@camstack/addon-pipeline 1.2.74 → 1.2.75

package/dist/lazy-sharp-DvwPafeP.js

@@ -0,0 +1,360 @@
+const require_dist = require("./dist-6ZJCV0jY.js");
+let node_url = require("node:url");
+let node_module = require("node:module");
+let node_path = require("node:path");
+node_path = require_dist.__toESM(node_path);
+//#region src/shared/host-external-import.ts
+/**
+* Resolving a HOST-EXTERNAL package (`sharp`, `node-av`, …) from a process that
+* does NOT have the framework ESM resolver hook registered.
+*
+* ## The problem this exists for
+*
+* An addon bundle leaves the packages in `HOST_EXTERNAL_SPECIFIERS`
+* (`@camstack/system` → `kernel/host-externals.ts`) unbundled and expects the
+* HOST to provide them. What provides them is a module-customization hook
+* (`framework-resolver-hook.mjs`) that `registerFrameworkResolver` installs in
+* the **addon-runner process**, re-anchoring those bare specifiers at
+* `<frameworkDir>/node_modules`.
+*
+* A worker started with a plain `child_process.fork` — the session decode
+* worker (`session-decode/fork-decode-worker.ts`) is the one in this package —
+* does NOT inherit that hook. In it, `import('sharp')` and `import('node-av')`
+* throw `Cannot find package 'X' imported from /data/addons/@camstack/…`,
+* because the addon directory has no `node_modules` to walk up into.
+*
+* ## Why an explicit path and not the hook
+*
+* Registering the framework resolver in the child was considered and rejected:
+*
+*  - it would need the child to reach INTO another package's build output
+*    (`<frameworkDir>/node_modules/@camstack/system/dist/…/framework-resolver-hook.mjs`)
+*    plus an `--import` shim, i.e. a hard coupling to a layout nothing checks;
+*  - a registered hook makes **every** `import()` in that process re-enter the
+*    loader and block the main thread on `Atomics.wait` until the hooks worker
+*    answers — the exact cost `shared/lazy-sharp.ts` was written to remove from
+*    the frame path. Paying it per decode worker to load two modules is the
+*    wrong trade;
+*  - the explicit-path fallback is already the shipped answer for `node-av` in
+*    this same worker, and had been for months. A second mechanism for `sharp`
+*    would mean two ways to fail.
+*
+* So: try the bare specifier (works on the hub, where the fork inherits the
+* hook, and in dev, where workspace symlinks resolve), then resolve the package
+* explicitly out of the module roots an agent is known to lay out.
+*
+* ## The anchors, in order
+*
+*  - **DOCKER / single-copy node** — the framework overlay
+*    `CAMSTACK_FRAMEWORK_DIR` (`<frameworkDir>/node_modules/<pkg>`). The
+*    launcher points this at the ACTIVE closure in data-root mode and forked
+*    children inherit it (`server/backend/src/launcher.ts`).
+*  - **ELECTRON agent** — the app bundle beside `CAMSTACK_BUNDLED_ADDONS_DIR`
+*    (`<resources>/addons`): `<resources>/node_modules/<pkg>` and the
+*    `app.asar.unpacked` mirror.
+*  - **the process cwd** — always tried last, and it is NOT redundant:
+*    `CAMSTACK_FRAMEWORK_DIR` is only exported on some boots (the Docker
+*    entrypoint sets it in its fallback branch; the launcher only in data-root
+*    mode), while the launcher ALWAYS extends `NODE_PATH` with the framework and
+*    hub `node_modules`. A CJS-style resolution honours `NODE_PATH`; an ESM
+*    `import()` of a bare specifier does not. This is the same escape hatch
+*    `stream-broker/webrtc/session.ts` uses to find the framework's `werift`.
+*
+* An anchor that cannot resolve the specifier is skipped, so an empty result
+* leaves the bare specifier as the only path, exactly as before.
+*
+* Resolution goes through `createRequire(...).resolve(specifier)` rather than a
+* hardcoded relative entry (`dist/index.js`, …): that honours the package's own
+* `exports`/`main`, so it keeps working across a dependency's file-layout
+* changes, handles SUBPATH specifiers (`node-av/constants`) with no mapping
+* table, and consults `NODE_PATH`. It also verifies the file exists, which is
+* what the previous `fs.existsSync` check did by hand.
+*/
+/**
+* The anchor filename resolution walks up from. It never has to EXIST —
+* `createRequire` only needs a path to anchor at — but naming it after camstack
+* keeps a stack trace readable if one ever escapes.
+*/
+var ANCHOR_FILE = "__camstack_host_external_anchor__.cjs";
+/** Node error codes that mean "the module is not there", not "it failed to load". */
+var RESOLUTION_ERROR_CODES = [
+	"ERR_MODULE_NOT_FOUND",
+	"MODULE_NOT_FOUND",
+	"ERR_PACKAGE_PATH_NOT_EXPORTED",
+	"ERR_UNSUPPORTED_DIR_IMPORT"
+];
+/** `err.code` when the error carries a string one. No cast: `in` narrows. */
+function errorCode(err) {
+	if (typeof err !== "object" || err === null) return null;
+	if (!("code" in err)) return null;
+	const code = err.code;
+	return typeof code === "string" ? code : null;
+}
+/**
+* True when `err` says the module could not be FOUND (as opposed to found and
+* failed to load — a broken native binary, a throwing top level).
+*
+* The distinction is load-bearing for callers that memoize failure: a
+* resolution failure is deterministic for the life of the process (the env and
+* the framework layout do not change under a running worker), so retrying it
+* per frame can only re-pay the loader round-trip and re-log. A LOAD failure
+* can plausibly be a deploy blip and stays retryable.
+*
+* The message check is a belt for the same braces: Node has moved these codes
+* before, and a miss here degrades to "retry forever", which is the bug.
+*/
+function isModuleResolutionError(err) {
+	const code = errorCode(err);
+	if (code !== null && RESOLUTION_ERROR_CODES.includes(code)) return true;
+	if (!(err instanceof Error)) return false;
+	return err.message.includes("Cannot find package") || err.message.includes("Cannot find module");
+}
+/**
+* The files a resolution is anchored at, in the order they are tried. Each is a
+* path INSIDE a candidate `node_modules` (so `<dir>/node_modules/<pkg>` is on
+* the walk), except the cwd anchor, which walks up from the cwd itself.
+*
+* The anchor files never have to exist — `createRequire` only needs a path.
+*/
+function hostExternalAnchors(env, cwd) {
+	const anchors = [];
+	const frameworkDir = env["CAMSTACK_FRAMEWORK_DIR"];
+	if (frameworkDir !== void 0 && frameworkDir.length > 0) anchors.push(node_path.join(frameworkDir, "node_modules", ANCHOR_FILE));
+	const bundledAddons = env["CAMSTACK_BUNDLED_ADDONS_DIR"];
+	if (bundledAddons !== void 0 && bundledAddons.length > 0) {
+		const resourcesRoot = node_path.dirname(bundledAddons);
+		anchors.push(node_path.join(resourcesRoot, "node_modules", ANCHOR_FILE));
+		anchors.push(node_path.join(resourcesRoot, "app.asar.unpacked", "node_modules", ANCHOR_FILE));
+	}
+	anchors.push(node_path.join(cwd, ANCHOR_FILE));
+	return anchors;
+}
+/** `createRequire(anchor).resolve(specifier)`, or `null` when it is not there. */
+function resolveFromAnchor(anchorPath, specifier) {
+	try {
+		return (0, node_module.createRequire)(anchorPath).resolve(specifier);
+	} catch {
+		return null;
+	}
+}
+/**
+* Importable `file:` URLs for `specifier`, in the order a caller should try them
+* after the bare specifier has already failed. Deduplicated (two anchors
+* routinely resolve to the SAME file — a NODE_PATH hit, or a symlink), and empty
+* when nothing resolves it, which leaves the bare specifier the only path.
+*/
+function hostExternalEntryUrls(specifier, options = {}) {
+	const env = options.env ?? process.env;
+	const cwd = options.cwd ?? process.cwd();
+	const resolveEntry = options.resolve ?? resolveFromAnchor;
+	const urls = [];
+	for (const anchor of hostExternalAnchors(env, cwd)) {
+		const entry = resolveEntry(anchor, specifier);
+		if (entry === null || entry.length === 0) continue;
+		const url = (0, node_url.pathToFileURL)(entry).href;
+		if (!urls.includes(url)) urls.push(url);
+	}
+	return urls;
+}
+//#endregion
+//#region src/shared/lazy-sharp.ts
+/**
+* lazy-sharp — resolve `sharp` ONCE, not once per frame, and give up ONCE when
+* it cannot be resolved at all.
+*
+* ## What this fixes (2026-08-02)
+*
+* `await import('sharp')` sat directly in the frame path, in a spot whose own
+* comment reads "This is the production hot path (camera frames from broker)",
+* and in six other places along the same path. At ~13 fps per camera across the
+* fleet that is thousands of dynamic imports a minute.
+*
+* Node caches the MODULE after the first import, so this looks free. It is not:
+* the addon runner registers module-customization hooks (the framework
+* resolver), and with hooks registered every `import()` re-enters the loader and
+* resolves the specifier through the hooks worker — **synchronously**. A CPU
+* profile of the live detection runner caught it exactly:
+*
+*     makeSyncRequest@hooks:631
+*     resolveSync@hooks:860
+*     #resolveAndMaybeBlockOnLoaderThread@loader:715
+*     …
+*     import@loader:626
+*     runPipeline@index.js:5565
+*
+* `#resolveAndMaybeBlockOnLoaderThread` is the name of the problem:
+* `makeSyncRequest` blocks the MAIN THREAD on `Atomics.wait` until the hooks
+* worker answers. That is a synchronous block on the frame path, which is the
+* shape the 22-88s event-loop freezes had.
+*
+* ## What it fixes a second time (2026-08-14)
+*
+* A memo that CLEARS on failure re-pays that entire cost on every call once the
+* module genuinely is not there. The subject-tile tier hit exactly that: in the
+* decode worker (a plain `child_process.fork`, no resolver hook) `import('sharp')`
+* cannot resolve, and because the memo was dropped on failure, every subject of
+* every frame re-entered the loader and logged a WARN — 3 800 WARN/min
+* cluster-wide, with a synchronous loader round-trip on the frame path behind
+* each one, and not one tile ever cut.
+*
+* So this module now does two more things:
+*
+*  1. **Falls back to an explicit path.** Same mechanism `node-av` has used in
+*     the same worker for months, extracted into
+*     `shared/host-external-import.ts` — read its docblock for the layouts and
+*     for why the framework resolver is NOT registered in the child instead.
+*  2. **Distinguishes the two failure kinds.**
+*     - **Resolution** failure (nothing, anywhere, resolves `sharp`): the answer
+*       cannot change while this process lives, so it is memoized as a sticky
+*       {@link SharpUnavailableError}. Later calls reject IMMEDIATELY, with no
+*       loader re-entry, and exactly ONE warning is emitted for the process
+*       naming every candidate tried and the cause.
+*     - **Load** failure (found, but the native binary or the module body threw):
+*       the memo is cleared, so a later call retries. A partially-installed
+*       native dep during a deploy must not poison the encoder for the whole
+*       process lifetime — that would turn a blip into a camera that never
+*       produces media again. This is the original behaviour, kept on purpose,
+*       and it is safe to keep only because it is now the NARROW case.
+*
+* ## Why a memo and not a static import
+*
+* `sharp` is a heavy native module. The dynamic import was deliberate — nodes
+* that never encode a frame should not pay to load it, and a node whose native
+* build is missing must fail at first use rather than at boot. Both properties
+* survive: the module is still loaded on FIRST use, and a failure still surfaces
+* at that call. Only the repeat resolutions are removed.
+*
+* The promise itself is cached (not just the resolved value), so N concurrent
+* first-callers share one import instead of racing into N.
+*/
+/** The bare specifier. Also the first entry of a failure's candidate list. */
+var SHARP_SPECIFIER = "sharp";
+/**
+* `sharp` cannot be resolved in this process, and nothing about that can change
+* while it runs. Carries the candidates tried so the log answers "where did you
+* look" without a second round of diagnosis.
+*/
+var SharpUnavailableError = class extends Error {
+	attempts;
+	constructor(attempts, cause) {
+		super(`sharp could not be resolved in this process — tried ${attempts.join(", ")}; cause: ${describeError(cause)}`, { cause });
+		this.name = "SharpUnavailableError";
+		this.attempts = attempts;
+	}
+};
+function describeError(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* The bare specifier stays a LITERAL `import('sharp')` so the bundler keeps
+* treating it as the declared external it is; only the fallback candidates go
+* through a variable specifier (typed `any` by TS, so the declared return type
+* applies without a cast — the same shape `importNodeAv` uses).
+*/
+async function importSharpModule(specifier) {
+	if (specifier === SHARP_SPECIFIER) return import("sharp");
+	return await import(specifier);
+}
+/**
+* Build a loader. Exported for tests; production uses the module-level
+* {@link getSharp}, which is one of these.
+*/
+function createSharpLoader(deps = {}) {
+	const importModule = deps.importModule ?? importSharpModule;
+	const fallbackUrls = deps.fallbackUrls ?? (() => hostExternalEntryUrls(SHARP_SPECIFIER));
+	const warn = deps.warn;
+	let pending = null;
+	let unavailable = null;
+	let warned = false;
+	/** Bare first, then each fallback candidate, in order. */
+	const attempt = async () => {
+		const attempts = [SHARP_SPECIFIER];
+		let lastError;
+		try {
+			return (await importModule(SHARP_SPECIFIER)).default;
+		} catch (bareError) {
+			if (!isModuleResolutionError(bareError)) {
+				pending = null;
+				throw bareError;
+			}
+			lastError = bareError;
+		}
+		for (const url of fallbackUrls()) {
+			attempts.push(url);
+			try {
+				return (await importModule(url)).default;
+			} catch (candidateError) {
+				if (!isModuleResolutionError(candidateError)) {
+					pending = null;
+					throw candidateError;
+				}
+				lastError = candidateError;
+			}
+		}
+		const failure = new SharpUnavailableError(attempts, lastError);
+		unavailable = failure;
+		pending = null;
+		if (!warned) {
+			warned = true;
+			if (warn) warn(failure.message);
+			else process.stderr.write(`${failure.message}\n`);
+		}
+		throw failure;
+	};
+	return {
+		load: () => {
+			if (unavailable !== null) return Promise.reject(unavailable);
+			if (pending === null) pending = attempt();
+			return pending;
+		},
+		reset: () => {
+			pending = null;
+			unavailable = null;
+			warned = false;
+		}
+	};
+}
+/** Where the process-wide loader's single diagnostic goes. */
+var warnSink = null;
+/**
+* Route the one-off "sharp is unavailable" diagnostic somewhere it will be seen.
+* Without a sink it goes to stderr, which the decode worker's parent inherits
+* but does NOT forward to the scoped logger — so the worker installs one at
+* boot (`decode-worker-child.ts`) to get the line into `addons.getLogs` with its
+* `[dev:<id>]` prefix.
+*/
+function setSharpWarnSink(sink) {
+	warnSink = sink;
+}
+var defaultLoader = createSharpLoader({ warn: (message) => {
+	if (warnSink) warnSink(message);
+	else process.stderr.write(`${message}\n`);
+} });
+/**
+* The `sharp` factory, resolved once per process.
+*
+* Rejects with {@link SharpUnavailableError} — immediately, and without touching
+* the module loader — once resolution has been proven impossible here.
+*/
+function getSharp() {
+	return defaultLoader.load();
+}
+//#endregion
+Object.defineProperty(exports, "getSharp", {
+	enumerable: true,
+	get: function() {
+		return getSharp;
+	}
+});
+Object.defineProperty(exports, "hostExternalEntryUrls", {
+	enumerable: true,
+	get: function() {
+		return hostExternalEntryUrls;
+	}
+});
+Object.defineProperty(exports, "setSharpWarnSink", {
+	enumerable: true,
+	get: function() {
+		return setSharpWarnSink;
+	}
+});

package/dist/motion-wasm/index.js

@@ -2,10 +2,10 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CgJ8MRAy.js");
-const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
-let node_fs = require("node:fs");
+const require_dist = require("../dist-6ZJCV0jY.js");
+const require_lazy_sharp = require("../lazy-sharp-DvwPafeP.js");
 let node_path = require("node:path");
+let node_fs = require("node:fs");
 //#region src/motion-wasm/wasm-motion-detector.ts
 /**
 * WasmMotionDetector — loads the AssemblyScript WASM module and provides

package/dist/motion-wasm/index.mjs

@@ -1,7 +1,7 @@
-import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-CKY0efl3.mjs";
-import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
-import { readFileSync } from "node:fs";
+import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-T_8jMw7d.mjs";
+import { t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
 import { join } from "node:path";
+import { readFileSync } from "node:fs";
 //#region src/motion-wasm/wasm-motion-detector.ts
 /**
 * WasmMotionDetector — loads the AssemblyScript WASM module and provides

package/dist/pipeline-runner/index.js

@@ -2,20 +2,19 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-CgJ8MRAy.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-Dx-zXcNg.js");
-const require_worker_protocol = require("../worker-protocol-D44DCkcs.js");
+const require_dist = require("../dist-6ZJCV0jY.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-Cjof8vA1.js");
+const require_worker_protocol = require("../worker-protocol-B0cbTXyw.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
+const require_lazy_sharp = require("../lazy-sharp-DvwPafeP.js");
 const require_remote_restream = require("../remote-restream-BYbAsgUf.js");
 let sharp = require("sharp");
-sharp = require_chunk.__toESM(sharp);
+sharp = require_dist.__toESM(sharp);
 let node_child_process = require("node:child_process");
 let node_url = require("node:url");
 let node_perf_hooks = require("node:perf_hooks");
 let node_os = require("node:os");
-node_os = require_chunk.__toESM(node_os);
+node_os = require_dist.__toESM(node_os);
 //#region src/session-decode/fork-decode-worker.ts
 /** Absolute path to the built decode-worker child entry (a vite build entry). */
 var CHILD_ENTRY_PATH = (0, node_url.fileURLToPath)(new URL("../session-decode/decode-worker-child.js", require("url").pathToFileURL(__filename).href));

package/dist/pipeline-runner/index.mjs

@@ -1,8 +1,8 @@
-import { At as string, Ct as boolean, Dt as number, Et as literal, K as pipelineRunnerCapability, M as deriveDetailCropRect, Mt as EventCategory, Ot as object, St as array, Tt as lazy, U as pickDetailCropConvention, W as pickNativeLeaseOverride, dt as createEvent, gt as nodePin, j as defineCustomActions, k as customAction, s as DEFAULT_DETAIL_CROP_CONVENTION, st as BaseAddon, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT, xt as _enum } from "../dist-CKY0efl3.mjs";
-import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-CIapFIez.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-BzAQPUR-.mjs";
+import { At as string, Ct as boolean, Dt as number, Et as literal, K as pipelineRunnerCapability, M as deriveDetailCropRect, Mt as EventCategory, Ot as object, St as array, Tt as lazy, U as pickDetailCropConvention, W as pickNativeLeaseOverride, dt as createEvent, gt as nodePin, j as defineCustomActions, k as customAction, s as DEFAULT_DETAIL_CROP_CONVENTION, st as BaseAddon, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT, xt as _enum } from "../dist-T_8jMw7d.mjs";
+import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-XeGmL4xr.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-SqED7Y9i.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
+import { t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
 import { i as withDetectionIntent, n as profileForStreamId, t as isRemoteRestream } from "../remote-restream-Ci7RXNGb.mjs";
 import sharp from "sharp";
 import { fork } from "node:child_process";

package/dist/recorder/index.js

@@ -1,12 +1,11 @@
-const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-CgJ8MRAy.js");
+const require_dist = require("../dist-6ZJCV0jY.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_addon_utils = require("../addon-utils-CQs-AjTJ.js");
+const require_addon_utils = require("../addon-utils-a_36HH_N.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
-let node_fs = require("node:fs");
 let node_path = require("node:path");
-node_path = require_chunk.__toESM(node_path);
+node_path = require_dist.__toESM(node_path);
+let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 //#region src/recorder/event-capture.ts
 function markerFromMotion(data, pad) {
@@ -2251,7 +2250,7 @@ var DEFAULT_DEVICE_CONFIG = {
 	enabled: false,
 	bands: []
 };
-function serialize(map) {
+function serialize$1(map) {
 	const out = {};
 	for (const [id, config] of map) out[String(id)] = config;
 	return out;
@@ -2306,7 +2305,7 @@ async function saveDeviceConfig(state, deviceId, config) {
 	};
 	const map = await readDeviceConfigs(state);
 	map.set(deviceId, validated);
-	await state.set(serialize(map));
+	await state.set(serialize$1(map));
 	return validated;
 }
 /**
@@ -2644,6 +2643,33 @@ function buildExportArgs(input) {
 var RECORDING_EXPORTS_KEY = "recordingExports";
 /** Persisted shape: export id → full ExportRecord. */
 var RecordingExportsBlobSchema = require_dist.record(require_dist.string(), require_dist.ExportRecordSchema);
+/**
+* One in-flight mutation chain per durable handle.
+*
+* EVERY mutation here is a read-modify-write of the SAME blob, and both halves
+* are async — so two overlapping cycles read the same snapshot and the second
+* `set` discards whatever the first one added. Last writer wins, silently.
+*
+* That is not a hypothetical. The engine patches `progressPct` roughly once a
+* second for an in-flight render, unawaited; on 2026-08-14 a `createExport` for
+* camera 615 landed between one such patch's read and its write, the row was
+* erased, and five seconds later the poll answered `unknown export
+* "547ea182-…"`. The camera's whole night was lost to it — the scheduler read a
+* vanished row as a failed render and re-queued, forever.
+*
+* Serialising per handle is the smallest fix that makes the loss impossible:
+* the cycles queue instead of interleaving, and the queue is per state object
+* so two recorders in one process never contend. A `WeakMap` keeps a disposed
+* handle collectable. Reads stay OUTSIDE the chain — a blob replacement is
+* atomic, so a reader always sees one consistent generation.
+*/
+var mutationChains = /* @__PURE__ */ new WeakMap();
+/** Run `work` after every mutation already queued for `state`, never before. */
+async function serialize(state, work) {
+	const next = (mutationChains.get(state) ?? Promise.resolve()).then(work, work);
+	mutationChains.set(state, next.catch(() => void 0));
+	return next;
+}
 /** Read every persisted export row, keyed by export id. */
 async function readExports(state) {
 	const blob = await state.get();
@@ -2652,26 +2678,30 @@ async function readExports(state) {
 /** Insert or replace one export row. Validates at the boundary. Returns it. */
 async function upsertExport(state, record) {
 	const validated = require_dist.ExportRecordSchema.parse(record);
-	const map = await readExports(state);
-	map.set(validated.id, validated);
-	await state.set(Object.fromEntries(map));
-	return validated;
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		map.set(validated.id, validated);
+		await state.set(Object.fromEntries(map));
+		return validated;
+	});
 }
 /**
 * Shallow-merge a patch into one export row and persist. Returns the merged
 * record, or null when the id is unknown.
 */
 async function patchExport(state, id, patch) {
-	const map = await readExports(state);
-	const existing = map.get(id);
-	if (!existing) return null;
-	const merged = require_dist.ExportRecordSchema.parse({
-		...existing,
-		...patch
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		const existing = map.get(id);
+		if (!existing) return null;
+		const merged = require_dist.ExportRecordSchema.parse({
+			...existing,
+			...patch
+		});
+		map.set(id, merged);
+		await state.set(Object.fromEntries(map));
+		return merged;
 	});
-	map.set(id, merged);
-	await state.set(Object.fromEntries(map));
-	return merged;
 }
 /** Read one export row by id, or null. */
 async function getExportRecord(state, id) {
@@ -3002,6 +3032,80 @@ async function markDownloaded(id, now, deps, scheduleDelete, graceMs) {
 	}, graceMs);
 }
 //#endregion
+//#region src/recorder/addon/export-reconcile.ts
+/**
+* States that can only mean "a render was owed and the process went away".
+*
+* There is no live render at reconcile time by construction: the engine is
+* built fresh with an empty queue, and this runs before anything is enqueued.
+*/
+function isInterrupted(record) {
+	return record.state === "queued" || record.state === "rendering";
+}
+/**
+* Hand every interrupted row back to the engine, once, at boot.
+*
+* A row past its `expiresAt` is FAILED rather than re-rendered: hours of
+* footage re-encoded for a file the janitor is about to drop costs a recording
+* node an ffmpeg for nothing. Failing it is also what makes the outcome
+* visible — a row that silently stays `queued` forever is the defect this
+* module exists to remove, and swapping it for a quieter one would not be a
+* fix.
+*/
+async function reconcileInterruptedExports(deps) {
+	const now = deps.now();
+	const interrupted = (await listExportsFor(deps.state)).filter(isInterrupted);
+	if (interrupted.length === 0) return {
+		requeued: 0,
+		expired: 0
+	};
+	let requeued = 0;
+	let expired = 0;
+	for (const row of interrupted) {
+		const tags = { deviceId: row.deviceId };
+		const meta = {
+			exportId: row.id,
+			wasState: row.state,
+			fromMs: row.fromMs,
+			toMs: row.toMs,
+			createdAt: row.createdAt
+		};
+		if (row.expiresAt <= now) {
+			expired += 1;
+			await patchExport(deps.state, row.id, {
+				state: "failed",
+				progressPct: null,
+				error: "interrupted by a restart and expired before it could be rendered"
+			});
+			deps.logger.warn("export abandoned: interrupted by a restart, and already expired", {
+				tags,
+				meta
+			});
+			continue;
+		}
+		requeued += 1;
+		await patchExport(deps.state, row.id, {
+			state: "queued",
+			progressPct: null,
+			error: null
+		});
+		deps.logger.warn("export re-queued: it was interrupted by a restart", {
+			tags,
+			meta
+		});
+		deps.engine.enqueue(row.id);
+	}
+	deps.logger.info("recording exports reconciled after restart", { meta: {
+		interrupted: interrupted.length,
+		requeued,
+		expired
+	} });
+	return {
+		requeued,
+		expired
+	};
+}
+//#endregion
 //#region src/recorder/playlist.ts
 /** A VOD variant playlist with an absolute wall-clock anchor per segment. */
 function buildVariantPlaylist(segments) {
@@ -7479,23 +7583,25 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.retentionSweeper?.start();
 	}
 	/**
-	* Resume interrupted exports and arm the expiry sweep. A row left `rendering`
-	* by a crash/restart has no live ffmpeg, so demote it to `queued` and re-enqueue
-	* it alongside any still-`queued` rows. The sweep runs immediately then on an
-	* interval; both are best-effort (a failure never blocks boot).
+	* Resume interrupted exports and arm the expiry sweep.
+	*
+	* The resume itself lives in `export-reconcile.ts` — pure, tested, and loud
+	* about every row it moves. It used to be an untested loop inlined here that
+	* said nothing at all, so "why is this export still queued an hour later" had
+	* no answer in the log, and a row whose life had already run out was
+	* re-rendered anyway. Both halves are best-effort: a failure never blocks
+	* boot.
 	*/
 	async bootstrapExports() {
 		const engine = this.exportEngine;
 		if (!engine) return;
-		const state = this.exportsStore();
 		try {
-			for (const rec of await listExportsFor(state)) {
-				if (rec.state === "rendering") await patchExport(state, rec.id, {
-					state: "queued",
-					progressPct: null
-				});
-				if (rec.state === "queued" || rec.state === "rendering") engine.enqueue(rec.id);
-			}
+			await reconcileInterruptedExports({
+				state: this.exportsStore(),
+				engine,
+				now: () => Date.now(),
+				logger: this.ctx.logger.child("export")
+			});
 		} catch (err) {
 			this.ctx.logger.warn("recorder: export boot re-queue failed", { meta: { error: require_dist.errMsg(err) } });
 		}