Recording and evidence

KeepPeek treats a recording as evidence only when the media is finalized, indexed, and playable. A connected camera or an MP4 filename alone does not prove that the requested interval can be reviewed later. The underlying live evidence dimensions are defined in Camera and stream health.

Find and play a recording

Open Keep, choose the camera and recorded day, then select footage or an event on the timeline. The four modes serve different investigations:

Use play/pause, skip, the recording-position slider, volume/mute, speed and fullscreen controls below the image. Available stream quality depends on retained media and browser codec support. Changing the quality preference is separate from digital zoom. Stored playback does not provide automatic transcoding for an unsupported codec; retain a compatible H.264 stream when your viewing devices need one.

With the recorded player focused, Left and Right step frames. Space toggles playback; J, K and L provide shuttle/pause controls. [ and ] set export boundaries. Form fields keep their normal keyboard behavior, and arrow keys pan a focused digitally zoomed image instead of stepping frames.

Use Keep on a phone

In portrait, Keep keeps a compact camera/date row, the player and a horizontal history timeline in the main view. Tap the camera name or date to open Camera and date. Search for a camera or use previous/next camera; camera navigation wraps at the ends. The recorded-day selector and its arrows choose available days, with unavailable directions disabled.

Tap Playback options for volume, playback speed, quality, Copy link to this moment, and Refresh recordings. Changes apply immediately. Done, the close button, Escape or browser Back closes the sheet and returns focus to a visible control. Opening a sheet keeps the player open. In recording fullscreen, rate and volume remain available beside the player controls.

The compact controls do not remove Timeline, Stories, Swimlanes or Export. Rotate the device or close the sheet to return to the history view. The timeline changes recording time; the separate Digital controls above the image change only the inspection crop.

Keep the requested UTC time explicit

Recorded days and event time filters use UTC. Switching cameras preserves the selected absolute moment, including when the destination camera has no footage there. Choosing another recorded day keeps the UTC clock time on that chosen day. At midnight this means midnight of the selected day, not the following day.

A gap stays visible until you explicitly choose available footage. Use Previous recording or Next recording when offered, or select a recorded interval on the timeline. KeepPeek does not silently move an unavailable requested moment to the latest clip. Loading, no recorded days, unavailable footage and decode failure are distinct states; use the displayed action or refresh after checking the camera’s recording policy and retained coverage.

Choose what each camera records

Each camera has one recording policy:

event-boost is the default. It writes one logical recording rather than recording main and sub at the same time. Transitions happen only at keyframes, so the stored file remains seekable. A new event extends the configured main-stream interval.

Event-only and event-boost can retain up to 30 seconds of encoded pre-event media in memory. Pre-recording defaults to zero, preserving existing camera behavior. Choose the duration in camera setup or the camera editor. Event-only also lets you choose main or sub. Repeated events extend the post-event window. Event-only excludes frames at or after its deadline.

With event-boost pre-recording enabled, KeepPeek delays the continuous substream by at most the selected duration so available main-stream history can replace that interval in one recording. A crash can lose this uncommitted interval. Memory pressure releases continuous sub media and shortens optional history. Disable pre-recording to restore the existing immediate admission path.

The requested interval is a ceiling, not a guarantee. Recordings begin at a retained, decodable keyframe. Startup, missing keyframes, long GOPs, and byte limits can shorten the interval. Camera health reports the requested and available history, retained bytes, and the current reason. Pending replay means media is queued; it does not prove a successful disk or catalog commit. Use Recording integrity and playback to inspect committed evidence. Audio packets crossing the selected video boundary are omitted without re-encoding.

If a runtime profile reports a camera as Degraded because storage rejected its recording settings or could not queue the change, new recording input for that camera stops. Live viewing can continue, and other cameras still apply their profile changes. Pending means the recording writer has not yet accepted the configuration. A missing writer acknowledgement also reports Degraded and stops new recording input for the current request. Correct the reported settings or restore storage availability, then open Settings → Runtime profiles and select Reapply active policy. This retries the accepted Base or named profile without switching to another policy. Save or discard profile edits before retrying. An authorized WebRTC client can also reapply the current policy, and restarting KeepPeek restores the saved selection. Applied confirms that the writer accepted the recording configuration; use Recording integrity and playback to verify retained footage.

An active recording write failure after acceptance can also change Applied to Degraded. This status uses the camera source identity even when its recording folder has a different name. Recording can continue to attempt writes. After repairing storage, use Reapply active policy to clear the failure observation after fresh configuration acceptance. A failed retry keeps the desired selection and shows its error; reload current state before trying again if another Administrator changed it. Fresh configuration acceptance does not prove media recovery, so check Recording integrity and playback. Idle event recording and ordinary write progress do not clear the failure status automatically. Use integrity checks, playback and server logs to assess cleanup, finalization, shutdown and storage-pressure failures.

The default limits are 64 MiB per buffered stream and 256 MiB globally. Administrators can change them in advanced storage settings. History is not saved across restart. Privacy activation, reconnect, and storage pause discard stale history; recording resumes from a valid keyframe. See the configuration reference for persisted fields and limits.

Before downgrading to a version without event-only support, change affected cameras to a supported policy and set pre-recording to zero. Save a configuration backup first. Existing committed media does not need conversion or deletion, and disabling pre-recording does not remove it.

Choose a browser-compatible H.264 substream even when the main evidence stream is H.265. KeepPeek stores the camera’s encoded media without re-encoding it, so browser support still determines which recordings can play directly.

Recording admission and media retention are separate. The current camera modes and event pre-recording do not implement independent continuous, motion, alert and detection retention deadlines. Storage pressure can shorten available coverage. The recording policy audit tracks verified behavior, missing retention rules and their implementation owners under #168.

Use the local archive tier

KeepPeek separates short-lived RAM buffering, active recording files, finalized primary media, and the fourth ARCHIVE tier. A fourth-tier archive is a verified replica. The named-volume archive placement role still relocates primary recordings; it does not create a second replica.

As an Administrator, open Settings → Storage → Local archive. Create a private destination directory owned by the recorder account on an already mounted local disk, then edit and save its target ID, root, limits, and optional source selection. The archive root must not overlap primary or metadata roots. Save requires a configuration revision; a conflict preserves your draft. Reload archive settings explicitly discards the draft after confirmation and loads current settings. Restart KeepPeek to apply the saved configuration, then test the destination and refresh archive jobs to observe the result. A pending probe is not a successful destination test.

You can queue a manual copy of finalized recordings or completed exports from the catalog object selector. Automatic mode selects eligible sources after the configured minimum age; an empty source list selects all. Copies use bounded background work and independently verify the retained replica before reporting success. Jobs show identity, state, bytes, attempts, failures, and any restore or eviction action. Refresh before retrying an uncertain result. A lost copy reply is reconciled using the same durable job identity.

Primary eviction defaults to off. A successful copy alone does not remove the primary file. Enable automatic eviction only deliberately, or confirm Evict primary for an individual job. The server checks the verified archive, current reader leases, and retention holds before retiring the primary. Timeline and seek metadata remain indexed. Open archived recordings through the normal Keep timeline; the player displays ARCHIVE — Playing from archive. Startup and seeking may take longer. It reads the required archive ranges directly, without a full restore or an artificial delay. Existing waiting, failure, seek, and cancellation controls still apply.

Restore primary queues a verified transfer back to the original primary destination. Cancellation stops cancellable copy or restore work and cleans up partial staging. Retry / finish cleanup retains the cancelled copy’s job identity. Copying resumes only after cleanup is acknowledged and current source evidence is validated. Refresh to distinguish pending cleanup from resumed copying. Once a primary eviction intent is durable, it must finish reconciliation; cancellation is unavailable for that state. Preserve the job evidence and restore the destination before retrying recovery.

An offline archive reports unavailable health without blocking new recording ingestion. Archived media whose primary was evicted can remain temporarily inaccessible until the mounted destination returns. Do not recreate or substitute a missing mount: the catalog binds the target ID to its root identity. Retain the catalog, archive tree, and configuration together for filesystem recovery. Broader offsite providers remain planned; the supported target in this phase is the local filesystem only.

Prove recording integrity

Open Recording integrity to inspect the fleet before footage is needed. The workspace reports:

• whether recording is requested by policy;
• current writer state and the last frame, write, finalization, and catalog commit;
• oldest and newest retained media;
• effective retained duration, attributed bytes, and estimated daily growth;
• playable coverage for the selected 24-hour, 7-day, or 30-day interval;
• exact recent gaps and the evidence that explains each one.

Fleet states have narrow meanings:

The Not configured summary appears only when its count is nonzero. Policy-disabled streams and unconfigured cameras remain distinct from unexpected recording loss.

Coverage comes from keyframe-indexed fragments, not from file presence. Current gaps remain open and never claim an end time. Causes include source silence, transport outage, stale frames, decode failure, writer failure, disk pressure, retention deletion, storage migration, catalog mismatch, and an explicit unknown state. Gap actions open nearby footage, camera health, or relevant logs.

Long histories remain bounded: fleet pages contain 25 cameras by default, recent exact detail keeps at most 256 ranges per stream, and longer periods use deterministic time buckets while retaining exact totals.

Review events consistently

Open Events to search across authorized cameras. Choose the UTC date and optional start/end times, then narrow by camera, event kind, origin, zone, confidence, image availability or text. Review and bookmark filters compose with the same search. If a filter reports unavailable support, check the server capability instead of assuming that an empty result means no events.

Select a card to inspect its canonical image, description, timestamps and revision. Use Open at this moment to investigate recorded footage or the export action to prepare a clip. The return link restores the selected event and supported filter context. For an empty result, check the effective filters and UTC date before broadening the search.

Mark events reviewed or dismissed without deleting evidence. Those flags belong to your authenticated identity, or to a persistent Local workspace in trusted-LAN use. Event updates do not reset them. Use the visible or selected count on bulk actions; undo applies only to the acknowledged targets. Review and bookmark filters use server-computed counts, not the current page length.

Reviewed and Dismissed are independent flags. Unreviewed means neither flag is set; dismissal removes an event from that review queue without deleting its attachments or recording. Mark N visible reviewed affects the rendered page, while Mark N selected reviewed sends the explicit selection, which may span pages. The selection limit is 128 events. A stale or unconfirmed write requires Reload and retry; note drafts and action intent remain available.

Named credentials retain their review identity across credential rotation. A trusted-local browser uses a persistent Local workspace identity rather than attributing work to a person. Clearing that site’s browser storage creates a new workspace; unavailable persistent storage disables its mutations instead of silently using a temporary identity.

Bookmarks are shared with authorized camera viewers. Their creator or an Administrator can edit the bounded note or remove the bookmark. Saved bookmarks retains honest metadata-only references when media, events, or sources are unavailable. A bookmark does not pin video through retention. Exports keep their source event/bookmark revision relationship without creating a retention hold.

Bookmark notes are plain text, limited to 1,024 UTF-8 bytes. The bookmark library has its own source, date and creator scope, independent of the main Events filters. Recording retention can remove footage without removing the bookmark. References for deleted events are retained for 90 days and explicitly identify missing event, source or media.

Events, Keep, notifications, MQTT, and export entry points use the same event revision and canonical preview. An authorized producer may name the canonical attachment. Otherwise KeepPeek chooses a supported snapshot, then a story frame, then a retained thumbnail using stable ordinal, capture time, and attachment ID ordering.

If canonical image bytes are unavailable, KeepPeek shows that state instead of silently choosing a different image. Bounding boxes appear only when their coordinate-space attachment matches the canonical image. Event type remains authoritative for filtering and automation; semantic icons are presentation-only and come from a fixed allowlist.

Notifications and integrations explains how those same event and operational identities remain stable across delivery, retry, and broker recovery.

Copy a recording moment

Use digital zoom and pan to inspect recorded frames and canonical event images without changing their source resolution or the evidence. Inspection crops are not included in copied moment links or exports.

Use the link icon in Keep’s command bar to copy the current recording moment. The command reads the playback clock when invoked; it does not pause, seek, reload the video, or change browser history. Event detail has the same command beside Open at this moment, using the event’s start time. Both event actions retain the selected event and active filters. Back to event returns to that context from any Keep mode.

These are authenticated navigation links, not public shares or exports. Recipients need access to the same KeepPeek server and camera, and remote recipients must sign in. A link does not contain an access key, session ID, temporary media URL, recording filename, or filesystem path. It does include the server-provided camera identifier and, for event links, event and filter context. Treat those details as private operational information. Changing camera identity or deleting footage can make an old link unavailable.

Links use the existing /keep route, including any configured application base path:

The timestamp remains the same across browser timezones. For retained, supported media, playback restoration is verified within one second or one source-frame duration, whichever is larger. Browser codec support still applies. KeepPeek explains a compatible stream fallback and preserves the requested preference in copied links.

An exact link into a gap does not open nearby footage automatically. It keeps the requested UTC time visible and offers previous or next recordings found in the bounded five-minute window on each side, within that UTC day. Selecting one explicitly moves the playhead. If no retained footage is found, the view explains that it may have expired or never been recorded. Missing and inaccessible cameras share an unavailable-or-not-authorized message to avoid disclosing hidden sources. Malformed links fail visibly instead of selecting another camera.

Successful copying shows a checkmark and announces confirmation. If browser clipboard access is denied, unsupported, or takes more than 2.5 seconds, a dialog presents the same link in a selected, read-only field for manual copying. Escape closes that dialog and returns focus to the command.

Export evidence

An Administrator can select up to two minutes in Keep and create a standalone MP4. Event export opens the same editor with 15 seconds of context before and after the event while preserving the camera, stream, timestamp, event revision, filters, and return route.

Export jobs can be running, ready, partial, failed, cancelled, or expired. KeepPeek:

• returns an identical running job instead of starting hidden duplicate work;
• offers an existing ready artifact before creating a fresh one;
• names every missing interval before a partial export proceeds;
• stops jobs after 30 seconds without progress or five minutes total runtime;
• removes partial output after failure or cancellation;
• marks interrupted jobs failed and retryable after restart;
• verifies SHA-256 again immediately before download.

Ready files remain available for 24 hours. Bounded job history remains for 30 days, up to 500 jobs, so an expired or missing artifact can still explain what happened and support an explicit retry. History and files remain scoped to the Administrator identity that created them.

Check the completed job’s interval, stream and missing-range explanation before downloading. A partial artifact contains only its available intervals and must not be described as continuous coverage of the whole selection. Cancellation and retry are explicit actions; opening another page does not turn a running job into a completed download. Download integrity failure or an expired artifact requires a fresh job if the original recordings are still available.

Timestamp burn-in requires a configured re-encoding worker and otherwise fails explicitly. The normal export path preserves source frames and timestamps without re-encoding.

For the availability and safety limits of manual deletion and catalog drift checks, see Recording maintenance. The Administrator workflow is under qualification; confirmed jobs can remove selected recordings permanently.

For the detailed coverage model and export lifecycle, see the recording integrity, event presentation, and evidence export references.