@camstack/addon-mqtt-broker 1.2.45 → 1.2.46

package/dist/mqtt-broker.addon.js

@@ -8032,6 +8032,21 @@ var RelocateJobSchema = object({
 	bytesMoved: number().int(),
 	/** Total files discovered up front; null while (or when) unknown. */
 	filesTotal: number().int().nullable(),
+	/**
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
+	*
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	*/
+	rowsReconciled: number().int().nonnegative().optional(),
 	startedAt: number(),
 	finishedAt: number().nullable(),
 	error: string().nullable()
@@ -8100,14 +8115,42 @@ var RelocateMediaInputSchema = object({
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
 });
-/** How many rows still carry NO `locationId` — the population a repoint would
-*  silently re-aim at a disk that does not hold their bytes. Zero is the only
-*  value that permits a non-blocking `eventMedia` cutover. */
-var UnstampedEventMediaCountSchema = object({
-	media: number().int().nonnegative(),
-	retrainFrames: number().int().nonnegative(),
-	total: number().int().nonnegative()
+/**
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
+*
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
+*
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
+*/
+var UnstampedRowsSchema = object({
+	present: boolean(),
+	rows: number().int().nonnegative().nullable()
 });
+/**
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
+*
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -8218,6 +8261,10 @@ var StorageMigrationMoveProgressSchema = object({
 	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
 	filesTotal: number().int().nonnegative().nullable(),
 	bytesMoved: number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: number().int().nonnegative().optional(),
 	/** The MOVER's start, not the migration's: a drain restarted after an addon
 	*  crash gets a new mover, and a rate computed from the migration's start
 	*  would silently average in the time nothing was running. */

package/dist/mqtt-broker.addon.mjs

@@ -8027,6 +8027,21 @@ var RelocateJobSchema = object({
 	bytesMoved: number().int(),
 	/** Total files discovered up front; null while (or when) unknown. */
 	filesTotal: number().int().nullable(),
+	/**
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
+	*
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	*/
+	rowsReconciled: number().int().nonnegative().optional(),
 	startedAt: number(),
 	finishedAt: number().nullable(),
 	error: string().nullable()
@@ -8095,14 +8110,42 @@ var RelocateMediaInputSchema = object({
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
 });
-/** How many rows still carry NO `locationId` — the population a repoint would
-*  silently re-aim at a disk that does not hold their bytes. Zero is the only
-*  value that permits a non-blocking `eventMedia` cutover. */
-var UnstampedEventMediaCountSchema = object({
-	media: number().int().nonnegative(),
-	retrainFrames: number().int().nonnegative(),
-	total: number().int().nonnegative()
+/**
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
+*
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
+*
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
+*/
+var UnstampedRowsSchema = object({
+	present: boolean(),
+	rows: number().int().nonnegative().nullable()
 });
+/**
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
+*
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -8213,6 +8256,10 @@ var StorageMigrationMoveProgressSchema = object({
 	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
 	filesTotal: number().int().nonnegative().nullable(),
 	bytesMoved: number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: number().int().nonnegative().optional(),
 	/** The MOVER's start, not the migration's: a drain restarted after an addon
 	*  crash gets a new mover, and a rate computed from the migration's start
 	*  would silently average in the time nothing was running. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-mqtt-broker",
-  "version": "1.2.45",
+  "version": "1.2.46",
   "description": "MQTT broker registry addon for CamStack — manages external broker entries + an optional embedded aedes broker. Consumers spin up their own `mqtt.js` clients via the `mqtt-broker` cap.",
   "keywords": [
     "camstack",