@camstack/addon-pipeline 1.2.69 → 1.2.71

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-DGLqaonv.mjs";
+import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-D1Xk5Tji.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CZ2xo67g.mjs";
 import { randomUUID } from "node:crypto";
@@ -681,6 +681,36 @@ var RecordingIndex = class {
 		}
 		return out;
 	}
+	/**
+	* Every (device, profile, location) pile in ONE pass — bytes and file count,
+	* no sort and no cache rebuild.
+	*
+	* This is the input to the operator-armed rebalance (D116): it asks "where is
+	* each camera-profile's footage, and how much of it", which is exactly the
+	* unit the placement plan assigns and the relocate mover moves. Building it
+	* from `segmentsOnLocation` per location would sort the whole archive once
+	* per location instead.
+	*/
+	piles() {
+		const out = /* @__PURE__ */ new Map();
+		for (const m of this.byDevice.values()) for (const s of m.values()) {
+			const key = `${s.deviceId}:${s.profile}:${s.locationId}`;
+			const prev = out.get(key);
+			if (prev) {
+				prev.bytes += s.bytes;
+				prev.files += 1;
+				continue;
+			}
+			out.set(key, {
+				deviceId: s.deviceId,
+				profile: s.profile,
+				locationId: s.locationId,
+				bytes: s.bytes,
+				files: 1
+			});
+		}
+		return [...out.values()];
+	}
 	/** All segments on a storage location across every device, oldest-first. */
 	segmentsOnLocation(locationId) {
 		const out = [];
@@ -870,6 +900,19 @@ function resolveEvictionDomain(locations, locationId, realpath = realpathSync) {
 *
 * Runs INSIDE the recorder process — container uid, same-uid files, no host
 * chown trap (see docs/history 2026-07-29).
+*
+* ── Phase 2 (D116, multi-location) ────────────────────────────────────────
+* Two additions the OPERATOR-ARMED rebalance needs:
+*
+*   - A move is scoped to one CAMERA (and optionally to specific profiles),
+*     not just to a whole disk. The rebalance's unit is a (camera, profile)
+*     pile, because that is the unit the placement plan assigns.
+*   - Concurrent starts QUEUE instead of being refused. The engine is still
+*     single-flight — two movers on one disk thrash both — but a rebalance
+*     enqueues one job per pile, and refusing the second turned a
+*     fifteen-camera rebalance into fifteen manual retries. Jobs run FIFO; a
+*     job cancelled while queued never runs, and a job that FAILS does not
+*     strand the queue behind it.
 */
 var DEFAULT_THROTTLE_MBPS = 40;
 /** Progress callback cadence (files) — cheap enough to fire often. */
@@ -913,22 +956,48 @@ async function moveFile(src, dst, srcBytes) {
 var RelocateEngine = class {
 	deps;
 	jobs = /* @__PURE__ */ new Map();
+	/** Job ids waiting for the mover, in enqueue order. */
+	queue = [];
+	/** Set while a job is executing — the single-flight latch. */
+	draining = false;
 	constructor(deps) {
 		this.deps = deps;
 	}
 	list() {
 		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
 	}
+	/**
+	* Cancel a running OR queued job. A running job stops after its current
+	* file; a queued job is terminated where it stands and never runs — which is
+	* why this returns true for both, and why the cancelled job still gets its
+	* `onFinished` audit row.
+	*/
 	cancel(jobId) {
 		const job = this.jobs.get(jobId);
-		if (!job || job.state !== "running") return false;
+		if (!job) return false;
+		if (job.state === "running") {
+			job.cancelRequested = true;
+			return true;
+		}
+		if (job.state !== "queued") return false;
 		job.cancelRequested = true;
+		job.state = "cancelled";
+		job.finishedAt = this.deps.now();
+		const at = this.queue.indexOf(jobId);
+		if (at >= 0) this.queue.splice(at, 1);
+		this.deps.onFinished?.(snapshot(job));
 		return true;
 	}
-	/** Start a relocation. Throws on invalid locations or when a job is already
-	*  running (single-flight — two movers on one disk thrash both). */
+	/**
+	* Enqueue a relocation and return its job id. Throws only on an input the
+	* mover could never satisfy (unknown/identical/read-only locations) —
+	* validated SYNCHRONOUSLY so a caller arming a rebalance learns about a bad
+	* target before any job runs.
+	*
+	* Concurrency: the returned job may be `queued` rather than `running`. The
+	* engine still moves one job at a time.
+	*/
 	start(input) {
-		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a relocation is already running (${j.jobId})`);
 		const locs = this.deps.locations();
 		const from = locs.find((l) => l.id === input.fromLocationId);
 		const to = locs.find((l) => l.id === input.toLocationId);
@@ -938,10 +1007,13 @@ var RelocateEngine = class {
 		if (to.readOnly) throw new Error(`target location is read-only: ${to.id}`);
 		const job = {
 			jobId: this.deps.newId(),
-			state: "running",
+			state: "queued",
 			fromLocationId: from.id,
 			toLocationId: to.id,
-			deviceId: null,
+			deviceId: input.deviceId ?? null,
+			profiles: input.profiles ? [...input.profiles] : [],
+			footageClass: input.footageClass,
+			throttleMbps: input.throttleMbps ?? DEFAULT_THROTTLE_MBPS,
 			entities: input.entities ? [...input.entities] : ["segments"],
 			filesMoved: 0,
 			bytesMoved: 0,
@@ -952,15 +1024,56 @@ var RelocateEngine = class {
 			cancelRequested: false
 		};
 		this.jobs.set(job.jobId, job);
-		this.run(job, from, to, input.throttleMbps ?? DEFAULT_THROTTLE_MBPS, input.footageClass);
+		this.queue.push(job.jobId);
+		this.drain();
 		return job.jobId;
 	}
-	async run(job, from, to, throttleMbps, footageClass) {
+	/**
+	* Run queued jobs one at a time, in enqueue order. Re-entrant by design: the
+	* `draining` latch is the single-flight guarantee, and every terminal state
+	* (including `failed`) falls through to the next job — a queue stranded
+	* behind one bad camera is the failure mode FIFO exists to avoid.
+	*/
+	async drain() {
+		if (this.draining) return;
+		this.draining = true;
+		try {
+			for (;;) {
+				const jobId = this.queue.shift();
+				if (jobId === void 0) return;
+				const job = this.jobs.get(jobId);
+				if (!job || job.state !== "queued") continue;
+				const locs = this.deps.locations();
+				const from = locs.find((l) => l.id === job.fromLocationId);
+				const to = locs.find((l) => l.id === job.toLocationId);
+				if (!from || !to) {
+					job.state = "failed";
+					job.error = `location disappeared while queued: ${job.fromLocationId} → ${job.toLocationId}`;
+					job.finishedAt = this.deps.now();
+					this.deps.logger.warn("relocate job failed", {
+						...job.deviceId !== null ? { tags: { deviceId: job.deviceId } } : {},
+						meta: {
+							jobId: job.jobId,
+							error: job.error
+						}
+					});
+					this.deps.onFinished?.(snapshot(job));
+					continue;
+				}
+				job.state = "running";
+				job.startedAt = this.deps.now();
+				await this.run(job, from, to);
+			}
+		} finally {
+			this.draining = false;
+		}
+	}
+	async run(job, from, to) {
 		const sleep = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-		const bytesPerMs = throttleMbps * 1024 * 1024 / 1e3;
+		const bytesPerMs = job.throttleMbps * 1024 * 1024 / 1e3;
 		try {
 			const samePhysicalRoot = await rootsPhysicallySame(from.root, to.root);
-			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => profileBelongsToClass(r.profile, footageClass)).sort((a, b) => a.startMs - b.startMs);
+			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).filter((r) => job.profiles.length === 0 || job.profiles.includes(r.profile)).filter((r) => profileBelongsToClass(r.profile, job.footageClass)).sort((a, b) => a.startMs - b.startMs);
 			job.filesTotal = segRows.length;
 			for (const row of segRows) {
 				if (job.cancelRequested) break;
@@ -983,10 +1096,13 @@ var RelocateEngine = class {
 		} catch (err) {
 			job.state = "failed";
 			job.error = err instanceof Error ? err.message : String(err);
-			this.deps.logger.warn("relocate job failed", { meta: {
-				jobId: job.jobId,
-				error: job.error
-			} });
+			this.deps.logger.warn("relocate job failed", {
+				...job.deviceId !== null ? { tags: { deviceId: job.deviceId } } : {},
+				meta: {
+					jobId: job.jobId,
+					error: job.error
+				}
+			});
 		} finally {
 			job.finishedAt = this.deps.now();
 			this.deps.onFinished?.(snapshot(job));
@@ -2298,6 +2414,105 @@ function sendDirectory(res, payload) {
 	res.end(Buffer.from(body));
 }
 //#endregion
+//#region src/recorder/addon/export-dense-map.ts
+/**
+* Shortest clip worth keeping, in ms.
+*
+* Exists only to honour `ExportDenseRangeSchema`'s `toSec > fromSec`: a range
+* clipped to a sliver of footage is still honest, but a range clipped to
+* NOTHING must not be emitted as a zero-length interval the schema refuses.
+*/
+var MIN_MAPPED_MS = 1;
+/** Milliseconds of footage that precede `wallMs` in the concatenation. */
+function recordedMsBefore(segments, wallMs) {
+	let acc = 0;
+	for (const s of segments) if (wallMs >= s.startMs + s.durMs) acc += s.durMs;
+	else if (wallMs > s.startMs) acc += wallMs - s.startMs;
+	return acc;
+}
+/** Whole milliseconds → seconds, with no float tail for the filter string. */
+function msToSec(ms) {
+	return Math.round(ms) / 1e3;
+}
+/**
+* Translate wall-clock dense ranges into the export's stream timeline.
+*
+* @returns the surviving ranges (in stream seconds, ordered as given) plus the
+*   report the render logs.
+*/
+function mapDenseRangesToStreamTime(input) {
+	const segments = [...input.segments].sort((a, b) => a.startMs - b.startMs);
+	const footageEndMs = segments.reduce((end, s) => Math.max(end, s.startMs + s.durMs), input.exportFromMs);
+	const mapped = [];
+	const dropped = [];
+	for (const range of input.ranges) {
+		const fromWallMs = input.exportFromMs + range.fromSec * 1e3;
+		const toWallMs = input.exportFromMs + range.toSec * 1e3;
+		const fromMs = Math.round(recordedMsBefore(segments, fromWallMs));
+		const toMs = Math.round(recordedMsBefore(segments, toWallMs));
+		if (toMs - fromMs < MIN_MAPPED_MS) {
+			dropped.push({
+				fromSec: range.fromSec,
+				toSec: range.toSec,
+				reason: fromWallMs >= footageEndMs ? "past-end" : "gap"
+			});
+			continue;
+		}
+		mapped.push({
+			fromSec: msToSec(fromMs),
+			toSec: msToSec(toMs)
+		});
+	}
+	return {
+		ranges: mapped,
+		report: {
+			requested: input.ranges.length,
+			mapped: mapped.length,
+			dropped
+		}
+	};
+}
+/**
+* One export's options with its dense ranges expressed in stream time.
+*
+* An overlay that maps to NOTHING is removed entirely rather than left with an
+* empty range list: `ExportDenseSchema` refuses `ranges: []` and
+* `selectPredicate` would emit `if(,…)`, a filter ffmpeg rejects — so a night
+* whose busy moments all fell in holes would fail the render instead of
+* delivering the uniform video it legitimately is.
+*/
+function withStreamTimeDenseRanges(input) {
+	const timelapse = input.options.timelapse;
+	const dense = timelapse?.dense;
+	if (timelapse === void 0 || dense === void 0) return {
+		options: input.options,
+		report: null
+	};
+	const { ranges, report } = mapDenseRangesToStreamTime({
+		ranges: dense.ranges,
+		exportFromMs: input.fromMs,
+		segments: input.segments
+	});
+	const base = {
+		everyMs: timelapse.everyMs,
+		...timelapse.outputFps !== void 0 ? { outputFps: timelapse.outputFps } : {}
+	};
+	const remapped = ranges.length > 0 ? {
+		...base,
+		dense: {
+			everyMs: dense.everyMs,
+			ranges: [...ranges]
+		}
+	} : base;
+	return {
+		options: {
+			...input.options,
+			timelapse: remapped
+		},
+		report
+	};
+}
+//#endregion
 //#region src/recorder/addon/export-ffmpeg-args.ts
 /** Widest [min,max] speed a single ffmpeg `atempo` filter accepts. Outside this
 *  band audio is dropped rather than chained (kept simple + predictable). */
@@ -2468,20 +2683,6 @@ async function listExportsFor(state, deviceId) {
 }
 //#endregion
 //#region src/recorder/addon/export-engine.ts
-/**
-* Render engine for recording exports.
-*
-* A FIFO queue with ONE concurrent ffmpeg render (exports are heavy; serialising
-* protects the recording node). Each job: write the range's per-export source
-* playlist (`resolvePlaylist`) → build argv (`buildExportArgs`) → spawn ffmpeg →
-* parse `time=` from stderr for progress → on exit 0 stat the file and mark
-* `ready`; on non-zero mark `failed` and remove the partial; drop the source
-* playlist whatever the outcome. `cancel` SIGKILLs an in-flight render.
-* State transitions patch the DurableState store and emit telemetry events.
-*
-* Unlike `SegmentWriter` there is NO auto-restart — a render runs once; boot
-* re-queue of interrupted jobs is the provider's concern.
-*/
 /** Stderr lines retained for the failure LOG. ffmpeg prints one line per failed
 *  segment before the decisive "Error opening input" summary, so a short tail can
 *  push the actual cause out of the window (it very nearly did — the line that
@@ -2489,6 +2690,26 @@ async function listExportsFor(state, deviceId) {
 *  render writes one progress line per second. */
 var STDERR_TAIL_LINES$1 = 40;
 var TIME_RE = /time=(\d+):(\d+):(\d+(?:\.\d+)?)/;
+/**
+* The floor under which an MP4 cannot hold a single decodable frame.
+*
+* **Exit 0 is not the same question as "the file holds a video".** A timelapse
+* whose frame-select predicate matched nothing produced a **262-byte** MP4 —
+* `ftyp` + `moov` + an EMPTY `mdat`, `nb_streams=0` to ffprobe — and ffmpeg
+* exited 0 while doing it. The row went `ready`, `readExportBytes` served the
+* 262 bytes, the notification centre republished them on the artifact plane
+* and a phone was handed a video no player can open (2026-08-12; the operator
+* reported it as "il video è danneggiato", and the served artifact was
+* byte-identical to the file on disk, so the render was the only suspect).
+*
+* A frame-free MP4 tops out around 300 bytes (the box headers and nothing
+* else); the smallest REAL one-frame 640×360 h264 export measured here is
+* several kilobytes. 1 KiB sits between the two with room on both sides, and
+* it is deliberately a byte floor and not an ffprobe call: the engine must be
+* able to refuse an empty render without a second process, on every node,
+* whatever ffmpeg build is installed.
+*/
+var EXPORT_MIN_PLAUSIBLE_BYTES = 1024;
 /** Expected OUTPUT duration (seconds) for progress scaling. */
 function expectedOutSeconds(rec) {
 	const rangeSec = Math.max(.001, (rec.toMs - rec.fromMs) / 1e3);
@@ -2557,35 +2778,76 @@ var ExportEngine = class {
 			return;
 		}
 		try {
-			await this.spawnRender(id, rec, playlist);
+			await this.spawnRender(id, rec, playlist.path, this.streamTimeOptions(rec, playlist.segments));
 		} finally {
 			if (this.deps.cleanupPlaylist) try {
-				await this.deps.cleanupPlaylist(playlist);
+				await this.deps.cleanupPlaylist(playlist.path);
 			} catch (err) {
-				this.deps.logger.warn("export: source playlist cleanup failed", { meta: {
-					exportId: id,
-					playlist,
-					error: err instanceof Error ? err.message : String(err)
-				} });
+				this.deps.logger.warn("export: source playlist cleanup failed", {
+					tags: { deviceId: rec.deviceId },
+					meta: {
+						exportId: id,
+						playlist: playlist.path,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
 			}
 		}
 	}
+	/**
+	* The record's options with any dense overlay moved onto ffmpeg's clock.
+	*
+	* The translation is reported on EVERY render that carries an overlay, not
+	* only when something is dropped: `denseRangesRequested` vs
+	* `denseRangesMapped` is the one line that can tell "the video is uniform
+	* because the night was quiet" from "the video is uniform because every range
+	* missed" — the distinction that went unnoticed for a full night because the
+	* only line printed was the requested count.
+	*/
+	streamTimeOptions(rec, segments) {
+		const { options, report } = withStreamTimeDenseRanges({
+			options: rec.options,
+			fromMs: rec.fromMs,
+			segments
+		});
+		if (report !== null) this.logDenseMapping(rec, report);
+		return options;
+	}
+	/** One line, whatever the outcome — `warn` when ranges were dropped, because
+	*  a dropped range is footage the operator asked for and did not get. */
+	logDenseMapping(rec, report) {
+		const entry = {
+			tags: { deviceId: rec.deviceId },
+			meta: {
+				exportId: rec.id,
+				denseRangesRequested: report.requested,
+				denseRangesMapped: report.mapped,
+				...report.dropped.length > 0 ? { denseRangesDropped: report.dropped } : {}
+			}
+		};
+		const message = "export dense ranges mapped onto the concatenated stream";
+		if (report.dropped.length > 0) this.deps.logger.warn(message, entry);
+		else this.deps.logger.info(message, entry);
+	}
 	/** Spawn ffmpeg for one render and resolve when it has exited + finalized. */
-	async spawnRender(id, rec, playlist) {
+	async spawnRender(id, rec, playlist, options) {
 		const outPath = this.deps.outPath(rec);
 		const args = buildExportArgs({
 			inputPlaylist: playlist,
 			outPath,
-			options: rec.options
+			options
 		});
 		const totalSec = expectedOutSeconds(rec);
-		this.deps.logger.info("export render starting", { meta: {
-			exportId: id,
-			deviceId: rec.deviceId,
-			profile: rec.profile,
-			playlist,
-			outPath
-		} });
+		this.deps.logger.info("export render starting", {
+			tags: { deviceId: rec.deviceId },
+			meta: {
+				exportId: id,
+				deviceId: rec.deviceId,
+				profile: rec.profile,
+				playlist,
+				outPath
+			}
+		});
 		this.deps.logger.debug("export ffmpeg argv", { meta: {
 			exportId: id,
 			args
@@ -2645,6 +2907,17 @@ var ExportEngine = class {
 			await this.fail(id, err instanceof Error ? err.message : String(err));
 			return;
 		}
+		if (bytes < 1024) {
+			this.deps.logger.error("export produced no video frames", { meta: {
+				exportId: id,
+				outPath,
+				bytes,
+				minBytes: EXPORT_MIN_PLAUSIBLE_BYTES
+			} });
+			await this.deps.removeFile(outPath);
+			await this.fail(id, `render produced no video frames (${bytes} bytes, < ${EXPORT_MIN_PLAUSIBLE_BYTES})`);
+			return;
+		}
 		await patchExport(this.deps.state, id, {
 			state: "ready",
 			progressPct: 100,
@@ -3026,6 +3299,73 @@ function buildRecordingDeviceSchema() {
 		}]
 	}] };
 }
+/** The placement-store key for one (camera, profile). Mirrors `assignmentKey`
+*  in `placement-store.ts`; kept local so this module stays dependency-free. */
+function sourceKey(source) {
+	return `${source.deviceId}:${source.profile}`;
+}
+/** Biggest pile first (the overloaded disk is relieved fastest), ties broken
+*  deterministically so the same input always yields the same plan. */
+function bySizeThenKey(a, b) {
+	return b.bytes - a.bytes || a.deviceId - b.deviceId || a.profile.localeCompare(b.profile);
+}
+/**
+* Plan the moves that would make stored footage agree with the placement plan.
+* Pure: the same input always yields the same plan, and the input is untouched.
+*/
+function planRebalance(input) {
+	const minMoveBytes = input.minMoveBytes ?? 1e9;
+	const remaining = new Map(input.headroom.map((h) => [h.locationId, h.headroomBytes]));
+	const moves = [];
+	const skipped = [];
+	let bytesToMove = 0;
+	for (const source of [...input.sources].sort(bySizeThenKey)) {
+		const target = input.assignments.get(sourceKey(source));
+		if (target === source.locationId) continue;
+		const skip = (reason, toLocationId) => {
+			skipped.push({
+				deviceId: source.deviceId,
+				profile: source.profile,
+				fromLocationId: source.locationId,
+				toLocationId,
+				bytes: source.bytes,
+				reason
+			});
+		};
+		if (target === void 0) {
+			skip("unassigned", null);
+			continue;
+		}
+		const headroomBytes = remaining.get(target);
+		if (headroomBytes === void 0) {
+			skip("target-not-writable", target);
+			continue;
+		}
+		if (source.bytes < minMoveBytes) {
+			skip("below-threshold", target);
+			continue;
+		}
+		if (source.bytes > headroomBytes) {
+			skip("no-headroom", target);
+			continue;
+		}
+		remaining.set(target, headroomBytes - source.bytes);
+		bytesToMove += source.bytes;
+		moves.push({
+			deviceId: source.deviceId,
+			profile: source.profile,
+			fromLocationId: source.locationId,
+			toLocationId: target,
+			bytes: source.bytes,
+			files: source.files
+		});
+	}
+	return {
+		moves,
+		skipped,
+		bytesToMove
+	};
+}
 //#endregion
 //#region src/recorder/addon/recording-provider.ts
 /**
@@ -3303,6 +3643,75 @@ async function openRangeFromDisk(absPath, size) {
 		close: () => handle.close()
 	};
 }
+/** Bytes in one operator-facing gigabyte — the same decimal GB `maxUsedGb`
+*  uses, so two knobs on the same page never mean two different things. */
+var BYTES_PER_GB = 1e9;
+/**
+* The operator-armed rebalance, both halves (D116, Phase 2).
+*
+* `arm: false` is the dry run the operator confirms; `arm: true` enqueues one
+* relocate job per planned move, FIFO behind the single-flight mover. The two
+* share this one body deliberately: what is confirmed is exactly what runs.
+*
+* Every refusal is LOGGED, per camera. A rebalance that quietly leaves half the
+* archive where it was is indistinguishable from one that had nothing to do,
+* and this repo has paid for that ambiguity twice.
+*/
+async function runRebalance(deps, input, arm) {
+	const relocate = deps.relocate;
+	if (!deps.placementSnapshot) throw new Error("placement is not active on this node");
+	if (arm && !relocate) throw new Error("relocation unavailable on this node");
+	const snapshot = await deps.placementSnapshot();
+	const plan = planRebalance({
+		assignments: snapshot.assignments,
+		sources: deps.index.piles(),
+		headroom: snapshot.headroom,
+		...input.minMoveGb !== void 0 ? { minMoveBytes: input.minMoveGb * BYTES_PER_GB } : {}
+	});
+	for (const skip of plan.skipped) deps.logger.info("recorder rebalance: footage left where it is", {
+		tags: { deviceId: skip.deviceId },
+		meta: {
+			profile: skip.profile,
+			from: skip.fromLocationId,
+			to: skip.toLocationId,
+			bytes: skip.bytes,
+			reason: skip.reason
+		}
+	});
+	const result = {
+		moves: [...plan.moves],
+		skipped: [...plan.skipped],
+		bytesToMove: plan.bytesToMove,
+		jobIds: []
+	};
+	if (!arm || !relocate) return result;
+	const jobIds = [];
+	for (const move of plan.moves) {
+		const jobId = relocate.start({
+			fromLocationId: move.fromLocationId,
+			toLocationId: move.toLocationId,
+			deviceId: move.deviceId,
+			profiles: [move.profile],
+			...input.throttleMbps !== void 0 ? { throttleMbps: input.throttleMbps } : {}
+		});
+		jobIds.push(jobId);
+		deps.logger.info("recorder rebalance: relocate job enqueued", {
+			tags: { deviceId: move.deviceId },
+			meta: {
+				jobId,
+				profile: move.profile,
+				from: move.fromLocationId,
+				to: move.toLocationId,
+				bytes: move.bytes,
+				files: move.files
+			}
+		});
+	}
+	return {
+		...result,
+		jobIds
+	};
+}
 /**
 * Build the `IRecordingProvider`. The provider is a thin façade over the v2
 * core; all storage I/O flows through the injected deps.
@@ -3366,11 +3775,12 @@ function buildRecordingProvider(deps) {
 			for (const loc of locations) for (const row of deps.index.segmentsOnLocation(loc.id)) seenDevices.add(row.deviceId);
 			let totalUsedBytes = 0;
 			for (const deviceId of seenDevices) {
-				const usedBytes = deps.index.accounting(deviceId).bytes;
-				totalUsedBytes += usedBytes;
+				const accounting = deps.index.accounting(deviceId);
+				totalUsedBytes += accounting.bytes;
 				devices.push({
 					deviceId,
-					usedBytes
+					usedBytes: accounting.bytes,
+					oldestMs: accounting.oldestMs
 				});
 			}
 			const byPhysical = /* @__PURE__ */ new Map();
@@ -3557,6 +3967,24 @@ function buildRecordingProvider(deps) {
 		},
 		getStorageMigrationMoveStatus: async ({ jobId }) => deps.relocate?.list().find((job) => job.jobId === jobId) ?? null,
 		cancelStorageMigrationMove: async ({ jobId }) => ({ cancelled: deps.relocate?.cancel(jobId) ?? false }),
+		relocateFootage: async (input) => {
+			if (!deps.relocate) throw new Error("relocation unavailable on this node");
+			const jobId = deps.relocate.start(input);
+			deps.logger.info("recorder: relocate job enqueued", {
+				...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
+				meta: {
+					jobId,
+					from: input.fromLocationId,
+					to: input.toLocationId,
+					profiles: input.profiles ?? null
+				}
+			});
+			return { jobId };
+		},
+		listRelocateJobs: async () => deps.relocate?.list() ?? [],
+		cancelRelocateJob: async ({ jobId }) => ({ cancelled: deps.relocate?.cancel(jobId) ?? false }),
+		planStorageRebalance: (input) => runRebalance(deps, input, false),
+		startStorageRebalance: (input) => runRebalance(deps, input, true),
 		getDeviceSettingsContribution: async ({ deviceId }) => {
 			if (deps.isCameraDevice && !await deps.isCameraDevice(deviceId)) return null;
 			return hydrateSchema(buildRecordingDeviceSchema(), {});
@@ -3602,9 +4030,9 @@ function exportSourcePlaylistPath(exportsDir, deviceId, exportId) {
 	return path.join(exportsDir, String(deviceId), `${exportId}.src.m3u8`);
 }
 /**
-* Write the export's source playlist and return its absolute path, or null when
-* no segment of the requested profile is present on disk for the range (the
-* engine then fails the job with 'no footage for range').
+* Write the export's source playlist and return it, or null when no segment of
+* the requested profile is present on disk for the range (the engine then fails
+* the job with 'no footage for range').
 */
 async function writeExportSourcePlaylist(input) {
 	const { segments } = await collectRangeSegments(input.deps, input.deviceId, input.profile, input.fromMs, input.toMs, "absolute");
@@ -3612,26 +4040,16 @@ async function writeExportSourcePlaylist(input) {
 	const playlistPath = exportSourcePlaylistPath(input.exportsDir, input.deviceId, input.exportId);
 	await promises.mkdir(path.dirname(playlistPath), { recursive: true });
 	await promises.writeFile(playlistPath, buildVariantPlaylist(segments), "utf8");
-	return playlistPath;
+	return {
+		path: playlistPath,
+		segments: segments.map((s) => ({
+			startMs: s.startMs,
+			durMs: s.durMs
+		}))
+	};
 }
 //#endregion
 //#region src/recorder/addon/footage-render.ts
-/**
-* One-shot media render FROM RECORDED FOOTAGE (notification attachments).
-*
-* Shared core behind `renderGif` and `renderClip`: both cut the same window out
-* of the same `low` profile through the export machinery's per-render source
-* playlist (absolute segment URIs — the ONLY playlist shape ffmpeg can consume,
-* see export-source-playlist.ts), pipe it through ONE ffmpeg invocation, and
-* return the bytes. Everything is transient: playlist and output are deleted on
-* every outcome.
-*
-* Fail-closed by construction: no footage covering the window ⇒ it throws, and
-* the caller (a notification rule) simply ships no attachment. A camera that is
-* not recording therefore cannot produce a clip — which is exactly why the
-* frame-ring plane (roadmap Phase 5) still matters for cameras with no
-* recording. It is NOT a prerequisite for the cameras that do record.
-*/
 var RENDER_TIMEOUT_MS = 3e4;
 /**
 * A notification clip must sit AROUND the moment it describes. Sliding the
@@ -3729,9 +4147,9 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 		toMs: window.toMs
 	});
 	if (playlist === null) throw new Error(`no footage covers [${window.fromMs}, ${window.toMs}) for device ${input.deviceId}`);
-	const outPath = path.join(path.dirname(playlist), `${renderId}.${ext}`);
+	const outPath = path.join(path.dirname(playlist.path), `${renderId}.${ext}`);
 	try {
-		await runFfmpeg(renderDeps, buildArgs(playlist, outPath), ext);
+		await runFfmpeg(renderDeps, buildArgs(playlist.path, outPath), ext);
 		const bytes = await promises.readFile(outPath);
 		if (bytes.byteLength === 0) throw new Error(`${ext} render produced an empty file`);
 		return {
@@ -3740,7 +4158,7 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 			toMs: window.toMs
 		};
 	} finally {
-		await promises.rm(playlist, { force: true }).catch(() => {});
+		await promises.rm(playlist.path, { force: true }).catch(() => {});
 		await promises.rm(outPath, { force: true }).catch(() => {});
 	}
 }
@@ -4688,6 +5106,33 @@ var PlacementService = class {
 		return plan;
 	}
 	/**
+	* The write targets and what each can still absorb — the SAME pool and the
+	* SAME headroom `recompute` plans over.
+	*
+	* Exposed for the operator-armed rebalance (D116): weighing existing footage
+	* against a second, independently-derived idea of "what fits" is how the two
+	* halves end up disagreeing, and a rebalance that plans onto a location the
+	* planner would never write to is a rebalance that undoes itself on the next
+	* tick. A location absent from this list is not a write target at all.
+	*/
+	async candidates() {
+		return this.candidatesFor(this.pool());
+	}
+	/**
+	* The plan in force: `<deviceId>:<profile>` → locationId. Empty when the
+	* store cannot be read — a fallible read decides nothing (D49), and an empty
+	* plan makes the rebalance report every pile as `unassigned` rather than
+	* inventing moves.
+	*/
+	async currentAssignments() {
+		try {
+			return new Map(Object.entries((await readPlacementState(this.deps.state)).assignments));
+		} catch (err) {
+			this.deps.logger.warn("recorder placement: assignment read failed — reporting no plan", { meta: { error: errMsg(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
 	* Turn each pool location into a planner candidate. Headroom is
 	* `min(free − minFree floor, maxUsedGb − used)`, clamped at zero: the first
 	* term is the per-location free-space guard the storage pressure manager also
@@ -4957,6 +5402,49 @@ function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
 	return false;
 }
 //#endregion
+//#region src/recorder/addon/periodic-pass.ts
+function startPeriodicPass(deps) {
+	const now = () => deps.now?.() ?? Date.now();
+	let startedAt = null;
+	let stopped = false;
+	const fire = () => {
+		if (stopped) return;
+		if (startedAt !== null) {
+			deps.logger.warn("recorder: pass skipped — the previous pass is still running", { meta: {
+				pass: deps.name,
+				inFlightMs: now() - startedAt,
+				intervalMs: deps.intervalMs
+			} });
+			return;
+		}
+		const began = now();
+		startedAt = began;
+		deps.run().catch((err) => {
+			deps.logger.warn("recorder: pass failed", { meta: {
+				pass: deps.name,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}).finally(() => {
+			const durationMs = now() - began;
+			startedAt = null;
+			if (durationMs > deps.slowAfterMs) deps.logger.warn("recorder: pass exceeded its budget", { meta: {
+				pass: deps.name,
+				durationMs,
+				budgetMs: deps.slowAfterMs
+			} });
+		});
+	};
+	const timer = setInterval(fire, deps.intervalMs);
+	timer.unref?.();
+	return {
+		stop() {
+			stopped = true;
+			clearInterval(timer);
+		},
+		isRunning: () => startedAt !== null
+	};
+}
+//#endregion
 //#region src/recorder/addon/readiness-restore.ts
 var ReadinessRestore = class {
 	deps;
@@ -5043,10 +5531,59 @@ var ReadinessRestore = class {
 * no subtree to classify.
 */
 var EPOCH_NAME_RE = /^(\d+)\.m4s$/;
-/** How many consecutive ticks to wait for a finalized segment's flat file to
-*  land before giving up on it (a genuine phantom). At a 2s watch interval this
-*  is ~16s — far longer than ffmpeg's slow-first-segment flush. */
-var MAX_PENDING_TICKS = 8;
+/**
+* How long a finalized segment's flat file may take to appear before the entry
+* is given up on.
+*
+* This used to be `MAX_PENDING_TICKS = 8` — a count of TICKS, which is not a
+* measure of time. The tick loop self-excludes while a pass is running and each
+* pass does real filesystem work, so on 2026-08-10..13 eight ticks measured
+* anywhere from 8 s to 819 s. A bound has to be denominated in the thing it
+* bounds.
+*
+* 30 s is chosen from the measurement, not from taste. Over four days the
+* segments that were retried and then DID land waited p50 7.8 s and p90 11.6 s,
+* and widening the window from 16 s to 120 s moved coverage only from 92.9% to
+* 93.8%. There is no tail to chase: past this knee a segment is not slow, it is
+* lost (a writer killed mid-segment), and waiting only delays the skip and the
+* log line that reports it.
+*/
+var PENDING_GRACE_MS = 3e4;
+/**
+* How far before the writer's own start a segment may be named and still be
+* treated as belonging to THIS run.
+*
+* ffmpeg names segments with whole-second `%s`, so the first segment of a run
+* carries the second that was already in progress when the process spawned —
+* up to ~1 s "before" the writer started. Without this tolerance the very first
+* segment of every recording would be classified as a previous run's leftover
+* and dropped.
+*/
+var PREVIOUS_RUN_SKEW_MS = 1e3;
+/**
+* Decide whether a missing flat file is a late flush or a previous run's entry.
+*
+* ffmpeg's `-segment_list` file is not cleared between runs and a fresh watcher
+* starts at `processed = 0`, so the first passes after every attach replay the
+* PREVIOUS run's playlist. Those entries were relocated into the bucket tree
+* long ago; their absence is the system working. Over 2026-08-10..13 they were
+* 83% of all retries (median age 1 615 s, max 17.4 h) and produced 68 of the
+* 122 `never landed` warnings — a warning that reads like data loss for a file
+* that was correctly filed hours earlier.
+*
+* Note what this deliberately does NOT do: it does not skip a previous run's
+* entry whose file is STILL THERE. That case is real crash recovery — an
+* unclean stop leaves un-relocated segments in `.rec-tmp` and the playlist is
+* the only record of their durations — so the caller stats first and only asks
+* this question once the file is known to be absent.
+*/
+function classifyMissingEntry(input) {
+	return input.segmentStartMs < input.writerStartedMs - PREVIOUS_RUN_SKEW_MS ? "stale-previous-run" : "pending";
+}
+/** Whether a pending entry has outlived its grace. Pure — the caller clocks it. */
+function shouldGiveUpOnPending(input) {
+	return input.waitedMs > input.boundMs;
+}
 /**
 * Derive `startMs` (epoch milliseconds) from a flat ffmpeg segment path
 * (`<epochSec>.m4s`, possibly absolute). Returns null for any non-epoch path.
@@ -5121,11 +5658,22 @@ async function statSize(p) {
 * Unlike the old recorder, this watcher does NOT relocate or re-stat: the
 * SegmentStore owns the move + the authoritative byte count.
 */
-async function handleSegmentEntry(outDir, entry, durMs, onFinalized, logger) {
+async function handleSegmentEntry(outDir, entry, durMs, onFinalized, logger, writerStartedMs) {
 	const flatAbsPath = path.isAbsolute(entry.segPath) ? entry.segPath : path.join(outDir, entry.segPath);
 	const startMs = parseEpochStartMs(flatAbsPath);
 	if (startMs === null) return "skipped";
 	if (await statSize(flatAbsPath) === null) {
+		if (classifyMissingEntry({
+			segmentStartMs: startMs,
+			writerStartedMs
+		}) === "stale-previous-run") {
+			logger.debug("segment entry predates this writer — already relocated, skipping", { meta: {
+				path: flatAbsPath,
+				segmentStartMs: startMs,
+				writerStartedMs
+			} });
+			return "skipped";
+		}
 		logger.debug("segment flat file not on disk yet — will retry", { meta: { path: flatAbsPath } });
 		return "pending";
 	}
@@ -5171,12 +5719,13 @@ function planFinalizations(body, processed, forceFinal = false) {
 */
 function startSegmentWatcher(deps) {
 	const playlistPath = path.join(deps.outDir, "live.m3u8");
+	const now = () => deps.now?.() ?? Date.now();
 	let processed = 0;
 	let stopped = false;
 	let ticking = false;
 	let currentTick = null;
 	let pendingIndex = -1;
-	let pendingTicks = 0;
+	let pendingSinceMs = 0;
 	const tick = async (forceFinal = false) => {
 		if (stopped || ticking) return;
 		ticking = true;
@@ -5190,19 +5739,26 @@ function startSegmentWatcher(deps) {
 			const plan = planFinalizations(body, processed, forceFinal);
 			let index = plan.from;
 			for (const { entry, durMs } of plan.toHandle) {
-				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger) === "pending") {
+				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger, deps.writerStartedMs) === "pending") {
 					if (pendingIndex === index) {
-						pendingTicks++;
-						if (pendingTicks >= MAX_PENDING_TICKS) {
-							deps.logger.warn("segment file never landed — skipping", { meta: { seg: entry.segPath } });
+						const waitedMs = now() - pendingSinceMs;
+						if (shouldGiveUpOnPending({
+							waitedMs,
+							boundMs: 3e4
+						})) {
+							deps.logger.warn("segment file never landed — skipping", { meta: {
+								seg: entry.segPath,
+								waitedMs,
+								boundMs: PENDING_GRACE_MS
+							} });
 							pendingIndex = -1;
-							pendingTicks = 0;
+							pendingSinceMs = 0;
 							index++;
 							continue;
 						}
 					} else {
 						pendingIndex = index;
-						pendingTicks = 1;
+						pendingSinceMs = now();
 					}
 					break;
 				}
@@ -5210,7 +5766,7 @@ function startSegmentWatcher(deps) {
 			}
 			if (pendingIndex !== index) {
 				pendingIndex = -1;
-				pendingTicks = 0;
+				pendingSinceMs = 0;
 			}
 			processed = index;
 		} finally {
@@ -5411,9 +5967,16 @@ var SegmentWriter = class {
 * (`shouldRecordContinuousAt`) and ensures the writer set is running iff so.
 * It re-evaluates on three triggers:
 *   1. `setDeviceConfig` (operator changed the bands / enable),
-*   2. a periodic tick (catches band boundaries crossed with no config change),
+*   2. a periodic pass (catches band boundaries crossed with no config change),
 *   3. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`).
 *
+* There are TWO periodic passes, on separate timers and never overlapping
+* themselves (`periodic-pass.ts`): a cheap LIVENESS pass that catches writers
+* pinned but producing nothing, and an expensive CONVERGENCE pass that
+* re-evaluates bands and placement. They were one pass until 2026-08-13, when a
+* convergence sweep wedged on unbounded broker RPCs and took the liveness
+* watchdog down with it for 9-27 minutes at a time.
+*
 * EVENTS bands are treated as "not recording continuously" in B2 — B3 adds
 * trigger-gating. The enable intent is persisted in durable-state by the
 * config-store, so `restoreEnabledDevices` on boot re-attaches every device
@@ -5443,6 +6006,34 @@ var TICK_MS = 3e4;
 */
 var RELEASE_RPC_TIMEOUT_MS = 2e3;
 /**
+* Bound on each broker RPC in the ATTACH chain (`listAllProfileSlots`,
+* `getStreamWithCodec`).
+*
+* These were the only unbounded calls left in the controller.
+* `CapabilityHandle.call` gates READINESS (10 s) and then returns `fn()`
+* untouched, so an accepted-but-unanswered request fell through to the 60 s UDS
+* default in `kernel/transport/socket-channel.ts`. On 2026-08-13 the broker was
+* degraded (516 UDS timeouts that day) and the arithmetic did the damage: one
+* device costs `listAllProfileSlots` + one `getStreamWithCodec` per profile, so
+* a 4-camera fleet on 3 profiles reached ~16 minutes inside a single recovery
+* pass — during which every device sits DETACHED (recording stopped) and in
+* `attaching` (so `evaluateDevice` returns early and the liveness watchdog,
+* which reads `active`, has nothing to report). That is the shape of the 9-27
+* minute silences and the real recording gaps behind the 80% timelapse
+* coverage.
+*
+* 20 s is generous for a real RTSP dial and far below the UDS default, so a
+* hung broker now fails the attach fast. Nothing is lost by giving up: the
+* device stays on the readiness-restore queue and the next pass retries it.
+*/
+var ATTACH_RPC_TIMEOUT_MS = 2e4;
+/**
+* A pass longer than this is reported with its duration. Equal to the pass
+* cadence: a pass that cannot finish inside its own interval is the condition
+* that used to go unlogged for half an hour.
+*/
+var PASS_SLOW_AFTER_MS = TICK_MS;
+/**
 * Race `promise` against a deadline. Handlers stay attached to the losing
 * promise, so a post-deadline settlement can never surface as a process-level
 * `unhandledRejection`.
@@ -5530,7 +6121,10 @@ var RecordingController = class {
 	*/
 	unrecordableReported = /* @__PURE__ */ new Set();
 	restore = null;
-	tickTimer = null;
+	/** Cheap, never-delayed: is any pinned writer producing nothing? */
+	livenessPass = null;
+	/** Expensive: re-evaluate bands + placement for every configured device. */
+	convergePass = null;
 	stopped = false;
 	/** A reversible maintenance lease. Unlike `stopped`, it never changes
 	* persisted recording intent and `resume()` restarts normal convergence. */
@@ -5565,18 +6159,28 @@ var RecordingController = class {
 				meta: { error: errMsg(err) }
 			})
 		});
-		if (this.tickTimer === null) {
-			this.tickTimer = setInterval(() => {
-				this.tick();
-			}, TICK_MS);
-			this.tickTimer.unref?.();
+		if (this.convergePass === null) {
+			this.livenessPass = startPeriodicPass({
+				name: "liveness",
+				intervalMs: TICK_MS,
+				slowAfterMs: PASS_SLOW_AFTER_MS,
+				logger: this.deps.logger,
+				now: () => this.now(),
+				run: () => this.checkIdleWriters()
+			});
+			this.convergePass = startPeriodicPass({
+				name: "convergence",
+				intervalMs: TICK_MS,
+				slowAfterMs: PASS_SLOW_AFTER_MS,
+				logger: this.deps.logger,
+				now: () => this.now(),
+				run: () => this.converge()
+			});
 		}
 		await this.restore.start(ids.map((id) => [id, true]));
 	}
-	/** Re-evaluate every currently-tracked OR active device on the periodic tick. */
-	async tick() {
-		if (this.stopped) return;
-		await this.checkIdleWriters();
+	/** Re-evaluate every currently-tracked OR active device on the periodic pass. */
+	async converge() {
 		if (this.stopped) return;
 		const ids = new Set(this.active.keys());
 		let persisted = [];
@@ -5592,7 +6196,7 @@ var RecordingController = class {
 		for (const id of ids) try {
 			await this.evaluateDevice(id);
 		} catch (err) {
-			this.deps.logger.warn("recorder controller: tick evaluate failed", {
+			this.deps.logger.warn("recorder controller: convergence evaluate failed", {
 				tags: { deviceId: id },
 				meta: { error: errMsg(err) }
 			});
@@ -5666,7 +6270,7 @@ var RecordingController = class {
 				segmentSeconds: this.active.get(s.deviceId)?.find((r) => r.profile === s.profile)?.segmentSeconds
 			}
 		});
-		for (const deviceId of devices) await this.recoverWriterGaveUp(deviceId);
+		await Promise.all([...devices].map((deviceId) => this.recoverWriterGaveUp(deviceId)));
 	}
 	/** Current trigger state for a device (cold default = no triggers seen). */
 	triggersFor(deviceId) {
@@ -5808,7 +6412,7 @@ var RecordingController = class {
 	* assigned sources is ignored (record every assigned source — minimum of 1).
 	*/
 	async resolveProfiles(deviceId, override) {
-		const assigned = selectAssignedProfileSlots(await this.deps.brokerCall(() => this.deps.api.streamBroker.listAllProfileSlots.query(void 0, nodePin(this.deps.ownerNodeId))), deviceId).map((slot) => slot.profile);
+		const assigned = selectAssignedProfileSlots(await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.listAllProfileSlots.query(void 0, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "listAllProfileSlots")), deviceId).map((slot) => slot.profile);
 		if (!override || override.length === 0) return assigned;
 		const selected = assigned.filter((p) => override.includes(p));
 		return selected.length > 0 ? selected : assigned;
@@ -5821,14 +6425,14 @@ var RecordingController = class {
 	*/
 	async attachProfile(deviceId, profile, segmentSeconds) {
 		const placement = await this.resolvePlacement(deviceId, profile);
-		const source = await this.deps.brokerCall(() => this.deps.api.streamBroker.getStreamWithCodec.mutate({
+		const source = await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.getStreamWithCodec.mutate({
 			deviceId,
 			video: "copy",
 			audio: "aac",
 			profile,
 			...this.deps.consumerHostname !== void 0 ? { hostname: this.deps.consumerHostname } : {},
 			tag: `recorder:${deviceId}/${profile}`
-		}, nodePin(this.deps.ownerNodeId)));
+		}, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "getStreamWithCodec"));
 		const outDir = path.join(placement.root, STAGING_DIR_NAME, String(deviceId), profile);
 		await promises.mkdir(outDir, { recursive: true });
 		const deviceLog = this.deps.logger.withTags({ deviceId });
@@ -5844,6 +6448,7 @@ var RecordingController = class {
 				this.recoverWriterGaveUp(deviceId);
 			}
 		});
+		const writerStartedMs = this.now();
 		writer.start();
 		this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
 		return {
@@ -5851,6 +6456,8 @@ var RecordingController = class {
 			writer,
 			watcher: startSegmentWatcher({
 				outDir,
+				writerStartedMs,
+				now: () => this.now(),
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
@@ -5967,10 +6574,10 @@ var RecordingController = class {
 	/** Tear EVERYTHING down: timer, restore subscription, every writer/watcher/lease. */
 	async stop() {
 		this.stopped = true;
-		if (this.tickTimer !== null) {
-			clearInterval(this.tickTimer);
-			this.tickTimer = null;
-		}
+		this.livenessPass?.stop();
+		this.livenessPass = null;
+		this.convergePass?.stop();
+		this.convergePass = null;
 		this.restore?.stop();
 		this.restore = null;
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));
@@ -6573,6 +7180,7 @@ var RecorderV2Addon = class extends BaseAddon {
 			resumeForStorageMigration: (leaseId) => this.resumeForStorageMigration(leaseId),
 			refreshStorageLocationsForMigration: (leaseId) => this.refreshStorageLocationsForMigration(leaseId),
 			assertStorageMigrationLease: (leaseId) => this.assertStorageMigrationLease(leaseId),
+			placementSnapshot: () => this.placementSnapshot(),
 			dataDir: this.ctx.dataDir,
 			playbackBaseUrl: () => this.playbackBaseUrl,
 			isCameraDevice: async (deviceId) => {
@@ -7012,6 +7620,28 @@ var RecorderV2Addon = class extends BaseAddon {
 		await this.placement.recompute(work);
 	}
 	/**
+	* The plan in force plus each write target's headroom, for the operator-armed
+	* rebalance (D116, Phase 2). Both come from the SAME `PlacementService` the
+	* 30 s tick plans with: a rebalance computed against a second idea of "what
+	* fits" would plan moves the next tick undoes.
+	*
+	* Throws when placement is not active (a non-recording node, or early boot) —
+	* the rebalance is an operator action and a silent empty plan would read as
+	* "nothing to do".
+	*/
+	async placementSnapshot() {
+		const placement = this.placement;
+		if (!placement) throw new Error("placement is not active on this node");
+		const [assignments, candidates] = await Promise.all([placement.currentAssignments(), placement.candidates()]);
+		return {
+			assignments,
+			headroom: candidates.map((candidate) => ({
+				locationId: candidate.locationId,
+				headroomBytes: candidate.headroomBytes
+			}))
+		};
+	}
+	/**
 	* Measured bytes/day for one (camera, profile) — the demand signal the
 	* placement planner weights against each location's headroom. Derived from
 	* the index's own accounting (segment paths encode bytes + start), so it