@camstack/addon-pipeline 1.2.70 → 1.2.72

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-BPaa4_z6.mjs";
+import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-CNYUiN27.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CZ2xo67g.mjs";
 import { randomUUID } from "node:crypto";
@@ -2414,6 +2414,105 @@ function sendDirectory(res, payload) {
 	res.end(Buffer.from(body));
 }
 //#endregion
+//#region src/recorder/addon/export-dense-map.ts
+/**
+* Shortest clip worth keeping, in ms.
+*
+* Exists only to honour `ExportDenseRangeSchema`'s `toSec > fromSec`: a range
+* clipped to a sliver of footage is still honest, but a range clipped to
+* NOTHING must not be emitted as a zero-length interval the schema refuses.
+*/
+var MIN_MAPPED_MS = 1;
+/** Milliseconds of footage that precede `wallMs` in the concatenation. */
+function recordedMsBefore(segments, wallMs) {
+	let acc = 0;
+	for (const s of segments) if (wallMs >= s.startMs + s.durMs) acc += s.durMs;
+	else if (wallMs > s.startMs) acc += wallMs - s.startMs;
+	return acc;
+}
+/** Whole milliseconds → seconds, with no float tail for the filter string. */
+function msToSec(ms) {
+	return Math.round(ms) / 1e3;
+}
+/**
+* Translate wall-clock dense ranges into the export's stream timeline.
+*
+* @returns the surviving ranges (in stream seconds, ordered as given) plus the
+*   report the render logs.
+*/
+function mapDenseRangesToStreamTime(input) {
+	const segments = [...input.segments].sort((a, b) => a.startMs - b.startMs);
+	const footageEndMs = segments.reduce((end, s) => Math.max(end, s.startMs + s.durMs), input.exportFromMs);
+	const mapped = [];
+	const dropped = [];
+	for (const range of input.ranges) {
+		const fromWallMs = input.exportFromMs + range.fromSec * 1e3;
+		const toWallMs = input.exportFromMs + range.toSec * 1e3;
+		const fromMs = Math.round(recordedMsBefore(segments, fromWallMs));
+		const toMs = Math.round(recordedMsBefore(segments, toWallMs));
+		if (toMs - fromMs < MIN_MAPPED_MS) {
+			dropped.push({
+				fromSec: range.fromSec,
+				toSec: range.toSec,
+				reason: fromWallMs >= footageEndMs ? "past-end" : "gap"
+			});
+			continue;
+		}
+		mapped.push({
+			fromSec: msToSec(fromMs),
+			toSec: msToSec(toMs)
+		});
+	}
+	return {
+		ranges: mapped,
+		report: {
+			requested: input.ranges.length,
+			mapped: mapped.length,
+			dropped
+		}
+	};
+}
+/**
+* One export's options with its dense ranges expressed in stream time.
+*
+* An overlay that maps to NOTHING is removed entirely rather than left with an
+* empty range list: `ExportDenseSchema` refuses `ranges: []` and
+* `selectPredicate` would emit `if(,…)`, a filter ffmpeg rejects — so a night
+* whose busy moments all fell in holes would fail the render instead of
+* delivering the uniform video it legitimately is.
+*/
+function withStreamTimeDenseRanges(input) {
+	const timelapse = input.options.timelapse;
+	const dense = timelapse?.dense;
+	if (timelapse === void 0 || dense === void 0) return {
+		options: input.options,
+		report: null
+	};
+	const { ranges, report } = mapDenseRangesToStreamTime({
+		ranges: dense.ranges,
+		exportFromMs: input.fromMs,
+		segments: input.segments
+	});
+	const base = {
+		everyMs: timelapse.everyMs,
+		...timelapse.outputFps !== void 0 ? { outputFps: timelapse.outputFps } : {}
+	};
+	const remapped = ranges.length > 0 ? {
+		...base,
+		dense: {
+			everyMs: dense.everyMs,
+			ranges: [...ranges]
+		}
+	} : base;
+	return {
+		options: {
+			...input.options,
+			timelapse: remapped
+		},
+		report
+	};
+}
+//#endregion
 //#region src/recorder/addon/export-ffmpeg-args.ts
 /** Widest [min,max] speed a single ffmpeg `atempo` filter accepts. Outside this
 *  band audio is dropped rather than chained (kept simple + predictable). */
@@ -2679,35 +2778,76 @@ var ExportEngine = class {
 			return;
 		}
 		try {
-			await this.spawnRender(id, rec, playlist);
+			await this.spawnRender(id, rec, playlist.path, this.streamTimeOptions(rec, playlist.segments));
 		} finally {
 			if (this.deps.cleanupPlaylist) try {
-				await this.deps.cleanupPlaylist(playlist);
+				await this.deps.cleanupPlaylist(playlist.path);
 			} catch (err) {
-				this.deps.logger.warn("export: source playlist cleanup failed", { meta: {
-					exportId: id,
-					playlist,
-					error: err instanceof Error ? err.message : String(err)
-				} });
+				this.deps.logger.warn("export: source playlist cleanup failed", {
+					tags: { deviceId: rec.deviceId },
+					meta: {
+						exportId: id,
+						playlist: playlist.path,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
 			}
 		}
 	}
+	/**
+	* The record's options with any dense overlay moved onto ffmpeg's clock.
+	*
+	* The translation is reported on EVERY render that carries an overlay, not
+	* only when something is dropped: `denseRangesRequested` vs
+	* `denseRangesMapped` is the one line that can tell "the video is uniform
+	* because the night was quiet" from "the video is uniform because every range
+	* missed" — the distinction that went unnoticed for a full night because the
+	* only line printed was the requested count.
+	*/
+	streamTimeOptions(rec, segments) {
+		const { options, report } = withStreamTimeDenseRanges({
+			options: rec.options,
+			fromMs: rec.fromMs,
+			segments
+		});
+		if (report !== null) this.logDenseMapping(rec, report);
+		return options;
+	}
+	/** One line, whatever the outcome — `warn` when ranges were dropped, because
+	*  a dropped range is footage the operator asked for and did not get. */
+	logDenseMapping(rec, report) {
+		const entry = {
+			tags: { deviceId: rec.deviceId },
+			meta: {
+				exportId: rec.id,
+				denseRangesRequested: report.requested,
+				denseRangesMapped: report.mapped,
+				...report.dropped.length > 0 ? { denseRangesDropped: report.dropped } : {}
+			}
+		};
+		const message = "export dense ranges mapped onto the concatenated stream";
+		if (report.dropped.length > 0) this.deps.logger.warn(message, entry);
+		else this.deps.logger.info(message, entry);
+	}
 	/** Spawn ffmpeg for one render and resolve when it has exited + finalized. */
-	async spawnRender(id, rec, playlist) {
+	async spawnRender(id, rec, playlist, options) {
 		const outPath = this.deps.outPath(rec);
 		const args = buildExportArgs({
 			inputPlaylist: playlist,
 			outPath,
-			options: rec.options
+			options
 		});
 		const totalSec = expectedOutSeconds(rec);
-		this.deps.logger.info("export render starting", { meta: {
-			exportId: id,
-			deviceId: rec.deviceId,
-			profile: rec.profile,
-			playlist,
-			outPath
-		} });
+		this.deps.logger.info("export render starting", {
+			tags: { deviceId: rec.deviceId },
+			meta: {
+				exportId: id,
+				deviceId: rec.deviceId,
+				profile: rec.profile,
+				playlist,
+				outPath
+			}
+		});
 		this.deps.logger.debug("export ffmpeg argv", { meta: {
 			exportId: id,
 			args
@@ -3890,9 +4030,9 @@ function exportSourcePlaylistPath(exportsDir, deviceId, exportId) {
 	return path.join(exportsDir, String(deviceId), `${exportId}.src.m3u8`);
 }
 /**
-* Write the export's source playlist and return its absolute path, or null when
-* no segment of the requested profile is present on disk for the range (the
-* engine then fails the job with 'no footage for range').
+* Write the export's source playlist and return it, or null when no segment of
+* the requested profile is present on disk for the range (the engine then fails
+* the job with 'no footage for range').
 */
 async function writeExportSourcePlaylist(input) {
 	const { segments } = await collectRangeSegments(input.deps, input.deviceId, input.profile, input.fromMs, input.toMs, "absolute");
@@ -3900,26 +4040,16 @@ async function writeExportSourcePlaylist(input) {
 	const playlistPath = exportSourcePlaylistPath(input.exportsDir, input.deviceId, input.exportId);
 	await promises.mkdir(path.dirname(playlistPath), { recursive: true });
 	await promises.writeFile(playlistPath, buildVariantPlaylist(segments), "utf8");
-	return playlistPath;
+	return {
+		path: playlistPath,
+		segments: segments.map((s) => ({
+			startMs: s.startMs,
+			durMs: s.durMs
+		}))
+	};
 }
 //#endregion
 //#region src/recorder/addon/footage-render.ts
-/**
-* One-shot media render FROM RECORDED FOOTAGE (notification attachments).
-*
-* Shared core behind `renderGif` and `renderClip`: both cut the same window out
-* of the same `low` profile through the export machinery's per-render source
-* playlist (absolute segment URIs — the ONLY playlist shape ffmpeg can consume,
-* see export-source-playlist.ts), pipe it through ONE ffmpeg invocation, and
-* return the bytes. Everything is transient: playlist and output are deleted on
-* every outcome.
-*
-* Fail-closed by construction: no footage covering the window ⇒ it throws, and
-* the caller (a notification rule) simply ships no attachment. A camera that is
-* not recording therefore cannot produce a clip — which is exactly why the
-* frame-ring plane (roadmap Phase 5) still matters for cameras with no
-* recording. It is NOT a prerequisite for the cameras that do record.
-*/
 var RENDER_TIMEOUT_MS = 3e4;
 /**
 * A notification clip must sit AROUND the moment it describes. Sliding the
@@ -4017,9 +4147,9 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 		toMs: window.toMs
 	});
 	if (playlist === null) throw new Error(`no footage covers [${window.fromMs}, ${window.toMs}) for device ${input.deviceId}`);
-	const outPath = path.join(path.dirname(playlist), `${renderId}.${ext}`);
+	const outPath = path.join(path.dirname(playlist.path), `${renderId}.${ext}`);
 	try {
-		await runFfmpeg(renderDeps, buildArgs(playlist, outPath), ext);
+		await runFfmpeg(renderDeps, buildArgs(playlist.path, outPath), ext);
 		const bytes = await promises.readFile(outPath);
 		if (bytes.byteLength === 0) throw new Error(`${ext} render produced an empty file`);
 		return {
@@ -4028,7 +4158,7 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 			toMs: window.toMs
 		};
 	} finally {
-		await promises.rm(playlist, { force: true }).catch(() => {});
+		await promises.rm(playlist.path, { force: true }).catch(() => {});
 		await promises.rm(outPath, { force: true }).catch(() => {});
 	}
 }
@@ -5272,6 +5402,49 @@ function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
 	return false;
 }
 //#endregion
+//#region src/recorder/addon/periodic-pass.ts
+function startPeriodicPass(deps) {
+	const now = () => deps.now?.() ?? Date.now();
+	let startedAt = null;
+	let stopped = false;
+	const fire = () => {
+		if (stopped) return;
+		if (startedAt !== null) {
+			deps.logger.warn("recorder: pass skipped — the previous pass is still running", { meta: {
+				pass: deps.name,
+				inFlightMs: now() - startedAt,
+				intervalMs: deps.intervalMs
+			} });
+			return;
+		}
+		const began = now();
+		startedAt = began;
+		deps.run().catch((err) => {
+			deps.logger.warn("recorder: pass failed", { meta: {
+				pass: deps.name,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}).finally(() => {
+			const durationMs = now() - began;
+			startedAt = null;
+			if (durationMs > deps.slowAfterMs) deps.logger.warn("recorder: pass exceeded its budget", { meta: {
+				pass: deps.name,
+				durationMs,
+				budgetMs: deps.slowAfterMs
+			} });
+		});
+	};
+	const timer = setInterval(fire, deps.intervalMs);
+	timer.unref?.();
+	return {
+		stop() {
+			stopped = true;
+			clearInterval(timer);
+		},
+		isRunning: () => startedAt !== null
+	};
+}
+//#endregion
 //#region src/recorder/addon/readiness-restore.ts
 var ReadinessRestore = class {
 	deps;
@@ -5358,10 +5531,59 @@ var ReadinessRestore = class {
 * no subtree to classify.
 */
 var EPOCH_NAME_RE = /^(\d+)\.m4s$/;
-/** How many consecutive ticks to wait for a finalized segment's flat file to
-*  land before giving up on it (a genuine phantom). At a 2s watch interval this
-*  is ~16s — far longer than ffmpeg's slow-first-segment flush. */
-var MAX_PENDING_TICKS = 8;
+/**
+* How long a finalized segment's flat file may take to appear before the entry
+* is given up on.
+*
+* This used to be `MAX_PENDING_TICKS = 8` — a count of TICKS, which is not a
+* measure of time. The tick loop self-excludes while a pass is running and each
+* pass does real filesystem work, so on 2026-08-10..13 eight ticks measured
+* anywhere from 8 s to 819 s. A bound has to be denominated in the thing it
+* bounds.
+*
+* 30 s is chosen from the measurement, not from taste. Over four days the
+* segments that were retried and then DID land waited p50 7.8 s and p90 11.6 s,
+* and widening the window from 16 s to 120 s moved coverage only from 92.9% to
+* 93.8%. There is no tail to chase: past this knee a segment is not slow, it is
+* lost (a writer killed mid-segment), and waiting only delays the skip and the
+* log line that reports it.
+*/
+var PENDING_GRACE_MS = 3e4;
+/**
+* How far before the writer's own start a segment may be named and still be
+* treated as belonging to THIS run.
+*
+* ffmpeg names segments with whole-second `%s`, so the first segment of a run
+* carries the second that was already in progress when the process spawned —
+* up to ~1 s "before" the writer started. Without this tolerance the very first
+* segment of every recording would be classified as a previous run's leftover
+* and dropped.
+*/
+var PREVIOUS_RUN_SKEW_MS = 1e3;
+/**
+* Decide whether a missing flat file is a late flush or a previous run's entry.
+*
+* ffmpeg's `-segment_list` file is not cleared between runs and a fresh watcher
+* starts at `processed = 0`, so the first passes after every attach replay the
+* PREVIOUS run's playlist. Those entries were relocated into the bucket tree
+* long ago; their absence is the system working. Over 2026-08-10..13 they were
+* 83% of all retries (median age 1 615 s, max 17.4 h) and produced 68 of the
+* 122 `never landed` warnings — a warning that reads like data loss for a file
+* that was correctly filed hours earlier.
+*
+* Note what this deliberately does NOT do: it does not skip a previous run's
+* entry whose file is STILL THERE. That case is real crash recovery — an
+* unclean stop leaves un-relocated segments in `.rec-tmp` and the playlist is
+* the only record of their durations — so the caller stats first and only asks
+* this question once the file is known to be absent.
+*/
+function classifyMissingEntry(input) {
+	return input.segmentStartMs < input.writerStartedMs - PREVIOUS_RUN_SKEW_MS ? "stale-previous-run" : "pending";
+}
+/** Whether a pending entry has outlived its grace. Pure — the caller clocks it. */
+function shouldGiveUpOnPending(input) {
+	return input.waitedMs > input.boundMs;
+}
 /**
 * Derive `startMs` (epoch milliseconds) from a flat ffmpeg segment path
 * (`<epochSec>.m4s`, possibly absolute). Returns null for any non-epoch path.
@@ -5436,11 +5658,22 @@ async function statSize(p) {
 * Unlike the old recorder, this watcher does NOT relocate or re-stat: the
 * SegmentStore owns the move + the authoritative byte count.
 */
-async function handleSegmentEntry(outDir, entry, durMs, onFinalized, logger) {
+async function handleSegmentEntry(outDir, entry, durMs, onFinalized, logger, writerStartedMs) {
 	const flatAbsPath = path.isAbsolute(entry.segPath) ? entry.segPath : path.join(outDir, entry.segPath);
 	const startMs = parseEpochStartMs(flatAbsPath);
 	if (startMs === null) return "skipped";
 	if (await statSize(flatAbsPath) === null) {
+		if (classifyMissingEntry({
+			segmentStartMs: startMs,
+			writerStartedMs
+		}) === "stale-previous-run") {
+			logger.debug("segment entry predates this writer — already relocated, skipping", { meta: {
+				path: flatAbsPath,
+				segmentStartMs: startMs,
+				writerStartedMs
+			} });
+			return "skipped";
+		}
 		logger.debug("segment flat file not on disk yet — will retry", { meta: { path: flatAbsPath } });
 		return "pending";
 	}
@@ -5486,12 +5719,13 @@ function planFinalizations(body, processed, forceFinal = false) {
 */
 function startSegmentWatcher(deps) {
 	const playlistPath = path.join(deps.outDir, "live.m3u8");
+	const now = () => deps.now?.() ?? Date.now();
 	let processed = 0;
 	let stopped = false;
 	let ticking = false;
 	let currentTick = null;
 	let pendingIndex = -1;
-	let pendingTicks = 0;
+	let pendingSinceMs = 0;
 	const tick = async (forceFinal = false) => {
 		if (stopped || ticking) return;
 		ticking = true;
@@ -5505,19 +5739,26 @@ function startSegmentWatcher(deps) {
 			const plan = planFinalizations(body, processed, forceFinal);
 			let index = plan.from;
 			for (const { entry, durMs } of plan.toHandle) {
-				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger) === "pending") {
+				if (await handleSegmentEntry(deps.outDir, entry, durMs, deps.onFinalized, deps.logger, deps.writerStartedMs) === "pending") {
 					if (pendingIndex === index) {
-						pendingTicks++;
-						if (pendingTicks >= MAX_PENDING_TICKS) {
-							deps.logger.warn("segment file never landed — skipping", { meta: { seg: entry.segPath } });
+						const waitedMs = now() - pendingSinceMs;
+						if (shouldGiveUpOnPending({
+							waitedMs,
+							boundMs: 3e4
+						})) {
+							deps.logger.warn("segment file never landed — skipping", { meta: {
+								seg: entry.segPath,
+								waitedMs,
+								boundMs: PENDING_GRACE_MS
+							} });
 							pendingIndex = -1;
-							pendingTicks = 0;
+							pendingSinceMs = 0;
 							index++;
 							continue;
 						}
 					} else {
 						pendingIndex = index;
-						pendingTicks = 1;
+						pendingSinceMs = now();
 					}
 					break;
 				}
@@ -5525,7 +5766,7 @@ function startSegmentWatcher(deps) {
 			}
 			if (pendingIndex !== index) {
 				pendingIndex = -1;
-				pendingTicks = 0;
+				pendingSinceMs = 0;
 			}
 			processed = index;
 		} finally {
@@ -5726,9 +5967,16 @@ var SegmentWriter = class {
 * (`shouldRecordContinuousAt`) and ensures the writer set is running iff so.
 * It re-evaluates on three triggers:
 *   1. `setDeviceConfig` (operator changed the bands / enable),
-*   2. a periodic tick (catches band boundaries crossed with no config change),
+*   2. a periodic pass (catches band boundaries crossed with no config change),
 *   3. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`).
 *
+* There are TWO periodic passes, on separate timers and never overlapping
+* themselves (`periodic-pass.ts`): a cheap LIVENESS pass that catches writers
+* pinned but producing nothing, and an expensive CONVERGENCE pass that
+* re-evaluates bands and placement. They were one pass until 2026-08-13, when a
+* convergence sweep wedged on unbounded broker RPCs and took the liveness
+* watchdog down with it for 9-27 minutes at a time.
+*
 * EVENTS bands are treated as "not recording continuously" in B2 — B3 adds
 * trigger-gating. The enable intent is persisted in durable-state by the
 * config-store, so `restoreEnabledDevices` on boot re-attaches every device
@@ -5758,6 +6006,34 @@ var TICK_MS = 3e4;
 */
 var RELEASE_RPC_TIMEOUT_MS = 2e3;
 /**
+* Bound on each broker RPC in the ATTACH chain (`listAllProfileSlots`,
+* `getStreamWithCodec`).
+*
+* These were the only unbounded calls left in the controller.
+* `CapabilityHandle.call` gates READINESS (10 s) and then returns `fn()`
+* untouched, so an accepted-but-unanswered request fell through to the 60 s UDS
+* default in `kernel/transport/socket-channel.ts`. On 2026-08-13 the broker was
+* degraded (516 UDS timeouts that day) and the arithmetic did the damage: one
+* device costs `listAllProfileSlots` + one `getStreamWithCodec` per profile, so
+* a 4-camera fleet on 3 profiles reached ~16 minutes inside a single recovery
+* pass — during which every device sits DETACHED (recording stopped) and in
+* `attaching` (so `evaluateDevice` returns early and the liveness watchdog,
+* which reads `active`, has nothing to report). That is the shape of the 9-27
+* minute silences and the real recording gaps behind the 80% timelapse
+* coverage.
+*
+* 20 s is generous for a real RTSP dial and far below the UDS default, so a
+* hung broker now fails the attach fast. Nothing is lost by giving up: the
+* device stays on the readiness-restore queue and the next pass retries it.
+*/
+var ATTACH_RPC_TIMEOUT_MS = 2e4;
+/**
+* A pass longer than this is reported with its duration. Equal to the pass
+* cadence: a pass that cannot finish inside its own interval is the condition
+* that used to go unlogged for half an hour.
+*/
+var PASS_SLOW_AFTER_MS = TICK_MS;
+/**
 * Race `promise` against a deadline. Handlers stay attached to the losing
 * promise, so a post-deadline settlement can never surface as a process-level
 * `unhandledRejection`.
@@ -5845,7 +6121,10 @@ var RecordingController = class {
 	*/
 	unrecordableReported = /* @__PURE__ */ new Set();
 	restore = null;
-	tickTimer = null;
+	/** Cheap, never-delayed: is any pinned writer producing nothing? */
+	livenessPass = null;
+	/** Expensive: re-evaluate bands + placement for every configured device. */
+	convergePass = null;
 	stopped = false;
 	/** A reversible maintenance lease. Unlike `stopped`, it never changes
 	* persisted recording intent and `resume()` restarts normal convergence. */
@@ -5880,18 +6159,28 @@ var RecordingController = class {
 				meta: { error: errMsg(err) }
 			})
 		});
-		if (this.tickTimer === null) {
-			this.tickTimer = setInterval(() => {
-				this.tick();
-			}, TICK_MS);
-			this.tickTimer.unref?.();
+		if (this.convergePass === null) {
+			this.livenessPass = startPeriodicPass({
+				name: "liveness",
+				intervalMs: TICK_MS,
+				slowAfterMs: PASS_SLOW_AFTER_MS,
+				logger: this.deps.logger,
+				now: () => this.now(),
+				run: () => this.checkIdleWriters()
+			});
+			this.convergePass = startPeriodicPass({
+				name: "convergence",
+				intervalMs: TICK_MS,
+				slowAfterMs: PASS_SLOW_AFTER_MS,
+				logger: this.deps.logger,
+				now: () => this.now(),
+				run: () => this.converge()
+			});
 		}
 		await this.restore.start(ids.map((id) => [id, true]));
 	}
-	/** Re-evaluate every currently-tracked OR active device on the periodic tick. */
-	async tick() {
-		if (this.stopped) return;
-		await this.checkIdleWriters();
+	/** Re-evaluate every currently-tracked OR active device on the periodic pass. */
+	async converge() {
 		if (this.stopped) return;
 		const ids = new Set(this.active.keys());
 		let persisted = [];
@@ -5907,7 +6196,7 @@ var RecordingController = class {
 		for (const id of ids) try {
 			await this.evaluateDevice(id);
 		} catch (err) {
-			this.deps.logger.warn("recorder controller: tick evaluate failed", {
+			this.deps.logger.warn("recorder controller: convergence evaluate failed", {
 				tags: { deviceId: id },
 				meta: { error: errMsg(err) }
 			});
@@ -5981,7 +6270,7 @@ var RecordingController = class {
 				segmentSeconds: this.active.get(s.deviceId)?.find((r) => r.profile === s.profile)?.segmentSeconds
 			}
 		});
-		for (const deviceId of devices) await this.recoverWriterGaveUp(deviceId);
+		await Promise.all([...devices].map((deviceId) => this.recoverWriterGaveUp(deviceId)));
 	}
 	/** Current trigger state for a device (cold default = no triggers seen). */
 	triggersFor(deviceId) {
@@ -6123,7 +6412,7 @@ var RecordingController = class {
 	* assigned sources is ignored (record every assigned source — minimum of 1).
 	*/
 	async resolveProfiles(deviceId, override) {
-		const assigned = selectAssignedProfileSlots(await this.deps.brokerCall(() => this.deps.api.streamBroker.listAllProfileSlots.query(void 0, nodePin(this.deps.ownerNodeId))), deviceId).map((slot) => slot.profile);
+		const assigned = selectAssignedProfileSlots(await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.listAllProfileSlots.query(void 0, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "listAllProfileSlots")), deviceId).map((slot) => slot.profile);
 		if (!override || override.length === 0) return assigned;
 		const selected = assigned.filter((p) => override.includes(p));
 		return selected.length > 0 ? selected : assigned;
@@ -6136,14 +6425,14 @@ var RecordingController = class {
 	*/
 	async attachProfile(deviceId, profile, segmentSeconds) {
 		const placement = await this.resolvePlacement(deviceId, profile);
-		const source = await this.deps.brokerCall(() => this.deps.api.streamBroker.getStreamWithCodec.mutate({
+		const source = await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.getStreamWithCodec.mutate({
 			deviceId,
 			video: "copy",
 			audio: "aac",
 			profile,
 			...this.deps.consumerHostname !== void 0 ? { hostname: this.deps.consumerHostname } : {},
 			tag: `recorder:${deviceId}/${profile}`
-		}, nodePin(this.deps.ownerNodeId)));
+		}, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "getStreamWithCodec"));
 		const outDir = path.join(placement.root, STAGING_DIR_NAME, String(deviceId), profile);
 		await promises.mkdir(outDir, { recursive: true });
 		const deviceLog = this.deps.logger.withTags({ deviceId });
@@ -6159,6 +6448,7 @@ var RecordingController = class {
 				this.recoverWriterGaveUp(deviceId);
 			}
 		});
+		const writerStartedMs = this.now();
 		writer.start();
 		this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
 		return {
@@ -6166,6 +6456,8 @@ var RecordingController = class {
 			writer,
 			watcher: startSegmentWatcher({
 				outDir,
+				writerStartedMs,
+				now: () => this.now(),
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
@@ -6282,10 +6574,10 @@ var RecordingController = class {
 	/** Tear EVERYTHING down: timer, restore subscription, every writer/watcher/lease. */
 	async stop() {
 		this.stopped = true;
-		if (this.tickTimer !== null) {
-			clearInterval(this.tickTimer);
-			this.tickTimer = null;
-		}
+		this.livenessPass?.stop();
+		this.livenessPass = null;
+		this.convergePass?.stop();
+		this.convergePass = null;
 		this.restore?.stop();
 		this.restore = null;
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));