@camstack/addon-pipeline 1.2.89 → 1.2.90

package/dist/recorder/index.js

@@ -507,14 +507,14 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$4 = 36e5;
+var HOUR_MS$5 = 36e5;
 /** A device walked end-to-end. Cheaper and clearer than inserting every hour of
 *  the retention window into the set. */
 var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
-	for (let h = first; h < toMs; h += HOUR_MS$4) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
+	for (let h = first; h < toMs; h += HOUR_MS$5) yield h;
 }
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
@@ -630,7 +630,7 @@ var RecordingIndex = class {
 			});
 		}
 		this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$4);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$5);
 	}
 	/** Insert/replace one finalized segment (idempotent by path). */
 	addSegment(s) {
@@ -1371,6 +1371,8 @@ var SegmentStore = class SegmentStore {
 		if (removed.length > 0) {
 			this.deps.index.removeSegments(removed);
 			this.notifyEvicted(rows);
+			const gone = new Set(removed);
+			this.deps.onDeindexed?.(rows.filter((r) => gone.has(r.path)));
 		}
 		await this.pruneEmptyAncestors(location, [...byBucket.keys()]);
 		this.deps.logger.info("recorder: eviction round complete", { meta: {
@@ -1936,7 +1938,7 @@ async function profileHasFootage(root, deviceId, profile) {
 //#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
-var HOUR_MS$3 = 36e5;
+var HOUR_MS$4 = 36e5;
 /**
 * UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
 *
@@ -2109,7 +2111,7 @@ var CalendarIndex = class {
 		}));
 		const days = /* @__PURE__ */ new Set();
 		for (const { day, hours } of perDay) for (const h of hours) {
-			const at = day + h * HOUR_MS$3;
+			const at = day + h * HOUR_MS$4;
 			if (at < fromMs || at >= toMs) continue;
 			days.add(localDayStart(at, tzOffsetMinutes));
 		}
@@ -2171,7 +2173,7 @@ var CalendarIndex = class {
 		const day = utcDayOf(utcDayMs);
 		for (let h = 0; h < 24; h++) {
 			await this.awaitQuiet();
-			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$3, true);
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$4, true);
 		}
 	}
 	/**
@@ -2192,10 +2194,10 @@ var CalendarIndex = class {
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
 		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
-		const hour = Math.floor(hourStartMs / HOUR_MS$3) * HOUR_MS$3;
+		const hour = Math.floor(hourStartMs / HOUR_MS$4) * HOUR_MS$4;
 		const key = `${deviceId}:${profile}:${hour}`;
 		const now = this.deps.now?.() ?? Date.now();
-		const isCurrentHour = hour === Math.floor(now / HOUR_MS$3) * HOUR_MS$3;
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$4) * HOUR_MS$4;
 		const cached = this.hourSegs.get(key);
 		if (cached !== void 0) {
 			if (!isCurrentHour) return {
@@ -2259,7 +2261,7 @@ var CalendarIndex = class {
 	*/
 	async dayRanges(deviceId, profile, utcDayMs) {
 		const day = utcDayOf(utcDayMs);
-		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$3), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$4), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
 	}
 	/**
 	* Warm the days either side of the one being viewed, in the BACKGROUND.
@@ -2437,7 +2439,7 @@ function activeModeForConfig(config) {
 }
 //#endregion
 //#region src/recorder/addon/directory-handler.ts
-var HOUR_MS$2 = 36e5;
+var HOUR_MS$3 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
 *  would walk the archive on the read path — the thing this replaces. */
 var MAX_WINDOW_MS = 32 * 864e5;
@@ -2484,9 +2486,9 @@ function withDirectoryRoute(deps, next) {
 				return;
 			}
 			const rows = [];
-			const firstHour = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+			const firstHour = Math.floor(fromMs / HOUR_MS$3) * HOUR_MS$3;
 			let hydrated = true;
-			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$2) {
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$3) {
 				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
 				if (!complete) hydrated = false;
 				for (const s of segments) {
@@ -5186,7 +5188,7 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	const p2 = (n) => String(n).padStart(2, "0");
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
-var HOUR_MS$1 = 36e5;
+var HOUR_MS$2 = 36e5;
 /**
 * Hydrate ONLY the hours a window spans, instead of walking the archive.
 *
@@ -5221,8 +5223,8 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			});
 			continue;
 		}
-		const first = Math.floor(fromMs / HOUR_MS$1) * HOUR_MS$1;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$1) for (const profile of profiles) {
+		const first = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$2) for (const profile of profiles) {
 			const rel = hourDirRelPath(deviceId, profile, hour);
 			let files;
 			try {
@@ -7040,6 +7042,503 @@ function makeBrokerCall(handle) {
 	return (fn) => handle.call(fn, BROKER_READY_TIMEOUT_MS);
 }
 //#endregion
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
+		try {
+			await this.store.delete.mutate({
+				collection: this.spec.collection,
+				key
+			});
+		} catch (err) {
+			this.logger.debug("durable delete failed", { meta: {
+				collection: this.spec.collection,
+				key,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
+	*
+	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
+	* fallible read is work destroyed on an error (D49/D130) — that is why this
+	* is a method a feature opts into rather than a policy the primitive runs.
+	* Best-effort per row: a failed delete keeps the key (retried next prune)
+	* rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
+				});
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
+			}
+		}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
+//#region src/recorder/addon/segment-hour-ledger.ts
+var HOUR_MS$1 = 36e5;
+/**
+* @durable class=mirror owner=recorder
+*   write="write-behind on every finalized segment (hour-row upsert); eviction drops paths; the archive walk reconciles disk into the row set"
+*   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
+*/
+var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
+var RECORDING_SEGMENT_HOURS_COLUMNS = [
+	{
+		name: "key",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "profile",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "locationId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "hourStartMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "paths",
+		type: "TEXT",
+		notNull: true
+	}
+];
+var RECORDING_SEGMENT_HOURS_INDEXES = [{
+	name: "idx_recorder_segment_hours_device",
+	columns: ["deviceId"]
+}, {
+	name: "idx_recorder_segment_hours_hour",
+	columns: ["hourStartMs"]
+}];
+function hourStartMs(startMs) {
+	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
+}
+function segmentHourKey(deviceId, profile, locationId, hour) {
+	return `${deviceId}|${profile}|${locationId}|${hour}`;
+}
+function hourOf(row) {
+	const hour = hourStartMs(row.startMs);
+	return {
+		hourStartMs: hour,
+		key: segmentHourKey(row.deviceId, row.profile, row.locationId, hour)
+	};
+}
+function uniquePaths(paths) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const p of paths) {
+		if (seen.has(p)) continue;
+		seen.add(p);
+		out.push(p);
+	}
+	return out;
+}
+function samePaths(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	for (const p of b) if (!set.has(p)) return false;
+	return true;
+}
+function rowToValue(row) {
+	return {
+		deviceId: row.deviceId,
+		profile: row.profile,
+		locationId: row.locationId,
+		hourStartMs: row.hourStartMs,
+		paths: JSON.stringify(row.paths)
+	};
+}
+function recordToRow(key, data) {
+	const deviceId = Number(data["deviceId"]);
+	const profile = data["profile"];
+	const locationId = data["locationId"];
+	const hour = Number(data["hourStartMs"]);
+	let raw = data["paths"];
+	if (typeof raw === "string") try {
+		raw = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
+	return {
+		key,
+		deviceId,
+		profile,
+		locationId,
+		hourStartMs: hour,
+		paths: raw
+	};
+}
+var SPEC = {
+	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+	columns: RECORDING_SEGMENT_HOURS_COLUMNS,
+	indexes: RECORDING_SEGMENT_HOURS_INDEXES,
+	writeMode: "write-behind",
+	loadLimit: 1e5,
+	keyOf: (row) => row.key,
+	toValue: rowToValue,
+	fromRecord: recordToRow,
+	deviceIdOf: (row) => row.deviceId
+};
+var SegmentHourLedger = class {
+	ledger;
+	logger;
+	constructor(deps) {
+		this.logger = deps.logger;
+		this.ledger = new DurableLedger({
+			spec: SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, SPEC);
+	}
+	declare() {
+		return this.ledger.declare();
+	}
+	async load() {
+		const rows = await this.ledger.load();
+		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
+			hours: rows.length,
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION
+		} });
+		return rows;
+	}
+	snapshot() {
+		return this.ledger.snapshot();
+	}
+	/**
+	* Seed {@link RecordingIndex} from the mirrored hour rows.
+	*
+	* Hours present in the ledger become `hydrated` so a seek in those windows
+	* does not pay for a disk walk. Hours the ledger never held stay `unknown`
+	* — that is the fail-toward-walk direction.
+	*/
+	hydrateIndex(index) {
+		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
+	}
+	/** Write-behind: a just-finalized segment joins its hour row. */
+	async recordSegment(row) {
+		const { key, hourStartMs: hour } = hourOf(row);
+		const held = this.ledger.get(key);
+		if (held !== void 0 && held.paths.includes(row.path)) return;
+		await this.ledger.put({
+			key,
+			deviceId: row.deviceId,
+			profile: row.profile,
+			locationId: row.locationId,
+			hourStartMs: hour,
+			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
+		});
+	}
+	/**
+	* Eviction confirmed these paths are gone from disk. Drop them; forget the
+	* hour when it holds nothing.
+	*/
+	async dropSegments(rows) {
+		const doomed = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const { key } = hourOf(row);
+			let set = doomed.get(key);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				doomed.set(key, set);
+			}
+			set.add(row.path);
+		}
+		for (const [key, paths] of doomed) {
+			const held = this.ledger.get(key);
+			if (held === void 0) continue;
+			const next = held.paths.filter((p) => !paths.has(p));
+			if (next.length === 0) {
+				await this.ledger.forget(key);
+				continue;
+			}
+			if (next.length === held.paths.length) continue;
+			await this.ledger.put({
+				...held,
+				paths: next
+			});
+		}
+	}
+	/**
+	* After a disk walk of `deviceIds`, make the ledger match the index — with
+	* two D148 exceptions:
+	*
+	*  - an hour the walk did not see is dropped ONLY if it is in the past;
+	*    the current hour may still hold a live writer whose file the readdir
+	*    raced;
+	*  - the current hour UNIONs ledger paths with index paths rather than
+	*    replacing, for the same race.
+	*
+	* Devices not in `deviceIds` are left untouched (a partial walk must not
+	* prune cameras it did not look at).
+	*/
+	async reconcileFromIndex(index, deviceIds, nowMs) {
+		const walked = new Set(deviceIds);
+		const currentHour = hourStartMs(nowMs);
+		const fromIndex = /* @__PURE__ */ new Map();
+		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
+			const { key, hourStartMs: hour } = hourOf(seg);
+			const existing = fromIndex.get(key);
+			if (existing === void 0) fromIndex.set(key, {
+				key,
+				deviceId: seg.deviceId,
+				profile: seg.profile,
+				locationId: seg.locationId,
+				hourStartMs: hour,
+				paths: [seg.path]
+			});
+			else fromIndex.set(key, {
+				...existing,
+				paths: [...existing.paths, seg.path]
+			});
+		}
+		for (const row of this.ledger.snapshot()) {
+			if (!walked.has(row.deviceId)) continue;
+			const disk = fromIndex.get(row.key);
+			if (disk === void 0) {
+				if (row.hourStartMs === currentHour) continue;
+				await this.ledger.forget(row.key);
+				continue;
+			}
+			if (row.hourStartMs === currentHour) {
+				const union = uniquePaths([...disk.paths, ...row.paths]);
+				if (!samePaths(union, row.paths)) await this.ledger.put({
+					...row,
+					paths: union
+				});
+				continue;
+			}
+			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
+		}
+		for (const [key, disk] of fromIndex) {
+			if (this.ledger.has(key)) continue;
+			await this.ledger.put(disk);
+		}
+	}
+};
+//#endregion
 //#region src/recorder/addon/recording-export-provider.ts
 /** Content type of every rendered export — the engine only ever writes MP4. */
 var EXPORT_CONTENT_TYPE = "video/mp4";
@@ -7861,6 +8360,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	isRecordingNode = true;
 	index = new RecordingIndex();
 	/**
+	* Durable hour-directory copy of {@link index}. Null on an inert
+	* (non-recording) node. Boot reseeds the RAM index from this; the
+	* deferred archive walk reconciles it against disk.
+	*/
+	segmentHours = null;
+	/**
 	* The calendar rungs — which days, which hours, and a day's exact ranges.
 	*
 	* Separate from `RecordingIndex` on purpose: that one is the SEGMENT model
@@ -7932,6 +8437,16 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			} });
 			return { providers: [] };
 		}
+		this.segmentHours = new SegmentHourLedger({
+			store: this.ctx.api.settingsStore,
+			logger: this.ctx.logger
+		});
+		try {
+			await this.segmentHours.declare();
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger declare failed — index stays RAM-only this boot", { meta: { error: require_dist.errMsg(err) } });
+			this.segmentHours = null;
+		}
 		const ingestOwner = await this.resolveIngestOwner();
 		const consumerHostname = this.nodeId === ingestOwner.ownerNodeId ? void 0 : ingestOwner.reachableHost ?? resolveRecordingHubHostname(this.config.recordingHubHostname, process.env["CAMSTACK_HUB_URL"]);
 		if (this.nodeId !== ingestOwner.ownerNodeId) {
@@ -7968,7 +8483,11 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			onEvicted: (deviceId, atMs) => {
 				this.calendar.invalidate(deviceId, atMs);
 			},
+			onDeindexed: (rows) => {
+				this.segmentHours?.dropSegments(rows);
+			},
 			onIndexed: (row, absPath) => {
+				this.segmentHours?.recordSegment(row);
 				if (!isMfraTableServable(row.startMs, Date.now())) return;
 				readMfraTable(absPath, row.bytes).then((table) => {
 					this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
@@ -8345,6 +8864,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				this.controller?.onTrigger(deviceId, "motion", atMs);
 			}
 		});
+		try {
+			await this.segmentHours?.load();
+			this.segmentHours?.hydrateIndex(this.index);
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger load failed — falling through to the archive walk", { meta: { error: require_dist.errMsg(err) } });
+		}
 		let configs;
 		try {
 			configs = await readDeviceConfigs(this.configStore());
@@ -8832,6 +9357,11 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				locationCount: this.resolvedLocations.length,
 				ms: Date.now() - hydrateStartedMs
 			} });
+			try {
+				await this.segmentHours?.reconcileFromIndex(this.index, deviceIds, Date.now());
+			} catch (err) {
+				this.ctx.logger.warn("recorder: segment-hour ledger reconcile failed — walk remains the authority", { meta: { error: require_dist.errMsg(err) } });
+			}
 			const loggedDomains = /* @__PURE__ */ new Set();
 			for (const loc of this.resolvedLocations) {
 				const domain = this.locationDomain(loc.id);

package/dist/recorder/index.mjs

@@ -506,14 +506,14 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$4 = 36e5;
+var HOUR_MS$5 = 36e5;
 /** A device walked end-to-end. Cheaper and clearer than inserting every hour of
 *  the retention window into the set. */
 var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
-	for (let h = first; h < toMs; h += HOUR_MS$4) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
+	for (let h = first; h < toMs; h += HOUR_MS$5) yield h;
 }
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
@@ -629,7 +629,7 @@ var RecordingIndex = class {
 			});
 		}
 		this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$4);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$5);
 	}
 	/** Insert/replace one finalized segment (idempotent by path). */
 	addSegment(s) {
@@ -1370,6 +1370,8 @@ var SegmentStore = class SegmentStore {
 		if (removed.length > 0) {
 			this.deps.index.removeSegments(removed);
 			this.notifyEvicted(rows);
+			const gone = new Set(removed);
+			this.deps.onDeindexed?.(rows.filter((r) => gone.has(r.path)));
 		}
 		await this.pruneEmptyAncestors(location, [...byBucket.keys()]);
 		this.deps.logger.info("recorder: eviction round complete", { meta: {
@@ -1935,7 +1937,7 @@ async function profileHasFootage(root, deviceId, profile) {
 //#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
-var HOUR_MS$3 = 36e5;
+var HOUR_MS$4 = 36e5;
 /**
 * UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
 *
@@ -2108,7 +2110,7 @@ var CalendarIndex = class {
 		}));
 		const days = /* @__PURE__ */ new Set();
 		for (const { day, hours } of perDay) for (const h of hours) {
-			const at = day + h * HOUR_MS$3;
+			const at = day + h * HOUR_MS$4;
 			if (at < fromMs || at >= toMs) continue;
 			days.add(localDayStart(at, tzOffsetMinutes));
 		}
@@ -2170,7 +2172,7 @@ var CalendarIndex = class {
 		const day = utcDayOf(utcDayMs);
 		for (let h = 0; h < 24; h++) {
 			await this.awaitQuiet();
-			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$3, true);
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$4, true);
 		}
 	}
 	/**
@@ -2191,10 +2193,10 @@ var CalendarIndex = class {
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
 		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
-		const hour = Math.floor(hourStartMs / HOUR_MS$3) * HOUR_MS$3;
+		const hour = Math.floor(hourStartMs / HOUR_MS$4) * HOUR_MS$4;
 		const key = `${deviceId}:${profile}:${hour}`;
 		const now = this.deps.now?.() ?? Date.now();
-		const isCurrentHour = hour === Math.floor(now / HOUR_MS$3) * HOUR_MS$3;
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$4) * HOUR_MS$4;
 		const cached = this.hourSegs.get(key);
 		if (cached !== void 0) {
 			if (!isCurrentHour) return {
@@ -2258,7 +2260,7 @@ var CalendarIndex = class {
 	*/
 	async dayRanges(deviceId, profile, utcDayMs) {
 		const day = utcDayOf(utcDayMs);
-		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$3), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$4), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
 	}
 	/**
 	* Warm the days either side of the one being viewed, in the BACKGROUND.
@@ -2436,7 +2438,7 @@ function activeModeForConfig(config) {
 }
 //#endregion
 //#region src/recorder/addon/directory-handler.ts
-var HOUR_MS$2 = 36e5;
+var HOUR_MS$3 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
 *  would walk the archive on the read path — the thing this replaces. */
 var MAX_WINDOW_MS = 32 * 864e5;
@@ -2483,9 +2485,9 @@ function withDirectoryRoute(deps, next) {
 				return;
 			}
 			const rows = [];
-			const firstHour = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+			const firstHour = Math.floor(fromMs / HOUR_MS$3) * HOUR_MS$3;
 			let hydrated = true;
-			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$2) {
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$3) {
 				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
 				if (!complete) hydrated = false;
 				for (const s of segments) {
@@ -5185,7 +5187,7 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	const p2 = (n) => String(n).padStart(2, "0");
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
-var HOUR_MS$1 = 36e5;
+var HOUR_MS$2 = 36e5;
 /**
 * Hydrate ONLY the hours a window spans, instead of walking the archive.
 *
@@ -5220,8 +5222,8 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			});
 			continue;
 		}
-		const first = Math.floor(fromMs / HOUR_MS$1) * HOUR_MS$1;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$1) for (const profile of profiles) {
+		const first = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$2) for (const profile of profiles) {
 			const rel = hourDirRelPath(deviceId, profile, hour);
 			let files;
 			try {
@@ -7039,6 +7041,503 @@ function makeBrokerCall(handle) {
 	return (fn) => handle.call(fn, BROKER_READY_TIMEOUT_MS);
 }
 //#endregion
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
+		try {
+			await this.store.delete.mutate({
+				collection: this.spec.collection,
+				key
+			});
+		} catch (err) {
+			this.logger.debug("durable delete failed", { meta: {
+				collection: this.spec.collection,
+				key,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
+	*
+	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
+	* fallible read is work destroyed on an error (D49/D130) — that is why this
+	* is a method a feature opts into rather than a policy the primitive runs.
+	* Best-effort per row: a failed delete keeps the key (retried next prune)
+	* rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
+				});
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
+			}
+		}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
+//#region src/recorder/addon/segment-hour-ledger.ts
+var HOUR_MS$1 = 36e5;
+/**
+* @durable class=mirror owner=recorder
+*   write="write-behind on every finalized segment (hour-row upsert); eviction drops paths; the archive walk reconciles disk into the row set"
+*   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
+*/
+var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
+var RECORDING_SEGMENT_HOURS_COLUMNS = [
+	{
+		name: "key",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "profile",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "locationId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "hourStartMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "paths",
+		type: "TEXT",
+		notNull: true
+	}
+];
+var RECORDING_SEGMENT_HOURS_INDEXES = [{
+	name: "idx_recorder_segment_hours_device",
+	columns: ["deviceId"]
+}, {
+	name: "idx_recorder_segment_hours_hour",
+	columns: ["hourStartMs"]
+}];
+function hourStartMs(startMs) {
+	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
+}
+function segmentHourKey(deviceId, profile, locationId, hour) {
+	return `${deviceId}|${profile}|${locationId}|${hour}`;
+}
+function hourOf(row) {
+	const hour = hourStartMs(row.startMs);
+	return {
+		hourStartMs: hour,
+		key: segmentHourKey(row.deviceId, row.profile, row.locationId, hour)
+	};
+}
+function uniquePaths(paths) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const p of paths) {
+		if (seen.has(p)) continue;
+		seen.add(p);
+		out.push(p);
+	}
+	return out;
+}
+function samePaths(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	for (const p of b) if (!set.has(p)) return false;
+	return true;
+}
+function rowToValue(row) {
+	return {
+		deviceId: row.deviceId,
+		profile: row.profile,
+		locationId: row.locationId,
+		hourStartMs: row.hourStartMs,
+		paths: JSON.stringify(row.paths)
+	};
+}
+function recordToRow(key, data) {
+	const deviceId = Number(data["deviceId"]);
+	const profile = data["profile"];
+	const locationId = data["locationId"];
+	const hour = Number(data["hourStartMs"]);
+	let raw = data["paths"];
+	if (typeof raw === "string") try {
+		raw = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
+	return {
+		key,
+		deviceId,
+		profile,
+		locationId,
+		hourStartMs: hour,
+		paths: raw
+	};
+}
+var SPEC = {
+	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+	columns: RECORDING_SEGMENT_HOURS_COLUMNS,
+	indexes: RECORDING_SEGMENT_HOURS_INDEXES,
+	writeMode: "write-behind",
+	loadLimit: 1e5,
+	keyOf: (row) => row.key,
+	toValue: rowToValue,
+	fromRecord: recordToRow,
+	deviceIdOf: (row) => row.deviceId
+};
+var SegmentHourLedger = class {
+	ledger;
+	logger;
+	constructor(deps) {
+		this.logger = deps.logger;
+		this.ledger = new DurableLedger({
+			spec: SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, SPEC);
+	}
+	declare() {
+		return this.ledger.declare();
+	}
+	async load() {
+		const rows = await this.ledger.load();
+		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
+			hours: rows.length,
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION
+		} });
+		return rows;
+	}
+	snapshot() {
+		return this.ledger.snapshot();
+	}
+	/**
+	* Seed {@link RecordingIndex} from the mirrored hour rows.
+	*
+	* Hours present in the ledger become `hydrated` so a seek in those windows
+	* does not pay for a disk walk. Hours the ledger never held stay `unknown`
+	* — that is the fail-toward-walk direction.
+	*/
+	hydrateIndex(index) {
+		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
+	}
+	/** Write-behind: a just-finalized segment joins its hour row. */
+	async recordSegment(row) {
+		const { key, hourStartMs: hour } = hourOf(row);
+		const held = this.ledger.get(key);
+		if (held !== void 0 && held.paths.includes(row.path)) return;
+		await this.ledger.put({
+			key,
+			deviceId: row.deviceId,
+			profile: row.profile,
+			locationId: row.locationId,
+			hourStartMs: hour,
+			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
+		});
+	}
+	/**
+	* Eviction confirmed these paths are gone from disk. Drop them; forget the
+	* hour when it holds nothing.
+	*/
+	async dropSegments(rows) {
+		const doomed = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const { key } = hourOf(row);
+			let set = doomed.get(key);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				doomed.set(key, set);
+			}
+			set.add(row.path);
+		}
+		for (const [key, paths] of doomed) {
+			const held = this.ledger.get(key);
+			if (held === void 0) continue;
+			const next = held.paths.filter((p) => !paths.has(p));
+			if (next.length === 0) {
+				await this.ledger.forget(key);
+				continue;
+			}
+			if (next.length === held.paths.length) continue;
+			await this.ledger.put({
+				...held,
+				paths: next
+			});
+		}
+	}
+	/**
+	* After a disk walk of `deviceIds`, make the ledger match the index — with
+	* two D148 exceptions:
+	*
+	*  - an hour the walk did not see is dropped ONLY if it is in the past;
+	*    the current hour may still hold a live writer whose file the readdir
+	*    raced;
+	*  - the current hour UNIONs ledger paths with index paths rather than
+	*    replacing, for the same race.
+	*
+	* Devices not in `deviceIds` are left untouched (a partial walk must not
+	* prune cameras it did not look at).
+	*/
+	async reconcileFromIndex(index, deviceIds, nowMs) {
+		const walked = new Set(deviceIds);
+		const currentHour = hourStartMs(nowMs);
+		const fromIndex = /* @__PURE__ */ new Map();
+		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
+			const { key, hourStartMs: hour } = hourOf(seg);
+			const existing = fromIndex.get(key);
+			if (existing === void 0) fromIndex.set(key, {
+				key,
+				deviceId: seg.deviceId,
+				profile: seg.profile,
+				locationId: seg.locationId,
+				hourStartMs: hour,
+				paths: [seg.path]
+			});
+			else fromIndex.set(key, {
+				...existing,
+				paths: [...existing.paths, seg.path]
+			});
+		}
+		for (const row of this.ledger.snapshot()) {
+			if (!walked.has(row.deviceId)) continue;
+			const disk = fromIndex.get(row.key);
+			if (disk === void 0) {
+				if (row.hourStartMs === currentHour) continue;
+				await this.ledger.forget(row.key);
+				continue;
+			}
+			if (row.hourStartMs === currentHour) {
+				const union = uniquePaths([...disk.paths, ...row.paths]);
+				if (!samePaths(union, row.paths)) await this.ledger.put({
+					...row,
+					paths: union
+				});
+				continue;
+			}
+			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
+		}
+		for (const [key, disk] of fromIndex) {
+			if (this.ledger.has(key)) continue;
+			await this.ledger.put(disk);
+		}
+	}
+};
+//#endregion
 //#region src/recorder/addon/recording-export-provider.ts
 /** Content type of every rendered export — the engine only ever writes MP4. */
 var EXPORT_CONTENT_TYPE = "video/mp4";
@@ -7860,6 +8359,12 @@ var RecorderV2Addon = class extends BaseAddon {
 	isRecordingNode = true;
 	index = new RecordingIndex();
 	/**
+	* Durable hour-directory copy of {@link index}. Null on an inert
+	* (non-recording) node. Boot reseeds the RAM index from this; the
+	* deferred archive walk reconciles it against disk.
+	*/
+	segmentHours = null;
+	/**
 	* The calendar rungs — which days, which hours, and a day's exact ranges.
 	*
 	* Separate from `RecordingIndex` on purpose: that one is the SEGMENT model
@@ -7931,6 +8436,16 @@ var RecorderV2Addon = class extends BaseAddon {
 			} });
 			return { providers: [] };
 		}
+		this.segmentHours = new SegmentHourLedger({
+			store: this.ctx.api.settingsStore,
+			logger: this.ctx.logger
+		});
+		try {
+			await this.segmentHours.declare();
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger declare failed — index stays RAM-only this boot", { meta: { error: errMsg(err) } });
+			this.segmentHours = null;
+		}
 		const ingestOwner = await this.resolveIngestOwner();
 		const consumerHostname = this.nodeId === ingestOwner.ownerNodeId ? void 0 : ingestOwner.reachableHost ?? resolveRecordingHubHostname(this.config.recordingHubHostname, process.env["CAMSTACK_HUB_URL"]);
 		if (this.nodeId !== ingestOwner.ownerNodeId) {
@@ -7967,7 +8482,11 @@ var RecorderV2Addon = class extends BaseAddon {
 			onEvicted: (deviceId, atMs) => {
 				this.calendar.invalidate(deviceId, atMs);
 			},
+			onDeindexed: (rows) => {
+				this.segmentHours?.dropSegments(rows);
+			},
 			onIndexed: (row, absPath) => {
+				this.segmentHours?.recordSegment(row);
 				if (!isMfraTableServable(row.startMs, Date.now())) return;
 				readMfraTable(absPath, row.bytes).then((table) => {
 					this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
@@ -8344,6 +8863,12 @@ var RecorderV2Addon = class extends BaseAddon {
 				this.controller?.onTrigger(deviceId, "motion", atMs);
 			}
 		});
+		try {
+			await this.segmentHours?.load();
+			this.segmentHours?.hydrateIndex(this.index);
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger load failed — falling through to the archive walk", { meta: { error: errMsg(err) } });
+		}
 		let configs;
 		try {
 			configs = await readDeviceConfigs(this.configStore());
@@ -8831,6 +9356,11 @@ var RecorderV2Addon = class extends BaseAddon {
 				locationCount: this.resolvedLocations.length,
 				ms: Date.now() - hydrateStartedMs
 			} });
+			try {
+				await this.segmentHours?.reconcileFromIndex(this.index, deviceIds, Date.now());
+			} catch (err) {
+				this.ctx.logger.warn("recorder: segment-hour ledger reconcile failed — walk remains the authority", { meta: { error: errMsg(err) } });
+			}
 			const loggedDomains = /* @__PURE__ */ new Set();
 			for (const loc of this.resolvedLocations) {
 				const domain = this.locationDomain(loc.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-pipeline",
-  "version": "1.2.89",
+  "version": "1.2.90",
   "description": "Pipeline bundle — runner, detection, motion, audio + stream broker. Multi-entry npm package shipping pipeline addons under a single bundle.",
   "keywords": [
     "camstack",