@camstack/addon-pipeline 1.2.145 → 1.2.148

package/dist/recorder/index.mjs

@@ -1,7 +1,8 @@
-import { $ as isFirstLevelMacroClass, $t as record, B as defineCustomActions, Bt as nodePin, E as RecordingConfigSchema, It as hydrateSchema, J as evaluateSensorEdge, Kt as array, L as customAction, N as batteryCapability, Nt as DeviceFeature, Pt as DeviceType, Qt as object, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as selectAssignedProfileSlots, V as deriveBatteryPresence, Zt as number, bt as storageEvictableCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as string, et as loadContributionCapability, g as ExportRecordSchema, i as BatteryStatusSchema, jt as BaseAddon, mt as recordingExportCapability, nn as EventCategory, pt as recordingCapability, qt as boolean, vt as resolveRecordingProfiles, wt as errMsg, x as OpsLogEntrySchema } from "../dist-cZopp8Xm.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-Br6p9KvD.mjs";
+import { $ as isFirstLevelMacroClass, $t as record, B as defineCustomActions, Bt as nodePin, E as RecordingConfigSchema, It as hydrateSchema, J as evaluateSensorEdge, Kt as array, L as customAction, N as batteryCapability, Nt as DeviceFeature, Pt as DeviceType, Qt as object, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as selectAssignedProfileSlots, V as deriveBatteryPresence, Zt as number, bt as storageEvictableCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as string, et as loadContributionCapability, g as ExportRecordSchema, i as BatteryStatusSchema, jt as BaseAddon, mt as recordingExportCapability, nn as EventCategory, pt as recordingCapability, qt as boolean, vt as resolveRecordingProfiles, wt as errMsg, x as OpsLogEntrySchema } from "../dist-DjplinYP.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-D7uxWSXD.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
+import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DMolfhsP.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";
@@ -48,321 +49,6 @@ function subscribeEventCapture(deps) {
 	});
 }
 //#endregion
-//#region src/recorder/object-trigger.ts
-/**
-* Il gate fra `pipeline-analytics.detection-event` e "apri una finestra di
-* registrazione".
-*
-* Fratello di `recorder/event-capture.ts` e per lo stesso motivo: la qualifica
-* ha dei rami, e un ramo che scarta lavoro senza dirlo è indistinguibile da una
-* funzione mai cablata. Ogni verdetto negativo NOMINA il motivo, e il chiamante
-* lo logga.
-*
-* Puro: nessun bus, nessun orologio, nessuna config. La scelta di QUALI classi
-* ascoltare è della banda (`bandTriggerSources`); qui si decide solo se
-* l'evento è una detection utilizzabile e di che macro classe è.
-*
-* ## Perché la forma è DISCRIMINATA su `kind` (2026-08-29)
-*
-* Fino al 2026-08-29 questo file dichiarava UNA sola forma piatta — quella
-* dell'evento `object` — e la pretendeva da OGNI payload del topic. Ma
-* `EventCategory.PipelineAnalyticsDetectionEvent` è un topic condiviso da tre
-* emettitori in `addon-post-analysis/src/pipeline-analytics/index.ts`: object
-* (`className`, `source`, `confidence`, `zones`), motion e audio — e motion e
-* audio non portano `className`, perché non ne hanno una. Il risultato misurato:
-* `malformed` su **394 righe campionate su 394**, a 3.3–3.9 eventi/s, per
-* settimane. `malformed` significa "l'emettitore è andato in deriva" ed era
-* invece il traffico normale del topic; l'unico secchio che poteva segnalare
-* una vera rottura di protocollo era saturo al 100% di eventi sani, quindi
-* inservibile — ed è stato letto come "il trigger object non ha mai funzionato".
-*
-* Quindi: si valida prima la BUSTA comune (`deviceId`, `kind`, `timestamp`),
-* poi si discrimina su `kind`, e solo il ramo `object` pretende i campi
-* dell'object. Un `object` senza `className` resta un difetto e ha il suo nome
-* (`malformed-object`), distinto da una busta illeggibile.
-*/
-/** Il `kind` dell'unico ramo del topic che può aprire una finestra. */
-var OBJECT_EVENT_KIND = "object";
-/** La sorgente implicita delle righe legacy senza `source` (`DetectionSourceSchema`). */
-var DEFAULT_DETECTION_SOURCE = "pipeline";
-/** Type guard, non cast: `event.data` è `unknown` finché non passa di qui. */
-function isDetectionEventEnvelope(value) {
-	if (typeof value !== "object" || value === null) return false;
-	if (!("deviceId" in value) || typeof value.deviceId !== "number") return false;
-	if (!Number.isFinite(value.deviceId)) return false;
-	if (!("kind" in value) || typeof value.kind !== "string") return false;
-	if (!("timestamp" in value) || typeof value.timestamp !== "number") return false;
-	if (!Number.isFinite(value.timestamp) || value.timestamp <= 0) return false;
-	return true;
-}
-/** I campi che SOLO il ramo object porta. Chiamata dopo la busta. */
-function isObjectDetectionEventData(value) {
-	if (!("className" in value) || typeof value.className !== "string") return false;
-	if ("source" in value && value.source !== void 0 && typeof value.source !== "string") return false;
-	return true;
-}
-function qualifyObjectTrigger(data) {
-	if (!isDetectionEventEnvelope(data)) return {
-		qualified: false,
-		reason: "malformed"
-	};
-	const deviceId = data.deviceId;
-	if (data.kind !== OBJECT_EVENT_KIND) return {
-		qualified: false,
-		reason: "not-object",
-		deviceId
-	};
-	if (!isObjectDetectionEventData(data)) return {
-		qualified: false,
-		reason: "malformed-object",
-		deviceId
-	};
-	if ((data.source ?? DEFAULT_DETECTION_SOURCE) !== DEFAULT_DETECTION_SOURCE) return {
-		qualified: false,
-		reason: "not-pipeline",
-		deviceId
-	};
-	const className = data.className.trim().toLowerCase();
-	if (!isFirstLevelMacroClass(className)) return {
-		qualified: false,
-		reason: "not-a-macro",
-		deviceId
-	};
-	return {
-		qualified: true,
-		deviceId,
-		macroClass: className,
-		atMs: data.timestamp
-	};
-}
-//#endregion
-//#region src/recorder/object-trigger-health.ts
-/** Ampiezza della finestra di aggregazione. Un minuto: abbastanza corto perché
-*  la riga arrivi entro il primo minuto di un deploy rotto, abbastanza lungo
-*  perché a 4 eventi/s il campione sia significativo. */
-var OBJECT_TRIGGER_HEALTH_WINDOW_MS = 6e4;
-function emptyTally() {
-	return {
-		objectEvents: 0,
-		qualified: 0,
-		otherKinds: 0,
-		byReason: /* @__PURE__ */ new Map()
-	};
-}
-function dominantReason(byReason) {
-	let reason = null;
-	let best = 0;
-	const counts = {};
-	for (const [r, n] of byReason) {
-		counts[r] = n;
-		if (n > best) {
-			best = n;
-			reason = r;
-		}
-	}
-	return {
-		reason,
-		counts
-	};
-}
-var ObjectTriggerHealth = class {
-	windowMs;
-	minSample;
-	buckets = /* @__PURE__ */ new Map();
-	windowStartMs = null;
-	constructor(windowMs = OBJECT_TRIGGER_HEALTH_WINDOW_MS, minSample = 5) {
-		this.windowMs = windowMs;
-		this.minSample = minSample;
-	}
-	/**
-	* Registra un verdetto e, se la finestra si è chiusa con questo evento,
-	* restituisce i report da stampare (e riapre la finestra). Nessun timer:
-	* il feed viaggia a ~4/s, quindi la chiusura arriva sempre in tempo, e una
-	* finestra che non si chiude è una finestra in cui non è successo nulla.
-	*/
-	record(verdict, nowMs) {
-		const reports = this.windowStartMs !== null && nowMs - this.windowStartMs >= this.windowMs ? this.drain(nowMs) : [];
-		this.windowStartMs ??= nowMs;
-		this.count(verdict);
-		return reports;
-	}
-	count(verdict) {
-		if (verdict.qualified) {
-			const t = this.bucket(verdict.deviceId);
-			t.objectEvents += 1;
-			t.qualified += 1;
-			return;
-		}
-		if (verdict.reason === "not-object") {
-			this.bucket(verdict.deviceId).otherKinds += 1;
-			return;
-		}
-		const key = verdict.reason === "malformed" ? null : verdict.deviceId;
-		const t = this.bucket(key);
-		t.objectEvents += 1;
-		t.byReason.set(verdict.reason, (t.byReason.get(verdict.reason) ?? 0) + 1);
-	}
-	bucket(key) {
-		const existing = this.buckets.get(key);
-		if (existing !== void 0) return existing;
-		const fresh = emptyTally();
-		this.buckets.set(key, fresh);
-		return fresh;
-	}
-	/** Chiude la finestra e restituisce un report per secchio non vuoto. */
-	drain(nowMs) {
-		const windowMs = this.windowStartMs === null ? 0 : nowMs - this.windowStartMs;
-		const out = [];
-		for (const [deviceId, t] of this.buckets) {
-			if (t.objectEvents === 0 && t.otherKinds === 0) continue;
-			const rejected = t.objectEvents - t.qualified;
-			const { reason, counts } = dominantReason(t.byReason);
-			out.push({
-				deviceId,
-				windowMs,
-				objectEvents: t.objectEvents,
-				qualified: t.qualified,
-				rejectedPct: t.objectEvents === 0 ? 0 : Math.round(rejected / t.objectEvents * 100),
-				otherKinds: t.otherKinds,
-				topReason: reason,
-				byReason: counts,
-				totalRejection: t.objectEvents >= this.minSample && t.qualified === 0
-			});
-		}
-		this.buckets.clear();
-		this.windowStartMs = nowMs;
-		return out;
-	}
-};
-//#endregion
-//#region src/recorder/sensor-trigger.ts
-/**
-* Da `DeviceStateChanged` a "quali camere devono registrare".
-*
-* Due responsabilità, entrambe in RAM e nessuna durevole:
-*  - la MEMORIA del fronte, per `(deviceId, capName)`, che rende `false→true`
-*    distinguibile da una ri-emissione. Il predicato è `evaluateSensorEdge`
-*    (`@camstack/types`) — la stessa tabella `SOURCE_CAP_ACTIVE_FIELD` del
-*    virtual-doorbell, non una copia;
-*  - l'INDICE INVERSO sorgente→camere, uno stato rispecchiato aggiornato FUORI
-*    dal percorso dell'evento (D49): `setBindings` è chiamato al boot dalle
-*    config già lette e a ogni `onConfigChanged`, che è un'RPC. Una lettura
-*    fallibile sul percorso del trigger potrebbe rispondere "nessuno ascolta"
-*    e perdere l'episodio, che è il fallimento contro cui D49 è scritta.
-*
-* L'ordine dei controlli è deliberato: `DeviceStateChanged` viaggia a ritmo di
-* bus su tutta la flotta (batteria, la `motion` nativa di ogni camera, la
-* connettività). L'indice inverso è una `Map.get` senza allocazioni e va per
-* primo; il fronte — che legge due tabelle e la slice — viene dopo. È la stessa
-* scelta che post-analysis scrive per la sua sottoscrizione: *"the
-* EVENT_KIND_BY_CAP gate runs FIRST so non-sensor cap churn exits before any
-* async work"*.
-*
-* Puro rispetto al mondo: nessun bus, nessun logger, nessun orologio proprio.
-* Il chiamante logga il verdetto — un ramo che non accende nulla lo DICE.
-*/
-/**
-* Type GUARD, not a cast: `event.data` is `unknown`, and a version-skewed
-* emitter must leave this router untouched rather than route a `deviceId` of
-* `undefined`. Same discipline as `parseTopologySnapshotNodes`.
-*
-* A missing or non-object `slice` is REFUSED rather than defaulted to `{}`:
-* `evaluateSensorEdge` would read `non-boolean-value` from an empty object and
-* that would look like a sensor reporting nonsense, when what actually
-* happened is that there was nothing to read.
-*/
-function parseSensorStateChanged(data) {
-	if (typeof data !== "object" || data === null) return null;
-	if (!("deviceId" in data) || typeof data.deviceId !== "number") return null;
-	if (!("capName" in data) || typeof data.capName !== "string") return null;
-	if (!("slice" in data) || typeof data.slice !== "object" || data.slice === null) return null;
-	const slice = { ...data.slice };
-	return {
-		deviceId: data.deviceId,
-		capName: data.capName,
-		slice
-	};
-}
-/**
-* sourceDeviceId → cameras whose config names it.
-*
-* From EVERY band, not only the one active now: the index only changes on a
-* config write, while the active band changes with the clock, and an index
-* that followed the clock would lose the first trigger after every band edge.
-* Filtering by band is already the gate's job — `bandTriggerSources` reads the
-* band active at the instant of evaluation.
-*
-* A disabled camera is skipped: it records nothing whatever a sensor does, and
-* it re-enters through `onConfigChanged`, which rebuilds this.
-*/
-function buildSensorTriggerBindings(configs) {
-	const index = /* @__PURE__ */ new Map();
-	for (const [cameraId, config] of configs) {
-		if (config.enabled !== true) continue;
-		for (const band of config.bands ?? []) for (const sourceDeviceId of band.triggers?.sensorDeviceIds ?? []) {
-			const cameras = index.get(sourceDeviceId) ?? /* @__PURE__ */ new Set();
-			cameras.add(cameraId);
-			index.set(sourceDeviceId, cameras);
-		}
-	}
-	return index;
-}
-var SensorTriggerRouter = class {
-	/** sourceDeviceId → camere la cui config lo nomina. */
-	bindings = /* @__PURE__ */ new Map();
-	/** Ultimo booleano osservato, per `${deviceId}:${capName}`. */
-	lastValues = /* @__PURE__ */ new Map();
-	now;
-	startedAtMs;
-	freshnessMs;
-	constructor(options) {
-		this.now = options.now;
-		this.startedAtMs = options.startedAtMs;
-		this.freshnessMs = options.firstSightingFreshnessMs ?? 3e4;
-	}
-	/**
-	* Sostituisce l'indice inverso. NON tocca `lastValues`: un sensore tolto e
-	* rimesso in una banda deve ritrovare il suo livello precedente, altrimenti
-	* la prima slice dopo il rientro sarebbe una "prima osservazione" e un
-	* contatto rimasto aperto tutto il tempo diventerebbe un fronte alto.
-	*/
-	setBindings(bindings) {
-		this.bindings = bindings;
-	}
-	/** Quali sorgenti l'indice contiene ora — per la riga di log al boot. */
-	listenedSourceIds() {
-		return [...this.bindings.keys()];
-	}
-	onStateSlice(deviceId, capName, slice) {
-		const cameras = this.bindings.get(deviceId);
-		if (cameras === void 0 || cameras.size === 0) return {
-			fired: [],
-			skipped: "not-listened"
-		};
-		const key = `${deviceId}:${capName}`;
-		const verdict = evaluateSensorEdge({
-			capName,
-			slice,
-			prior: this.lastValues.get(key),
-			startedAtMs: this.startedAtMs,
-			nowMs: this.now(),
-			firstSightingFreshnessMs: this.freshnessMs
-		});
-		if (verdict.edge === "none") {
-			if (verdict.value !== null) this.lastValues.set(key, verdict.value);
-			return {
-				fired: [],
-				skipped: verdict.reason
-			};
-		}
-		this.lastValues.set(key, true);
-		return {
-			fired: [...cameras],
-			skipped: null
-		};
-	}
-};
-//#endregion
 //#region src/recorder/init-info.ts
 /** Walk sibling boxes in [from, to), yielding [type, start, end]. */
 function* boxes$1(buf, view, from, to) {
@@ -818,13 +504,200 @@ var MfraTableStore = class {
 	get size() {
 		return this.tables.size;
 	}
-	/** Insertion order is time order, so the expired prefix is contiguous. */
-	prune() {
-		const cutoff = this.now() - MFRA_RETAIN_MS;
-		for (const [key, entry] of this.tables) {
-			if (entry.startMs >= cutoff) break;
-			this.tables.delete(key);
+	/** Insertion order is time order, so the expired prefix is contiguous. */
+	prune() {
+		const cutoff = this.now() - MFRA_RETAIN_MS;
+		for (const [key, entry] of this.tables) {
+			if (entry.startMs >= cutoff) break;
+			this.tables.delete(key);
+		}
+	}
+};
+//#endregion
+//#region src/recorder/object-trigger.ts
+/**
+* Il gate fra `pipeline-analytics.detection-event` e "apri una finestra di
+* registrazione".
+*
+* Fratello di `recorder/event-capture.ts` e per lo stesso motivo: la qualifica
+* ha dei rami, e un ramo che scarta lavoro senza dirlo è indistinguibile da una
+* funzione mai cablata. Ogni verdetto negativo NOMINA il motivo, e il chiamante
+* lo logga.
+*
+* Puro: nessun bus, nessun orologio, nessuna config. La scelta di QUALI classi
+* ascoltare è della banda (`bandTriggerSources`); qui si decide solo se
+* l'evento è una detection utilizzabile e di che macro classe è.
+*
+* ## Perché la forma è DISCRIMINATA su `kind` (2026-08-29)
+*
+* Fino al 2026-08-29 questo file dichiarava UNA sola forma piatta — quella
+* dell'evento `object` — e la pretendeva da OGNI payload del topic. Ma
+* `EventCategory.PipelineAnalyticsDetectionEvent` è un topic condiviso da tre
+* emettitori in `addon-post-analysis/src/pipeline-analytics/index.ts`: object
+* (`className`, `source`, `confidence`, `zones`), motion e audio — e motion e
+* audio non portano `className`, perché non ne hanno una. Il risultato misurato:
+* `malformed` su **394 righe campionate su 394**, a 3.3–3.9 eventi/s, per
+* settimane. `malformed` significa "l'emettitore è andato in deriva" ed era
+* invece il traffico normale del topic; l'unico secchio che poteva segnalare
+* una vera rottura di protocollo era saturo al 100% di eventi sani, quindi
+* inservibile — ed è stato letto come "il trigger object non ha mai funzionato".
+*
+* Quindi: si valida prima la BUSTA comune (`deviceId`, `kind`, `timestamp`),
+* poi si discrimina su `kind`, e solo il ramo `object` pretende i campi
+* dell'object. Un `object` senza `className` resta un difetto e ha il suo nome
+* (`malformed-object`), distinto da una busta illeggibile.
+*/
+/** Il `kind` dell'unico ramo del topic che può aprire una finestra. */
+var OBJECT_EVENT_KIND = "object";
+/** La sorgente implicita delle righe legacy senza `source` (`DetectionSourceSchema`). */
+var DEFAULT_DETECTION_SOURCE = "pipeline";
+/** Type guard, non cast: `event.data` è `unknown` finché non passa di qui. */
+function isDetectionEventEnvelope(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("deviceId" in value) || typeof value.deviceId !== "number") return false;
+	if (!Number.isFinite(value.deviceId)) return false;
+	if (!("kind" in value) || typeof value.kind !== "string") return false;
+	if (!("timestamp" in value) || typeof value.timestamp !== "number") return false;
+	if (!Number.isFinite(value.timestamp) || value.timestamp <= 0) return false;
+	return true;
+}
+/** I campi che SOLO il ramo object porta. Chiamata dopo la busta. */
+function isObjectDetectionEventData(value) {
+	if (!("className" in value) || typeof value.className !== "string") return false;
+	if ("source" in value && value.source !== void 0 && typeof value.source !== "string") return false;
+	return true;
+}
+function qualifyObjectTrigger(data) {
+	if (!isDetectionEventEnvelope(data)) return {
+		qualified: false,
+		reason: "malformed"
+	};
+	const deviceId = data.deviceId;
+	if (data.kind !== OBJECT_EVENT_KIND) return {
+		qualified: false,
+		reason: "not-object",
+		deviceId
+	};
+	if (!isObjectDetectionEventData(data)) return {
+		qualified: false,
+		reason: "malformed-object",
+		deviceId
+	};
+	if ((data.source ?? DEFAULT_DETECTION_SOURCE) !== DEFAULT_DETECTION_SOURCE) return {
+		qualified: false,
+		reason: "not-pipeline",
+		deviceId
+	};
+	const className = data.className.trim().toLowerCase();
+	if (!isFirstLevelMacroClass(className)) return {
+		qualified: false,
+		reason: "not-a-macro",
+		deviceId
+	};
+	return {
+		qualified: true,
+		deviceId,
+		macroClass: className,
+		atMs: data.timestamp
+	};
+}
+//#endregion
+//#region src/recorder/object-trigger-health.ts
+/** Ampiezza della finestra di aggregazione. Un minuto: abbastanza corto perché
+*  la riga arrivi entro il primo minuto di un deploy rotto, abbastanza lungo
+*  perché a 4 eventi/s il campione sia significativo. */
+var OBJECT_TRIGGER_HEALTH_WINDOW_MS = 6e4;
+function emptyTally() {
+	return {
+		objectEvents: 0,
+		qualified: 0,
+		otherKinds: 0,
+		byReason: /* @__PURE__ */ new Map()
+	};
+}
+function dominantReason(byReason) {
+	let reason = null;
+	let best = 0;
+	const counts = {};
+	for (const [r, n] of byReason) {
+		counts[r] = n;
+		if (n > best) {
+			best = n;
+			reason = r;
+		}
+	}
+	return {
+		reason,
+		counts
+	};
+}
+var ObjectTriggerHealth = class {
+	windowMs;
+	minSample;
+	buckets = /* @__PURE__ */ new Map();
+	windowStartMs = null;
+	constructor(windowMs = OBJECT_TRIGGER_HEALTH_WINDOW_MS, minSample = 5) {
+		this.windowMs = windowMs;
+		this.minSample = minSample;
+	}
+	/**
+	* Registra un verdetto e, se la finestra si è chiusa con questo evento,
+	* restituisce i report da stampare (e riapre la finestra). Nessun timer:
+	* il feed viaggia a ~4/s, quindi la chiusura arriva sempre in tempo, e una
+	* finestra che non si chiude è una finestra in cui non è successo nulla.
+	*/
+	record(verdict, nowMs) {
+		const reports = this.windowStartMs !== null && nowMs - this.windowStartMs >= this.windowMs ? this.drain(nowMs) : [];
+		this.windowStartMs ??= nowMs;
+		this.count(verdict);
+		return reports;
+	}
+	count(verdict) {
+		if (verdict.qualified) {
+			const t = this.bucket(verdict.deviceId);
+			t.objectEvents += 1;
+			t.qualified += 1;
+			return;
+		}
+		if (verdict.reason === "not-object") {
+			this.bucket(verdict.deviceId).otherKinds += 1;
+			return;
+		}
+		const key = verdict.reason === "malformed" ? null : verdict.deviceId;
+		const t = this.bucket(key);
+		t.objectEvents += 1;
+		t.byReason.set(verdict.reason, (t.byReason.get(verdict.reason) ?? 0) + 1);
+	}
+	bucket(key) {
+		const existing = this.buckets.get(key);
+		if (existing !== void 0) return existing;
+		const fresh = emptyTally();
+		this.buckets.set(key, fresh);
+		return fresh;
+	}
+	/** Chiude la finestra e restituisce un report per secchio non vuoto. */
+	drain(nowMs) {
+		const windowMs = this.windowStartMs === null ? 0 : nowMs - this.windowStartMs;
+		const out = [];
+		for (const [deviceId, t] of this.buckets) {
+			if (t.objectEvents === 0 && t.otherKinds === 0) continue;
+			const rejected = t.objectEvents - t.qualified;
+			const { reason, counts } = dominantReason(t.byReason);
+			out.push({
+				deviceId,
+				windowMs,
+				objectEvents: t.objectEvents,
+				qualified: t.qualified,
+				rejectedPct: t.objectEvents === 0 ? 0 : Math.round(rejected / t.objectEvents * 100),
+				otherKinds: t.otherKinds,
+				topReason: reason,
+				byReason: counts,
+				totalRejection: t.objectEvents >= this.minSample && t.qualified === 0
+			});
 		}
+		this.buckets.clear();
+		this.windowStartMs = nowMs;
+		return out;
 	}
 };
 var PendingGate = class {
@@ -948,14 +821,14 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$5 = 36e5;
+var HOUR_MS$6 = 36e5;
 /** A device walked end-to-end. Cheaper and clearer than inserting every hour of
 *  the retention window into the set. */
 var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
-	for (let h = first; h < toMs; h += HOUR_MS$5) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$6) * HOUR_MS$6;
+	for (let h = first; h < toMs; h += HOUR_MS$6) yield h;
 }
 /**
 * Index of the first element whose `startMs` is GREATER than `startMs` (upper
@@ -1245,7 +1118,7 @@ var RecordingIndex = class {
 			changed = true;
 		}
 		if (changed) this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$5);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$6);
 	}
 	/**
 	* Insert/replace one finalized segment (idempotent by path).
@@ -1491,22 +1364,41 @@ var RecordingIndex = class {
 		for (const m of this.byDevice.values()) for (const s of m.values()) if (s.locationId === locationId) out.push(s);
 		return out.toSorted((a, b) => a.startMs - b.startMs);
 	}
-	/** Binary-search a start-sorted slice for the segment containing epochMs. */
+	/**
+	* Binary-search a start-sorted slice for the segment containing `epochMs`,
+	* then walk backwards under {@link maxDurMs} while an earlier row could still
+	* cover it.
+	*
+	* ## Why the last row starting at-or-before the instant is not the answer
+	*
+	* It is the answer whenever it covers — and that case is unchanged, so the
+	* row this returns is the row it always returned. But the view is sorted by
+	* `startMs` and coverage is `startMs + durMs`, which is NOT sorted: a SHORT
+	* segment starting inside a longer overlapping one (a restart re-recording an
+	* hour) lands last and does not cover, while the long one enclosing it does.
+	* Stopping there reported a gap over footage that is on disk — a hole in the
+	* operator's timeline, and a `locateSegment` / `nearestCoveredEdge` answer
+	* that snapped past playable video.
+	*
+	* The walk is bounded exactly as {@link segmentsOverlapping} and
+	* {@link coveredEdgeBefore} bound theirs: once a candidate's ceiling
+	* `startMs + maxDurMs` no longer reaches past `epochMs`, no earlier row's can
+	* either — earlier rows start no later. The ceiling is checked AFTER the row
+	* itself, so a stale-narrow ceiling could only lengthen the walk, never skip
+	* a coverer.
+	*
+	* Boundary convention preserved verbatim: the window is `[startMs, startMs +
+	* durMs)`. `epochMs === startMs` is covered; `epochMs === startMs + durMs` is
+	* not. Among several covering rows the LATEST-starting one wins, which is
+	* what the plain binary search returned.
+	*/
 	segmentAtIn(segs, epochMs) {
-		if (segs.length === 0) return null;
-		let lo = 0;
-		let hi = segs.length - 1;
-		let cand = -1;
-		while (lo <= hi) {
-			const mid = lo + hi >> 1;
-			if (segs[mid].startMs <= epochMs) {
-				cand = mid;
-				lo = mid + 1;
-			} else hi = mid - 1;
+		for (let i = upperBoundByStart(segs, epochMs) - 1; i >= 0; i--) {
+			const s = segs[i];
+			if (epochMs < s.startMs + s.durMs) return s;
+			if (s.startMs + this.maxDurMs <= epochMs) break;
 		}
-		if (cand < 0) return null;
-		const seg = segs[cand];
-		return epochMs < seg.startMs + seg.durMs ? seg : null;
+		return null;
 	}
 	/** The segment whose [startMs, startMs+durMs) window contains `epochMs`, or null if `epochMs` falls in a gap / there is no footage. */
 	segmentAt(deviceId, profile, epochMs) {
@@ -1641,12 +1533,17 @@ function resolveEvictionDomain(locations, locationId, realpath = realpathSync) {
 * of disk decommissioning: mark the old location read-only (Phase 2), then
 * relocate its footage here, then delete the location.
 *
-* Mechanics, per file: throttled copy → size-verify → delete source → index
-* re-point. The copy is `copy-if-absent` (an equal-size destination is
-* adopted, not re-copied), so cancel/crash/re-run RESUMES instead of
-* restarting. Throttling is file-level pacing (segments are ~1–8 MB /
-* ~4 s, so per-file granularity bounds the rate tightly enough) — the drain
-* is a background chore that must never starve live writers.
+* Mechanics, per HOUR (D291): throttled copy + size-verify of every file in the
+* hour → re-point the DURABLE hour row → delete the sources → re-point the RAM
+* index. The hour is the batch because the durable index is hour-granular, and
+* the sources outlive the durable write on purpose: between the copy and the
+* delete both locations hold the hour, so no crash can leave the index naming a
+* location without the bytes. The copy is `copy-if-absent` (an equal-size
+* destination is adopted, not re-copied), so cancel/crash/re-run RESUMES
+* instead of restarting, and a cancel inside an hour leaves that hour WHOLLY
+* readable at the source. Throttling is file-level pacing (segments are
+* ~1–8 MB / ~4 s, so per-file granularity bounds the rate tightly enough) —
+* the drain is a background chore that must never starve live writers.
 *
 * Runs INSIDE the recorder process — container uid, same-uid files, no host
 * chown trap (see docs/history 2026-07-29).
@@ -1665,8 +1562,16 @@ function resolveEvictionDomain(locations, locationId, realpath = realpathSync) {
 *     strand the queue behind it.
 */
 var DEFAULT_THROTTLE_MBPS = 40;
+/** The durable index's bucket, and therefore this mover's batch. */
+var HOUR_MS$5 = 36e5;
 /** Progress callback cadence (files) — cheap enough to fire often. */
 var PROGRESS_EVERY_FILES = 25;
+/** Free space a destination must keep when it declares no `config.minFreePercent`
+*  — the same default `roots.ts` documents for placement. */
+var DEFAULT_MIN_FREE_PERCENT$1 = 10;
+/** Prefix every destination-full error carries, so the coordinator can report
+*  "drain stalled: destination full" instead of a raw ENOSPC string. */
+var DESTINATION_FULL_PREFIX = "destination full";
 function snapshot(j) {
 	return {
 		jobId: j.jobId,
@@ -1683,25 +1588,27 @@ function snapshot(j) {
 		error: j.error
 	};
 }
-/** One file's move: copy-if-absent → verify size → delete source. Returns the
-*  bytes that MOVED (0 when the destination was already complete). */
-async function moveFile(src, dst, srcBytes) {
-	let copied = 0;
+/**
+* One file's COPY: copy-if-absent → verify size. The source is left in place.
+*
+* Split out of {@link moveFile} because the durable index re-point has to
+* happen while BOTH locations still hold the bytes — see
+* `SegmentHourLedger.repointSegments`. Returns the bytes that were copied
+* (0 when the destination already held a complete copy).
+*/
+async function copyVerified(src, dst, srcBytes) {
 	let dstBytes = null;
 	try {
 		dstBytes = (await promises.stat(dst)).size;
 	} catch {
 		dstBytes = null;
 	}
-	if (dstBytes !== srcBytes) {
-		await promises.mkdir(path.dirname(dst), { recursive: true });
-		await promises.copyFile(src, dst);
-		const after = await promises.stat(dst);
-		if (after.size !== srcBytes) throw new Error(`relocate verify failed: ${dst} is ${after.size}B, expected ${srcBytes}B`);
-		copied = srcBytes;
-	}
-	await promises.rm(src, { force: true });
-	return copied;
+	if (dstBytes === srcBytes) return 0;
+	await promises.mkdir(path.dirname(dst), { recursive: true });
+	await promises.copyFile(src, dst);
+	const after = await promises.stat(dst);
+	if (after.size !== srcBytes) throw new Error(`relocate verify failed: ${dst} is ${after.size}B, expected ${srcBytes}B`);
+	return srcBytes;
 }
 var RelocateEngine = class {
 	deps;
@@ -1824,15 +1731,15 @@ var RelocateEngine = class {
 		const bytesPerMs = job.throttleMbps * 1024 * 1024 / 1e3;
 		try {
 			const samePhysicalRoot = await rootsPhysicallySame(from.root, to.root);
+			const upFront = await this.headroomRefusal(job, to, samePhysicalRoot);
+			if (upFront !== null) throw new Error(upFront);
 			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).filter((r) => job.profiles.length === 0 || job.profiles.includes(r.profile)).filter((r) => profileBelongsToClass(r.profile, job.footageClass)).filter((r) => job.sinceMs === null || r.startMs >= job.sinceMs).sort((a, b) => a.startMs - b.startMs);
 			job.filesTotal = segRows.length;
-			for (const row of segRows) {
+			for (const [, hourRows] of groupByHour(segRows)) {
 				if (job.cancelRequested) break;
-				await this.moveSegment(row, from, to, samePhysicalRoot);
-				job.filesMoved++;
-				job.bytesMoved += row.bytes;
-				if (job.filesMoved % PROGRESS_EVERY_FILES === 0) this.deps.onProgress?.(snapshot(job));
-				await sleep(row.bytes / bytesPerMs);
+				const refusal = await this.headroomRefusal(job, to, samePhysicalRoot);
+				if (refusal !== null) throw new Error(refusal);
+				await this.moveHour(job, hourRows, from, to, samePhysicalRoot, sleep, bytesPerMs);
 			}
 			async function rootsPhysicallySame(from, to) {
 				if (physicalRootKey(from) === physicalRootKey(to)) return true;
@@ -1859,15 +1766,76 @@ var RelocateEngine = class {
 			this.deps.onFinished?.(snapshot(job));
 		}
 	}
-	/** Move one segment file and re-point its index row to the target location
-	*  (same location-relative path — the layout is identical on every root).
-	*  A source that is already gone (evicted, never flushed, ENOSPC) is dropped
-	*  from the index and skipped — one ghost file must not abort a drain. */
-	async moveSegment(row, from, to, samePhysicalRoot) {
-		if (!samePhysicalRoot) try {
-			await moveFile(path.join(from.root, row.path), path.join(to.root, row.path), row.bytes);
-		} catch (err) {
-			if (isEnoent(err)) {
+	/**
+	* Why this drain must not put another hour on `to`, or `null` to proceed.
+	*
+	* Three deliberate non-refusals:
+	*
+	*  - **Same physical root.** The move is a re-stamp, not a copy: it consumes
+	*    one hour of transient duplication and gives it straight back. Refusing
+	*    there would block the one relocation that RELIEVES a full disk.
+	*  - **Unknown free space.** `null` is "the question was not answered", not
+	*    "there is no room". Refusing on unknown would strand every drain on a
+	*    filesystem `statfs` cannot describe, and the fallback — ENOSPC — is
+	*    already safe: D291 copies and verifies before any durable re-point, so
+	*    a full destination loses nothing. It is logged, because a check that
+	*    silently never fires is worse than no check.
+	*  - **`maxUsedGb`.** That is a cap on what recordings may OCCUPY, arbitrated
+	*    by the eviction sweep against the archive ledger — not free space on a
+	*    volume, and not a question a mover can answer with one syscall.
+	*/
+	async headroomRefusal(job, to, samePhysicalRoot) {
+		if (samePhysicalRoot) return null;
+		const free = await (this.deps.freePercentOf ?? volumeFreePercent)(to.root);
+		if (free === null) {
+			this.deps.logger.warn("relocate: destination free space is UNREADABLE — draining anyway, a full disk will surface as ENOSPC", {
+				...job.deviceId !== null ? { tags: { deviceId: job.deviceId } } : {},
+				meta: {
+					jobId: job.jobId,
+					toLocationId: to.id,
+					root: to.root
+				}
+			});
+			return null;
+		}
+		const floor = to.minFreePercent ?? DEFAULT_MIN_FREE_PERCENT$1;
+		if (free >= floor) return null;
+		this.deps.logger.warn("relocate: destination is at its free-space floor — drain stops here", {
+			...job.deviceId !== null ? { tags: { deviceId: job.deviceId } } : {},
+			meta: {
+				jobId: job.jobId,
+				toLocationId: to.id,
+				freePercent: Math.round(free * 100) / 100,
+				minFreePercent: floor,
+				filesMoved: job.filesMoved
+			}
+		});
+		return `${DESTINATION_FULL_PREFIX}: ${to.id} has ${(Math.round(free * 100) / 100).toString()}% free, below its ${floor.toString()}% floor — everything not yet moved is still readable at ${job.fromLocationId}`;
+	}
+	/**
+	* Move ONE hour of one (device, profile): copy+verify every file, re-point
+	* the durable hour row, delete the sources, re-point the RAM index.
+	*
+	* The order is the whole point. Between the copy and the delete both
+	* locations hold every byte, so the ledger re-point in the middle can only
+	* ever name a location that HAS the file — which is what makes a crash
+	* recoverable instead of a black window. A ledger that refuses (a failed
+	* point read: D49/D287) stops this hour dead with nothing deleted; the
+	* copies at the target are adopted by the next run.
+	*/
+	async moveHour(job, rows, from, to, samePhysicalRoot, sleep, bytesPerMs) {
+		const movable = [];
+		let copiedBytes = 0;
+		if (samePhysicalRoot) movable.push(...rows);
+		else for (const row of rows) {
+			if (job.cancelRequested) return;
+			const src = path.join(from.root, row.path);
+			const dst = path.join(to.root, row.path);
+			try {
+				copiedBytes += await copyVerified(src, dst, row.bytes);
+				movable.push(row);
+			} catch (err) {
+				if (!isEnoent(err)) throw err;
 				this.deps.index.removeSegments([row.path]);
 				this.deps.logger.warn("relocate skipped missing source", {
 					tags: { deviceId: row.deviceId },
@@ -1876,17 +1844,70 @@ var RelocateEngine = class {
 						locationId: from.id
 					}
 				});
-				return;
 			}
-			throw err;
+			await sleep(row.bytes / bytesPerMs);
 		}
-		this.deps.index.removeSegments([row.path]);
-		this.deps.index.addSegment({
-			...row,
-			locationId: to.id
+		if (movable.length === 0) return;
+		if (job.cancelRequested) return;
+		const ledger = this.deps.ledger?.() ?? null;
+		if (ledger === null) this.deps.logger.warn("relocate: NO durable hour ledger on this node — the re-point is RAM-only and will not survive a restart", {
+			tags: { deviceId: movable[0].deviceId },
+			meta: {
+				jobId: job.jobId,
+				toLocationId: to.id
+			}
 		});
+		else if (!await ledger.repointSegments(movable, to.id)) {
+			this.deps.logger.warn("relocate: hour NOT moved — the durable ledger refused the re-point, so the source bytes are kept", {
+				tags: { deviceId: movable[0].deviceId },
+				meta: {
+					jobId: job.jobId,
+					files: movable.length,
+					toLocationId: to.id
+				}
+			});
+			return;
+		}
+		if (!samePhysicalRoot) for (const row of movable) await promises.rm(path.join(from.root, row.path), { force: true });
+		for (const row of movable) {
+			this.deps.index.removeSegments([row.path]);
+			this.deps.index.addSegment({
+				...row,
+				locationId: to.id
+			});
+		}
+		job.filesMoved += movable.length;
+		job.bytesMoved += copiedBytes;
+		if (job.filesMoved % PROGRESS_EVERY_FILES < movable.length) this.deps.onProgress?.(snapshot(job));
 	}
 };
+/**
+* The job's rows bucketed by the hour row that describes them — `(device,
+* profile, hour)`, the durable ledger's own key minus its location half.
+* Insertion order preserves the caller's start-ascending sort, so a drain
+* still empties the oldest footage first.
+*/
+function groupByHour(rows) {
+	const out = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$5)}`;
+		const found = out.get(key);
+		if (found) found.push(row);
+		else out.set(key, [row]);
+	}
+	return out;
+}
+/** Free space on the volume behind `root`, as a percentage of total blocks.
+*  `null` when the volume cannot be described — never a number that guesses. */
+async function volumeFreePercent(root) {
+	try {
+		const st = await promises.statfs(root);
+		if (st.blocks <= 0) return null;
+		return st.bavail / st.blocks * 100;
+	} catch {
+		return null;
+	}
+}
 function isEnoent(err) {
 	return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
@@ -2209,6 +2230,134 @@ var macrotask$3 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
 //#endregion
+//#region src/recorder/sensor-trigger.ts
+/**
+* Da `DeviceStateChanged` a "quali camere devono registrare".
+*
+* Due responsabilità, entrambe in RAM e nessuna durevole:
+*  - la MEMORIA del fronte, per `(deviceId, capName)`, che rende `false→true`
+*    distinguibile da una ri-emissione. Il predicato è `evaluateSensorEdge`
+*    (`@camstack/types`) — la stessa tabella `SOURCE_CAP_ACTIVE_FIELD` del
+*    virtual-doorbell, non una copia;
+*  - l'INDICE INVERSO sorgente→camere, uno stato rispecchiato aggiornato FUORI
+*    dal percorso dell'evento (D49): `setBindings` è chiamato al boot dalle
+*    config già lette e a ogni `onConfigChanged`, che è un'RPC. Una lettura
+*    fallibile sul percorso del trigger potrebbe rispondere "nessuno ascolta"
+*    e perdere l'episodio, che è il fallimento contro cui D49 è scritta.
+*
+* L'ordine dei controlli è deliberato: `DeviceStateChanged` viaggia a ritmo di
+* bus su tutta la flotta (batteria, la `motion` nativa di ogni camera, la
+* connettività). L'indice inverso è una `Map.get` senza allocazioni e va per
+* primo; il fronte — che legge due tabelle e la slice — viene dopo. È la stessa
+* scelta che post-analysis scrive per la sua sottoscrizione: *"the
+* EVENT_KIND_BY_CAP gate runs FIRST so non-sensor cap churn exits before any
+* async work"*.
+*
+* Puro rispetto al mondo: nessun bus, nessun logger, nessun orologio proprio.
+* Il chiamante logga il verdetto — un ramo che non accende nulla lo DICE.
+*/
+/**
+* Type GUARD, not a cast: `event.data` is `unknown`, and a version-skewed
+* emitter must leave this router untouched rather than route a `deviceId` of
+* `undefined`. Same discipline as `parseTopologySnapshotNodes`.
+*
+* A missing or non-object `slice` is REFUSED rather than defaulted to `{}`:
+* `evaluateSensorEdge` would read `non-boolean-value` from an empty object and
+* that would look like a sensor reporting nonsense, when what actually
+* happened is that there was nothing to read.
+*/
+function parseSensorStateChanged(data) {
+	if (typeof data !== "object" || data === null) return null;
+	if (!("deviceId" in data) || typeof data.deviceId !== "number") return null;
+	if (!("capName" in data) || typeof data.capName !== "string") return null;
+	if (!("slice" in data) || typeof data.slice !== "object" || data.slice === null) return null;
+	const slice = { ...data.slice };
+	return {
+		deviceId: data.deviceId,
+		capName: data.capName,
+		slice
+	};
+}
+/**
+* sourceDeviceId → cameras whose config names it.
+*
+* From EVERY band, not only the one active now: the index only changes on a
+* config write, while the active band changes with the clock, and an index
+* that followed the clock would lose the first trigger after every band edge.
+* Filtering by band is already the gate's job — `bandTriggerSources` reads the
+* band active at the instant of evaluation.
+*
+* A disabled camera is skipped: it records nothing whatever a sensor does, and
+* it re-enters through `onConfigChanged`, which rebuilds this.
+*/
+function buildSensorTriggerBindings(configs) {
+	const index = /* @__PURE__ */ new Map();
+	for (const [cameraId, config] of configs) {
+		if (config.enabled !== true) continue;
+		for (const band of config.bands ?? []) for (const sourceDeviceId of band.triggers?.sensorDeviceIds ?? []) {
+			const cameras = index.get(sourceDeviceId) ?? /* @__PURE__ */ new Set();
+			cameras.add(cameraId);
+			index.set(sourceDeviceId, cameras);
+		}
+	}
+	return index;
+}
+var SensorTriggerRouter = class {
+	/** sourceDeviceId → camere la cui config lo nomina. */
+	bindings = /* @__PURE__ */ new Map();
+	/** Ultimo booleano osservato, per `${deviceId}:${capName}`. */
+	lastValues = /* @__PURE__ */ new Map();
+	now;
+	startedAtMs;
+	freshnessMs;
+	constructor(options) {
+		this.now = options.now;
+		this.startedAtMs = options.startedAtMs;
+		this.freshnessMs = options.firstSightingFreshnessMs ?? 3e4;
+	}
+	/**
+	* Sostituisce l'indice inverso. NON tocca `lastValues`: un sensore tolto e
+	* rimesso in una banda deve ritrovare il suo livello precedente, altrimenti
+	* la prima slice dopo il rientro sarebbe una "prima osservazione" e un
+	* contatto rimasto aperto tutto il tempo diventerebbe un fronte alto.
+	*/
+	setBindings(bindings) {
+		this.bindings = bindings;
+	}
+	/** Quali sorgenti l'indice contiene ora — per la riga di log al boot. */
+	listenedSourceIds() {
+		return [...this.bindings.keys()];
+	}
+	onStateSlice(deviceId, capName, slice) {
+		const cameras = this.bindings.get(deviceId);
+		if (cameras === void 0 || cameras.size === 0) return {
+			fired: [],
+			skipped: "not-listened"
+		};
+		const key = `${deviceId}:${capName}`;
+		const verdict = evaluateSensorEdge({
+			capName,
+			slice,
+			prior: this.lastValues.get(key),
+			startedAtMs: this.startedAtMs,
+			nowMs: this.now(),
+			firstSightingFreshnessMs: this.freshnessMs
+		});
+		if (verdict.edge === "none") {
+			if (verdict.value !== null) this.lastValues.set(key, verdict.value);
+			return {
+				fired: [],
+				skipped: verdict.reason
+			};
+		}
+		this.lastValues.set(key, true);
+		return {
+			fired: [...cameras],
+			skipped: null
+		};
+	}
+};
+//#endregion
 //#region src/recorder/still/still-source.ts
 /**
 * Resolve the low segment covering `epochMs` and the seek offset from that
@@ -12463,11 +12612,17 @@ var SegmentHourLedger = class {
 					offset
 				}
 			});
+			let met = false;
 			for (const record of records) {
 				chosen.push(record.id);
 				const bytes = record.data["bytes"];
 				covered += typeof bytes === "number" ? bytes : 0;
+				if (covered >= targetBytes) {
+					met = true;
+					break;
+				}
 			}
+			if (met) break;
 			offset += records.length;
 			if (records.length < 32) {
 				exhausted = true;
@@ -12642,6 +12797,89 @@ var SegmentHourLedger = class {
 		}
 	}
 	/**
+	* Move `rows` from the hour rows they are listed in today to the SAME hours
+	* at `toLocationId` — the DURABLE half of a relocation.
+	*
+	* Without this the mover re-points only `RecordingIndex`, which is RAM. Since
+	* D287 a closed hour is hydrated from the ledger FIRST and the disk is not
+	* consulted at all when the ledger covered the window, so a relocated hour
+	* comes back at its OLD location on the next boot — paths under a root that
+	* no longer holds the file. Playback does not stat (that syscall per segment
+	* was removed deliberately), so the result is a silent black window; and once
+	* the drained location is deleted, `collectRangeSegments` drops the rows
+	* outright and the footage is invisible. That is the shape of the 2 131
+	* `recordings:high` ghost segments already on this hub.
+	*
+	* **The ordering is the invariant, not an implementation detail.** The
+	* destination row is written BEFORE the source row is shrunk, and the caller
+	* has not yet deleted the source bytes — so the only state a crash can leave
+	* is "listed at BOTH locations, both of which hold the file", which resolves
+	* correctly whichever row hydrate happens to apply last. The reverse order
+	* has a window in which the path is in NO row, and a ledger-known hour marks
+	* the index `hydrated`: nothing would ever walk that hour again, and the
+	* segment would sit on disk permanently unreachable.
+	*
+	* Returns `false` when NOTHING was repointed and the caller must delete
+	* nothing. An hour whose detail could not be read decides nothing (D49) —
+	* the same refusal {@link dropSegments} makes for eviction.
+	*/
+	async repointSegments(rows, toLocationId) {
+		const byHour = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			if (row.locationId === toLocationId) continue;
+			const { key } = hourOf(row);
+			const entry = byHour.get(key);
+			if (entry === void 0) byHour.set(key, {
+				row,
+				paths: new Set([row.path])
+			});
+			else entry.paths.add(row.path);
+		}
+		for (const [sourceKey, { row, paths }] of byHour) {
+			const held = await this.resident(sourceKey, row.deviceId);
+			if (held === null) {
+				this.logger.warn("recorder: hour detail unavailable — this relocation is REFUSED and nothing is deleted; the segments stay where they are", {
+					tags: { deviceId: row.deviceId },
+					meta: {
+						key: sourceKey,
+						toLocationId,
+						paths: paths.size
+					}
+				});
+				return false;
+			}
+			const targetKey = segmentHourKey(row.deviceId, row.profile, toLocationId, held.hourStartMs);
+			const target = this.ledger.has(targetKey) ? await this.resident(targetKey, row.deviceId) : void 0;
+			if (target === null) {
+				this.logger.warn("recorder: TARGET hour detail unavailable — this relocation is REFUSED; appending to a summary would rewrite the hour as these paths alone", {
+					tags: { deviceId: row.deviceId },
+					meta: {
+						key: targetKey,
+						fromLocationId: row.locationId,
+						paths: paths.size
+					}
+				});
+				return false;
+			}
+			const merged = uniquePaths([...target?.paths ?? [], ...paths]);
+			await this.ledger.put(segmentHourRow({
+				key: targetKey,
+				deviceId: row.deviceId,
+				profile: row.profile,
+				locationId: toLocationId,
+				hourStartMs: held.hourStartMs,
+				paths: merged
+			}));
+			const next = held.paths.filter((p) => !paths.has(p));
+			if (next.length === 0) await this.ledger.forget(sourceKey);
+			else await this.ledger.put(segmentHourRow({
+				...held,
+				paths: next
+			}));
+		}
+		return true;
+	}
+	/**
 	* After a disk walk of `deviceIds`, make the ledger match the index — with
 	* two D148 exceptions:
 	*
@@ -13363,6 +13601,16 @@ var RecorderV2Addon = class extends BaseAddon {
 	isRecordingNode = true;
 	index = new RecordingIndex();
 	/**
+	* Stops the GC-attributing stall monitor armed in {@link onInitialize}.
+	*
+	* REUSED, not re-implemented, and not promoted: `startEventLoopStallMonitor`
+	* already ships inside `@camstack/addon-pipeline` — the same bundle as this
+	* addon — and moving it into `@camstack/system` would duplicate a mechanism
+	* that already exists (forbidden) or relocate it across a package boundary,
+	* which is a refactor with a slower ship chain, not a measurement.
+	*/
+	stopStallMonitor = null;
+	/**
 	* Durable hour-directory copy of {@link index}. Null on an inert
 	* (non-recording) node. Boot reseeds the RAM index from this; the
 	* deferred archive walk reconciles it against disk.
@@ -13530,6 +13778,7 @@ var RecorderV2Addon = class extends BaseAddon {
 		} });
 	}
 	async onInitialize() {
+		this.stopStallMonitor = startEventLoopStallMonitor(this.ctx.logger);
 		const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
 		this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
 		const configuredNode = this.config.recordingNodeId;
@@ -13722,6 +13971,7 @@ var RecorderV2Addon = class extends BaseAddon {
 		const relocateEngine = new RelocateEngine({
 			index: this.index,
 			locations: () => this.resolvedLocations,
+			ledger: () => this.segmentHours,
 			logger: this.ctx.logger.child("relocate"),
 			now: () => Date.now(),
 			newId: () => randomUUID(),
@@ -13969,6 +14219,8 @@ var RecorderV2Addon = class extends BaseAddon {
 		};
 	}
 	async onShutdown() {
+		this.stopStallMonitor?.();
+		this.stopStallMonitor = null;
 		this.eventUnsub?.();
 		this.eventUnsub = null;
 		this.audioTriggerUnsub?.();