null) {
-			res.writeHead(404).end();
-			return;
+		for (const dev of deviceDirs) {
+			const devPath = path.join(this.deps.cacheDir, dev);
+			let days = [];
+			try {
+				days = await promises.readdir(devPath);
+			} catch {
+				continue;
+			}
+			for (const day of days) {
+				const dayMs = Date.parse(`${day}T00:00:00Z`);
+				if (Number.isFinite(dayMs) && dayMs < cutoff) await promises.rm(path.join(devPath, day), {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+			}
+			try {
+				if ((await promises.readdir(devPath)).length === 0) await promises.rm(devPath, {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+			} catch {}
 		}
-		res.writeHead(200, {
-			"content-type": file.contentType,
-			"cache-control": IMMUTABLE,
-			etag,
-			"content-length": String(file.bytes.byteLength)
-		});
-		if (req.method === "HEAD") res.end();
-		else res.end(Buffer.from(file.bytes));
-	};
-}
-//#endregion
-//#region src/thumbnails/thumb-backfill-plan.ts
-/**
-* Backfill PLANNER — pure (no ffmpeg, no I/O). Given a device's low segments
-* and the window starts already covered by a sampled/backfilled index, decide
-* which windows still need a keyframe-only ffmpeg pass and which segments cover
-* each. The executor (recorder) runs at most ONE ffmpeg per planned window,
-* single-flighted; this module owns only the "what to do" decision so it is
-* fully unit-testable.
-*
-* A window is a backfill candidate when:
-*   - at least one low segment overlaps it (there is footage to sample), AND
-*   - no index already covers it (sampling didn't reach it), AND
-*   - the window is fully in the past by `settleMs` (no new segment can still
-*     land in it — mirrors the segment store's current-hour eviction guard).
-*/
-/** True when `[startMs, startMs+durMs)` overlaps `[winStart, winEnd)`. */
-function overlaps(startMs, durMs, winStart, winEnd) {
-	return startMs < winEnd && startMs + durMs > winStart;
-}
-/**
-* Compute the ordered (ascending window) backfill plan. Deterministic and
-* bounded: returns at most `maxWindows` window plans (oldest first), each with
-* its overlapping segments.
-*/
-function planBackfill(input) {
-	const { segments, coveredWindows, windowMs, now, settleMs } = input;
-	const maxWindows = input.maxWindows ?? 500;
-	if (!(windowMs > 0)) return [];
-	const candidates = /* @__PURE__ */ new Set();
-	for (const seg of segments) {
-		if (seg.durMs <= 0) continue;
-		const firstW = windowStartFor(seg.startMs, windowMs);
-		const lastW = windowStartFor(seg.startMs + seg.durMs - 1, windowMs);
-		for (let w = firstW; w <= lastW; w += windowMs) candidates.add(w);
-	}
-	const plans = [];
-	for (const windowStartMs of [...candidates].sort((a, b) => a - b)) {
-		if (coveredWindows.has(windowStartMs)) continue;
-		const windowEndMs = windowStartMs + windowMs;
-		if (now - windowEndMs < settleMs) continue;
-		const covering = segments.filter((s) => s.durMs > 0 && overlaps(s.startMs, s.durMs, windowStartMs, windowEndMs)).sort((a, b) => a.startMs - b.startMs);
-		if (covering.length === 0) continue;
-		plans.push({
-			windowStartMs,
-			windowEndMs,
-			segments: covering
-		});
-		if (plans.length >= maxWindows) break;
 	}
-	return plans;
-}
+};
 //#endregion
-//#region src/thumbnails/backfill-ffmpeg.ts
+//#region src/recorder/still/still-source.ts
 /**
-* Map a JPEG quality (higher = better; the scrub presets span ~55..85) onto
-* ffmpeg's INVERSE `-q:v` scale (2 = best .. 31 = worst). Inverse-linear over
-* the full JPEG 1..100 domain, monotonic-decreasing (a higher JPEG quality
-* yields a lower/better ffmpeg q), clamped to [2, 31] for any input.
-*
-* These extracted keyframes are INTERMEDIATE — `composeSheet` re-encodes them
-* into the sheet at the preset's final JPEG quality — so this only governs the
-* extract's crispness. Anchoring the extract to the same preset keeps a
-* high-preset camera's backfill from being the bottleneck while a low-preset
-* camera spends fewer bytes on throwaway intermediates.
+* Resolve the low segment covering `epochMs` and the seek offset from that
+* segment's start. Returns the LAST segment whose half-open span
+* `[startMs, startMs+durMs)` contains the instant (segments can overlap after a
+* restart; the newest wins). Null when no segment covers the instant.
 */
-function jpegQualityToFfmpegQ(jpegQuality) {
-	const q = Math.round(31 - (Math.min(100, Math.max(1, jpegQuality)) - 1) / 99 * 29);
-	return Math.min(31, Math.max(2, q));
-}
-/**
-* ffmpeg args to extract keyframes from one segment as scaled JPEGs. `-skip_frame
-* nokey` + `-vsync 0` (a.k.a. passthrough) keeps only I-frames without
-* duplicating; `-an` drops audio. The caller resolves timestamps from the
-* segment start + the extracted frame order (keyframes are ~GOP-spaced).
-*/
-function buildKeyframeExtractArgs(input) {
-	const q = input.quality ?? 4;
-	return [
-		"-hide_banner",
-		"-loglevel",
-		"error",
-		"-skip_frame",
-		"nokey",
-		"-i",
-		input.inputPath,
-		"-an",
-		"-vsync",
-		"0",
-		"-vf",
-		`scale=${input.tileWidth}:-2`,
-		"-q:v",
-		String(q),
-		input.outputPattern
-	];
+function resolveStillSource(segments, epochMs) {
+	let match = null;
+	for (const s of segments) if (epochMs >= s.startMs && epochMs < s.startMs + s.durMs) {
+		if (match === null || s.startMs >= match.startMs) match = s;
+	}
+	if (match === null) return null;
+	const offsetSec = Math.max(0, (epochMs - match.startMs) / 1e3);
+	return {
+		row: match,
+		offsetSec
+	};
 }
 //#endregion
-//#region src/recorder/addon/thumbnail-service.ts
+//#region src/recorder/still/still-frame-service.ts
 /**
-* Recorder-side scrub-thumbnail SERVICE — the wiring that turns
-* `recording.thumb-sampled` telemetry into served sprite sheets.
-*
-*   runner (any node) --recording.thumb-sampled event--> THIS (recording node)
-*      -> ThumbnailSink accumulates a 5-min window
-*      -> composeSheet (sharp) + persistThumbnailWindow (write-once)
-*      -> data-plane `/addon/recorder/thumbs/<dev>/Y/M/D/H/{sheet,index}`
-*
-* Cross-node decision (documented, simplest per the analysis §3 open
-* questions): the thumb rides the EVENT BUS. The recorder is a SINGLE
-* designated node, so its data-plane prefix (`/addon/recorder/thumbs`) is
-* unambiguous — serving from any decode node's own prefix would be
-* multi-node-ambiguous. Sampling is compressed (~10 KB) at 1/5 Hz — well inside
-* D9 — and telemetry-grade (a lost thumb is a scrub gap the keyframe backfill
-* fills), so no new cap method and no RPC hop are needed.
+* Recorder STILL-frame service — decode ONE JPEG near a wall-clock instant from
+* the recorded LOW footage, on demand, for the export dialog's start/end frame
+* previews. Replaces the retired sprite-sheet scrub-thumbnail tier for this use.
 *
-* Backfill (phase 2): hourly, for windows with recorded LOW footage but no
-* sampled coverage, ONE keyframe-only ffmpeg pass per window fills quiet-period
-* heartbeat thumbs. Bounded concurrency + single-flight so a burst never spawns
-* a storm.
+* A one-off still (a dialog preview, not frame-rate playback), so the simplest
+* robust path is chosen: feed ffmpeg the segment file directly with an INPUT
+* seek (`-ss` before `-i`, which lands on the nearest keyframe at/before the
+* offset — cheap, no full decode) and ask for a single frame on stdout. No
+* WebCodecs, no mp4box parse, no persistent cache — a ~100ms one-shot is fine
+* for a dialog and keeps the endpoint stateless.
 */
-var THUMBS_PREFIX = "thumbs";
-var RECORDER_ADDON_ID$1 = "recorder";
-/** Idle window flush grace — a window whose end passed this long ago is
-*  composed even if no later sample rolled it over (idle camera). */
-var IDLE_GRACE_MS = 3e4;
-/** Flush-timer cadence. */
-var FLUSH_TICK_MS = 15e3;
-/** Backfill scan cadence — 15 min so scrub coverage holes close within the
-*  hour instead of lingering (spawns stay bounded: keyframe-only ffmpeg over
-*  low segments, concurrency-gated, per-device window budget). */
-var BACKFILL_TICK_MS = 15 * 6e4;
-/** A window must have ended this long ago before backfill considers it. */
-var BACKFILL_SETTLE_MS = 5 * DEFAULT_WINDOW_MS;
-/** Max concurrent backfill ffmpeg passes across all cameras. */
-var BACKFILL_MAX_CONCURRENT = 2;
-/** Max windows filled PER DEVICE per backfill pass. A recording camera accrues
-*  ≤12 uncovered 5-min windows/hour, so 24 lets a device also DRAIN backlog.
-*  (This was a GLOBAL cap: 24/pass vs ~12×N windows/hour needed cluster-wide —
-*  devices later in the list starved and coverage grew permanent holes,
-*  live-measured 2026-07-17 on 590: gaps at −55…−110 min.) */
-var BACKFILL_MAX_WINDOWS_PER_DEVICE = 24;
-/** Global safety cap per pass (runaway bound across all cameras). */
-var BACKFILL_MAX_WINDOWS_PER_PASS = 240;
-/** Hard cap on tiles per window (bounds sheet size + compose cost). */
-var MAX_TILES_PER_WINDOW = 90;
-/** Retention-prune cadence (sheets are small — a slow sweep is plenty). */
-var PRUNE_TICK_MS = 6 * 36e5;
-/** First prune runs this long after start (off the boot churn). */
-var PRUNE_INITIAL_DELAY_MS = 10 * 6e4;
-var SHARP = sharp;
-var ThumbnailService = class {
+/** Hard ceiling on a single still decode (a stuck ffmpeg must never leak). */
+var FFMPEG_TIMEOUT_MS = 15e3;
+/** At most this many concurrent ffmpeg decodes (the endpoint is authenticated
+* but request-driven — without a cap a client loop could fork-bomb the node). */
+var MAX_CONCURRENT_DECODES = 3;
+/** Requests parked beyond the concurrency cap; overflow answers 204 instead of
+* queueing unboundedly. The real dialog fetches 2 stills — this is headroom. */
+var MAX_WAIT_QUEUE = 8;
+var StillFrameService = class {
 	deps;
-	sink;
-	unsub = null;
-	dataPlaneDispose = null;
-	flushTimer = null;
-	backfillTimer = null;
-	pruneTimer = null;
-	pruneInitialTimer = null;
-	backfillActive = 0;
-	backfillInFlight = /* @__PURE__ */ new Set();
-	stopped = false;
+	inFlight = 0;
+	waitQueue = [];
 	constructor(deps) {
 		this.deps = deps;
-		this.sink = new ThumbnailSink({
-			windowMs: deps.config.windowMs,
-			intervalMs: deps.config.intervalMs,
-			maxCols: 10,
-			resolvePreset: (deviceId) => deps.resolvePreset(deviceId),
-			maxTilesPerWindow: MAX_TILES_PER_WINDOW,
-			idleGraceMs: IDLE_GRACE_MS,
-			source: "sampled",
-			compose: (req) => composeSheet(SHARP, {
-				tiles: [...req.tiles],
-				placements: req.placements,
-				geometry: req.geometry,
-				quality: req.quality
-			}),
-			persist: (req) => this.persist(req),
-			logger: deps.logger.child("thumbnail-sink")
-		});
-	}
-	/** First writable thumbs root (`<locationRoot>/.thumbs`), or null when no
-	*  recordings location is resolved yet. */
-	writeRoot() {
-		const loc = this.deps.locations()[0];
-		return loc ? path.join(loc.root, THUMBS_SUBDIR) : null;
-	}
-	/** Every thumbs root (for the data-plane getFile search). */
-	thumbsRoots() {
-		return this.deps.locations().map((l) => path.join(l.root, THUMBS_SUBDIR));
-	}
-	/**
-	* Serve ONLY the `thumbs` data-plane endpoint, without starting the sink /
-	* timers. Called from the recorder's `onInitialize` — BEFORE the
-	* node-registration handshake — because the hub pulls a forked addon's
-	* data-plane endpoints once, off the caps-registered signal: an endpoint
-	* served later (the `start()` in `onHubReachable` lands minutes after boot)
-	* never reaches the reverse-proxy and `/addon/recorder/thumbs/*` 404s to the
-	* SPA (live-diagnosed 2026-07-17). Safe to serve early: the handler resolves
-	* roots lazily per request (mirrors the playback data-plane pattern).
-	* Idempotent — `start()` re-invokes it harmlessly.
-	*/
-	async serveEarly() {
-		if (!this.deps.config.enabled) return;
-		if (this.dataPlaneDispose !== null) return;
-		await this.serveDataPlane();
 	}
-	async start() {
-		if (!this.deps.config.enabled) {
-			this.deps.logger.info("thumbnails disabled — service inert");
-			return;
-		}
-		if (this.unsub !== null) return;
-		this.unsub = this.deps.eventBus.subscribe({ category: EventCategory.RecordingThumbSampled }, (event) => {
-			if (!isEvent(event, EventCategory.RecordingThumbSampled)) return;
-			const d = event.data;
-			try {
-				this.sink.add(d.deviceId, {
-					capturedAt: d.capturedAt,
-					jpeg: Buffer.from(d.jpeg)
-				});
-			} catch (err) {
-				this.deps.logger.debug("thumbnail add failed", {
-					tags: { deviceId: d.deviceId },
-					meta: { error: err instanceof Error ? err.message : String(err) }
-				});
-			}
+	/** Acquire a decode slot; resolves false when the wait queue is saturated. */
+	acquireSlot() {
+		if (this.inFlight < MAX_CONCURRENT_DECODES) {
+			this.inFlight += 1;
+			return Promise.resolve(true);
+		}
+		if (this.waitQueue.length >= MAX_WAIT_QUEUE) return Promise.resolve(false);
+		return new Promise((resolve) => {
+			this.waitQueue.push(() => {
+				this.inFlight += 1;
+				resolve(true);
+			});
 		});
-		if (this.dataPlaneDispose === null) await this.serveDataPlane();
-		this.flushTimer = setInterval(() => this.sink.flushExpired(), FLUSH_TICK_MS);
-		if (typeof this.flushTimer === "object" && "unref" in this.flushTimer) this.flushTimer.unref?.();
-		if (this.deps.config.backfillEnabled) {
-			this.backfillTimer = setInterval(() => {
-				this.runBackfillPass();
-			}, BACKFILL_TICK_MS);
-			this.backfillTimer.unref?.();
-		}
-		this.pruneInitialTimer = setTimeout(() => {
-			this.runPrunePass();
-		}, PRUNE_INITIAL_DELAY_MS);
-		this.pruneInitialTimer.unref?.();
-		this.pruneTimer = setInterval(() => {
-			this.runPrunePass();
-		}, PRUNE_TICK_MS);
-		this.pruneTimer.unref?.();
-		this.deps.logger.info("thumbnail service started", { meta: {
-			windowMs: this.deps.config.windowMs,
-			intervalMs: this.deps.config.intervalMs,
-			backfill: this.deps.config.backfillEnabled
-		} });
 	}
-	async stop() {
-		this.stopped = true;
-		this.unsub?.();
-		this.unsub = null;
-		if (this.flushTimer) clearInterval(this.flushTimer);
-		if (this.backfillTimer) clearInterval(this.backfillTimer);
-		if (this.pruneTimer) clearInterval(this.pruneTimer);
-		if (this.pruneInitialTimer) clearTimeout(this.pruneInitialTimer);
-		this.flushTimer = null;
-		this.backfillTimer = null;
-		this.pruneTimer = null;
-		this.pruneInitialTimer = null;
-		try {
-			await this.sink.flushAll();
-		} catch {}
-		await this.dataPlaneDispose?.().catch(() => {});
-		this.dataPlaneDispose = null;
-	}
-	async serveDataPlane() {
-		const handler = createThumbsMediaHandler({ getFile: async (rel) => {
-			for (const root of this.thumbsRoots()) {
-				const abs = path.join(root, rel);
-				if (!abs.startsWith(root + path.sep)) continue;
-				try {
-					return {
-						bytes: await promises.readFile(abs),
-						contentType: thumbsContentType(rel)
-					};
-				} catch {}
-			}
-			return null;
-		} });
-		try {
-			const served = await this.deps.dataPlane?.serve({
-				prefix: THUMBS_PREFIX,
-				access: "authenticated",
-				handler
-			});
-			if (served) {
-				this.dataPlaneDispose = () => served.dispose();
-				this.deps.logger.info("thumbnail data-plane served", { meta: { clientBase: `/addon/${RECORDER_ADDON_ID$1}/${THUMBS_PREFIX}` } });
-			}
-		} catch (err) {
-			this.deps.logger.warn("thumbnail data-plane failed to serve", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		}
+	releaseSlot() {
+		this.inFlight -= 1;
+		const next = this.waitQueue.shift();
+		if (next !== void 0) next();
 	}
 	/**
-	* One retention sweep: for every device dir under every thumbs root, drop
-	* the hour buckets fully older than the device's oldest indexed segment
-	* (thumbs live exactly as long as footage; fixed fallback age when the
-	* device has no segments). Pure decision in `planThumbPrune`; only valid
-	* `Y/M/D/H` buckets are ever deleted. Best-effort — a failed rm retries on
-	* the next sweep.
+	* Decode the frame covering `epochMs`. Returns the JPEG + immutability, or
+	* null when no footage covers the instant / the decode yields no bytes (the
+	* caller replies 204 → the dialog shows its placeholder).
 	*/
-	async runPrunePass() {
-		if (this.stopped) return;
-		let pruned = 0;
-		for (const root of this.thumbsRoots()) {
-			let deviceDirs;
-			try {
-				deviceDirs = (await promises.readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory() && /^\d+$/.test(e.name)).map((e) => e.name);
-			} catch {
-				continue;
-			}
-			for (const dev of deviceDirs) {
-				if (this.stopped) return;
-				const deviceId = Number(dev);
-				const deviceDir = path.join(root, dev);
-				const buckets = [];
-				try {
-					for (const rel of await promises.readdir(deviceDir, { recursive: true })) {
-						const relPosix = String(rel).split(path.sep).join("/");
-						const hourStartMs = parseHourBucket(relPosix);
-						if (hourStartMs !== null) buckets.push({
-							relDir: relPosix,
-							hourStartMs
-						});
-					}
-				} catch {
-					continue;
-				}
-				const segments = this.deps.lowSegments(deviceId);
-				const plan = planThumbPrune({
-					buckets,
-					oldestSegmentStartMs: segments.length > 0 ? Math.min(...segments.map((s) => s.startMs)) : null,
-					nowMs: Date.now()
-				});
-				for (const b of plan) try {
-					await promises.rm(path.join(deviceDir, b.relDir), {
-						recursive: true,
-						force: true
-					});
-					pruned += 1;
-				} catch {}
-				if (plan.length > 0) await removeEmptyParents(deviceDir);
-			}
-		}
-		if (pruned > 0) this.deps.logger.info("thumbnail retention prune removed buckets", { meta: { pruned } });
-	}
-	async persist(req) {
-		const root = this.writeRoot();
-		if (!root) {
-			this.deps.logger.warn("thumbnail persist skipped — no recordings location resolved", { tags: { deviceId: req.deviceId } });
-			return;
-		}
-		await persistThumbnailWindow(root, req);
-	}
-	/** One backfill scan: fill uncovered, settled windows with recorded low
-	*  footage, bounded per pass + per concurrency. Best-effort. */
-	async runBackfillPass() {
-		if (this.stopped || !this.deps.config.backfillEnabled) return;
-		const root = this.writeRoot();
-		if (!root) return;
-		let deviceIds;
-		try {
-			deviceIds = await this.deps.recordingDeviceIds();
-		} catch {
-			return;
-		}
-		let filled = 0;
-		for (const deviceId of deviceIds) {
-			if (filled >= BACKFILL_MAX_WINDOWS_PER_PASS || this.stopped) break;
-			const segments = this.deps.lowSegments(deviceId).map((s) => ({
-				startMs: s.startMs,
-				durMs: s.durMs,
-				path: s.path
-			}));
-			if (segments.length === 0) continue;
-			const plans = planBackfill({
-				segments,
-				coveredWindows: await this.readCoveredWindows(root, deviceId),
-				windowMs: this.deps.config.windowMs,
-				now: Date.now(),
-				settleMs: BACKFILL_SETTLE_MS,
-				maxWindows: Math.min(BACKFILL_MAX_WINDOWS_PER_DEVICE, BACKFILL_MAX_WINDOWS_PER_PASS - filled)
-			});
-			let filledForDevice = 0;
-			for (const plan of plans) {
-				if (filled >= BACKFILL_MAX_WINDOWS_PER_PASS || filledForDevice >= BACKFILL_MAX_WINDOWS_PER_DEVICE || this.stopped) break;
-				const key = `${deviceId}:${plan.windowStartMs}`;
-				if (this.backfillInFlight.has(key)) continue;
-				this.backfillInFlight.add(key);
-				try {
-					await this.gateBackfill(() => this.backfillWindow(deviceId, plan.windowStartMs, plan.segments, root));
-					filled += 1;
-					filledForDevice += 1;
-				} catch (err) {
-					this.deps.logger.debug("backfill window failed", {
-						tags: { deviceId },
-						meta: {
-							windowStartMs: plan.windowStartMs,
-							error: err instanceof Error ? err.message : err
-						}
-					});
-				} finally {
-					this.backfillInFlight.delete(key);
-				}
-			}
-		}
-		if (filled > 0) this.deps.logger.info("thumbnail backfill pass filled windows", { meta: { filled } });
-	}
-	/** Bounded-concurrency gate (spin-wait, coarse — backfill is rare/hourly). */
-	async gateBackfill(fn) {
-		while (this.backfillActive >= BACKFILL_MAX_CONCURRENT && !this.stopped) await new Promise((r) => setTimeout(r, 200));
-		this.backfillActive += 1;
-		try {
-			return await fn();
-		} finally {
-			this.backfillActive -= 1;
-		}
-	}
-	/** Which windows already have an index sidecar on disk (sampled or prior backfill). */
-	async readCoveredWindows(root, deviceId) {
-		const covered = /* @__PURE__ */ new Set();
-		const deviceDir = path.join(root, String(deviceId));
-		let entries;
-		try {
-			entries = await promises.readdir(deviceDir, { recursive: true });
-		} catch {
-			return covered;
-		}
-		for (const e of entries) {
-			const m = /index-(\d+)\.json$/.exec(e);
-			if (m) covered.add(Number(m[1]));
+	async getStill(deviceId, epochMs) {
+		const source = resolveStillSource(this.deps.listLowSegments(deviceId), epochMs);
+		if (source === null) return null;
+		const abs = this.deps.resolveAbsPath(source.row);
+		const now = (this.deps.now ?? Date.now)();
+		const immutable = source.row.startMs + source.row.durMs < now;
+		if (!await this.acquireSlot()) {
+			this.deps.logger.debug("still: decode queue saturated, dropping request", { meta: {
+				deviceId,
+				epochMs
+			} });
+			return null;
 		}
-		return covered;
-	}
-	/** Fill ONE window: extract keyframes from its covering low segments, compose
-	*  a sheet, persist with `source:'backfill'`. */
-	async backfillWindow(deviceId, windowStartMs, segments, root) {
-		const preset = await this.deps.resolvePreset(deviceId);
-		const workDir = await promises.mkdtemp(path.join(tmpdir(), `csthumb-${deviceId}-`));
 		try {
-			const samples = [];
-			for (const seg of segments) {
-				const absSeg = this.resolveSegmentAbs(deviceId, seg.path);
-				if (!absSeg) continue;
-				const jpegs = await this.extractKeyframes(absSeg, workDir, preset);
-				const n = jpegs.length;
-				for (let i = 0; i < n; i += 1) {
-					const t = seg.startMs + Math.round(seg.durMs * i / Math.max(1, n));
-					if (t >= windowStartMs && t < windowStartMs + this.deps.config.windowMs) samples.push({
-						t,
-						jpeg: jpegs[i]
-					});
-				}
-			}
-			if (samples.length === 0) return;
-			if (samples.length > MAX_TILES_PER_WINDOW) samples.length = MAX_TILES_PER_WINDOW;
-			const ordered = samples.sort((a, b) => a.t - b.t);
-			const built = buildThumbnailIndex({
-				deviceId,
-				windowStartMs,
-				windowMs: this.deps.config.windowMs,
-				intervalMs: this.deps.config.intervalMs,
-				source: "backfill",
-				tileWidth: preset.tileWidth,
-				tileHeight: preset.tileHeight,
-				maxCols: 10,
-				samples: ordered.map((s) => ({ t: s.t }))
-			});
-			const geometry = computeSheetGeometry(ordered.length, {
-				tileWidth: preset.tileWidth,
-				tileHeight: preset.tileHeight,
-				maxCols: 10
-			});
-			const placements = allTilePlacements(ordered.length, geometry);
-			const sheetBytes = await composeSheet(SHARP, {
-				tiles: ordered.map((s) => s.jpeg),
-				placements,
-				geometry,
-				quality: preset.quality
-			});
-			await persistThumbnailWindow(root, {
-				deviceId,
-				windowStartMs,
-				relDir: `${deviceId}/${bucketDir(windowStartMs)}`,
-				sheetName: sheetFileName(windowStartMs),
-				sheetBytes,
-				indexName: indexFileName(windowStartMs),
-				index: built.index
-			});
+			const jpeg = await this.decodeFrame(abs, source.offsetSec);
+			if (jpeg === null || jpeg.byteLength === 0) return null;
+			return {
+				jpeg,
+				immutable
+			};
 		} finally {
-			await promises.rm(workDir, {
-				recursive: true,
-				force: true
-			}).catch(() => {});
-		}
-	}
-	/** Resolve a low segment's absolute path from its location root + rel path. */
-	resolveSegmentAbs(deviceId, relPath) {
-		const row = this.deps.lowSegments(deviceId).find((r) => r.path === relPath);
-		if (!row) return null;
-		const loc = this.deps.locations().find((l) => l.id === row.locationId);
-		if (!loc) return null;
-		return path.join(loc.root, relPath);
-	}
-	/** Run ONE keyframe-only ffmpeg pass over a segment; return the extracted
-	*  JPEG buffers in order. */
-	async extractKeyframes(absSeg, workDir, preset) {
-		const args = buildKeyframeExtractArgs({
-			inputPath: absSeg,
-			outputPattern: path.join(workDir, "kf-%04d.jpg"),
-			tileWidth: preset.tileWidth,
-			quality: jpegQualityToFfmpegQ(preset.quality)
-		});
-		await this.spawnFfmpeg(args);
-		const files = (await promises.readdir(workDir)).filter((f) => /^kf-\d+\.jpg$/.test(f)).sort();
-		const out = [];
-		for (const f of files) {
-			out.push(await promises.readFile(path.join(workDir, f)));
-			await promises.rm(path.join(workDir, f), { force: true }).catch(() => {});
-		}
-		return out;
-	}
-	spawnFfmpeg(args) {
-		return new Promise((resolve, reject) => {
+			this.releaseSlot();
+		}
+	}
+	/** Run ONE ffmpeg input-seek + single-frame decode; JPEG bytes on stdout. */
+	decodeFrame(absPath, offsetSec) {
+		const args = [
+			"-hide_banner",
+			"-loglevel",
+			"error",
+			"-ss",
+			offsetSec.toFixed(3),
+			"-i",
+			absPath,
+			"-frames:v",
+			"1",
+			"-f",
+			"mjpeg",
+			"pipe:1"
+		];
+		const spawn$1 = this.deps.spawn ?? spawn;
+		const bin = this.deps.ffmpegPath ?? "ffmpeg";
+		return new Promise((resolve) => {
 			let child;
 			try {
-				child = spawn("ffmpeg", [...args], { stdio: [
-					"ignore",
-					"ignore",
-					"ignore"
-				] });
+				child = spawn$1(bin, args);
 			} catch (err) {
-				reject(err instanceof Error ? err : new Error(String(err)));
+				this.deps.logger.debug("still: ffmpeg spawn failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+				resolve(null);
 				return;
 			}
+			const chunks = [];
+			child.stdout?.on("data", (c) => chunks.push(c));
 			const timer = setTimeout(() => {
 				child.kill("SIGKILL");
-				reject(/* @__PURE__ */ new Error("ffmpeg keyframe extract timed out"));
-			}, 3e4);
+				this.deps.logger.debug("still: ffmpeg decode timed out", { meta: { absPath } });
+				resolve(null);
+			}, FFMPEG_TIMEOUT_MS);
 			timer.unref?.();
 			child.on("error", (err) => {
 				clearTimeout(timer);
-				reject(err);
+				this.deps.logger.debug("still: ffmpeg error", { meta: { error: err.message } });
+				resolve(null);
 			});
 			child.on("close", (code) => {
 				clearTimeout(timer);
-				if (code === 0) resolve();
-				else reject(/* @__PURE__ */ new Error(`ffmpeg exited ${code}`));
+				if (code !== 0 && chunks.length === 0) {
+					resolve(null);
+					return;
+				}
+				resolve(chunks.length > 0 ? Buffer.concat(chunks) : null);
 			});
 		});
 	}
 };
-/**
-* Best-effort removal of now-empty `Y/M/D` parent dirs after a prune (never
-* the device dir itself). `rmdir` refuses non-empty dirs, so this can never
-* delete content — failures are simply left for the next sweep.
-*/
-async function removeEmptyParents(deviceDir) {
-	let entries;
-	try {
-		entries = (await promises.readdir(deviceDir, { recursive: true })).map(String);
-	} catch {
-		return;
-	}
-	const dirs = entries.map((rel) => rel.split(path.sep).join("/")).filter((rel) => /^\d{4}(\/\d{2}){0,3}$/.test(rel)).sort((a, b) => b.length - a.length);
-	for (const rel of dirs) try {
-		await promises.rmdir(path.join(deviceDir, rel));
-	} catch {}
-}
 //#endregion
 //#region src/recorder/addon/index.ts
 /**
@@ -3691,9 +3208,7 @@ var DEFAULT_CONFIG = {
 	segmentSeconds: 10,
 	watchIntervalMs: 2e3,
 	recordingNodeId: RECORDING_NODE_DEFAULT,
-	recordingHubHostname: "",
-	thumbnailsEnabled: true,
-	thumbnailBackfillEnabled: true
+	recordingHubHostname: ""
 };
 /** Playback-marker window padding around a motion event (EventMap only; the
 *  controller's events-band gating uses the raw trigger ms, not this pad).
@@ -3708,6 +3223,12 @@ var MARKER_PAD_POST_MS = EVENT_PAD_MS.postMs;
 *  form the hub reverse-proxy client path `/addon/recorder/playback`. */
 var RECORDER_ADDON_ID = "recorder";
 var PLAYBACK_PREFIX = "playback";
+/** Data-plane prefix for keyframe-only scrub packs →
+*  `/addon/recorder/scrub/<deviceId>/<windowStartSec>`. */
+var SCRUB_PREFIX = "scrub";
+/** Data-plane prefix for on-demand single stills →
+*  `/addon/recorder/still/<deviceId>/<epochSec>`. */
+var STILL_PREFIX = "still";
 /** Data-plane prefix for export MP4 downloads → `/addon/recorder/exports/<id>.mp4`. */
 var EXPORTS_PREFIX = "exports";
 /** How often the export janitor sweeps expired exports. */
@@ -3718,6 +3239,19 @@ var EXPORT_SWEEP_INTERVAL_MS = 5 * 6e4;
 *  hourly cadence keeps the storage.list/evict cost negligible while honouring
 *  the recording-spec §6 periodic retention. */
 var RETENTION_SWEEP_INTERVAL_MS = 60 * 6e4;
+/** Scrub-pack cache prune cadence — mirrors the thumbnail service's own prune
+*  tick (6h) + initial delay (10min off boot churn). Packs are a rebuild-on-
+*  demand cache, so a slow sweep is plenty. */
+var SCRUB_PRUNE_TICK_MS = 6 * 36e5;
+var SCRUB_PRUNE_INITIAL_DELAY_MS = 10 * 6e4;
+/** Retention horizon for the scrub-pack cache (days). Packs are a keyframe-only
+*  CACHE derived from the LOW footage — never primary data — so a pruned window
+*  simply rebuilds on the next request while its segments still exist. A fixed,
+*  generous horizon (comfortably past any typical per-device footage max-age)
+*  reclaims disk from truly-old orphaned packs without racing footage retention.
+*  The recorder has no single global footage max-age (it is per-device), so a
+*  fixed cache horizon is the correct scope here. */
+var SCRUB_PACK_RETENTION_DAYS = 90;
 /** Grace after a completed download before a `deleteAfterDownload` file is removed. */
 var EXPORT_DELETE_GRACE_MS = 6e4;
 /** Only `.mp4` export ids matching this shape are servable (traversal guard). */
@@ -3747,8 +3281,15 @@ var RecorderV2Addon = class extends BaseAddon {
 	resolvedLocations = [];
 	/** Base URL of the playback HTTP data-plane, null until served in onHubReachable. */
 	playbackBaseUrl = null;
-	/** Scrub-thumbnail service (sink + data-plane + backfill). Null until started. */
-	thumbnailService = null;
+	/** On-demand single-still decode service (export-dialog frame previews). Null
+	*  on non-recording nodes / when the data-plane serve fails. */
+	/** Keyframe-only scrub-pack service (built + served in onInitialize). Null on
+	*  non-recording nodes / when the data-plane serve fails. */
+	scrubPackService = null;
+	/** Periodic scrub-pack cache prune timer + its one-shot initial delay. Cleared
+	*  on shutdown. */
+	scrubPruneTimer = null;
+	scrubPruneInitialTimer = null;
 	/** Render engine for recording exports. Null on non-recording nodes. */
 	exportEngine = null;
 	/** Periodic export-expiry sweep timer. Cleared on shutdown. */
@@ -3870,7 +3411,31 @@ var RecorderV2Addon = class extends BaseAddon {
 		this.recordingProvider = recordingProvider;
 		const evictableProvider = new StorageEvictableProvider({
 			index: this.index,
-			store: this.segmentStore
+			store: this.segmentStore,
+			resolveDomain: (locationId) => this.locationDomain(locationId),
+			onEvicted: (summaries) => {
+				for (const s of summaries) this.ctx.eventBus.emit({
+					id: randomUUID(),
+					timestamp: /* @__PURE__ */ new Date(),
+					source: {
+						type: "device",
+						id: s.deviceId,
+						addonId: this.ctx.id,
+						deviceId: s.deviceId,
+						nodeId: this.nodeId
+					},
+					category: EventCategory.RecordingRetentionCompleted,
+					data: {
+						deviceId: s.deviceId,
+						locationId: s.locationId,
+						segments: s.segments,
+						bytes: s.bytes,
+						fromMs: s.fromMs,
+						toMs: s.toMs,
+						trigger: "disk-pressure"
+					}
+				});
+			}
 		});
 		const exportsState = this.exportsStore();
 		const exportCodecCache = /* @__PURE__ */ new Map();
@@ -3917,6 +3482,55 @@ var RecorderV2Addon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("recorder playback data-plane failed to serve", { meta: { error: errMsg(err) } });
 		}
+		try {
+			const scrubService = new ScrubPackService({
+				listLowSegments: (deviceId) => this.index.segments(deviceId, "low"),
+				readSegmentBytes: async (row) => {
+					const abs = this.resolveSegmentAbsPath(row);
+					return new Uint8Array(await promises.readFile(abs));
+				},
+				cacheDir: path.join(this.ctx.dataDir, "scrub-packs"),
+				logger: this.ctx.logger.child("ScrubPacks")
+			});
+			this.scrubPackService = scrubService;
+			const served = await this.ctx.dataPlane?.serve({
+				prefix: SCRUB_PREFIX,
+				access: "authenticated",
+				handler: (req, res) => this.serveScrubPack(scrubService, req, res)
+			});
+			this.scrubPruneInitialTimer = setTimeout(() => {
+				this.scrubPackService?.prune(SCRUB_PACK_RETENTION_DAYS);
+			}, SCRUB_PRUNE_INITIAL_DELAY_MS);
+			this.scrubPruneInitialTimer.unref?.();
+			this.scrubPruneTimer = setInterval(() => {
+				this.scrubPackService?.prune(SCRUB_PACK_RETENTION_DAYS);
+			}, SCRUB_PRUNE_TICK_MS);
+			this.scrubPruneTimer.unref?.();
+			this.ctx.logger.info("recorder scrub-pack data-plane served", { meta: {
+				clientBase: served ? `/addon/${RECORDER_ADDON_ID}/${SCRUB_PREFIX}` : "(no dataPlane)",
+				internal: served?.baseUrl
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("scrub-pack data-plane serve failed", { meta: { error: errMsg(err) } });
+		}
+		try {
+			const stillService = new StillFrameService({
+				listLowSegments: (deviceId) => this.index.segments(deviceId, "low"),
+				resolveAbsPath: (row) => this.resolveSegmentAbsPath(row),
+				logger: this.ctx.logger.child("Still")
+			});
+			const served = await this.ctx.dataPlane?.serve({
+				prefix: STILL_PREFIX,
+				access: "authenticated",
+				handler: (req, res) => this.serveStill(stillService, req, res)
+			});
+			this.ctx.logger.info("recorder still data-plane served", { meta: {
+				clientBase: served ? `/addon/${RECORDER_ADDON_ID}/${STILL_PREFIX}` : "(no dataPlane)",
+				internal: served?.baseUrl
+			} });
+		} catch (err) {
+			this.ctx.logger.warn("still data-plane serve failed", { meta: { error: errMsg(err) } });
+		}
 		try {
 			const served = await this.ctx.dataPlane?.serve({
 				prefix: EXPORTS_PREFIX,
@@ -3930,7 +3544,6 @@ var RecorderV2Addon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("recorder exports data-plane failed to serve", { meta: { error: errMsg(err) } });
 		}
-		await this.ensureThumbnailService().serveEarly();
 		this.ctx.logger.info("recorder addon started (continuous write path active)", {
 			tags: { nodeId: this.nodeId },
 			meta: {
@@ -3959,8 +3572,15 @@ var RecorderV2Addon = class extends BaseAddon {
 		await this.controller?.stop();
 		this.controller = null;
 		this.segmentStore = null;
-		await this.thumbnailService?.stop();
-		this.thumbnailService = null;
+		if (this.scrubPruneInitialTimer !== null) {
+			clearTimeout(this.scrubPruneInitialTimer);
+			this.scrubPruneInitialTimer = null;
+		}
+		if (this.scrubPruneTimer !== null) {
+			clearInterval(this.scrubPruneTimer);
+			this.scrubPruneTimer = null;
+		}
+		this.scrubPackService = null;
 		if (this.exportSweepTimer !== null) {
 			clearInterval(this.exportSweepTimer);
 			this.exportSweepTimer = null;
@@ -3971,6 +3591,25 @@ var RecorderV2Addon = class extends BaseAddon {
 		this.recordingProvider = null;
 	}
 	/**
+	* The eviction DOMAIN of `locationId`: every resolved recordings location that
+	* shares its physical filesystem root, including itself. Managed locations that
+	* alias one disk (today `recordings:default` + `recordingsLow:default` both at
+	* `/recordings`) form one oldest-first eviction pool — otherwise disk-pressure
+	* relief on one alias deletes the newest footage while the other alias holds the
+	* old (the age-partition data-loss bug).
+	*
+	* Grouping keys by `fs.realpathSync` of the resolved root (see
+	* `resolveEvictionDomain`), NOT the resolved string alone: a symlinked or
+	* bind-aliased path reaching the same disk collapses to one key, closing the
+	* loophole where two aliases with different path strings would re-partition.
+	* When realpath throws (root missing at boot) it falls back to the resolved
+	* string — distinct roots stay distinct domains (safe: over-partitions at
+	* worst, never merges two disks).
+	*/
+	locationDomain(locationId) {
+		return resolveEvictionDomain(this.resolvedLocations, locationId);
+	}
+	/**
 	* Boot hydrate: once the hub is reachable (`ctx.api.*` safe), resolve the
 	* recordings locations and rebuild the in-memory index from `storage.list`
 	* for every device that has a persisted config. The list result is the
@@ -3984,6 +3623,20 @@ var RecorderV2Addon = class extends BaseAddon {
 			this.ctx.logger.warn("recorder: no recordings storage locations resolved — index not hydrated");
 			return;
 		}
+		try {
+			await this.controller?.start();
+		} catch (err) {
+			this.ctx.logger.warn("recorder: controller start failed", { meta: { error: errMsg(err) } });
+		}
+		if (this.eventUnsub === null) this.eventUnsub = subscribeEventCapture({
+			eventBus: this.ctx.eventBus,
+			map: this.eventMap,
+			padPreMs: MARKER_PAD_PRE_MS,
+			padPostMs: MARKER_PAD_POST_MS,
+			onMotion: (deviceId, atMs) => {
+				this.controller?.onTrigger(deviceId, "motion", atMs);
+			}
+		});
 		let configs;
 		try {
 			configs = await readDeviceConfigs(this.configStore());
@@ -3996,6 +3649,23 @@ var RecorderV2Addon = class extends BaseAddon {
 			deviceCount: configs.size,
 			locationCount: this.resolvedLocations.length
 		} });
+		const loggedDomains = /* @__PURE__ */ new Set();
+		for (const loc of this.resolvedLocations) {
+			const domain = this.locationDomain(loc.id);
+			const domainKey = [...domain].toSorted().join("+");
+			if (loggedDomains.has(domainKey)) continue;
+			loggedDomains.add(domainKey);
+			const acct = this.index.accountingForLocations(domain);
+			this.ctx.logger.info("recorder: eviction domain footage span at hydrate", { meta: {
+				locationIds: [...domain].toSorted(),
+				root: loc.root,
+				count: acct.count,
+				bytes: acct.bytes,
+				oldestMs: acct.oldestMs,
+				newestMs: acct.newestMs
+			} });
+		}
+		this.cleanupLegacyThumbsDirs();
 		const store = this.segmentStore;
 		if (store) try {
 			await runRedundancyJanitor({
@@ -4007,25 +3677,6 @@ var RecorderV2Addon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("recorder: redundancy janitor failed", { meta: { error: errMsg(err) } });
 		}
-		try {
-			await this.controller?.start();
-		} catch (err) {
-			this.ctx.logger.warn("recorder: controller start failed", { meta: { error: errMsg(err) } });
-		}
-		if (this.eventUnsub === null) this.eventUnsub = subscribeEventCapture({
-			eventBus: this.ctx.eventBus,
-			map: this.eventMap,
-			padPreMs: MARKER_PAD_PRE_MS,
-			padPostMs: MARKER_PAD_POST_MS,
-			onMotion: (deviceId, atMs) => {
-				this.controller?.onTrigger(deviceId, "motion", atMs);
-			}
-		});
-		try {
-			await this.ensureThumbnailService().start();
-		} catch (err) {
-			this.ctx.logger.warn("recorder: thumbnail service start failed", { meta: { error: errMsg(err) } });
-		}
 		await this.bootstrapExports();
 		const provider = this.recordingProvider;
 		if (provider && this.retentionSweeper === null) this.retentionSweeper = new RetentionSweeper({
@@ -4068,31 +3719,68 @@ var RecorderV2Addon = class extends BaseAddon {
 			this.exportSweepTimer.unref?.();
 		}
 	}
-	/** Construct the thumbnail service once — every dep is a lazy closure, so
-	*  construction is safe in `onInitialize` (before locations resolve). */
-	ensureThumbnailService() {
-		if (this.thumbnailService === null) this.thumbnailService = new ThumbnailService({
-			logger: this.ctx.logger.child("thumbnails"),
-			eventBus: this.ctx.eventBus,
-			...this.ctx.dataPlane !== void 0 ? { dataPlane: this.ctx.dataPlane } : {},
-			locations: () => this.resolvedLocations,
-			lowSegments: (deviceId) => this.index.segments(deviceId, "low"),
-			recordingDeviceIds: async () => [...(await readDeviceConfigs(this.configStore())).keys()],
-			resolvePreset: async (deviceId) => {
-				try {
-					return resolveScrubThumbnailGeometry((await loadDeviceConfig(this.configStore(), deviceId)).scrubThumbnails);
-				} catch {
-					return resolveScrubThumbnailGeometry(void 0);
-				}
-			},
-			config: {
-				enabled: this.config.thumbnailsEnabled,
-				backfillEnabled: this.config.thumbnailBackfillEnabled,
-				windowMs: DEFAULT_WINDOW_MS,
-				intervalMs: 5e3
+	/**
+	* One-time boot cleanup of the retired sprite-sheet scrub-thumbnail dirs
+	* (`<locationRoot>/.thumbs`). Scrub previews now use the WebCodecs keyframe
+	* packs + the on-demand still route, so the sheets are dead weight on the
+	* recordings share. Best-effort per location — a failed rm just retries next
+	* boot; a missing dir is a no-op.
+	*/
+	async cleanupLegacyThumbsDirs() {
+		const LEGACY_THUMBS_SUBDIR = ".thumbs";
+		for (const loc of this.resolvedLocations) {
+			const dir = path.join(loc.root, LEGACY_THUMBS_SUBDIR);
+			try {
+				await promises.rm(dir, {
+					recursive: true,
+					force: true
+				});
+				this.ctx.logger.info("recorder: removed legacy scrub-thumbnail dir", { meta: { dir } });
+			} catch (err) {
+				this.ctx.logger.debug("recorder: legacy thumbs cleanup skipped", { meta: {
+					dir,
+					error: errMsg(err)
+				} });
 			}
-		});
-		return this.thumbnailService;
+		}
+	}
+	/**
+	* Still request handler: `GET /<deviceId>/<epochSec>` → `image/jpeg` (the
+	* frame nearest the instant in the LOW recording) | 204 (no footage covers
+	* the instant / decode produced nothing) | 400 (bad path) | 500. A fully-past
+	* segment yields an immutable-cacheable still; the still-open live edge is
+	* `no-store`.
+	*/
+	async serveStill(service, req, res) {
+		const m = /^\/(\d+)\/(\d+)$/.exec(req.url?.split("?")[0] ?? "");
+		if (!m) {
+			res.writeHead(400).end();
+			return;
+		}
+		const deviceId = Number(m[1]);
+		const epochMs = Number(m[2]) * 1e3;
+		try {
+			const built = await service.getStill(deviceId, epochMs);
+			if (!built) {
+				res.writeHead(204).end();
+				return;
+			}
+			res.writeHead(200, {
+				"content-type": "image/jpeg",
+				"content-length": built.jpeg.byteLength,
+				"cache-control": built.immutable ? "private, max-age=31536000, immutable" : "no-store"
+			});
+			res.end(built.jpeg);
+		} catch (err) {
+			this.ctx.logger.warn("still request failed", {
+				tags: { deviceId },
+				meta: {
+					epochMs,
+					error: errMsg(err)
+				}
+			});
+			res.writeHead(500).end();
+		}
 	}
 	/** Re-resolve recordings locations (rescanStorage picks up newly-added disks). */
 	async refreshLocations() {
@@ -4169,24 +3857,6 @@ var RecorderV2Addon = class extends BaseAddon {
 				description: "Advanced: only used when the recording node is an AGENT. The hub's host the agent dials to pull broker streams (the RTSP restream port must be reachable there). Leave empty to auto-derive from the agent's hub connection.",
 				default: ""
 			}]
-		}, {
-			id: "scrub-thumbnails",
-			title: "Scrub thumbnails",
-			description: "Timeline scrub previews. Small JPEG sprite sheets packed from the runner-sampled detection frames (zero extra decode) + an hourly keyframe-only backfill for quiet windows. Served write-once over the authenticated data-plane; works on every viewer platform (no client video decode).",
-			columns: 1,
-			fields: [{
-				type: "boolean",
-				key: "thumbnailsEnabled",
-				label: "Serve scrub thumbnails",
-				description: "Accumulate + serve sprite sheets. Disable to stop packing/serving thumbnails.",
-				default: true
-			}, {
-				type: "boolean",
-				key: "thumbnailBackfillEnabled",
-				label: "Keyframe backfill",
-				description: "Hourly, fill windows that have recorded low footage but no sampled thumbs with a single keyframe-only ffmpeg pass per window (≤24 spawns/day/camera worst case).",
-				default: true
-			}]
 		}] });
 	}
 	/** Durable handle config-store reads/writes the deviceId→config blob on —
@@ -4231,6 +3901,58 @@ var RecorderV2Addon = class extends BaseAddon {
 		});
 	}
 	/**
+	* Absolute on-disk path for a scrub segment row. Mirrors the playback path
+	* resolution exactly: the file playback serves for `row.path` lives at
+	* `<root for row.locationId>/<row.path>` (same `rootById` lookup the playback
+	* manifest uses). The scrub packs read the SAME source segments as playback.
+	*/
+	resolveSegmentAbsPath(row) {
+		const loc = this.resolvedLocations.find((l) => l.id === row.locationId);
+		if (loc === void 0) throw new Error(`recorder scrub: unknown recordings location ${row.locationId}`);
+		return path.join(loc.root, row.path);
+	}
+	/**
+	* Scrub-pack request handler: `GET /<deviceId>/<windowStartSec>` →
+	* `application/octet-stream` pack | 204 (no footage) | 400 (bad path / window
+	* not aligned to `SCRUB_WINDOW_MS`) | 500. Immutable (fully past) windows carry
+	* a 1-year immutable cache header; the still-open current window is `no-store`.
+	*/
+	async serveScrubPack(service, req, res) {
+		const m = /^\/(\d+)\/(\d+)$/.exec(req.url?.split("?")[0] ?? "");
+		if (!m) {
+			res.writeHead(400).end();
+			return;
+		}
+		const deviceId = Number(m[1]);
+		const windowStartMs = Number(m[2]) * 1e3;
+		if (windowStartMs % 6e4 !== 0) {
+			res.writeHead(400).end();
+			return;
+		}
+		try {
+			const built = await service.getOrBuild(deviceId, windowStartMs);
+			if (!built) {
+				res.writeHead(204).end();
+				return;
+			}
+			res.writeHead(200, {
+				"content-type": "application/octet-stream",
+				"content-length": built.pack.byteLength,
+				"cache-control": built.immutable ? "private, max-age=31536000, immutable" : "no-store"
+			});
+			res.end(Buffer.from(built.pack));
+		} catch (err) {
+			this.ctx.logger.warn("scrub pack request failed", {
+				tags: { deviceId },
+				meta: {
+					windowStartMs,
+					error: errMsg(err)
+				}
+			});
+			res.writeHead(500).end();
+		}
+	}
+	/**
 	* Dedicated export MP4 download handler. Resolves `<exportId>.mp4` to a `ready`
 	* row's file (traversal-guarded by the id regex + the exact stored path),
 	* streams it with HTTP `Range`, and — when the FINAL byte of a full-file GET is