diff --git a/Directory.Packages.props b/Directory.Packages.props
index 9b029b6..4fce88a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -36,8 +36,10 @@
     <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="9.0.0" />
     <!-- Pin: transitive pull (Onvif.Core → System.ServiceModel) lands 9.0.1
          which carries GHSA-37gx-xxp4-5rgx + GHSA-w3x6-4m5h-cxqf; 9.0.x line
-         hasn't shipped a patched servicing yet, so pin to the 10.0.0 release. -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.0" />
+         hasn't shipped a patched servicing yet, so pin to the 10.0 line.
+         10.0.13: 10.0.0–10.0.12 drag in System.Security.Cryptography.Pkcs with
+         GHSA-2fmv-rv2c-59x7 (CVE-2026-70162), which fails restore. -->
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.13" />
 
     <!-- Split package pair from 7.1.1: Abstractions defines the ffmpeg facade
          (no broken cctor — see PR #344), DynamicallyLoaded provides the loader
diff --git a/src/OpenIPC.Viewer.App/Services/Localizer.cs b/src/OpenIPC.Viewer.App/Services/Localizer.cs
index 709f040..cadb3de 100644
--- a/src/OpenIPC.Viewer.App/Services/Localizer.cs
+++ b/src/OpenIPC.Viewer.App/Services/Localizer.cs
@@ -555,6 +555,8 @@ private static LangCode DetectSystem()
         ["CameraPage.ApplyDone"] = "Done.",
         ["CameraPage.ApplyFailedFormat"] = "Failed: {0}",
         ["CameraPage.RecordingFailedFormat"] = "Recording failed: {0}",
+        ["CameraPage.RecordingNotStartedFormat"] = "Recording did not start: {0}",
+        ["CameraPage.RecordingInterruptedFormat"] = "Recording stopped unexpectedly: {0}",
         ["CameraPage.SnapshotFailedFormat"] = "Snapshot failed: {0}",
         ["CameraPage.Tooltip.Listen"] = "Listen to camera audio",
         ["CameraPage.Tooltip.Mute"] = "Mute audio",
@@ -1211,6 +1213,8 @@ private static LangCode DetectSystem()
         ["CameraPage.ApplyDone"] = "Готово.",
         ["CameraPage.ApplyFailedFormat"] = "Ошибка: {0}",
         ["CameraPage.RecordingFailedFormat"] = "Запись не удалась: {0}",
+        ["CameraPage.RecordingNotStartedFormat"] = "Запись не началась: {0}",
+        ["CameraPage.RecordingInterruptedFormat"] = "Запись неожиданно остановилась: {0}",
         ["CameraPage.SnapshotFailedFormat"] = "Снимок не удался: {0}",
         ["CameraPage.Tooltip.Listen"] = "Слушать звук с камеры",
         ["CameraPage.Tooltip.Mute"] = "Выключить звук",
diff --git a/src/OpenIPC.Viewer.App/ViewModels/SingleCameraPageViewModel.cs b/src/OpenIPC.Viewer.App/ViewModels/SingleCameraPageViewModel.cs
index 8e9c65b..dc18d55 100644
--- a/src/OpenIPC.Viewer.App/ViewModels/SingleCameraPageViewModel.cs
+++ b/src/OpenIPC.Viewer.App/ViewModels/SingleCameraPageViewModel.cs
@@ -304,6 +304,7 @@ public SingleCameraPageViewModel(
 
         IsRecording = _recordings.IsRecording(_camera.Id);
         _recordings.StateChanged += OnRecordingsStateChanged;
+        _recordings.RecordingFailed += OnRecordingFailed;
         if (IsRecording) StartRecTimer();
 
         // Telemetry overlay visibility is a user pref — re-raise PropertyChanged
@@ -561,6 +562,14 @@ private void OnRecordingsStateChanged(object? sender, CameraId cam)
         });
     }
 
+    private void OnRecordingFailed(object? sender, RecordingService.RecordingFailure failure)
+    {
+        if (failure.CameraId != _camera.Id) return;
+        var key = failure.WroteSegment ? "CameraPage.RecordingInterruptedFormat" : "CameraPage.RecordingNotStartedFormat";
+        Dispatcher.UIThread.Post(() => ErrorMessage = string.Format(CultureInfo.CurrentCulture,
+            Localizer.Instance[key], failure.Message));
+    }
+
     private void StartRecTimer()
     {
         _recTimer ??= new DispatcherTimer(TimeSpan.FromSeconds(1), DispatcherPriority.Background, (_, _) => UpdateRecElapsed());
@@ -1513,6 +1522,7 @@ public async ValueTask DisposeAsync()
         _detectionsSub?.Dispose();
         DetachAnalyticsFallback();
         _recordings.StateChanged -= OnRecordingsStateChanged;
+        _recordings.RecordingFailed -= OnRecordingFailed;
         _userSettings.Changed -= OnUserSettingsChanged;
         _coordinator.Invalidated -= OnCoordinatorInvalidated;
         _audio.Changed -= OnAudioChanged;
diff --git a/src/OpenIPC.Viewer.Core/Recording/RecordingEvent.cs b/src/OpenIPC.Viewer.Core/Recording/RecordingEvent.cs
index ba7ed89..7087b5f 100644
--- a/src/OpenIPC.Viewer.Core/Recording/RecordingEvent.cs
+++ b/src/OpenIPC.Viewer.Core/Recording/RecordingEvent.cs
@@ -6,7 +6,8 @@ public abstract record RecordingEvent
 {
     public sealed record Started(string FirstSegmentPath, DateTime Time) : RecordingEvent;
     public sealed record SegmentRotated(string PrevPath, string NewPath, DateTime Time, long? Size) : RecordingEvent;
-    public sealed record Stopped(DateTime Time, RecordingStopReason Reason) : RecordingEvent;
+    // Detail: the recorder's own reason for a stop it wasn't asked for.
+    public sealed record Stopped(DateTime Time, RecordingStopReason Reason, string? Detail = null) : RecordingEvent;
     public sealed record Error(string Message) : RecordingEvent;
 }
 
diff --git a/src/OpenIPC.Viewer.Core/Recording/RecordingService.cs b/src/OpenIPC.Viewer.Core/Recording/RecordingService.cs
index b71faa3..5a0bc39 100644
--- a/src/OpenIPC.Viewer.Core/Recording/RecordingService.cs
+++ b/src/OpenIPC.Viewer.Core/Recording/RecordingService.cs
@@ -30,6 +30,10 @@ public sealed class RecordingService : IAsyncDisposable
     // attaches logging here — Core stays package-dep free.
     public event EventHandler<Exception>? BookkeepingFailed;
 
+    // A session that ended without the user stopping it (camera unreachable,
+    // stream dropped, disk refused the file). The message is the recorder's own.
+    public event EventHandler<RecordingFailure>? RecordingFailed;
+
     public RecordingService(
         IRecorder recorder,
         IRecordingRepository repo,
@@ -91,10 +95,14 @@ public async Task StartAsync(CameraId id, CancellationToken ct)
             SegmentDuration: TimeSpan.FromMinutes(10));
 
         var session = await _recorder.StartAsync(options, ct).ConfigureAwait(false);
+        // Register before subscribing: a recorder that dies at once (camera
+        // refused) must find its handle, or the ended session would stay active.
+        // Sessions replay what they published before this subscription.
+        var h = new Handle(session);
+        lock (_gate) _active[id] = h;
         // Adapter exists because Core has no System.Reactive (no package deps);
         // BCL only exposes IObservable.Subscribe(IObserver<T>).
-        var sub = session.Events.Subscribe(new CallbackObserver(ev => _ = HandleEventAsync(id, ev)));
-        lock (_gate) _active[id] = new Handle(session, sub);
+        h.Subscription = session.Events.Subscribe(new CallbackObserver(ev => h.Enqueue(() => HandleEventAsync(id, h, ev))));
         StateChanged?.Invoke(this, id);
     }
 
@@ -111,16 +119,19 @@ public async Task StopAsync(CameraId id, CancellationToken ct)
         try { await h.Session.StopAsync(ct).ConfigureAwait(false); }
         catch (Exception ex) { BookkeepingFailed?.Invoke(this, ex); }
 
-        // Finalize last segment row with EndedAt + final size.
-        if (h.Session.CurrentSegmentPath is { } lastPath)
+        // Let a still-pending Started/Rotated insert land first, then finalize
+        // the last segment row with EndedAt + final size.
+        await h.DrainAsync().ConfigureAwait(false);
+        if (h.LastSegmentPath is { } lastPath)
             await FinalizeSegmentAsync(lastPath, DateTime.UtcNow).ConfigureAwait(false);
 
-        h.Subscription.Dispose();
+        h.Subscription?.Dispose();
         try { await h.Session.DisposeAsync().ConfigureAwait(false); } catch { /* swallow */ }
         StateChanged?.Invoke(this, id);
     }
 
-    private async Task HandleEventAsync(CameraId id, RecordingEvent ev)
+    // Runs on the handle's queue: one event at a time, in publication order.
+    private async Task HandleEventAsync(CameraId id, Handle h, RecordingEvent ev)
     {
         try
         {
@@ -128,16 +139,23 @@ private async Task HandleEventAsync(CameraId id, RecordingEvent ev)
             {
                 case RecordingEvent.Started s:
                     await _repo.AddAsync(NewRow(id, s.FirstSegmentPath, s.Time), CancellationToken.None).ConfigureAwait(false);
+                    h.LastSegmentPath = s.FirstSegmentPath;
                     break;
 
                 case RecordingEvent.SegmentRotated r:
                     await FinalizeSegmentAsync(r.PrevPath, r.Time, r.Size).ConfigureAwait(false);
                     await _repo.AddAsync(NewRow(id, r.NewPath, r.Time), CancellationToken.None).ConfigureAwait(false);
+                    h.LastSegmentPath = r.NewPath;
                     break;
 
                 case RecordingEvent.Error err:
+                    h.LastError = err.Message;
                     BookkeepingFailed?.Invoke(this, new InvalidOperationException($"Recorder error: {err.Message}"));
                     break;
+
+                case RecordingEvent.Stopped st when st.Reason != RecordingStopReason.User:
+                    await OnSessionEndedAsync(id, h, st).ConfigureAwait(false);
+                    break;
             }
         }
         catch (Exception ex)
@@ -146,6 +164,32 @@ private async Task HandleEventAsync(CameraId id, RecordingEvent ev)
         }
     }
 
+    // The recorder gave up on its own. Without this the camera stayed "recording"
+    // with a ticking REC timer and no file behind it, the last row never got
+    // EndedAt, and a fresh Start was refused as "already recording".
+    private async Task OnSessionEndedAsync(CameraId id, Handle h, RecordingEvent.Stopped st)
+    {
+        lock (_gate)
+        {
+            // StopAsync removes the handle before stopping, so a missing or different
+            // handle means this session is already being torn down elsewhere.
+            if (!_active.TryGetValue(id, out var current) || !ReferenceEquals(current, h)) return;
+            _active.Remove(id);
+        }
+
+        // Events run in order on h's queue, so any row this session inserted is
+        // already in the repository.
+        var lastPath = h.LastSegmentPath;
+        if (lastPath is not null)
+            await FinalizeSegmentAsync(lastPath, st.Time).ConfigureAwait(false);
+
+        h.Subscription?.Dispose();
+        try { await h.Session.DisposeAsync().ConfigureAwait(false); } catch { /* swallow */ }
+        StateChanged?.Invoke(this, id);
+        RecordingFailed?.Invoke(this, new RecordingFailure(
+            id, h.LastError ?? st.Detail ?? st.Reason.ToString(), WroteSegment: lastPath is not null));
+    }
+
     private async Task FinalizeSegmentAsync(string path, DateTime endedAt, long? size = null)
     {
         try
@@ -192,12 +236,46 @@ public async ValueTask DisposeAsync()
         foreach (var h in handles)
         {
             try { await h.Session.StopAsync(CancellationToken.None).ConfigureAwait(false); } catch { }
-            h.Subscription.Dispose();
+            h.Subscription?.Dispose();
             try { await h.Session.DisposeAsync().ConfigureAwait(false); } catch { }
         }
     }
 
-    private sealed record Handle(IRecordingSession Session, IDisposable Subscription);
+    // WroteSegment is false when the recorder never got as far as opening a
+    // file — the camera refused or never answered, so nothing reached the
+    // Recordings tab.
+    public sealed record RecordingFailure(CameraId CameraId, string Message, bool WroteSegment = true);
+
+    // Per-session state. The error and the last inserted segment live here,
+    // never keyed by camera, so an old session can't explain a newer one's failure.
+    private sealed class Handle
+    {
+        private readonly object _queueGate = new();
+        private Task _queue = Task.CompletedTask;
+
+        public Handle(IRecordingSession session) => Session = session;
+
+        public IRecordingSession Session { get; }
+        public IDisposable? Subscription { get; set; }
+
+        // Set only once a row was inserted for it: a recorder may name its
+        // output file before it has even opened the camera.
+        public string? LastSegmentPath { get; set; }
+        public string? LastError { get; set; }
+
+        // Chains work behind whatever is queued, off the publisher's thread.
+        public void Enqueue(Func<Task> work)
+        {
+            lock (_queueGate)
+                _queue = _queue.ContinueWith(_ => work(), CancellationToken.None,
+                    TaskContinuationOptions.None, TaskScheduler.Default).Unwrap();
+        }
+
+        public Task DrainAsync()
+        {
+            lock (_queueGate) return _queue;
+        }
+    }
 
     private sealed class CallbackObserver : IObserver<RecordingEvent>
     {
diff --git a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegError.cs b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegError.cs
index d8c97a8..1689be7 100644
--- a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegError.cs
+++ b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegError.cs
@@ -1,18 +1,58 @@
 using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text.RegularExpressions;
 using FFmpeg.AutoGen.Abstractions;
 
 namespace OpenIPC.Viewer.Video.Pipeline;
 
-internal static class FfmpegError
+internal static partial class FfmpegError
 {
+    // FFmpeg on Windows maps socket failures to the MSVC CRT's POSIX errno
+    // values (ETIMEDOUT = 138, ...) or passes WSA codes through, and the CRT's
+    // strerror knows neither — av_strerror then prints "Error number -138
+    // occurred". Name the ones a camera connection actually hits.
+    private static readonly Dictionary<int, string> WindowsSocketErrors = new()
+    {
+        [100] = "Address already in use",
+        [106] = "Connection aborted",
+        [107] = "Connection refused",
+        [108] = "Connection reset by peer",
+        [110] = "Host is unreachable",
+        [116] = "Network is down",
+        [118] = "Network is unreachable",
+        [138] = "Connection timed out",
+        [10053] = "Connection aborted",
+        [10054] = "Connection reset by peer",
+        [10060] = "Connection timed out",
+        [10061] = "Connection refused",
+        [10051] = "Network is unreachable",
+        [10065] = "Host is unreachable",
+    };
+
+    [GeneratedRegex(@"Error number -(\d+) occurred")]
+    private static partial Regex UnknownErrnoRegex();
+
     public static unsafe string Describe(int code)
     {
         const int bufSize = 1024;
         var buffer = stackalloc byte[bufSize];
         ffmpeg.av_strerror(code, buffer, (ulong)bufSize);
-        return System.Runtime.InteropServices.Marshal.PtrToStringAnsi((IntPtr)buffer) ?? $"FFmpeg error {code}";
+        var text = System.Runtime.InteropServices.Marshal.PtrToStringAnsi((IntPtr)buffer) ?? $"FFmpeg error {code}";
+        return Humanize(text);
     }
 
+    // Swaps FFmpeg's "Error number -N occurred" for the socket error's name
+    // when N is one we know; anything else passes through untouched.
+    public static string Humanize(string text) =>
+        text.Contains("Error number -", StringComparison.Ordinal)
+            ? UnknownErrnoRegex().Replace(text, m =>
+                int.TryParse(m.Groups[1].Value, NumberStyles.None, CultureInfo.InvariantCulture, out var n)
+                && WindowsSocketErrors.TryGetValue(n, out var name)
+                    ? name
+                    : m.Value)
+            : text;
+
     public static void ThrowIfError(int code, string operation)
     {
         if (code < 0)
@@ -24,6 +64,10 @@ internal sealed class FfmpegException : Exception
 {
     public int Code { get; }
 
+    // The one call whose warnings explain its failure (#90); every caller
+    // clears native diagnostics right before it.
+    internal const string OpenInput = "avformat_open_input";
+
     public FfmpegException(string operation, int code)
         : base(Compose(operation, code))
     {
@@ -36,7 +80,7 @@ public FfmpegException(string operation, int code)
     private static string Compose(string operation, int code)
     {
         var msg = $"{operation} failed: {FfmpegError.Describe(code)} ({code})";
-        var native = FfmpegRuntime.TakeLastNativeError();
+        var native = FfmpegRuntime.TakeLastNativeError(includeWarning: operation == OpenInput);
         return string.IsNullOrEmpty(native) ? msg : $"{msg} — {native}";
     }
 }
diff --git a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegMediaProbe.cs b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegMediaProbe.cs
index 99acd84..0f46675 100644
--- a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegMediaProbe.cs
+++ b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegMediaProbe.cs
@@ -30,6 +30,7 @@ private unsafe MediaInfo Probe(string filePath)
         AVFormatContext* fmtCtx = null;
         try
         {
+            FfmpegRuntime.ClearLastNativeError();
             var ret = ffmpeg.avformat_open_input(&fmtCtx, filePath, null, null);
             FfmpegError.ThrowIfError(ret, "avformat_open_input");
 
diff --git a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegPlaybackSession.cs b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegPlaybackSession.cs
index 054d014..e03f342 100644
--- a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegPlaybackSession.cs
+++ b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegPlaybackSession.cs
@@ -241,6 +241,7 @@ private unsafe void Run()
         try
         {
             fmtCtx = ffmpeg.avformat_alloc_context();
+            FfmpegRuntime.ClearLastNativeError();
             var ret = ffmpeg.avformat_open_input(&fmtCtx, _options.FilePath, null, null);
             FfmpegError.ThrowIfError(ret, "avformat_open_input");
 
diff --git a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegRuntime.cs b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegRuntime.cs
index 9d381cb..a9e63c2 100644
--- a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegRuntime.cs
+++ b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegRuntime.cs
@@ -20,15 +20,32 @@ internal static class FfmpegRuntime
     // FfmpegException ctor on that same thread consumes it.
     [ThreadStatic] private static string? _lastNativeError;
 
+    // Fallback when nothing logged at error level: the RTSP demuxer reports a
+    // stalled handshake only as a warning ("Failed reading RTSP data: ...")
+    // and then returns a bare "Invalid data found" (#90).
+    [ThreadStatic] private static string? _lastNativeWarning;
+
     // Held so the GC can't collect the delegate while native code holds it.
     private static av_log_set_callback_callback? _logCallback;
 
-    internal static string? TakeLastNativeError()
+    // includeWarning: only for avformat_open_input, which clears the state
+    // right before the call — anywhere else a warning from an earlier call
+    // that succeeded would be pinned on an unrelated failure.
+    internal static string? TakeLastNativeError(bool includeWarning = false)
     {
-        var v = _lastNativeError;
+        var v = includeWarning ? _lastNativeError ?? _lastNativeWarning : _lastNativeError;
         _lastNativeError = null;
+        _lastNativeWarning = null;
         return v;
     }
+
+    // Drops whatever an earlier call on this thread left behind, so the next
+    // failure isn't explained by a stale line.
+    internal static void ClearLastNativeError()
+    {
+        _lastNativeError = null;
+        _lastNativeWarning = null;
+    }
     // Serializes the one-time native init. The old design used an Interlocked
     // CompareExchange flag, but that let the *second* caller return "ready"
     // the instant the first caller flipped the flag — before its (slow)
@@ -135,8 +152,10 @@ private static unsafe void LogCallback(void* avcl, int level, string fmt, byte*
         ffmpeg.av_log_format_line2(avcl, level, fmt, vl, buf, bufSize, &printPrefix);
         var msg = Marshal.PtrToStringAnsi((IntPtr)buf)?.Trim();
         if (string.IsNullOrEmpty(msg)) return;
+        msg = FfmpegError.Humanize(msg);
 
         if (level <= ffmpeg.AV_LOG_ERROR) _lastNativeError = msg;
+        else _lastNativeWarning = msg;
 
         // A logging sink must never throw back into native FFmpeg.
         try { NativeLog?.Invoke(level, msg); }
diff --git a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegVideoSession.cs b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegVideoSession.cs
index 29afec8..9450d1d 100644
--- a/src/OpenIPC.Viewer.Video/Pipeline/FfmpegVideoSession.cs
+++ b/src/OpenIPC.Viewer.Video/Pipeline/FfmpegVideoSession.cs
@@ -216,6 +216,7 @@ private unsafe void Run()
             var url = BuildUrlWithCredentials(_options.RtspUri, _options.Credentials);
 
             ArmIoDeadline(ConnectBudgetMs);
+            FfmpegRuntime.ClearLastNativeError();
             var ret = ffmpeg.avformat_open_input(&fmtCtx, url, null, &opts);
             ThrowIfIoError(ret, "avformat_open_input", ConnectBudgetMs);
 
diff --git a/src/OpenIPC.Viewer.Video/Recording/FfmpegCliOptions.cs b/src/OpenIPC.Viewer.Video/Recording/FfmpegCliOptions.cs
new file mode 100644
index 0000000..85a6880
--- /dev/null
+++ b/src/OpenIPC.Viewer.Video/Recording/FfmpegCliOptions.cs
@@ -0,0 +1,59 @@
+using System;
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Globalization;
+using System.Text.RegularExpressions;
+
+namespace OpenIPC.Viewer.Video.Recording;
+
+// Options whose spelling depends on which ffmpeg binary we shell out to. The
+// bundled one is 7.x, but the PATH fallback can be a distro build (4.4 on
+// Ubuntu 22.04, 4.3 on Debian 11).
+internal static partial class FfmpegCliOptions
+{
+    private static readonly ConcurrentDictionary<string, string> TimeoutFlags = new(StringComparer.Ordinal);
+
+    // "ffmpeg version 4.4.2-0ubuntu0.22.04.1", "ffmpeg version n7.1-…". Git
+    // snapshots ("N-112233-g…") don't match and count as current.
+    [GeneratedRegex(@"^ffmpeg version n?(\d+)\.\d+", RegexOptions.Multiline)]
+    private static partial Regex VersionRegex();
+
+    // The RTSP socket I/O timeout is "-timeout" from FFmpeg 5 on. In 4.x that
+    // name means "listen for an incoming connection" and the old "-stimeout"
+    // is the socket timeout, so passing the new name would turn the client
+    // into a server.
+    public static string RtspTimeoutFlag(string ffmpegPath) =>
+        TimeoutFlags.GetOrAdd(ffmpegPath, static path => MajorVersion(path) is int major and < 5 ? "-stimeout" : "-timeout");
+
+    private static int? MajorVersion(string ffmpegPath)
+    {
+        try
+        {
+            using var proc = Process.Start(new ProcessStartInfo(ffmpegPath)
+            {
+                ArgumentList = { "-hide_banner", "-version" },
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+                CreateNoWindow = true,
+            });
+            if (proc is null) return null;
+            var stdout = proc.StandardOutput.ReadToEndAsync();
+            _ = proc.StandardError.ReadToEndAsync();
+            if (!proc.WaitForExit(3000))
+            {
+                try { proc.Kill(entireProcessTree: true); } catch { /* already gone */ }
+                return null;
+            }
+            var m = VersionRegex().Match(stdout.Result);
+            return m.Success && int.TryParse(m.Groups[1].Value, NumberStyles.None, CultureInfo.InvariantCulture, out var v)
+                ? v
+                : null;
+        }
+        catch
+        {
+            // Missing binary or no permission: the recorder reports that itself.
+            return null;
+        }
+    }
+}
diff --git a/src/OpenIPC.Viewer.Video/Recording/FfmpegRecordingSession.cs b/src/OpenIPC.Viewer.Video/Recording/FfmpegRecordingSession.cs
index 53ce481..c2e8b7e 100644
--- a/src/OpenIPC.Viewer.Video/Recording/FfmpegRecordingSession.cs
+++ b/src/OpenIPC.Viewer.Video/Recording/FfmpegRecordingSession.cs
@@ -20,17 +20,27 @@ internal sealed partial class FfmpegRecordingSession : IRecordingSession
     [GeneratedRegex(@"Opening '([^']+)' for writing")]
     private static partial Regex OpeningRegex();
 
+    // Last stderr line that reads like a failure, kept so an unexpected exit
+    // can say why ("401 Unauthorized", "Connection timed out", ...).
+    [GeneratedRegex(@"error|failed|refused|timed out|invalid|unauthorized", RegexOptions.IgnoreCase)]
+    private static partial Regex FailureRegex();
+
     private static readonly TimeSpan StopGrace = TimeSpan.FromSeconds(5);
+    private const string RtspTimeoutMicros = "10000000";
 
     private readonly RecordingOptions _options;
     private readonly string _ffmpegPath;
     private readonly ILogger _logger;
-    private readonly Subject<RecordingEvent> _events = new();
+    // Replaying: the worker starts before RecordingService can subscribe, and
+    // a camera that refuses at once would otherwise Stop into the void.
+    private readonly ReplaySubject<RecordingEvent> _events = new(bufferSize: 8);
 
     private Process? _proc;
+    private Task _stderrPump = Task.CompletedTask;
     private string? _currentSegment;
     private string? _lastSegment;
-    private bool _stopRequested;
+    private volatile bool _stopRequested;
+    private volatile string? _lastFailureLine;
 
     public DateTime StartedAt { get; } = DateTime.UtcNow;
     public string? CurrentSegmentPath => _currentSegment;
@@ -77,6 +87,12 @@ public void Start()
         // no DB row is written and the recording never shows in the list.
         psi.ArgumentList.Add("-loglevel"); psi.ArgumentList.Add("verbose");
         psi.ArgumentList.Add("-rtsp_transport"); psi.ArgumentList.Add("tcp");
+        // RTSP socket I/O timeout (µs; FFmpeg 5 renamed stimeout → timeout,
+        // and the PATH fallback may still be a 4.x distro build).
+        // Without it a camera that accepts the TCP connect but never answers
+        // DESCRIBE parks ffmpeg in open forever: no segment is ever opened, so
+        // no row reaches the Recordings tab while REC keeps "running" (#91).
+        psi.ArgumentList.Add(FfmpegCliOptions.RtspTimeoutFlag(_ffmpegPath)); psi.ArgumentList.Add(RtspTimeoutMicros);
         psi.ArgumentList.Add("-i"); psi.ArgumentList.Add(BuildRtspUri(_options.RtspUri, _options.Credentials).ToString());
         psi.ArgumentList.Add("-c"); psi.ArgumentList.Add("copy");
         psi.ArgumentList.Add("-f"); psi.ArgumentList.Add("segment");
@@ -94,7 +110,7 @@ public void Start()
         _proc = Process.Start(psi)
             ?? throw new InvalidOperationException("Failed to launch ffmpeg (check PATH)");
 
-        _ = Task.Run(ReadStderrAsync);
+        _stderrPump = Task.Run(ReadStderrAsync);
         _ = Task.Run(WatchExitAsync);
     }
 
@@ -150,9 +166,14 @@ private async Task ReadStderrAsync()
             {
                 var m = OpeningRegex().Match(line);
                 if (m.Success)
+                {
                     HandleSegmentOpened(m.Groups[1].Value);
+                }
                 else
+                {
+                    if (FailureRegex().IsMatch(line)) _lastFailureLine = Pipeline.FfmpegError.Humanize(line);
                     _logger.LogDebug("ffmpeg[{Cam}]: {Line}", _options.CameraId, line);
+                }
             }
         }
         catch (Exception ex)
@@ -166,8 +187,21 @@ private async Task WatchExitAsync()
         if (_proc is null) return;
         try { await _proc.WaitForExitAsync().ConfigureAwait(false); }
         catch { /* ignore */ }
-        if (!_stopRequested)
-            EmitStopped(RecordingStopReason.ProcessExited);
+        if (_stopRequested) return;
+        // stderr hits EOF with the process; let the reader take ffmpeg's last
+        // words so the reason below is the actual one.
+        try { await _stderrPump.WaitAsync(TimeSpan.FromSeconds(2)).ConfigureAwait(false); }
+        catch { /* reason stays whatever we have */ }
+        var code = TryExitCode();
+        _logger.LogWarning("ffmpeg recorder for {Cam} exited unexpectedly (code {Code}): {Reason}",
+            _options.CameraId, code, _lastFailureLine ?? "no error output");
+        EmitStopped(RecordingStopReason.ProcessExited, _lastFailureLine);
+    }
+
+    private int? TryExitCode()
+    {
+        try { return _proc?.ExitCode; }
+        catch { return null; }
     }
 
     private void HandleSegmentOpened(string path)
@@ -187,9 +221,9 @@ private void HandleSegmentOpened(string path)
         }
     }
 
-    private void EmitStopped(RecordingStopReason reason)
+    private void EmitStopped(RecordingStopReason reason, string? detail = null)
     {
-        try { _events.OnNext(new RecordingEvent.Stopped(DateTime.UtcNow, reason)); }
+        try { _events.OnNext(new RecordingEvent.Stopped(DateTime.UtcNow, reason, detail)); }
         catch { /* observers may already be unsubscribed */ }
     }
 
diff --git a/src/OpenIPC.Viewer.Video/Recording/LibavformatClipExporter.cs b/src/OpenIPC.Viewer.Video/Recording/LibavformatClipExporter.cs
index 5b77d45..6cc9e9c 100644
--- a/src/OpenIPC.Viewer.Video/Recording/LibavformatClipExporter.cs
+++ b/src/OpenIPC.Viewer.Video/Recording/LibavformatClipExporter.cs
@@ -50,6 +50,7 @@ private unsafe void Run(ClipExportRequest request, TimeSpan dur, IProgress<doubl
         try
         {
             // --- Input ---
+            FfmpegRuntime.ClearLastNativeError();
             var ret = ffmpeg.avformat_open_input(&inputCtx, request.SourcePath, null, null);
             FfmpegError.ThrowIfError(ret, "avformat_open_input");
             ret = ffmpeg.avformat_find_stream_info(inputCtx, null);
diff --git a/src/OpenIPC.Viewer.Video/Recording/LibavformatRecordingSession.cs b/src/OpenIPC.Viewer.Video/Recording/LibavformatRecordingSession.cs
index 7fb1b11..dc8eb29 100644
--- a/src/OpenIPC.Viewer.Video/Recording/LibavformatRecordingSession.cs
+++ b/src/OpenIPC.Viewer.Video/Recording/LibavformatRecordingSession.cs
@@ -27,7 +27,9 @@ internal sealed class LibavformatRecordingSession : IRecordingSession
 
     private readonly RecordingOptions _options;
     private readonly ILogger _logger;
-    private readonly Subject<RecordingEvent> _events = new();
+    // Replaying: the worker starts before RecordingService can subscribe, and
+    // a camera that refuses at once would otherwise Stop into the void.
+    private readonly ReplaySubject<RecordingEvent> _events = new(bufferSize: 8);
     private readonly CancellationTokenSource _cts = new();
     private readonly TaskCompletionSource _stoppedTcs = new(TaskCreationOptions.RunContinuationsAsynchronously);
 
@@ -126,6 +128,7 @@ private unsafe void Run()
         int[] streamMap = System.Array.Empty<int>();
         var ct = _cts.Token;
         var stopReason = RecordingStopReason.User;
+        string? stopDetail = null;
 
         try
         {
@@ -146,6 +149,7 @@ private unsafe void Run()
                 opaque = null,
             };
             var url = BuildRtspUri(_options.RtspUri, _options.Credentials);
+            FfmpegRuntime.ClearLastNativeError();
             var ret = ffmpeg.avformat_open_input(&inputCtx, url, null, &inputOpts);
             FfmpegError.ThrowIfError(ret, "avformat_open_input");
 
@@ -216,7 +220,8 @@ private unsafe void Run()
                         stopReason = RecordingStopReason.ProcessExited;
                         break;
                     }
-                    _logger.LogWarning("av_read_frame failed: {Err}", FfmpegError.Describe(ret));
+                    stopDetail = FfmpegError.Describe(ret);
+                    _logger.LogWarning("av_read_frame failed: {Err}", stopDetail);
                     stopReason = RecordingStopReason.Error;
                     break;
                 }
@@ -256,6 +261,7 @@ private unsafe void Run()
             _logger.LogError(ex, "Recording loop failed");
             try { _events.OnNext(new RecordingEvent.Error(ex.Message)); } catch { }
             stopReason = RecordingStopReason.Error;
+            stopDetail = ex.Message;
         }
         finally
         {
@@ -273,7 +279,7 @@ private unsafe void Run()
             if (inputOpts != null) ffmpeg.av_dict_free(&inputOpts);
             if (outputOpts != null) ffmpeg.av_dict_free(&outputOpts);
 
-            try { _events.OnNext(new RecordingEvent.Stopped(DateTime.UtcNow, stopReason)); } catch { }
+            try { _events.OnNext(new RecordingEvent.Stopped(DateTime.UtcNow, stopReason, stopDetail)); } catch { }
             _stoppedTcs.TrySetResult();
         }
     }
diff --git a/src/OpenIPC.Viewer.Web/Api/LiveFfmpeg.cs b/src/OpenIPC.Viewer.Web/Api/LiveFfmpeg.cs
index cdc47bf..709963f 100644
--- a/src/OpenIPC.Viewer.Web/Api/LiveFfmpeg.cs
+++ b/src/OpenIPC.Viewer.Web/Api/LiveFfmpeg.cs
@@ -1,7 +1,9 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Globalization;
 using System.IO;
+using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 
@@ -21,7 +23,9 @@ public static Process Start(string rtspUrl, bool transcode)
             CreateNoWindow = true,
         };
 
-        var args = new List<string> { "-rtsp_transport", "tcp", "-fflags", "nobuffer", "-i", rtspUrl };
+        // RTSP socket I/O timeout (µs) so a silent camera ends the process
+        // instead of holding a connection open forever.
+        var args = new List<string> { "-rtsp_transport", "tcp", RtspTimeoutFlag(), RtspTimeoutMicros, "-fflags", "nobuffer", "-i", rtspUrl };
 
         // Audio rides along in the same stream instead of getting its own ffmpeg
         // session: AAC at 64 kbps is around a percent of the video bitrate, so
@@ -77,6 +81,48 @@ public static void Kill(Process? proc)
     // Also used by the snapshot endpoint, which spawns its own one-shot ffmpeg.
     public static string ResolveExecutable() => Resolve();
 
+    public const string RtspTimeoutMicros = "10000000";
+
+    private static string? _rtspTimeoutFlag;
+
+    // "-timeout" is the RTSP socket timeout from FFmpeg 5 on; in 4.x (the apt
+    // package on Ubuntu 22.04 / Debian 11) it means "listen for a connection"
+    // and the socket timeout is still "-stimeout". Probed once per process.
+    public static string RtspTimeoutFlag() => _rtspTimeoutFlag ??= ProbeMajorVersion(Resolve()) is int major and < 5 ? "-stimeout" : "-timeout";
+
+    private static int? ProbeMajorVersion(string ffmpeg)
+    {
+        try
+        {
+            using var proc = Process.Start(new ProcessStartInfo(ffmpeg)
+            {
+                ArgumentList = { "-hide_banner", "-version" },
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+                CreateNoWindow = true,
+            });
+            if (proc is null) return null;
+            var stdout = proc.StandardOutput.ReadToEndAsync();
+            _ = proc.StandardError.ReadToEndAsync();
+            if (!proc.WaitForExit(3000))
+            {
+                try { proc.Kill(entireProcessTree: true); } catch { /* already gone */ }
+                return null;
+            }
+            // "ffmpeg version 4.4.2-0ubuntu0.22.04.1", "ffmpeg version n7.1-…";
+            // git snapshots ("N-112233-g…") don't match and count as current.
+            var m = Regex.Match(stdout.Result, @"^ffmpeg version n?(\d+)\.\d+",
+                RegexOptions.Multiline);
+            return m.Success && int.TryParse(m.Groups[1].Value, NumberStyles.None,
+                CultureInfo.InvariantCulture, out var v) ? v : null;
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
     private static string Resolve()
     {
         string? rid = null;
diff --git a/src/OpenIPC.Viewer.Web/Api/SnapshotApi.cs b/src/OpenIPC.Viewer.Web/Api/SnapshotApi.cs
index 17e708c..3ba3667 100644
--- a/src/OpenIPC.Viewer.Web/Api/SnapshotApi.cs
+++ b/src/OpenIPC.Viewer.Web/Api/SnapshotApi.cs
@@ -120,7 +120,7 @@ public static void MapSnapshotEndpoints(this WebApplication app)
         };
         foreach (var arg in new[]
                  {
-                     "-rtsp_transport", "tcp", "-i", url,
+                     "-rtsp_transport", "tcp", LiveFfmpeg.RtspTimeoutFlag(), LiveFfmpeg.RtspTimeoutMicros, "-i", url,
                      "-frames:v", "1", "-q:v", "3",
                      "-f", "image2pipe", "-vcodec", "mjpeg", "pipe:1",
                  })
diff --git a/src/OpenIPC.Viewer.Web/Api/WebRecorder.cs b/src/OpenIPC.Viewer.Web/Api/WebRecorder.cs
index 78febfb..a96fb2f 100644
--- a/src/OpenIPC.Viewer.Web/Api/WebRecorder.cs
+++ b/src/OpenIPC.Viewer.Web/Api/WebRecorder.cs
@@ -93,7 +93,11 @@ public WebRecorder(IRecordingRepository repo, IFileSystem fs, ILogger<WebRecorde
         };
         foreach (var arg in new[]
                  {
-                     "-rtsp_transport", "tcp", "-i", rtspUrl,
+                     "-rtsp_transport", "tcp",
+                     // RTSP socket timeout (µs): a camera that accepts the connect
+                     // but never answers must not park ffmpeg in open forever.
+                     LiveFfmpeg.RtspTimeoutFlag(), LiveFfmpeg.RtspTimeoutMicros,
+                     "-i", rtspUrl,
                      // Copy, never re-encode: recording must not cost CPU per camera,
                      // and the archive should hold what the camera actually sent.
                      "-c", "copy",
@@ -127,11 +131,38 @@ public WebRecorder(IRecordingRepository repo, IFileSystem fs, ILogger<WebRecorde
         // Indexed while running, so a server that dies mid-recording still leaves
         // a row pointing at the partial file instead of an orphan on disk.
         await _repo.AddAsync(recording, ct);
-        _active[cameraId] = new ActiveRecording(process, recording, baseName, dir);
+        var active = new ActiveRecording(process, recording, baseName, dir);
+        _active[cameraId] = active;
+        _ = WatchForExitAsync(cameraId, active);
         _logger.LogInformation("Recording {Camera} to {Path}", camera.Name, path);
         return recording;
     }
 
+    // ffmpeg can end on its own: the camera went silent past the RTSP timeout,
+    // dropped the stream, or refused it outright. Without this the camera stayed
+    // "recording" (a new Start was refused) and its row kept a null EndedAt
+    // until someone pressed Stop.
+    private async Task WatchForExitAsync(string cameraId, ActiveRecording active)
+    {
+        try { await active.Process.WaitForExitAsync(); }
+        catch (Exception) { return; } // disposed by StopAsync — it owns the teardown
+
+        // Only if it is still ours: StopAsync removes the entry before stopping.
+        if (!_active.TryRemove(new KeyValuePair<string, ActiveRecording>(cameraId, active)))
+            return;
+
+        _logger.LogWarning("ffmpeg recording {Camera} exited on its own (code {Code})", cameraId, TryExitCode(active.Process));
+        try { await ReconcileSegmentsAsync(active, DateTime.UtcNow, CancellationToken.None); }
+        catch (Exception ex) { _logger.LogWarning(ex, "Failed to reconcile recording {Camera} after ffmpeg exited", cameraId); }
+        finally { active.Process.Dispose(); }
+    }
+
+    private static int? TryExitCode(Process process)
+    {
+        try { return process.ExitCode; }
+        catch (InvalidOperationException) { return null; }
+    }
+
     /// Returns the finished recording, or null when there was nothing to stop
     /// OR the camera produced an empty file (see below) — the caller tells the
     /// two apart with <see cref="IsRecording"/>.
diff --git a/tests/OpenIPC.Viewer.Core.Tests/Recording/RecordingServiceTests.cs b/tests/OpenIPC.Viewer.Core.Tests/Recording/RecordingServiceTests.cs
new file mode 100644
index 0000000..0f77f8f
--- /dev/null
+++ b/tests/OpenIPC.Viewer.Core.Tests/Recording/RecordingServiceTests.cs
@@ -0,0 +1,284 @@
+using OpenIPC.Viewer.Core.Entities;
+using OpenIPC.Viewer.Core.Platform;
+using OpenIPC.Viewer.Core.Recording;
+using OpenIPC.Viewer.Core.Services;
+using OpenIPC.Viewer.Core.Tests.Fakes;
+
+namespace OpenIPC.Viewer.Core.Tests.Recording;
+
+public sealed class RecordingServiceTests : IDisposable
+{
+    private readonly DirectoryInfo _root = Directory.CreateTempSubdirectory("openipc-rec-tests-");
+
+    public void Dispose()
+    {
+        try { _root.Delete(recursive: true); } catch { /* best effort */ }
+    }
+
+    [Fact]
+    public async Task RecorderExitingBeforeFirstSegment_ClearsActiveStateAndReportsNothingWritten()
+    {
+        var (service, recorder, repo, id) = await CreateAsync();
+        await service.StartAsync(id, CancellationToken.None);
+        Assert.True(service.IsRecording(id));
+
+        var failed = WaitForFailure(service);
+        recorder.Last!.Emit(new RecordingEvent.Stopped(DateTime.UtcNow, RecordingStopReason.ProcessExited, "Connection timed out"));
+        var e = await failed;
+
+        Assert.False(service.IsRecording(id));
+        Assert.Equal(id, e.CameraId);
+        Assert.False(e.WroteSegment);
+        Assert.Equal("Connection timed out", e.Message);
+        Assert.True(recorder.Last.Disposed);
+        Assert.Empty(repo.Rows);
+    }
+
+    [Fact]
+    public async Task RecorderDyingMidSegment_FinalizesTheOpenRow()
+    {
+        var (service, recorder, repo, id) = await CreateAsync();
+        await service.StartAsync(id, CancellationToken.None);
+
+        var session = recorder.Last!;
+        session.CurrentSegmentPath = Path.Combine(_root.FullName, "seg.mp4");
+        session.Emit(new RecordingEvent.Started(session.CurrentSegmentPath, DateTime.UtcNow));
+        await WaitUntilAsync(() => repo.Rows.Count == 1);
+
+        var failed = WaitForFailure(service);
+        session.Emit(new RecordingEvent.Stopped(DateTime.UtcNow, RecordingStopReason.Error));
+        var e = await failed;
+
+        Assert.True(e.WroteSegment);
+        Assert.False(service.IsRecording(id));
+        Assert.NotNull(Assert.Single(repo.Rows).EndedAt);
+    }
+
+    [Fact]
+    public async Task UserStop_DoesNotRaiseRecordingFailed()
+    {
+        var (service, recorder, _, id) = await CreateAsync();
+        await service.StartAsync(id, CancellationToken.None);
+
+        var raised = false;
+        service.RecordingFailed += (_, _) => raised = true;
+        await service.StopAsync(id, CancellationToken.None);
+        await Task.Delay(50);
+
+        Assert.False(raised);
+        Assert.False(service.IsRecording(id));
+        Assert.True(recorder.Last!.Disposed);
+    }
+
+    [Fact]
+    public async Task StopWhileStartedInsertIsPending_StillFinalizesTheRow()
+    {
+        var (service, recorder, repo, id) = await CreateAsync();
+        await service.StartAsync(id, CancellationToken.None);
+        repo.HoldAdds();
+
+        var session = recorder.Last!;
+        var path = Path.Combine(_root.FullName, "seg.mp4");
+        session.Emit(new RecordingEvent.Started(path, DateTime.UtcNow));
+        var failed = WaitForFailure(service);
+        session.Emit(new RecordingEvent.Stopped(DateTime.UtcNow, RecordingStopReason.ProcessExited));
+
+        await Task.Delay(50);
+        repo.ReleaseAdds();
+        var e = await failed;
+
+        Assert.True(e.WroteSegment);
+        Assert.NotNull(Assert.Single(repo.Rows).EndedAt);
+    }
+
+    [Fact]
+    public async Task OutputPathNamedButNothingStarted_ReportsNothingWritten()
+    {
+        // The libavformat session names its output file before it opens the camera.
+        var (service, recorder, repo, id) = await CreateAsync();
+        await service.StartAsync(id, CancellationToken.None);
+        recorder.Last!.CurrentSegmentPath = Path.Combine(_root.FullName, "never-written.mp4");
+
+        var failed = WaitForFailure(service);
+        recorder.Last.Emit(new RecordingEvent.Stopped(DateTime.UtcNow, RecordingStopReason.Error, "Connection refused"));
+        var e = await failed;
+
+        Assert.False(e.WroteSegment);
+        Assert.Empty(repo.Rows);
+    }
+
+    [Fact]
+    public async Task RecorderStoppingBeforeSubscription_IsStillCleanedUp()
+    {
+        var (service, recorder, _, id) = await CreateAsync();
+        recorder.StopImmediately = new RecordingEvent.Stopped(DateTime.UtcNow, RecordingStopReason.Error, "Connection refused");
+
+        var failed = WaitForFailure(service);
+        await service.StartAsync(id, CancellationToken.None);
+        var e = await failed;
+
+        Assert.Equal("Connection refused", e.Message);
+        Assert.False(service.IsRecording(id));
+    }
+
+    [Fact]
+    public async Task ErrorFromAnEarlierSession_DoesNotExplainALaterFailure()
+    {
+        var (service, recorder, _, id) = await CreateAsync();
+        await service.StartAsync(id, CancellationToken.None);
+        recorder.Last!.Emit(new RecordingEvent.Error("disk full"));
+        await service.StopAsync(id, CancellationToken.None);
+
+        await service.StartAsync(id, CancellationToken.None);
+        var failed = WaitForFailure(service);
+        recorder.Last!.Emit(new RecordingEvent.Stopped(DateTime.UtcNow, RecordingStopReason.ProcessExited, "Connection timed out"));
+        var e = await failed;
+
+        Assert.Equal("Connection timed out", e.Message);
+    }
+
+    private async Task<(RecordingService, FakeRecorder, FakeRecordingRepository, CameraId)> CreateAsync()
+    {
+        var cameras = new CameraDirectoryService(new InMemoryCameraRepository(), new InMemoryGroupRepository(), new InMemorySecretsStore());
+        var id = await cameras.AddAsync(new NewCameraRequest(
+            Name: "Yard",
+            Host: "192.168.1.10",
+            HttpPort: 80,
+            OnvifPort: null,
+            RtspMainUri: new Uri("rtsp://192.168.1.10/"),
+            RtspSubUri: null,
+            Credentials: null), CancellationToken.None);
+        var recorder = new FakeRecorder();
+        var repo = new FakeRecordingRepository();
+        var service = new RecordingService(recorder, repo, new TempFileSystem(_root), cameras);
+        return (service, recorder, repo, id);
+    }
+
+    private static Task<RecordingService.RecordingFailure> WaitForFailure(RecordingService service)
+    {
+        var tcs = new TaskCompletionSource<RecordingService.RecordingFailure>(TaskCreationOptions.RunContinuationsAsynchronously);
+        service.RecordingFailed += (_, e) => tcs.TrySetResult(e);
+        return tcs.Task.WaitAsync(TimeSpan.FromSeconds(5));
+    }
+
+    private static async Task WaitUntilAsync(Func<bool> condition)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(5);
+        while (!condition())
+        {
+            if (DateTime.UtcNow > deadline) throw new TimeoutException();
+            await Task.Delay(10);
+        }
+    }
+
+    private sealed class TempFileSystem : IFileSystem
+    {
+        public TempFileSystem(DirectoryInfo root) => AppDataDir = RecordingsDir = SnapshotsDir = root;
+        public DirectoryInfo AppDataDir { get; }
+        public DirectoryInfo RecordingsDir { get; }
+        public DirectoryInfo SnapshotsDir { get; }
+    }
+
+    private sealed class FakeRecorder : IRecorder
+    {
+        public FakeSession? Last { get; private set; }
+
+        // Published before the service can subscribe, like a camera refusing at once.
+        public RecordingEvent? StopImmediately { get; set; }
+
+        public Task<IRecordingSession> StartAsync(RecordingOptions options, CancellationToken ct)
+        {
+            Last = new FakeSession();
+            if (StopImmediately is { } ev) Last.Emit(ev);
+            return Task.FromResult<IRecordingSession>(Last);
+        }
+    }
+
+    // Replays what it published before a subscription, as the real sessions do.
+    private sealed class FakeSession : IRecordingSession, IObservable<RecordingEvent>
+    {
+        private readonly List<IObserver<RecordingEvent>> _observers = new();
+        private readonly List<RecordingEvent> _published = new();
+
+        public DateTime StartedAt { get; } = DateTime.UtcNow;
+        public string? CurrentSegmentPath { get; set; }
+        public IObservable<RecordingEvent> Events => this;
+        public bool Disposed { get; private set; }
+
+        public void Emit(RecordingEvent ev)
+        {
+            _published.Add(ev);
+            foreach (var o in _observers.ToArray()) o.OnNext(ev);
+        }
+
+        public Task StopAsync(CancellationToken ct)
+        {
+            Emit(new RecordingEvent.Stopped(DateTime.UtcNow, RecordingStopReason.User));
+            return Task.CompletedTask;
+        }
+
+        public ValueTask DisposeAsync()
+        {
+            Disposed = true;
+            return ValueTask.CompletedTask;
+        }
+
+        public IDisposable Subscribe(IObserver<RecordingEvent> observer)
+        {
+            _observers.Add(observer);
+            foreach (var ev in _published.ToArray()) observer.OnNext(ev);
+            return new Unsubscriber(() => _observers.Remove(observer));
+        }
+
+        private sealed class Unsubscriber(Action dispose) : IDisposable
+        {
+            public void Dispose() => dispose();
+        }
+    }
+
+    private sealed class FakeRecordingRepository : IRecordingRepository
+    {
+        private readonly object _gate = new();
+        private readonly List<Core.Recording.Recording> _rows = new();
+        private TaskCompletionSource? _addGate;
+
+        // Makes AddAsync wait (a slow or locked database) until ReleaseAdds.
+        public void HoldAdds() => _addGate = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        public void ReleaseAdds() => _addGate?.TrySetResult();
+
+        public IReadOnlyList<Core.Recording.Recording> Rows
+        {
+            get { lock (_gate) return _rows.ToList(); }
+        }
+
+        public Task<IReadOnlyList<Core.Recording.Recording>> ListAsync(CameraId? cameraId, CancellationToken ct) =>
+            Task.FromResult(Rows);
+
+        public async Task AddAsync(Core.Recording.Recording recording, CancellationToken ct)
+        {
+            if (_addGate is { } gate) await gate.Task;
+            lock (_gate) _rows.Add(recording);
+        }
+
+        public Task UpdateAsync(Core.Recording.Recording recording, CancellationToken ct)
+        {
+            lock (_gate)
+            {
+                var i = _rows.FindIndex(r => r.Id == recording.Id);
+                if (i >= 0) _rows[i] = recording;
+            }
+            return Task.CompletedTask;
+        }
+
+        public Task<Core.Recording.Recording?> GetByPathAsync(string filePath, CancellationToken ct)
+        {
+            lock (_gate) return Task.FromResult(_rows.FirstOrDefault(r => r.FilePath == filePath));
+        }
+
+        public Task RemoveAsync(RecordingId id, CancellationToken ct)
+        {
+            lock (_gate) _rows.RemoveAll(r => r.Id == id);
+            return Task.CompletedTask;
+        }
+    }
+}