@camstack/addon-pipeline 1.2.90 → 1.2.94

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { At as number, Ft as EventCategory, I as deriveRecordingMode, Mt as record, Nt as string, S as RecordingConfigSchema, St as selectAssignedProfileSlots, Tt as array, X as recordingCapability, Z as recordingExportCapability, et as storageEvictableCapability, f as EVENT_PAD_MS, ht as hydrateSchema, it as errMsg, jt as object, l as DEFAULT_EVENTS_BAND_BUFFER_SEC, m as ExportRecordSchema, pt as DeviceType, ut as BaseAddon, v as OpsLogEntrySchema, x as RECORDING_EXPORT_MAX_READ_BYTES, yt as nodePin } from "../dist-BJYwWEZ9.mjs";
+import { $ as resolveRecordingProfiles, Ct as selectAssignedProfileSlots, Et as array, I as deriveRecordingMode, It as EventCategory, Mt as object, Nt as record, Pt as string, S as RecordingConfigSchema, X as recordingCapability, Z as recordingExportCapability, at as errMsg, bt as nodePin, dt as BaseAddon, f as EVENT_PAD_MS, gt as hydrateSchema, jt as number, l as DEFAULT_EVENTS_BAND_BUFFER_SEC, m as ExportRecordSchema, mt as DeviceType, tt as storageEvictableCapability, v as OpsLogEntrySchema, x as RECORDING_EXPORT_MAX_READ_BYTES } from "../dist-XbrYiMV3.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-A2S9D7pu.mjs";
 import { randomUUID } from "node:crypto";
@@ -1068,6 +1068,7 @@ var RelocateEngine = class {
 			deviceId: input.deviceId ?? null,
 			profiles: input.profiles ? [...input.profiles] : [],
 			footageClass: input.footageClass,
+			sinceMs: input.sinceMs ?? null,
 			throttleMbps: input.throttleMbps ?? DEFAULT_THROTTLE_MBPS,
 			entities: input.entities ? [...input.entities] : ["segments"],
 			filesMoved: 0,
@@ -1128,7 +1129,7 @@ var RelocateEngine = class {
 		const bytesPerMs = job.throttleMbps * 1024 * 1024 / 1e3;
 		try {
 			const samePhysicalRoot = await rootsPhysicallySame(from.root, to.root);
-			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).filter((r) => job.profiles.length === 0 || job.profiles.includes(r.profile)).filter((r) => profileBelongsToClass(r.profile, job.footageClass)).sort((a, b) => a.startMs - b.startMs);
+			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).filter((r) => job.profiles.length === 0 || job.profiles.includes(r.profile)).filter((r) => profileBelongsToClass(r.profile, job.footageClass)).filter((r) => job.sinceMs === null || r.startMs >= job.sinceMs).sort((a, b) => a.startMs - b.startMs);
 			job.filesTotal = segRows.length;
 			for (const row of segRows) {
 				if (job.cancelRequested) break;
@@ -1164,9 +1165,26 @@ var RelocateEngine = class {
 		}
 	}
 	/** Move one segment file and re-point its index row to the target location
-	*  (same location-relative path — the layout is identical on every root). */
+	*  (same location-relative path — the layout is identical on every root).
+	*  A source that is already gone (evicted, never flushed, ENOSPC) is dropped
+	*  from the index and skipped — one ghost file must not abort a drain. */
 	async moveSegment(row, from, to, samePhysicalRoot) {
-		if (!samePhysicalRoot) await moveFile(path.join(from.root, row.path), path.join(to.root, row.path), row.bytes);
+		if (!samePhysicalRoot) try {
+			await moveFile(path.join(from.root, row.path), path.join(to.root, row.path), row.bytes);
+		} catch (err) {
+			if (isEnoent(err)) {
+				this.deps.index.removeSegments([row.path]);
+				this.deps.logger.warn("relocate skipped missing source", {
+					tags: { deviceId: row.deviceId },
+					meta: {
+						path: row.path,
+						locationId: from.id
+					}
+				});
+				return;
+			}
+			throw err;
+		}
 		this.deps.index.removeSegments([row.path]);
 		this.deps.index.addSegment({
 			...row,
@@ -1174,6 +1192,9 @@ var RelocateEngine = class {
 		});
 	}
 };
+function isEnoent(err) {
+	return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
 /** Logical migration classes are profile-derived, never location-derived:
 * high+mid are `recordings`; low is `recordingsLow`. */
 var profileBelongsToClass = (profile, footageClass) => {
@@ -4212,6 +4233,7 @@ function buildRecordingProvider(deps) {
 		rescanStorage: async ({ deviceId }) => {
 			const locations = await deps.refreshLocations();
 			await deps.hydrateDevice(deviceId, locations);
+			await deps.reconcileHourLedger?.(deviceId);
 			const config = await loadDeviceConfig(deps.configStore, deviceId);
 			await deps.opsLog?.append({
 				op: "rescan",
@@ -5075,7 +5097,11 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 		try {
 			entries = await promises.readdir(deviceDir, { recursive: true });
 		} catch (err) {
-			if (err.code !== "ENOENT") logger.warn("recorder: hydrateDevice walk failed for location", {
+			if (err.code === "ENOENT") {
+				for (const location of aliases) index.hydrateDevice(deviceId, location.id, []);
+				continue;
+			}
+			logger.warn("recorder: hydrateDevice walk failed for location", {
 				tags: { deviceId },
 				meta: {
 					locationIds: aliases.map((location) => location.id),
@@ -5103,6 +5129,7 @@ async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger
 			handled += 1;
 			if (handled % chunkSize === 0) await yieldBetween();
 		}
+		for (const location of aliases) if (!pathsByLocation.has(location.id)) pathsByLocation.set(location.id, []);
 		let indexed = 0;
 		for (const [locationId, relPaths] of pathsByLocation) {
 			index.hydrateDevice(deviceId, locationId, relPaths);
@@ -5810,18 +5837,232 @@ function shouldRecordAt(config, triggers, at) {
 	return eventsBandDemanded(band, triggers, at.getTime());
 }
 /**
-* Should a finalized segment `[segStartMs, segEndMs]` recorded under an
-* `events` band be KEPT (else discarded)? Kept iff it overlaps any qualifying
-* trigger's full window `[trigger - preBufferSec, trigger + postBufferSec]`.
-* This is where `preBufferSec` retroactively retains pre-trigger footage.
+* How late the FIRST segment of an attach may be NAMED, relative to the writer
+* spawn, and still count as "the segment this attach was spawned to produce".
+*
+* ffmpeg names a segment when it OPENS it, which is after the RTSP dial and the
+* first keyframe. Measured on camera 1439 (4K, H.265) on 2026-08-18: writer
+* spawned at trigger+29.5 s, first `high` segment named at trigger+32.7 s —
+* 3.2 s. 5 s carries that with margin while staying far below the writer's own
+* "this is dead" bound (`WRITER_IDLE_MIN_MS`, 90 s), so a writer that is merely
+* slow is not mistaken for one that is producing useful footage.
 */
-function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
+var FIRST_SEGMENT_GRACE_MS = 5e3;
+/**
+* Latest segment START this attach may still produce and have kept, regardless
+* of where the operator's post-buffer ended: one full segment (nothing can be
+* finalized sooner) plus {@link FIRST_SEGMENT_GRACE_MS} of spawn→first-name
+* latency.
+*/
+function attachRetainDeadlineMs(attach) {
+	return attach.attachedAtMs + attach.segmentSeconds * 1e3 + FIRST_SEGMENT_GRACE_MS;
+}
+/**
+* Should a finalized segment `[segStartMs, segEndMs]` recorded under an
+* `events` band be KEPT (else discarded)? Kept iff it overlaps a qualifying
+* trigger's full window `[trigger - preBufferSec, trigger + postBufferSec]` —
+* this is where `preBufferSec` retroactively retains pre-trigger footage — OR
+* it is the footage `attach` was spawned to produce (below).
+*
+* ## Why the attach matters here
+*
+* The LIVE gate ({@link shouldRecordAt}) is evaluated at wall clock; this KEEP
+* gate is evaluated on segment timestamps. They shared one window, and a writer
+* physically cannot finalize anything before `spawn + segmentSeconds + dial`.
+* So the last ~`segmentSeconds` of every demand window was a zone where the
+* recorder was GUARANTEED to attach, pull the camera, and delete 100% of the
+* result: on camera 1439 a trigger reached the recorder 29.5 s into its 30 s
+* post-buffer (hub overload, `busLagMs=142173`), ffmpeg ran 31 s, and all six
+* finalized segments were unlinked.
+*
+* The allowance is deliberately NOT a wider `postBufferSec`: it is anchored to
+* `attachedAtMs`, so a PUNCTUAL attach (the normal case) has a deadline far
+* inside `trigger + postMs` and retains exactly what it retained before. It
+* only ever extends the tail of a LATE attach, by at most one segment plus the
+* grace, and only for a trigger whose live window was still open AT ATTACH — the
+* precise statement of "if the live gate said yes, the keep gate honours the
+* first segment that decision produces". A stale trigger extends nothing.
+*/
+function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers, attach) {
 	const { preMs, postMs } = resolveBandBufferMs(band);
-	const overlaps = (lastMs) => lastMs != null && segStartMs <= lastMs + postMs && segEndMs >= lastMs - preMs;
+	const deadlineMs = attachRetainDeadlineMs(attach);
+	const overlaps = (lastMs) => {
+		if (lastMs == null) return false;
+		if (segEndMs < lastMs - preMs) return false;
+		if (segStartMs <= lastMs + postMs) return true;
+		return attach.attachedAtMs <= lastMs + postMs && segStartMs <= deadlineMs;
+	};
 	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
 	return false;
 }
+/**
+* By how many ms a discarded segment missed being kept — its start past the
+* latest start that WOULD have been retained, mirroring
+* {@link segmentRetainedForEvents}'s upper bound exactly (post-buffer end, or
+* the attach allowance for a trigger that was still live at attach). Null when
+* no qualifying trigger exists at all, which is a different fact and says so.
+*
+* Negative means the segment was dropped on the PRE-buffer side (it ended
+* before `trigger - preBufferSec`), not for being late.
+*
+* Reporting-only. The discard branch has to name a number: "outside the window"
+* with no magnitude made a 2.5 s miss and a 10-minute miss indistinguishable.
+*/
+function segmentMissedByMs(segStartMs, band, triggers, attach) {
+	const { postMs } = resolveBandBufferMs(band);
+	const deadlineMs = attachRetainDeadlineMs(attach);
+	const latestKeptStart = (lastMs) => {
+		if (lastMs == null) return null;
+		const windowEndMs = lastMs + postMs;
+		return attach.attachedAtMs <= windowEndMs ? Math.max(windowEndMs, deadlineMs) : windowEndMs;
+	};
+	const bounds = [band.triggers?.motion === true ? latestKeptStart(triggers.lastMotionMs) : null, band.triggers?.audioThresholdDbfs != null ? latestKeptStart(triggers.lastAudioMs) : null].filter((ms) => ms != null);
+	if (bounds.length === 0) return null;
+	return segStartMs - Math.max(...bounds);
+}
+/** Local-calendar instant for `HH:MM` on the given local Y/M/D (day may overflow). */
+function localInstantMs(year, month, day, hhmm) {
+	const [hours, minutes] = hhmm.split(":");
+	return new Date(year, month, day, Number(hours), Number(minutes), 0, 0).getTime();
+}
+/**
+* Every instant inside the horizon at which `bandActiveAt` COULD change value:
+* each band's start and end on each local day, plus each local midnight (the
+* `days` membership boundary). A superset — cheap to compute (a few dozen
+* entries) and filtered against `activeBandAt` below.
+*/
+function candidateEdgesMs(bands, nowMs) {
+	const base = new Date(nowMs);
+	const year = base.getFullYear();
+	const month = base.getMonth();
+	const day = base.getDate();
+	const out = [];
+	for (let offset = 0; offset <= 8; offset++) {
+		out.push(new Date(year, month, day + offset, 0, 0, 0, 0).getTime());
+		for (const band of bands) {
+			out.push(localInstantMs(year, month, day + offset, band.start));
+			out.push(localInstantMs(year, month, day + offset, band.end));
+		}
+	}
+	return out;
+}
+/**
+* The next instant at which a DIFFERENT band (or no band) covers the clock, or
+* `null` when none exists inside {@link BAND_EDGE_HORIZON_DAYS} — the always-on
+* band (`start === end`, empty `days`) being the common case that legitimately
+* has no edge at all.
+*
+* Identity is by band REFERENCE, which is what makes this exact: two distinct
+* band objects with the same fields yield an edge that changes nothing, which
+* costs one wasted wake-up and never costs footage.
+*/
+function nextBandEdgeMs(config, nowMs) {
+	const bands = config.bands;
+	if (!bands || bands.length === 0) return null;
+	const current = activeBandAt({ bands }, new Date(nowMs));
+	const candidates = [...new Set(candidateEdgesMs(bands, nowMs))].filter((ms) => ms > nowMs).toSorted((a, b) => a - b);
+	for (const ms of candidates) if (activeBandAt({ bands }, new Date(ms)) !== current) return ms;
+	return null;
+}
+/**
+* The first instant an `events` band's demand window is CLOSED, given the
+* triggers it listens for, or `null` when no window is open at `nowMs`.
+*
+* Demand is an OR across the listened trigger kinds, so an open window ends
+* with the LATEST of them — a motion trigger followed by an audio trigger 5 s
+* later keeps the camera attached until the audio one expires, exactly as the
+* sliding window already behaved.
+*/
+function eventsWindowCloseMs(band, triggers, nowMs) {
+	if (band.mode !== "events") return null;
+	const { postMs } = resolveBandBufferMs(band);
+	const ends = [];
+	if (band.triggers?.motion === true && triggers.lastMotionMs != null) ends.push(triggers.lastMotionMs + postMs);
+	if (band.triggers?.audioThresholdDbfs != null && triggers.lastAudioMs != null) ends.push(triggers.lastAudioMs + postMs);
+	const open = ends.filter((ms) => ms >= nowMs);
+	if (open.length === 0) return null;
+	return Math.max(...open) + 1;
+}
+/**
+* THE next instant the controller must re-evaluate this device, or `null` when
+* nothing can change without an event the controller already receives (a
+* trigger or a config write).
+*
+* Whichever of the two sources comes first wins, and the reason is carried so
+* the wake-up is attributable in the log without correlating timestamps.
+*/
+function nextDecisionChangeAt(input) {
+	const { config, triggers, nowMs } = input;
+	if (!config.enabled) return null;
+	const bands = config.bands;
+	if (!bands || bands.length === 0) return null;
+	const band = activeBandAt({ bands }, new Date(nowMs));
+	const edgeMs = nextBandEdgeMs(config, nowMs);
+	const closeMs = band === null ? null : eventsWindowCloseMs(band, triggers, nowMs);
+	if (closeMs === null) return edgeMs === null ? null : {
+		atMs: edgeMs,
+		reason: "band-edge"
+	};
+	if (edgeMs === null || closeMs <= edgeMs) return {
+		atMs: closeMs,
+		reason: "window-close"
+	};
+	return {
+		atMs: edgeMs,
+		reason: "band-edge"
+	};
+}
+//#endregion
+//#region src/recorder/addon/device-wakeups.ts
+/** Node truncates a `setTimeout` delay past this to 1 ms — clamp instead. */
+var MAX_TIMER_DELAY_MS = 2147483647;
+var DeviceWakeups = class {
+	deps;
+	timers = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Wake this device at `atMs`, replacing any wake-up already armed for it.
+	* `reason` is carried into the log line so a wake is attributable without
+	* correlating it against the band model by hand.
+	*/
+	arm(deviceId, atMs, reason) {
+		this.cancel(deviceId);
+		const delayMs = Math.min(MAX_TIMER_DELAY_MS, Math.max(1, atMs - this.deps.now()));
+		const timer = setTimeout(() => {
+			this.timers.delete(deviceId);
+			this.deps.fire(deviceId);
+		}, delayMs);
+		timer.unref?.();
+		this.timers.set(deviceId, timer);
+		this.deps.logger.debug("recorder: device wake-up armed", {
+			tags: { deviceId },
+			meta: {
+				atMs,
+				delayMs,
+				reason
+			}
+		});
+	}
+	/** Drop this device's pending wake-up, if any. Idempotent. */
+	cancel(deviceId) {
+		const timer = this.timers.get(deviceId);
+		if (timer === void 0) return;
+		clearTimeout(timer);
+		this.timers.delete(deviceId);
+	}
+	/** Drop every pending wake-up — shutdown and maintenance pause. */
+	cancelAll() {
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+	}
+	/** Devices with a wake-up pending — for tests and for shutdown assertions. */
+	get pendingCount() {
+		return this.timers.size;
+	}
+};
 //#endregion
 //#region src/recorder/addon/periodic-pass.ts
 function startPeriodicPass(deps) {
@@ -6405,19 +6646,37 @@ var SegmentWriter = class {
 *   - a `live.m3u8` `SegmentWatcher` that hands each finalized flat segment to
 *     the v2 `SegmentStore.onFinalized` (stat + relocate + index).
 *
-* Per device it decides whether a CONTINUOUS band is active right now
-* (`shouldRecordContinuousAt`) and ensures the writer set is running iff so.
-* It re-evaluates on three triggers:
-*   1. `setDeviceConfig` (operator changed the bands / enable),
-*   2. a periodic pass (catches band boundaries crossed with no config change),
-*   3. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`).
-*
-* There are TWO periodic passes, on separate timers and never overlapping
-* themselves (`periodic-pass.ts`): a cheap LIVENESS pass that catches writers
-* pinned but producing nothing, and an expensive CONVERGENCE pass that
-* re-evaluates bands and placement. They were one pass until 2026-08-13, when a
-* convergence sweep wedged on unbounded broker RPCs and took the liveness
-* watchdog down with it for 9-27 minutes at a time.
+* Per device it decides whether the active band demands recording right now
+* (`shouldRecordAt`) and ensures the writer set is running iff so. Convergence
+* is EVENT-DRIVEN; the periodic pass is a backstop, not the mechanism:
+*   1. `setDeviceConfig` (operator changed the bands / enable) — an RPC,
+*   2. a qualifying motion/audio trigger (`onTrigger`) — opens a window,
+*   3. a per-device WAKE-UP armed for the exact instant the decision could
+*      change on its own (`decision-schedule.ts` + `device-wakeups.ts`): an
+*      `events` window closing at `lastTrigger + postBufferSec`, or a band edge,
+*   4. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`),
+*   5. the periodic RECONCILE (below), for everything the four above can lose.
+*
+* (3) is why a detach is now punctual. A trigger only ever OPENED a window — the
+* demand test is a sliding `atMs - lastMotionMs <= postMs` anchored on the LAST
+* trigger, so nothing called `evaluateDevice` at the moment it closed and the
+* detach waited for the next pass. A 4K camera stayed dialled, decoded and
+* written for up to a whole tick past the operator's `postBufferSec`.
+*
+* There are THREE periodic passes, each on its own timer and each non-overlapping
+* (`periodic-pass.ts`):
+*   - LIVENESS ({@link LIVENESS_TICK_MS}) — cheap, in-memory: is a pinned writer
+*     producing nothing?
+*   - PLACEMENT ({@link PLACEMENT_TICK_MS}) — cheap (a statfs per location), and
+*     deliberately NOT on the attach beat, so a cold broker cannot delay it.
+*   - RECONCILE ({@link RECONCILE_TICK_MS}) — the only one that can touch the
+*     broker, and the only backstop for a lost wake-up or a failed attach.
+*
+* They were ONE pass until 2026-08-13, when a convergence sweep wedged on
+* unbounded broker RPCs and took the liveness watchdog down with it for 9-27
+* minutes at a time; placement was split out of the second on 2026-08-18, after
+* a converge pass blocked for 60 001 ms (3 x {@link ATTACH_RPC_TIMEOUT_MS})
+* cold-dialling ~40 RTSP sources.
 *
 * EVENTS bands are treated as "not recording continuously" in B2 — B3 adds
 * trigger-gating. The enable intent is persisted in durable-state by the
@@ -6430,8 +6689,45 @@ var SegmentWriter = class {
 * `ReadinessRegistry` is the single source of truth.
 */
 var DEFAULT_WATCH_INTERVAL_MS = 2e3;
-/** Periodic re-evaluation to catch band boundaries crossed with no config change. */
-var TICK_MS = 3e4;
+/**
+* Liveness cadence — "is a pinned writer producing nothing?". Unchanged: the
+* question is an in-memory scan over `active`, it costs nothing, and its bound
+* (`writerIdleBoundMs`, floor 90 s) is sized against this beat.
+*/
+var LIVENESS_TICK_MS = 3e4;
+/**
+* Placement cadence — unchanged from the beat it used to share with
+* convergence, because nothing about placement wanted to be rarer. What changed
+* is that it no longer rides a pass that can block on broker RPCs: it is one
+* `statfs` per location and it re-plans only, so a plan reaches a camera at its
+* NEXT attach.
+*/
+var PLACEMENT_TICK_MS = 3e4;
+/**
+* Reconcile cadence — the SAFETY NET, not the mechanism.
+*
+* It was 30 s because it WAS the mechanism: nothing else ever closed an `events`
+* window or crossed a band edge, so the loop had to keep asking. Both are now
+* armed for their exact instant (`decision-schedule.ts`), a config change is an
+* RPC, and a broker recovery is a readiness transition — so this pass exists
+* only for what those cannot cover: a wake-up lost because the event path threw
+* before it could arm one, an attach that failed with no later ready transition
+* to ride, a timer lost to a runner respawn, and clock drift.
+*
+* 2 minutes, and the number is chosen against a bound this recorder already
+* accepts. The liveness watchdog tolerates a pinned-but-silent writer for
+* `WRITER_IDLE_MIN_MS` (90 s) before it recovers it; a device that WANTS
+* recording but is detached is the same class of fault — footage is not being
+* written and only a periodic check will notice — so its recovery is put on the
+* same order rather than an order slower. Four times rarer than the beat that
+* blocked for 60 001 ms on 2026-08-18, while still bounding the worst case at
+* ~2 minutes of footage for a camera whose event path failed entirely.
+*
+* Going rarer than this trades real footage for CPU that the pass no longer
+* spends anyway: with the broker-readiness pre-check below, a reconcile over a
+* healthy fleet is N config reads and no RPC at all.
+*/
+var RECONCILE_TICK_MS = 12e4;
 /**
 * Bound on the broker lease-release RPC (`releaseStreamWithCodec`) during
 * teardown. The UDS request default is 60s, but the runner supervisor's
@@ -6470,11 +6766,15 @@ var RELEASE_RPC_TIMEOUT_MS = 2e3;
 */
 var ATTACH_RPC_TIMEOUT_MS = 2e4;
 /**
-* A pass longer than this is reported with its duration. Equal to the pass
-* cadence: a pass that cannot finish inside its own interval is the condition
-* that used to go unlogged for half an hour.
+* A pass longer than this is reported with its duration. Each pass uses its OWN
+* cadence as the budget: a pass that cannot finish inside its own interval is
+* the condition that used to go unlogged for half an hour. Keeping it per-pass
+* matters now that the three cadences differ — a 40 s reconcile is healthy
+* against a 120 s beat and was a red flag against a 30 s one.
 */
-var PASS_SLOW_AFTER_MS = TICK_MS;
+function passSlowAfterMs(intervalMs) {
+	return intervalMs;
+}
 /**
 * Race `promise` against a deadline. Handlers stay attached to the losing
 * promise, so a post-deadline settlement can never surface as a process-level
@@ -6557,30 +6857,100 @@ var RecordingController = class {
 	*/
 	lastSegmentAt = /* @__PURE__ */ new Map();
 	/**
+	* Per `deviceId:profile`, the `attachedAtMs` of the attach that has retained
+	* at least one `events` segment. Read only to LEVEL the discard log: an
+	* attach that kept nothing is a wasted pull (warn), a later discard from one
+	* that kept something is the tail of the window (info). Bounded by
+	* device×profile like {@link lastSegmentAt}, and cleared with it on detach.
+	*/
+	attachRetained = /* @__PURE__ */ new Map();
+	/**
 	* Devices already named by {@link reportUnrecordable} — one warn per device
 	* per "enabled but can never record" episode, re-armed as soon as the device
 	* records again.
 	*/
 	unrecordableReported = /* @__PURE__ */ new Set();
+	/**
+	* Profiles the last attach skipped (stream not published / getStream threw).
+	* `evaluateDevice` retries only these on the converge tick so a dead `low`
+	* cannot keep `high` dark, without a `listAllProfileSlots` RPC on every
+	* healthy device every 30s.
+	*/
+	skippedProfiles = /* @__PURE__ */ new Map();
 	restore = null;
+	/**
+	* One pending wake-up per device, armed for the exact instant its recording
+	* decision could change on its own — an `events` window closing or a band
+	* edge. THE reason a detach is punctual instead of up to a pass late.
+	*/
+	wakeups;
 	/** Cheap, never-delayed: is any pinned writer producing nothing? */
 	livenessPass = null;
-	/** Expensive: re-evaluate bands + placement for every configured device. */
-	convergePass = null;
+	/** Cheap, and off the attach beat: re-plan where each (device, profile) writes. */
+	placementPass = null;
+	/** The backstop: re-evaluate every tracked-or-configured device. */
+	reconcilePass = null;
 	stopped = false;
 	/** A reversible maintenance lease. Unlike `stopped`, it never changes
 	* persisted recording intent and `resume()` restarts normal convergence. */
 	paused = false;
 	constructor(deps) {
 		this.deps = deps;
+		this.wakeups = new DeviceWakeups({
+			logger: deps.logger,
+			now: () => this.now(),
+			fire: (deviceId) => this.onWakeup(deviceId)
+		});
 	}
 	now() {
 		return this.deps.now?.() ?? Date.now();
 	}
 	/**
+	* A per-device wake-up came due: re-decide. `evaluateDevice` re-arms (or
+	* cancels) the next one as part of deciding, so the chain is self-sustaining.
+	*
+	* A throw here breaks that chain — the device keeps whatever state it had and
+	* has no timer behind it — so it is NAMED, and the reconcile is what picks it
+	* up. Silence would read as "the window never closed".
+	*/
+	onWakeup(deviceId) {
+		this.evaluateDevice(deviceId).catch((err) => {
+			this.deps.logger.warn("recorder: scheduled re-evaluation failed — no wake-up re-armed (the reconcile is the backstop)", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		});
+	}
+	/**
+	* Arm (or cancel) this device's next wake-up from the config it was just
+	* evaluated against.
+	*
+	* Called from `evaluateDevice` BEFORE the attach/detach work, not after: the
+	* attach chain can throw (broker not ready, stream unpublished) and the
+	* schedule does not depend on whether it succeeded. Arming first means a
+	* failed attach still gets its band edge, and only a failure to READ the
+	* config can lose a wake-up.
+	*/
+	scheduleNextDecision(deviceId, config) {
+		if (this.stopped || this.paused) {
+			this.wakeups.cancel(deviceId);
+			return;
+		}
+		const next = nextDecisionChangeAt({
+			config,
+			triggers: this.triggersFor(deviceId),
+			nowMs: this.now()
+		});
+		if (next === null) {
+			this.wakeups.cancel(deviceId);
+			return;
+		}
+		this.wakeups.arm(deviceId, next.atMs, next.reason);
+	}
+	/**
 	* Boot restore: seed the readiness-gated queue with every persisted device and
 	* (re)evaluate each on every `stream-broker` ready transition. Also arms the
-	* periodic tick. Idempotent — safe to call once after the index is hydrated.
+	* periodic passes. Idempotent — safe to call once after the index is hydrated.
 	*/
 	async start() {
 		if (this.stopped) return;
@@ -6601,45 +6971,83 @@ var RecordingController = class {
 				meta: { error: errMsg(err) }
 			})
 		});
-		if (this.convergePass === null) {
+		if (this.reconcilePass === null) {
 			this.livenessPass = startPeriodicPass({
 				name: "liveness",
-				intervalMs: TICK_MS,
-				slowAfterMs: PASS_SLOW_AFTER_MS,
+				intervalMs: LIVENESS_TICK_MS,
+				slowAfterMs: passSlowAfterMs(LIVENESS_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
 				run: () => this.checkIdleWriters()
 			});
-			this.convergePass = startPeriodicPass({
-				name: "convergence",
-				intervalMs: TICK_MS,
-				slowAfterMs: PASS_SLOW_AFTER_MS,
+			this.placementPass = startPeriodicPass({
+				name: "placement",
+				intervalMs: PLACEMENT_TICK_MS,
+				slowAfterMs: passSlowAfterMs(PLACEMENT_TICK_MS),
+				logger: this.deps.logger,
+				now: () => this.now(),
+				run: () => this.replanPlacement()
+			});
+			this.reconcilePass = startPeriodicPass({
+				name: "reconcile",
+				intervalMs: RECONCILE_TICK_MS,
+				slowAfterMs: passSlowAfterMs(RECONCILE_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
-				run: () => this.converge()
+				run: () => this.reconcile()
 			});
 		}
 		await this.restore.start(ids.map((id) => [id, true]));
 	}
-	/** Re-evaluate every currently-tracked OR active device on the periodic pass. */
-	async converge() {
-		if (this.stopped) return;
+	/**
+	* Every device the recorder is responsible for right now: those with writers
+	* attached, plus every one with a persisted config. A failure to enumerate the
+	* persisted set degrades to "the active ones" rather than aborting the pass.
+	*/
+	async trackedDeviceIds() {
 		const ids = new Set(this.active.keys());
-		let persisted = [];
 		try {
-			persisted = await this.deps.enabledDeviceIds();
-		} catch {}
-		for (const id of persisted) ids.add(id);
+			for (const id of await this.deps.enabledDeviceIds()) ids.add(id);
+		} catch (err) {
+			this.deps.logger.warn("recorder controller: could not enumerate persisted devices — this pass covers the active ones only", { meta: {
+				error: errMsg(err),
+				activeDevices: this.active.size
+			} });
+		}
+		return [...ids];
+	}
+	/**
+	* Re-plan where each (device, profile) writes. Its OWN pass: cheap (no I/O
+	* beyond a statfs per location), and it must not be starved by an attach that
+	* is waiting on a 20 s broker timeout. It changes the PLAN only — a running
+	* writer keeps its root until it next attaches, which is the boundary rule.
+	*/
+	async replanPlacement() {
+		if (this.stopped || this.paused) return;
+		if (this.deps.onPlacementTick === void 0) return;
+		const ids = await this.trackedDeviceIds();
 		try {
-			await this.deps.onPlacementTick?.([...ids]);
+			await this.deps.onPlacementTick(ids);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: errMsg(err) } });
 		}
-		await runBounded([...ids], 8, async (id) => {
+	}
+	/**
+	* The backstop pass: re-evaluate every tracked-or-configured device.
+	*
+	* Nothing here is the normal path any more — a window close, a band edge, a
+	* config change and a broker recovery all reach `evaluateDevice` on their own.
+	* This exists for the four things that cannot: a wake-up the event path threw
+	* before arming, an attach that failed with no later readiness transition to
+	* ride, a timer lost to a runner respawn, and clock drift.
+	*/
+	async reconcile() {
+		if (this.stopped) return;
+		await runBounded(await this.trackedDeviceIds(), 8, async (id) => {
 			try {
 				await this.evaluateDevice(id);
 			} catch (err) {
-				this.deps.logger.warn("recorder controller: convergence evaluate failed", {
+				this.deps.logger.warn("recorder controller: reconcile evaluate failed", {
 					tags: { deviceId: id },
 					meta: { error: errMsg(err) }
 				});
@@ -6663,8 +7071,9 @@ var RecordingController = class {
 	* idle source can re-dial cleanly), then re-evaluate: if the band still demands
 	* recording, `evaluateDevice` re-queues + re-attaches a fresh writer set. If
 	* the broker is not ready, the re-attach throws and the device stays on the
-	* readiness queue (retried on the next broker ready) — and the periodic tick is
-	* the backstop. Bounded OUTER retry (TICK_MS cadence), never a tight loop.
+	* readiness queue (retried on the next broker ready) — and the periodic
+	* reconcile is the backstop. Bounded OUTER retry (RECONCILE_TICK_MS cadence),
+	* never a tight loop.
 	*/
 	async recoverWriterGaveUp(deviceId) {
 		if (this.stopped) return;
@@ -6674,7 +7083,7 @@ var RecordingController = class {
 			await this.evaluateDevice(deviceId);
 		} catch (err) {
 			this.restore?.add(deviceId, true);
-			this.deps.logger.warn("recorder: writer give-up recovery deferred (retries on next broker ready/tick)", {
+			this.deps.logger.warn("recorder: writer give-up recovery deferred (retries on next broker ready/reconcile)", {
 				tags: { deviceId },
 				meta: { error: errMsg(err) }
 			});
@@ -6725,10 +7134,16 @@ var RecordingController = class {
 	}
 	/**
 	* Record a qualifying trigger (motion/audio) for a device and converge: an
-	* `events` band whose window this opens attaches now; the periodic tick
-	* detaches it once `postBufferSec` elapses. Called from the addon's
-	* EventCapture subscription. The qualification test (motion detected / audio
-	* over threshold) is done upstream — by the time we're here, it qualified.
+	* `events` band whose window this opens attaches now, and the same
+	* `evaluateDevice` arms the wake-up that will CLOSE it at
+	* `atMs + postBufferSec`. Called from the addon's EventCapture subscription.
+	* The qualification test (motion detected / audio over threshold) is done
+	* upstream — by the time we're here, it qualified.
+	*
+	* A fresher trigger re-arms the wake-up later, which is exactly how the
+	* sliding window already behaved: continuous motion stays ONE recording,
+	* because `evaluateDevice` short-circuits at "already recording — converged"
+	* and only the timer moves.
 	*/
 	async onTrigger(deviceId, source, atMs) {
 		if (this.stopped) return;
@@ -6740,7 +7155,7 @@ var RecordingController = class {
 		try {
 			await this.evaluateDevice(deviceId);
 		} catch (err) {
-			this.deps.logger.warn("recorder: trigger attach deferred — stream not available yet (retries on next broker ready/tick)", {
+			this.deps.logger.warn("recorder: trigger attach deferred — stream not available yet (retries on next broker ready/reconcile)", {
 				tags: { deviceId },
 				meta: {
 					source,
@@ -6761,14 +7176,19 @@ var RecordingController = class {
 		if (this.stopped || this.paused) return;
 		const config = await this.deps.loadConfig(deviceId);
 		if (this.stopped || this.paused) return;
-		if (!shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()))) {
+		const wantRecording = shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()));
+		this.scheduleNextDecision(deviceId, config);
+		if (!wantRecording) {
 			this.reportUnrecordable(deviceId, config);
 			await this.detachDevice(deviceId);
 			this.restore?.remove(deviceId);
 			return;
 		}
 		this.unrecordableReported.delete(deviceId);
-		if (this.active.has(deviceId)) return;
+		if (this.active.has(deviceId)) {
+			if (this.skippedProfiles.has(deviceId)) await this.fillMissingProfiles(deviceId, config);
+			return;
+		}
 		if (this.attaching.has(deviceId)) return;
 		this.attaching.add(deviceId);
 		const attaching = this.performAttach(deviceId, config);
@@ -6817,49 +7237,141 @@ var RecordingController = class {
 		});
 	}
 	/**
+	* Throw before spending a single broker RPC when the registry already says the
+	* `stream-broker` on the owner node is not ready. See
+	* {@link RecordingControllerDeps.brokerReady}; absent → assume ready.
+	*/
+	failFastIfBrokerCold(deviceId) {
+		if (this.deps.brokerReady?.() !== false) return;
+		throw new Error(`recorder controller: stream-broker not ready on ${this.deps.ownerNodeId} — attach for device ${deviceId} deferred to the next ready transition`);
+	}
+	/**
 	* The attach body — extracted so the {@link attaching} in-flight guard in
 	* `evaluateDevice` wraps it cleanly. Resolves the profiles, spawns a
-	* SegmentWriter + watcher per profile, and records the set in `active`. A throw
-	* (broker not ready / no sources) rolls back partial attaches and re-throws.
+	* SegmentWriter + watcher per profile, and records the set in `active`.
+	*
+	* Per-profile: a throw from one slot is logged and skipped. Rolling back the
+	* whole device when a single stream was dead (618 `derived` on `low`) left
+	* ZERO footage for hours. If every profile fails, throw so the restore queue
+	* retries the device.
 	*/
 	async performAttach(deviceId, config) {
 		this.restore?.add(deviceId, true);
+		this.failFastIfBrokerCold(deviceId);
 		const profiles = await this.resolveProfiles(deviceId, config.profiles);
 		if (profiles.length === 0) throw new Error(`recorder controller: no assigned broker sources for device ${deviceId}`);
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
 		const recordings = [];
-		try {
-			for (const profile of profiles) recordings.push(await this.attachProfile(deviceId, profile, segmentSeconds));
+		const failed = [];
+		for (const profile of profiles) try {
+			recordings.push(await this.attachProfile(deviceId, profile, segmentSeconds));
 		} catch (err) {
-			for (const r of recordings) await this.teardownProfile(deviceId, r);
-			throw err;
+			failed.push(profile);
+			this.deps.logger.warn("recorder: profile attach failed — recording the remaining profiles", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					error: errMsg(err)
+				}
+			});
 		}
+		if (recordings.length === 0) throw new Error(`recorder controller: no profile attached for device ${deviceId}` + (failed.length > 0 ? ` (failed: ${failed.join(",")})` : ""));
 		if (this.paused) {
 			await Promise.all(recordings.map((recording) => this.teardownProfile(deviceId, recording)));
 			return;
 		}
 		this.active.set(deviceId, recordings);
+		if (failed.length > 0) this.skippedProfiles.set(deviceId, new Set(failed));
+		else this.skippedProfiles.delete(deviceId);
 		this.deps.logger.info("recorder pinned broker source(s) for recording", {
 			tags: { deviceId },
 			meta: {
-				profiles,
+				profiles: recordings.map((r) => r.profile),
+				failedProfiles: failed,
 				segmentSeconds,
 				pipelineKeys: recordings.map((r) => r.pipelineKey)
 			}
 		});
 	}
 	/**
+	* Retry profiles the last attach skipped, without tearing down writers that
+	* are already producing. Called from `evaluateDevice` when the device is
+	* already in `active` and {@link skippedProfiles} is non-empty. Failures stay
+	* logged; the next converge tick retries.
+	*/
+	async fillMissingProfiles(deviceId, config) {
+		if (this.attaching.has(deviceId)) return;
+		const current = this.active.get(deviceId);
+		const skipped = this.skippedProfiles.get(deviceId);
+		if (!current || !skipped || skipped.size === 0) return;
+		this.attaching.add(deviceId);
+		const filling = this.runFillMissingProfiles(deviceId, config, current, skipped);
+		this.attachingTasks.set(deviceId, filling);
+		try {
+			await filling;
+		} finally {
+			this.attachingTasks.delete(deviceId);
+			this.attaching.delete(deviceId);
+		}
+	}
+	async runFillMissingProfiles(deviceId, config, current, skipped) {
+		if (this.deps.brokerReady?.() === false) {
+			this.deps.logger.info("recorder: skipped-profile retry deferred — stream-broker not ready (healthy profiles keep recording)", {
+				tags: { deviceId },
+				meta: {
+					profiles: [...skipped],
+					ownerNodeId: this.deps.ownerNodeId
+				}
+			});
+			return;
+		}
+		const have = new Set(current.map((r) => r.profile));
+		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
+		const added = [];
+		for (const profile of [...skipped]) {
+			if (have.has(profile)) {
+				skipped.delete(profile);
+				continue;
+			}
+			try {
+				added.push(await this.attachProfile(deviceId, profile, segmentSeconds));
+				skipped.delete(profile);
+			} catch (err) {
+				this.deps.logger.warn("recorder: profile attach retry failed — keeping the healthy profiles", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						error: errMsg(err)
+					}
+				});
+			}
+		}
+		if (skipped.size === 0) this.skippedProfiles.delete(deviceId);
+		if (added.length === 0) return;
+		const existing = this.active.get(deviceId);
+		if (!existing || this.paused || this.stopped) {
+			await Promise.all(added.map((recording) => this.teardownProfile(deviceId, recording)));
+			return;
+		}
+		this.active.set(deviceId, [...existing, ...added]);
+		this.deps.logger.info("recorder pinned additional broker source(s) for recording", {
+			tags: { deviceId },
+			meta: {
+				profiles: added.map((r) => r.profile),
+				pipelineKeys: added.map((r) => r.pipelineKey)
+			}
+		});
+	}
+	/**
 	* Pick which profiles to record. The broker enumerates assigned profile slots,
 	* deduped by physical source (`selectAssignedProfileSlots`) so the same camera
-	* encoder is never recorded twice. An operator `override` DISABLES the
-	* unselected profiles (assigned ∩ selection); a selection matching none of the
-	* assigned sources is ignored (record every assigned source — minimum of 1).
+	* encoder is never recorded twice. Default is high+low among those slots
+	* (`resolveRecordingProfiles`); an operator `override` DISABLES the
+	* unselected profiles. A selection matching none of the assigned sources
+	* falls back to the default/assigned set (minimum of 1 when anything is assigned).
 	*/
 	async resolveProfiles(deviceId, override) {
-		const assigned = selectAssignedProfileSlots(await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.listAllProfileSlots.query(void 0, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "listAllProfileSlots")), deviceId).map((slot) => slot.profile);
-		if (!override || override.length === 0) return assigned;
-		const selected = assigned.filter((p) => override.includes(p));
-		return selected.length > 0 ? selected : assigned;
+		return resolveRecordingProfiles(selectAssignedProfileSlots(await this.deps.brokerCall(() => withDeadline(this.deps.api.streamBroker.listAllProfileSlots.query(void 0, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "listAllProfileSlots")), deviceId).map((slot) => slot.profile), override);
 	}
 	/**
 	* Attach one (device, profile): acquire the broker source, mkdir the staging
@@ -6905,7 +7417,10 @@ var RecordingController = class {
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
-					await this.handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath);
+					await this.handleFinalizedSegment(deviceId, profile, placement, {
+						attachedAtMs: writerStartedMs,
+						segmentSeconds
+					}, startMs, durMs, flatAbsPath);
 				},
 				logger: deviceLog
 			}),
@@ -6922,13 +7437,16 @@ var RecordingController = class {
 	* keep/discard gate touches `events`-mode segments only, so the continuous
 	* path is unchanged.
 	*/
-	async handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath) {
+	async handleFinalizedSegment(deviceId, profile, placement, attach, startMs, durMs, flatAbsPath) {
 		try {
 			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
-			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, this.triggersFor(deviceId))) {
+			const triggers = this.triggersFor(deviceId);
+			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, triggers, attach)) {
+				this.reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs);
 				await promises.unlink(flatAbsPath).catch(() => {});
 				return;
 			}
+			if (band?.mode === "events") this.attachRetained.set(idleKey(deviceId, profile), attach.attachedAtMs);
 			await this.deps.segmentStore.onFinalized({
 				deviceId,
 				profile,
@@ -6949,6 +7467,47 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Name a discarded `events`-band segment. This branch deletes recorded
+	* footage and used to write NOTHING: on camera 1439 the operator saw `pinned`
+	* then `unpinned` with an empty timeline in between and no line anywhere said
+	* why — the recorder had spawned ffmpeg, pulled 4K RTSP for 31 s and unlinked
+	* every segment it produced.
+	*
+	* Level is chosen, not defaulted. A discard at the TAIL of a window is the
+	* feature working (`info`) — the writer keeps running until the next converge
+	* tick and those trailing segments were never asked for. A discard from an
+	* attach that has retained NOTHING is a fault (`warn`): the whole pull was
+	* wasted, which is exactly the shape of the 1439 loss and of any future
+	* regression in the attach allowance.
+	*/
+	reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs) {
+		const { preMs, postMs } = resolveBandBufferMs(band);
+		const keptAnything = this.attachRetained.get(idleKey(deviceId, profile)) === attach.attachedAtMs;
+		const meta = {
+			profile,
+			startMs,
+			durMs,
+			lastMotionMs: triggers.lastMotionMs,
+			lastAudioMs: triggers.lastAudioMs,
+			postMs,
+			preMs,
+			attachedAtMs: attach.attachedAtMs,
+			missedByMs: segmentMissedByMs(startMs, band, triggers, attach),
+			keptAnythingFromThisAttach: keptAnything
+		};
+		if (keptAnything) {
+			this.deps.logger.info("recorder: discarding events segment outside every trigger window (tail of the window)", {
+				tags: { deviceId },
+				meta
+			});
+			return;
+		}
+		this.deps.logger.warn("recorder: discarding events segment — this attach has retained NOTHING, the whole pull is wasted", {
+			tags: { deviceId },
+			meta
+		});
+	}
+	/**
 	* Resolve the storage location a (device, profile) writes to, at an attach
 	* boundary. Delegates to the injected {@link RecordingControllerDeps.placeProfile}
 	* when the addon supplied one; otherwise to the pure `resolvePlacement` in
@@ -6989,7 +7548,11 @@ var RecordingController = class {
 		const recordings = this.active.get(deviceId);
 		if (!recordings) return;
 		this.active.delete(deviceId);
-		for (const r of recordings) this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
+		this.skippedProfiles.delete(deviceId);
+		for (const r of recordings) {
+			this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
+			this.attachRetained.delete(idleKey(deviceId, r.profile));
+		}
 		await Promise.all(recordings.map((r) => this.teardownProfile(deviceId, r)));
 		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
 			tags: { deviceId },
@@ -7000,6 +7563,7 @@ var RecordingController = class {
 	async pause() {
 		if (this.stopped || this.paused) return;
 		this.paused = true;
+		this.wakeups.cancelAll();
 		while (this.attachingTasks.size > 0) await Promise.allSettled([...this.attachingTasks.values()]);
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));
 	}
@@ -7015,13 +7579,16 @@ var RecordingController = class {
 		}
 		for (const deviceId of ids) await this.evaluateDevice(deviceId);
 	}
-	/** Tear EVERYTHING down: timer, restore subscription, every writer/watcher/lease. */
+	/** Tear EVERYTHING down: timers, restore subscription, every writer/watcher/lease. */
 	async stop() {
 		this.stopped = true;
+		this.wakeups.cancelAll();
 		this.livenessPass?.stop();
 		this.livenessPass = null;
-		this.convergePass?.stop();
-		this.convergePass = null;
+		this.placementPass?.stop();
+		this.placementPass = null;
+		this.reconcilePass?.stop();
+		this.reconcilePass = null;
 		this.restore?.stop();
 		this.restore = null;
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));
@@ -8555,7 +9122,8 @@ var RecorderV2Addon = class extends BaseAddon {
 			onBrokerReady: (handler) => this.ctx.onCapabilityStateChange("stream-broker", brokerScope(ingestOwner.ownerNodeId), (state) => {
 				if (state === "ready") handler();
 			}),
-			brokerCall: makeBrokerCall(brokerHandle)
+			brokerCall: makeBrokerCall(brokerHandle),
+			brokerReady: () => brokerHandle.isReady
 		});
 		const relocateEngine = new RelocateEngine({
 			index: this.index,
@@ -8605,6 +9173,9 @@ var RecorderV2Addon = class extends BaseAddon {
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),
+			reconcileHourLedger: async (deviceId) => {
+				await this.segmentHours?.reconcileFromIndex(this.index, [deviceId], Date.now());
+			},
 			calendar: this.calendar,
 			mfraFor: (deviceId, profile, startMs) => this.mfraTables.get(deviceId, profile, startMs),
 			hydrateWindow: (deviceId, fromMs, toMs) => hydrateWindowFromStorage(this.index, deviceId, fromMs, toMs, this.resolvedLocations, this.ctx.logger),