@camstack/addon-pipeline 1.2.151 → 1.2.152

package/dist/audio-analyzer/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-hmG3nfuW.js");
-const require_process_memory = require("../process-memory-DR9jSxpX.js");
+const require_dist = require("../dist-BpofTthV.js");
+const require_process_memory = require("../process-memory-DglWLA3J.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/audio-analyzer/index.mjs

@@ -1,6 +1,6 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { A as audioAnalysisCapability, It as hydrateSchema, S as PoolMemoryWatchdog, _t as resolvePoolMemoryPolicy, j as audioAnalyzerCapability, jt as BaseAddon, n as AUDIO_BACKEND_CHOICES, nt as mapAudioLabelToMacro, s as DEFAULT_AUDIO_ANALYZER_CONFIG, v as HF_BASE_URL, wt as errMsg } from "../dist-BjzcUac4.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-4WDUPavu.mjs";
+import { A as audioAnalysisCapability, It as hydrateSchema, S as PoolMemoryWatchdog, _t as resolvePoolMemoryPolicy, j as audioAnalyzerCapability, jt as BaseAddon, n as AUDIO_BACKEND_CHOICES, nt as mapAudioLabelToMacro, s as DEFAULT_AUDIO_ANALYZER_CONFIG, v as HF_BASE_URL, wt as errMsg } from "../dist-DoaR6NDJ.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DJoquJSu.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { downloadFile } from "@camstack/system/addon-utils";

package/dist/detection-pipeline/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-hmG3nfuW.js");
-const require_node = require("../node-BwXwfrvA.js");
-const require_local_frame_registry = require("../local-frame-registry-Ct2vQ7Dp.js");
-const require_lazy_sharp = require("../lazy-sharp-RLE6klOt.js");
+const require_dist = require("../dist-BpofTthV.js");
+const require_node = require("../node-DG_kTYFM.js");
+const require_local_frame_registry = require("../local-frame-registry-4MCvZQ2t.js");
+const require_lazy_sharp = require("../lazy-sharp-D6sSNL-G.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
-const require_process_memory = require("../process-memory-DR9jSxpX.js");
+const require_process_memory = require("../process-memory-DglWLA3J.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/detection-pipeline/index.mjs

@@ -1,10 +1,10 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { Bt as nodePin, Ft as createEvent, It as hydrateSchema, Kt as array, O as YAMNET_TO_MACRO, Q as inferModelProvider, Qt as object, S as PoolMemoryWatchdog, St as supportedRuntimes$1, Vt as parseJsonUnknown, W as detectionPipelineCapability, Wt as sleep, Y as evaluateZoneRules, _t as resolvePoolMemoryPolicy, at as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, ct as pickClusterStepSettings, dt as pipelineExecutorCapability, en as string, et as loadContributionCapability, ht as resolveClusterStepModelId, jt as BaseAddon, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, q as enumerateInferenceDevices, st as pickClusterStepModels, t as APPLE_SA_TO_MACRO, tn as union, wt as errMsg, yt as runtimeDevices$1, z as defaultDeviceFor$1 } from "../dist-BjzcUac4.mjs";
-import { a as readProcessCost } from "../node-U9fJ-bQN.mjs";
-import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep, t as localFrameRegistry, u as landmarkPrecisionVerdict } from "../local-frame-registry-BFaxbRtK.mjs";
+import { Bt as nodePin, Ft as createEvent, It as hydrateSchema, Kt as array, O as YAMNET_TO_MACRO, Q as inferModelProvider, Qt as object, S as PoolMemoryWatchdog, St as supportedRuntimes$1, Vt as parseJsonUnknown, W as detectionPipelineCapability, Wt as sleep, Y as evaluateZoneRules, _t as resolvePoolMemoryPolicy, at as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, ct as pickClusterStepSettings, dt as pipelineExecutorCapability, en as string, et as loadContributionCapability, ht as resolveClusterStepModelId, jt as BaseAddon, l as DEFAULT_CLUSTER_STEP_SETTINGS, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, q as enumerateInferenceDevices, st as pickClusterStepModels, t as APPLE_SA_TO_MACRO, tn as union, wt as errMsg, yt as runtimeDevices$1, z as defaultDeviceFor$1 } from "../dist-DoaR6NDJ.mjs";
+import { a as readProcessCost } from "../node-CeSZTDKV.mjs";
+import { a as getDefaultModelForFormat, c as getStepDefinition, i as ALL_STEPS, l as resolveModelForFormat, o as getDefaultModelForFormatFromDef, r as ALL_PIPELINE_STEPS, s as getStep, t as localFrameRegistry, u as landmarkPrecisionVerdict } from "../local-frame-registry-Dr8irbU_.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-4WDUPavu.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-DJoquJSu.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { spawn } from "node:child_process";

package/dist/{dist-hmG3nfuW.js → dist-BpofTthV.js}

@@ -9338,6 +9338,21 @@ var RelocateJobSchema = object({
 	bytesMoved: number().int(),
 	/** Total files discovered up front; null while (or when) unknown. */
 	filesTotal: number().int().nullable(),
+	/**
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
+	*
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	*/
+	rowsReconciled: number().int().nonnegative().optional(),
 	startedAt: number(),
 	finishedAt: number().nullable(),
 	error: string().nullable()
@@ -9406,14 +9421,42 @@ var RelocateMediaInputSchema = object({
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
 });
-/** How many rows still carry NO `locationId` — the population a repoint would
-*  silently re-aim at a disk that does not hold their bytes. Zero is the only
-*  value that permits a non-blocking `eventMedia` cutover. */
-var UnstampedEventMediaCountSchema = object({
-	media: number().int().nonnegative(),
-	retrainFrames: number().int().nonnegative(),
-	total: number().int().nonnegative()
+/**
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
+*
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
+*
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
+*/
+var UnstampedRowsSchema = object({
+	present: boolean(),
+	rows: number().int().nonnegative().nullable()
 });
+/**
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
+*
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -9524,6 +9567,10 @@ var StorageMigrationMoveProgressSchema = object({
 	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
 	filesTotal: number().int().nonnegative().nullable(),
 	bytesMoved: number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: number().int().nonnegative().optional(),
 	/** The MOVER's start, not the migration's: a drain restarted after an addon
 	*  crash gets a new mover, and a rate computed from the migration's start
 	*  would silently average in the time nothing was running. */

package/dist/{dist-BjzcUac4.mjs → dist-DoaR6NDJ.mjs}

@@ -9315,6 +9315,21 @@ var RelocateJobSchema = object({
 	bytesMoved: number().int(),
 	/** Total files discovered up front; null while (or when) unknown. */
 	filesTotal: number().int().nullable(),
+	/**
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
+	*
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	*/
+	rowsReconciled: number().int().nonnegative().optional(),
 	startedAt: number(),
 	finishedAt: number().nullable(),
 	error: string().nullable()
@@ -9383,14 +9398,42 @@ var RelocateMediaInputSchema = object({
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
 });
-/** How many rows still carry NO `locationId` — the population a repoint would
-*  silently re-aim at a disk that does not hold their bytes. Zero is the only
-*  value that permits a non-blocking `eventMedia` cutover. */
-var UnstampedEventMediaCountSchema = object({
-	media: number().int().nonnegative(),
-	retrainFrames: number().int().nonnegative(),
-	total: number().int().nonnegative()
+/**
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
+*
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
+*
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
+*/
+var UnstampedRowsSchema = object({
+	present: boolean(),
+	rows: number().int().nonnegative().nullable()
 });
+/**
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
+*
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -9501,6 +9544,10 @@ var StorageMigrationMoveProgressSchema = object({
 	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
 	filesTotal: number().int().nonnegative().nullable(),
 	bytesMoved: number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: number().int().nonnegative().optional(),
 	/** The MOVER's start, not the migration's: a drain restarted after an addon
 	*  crash gets a new mover, and a rate computed from the migration's start
 	*  would silently average in the time nothing was running. */

package/dist/{lazy-sharp-RLE6klOt.js → lazy-sharp-D6sSNL-G.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-hmG3nfuW.js");
+const require_dist = require("./dist-BpofTthV.js");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path);
 let node_url = require("node:url");

package/dist/{local-frame-registry-Ct2vQ7Dp.js → local-frame-registry-4MCvZQ2t.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-hmG3nfuW.js");
+const require_dist = require("./dist-BpofTthV.js");
 let node_crypto = require("node:crypto");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/{local-frame-registry-BFaxbRtK.mjs → local-frame-registry-Dr8irbU_.mjs}

@@ -1,4 +1,4 @@
-import { M as audioKindId, Z as hfModelUrl, a as COCO_80_LABELS, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS } from "./dist-BjzcUac4.mjs";
+import { M as audioKindId, Z as hfModelUrl, a as COCO_80_LABELS, o as COCO_TO_MACRO, r as AUDIO_MACRO_LABELS } from "./dist-DoaR6NDJ.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-hmG3nfuW.js");
-const require_lazy_sharp = require("../lazy-sharp-RLE6klOt.js");
+const require_dist = require("../dist-BpofTthV.js");
+const require_lazy_sharp = require("../lazy-sharp-D6sSNL-G.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 //#region src/motion-wasm/wasm-motion-detector.ts

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, Pt as DeviceType, Y as evaluateZoneRules, it as motionDetectionCapability, jt as BaseAddon } from "../dist-BjzcUac4.mjs";
+import { It as hydrateSchema, Pt as DeviceType, Y as evaluateZoneRules, it as motionDetectionCapability, jt as BaseAddon } from "../dist-DoaR6NDJ.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{node-U9fJ-bQN.mjs → node-CeSZTDKV.mjs}

@@ -1,4 +1,4 @@
-import { Dt as buildFfmpegArgs, Et as Fmp4BoxSplitter, kt as isSoftwareDecode, wt as errMsg } from "./dist-BjzcUac4.mjs";
+import { Dt as buildFfmpegArgs, Et as Fmp4BoxSplitter, kt as isSoftwareDecode, wt as errMsg } from "./dist-DoaR6NDJ.mjs";
 import { randomUUID } from "node:crypto";
 import "node:fs";
 import "node:path";

package/dist/{node-BwXwfrvA.js → node-DG_kTYFM.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-hmG3nfuW.js");
+const require_dist = require("./dist-BpofTthV.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);

package/dist/pipeline-runner/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-hmG3nfuW.js");
-const require_node = require("../node-BwXwfrvA.js");
-const require_local_frame_registry = require("../local-frame-registry-Ct2vQ7Dp.js");
-const require_worker_protocol = require("../worker-protocol-DE_jjbFA.js");
+const require_dist = require("../dist-BpofTthV.js");
+const require_node = require("../node-DG_kTYFM.js");
+const require_local_frame_registry = require("../local-frame-registry-4MCvZQ2t.js");
+const require_worker_protocol = require("../worker-protocol-C8bHw-bu.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_lazy_sharp = require("../lazy-sharp-RLE6klOt.js");
+const require_lazy_sharp = require("../lazy-sharp-D6sSNL-G.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");

package/dist/pipeline-runner/index.mjs

@@ -1,7 +1,7 @@
-import { B as defineCustomActions, Bt as nodePin, Ft as createEvent, Gt as _enum, H as deriveDetailCropRect, Kt as array, L as customAction, Qt as object, X as failureContributionCapability, Xt as literal, Yt as lazy, Zt as number, _ as FailureCounters, en as string, et as loadContributionCapability, ft as pipelineRunnerCapability, jt as BaseAddon, lt as pickDetailCropConvention, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, p as DEFAULT_NATIVE_LEASE_SETTINGS, qt as boolean, u as DEFAULT_DETAIL_CROP_CONVENTION, ut as pickNativeLeaseOverride, wt as errMsg } from "../dist-BjzcUac4.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-U9fJ-bQN.mjs";
-import { c as getStepDefinition, n as resolveFrameViewGeometry, t as localFrameRegistry } from "../local-frame-registry-BFaxbRtK.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-BzlEZ56r.mjs";
+import { B as defineCustomActions, Bt as nodePin, Ft as createEvent, Gt as _enum, H as deriveDetailCropRect, Kt as array, L as customAction, Qt as object, X as failureContributionCapability, Xt as literal, Yt as lazy, Zt as number, _ as FailureCounters, en as string, et as loadContributionCapability, ft as pipelineRunnerCapability, jt as BaseAddon, lt as pickDetailCropConvention, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, p as DEFAULT_NATIVE_LEASE_SETTINGS, qt as boolean, u as DEFAULT_DETAIL_CROP_CONVENTION, ut as pickNativeLeaseOverride, wt as errMsg } from "../dist-DoaR6NDJ.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CeSZTDKV.mjs";
+import { c as getStepDefinition, n as resolveFrameViewGeometry, t as localFrameRegistry } from "../local-frame-registry-Dr8irbU_.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-Ar0-GAh5.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { n as withDetectionIntent } from "../restream-intent-B4BXZra7.mjs";

package/dist/{process-memory-4WDUPavu.mjs → process-memory-DJoquJSu.mjs}

@@ -1,4 +1,4 @@
-import { ot as parseProcStatus } from "./dist-BjzcUac4.mjs";
+import { ot as parseProcStatus } from "./dist-DoaR6NDJ.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-DR9jSxpX.js → process-memory-DglWLA3J.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-hmG3nfuW.js");
+const require_dist = require("./dist-BpofTthV.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
-const require_dist = require("../dist-hmG3nfuW.js");
-const require_node = require("../node-BwXwfrvA.js");
+const require_dist = require("../dist-BpofTthV.js");
+const require_node = require("../node-DG_kTYFM.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
@@ -1621,32 +1621,73 @@ function snapshot(j) {
 		filesMoved: j.filesMoved,
 		bytesMoved: j.bytesMoved,
 		filesTotal: j.filesTotal,
+		rowsReconciled: j.rowsReconciled,
 		startedAt: j.startedAt,
 		finishedAt: j.finishedAt,
 		error: j.error
 	};
 }
 /**
-* One file's COPY: copy-if-absent → verify size. The source is left in place.
+* The row's source file is not on disk.
+*
+* Carries `code: 'ENOENT'` because that is how every caller here already tells
+* a ghost row from a real failure, and {@link copyVerified} now discovers the
+* absence with a `stat` rather than by letting `copyFile` raise it.
+*/
+var RelocateSourceMissingError = class extends Error {
+	code = "ENOENT";
+	constructor(src) {
+		super(`relocate source missing: ${src}`);
+		this.name = "RelocateSourceMissingError";
+	}
+};
+/**
+* One file's COPY: copy-if-absent → verify the destination against the SOURCE'S
+* OWN SIZE. The source is left in place.
 *
 * Split out of {@link moveFile} because the durable index re-point has to
 * happen while BOTH locations still hold the bytes — see
-* `SegmentHourLedger.repointSegments`. Returns the bytes that were copied
-* (0 when the destination already held a complete copy).
+* `SegmentHourLedger.repointSegments`.
+*
+* **`recordedBytes` is never the verify's reference.** It used to be, and it
+* cannot be: `fs.copyFile` truncates and replaces, so the destination always
+* equals the source, and comparing that result against a number the LEDGER
+* remembers can only ever fail when the ledger is wrong. On 2026-08-30 that
+* reported a byte-perfect copy as corruption and killed a 110 749-file drain
+* on its 12 440th file:
+*
+*     relocate verify failed: …/1787926410000-9966-274432.m4s
+*       is 783801B, expected 274432B
+*
+* Both files measured 783801 B on the hub. What is faithful is "the
+* destination equals the source", and that is what is asserted here; the
+* recorded number survives only as the reference for a destination whose
+* source is already GONE, where there is nothing else left to compare against.
 */
-async function copyVerified(src, dst, srcBytes) {
-	let dstBytes = null;
-	try {
-		dstBytes = (await node_fs.promises.stat(dst)).size;
-	} catch {
-		dstBytes = null;
-	}
-	if (dstBytes === srcBytes) return 0;
+async function copyVerified(src, dst, recordedBytes) {
+	const dstBytes = await fileSize(dst);
+	const srcBytes = await fileSize(src);
+	if (dstBytes !== null && dstBytes === (srcBytes ?? recordedBytes)) return {
+		copied: 0,
+		srcBytes: dstBytes
+	};
+	if (srcBytes === null) throw new RelocateSourceMissingError(src);
 	await node_fs.promises.mkdir(node_path.default.dirname(dst), { recursive: true });
 	await node_fs.promises.copyFile(src, dst);
 	const after = await node_fs.promises.stat(dst);
 	if (after.size !== srcBytes) throw new Error(`relocate verify failed: ${dst} is ${after.size}B, expected ${srcBytes}B`);
-	return srcBytes;
+	return {
+		copied: srcBytes,
+		srcBytes
+	};
+}
+/** A file's size, or `null` when it is not there. */
+async function fileSize(p) {
+	try {
+		return (await node_fs.promises.stat(p)).size;
+	} catch {
+		return null;
+	}
 }
 var RelocateEngine = class {
 	deps;
@@ -1700,6 +1741,14 @@ var RelocateEngine = class {
 		if (!to) throw new Error(`unknown target location: ${input.toLocationId}`);
 		if (from.id === to.id) throw new Error("source and target locations are identical");
 		if (to.readOnly) throw new Error(`target location is read-only: ${to.id}`);
+		if (to.enabled === false) this.deps.logger.warn("relocate: target location is DISABLED (standby) — moving to it because the operator named it; placement still never chooses it for new writes", {
+			...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
+			meta: {
+				fromLocationId: from.id,
+				toLocationId: to.id,
+				footageClass: input.footageClass ?? null
+			}
+		});
 		const job = {
 			jobId: this.deps.newId(),
 			state: "queued",
@@ -1714,6 +1763,7 @@ var RelocateEngine = class {
 			filesMoved: 0,
 			bytesMoved: 0,
 			filesTotal: null,
+			rowsReconciled: 0,
 			startedAt: this.deps.now(),
 			finishedAt: null,
 			error: null,
@@ -1867,7 +1917,8 @@ var RelocateEngine = class {
 			toLocationId: job.toLocationId,
 			archiveSegments: job.filesTotal,
 			seen,
-			moved: job.filesMoved
+			moved: job.filesMoved,
+			rowsReconciled: job.rowsReconciled
 		};
 		if (archive === null) {
 			this.deps.logger.warn("relocate: coverage UNKNOWN — with no durable ledger this node cannot say what the source still holds", {
@@ -1962,6 +2013,56 @@ var RelocateEngine = class {
 		return `${DESTINATION_FULL_PREFIX}: ${to.id} has ${(Math.round(free * 100) / 100).toString()}% free, below its ${floor.toString()}% floor — everything not yet moved is still readable at ${job.fromLocationId}`;
 	}
 	/**
+	* The row as the TARGET should record it, given what the source file
+	* actually measured.
+	*
+	* Equal sizes — every ordinary segment — hand the row straight back. A
+	* disagreement is reconciled rather than carried over, and reconciling it
+	* means RENAMING: a segment's byte count is part of its name
+	* (`segmentRelPath`), the durable hour row derives `bytes` from those names
+	* (`hourAggregate`), and those sums are what `StorageEvictableProvider` reads
+	* when a disk fills. Copying the file under its wrong name would carry the
+	* wrong number to the new disk and leave nothing able to correct it — a disk
+	* walk re-parses the same name and agrees with itself.
+	*
+	* The rename happens at the DESTINATION, before the ledger is touched, so a
+	* crash here leaves the source wholly authoritative and untouched: the next
+	* run re-copies under the old name and re-renames. Nothing is dropped
+	* silently — every re-stamp is one `warn` with `tags: { deviceId }` and both
+	* numbers, and the count rides the job record to the operator.
+	*/
+	async reconciled(job, row, to, srcBytes) {
+		if (srcBytes === row.bytes) return row;
+		const fixed = restampSegmentBytes(row, srcBytes);
+		if (fixed === null) {
+			this.deps.logger.warn("relocate: the recorded size disagrees with the file, and the path is not a canonical segment name — moved as-is, the durable byte count stays WRONG", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					jobId: job.jobId,
+					path: row.path,
+					recordedBytes: row.bytes,
+					actualBytes: srcBytes
+				}
+			});
+			return row;
+		}
+		await node_fs.promises.rename(node_path.default.join(to.root, row.path), node_path.default.join(to.root, fixed.path));
+		job.rowsReconciled += 1;
+		this.deps.logger.warn("relocate: RECONCILED a row whose recorded size disagreed with the file — the file is the fact, the name and the durable row now say so", {
+			tags: { deviceId: row.deviceId },
+			meta: {
+				jobId: job.jobId,
+				fromPath: row.path,
+				toPath: fixed.path,
+				recordedBytes: row.bytes,
+				actualBytes: srcBytes,
+				deltaBytes: srcBytes - row.bytes,
+				toLocationId: to.id
+			}
+		});
+		return fixed;
+	}
+	/**
 	* Move ONE hour of one (device, profile): copy+verify every file, re-point
 	* the durable hour row, delete the sources, re-point the RAM index.
 	*
@@ -1980,9 +2081,12 @@ var RelocateEngine = class {
 			if (job.cancelRequested) return;
 			const src = node_path.default.join(from.root, row.path);
 			const dst = node_path.default.join(to.root, row.path);
+			let pacedBytes = row.bytes;
 			try {
-				copiedBytes += await copyVerified(src, dst, row.bytes);
-				movable.push(row);
+				const outcome = await copyVerified(src, dst, row.bytes);
+				pacedBytes = outcome.srcBytes;
+				copiedBytes += outcome.copied;
+				movable.push(await this.reconciled(job, row, to, outcome.srcBytes));
 			} catch (err) {
 				if (!isEnoent(err)) throw err;
 				this.deps.index.removeSegments([row.path]);
@@ -1994,7 +2098,7 @@ var RelocateEngine = class {
 					}
 				});
 			}
-			await sleep(row.bytes / bytesPerMs);
+			await sleep(pacedBytes / bytesPerMs);
 		}
 		if (movable.length === 0) return;
 		if (job.cancelRequested) return;
@@ -2017,11 +2121,16 @@ var RelocateEngine = class {
 			});
 			return;
 		}
-		if (!samePhysicalRoot) for (const row of movable) await node_fs.promises.rm(node_path.default.join(from.root, row.path), { force: true });
+		if (!samePhysicalRoot) for (const row of movable) await node_fs.promises.rm(node_path.default.join(from.root, row.fromPath ?? row.path), { force: true });
 		for (const row of movable) {
-			this.deps.index.removeSegments([row.path]);
+			this.deps.index.removeSegments([row.fromPath ?? row.path]);
 			this.deps.index.addSegment({
-				...row,
+				deviceId: row.deviceId,
+				profile: row.profile,
+				startMs: row.startMs,
+				durMs: row.durMs,
+				bytes: row.bytes,
+				path: row.path,
 				locationId: to.id
 			});
 		}
@@ -2031,6 +2140,25 @@ var RelocateEngine = class {
 	}
 };
 /**
+* The same segment, recorded at its REAL size — or `null` when this path is not
+* one this repo names, in which case nothing here may rename it.
+*
+* The refusal is a round-trip, not a shape guess: the canonical name for the
+* row's own fields must reproduce `row.path` exactly before the corrected name
+* is trusted. A path that fails it came from somewhere else (a hand-placed
+* file, a future layout), and renaming it would move footage to a name no
+* reader derives.
+*/
+function restampSegmentBytes(row, actualBytes) {
+	if (segmentRelPath(row.deviceId, row.profile, row.startMs, row.durMs, row.bytes) !== row.path) return null;
+	return {
+		...row,
+		bytes: actualBytes,
+		path: segmentRelPath(row.deviceId, row.profile, row.startMs, row.durMs, actualBytes),
+		fromPath: row.path
+	};
+}
+/**
 * The archive slice this job moves, or `null` when it selects nothing at all.
 *
 * ONE derivation for the census and for the stream. Deriving them separately
@@ -8630,6 +8758,13 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* the index `hydrated`: nothing would ever walk that hour again, and the
 	* segment would sit on disk permanently unreachable.
 	*
+	* **Two path sets, not one.** A path can arrive at the target under a
+	* DIFFERENT name than it leaves the source under: a mover that found a file
+	* larger than its recorded size reconciles the row, and the byte count is
+	* part of the name. So the source row is shrunk by what is LEAVING it and the
+	* target row grows by what is ARRIVING — conflating them would leave the
+	* source row naming a file the caller is about to delete.
+	*
 	* Returns `false` when NOTHING was repointed and the caller must delete
 	* nothing. An hour whose detail could not be read decides nothing (D49) —
 	* the same refusal {@link dropSegments} makes for eviction.
@@ -8642,11 +8777,15 @@ var SegmentHourLedger = class SegmentHourLedger {
 			const entry = byHour.get(key);
 			if (entry === void 0) byHour.set(key, {
 				row,
-				paths: new Set([row.path])
+				leaving: new Set([row.fromPath ?? row.path]),
+				arriving: new Set([row.path])
 			});
-			else entry.paths.add(row.path);
+			else {
+				entry.leaving.add(row.fromPath ?? row.path);
+				entry.arriving.add(row.path);
+			}
 		}
-		for (const [sourceKey, { row, paths }] of byHour) {
+		for (const [sourceKey, { row, leaving, arriving }] of byHour) {
 			const held = await this.resident(sourceKey, row.deviceId);
 			if (held === null) {
 				this.logger.warn("recorder: hour detail unavailable — this relocation is REFUSED and nothing is deleted; the segments stay where they are", {
@@ -8654,7 +8793,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 					meta: {
 						key: sourceKey,
 						toLocationId,
-						paths: paths.size
+						paths: leaving.size
 					}
 				});
 				return false;
@@ -8667,12 +8806,12 @@ var SegmentHourLedger = class SegmentHourLedger {
 					meta: {
 						key: targetKey,
 						fromLocationId: row.locationId,
-						paths: paths.size
+						paths: arriving.size
 					}
 				});
 				return false;
 			}
-			const merged = uniquePaths([...target?.paths ?? [], ...paths]);
+			const merged = uniquePaths([...target?.paths ?? [], ...arriving]);
 			await this.ledger.put(segmentHourRow({
 				key: targetKey,
 				deviceId: row.deviceId,
@@ -8681,7 +8820,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 				hourStartMs: held.hourStartMs,
 				paths: merged
 			}));
-			const next = held.paths.filter((p) => !paths.has(p));
+			const next = held.paths.filter((p) => !leaving.has(p));
 			if (next.length === 0) await this.ledger.forget(sourceKey);
 			else await this.ledger.put(segmentHourRow({
 				...held,