@camstack/addon-pipeline 1.2.153 → 1.2.155

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
-const require_dist = require("../dist-DnVnWACi.js");
-const require_node = require("../node-C5xmFvjS.js");
+const require_dist = require("../dist-CmrtJ8RB.js");
+const require_node = require("../node-BSeMUwxJ.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
@@ -608,7 +608,7 @@ function qualifyObjectTrigger(data) {
 *  la riga arrivi entro il primo minuto di un deploy rotto, abbastanza lungo
 *  perché a 4 eventi/s il campione sia significativo. */
 var OBJECT_TRIGGER_HEALTH_WINDOW_MS = 6e4;
-function emptyTally$1() {
+function emptyTally$2() {
 	return {
 		objectEvents: 0,
 		qualified: 0,
@@ -672,7 +672,7 @@ var ObjectTriggerHealth = class {
 	bucket(key) {
 		const existing = this.buckets.get(key);
 		if (existing !== void 0) return existing;
-		const fresh = emptyTally$1();
+		const fresh = emptyTally$2();
 		this.buckets.set(key, fresh);
 		return fresh;
 	}
@@ -822,14 +822,14 @@ function parseSegmentPath(relPath) {
 //#region src/recorder/recording-index.ts
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
-var HOUR_MS$7 = 36e5;
+var HOUR_MS$8 = 36e5;
 /** A device walked end-to-end. Cheaper and clearer than inserting every hour of
 *  the retention window into the set. */
 var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
-	const first = Math.floor(fromMs / HOUR_MS$7) * HOUR_MS$7;
-	for (let h = first; h < toMs; h += HOUR_MS$7) yield h;
+	const first = Math.floor(fromMs / HOUR_MS$8) * HOUR_MS$8;
+	for (let h = first; h < toMs; h += HOUR_MS$8) yield h;
 }
 /**
 * Index of the first element whose `startMs` is GREATER than `startMs` (upper
@@ -1123,7 +1123,7 @@ var RecordingIndex = class {
 			changed = true;
 		}
 		if (changed) this.invalidateSorted(deviceId);
-		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$7);
+		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$8);
 	}
 	/**
 	* Insert/replace one finalized segment (idempotent by path).
@@ -1241,35 +1241,6 @@ var RecordingIndex = class {
 	hasSegment(deviceId, relPath) {
 		return this.byDevice.get(deviceId)?.has(relPath) === true;
 	}
-	/**
-	* Indexed-segment count per HOUR-BUCKET directory (`<dev>/<profile>/Y/M/D/H`)
-	* for one (device, profile), in ONE pass over the device's rows.
-	*
-	* Exists because `SegmentStore.evict` has to answer "does this eviction cover
-	* every segment the bucket holds?" for every bucket in the round, and it used
-	* to answer it with `segments(deviceId, profile)` — a full COPY of the
-	* device-profile archive plus a full `startsWith` scan, PER BUCKET. That is
-	* O(buckets x archive), and D148 is what made it bite: before it, a retention
-	* round touched a handful of buckets at the retention edge; after it, the
-	* recovered backlog made ~8 900 sparse buckets across six weeks evictable in
-	* ONE round. Measured on that shape (1.63 M live rows + 122 400 victims):
-	* 182 596 ms of uninterrupted main-thread CPU, with no log line, which is the
-	* silent 100%-CPU phase the operator saw. One pass answers all of them.
-	* @residency archive-shaped
-	*/
-	bucketCounts(deviceId, profile) {
-		const out = /* @__PURE__ */ new Map();
-		const m = this.byDevice.get(deviceId);
-		if (!m) return out;
-		for (const s of m.values()) {
-			if (s.profile !== profile) continue;
-			const cut = s.path.lastIndexOf("/");
-			if (cut <= 0) continue;
-			const bucketDir = s.path.slice(0, cut);
-			out.set(bucketDir, (out.get(bucketDir) ?? 0) + 1);
-		}
-		return out;
-	}
 	/** Aggregate accounting for a device across ALL its locations (use `accountingForLocation` for one location). @residency archive-shaped */
 	accounting(deviceId) {
 		const m = this.byDevice.get(deviceId);
@@ -1601,7 +1572,7 @@ function resolveEvictionDomain(locations, locationId, realpath = node_fs.realpat
 */
 var DEFAULT_THROTTLE_MBPS = 40;
 /** The durable index's bucket, and therefore this mover's batch. */
-var HOUR_MS$6 = 36e5;
+var HOUR_MS$7 = 36e5;
 /** Progress callback cadence (files) — cheap enough to fire often. */
 var PROGRESS_EVERY_FILES = 25;
 /** Free space a destination must keep when it declares no `config.minFreePercent`
@@ -1610,6 +1581,25 @@ var DEFAULT_MIN_FREE_PERCENT$1 = 10;
 /** Prefix every destination-full error carries, so the coordinator can report
 *  "drain stalled: destination full" instead of a raw ENOSPC string. */
 var DESTINATION_FULL_PREFIX = "destination full";
+/**
+* Ghost rows one job may FORGET, as a share of its own census — and the floor
+* below which the share is not the bound.
+*
+* D148 is why this is bounded at all: the ledger forgets only on a trusted walk
+* or an eviction, so that a transient read error cannot erase an operator's
+* index of real footage. A per-path ENOENT on a path derived from the row is
+* strong evidence about THAT path (D296) and weak evidence about a mount: a
+* root that vanished answers ENOENT for every path it is asked about, and looks
+* exactly like a location that is genuinely empty. The bound is what makes the
+* difference survivable — past it the mover keeps moving, keeps skipping, and
+* REPORTS, so an operator gets a reconcile to act on instead of an archive that
+* quietly emptied itself.
+*
+* 17.5 % of `recordingsLow:default` was ghosts on 2026-08-30 (11 074 of
+* 63 346), so a quarter admits a real reconcile of that size in one pass while
+* refusing a whole-location erase.
+*/
+var GHOST_FORGET_SHARE = .25;
 function snapshot(j) {
 	return {
 		jobId: j.jobId,
@@ -1622,6 +1612,7 @@ function snapshot(j) {
 		bytesMoved: j.bytesMoved,
 		filesTotal: j.filesTotal,
 		rowsReconciled: j.rowsReconciled,
+		rowsForgotten: j.rowsForgotten,
 		startedAt: j.startedAt,
 		finishedAt: j.finishedAt,
 		error: j.error
@@ -1764,6 +1755,9 @@ var RelocateEngine = class {
 			bytesMoved: 0,
 			filesTotal: null,
 			rowsReconciled: 0,
+			rowsForgotten: 0,
+			ghostsKept: 0,
+			budgetAnnounced: false,
 			startedAt: this.deps.now(),
 			finishedAt: null,
 			error: null,
@@ -1918,7 +1912,9 @@ var RelocateEngine = class {
 			archiveSegments: job.filesTotal,
 			seen,
 			moved: job.filesMoved,
-			rowsReconciled: job.rowsReconciled
+			rowsReconciled: job.rowsReconciled,
+			rowsForgotten: job.rowsForgotten,
+			ghostsKept: job.ghostsKept
 		};
 		if (archive === null) {
 			this.deps.logger.warn("relocate: coverage UNKNOWN — with no durable ledger this node cannot say what the source still holds", {
@@ -2063,6 +2059,81 @@ var RelocateEngine = class {
 		return fixed;
 	}
 	/**
+	* Forget the rows of one hour whose source file this mover CONFIRMED absent
+	* — durably, under a bound, and never in silence.
+	*
+	* ## Why this observation is trustworthy enough to act on (D148)
+	*
+	* D148 lets the ledger forget only on a trusted walk or an eviction, so that
+	* a fallible read can never delete an operator's index of real footage. This
+	* is neither, and it is stronger than the walk it is not: the mover built the
+	* absolute path from the ROW's own fields and `stat`ed exactly that path, so
+	* the answer is per-path (D296) rather than "a directory listing came back
+	* short" — the failure mode the walk-only rule exists to refuse. It is also
+	* the same channel eviction already uses: `dropSegments` refuses an hour
+	* whose detail it cannot read rather than emptying it, so a failed point read
+	* here still changes nothing (D49).
+	*
+	* ## Why it is nevertheless BOUNDED
+	*
+	* Because per-path evidence is strong about a path and weak about a MOUNT. A
+	* root that has gone away answers ENOENT for everything, and is
+	* indistinguishable from a location that is genuinely empty — with the
+	* archive as the difference. So the budget caps what one run may erase; past
+	* it the mover keeps moving and keeps skipping, and the operator gets a
+	* reported reconcile instead of an archive that emptied itself. A job with no
+	* census forgets NOTHING: a coverage that cannot be stated is not one to
+	* delete on (D295).
+	*/
+	async forgetGhosts(job, missing, from) {
+		if (missing.length === 0) return;
+		const ledger = this.deps.ledger?.() ?? null;
+		const budget = this.ghostForgetBudget(job);
+		const allowed = ledger === null ? 0 : Math.max(0, Math.min(missing.length, budget - job.rowsForgotten));
+		if (allowed > 0 && ledger !== null) {
+			await ledger.dropSegments(missing.slice(0, allowed));
+			job.rowsForgotten += allowed;
+		}
+		missing.forEach((row, i) => {
+			this.deps.logger.warn("relocate skipped missing source", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					jobId: job.jobId,
+					path: row.path,
+					locationId: from.id,
+					forgotten: i < allowed
+				}
+			});
+		});
+		const kept = missing.length - allowed;
+		if (kept === 0) return;
+		job.ghostsKept += kept;
+		if (job.budgetAnnounced) return;
+		job.budgetAnnounced = true;
+		this.deps.logger.warn("relocate: ghost-row forget BUDGET reached — the durable rows are KEPT", {
+			tags: { deviceId: missing[0].deviceId },
+			meta: {
+				jobId: job.jobId,
+				fromLocationId: from.id,
+				budget,
+				forgotten: job.rowsForgotten,
+				stillMissing: kept,
+				archiveSegments: job.filesTotal,
+				why: ledger === null ? "no durable hour ledger on this node — a RAM-only mover may not erase durable rows" : "a root that went away answers ENOENT for everything; past the bound this is reported, not deleted"
+			}
+		});
+	}
+	/**
+	* How many ghost rows THIS job may forget: the operator/test override, else a
+	* share of the census it reported itself against, else nothing.
+	*/
+	ghostForgetBudget(job) {
+		const override = this.deps.ghostForgetBudget;
+		if (override !== void 0) return override;
+		if (job.filesTotal === null) return 0;
+		return Math.max(64, Math.ceil(job.filesTotal * GHOST_FORGET_SHARE));
+	}
+	/**
 	* Move ONE hour of one (device, profile): copy+verify every file, re-point
 	* the durable hour row, delete the sources, re-point the RAM index.
 	*
@@ -2075,6 +2146,8 @@ var RelocateEngine = class {
 	*/
 	async moveHour(job, rows, from, to, samePhysicalRoot, sleep, bytesPerMs) {
 		const movable = [];
+		/** Rows of this hour whose source file the mover CONFIRMED absent. */
+		const missing = [];
 		let copiedBytes = 0;
 		if (samePhysicalRoot) movable.push(...rows);
 		else for (const row of rows) {
@@ -2090,16 +2163,11 @@ var RelocateEngine = class {
 			} catch (err) {
 				if (!isEnoent(err)) throw err;
 				this.deps.index.removeSegments([row.path]);
-				this.deps.logger.warn("relocate skipped missing source", {
-					tags: { deviceId: row.deviceId },
-					meta: {
-						path: row.path,
-						locationId: from.id
-					}
-				});
+				missing.push(row);
 			}
 			await sleep(pacedBytes / bytesPerMs);
 		}
+		await this.forgetGhosts(job, missing, from);
 		if (movable.length === 0) return;
 		if (job.cancelRequested) return;
 		const ledger = this.deps.ledger?.() ?? null;
@@ -2209,7 +2277,7 @@ function profilesOfClass(footageClass) {
 function groupByHour(rows) {
 	const out = /* @__PURE__ */ new Map();
 	for (const row of rows) {
-		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$6)}`;
+		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$7)}`;
 		const found = out.get(key);
 		if (found) found.push(row);
 		else out.set(key, [row]);
@@ -2397,21 +2465,12 @@ var SegmentStore = class SegmentStore {
 			if (group) group.push(r);
 			else byBucket.set(bucketDir, [r]);
 		}
-		const census = /* @__PURE__ */ new Map();
-		const countsFor = (deviceId, profile) => {
-			const key = `${deviceId}:${profile}`;
-			const cached = census.get(key);
-			if (cached) return cached;
-			const counts = this.deps.index.bucketCounts(deviceId, profile);
-			census.set(key, counts);
-			return counts;
-		};
 		const chunkSize = this.deps.evictChunkSize ?? SegmentStore.DEFAULT_EVICT_CHUNK;
 		const yieldBetween = this.deps.yieldBetween ?? macrotask$3;
 		let bucketsRemoved = 0;
 		let handled = 0;
 		for (const [bucketDir, bucketRows] of byBucket) {
-			if (bucketDir !== "" && this.bucketFullyEvicted(bucketDir, bucketRows, countsFor)) try {
+			if (bucketDir !== "" && await this.bucketFullyEvicted(bucketRows, location)) try {
 				await this.deps.removeDir(location, bucketDir);
 				bucketsRemoved += 1;
 				for (const r of bucketRows) {
@@ -2522,27 +2581,37 @@ var SegmentStore = class SegmentStore {
 	*  work now the per-bucket archive scan is gone. */
 	static DEFAULT_EVICT_CHUNK = 25;
 	/**
-	* True when `victims` cover EVERY indexed segment of `bucketDir` AND the
-	* bucket's hour has fully elapsed. The current-hour guard matters because
-	* `onFinalized` relocates new segments INTO the current bucket concurrently —
-	* an rm racing that rename would orphan a just-indexed segment.
+	* True when `victims` cover EVERY segment the ARCHIVE says the bucket holds,
+	* AND the bucket's hour has fully elapsed.
+	*
+	* The current-hour guard matters because `onFinalized` relocates new segments
+	* INTO the current bucket concurrently — an rm racing that rename would
+	* orphan a just-indexed segment.
+	*
+	* The cover test is against `SegmentHourLedger`'s own hour row, never
+	* `RecordingIndex`. A bucketDir is `<dev>/<profile>/Y/M/D/H`, so it names
+	* exactly one durable hour row: "every path that row lists is a victim" is
+	* the same question the `rm -rf` answers, asked of the authority for what
+	* EXISTS (D295). Asked of the resident index it read EQUAL whenever the hour
+	* was partly resident — both sides short by the same rows — and the directory
+	* went with every file the round never named, leaving their durable rows
+	* behind as ghosts.
 	*
-	* The cover test is a COUNT against the round's one-pass census plus an O(1)
-	* indexed-ness check per victim, never a scan of the device archive: a
-	* bucketDir is `<dev>/<profile>/Y/M/D/H`, so it names exactly one
-	* (device, profile), and the victims of a bucket are unique paths. Equal
-	* counts with every victim indexed therefore means the same set.
+	* An unanswerable archive returns `false`: per-file deletes are slower and
+	* always correct, and the alternative is a recursive delete computed from a
+	* fraction of the truth.
 	*/
-	bucketFullyEvicted(bucketDir, victims, countsFor) {
+	async bucketFullyEvicted(victims, location) {
 		const first = victims[0];
 		if (!first) return false;
 		const bucketStartMs = Math.floor(first.startMs / SegmentStore.HOUR_MS) * SegmentStore.HOUR_MS;
 		if ((this.deps.now?.() ?? Date.now()) < bucketStartMs + SegmentStore.HOUR_MS) return false;
-		const indexedInBucket = countsFor(first.deviceId, first.profile).get(bucketDir) ?? 0;
-		if (indexedInBucket === 0) return false;
-		const indexedVictims = /* @__PURE__ */ new Set();
-		for (const v of victims) if (this.deps.index.hasSegment(v.deviceId, v.path)) indexedVictims.add(v.path);
-		return indexedInBucket === indexedVictims.size;
+		const ask = this.deps.archiveHourPaths;
+		if (ask === void 0) return false;
+		const held = await ask(first.deviceId, first.profile, location, bucketStartMs);
+		if (held === null || held.length === 0) return false;
+		const doomed = new Set(victims.map((v) => v.path));
+		return held.every((p) => doomed.has(p));
 	}
 };
 var macrotask$3 = () => new Promise((resolve) => {
@@ -3220,7 +3289,7 @@ async function profileHasFootage(root, deviceId, profile) {
 //#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
-var HOUR_MS$5 = 36e5;
+var HOUR_MS$6 = 36e5;
 /**
 * UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
 *
@@ -3258,8 +3327,8 @@ var RANGE_MERGE_GAP_MS$1 = 5e3;
 * deploy gap). Unknown hours still fall through to one directory read.
 */
 function hourSegmentsFromIndex(index, deviceId, profile, hourStartMs) {
-	const hour = Math.floor(hourStartMs / HOUR_MS$5) * HOUR_MS$5;
-	const hourEnd = hour + HOUR_MS$5;
+	const hour = Math.floor(hourStartMs / HOUR_MS$6) * HOUR_MS$6;
+	const hourEnd = hour + HOUR_MS$6;
 	if (index.hydrationOf(deviceId, hour, hourEnd) !== "hydrated") return null;
 	const rows = [];
 	for (const s of index.segmentsStartingIn(deviceId, profile, hour, hourEnd)) rows.push({
@@ -3416,7 +3485,7 @@ var CalendarIndex = class {
 		}));
 		const days = /* @__PURE__ */ new Set();
 		for (const { day, hours } of perDay) for (const h of hours) {
-			const at = day + h * HOUR_MS$5;
+			const at = day + h * HOUR_MS$6;
 			if (at < fromMs || at >= toMs) continue;
 			days.add(localDayStart(at, tzOffsetMinutes));
 		}
@@ -3478,7 +3547,7 @@ var CalendarIndex = class {
 		const day = utcDayOf(utcDayMs);
 		for (let h = 0; h < 24; h++) {
 			await this.awaitQuiet();
-			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$5, true);
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$6, true);
 		}
 	}
 	/**
@@ -3499,7 +3568,7 @@ var CalendarIndex = class {
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
 		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
-		const hour = Math.floor(hourStartMs / HOUR_MS$5) * HOUR_MS$5;
+		const hour = Math.floor(hourStartMs / HOUR_MS$6) * HOUR_MS$6;
 		const fromIndex = this.deps.indexHour?.(deviceId, profile, hour);
 		if (fromIndex !== null && fromIndex !== void 0) return {
 			segments: fromIndex,
@@ -3507,7 +3576,7 @@ var CalendarIndex = class {
 		};
 		const key = `${deviceId}:${profile}:${hour}`;
 		const now = this.deps.now?.() ?? Date.now();
-		const isCurrentHour = hour === Math.floor(now / HOUR_MS$5) * HOUR_MS$5;
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$6) * HOUR_MS$6;
 		const cached = this.hourSegs.get(key);
 		if (cached !== void 0) {
 			if (!isCurrentHour) return {
@@ -3571,7 +3640,7 @@ var CalendarIndex = class {
 	*/
 	async dayRanges(deviceId, profile, utcDayMs) {
 		const day = utcDayOf(utcDayMs);
-		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$5), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$6), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
 	}
 	/**
 	* Exact ranges of `[fromMs, toMs)`, scanning ONLY the hours the window
@@ -3585,9 +3654,9 @@ var CalendarIndex = class {
 	*/
 	async rangesIn(deviceId, profile, fromMs, toMs) {
 		if (toMs <= fromMs) return [];
-		const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
+		const first = Math.floor(fromMs / HOUR_MS$6) * HOUR_MS$6;
 		const hours = [];
-		for (let hour = first; hour < toMs; hour += HOUR_MS$5) hours.push(hour);
+		for (let hour = first; hour < toMs; hour += HOUR_MS$6) hours.push(hour);
 		const perHour = await mapBounded(hours, READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour));
 		const ranges = [];
 		for (const r of mergeRanges(perHour.flat(), RANGE_MERGE_GAP_MS$1)) {
@@ -4045,7 +4114,7 @@ function handleStoreCensusAction(census, logger, input) {
 }
 //#endregion
 //#region src/recorder/addon/directory-handler.ts
-var HOUR_MS$4 = 36e5;
+var HOUR_MS$5 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
 *  would walk the archive on the read path — the thing this replaces. */
 var MAX_WINDOW_MS = 32 * 864e5;
@@ -4092,9 +4161,9 @@ function withDirectoryRoute(deps, next) {
 				return;
 			}
 			const rows = [];
-			const firstHour = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
+			const firstHour = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
 			let hydrated = true;
-			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$4) {
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$5) {
 				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
 				if (!complete) hydrated = false;
 				for (const s of segments) {
@@ -6623,6 +6692,53 @@ function buildRecordingProvider(deps) {
 				bytes: census.bytes
 			};
 		},
+		/**
+		* Walk one location's claimed hours and diff them against the disk (D319).
+		*
+		* Refuses rather than guessing when the reconciler is not wired on this
+		* node: a report whose numbers came from nowhere is worse than no report,
+		* and `location-unknown` is the honest shape for "nothing here can answer".
+		*/
+		reconcileLedgerAgainstDisk: async (input) => {
+			const reconciler = deps.ledgerWalk;
+			if (reconciler === void 0) {
+				deps.logger.warn("recorder: ledger walk unavailable on this node — no durable hour ledger is wired here", { meta: { locationId: input.locationId } });
+				return {
+					locationId: input.locationId,
+					applied: input.apply === true,
+					refused: "no-ledger",
+					archiveSegments: null,
+					archiveBytes: null,
+					hoursClaimed: 0,
+					hoursWalked: 0,
+					hoursMissing: 0,
+					listings: 0,
+					segmentsClaimed: 0,
+					ghostSegments: 0,
+					ghostBytes: 0,
+					ghostHoursWhole: 0,
+					forgottenSegments: 0,
+					forgottenBytes: 0,
+					orphanFiles: 0,
+					orphanSample: [],
+					hoursSkipped: 0,
+					skippedByReason: {
+						"live-tail": 0,
+						"listing-error": 0,
+						"path-mismatch": 0,
+						"durable-refused": 0
+					},
+					bounded: false,
+					byDevice: []
+				};
+			}
+			return reconciler.run({
+				locationId: input.locationId,
+				...input.apply !== void 0 ? { apply: input.apply } : {},
+				...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+				...input.profiles !== void 0 ? { profiles: input.profiles } : {}
+			});
+		},
 		cancelRelocateJob: async ({ jobId }) => ({ cancelled: deps.relocate?.cancel(jobId) ?? false }),
 		planStorageRebalance: (input) => runRebalance(deps, input, false),
 		startStorageRebalance: (input) => runRebalance(deps, input, true),
@@ -7121,7 +7237,7 @@ function hourDirRelPath(deviceId, profile, hourStartMs) {
 	const p2 = (n) => String(n).padStart(2, "0");
 	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
 }
-var HOUR_MS$3 = 36e5;
+var HOUR_MS$4 = 36e5;
 /**
 * Hydrate ONLY the hours a window spans, instead of walking the archive.
 *
@@ -7166,7 +7282,7 @@ var HOUR_MS$3 = 36e5;
 */
 async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger, ledger) {
 	if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
-	const liveHour = Math.floor(Date.now() / HOUR_MS$3) * HOUR_MS$3;
+	const liveHour = Math.floor(Date.now() / HOUR_MS$4) * HOUR_MS$4;
 	if (ledger !== void 0) {
 		const startedMs = Date.now();
 		const hours = await ledger.detailForWindow(deviceId, fromMs, toMs);
@@ -7203,12 +7319,12 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 			});
 			continue;
 		}
-		const first = Math.floor(fromMs / HOUR_MS$3) * HOUR_MS$3;
+		const first = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
 		const reuseBefore = index.hydrateReuseStats();
 		let hoursRead = 0;
 		let repaired = 0;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$3) {
-			if (hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$3) === "hydrated") continue;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$4) {
+			if (hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$4) === "hydrated") continue;
 			for (const profile of profiles) {
 				const rel = hourDirRelPath(deviceId, profile, hour);
 				let files;
@@ -7221,7 +7337,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 				const locationId = locationForHydratedProfile(aliases, profile).id;
 				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
 				index.hydrateHour(deviceId, locationId, hour, relPaths);
-				if (ledger !== void 0 && relPaths.length > 0 && hour + HOUR_MS$3 <= Date.now() && !ledger.knowsHour(deviceId, profile, locationId, hour)) {
+				if (ledger !== void 0 && relPaths.length > 0 && hour + HOUR_MS$4 <= Date.now() && !ledger.knowsHour(deviceId, profile, locationId, hour)) {
 					repaired += 1;
 					await ledger.adoptRebuiltHour(deviceId, profile, locationId, hour, relPaths);
 				}
@@ -7485,7 +7601,7 @@ var DurableLedger = class DurableLedger {
 };
 //#endregion
 //#region src/recorder/addon/segment-hour-ledger.ts
-var HOUR_MS$2 = 36e5;
+var HOUR_MS$3 = 36e5;
 var macrotask$1 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
@@ -7798,7 +7914,7 @@ var EMPTY_ACCOUNTING = {
 	newestMs: null
 };
 function hourStartMs(startMs) {
-	return Math.floor(startMs / HOUR_MS$2) * HOUR_MS$2;
+	return Math.floor(startMs / HOUR_MS$3) * HOUR_MS$3;
 }
 function segmentHourKey(deviceId, profile, locationId, hour) {
 	return `${deviceId}|${profile}|${locationId}|${hour}`;
@@ -8257,7 +8373,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/** The hour a write path may touch: current + previous. Materialised at boot
 	*  so {@link recordSegment}'s dedup gate answers from RAM (D49). */
 	async materializeLiveTail() {
-		const oldest = hourStartMs(this.now()) - (LIVE_TAIL_HOURS - 1) * HOUR_MS$2;
+		const oldest = hourStartMs(this.now()) - (LIVE_TAIL_HOURS - 1) * HOUR_MS$3;
 		const keys = [];
 		for (const row of this.ledger.snapshot()) if (row.hourStartMs >= oldest && !row.pathsResident) keys.push(row.key);
 		return (await this.materialize(keys)).length;
@@ -9047,7 +9163,7 @@ function locationKey(deviceId, locationId) {
 * Work it does not finish is left for the next pass and REPORTED, never
 * silently dropped.
 */
-var HOUR_MS$1 = 36e5;
+var HOUR_MS$2 = 36e5;
 /**
 * Group resolved locations by PHYSICAL root, so two aliases of one disk are
 * probed once and a `true` from each is not mistaken for the file existing in
@@ -9069,7 +9185,7 @@ function ghostProbeRoots(locations, realpath) {
 		aliases
 	})).toSorted((a, b) => a.key.localeCompare(b.key));
 }
-function emptyTally() {
+function emptyTally$1() {
 	return {
 		repointedHours: 0,
 		repointedSegments: 0,
@@ -9084,7 +9200,7 @@ function emptyTally() {
 }
 /** Every reason at zero — so a reason that never fired is REPORTED as zero
 *  rather than absent, and the summary shape does not change between passes. */
-function zeroReasons() {
+function zeroReasons$1() {
 	return {
 		"live-tail": 0,
 		"detail-unavailable": 0,
@@ -9110,7 +9226,7 @@ var GhostLocationSweeper = class {
 	async sweep() {
 		const maxHours = this.deps.maxHoursPerPass ?? 16;
 		const maxProbes = this.deps.maxProbesPerPass ?? 4e3;
-		const skippedByReason = zeroReasons();
+		const skippedByReason = zeroReasons$1();
 		const byDevice = /* @__PURE__ */ new Map();
 		const locations = this.deps.locations();
 		const roots = ghostProbeRoots(locations, this.deps.realpath);
@@ -9156,7 +9272,7 @@ var GhostLocationSweeper = class {
 				refused: null
 			};
 		}
-		const liveTailFrom = this.deps.now() - HOUR_MS$1;
+		const liveTailFrom = this.deps.now() - HOUR_MS$2;
 		let examined = 0;
 		let probes = 0;
 		let repointedHours = 0;
@@ -9168,7 +9284,7 @@ var GhostLocationSweeper = class {
 		const tallyOf = (deviceId) => {
 			const held = byDevice.get(deviceId);
 			if (held) return held;
-			const fresh = emptyTally();
+			const fresh = emptyTally$1();
 			byDevice.set(deviceId, fresh);
 			return fresh;
 		};
@@ -9493,6 +9609,7 @@ Object.freeze({
 	"pipeline-analytics": {
 		"getAudioEvents": { "limit": 1e3 },
 		"getKeyEvents": { "limit": 50 },
+		"getKeyEventsBatch": { "limit": 50 },
 		"getMotionEvents": { "limit": 1e3 },
 		"getObjectEvents": { "limit": 1e3 },
 		"getSensorEvents": { "limit": 1e3 },
@@ -9696,6 +9813,405 @@ function withLastKnownConfig(deps) {
 	};
 }
 //#endregion
+//#region src/recorder/addon/ledger-walk-reconcile.ts
+var HOUR_MS$1 = 36e5;
+/** Every reason at zero, so a reason that never fired reports as zero rather
+*  than absent and the summary shape is constant between passes. */
+function zeroReasons() {
+	return {
+		"live-tail": 0,
+		"listing-error": 0,
+		"path-mismatch": 0,
+		"durable-refused": 0
+	};
+}
+function emptyTally() {
+	return {
+		hoursWalked: 0,
+		hoursMissing: 0,
+		ghostSegments: 0,
+		ghostBytes: 0,
+		forgottenSegments: 0,
+		orphanFiles: 0
+	};
+}
+/** The basename of a segment path — what a listing returns. */
+function fileName(relPath) {
+	const cut = relPath.lastIndexOf("/");
+	return cut === -1 ? relPath : relPath.slice(cut + 1);
+}
+/** Group one archive page into whole hours. A page always carries complete hour
+*  rows (`streamSegments` expands them whole), so no hour is ever split. */
+function claimsOf(rows) {
+	const byHour = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const hour = hourStartMs(row.startMs);
+		const key = `${row.deviceId}|${row.profile}|${hour}`;
+		const held = byHour.get(key);
+		if (held) held.push(row);
+		else byHour.set(key, [row]);
+	}
+	const out = [];
+	for (const group of byHour.values()) {
+		const first = group[0];
+		if (first === void 0) continue;
+		out.push({
+			deviceId: first.deviceId,
+			profile: first.profile,
+			hourStartMs: hourStartMs(first.startMs),
+			rows: group
+		});
+	}
+	return out.toSorted((a, b) => a.hourStartMs - b.hourStartMs || a.deviceId - b.deviceId);
+}
+/**
+* One reconcile pass over one location's claimed hours.
+*
+* Never throws: a per-hour failure is a counted refusal and the pass continues;
+* a precondition failure is a named refusal and the pass does nothing at all.
+*/
+var LedgerWalkReconciler = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async run(request) {
+		const apply = request.apply === true;
+		const location = this.deps.locations().find((candidate) => candidate.id === request.locationId);
+		if (location === void 0) return this.refusedReport(request.locationId, apply, "location-unknown");
+		if ((location.enabled ?? true) && !location.readOnly) {
+			this.deps.logger.warn("recorder: ledger walk REFUSED — the source is still a write target, so a directory listing is a lower bound, not the truth", { meta: {
+				locationId: location.id,
+				root: location.root,
+				enabled: location.enabled ?? true,
+				readOnly: location.readOnly,
+				remedy: "set the location readOnly (or disable it) and re-run; a LIVE location is reconciled by the mover, under its bound (D318)"
+			} });
+			return this.refusedReport(location.id, apply, "source-writable");
+		}
+		const ledger = this.deps.ledger();
+		if (ledger === null) {
+			this.deps.logger.warn("recorder: ledger walk REFUSED — this node holds no durable hour ledger, so there is no archive to reconcile", { meta: { locationId: location.id } });
+			return this.refusedReport(location.id, apply, "no-ledger");
+		}
+		const anchor = await this.readAnchor(location);
+		if (!anchor.ok) return this.refusedReport(location.id, apply, anchor.refusal);
+		const scope = {
+			locationId: location.id,
+			...request.deviceId !== void 0 ? { deviceId: request.deviceId } : {},
+			...request.profiles !== void 0 && request.profiles.length > 0 ? { profiles: request.profiles } : {}
+		};
+		const census = await ledger.census(scope);
+		if (census === null) {
+			this.deps.logger.warn("recorder: ledger walk REFUSED — the archive could not say what this location holds, so no walk of it can be reported against anything", { meta: { locationId: location.id } });
+			return this.refusedReport(location.id, apply, "archive-unreadable");
+		}
+		const state = {
+			location,
+			ledger,
+			apply,
+			anchor: anchor.volumeId,
+			liveTailFrom: hourStartMs(this.deps.now()) - 1 * HOUR_MS$1,
+			maxHours: this.deps.maxHours ?? 4096,
+			byDevice: /* @__PURE__ */ new Map(),
+			skippedByReason: zeroReasons(),
+			orphanSample: [],
+			hoursClaimed: 0,
+			hoursWalked: 0,
+			hoursMissing: 0,
+			listings: 0,
+			segmentsClaimed: 0,
+			ghostSegments: 0,
+			ghostBytes: 0,
+			ghostHoursWhole: 0,
+			forgottenSegments: 0,
+			forgottenBytes: 0,
+			orphanFiles: 0,
+			hoursSkipped: 0,
+			bounded: false,
+			refused: null
+		};
+		await this.walk(state, scope);
+		const report = {
+			locationId: location.id,
+			applied: apply,
+			refused: state.refused,
+			archiveSegments: census.segments,
+			archiveBytes: census.bytes,
+			hoursClaimed: state.hoursClaimed,
+			hoursWalked: state.hoursWalked,
+			hoursMissing: state.hoursMissing,
+			listings: state.listings,
+			segmentsClaimed: state.segmentsClaimed,
+			ghostSegments: state.ghostSegments,
+			ghostBytes: state.ghostBytes,
+			ghostHoursWhole: state.ghostHoursWhole,
+			forgottenSegments: state.forgottenSegments,
+			forgottenBytes: state.forgottenBytes,
+			orphanFiles: state.orphanFiles,
+			orphanSample: [...state.orphanSample],
+			hoursSkipped: state.hoursSkipped,
+			skippedByReason: { ...state.skippedByReason },
+			bounded: state.bounded,
+			byDevice: [...state.byDevice.entries()].map(([deviceId, tally]) => ({
+				deviceId,
+				...tally
+			})).toSorted((a, b) => a.deviceId - b.deviceId)
+		};
+		this.reportPass(report);
+		return report;
+	}
+	/** Walk the archive page by page, one hour at a time. */
+	async walk(state, scope) {
+		for await (const page of state.ledger.streamSegments(scope)) for (const claim of claimsOf(page)) {
+			if (state.hoursClaimed >= state.maxHours) {
+				state.bounded = true;
+				return;
+			}
+			state.hoursClaimed += 1;
+			state.segmentsClaimed += claim.rows.length;
+			if (!await this.reconcileHour(state, claim)) return;
+		}
+	}
+	/**
+	* Diff ONE hour, and forget what it proved absent.
+	*
+	* `false` ends the whole pass — the only thing that returns it is an anchor
+	* that stopped agreeing, and every listing taken after that point is about a
+	* filesystem this pass did not start on.
+	*/
+	async reconcileHour(state, claim) {
+		const tally = this.tallyOf(state, claim.deviceId);
+		if (claim.hourStartMs >= state.liveTailFrom) {
+			this.skip(state, claim, "live-tail", `hourStartMs=${claim.hourStartMs}`);
+			return true;
+		}
+		const relDir = hourDirRelPath(claim.deviceId, claim.profile, claim.hourStartMs);
+		for (const row of claim.rows) if (parseSegmentPath(row.path) === null || row.path !== `${relDir}/${fileName(row.path)}`) {
+			this.skip(state, claim, "path-mismatch", row.path);
+			return true;
+		}
+		let listing;
+		try {
+			listing = await this.deps.listHour(state.location.root, relDir);
+		} catch (err) {
+			this.skip(state, claim, "listing-error", require_dist.errMsg(err));
+			return true;
+		}
+		state.listings += 1;
+		if (state.listings % 8 === 0) await this.deps.pace();
+		state.hoursWalked += 1;
+		tally.hoursWalked += 1;
+		const diff = this.diff(claim, listing);
+		if (diff.missingDirectory) {
+			state.hoursMissing += 1;
+			tally.hoursMissing += 1;
+		}
+		if (diff.orphans.length > 0) {
+			state.orphanFiles += diff.orphans.length;
+			tally.orphanFiles += diff.orphans.length;
+			for (const orphan of diff.orphans) {
+				if (state.orphanSample.length >= 50) break;
+				state.orphanSample.push(`${relDir}/${orphan}`);
+			}
+			this.deps.logger.warn("recorder: files under a claimed hour that the durable ledger does NOT name — reported, never deleted", {
+				tags: { deviceId: claim.deviceId },
+				meta: {
+					locationId: state.location.id,
+					profile: claim.profile,
+					hourStartMs: claim.hourStartMs,
+					orphans: diff.orphans.length,
+					sample: diff.orphans.slice(0, 5)
+				}
+			});
+		}
+		if (diff.ghosts.length === 0) return true;
+		const ghostBytes = diff.ghosts.reduce((sum, row) => sum + row.bytes, 0);
+		state.ghostSegments += diff.ghosts.length;
+		state.ghostBytes += ghostBytes;
+		tally.ghostSegments += diff.ghosts.length;
+		tally.ghostBytes += ghostBytes;
+		if (diff.ghosts.length === claim.rows.length) state.ghostHoursWhole += 1;
+		const anchor = await this.readAnchor(state.location);
+		if (!anchor.ok || anchor.volumeId !== state.anchor) {
+			state.refused = anchor.ok ? "anchor-moved" : anchor.refusal;
+			this.deps.logger.warn("recorder: ledger walk STOPPED — the volume under this location is not the one the pass started on, so every listing since is about another filesystem and NOTHING more is forgotten", {
+				tags: { deviceId: claim.deviceId },
+				meta: {
+					locationId: state.location.id,
+					root: state.location.root,
+					startedOn: state.anchor,
+					foundNow: anchor.ok ? anchor.volumeId : anchor.refusal,
+					forgottenBeforeStop: state.forgottenSegments
+				}
+			});
+			return false;
+		}
+		this.deps.logger.warn("recorder: durable hour row claims segments the directory does not hold", {
+			tags: { deviceId: claim.deviceId },
+			meta: {
+				locationId: state.location.id,
+				profile: claim.profile,
+				hourStartMs: claim.hourStartMs,
+				claimed: claim.rows.length,
+				ghosts: diff.ghosts.length,
+				ghostBytes,
+				wholeHour: diff.ghosts.length === claim.rows.length,
+				missingDirectory: diff.missingDirectory,
+				apply: state.apply
+			}
+		});
+		if (!state.apply) return true;
+		await state.ledger.dropSegments(diff.ghosts);
+		if (!await this.forgetLanded(state, claim, diff.ghosts)) {
+			this.skip(state, claim, "durable-refused", "the ledger still lists a dropped path");
+			return true;
+		}
+		this.deps.applyToIndex(diff.ghosts.map((row) => row.path));
+		state.forgottenSegments += diff.ghosts.length;
+		state.forgottenBytes += ghostBytes;
+		tally.forgottenSegments += diff.ghosts.length;
+		return true;
+	}
+	/** Did the durable drop actually land? */
+	async forgetLanded(state, claim, ghosts) {
+		const { deviceId, profile, hourStartMs: hour } = claim;
+		if (!state.ledger.knowsHour(deviceId, profile, state.location.id, hour)) return true;
+		const held = await state.ledger.hourPaths(deviceId, profile, state.location.id, hour);
+		if (held === null) return false;
+		const remaining = new Set(held);
+		return ghosts.every((row) => !remaining.has(row.path));
+	}
+	/**
+	* What the hour row claims, against what the directory holds — BOTH ways.
+	*
+	* A missing directory is an empty listing here, which makes every claim a
+	* ghost. That is only admissible because the caller re-reads the volume
+	* anchor before acting on it.
+	*/
+	diff(claim, listing) {
+		const present = new Set((listing ?? []).filter((name) => name.endsWith(".m4s")));
+		const claimed = new Set(claim.rows.map((row) => fileName(row.path)));
+		return {
+			ghosts: claim.rows.filter((row) => !present.has(fileName(row.path))),
+			orphans: [...present].filter((name) => !claimed.has(name)).toSorted(),
+			missingDirectory: listing === null
+		};
+	}
+	/** The volume anchor, or the refusal its absence produces. */
+	async readAnchor(location) {
+		let marker;
+		try {
+			marker = await this.deps.anchorOf(location.root);
+		} catch (err) {
+			this.deps.logger.warn("recorder: ledger walk cannot read the volume marker — an unreadable root decides nothing", { meta: {
+				locationId: location.id,
+				root: location.root,
+				error: require_dist.errMsg(err)
+			} });
+			return {
+				ok: false,
+				refusal: "anchor-unreadable"
+			};
+		}
+		if (marker === null) {
+			this.deps.logger.warn("recorder: ledger walk has NO volume marker at this root — a mountpoint directory without its disk answers ENOENT for every hour, which is indistinguishable from an empty location", { meta: {
+				locationId: location.id,
+				root: location.root
+			} });
+			return {
+				ok: false,
+				refusal: "anchor-absent"
+			};
+		}
+		return {
+			ok: true,
+			volumeId: marker
+		};
+	}
+	tallyOf(state, deviceId) {
+		const held = state.byDevice.get(deviceId);
+		if (held) return held;
+		const fresh = emptyTally();
+		state.byDevice.set(deviceId, fresh);
+		return fresh;
+	}
+	skip(state, claim, reason, detail) {
+		state.hoursSkipped += 1;
+		state.skippedByReason[reason] += 1;
+		this.deps.logger.debug("recorder: ledger walk left an hour exactly as it found it", {
+			tags: { deviceId: claim.deviceId },
+			meta: {
+				locationId: state.location.id,
+				profile: claim.profile,
+				hourStartMs: claim.hourStartMs,
+				reason,
+				detail
+			}
+		});
+	}
+	refusedReport(locationId, applied, refused) {
+		return {
+			locationId,
+			applied,
+			refused,
+			archiveSegments: null,
+			archiveBytes: null,
+			hoursClaimed: 0,
+			hoursWalked: 0,
+			hoursMissing: 0,
+			listings: 0,
+			segmentsClaimed: 0,
+			ghostSegments: 0,
+			ghostBytes: 0,
+			ghostHoursWhole: 0,
+			forgottenSegments: 0,
+			forgottenBytes: 0,
+			orphanFiles: 0,
+			orphanSample: [],
+			hoursSkipped: 0,
+			skippedByReason: zeroReasons(),
+			bounded: false,
+			byDevice: []
+		};
+	}
+	/** One line per camera, then one for the pass. */
+	reportPass(report) {
+		for (const device of report.byDevice) this.deps.logger.info("recorder: ledger walk — camera summary", {
+			tags: { deviceId: device.deviceId },
+			meta: {
+				locationId: report.locationId,
+				hoursWalked: device.hoursWalked,
+				hoursMissing: device.hoursMissing,
+				ghostSegments: device.ghostSegments,
+				ghostBytes: device.ghostBytes,
+				forgottenSegments: device.forgottenSegments,
+				orphanFiles: device.orphanFiles
+			}
+		});
+		this.deps.logger.info("recorder: ledger walk complete", { meta: {
+			locationId: report.locationId,
+			applied: report.applied,
+			refused: report.refused,
+			archiveSegments: report.archiveSegments,
+			segmentsClaimed: report.segmentsClaimed,
+			hoursClaimed: report.hoursClaimed,
+			hoursWalked: report.hoursWalked,
+			hoursMissing: report.hoursMissing,
+			listings: report.listings,
+			ghostSegments: report.ghostSegments,
+			ghostBytes: report.ghostBytes,
+			ghostHoursWhole: report.ghostHoursWhole,
+			forgottenSegments: report.forgottenSegments,
+			forgottenBytes: report.forgottenBytes,
+			orphanFiles: report.orphanFiles,
+			hoursSkipped: report.hoursSkipped,
+			skippedByReason: report.skippedByReason,
+			bounded: report.bounded
+		} });
+	}
+};
+//#endregion
 //#region src/recorder/addon/location-capacity.ts
 /** Human-readable failure text for a thrown value of unknown shape. */
 function reasonOf(err) {
@@ -15056,6 +15572,17 @@ var GHOST_LOCATION_SWEEP_SLOW_AFTER_MS = 10 * 6e4;
 /** Awaited every `GHOST_PROBE_BATCH` probes. The janitor's brake: it keeps a
 *  reconcile pass off the array's critical path rather than racing it. */
 var GHOST_LOCATION_PROBE_PAUSE_MS = 50;
+/**
+* Awaited every `WALK_HOUR_BATCH` hour listings by the ledger↔disk walk (D319).
+*
+* Twice the ghost sweep's brake, because the syscall between brakes is far
+* heavier: that pass paces `storage.exists` on one path, this one paces a
+* `readdir` of a whole hour directory — measured at ~650 ms on the live share
+* under load. The walk is operator-armed and one-off, so the right trade is to
+* be slower and invisible rather than fast and felt: a `find` over this array
+* hung an SSH session on 2026-08-29.
+*/
+var LEDGER_WALK_PAUSE_MS = 100;
 /** What the per-volume usage row reports when the hour ledger is unavailable:
 *  nothing measured, rather than a total counted off a partial RAM index. */
 var EMPTY_ARCHIVE_ACCOUNTING = {
@@ -15331,6 +15858,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 					await node_fs.promises.unlink(fromAbs);
 				}
 			},
+			archiveHourPaths: async (deviceId, profile, locationId, hourStartMs) => await this.segmentHours?.hourPaths(deviceId, profile, locationId, hourStartMs) ?? null,
 			removeDir: async (locationId, relDir) => {
 				const loc = this.resolvedLocations.find((l) => l.id === locationId);
 				if (!loc) throw new Error(`recorder: unknown recordings location ${locationId}`);
@@ -15520,6 +16048,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			capacity: (root) => this.locationCapacity(root),
 			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
 			archive: () => this.segmentHours,
+			ledgerWalk: this.ledgerWalkReconciler(),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),
 			reconcileHourLedger: async (deviceId) => {
 				await this.segmentHours?.reconcileFromIndex(this.index, [deviceId], Date.now());
@@ -15768,6 +16297,44 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		return resolveEvictionDomain(this.resolvedLocations, locationId);
 	}
 	/**
+	* The operator's "does my ledger tell the truth?" pass (D319).
+	*
+	* Built once and handed to the provider, but every dependency it holds is a
+	* THUNK: `this.segmentHours` is null until the collection declares, and
+	* `this.resolvedLocations` is re-resolved whenever a disk appears. A
+	* reconciler that captured either would answer for the boot instant forever.
+	*
+	* `listHour` is a SHALLOW `readdir` of exactly one hour directory — never
+	* `recursive: true`, which is the call that takes minutes over `/recordings`
+	* and the reason a shell `find` hung an SSH session. A directory that is not
+	* there answers `null`; anything else throws, and a throw decides nothing.
+	*
+	* `anchorOf` is the placement volume marker, which lives ON the disk: it is
+	* the only thing here that can tell a location whose hours were deleted from
+	* a mountpoint whose disk went away.
+	*/
+	ledgerWalkReconciler() {
+		return new LedgerWalkReconciler({
+			ledger: () => this.segmentHours,
+			locations: () => this.resolvedLocations,
+			listHour: async (root, relDir) => {
+				try {
+					return await node_fs.promises.readdir(node_path.default.join(root, relDir));
+				} catch (err) {
+					if (err.code === "ENOENT") return null;
+					throw err;
+				}
+			},
+			anchorOf: async (root) => (await readLocationMarker(root))?.volumeId ?? null,
+			applyToIndex: (paths) => {
+				this.index.removeSegments(paths);
+			},
+			logger: this.ctx.logger,
+			now: () => Date.now(),
+			pace: () => require_dist.sleep(LEDGER_WALK_PAUSE_MS)
+		});
+	}
+	/**
 	* Boot hydrate: once the hub is reachable (`ctx.api.*` safe), resolve the
 	* recordings locations and rebuild the in-memory index from `storage.list`
 	* for every device that has a persisted config. The list result is the