@camstack/addon-pipeline 1.2.93 → 1.2.94

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { $ as resolveRecordingProfiles, Ct as selectAssignedProfileSlots, Et as array, I as deriveRecordingMode, It as EventCategory, Mt as object, Nt as record, Pt as string, S as RecordingConfigSchema, X as recordingCapability, Z as recordingExportCapability, at as errMsg, bt as nodePin, dt as BaseAddon, f as EVENT_PAD_MS, gt as hydrateSchema, jt as number, l as DEFAULT_EVENTS_BAND_BUFFER_SEC, m as ExportRecordSchema, mt as DeviceType, tt as storageEvictableCapability, v as OpsLogEntrySchema, x as RECORDING_EXPORT_MAX_READ_BYTES } from "../dist-6POVIYmC.mjs";
+import { $ as resolveRecordingProfiles, Ct as selectAssignedProfileSlots, Et as array, I as deriveRecordingMode, It as EventCategory, Mt as object, Nt as record, Pt as string, S as RecordingConfigSchema, X as recordingCapability, Z as recordingExportCapability, at as errMsg, bt as nodePin, dt as BaseAddon, f as EVENT_PAD_MS, gt as hydrateSchema, jt as number, l as DEFAULT_EVENTS_BAND_BUFFER_SEC, m as ExportRecordSchema, mt as DeviceType, tt as storageEvictableCapability, v as OpsLogEntrySchema, x as RECORDING_EXPORT_MAX_READ_BYTES } from "../dist-XbrYiMV3.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-A2S9D7pu.mjs";
 import { randomUUID } from "node:crypto";
@@ -5837,18 +5837,232 @@ function shouldRecordAt(config, triggers, at) {
 	return eventsBandDemanded(band, triggers, at.getTime());
 }
 /**
-* Should a finalized segment `[segStartMs, segEndMs]` recorded under an
-* `events` band be KEPT (else discarded)? Kept iff it overlaps any qualifying
-* trigger's full window `[trigger - preBufferSec, trigger + postBufferSec]`.
-* This is where `preBufferSec` retroactively retains pre-trigger footage.
+* How late the FIRST segment of an attach may be NAMED, relative to the writer
+* spawn, and still count as "the segment this attach was spawned to produce".
+*
+* ffmpeg names a segment when it OPENS it, which is after the RTSP dial and the
+* first keyframe. Measured on camera 1439 (4K, H.265) on 2026-08-18: writer
+* spawned at trigger+29.5 s, first `high` segment named at trigger+32.7 s —
+* 3.2 s. 5 s carries that with margin while staying far below the writer's own
+* "this is dead" bound (`WRITER_IDLE_MIN_MS`, 90 s), so a writer that is merely
+* slow is not mistaken for one that is producing useful footage.
 */
-function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
+var FIRST_SEGMENT_GRACE_MS = 5e3;
+/**
+* Latest segment START this attach may still produce and have kept, regardless
+* of where the operator's post-buffer ended: one full segment (nothing can be
+* finalized sooner) plus {@link FIRST_SEGMENT_GRACE_MS} of spawn→first-name
+* latency.
+*/
+function attachRetainDeadlineMs(attach) {
+	return attach.attachedAtMs + attach.segmentSeconds * 1e3 + FIRST_SEGMENT_GRACE_MS;
+}
+/**
+* Should a finalized segment `[segStartMs, segEndMs]` recorded under an
+* `events` band be KEPT (else discarded)? Kept iff it overlaps a qualifying
+* trigger's full window `[trigger - preBufferSec, trigger + postBufferSec]` —
+* this is where `preBufferSec` retroactively retains pre-trigger footage — OR
+* it is the footage `attach` was spawned to produce (below).
+*
+* ## Why the attach matters here
+*
+* The LIVE gate ({@link shouldRecordAt}) is evaluated at wall clock; this KEEP
+* gate is evaluated on segment timestamps. They shared one window, and a writer
+* physically cannot finalize anything before `spawn + segmentSeconds + dial`.
+* So the last ~`segmentSeconds` of every demand window was a zone where the
+* recorder was GUARANTEED to attach, pull the camera, and delete 100% of the
+* result: on camera 1439 a trigger reached the recorder 29.5 s into its 30 s
+* post-buffer (hub overload, `busLagMs=142173`), ffmpeg ran 31 s, and all six
+* finalized segments were unlinked.
+*
+* The allowance is deliberately NOT a wider `postBufferSec`: it is anchored to
+* `attachedAtMs`, so a PUNCTUAL attach (the normal case) has a deadline far
+* inside `trigger + postMs` and retains exactly what it retained before. It
+* only ever extends the tail of a LATE attach, by at most one segment plus the
+* grace, and only for a trigger whose live window was still open AT ATTACH — the
+* precise statement of "if the live gate said yes, the keep gate honours the
+* first segment that decision produces". A stale trigger extends nothing.
+*/
+function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers, attach) {
 	const { preMs, postMs } = resolveBandBufferMs(band);
-	const overlaps = (lastMs) => lastMs != null && segStartMs <= lastMs + postMs && segEndMs >= lastMs - preMs;
+	const deadlineMs = attachRetainDeadlineMs(attach);
+	const overlaps = (lastMs) => {
+		if (lastMs == null) return false;
+		if (segEndMs < lastMs - preMs) return false;
+		if (segStartMs <= lastMs + postMs) return true;
+		return attach.attachedAtMs <= lastMs + postMs && segStartMs <= deadlineMs;
+	};
 	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
 	return false;
 }
+/**
+* By how many ms a discarded segment missed being kept — its start past the
+* latest start that WOULD have been retained, mirroring
+* {@link segmentRetainedForEvents}'s upper bound exactly (post-buffer end, or
+* the attach allowance for a trigger that was still live at attach). Null when
+* no qualifying trigger exists at all, which is a different fact and says so.
+*
+* Negative means the segment was dropped on the PRE-buffer side (it ended
+* before `trigger - preBufferSec`), not for being late.
+*
+* Reporting-only. The discard branch has to name a number: "outside the window"
+* with no magnitude made a 2.5 s miss and a 10-minute miss indistinguishable.
+*/
+function segmentMissedByMs(segStartMs, band, triggers, attach) {
+	const { postMs } = resolveBandBufferMs(band);
+	const deadlineMs = attachRetainDeadlineMs(attach);
+	const latestKeptStart = (lastMs) => {
+		if (lastMs == null) return null;
+		const windowEndMs = lastMs + postMs;
+		return attach.attachedAtMs <= windowEndMs ? Math.max(windowEndMs, deadlineMs) : windowEndMs;
+	};
+	const bounds = [band.triggers?.motion === true ? latestKeptStart(triggers.lastMotionMs) : null, band.triggers?.audioThresholdDbfs != null ? latestKeptStart(triggers.lastAudioMs) : null].filter((ms) => ms != null);
+	if (bounds.length === 0) return null;
+	return segStartMs - Math.max(...bounds);
+}
+/** Local-calendar instant for `HH:MM` on the given local Y/M/D (day may overflow). */
+function localInstantMs(year, month, day, hhmm) {
+	const [hours, minutes] = hhmm.split(":");
+	return new Date(year, month, day, Number(hours), Number(minutes), 0, 0).getTime();
+}
+/**
+* Every instant inside the horizon at which `bandActiveAt` COULD change value:
+* each band's start and end on each local day, plus each local midnight (the
+* `days` membership boundary). A superset — cheap to compute (a few dozen
+* entries) and filtered against `activeBandAt` below.
+*/
+function candidateEdgesMs(bands, nowMs) {
+	const base = new Date(nowMs);
+	const year = base.getFullYear();
+	const month = base.getMonth();
+	const day = base.getDate();
+	const out = [];
+	for (let offset = 0; offset <= 8; offset++) {
+		out.push(new Date(year, month, day + offset, 0, 0, 0, 0).getTime());
+		for (const band of bands) {
+			out.push(localInstantMs(year, month, day + offset, band.start));
+			out.push(localInstantMs(year, month, day + offset, band.end));
+		}
+	}
+	return out;
+}
+/**
+* The next instant at which a DIFFERENT band (or no band) covers the clock, or
+* `null` when none exists inside {@link BAND_EDGE_HORIZON_DAYS} — the always-on
+* band (`start === end`, empty `days`) being the common case that legitimately
+* has no edge at all.
+*
+* Identity is by band REFERENCE, which is what makes this exact: two distinct
+* band objects with the same fields yield an edge that changes nothing, which
+* costs one wasted wake-up and never costs footage.
+*/
+function nextBandEdgeMs(config, nowMs) {
+	const bands = config.bands;
+	if (!bands || bands.length === 0) return null;
+	const current = activeBandAt({ bands }, new Date(nowMs));
+	const candidates = [...new Set(candidateEdgesMs(bands, nowMs))].filter((ms) => ms > nowMs).toSorted((a, b) => a - b);
+	for (const ms of candidates) if (activeBandAt({ bands }, new Date(ms)) !== current) return ms;
+	return null;
+}
+/**
+* The first instant an `events` band's demand window is CLOSED, given the
+* triggers it listens for, or `null` when no window is open at `nowMs`.
+*
+* Demand is an OR across the listened trigger kinds, so an open window ends
+* with the LATEST of them — a motion trigger followed by an audio trigger 5 s
+* later keeps the camera attached until the audio one expires, exactly as the
+* sliding window already behaved.
+*/
+function eventsWindowCloseMs(band, triggers, nowMs) {
+	if (band.mode !== "events") return null;
+	const { postMs } = resolveBandBufferMs(band);
+	const ends = [];
+	if (band.triggers?.motion === true && triggers.lastMotionMs != null) ends.push(triggers.lastMotionMs + postMs);
+	if (band.triggers?.audioThresholdDbfs != null && triggers.lastAudioMs != null) ends.push(triggers.lastAudioMs + postMs);
+	const open = ends.filter((ms) => ms >= nowMs);
+	if (open.length === 0) return null;
+	return Math.max(...open) + 1;
+}
+/**
+* THE next instant the controller must re-evaluate this device, or `null` when
+* nothing can change without an event the controller already receives (a
+* trigger or a config write).
+*
+* Whichever of the two sources comes first wins, and the reason is carried so
+* the wake-up is attributable in the log without correlating timestamps.
+*/
+function nextDecisionChangeAt(input) {
+	const { config, triggers, nowMs } = input;
+	if (!config.enabled) return null;
+	const bands = config.bands;
+	if (!bands || bands.length === 0) return null;
+	const band = activeBandAt({ bands }, new Date(nowMs));
+	const edgeMs = nextBandEdgeMs(config, nowMs);
+	const closeMs = band === null ? null : eventsWindowCloseMs(band, triggers, nowMs);
+	if (closeMs === null) return edgeMs === null ? null : {
+		atMs: edgeMs,
+		reason: "band-edge"
+	};
+	if (edgeMs === null || closeMs <= edgeMs) return {
+		atMs: closeMs,
+		reason: "window-close"
+	};
+	return {
+		atMs: edgeMs,
+		reason: "band-edge"
+	};
+}
+//#endregion
+//#region src/recorder/addon/device-wakeups.ts
+/** Node truncates a `setTimeout` delay past this to 1 ms — clamp instead. */
+var MAX_TIMER_DELAY_MS = 2147483647;
+var DeviceWakeups = class {
+	deps;
+	timers = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Wake this device at `atMs`, replacing any wake-up already armed for it.
+	* `reason` is carried into the log line so a wake is attributable without
+	* correlating it against the band model by hand.
+	*/
+	arm(deviceId, atMs, reason) {
+		this.cancel(deviceId);
+		const delayMs = Math.min(MAX_TIMER_DELAY_MS, Math.max(1, atMs - this.deps.now()));
+		const timer = setTimeout(() => {
+			this.timers.delete(deviceId);
+			this.deps.fire(deviceId);
+		}, delayMs);
+		timer.unref?.();
+		this.timers.set(deviceId, timer);
+		this.deps.logger.debug("recorder: device wake-up armed", {
+			tags: { deviceId },
+			meta: {
+				atMs,
+				delayMs,
+				reason
+			}
+		});
+	}
+	/** Drop this device's pending wake-up, if any. Idempotent. */
+	cancel(deviceId) {
+		const timer = this.timers.get(deviceId);
+		if (timer === void 0) return;
+		clearTimeout(timer);
+		this.timers.delete(deviceId);
+	}
+	/** Drop every pending wake-up — shutdown and maintenance pause. */
+	cancelAll() {
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+	}
+	/** Devices with a wake-up pending — for tests and for shutdown assertions. */
+	get pendingCount() {
+		return this.timers.size;
+	}
+};
 //#endregion
 //#region src/recorder/addon/periodic-pass.ts
 function startPeriodicPass(deps) {
@@ -6432,19 +6646,37 @@ var SegmentWriter = class {
 *   - a `live.m3u8` `SegmentWatcher` that hands each finalized flat segment to
 *     the v2 `SegmentStore.onFinalized` (stat + relocate + index).
 *
-* Per device it decides whether a CONTINUOUS band is active right now
-* (`shouldRecordContinuousAt`) and ensures the writer set is running iff so.
-* It re-evaluates on three triggers:
-*   1. `setDeviceConfig` (operator changed the bands / enable),
-*   2. a periodic pass (catches band boundaries crossed with no config change),
-*   3. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`).
-*
-* There are TWO periodic passes, on separate timers and never overlapping
-* themselves (`periodic-pass.ts`): a cheap LIVENESS pass that catches writers
-* pinned but producing nothing, and an expensive CONVERGENCE pass that
-* re-evaluates bands and placement. They were one pass until 2026-08-13, when a
-* convergence sweep wedged on unbounded broker RPCs and took the liveness
-* watchdog down with it for 9-27 minutes at a time.
+* Per device it decides whether the active band demands recording right now
+* (`shouldRecordAt`) and ensures the writer set is running iff so. Convergence
+* is EVENT-DRIVEN; the periodic pass is a backstop, not the mechanism:
+*   1. `setDeviceConfig` (operator changed the bands / enable) — an RPC,
+*   2. a qualifying motion/audio trigger (`onTrigger`) — opens a window,
+*   3. a per-device WAKE-UP armed for the exact instant the decision could
+*      change on its own (`decision-schedule.ts` + `device-wakeups.ts`): an
+*      `events` window closing at `lastTrigger + postBufferSec`, or a band edge,
+*   4. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`),
+*   5. the periodic RECONCILE (below), for everything the four above can lose.
+*
+* (3) is why a detach is now punctual. A trigger only ever OPENED a window — the
+* demand test is a sliding `atMs - lastMotionMs <= postMs` anchored on the LAST
+* trigger, so nothing called `evaluateDevice` at the moment it closed and the
+* detach waited for the next pass. A 4K camera stayed dialled, decoded and
+* written for up to a whole tick past the operator's `postBufferSec`.
+*
+* There are THREE periodic passes, each on its own timer and each non-overlapping
+* (`periodic-pass.ts`):
+*   - LIVENESS ({@link LIVENESS_TICK_MS}) — cheap, in-memory: is a pinned writer
+*     producing nothing?
+*   - PLACEMENT ({@link PLACEMENT_TICK_MS}) — cheap (a statfs per location), and
+*     deliberately NOT on the attach beat, so a cold broker cannot delay it.
+*   - RECONCILE ({@link RECONCILE_TICK_MS}) — the only one that can touch the
+*     broker, and the only backstop for a lost wake-up or a failed attach.
+*
+* They were ONE pass until 2026-08-13, when a convergence sweep wedged on
+* unbounded broker RPCs and took the liveness watchdog down with it for 9-27
+* minutes at a time; placement was split out of the second on 2026-08-18, after
+* a converge pass blocked for 60 001 ms (3 x {@link ATTACH_RPC_TIMEOUT_MS})
+* cold-dialling ~40 RTSP sources.
 *
 * EVENTS bands are treated as "not recording continuously" in B2 — B3 adds
 * trigger-gating. The enable intent is persisted in durable-state by the
@@ -6457,8 +6689,45 @@ var SegmentWriter = class {
 * `ReadinessRegistry` is the single source of truth.
 */
 var DEFAULT_WATCH_INTERVAL_MS = 2e3;
-/** Periodic re-evaluation to catch band boundaries crossed with no config change. */
-var TICK_MS = 3e4;
+/**
+* Liveness cadence — "is a pinned writer producing nothing?". Unchanged: the
+* question is an in-memory scan over `active`, it costs nothing, and its bound
+* (`writerIdleBoundMs`, floor 90 s) is sized against this beat.
+*/
+var LIVENESS_TICK_MS = 3e4;
+/**
+* Placement cadence — unchanged from the beat it used to share with
+* convergence, because nothing about placement wanted to be rarer. What changed
+* is that it no longer rides a pass that can block on broker RPCs: it is one
+* `statfs` per location and it re-plans only, so a plan reaches a camera at its
+* NEXT attach.
+*/
+var PLACEMENT_TICK_MS = 3e4;
+/**
+* Reconcile cadence — the SAFETY NET, not the mechanism.
+*
+* It was 30 s because it WAS the mechanism: nothing else ever closed an `events`
+* window or crossed a band edge, so the loop had to keep asking. Both are now
+* armed for their exact instant (`decision-schedule.ts`), a config change is an
+* RPC, and a broker recovery is a readiness transition — so this pass exists
+* only for what those cannot cover: a wake-up lost because the event path threw
+* before it could arm one, an attach that failed with no later ready transition
+* to ride, a timer lost to a runner respawn, and clock drift.
+*
+* 2 minutes, and the number is chosen against a bound this recorder already
+* accepts. The liveness watchdog tolerates a pinned-but-silent writer for
+* `WRITER_IDLE_MIN_MS` (90 s) before it recovers it; a device that WANTS
+* recording but is detached is the same class of fault — footage is not being
+* written and only a periodic check will notice — so its recovery is put on the
+* same order rather than an order slower. Four times rarer than the beat that
+* blocked for 60 001 ms on 2026-08-18, while still bounding the worst case at
+* ~2 minutes of footage for a camera whose event path failed entirely.
+*
+* Going rarer than this trades real footage for CPU that the pass no longer
+* spends anyway: with the broker-readiness pre-check below, a reconcile over a
+* healthy fleet is N config reads and no RPC at all.
+*/
+var RECONCILE_TICK_MS = 12e4;
 /**
 * Bound on the broker lease-release RPC (`releaseStreamWithCodec`) during
 * teardown. The UDS request default is 60s, but the runner supervisor's
@@ -6497,11 +6766,15 @@ var RELEASE_RPC_TIMEOUT_MS = 2e3;
 */
 var ATTACH_RPC_TIMEOUT_MS = 2e4;
 /**
-* A pass longer than this is reported with its duration. Equal to the pass
-* cadence: a pass that cannot finish inside its own interval is the condition
-* that used to go unlogged for half an hour.
+* A pass longer than this is reported with its duration. Each pass uses its OWN
+* cadence as the budget: a pass that cannot finish inside its own interval is
+* the condition that used to go unlogged for half an hour. Keeping it per-pass
+* matters now that the three cadences differ — a 40 s reconcile is healthy
+* against a 120 s beat and was a red flag against a 30 s one.
 */
-var PASS_SLOW_AFTER_MS = TICK_MS;
+function passSlowAfterMs(intervalMs) {
+	return intervalMs;
+}
 /**
 * Race `promise` against a deadline. Handlers stay attached to the losing
 * promise, so a post-deadline settlement can never surface as a process-level
@@ -6584,6 +6857,14 @@ var RecordingController = class {
 	*/
 	lastSegmentAt = /* @__PURE__ */ new Map();
 	/**
+	* Per `deviceId:profile`, the `attachedAtMs` of the attach that has retained
+	* at least one `events` segment. Read only to LEVEL the discard log: an
+	* attach that kept nothing is a wasted pull (warn), a later discard from one
+	* that kept something is the tail of the window (info). Bounded by
+	* device×profile like {@link lastSegmentAt}, and cleared with it on detach.
+	*/
+	attachRetained = /* @__PURE__ */ new Map();
+	/**
 	* Devices already named by {@link reportUnrecordable} — one warn per device
 	* per "enabled but can never record" episode, re-armed as soon as the device
 	* records again.
@@ -6597,24 +6878,79 @@ var RecordingController = class {
 	*/
 	skippedProfiles = /* @__PURE__ */ new Map();
 	restore = null;
+	/**
+	* One pending wake-up per device, armed for the exact instant its recording
+	* decision could change on its own — an `events` window closing or a band
+	* edge. THE reason a detach is punctual instead of up to a pass late.
+	*/
+	wakeups;
 	/** Cheap, never-delayed: is any pinned writer producing nothing? */
 	livenessPass = null;
-	/** Expensive: re-evaluate bands + placement for every configured device. */
-	convergePass = null;
+	/** Cheap, and off the attach beat: re-plan where each (device, profile) writes. */
+	placementPass = null;
+	/** The backstop: re-evaluate every tracked-or-configured device. */
+	reconcilePass = null;
 	stopped = false;
 	/** A reversible maintenance lease. Unlike `stopped`, it never changes
 	* persisted recording intent and `resume()` restarts normal convergence. */
 	paused = false;
 	constructor(deps) {
 		this.deps = deps;
+		this.wakeups = new DeviceWakeups({
+			logger: deps.logger,
+			now: () => this.now(),
+			fire: (deviceId) => this.onWakeup(deviceId)
+		});
 	}
 	now() {
 		return this.deps.now?.() ?? Date.now();
 	}
 	/**
+	* A per-device wake-up came due: re-decide. `evaluateDevice` re-arms (or
+	* cancels) the next one as part of deciding, so the chain is self-sustaining.
+	*
+	* A throw here breaks that chain — the device keeps whatever state it had and
+	* has no timer behind it — so it is NAMED, and the reconcile is what picks it
+	* up. Silence would read as "the window never closed".
+	*/
+	onWakeup(deviceId) {
+		this.evaluateDevice(deviceId).catch((err) => {
+			this.deps.logger.warn("recorder: scheduled re-evaluation failed — no wake-up re-armed (the reconcile is the backstop)", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		});
+	}
+	/**
+	* Arm (or cancel) this device's next wake-up from the config it was just
+	* evaluated against.
+	*
+	* Called from `evaluateDevice` BEFORE the attach/detach work, not after: the
+	* attach chain can throw (broker not ready, stream unpublished) and the
+	* schedule does not depend on whether it succeeded. Arming first means a
+	* failed attach still gets its band edge, and only a failure to READ the
+	* config can lose a wake-up.
+	*/
+	scheduleNextDecision(deviceId, config) {
+		if (this.stopped || this.paused) {
+			this.wakeups.cancel(deviceId);
+			return;
+		}
+		const next = nextDecisionChangeAt({
+			config,
+			triggers: this.triggersFor(deviceId),
+			nowMs: this.now()
+		});
+		if (next === null) {
+			this.wakeups.cancel(deviceId);
+			return;
+		}
+		this.wakeups.arm(deviceId, next.atMs, next.reason);
+	}
+	/**
 	* Boot restore: seed the readiness-gated queue with every persisted device and
 	* (re)evaluate each on every `stream-broker` ready transition. Also arms the
-	* periodic tick. Idempotent — safe to call once after the index is hydrated.
+	* periodic passes. Idempotent — safe to call once after the index is hydrated.
 	*/
 	async start() {
 		if (this.stopped) return;
@@ -6635,45 +6971,83 @@ var RecordingController = class {
 				meta: { error: errMsg(err) }
 			})
 		});
-		if (this.convergePass === null) {
+		if (this.reconcilePass === null) {
 			this.livenessPass = startPeriodicPass({
 				name: "liveness",
-				intervalMs: TICK_MS,
-				slowAfterMs: PASS_SLOW_AFTER_MS,
+				intervalMs: LIVENESS_TICK_MS,
+				slowAfterMs: passSlowAfterMs(LIVENESS_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
 				run: () => this.checkIdleWriters()
 			});
-			this.convergePass = startPeriodicPass({
-				name: "convergence",
-				intervalMs: TICK_MS,
-				slowAfterMs: PASS_SLOW_AFTER_MS,
+			this.placementPass = startPeriodicPass({
+				name: "placement",
+				intervalMs: PLACEMENT_TICK_MS,
+				slowAfterMs: passSlowAfterMs(PLACEMENT_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
-				run: () => this.converge()
+				run: () => this.replanPlacement()
+			});
+			this.reconcilePass = startPeriodicPass({
+				name: "reconcile",
+				intervalMs: RECONCILE_TICK_MS,
+				slowAfterMs: passSlowAfterMs(RECONCILE_TICK_MS),
+				logger: this.deps.logger,
+				now: () => this.now(),
+				run: () => this.reconcile()
 			});
 		}
 		await this.restore.start(ids.map((id) => [id, true]));
 	}
-	/** Re-evaluate every currently-tracked OR active device on the periodic pass. */
-	async converge() {
-		if (this.stopped) return;
+	/**
+	* Every device the recorder is responsible for right now: those with writers
+	* attached, plus every one with a persisted config. A failure to enumerate the
+	* persisted set degrades to "the active ones" rather than aborting the pass.
+	*/
+	async trackedDeviceIds() {
 		const ids = new Set(this.active.keys());
-		let persisted = [];
 		try {
-			persisted = await this.deps.enabledDeviceIds();
-		} catch {}
-		for (const id of persisted) ids.add(id);
+			for (const id of await this.deps.enabledDeviceIds()) ids.add(id);
+		} catch (err) {
+			this.deps.logger.warn("recorder controller: could not enumerate persisted devices — this pass covers the active ones only", { meta: {
+				error: errMsg(err),
+				activeDevices: this.active.size
+			} });
+		}
+		return [...ids];
+	}
+	/**
+	* Re-plan where each (device, profile) writes. Its OWN pass: cheap (no I/O
+	* beyond a statfs per location), and it must not be starved by an attach that
+	* is waiting on a 20 s broker timeout. It changes the PLAN only — a running
+	* writer keeps its root until it next attaches, which is the boundary rule.
+	*/
+	async replanPlacement() {
+		if (this.stopped || this.paused) return;
+		if (this.deps.onPlacementTick === void 0) return;
+		const ids = await this.trackedDeviceIds();
 		try {
-			await this.deps.onPlacementTick?.([...ids]);
+			await this.deps.onPlacementTick(ids);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: errMsg(err) } });
 		}
-		await runBounded([...ids], 8, async (id) => {
+	}
+	/**
+	* The backstop pass: re-evaluate every tracked-or-configured device.
+	*
+	* Nothing here is the normal path any more — a window close, a band edge, a
+	* config change and a broker recovery all reach `evaluateDevice` on their own.
+	* This exists for the four things that cannot: a wake-up the event path threw
+	* before arming, an attach that failed with no later readiness transition to
+	* ride, a timer lost to a runner respawn, and clock drift.
+	*/
+	async reconcile() {
+		if (this.stopped) return;
+		await runBounded(await this.trackedDeviceIds(), 8, async (id) => {
 			try {
 				await this.evaluateDevice(id);
 			} catch (err) {
-				this.deps.logger.warn("recorder controller: convergence evaluate failed", {
+				this.deps.logger.warn("recorder controller: reconcile evaluate failed", {
 					tags: { deviceId: id },
 					meta: { error: errMsg(err) }
 				});
@@ -6697,8 +7071,9 @@ var RecordingController = class {
 	* idle source can re-dial cleanly), then re-evaluate: if the band still demands
 	* recording, `evaluateDevice` re-queues + re-attaches a fresh writer set. If
 	* the broker is not ready, the re-attach throws and the device stays on the
-	* readiness queue (retried on the next broker ready) — and the periodic tick is
-	* the backstop. Bounded OUTER retry (TICK_MS cadence), never a tight loop.
+	* readiness queue (retried on the next broker ready) — and the periodic
+	* reconcile is the backstop. Bounded OUTER retry (RECONCILE_TICK_MS cadence),
+	* never a tight loop.
 	*/
 	async recoverWriterGaveUp(deviceId) {
 		if (this.stopped) return;
@@ -6708,7 +7083,7 @@ var RecordingController = class {
 			await this.evaluateDevice(deviceId);
 		} catch (err) {
 			this.restore?.add(deviceId, true);
-			this.deps.logger.warn("recorder: writer give-up recovery deferred (retries on next broker ready/tick)", {
+			this.deps.logger.warn("recorder: writer give-up recovery deferred (retries on next broker ready/reconcile)", {
 				tags: { deviceId },
 				meta: { error: errMsg(err) }
 			});
@@ -6759,10 +7134,16 @@ var RecordingController = class {
 	}
 	/**
 	* Record a qualifying trigger (motion/audio) for a device and converge: an
-	* `events` band whose window this opens attaches now; the periodic tick
-	* detaches it once `postBufferSec` elapses. Called from the addon's
-	* EventCapture subscription. The qualification test (motion detected / audio
-	* over threshold) is done upstream — by the time we're here, it qualified.
+	* `events` band whose window this opens attaches now, and the same
+	* `evaluateDevice` arms the wake-up that will CLOSE it at
+	* `atMs + postBufferSec`. Called from the addon's EventCapture subscription.
+	* The qualification test (motion detected / audio over threshold) is done
+	* upstream — by the time we're here, it qualified.
+	*
+	* A fresher trigger re-arms the wake-up later, which is exactly how the
+	* sliding window already behaved: continuous motion stays ONE recording,
+	* because `evaluateDevice` short-circuits at "already recording — converged"
+	* and only the timer moves.
 	*/
 	async onTrigger(deviceId, source, atMs) {
 		if (this.stopped) return;
@@ -6774,7 +7155,7 @@ var RecordingController = class {
 		try {
 			await this.evaluateDevice(deviceId);
 		} catch (err) {
-			this.deps.logger.warn("recorder: trigger attach deferred — stream not available yet (retries on next broker ready/tick)", {
+			this.deps.logger.warn("recorder: trigger attach deferred — stream not available yet (retries on next broker ready/reconcile)", {
 				tags: { deviceId },
 				meta: {
 					source,
@@ -6795,7 +7176,9 @@ var RecordingController = class {
 		if (this.stopped || this.paused) return;
 		const config = await this.deps.loadConfig(deviceId);
 		if (this.stopped || this.paused) return;
-		if (!shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()))) {
+		const wantRecording = shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()));
+		this.scheduleNextDecision(deviceId, config);
+		if (!wantRecording) {
 			this.reportUnrecordable(deviceId, config);
 			await this.detachDevice(deviceId);
 			this.restore?.remove(deviceId);
@@ -6854,6 +7237,15 @@ var RecordingController = class {
 		});
 	}
 	/**
+	* Throw before spending a single broker RPC when the registry already says the
+	* `stream-broker` on the owner node is not ready. See
+	* {@link RecordingControllerDeps.brokerReady}; absent → assume ready.
+	*/
+	failFastIfBrokerCold(deviceId) {
+		if (this.deps.brokerReady?.() !== false) return;
+		throw new Error(`recorder controller: stream-broker not ready on ${this.deps.ownerNodeId} — attach for device ${deviceId} deferred to the next ready transition`);
+	}
+	/**
 	* The attach body — extracted so the {@link attaching} in-flight guard in
 	* `evaluateDevice` wraps it cleanly. Resolves the profiles, spawns a
 	* SegmentWriter + watcher per profile, and records the set in `active`.
@@ -6865,6 +7257,7 @@ var RecordingController = class {
 	*/
 	async performAttach(deviceId, config) {
 		this.restore?.add(deviceId, true);
+		this.failFastIfBrokerCold(deviceId);
 		const profiles = await this.resolveProfiles(deviceId, config.profiles);
 		if (profiles.length === 0) throw new Error(`recorder controller: no assigned broker sources for device ${deviceId}`);
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
@@ -6922,6 +7315,16 @@ var RecordingController = class {
 		}
 	}
 	async runFillMissingProfiles(deviceId, config, current, skipped) {
+		if (this.deps.brokerReady?.() === false) {
+			this.deps.logger.info("recorder: skipped-profile retry deferred — stream-broker not ready (healthy profiles keep recording)", {
+				tags: { deviceId },
+				meta: {
+					profiles: [...skipped],
+					ownerNodeId: this.deps.ownerNodeId
+				}
+			});
+			return;
+		}
 		const have = new Set(current.map((r) => r.profile));
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
 		const added = [];
@@ -7014,7 +7417,10 @@ var RecordingController = class {
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
-					await this.handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath);
+					await this.handleFinalizedSegment(deviceId, profile, placement, {
+						attachedAtMs: writerStartedMs,
+						segmentSeconds
+					}, startMs, durMs, flatAbsPath);
 				},
 				logger: deviceLog
 			}),
@@ -7031,13 +7437,16 @@ var RecordingController = class {
 	* keep/discard gate touches `events`-mode segments only, so the continuous
 	* path is unchanged.
 	*/
-	async handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath) {
+	async handleFinalizedSegment(deviceId, profile, placement, attach, startMs, durMs, flatAbsPath) {
 		try {
 			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
-			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, this.triggersFor(deviceId))) {
+			const triggers = this.triggersFor(deviceId);
+			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, triggers, attach)) {
+				this.reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs);
 				await promises.unlink(flatAbsPath).catch(() => {});
 				return;
 			}
+			if (band?.mode === "events") this.attachRetained.set(idleKey(deviceId, profile), attach.attachedAtMs);
 			await this.deps.segmentStore.onFinalized({
 				deviceId,
 				profile,
@@ -7058,6 +7467,47 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Name a discarded `events`-band segment. This branch deletes recorded
+	* footage and used to write NOTHING: on camera 1439 the operator saw `pinned`
+	* then `unpinned` with an empty timeline in between and no line anywhere said
+	* why — the recorder had spawned ffmpeg, pulled 4K RTSP for 31 s and unlinked
+	* every segment it produced.
+	*
+	* Level is chosen, not defaulted. A discard at the TAIL of a window is the
+	* feature working (`info`) — the writer keeps running until the next converge
+	* tick and those trailing segments were never asked for. A discard from an
+	* attach that has retained NOTHING is a fault (`warn`): the whole pull was
+	* wasted, which is exactly the shape of the 1439 loss and of any future
+	* regression in the attach allowance.
+	*/
+	reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs) {
+		const { preMs, postMs } = resolveBandBufferMs(band);
+		const keptAnything = this.attachRetained.get(idleKey(deviceId, profile)) === attach.attachedAtMs;
+		const meta = {
+			profile,
+			startMs,
+			durMs,
+			lastMotionMs: triggers.lastMotionMs,
+			lastAudioMs: triggers.lastAudioMs,
+			postMs,
+			preMs,
+			attachedAtMs: attach.attachedAtMs,
+			missedByMs: segmentMissedByMs(startMs, band, triggers, attach),
+			keptAnythingFromThisAttach: keptAnything
+		};
+		if (keptAnything) {
+			this.deps.logger.info("recorder: discarding events segment outside every trigger window (tail of the window)", {
+				tags: { deviceId },
+				meta
+			});
+			return;
+		}
+		this.deps.logger.warn("recorder: discarding events segment — this attach has retained NOTHING, the whole pull is wasted", {
+			tags: { deviceId },
+			meta
+		});
+	}
+	/**
 	* Resolve the storage location a (device, profile) writes to, at an attach
 	* boundary. Delegates to the injected {@link RecordingControllerDeps.placeProfile}
 	* when the addon supplied one; otherwise to the pure `resolvePlacement` in
@@ -7099,7 +7549,10 @@ var RecordingController = class {
 		if (!recordings) return;
 		this.active.delete(deviceId);
 		this.skippedProfiles.delete(deviceId);
-		for (const r of recordings) this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
+		for (const r of recordings) {
+			this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
+			this.attachRetained.delete(idleKey(deviceId, r.profile));
+		}
 		await Promise.all(recordings.map((r) => this.teardownProfile(deviceId, r)));
 		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
 			tags: { deviceId },
@@ -7110,6 +7563,7 @@ var RecordingController = class {
 	async pause() {
 		if (this.stopped || this.paused) return;
 		this.paused = true;
+		this.wakeups.cancelAll();
 		while (this.attachingTasks.size > 0) await Promise.allSettled([...this.attachingTasks.values()]);
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));
 	}
@@ -7125,13 +7579,16 @@ var RecordingController = class {
 		}
 		for (const deviceId of ids) await this.evaluateDevice(deviceId);
 	}
-	/** Tear EVERYTHING down: timer, restore subscription, every writer/watcher/lease. */
+	/** Tear EVERYTHING down: timers, restore subscription, every writer/watcher/lease. */
 	async stop() {
 		this.stopped = true;
+		this.wakeups.cancelAll();
 		this.livenessPass?.stop();
 		this.livenessPass = null;
-		this.convergePass?.stop();
-		this.convergePass = null;
+		this.placementPass?.stop();
+		this.placementPass = null;
+		this.reconcilePass?.stop();
+		this.reconcilePass = null;
 		this.restore?.stop();
 		this.restore = null;
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));
@@ -8665,7 +9122,8 @@ var RecorderV2Addon = class extends BaseAddon {
 			onBrokerReady: (handler) => this.ctx.onCapabilityStateChange("stream-broker", brokerScope(ingestOwner.ownerNodeId), (state) => {
 				if (state === "ready") handler();
 			}),
-			brokerCall: makeBrokerCall(brokerHandle)
+			brokerCall: makeBrokerCall(brokerHandle),
+			brokerReady: () => brokerHandle.isReady
 		});
 		const relocateEngine = new RelocateEngine({
 			index: this.index,