@camstack/addon-pipeline 1.2.93 → 1.2.95

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { $ as resolveRecordingProfiles, Ct as selectAssignedProfileSlots, Et as array, I as deriveRecordingMode, It as EventCategory, Mt as object, Nt as record, Pt as string, S as RecordingConfigSchema, X as recordingCapability, Z as recordingExportCapability, at as errMsg, bt as nodePin, dt as BaseAddon, f as EVENT_PAD_MS, gt as hydrateSchema, jt as number, l as DEFAULT_EVENTS_BAND_BUFFER_SEC, m as ExportRecordSchema, mt as DeviceType, tt as storageEvictableCapability, v as OpsLogEntrySchema, x as RECORDING_EXPORT_MAX_READ_BYTES } from "../dist-6POVIYmC.mjs";
+import { $ as recordingExportCapability, C as RecordingConfigSchema, Ct as nodePin, Et as selectAssignedProfileSlots, Ft as object, It as record, L as deriveRecordingMode, Lt as string, Pt as number, Q as recordingCapability, S as RECORDING_EXPORT_MAX_READ_BYTES, _t as DeviceType, ct as errMsg, f as EVENT_PAD_MS, it as storageEvictableCapability, kt as array, l as DEFAULT_EVENTS_BAND_BUFFER_SEC, m as ExportRecordSchema, mt as BaseAddon, nt as resolveRecordingProfiles, v as OpsLogEntrySchema, yt as hydrateSchema, zt as EventCategory } from "../dist-C49o1k7u.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-A2S9D7pu.mjs";
 import { randomUUID } from "node:crypto";
@@ -456,6 +456,51 @@ var MfraTableStore = class {
 		}
 	}
 };
+var PendingGate = class {
+	deps;
+	inFlight = 0;
+	droppedSinceReport = 0;
+	lastReportAt = Number.NEGATIVE_INFINITY;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Tasks currently in flight. */
+	get pending() {
+		return this.inFlight;
+	}
+	/**
+	* Admit `task` unless the lane is saturated.
+	*
+	* Returns `false` when the task was REFUSED — the caller must log the drop
+	* (with its `deviceId` tag when the work is about a device); a branch that
+	* drops work silently reads as "never happened".
+	*/
+	run(task) {
+		if (this.inFlight >= this.deps.limit) {
+			this.droppedSinceReport += 1;
+			const now = this.deps.now?.() ?? Date.now();
+			const intervalMs = this.deps.reportIntervalMs ?? 3e4;
+			if (now - this.lastReportAt >= intervalMs) {
+				this.lastReportAt = now;
+				const dropped = this.droppedSinceReport;
+				this.droppedSinceReport = 0;
+				this.deps.onSaturated({
+					label: this.deps.label,
+					dropped,
+					pending: this.inFlight
+				});
+			}
+			return false;
+		}
+		this.inFlight += 1;
+		Promise.resolve().then(task).catch((error) => {
+			this.deps.onTaskError?.(error);
+		}).finally(() => {
+			this.inFlight -= 1;
+		});
+		return true;
+	}
+};
 //#endregion
 //#region src/recorder/merge-ranges.ts
 function mergeRanges(segments, gapToleranceMs) {
@@ -515,12 +560,33 @@ function* hourBuckets(fromMs, toMs) {
 	const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
 	for (let h = first; h < toMs; h += HOUR_MS$5) yield h;
 }
+/**
+* Index of the first element whose `startMs` is GREATER than `startMs` (upper
+* bound). Inserting there keeps equal-start rows in arrival order — exactly
+* what a stable full sort of the backing map (insertion-ordered) produces, so
+* an incrementally-maintained view is indistinguishable from a rebuilt one.
+*/
+function upperBoundByStart(rows, startMs) {
+	let lo = 0;
+	let hi = rows.length;
+	while (lo < hi) {
+		const mid = lo + hi >> 1;
+		if (rows[mid].startMs <= startMs) lo = mid + 1;
+		else hi = mid;
+	}
+	return lo;
+}
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
-	/** Start-sorted snapshots, rebuilt only after index mutations. Interactive
-	* locate/range calls reuse them instead of filtering+sorting the complete
-	* archive on every seek and scrub miss. */
+	/** Start-sorted views. Built lazily on first read (one copy+sort), then kept
+	* LIVE by `addSegment`'s ordered insert — rows arrive roughly ascending, so
+	* the insert is near-appending. Bulk mutations (hydrate, eviction, a re-set
+	* of an existing path) still invalidate; the steady-state finalize never
+	* does. Interactive locate/range calls reuse these instead of
+	* filtering+sorting the complete archive on every seek and scrub miss. */
 	sortedByDevice = /* @__PURE__ */ new Map();
+	fullRebuilds = 0;
+	incrementalInserts = 0;
 	/** Hour buckets this device has been walked for; `ALL_HOURS` after a full
 	*  hydrate. Empty = nothing has been looked at, which is NOT the same as
 	*  "there is nothing" — see {@link hydrationOf}. */
@@ -547,10 +613,34 @@ var RecordingIndex = class {
 		if (cached) return cached;
 		const m = this.byDevice.get(deviceId);
 		if (!m) return [];
+		this.fullRebuilds += 1;
 		const sorted = [...m.values()].filter((s) => profile == null || s.profile === profile).toSorted((a, b) => a.startMs - b.startMs);
 		deviceCache.set(key, sorted);
 		return sorted;
 	}
+	/** See {@link SortedViewStats}. Telemetry + the guard the churn test asserts on. */
+	sortedViewStats() {
+		return {
+			fullRebuilds: this.fullRebuilds,
+			incrementalInserts: this.incrementalInserts
+		};
+	}
+	/**
+	* Ordered insert of ONE NEW row into every live view it belongs to (the
+	* all-profiles view and its own profile's view). Views not yet materialised
+	* stay unmaterialised — their first read pays the one build. PRECONDITION:
+	* the row's path was NOT already in the device map; a replace must
+	* invalidate instead, because the views hold the old row object.
+	*/
+	insertIntoSortedViews(s) {
+		const deviceCache = this.sortedByDevice.get(s.deviceId);
+		if (!deviceCache) return;
+		for (const [key, rows] of deviceCache) {
+			if (key !== "" && key !== s.profile) continue;
+			rows.splice(upperBoundByStart(rows, s.startMs), 0, s);
+			this.incrementalInserts += 1;
+		}
+	}
 	/**
 	* Replace a device's segments FOR ONE LOCATION from a `storage.list` result (paths relative to that
 	* location root). Rows on other locations are preserved. Non-segment paths and other devices are ignored.
@@ -631,10 +721,26 @@ var RecordingIndex = class {
 		this.invalidateSorted(deviceId);
 		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$5);
 	}
-	/** Insert/replace one finalized segment (idempotent by path). */
+	/**
+	* Insert/replace one finalized segment (idempotent by path).
+	*
+	* THE hot mutation: every profile-writer lands here every `segmentSeconds`,
+	* ~3.4 times a second fleet-wide. A NEW path is an ordered insert into the
+	* live sorted views (rows arrive roughly ascending, so it is near-appending
+	* — O(log n) search + a short memmove). Only the rare RE-SET of an existing
+	* path (watcher replay after a playlist reset, or a relocate that changes
+	* `locationId`) invalidates: the views hold the old row object, and a
+	* one-off rebuild is the simple correct answer for a case that is not hot.
+	*/
 	addSegment(s) {
-		this.mapFor(s.deviceId).set(s.path, s);
-		this.invalidateSorted(s.deviceId);
+		const m = this.mapFor(s.deviceId);
+		const replacing = m.has(s.path);
+		m.set(s.path, s);
+		if (replacing) {
+			this.invalidateSorted(s.deviceId);
+			return;
+		}
+		this.insertIntoSortedViews(s);
 	}
 	/** Remove segments by relative path, routing each path to the correct device map via its encoded deviceId. */
 	removeSegments(paths) {
@@ -2900,6 +3006,67 @@ async function listExportsFor(state, deviceId) {
 	return [...(await readExports(state)).values()].filter((r) => deviceId === void 0 || r.deviceId === deviceId).toSorted((a, b) => b.createdAt - a.createdAt);
 }
 //#endregion
+//#region src/recorder/addon/spawn-failure.ts
+/**
+* How the recorder reads a `child_process` `'error'` — ONE owner of the
+* transient-vs-permanent question.
+*
+* ── Why this file exists ───────────────────────────────────────────────────
+* In Node a child that cannot be spawned emits `'error'`, and an `'error'`
+* with no listener is re-thrown as an UNCAUGHT EXCEPTION. On 2026-08-18 three
+* cameras were unplugged, every writer for them re-dialled at once, the host
+* momentarily could not fork (`spawn ffmpeg EAGAIN`), and the `recorder`
+* runner died three times inside nine seconds. The D6 crash circuit-breaker
+* did its job and stopped respawning — leaving the whole fleet with no
+* recording for three hours and fifteen minutes while `/health` returned 200.
+*
+* Every ffmpeg spawn site in the recorder therefore attaches an `'error'`
+* listener, and every one of them classifies the failure HERE rather than
+* inventing its own list.
+*/
+/**
+* Spawn failures that RETRYING CANNOT FIX.
+*
+* The EAGAIN-vs-ENOENT split, stated once:
+*
+*   - EAGAIN / EMFILE / ENOMEM are the host saying "not right now". The
+*     resource comes back, often within one backoff. They take the ordinary
+*     restart-with-backoff path, whose own comment already states the policy
+*     for this shape: "only RAPID back-to-back failures count toward giving
+*     up, so a brief blip never permanently stops a camera's recording".
+*   - ENOENT / EACCES are the host saying "there is no ffmpeg here you may
+*     run". Nothing about the next ten attempts differs from this one, so the
+*     caller stops immediately and surfaces it at ERROR level: burning a
+*     ten-attempt budget on a missing binary only delays recovery and buries
+*     the single actionable line under ten identical warnings.
+*
+* EPERM is deliberately absent: it is reported for transient sandbox/cgroup
+* refusals as well as for real permission faults, and treating an ambiguous
+* code as permanent stops a camera that would have recovered.
+*/
+var PERMANENT_SPAWN_CODES = new Set(["ENOENT", "EACCES"]);
+/**
+* Read the `'error'` payload without a cast.
+*
+* An unknown code is treated as TRANSIENT: the cost of retrying something
+* permanent is a bounded restart budget, while the cost of giving up on
+* something transient is a camera that stops recording until an operator
+* notices.
+*/
+function readSpawnFailure(raw) {
+	const code = errnoCode(raw);
+	return {
+		code,
+		message: raw instanceof Error ? raw.message : String(raw),
+		permanent: code !== void 0 && PERMANENT_SPAWN_CODES.has(code)
+	};
+}
+function errnoCode(raw) {
+	if (typeof raw !== "object" || raw === null || !("code" in raw)) return void 0;
+	const code = raw.code;
+	return typeof code === "string" ? code : void 0;
+}
+//#endregion
 //#region src/recorder/addon/export-engine.ts
 /** Stderr lines retained for the failure LOG. ffmpeg prints one line per failed
 *  segment before the decisive "Error opening input" summary, so a short tail can
@@ -3069,7 +3236,7 @@ var ExportEngine = class {
 			outPath,
 			options
 		});
-		const ran = await this.runFfmpeg(id, args, {
+		const ran = await this.runFfmpeg(id, rec.deviceId, args, {
 			totalSec: expectedOutSeconds(rec),
 			floor: 0,
 			ceil: 99
@@ -3089,7 +3256,7 @@ var ExportEngine = class {
 				inputPlaylist: playlist,
 				outPath: concatPath
 			});
-			const concatRan = await this.runFfmpeg(id, concatArgs, {
+			const concatRan = await this.runFfmpeg(id, rec.deviceId, concatArgs, {
 				totalSec: Math.max(.001, (rec.toMs - rec.fromMs) / 1e3),
 				floor: 0,
 				ceil: 49
@@ -3103,7 +3270,7 @@ var ExportEngine = class {
 				outPath,
 				options
 			});
-			const selectRan = await this.runFfmpeg(id, selectArgs, {
+			const selectRan = await this.runFfmpeg(id, rec.deviceId, selectArgs, {
 				totalSec: expectedOutSeconds(rec),
 				floor: 50,
 				ceil: 99
@@ -3115,7 +3282,7 @@ var ExportEngine = class {
 			} catch {}
 		}
 	}
-	runFfmpeg(id, args, progress) {
+	runFfmpeg(id, deviceId, args, progress) {
 		this.deps.logger.debug("export ffmpeg argv", { meta: {
 			exportId: id,
 			args
@@ -3152,6 +3319,24 @@ var ExportEngine = class {
 					stderrTail
 				});
 			});
+			proc.on("error", (raw) => {
+				this.activeProc = null;
+				const failure = readSpawnFailure(raw);
+				this.deps.logger.error("export ffmpeg could not be spawned", {
+					tags: { deviceId },
+					meta: {
+						exportId: id,
+						errorCode: failure.code,
+						error: failure.message,
+						permanent: failure.permanent
+					}
+				});
+				stderrTail.push(`ffmpeg spawn failed: ${failure.message}` + (failure.code === void 0 ? "" : ` (${failure.code})`));
+				resolve({
+					code: null,
+					stderrTail
+				});
+			});
 		});
 	}
 	async finish(id, code, outPath, stderrTail) {
@@ -5837,18 +6022,232 @@ function shouldRecordAt(config, triggers, at) {
 	return eventsBandDemanded(band, triggers, at.getTime());
 }
 /**
-* Should a finalized segment `[segStartMs, segEndMs]` recorded under an
-* `events` band be KEPT (else discarded)? Kept iff it overlaps any qualifying
-* trigger's full window `[trigger - preBufferSec, trigger + postBufferSec]`.
-* This is where `preBufferSec` retroactively retains pre-trigger footage.
+* How late the FIRST segment of an attach may be NAMED, relative to the writer
+* spawn, and still count as "the segment this attach was spawned to produce".
+*
+* ffmpeg names a segment when it OPENS it, which is after the RTSP dial and the
+* first keyframe. Measured on camera 1439 (4K, H.265) on 2026-08-18: writer
+* spawned at trigger+29.5 s, first `high` segment named at trigger+32.7 s —
+* 3.2 s. 5 s carries that with margin while staying far below the writer's own
+* "this is dead" bound (`WRITER_IDLE_MIN_MS`, 90 s), so a writer that is merely
+* slow is not mistaken for one that is producing useful footage.
 */
-function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers) {
+var FIRST_SEGMENT_GRACE_MS = 5e3;
+/**
+* Latest segment START this attach may still produce and have kept, regardless
+* of where the operator's post-buffer ended: one full segment (nothing can be
+* finalized sooner) plus {@link FIRST_SEGMENT_GRACE_MS} of spawn→first-name
+* latency.
+*/
+function attachRetainDeadlineMs(attach) {
+	return attach.attachedAtMs + attach.segmentSeconds * 1e3 + FIRST_SEGMENT_GRACE_MS;
+}
+/**
+* Should a finalized segment `[segStartMs, segEndMs]` recorded under an
+* `events` band be KEPT (else discarded)? Kept iff it overlaps a qualifying
+* trigger's full window `[trigger - preBufferSec, trigger + postBufferSec]` —
+* this is where `preBufferSec` retroactively retains pre-trigger footage — OR
+* it is the footage `attach` was spawned to produce (below).
+*
+* ## Why the attach matters here
+*
+* The LIVE gate ({@link shouldRecordAt}) is evaluated at wall clock; this KEEP
+* gate is evaluated on segment timestamps. They shared one window, and a writer
+* physically cannot finalize anything before `spawn + segmentSeconds + dial`.
+* So the last ~`segmentSeconds` of every demand window was a zone where the
+* recorder was GUARANTEED to attach, pull the camera, and delete 100% of the
+* result: on camera 1439 a trigger reached the recorder 29.5 s into its 30 s
+* post-buffer (hub overload, `busLagMs=142173`), ffmpeg ran 31 s, and all six
+* finalized segments were unlinked.
+*
+* The allowance is deliberately NOT a wider `postBufferSec`: it is anchored to
+* `attachedAtMs`, so a PUNCTUAL attach (the normal case) has a deadline far
+* inside `trigger + postMs` and retains exactly what it retained before. It
+* only ever extends the tail of a LATE attach, by at most one segment plus the
+* grace, and only for a trigger whose live window was still open AT ATTACH — the
+* precise statement of "if the live gate said yes, the keep gate honours the
+* first segment that decision produces". A stale trigger extends nothing.
+*/
+function segmentRetainedForEvents(segStartMs, segEndMs, band, triggers, attach) {
 	const { preMs, postMs } = resolveBandBufferMs(band);
-	const overlaps = (lastMs) => lastMs != null && segStartMs <= lastMs + postMs && segEndMs >= lastMs - preMs;
+	const deadlineMs = attachRetainDeadlineMs(attach);
+	const overlaps = (lastMs) => {
+		if (lastMs == null) return false;
+		if (segEndMs < lastMs - preMs) return false;
+		if (segStartMs <= lastMs + postMs) return true;
+		return attach.attachedAtMs <= lastMs + postMs && segStartMs <= deadlineMs;
+	};
 	if (band.triggers?.motion && overlaps(triggers.lastMotionMs)) return true;
 	if (band.triggers?.audioThresholdDbfs != null && overlaps(triggers.lastAudioMs)) return true;
 	return false;
 }
+/**
+* By how many ms a discarded segment missed being kept — its start past the
+* latest start that WOULD have been retained, mirroring
+* {@link segmentRetainedForEvents}'s upper bound exactly (post-buffer end, or
+* the attach allowance for a trigger that was still live at attach). Null when
+* no qualifying trigger exists at all, which is a different fact and says so.
+*
+* Negative means the segment was dropped on the PRE-buffer side (it ended
+* before `trigger - preBufferSec`), not for being late.
+*
+* Reporting-only. The discard branch has to name a number: "outside the window"
+* with no magnitude made a 2.5 s miss and a 10-minute miss indistinguishable.
+*/
+function segmentMissedByMs(segStartMs, band, triggers, attach) {
+	const { postMs } = resolveBandBufferMs(band);
+	const deadlineMs = attachRetainDeadlineMs(attach);
+	const latestKeptStart = (lastMs) => {
+		if (lastMs == null) return null;
+		const windowEndMs = lastMs + postMs;
+		return attach.attachedAtMs <= windowEndMs ? Math.max(windowEndMs, deadlineMs) : windowEndMs;
+	};
+	const bounds = [band.triggers?.motion === true ? latestKeptStart(triggers.lastMotionMs) : null, band.triggers?.audioThresholdDbfs != null ? latestKeptStart(triggers.lastAudioMs) : null].filter((ms) => ms != null);
+	if (bounds.length === 0) return null;
+	return segStartMs - Math.max(...bounds);
+}
+/** Local-calendar instant for `HH:MM` on the given local Y/M/D (day may overflow). */
+function localInstantMs(year, month, day, hhmm) {
+	const [hours, minutes] = hhmm.split(":");
+	return new Date(year, month, day, Number(hours), Number(minutes), 0, 0).getTime();
+}
+/**
+* Every instant inside the horizon at which `bandActiveAt` COULD change value:
+* each band's start and end on each local day, plus each local midnight (the
+* `days` membership boundary). A superset — cheap to compute (a few dozen
+* entries) and filtered against `activeBandAt` below.
+*/
+function candidateEdgesMs(bands, nowMs) {
+	const base = new Date(nowMs);
+	const year = base.getFullYear();
+	const month = base.getMonth();
+	const day = base.getDate();
+	const out = [];
+	for (let offset = 0; offset <= 8; offset++) {
+		out.push(new Date(year, month, day + offset, 0, 0, 0, 0).getTime());
+		for (const band of bands) {
+			out.push(localInstantMs(year, month, day + offset, band.start));
+			out.push(localInstantMs(year, month, day + offset, band.end));
+		}
+	}
+	return out;
+}
+/**
+* The next instant at which a DIFFERENT band (or no band) covers the clock, or
+* `null` when none exists inside {@link BAND_EDGE_HORIZON_DAYS} — the always-on
+* band (`start === end`, empty `days`) being the common case that legitimately
+* has no edge at all.
+*
+* Identity is by band REFERENCE, which is what makes this exact: two distinct
+* band objects with the same fields yield an edge that changes nothing, which
+* costs one wasted wake-up and never costs footage.
+*/
+function nextBandEdgeMs(config, nowMs) {
+	const bands = config.bands;
+	if (!bands || bands.length === 0) return null;
+	const current = activeBandAt({ bands }, new Date(nowMs));
+	const candidates = [...new Set(candidateEdgesMs(bands, nowMs))].filter((ms) => ms > nowMs).toSorted((a, b) => a - b);
+	for (const ms of candidates) if (activeBandAt({ bands }, new Date(ms)) !== current) return ms;
+	return null;
+}
+/**
+* The first instant an `events` band's demand window is CLOSED, given the
+* triggers it listens for, or `null` when no window is open at `nowMs`.
+*
+* Demand is an OR across the listened trigger kinds, so an open window ends
+* with the LATEST of them — a motion trigger followed by an audio trigger 5 s
+* later keeps the camera attached until the audio one expires, exactly as the
+* sliding window already behaved.
+*/
+function eventsWindowCloseMs(band, triggers, nowMs) {
+	if (band.mode !== "events") return null;
+	const { postMs } = resolveBandBufferMs(band);
+	const ends = [];
+	if (band.triggers?.motion === true && triggers.lastMotionMs != null) ends.push(triggers.lastMotionMs + postMs);
+	if (band.triggers?.audioThresholdDbfs != null && triggers.lastAudioMs != null) ends.push(triggers.lastAudioMs + postMs);
+	const open = ends.filter((ms) => ms >= nowMs);
+	if (open.length === 0) return null;
+	return Math.max(...open) + 1;
+}
+/**
+* THE next instant the controller must re-evaluate this device, or `null` when
+* nothing can change without an event the controller already receives (a
+* trigger or a config write).
+*
+* Whichever of the two sources comes first wins, and the reason is carried so
+* the wake-up is attributable in the log without correlating timestamps.
+*/
+function nextDecisionChangeAt(input) {
+	const { config, triggers, nowMs } = input;
+	if (!config.enabled) return null;
+	const bands = config.bands;
+	if (!bands || bands.length === 0) return null;
+	const band = activeBandAt({ bands }, new Date(nowMs));
+	const edgeMs = nextBandEdgeMs(config, nowMs);
+	const closeMs = band === null ? null : eventsWindowCloseMs(band, triggers, nowMs);
+	if (closeMs === null) return edgeMs === null ? null : {
+		atMs: edgeMs,
+		reason: "band-edge"
+	};
+	if (edgeMs === null || closeMs <= edgeMs) return {
+		atMs: closeMs,
+		reason: "window-close"
+	};
+	return {
+		atMs: edgeMs,
+		reason: "band-edge"
+	};
+}
+//#endregion
+//#region src/recorder/addon/device-wakeups.ts
+/** Node truncates a `setTimeout` delay past this to 1 ms — clamp instead. */
+var MAX_TIMER_DELAY_MS = 2147483647;
+var DeviceWakeups = class {
+	deps;
+	timers = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* Wake this device at `atMs`, replacing any wake-up already armed for it.
+	* `reason` is carried into the log line so a wake is attributable without
+	* correlating it against the band model by hand.
+	*/
+	arm(deviceId, atMs, reason) {
+		this.cancel(deviceId);
+		const delayMs = Math.min(MAX_TIMER_DELAY_MS, Math.max(1, atMs - this.deps.now()));
+		const timer = setTimeout(() => {
+			this.timers.delete(deviceId);
+			this.deps.fire(deviceId);
+		}, delayMs);
+		timer.unref?.();
+		this.timers.set(deviceId, timer);
+		this.deps.logger.debug("recorder: device wake-up armed", {
+			tags: { deviceId },
+			meta: {
+				atMs,
+				delayMs,
+				reason
+			}
+		});
+	}
+	/** Drop this device's pending wake-up, if any. Idempotent. */
+	cancel(deviceId) {
+		const timer = this.timers.get(deviceId);
+		if (timer === void 0) return;
+		clearTimeout(timer);
+		this.timers.delete(deviceId);
+	}
+	/** Drop every pending wake-up — shutdown and maintenance pause. */
+	cancelAll() {
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+	}
+	/** Devices with a wake-up pending — for tests and for shutdown assertions. */
+	get pendingCount() {
+		return this.timers.size;
+	}
+};
 //#endregion
 //#region src/recorder/addon/periodic-pass.ts
 function startPeriodicPass(deps) {
@@ -5915,7 +6314,9 @@ var ReadinessRestore = class {
 		this.deps = deps;
 	}
 	get concurrency() {
-		return Math.max(1, this.deps.concurrency ?? 8);
+		const declared = this.deps.concurrency;
+		const value = typeof declared === "function" ? declared() : declared;
+		return Math.max(1, value ?? 8);
 	}
 	/** Seed the pending set, subscribe to readiness, and drain once immediately
 	*  (covers the already-ready case). Returns when the first drain settles. */
@@ -5974,6 +6375,70 @@ var ReadinessRestore = class {
 		}
 	}
 };
+/** Adaptive bound for the recorder's attach parallelism. */
+var SpawnPressureGovernor = class {
+	deps;
+	limit;
+	min;
+	recoverAfterMs;
+	/** When the limit last MOVED — the clock both directions are measured from. */
+	lastChangeAt;
+	underPressure = false;
+	constructor(deps) {
+		this.deps = deps;
+		this.min = Math.max(1, deps.minConcurrency ?? 1);
+		this.limit = Math.max(this.min, deps.maxConcurrency);
+		this.recoverAfterMs = deps.recoverAfterMs ?? 3e4;
+		this.lastChangeAt = this.now();
+	}
+	/**
+	* How many attaches may overlap right now.
+	*
+	* Reading is what drives recovery: there is no timer to leak, no interval to
+	* lose to a runner respawn, and a recorder that stops attaching entirely
+	* simply keeps its reduced bound until it tries again — which is correct.
+	*/
+	get concurrency() {
+		const max = Math.max(this.min, this.deps.maxConcurrency);
+		if (this.limit >= max) return max;
+		const elapsed = this.now() - this.lastChangeAt;
+		if (elapsed < this.recoverAfterMs) return this.limit;
+		const lanes = Math.floor(elapsed / this.recoverAfterMs);
+		this.limit = Math.min(max, this.limit + lanes);
+		this.lastChangeAt += lanes * this.recoverAfterMs;
+		if (this.limit >= max && this.underPressure) {
+			this.underPressure = false;
+			this.deps.logger?.info("recorder: spawn pressure cleared — attach concurrency restored", { meta: { concurrency: this.limit } });
+		} else this.deps.logger?.info("recorder: recovering attach concurrency", { meta: {
+			concurrency: this.limit,
+			max
+		} });
+		return this.limit;
+	}
+	/**
+	* A transient spawn failure happened on `deviceId`'s writer.
+	*
+	* Halves the CURRENT limit, not the max: two waves of pressure inside one
+	* recovery window must compound, or a host under sustained load is asked for
+	* the same too-large batch over and over.
+	*/
+	report(deviceId) {
+		const before = this.limit;
+		this.limit = Math.max(this.min, Math.floor(this.limit / 2));
+		this.lastChangeAt = this.now();
+		this.underPressure = true;
+		this.deps.logger?.warn("recorder: spawn pressure — reducing attach concurrency", {
+			tags: { deviceId },
+			meta: {
+				from: before,
+				to: this.limit
+			}
+		});
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+};
 //#endregion
 //#region src/recorder/addon/segment-watcher.ts
 /**
@@ -6359,36 +6824,87 @@ var SegmentWriter = class {
 				if (stderrTail.length > STDERR_TAIL_LINES) stderrTail.shift();
 			}
 		});
+		let settled = false;
+		const terminate = (termination) => {
+			if (settled) return;
+			settled = true;
+			this.onTermination(termination, stderrTail);
+		};
 		proc.on("exit", (code) => {
-			this.resolveExit?.();
-			this.resolveExit = null;
-			this.proc = null;
-			if (this.stopped) return;
-			const ranMs = Date.now() - this.startedAt;
-			if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
-			if (this.restarts >= MAX_RESTARTS) {
-				this.deps.logger.warn("SegmentWriter giving up after max restarts", { meta: {
+			terminate({
+				reason: "exit",
+				exitCode: typeof code === "number" ? code : null
+			});
+		});
+		proc.on("error", (raw) => {
+			const failure = readSpawnFailure(raw);
+			terminate({
+				reason: "spawn-error",
+				errorCode: failure.code,
+				message: failure.message,
+				permanent: failure.permanent
+			});
+		});
+	}
+	/**
+	* The ONE restart policy, reached from both `exit` and `error`.
+	*
+	* `deps.logger` is the device-scoped child the controller binds
+	* (`logger.withTags({ deviceId })`), so every line below carries
+	* `tags: { deviceId }` — "why is 617 worse than 615" is always asked per
+	* camera, and a writer that stops recording one camera must be greppable by
+	* that camera.
+	*/
+	onTermination(termination, stderrTail) {
+		this.resolveExit?.();
+		this.resolveExit = null;
+		this.proc = null;
+		if (this.stopped) return;
+		const ranMs = Date.now() - this.startedAt;
+		if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
+		if (termination.reason === "spawn-error") {
+			this.deps.logger.warn("SegmentWriter ffmpeg spawn failed", { meta: {
+				outDir: this.cfg.outDir,
+				errorCode: termination.errorCode,
+				error: termination.message,
+				permanent: termination.permanent
+			} });
+			if (termination.permanent) {
+				this.deps.logger.error("SegmentWriter giving up: ffmpeg cannot be executed on this node", { meta: {
 					outDir: this.cfg.outDir,
-					code,
-					stderrTail: stderrTail.join(" | ")
+					errorCode: termination.errorCode,
+					error: termination.message
 				} });
 				this.stopped = true;
 				this.deps.onGaveUp?.();
 				return;
 			}
-			this.restarts++;
-			const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
-			this.deps.logger.info("SegmentWriter restarting", { meta: {
+			this.deps.onResourcePressure?.();
+		}
+		if (this.restarts >= MAX_RESTARTS) {
+			this.deps.logger.warn("SegmentWriter giving up after max restarts", { meta: {
 				outDir: this.cfg.outDir,
-				attempt: this.restarts,
-				delayMs,
-				ranMs
+				reason: termination.reason,
+				code: termination.reason === "exit" ? termination.exitCode : termination.errorCode,
+				stderrTail: stderrTail.join(" | ")
 			} });
-			this.restartTimer = setTimeout(() => {
-				this.restartTimer = null;
-				this.start();
-			}, delayMs);
-		});
+			this.stopped = true;
+			this.deps.onGaveUp?.();
+			return;
+		}
+		this.restarts++;
+		const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
+		this.deps.logger.info("SegmentWriter restarting", { meta: {
+			outDir: this.cfg.outDir,
+			attempt: this.restarts,
+			delayMs,
+			ranMs,
+			reason: termination.reason
+		} });
+		this.restartTimer = setTimeout(() => {
+			this.restartTimer = null;
+			this.start();
+		}, delayMs);
 	}
 	stop() {
 		this.stopAndWait();
@@ -6432,19 +6948,37 @@ var SegmentWriter = class {
 *   - a `live.m3u8` `SegmentWatcher` that hands each finalized flat segment to
 *     the v2 `SegmentStore.onFinalized` (stat + relocate + index).
 *
-* Per device it decides whether a CONTINUOUS band is active right now
-* (`shouldRecordContinuousAt`) and ensures the writer set is running iff so.
-* It re-evaluates on three triggers:
-*   1. `setDeviceConfig` (operator changed the bands / enable),
-*   2. a periodic pass (catches band boundaries crossed with no config change),
-*   3. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`).
-*
-* There are TWO periodic passes, on separate timers and never overlapping
-* themselves (`periodic-pass.ts`): a cheap LIVENESS pass that catches writers
-* pinned but producing nothing, and an expensive CONVERGENCE pass that
-* re-evaluates bands and placement. They were one pass until 2026-08-13, when a
-* convergence sweep wedged on unbounded broker RPCs and took the liveness
-* watchdog down with it for 9-27 minutes at a time.
+* Per device it decides whether the active band demands recording right now
+* (`shouldRecordAt`) and ensures the writer set is running iff so. Convergence
+* is EVENT-DRIVEN; the periodic pass is a backstop, not the mechanism:
+*   1. `setDeviceConfig` (operator changed the bands / enable) — an RPC,
+*   2. a qualifying motion/audio trigger (`onTrigger`) — opens a window,
+*   3. a per-device WAKE-UP armed for the exact instant the decision could
+*      change on its own (`decision-schedule.ts` + `device-wakeups.ts`): an
+*      `events` window closing at `lastTrigger + postBufferSec`, or a band edge,
+*   4. a `stream-broker` ready transition (boot restore — via `ReadinessRestore`),
+*   5. the periodic RECONCILE (below), for everything the four above can lose.
+*
+* (3) is why a detach is now punctual. A trigger only ever OPENED a window — the
+* demand test is a sliding `atMs - lastMotionMs <= postMs` anchored on the LAST
+* trigger, so nothing called `evaluateDevice` at the moment it closed and the
+* detach waited for the next pass. A 4K camera stayed dialled, decoded and
+* written for up to a whole tick past the operator's `postBufferSec`.
+*
+* There are THREE periodic passes, each on its own timer and each non-overlapping
+* (`periodic-pass.ts`):
+*   - LIVENESS ({@link LIVENESS_TICK_MS}) — cheap, in-memory: is a pinned writer
+*     producing nothing?
+*   - PLACEMENT ({@link PLACEMENT_TICK_MS}) — cheap (a statfs per location), and
+*     deliberately NOT on the attach beat, so a cold broker cannot delay it.
+*   - RECONCILE ({@link RECONCILE_TICK_MS}) — the only one that can touch the
+*     broker, and the only backstop for a lost wake-up or a failed attach.
+*
+* They were ONE pass until 2026-08-13, when a convergence sweep wedged on
+* unbounded broker RPCs and took the liveness watchdog down with it for 9-27
+* minutes at a time; placement was split out of the second on 2026-08-18, after
+* a converge pass blocked for 60 001 ms (3 x {@link ATTACH_RPC_TIMEOUT_MS})
+* cold-dialling ~40 RTSP sources.
 *
 * EVENTS bands are treated as "not recording continuously" in B2 — B3 adds
 * trigger-gating. The enable intent is persisted in durable-state by the
@@ -6457,8 +6991,45 @@ var SegmentWriter = class {
 * `ReadinessRegistry` is the single source of truth.
 */
 var DEFAULT_WATCH_INTERVAL_MS = 2e3;
-/** Periodic re-evaluation to catch band boundaries crossed with no config change. */
-var TICK_MS = 3e4;
+/**
+* Liveness cadence — "is a pinned writer producing nothing?". Unchanged: the
+* question is an in-memory scan over `active`, it costs nothing, and its bound
+* (`writerIdleBoundMs`, floor 90 s) is sized against this beat.
+*/
+var LIVENESS_TICK_MS = 3e4;
+/**
+* Placement cadence — unchanged from the beat it used to share with
+* convergence, because nothing about placement wanted to be rarer. What changed
+* is that it no longer rides a pass that can block on broker RPCs: it is one
+* `statfs` per location and it re-plans only, so a plan reaches a camera at its
+* NEXT attach.
+*/
+var PLACEMENT_TICK_MS = 3e4;
+/**
+* Reconcile cadence — the SAFETY NET, not the mechanism.
+*
+* It was 30 s because it WAS the mechanism: nothing else ever closed an `events`
+* window or crossed a band edge, so the loop had to keep asking. Both are now
+* armed for their exact instant (`decision-schedule.ts`), a config change is an
+* RPC, and a broker recovery is a readiness transition — so this pass exists
+* only for what those cannot cover: a wake-up lost because the event path threw
+* before it could arm one, an attach that failed with no later ready transition
+* to ride, a timer lost to a runner respawn, and clock drift.
+*
+* 2 minutes, and the number is chosen against a bound this recorder already
+* accepts. The liveness watchdog tolerates a pinned-but-silent writer for
+* `WRITER_IDLE_MIN_MS` (90 s) before it recovers it; a device that WANTS
+* recording but is detached is the same class of fault — footage is not being
+* written and only a periodic check will notice — so its recovery is put on the
+* same order rather than an order slower. Four times rarer than the beat that
+* blocked for 60 001 ms on 2026-08-18, while still bounding the worst case at
+* ~2 minutes of footage for a camera whose event path failed entirely.
+*
+* Going rarer than this trades real footage for CPU that the pass no longer
+* spends anyway: with the broker-readiness pre-check below, a reconcile over a
+* healthy fleet is N config reads and no RPC at all.
+*/
+var RECONCILE_TICK_MS = 12e4;
 /**
 * Bound on the broker lease-release RPC (`releaseStreamWithCodec`) during
 * teardown. The UDS request default is 60s, but the runner supervisor's
@@ -6497,11 +7068,15 @@ var RELEASE_RPC_TIMEOUT_MS = 2e3;
 */
 var ATTACH_RPC_TIMEOUT_MS = 2e4;
 /**
-* A pass longer than this is reported with its duration. Equal to the pass
-* cadence: a pass that cannot finish inside its own interval is the condition
-* that used to go unlogged for half an hour.
+* A pass longer than this is reported with its duration. Each pass uses its OWN
+* cadence as the budget: a pass that cannot finish inside its own interval is
+* the condition that used to go unlogged for half an hour. Keeping it per-pass
+* matters now that the three cadences differ — a 40 s reconcile is healthy
+* against a 120 s beat and was a red flag against a 30 s one.
 */
-var PASS_SLOW_AFTER_MS = TICK_MS;
+function passSlowAfterMs(intervalMs) {
+	return intervalMs;
+}
 /**
 * Race `promise` against a deadline. Handlers stay attached to the losing
 * promise, so a post-deadline settlement can never surface as a process-level
@@ -6584,6 +7159,14 @@ var RecordingController = class {
 	*/
 	lastSegmentAt = /* @__PURE__ */ new Map();
 	/**
+	* Per `deviceId:profile`, the `attachedAtMs` of the attach that has retained
+	* at least one `events` segment. Read only to LEVEL the discard log: an
+	* attach that kept nothing is a wasted pull (warn), a later discard from one
+	* that kept something is the tail of the window (info). Bounded by
+	* device×profile like {@link lastSegmentAt}, and cleared with it on detach.
+	*/
+	attachRetained = /* @__PURE__ */ new Map();
+	/**
 	* Devices already named by {@link reportUnrecordable} — one warn per device
 	* per "enabled but can never record" episode, re-armed as soon as the device
 	* records again.
@@ -6597,24 +7180,91 @@ var RecordingController = class {
 	*/
 	skippedProfiles = /* @__PURE__ */ new Map();
 	restore = null;
+	/**
+	* One pending wake-up per device, armed for the exact instant its recording
+	* decision could change on its own — an `events` window closing or a band
+	* edge. THE reason a detach is punctual instead of up to a pass late.
+	*/
+	wakeups;
 	/** Cheap, never-delayed: is any pinned writer producing nothing? */
 	livenessPass = null;
-	/** Expensive: re-evaluate bands + placement for every configured device. */
-	convergePass = null;
+	/** Cheap, and off the attach beat: re-plan where each (device, profile) writes. */
+	placementPass = null;
+	/** The backstop: re-evaluate every tracked-or-configured device. */
+	reconcilePass = null;
 	stopped = false;
 	/** A reversible maintenance lease. Unlike `stopped`, it never changes
 	* persisted recording intent and `resume()` restarts normal convergence. */
 	paused = false;
+	/**
+	* The ADAPTIVE attach bound. A transient `spawn ffmpeg` failure (EAGAIN) is
+	* the host saying it cannot fork right now, and the answer is to attach
+	* FEWER cameras at once — not to serialise them, which `e2fa17a2b` removed
+	* for good reason. Every bounded-parallel attach in this file reads it.
+	*/
+	spawnPressure;
 	constructor(deps) {
 		this.deps = deps;
+		this.spawnPressure = new SpawnPressureGovernor({
+			maxConcurrency: 8,
+			now: () => this.now(),
+			logger: deps.logger
+		});
+		this.wakeups = new DeviceWakeups({
+			logger: deps.logger,
+			now: () => this.now(),
+			fire: (deviceId) => this.onWakeup(deviceId)
+		});
 	}
 	now() {
 		return this.deps.now?.() ?? Date.now();
 	}
 	/**
+	* A per-device wake-up came due: re-decide. `evaluateDevice` re-arms (or
+	* cancels) the next one as part of deciding, so the chain is self-sustaining.
+	*
+	* A throw here breaks that chain — the device keeps whatever state it had and
+	* has no timer behind it — so it is NAMED, and the reconcile is what picks it
+	* up. Silence would read as "the window never closed".
+	*/
+	onWakeup(deviceId) {
+		this.evaluateDevice(deviceId).catch((err) => {
+			this.deps.logger.warn("recorder: scheduled re-evaluation failed — no wake-up re-armed (the reconcile is the backstop)", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		});
+	}
+	/**
+	* Arm (or cancel) this device's next wake-up from the config it was just
+	* evaluated against.
+	*
+	* Called from `evaluateDevice` BEFORE the attach/detach work, not after: the
+	* attach chain can throw (broker not ready, stream unpublished) and the
+	* schedule does not depend on whether it succeeded. Arming first means a
+	* failed attach still gets its band edge, and only a failure to READ the
+	* config can lose a wake-up.
+	*/
+	scheduleNextDecision(deviceId, config) {
+		if (this.stopped || this.paused) {
+			this.wakeups.cancel(deviceId);
+			return;
+		}
+		const next = nextDecisionChangeAt({
+			config,
+			triggers: this.triggersFor(deviceId),
+			nowMs: this.now()
+		});
+		if (next === null) {
+			this.wakeups.cancel(deviceId);
+			return;
+		}
+		this.wakeups.arm(deviceId, next.atMs, next.reason);
+	}
+	/**
 	* Boot restore: seed the readiness-gated queue with every persisted device and
 	* (re)evaluate each on every `stream-broker` ready transition. Also arms the
-	* periodic tick. Idempotent — safe to call once after the index is hydrated.
+	* periodic passes. Idempotent — safe to call once after the index is hydrated.
 	*/
 	async start() {
 		if (this.stopped) return;
@@ -6627,6 +7277,7 @@ var RecordingController = class {
 		}
 		this.restore = new ReadinessRestore({
 			subscribeReady: (handler) => this.deps.onBrokerReady(handler),
+			concurrency: () => this.spawnPressure.concurrency,
 			attempt: async (deviceId) => {
 				await this.evaluateDevice(deviceId);
 			},
@@ -6635,45 +7286,83 @@ var RecordingController = class {
 				meta: { error: errMsg(err) }
 			})
 		});
-		if (this.convergePass === null) {
+		if (this.reconcilePass === null) {
 			this.livenessPass = startPeriodicPass({
 				name: "liveness",
-				intervalMs: TICK_MS,
-				slowAfterMs: PASS_SLOW_AFTER_MS,
+				intervalMs: LIVENESS_TICK_MS,
+				slowAfterMs: passSlowAfterMs(LIVENESS_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
 				run: () => this.checkIdleWriters()
 			});
-			this.convergePass = startPeriodicPass({
-				name: "convergence",
-				intervalMs: TICK_MS,
-				slowAfterMs: PASS_SLOW_AFTER_MS,
+			this.placementPass = startPeriodicPass({
+				name: "placement",
+				intervalMs: PLACEMENT_TICK_MS,
+				slowAfterMs: passSlowAfterMs(PLACEMENT_TICK_MS),
+				logger: this.deps.logger,
+				now: () => this.now(),
+				run: () => this.replanPlacement()
+			});
+			this.reconcilePass = startPeriodicPass({
+				name: "reconcile",
+				intervalMs: RECONCILE_TICK_MS,
+				slowAfterMs: passSlowAfterMs(RECONCILE_TICK_MS),
 				logger: this.deps.logger,
 				now: () => this.now(),
-				run: () => this.converge()
+				run: () => this.reconcile()
 			});
 		}
 		await this.restore.start(ids.map((id) => [id, true]));
 	}
-	/** Re-evaluate every currently-tracked OR active device on the periodic pass. */
-	async converge() {
-		if (this.stopped) return;
+	/**
+	* Every device the recorder is responsible for right now: those with writers
+	* attached, plus every one with a persisted config. A failure to enumerate the
+	* persisted set degrades to "the active ones" rather than aborting the pass.
+	*/
+	async trackedDeviceIds() {
 		const ids = new Set(this.active.keys());
-		let persisted = [];
 		try {
-			persisted = await this.deps.enabledDeviceIds();
-		} catch {}
-		for (const id of persisted) ids.add(id);
+			for (const id of await this.deps.enabledDeviceIds()) ids.add(id);
+		} catch (err) {
+			this.deps.logger.warn("recorder controller: could not enumerate persisted devices — this pass covers the active ones only", { meta: {
+				error: errMsg(err),
+				activeDevices: this.active.size
+			} });
+		}
+		return [...ids];
+	}
+	/**
+	* Re-plan where each (device, profile) writes. Its OWN pass: cheap (no I/O
+	* beyond a statfs per location), and it must not be starved by an attach that
+	* is waiting on a 20 s broker timeout. It changes the PLAN only — a running
+	* writer keeps its root until it next attaches, which is the boundary rule.
+	*/
+	async replanPlacement() {
+		if (this.stopped || this.paused) return;
+		if (this.deps.onPlacementTick === void 0) return;
+		const ids = await this.trackedDeviceIds();
 		try {
-			await this.deps.onPlacementTick?.([...ids]);
+			await this.deps.onPlacementTick(ids);
 		} catch (err) {
 			this.deps.logger.warn("recorder controller: placement recompute failed", { meta: { error: errMsg(err) } });
 		}
-		await runBounded([...ids], 8, async (id) => {
+	}
+	/**
+	* The backstop pass: re-evaluate every tracked-or-configured device.
+	*
+	* Nothing here is the normal path any more — a window close, a band edge, a
+	* config change and a broker recovery all reach `evaluateDevice` on their own.
+	* This exists for the four things that cannot: a wake-up the event path threw
+	* before arming, an attach that failed with no later readiness transition to
+	* ride, a timer lost to a runner respawn, and clock drift.
+	*/
+	async reconcile() {
+		if (this.stopped) return;
+		await runBounded(await this.trackedDeviceIds(), this.spawnPressure.concurrency, async (id) => {
 			try {
 				await this.evaluateDevice(id);
 			} catch (err) {
-				this.deps.logger.warn("recorder controller: convergence evaluate failed", {
+				this.deps.logger.warn("recorder controller: reconcile evaluate failed", {
 					tags: { deviceId: id },
 					meta: { error: errMsg(err) }
 				});
@@ -6697,8 +7386,9 @@ var RecordingController = class {
 	* idle source can re-dial cleanly), then re-evaluate: if the band still demands
 	* recording, `evaluateDevice` re-queues + re-attaches a fresh writer set. If
 	* the broker is not ready, the re-attach throws and the device stays on the
-	* readiness queue (retried on the next broker ready) — and the periodic tick is
-	* the backstop. Bounded OUTER retry (TICK_MS cadence), never a tight loop.
+	* readiness queue (retried on the next broker ready) — and the periodic
+	* reconcile is the backstop. Bounded OUTER retry (RECONCILE_TICK_MS cadence),
+	* never a tight loop.
 	*/
 	async recoverWriterGaveUp(deviceId) {
 		if (this.stopped) return;
@@ -6708,7 +7398,7 @@ var RecordingController = class {
 			await this.evaluateDevice(deviceId);
 		} catch (err) {
 			this.restore?.add(deviceId, true);
-			this.deps.logger.warn("recorder: writer give-up recovery deferred (retries on next broker ready/tick)", {
+			this.deps.logger.warn("recorder: writer give-up recovery deferred (retries on next broker ready/reconcile)", {
 				tags: { deviceId },
 				meta: { error: errMsg(err) }
 			});
@@ -6759,10 +7449,16 @@ var RecordingController = class {
 	}
 	/**
 	* Record a qualifying trigger (motion/audio) for a device and converge: an
-	* `events` band whose window this opens attaches now; the periodic tick
-	* detaches it once `postBufferSec` elapses. Called from the addon's
-	* EventCapture subscription. The qualification test (motion detected / audio
-	* over threshold) is done upstream — by the time we're here, it qualified.
+	* `events` band whose window this opens attaches now, and the same
+	* `evaluateDevice` arms the wake-up that will CLOSE it at
+	* `atMs + postBufferSec`. Called from the addon's EventCapture subscription.
+	* The qualification test (motion detected / audio over threshold) is done
+	* upstream — by the time we're here, it qualified.
+	*
+	* A fresher trigger re-arms the wake-up later, which is exactly how the
+	* sliding window already behaved: continuous motion stays ONE recording,
+	* because `evaluateDevice` short-circuits at "already recording — converged"
+	* and only the timer moves.
 	*/
 	async onTrigger(deviceId, source, atMs) {
 		if (this.stopped) return;
@@ -6774,7 +7470,7 @@ var RecordingController = class {
 		try {
 			await this.evaluateDevice(deviceId);
 		} catch (err) {
-			this.deps.logger.warn("recorder: trigger attach deferred — stream not available yet (retries on next broker ready/tick)", {
+			this.deps.logger.warn("recorder: trigger attach deferred — stream not available yet (retries on next broker ready/reconcile)", {
 				tags: { deviceId },
 				meta: {
 					source,
@@ -6795,7 +7491,9 @@ var RecordingController = class {
 		if (this.stopped || this.paused) return;
 		const config = await this.deps.loadConfig(deviceId);
 		if (this.stopped || this.paused) return;
-		if (!shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()))) {
+		const wantRecording = shouldRecordAt(config, this.triggersFor(deviceId), new Date(this.now()));
+		this.scheduleNextDecision(deviceId, config);
+		if (!wantRecording) {
 			this.reportUnrecordable(deviceId, config);
 			await this.detachDevice(deviceId);
 			this.restore?.remove(deviceId);
@@ -6854,6 +7552,15 @@ var RecordingController = class {
 		});
 	}
 	/**
+	* Throw before spending a single broker RPC when the registry already says the
+	* `stream-broker` on the owner node is not ready. See
+	* {@link RecordingControllerDeps.brokerReady}; absent → assume ready.
+	*/
+	failFastIfBrokerCold(deviceId) {
+		if (this.deps.brokerReady?.() !== false) return;
+		throw new Error(`recorder controller: stream-broker not ready on ${this.deps.ownerNodeId} — attach for device ${deviceId} deferred to the next ready transition`);
+	}
+	/**
 	* The attach body — extracted so the {@link attaching} in-flight guard in
 	* `evaluateDevice` wraps it cleanly. Resolves the profiles, spawns a
 	* SegmentWriter + watcher per profile, and records the set in `active`.
@@ -6865,6 +7572,7 @@ var RecordingController = class {
 	*/
 	async performAttach(deviceId, config) {
 		this.restore?.add(deviceId, true);
+		this.failFastIfBrokerCold(deviceId);
 		const profiles = await this.resolveProfiles(deviceId, config.profiles);
 		if (profiles.length === 0) throw new Error(`recorder controller: no assigned broker sources for device ${deviceId}`);
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
@@ -6922,6 +7630,16 @@ var RecordingController = class {
 		}
 	}
 	async runFillMissingProfiles(deviceId, config, current, skipped) {
+		if (this.deps.brokerReady?.() === false) {
+			this.deps.logger.info("recorder: skipped-profile retry deferred — stream-broker not ready (healthy profiles keep recording)", {
+				tags: { deviceId },
+				meta: {
+					profiles: [...skipped],
+					ownerNodeId: this.deps.ownerNodeId
+				}
+			});
+			return;
+		}
 		const have = new Set(current.map((r) => r.profile));
 		const segmentSeconds = config.segmentSeconds ?? this.deps.segmentSeconds;
 		const added = [];
@@ -6999,7 +7717,8 @@ var RecordingController = class {
 			logger: deviceLog,
 			onGaveUp: () => {
 				this.recoverWriterGaveUp(deviceId);
-			}
+			},
+			onResourcePressure: () => this.spawnPressure.report(deviceId)
 		});
 		const writerStartedMs = this.now();
 		writer.start();
@@ -7014,7 +7733,10 @@ var RecordingController = class {
 				intervalMs: this.deps.watchIntervalMs > 0 ? this.deps.watchIntervalMs : DEFAULT_WATCH_INTERVAL_MS,
 				onFinalized: async (startMs, durMs, flatAbsPath) => {
 					this.lastSegmentAt.set(idleKey(deviceId, profile), this.now());
-					await this.handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath);
+					await this.handleFinalizedSegment(deviceId, profile, placement, {
+						attachedAtMs: writerStartedMs,
+						segmentSeconds
+					}, startMs, durMs, flatAbsPath);
 				},
 				logger: deviceLog
 			}),
@@ -7031,13 +7753,16 @@ var RecordingController = class {
 	* keep/discard gate touches `events`-mode segments only, so the continuous
 	* path is unchanged.
 	*/
-	async handleFinalizedSegment(deviceId, profile, placement, startMs, durMs, flatAbsPath) {
+	async handleFinalizedSegment(deviceId, profile, placement, attach, startMs, durMs, flatAbsPath) {
 		try {
 			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
-			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, this.triggersFor(deviceId))) {
+			const triggers = this.triggersFor(deviceId);
+			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, triggers, attach)) {
+				this.reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs);
 				await promises.unlink(flatAbsPath).catch(() => {});
 				return;
 			}
+			if (band?.mode === "events") this.attachRetained.set(idleKey(deviceId, profile), attach.attachedAtMs);
 			await this.deps.segmentStore.onFinalized({
 				deviceId,
 				profile,
@@ -7058,6 +7783,47 @@ var RecordingController = class {
 		}
 	}
 	/**
+	* Name a discarded `events`-band segment. This branch deletes recorded
+	* footage and used to write NOTHING: on camera 1439 the operator saw `pinned`
+	* then `unpinned` with an empty timeline in between and no line anywhere said
+	* why — the recorder had spawned ffmpeg, pulled 4K RTSP for 31 s and unlinked
+	* every segment it produced.
+	*
+	* Level is chosen, not defaulted. A discard at the TAIL of a window is the
+	* feature working (`info`) — the writer keeps running until the next converge
+	* tick and those trailing segments were never asked for. A discard from an
+	* attach that has retained NOTHING is a fault (`warn`): the whole pull was
+	* wasted, which is exactly the shape of the 1439 loss and of any future
+	* regression in the attach allowance.
+	*/
+	reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs) {
+		const { preMs, postMs } = resolveBandBufferMs(band);
+		const keptAnything = this.attachRetained.get(idleKey(deviceId, profile)) === attach.attachedAtMs;
+		const meta = {
+			profile,
+			startMs,
+			durMs,
+			lastMotionMs: triggers.lastMotionMs,
+			lastAudioMs: triggers.lastAudioMs,
+			postMs,
+			preMs,
+			attachedAtMs: attach.attachedAtMs,
+			missedByMs: segmentMissedByMs(startMs, band, triggers, attach),
+			keptAnythingFromThisAttach: keptAnything
+		};
+		if (keptAnything) {
+			this.deps.logger.info("recorder: discarding events segment outside every trigger window (tail of the window)", {
+				tags: { deviceId },
+				meta
+			});
+			return;
+		}
+		this.deps.logger.warn("recorder: discarding events segment — this attach has retained NOTHING, the whole pull is wasted", {
+			tags: { deviceId },
+			meta
+		});
+	}
+	/**
 	* Resolve the storage location a (device, profile) writes to, at an attach
 	* boundary. Delegates to the injected {@link RecordingControllerDeps.placeProfile}
 	* when the addon supplied one; otherwise to the pure `resolvePlacement` in
@@ -7099,7 +7865,10 @@ var RecordingController = class {
 		if (!recordings) return;
 		this.active.delete(deviceId);
 		this.skippedProfiles.delete(deviceId);
-		for (const r of recordings) this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
+		for (const r of recordings) {
+			this.lastSegmentAt.delete(idleKey(deviceId, r.profile));
+			this.attachRetained.delete(idleKey(deviceId, r.profile));
+		}
 		await Promise.all(recordings.map((r) => this.teardownProfile(deviceId, r)));
 		this.deps.logger.info("recorder unpinned broker source(s) — recording stopped", {
 			tags: { deviceId },
@@ -7110,6 +7879,7 @@ var RecordingController = class {
 	async pause() {
 		if (this.stopped || this.paused) return;
 		this.paused = true;
+		this.wakeups.cancelAll();
 		while (this.attachingTasks.size > 0) await Promise.allSettled([...this.attachingTasks.values()]);
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));
 	}
@@ -7125,13 +7895,16 @@ var RecordingController = class {
 		}
 		for (const deviceId of ids) await this.evaluateDevice(deviceId);
 	}
-	/** Tear EVERYTHING down: timer, restore subscription, every writer/watcher/lease. */
+	/** Tear EVERYTHING down: timers, restore subscription, every writer/watcher/lease. */
 	async stop() {
 		this.stopped = true;
+		this.wakeups.cancelAll();
 		this.livenessPass?.stop();
 		this.livenessPass = null;
-		this.convergePass?.stop();
-		this.convergePass = null;
+		this.placementPass?.stop();
+		this.placementPass = null;
+		this.reconcilePass?.stop();
+		this.reconcilePass = null;
 		this.restore?.stop();
 		this.restore = null;
 		await Promise.all(Array.from(this.active.keys()).map((deviceId) => this.detachDevice(deviceId)));
@@ -8420,6 +9193,23 @@ var PLAYBACK_PREFIX = "playback";
 /** Data-plane prefix for on-demand single stills →
 *  `/addon/recorder/still/<deviceId>/<epochSec>`. */
 var STILL_PREFIX = "still";
+/**
+* Bound on pending hour-ledger writes (one per finalized segment, an RPC to
+* the hub store). Steady state completes in milliseconds and holds ~0–2; under
+* a store stall the fleet-wide finalize rate (~3.4/s) fills 256 in ~75s of
+* grace before refusals begin. Each pending write holds one hour-row copy
+* (≤360 paths ≈ ~25KB), so the lane's worst-case heap is single-digit MB —
+* a dropped write is one silent re-seed from the archive walk (D148).
+*/
+var LEDGER_GATE_LIMIT = 256;
+/**
+* Bound on pending mfra tail reads (one per finalized RECENT segment; each is
+* an open + two reads on the same 4-thread libuv pool the live writers use,
+* holding read buffers while pending). 64 bounds both the held memory and the
+* pool contention; a dropped capture costs that segment's client one extra
+* round trip to the file's tail on the first seek.
+*/
+var MFRA_GATE_LIMIT = 64;
 /** Data-plane prefix for export MP4 downloads → `/addon/recorder/exports/<id>.mp4`. */
 var EXPORTS_PREFIX = "exports";
 /** How often the export janitor sweeps expired exports. */
@@ -8496,6 +9286,25 @@ var RecorderV2Addon = class extends BaseAddon {
 	/** Sync-sample tables captured at finalize, served by the directory so a
 	*  playback seek needs no mfra tail fetch. RAM-only, TTL-bounded. */
 	mfraTables = new MfraTableStore();
+	/** Bound on the per-finalize fire-and-forget lanes (item 3, 2026-08-18): a
+	*  disk/store stall must throttle this work, never balloon live heap — the
+	*  unbounded pending set is what fed the two `Ineffective mark-compacts`
+	*  fatals. Saturation is reported loudly but throttled; every individual
+	*  drop is logged with its deviceId at the call site. */
+	ledgerWriteGate = new PendingGate({
+		label: "hour-ledger",
+		limit: LEDGER_GATE_LIMIT,
+		onSaturated: (report) => {
+			this.reportGateSaturated(report);
+		}
+	});
+	mfraCaptureGate = new PendingGate({
+		label: "mfra-capture",
+		limit: MFRA_GATE_LIMIT,
+		onSaturated: (report) => {
+			this.reportGateSaturated(report);
+		}
+	});
 	/** Continuous + events band write-path controller (ffmpeg writers + watchers). */
 	controller = null;
 	/** Per-device motion/audio markers for playback (B3 events feed the controller). */
@@ -8533,6 +9342,20 @@ var RecorderV2Addon = class extends BaseAddon {
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
+	/**
+	* One throttled line per saturated lane per report interval. Lane-level (no
+	* deviceId — the lane aggregates every camera); the per-drop debug lines at
+	* the call sites carry the tag. WARN because a saturated lane means the
+	* store or the disk is stalling under live finalize load — the line that
+	* explains the missing ledger hours and mfra misses an operator will see.
+	*/
+	reportGateSaturated(report) {
+		this.ctx.logger.warn("recorder: fire-and-forget lane saturated — dropping over the bound", { meta: {
+			lane: report.label,
+			dropped: report.dropped,
+			pending: report.pending
+		} });
+	}
 	async onInitialize() {
 		const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
 		this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
@@ -8596,18 +9419,28 @@ var RecorderV2Addon = class extends BaseAddon {
 				this.segmentHours?.dropSegments(rows);
 			},
 			onIndexed: (row, absPath) => {
-				this.segmentHours?.recordSegment(row);
+				const ledger = this.segmentHours;
+				if (ledger && !this.ledgerWriteGate.run(() => ledger.recordSegment(row))) this.ctx.logger.debug("recorder: hour-ledger write dropped — lane saturated; the archive walk reconciles this hour", {
+					tags: { deviceId: row.deviceId },
+					meta: { path: row.path }
+				});
 				if (!isMfraTableServable(row.startMs, Date.now())) return;
-				readMfraTable(absPath, row.bytes).then((table) => {
-					this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
-				}).catch((err) => {
-					this.ctx.logger.debug("mfra capture failed", {
-						tags: { deviceId: row.deviceId },
-						meta: {
-							path: row.path,
-							error: errMsg(err)
-						}
-					});
+				if (!this.mfraCaptureGate.run(async () => {
+					try {
+						const table = await readMfraTable(absPath, row.bytes);
+						this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
+					} catch (err) {
+						this.ctx.logger.debug("mfra capture failed", {
+							tags: { deviceId: row.deviceId },
+							meta: {
+								path: row.path,
+								error: errMsg(err)
+							}
+						});
+					}
+				})) this.ctx.logger.debug("recorder: mfra capture dropped — lane saturated; first seek pays one tail fetch", {
+					tags: { deviceId: row.deviceId },
+					meta: { path: row.path }
 				});
 			},
 			removeDirIfEmpty: async (locationId, relDir) => {
@@ -8665,7 +9498,8 @@ var RecorderV2Addon = class extends BaseAddon {
 			onBrokerReady: (handler) => this.ctx.onCapabilityStateChange("stream-broker", brokerScope(ingestOwner.ownerNodeId), (state) => {
 				if (state === "ready") handler();
 			}),
-			brokerCall: makeBrokerCall(brokerHandle)
+			brokerCall: makeBrokerCall(brokerHandle),
+			brokerReady: () => brokerHandle.isReady
 		});
 		const relocateEngine = new RelocateEngine({
 			index: this.index,