@camstack/addon-pipeline 1.2.199 → 1.2.200

package/dist/recorder/index.mjs

@@ -1,9 +1,9 @@
-import { Bt as hydrateSchema, Ct as storageEvictableCapability, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Ft as BaseAddon, H as deriveBatteryPresence, Jt as sleep$1, Lt as DeviceFeature, Ot as errMsg, P as batteryCapability, R as customAction, Rt as DeviceType, T as RECORDING_EXPORT_MAX_READ_BYTES, Tt as stripRetiredBandPreBufferSec, V as defineCustomActions, W as deriveRecordingMode, Wt as nodePin, Xt as array, Y as evaluateSensorEdge, Yt as _enum, Zt as boolean, _t as recordingSignalCapability, an as string, at as migrateLegacyDeviceSignalConfig, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, et as isFirstLevelMacroClass, g as ExportRecordSchema, gt as recordingExportCapability, ht as recordingCapability, i as BatteryStatusSchema, in as record, nn as object, qt as selectAssignedProfileSlots, rn as preprocess, sn as EventCategory, tn as number, tt as loadContributionCapability, x as OpsLogEntrySchema, xt as resolveRecordingProfiles } from "../dist-B23u1tmN.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-D1MLn6oV.mjs";
+import { Bt as hydrateSchema, Ct as storageEvictableCapability, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Ft as BaseAddon, H as deriveBatteryPresence, Jt as sleep$1, Lt as DeviceFeature, Ot as errMsg, P as batteryCapability, R as customAction, Rt as DeviceType, T as RECORDING_EXPORT_MAX_READ_BYTES, Tt as stripRetiredBandPreBufferSec, V as defineCustomActions, W as deriveRecordingMode, Wt as nodePin, Xt as array, Y as evaluateSensorEdge, Yt as _enum, Zt as boolean, _t as recordingSignalCapability, an as string, at as migrateLegacyDeviceSignalConfig, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, et as isFirstLevelMacroClass, g as ExportRecordSchema, gt as recordingExportCapability, ht as recordingCapability, i as BatteryStatusSchema, in as record, nn as object, qt as selectAssignedProfileSlots, rn as preprocess, sn as EventCategory, tn as number, tt as loadContributionCapability, x as OpsLogEntrySchema, xt as resolveRecordingProfiles } from "../dist-mEsrAAc3.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CUxep5tc.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
+import { c as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-DWe2kInY.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
-import { a as retireRootKeys, o as RowMapStore, t as PREBUFFER_MAX_MS } from "../prebuffer-DmBYRQWg.mjs";
+import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";
 import path from "node:path";
@@ -7727,96 +7727,59 @@ function runFfmpeg(renderDeps, args, ext) {
 		});
 	});
 }
-//#endregion
-//#region src/recorder/addon/roots.ts
-/**
-* Storage-root resolution + boot hydrate for the recorder addon.
-*
-* Recordings live in the managed `recordings` / `recordingsLow` storage
-* locations (operator-configurable, multi-disk-ready), resolved through the
-* `storage` cap. The v2 `RecordingIndex` is hydrated by walking each location
-* root's `<deviceId>/` subtree on disk — segment paths encode start/dur/bytes,
-* so the in-memory index can never drift from disk. (We walk the filesystem
-* directly instead of `storage.list` because that cap lists only a directory's
-* IMMEDIATE children, not the `<deviceId>/<profile>/Y/M/D/H/*.m4s` tree — using
-* it dropped the entire index to ~empty on every restart/rescan; the recorder
-* already does local fs I/O for stat/move on these same roots.)
-*/
-/** The two recordings location types the recorder addon writes/reads. */
-var PLACEMENT_LOCATION_TYPES = ["recordings", "recordingsLow"];
-var RECORDING_LOCATION_TYPES = new Set(PLACEMENT_LOCATION_TYPES);
+var RECORDING_LOCATION_TYPES = new Set(["recordings", "recordingsLow"]);
 /**
 * The recordings CLASS a profile belongs to. The one place this rule is
-* written: `resolvePlacement`, the planner's demand type and the repoint check
-* must agree on it, and three copies of `profile === 'low' ? … : …` is how they
-* stop agreeing.
+* written: `resolvePlacement`, the planner's demand type and the placement
+* census must agree on it, and three copies of `profile === 'low' ? … : …` is
+* how they stop agreeing.
 */
 function placementTypeForProfile(profile) {
 	return profile === "low" ? "recordingsLow" : "recordings";
 }
-/** The profile that routes to each class — the probe `authorityLocations` asks
-*  `resolvePlacement` with, so the answer is derived from the same function the
-*  unassigned path uses rather than from a second reading of `isDefault`. */
-var CLASS_PROBE_PROFILE = {
-	recordings: "high",
-	recordingsLow: "low"
-};
-/**
-* Where each recordings class writes when NOTHING has planned it — the location
-* `resolvePlacement` picks, which is the type default unless the default is
-* gone, read-only, or absent from the pool.
-*
-* This is the AUTHORITY a stored assignment is measured against (D298). A
-* repoint (`storage.setDefaultLocations`, an operator making another disk the
-* default, a default deleted) changes exactly this map, and a stored assignment
-* that survives that change is a plan that outlived the pool it was planned
-* for.
-*
-* A class with nothing writable is ABSENT from the map, not guessed at: `place`
-* already throws loudly on that path, and an authority nobody can compute must
-* invalidate nothing.
-*/
-function authorityLocations(pool) {
-	const out = /* @__PURE__ */ new Map();
-	for (const type of PLACEMENT_LOCATION_TYPES) try {
-		out.set(type, resolvePlacement(pool, CLASS_PROBE_PROFILE[type]).id);
-	} catch {}
-	return out;
-}
 /**
 * Narrow a resolved location list to the ones placement may write to: the
-* operator-enabled ones. A location the operator has not opted in
-* (`enabled === false`) is still READ, age-swept and drained — it is simply
+* enabled ones — ALL of them, together. A location the operator has not opted
+* in (`enabled === false`) is still READ, age-swept and drained — it is simply
 * never a write target, exactly like a read-only one.
 *
-* When no enabled location is writable the type DEFAULTS serve instead, loudly:
-* the default of a type is guaranteed enabled by the orchestrator, so this can
-* only happen through a hand-edited store — and a recorder that writes nowhere
-* is worse than one that writes to the default and complains.
+* When no enabled location is writable EVERY location serves instead, loudly.
+* The orchestrator refuses to leave a recordings class without an enabled
+* location, so this is reachable only through a hand-edited store — and a
+* recorder that writes nowhere is worse than one that writes under protest.
 */
 function placementPool(locations) {
 	const enabled = locations.filter((l) => l.enabled !== false);
 	if (enabled.some((l) => !l.readOnly)) return {
 		locations: enabled,
-		fellBackToDefault: false
-	};
-	const defaults = locations.filter((l) => l.isDefault === true);
-	if (defaults.some((l) => !l.readOnly)) return {
-		locations: defaults,
-		fellBackToDefault: true
+		fellBackToDisabled: false
 	};
 	return {
 		locations,
-		fellBackToDefault: true
+		fellBackToDisabled: true
 	};
 }
 /**
-* Route a recording profile to its storage location by the location's declared
-* `type`: the `low` profile prefers the `recordingsLow` location, every other
-* profile the `recordings` location. READ-ONLY locations are never write
-* targets (the drain model): when the preferred type has only read-only
-* instances, any writable recordings-type location serves. Throws when NO
-* writable location exists — recording cannot start, and that must be loud.
+* Route a recording profile to a storage location, for a (camera, profile) the
+* PLANNER has not placed yet — the first attach of a new camera, before the
+* 30 s pass runs.
+*
+* The rule, in order:
+*   1. the location's declared `type` — `low` prefers `recordingsLow`, every
+*      other profile prefers `recordings`; when the preferred type has only
+*      read-only instances, any writable recordings-type location serves;
+*   2. among those, the one with the most MEASURED headroom
+*      (`min(free − minFree floor, maxUsedGb − used)`) — the same signal the
+*      planner balances on, so the bootstrap pick and the plan agree instead of
+*      the plan having to undo the pick at the next tick;
+*   3. ties, and a pool where nothing was measured, fall to the
+*      lexicographically first id — deterministic, never "whichever came back
+*      first from the cap".
+*
+* There is no preferred instance any more (D383): every enabled location of a
+* class is a write target, and which one a camera gets is a capacity question,
+* not a flag. Throws when NO writable location exists — recording cannot start,
+* and that must be loud.
 */
 function resolvePlacement(locations, profile) {
 	if (locations.length === 0) throw new Error("recorder controller: no recordings storage locations resolved");
@@ -7824,7 +7787,15 @@ function resolvePlacement(locations, profile) {
 	if (writable.length === 0) throw new Error("recorder controller: every recordings location is read-only — nowhere to write");
 	const preferType = profile === "low" ? "recordingsLow" : "recordings";
 	const preferred = writable.filter((l) => l.type === preferType);
-	return preferred.find((l) => l.isDefault) ?? preferred[0] ?? writable.find((l) => l.isDefault) ?? writable[0];
+	return emptiestOf(preferred.length > 0 ? preferred : writable);
+}
+/** The candidate with the most measured headroom; ties (and an unmeasured
+*  pool, where every headroom is absent) by lexicographic id. */
+function emptiestOf(candidates) {
+	return candidates.toSorted((a, b) => {
+		const byHeadroom = (b.headroomBytes ?? 0) - (a.headroomBytes ?? 0);
+		return byHeadroom !== 0 ? byHeadroom : a.id.localeCompare(b.id);
+	})[0];
 }
 /**
 * Attribute a discovered segment on an aliased physical root by its profile,
@@ -7874,7 +7845,6 @@ async function resolveRecordingsLocations(api, logger) {
 				relativePath: ""
 			}),
 			readOnly: l.config["readOnly"] === true,
-			isDefault: l.isDefault,
 			...l.enabled === false ? { enabled: false } : {},
 			...numericConfig(l.config, "minFreePercent", "minFreePercent"),
 			...numericConfig(l.config, "maxUsedGb", "maxUsedGb")
@@ -10432,47 +10402,17 @@ Object.freeze({
 		},
 		"setDeviceConfig": { "config": { "__nested__": { "bands": [] } } }
 	},
-	"storage": { "upsertLocation": {
-		"isDefault": false,
-		"isSystem": false
-	} },
+	"storage": { "upsertLocation": { "isSystem": false } },
 	"storage-provider": {
-		"beginDownload": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"beginUpload": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"delete": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"exists": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"getAvailableSpace": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"list": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"read": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"resolve": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"write": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } }
+		"beginDownload": { "location": { "__nested__": { "isSystem": false } } },
+		"beginUpload": { "location": { "__nested__": { "isSystem": false } } },
+		"delete": { "location": { "__nested__": { "isSystem": false } } },
+		"exists": { "location": { "__nested__": { "isSystem": false } } },
+		"getAvailableSpace": { "location": { "__nested__": { "isSystem": false } } },
+		"list": { "location": { "__nested__": { "isSystem": false } } },
+		"read": { "location": { "__nested__": { "isSystem": false } } },
+		"resolve": { "location": { "__nested__": { "isSystem": false } } },
+		"write": { "location": { "__nested__": { "isSystem": false } } }
 	},
 	"stream-broker": {
 		"produceEventMedia": {
@@ -11490,19 +11430,16 @@ var RecordingPlacementBlobSchema = object({
 	/** locationId → the volume id last verified at that location's root. */
 	volumeIds: record(string(), string()).default({}),
 	/**
-	* Recordings class (`recordings` / `recordingsLow`) → the location
-	* `resolvePlacement` chose for it when these assignments were last planned.
-	*
-	* ABSENT means "nobody has recorded an authority yet", and that is never read
-	* as a repoint: shipping this field must not invalidate assignments that were
-	* made under an authority nothing wrote down. The first pass stamps it and
-	* invalidates nothing; every later change of it is a repoint.
+	* DEAD KEY (D383) — the class authority a pass planned against, back when a
+	* class had a default distinct from its pool. Declared so an existing blob
+	* round-trips unchanged and so its removal is a decision on the record rather
+	* than a silent strip. Never read, never written.
 	*/
 	defaultLocations: record(string(), string()).default({}),
 	/** When the blob was last written (operator-facing debugging only). */
 	updatedAt: number().optional()
 });
-/** Cold-start value: nothing assigned, nothing claimed, no authority recorded. */
+/** Cold-start value: nothing assigned, nothing claimed. */
 var EMPTY_PLACEMENT = {
 	assignments: {},
 	pins: {},
@@ -11551,31 +11488,27 @@ async function replaceAssignments(state, base, assignments) {
 	});
 }
 /**
-* The assignment record a pass leaves behind: the stored one, with the repoint
-* applied, then the plan merged over it. **Nothing is ever removed** — a pass
-* that plans a subset cannot delete a key it did not mention.
+* The assignment record a pass leaves behind: the stored one with the plan
+* merged over it. **Nothing is ever removed** — a pass that plans a subset
+* cannot delete a key it did not mention.
 *
-* PURE, and shared by the write and the divergence report — a report computed
+* PURE, and shared by the write and the placement census — a report computed
 * from a second reading of the same rule is a report that can describe a record
 * the write did not produce.
 */
 function applyPlacementPass(base, pass) {
 	const next = new Map(Object.entries(base));
-	for (const [key, locationId] of pass.repointed) next.set(key, locationId);
 	for (const [key, locationId] of pass.planned) next.set(key, locationId);
 	return next;
 }
-/** Persist one work-scoped pass: apply the repoint, merge its plan, and stamp
-*  the authority the plan was resolved against. One write. */
+/** Persist one work-scoped pass: merge its plan over the stored record. One
+*  write. */
 async function writePlacementPass(state, base, pass) {
 	const assignments = {};
 	for (const [key, locationId] of applyPlacementPass(base.assignments, pass)) assignments[key] = locationId;
-	const defaultLocations = {};
-	for (const [type, locationId] of pass.defaultLocations) defaultLocations[type] = locationId;
 	await state.set({
 		...base,
 		assignments,
-		defaultLocations,
 		updatedAt: Date.now()
 	});
 }
@@ -11824,14 +11757,6 @@ var NO_PLAN = {
 	assignments: /* @__PURE__ */ new Map(),
 	changes: []
 };
-/** Is the authority already stamped, exactly? A pass that would change the
-*  stamp always writes, even when it moved nothing: an unstamped authority is
-*  an undetectable repoint. */
-function sameStamp(stamped, authority) {
-	if (stamped.size !== authority.size) return false;
-	for (const [type, locationId] of authority) if (stamped.get(type) !== locationId) return false;
-	return true;
-}
 /** Operator pins win over the planner for high/mid of the pinned camera. */
 function overlayPins(planned, pins) {
 	const next = new Map(planned);
@@ -11859,14 +11784,11 @@ var PlacementService = class {
 	/** The fair tie-break the PURE planner defers to (D37). Advisory state, and
 	*  consulted only for a tie the capacity signal cannot separate. */
 	rotation = new PlacementRotation();
-	/** The divergent set last announced, as a stable signature. `null` ⇒ nothing
-	*  announced yet, which is why an all-aligned fleet says nothing at boot. */
-	divergenceSignature = null;
-	/** When the standing divergence was last announced. */
-	divergenceReportedAt = null;
-	/** Repoint episodes already announced (`type:from->to`). Cleared the moment a
-	*  pass sees no repoint at all — the next one is a NEW episode. */
-	repointAnnounced = /* @__PURE__ */ new Set();
+	/** The census last announced, as a stable signature. `null` ⇒ nothing
+	*  announced yet. */
+	censusSignature = null;
+	/** When the census was last announced. */
+	censusReportedAt = null;
 	constructor(deps) {
 		this.deps = deps;
 	}
@@ -11901,15 +11823,14 @@ var PlacementService = class {
 	async place(deviceId, profile) {
 		const pool = this.pool();
 		this.reprobeAfterBackoff(pool);
-		const authority = authorityLocations(pool);
-		const resolved = await this.assignedLocation(deviceId, profile, pool, authority) ?? resolvePlacement(pool, profile);
+		const resolved = await this.assignedLocation(deviceId, profile, pool) ?? resolvePlacement(await this.withHeadroom(pool), profile);
 		const usable = await this.ensureUsable(resolved, pool, profile, deviceId);
 		if (this.everyLocationUnusable(pool)) {
 			this.reportEveryLocationUnusable(deviceId, profile, resolved, pool);
 			return resolved;
 		}
 		this.allUnusableReported.delete(deviceId);
-		await this.recordDecision(deviceId, profile, usable, resolved.id === usable.id, authority.get(placementTypeForProfile(profile)) ?? null);
+		await this.recordDecision(deviceId, profile, usable, resolved.id === usable.id);
 		return usable;
 	}
 	/**
@@ -11993,35 +11914,30 @@ var PlacementService = class {
 	* to it, so an unknown flag is the only thing that counts as opted in.
 	*/
 	pool() {
-		const { locations, fellBackToDefault } = placementPool(this.deps.locations());
-		if (fellBackToDefault) this.deps.logger.warn("recorder placement: NO recordings location is enabled for writing — falling back to the type default. Enable a location in Storage, or recordings will keep landing on the default.", { meta: { locationIds: locations.map((l) => l.id) } });
+		const { locations, fellBackToDisabled } = placementPool(this.deps.locations());
+		if (fellBackToDisabled) this.deps.logger.warn("recorder placement: NO recordings location is enabled for writing — writing to a DISABLED location under protest. Enable one in Storage.", { meta: { locationIds: locations.map((l) => l.id) } });
 		return locations;
 	}
 	/**
 	* The stored assignment for one (camera, profile), when it is still valid.
 	*
-	* Three things invalidate it, and the third is the one this used to miss:
-	*
-	*   1. the location is absent from the current pool (deleted, opted out);
-	*   2. the location is read-only (an operator drain);
-	*   3. **the class was REPOINTED under it** — the authority stamped in the
-	*      blob is not the authority now, and the assignment names neither.
+	* Two things invalidate it, and under the operator's model (D383) there is
+	* nothing else that can:
 	*
-	* (1) and (2) both mean "this location is not a write target any more", so
-	* they only ever caught a repoint that took the old location out of service.
-	* A repoint of a class the operator is MIGRATING does the opposite: the
-	* source must stay enabled and writable, because it holds the history. So the
-	* assignment survived every attach, indefinitely, and `resolvePlacement`
-	* returning the new default changed nothing — it is the fallback, not the
-	* authority. On 2026-08-29 that left two of thirteen cameras writing to the
-	* disk the fleet was migrating off, silently (D298).
+	*   1. the location is absent from the current POOL — deleted, or the
+	*      operator disabled it. The pool is the single write authority, so an
+	*      assignment naming a location outside it is not a divergence to report,
+	*      it is unrepresentable;
+	*   2. the location is read-only (an operator drain).
 	*
-	* The invalidation is a TRANSITION, not a policy: it fires only while the
-	* stamped authority disagrees with the live one, which the next placement pass
-	* ends by stamping. After that the plan is the authority again and a
-	* deliberate spread is honoured — and reported (`reportDivergence`).
+	* There used to be a third — "the class was REPOINTED under it", measured
+	* against the class default stamped in the blob (D301). It existed only
+	* because the default was a SECOND write authority layered over the pool and
+	* the two could disagree. With the default deleted the disagreement cannot be
+	* expressed: a location leaving the pool already invalidates every assignment
+	* naming it, and the planner then moves those keys with `reason: 'gone'`.
 	*/
-	async assignedLocation(deviceId, profile, pool, authority) {
+	async assignedLocation(deviceId, profile, pool) {
 		let blob;
 		try {
 			blob = await readPlacementState(this.deps.state);
@@ -12043,23 +11959,28 @@ var PlacementService = class {
 		}
 		if (assignedId === void 0) return null;
 		const location = pool.find((l) => l.id === assignedId && !l.readOnly) ?? null;
-		if (location === null) return null;
-		const type = placementTypeForProfile(profile);
-		const target = authority.get(type);
-		const stamped = blob.defaultLocations[type];
-		if (target === void 0 || stamped === void 0) return location;
-		if (stamped === target || location.id === target) return location;
-		this.deps.logger.warn("recorder placement: stored assignment INVALIDATED — this recordings class was repointed and the assignment still names the location it was repointed away from", {
+		if (location === null) this.deps.logger.info("recorder placement: stored assignment INVALIDATED — its location is not a write target any more (disabled, read-only, or gone). Resolving fresh from the pool.", {
 			tags: { deviceId },
 			meta: {
 				profile,
-				assignedLocationId: location.id,
-				repointedFrom: stamped,
-				repointedTo: target,
-				locationType: type
+				assignedLocationId: assignedId,
+				poolLocationIds: pool.filter((l) => !l.readOnly).map((l) => l.id)
 			}
 		});
-		return null;
+		return location;
+	}
+	/** The pool, with each member's measured headroom attached. One capacity read
+	*  per location; used only on the bootstrap path, never per segment. */
+	async withHeadroom(pool) {
+		const candidates = await this.candidatesFor(pool);
+		const byId = new Map(candidates.map((c) => [c.locationId, c.headroomBytes]));
+		return pool.map((location) => {
+			const headroomBytes = byId.get(location.id);
+			return headroomBytes === void 0 ? location : {
+				...location,
+				headroomBytes
+			};
+		});
 	}
 	/**
 	* Re-plan the (camera, profile) pairs in `work` over the current locations.
@@ -12081,7 +12002,6 @@ var PlacementService = class {
 	*/
 	async recompute(work) {
 		const pool = this.pool();
-		const authority = authorityLocations(pool);
 		const candidates = await this.candidatesFor(pool);
 		const demands = work.map((item) => ({
 			key: assignmentKey(item.deviceId, item.profile),
@@ -12098,17 +12018,7 @@ var PlacementService = class {
 			} });
 			return NO_PLAN;
 		}
-		const stamped = new Map(Object.entries(blob.defaultLocations));
-		const repoints = this.detectRepoints(blob.assignments, stamped, authority, blob.pins);
-		if (repoints.length === 0) this.repointAnnounced.clear();
-		for (const repoint of repoints) this.announceRepoint(repoint);
-		const repointed = /* @__PURE__ */ new Map();
-		for (const repoint of repoints) for (const key of repoint.keys) repointed.set(key, repoint.to);
-		const current = applyPlacementPass(blob.assignments, {
-			repointed,
-			planned: /* @__PURE__ */ new Map(),
-			defaultLocations: authority
-		});
+		const current = new Map(Object.entries(blob.assignments));
 		const evacuate = new Set(candidates.filter((c) => c.headroomBytes <= 0).map((c) => c.locationId));
 		for (const location of pool) if (location.readOnly) evacuate.add(location.id);
 		const plan = planPlacement({
@@ -12118,13 +12028,9 @@ var PlacementService = class {
 			evacuate,
 			breakTie: (tied) => this.rotation.next(tied)
 		});
-		const pass = {
-			repointed,
-			planned: overlayPins(plan.assignments, blob.pins),
-			defaultLocations: authority
-		};
-		this.reportDivergence(applyPlacementPass(blob.assignments, pass), authority);
-		if (plan.changes.length === 0 && repointed.size === 0 && sameStamp(stamped, authority)) return plan;
+		const pass = { planned: overlayPins(plan.assignments, blob.pins) };
+		this.reportCensus(applyPlacementPass(blob.assignments, pass), pool);
+		if (plan.changes.length === 0) return plan;
 		for (const change of plan.changes) {
 			const deviceId = Number(change.key.split(":")[0]);
 			this.deps.logger.info("recorder placement: plan moves a profile to another location", {
@@ -12148,129 +12054,60 @@ var PlacementService = class {
 		return plan;
 	}
 	/**
-	* Which recordings classes were REPOINTED under the stored plan, and which of
-	* its keys that invalidates.
-	*
-	* PURE. A class is repointed when the blob stamped an authority for it and
-	* the authority now is a different location. A class with NO stamp is not a
-	* repoint — it is the first pass after this shipped, and inferring a repoint
-	* from an absent stamp would throw away every deliberate assignment on the
-	* first tick after a deploy.
-	*/
-	detectRepoints(stored, stamped, authority, pins) {
-		const out = [];
-		for (const [type, to] of authority) {
-			const from = stamped.get(type);
-			if (from === void 0 || from === to) continue;
-			const keys = [];
-			for (const [key, locationId] of Object.entries(stored)) {
-				const [devicePart, profilePart] = key.split(":");
-				if (placementTypeForProfile(profilePart ?? "") !== type) continue;
-				if (locationId === to) continue;
-				if (type === "recordings" && devicePart !== void 0 && pins[devicePart] !== void 0) continue;
-				keys.push(key);
-			}
-			out.push({
-				type,
-				from,
-				to,
-				keys
-			});
-		}
-		return out;
-	}
-	/**
-	* One line PER CAMERA (a repoint is asked per-camera: "did 3839 move?"), plus
-	* one audit row per class. A repoint is a rare operator event, so the volume
-	* is one burst of fleet-size, not a stream.
+	* WHERE THE FLEET WRITES — one line per (class, location), always with its
+	* denominator (D277).
 	*
-	* Announced ONCE per episode: the detection is a comparison against the
-	* stamp, so a write that fails leaves the stamp behind and the next tick sees
-	* the same repoint again. Without the latch, a settings door that accepts
-	* reads and refuses writes would repeat the whole burst every 30 s.
-	*/
-	announceRepoint(repoint) {
-		const episode = `${repoint.type}:${repoint.from}->${repoint.to}`;
-		if (this.repointAnnounced.has(episode)) return;
-		this.repointAnnounced.add(episode);
-		for (const key of repoint.keys) {
-			const deviceId = Number(key.split(":")[0]);
-			this.deps.logger.warn("recorder placement: recordings class REPOINTED — moving this assignment onto the class`s new authority location", {
-				...Number.isFinite(deviceId) ? { tags: { deviceId } } : {},
-				meta: {
-					key,
-					locationType: repoint.type,
-					repointedFrom: repoint.from,
-					repointedTo: repoint.to
-				}
-			});
-		}
-		this.deps.opsLog.append({
-			op: "relocate",
-			reason: "operator",
-			deviceId: null,
-			itemsAffected: repoint.keys.length,
-			bytesReclaimed: 0,
-			actor: "system",
-			detail: `placement: ${repoint.type} repointed ${repoint.from} → ${repoint.to}; ${repoint.keys.length.toString()} assignment(s) moved (${repoint.keys.join(", ")})`
-		});
-	}
-	/**
-	* Say which (camera, profile) the plan writes somewhere other than its class
-	* authority — per camera, WITH its denominator (D277).
-	*
-	* This is not an error path. The planner spreads a class across its pool on
-	* purpose, and a location with headroom is a legitimate target. What was
-	* wrong is that a deliberate spread and a leftover from a repoint nobody
-	* noticed produced the *same* absence of output: `recordDecision` audits only
-	* a CHANGE, so a camera that keeps using its old assignment writes no row and
-	* no line, forever. An operator read "migration done" while two cameras were
-	* still filling the disk they were migrating off.
+	* This replaced the class-authority divergence report (D301) when the default
+	* was deleted: with every enabled location of a class a legitimate target,
+	* "this camera does not write to THE location" is not a fact any more, while
+	* "recordings: 9 of 13 on recordings:default, 4 on recordings:hgst" is
+	* exactly the question an operator asks after enabling a second disk. A pool
+	* member holding ZERO assignments is listed too — an enabled disk nothing
+	* lands on is the failure this whole model exists to make visible.
 	*
-	* Fires on a CHANGE of the divergent set, and otherwise at most once per
-	* {@link PLACEMENT_DIVERGENCE_REPORT_MS}. An all-aligned fleet says nothing —
-	* until it stops being all-aligned, and again when it recovers.
+	* Fires on a CHANGE of the distribution, and otherwise at most once per
+	* {@link PLACEMENT_CENSUS_REPORT_MS}.
 	*/
-	reportDivergence(assignments, authority) {
-		const divergent = [];
+	reportCensus(assignments, pool) {
+		const counts = /* @__PURE__ */ new Map();
+		const perClass = /* @__PURE__ */ new Map();
+		for (const location of pool) if (!location.readOnly) counts.set(location.id, 0);
 		for (const [key, locationId] of assignments) {
-			const profile = key.split(":")[1] ?? "";
-			const authorityLocationId = authority.get(placementTypeForProfile(profile));
-			if (authorityLocationId === void 0 || authorityLocationId === locationId) continue;
-			divergent.push({
-				key,
-				deviceId: Number(key.split(":")[0]),
-				profile,
-				locationId,
-				authorityLocationId
-			});
+			counts.set(locationId, (counts.get(locationId) ?? 0) + 1);
+			const type = placementTypeForProfile(key.split(":")[1] ?? "");
+			perClass.set(type, (perClass.get(type) ?? 0) + 1);
 		}
-		const signature = divergent.map((d) => `${d.key}=${d.locationId}`).toSorted().join(",");
-		const previous = this.divergenceSignature;
+		const typeOf = new Map(pool.map((location) => [location.id, location.type]));
+		const lines = [...counts.entries()].toSorted(([a], [b]) => a.localeCompare(b)).map(([locationId, count]) => {
+			const type = typeOf.get(locationId) ?? locationId.split(":")[0] ?? locationId;
+			return {
+				locationId,
+				type,
+				assignments: count,
+				ofClass: perClass.get(type) ?? 0
+			};
+		});
+		const signature = lines.map((line) => `${line.locationId}=${String(line.assignments)}`).join(",");
 		const now = this.now;
-		const due = this.divergenceReportedAt === null || now - this.divergenceReportedAt >= 36e5;
-		if (signature === previous && !due) return;
-		this.divergenceSignature = signature;
-		this.divergenceReportedAt = now;
-		if (divergent.length === 0) {
-			if (previous !== null && previous !== "") this.deps.logger.info("recorder placement: every assignment now writes to its class authority location", { meta: { assignments: assignments.size } });
-			return;
+		const due = this.censusReportedAt === null || now - this.censusReportedAt >= 36e5;
+		if (signature === this.censusSignature && !due) return;
+		this.censusSignature = signature;
+		this.censusReportedAt = now;
+		if (lines.length === 0) return;
+		this.deps.logger.info("recorder placement: census — which locations the fleet writes to", { meta: { locations: lines.map((line) => ({
+			locationId: line.locationId,
+			type: line.type,
+			assignments: line.assignments,
+			ofClass: line.ofClass
+		})) } });
+		for (const line of lines) {
+			if (line.assignments > 0) continue;
+			this.deps.logger.warn("recorder placement: this location is ENABLED but holds no assignment — nothing writes to it", { meta: {
+				locationId: line.locationId,
+				type: line.type,
+				ofClass: line.ofClass
+			} });
 		}
-		this.deps.logger.warn("recorder placement: assignments write somewhere other than their class authority location", { meta: {
-			divergent: divergent.length,
-			assignments: assignments.size,
-			authority: Object.fromEntries(authority)
-		} });
-		for (const entry of divergent) this.deps.logger.warn("recorder placement: this profile does NOT write to its class authority location", {
-			...Number.isFinite(entry.deviceId) ? { tags: { deviceId: entry.deviceId } } : {},
-			meta: {
-				profile: entry.profile,
-				locationId: entry.locationId,
-				authorityLocationId: entry.authorityLocationId,
-				divergent: divergent.length,
-				assignments: assignments.size
-			}
-		});
 	}
 	/** Bound one addon-store round trip. See {@link PLACEMENT_STORE_TIMEOUT_MS}. */
 	bounded(promise, label) {
@@ -12451,13 +12288,13 @@ var PlacementService = class {
 	* Persist the assignment and audit it — but only when it actually changed.
 	* The steady state (every attach after the first) writes nothing.
 	*
-	* The per-attach line carries `authorityLocationId` and `divergent` so a
-	* single camera's line answers "is 3839 writing where the class default
-	* says?" on its own. Without it, a camera pinned to a location the class was
-	* repointed away from logged `reason: 'resolved'` — byte-identical to a
-	* camera correctly on the current default.
+	* The per-attach line carries the camera's location and the one it replaced,
+	* tagged with `deviceId`, so "where does 3839 write, and did it move?" is
+	* answerable per camera. Which locations the FLEET is spread over is the
+	* census's job (D383) — there is no class authority for a single line to be
+	* measured against any more.
 	*/
-	async recordDecision(deviceId, profile, location, verbatim, authorityLocationId) {
+	async recordDecision(deviceId, profile, location, verbatim) {
 		const key = assignmentKey(deviceId, profile);
 		let previous;
 		try {
@@ -12478,8 +12315,6 @@ var PlacementService = class {
 				locationId: location.id,
 				root: location.root,
 				previousLocationId: previous ?? null,
-				authorityLocationId,
-				divergent: authorityLocationId !== null && authorityLocationId !== location.id,
 				reason: verbatim ? "resolved" : "failover"
 			}
 		});
@@ -15377,7 +15212,7 @@ var RecordingController = class {
 			tag: `recorder:${deviceId}/${profile}`
 		}, nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "getStreamWithCodec"));
 		const streamAcquiredMs = this.now();
-		const rtspUrl = withRecordingIntent(source.url);
+		const rtspUrl = withRecordingIntent(source.url, RECORDING_PRE_ROLL_REQUEST_MS);
 		this.attachSeq++;
 		const consumerTag = `recorder/${deviceId}/${profile}/${this.attachSeq}`;
 		if (rtspUrl === source.url) this.deps.logger.info("recorder: dial carries no recording intent — no pre-roll", {