@camstack/addon-pipeline 1.2.73 → 1.2.75

package/dist/pipeline-runner/index.mjs

@@ -1,8 +1,8 @@
-import { At as string, Ct as boolean, Dt as number, Et as literal, K as pipelineRunnerCapability, M as deriveDetailCropRect, Mt as EventCategory, Ot as object, St as array, Tt as lazy, U as pickDetailCropConvention, W as pickNativeLeaseOverride, dt as createEvent, gt as nodePin, j as defineCustomActions, k as customAction, s as DEFAULT_DETAIL_CROP_CONVENTION, st as BaseAddon, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT, xt as _enum } from "../dist-Dpr92hOt.mjs";
-import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-B7Wd2jo-.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-C1FtUWvH.mjs";
+import { At as string, Ct as boolean, Dt as number, Et as literal, K as pipelineRunnerCapability, M as deriveDetailCropRect, Mt as EventCategory, Ot as object, St as array, Tt as lazy, U as pickDetailCropConvention, W as pickNativeLeaseOverride, dt as createEvent, gt as nodePin, j as defineCustomActions, k as customAction, s as DEFAULT_DETAIL_CROP_CONVENTION, st as BaseAddon, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT, xt as _enum } from "../dist-T_8jMw7d.mjs";
+import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-XeGmL4xr.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-SqED7Y9i.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
+import { t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
 import { i as withDetectionIntent, n as profileForStreamId, t as isRemoteRestream } from "../remote-restream-Ci7RXNGb.mjs";
 import sharp from "sharp";
 import { fork } from "node:child_process";
@@ -3828,6 +3828,18 @@ function isUsable(bbox) {
 }
 //#endregion
 //#region src/pipeline-runner/index.ts
+/**
+* Bound on the frames whose cutter is bound but whose result has not come back.
+* A few per camera in flight; the ceiling only catches results that never
+* arrive (shed, inference timeout, detach mid-flight).
+*/
+var MAX_BOUND_FRAME_CUTTERS = 256;
+/** How often a camera reports its undispatched cuts. */
+var TILE_CUT_DROP_LOG_INTERVAL_MS = 6e4;
+/** The per-frame binding key — the same identity the retention handle carries. */
+function frameCutterKey(handle) {
+	return `${handle.shmId}#${handle.slot}#${handle.seq}`;
+}
 var DEFAULT_CONFIG = {
 	maxQueueDepth: 30,
 	maxConcurrentInferences: 16,
@@ -4143,6 +4155,20 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 	*/
 	nativeCropRegistry = new NativeCropRegistry();
 	/**
+	* Per-frame cutter bindings — handle key → the requester that can cut this
+	* frame's subject tiles and end its hold.
+	*
+	* Deliberately NOT `nativeCropRegistry`. That one is a node-wide LRU capped
+	* at 256 and shared by every camera to serve LATE cross-process crops; on the
+	* live hub it sits pinned at its cap, so an entry's lifetime depends on how
+	* busy the OTHER cameras are. Ending a frame's hold is a per-frame lifecycle
+	* event and cannot be allowed to depend on that.
+	*/
+	frameCutters = /* @__PURE__ */ new Map();
+	/** Per-camera tally of cuts that could not be dispatched, and why. */
+	tileCutDrops = /* @__PURE__ */ new Map();
+	tileCutDropLoggedAt = /* @__PURE__ */ new Map();
+	/**
 	* Node-level RAM store of retained rgb detection frames, keyed by the
 	* `FrameHandle` that rides the inference-result event (shm-ring removal
 	* 2026-07-16 — replaces the `csr.` shm retention ring). Backs the
@@ -5150,23 +5176,80 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 	* by an encode.
 	*/
 	cutSubjectTiles(deviceId, result, handle) {
-		if (!handle) return;
-		const found = this.nativeCropRegistry.get(handle);
-		if (!found) return;
+		const outcome = this.dispatchSubjectTiles(result, handle);
+		if (outcome === "sent") return;
+		const tally = this.tileCutDrops.get(deviceId) ?? {
+			handleless: 0,
+			unbound: 0,
+			threw: 0
+		};
+		tally[outcome] += 1;
+		this.tileCutDrops.set(deviceId, tally);
+		const now = Date.now();
+		if (now - (this.tileCutDropLoggedAt.get(deviceId) ?? 0) < TILE_CUT_DROP_LOG_INTERVAL_MS) return;
+		this.tileCutDropLoggedAt.set(deviceId, now);
+		this.ctx.logger.warn("subject tile cut NOT dispatched — the frame hold will not be released", {
+			tags: { deviceId },
+			meta: {
+				...tally,
+				lastReason: outcome,
+				boundFrames: this.frameCutters.size
+			}
+		});
+	}
+	/**
+	* Send the cut for one finished frame. Returns what happened, so the caller
+	* can account for it.
+	*
+	* The cutter is looked up in {@link frameCutters} — the addon's OWN per-frame
+	* binding — and NOT in `nativeCropRegistry`. That distinction is the bug this
+	* method exists to not have again: the registry is a node-wide LRU capped at
+	* 256 entries, shared by every camera, and it exists to serve LATE
+	* cross-process crops. Measured on the live hub during the incident it sits
+	* PINNED at `registrySize=256 registryCap=256`, so an entry's lifetime is a
+	* function of how many other cameras are busy. Ending a frame's hold is a
+	* per-frame lifecycle event and must never be subject to another camera's
+	* eviction pressure.
+	*/
+	dispatchSubjectTiles(result, handle) {
+		if (!handle) return "handleless";
+		const key = frameCutterKey(handle);
+		const cutter = this.frameCutters.get(key);
+		this.frameCutters.delete(key);
+		if (!cutter) return "unbound";
 		const boxes = planTileCuts(result.detections ?? [], {
 			width: result.width,
 			height: result.height
 		});
 		try {
-			found.request.cutTiles(boxes);
-		} catch (err) {
-			this.ctx.logger.debug("subject tile cut could not be dispatched", {
-				tags: { deviceId },
-				meta: {
-					subjects: boxes.length,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
+			cutter.cutTiles(boxes);
+			return "sent";
+		} catch {
+			return "threw";
+		}
+	}
+	/**
+	* Bind a frame's cutter at DELIVERY, so its result can end its hold.
+	*
+	* Bounded by {@link MAX_BOUND_FRAME_CUTTERS}: a frame whose result never
+	* comes back (a shed, a timed-out inference, a camera detaching mid-flight)
+	* would otherwise leave its binding forever. The oldest is dropped and its
+	* hold released directly — the worker's own frame bound would have reclaimed
+	* it anyway, but releasing here is what keeps `holdOverflow` meaning "the
+	* runner stopped answering" rather than "the runner forgot".
+	*/
+	bindFrameCutter(handle, cutter) {
+		const key = frameCutterKey(handle);
+		this.frameCutters.delete(key);
+		this.frameCutters.set(key, cutter);
+		while (this.frameCutters.size > MAX_BOUND_FRAME_CUTTERS) {
+			const oldest = this.frameCutters.keys().next().value;
+			if (oldest === void 0) break;
+			const stale = this.frameCutters.get(oldest);
+			this.frameCutters.delete(oldest);
+			try {
+				stale?.release();
+			} catch {}
 		}
 	}
 	/**
@@ -5965,7 +6048,10 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 						reservation = null;
 						if (!current) return;
 						const handle = current.detection ? retainedFrames?.write(config.deviceId, frame) ?? void 0 : void 0;
-						if (handle && nativeCrop) this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+						if (handle && nativeCrop) {
+							this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+							this.bindFrameCutter(handle, nativeCrop);
+						}
 						if (this.enqueueSharedDetectionFrame(config.deviceId, frame, handle, current)) nativeCrop?.markInferred();
 					}
 				});
@@ -6489,7 +6575,10 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 				onDecodedFrame: (frame, nativeCrop) => {
 					if (settled) return;
 					const handle = retainedFrames?.write(config.deviceId, frame) ?? void 0;
-					if (handle && nativeCrop) this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+					if (handle && nativeCrop) {
+						this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+						this.bindFrameCutter(handle, nativeCrop);
+					}
 					if (runner.enqueueOccupancyFrame(deviceId, frame, handle)) nativeCrop?.markInferred();
 					count++;
 					if (count >= frames) {

package/dist/recorder/index.js

@@ -1,12 +1,11 @@
-const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-BAbvf81B.js");
+const require_dist = require("../dist-6ZJCV0jY.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_addon_utils = require("../addon-utils-CQs-AjTJ.js");
+const require_addon_utils = require("../addon-utils-a_36HH_N.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
-let node_fs = require("node:fs");
 let node_path = require("node:path");
-node_path = require_chunk.__toESM(node_path);
+node_path = require_dist.__toESM(node_path);
+let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 //#region src/recorder/event-capture.ts
 function markerFromMotion(data, pad) {
@@ -2251,7 +2250,7 @@ var DEFAULT_DEVICE_CONFIG = {
 	enabled: false,
 	bands: []
 };
-function serialize(map) {
+function serialize$1(map) {
 	const out = {};
 	for (const [id, config] of map) out[String(id)] = config;
 	return out;
@@ -2306,7 +2305,7 @@ async function saveDeviceConfig(state, deviceId, config) {
 	};
 	const map = await readDeviceConfigs(state);
 	map.set(deviceId, validated);
-	await state.set(serialize(map));
+	await state.set(serialize$1(map));
 	return validated;
 }
 /**
@@ -2644,6 +2643,33 @@ function buildExportArgs(input) {
 var RECORDING_EXPORTS_KEY = "recordingExports";
 /** Persisted shape: export id → full ExportRecord. */
 var RecordingExportsBlobSchema = require_dist.record(require_dist.string(), require_dist.ExportRecordSchema);
+/**
+* One in-flight mutation chain per durable handle.
+*
+* EVERY mutation here is a read-modify-write of the SAME blob, and both halves
+* are async — so two overlapping cycles read the same snapshot and the second
+* `set` discards whatever the first one added. Last writer wins, silently.
+*
+* That is not a hypothetical. The engine patches `progressPct` roughly once a
+* second for an in-flight render, unawaited; on 2026-08-14 a `createExport` for
+* camera 615 landed between one such patch's read and its write, the row was
+* erased, and five seconds later the poll answered `unknown export
+* "547ea182-…"`. The camera's whole night was lost to it — the scheduler read a
+* vanished row as a failed render and re-queued, forever.
+*
+* Serialising per handle is the smallest fix that makes the loss impossible:
+* the cycles queue instead of interleaving, and the queue is per state object
+* so two recorders in one process never contend. A `WeakMap` keeps a disposed
+* handle collectable. Reads stay OUTSIDE the chain — a blob replacement is
+* atomic, so a reader always sees one consistent generation.
+*/
+var mutationChains = /* @__PURE__ */ new WeakMap();
+/** Run `work` after every mutation already queued for `state`, never before. */
+async function serialize(state, work) {
+	const next = (mutationChains.get(state) ?? Promise.resolve()).then(work, work);
+	mutationChains.set(state, next.catch(() => void 0));
+	return next;
+}
 /** Read every persisted export row, keyed by export id. */
 async function readExports(state) {
 	const blob = await state.get();
@@ -2652,26 +2678,30 @@ async function readExports(state) {
 /** Insert or replace one export row. Validates at the boundary. Returns it. */
 async function upsertExport(state, record) {
 	const validated = require_dist.ExportRecordSchema.parse(record);
-	const map = await readExports(state);
-	map.set(validated.id, validated);
-	await state.set(Object.fromEntries(map));
-	return validated;
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		map.set(validated.id, validated);
+		await state.set(Object.fromEntries(map));
+		return validated;
+	});
 }
 /**
 * Shallow-merge a patch into one export row and persist. Returns the merged
 * record, or null when the id is unknown.
 */
 async function patchExport(state, id, patch) {
-	const map = await readExports(state);
-	const existing = map.get(id);
-	if (!existing) return null;
-	const merged = require_dist.ExportRecordSchema.parse({
-		...existing,
-		...patch
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		const existing = map.get(id);
+		if (!existing) return null;
+		const merged = require_dist.ExportRecordSchema.parse({
+			...existing,
+			...patch
+		});
+		map.set(id, merged);
+		await state.set(Object.fromEntries(map));
+		return merged;
 	});
-	map.set(id, merged);
-	await state.set(Object.fromEntries(map));
-	return merged;
 }
 /** Read one export row by id, or null. */
 async function getExportRecord(state, id) {
@@ -3002,6 +3032,80 @@ async function markDownloaded(id, now, deps, scheduleDelete, graceMs) {
 	}, graceMs);
 }
 //#endregion
+//#region src/recorder/addon/export-reconcile.ts
+/**
+* States that can only mean "a render was owed and the process went away".
+*
+* There is no live render at reconcile time by construction: the engine is
+* built fresh with an empty queue, and this runs before anything is enqueued.
+*/
+function isInterrupted(record) {
+	return record.state === "queued" || record.state === "rendering";
+}
+/**
+* Hand every interrupted row back to the engine, once, at boot.
+*
+* A row past its `expiresAt` is FAILED rather than re-rendered: hours of
+* footage re-encoded for a file the janitor is about to drop costs a recording
+* node an ffmpeg for nothing. Failing it is also what makes the outcome
+* visible — a row that silently stays `queued` forever is the defect this
+* module exists to remove, and swapping it for a quieter one would not be a
+* fix.
+*/
+async function reconcileInterruptedExports(deps) {
+	const now = deps.now();
+	const interrupted = (await listExportsFor(deps.state)).filter(isInterrupted);
+	if (interrupted.length === 0) return {
+		requeued: 0,
+		expired: 0
+	};
+	let requeued = 0;
+	let expired = 0;
+	for (const row of interrupted) {
+		const tags = { deviceId: row.deviceId };
+		const meta = {
+			exportId: row.id,
+			wasState: row.state,
+			fromMs: row.fromMs,
+			toMs: row.toMs,
+			createdAt: row.createdAt
+		};
+		if (row.expiresAt <= now) {
+			expired += 1;
+			await patchExport(deps.state, row.id, {
+				state: "failed",
+				progressPct: null,
+				error: "interrupted by a restart and expired before it could be rendered"
+			});
+			deps.logger.warn("export abandoned: interrupted by a restart, and already expired", {
+				tags,
+				meta
+			});
+			continue;
+		}
+		requeued += 1;
+		await patchExport(deps.state, row.id, {
+			state: "queued",
+			progressPct: null,
+			error: null
+		});
+		deps.logger.warn("export re-queued: it was interrupted by a restart", {
+			tags,
+			meta
+		});
+		deps.engine.enqueue(row.id);
+	}
+	deps.logger.info("recording exports reconciled after restart", { meta: {
+		interrupted: interrupted.length,
+		requeued,
+		expired
+	} });
+	return {
+		requeued,
+		expired
+	};
+}
+//#endregion
 //#region src/recorder/playlist.ts
 /** A VOD variant playlist with an absolute wall-clock anchor per segment. */
 function buildVariantPlaylist(segments) {
@@ -7479,23 +7583,25 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.retentionSweeper?.start();
 	}
 	/**
-	* Resume interrupted exports and arm the expiry sweep. A row left `rendering`
-	* by a crash/restart has no live ffmpeg, so demote it to `queued` and re-enqueue
-	* it alongside any still-`queued` rows. The sweep runs immediately then on an
-	* interval; both are best-effort (a failure never blocks boot).
+	* Resume interrupted exports and arm the expiry sweep.
+	*
+	* The resume itself lives in `export-reconcile.ts` — pure, tested, and loud
+	* about every row it moves. It used to be an untested loop inlined here that
+	* said nothing at all, so "why is this export still queued an hour later" had
+	* no answer in the log, and a row whose life had already run out was
+	* re-rendered anyway. Both halves are best-effort: a failure never blocks
+	* boot.
 	*/
 	async bootstrapExports() {
 		const engine = this.exportEngine;
 		if (!engine) return;
-		const state = this.exportsStore();
 		try {
-			for (const rec of await listExportsFor(state)) {
-				if (rec.state === "rendering") await patchExport(state, rec.id, {
-					state: "queued",
-					progressPct: null
-				});
-				if (rec.state === "queued" || rec.state === "rendering") engine.enqueue(rec.id);
-			}
+			await reconcileInterruptedExports({
+				state: this.exportsStore(),
+				engine,
+				now: () => Date.now(),
+				logger: this.ctx.logger.child("export")
+			});
 		} catch (err) {
 			this.ctx.logger.warn("recorder: export boot re-queue failed", { meta: { error: require_dist.errMsg(err) } });
 		}

package/dist/recorder/index.mjs

@@ -1,10 +1,10 @@
-import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-Dpr92hOt.mjs";
+import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-T_8jMw7d.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CZ2xo67g.mjs";
+import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-A2S9D7pu.mjs";
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-import { createReadStream, promises, realpathSync } from "node:fs";
 import path from "node:path";
+import { createReadStream, promises, realpathSync } from "node:fs";
 import { open } from "node:fs/promises";
 //#region src/recorder/event-capture.ts
 function markerFromMotion(data, pad) {
@@ -2249,7 +2249,7 @@ var DEFAULT_DEVICE_CONFIG = {
 	enabled: false,
 	bands: []
 };
-function serialize(map) {
+function serialize$1(map) {
 	const out = {};
 	for (const [id, config] of map) out[String(id)] = config;
 	return out;
@@ -2304,7 +2304,7 @@ async function saveDeviceConfig(state, deviceId, config) {
 	};
 	const map = await readDeviceConfigs(state);
 	map.set(deviceId, validated);
-	await state.set(serialize(map));
+	await state.set(serialize$1(map));
 	return validated;
 }
 /**
@@ -2642,6 +2642,33 @@ function buildExportArgs(input) {
 var RECORDING_EXPORTS_KEY = "recordingExports";
 /** Persisted shape: export id → full ExportRecord. */
 var RecordingExportsBlobSchema = record(string(), ExportRecordSchema);
+/**
+* One in-flight mutation chain per durable handle.
+*
+* EVERY mutation here is a read-modify-write of the SAME blob, and both halves
+* are async — so two overlapping cycles read the same snapshot and the second
+* `set` discards whatever the first one added. Last writer wins, silently.
+*
+* That is not a hypothetical. The engine patches `progressPct` roughly once a
+* second for an in-flight render, unawaited; on 2026-08-14 a `createExport` for
+* camera 615 landed between one such patch's read and its write, the row was
+* erased, and five seconds later the poll answered `unknown export
+* "547ea182-…"`. The camera's whole night was lost to it — the scheduler read a
+* vanished row as a failed render and re-queued, forever.
+*
+* Serialising per handle is the smallest fix that makes the loss impossible:
+* the cycles queue instead of interleaving, and the queue is per state object
+* so two recorders in one process never contend. A `WeakMap` keeps a disposed
+* handle collectable. Reads stay OUTSIDE the chain — a blob replacement is
+* atomic, so a reader always sees one consistent generation.
+*/
+var mutationChains = /* @__PURE__ */ new WeakMap();
+/** Run `work` after every mutation already queued for `state`, never before. */
+async function serialize(state, work) {
+	const next = (mutationChains.get(state) ?? Promise.resolve()).then(work, work);
+	mutationChains.set(state, next.catch(() => void 0));
+	return next;
+}
 /** Read every persisted export row, keyed by export id. */
 async function readExports(state) {
 	const blob = await state.get();
@@ -2650,26 +2677,30 @@ async function readExports(state) {
 /** Insert or replace one export row. Validates at the boundary. Returns it. */
 async function upsertExport(state, record) {
 	const validated = ExportRecordSchema.parse(record);
-	const map = await readExports(state);
-	map.set(validated.id, validated);
-	await state.set(Object.fromEntries(map));
-	return validated;
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		map.set(validated.id, validated);
+		await state.set(Object.fromEntries(map));
+		return validated;
+	});
 }
 /**
 * Shallow-merge a patch into one export row and persist. Returns the merged
 * record, or null when the id is unknown.
 */
 async function patchExport(state, id, patch) {
-	const map = await readExports(state);
-	const existing = map.get(id);
-	if (!existing) return null;
-	const merged = ExportRecordSchema.parse({
-		...existing,
-		...patch
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		const existing = map.get(id);
+		if (!existing) return null;
+		const merged = ExportRecordSchema.parse({
+			...existing,
+			...patch
+		});
+		map.set(id, merged);
+		await state.set(Object.fromEntries(map));
+		return merged;
 	});
-	map.set(id, merged);
-	await state.set(Object.fromEntries(map));
-	return merged;
 }
 /** Read one export row by id, or null. */
 async function getExportRecord(state, id) {
@@ -3000,6 +3031,80 @@ async function markDownloaded(id, now, deps, scheduleDelete, graceMs) {
 	}, graceMs);
 }
 //#endregion
+//#region src/recorder/addon/export-reconcile.ts
+/**
+* States that can only mean "a render was owed and the process went away".
+*
+* There is no live render at reconcile time by construction: the engine is
+* built fresh with an empty queue, and this runs before anything is enqueued.
+*/
+function isInterrupted(record) {
+	return record.state === "queued" || record.state === "rendering";
+}
+/**
+* Hand every interrupted row back to the engine, once, at boot.
+*
+* A row past its `expiresAt` is FAILED rather than re-rendered: hours of
+* footage re-encoded for a file the janitor is about to drop costs a recording
+* node an ffmpeg for nothing. Failing it is also what makes the outcome
+* visible — a row that silently stays `queued` forever is the defect this
+* module exists to remove, and swapping it for a quieter one would not be a
+* fix.
+*/
+async function reconcileInterruptedExports(deps) {
+	const now = deps.now();
+	const interrupted = (await listExportsFor(deps.state)).filter(isInterrupted);
+	if (interrupted.length === 0) return {
+		requeued: 0,
+		expired: 0
+	};
+	let requeued = 0;
+	let expired = 0;
+	for (const row of interrupted) {
+		const tags = { deviceId: row.deviceId };
+		const meta = {
+			exportId: row.id,
+			wasState: row.state,
+			fromMs: row.fromMs,
+			toMs: row.toMs,
+			createdAt: row.createdAt
+		};
+		if (row.expiresAt <= now) {
+			expired += 1;
+			await patchExport(deps.state, row.id, {
+				state: "failed",
+				progressPct: null,
+				error: "interrupted by a restart and expired before it could be rendered"
+			});
+			deps.logger.warn("export abandoned: interrupted by a restart, and already expired", {
+				tags,
+				meta
+			});
+			continue;
+		}
+		requeued += 1;
+		await patchExport(deps.state, row.id, {
+			state: "queued",
+			progressPct: null,
+			error: null
+		});
+		deps.logger.warn("export re-queued: it was interrupted by a restart", {
+			tags,
+			meta
+		});
+		deps.engine.enqueue(row.id);
+	}
+	deps.logger.info("recording exports reconciled after restart", { meta: {
+		interrupted: interrupted.length,
+		requeued,
+		expired
+	} });
+	return {
+		requeued,
+		expired
+	};
+}
+//#endregion
 //#region src/recorder/playlist.ts
 /** A VOD variant playlist with an absolute wall-clock anchor per segment. */
 function buildVariantPlaylist(segments) {
@@ -7477,23 +7582,25 @@ var RecorderV2Addon = class extends BaseAddon {
 		this.retentionSweeper?.start();
 	}
 	/**
-	* Resume interrupted exports and arm the expiry sweep. A row left `rendering`
-	* by a crash/restart has no live ffmpeg, so demote it to `queued` and re-enqueue
-	* it alongside any still-`queued` rows. The sweep runs immediately then on an
-	* interval; both are best-effort (a failure never blocks boot).
+	* Resume interrupted exports and arm the expiry sweep.
+	*
+	* The resume itself lives in `export-reconcile.ts` — pure, tested, and loud
+	* about every row it moves. It used to be an untested loop inlined here that
+	* said nothing at all, so "why is this export still queued an hour later" had
+	* no answer in the log, and a row whose life had already run out was
+	* re-rendered anyway. Both halves are best-effort: a failure never blocks
+	* boot.
 	*/
 	async bootstrapExports() {
 		const engine = this.exportEngine;
 		if (!engine) return;
-		const state = this.exportsStore();
 		try {
-			for (const rec of await listExportsFor(state)) {
-				if (rec.state === "rendering") await patchExport(state, rec.id, {
-					state: "queued",
-					progressPct: null
-				});
-				if (rec.state === "queued" || rec.state === "rendering") engine.enqueue(rec.id);
-			}
+			await reconcileInterruptedExports({
+				state: this.exportsStore(),
+				engine,
+				now: () => Date.now(),
+				logger: this.ctx.logger.child("export")
+			});
 		} catch (err) {
 			this.ctx.logger.warn("recorder: export boot re-queue failed", { meta: { error: errMsg(err) } });
 		}