@camstack/addon-pipeline 1.2.88 → 1.2.90

package/dist/recorder/index.js

@@ -1,6 +1,6 @@
-const require_dist = require("../dist-CMHxEH6s.js");
+const require_dist = require("../dist-n4Nbnxx5.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_addon_utils = require("../addon-utils-B8tPjc8F.js");
+const require_addon_utils = require("../addon-utils-yc-chXuC.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 let node_path = require("node:path");
@@ -507,14 +507,14 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$4 = 36e5;
+var HOUR_MS$5 = 36e5;
 /** A device walked end-to-end. Cheaper and clearer than inserting every hour of
 *  the retention window into the set. */
 var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
-	for (let h = first; h < toMs; h += HOUR_MS$4) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
+	for (let h = first; h < toMs; h += HOUR_MS$5) yield h;
 }
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
@@ -630,7 +630,7 @@ var RecordingIndex = class {
 			});
 		}
 		this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$4);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$5);
 	}
 	/** Insert/replace one finalized segment (idempotent by path). */
 	addSegment(s) {
@@ -1371,6 +1371,8 @@ var SegmentStore = class SegmentStore {
 		if (removed.length > 0) {
 			this.deps.index.removeSegments(removed);
 			this.notifyEvicted(rows);
+			const gone = new Set(removed);
+			this.deps.onDeindexed?.(rows.filter((r) => gone.has(r.path)));
 		}
 		await this.pruneEmptyAncestors(location, [...byBucket.keys()]);
 		this.deps.logger.info("recorder: eviction round complete", { meta: {
@@ -1936,7 +1938,7 @@ async function profileHasFootage(root, deviceId, profile) {
 //#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
-var HOUR_MS$3 = 36e5;
+var HOUR_MS$4 = 36e5;
 /**
 * UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
 *
@@ -2109,7 +2111,7 @@ var CalendarIndex = class {
 		}));
 		const days = /* @__PURE__ */ new Set();
 		for (const { day, hours } of perDay) for (const h of hours) {
-			const at = day + h * HOUR_MS$3;
+			const at = day + h * HOUR_MS$4;
 			if (at < fromMs || at >= toMs) continue;
 			days.add(localDayStart(at, tzOffsetMinutes));
 		}
@@ -2171,7 +2173,7 @@ var CalendarIndex = class {
 		const day = utcDayOf(utcDayMs);
 		for (let h = 0; h < 24; h++) {
 			await this.awaitQuiet();
-			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$3, true);
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$4, true);
 		}
 	}
 	/**
@@ -2192,10 +2194,10 @@ var CalendarIndex = class {
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
 		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
-		const hour = Math.floor(hourStartMs / HOUR_MS$3) * HOUR_MS$3;
+		const hour = Math.floor(hourStartMs / HOUR_MS$4) * HOUR_MS$4;
 		const key = `${deviceId}:${profile}:${hour}`;
 		const now = this.deps.now?.() ?? Date.now();
-		const isCurrentHour = hour === Math.floor(now / HOUR_MS$3) * HOUR_MS$3;
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$4) * HOUR_MS$4;
 		const cached = this.hourSegs.get(key);
 		if (cached !== void 0) {
 			if (!isCurrentHour) return {
@@ -2259,7 +2261,7 @@ var CalendarIndex = class {
 	*/
 	async dayRanges(deviceId, profile, utcDayMs) {
 		const day = utcDayOf(utcDayMs);
-		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$3), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$4), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
 	}
 	/**
 	* Warm the days either side of the one being viewed, in the BACKGROUND.
@@ -2437,7 +2439,7 @@ function activeModeForConfig(config) {
 }
 //#endregion
 //#region src/recorder/addon/directory-handler.ts
-var HOUR_MS$2 = 36e5;
+var HOUR_MS$3 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
 *  would walk the archive on the read path — the thing this replaces. */
 var MAX_WINDOW_MS = 32 * 864e5;
@@ -2484,9 +2486,9 @@ function withDirectoryRoute(deps, next) {
 				return;
 			}
 			const rows = [];
-			const firstHour = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+			const firstHour = Math.floor(fromMs / HOUR_MS$3) * HOUR_MS$3;
 			let hydrated = true;
-			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$2) {
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$3) {
 				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
 				if (!complete) hydrated = false;
 				for (const s of segments) {
@@ -2634,6 +2636,28 @@ function withStreamTimeDenseRanges(input) {
 }
 //#endregion
 //#region src/recorder/addon/export-ffmpeg-args.ts
+/**
+* ffmpeg argv builder for recording EXPORTS (render a footage range → one MP4).
+*
+* Input is the export's OWN source playlist for the range — a per-export file
+* whose segment URIs are absolute on-disk paths (`export-source-playlist.ts`).
+* It is deliberately NOT the playback manifest's `localMasterPath`: those URIs
+* resolve only through the data-plane's multi-root search, which ffmpeg does not
+* have. Output is a single faststart MP4. Three shapes, from `ExportOptions`:
+*   - 1× + audio            → pure remux (`-c copy`), zero re-encode.
+*   - speed ≠ 1             → `setpts=PTS/speed` video re-encode; audio kept
+*                             only for 0.5–2× (single `atempo`), else dropped.
+*   - timelapse             → sample one frame per `everyMs`, output at
+*                             `outputFps`, always silent.
+* Distinct from `buildPassthroughArgs` (live segmentation) — do not conflate.
+*
+* A **timelapse of a long HLS concat** is two argv sets, not one. Pass 1
+* (`buildConcatPassArgs`) remuxes the playlist to a single mpegts with `-c
+* copy`. Pass 2 (`buildExportArgs` with that file as `-i`) then selects
+* frames. Selecting WHILE walking `#EXT-X-DISCONTINUITY` (one per 10s
+* segment from `-reset_timestamps`) is what parked a 30h salone job at
+* `rendering 0%` / 0% CPU — ffmpeg never left the concat demuxer.
+*/
 /** Widest [min,max] speed a single ffmpeg `atempo` filter accepts. Outside this
 *  band audio is dropped rather than chained (kept simple + predictable). */
 var ATEMPO_MIN = .5;
@@ -2697,6 +2721,29 @@ function selectPredicate(everySec, dense) {
 	if (dense === void 0 || dense.ranges.length === 0) return `${seed}+${elapsed(everySec)}`;
 	return `${seed}+if(${dense.ranges.map((r) => `between(t,${sec(r.fromSec)},${sec(r.toSec)})`).join("+")},${elapsed(dense.everyMs / 1e3)},${elapsed(everySec)})`;
 }
+/**
+* Sidecar for timelapse pass 1: same directory as the final MP4, `.concat.ts`.
+* mpegts (not MP4) because `-c copy` across HLS discontinuities is reliable
+* in a transport stream and often is not in a fragmented MP4.
+*/
+function concatPassOutPath(outPath) {
+	const dir = node_path.default.dirname(outPath);
+	const base = node_path.default.basename(outPath, node_path.default.extname(outPath));
+	return node_path.default.join(dir, `${base}.concat.ts`);
+}
+/** Pass 1 of a timelapse: remux the HLS playlist into one continuous file. */
+function buildConcatPassArgs(input) {
+	return [
+		"-i",
+		input.inputPlaylist,
+		"-c",
+		"copy",
+		"-an",
+		"-f",
+		"mpegts",
+		input.outPath
+	];
+}
 /** Build the ffmpeg argv for one export render. */
 function buildExportArgs(input) {
 	const { inputPlaylist, outPath, options } = input;
@@ -2983,12 +3030,6 @@ var ExportEngine = class {
 	/** Spawn ffmpeg for one render and resolve when it has exited + finalized. */
 	async spawnRender(id, rec, playlist, options) {
 		const outPath = this.deps.outPath(rec);
-		const args = buildExportArgs({
-			inputPlaylist: playlist,
-			outPath,
-			options
-		});
-		const totalSec = expectedOutSeconds(rec);
 		this.deps.logger.info("export render starting", {
 			tags: { deviceId: rec.deviceId },
 			meta: {
@@ -2999,11 +3040,67 @@ var ExportEngine = class {
 				outPath
 			}
 		});
+		if (options.timelapse) {
+			await this.spawnTimelapse(id, rec, playlist, outPath, options);
+			return;
+		}
+		const args = buildExportArgs({
+			inputPlaylist: playlist,
+			outPath,
+			options
+		});
+		const ran = await this.runFfmpeg(id, args, {
+			totalSec: expectedOutSeconds(rec),
+			floor: 0,
+			ceil: 99
+		});
+		await this.finish(id, ran.code, outPath, ran.stderrTail);
+	}
+	/**
+	* Concat the HLS pieces into one continuous file, THEN select frames.
+	* The select filter on a discontinuity-heavy playlist is what parked a
+	* 30h job at `rendering 0%` — pass 1 is `-c copy` into mpegts so pass 2
+	* sees a single timestamp line.
+	*/
+	async spawnTimelapse(id, rec, playlist, outPath, options) {
+		const concatPath = concatPassOutPath(outPath);
+		try {
+			const concatArgs = buildConcatPassArgs({
+				inputPlaylist: playlist,
+				outPath: concatPath
+			});
+			const concatRan = await this.runFfmpeg(id, concatArgs, {
+				totalSec: Math.max(.001, (rec.toMs - rec.fromMs) / 1e3),
+				floor: 0,
+				ceil: 49
+			});
+			if (this.cancelled.has(id) || concatRan.code !== 0) {
+				await this.finish(id, concatRan.code, concatPath, concatRan.stderrTail);
+				return;
+			}
+			const selectArgs = buildExportArgs({
+				inputPlaylist: concatPath,
+				outPath,
+				options
+			});
+			const selectRan = await this.runFfmpeg(id, selectArgs, {
+				totalSec: expectedOutSeconds(rec),
+				floor: 50,
+				ceil: 99
+			});
+			await this.finish(id, selectRan.code, outPath, selectRan.stderrTail);
+		} finally {
+			try {
+				await this.deps.removeFile(concatPath);
+			} catch {}
+		}
+	}
+	runFfmpeg(id, args, progress) {
 		this.deps.logger.debug("export ffmpeg argv", { meta: {
 			exportId: id,
 			args
 		} });
-		await new Promise((resolve) => {
+		return new Promise((resolve) => {
 			const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
 			this.activeProc = proc;
 			const stderrTail = [];
@@ -3018,7 +3115,8 @@ var ExportEngine = class {
 					const m = TIME_RE.exec(line);
 					if (m) {
 						const sec = Number(m[1]) * 3600 + Number(m[2]) * 60 + Number(m[3]);
-						const pct = Math.min(99, Math.round(sec / totalSec * 100));
+						const span = progress.ceil - progress.floor;
+						const pct = Math.min(progress.ceil, progress.floor + Math.round(sec / progress.totalSec * span));
 						patchExport(this.deps.state, id, { progressPct: pct });
 						this.deps.emit(require_dist.EventCategory.RecordingExportProgress, {
 							exportId: id,
@@ -3029,7 +3127,10 @@ var ExportEngine = class {
 			});
 			proc.on("exit", (code) => {
 				this.activeProc = null;
-				this.finish(id, typeof code === "number" ? code : null, outPath, stderrTail).then(resolve);
+				resolve({
+					code: typeof code === "number" ? code : null,
+					stderrTail
+				});
 			});
 		});
 	}
@@ -3080,9 +3181,15 @@ var ExportEngine = class {
 			outPath,
 			bytes
 		} });
+		const rec = await getExportRecord(this.deps.state, id);
 		this.deps.emit(require_dist.EventCategory.RecordingExportCompleted, {
 			exportId: id,
-			fileBytes: bytes
+			fileBytes: bytes,
+			...rec !== null ? {
+				deviceId: rec.deviceId,
+				...rec.options.title !== void 0 ? { title: rec.options.title } : {},
+				...rec.options.notifyTargetIds !== void 0 && rec.options.notifyTargetIds.length > 0 ? { notifyTargetIds: rec.options.notifyTargetIds } : {}
+			} : {}
 		});
 	}
 	async fail(id, error) {
@@ -5081,7 +5188,7 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	const p2 = (n) => String(n).padStart(2, "0");
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
-var HOUR_MS$1 = 36e5;
+var HOUR_MS$2 = 36e5;
 /**
 * Hydrate ONLY the hours a window spans, instead of walking the archive.
 *
@@ -5116,8 +5223,8 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			});
 			continue;
 		}
-		const first = Math.floor(fromMs / HOUR_MS$1) * HOUR_MS$1;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$1) for (const profile of profiles) {
+		const first = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$2) for (const profile of profiles) {
 			const rel = hourDirRelPath(deviceId, profile, hour);
 			let files;
 			try {
@@ -5759,8 +5866,19 @@ function startPeriodicPass(deps) {
 		isRunning: () => startedAt !== null
 	};
 }
-//#endregion
-//#region src/recorder/addon/readiness-restore.ts
+async function runBounded(items, concurrency, worker) {
+	if (items.length === 0) return;
+	const queue = [...items];
+	const lanes = Math.max(1, Math.min(concurrency, queue.length));
+	const lane = async () => {
+		for (;;) {
+			const item = queue.shift();
+			if (item === void 0) return;
+			await worker(item);
+		}
+	};
+	await Promise.all(Array.from({ length: lanes }, () => lane()));
+}
 var ReadinessRestore = class {
 	deps;
 	pending = /* @__PURE__ */ new Map();
@@ -5770,6 +5888,9 @@ var ReadinessRestore = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	get concurrency() {
+		return Math.max(1, this.deps.concurrency ?? 8);
+	}
 	/** Seed the pending set, subscribe to readiness, and drain once immediately
 	*  (covers the already-ready case). Returns when the first drain settles. */
 	async start(items) {
@@ -5800,7 +5921,8 @@ var ReadinessRestore = class {
 		return this.pending.has(key);
 	}
 	/** Attempt every still-pending item; repeat once if a readiness signal arrived
-	*  mid-flight. Re-entrant and self-coalescing. */
+	*  mid-flight. Re-entrant and self-coalescing. Overlapping up to
+	*  {@link ReadinessRestoreDeps.concurrency}. */
 	async drain() {
 		if (this.draining) {
 			this.rerun = true;
@@ -5811,12 +5933,15 @@ var ReadinessRestore = class {
 		try {
 			do {
 				this.rerun = false;
-				for (const [key, value] of Array.from(this.pending)) try {
-					await this.deps.attempt(key, value);
-					this.pending.delete(key);
-				} catch (err) {
-					this.deps.onDefer?.(key, value, err);
-				}
+				await runBounded(Array.from(this.pending), this.concurrency, async ([key, value]) => {
+					if (!this.pending.has(key)) return;
+					try {
+						await this.deps.attempt(key, value);
+						this.pending.delete(key);
+					} catch (err) {
+						this.deps.onDefer?.(key, value, err);
+					}
+				});
 			} while (this.rerun && this.pending.size > 0);
 		} finally {
 			this.draining = false;
@@ -6511,14 +6636,16 @@ var RecordingController = class {
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: require_dist.errMsg(err) } });
 		}
-		for (const id of ids) try {
-			await this.evaluateDevice(id);
-		} catch (err) {
-			this.deps.logger.warn("recorder controller: convergence evaluate failed", {
-				tags: { deviceId: id },
-				meta: { error: require_dist.errMsg(err) }
-			});
-		}
+		await runBounded([...ids], 8, async (id) => {
+			try {
+				await this.evaluateDevice(id);
+			} catch (err) {
+				this.deps.logger.warn("recorder controller: convergence evaluate failed", {
+					tags: { deviceId: id },
+					meta: { error: require_dist.errMsg(err) }
+				});
+			}
+		});
 	}
 	/**
 	* Re-evaluate one device after a config change (called from `setDeviceConfig`).
@@ -6915,6 +7042,503 @@ function makeBrokerCall(handle) {
 	return (fn) => handle.call(fn, BROKER_READY_TIMEOUT_MS);
 }
 //#endregion
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
+		try {
+			await this.store.delete.mutate({
+				collection: this.spec.collection,
+				key
+			});
+		} catch (err) {
+			this.logger.debug("durable delete failed", { meta: {
+				collection: this.spec.collection,
+				key,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
+	*
+	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
+	* fallible read is work destroyed on an error (D49/D130) — that is why this
+	* is a method a feature opts into rather than a policy the primitive runs.
+	* Best-effort per row: a failed delete keeps the key (retried next prune)
+	* rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
+				});
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
+			}
+		}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
+//#region src/recorder/addon/segment-hour-ledger.ts
+var HOUR_MS$1 = 36e5;
+/**
+* @durable class=mirror owner=recorder
+*   write="write-behind on every finalized segment (hour-row upsert); eviction drops paths; the archive walk reconciles disk into the row set"
+*   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
+*/
+var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
+var RECORDING_SEGMENT_HOURS_COLUMNS = [
+	{
+		name: "key",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "profile",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "locationId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "hourStartMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "paths",
+		type: "TEXT",
+		notNull: true
+	}
+];
+var RECORDING_SEGMENT_HOURS_INDEXES = [{
+	name: "idx_recorder_segment_hours_device",
+	columns: ["deviceId"]
+}, {
+	name: "idx_recorder_segment_hours_hour",
+	columns: ["hourStartMs"]
+}];
+function hourStartMs(startMs) {
+	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
+}
+function segmentHourKey(deviceId, profile, locationId, hour) {
+	return `${deviceId}|${profile}|${locationId}|${hour}`;
+}
+function hourOf(row) {
+	const hour = hourStartMs(row.startMs);
+	return {
+		hourStartMs: hour,
+		key: segmentHourKey(row.deviceId, row.profile, row.locationId, hour)
+	};
+}
+function uniquePaths(paths) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const p of paths) {
+		if (seen.has(p)) continue;
+		seen.add(p);
+		out.push(p);
+	}
+	return out;
+}
+function samePaths(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	for (const p of b) if (!set.has(p)) return false;
+	return true;
+}
+function rowToValue(row) {
+	return {
+		deviceId: row.deviceId,
+		profile: row.profile,
+		locationId: row.locationId,
+		hourStartMs: row.hourStartMs,
+		paths: JSON.stringify(row.paths)
+	};
+}
+function recordToRow(key, data) {
+	const deviceId = Number(data["deviceId"]);
+	const profile = data["profile"];
+	const locationId = data["locationId"];
+	const hour = Number(data["hourStartMs"]);
+	let raw = data["paths"];
+	if (typeof raw === "string") try {
+		raw = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
+	return {
+		key,
+		deviceId,
+		profile,
+		locationId,
+		hourStartMs: hour,
+		paths: raw
+	};
+}
+var SPEC = {
+	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+	columns: RECORDING_SEGMENT_HOURS_COLUMNS,
+	indexes: RECORDING_SEGMENT_HOURS_INDEXES,
+	writeMode: "write-behind",
+	loadLimit: 1e5,
+	keyOf: (row) => row.key,
+	toValue: rowToValue,
+	fromRecord: recordToRow,
+	deviceIdOf: (row) => row.deviceId
+};
+var SegmentHourLedger = class {
+	ledger;
+	logger;
+	constructor(deps) {
+		this.logger = deps.logger;
+		this.ledger = new DurableLedger({
+			spec: SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, SPEC);
+	}
+	declare() {
+		return this.ledger.declare();
+	}
+	async load() {
+		const rows = await this.ledger.load();
+		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
+			hours: rows.length,
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION
+		} });
+		return rows;
+	}
+	snapshot() {
+		return this.ledger.snapshot();
+	}
+	/**
+	* Seed {@link RecordingIndex} from the mirrored hour rows.
+	*
+	* Hours present in the ledger become `hydrated` so a seek in those windows
+	* does not pay for a disk walk. Hours the ledger never held stay `unknown`
+	* — that is the fail-toward-walk direction.
+	*/
+	hydrateIndex(index) {
+		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
+	}
+	/** Write-behind: a just-finalized segment joins its hour row. */
+	async recordSegment(row) {
+		const { key, hourStartMs: hour } = hourOf(row);
+		const held = this.ledger.get(key);
+		if (held !== void 0 && held.paths.includes(row.path)) return;
+		await this.ledger.put({
+			key,
+			deviceId: row.deviceId,
+			profile: row.profile,
+			locationId: row.locationId,
+			hourStartMs: hour,
+			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
+		});
+	}
+	/**
+	* Eviction confirmed these paths are gone from disk. Drop them; forget the
+	* hour when it holds nothing.
+	*/
+	async dropSegments(rows) {
+		const doomed = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const { key } = hourOf(row);
+			let set = doomed.get(key);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				doomed.set(key, set);
+			}
+			set.add(row.path);
+		}
+		for (const [key, paths] of doomed) {
+			const held = this.ledger.get(key);
+			if (held === void 0) continue;
+			const next = held.paths.filter((p) => !paths.has(p));
+			if (next.length === 0) {
+				await this.ledger.forget(key);
+				continue;
+			}
+			if (next.length === held.paths.length) continue;
+			await this.ledger.put({
+				...held,
+				paths: next
+			});
+		}
+	}
+	/**
+	* After a disk walk of `deviceIds`, make the ledger match the index — with
+	* two D148 exceptions:
+	*
+	*  - an hour the walk did not see is dropped ONLY if it is in the past;
+	*    the current hour may still hold a live writer whose file the readdir
+	*    raced;
+	*  - the current hour UNIONs ledger paths with index paths rather than
+	*    replacing, for the same race.
+	*
+	* Devices not in `deviceIds` are left untouched (a partial walk must not
+	* prune cameras it did not look at).
+	*/
+	async reconcileFromIndex(index, deviceIds, nowMs) {
+		const walked = new Set(deviceIds);
+		const currentHour = hourStartMs(nowMs);
+		const fromIndex = /* @__PURE__ */ new Map();
+		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
+			const { key, hourStartMs: hour } = hourOf(seg);
+			const existing = fromIndex.get(key);
+			if (existing === void 0) fromIndex.set(key, {
+				key,
+				deviceId: seg.deviceId,
+				profile: seg.profile,
+				locationId: seg.locationId,
+				hourStartMs: hour,
+				paths: [seg.path]
+			});
+			else fromIndex.set(key, {
+				...existing,
+				paths: [...existing.paths, seg.path]
+			});
+		}
+		for (const row of this.ledger.snapshot()) {
+			if (!walked.has(row.deviceId)) continue;
+			const disk = fromIndex.get(row.key);
+			if (disk === void 0) {
+				if (row.hourStartMs === currentHour) continue;
+				await this.ledger.forget(row.key);
+				continue;
+			}
+			if (row.hourStartMs === currentHour) {
+				const union = uniquePaths([...disk.paths, ...row.paths]);
+				if (!samePaths(union, row.paths)) await this.ledger.put({
+					...row,
+					paths: union
+				});
+				continue;
+			}
+			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
+		}
+		for (const [key, disk] of fromIndex) {
+			if (this.ledger.has(key)) continue;
+			await this.ledger.put(disk);
+		}
+	}
+};
+//#endregion
 //#region src/recorder/addon/recording-export-provider.ts
 /** Content type of every rendered export — the engine only ever writes MP4. */
 var EXPORT_CONTENT_TYPE = "video/mp4";
@@ -6942,6 +7566,12 @@ function exportFileName(rec) {
 async function hasFootage(index, deviceId, profile, fromMs, toMs) {
 	return (await index.segmentsInWindow(deviceId, profile, fromMs, toMs)).some((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs);
 }
+/** Canonical `profiles[]`, falling back to the legacy singular `profile`. */
+function resolveExportProfiles(input) {
+	if (input.profiles !== void 0 && input.profiles.length > 0) return [...input.profiles];
+	if (typeof input.profile === "string" && input.profile.length > 0) return [input.profile];
+	return [];
+}
 /** Load a record or throw a clear NOT_FOUND-style error. */
 async function requireRecord(state, exportId) {
 	const rec = await getExportRecord(state, exportId);
@@ -6951,30 +7581,37 @@ async function requireRecord(state, exportId) {
 /** Build the `recordingExport` provider over the injected deps. */
 function buildRecordingExportProvider(deps) {
 	return {
-		createExport: async ({ deviceId, profile, fromMs, toMs, options }) => {
+		createExport: async (input) => {
+			const { deviceId, fromMs, toMs, options } = input;
+			const profiles = resolveExportProfiles(input);
+			if (profiles.length < 1) throw new Error("recording-export: profiles must contain at least one profile");
 			if (!(fromMs < toMs)) throw new Error(`recording-export: invalid range ${fromMs}..${toMs}`);
-			if (!await hasFootage(deps.index, deviceId, profile, fromMs, toMs)) throw new Error(`recording-export: no footage for ${deviceId}/${profile} in ${fromMs}..${toMs}`);
+			for (const profile of profiles) if (!await hasFootage(deps.index, deviceId, profile, fromMs, toMs)) throw new Error(`recording-export: no footage for ${deviceId}/${profile} in ${fromMs}..${toMs}`);
 			const now = deps.now();
-			const record = {
-				id: deps.newId(),
-				deviceId,
-				profile,
-				fromMs,
-				toMs,
-				options,
-				state: "queued",
-				progressPct: null,
-				fileBytes: null,
-				expiresAt: now + options.maxLifeMs,
-				deleteAfterDownload: options.deleteAfterDownload,
-				downloadedAt: null,
-				createdAt: now,
-				createdBy: deps.createdBy(),
-				error: null
-			};
-			const saved = await upsertExport(deps.state, record);
-			deps.engine.enqueue(saved.id);
-			return saved;
+			let first = null;
+			for (const profile of profiles) {
+				const record = {
+					id: deps.newId(),
+					deviceId,
+					profile,
+					fromMs,
+					toMs,
+					options,
+					state: "queued",
+					progressPct: null,
+					fileBytes: null,
+					expiresAt: now + options.maxLifeMs,
+					deleteAfterDownload: options.deleteAfterDownload,
+					downloadedAt: null,
+					createdAt: now,
+					createdBy: deps.createdBy(),
+					error: null
+				};
+				const saved = await upsertExport(deps.state, record);
+				deps.engine.enqueue(saved.id);
+				first ??= saved;
+			}
+			return first;
 		},
 		listExports: ({ deviceId }) => listExportsFor(deps.state, deviceId),
 		getExport: ({ exportId }) => requireRecord(deps.state, exportId),
@@ -7723,6 +8360,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	isRecordingNode = true;
 	index = new RecordingIndex();
 	/**
+	* Durable hour-directory copy of {@link index}. Null on an inert
+	* (non-recording) node. Boot reseeds the RAM index from this; the
+	* deferred archive walk reconciles it against disk.
+	*/
+	segmentHours = null;
+	/**
 	* The calendar rungs — which days, which hours, and a day's exact ranges.
 	*
 	* Separate from `RecordingIndex` on purpose: that one is the SEGMENT model
@@ -7794,6 +8437,16 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			} });
 			return { providers: [] };
 		}
+		this.segmentHours = new SegmentHourLedger({
+			store: this.ctx.api.settingsStore,
+			logger: this.ctx.logger
+		});
+		try {
+			await this.segmentHours.declare();
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger declare failed — index stays RAM-only this boot", { meta: { error: require_dist.errMsg(err) } });
+			this.segmentHours = null;
+		}
 		const ingestOwner = await this.resolveIngestOwner();
 		const consumerHostname = this.nodeId === ingestOwner.ownerNodeId ? void 0 : ingestOwner.reachableHost ?? resolveRecordingHubHostname(this.config.recordingHubHostname, process.env["CAMSTACK_HUB_URL"]);
 		if (this.nodeId !== ingestOwner.ownerNodeId) {
@@ -7830,7 +8483,11 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			onEvicted: (deviceId, atMs) => {
 				this.calendar.invalidate(deviceId, atMs);
 			},
+			onDeindexed: (rows) => {
+				this.segmentHours?.dropSegments(rows);
+			},
 			onIndexed: (row, absPath) => {
+				this.segmentHours?.recordSegment(row);
 				if (!isMfraTableServable(row.startMs, Date.now())) return;
 				readMfraTable(absPath, row.bytes).then((table) => {
 					this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
@@ -8207,6 +8864,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				this.controller?.onTrigger(deviceId, "motion", atMs);
 			}
 		});
+		try {
+			await this.segmentHours?.load();
+			this.segmentHours?.hydrateIndex(this.index);
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger load failed — falling through to the archive walk", { meta: { error: require_dist.errMsg(err) } });
+		}
 		let configs;
 		try {
 			configs = await readDeviceConfigs(this.configStore());
@@ -8694,6 +9357,11 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				locationCount: this.resolvedLocations.length,
 				ms: Date.now() - hydrateStartedMs
 			} });
+			try {
+				await this.segmentHours?.reconcileFromIndex(this.index, deviceIds, Date.now());
+			} catch (err) {
+				this.ctx.logger.warn("recorder: segment-hour ledger reconcile failed — walk remains the authority", { meta: { error: require_dist.errMsg(err) } });
+			}
 			const loggedDomains = /* @__PURE__ */ new Set();
 			for (const loc of this.resolvedLocations) {
 				const domain = this.locationDomain(loc.id);