@camstack/addon-pipeline 1.2.89 → 1.2.93

package/dist/recorder/index.js

@@ -1,6 +1,6 @@
-const require_dist = require("../dist-n4Nbnxx5.js");
+const require_dist = require("../dist-D9To_r_d.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_addon_utils = require("../addon-utils-yc-chXuC.js");
+const require_addon_utils = require("../addon-utils-CTRpEiSd.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 let node_path = require("node:path");
@@ -507,14 +507,14 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$4 = 36e5;
+var HOUR_MS$5 = 36e5;
 /** A device walked end-to-end. Cheaper and clearer than inserting every hour of
 *  the retention window into the set. */
 var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
-	for (let h = first; h < toMs; h += HOUR_MS$4) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
+	for (let h = first; h < toMs; h += HOUR_MS$5) yield h;
 }
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
@@ -630,7 +630,7 @@ var RecordingIndex = class {
 			});
 		}
 		this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$4);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$5);
 	}
 	/** Insert/replace one finalized segment (idempotent by path). */
 	addSegment(s) {
@@ -1069,6 +1069,7 @@ var RelocateEngine = class {
 			deviceId: input.deviceId ?? null,
 			profiles: input.profiles ? [...input.profiles] : [],
 			footageClass: input.footageClass,
+			sinceMs: input.sinceMs ?? null,
 			throttleMbps: input.throttleMbps ?? DEFAULT_THROTTLE_MBPS,
 			entities: input.entities ? [...input.entities] : ["segments"],
 			filesMoved: 0,
@@ -1129,7 +1130,7 @@ var RelocateEngine = class {
 		const bytesPerMs = job.throttleMbps * 1024 * 1024 / 1e3;
 		try {
 			const samePhysicalRoot = await rootsPhysicallySame(from.root, to.root);
-			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).filter((r) => job.profiles.length === 0 || job.profiles.includes(r.profile)).filter((r) => profileBelongsToClass(r.profile, job.footageClass)).sort((a, b) => a.startMs - b.startMs);
+			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).filter((r) => job.profiles.length === 0 || job.profiles.includes(r.profile)).filter((r) => profileBelongsToClass(r.profile, job.footageClass)).filter((r) => job.sinceMs === null || r.startMs >= job.sinceMs).sort((a, b) => a.startMs - b.startMs);
 			job.filesTotal = segRows.length;
 			for (const row of segRows) {
 				if (job.cancelRequested) break;
@@ -1165,9 +1166,26 @@ var RelocateEngine = class {
 		}
 	}
 	/** Move one segment file and re-point its index row to the target location
-	*  (same location-relative path — the layout is identical on every root). */
+	*  (same location-relative path — the layout is identical on every root).
+	*  A source that is already gone (evicted, never flushed, ENOSPC) is dropped
+	*  from the index and skipped — one ghost file must not abort a drain. */
 	async moveSegment(row, from, to, samePhysicalRoot) {
-		if (!samePhysicalRoot) await moveFile(node_path.default.join(from.root, row.path), node_path.default.join(to.root, row.path), row.bytes);
+		if (!samePhysicalRoot) try {
+			await moveFile(node_path.default.join(from.root, row.path), node_path.default.join(to.root, row.path), row.bytes);
+		} catch (err) {
+			if (isEnoent(err)) {
+				this.deps.index.removeSegments([row.path]);
+				this.deps.logger.warn("relocate skipped missing source", {
+					tags: { deviceId: row.deviceId },
+					meta: {
+						path: row.path,
+						locationId: from.id
+					}
+				});
+				return;
+			}
+			throw err;
+		}
 		this.deps.index.removeSegments([row.path]);
 		this.deps.index.addSegment({
 			...row,
@@ -1175,6 +1193,9 @@ var RelocateEngine = class {
 		});
 	}
 };
+function isEnoent(err) {
+	return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
 /** Logical migration classes are profile-derived, never location-derived:
 * high+mid are `recordings`; low is `recordingsLow`. */
 var profileBelongsToClass = (profile, footageClass) => {
@@ -1371,6 +1392,8 @@ var SegmentStore = class SegmentStore {
 		if (removed.length > 0) {
 			this.deps.index.removeSegments(removed);
 			this.notifyEvicted(rows);
+			const gone = new Set(removed);
+			this.deps.onDeindexed?.(rows.filter((r) => gone.has(r.path)));
 		}
 		await this.pruneEmptyAncestors(location, [...byBucket.keys()]);
 		this.deps.logger.info("recorder: eviction round complete", { meta: {
@@ -1936,7 +1959,7 @@ async function profileHasFootage(root, deviceId, profile) {
 //#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
-var HOUR_MS$3 = 36e5;
+var HOUR_MS$4 = 36e5;
 /**
 * UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
 *
@@ -2109,7 +2132,7 @@ var CalendarIndex = class {
 		}));
 		const days = /* @__PURE__ */ new Set();
 		for (const { day, hours } of perDay) for (const h of hours) {
-			const at = day + h * HOUR_MS$3;
+			const at = day + h * HOUR_MS$4;
 			if (at < fromMs || at >= toMs) continue;
 			days.add(localDayStart(at, tzOffsetMinutes));
 		}
@@ -2171,7 +2194,7 @@ var CalendarIndex = class {
 		const day = utcDayOf(utcDayMs);
 		for (let h = 0; h < 24; h++) {
 			await this.awaitQuiet();
-			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$3, true);
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$4, true);
 		}
 	}
 	/**
@@ -2192,10 +2215,10 @@ var CalendarIndex = class {
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
 		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
-		const hour = Math.floor(hourStartMs / HOUR_MS$3) * HOUR_MS$3;
+		const hour = Math.floor(hourStartMs / HOUR_MS$4) * HOUR_MS$4;
 		const key = `${deviceId}:${profile}:${hour}`;
 		const now = this.deps.now?.() ?? Date.now();
-		const isCurrentHour = hour === Math.floor(now / HOUR_MS$3) * HOUR_MS$3;
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$4) * HOUR_MS$4;
 		const cached = this.hourSegs.get(key);
 		if (cached !== void 0) {
 			if (!isCurrentHour) return {
@@ -2259,7 +2282,7 @@ var CalendarIndex = class {
 	*/
 	async dayRanges(deviceId, profile, utcDayMs) {
 		const day = utcDayOf(utcDayMs);
-		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$3), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$4), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
 	}
 	/**
 	* Warm the days either side of the one being viewed, in the BACKGROUND.
@@ -2437,7 +2460,7 @@ function activeModeForConfig(config) {
 }
 //#endregion
 //#region src/recorder/addon/directory-handler.ts
-var HOUR_MS$2 = 36e5;
+var HOUR_MS$3 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
 *  would walk the archive on the read path — the thing this replaces. */
 var MAX_WINDOW_MS = 32 * 864e5;
@@ -2484,9 +2507,9 @@ function withDirectoryRoute(deps, next) {
 				return;
 			}
 			const rows = [];
-			const firstHour = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+			const firstHour = Math.floor(fromMs / HOUR_MS$3) * HOUR_MS$3;
 			let hydrated = true;
-			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$2) {
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$3) {
 				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
 				if (!complete) hydrated = false;
 				for (const s of segments) {
@@ -4211,6 +4234,7 @@ function buildRecordingProvider(deps) {
 		rescanStorage: async ({ deviceId }) => {
 			const locations = await deps.refreshLocations();
 			await deps.hydrateDevice(deviceId, locations);
+			await deps.reconcileHourLedger?.(deviceId);
 			const config = await loadDeviceConfig(deps.configStore, deviceId);
 			await deps.opsLog?.append({
 				op: "rescan",
@@ -5074,7 +5098,11 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 		try {
 			entries = await node_fs.promises.readdir(deviceDir, { recursive: true });
 		} catch (err) {
-			if (err.code !== "ENOENT") logger.warn("recorder: hydrateDevice walk failed for location", {
+			if (err.code === "ENOENT") {
+				for (const location of aliases) index.hydrateDevice(deviceId, location.id, []);
+				continue;
+			}
+			logger.warn("recorder: hydrateDevice walk failed for location", {
 				tags: { deviceId },
 				meta: {
 					locationIds: aliases.map((location) => location.id),
@@ -5102,6 +5130,7 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 			handled += 1;
 			if (handled % chunkSize === 0) await yieldBetween();
 		}
+		for (const location of aliases) if (!pathsByLocation.has(location.id)) pathsByLocation.set(location.id, []);
 		let indexed = 0;
 		for (const [locationId, relPaths] of pathsByLocation) {
 			index.hydrateDevice(deviceId, locationId, relPaths);
@@ -5186,7 +5215,7 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	const p2 = (n) => String(n).padStart(2, "0");
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
-var HOUR_MS$1 = 36e5;
+var HOUR_MS$2 = 36e5;
 /**
 * Hydrate ONLY the hours a window spans, instead of walking the archive.
 *
@@ -5221,8 +5250,8 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			});
 			continue;
 		}
-		const first = Math.floor(fromMs / HOUR_MS$1) * HOUR_MS$1;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$1) for (const profile of profiles) {
+		const first = Math.floor(fromMs / HOUR_MS$2) * HOUR_MS$2;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$2) for (const profile of profiles) {
 			const rel = hourDirRelPath(deviceId, profile, hour);
 			let files;
 			try {
@@ -6561,6 +6590,13 @@ var RecordingController = class {
 	* records again.
 	*/
 	unrecordableReported = /* @__PURE__ */ new Set();
+	/**
+	* Profiles the last attach skipped (stream not published / getStream threw).
+	* `evaluateDevice` retries only these on the converge tick so a dead `low`
+	* cannot keep `high` dark, without a `listAllProfileSlots` RPC on every
+	* healthy device every 30s.
+	*/
+	skippedProfiles = /* @__PURE__ */ new Map();
 	restore = null;
 	/** Cheap, never-delayed: is any pinned writer producing nothing? */
 	livenessPass = null;
@@ -6767,7 +6803,10 @@ var RecordingController = class {
 			return;
 		}
 		this.unrecordableReported.delete(deviceId);
-		if (this.active.has(deviceId)) return;
+		if (this.active.has(deviceId)) {
+			if (this.skippedProfiles.has(deviceId)) await this.fillMissingProfiles(deviceId, config);
+			return;
+		}
 		if (this.attaching.has(deviceId)) return;
 		this.attaching.add(deviceId);
 		const attaching = this.performAttach(deviceId, config);
@@ -6818,8 +6857,12 @@ var RecordingController = class {
 	/**
 	* The attach body — extracted so the {@link attaching} in-flight guard in
 	* `evaluateDevice` wraps it cleanly. Resolves the profiles, spawns a
-	* SegmentWriter + watcher per profile, and records the set in `active`. A throw
-	* (broker not ready / no sources) rolls back partial attaches and re-throws.
+	* SegmentWriter + watcher per profile, and records the set in `active`.
+	*
+	* Per-profile: a throw from one slot is logged and skipped. Rolling back the
+	* whole device when a single stream was dead (618 `derived` on `low`) left
+	* ZERO footage for hours. If every profile fails, throw so the restore queue
+	* retries the device.
 	*/
 	async performAttach(deviceId, config) {
 		this.restore?.add(deviceId, true);
@@ -6827,38 +6870,106 @@ var RecordingController = class {
 		if (profiles.length === 0) throw new Error(`recorder controller: no assigned broker sources for device ${deviceId}`);
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
 		const recordings = [];
-		try {
-			for (const profile of profiles) recordings.push(await this.attachProfile(deviceId, profile, segmentSeconds));
+		const failed = [];
+		for (const profile of profiles) try {
+			recordings.push(await this.attachProfile(deviceId, profile, segmentSeconds));
 		} catch (err) {
-			for (const r of recordings) await this.teardownProfile(deviceId, r);
-			throw err;
+			failed.push(profile);
+			this.deps.logger.warn("recorder: profile attach failed — recording the remaining profiles", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					error: require_dist.errMsg(err)
+				}
+			});
 		}
+		if (recordings.length === 0) throw new Error(`recorder controller: no profile attached for device ${deviceId}` + (failed.length > 0 ? ` (failed: ${failed.join(",")})` : ""));
 		if (this.paused) {
 			await Promise.all(recordings.map((recording) => this.teardownProfile(deviceId, recording)));
 			return;
 		}
 		this.active.set(deviceId, recordings);
+		if (failed.length > 0) this.skippedProfiles.set(deviceId, new Set(failed));
+		else this.skippedProfiles.delete(deviceId);
 		this.deps.logger.info("recorder pinned broker source(s) for recording", {
 			tags: { deviceId },
 			meta: {
-				profiles,
+				profiles: recordings.map((r) => r.profile),
+				failedProfiles: failed,
 				segmentSeconds,
 				pipelineKeys: recordings.map((r) => r.pipelineKey)
 			}
 		});
 	}
 	/**
+	* Retry profiles the last attach skipped, without tearing down writers that
+	* are already producing. Called from `evaluateDevice` when the device is
+	* already in `active` and {@link skippedProfiles} is non-empty. Failures stay
+	* logged; the next converge tick retries.
+	*/
+	async fillMissingProfiles(deviceId, config) {
+		if (this.attaching.has(deviceId)) return;
+		const current = this.active.get(deviceId);
+		const skipped = this.skippedProfiles.get(deviceId);
+		if (!current || !skipped || skipped.size === 0) return;
+		this.attaching.add(deviceId);
+		const filling = this.runFillMissingProfiles(deviceId, config, current, skipped);
+		this.attachingTasks.set(deviceId, filling);
+		try {
+			await filling;
+		} finally {
+			this.attachingTasks.delete(deviceId);
+			this.attaching.delete(deviceId);
+		}
+	}
+	async runFillMissingProfiles(deviceId, config, current, skipped) {
+		const have = new Set(current.map((r) => r.profile));
+		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
+		const added = [];
+		for (const profile of [...skipped]) {
+			if (have.has(profile)) {
+				skipped.delete(profile);
+				continue;
+			}
+			try {
+				added.push(await this.attachProfile(deviceId, profile, segmentSeconds));
+				skipped.delete(profile);
+			} catch (err) {
+				this.deps.logger.warn("recorder: profile attach retry failed — keeping the healthy profiles", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						error: require_dist.errMsg(err)
+					}
+				});
+			}
+		}
+		if (skipped.size === 0) this.skippedProfiles.delete(deviceId);
+		if (added.length === 0) return;
+		const existing = this.active.get(deviceId);
+		if (!existing || this.paused || this.stopped) {
+			await Promise.all(added.map((recording) => this.teardownProfile(deviceId, recording)));
+			return;
+		}
+		this.active.set(deviceId, [...existing, ...added]);
+		this.deps.logger.info("recorder pinned additional broker source(s) for recording", {
+			tags: { deviceId },
+			meta: {
+				profiles: added.map((r) => r.profile),
+				pipelineKeys: added.map((r) => r.pipelineKey)
+			}
+		});
+	}
+	/**
 	* Pick which profiles to record. The broker enumerates assigned profile slots,
 	* deduped by physical source (`selectAssignedProfileSlots`) so the same camera
-	* encoder is never recorded twice. An operator `override` DISABLES the
-	* unselected profiles (assigned ∩ selection); a selection matching none of the
-	* assigned sources is ignored (record every assigned source — minimum of 1).
+	* encoder is never recorded twice. Default is high+low among those slots
+	* (`resolveRecordingProfiles`); an operator `override` DISABLES the
+	* unselected profiles. A selection matching none of the assigned sources
+	* falls back to the default/assigned set (minimum of 1 when anything is assigned).
 	*/
 	async resolveProfiles(deviceId, override) {
-		const assigned = require_dist.selectAssignedProfileSlots(await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.listAllProfileSlots.query(void 0, require_dist.nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "listAllProfileSlots")), deviceId).map((slot) => slot.profile);
-		if (!override || override.length === 0) return assigned;
-		const selected = assigned.filter((p) => override.includes(p));
-		return selected.length > 0 ? selected : assigned;
+		return require_dist.resolveRecordingProfiles(require_dist.selectAssignedProfileSlots(await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.listAllProfileSlots.query(void 0, require_dist.nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "listAllProfileSlots")), deviceId).map((slot) => slot.profile), override);
 	}
 	/**
 	* Attach one (device, profile): acquire the broker source, mkdir the staging
@@ -6988,6 +7099,7 @@ var RecordingController = class {
 		const recordings = this.active.get(deviceId);
 		if (!recordings) return;
 		this.active.delete(deviceId);
+		this.skippedProfiles.delete(deviceId);
 		for (const r of recordings) this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
 		await Promise.all(recordings.map((r) => this.teardownProfile(deviceId, r)));
 		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
@@ -7040,6 +7152,503 @@ function makeBrokerCall(handle) {
 	return (fn) => handle.call(fn, BROKER_READY_TIMEOUT_MS);
 }
 //#endregion
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
+		try {
+			await this.store.delete.mutate({
+				collection: this.spec.collection,
+				key
+			});
+		} catch (err) {
+			this.logger.debug("durable delete failed", { meta: {
+				collection: this.spec.collection,
+				key,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
+	*
+	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
+	* fallible read is work destroyed on an error (D49/D130) — that is why this
+	* is a method a feature opts into rather than a policy the primitive runs.
+	* Best-effort per row: a failed delete keeps the key (retried next prune)
+	* rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
+				});
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
+			}
+		}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
+//#region src/recorder/addon/segment-hour-ledger.ts
+var HOUR_MS$1 = 36e5;
+/**
+* @durable class=mirror owner=recorder
+*   write="write-behind on every finalized segment (hour-row upsert); eviction drops paths; the archive walk reconciles disk into the row set"
+*   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
+*/
+var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
+var RECORDING_SEGMENT_HOURS_COLUMNS = [
+	{
+		name: "key",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "profile",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "locationId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "hourStartMs",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "paths",
+		type: "TEXT",
+		notNull: true
+	}
+];
+var RECORDING_SEGMENT_HOURS_INDEXES = [{
+	name: "idx_recorder_segment_hours_device",
+	columns: ["deviceId"]
+}, {
+	name: "idx_recorder_segment_hours_hour",
+	columns: ["hourStartMs"]
+}];
+function hourStartMs(startMs) {
+	return Math.floor(startMs / HOUR_MS$1) * HOUR_MS$1;
+}
+function segmentHourKey(deviceId, profile, locationId, hour) {
+	return `${deviceId}|${profile}|${locationId}|${hour}`;
+}
+function hourOf(row) {
+	const hour = hourStartMs(row.startMs);
+	return {
+		hourStartMs: hour,
+		key: segmentHourKey(row.deviceId, row.profile, row.locationId, hour)
+	};
+}
+function uniquePaths(paths) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const p of paths) {
+		if (seen.has(p)) continue;
+		seen.add(p);
+		out.push(p);
+	}
+	return out;
+}
+function samePaths(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	for (const p of b) if (!set.has(p)) return false;
+	return true;
+}
+function rowToValue(row) {
+	return {
+		deviceId: row.deviceId,
+		profile: row.profile,
+		locationId: row.locationId,
+		hourStartMs: row.hourStartMs,
+		paths: JSON.stringify(row.paths)
+	};
+}
+function recordToRow(key, data) {
+	const deviceId = Number(data["deviceId"]);
+	const profile = data["profile"];
+	const locationId = data["locationId"];
+	const hour = Number(data["hourStartMs"]);
+	let raw = data["paths"];
+	if (typeof raw === "string") try {
+		raw = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
+	return {
+		key,
+		deviceId,
+		profile,
+		locationId,
+		hourStartMs: hour,
+		paths: raw
+	};
+}
+var SPEC = {
+	collection: RECORDING_SEGMENT_HOURS_COLLECTION,
+	columns: RECORDING_SEGMENT_HOURS_COLUMNS,
+	indexes: RECORDING_SEGMENT_HOURS_INDEXES,
+	writeMode: "write-behind",
+	loadLimit: 1e5,
+	keyOf: (row) => row.key,
+	toValue: rowToValue,
+	fromRecord: recordToRow,
+	deviceIdOf: (row) => row.deviceId
+};
+var SegmentHourLedger = class {
+	ledger;
+	logger;
+	constructor(deps) {
+		this.logger = deps.logger;
+		this.ledger = new DurableLedger({
+			spec: SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, SPEC);
+	}
+	declare() {
+		return this.ledger.declare();
+	}
+	async load() {
+		const rows = await this.ledger.load();
+		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
+			hours: rows.length,
+			collection: RECORDING_SEGMENT_HOURS_COLLECTION
+		} });
+		return rows;
+	}
+	snapshot() {
+		return this.ledger.snapshot();
+	}
+	/**
+	* Seed {@link RecordingIndex} from the mirrored hour rows.
+	*
+	* Hours present in the ledger become `hydrated` so a seek in those windows
+	* does not pay for a disk walk. Hours the ledger never held stay `unknown`
+	* — that is the fail-toward-walk direction.
+	*/
+	hydrateIndex(index) {
+		for (const hour of this.ledger.snapshot()) index.hydrateHour(hour.deviceId, hour.locationId, hour.hourStartMs, hour.paths);
+	}
+	/** Write-behind: a just-finalized segment joins its hour row. */
+	async recordSegment(row) {
+		const { key, hourStartMs: hour } = hourOf(row);
+		const held = this.ledger.get(key);
+		if (held !== void 0 && held.paths.includes(row.path)) return;
+		await this.ledger.put({
+			key,
+			deviceId: row.deviceId,
+			profile: row.profile,
+			locationId: row.locationId,
+			hourStartMs: hour,
+			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
+		});
+	}
+	/**
+	* Eviction confirmed these paths are gone from disk. Drop them; forget the
+	* hour when it holds nothing.
+	*/
+	async dropSegments(rows) {
+		const doomed = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const { key } = hourOf(row);
+			let set = doomed.get(key);
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				doomed.set(key, set);
+			}
+			set.add(row.path);
+		}
+		for (const [key, paths] of doomed) {
+			const held = this.ledger.get(key);
+			if (held === void 0) continue;
+			const next = held.paths.filter((p) => !paths.has(p));
+			if (next.length === 0) {
+				await this.ledger.forget(key);
+				continue;
+			}
+			if (next.length === held.paths.length) continue;
+			await this.ledger.put({
+				...held,
+				paths: next
+			});
+		}
+	}
+	/**
+	* After a disk walk of `deviceIds`, make the ledger match the index — with
+	* two D148 exceptions:
+	*
+	*  - an hour the walk did not see is dropped ONLY if it is in the past;
+	*    the current hour may still hold a live writer whose file the readdir
+	*    raced;
+	*  - the current hour UNIONs ledger paths with index paths rather than
+	*    replacing, for the same race.
+	*
+	* Devices not in `deviceIds` are left untouched (a partial walk must not
+	* prune cameras it did not look at).
+	*/
+	async reconcileFromIndex(index, deviceIds, nowMs) {
+		const walked = new Set(deviceIds);
+		const currentHour = hourStartMs(nowMs);
+		const fromIndex = /* @__PURE__ */ new Map();
+		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
+			const { key, hourStartMs: hour } = hourOf(seg);
+			const existing = fromIndex.get(key);
+			if (existing === void 0) fromIndex.set(key, {
+				key,
+				deviceId: seg.deviceId,
+				profile: seg.profile,
+				locationId: seg.locationId,
+				hourStartMs: hour,
+				paths: [seg.path]
+			});
+			else fromIndex.set(key, {
+				...existing,
+				paths: [...existing.paths, seg.path]
+			});
+		}
+		for (const row of this.ledger.snapshot()) {
+			if (!walked.has(row.deviceId)) continue;
+			const disk = fromIndex.get(row.key);
+			if (disk === void 0) {
+				if (row.hourStartMs === currentHour) continue;
+				await this.ledger.forget(row.key);
+				continue;
+			}
+			if (row.hourStartMs === currentHour) {
+				const union = uniquePaths([...disk.paths, ...row.paths]);
+				if (!samePaths(union, row.paths)) await this.ledger.put({
+					...row,
+					paths: union
+				});
+				continue;
+			}
+			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
+		}
+		for (const [key, disk] of fromIndex) {
+			if (this.ledger.has(key)) continue;
+			await this.ledger.put(disk);
+		}
+	}
+};
+//#endregion
 //#region src/recorder/addon/recording-export-provider.ts
 /** Content type of every rendered export — the engine only ever writes MP4. */
 var EXPORT_CONTENT_TYPE = "video/mp4";
@@ -7861,6 +8470,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	isRecordingNode = true;
 	index = new RecordingIndex();
 	/**
+	* Durable hour-directory copy of {@link index}. Null on an inert
+	* (non-recording) node. Boot reseeds the RAM index from this; the
+	* deferred archive walk reconciles it against disk.
+	*/
+	segmentHours = null;
+	/**
 	* The calendar rungs — which days, which hours, and a day's exact ranges.
 	*
 	* Separate from `RecordingIndex` on purpose: that one is the SEGMENT model
@@ -7932,6 +8547,16 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			} });
 			return { providers: [] };
 		}
+		this.segmentHours = new SegmentHourLedger({
+			store: this.ctx.api.settingsStore,
+			logger: this.ctx.logger
+		});
+		try {
+			await this.segmentHours.declare();
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger declare failed — index stays RAM-only this boot", { meta: { error: require_dist.errMsg(err) } });
+			this.segmentHours = null;
+		}
 		const ingestOwner = await this.resolveIngestOwner();
 		const consumerHostname = this.nodeId === ingestOwner.ownerNodeId ? void 0 : ingestOwner.reachableHost ?? resolveRecordingHubHostname(this.config.recordingHubHostname, process.env["CAMSTACK_HUB_URL"]);
 		if (this.nodeId !== ingestOwner.ownerNodeId) {
@@ -7968,7 +8593,11 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			onEvicted: (deviceId, atMs) => {
 				this.calendar.invalidate(deviceId, atMs);
 			},
+			onDeindexed: (rows) => {
+				this.segmentHours?.dropSegments(rows);
+			},
 			onIndexed: (row, absPath) => {
+				this.segmentHours?.recordSegment(row);
 				if (!isMfraTableServable(row.startMs, Date.now())) return;
 				readMfraTable(absPath, row.bytes).then((table) => {
 					this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
@@ -8087,6 +8716,9 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),
+			reconcileHourLedger: async (deviceId) => {
+				await this.segmentHours?.reconcileFromIndex(this.index, [deviceId], Date.now());
+			},
 			calendar: this.calendar,
 			mfraFor: (deviceId, profile, startMs) => this.mfraTables.get(deviceId, profile, startMs),
 			hydrateWindow: (deviceId, fromMs, toMs) => hydrateWindowFromStorage(this.index, deviceId, fromMs, toMs, this.resolvedLocations, this.ctx.logger),
@@ -8345,6 +8977,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				this.controller?.onTrigger(deviceId, "motion", atMs);
 			}
 		});
+		try {
+			await this.segmentHours?.load();
+			this.segmentHours?.hydrateIndex(this.index);
+		} catch (err) {
+			this.ctx.logger.warn("recorder: segment-hour ledger load failed — falling through to the archive walk", { meta: { error: require_dist.errMsg(err) } });
+		}
 		let configs;
 		try {
 			configs = await readDeviceConfigs(this.configStore());
@@ -8832,6 +9470,11 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				locationCount: this.resolvedLocations.length,
 				ms: Date.now() - hydrateStartedMs
 			} });
+			try {
+				await this.segmentHours?.reconcileFromIndex(this.index, deviceIds, Date.now());
+			} catch (err) {
+				this.ctx.logger.warn("recorder: segment-hour ledger reconcile failed — walk remains the authority", { meta: { error: require_dist.errMsg(err) } });
+			}
 			const loggedDomains = /* @__PURE__ */ new Set();
 			for (const loc of this.resolvedLocations) {
 				const domain = this.locationDomain(loc.id);