@camstack/addon-pipeline 1.2.94 → 1.2.96

package/dist/recorder/index.js

@@ -1,6 +1,6 @@
-const require_dist = require("../dist-BbRv3bM2.js");
+const require_dist = require("../dist-w9QWDvWn.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_addon_utils = require("../addon-utils-DnUCCZVx.js");
+const require_addon_utils = require("../addon-utils-B6usm-YO.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
 let node_path = require("node:path");
@@ -457,6 +457,51 @@ var MfraTableStore = class {
 		}
 	}
 };
+var PendingGate = class {
+	deps;
+	inFlight = 0;
+	droppedSinceReport = 0;
+	lastReportAt = Number.NEGATIVE_INFINITY;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** Tasks currently in flight. */
+	get pending() {
+		return this.inFlight;
+	}
+	/**
+	* Admit `task` unless the lane is saturated.
+	*
+	* Returns `false` when the task was REFUSED — the caller must log the drop
+	* (with its `deviceId` tag when the work is about a device); a branch that
+	* drops work silently reads as "never happened".
+	*/
+	run(task) {
+		if (this.inFlight >= this.deps.limit) {
+			this.droppedSinceReport += 1;
+			const now = this.deps.now?.() ?? Date.now();
+			const intervalMs = this.deps.reportIntervalMs ?? 3e4;
+			if (now - this.lastReportAt >= intervalMs) {
+				this.lastReportAt = now;
+				const dropped = this.droppedSinceReport;
+				this.droppedSinceReport = 0;
+				this.deps.onSaturated({
+					label: this.deps.label,
+					dropped,
+					pending: this.inFlight
+				});
+			}
+			return false;
+		}
+		this.inFlight += 1;
+		Promise.resolve().then(task).catch((error) => {
+			this.deps.onTaskError?.(error);
+		}).finally(() => {
+			this.inFlight -= 1;
+		});
+		return true;
+	}
+};
 //#endregion
 //#region src/recorder/merge-ranges.ts
 function mergeRanges(segments, gapToleranceMs) {
@@ -516,12 +561,33 @@ function* hourBuckets(fromMs, toMs) {
 	const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
 	for (let h = first; h < toMs; h += HOUR_MS$5) yield h;
 }
+/**
+* Index of the first element whose `startMs` is GREATER than `startMs` (upper
+* bound). Inserting there keeps equal-start rows in arrival order — exactly
+* what a stable full sort of the backing map (insertion-ordered) produces, so
+* an incrementally-maintained view is indistinguishable from a rebuilt one.
+*/
+function upperBoundByStart(rows, startMs) {
+	let lo = 0;
+	let hi = rows.length;
+	while (lo < hi) {
+		const mid = lo + hi >> 1;
+		if (rows[mid].startMs <= startMs) lo = mid + 1;
+		else hi = mid;
+	}
+	return lo;
+}
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
-	/** Start-sorted snapshots, rebuilt only after index mutations. Interactive
-	* locate/range calls reuse them instead of filtering+sorting the complete
-	* archive on every seek and scrub miss. */
+	/** Start-sorted views. Built lazily on first read (one copy+sort), then kept
+	* LIVE by `addSegment`'s ordered insert — rows arrive roughly ascending, so
+	* the insert is near-appending. Bulk mutations (hydrate, eviction, a re-set
+	* of an existing path) still invalidate; the steady-state finalize never
+	* does. Interactive locate/range calls reuse these instead of
+	* filtering+sorting the complete archive on every seek and scrub miss. */
 	sortedByDevice = /* @__PURE__ */ new Map();
+	fullRebuilds = 0;
+	incrementalInserts = 0;
 	/** Hour buckets this device has been walked for; `ALL_HOURS` after a full
 	*  hydrate. Empty = nothing has been looked at, which is NOT the same as
 	*  "there is nothing" — see {@link hydrationOf}. */
@@ -548,10 +614,34 @@ var RecordingIndex = class {
 		if (cached) return cached;
 		const m = this.byDevice.get(deviceId);
 		if (!m) return [];
+		this.fullRebuilds += 1;
 		const sorted = [...m.values()].filter((s) => profile == null || s.profile === profile).toSorted((a, b) => a.startMs - b.startMs);
 		deviceCache.set(key, sorted);
 		return sorted;
 	}
+	/** See {@link SortedViewStats}. Telemetry + the guard the churn test asserts on. */
+	sortedViewStats() {
+		return {
+			fullRebuilds: this.fullRebuilds,
+			incrementalInserts: this.incrementalInserts
+		};
+	}
+	/**
+	* Ordered insert of ONE NEW row into every live view it belongs to (the
+	* all-profiles view and its own profile's view). Views not yet materialised
+	* stay unmaterialised — their first read pays the one build. PRECONDITION:
+	* the row's path was NOT already in the device map; a replace must
+	* invalidate instead, because the views hold the old row object.
+	*/
+	insertIntoSortedViews(s) {
+		const deviceCache = this.sortedByDevice.get(s.deviceId);
+		if (!deviceCache) return;
+		for (const [key, rows] of deviceCache) {
+			if (key !== "" && key !== s.profile) continue;
+			rows.splice(upperBoundByStart(rows, s.startMs), 0, s);
+			this.incrementalInserts += 1;
+		}
+	}
 	/**
 	* Replace a device's segments FOR ONE LOCATION from a `storage.list` result (paths relative to that
 	* location root). Rows on other locations are preserved. Non-segment paths and other devices are ignored.
@@ -632,10 +722,26 @@ var RecordingIndex = class {
 		this.invalidateSorted(deviceId);
 		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$5);
 	}
-	/** Insert/replace one finalized segment (idempotent by path). */
+	/**
+	* Insert/replace one finalized segment (idempotent by path).
+	*
+	* THE hot mutation: every profile-writer lands here every `segmentSeconds`,
+	* ~3.4 times a second fleet-wide. A NEW path is an ordered insert into the
+	* live sorted views (rows arrive roughly ascending, so it is near-appending
+	* — O(log n) search + a short memmove). Only the rare RE-SET of an existing
+	* path (watcher replay after a playlist reset, or a relocate that changes
+	* `locationId`) invalidates: the views hold the old row object, and a
+	* one-off rebuild is the simple correct answer for a case that is not hot.
+	*/
 	addSegment(s) {
-		this.mapFor(s.deviceId).set(s.path, s);
-		this.invalidateSorted(s.deviceId);
+		const m = this.mapFor(s.deviceId);
+		const replacing = m.has(s.path);
+		m.set(s.path, s);
+		if (replacing) {
+			this.invalidateSorted(s.deviceId);
+			return;
+		}
+		this.insertIntoSortedViews(s);
 	}
 	/** Remove segments by relative path, routing each path to the correct device map via its encoded deviceId. */
 	removeSegments(paths) {
@@ -2901,6 +3007,67 @@ async function listExportsFor(state, deviceId) {
 	return [...(await readExports(state)).values()].filter((r) => deviceId === void 0 || r.deviceId === deviceId).toSorted((a, b) => b.createdAt - a.createdAt);
 }
 //#endregion
+//#region src/recorder/addon/spawn-failure.ts
+/**
+* How the recorder reads a `child_process` `'error'` — ONE owner of the
+* transient-vs-permanent question.
+*
+* ── Why this file exists ───────────────────────────────────────────────────
+* In Node a child that cannot be spawned emits `'error'`, and an `'error'`
+* with no listener is re-thrown as an UNCAUGHT EXCEPTION. On 2026-08-18 three
+* cameras were unplugged, every writer for them re-dialled at once, the host
+* momentarily could not fork (`spawn ffmpeg EAGAIN`), and the `recorder`
+* runner died three times inside nine seconds. The D6 crash circuit-breaker
+* did its job and stopped respawning — leaving the whole fleet with no
+* recording for three hours and fifteen minutes while `/health` returned 200.
+*
+* Every ffmpeg spawn site in the recorder therefore attaches an `'error'`
+* listener, and every one of them classifies the failure HERE rather than
+* inventing its own list.
+*/
+/**
+* Spawn failures that RETRYING CANNOT FIX.
+*
+* The EAGAIN-vs-ENOENT split, stated once:
+*
+*   - EAGAIN / EMFILE / ENOMEM are the host saying "not right now". The
+*     resource comes back, often within one backoff. They take the ordinary
+*     restart-with-backoff path, whose own comment already states the policy
+*     for this shape: "only RAPID back-to-back failures count toward giving
+*     up, so a brief blip never permanently stops a camera's recording".
+*   - ENOENT / EACCES are the host saying "there is no ffmpeg here you may
+*     run". Nothing about the next ten attempts differs from this one, so the
+*     caller stops immediately and surfaces it at ERROR level: burning a
+*     ten-attempt budget on a missing binary only delays recovery and buries
+*     the single actionable line under ten identical warnings.
+*
+* EPERM is deliberately absent: it is reported for transient sandbox/cgroup
+* refusals as well as for real permission faults, and treating an ambiguous
+* code as permanent stops a camera that would have recovered.
+*/
+var PERMANENT_SPAWN_CODES = new Set(["ENOENT", "EACCES"]);
+/**
+* Read the `'error'` payload without a cast.
+*
+* An unknown code is treated as TRANSIENT: the cost of retrying something
+* permanent is a bounded restart budget, while the cost of giving up on
+* something transient is a camera that stops recording until an operator
+* notices.
+*/
+function readSpawnFailure(raw) {
+	const code = errnoCode(raw);
+	return {
+		code,
+		message: raw instanceof Error ? raw.message : String(raw),
+		permanent: code !== void 0 && PERMANENT_SPAWN_CODES.has(code)
+	};
+}
+function errnoCode(raw) {
+	if (typeof raw !== "object" || raw === null || !("code" in raw)) return void 0;
+	const code = raw.code;
+	return typeof code === "string" ? code : void 0;
+}
+//#endregion
 //#region src/recorder/addon/export-engine.ts
 /** Stderr lines retained for the failure LOG. ffmpeg prints one line per failed
 *  segment before the decisive "Error opening input" summary, so a short tail can
@@ -3070,7 +3237,7 @@ var ExportEngine = class {
 			outPath,
 			options
 		});
-		const ran = await this.runFfmpeg(id, args, {
+		const ran = await this.runFfmpeg(id, rec.deviceId, args, {
 			totalSec: expectedOutSeconds(rec),
 			floor: 0,
 			ceil: 99
@@ -3090,7 +3257,7 @@ var ExportEngine = class {
 				inputPlaylist: playlist,
 				outPath: concatPath
 			});
-			const concatRan = await this.runFfmpeg(id, concatArgs, {
+			const concatRan = await this.runFfmpeg(id, rec.deviceId, concatArgs, {
 				totalSec: Math.max(.001, (rec.toMs - rec.fromMs) / 1e3),
 				floor: 0,
 				ceil: 49
@@ -3104,7 +3271,7 @@ var ExportEngine = class {
 				outPath,
 				options
 			});
-			const selectRan = await this.runFfmpeg(id, selectArgs, {
+			const selectRan = await this.runFfmpeg(id, rec.deviceId, selectArgs, {
 				totalSec: expectedOutSeconds(rec),
 				floor: 50,
 				ceil: 99
@@ -3116,7 +3283,7 @@ var ExportEngine = class {
 			} catch {}
 		}
 	}
-	runFfmpeg(id, args, progress) {
+	runFfmpeg(id, deviceId, args, progress) {
 		this.deps.logger.debug("export ffmpeg argv", { meta: {
 			exportId: id,
 			args
@@ -3153,6 +3320,24 @@ var ExportEngine = class {
 					stderrTail
 				});
 			});
+			proc.on("error", (raw) => {
+				this.activeProc = null;
+				const failure = readSpawnFailure(raw);
+				this.deps.logger.error("export ffmpeg could not be spawned", {
+					tags: { deviceId },
+					meta: {
+						exportId: id,
+						errorCode: failure.code,
+						error: failure.message,
+						permanent: failure.permanent
+					}
+				});
+				stderrTail.push(`ffmpeg spawn failed: ${failure.message}` + (failure.code === void 0 ? "" : ` (${failure.code})`));
+				resolve({
+					code: null,
+					stderrTail
+				});
+			});
 		});
 	}
 	async finish(id, code, outPath, stderrTail) {
@@ -6130,7 +6315,9 @@ var ReadinessRestore = class {
 		this.deps = deps;
 	}
 	get concurrency() {
-		return Math.max(1, this.deps.concurrency ?? 8);
+		const declared = this.deps.concurrency;
+		const value = typeof declared === "function" ? declared() : declared;
+		return Math.max(1, value ?? 8);
 	}
 	/** Seed the pending set, subscribe to readiness, and drain once immediately
 	*  (covers the already-ready case). Returns when the first drain settles. */
@@ -6189,6 +6376,70 @@ var ReadinessRestore = class {
 		}
 	}
 };
+/** Adaptive bound for the recorder's attach parallelism. */
+var SpawnPressureGovernor = class {
+	deps;
+	limit;
+	min;
+	recoverAfterMs;
+	/** When the limit last MOVED — the clock both directions are measured from. */
+	lastChangeAt;
+	underPressure = false;
+	constructor(deps) {
+		this.deps = deps;
+		this.min = Math.max(1, deps.minConcurrency ?? 1);
+		this.limit = Math.max(this.min, deps.maxConcurrency);
+		this.recoverAfterMs = deps.recoverAfterMs ?? 3e4;
+		this.lastChangeAt = this.now();
+	}
+	/**
+	* How many attaches may overlap right now.
+	*
+	* Reading is what drives recovery: there is no timer to leak, no interval to
+	* lose to a runner respawn, and a recorder that stops attaching entirely
+	* simply keeps its reduced bound until it tries again — which is correct.
+	*/
+	get concurrency() {
+		const max = Math.max(this.min, this.deps.maxConcurrency);
+		if (this.limit >= max) return max;
+		const elapsed = this.now() - this.lastChangeAt;
+		if (elapsed < this.recoverAfterMs) return this.limit;
+		const lanes = Math.floor(elapsed / this.recoverAfterMs);
+		this.limit = Math.min(max, this.limit + lanes);
+		this.lastChangeAt += lanes * this.recoverAfterMs;
+		if (this.limit >= max && this.underPressure) {
+			this.underPressure = false;
+			this.deps.logger?.info("recorder: spawn pressure cleared — attach concurrency restored", { meta: { concurrency: this.limit } });
+		} else this.deps.logger?.info("recorder: recovering attach concurrency", { meta: {
+			concurrency: this.limit,
+			max
+		} });
+		return this.limit;
+	}
+	/**
+	* A transient spawn failure happened on `deviceId`'s writer.
+	*
+	* Halves the CURRENT limit, not the max: two waves of pressure inside one
+	* recovery window must compound, or a host under sustained load is asked for
+	* the same too-large batch over and over.
+	*/
+	report(deviceId) {
+		const before = this.limit;
+		this.limit = Math.max(this.min, Math.floor(this.limit / 2));
+		this.lastChangeAt = this.now();
+		this.underPressure = true;
+		this.deps.logger?.warn("recorder: spawn pressure — reducing attach concurrency", {
+			tags: { deviceId },
+			meta: {
+				from: before,
+				to: this.limit
+			}
+		});
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+};
 //#endregion
 //#region src/recorder/addon/segment-watcher.ts
 /**
@@ -6574,36 +6825,87 @@ var SegmentWriter = class {
 				if (stderrTail.length > STDERR_TAIL_LINES) stderrTail.shift();
 			}
 		});
+		let settled = false;
+		const terminate = (termination) => {
+			if (settled) return;
+			settled = true;
+			this.onTermination(termination, stderrTail);
+		};
 		proc.on("exit", (code) => {
-			this.resolveExit?.();
-			this.resolveExit = null;
-			this.proc = null;
-			if (this.stopped) return;
-			const ranMs = Date.now() - this.startedAt;
-			if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
-			if (this.restarts >= MAX_RESTARTS) {
-				this.deps.logger.warn("SegmentWriter giving up after max restarts", { meta: {
+			terminate({
+				reason: "exit",
+				exitCode: typeof code === "number" ? code : null
+			});
+		});
+		proc.on("error", (raw) => {
+			const failure = readSpawnFailure(raw);
+			terminate({
+				reason: "spawn-error",
+				errorCode: failure.code,
+				message: failure.message,
+				permanent: failure.permanent
+			});
+		});
+	}
+	/**
+	* The ONE restart policy, reached from both `exit` and `error`.
+	*
+	* `deps.logger` is the device-scoped child the controller binds
+	* (`logger.withTags({ deviceId })`), so every line below carries
+	* `tags: { deviceId }` — "why is 617 worse than 615" is always asked per
+	* camera, and a writer that stops recording one camera must be greppable by
+	* that camera.
+	*/
+	onTermination(termination, stderrTail) {
+		this.resolveExit?.();
+		this.resolveExit = null;
+		this.proc = null;
+		if (this.stopped) return;
+		const ranMs = Date.now() - this.startedAt;
+		if (ranMs >= STABLE_RUN_MS) this.restarts = 0;
+		if (termination.reason === "spawn-error") {
+			this.deps.logger.warn("SegmentWriter ffmpeg spawn failed", { meta: {
+				outDir: this.cfg.outDir,
+				errorCode: termination.errorCode,
+				error: termination.message,
+				permanent: termination.permanent
+			} });
+			if (termination.permanent) {
+				this.deps.logger.error("SegmentWriter giving up: ffmpeg cannot be executed on this node", { meta: {
 					outDir: this.cfg.outDir,
-					code,
-					stderrTail: stderrTail.join(" | ")
+					errorCode: termination.errorCode,
+					error: termination.message
 				} });
 				this.stopped = true;
 				this.deps.onGaveUp?.();
 				return;
 			}
-			this.restarts++;
-			const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
-			this.deps.logger.info("SegmentWriter restarting", { meta: {
+			this.deps.onResourcePressure?.();
+		}
+		if (this.restarts >= MAX_RESTARTS) {
+			this.deps.logger.warn("SegmentWriter giving up after max restarts", { meta: {
 				outDir: this.cfg.outDir,
-				attempt: this.restarts,
-				delayMs,
-				ranMs
+				reason: termination.reason,
+				code: termination.reason === "exit" ? termination.exitCode : termination.errorCode,
+				stderrTail: stderrTail.join(" | ")
 			} });
-			this.restartTimer = setTimeout(() => {
-				this.restartTimer = null;
-				this.start();
-			}, delayMs);
-		});
+			this.stopped = true;
+			this.deps.onGaveUp?.();
+			return;
+		}
+		this.restarts++;
+		const delayMs = Math.min(RESTART_BASE_MS * 2 ** (this.restarts - 1), RESTART_MAX_MS);
+		this.deps.logger.info("SegmentWriter restarting", { meta: {
+			outDir: this.cfg.outDir,
+			attempt: this.restarts,
+			delayMs,
+			ranMs,
+			reason: termination.reason
+		} });
+		this.restartTimer = setTimeout(() => {
+			this.restartTimer = null;
+			this.start();
+		}, delayMs);
 	}
 	stop() {
 		this.stopAndWait();
@@ -6895,8 +7197,20 @@ var RecordingController = class {
 	/** A reversible maintenance lease. Unlike `stopped`, it never changes
 	* persisted recording intent and `resume()` restarts normal convergence. */
 	paused = false;
+	/**
+	* The ADAPTIVE attach bound. A transient `spawn ffmpeg` failure (EAGAIN) is
+	* the host saying it cannot fork right now, and the answer is to attach
+	* FEWER cameras at once — not to serialise them, which `e2fa17a2b` removed
+	* for good reason. Every bounded-parallel attach in this file reads it.
+	*/
+	spawnPressure;
 	constructor(deps) {
 		this.deps = deps;
+		this.spawnPressure = new SpawnPressureGovernor({
+			maxConcurrency: 8,
+			now: () => this.now(),
+			logger: deps.logger
+		});
 		this.wakeups = new DeviceWakeups({
 			logger: deps.logger,
 			now: () => this.now(),
@@ -6964,6 +7278,7 @@ var RecordingController = class {
 		}
 		this.restore = new ReadinessRestore({
 			subscribeReady: (handler) => this.deps.onBrokerReady(handler),
+			concurrency: () => this.spawnPressure.concurrency,
 			attempt: async (deviceId) => {
 				await this.evaluateDevice(deviceId);
 			},
@@ -7044,7 +7359,7 @@ var RecordingController = class {
 	*/
 	async reconcile() {
 		if (this.stopped) return;
-		await runBounded(await this.trackedDeviceIds(), 8, async (id) => {
+		await runBounded(await this.trackedDeviceIds(), this.spawnPressure.concurrency, async (id) => {
 			try {
 				await this.evaluateDevice(id);
 			} catch (err) {
@@ -7403,7 +7718,8 @@ var RecordingController = class {
 			logger: deviceLog,
 			onGaveUp: () => {
 				this.recoverWriterGaveUp(deviceId);
-			}
+			},
+			onResourcePressure: () => this.spawnPressure.report(deviceId)
 		});
 		const writerStartedMs = this.now();
 		writer.start();
@@ -8878,6 +9194,23 @@ var PLAYBACK_PREFIX = "playback";
 /** Data-plane prefix for on-demand single stills →
 *  `/addon/recorder/still/<deviceId>/<epochSec>`. */
 var STILL_PREFIX = "still";
+/**
+* Bound on pending hour-ledger writes (one per finalized segment, an RPC to
+* the hub store). Steady state completes in milliseconds and holds ~0–2; under
+* a store stall the fleet-wide finalize rate (~3.4/s) fills 256 in ~75s of
+* grace before refusals begin. Each pending write holds one hour-row copy
+* (≤360 paths ≈ ~25KB), so the lane's worst-case heap is single-digit MB —
+* a dropped write is one silent re-seed from the archive walk (D148).
+*/
+var LEDGER_GATE_LIMIT = 256;
+/**
+* Bound on pending mfra tail reads (one per finalized RECENT segment; each is
+* an open + two reads on the same 4-thread libuv pool the live writers use,
+* holding read buffers while pending). 64 bounds both the held memory and the
+* pool contention; a dropped capture costs that segment's client one extra
+* round trip to the file's tail on the first seek.
+*/
+var MFRA_GATE_LIMIT = 64;
 /** Data-plane prefix for export MP4 downloads → `/addon/recorder/exports/<id>.mp4`. */
 var EXPORTS_PREFIX = "exports";
 /** How often the export janitor sweeps expired exports. */
@@ -8954,6 +9287,25 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	/** Sync-sample tables captured at finalize, served by the directory so a
 	*  playback seek needs no mfra tail fetch. RAM-only, TTL-bounded. */
 	mfraTables = new MfraTableStore();
+	/** Bound on the per-finalize fire-and-forget lanes (item 3, 2026-08-18): a
+	*  disk/store stall must throttle this work, never balloon live heap — the
+	*  unbounded pending set is what fed the two `Ineffective mark-compacts`
+	*  fatals. Saturation is reported loudly but throttled; every individual
+	*  drop is logged with its deviceId at the call site. */
+	ledgerWriteGate = new PendingGate({
+		label: "hour-ledger",
+		limit: LEDGER_GATE_LIMIT,
+		onSaturated: (report) => {
+			this.reportGateSaturated(report);
+		}
+	});
+	mfraCaptureGate = new PendingGate({
+		label: "mfra-capture",
+		limit: MFRA_GATE_LIMIT,
+		onSaturated: (report) => {
+			this.reportGateSaturated(report);
+		}
+	});
 	/** Continuous + events band write-path controller (ffmpeg writers + watchers). */
 	controller = null;
 	/** Per-device motion/audio markers for playback (B3 events feed the controller). */
@@ -8991,6 +9343,20 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
+	/**
+	* One throttled line per saturated lane per report interval. Lane-level (no
+	* deviceId — the lane aggregates every camera); the per-drop debug lines at
+	* the call sites carry the tag. WARN because a saturated lane means the
+	* store or the disk is stalling under live finalize load — the line that
+	* explains the missing ledger hours and mfra misses an operator will see.
+	*/
+	reportGateSaturated(report) {
+		this.ctx.logger.warn("recorder: fire-and-forget lane saturated — dropping over the bound", { meta: {
+			lane: report.label,
+			dropped: report.dropped,
+			pending: report.pending
+		} });
+	}
 	async onInitialize() {
 		const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
 		this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
@@ -9054,18 +9420,28 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				this.segmentHours?.dropSegments(rows);
 			},
 			onIndexed: (row, absPath) => {
-				this.segmentHours?.recordSegment(row);
+				const ledger = this.segmentHours;
+				if (ledger && !this.ledgerWriteGate.run(() => ledger.recordSegment(row))) this.ctx.logger.debug("recorder: hour-ledger write dropped — lane saturated; the archive walk reconciles this hour", {
+					tags: { deviceId: row.deviceId },
+					meta: { path: row.path }
+				});
 				if (!isMfraTableServable(row.startMs, Date.now())) return;
-				readMfraTable(absPath, row.bytes).then((table) => {
-					this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
-				}).catch((err) => {
-					this.ctx.logger.debug("mfra capture failed", {
-						tags: { deviceId: row.deviceId },
-						meta: {
-							path: row.path,
-							error: require_dist.errMsg(err)
-						}
-					});
+				if (!this.mfraCaptureGate.run(async () => {
+					try {
+						const table = await readMfraTable(absPath, row.bytes);
+						this.mfraTables.record(row.deviceId, row.profile, row.startMs, table);
+					} catch (err) {
+						this.ctx.logger.debug("mfra capture failed", {
+							tags: { deviceId: row.deviceId },
+							meta: {
+								path: row.path,
+								error: require_dist.errMsg(err)
+							}
+						});
+					}
+				})) this.ctx.logger.debug("recorder: mfra capture dropped — lane saturated; first seek pays one tail fetch", {
+					tags: { deviceId: row.deviceId },
+					meta: { path: row.path }
 				});
 			},
 			removeDirIfEmpty: async (locationId, relDir) => {