@camstack/addon-pipeline 1.2.199 → 1.2.201

package/dist/recorder/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DmCrC2yx.js");
-const require_node = require("../node-DCSTbt6C.js");
+const require_dist = require("../dist-Bd875pfj.js");
+const require_node = require("../node-dwhLC9Fh.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
+const require_restream_intent = require("../restream-intent-B1Difcnq.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
-const require_prebuffer = require("../prebuffer-DqdeLSsk.js");
+const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
@@ -1517,14 +1517,17 @@ var RecordingIndex = class {
 /**
 * The physical-device key of a location root: `realpath` of the resolved path,
 * or the resolved path string itself when realpath throws (root missing).
+*
+* ONE derivation, shared with the orchestrator's same-type root refusal (D389)
+* — two implementations of "is this the same disk" is two answers waiting to
+* disagree. This side deliberately DROPS the `resolved` flag: an unresolvable
+* root falls back to the lexical path, which can only over-partition (treat one
+* disk as two) and never merge two different disks, the safe failure mode for a
+* data-loss guard. The orchestrator needs the flag, because a refusal must not
+* be built on a read that failed.
 */
 function physicalRootKey(root, realpath = node_fs.realpathSync) {
-	const resolved = node_path.default.resolve(root);
-	try {
-		return realpath(resolved);
-	} catch {
-		return resolved;
-	}
+	return require_node.physicalRootOf(root, realpath).key;
 }
 /**
 * The eviction DOMAIN of `locationId`: the set of location ids (INCLUDING
@@ -1539,211 +1542,578 @@ function resolveEvictionDomain(locations, locationId, realpath = node_fs.realpat
 	for (const l of locations) if (physicalRootKey(l.root, realpath) === selfKey) domain.add(l.id);
 	return domain;
 }
-//#endregion
-//#region src/recorder/relocate-engine.ts
+var RECORDING_LOCATION_TYPES = new Set(["recordings", "recordingsLow"]);
 /**
-* Footage relocation engine (entity-routing spec, Phase 4) — the mover half
-* of disk decommissioning: mark the old location read-only (Phase 2), then
-* relocate its footage here, then delete the location.
-*
-* Mechanics, per HOUR (D291): throttled copy + size-verify of every file in the
-* hour → re-point the DURABLE hour row → delete the sources → re-point the RAM
-* index. The hour is the batch because the durable index is hour-granular, and
-* the sources outlive the durable write on purpose: between the copy and the
-* delete both locations hold the hour, so no crash can leave the index naming a
-* location without the bytes. The copy is `copy-if-absent` (an equal-size
-* destination is adopted, not re-copied), so cancel/crash/re-run RESUMES
-* instead of restarting, and a cancel inside an hour leaves that hour WHOLLY
-* readable at the source. Throttling is file-level pacing (segments are
-* ~1–8 MB / ~4 s, so per-file granularity bounds the rate tightly enough) —
-* the drain is a background chore that must never starve live writers.
-*
-* Runs INSIDE the recorder process — container uid, same-uid files, no host
-* chown trap (see docs/history 2026-07-29).
-*
-* ── Phase 2 (D116, multi-location) ────────────────────────────────────────
-* Two additions the OPERATOR-ARMED rebalance needs:
-*
-*   - A move is scoped to one CAMERA (and optionally to specific profiles),
-*     not just to a whole disk. The rebalance's unit is a (camera, profile)
-*     pile, because that is the unit the placement plan assigns.
-*   - Concurrent starts QUEUE instead of being refused. The engine is still
-*     single-flight — two movers on one disk thrash both — but a rebalance
-*     enqueues one job per pile, and refusing the second turned a
-*     fifteen-camera rebalance into fifteen manual retries. Jobs run FIFO; a
-*     job cancelled while queued never runs, and a job that FAILS does not
-*     strand the queue behind it.
+* The recordings CLASS a profile belongs to. The one place this rule is
+* written: `resolvePlacement`, the planner's demand type and the placement
+* census must agree on it, and three copies of `profile === 'low' ? … : …` is
+* how they stop agreeing.
 */
-var DEFAULT_THROTTLE_MBPS = 40;
-/** The durable index's bucket, and therefore this mover's batch. */
-var HOUR_MS$7 = 36e5;
-/** Progress callback cadence (files) — cheap enough to fire often. */
-var PROGRESS_EVERY_FILES = 25;
-/** Free space a destination must keep when it declares no `config.minFreePercent`
-*  — the same default `roots.ts` documents for placement. */
-var DEFAULT_MIN_FREE_PERCENT$1 = 10;
-/** Prefix every destination-full error carries, so the coordinator can report
-*  "drain stalled: destination full" instead of a raw ENOSPC string. */
-var DESTINATION_FULL_PREFIX = "destination full";
+function placementTypeForProfile(profile) {
+	return profile === "low" ? "recordingsLow" : "recordings";
+}
 /**
-* Ghost rows one job may FORGET, as a share of its own census — and the floor
-* below which the share is not the bound.
-*
-* D148 is why this is bounded at all: the ledger forgets only on a trusted walk
-* or an eviction, so that a transient read error cannot erase an operator's
-* index of real footage. A per-path ENOENT on a path derived from the row is
-* strong evidence about THAT path (D296) and weak evidence about a mount: a
-* root that vanished answers ENOENT for every path it is asked about, and looks
-* exactly like a location that is genuinely empty. The bound is what makes the
-* difference survivable — past it the mover keeps moving, keeps skipping, and
-* REPORTS, so an operator gets a reconcile to act on instead of an archive that
-* quietly emptied itself.
+* Narrow a resolved location list to the ones placement may write to: the
+* enabled ones — ALL of them, together. A location the operator has not opted
+* in (`enabled === false`) is still READ, age-swept and drained — it is simply
+* never a write target, exactly like a read-only one.
 *
-* 17.5 % of `recordingsLow:default` was ghosts on 2026-08-30 (11 074 of
-* 63 346), so a quarter admits a real reconcile of that size in one pass while
-* refusing a whole-location erase.
+* When no enabled location is writable EVERY location serves instead, loudly.
+* The orchestrator refuses to leave a recordings class without an enabled
+* location, so this is reachable only through a hand-edited store — and a
+* recorder that writes nowhere is worse than one that writes under protest.
 */
-var GHOST_FORGET_SHARE = .25;
-function snapshot(j) {
+function placementPool(locations) {
+	const writable = locations.filter((l) => locationMayBeWritten(l));
+	if (writable.length > 0) return {
+		locations: writable,
+		fellBackToDisabled: false
+	};
 	return {
-		jobId: j.jobId,
-		state: j.state,
-		fromLocationId: j.fromLocationId,
-		toLocationId: j.toLocationId,
-		deviceId: j.deviceId,
-		entities: [...j.entities],
-		filesMoved: j.filesMoved,
-		bytesMoved: j.bytesMoved,
-		filesTotal: j.filesTotal,
-		rowsReconciled: j.rowsReconciled,
-		rowsForgotten: j.rowsForgotten,
-		startedAt: j.startedAt,
-		finishedAt: j.finishedAt,
-		error: j.error
+		locations: locations.filter((l) => locationMayBeRead(l)),
+		fellBackToDisabled: true
 	};
 }
 /**
-* The row's source file is not on disk.
+* The state question, put to the ONE interpreter.
 *
-* Carries `code: 'ENOENT'` because that is how every caller here already tells
-* a ghost row from a real failure, and {@link copyVerified} now discovers the
-* absence with a `stat` rather than by letting `copyFile` raise it.
+* The legacy mirrors are handed over too, so a location built by a caller that
+* has not moved to `recordingsLocationOfMode` yet is folded by the SAME rule
+* that folds an unmigrated persisted row (`mode` absent → `readOnly` → `enabled`
+* → active). There is still exactly one interpretation; the mirrors and this
+* argument disappear together next release.
 */
-var RelocateSourceMissingError = class extends Error {
-	code = "ENOENT";
-	constructor(src) {
-		super(`relocate source missing: ${src}`);
-		this.name = "RelocateSourceMissingError";
-	}
-};
+function stateOf(location) {
+	return {
+		...location.mode !== void 0 ? { mode: location.mode } : {},
+		...location.enabled !== void 0 ? { enabled: location.enabled } : {},
+		config: location.readOnly === true ? { readOnly: true } : {}
+	};
+}
+/** The resolved state of a location, for a message or a log line. */
+function locationMode(location) {
+	return require_dist.resolveLocationMode(stateOf(location));
+}
+/** May the recorder write here? THE policy, never a local re-derivation. */
+function locationMayBeWritten(location) {
+	return require_dist.mayWriteToLocation(stateOf(location));
+}
 /**
-* One file's COPY: copy-if-absent → verify the destination against the SOURCE'S
-* OWN SIZE. The source is left in place.
-*
-* Split out of {@link moveFile} because the durable index re-point has to
-* happen while BOTH locations still hold the bytes — see
-* `SegmentHourLedger.repointSegments`.
-*
-* **`recordedBytes` is never the verify's reference.** It used to be, and it
-* cannot be: `fs.copyFile` truncates and replaces, so the destination always
-* equals the source, and comparing that result against a number the LEDGER
-* remembers can only ever fail when the ledger is wrong. On 2026-08-30 that
-* reported a byte-perfect copy as corruption and killed a 110 749-file drain
-* on its 12 440th file:
-*
-*     relocate verify failed: …/1787926410000-9966-274432.m4s
-*       is 783801B, expected 274432B
-*
-* Both files measured 783801 B on the hub. What is faithful is "the
-* destination equals the source", and that is what is asserted here; the
-* recorded number survives only as the reference for a destination whose
-* source is already GONE, where there is nothing else left to compare against.
+* A resolved location, with every derived mirror written from the ONE state.
+* Every `RecordingsLocation` in the recorder comes from here.
 */
-async function copyVerified(src, dst, recordedBytes) {
-	const dstBytes = await fileSize(dst);
-	const srcBytes = await fileSize(src);
-	if (dstBytes !== null && dstBytes === (srcBytes ?? recordedBytes)) return {
-		copied: 0,
-		srcBytes: dstBytes
-	};
-	if (srcBytes === null) throw new RelocateSourceMissingError(src);
-	await node_fs.promises.mkdir(node_path.default.dirname(dst), { recursive: true });
-	await node_fs.promises.copyFile(src, dst);
-	const after = await node_fs.promises.stat(dst);
-	if (after.size !== srcBytes) throw new Error(`relocate verify failed: ${dst} is ${after.size}B, expected ${srcBytes}B`);
+function recordingsLocationOfMode(base, mode) {
 	return {
-		copied: srcBytes,
-		srcBytes
+		...base,
+		mode,
+		readOnly: !require_dist.modeMayWrite(mode),
+		enabled: require_dist.modeMayWrite(mode)
 	};
 }
-/** A file's size, or `null` when it is not there. */
-async function fileSize(p) {
-	try {
-		return (await node_fs.promises.stat(p)).size;
-	} catch {
-		return null;
-	}
+/** May the recorder read here? A `disabled` location may not — and that is an
+*  operator CHOICE, reported as unavailable, never as an unknown location. */
+function locationMayBeRead(location) {
+	return require_dist.mayReadLocation(stateOf(location));
 }
-var RelocateEngine = class {
-	deps;
-	jobs = /* @__PURE__ */ new Map();
-	/** Job ids waiting for the mover, in enqueue order. */
-	queue = [];
-	/** Set while a job is executing — the single-flight latch. */
-	draining = false;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	list() {
-		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
+/**
+* Route a recording profile to a storage location, for a (camera, profile) the
+* PLANNER has not placed yet — the first attach of a new camera, before the
+* 30 s pass runs.
+*
+* The rule, in order:
+*   1. the location's declared `type` — `low` prefers `recordingsLow`, every
+*      other profile prefers `recordings`; when the preferred type has only
+*      read-only instances, any writable recordings-type location serves;
+*   2. among those, the one with the most MEASURED headroom
+*      (`min(free − minFree floor, maxUsedGb − used)`) — the same signal the
+*      planner balances on, so the bootstrap pick and the plan agree instead of
+*      the plan having to undo the pick at the next tick;
+*   3. ties, and a pool where nothing was measured, fall to the
+*      lexicographically first id — deterministic, never "whichever came back
+*      first from the cap".
+*
+* There is no preferred instance any more (D383): every enabled location of a
+* class is a write target, and which one a camera gets is a capacity question,
+* not a flag. Throws when NO writable location exists — recording cannot start,
+* and that must be loud.
+*/
+function resolvePlacement(locations, profile) {
+	if (locations.length === 0) throw new Error("recorder controller: no recordings storage locations resolved");
+	const writable = locations.filter((l) => locationMayBeWritten(l));
+	if (writable.length === 0) throw new Error("recorder controller: every recordings location is read-only — nowhere to write");
+	const preferType = profile === "low" ? "recordingsLow" : "recordings";
+	const preferred = writable.filter((l) => l.type === preferType);
+	return emptiestOf(preferred.length > 0 ? preferred : writable);
+}
+/** The candidate with the most measured headroom; ties (and an unmeasured
+*  pool, where every headroom is absent) by lexicographic id. */
+function emptiestOf(candidates) {
+	return candidates.toSorted((a, b) => {
+		const byHeadroom = (b.headroomBytes ?? 0) - (a.headroomBytes ?? 0);
+		return byHeadroom !== 0 ? byHeadroom : a.id.localeCompare(b.id);
+	})[0];
+}
+/**
+* Attribute a discovered segment on an aliased physical root by its profile,
+* not by whichever logical location happened to be hydrated last. Stock
+* `recordings` and `recordingsLow` deliberately share a root: high/mid belong
+* to `recordings`, while low belongs to `recordingsLow`.
+*/
+function locationForHydratedProfile(aliases, profile) {
+	const preferredType = profile === "low" ? "recordingsLow" : "recordings";
+	const preferred = aliases.filter((location) => location.type === preferredType).toSorted((a, b) => a.id.localeCompare(b.id))[0];
+	const fallback = aliases.toSorted((a, b) => a.id.localeCompare(b.id))[0];
+	if (preferred) return preferred;
+	if (fallback) return fallback;
+	throw new Error("recorder: no location aliases to attribute hydrated profile");
+}
+function aliasesByRoot(locations) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const location of locations) {
+		const aliases = grouped.get(location.root);
+		if (aliases) aliases.push(location);
+		else grouped.set(location.root, [location]);
 	}
-	/**
-	* Cancel a running OR queued job. A running job stops after its current
-	* file; a queued job is terminated where it stands and never runs — which is
-	* why this returns true for both, and why the cancelled job still gets its
-	* `onFinished` audit row.
-	*/
-	cancel(jobId) {
-		const job = this.jobs.get(jobId);
-		if (!job) return false;
-		if (job.state === "running") {
-			job.cancelRequested = true;
-			return true;
-		}
-		if (job.state !== "queued") return false;
-		job.cancelRequested = true;
-		job.state = "cancelled";
-		job.finishedAt = this.deps.now();
-		const at = this.queue.indexOf(jobId);
-		if (at >= 0) this.queue.splice(at, 1);
-		this.deps.onFinished?.(snapshot(job));
-		return true;
+	return grouped;
+}
+/** One numeric key lifted out of a location's untyped `config` record, or
+*  nothing at all when it is absent or not a finite number. Absent is a real
+*  answer here: the caller falls back to a documented default, and a garbage
+*  value must never become a capacity limit. */
+function numericConfig(config, key, field) {
+	const raw = config[key];
+	if (typeof raw !== "number" || !Number.isFinite(raw)) return {};
+	return { [field]: raw };
+}
+/**
+* Resolve every recordings storage location (`recordings` + `recordingsLow`)
+* to `{ id, root }`. Returns an empty list when the storage cap is unreachable
+* or no recordings location exists — callers degrade rather than crash.
+*/
+async function resolveRecordingsLocations(api, logger) {
+	try {
+		const recordings = (await api.storage.listLocations.query({})).filter((l) => RECORDING_LOCATION_TYPES.has(l.type));
+		return Promise.all(recordings.map(async (l) => recordingsLocationOfMode({
+			id: l.id,
+			type: l.type,
+			root: await api.storage.resolve.query({
+				location: l.id,
+				relativePath: ""
+			}),
+			...numericConfig(l.config, "minFreePercent", "minFreePercent"),
+			...numericConfig(l.config, "maxUsedGb", "maxUsedGb")
+		}, require_dist.resolveLocationMode(l))));
+	} catch (err) {
+		logger.warn("recorder: listLocations failed — no recordings locations resolved", { meta: { error: require_dist.errMsg(err) } });
+		return [];
 	}
-	/**
-	* Enqueue a relocation and return its job id. Throws only on an input the
-	* mover could never satisfy (unknown/identical/read-only locations) —
-	* validated SYNCHRONOUSLY so a caller arming a rebalance learns about a bad
-	* target before any job runs.
-	*
-	* Concurrency: the returned job may be `queued` rather than `running`. The
-	* engine still moves one job at a time.
-	*/
-	start(input) {
-		const locs = this.deps.locations();
-		const from = locs.find((l) => l.id === input.fromLocationId);
-		const to = locs.find((l) => l.id === input.toLocationId);
-		if (!from) throw new Error(`unknown source location: ${input.fromLocationId}`);
-		if (!to) throw new Error(`unknown target location: ${input.toLocationId}`);
-		if (from.id === to.id) throw new Error("source and target locations are identical");
-		if (to.readOnly) throw new Error(`target location is read-only: ${to.id}`);
-		if (to.enabled === false) this.deps.logger.warn("relocate: target location is DISABLED (standby) — moving to it because the operator named it; placement still never chooses it for new writes", {
-			...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
-			meta: {
-				fromLocationId: from.id,
-				toLocationId: to.id,
-				footageClass: input.footageClass ?? null
+}
+/**
+* Hydrate the v2 `RecordingIndex` for one device from every recordings location
+* by recursively walking `<root>/<deviceId>/` for `*.m4s` segments and feeding
+* the location-relative paths (`<deviceId>/<profile>/Y/M/D/H/<file>.m4s`, which
+* `parseSegmentPath` understands) to `index.hydrateDevice`. A missing device dir
+* (no footage yet) and any per-location failure are warned + skipped
+* (best-effort), so one bad volume never blocks the rest of the hydrate.
+*/
+async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger, options = {}) {
+	const yieldBetween = options.yieldBetween ?? macrotask$3;
+	const chunkSize = options.chunkSize ?? HYDRATE_CHUNK;
+	for (const [root, aliases] of aliasesByRoot(locations)) {
+		const deviceDir = node_path.default.join(root, String(deviceId));
+		const startedMs = Date.now();
+		let entries;
+		try {
+			entries = await node_fs.promises.readdir(deviceDir, { recursive: true });
+		} catch (err) {
+			if (err.code === "ENOENT") {
+				for (const location of aliases) index.hydrateDevice(deviceId, location.id, []);
+				continue;
+			}
+			logger.warn("recorder: hydrateDevice walk failed for location", {
+				tags: { deviceId },
+				meta: {
+					locationIds: aliases.map((location) => location.id),
+					error: require_dist.errMsg(err)
+				}
+			});
+			continue;
+		}
+		const walkedMs = Date.now();
+		const locationForProfile = /* @__PURE__ */ new Map();
+		const pathsByLocation = /* @__PURE__ */ new Map();
+		let handled = 0;
+		for (const entry of entries) {
+			if (!entry.endsWith(".m4s")) continue;
+			const relative = `${deviceId}/${entry.split(node_path.default.sep).join("/")}`;
+			const profile = relative.split("/")[1] ?? "";
+			let locationId = locationForProfile.get(profile);
+			if (locationId === void 0) {
+				locationId = locationForHydratedProfile(aliases, profile).id;
+				locationForProfile.set(profile, locationId);
+			}
+			const paths = pathsByLocation.get(locationId);
+			if (paths) paths.push(relative);
+			else pathsByLocation.set(locationId, [relative]);
+			handled += 1;
+			if (handled % chunkSize === 0) await yieldBetween();
+		}
+		for (const location of aliases) if (!pathsByLocation.has(location.id)) pathsByLocation.set(location.id, []);
+		let indexed = 0;
+		const reuseBefore = index.hydrateReuseStats();
+		for (const [locationId, relPaths] of pathsByLocation) {
+			index.hydrateDevice(deviceId, locationId, relPaths);
+			indexed += relPaths.length;
+		}
+		const reuseAfter = index.hydrateReuseStats();
+		const reused = reuseAfter.rowsReused - reuseBefore.rowsReused;
+		const allocated = reuseAfter.rowsAllocated - reuseBefore.rowsAllocated;
+		logger.info("recorder: hydrated a device from one recordings root", {
+			tags: { deviceId },
+			meta: {
+				root,
+				entries: entries.length,
+				indexed,
+				reused,
+				allocated,
+				locationIds: [...pathsByLocation.keys()],
+				walkMs: walkedMs - startedMs,
+				ms: Date.now() - startedMs
+			}
+		});
+	}
+}
+/** Entries classified between yields in {@link hydrateDeviceFromStorage}. */
+var HYDRATE_CHUNK = 2e4;
+var macrotask$3 = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
+/** `<deviceId>/<profile>/YYYY/MM/DD/HH` for an hour bucket (paths are UTC). */
+function hourDirRelPath(deviceId, profile, hourStartMs) {
+	const d = new Date(hourStartMs);
+	const p2 = (n) => String(n).padStart(2, "0");
+	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
+}
+var HOUR_MS$7 = 36e5;
+/**
+* Hydrate ONLY the hours a window spans, instead of walking the archive.
+*
+* `hydrateDeviceFromStorage` is a recursive `readdir` over the whole device
+* subtree — ">1M files and takes minutes" per its own comment. Until it lands,
+* every read of past footage sees an empty index, which the server reports as
+* "no footage": measured after a deploy, a camera-day held 7 segments and grew
+* only at the rate of NEW writes for ~9 minutes.
+*
+* The path convention makes the window addressable directly: one SHALLOW
+* `readdir` per (profile, hour), ~450 entries each. A day is ~72 of them. The
+* background full walk still runs, for the consumers that need the whole
+* archive (footprint, eviction domains, retention).
+*
+* Hours already walked are skipped, so a drag across an hour costs nothing the
+* second time.
+*
+* ## The ledger is the first stop for a CLOSED hour (D287)
+*
+* Boot no longer replays the archive into the index, so a ledger-known hour
+* arrives here `unknown` and pays ONE point read of its hour row instead of a
+* `readdir` — measured at ~650 ms per hour directory on the live share under
+* load, against the array the scrub feeder is competing for. Hours the ledger
+* does not know, and every hour if the read fails, fall through to the walk
+* exactly as before: the failure direction is toward the disk, never toward an
+* hour that renders empty because nobody read it.
+*
+* **The live hour is never served from the ledger.** It is the one hour whose
+* durable row is knowably behind the disk: a segment finalized after the last
+* persist and before a crash is on the array and not in the row. Boot used to
+* mark every ledger hour `hydrated`, which made that tail invisible to
+* playback and the timeline FOREVER, not merely under-reported. Excluding the
+* live hour costs exactly one hour-directory read per process — the walk marks
+* it, so the second reader pays nothing — and it is what turns a lost tail
+* back into a recoverable one.
+*
+* A CLOSED hour already walked is skipped, which is what makes that exclusion
+* affordable: without it, every window touching the live hour would re-walk
+* all of its hours. The past is immutable, so re-reading a closed hour
+* directory can only ever return what the index already holds; eviction
+* removes rows through the index directly.
+*/
+async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger, ledger) {
+	if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
+	const liveHour = Math.floor(Date.now() / HOUR_MS$7) * HOUR_MS$7;
+	if (ledger !== void 0) {
+		const startedMs = Date.now();
+		const hours = await ledger.detailForWindow(deviceId, fromMs, toMs);
+		let segments = 0;
+		let served = 0;
+		for (const hour of hours) {
+			if (hour.hourStartMs >= liveHour) continue;
+			index.hydrateHour(deviceId, hour.locationId, hour.hourStartMs, hour.paths);
+			segments += hour.paths.length;
+			served += 1;
+		}
+		if (served > 0) logger.info("recorder: hydrated a window from the hour ledger", {
+			tags: { deviceId },
+			meta: {
+				hours: served,
+				segments,
+				ms: Date.now() - startedMs
+			}
+		});
+		if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
+	}
+	for (const [root, aliases] of aliasesByRoot(locations)) {
+		const deviceDir = node_path.default.join(root, String(deviceId));
+		let profiles;
+		try {
+			profiles = (await node_fs.promises.readdir(deviceDir)).filter((e) => e === "high" || e === "mid" || e === "low");
+		} catch (err) {
+			if (err.code !== "ENOENT") logger.warn("recorder: hydrateWindow profile listing failed", {
+				tags: { deviceId },
+				meta: {
+					locationIds: aliases.map((location) => location.id),
+					error: require_dist.errMsg(err)
+				}
+			});
+			continue;
+		}
+		const first = Math.floor(fromMs / HOUR_MS$7) * HOUR_MS$7;
+		const reuseBefore = index.hydrateReuseStats();
+		let hoursRead = 0;
+		let repaired = 0;
+		for (let hour = first; hour < toMs; hour += HOUR_MS$7) {
+			if (hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$7) === "hydrated") continue;
+			for (const profile of profiles) {
+				const rel = hourDirRelPath(deviceId, profile, hour);
+				let files;
+				try {
+					files = await node_fs.promises.readdir(node_path.default.join(root, rel));
+				} catch {
+					continue;
+				}
+				hoursRead += 1;
+				const locationId = locationForHydratedProfile(aliases, profile).id;
+				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
+				index.hydrateHour(deviceId, locationId, hour, relPaths);
+				if (ledger !== void 0 && relPaths.length > 0 && hour + HOUR_MS$7 <= Date.now() && !ledger.knowsHour(deviceId, profile, locationId, hour)) {
+					repaired += 1;
+					await ledger.adoptRebuiltHour(deviceId, profile, locationId, hour, relPaths);
+				}
+			}
+		}
+		index.markHydrated(deviceId, fromMs, toMs);
+		if (hoursRead === 0) continue;
+		const reuseAfter = index.hydrateReuseStats();
+		const reused = reuseAfter.rowsReused - reuseBefore.rowsReused;
+		const allocated = reuseAfter.rowsAllocated - reuseBefore.rowsAllocated;
+		logger.info("recorder: hydrated a window from one recordings root", {
+			tags: { deviceId },
+			meta: {
+				root,
+				hoursRead,
+				repaired,
+				reused,
+				allocated
 			}
 		});
+	}
+}
+//#endregion
+//#region src/recorder/relocate-engine.ts
+/**
+* Footage relocation engine (entity-routing spec, Phase 4) — the mover half
+* of disk decommissioning: mark the old location read-only (Phase 2), then
+* relocate its footage here, then delete the location.
+*
+* Mechanics, per HOUR (D291): throttled copy + size-verify of every file in the
+* hour → re-point the DURABLE hour row → delete the sources → re-point the RAM
+* index. The hour is the batch because the durable index is hour-granular, and
+* the sources outlive the durable write on purpose: between the copy and the
+* delete both locations hold the hour, so no crash can leave the index naming a
+* location without the bytes. The copy is `copy-if-absent` (an equal-size
+* destination is adopted, not re-copied), so cancel/crash/re-run RESUMES
+* instead of restarting, and a cancel inside an hour leaves that hour WHOLLY
+* readable at the source. Throttling is file-level pacing (segments are
+* ~1–8 MB / ~4 s, so per-file granularity bounds the rate tightly enough) —
+* the drain is a background chore that must never starve live writers.
+*
+* Runs INSIDE the recorder process — container uid, same-uid files, no host
+* chown trap (see docs/history 2026-07-29).
+*
+* ── Phase 2 (D116, multi-location) ────────────────────────────────────────
+* Two additions the OPERATOR-ARMED rebalance needs:
+*
+*   - A move is scoped to one CAMERA (and optionally to specific profiles),
+*     not just to a whole disk. The rebalance's unit is a (camera, profile)
+*     pile, because that is the unit the placement plan assigns.
+*   - Concurrent starts QUEUE instead of being refused. The engine is still
+*     single-flight — two movers on one disk thrash both — but a rebalance
+*     enqueues one job per pile, and refusing the second turned a
+*     fifteen-camera rebalance into fifteen manual retries. Jobs run FIFO; a
+*     job cancelled while queued never runs, and a job that FAILS does not
+*     strand the queue behind it.
+*/
+var DEFAULT_THROTTLE_MBPS = 40;
+/** The durable index's bucket, and therefore this mover's batch. */
+var HOUR_MS$6 = 36e5;
+/** Progress callback cadence (files) — cheap enough to fire often. */
+var PROGRESS_EVERY_FILES = 25;
+/** Free space a destination must keep when it declares no `config.minFreePercent`
+*  — the same default `roots.ts` documents for placement. */
+var DEFAULT_MIN_FREE_PERCENT$1 = 10;
+/** Prefix every destination-full error carries, so the coordinator can report
+*  "drain stalled: destination full" instead of a raw ENOSPC string. */
+var DESTINATION_FULL_PREFIX = "destination full";
+/**
+* Ghost rows one job may FORGET, as a share of its own census — and the floor
+* below which the share is not the bound.
+*
+* D148 is why this is bounded at all: the ledger forgets only on a trusted walk
+* or an eviction, so that a transient read error cannot erase an operator's
+* index of real footage. A per-path ENOENT on a path derived from the row is
+* strong evidence about THAT path (D296) and weak evidence about a mount: a
+* root that vanished answers ENOENT for every path it is asked about, and looks
+* exactly like a location that is genuinely empty. The bound is what makes the
+* difference survivable — past it the mover keeps moving, keeps skipping, and
+* REPORTS, so an operator gets a reconcile to act on instead of an archive that
+* quietly emptied itself.
+*
+* 17.5 % of `recordingsLow:default` was ghosts on 2026-08-30 (11 074 of
+* 63 346), so a quarter admits a real reconcile of that size in one pass while
+* refusing a whole-location erase.
+*/
+var GHOST_FORGET_SHARE = .25;
+function snapshot(j) {
+	return {
+		jobId: j.jobId,
+		state: j.state,
+		fromLocationId: j.fromLocationId,
+		toLocationId: j.toLocationId,
+		deviceId: j.deviceId,
+		entities: [...j.entities],
+		filesMoved: j.filesMoved,
+		bytesMoved: j.bytesMoved,
+		filesTotal: j.filesTotal,
+		rowsReconciled: j.rowsReconciled,
+		rowsForgotten: j.rowsForgotten,
+		startedAt: j.startedAt,
+		finishedAt: j.finishedAt,
+		error: j.error
+	};
+}
+/**
+* The row's source file is not on disk.
+*
+* Carries `code: 'ENOENT'` because that is how every caller here already tells
+* a ghost row from a real failure, and {@link copyVerified} now discovers the
+* absence with a `stat` rather than by letting `copyFile` raise it.
+*/
+var RelocateSourceMissingError = class extends Error {
+	code = "ENOENT";
+	constructor(src) {
+		super(`relocate source missing: ${src}`);
+		this.name = "RelocateSourceMissingError";
+	}
+};
+/**
+* One file's COPY: copy-if-absent → verify the destination against the SOURCE'S
+* OWN SIZE. The source is left in place.
+*
+* Split out of {@link moveFile} because the durable index re-point has to
+* happen while BOTH locations still hold the bytes — see
+* `SegmentHourLedger.repointSegments`.
+*
+* **`recordedBytes` is never the verify's reference.** It used to be, and it
+* cannot be: `fs.copyFile` truncates and replaces, so the destination always
+* equals the source, and comparing that result against a number the LEDGER
+* remembers can only ever fail when the ledger is wrong. On 2026-08-30 that
+* reported a byte-perfect copy as corruption and killed a 110 749-file drain
+* on its 12 440th file:
+*
+*     relocate verify failed: …/1787926410000-9966-274432.m4s
+*       is 783801B, expected 274432B
+*
+* Both files measured 783801 B on the hub. What is faithful is "the
+* destination equals the source", and that is what is asserted here; the
+* recorded number survives only as the reference for a destination whose
+* source is already GONE, where there is nothing else left to compare against.
+*/
+async function copyVerified(src, dst, recordedBytes) {
+	const dstBytes = await fileSize(dst);
+	const srcBytes = await fileSize(src);
+	if (dstBytes !== null && dstBytes === (srcBytes ?? recordedBytes)) return {
+		copied: 0,
+		srcBytes: dstBytes
+	};
+	if (srcBytes === null) throw new RelocateSourceMissingError(src);
+	await node_fs.promises.mkdir(node_path.default.dirname(dst), { recursive: true });
+	await node_fs.promises.copyFile(src, dst);
+	const after = await node_fs.promises.stat(dst);
+	if (after.size !== srcBytes) throw new Error(`relocate verify failed: ${dst} is ${after.size}B, expected ${srcBytes}B`);
+	return {
+		copied: srcBytes,
+		srcBytes
+	};
+}
+/** A file's size, or `null` when it is not there. */
+async function fileSize(p) {
+	try {
+		return (await node_fs.promises.stat(p)).size;
+	} catch {
+		return null;
+	}
+}
+var RelocateEngine = class {
+	deps;
+	jobs = /* @__PURE__ */ new Map();
+	/** Job ids waiting for the mover, in enqueue order. */
+	queue = [];
+	/** Set while a job is executing — the single-flight latch. */
+	draining = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	list() {
+		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
+	}
+	/**
+	* Cancel a running OR queued job. A running job stops after its current
+	* file; a queued job is terminated where it stands and never runs — which is
+	* why this returns true for both, and why the cancelled job still gets its
+	* `onFinished` audit row.
+	*/
+	cancel(jobId) {
+		const job = this.jobs.get(jobId);
+		if (!job) return false;
+		if (job.state === "running") {
+			job.cancelRequested = true;
+			return true;
+		}
+		if (job.state !== "queued") return false;
+		job.cancelRequested = true;
+		job.state = "cancelled";
+		job.finishedAt = this.deps.now();
+		const at = this.queue.indexOf(jobId);
+		if (at >= 0) this.queue.splice(at, 1);
+		this.deps.onFinished?.(snapshot(job));
+		return true;
+	}
+	/**
+	* Enqueue a relocation and return its job id. Throws only on an input the
+	* mover could never satisfy (unknown/identical/read-only locations) —
+	* validated SYNCHRONOUSLY so a caller arming a rebalance learns about a bad
+	* target before any job runs.
+	*
+	* Concurrency: the returned job may be `queued` rather than `running`. The
+	* engine still moves one job at a time.
+	*/
+	start(input) {
+		const locs = this.deps.locations();
+		const from = locs.find((l) => l.id === input.fromLocationId);
+		const to = locs.find((l) => l.id === input.toLocationId);
+		if (!from) throw new Error(`unknown source location: ${input.fromLocationId}`);
+		if (!to) throw new Error(`unknown target location: ${input.toLocationId}`);
+		if (from.id === to.id) throw new Error("source and target locations are identical");
+		if (!locationMayBeWritten(to)) throw new Error(`target location is read-only (mode: ${locationMode(to)}): ${to.id}`);
 		const job = {
 			jobId: this.deps.newId(),
 			state: "queued",
@@ -2281,7 +2651,7 @@ function profilesOfClass(footageClass) {
 function groupByHour(rows) {
 	const out = /* @__PURE__ */ new Map();
 	for (const row of rows) {
-		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$7)}`;
+		const key = `${row.deviceId}|${row.profile}|${Math.floor(row.startMs / HOUR_MS$6)}`;
 		const found = out.get(key);
 		if (found) found.push(row);
 		else out.set(key, [row]);
@@ -2470,7 +2840,7 @@ var SegmentStore = class SegmentStore {
 			else byBucket.set(bucketDir, [r]);
 		}
 		const chunkSize = this.deps.evictChunkSize ?? SegmentStore.DEFAULT_EVICT_CHUNK;
-		const yieldBetween = this.deps.yieldBetween ?? macrotask$3;
+		const yieldBetween = this.deps.yieldBetween ?? macrotask$2;
 		let bucketsRemoved = 0;
 		let handled = 0;
 		for (const [bucketDir, bucketRows] of byBucket) {
@@ -2618,7 +2988,7 @@ var SegmentStore = class SegmentStore {
 		return held.every((p) => doomed.has(p));
 	}
 };
-var macrotask$3 = () => new Promise((resolve) => {
+var macrotask$2 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
 //#endregion
@@ -3130,6 +3500,12 @@ function intersect(a, b) {
 * The cap's `locationId` is used directly as the storage `location` (identity); see Plan 2d
 * notes. Wiring this class to the cap + the SegmentStore happens in Plan 2e.
 */
+/**
+* One class, two cap surfaces: `storage-evictable` (what may be deleted under
+* pressure) and `storage-occupancy` (what is HELD, D388). They live together
+* because they read the same archive, and they are separate CAPS because they
+* are separate quantities — see `getOccupancy`.
+*/
 var StorageEvictableProvider = class {
 	deps;
 	orphanLane;
@@ -3147,9 +3523,9 @@ var StorageEvictableProvider = class {
 	*  reported evictable nor selected as victims). */
 	domainOf(locationId) {
 		const domain = this.deps.resolveDomain?.(locationId) ?? new Set([locationId]);
-		if (!this.deps.isReadOnly) return domain;
+		if (!this.deps.isEvictionFrozen) return domain;
 		const writable = /* @__PURE__ */ new Set();
-		for (const id of domain) if (!this.deps.isReadOnly(id)) writable.add(id);
+		for (const id of domain) if (!this.deps.isEvictionFrozen(id)) writable.add(id);
 		return writable;
 	}
 	/**
@@ -3168,6 +3544,41 @@ var StorageEvictableProvider = class {
 		}
 		return { bytes: (await archive.accountingForLocations(this.domainOf(input.locationId))).bytes };
 	}
+	/**
+	* The `storage-occupancy` answer (D388) — a DIFFERENT quantity from
+	* {@link getEvictableUsage}, and the difference is the whole reason the cap
+	* exists:
+	*
+	*  - it is the location's OWN bytes, not its eviction domain's. Two aliases
+	*    of one root report their own halves instead of the same combined total
+	*    twice;
+	*  - it counts a location whose eviction policy is `never` (a `readonly` or
+	*    `disabled` disk), which `getEvictableUsage` deliberately reports as 0.
+	*    Those are the disks an operator retiring hardware is staring at.
+	*
+	* A location this recorder holds nothing on is OMITTED, never reported as
+	* zero, and an archive it cannot measure yields NO reports at all — unknown
+	* is the truth when nothing could be read.
+	*/
+	async getOccupancy(input) {
+		const archive = this.deps.archive();
+		if (archive === null) {
+			this.deps.logger.warn("recorder: occupancy unavailable — no footage archive to measure, reporting NOTHING (a location with no report reads as unknown, never as empty)", { meta: { locationIds: [...input.locationIds] } });
+			return [];
+		}
+		const measuredAtMs = this.deps.now?.() ?? Date.now();
+		const out = [];
+		for (const locationId of input.locationIds) {
+			const acct = await archive.accountingForLocations(new Set([locationId]));
+			if (acct.bytes <= 0) continue;
+			out.push({
+				locationId,
+				ownedBytes: acct.bytes,
+				measuredAtMs
+			});
+		}
+		return out;
+	}
 	async evict(input) {
 		const archive = this.deps.archive();
 		if (archive === null) {
@@ -3434,7 +3845,7 @@ async function profileHasFootage(root, deviceId, profile) {
 //#endregion
 //#region src/recorder/addon/calendar-index.ts
 var DAY_MS$3 = 864e5;
-var HOUR_MS$6 = 36e5;
+var HOUR_MS$5 = 36e5;
 /**
 * UTC ms → the UTC epoch of LOCAL midnight of the day it falls in.
 *
@@ -3472,8 +3883,8 @@ var RANGE_MERGE_GAP_MS$1 = 5e3;
 * deploy gap). Unknown hours still fall through to one directory read.
 */
 function hourSegmentsFromIndex(index, deviceId, profile, hourStartMs) {
-	const hour = Math.floor(hourStartMs / HOUR_MS$6) * HOUR_MS$6;
-	const hourEnd = hour + HOUR_MS$6;
+	const hour = Math.floor(hourStartMs / HOUR_MS$5) * HOUR_MS$5;
+	const hourEnd = hour + HOUR_MS$5;
 	if (index.hydrationOf(deviceId, hour, hourEnd) !== "hydrated") return null;
 	const rows = [];
 	for (const s of index.segmentsStartingIn(deviceId, profile, hour, hourEnd)) rows.push({
@@ -3630,7 +4041,7 @@ var CalendarIndex = class {
 		}));
 		const days = /* @__PURE__ */ new Set();
 		for (const { day, hours } of perDay) for (const h of hours) {
-			const at = day + h * HOUR_MS$6;
+			const at = day + h * HOUR_MS$5;
 			if (at < fromMs || at >= toMs) continue;
 			days.add(localDayStart(at, tzOffsetMinutes));
 		}
@@ -3692,7 +4103,7 @@ var CalendarIndex = class {
 		const day = utcDayOf(utcDayMs);
 		for (let h = 0; h < 24; h++) {
 			await this.awaitQuiet();
-			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$6, true);
+			await this.segmentsOf(deviceId, profile, day + h * HOUR_MS$5, true);
 		}
 	}
 	/**
@@ -3713,7 +4124,7 @@ var CalendarIndex = class {
 	*/
 	async segmentsOfChecked(deviceId, profile, hourStartMs, background = false) {
 		if (!background) this.lastForegroundAt = this.deps.now?.() ?? Date.now();
-		const hour = Math.floor(hourStartMs / HOUR_MS$6) * HOUR_MS$6;
+		const hour = Math.floor(hourStartMs / HOUR_MS$5) * HOUR_MS$5;
 		const fromIndex = this.deps.indexHour?.(deviceId, profile, hour);
 		if (fromIndex !== null && fromIndex !== void 0) return {
 			segments: fromIndex,
@@ -3721,7 +4132,7 @@ var CalendarIndex = class {
 		};
 		const key = `${deviceId}:${profile}:${hour}`;
 		const now = this.deps.now?.() ?? Date.now();
-		const isCurrentHour = hour === Math.floor(now / HOUR_MS$6) * HOUR_MS$6;
+		const isCurrentHour = hour === Math.floor(now / HOUR_MS$5) * HOUR_MS$5;
 		const cached = this.hourSegs.get(key);
 		if (cached !== void 0) {
 			if (!isCurrentHour) return {
@@ -3785,7 +4196,7 @@ var CalendarIndex = class {
 	*/
 	async dayRanges(deviceId, profile, utcDayMs) {
 		const day = utcDayOf(utcDayMs);
-		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$6), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
+		return mergeRanges((await mapBounded(Array.from({ length: 24 }, (_, h) => day + h * HOUR_MS$5), READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour))).flat(), RANGE_MERGE_GAP_MS$1);
 	}
 	/**
 	* Exact ranges of `[fromMs, toMs)`, scanning ONLY the hours the window
@@ -3799,9 +4210,9 @@ var CalendarIndex = class {
 	*/
 	async rangesIn(deviceId, profile, fromMs, toMs) {
 		if (toMs <= fromMs) return [];
-		const first = Math.floor(fromMs / HOUR_MS$6) * HOUR_MS$6;
+		const first = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
 		const hours = [];
-		for (let hour = first; hour < toMs; hour += HOUR_MS$6) hours.push(hour);
+		for (let hour = first; hour < toMs; hour += HOUR_MS$5) hours.push(hour);
 		const perHour = await mapBounded(hours, READ_CONCURRENCY, (hour) => this.segmentsOf(deviceId, profile, hour));
 		const ranges = [];
 		for (const r of mergeRanges(perHour.flat(), RANGE_MERGE_GAP_MS$1)) {
@@ -3950,7 +4361,7 @@ var DEFAULT_DEVICE_CONFIG = {
 };
 /** Build the handle. `declare()` MUST run once at boot before any read/write. */
 function recordingConfigsState(store, logger) {
-	return new require_prebuffer.RowMapStore({
+	return new require_retire_root_keys.RowMapStore({
 		spec: RECORDING_CONFIGS_SPEC,
 		store,
 		logger
@@ -4329,7 +4740,7 @@ function handleStoreCensusAction(census, logger, input) {
 }
 //#endregion
 //#region src/recorder/addon/directory-handler.ts
-var HOUR_MS$5 = 36e5;
+var HOUR_MS$4 = 36e5;
 /** A window wider than this is refused: it is a client bug, and answering it
 *  would walk the archive on the read path — the thing this replaces. */
 var MAX_WINDOW_MS = 32 * 864e5;
@@ -4376,9 +4787,9 @@ function withDirectoryRoute(deps, next) {
 				return;
 			}
 			const rows = [];
-			const firstHour = Math.floor(fromMs / HOUR_MS$5) * HOUR_MS$5;
+			const firstHour = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
 			let hydrated = true;
-			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$5) {
+			for (let hour = firstHour; hour < toMs; hour += HOUR_MS$4) {
 				const { segments, complete } = await deps.source.segmentsOfChecked(deviceId, profile, hour);
 				if (!complete) hydrated = false;
 				for (const s of segments) {
@@ -4564,21 +4975,16 @@ async function wipeClassSubtrees(input) {
 }
 //#endregion
 //#region src/recorder/addon/location-discard-policy.ts
-/**
-* Server-side eligibility for discarding a frozen location's leftover
-* class subtree. Same rules as the admin-ui card: frozen, known class,
-* writable sibling of the same type. The last writable of a type is
-* refused here even if the UI is bypassed.
-*/
 var DISCARD_SUBTREES = {
 	eventMedia: ["events"],
 	recordingsLow: ["low"],
 	recordings: ["high", "mid"]
 };
+/** Frozen = the system will not remove this footage on its own: eviction
+*  policy `never` (D385), i.e. `readonly` or `disabled`. A `drain` location is
+*  NOT frozen — the ratchet is already removing it. */
 function locationIsFrozen(location) {
-	const enabled = location.enabled !== false;
-	const readOnly = location.config["readOnly"] === true;
-	return !enabled || readOnly;
+	return require_dist.evictionPolicyOfLocation(location) === "never";
 }
 function discardEligible(location, siblings) {
 	if (!(location.type in DISCARD_SUBTREES)) return false;
@@ -4586,9 +4992,7 @@ function discardEligible(location, siblings) {
 	return siblings.some((s) => {
 		if (s.id === location.id) return false;
 		if (s.type !== location.type) return false;
-		const enabled = s.enabled !== false;
-		const readOnly = s.config["readOnly"] === true;
-		return enabled && !readOnly;
+		return require_dist.mayWriteToLocation(s);
 	});
 }
 function assertDiscardAllowed(location, all, localNodeId) {
@@ -4797,6 +5201,20 @@ function createFootageDiscardJob(deps) {
 	};
 }
 //#endregion
+//#region src/recorder/addon/location-resolve.ts
+/**
+* A location this process may READ from.
+*
+* Throws with a message that names WHICH of the two it is — never one message
+* for both. The caller does not have to branch: the message is the product.
+*/
+function requireReadableLocation(locations, locationId, context) {
+	const location = locations.find((candidate) => candidate.id === locationId);
+	if (location === void 0) throw new Error(`${context}: unknown location ${locationId}`);
+	if (!locationMayBeRead(location)) throw new Error(`${context}: recordings location ${locationId} is UNAVAILABLE — the operator switched it off (mode: ${location.mode}). Its footage is still on disk; set the location back to readonly or active to read it.`);
+	return location;
+}
+//#endregion
 //#region src/recorder/addon/export-dense-map.ts
 /**
 * Shortest clip worth keeping, in ms.
@@ -5241,7 +5659,7 @@ var RECORDING_EXPORTS_SPEC = {
 };
 /** Build the handle. `declare()` MUST run once at boot before any read/write. */
 function recordingExportsState(store, logger) {
-	return new require_prebuffer.RowMapStore({
+	return new require_retire_root_keys.RowMapStore({
 		spec: RECORDING_EXPORTS_SPEC,
 		store,
 		logger
@@ -6784,8 +7202,7 @@ async function evictVictims(deps, deviceId, victims) {
 function resolveSegmentFile(deps, deviceId, profile, startMs) {
 	const seg = deps.index.segmentStartingAt(deviceId, profile, startMs);
 	if (!seg) throw new Error(`recording: no segment at start ${startMs} for ${deviceId}/${profile}`);
-	const loc = deps.locations().find((l) => l.id === seg.locationId);
-	if (!loc) throw new Error(`recording: unknown location ${seg.locationId}`);
+	const loc = requireReadableLocation(deps.locations(), seg.locationId, "recording");
 	return {
 		seg,
 		abs: node_path.default.join(loc.root, seg.path)
@@ -7058,7 +7475,7 @@ function buildRecordingProvider(deps) {
 			}
 			const locationUsages = await Promise.all([...byPhysical.values()].map(async (group) => {
 				const first = group[0];
-				const cap = group.some((l) => l.enabled !== false) ? await deps.capacity(first.root) : {
+				const cap = group.some((l) => locationMayBeWritten(l)) ? await deps.capacity(first.root) : {
 					availableBytes: null,
 					totalBytes: null
 				};
@@ -7576,528 +7993,162 @@ var RENDER_TIMEOUT_MS = 3e4;
 */
 var FOOTAGE_NOT_READY = "footage-not-yet-finalized";
 /**
-* GIF for the widest notifier reach (every backend that takes an image takes a
-* gif); `fps` decimates and lanczos downscales.
-*/
-async function renderGif(renderDeps, input) {
-	const out = await renderFootage(renderDeps, input, "gif", (playlistPath, outPath) => [
-		"-y",
-		"-i",
-		playlistPath,
-		"-vf",
-		`fps=${input.fps},scale=${input.maxWidth}:-2:flags=lanczos`,
-		"-loop",
-		"0",
-		"-f",
-		"gif",
-		outPath
-	]);
-	return {
-		gifBase64: out.bytes.toString("base64"),
-		fromMs: out.fromMs,
-		toMs: out.toMs
-	};
-}
-/**
-* MP4 clip — the "send a clip, not a gif" attachment. Re-encodes rather than
-* stream-copying: a concat of segments whose encoder parameters differ (a
-* profile switch, a broker redial) produces an mp4 no player will scrub, and a
-* notification attachment that will not play is worse than none. `faststart`
-* puts the moov up front so a chat client can play it without the whole file.
-*/
-async function renderClip(renderDeps, input) {
-	const out = await renderFootage(renderDeps, input, "mp4", (playlistPath, outPath) => [
-		"-y",
-		"-i",
-		playlistPath,
-		"-vf",
-		`scale=${input.maxWidth}:-2:flags=lanczos`,
-		"-c:v",
-		"libx264",
-		"-preset",
-		"veryfast",
-		"-crf",
-		"28",
-		"-profile:v",
-		"main",
-		"-pix_fmt",
-		"yuv420p",
-		"-movflags",
-		"+faststart",
-		"-an",
-		"-f",
-		"mp4",
-		outPath
-	]);
-	return {
-		clipBase64: out.bytes.toString("base64"),
-		mime: "video/mp4",
-		fromMs: out.fromMs,
-		toMs: out.toMs,
-		bytes: out.bytes.byteLength
-	};
-}
-/** The shared playlist → ffmpeg → bytes pipeline. */
-async function renderFootage(renderDeps, input, ext, buildArgs) {
-	const now = renderDeps.now ?? Date.now;
-	const fromMs = input.aroundMs - input.preRollSec * 1e3;
-	const toMs = input.aroundMs + input.postRollSec * 1e3;
-	if (!Number.isFinite(fromMs) || !Number.isFinite(toMs) || toMs <= fromMs) throw new Error(`invalid ${ext} window [${fromMs}, ${toMs}) for device ${input.deviceId} — aroundMs=${input.aroundMs} preRollSec=${input.preRollSec} postRollSec=${input.postRollSec}`);
-	const renderId = `${ext}-${now()}-${Math.floor(Math.random() * 1e6)}`;
-	const availableEnd = latestFinalizedEnd(renderDeps, input.deviceId);
-	if (availableEnd === null || availableEnd < toMs) throw new Error(`${FOOTAGE_NOT_READY}: [${fromMs}, ${toMs}) for device ${input.deviceId} — finalized footage ends at ${availableEnd ?? "never"}`);
-	const window = {
-		fromMs,
-		toMs
-	};
-	const playlist = await writeExportSourcePlaylist({
-		deps: renderDeps.deps,
-		exportsDir: renderDeps.exportsDir,
-		exportId: renderId,
-		deviceId: input.deviceId,
-		profile: "low",
-		fromMs: window.fromMs,
-		toMs: window.toMs
-	});
-	if (playlist === null) throw new Error(`no footage covers [${window.fromMs}, ${window.toMs}) for device ${input.deviceId}`);
-	const outPath = node_path.default.join(node_path.default.dirname(playlist.path), `${renderId}.${ext}`);
-	try {
-		await runFfmpeg(renderDeps, buildArgs(playlist.path, outPath), ext);
-		const bytes = await node_fs.promises.readFile(outPath);
-		if (bytes.byteLength === 0) throw new Error(`${ext} render produced an empty file`);
-		return {
-			bytes,
-			fromMs: window.fromMs,
-			toMs: window.toMs
-		};
-	} finally {
-		await node_fs.promises.rm(playlist.path, { force: true }).catch(() => {});
-		await node_fs.promises.rm(playlist.concatPath, { force: true }).catch(() => {});
-		await node_fs.promises.rm(outPath, { force: true }).catch(() => {});
-	}
-}
-/**
-* The end of the newest FINALIZED `low` segment, or null when none exists.
-*
-* One scalar off the tail of the live sorted view — it used to COPY the
-* device's whole `low` archive to fold a maximum out of it, per render.
-*/
-function latestFinalizedEnd(renderDeps, deviceId) {
-	return renderDeps.deps.index.latestEnd(deviceId, "low");
-}
-/**
-* Run one ffmpeg and GUARANTEE the child is gone before the promise settles.
-*
-* The previous shape leaked on two paths: a `spawn` error (`ENOENT`, a bad
-* path) rejected while a process could still be alive, and a `close` with a
-* non-zero code rejected without ever reaping stdio. These renders fire on
-* every notification with a gif or clip, so a leak here is a slow accumulation
-* of ffmpeg processes on the recording node — the kind that shows up days later
-* as "the hub got slow" (operator, 2026-07-30).
-*
-* `settle` is idempotent and always kills first: killing an already-exited pid
-* throws ESRCH, which is swallowed, so the cost of being wrong is nothing while
-* the cost of NOT killing is a zombie per render.
-*/
-function runFfmpeg(renderDeps, args, ext) {
-	return new Promise((resolve, reject) => {
-		const proc = renderDeps.spawn(renderDeps.ffmpegPath ?? "ffmpeg", args);
-		let done = false;
-		let timer = null;
-		const settle = (err) => {
-			if (done) return;
-			done = true;
-			if (timer !== null) {
-				clearTimeout(timer);
-				timer = null;
-			}
-			if (proc.exitCode === null && proc.signalCode === null) try {
-				proc.kill("SIGKILL");
-			} catch {}
-			try {
-				proc.stderr?.removeAllListeners();
-				proc.stdout?.destroy();
-				proc.stderr?.destroy();
-			} catch {}
-			if (err === null) resolve();
-			else reject(err);
-		};
-		timer = setTimeout(() => settle(/* @__PURE__ */ new Error(`${ext} render timed out`)), RENDER_TIMEOUT_MS);
-		let stderrTail = "";
-		proc.stderr?.on("data", (c) => {
-			stderrTail = (stderrTail + c.toString()).slice(-400);
-		});
-		proc.on("error", (err) => settle(err instanceof Error ? err : new Error(String(err))));
-		proc.on("close", (code) => {
-			settle(code === 0 ? null : /* @__PURE__ */ new Error(`ffmpeg ${ext} render exited ${code}: ${stderrTail}`));
-		});
-	});
-}
-//#endregion
-//#region src/recorder/addon/roots.ts
-/**
-* Storage-root resolution + boot hydrate for the recorder addon.
-*
-* Recordings live in the managed `recordings` / `recordingsLow` storage
-* locations (operator-configurable, multi-disk-ready), resolved through the
-* `storage` cap. The v2 `RecordingIndex` is hydrated by walking each location
-* root's `<deviceId>/` subtree on disk — segment paths encode start/dur/bytes,
-* so the in-memory index can never drift from disk. (We walk the filesystem
-* directly instead of `storage.list` because that cap lists only a directory's
-* IMMEDIATE children, not the `<deviceId>/<profile>/Y/M/D/H/*.m4s` tree — using
-* it dropped the entire index to ~empty on every restart/rescan; the recorder
-* already does local fs I/O for stat/move on these same roots.)
-*/
-/** The two recordings location types the recorder addon writes/reads. */
-var PLACEMENT_LOCATION_TYPES = ["recordings", "recordingsLow"];
-var RECORDING_LOCATION_TYPES = new Set(PLACEMENT_LOCATION_TYPES);
-/**
-* The recordings CLASS a profile belongs to. The one place this rule is
-* written: `resolvePlacement`, the planner's demand type and the repoint check
-* must agree on it, and three copies of `profile === 'low' ? … : …` is how they
-* stop agreeing.
-*/
-function placementTypeForProfile(profile) {
-	return profile === "low" ? "recordingsLow" : "recordings";
-}
-/** The profile that routes to each class — the probe `authorityLocations` asks
-*  `resolvePlacement` with, so the answer is derived from the same function the
-*  unassigned path uses rather than from a second reading of `isDefault`. */
-var CLASS_PROBE_PROFILE = {
-	recordings: "high",
-	recordingsLow: "low"
-};
-/**
-* Where each recordings class writes when NOTHING has planned it — the location
-* `resolvePlacement` picks, which is the type default unless the default is
-* gone, read-only, or absent from the pool.
-*
-* This is the AUTHORITY a stored assignment is measured against (D298). A
-* repoint (`storage.setDefaultLocations`, an operator making another disk the
-* default, a default deleted) changes exactly this map, and a stored assignment
-* that survives that change is a plan that outlived the pool it was planned
-* for.
-*
-* A class with nothing writable is ABSENT from the map, not guessed at: `place`
-* already throws loudly on that path, and an authority nobody can compute must
-* invalidate nothing.
-*/
-function authorityLocations(pool) {
-	const out = /* @__PURE__ */ new Map();
-	for (const type of PLACEMENT_LOCATION_TYPES) try {
-		out.set(type, resolvePlacement(pool, CLASS_PROBE_PROFILE[type]).id);
-	} catch {}
-	return out;
-}
-/**
-* Narrow a resolved location list to the ones placement may write to: the
-* operator-enabled ones. A location the operator has not opted in
-* (`enabled === false`) is still READ, age-swept and drained — it is simply
-* never a write target, exactly like a read-only one.
-*
-* When no enabled location is writable the type DEFAULTS serve instead, loudly:
-* the default of a type is guaranteed enabled by the orchestrator, so this can
-* only happen through a hand-edited store — and a recorder that writes nowhere
-* is worse than one that writes to the default and complains.
-*/
-function placementPool(locations) {
-	const enabled = locations.filter((l) => l.enabled !== false);
-	if (enabled.some((l) => !l.readOnly)) return {
-		locations: enabled,
-		fellBackToDefault: false
-	};
-	const defaults = locations.filter((l) => l.isDefault === true);
-	if (defaults.some((l) => !l.readOnly)) return {
-		locations: defaults,
-		fellBackToDefault: true
-	};
-	return {
-		locations,
-		fellBackToDefault: true
-	};
-}
-/**
-* Route a recording profile to its storage location by the location's declared
-* `type`: the `low` profile prefers the `recordingsLow` location, every other
-* profile the `recordings` location. READ-ONLY locations are never write
-* targets (the drain model): when the preferred type has only read-only
-* instances, any writable recordings-type location serves. Throws when NO
-* writable location exists — recording cannot start, and that must be loud.
-*/
-function resolvePlacement(locations, profile) {
-	if (locations.length === 0) throw new Error("recorder controller: no recordings storage locations resolved");
-	const writable = locations.filter((l) => !l.readOnly);
-	if (writable.length === 0) throw new Error("recorder controller: every recordings location is read-only — nowhere to write");
-	const preferType = profile === "low" ? "recordingsLow" : "recordings";
-	const preferred = writable.filter((l) => l.type === preferType);
-	return preferred.find((l) => l.isDefault) ?? preferred[0] ?? writable.find((l) => l.isDefault) ?? writable[0];
-}
-/**
-* Attribute a discovered segment on an aliased physical root by its profile,
-* not by whichever logical location happened to be hydrated last. Stock
-* `recordings` and `recordingsLow` deliberately share a root: high/mid belong
-* to `recordings`, while low belongs to `recordingsLow`.
-*/
-function locationForHydratedProfile(aliases, profile) {
-	const preferredType = profile === "low" ? "recordingsLow" : "recordings";
-	const preferred = aliases.filter((location) => location.type === preferredType).toSorted((a, b) => a.id.localeCompare(b.id))[0];
-	const fallback = aliases.toSorted((a, b) => a.id.localeCompare(b.id))[0];
-	if (preferred) return preferred;
-	if (fallback) return fallback;
-	throw new Error("recorder: no location aliases to attribute hydrated profile");
-}
-function aliasesByRoot(locations) {
-	const grouped = /* @__PURE__ */ new Map();
-	for (const location of locations) {
-		const aliases = grouped.get(location.root);
-		if (aliases) aliases.push(location);
-		else grouped.set(location.root, [location]);
-	}
-	return grouped;
-}
-/** One numeric key lifted out of a location's untyped `config` record, or
-*  nothing at all when it is absent or not a finite number. Absent is a real
-*  answer here: the caller falls back to a documented default, and a garbage
-*  value must never become a capacity limit. */
-function numericConfig(config, key, field) {
-	const raw = config[key];
-	if (typeof raw !== "number" || !Number.isFinite(raw)) return {};
-	return { [field]: raw };
-}
-/**
-* Resolve every recordings storage location (`recordings` + `recordingsLow`)
-* to `{ id, root }`. Returns an empty list when the storage cap is unreachable
-* or no recordings location exists — callers degrade rather than crash.
+* GIF for the widest notifier reach (every backend that takes an image takes a
+* gif); `fps` decimates and lanczos downscales.
 */
-async function resolveRecordingsLocations(api, logger) {
-	try {
-		const recordings = (await api.storage.listLocations.query({})).filter((l) => RECORDING_LOCATION_TYPES.has(l.type));
-		return Promise.all(recordings.map(async (l) => ({
-			id: l.id,
-			type: l.type,
-			root: await api.storage.resolve.query({
-				location: l.id,
-				relativePath: ""
-			}),
-			readOnly: l.config["readOnly"] === true,
-			isDefault: l.isDefault,
-			...l.enabled === false ? { enabled: false } : {},
-			...numericConfig(l.config, "minFreePercent", "minFreePercent"),
-			...numericConfig(l.config, "maxUsedGb", "maxUsedGb")
-		})));
-	} catch (err) {
-		logger.warn("recorder: listLocations failed — no recordings locations resolved", { meta: { error: require_dist.errMsg(err) } });
-		return [];
-	}
+async function renderGif(renderDeps, input) {
+	const out = await renderFootage(renderDeps, input, "gif", (playlistPath, outPath) => [
+		"-y",
+		"-i",
+		playlistPath,
+		"-vf",
+		`fps=${input.fps},scale=${input.maxWidth}:-2:flags=lanczos`,
+		"-loop",
+		"0",
+		"-f",
+		"gif",
+		outPath
+	]);
+	return {
+		gifBase64: out.bytes.toString("base64"),
+		fromMs: out.fromMs,
+		toMs: out.toMs
+	};
 }
 /**
-* Hydrate the v2 `RecordingIndex` for one device from every recordings location
-* by recursively walking `<root>/<deviceId>/` for `*.m4s` segments and feeding
-* the location-relative paths (`<deviceId>/<profile>/Y/M/D/H/<file>.m4s`, which
-* `parseSegmentPath` understands) to `index.hydrateDevice`. A missing device dir
-* (no footage yet) and any per-location failure are warned + skipped
-* (best-effort), so one bad volume never blocks the rest of the hydrate.
+* MP4 clip — the "send a clip, not a gif" attachment. Re-encodes rather than
+* stream-copying: a concat of segments whose encoder parameters differ (a
+* profile switch, a broker redial) produces an mp4 no player will scrub, and a
+* notification attachment that will not play is worse than none. `faststart`
+* puts the moov up front so a chat client can play it without the whole file.
 */
-async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger, options = {}) {
-	const yieldBetween = options.yieldBetween ?? macrotask$2;
-	const chunkSize = options.chunkSize ?? HYDRATE_CHUNK;
-	for (const [root, aliases] of aliasesByRoot(locations)) {
-		const deviceDir = node_path.default.join(root, String(deviceId));
-		const startedMs = Date.now();
-		let entries;
-		try {
-			entries = await node_fs.promises.readdir(deviceDir, { recursive: true });
-		} catch (err) {
-			if (err.code === "ENOENT") {
-				for (const location of aliases) index.hydrateDevice(deviceId, location.id, []);
-				continue;
-			}
-			logger.warn("recorder: hydrateDevice walk failed for location", {
-				tags: { deviceId },
-				meta: {
-					locationIds: aliases.map((location) => location.id),
-					error: require_dist.errMsg(err)
-				}
-			});
-			continue;
-		}
-		const walkedMs = Date.now();
-		const locationForProfile = /* @__PURE__ */ new Map();
-		const pathsByLocation = /* @__PURE__ */ new Map();
-		let handled = 0;
-		for (const entry of entries) {
-			if (!entry.endsWith(".m4s")) continue;
-			const relative = `${deviceId}/${entry.split(node_path.default.sep).join("/")}`;
-			const profile = relative.split("/")[1] ?? "";
-			let locationId = locationForProfile.get(profile);
-			if (locationId === void 0) {
-				locationId = locationForHydratedProfile(aliases, profile).id;
-				locationForProfile.set(profile, locationId);
-			}
-			const paths = pathsByLocation.get(locationId);
-			if (paths) paths.push(relative);
-			else pathsByLocation.set(locationId, [relative]);
-			handled += 1;
-			if (handled % chunkSize === 0) await yieldBetween();
-		}
-		for (const location of aliases) if (!pathsByLocation.has(location.id)) pathsByLocation.set(location.id, []);
-		let indexed = 0;
-		const reuseBefore = index.hydrateReuseStats();
-		for (const [locationId, relPaths] of pathsByLocation) {
-			index.hydrateDevice(deviceId, locationId, relPaths);
-			indexed += relPaths.length;
-		}
-		const reuseAfter = index.hydrateReuseStats();
-		const reused = reuseAfter.rowsReused - reuseBefore.rowsReused;
-		const allocated = reuseAfter.rowsAllocated - reuseBefore.rowsAllocated;
-		logger.info("recorder: hydrated a device from one recordings root", {
-			tags: { deviceId },
-			meta: {
-				root,
-				entries: entries.length,
-				indexed,
-				reused,
-				allocated,
-				locationIds: [...pathsByLocation.keys()],
-				walkMs: walkedMs - startedMs,
-				ms: Date.now() - startedMs
-			}
-		});
-	}
+async function renderClip(renderDeps, input) {
+	const out = await renderFootage(renderDeps, input, "mp4", (playlistPath, outPath) => [
+		"-y",
+		"-i",
+		playlistPath,
+		"-vf",
+		`scale=${input.maxWidth}:-2:flags=lanczos`,
+		"-c:v",
+		"libx264",
+		"-preset",
+		"veryfast",
+		"-crf",
+		"28",
+		"-profile:v",
+		"main",
+		"-pix_fmt",
+		"yuv420p",
+		"-movflags",
+		"+faststart",
+		"-an",
+		"-f",
+		"mp4",
+		outPath
+	]);
+	return {
+		clipBase64: out.bytes.toString("base64"),
+		mime: "video/mp4",
+		fromMs: out.fromMs,
+		toMs: out.toMs,
+		bytes: out.bytes.byteLength
+	};
 }
-/** Entries classified between yields in {@link hydrateDeviceFromStorage}. */
-var HYDRATE_CHUNK = 2e4;
-var macrotask$2 = () => new Promise((resolve) => {
-	setImmediate(resolve);
-});
-/** `<deviceId>/<profile>/YYYY/MM/DD/HH` for an hour bucket (paths are UTC). */
-function hourDirRelPath(deviceId, profile, hourStartMs) {
-	const d = new Date(hourStartMs);
-	const p2 = (n) => String(n).padStart(2, "0");
-	return `${deviceId}/${profile}/${d.getUTCFullYear()}/${p2(d.getUTCMonth() + 1)}/${p2(d.getUTCDate())}/${p2(d.getUTCHours())}`;
+/** The shared playlist → ffmpeg → bytes pipeline. */
+async function renderFootage(renderDeps, input, ext, buildArgs) {
+	const now = renderDeps.now ?? Date.now;
+	const fromMs = input.aroundMs - input.preRollSec * 1e3;
+	const toMs = input.aroundMs + input.postRollSec * 1e3;
+	if (!Number.isFinite(fromMs) || !Number.isFinite(toMs) || toMs <= fromMs) throw new Error(`invalid ${ext} window [${fromMs}, ${toMs}) for device ${input.deviceId} — aroundMs=${input.aroundMs} preRollSec=${input.preRollSec} postRollSec=${input.postRollSec}`);
+	const renderId = `${ext}-${now()}-${Math.floor(Math.random() * 1e6)}`;
+	const availableEnd = latestFinalizedEnd(renderDeps, input.deviceId);
+	if (availableEnd === null || availableEnd < toMs) throw new Error(`${FOOTAGE_NOT_READY}: [${fromMs}, ${toMs}) for device ${input.deviceId} — finalized footage ends at ${availableEnd ?? "never"}`);
+	const window = {
+		fromMs,
+		toMs
+	};
+	const playlist = await writeExportSourcePlaylist({
+		deps: renderDeps.deps,
+		exportsDir: renderDeps.exportsDir,
+		exportId: renderId,
+		deviceId: input.deviceId,
+		profile: "low",
+		fromMs: window.fromMs,
+		toMs: window.toMs
+	});
+	if (playlist === null) throw new Error(`no footage covers [${window.fromMs}, ${window.toMs}) for device ${input.deviceId}`);
+	const outPath = node_path.default.join(node_path.default.dirname(playlist.path), `${renderId}.${ext}`);
+	try {
+		await runFfmpeg(renderDeps, buildArgs(playlist.path, outPath), ext);
+		const bytes = await node_fs.promises.readFile(outPath);
+		if (bytes.byteLength === 0) throw new Error(`${ext} render produced an empty file`);
+		return {
+			bytes,
+			fromMs: window.fromMs,
+			toMs: window.toMs
+		};
+	} finally {
+		await node_fs.promises.rm(playlist.path, { force: true }).catch(() => {});
+		await node_fs.promises.rm(playlist.concatPath, { force: true }).catch(() => {});
+		await node_fs.promises.rm(outPath, { force: true }).catch(() => {});
+	}
 }
-var HOUR_MS$4 = 36e5;
 /**
-* Hydrate ONLY the hours a window spans, instead of walking the archive.
-*
-* `hydrateDeviceFromStorage` is a recursive `readdir` over the whole device
-* subtree — ">1M files and takes minutes" per its own comment. Until it lands,
-* every read of past footage sees an empty index, which the server reports as
-* "no footage": measured after a deploy, a camera-day held 7 segments and grew
-* only at the rate of NEW writes for ~9 minutes.
-*
-* The path convention makes the window addressable directly: one SHALLOW
-* `readdir` per (profile, hour), ~450 entries each. A day is ~72 of them. The
-* background full walk still runs, for the consumers that need the whole
-* archive (footprint, eviction domains, retention).
-*
-* Hours already walked are skipped, so a drag across an hour costs nothing the
-* second time.
-*
-* ## The ledger is the first stop for a CLOSED hour (D287)
-*
-* Boot no longer replays the archive into the index, so a ledger-known hour
-* arrives here `unknown` and pays ONE point read of its hour row instead of a
-* `readdir` — measured at ~650 ms per hour directory on the live share under
-* load, against the array the scrub feeder is competing for. Hours the ledger
-* does not know, and every hour if the read fails, fall through to the walk
-* exactly as before: the failure direction is toward the disk, never toward an
-* hour that renders empty because nobody read it.
-*
-* **The live hour is never served from the ledger.** It is the one hour whose
-* durable row is knowably behind the disk: a segment finalized after the last
-* persist and before a crash is on the array and not in the row. Boot used to
-* mark every ledger hour `hydrated`, which made that tail invisible to
-* playback and the timeline FOREVER, not merely under-reported. Excluding the
-* live hour costs exactly one hour-directory read per process — the walk marks
-* it, so the second reader pays nothing — and it is what turns a lost tail
-* back into a recoverable one.
+* The end of the newest FINALIZED `low` segment, or null when none exists.
 *
-* A CLOSED hour already walked is skipped, which is what makes that exclusion
-* affordable: without it, every window touching the live hour would re-walk
-* all of its hours. The past is immutable, so re-reading a closed hour
-* directory can only ever return what the index already holds; eviction
-* removes rows through the index directly.
-*/
-async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations, logger, ledger) {
-	if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
-	const liveHour = Math.floor(Date.now() / HOUR_MS$4) * HOUR_MS$4;
-	if (ledger !== void 0) {
-		const startedMs = Date.now();
-		const hours = await ledger.detailForWindow(deviceId, fromMs, toMs);
-		let segments = 0;
-		let served = 0;
-		for (const hour of hours) {
-			if (hour.hourStartMs >= liveHour) continue;
-			index.hydrateHour(deviceId, hour.locationId, hour.hourStartMs, hour.paths);
-			segments += hour.paths.length;
-			served += 1;
-		}
-		if (served > 0) logger.info("recorder: hydrated a window from the hour ledger", {
-			tags: { deviceId },
-			meta: {
-				hours: served,
-				segments,
-				ms: Date.now() - startedMs
+* One scalar off the tail of the live sorted view — it used to COPY the
+* device's whole `low` archive to fold a maximum out of it, per render.
+*/
+function latestFinalizedEnd(renderDeps, deviceId) {
+	return renderDeps.deps.index.latestEnd(deviceId, "low");
+}
+/**
+* Run one ffmpeg and GUARANTEE the child is gone before the promise settles.
+*
+* The previous shape leaked on two paths: a `spawn` error (`ENOENT`, a bad
+* path) rejected while a process could still be alive, and a `close` with a
+* non-zero code rejected without ever reaping stdio. These renders fire on
+* every notification with a gif or clip, so a leak here is a slow accumulation
+* of ffmpeg processes on the recording node — the kind that shows up days later
+* as "the hub got slow" (operator, 2026-07-30).
+*
+* `settle` is idempotent and always kills first: killing an already-exited pid
+* throws ESRCH, which is swallowed, so the cost of being wrong is nothing while
+* the cost of NOT killing is a zombie per render.
+*/
+function runFfmpeg(renderDeps, args, ext) {
+	return new Promise((resolve, reject) => {
+		const proc = renderDeps.spawn(renderDeps.ffmpegPath ?? "ffmpeg", args);
+		let done = false;
+		let timer = null;
+		const settle = (err) => {
+			if (done) return;
+			done = true;
+			if (timer !== null) {
+				clearTimeout(timer);
+				timer = null;
 			}
+			if (proc.exitCode === null && proc.signalCode === null) try {
+				proc.kill("SIGKILL");
+			} catch {}
+			try {
+				proc.stderr?.removeAllListeners();
+				proc.stdout?.destroy();
+				proc.stderr?.destroy();
+			} catch {}
+			if (err === null) resolve();
+			else reject(err);
+		};
+		timer = setTimeout(() => settle(/* @__PURE__ */ new Error(`${ext} render timed out`)), RENDER_TIMEOUT_MS);
+		let stderrTail = "";
+		proc.stderr?.on("data", (c) => {
+			stderrTail = (stderrTail + c.toString()).slice(-400);
 		});
-		if (index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
-	}
-	for (const [root, aliases] of aliasesByRoot(locations)) {
-		const deviceDir = node_path.default.join(root, String(deviceId));
-		let profiles;
-		try {
-			profiles = (await node_fs.promises.readdir(deviceDir)).filter((e) => e === "high" || e === "mid" || e === "low");
-		} catch (err) {
-			if (err.code !== "ENOENT") logger.warn("recorder: hydrateWindow profile listing failed", {
-				tags: { deviceId },
-				meta: {
-					locationIds: aliases.map((location) => location.id),
-					error: require_dist.errMsg(err)
-				}
-			});
-			continue;
-		}
-		const first = Math.floor(fromMs / HOUR_MS$4) * HOUR_MS$4;
-		const reuseBefore = index.hydrateReuseStats();
-		let hoursRead = 0;
-		let repaired = 0;
-		for (let hour = first; hour < toMs; hour += HOUR_MS$4) {
-			if (hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$4) === "hydrated") continue;
-			for (const profile of profiles) {
-				const rel = hourDirRelPath(deviceId, profile, hour);
-				let files;
-				try {
-					files = await node_fs.promises.readdir(node_path.default.join(root, rel));
-				} catch {
-					continue;
-				}
-				hoursRead += 1;
-				const locationId = locationForHydratedProfile(aliases, profile).id;
-				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
-				index.hydrateHour(deviceId, locationId, hour, relPaths);
-				if (ledger !== void 0 && relPaths.length > 0 && hour + HOUR_MS$4 <= Date.now() && !ledger.knowsHour(deviceId, profile, locationId, hour)) {
-					repaired += 1;
-					await ledger.adoptRebuiltHour(deviceId, profile, locationId, hour, relPaths);
-				}
-			}
-		}
-		index.markHydrated(deviceId, fromMs, toMs);
-		if (hoursRead === 0) continue;
-		const reuseAfter = index.hydrateReuseStats();
-		const reused = reuseAfter.rowsReused - reuseBefore.rowsReused;
-		const allocated = reuseAfter.rowsAllocated - reuseBefore.rowsAllocated;
-		logger.info("recorder: hydrated a window from one recordings root", {
-			tags: { deviceId },
-			meta: {
-				root,
-				hoursRead,
-				repaired,
-				reused,
-				allocated
-			}
+		proc.on("error", (err) => settle(err instanceof Error ? err : new Error(String(err))));
+		proc.on("close", (code) => {
+			settle(code === 0 ? null : /* @__PURE__ */ new Error(`ffmpeg ${ext} render exited ${code}: ${stderrTail}`));
 		});
-	}
+	});
 }
 //#endregion
 //#region src/durable/durable-ledger.ts
@@ -10438,47 +10489,17 @@ Object.freeze({
 		},
 		"setDeviceConfig": { "config": { "__nested__": { "bands": [] } } }
 	},
-	"storage": { "upsertLocation": {
-		"isDefault": false,
-		"isSystem": false
-	} },
+	"storage": { "upsertLocation": { "isSystem": false } },
 	"storage-provider": {
-		"beginDownload": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"beginUpload": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"delete": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"exists": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"getAvailableSpace": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"list": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"read": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"resolve": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } },
-		"write": { "location": { "__nested__": {
-			"isDefault": false,
-			"isSystem": false
-		} } }
+		"beginDownload": { "location": { "__nested__": { "isSystem": false } } },
+		"beginUpload": { "location": { "__nested__": { "isSystem": false } } },
+		"delete": { "location": { "__nested__": { "isSystem": false } } },
+		"exists": { "location": { "__nested__": { "isSystem": false } } },
+		"getAvailableSpace": { "location": { "__nested__": { "isSystem": false } } },
+		"list": { "location": { "__nested__": { "isSystem": false } } },
+		"read": { "location": { "__nested__": { "isSystem": false } } },
+		"resolve": { "location": { "__nested__": { "isSystem": false } } },
+		"write": { "location": { "__nested__": { "isSystem": false } } }
 	},
 	"stream-broker": {
 		"produceEventMedia": {
@@ -10552,6 +10573,7 @@ Object.freeze({
 		"listTargetKinds",
 		"listTargets"
 	],
+	"storage-occupancy": ["getOccupancy"],
 	"storage-provider": ["list"],
 	"turn-provider": ["getTurnServers"],
 	"user-passkeys": ["listPasskeys"]
@@ -10665,13 +10687,12 @@ var LedgerWalkReconciler = class {
 		const apply = request.apply === true;
 		const location = this.deps.locations().find((candidate) => candidate.id === request.locationId);
 		if (location === void 0) return this.refusedReport(request.locationId, apply, "location-unknown");
-		if ((location.enabled ?? true) && !location.readOnly) {
+		if (locationMayBeWritten(location)) {
 			this.deps.logger.warn("recorder: ledger walk REFUSED — the source is still a write target, so a directory listing is a lower bound, not the truth", { meta: {
 				locationId: location.id,
 				root: location.root,
-				enabled: location.enabled ?? true,
-				readOnly: location.readOnly,
-				remedy: "set the location readOnly (or disable it) and re-run; a LIVE location is reconciled by the mover, under its bound (D318)"
+				mode: location.mode,
+				remedy: "switch the location to readonly / drain / disabled and re-run; a LIVE location is reconciled by the mover, under its bound (D318)"
 			} });
 			return this.refusedReport(location.id, apply, "source-writable");
 		}
@@ -11025,6 +11046,91 @@ async function readLocationCapacity(root, statfs) {
 		};
 	}
 }
+/**
+* Coalesces location-change doorbells into refreshes, and converges on its own
+* whether or not any doorbell ever arrives.
+*/
+var LocationRefresher = class {
+	deps;
+	timer = null;
+	running = false;
+	/** A doorbell rang while a refresh was in flight — run exactly one more. */
+	rearm = false;
+	/** When the last refresh STARTED. `null` ⇒ none since this object was made. */
+	lastStartedAt = null;
+	disposed = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	get now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+	get debounceMs() {
+		return this.deps.debounceMs ?? 2e3;
+	}
+	get backstopMs() {
+		return this.deps.backstopMs ?? 3e5;
+	}
+	/**
+	* The doorbell. Never awaits the refresh: this runs on the event bus, and a
+	* subscriber that blocks on I/O holds up every other consumer of the bus.
+	*/
+	ring(locationId, reason) {
+		if (this.disposed) return;
+		this.deps.logger.info("recorder: the storage location set changed — re-resolving where recordings may be written", { meta: {
+			locationId,
+			reason,
+			coalesceMs: this.debounceMs
+		} });
+		if (this.timer !== null) return;
+		this.timer = setTimeout(() => {
+			this.timer = null;
+			this.run("storage location change");
+		}, this.debounceMs);
+	}
+	/**
+	* The backstop, called from a pass that already runs on a timer. Refreshes
+	* only when nothing has refreshed for {@link LOCATION_BACKSTOP_MS} — a
+	* doorbell that already produced one resets the clock, so the two paths
+	* never both pay.
+	*/
+	async convergeIfDue() {
+		if (this.disposed) return;
+		const last = this.lastStartedAt;
+		if (last !== null && this.now - last < this.backstopMs) return;
+		await this.run("periodic convergence");
+	}
+	/** Stop the pending doorbell. Nothing in flight is cancelled — it is idempotent. */
+	dispose() {
+		this.disposed = true;
+		if (this.timer !== null) {
+			clearTimeout(this.timer);
+			this.timer = null;
+		}
+	}
+	async run(trigger) {
+		if (this.running) {
+			this.rearm = true;
+			return;
+		}
+		this.running = true;
+		this.lastStartedAt = this.now;
+		try {
+			await this.deps.refresh();
+		} catch (err) {
+			this.deps.logger.warn("recorder: could not re-resolve storage locations — the previously resolved set stands", { meta: {
+				trigger,
+				error: require_dist.errMsg(err)
+			} });
+		} finally {
+			this.running = false;
+		}
+		if (this.rearm && !this.disposed) {
+			this.rearm = false;
+			await this.run("change during refresh");
+		}
+	}
+};
 //#endregion
 //#region src/recorder/addon/ops-log-store.ts
 /**
@@ -11084,7 +11190,7 @@ var RECORDING_OPS_LOG_SPEC = {
 };
 /** Build the handle. `declare()` MUST run once at boot before any read/write. */
 function recordingOpsLogState(store, logger) {
-	return new require_prebuffer.RowMapStore({
+	return new require_retire_root_keys.RowMapStore({
 		spec: RECORDING_OPS_LOG_SPEC,
 		store,
 		logger
@@ -11179,6 +11285,72 @@ function createRecordingOpsLogSink(deps) {
 	};
 }
 //#endregion
+//#region src/recorder/addon/pending-writer-moves.ts
+/**
+* The gap between the PLAN and the DISK, for as long as it stands.
+*
+* Placement applies at writer-attach boundaries only: the `.rec-tmp` staging
+* dir lives UNDER the chosen root so the finalize relocate is a
+* same-filesystem rename, and repointing a live writer would turn every
+* segment into the EXDEV copy+unlink fallback — 2× disk writes on the hot path
+* (the F1 regression). So a plan reaches a camera when it next attaches.
+*
+* For a camera on a schedule that is the next band edge, minutes away. For a
+* CONTINUOUSLY recording camera there is no next attach: its writer outlives
+* every tick, and its assignment can be re-planned onto a new disk forever
+* without one byte moving. That is the state this module makes visible (D387).
+* The alternative — detaching live writers to apply a plan — buys the move at
+* the cost of a recording gap on every affected camera at once, which is
+* exactly the wrong trade on the day an operator adds a disk to relieve
+* pressure.
+*/
+/** Is `dir` inside `root` (or the root itself)? A prefix compare that cannot
+*  match `/recordings-2` against `/recordings`. */
+function isUnder(dir, root) {
+	const rel = node_path.default.relative(root, dir);
+	return rel === "" || !rel.startsWith("..") && !node_path.default.isAbsolute(rel);
+}
+/** The location whose root contains `dir` — the DEEPEST one, so a location
+*  nested inside another is attributed to the nested one. */
+function locationOf(dir, locations) {
+	let best = null;
+	for (const location of locations) {
+		if (!isUnder(dir, location.root)) continue;
+		if (best === null || location.root.length > best.root.length) best = location;
+	}
+	return best?.id ?? null;
+}
+/**
+* Every live writer the plan wants somewhere else.
+*
+* A writer whose key the plan says nothing about is NOT pending: the pass
+* plans a work SUBSET, and "not in this pass" must never read as "planned
+* elsewhere". A writer under no known root is reported with `writingTo: null`
+* rather than dropped — a directory outside every resolved location is its own
+* fault, and a silent skip would hide it.
+*/
+function pendingWriterMoves(writers, planned, locations) {
+	const out = [];
+	for (const writer of writers) {
+		const plannedFor = planned.get(`${String(writer.deviceId)}:${writer.profile}`);
+		if (plannedFor === void 0) continue;
+		const writingTo = locationOf(writer.outDir, locations);
+		if (writingTo === plannedFor) continue;
+		out.push({
+			deviceId: writer.deviceId,
+			profile: writer.profile,
+			writingTo,
+			plannedFor
+		});
+	}
+	return out.toSorted((a, b) => a.deviceId - b.deviceId || a.profile.localeCompare(b.profile));
+}
+/** A stable signature of a pending set, so the report is latched on WHAT is
+*  pending rather than repeated every 30 s tick. */
+function pendingMovesSignature(moves) {
+	return moves.map((m) => `${String(m.deviceId)}:${m.profile}>${m.plannedFor}`).join(",");
+}
+//#endregion
 //#region src/recorder/addon/periodic-pass.ts
 function startPeriodicPass(deps) {
 	const now = () => deps.now?.() ?? Date.now();
@@ -11301,6 +11473,30 @@ function poolFor(demand, candidates) {
 function poolKey(pool) {
 	return pool.map((c) => c.locationId).toSorted().join("|");
 }
+/**
+* What one demand with NO measured rate weighs: the median of the rates that
+* WERE measured, and one unit when nothing in the pool was measured at all.
+*
+* Never zero, and that is the whole point (D387). `dailyBytes` is 0 for every
+* camera the recorder's RAM index has not accounted for — after D287 that is
+* most of a fleet at any moment — and a zero-byte demand is invisible to every
+* balance calculation here. Phase C reaches for the SMALLEST demand on an
+* overloaded location, which is one of those; moving 0 bytes moves neither side
+* towards its target, so the strict-improvement check fails and the rebalance
+* `break`s on its first iteration. A single measured camera in the pool was
+* enough to make every unmeasured one weightless and wedge the whole pass — on
+* a live hub that left 19 assignments pinned to an 89%-full disk with an empty
+* 4 TB one next to it, silently, on every 30 s tick.
+*
+* The median (rather than the mean) so one 24/7 4K camera does not decide what
+* an unknown camera is assumed to cost.
+*/
+function weightOfUnmeasured(demands) {
+	const measured = demands.map((d) => d.dailyBytes).filter((bytes) => bytes > 0).toSorted((a, b) => a - b);
+	if (measured.length === 0) return 1;
+	const mid = Math.floor(measured.length / 2);
+	return measured.length % 2 === 1 ? measured[mid] : (measured[mid - 1] + measured[mid]) / 2;
+}
 /** Normalised weight per location: headroom share, or an even split when no
 *  location reports any headroom (nothing is known yet — never divide by 0). */
 function weightsFor(pool) {
@@ -11350,8 +11546,8 @@ function planPlacement(input) {
 		});
 	}
 	for (const { pool, demands } of pools.values()) {
-		const anyRate = demands.some((d) => d.dailyBytes > 0);
-		const bytesOf = (d) => anyRate ? d.dailyBytes : 1;
+		const unmeasured = weightOfUnmeasured(demands);
+		const bytesOf = (d) => d.dailyBytes > 0 ? d.dailyBytes : unmeasured;
 		const totalBytes = demands.reduce((sum, d) => sum + bytesOf(d), 0);
 		const weights = weightsFor(pool);
 		const slots = pool.map((c) => ({
@@ -11496,19 +11692,16 @@ var RecordingPlacementBlobSchema = require_dist.object({
 	/** locationId → the volume id last verified at that location's root. */
 	volumeIds: require_dist.record(require_dist.string(), require_dist.string()).default({}),
 	/**
-	* Recordings class (`recordings` / `recordingsLow`) → the location
-	* `resolvePlacement` chose for it when these assignments were last planned.
-	*
-	* ABSENT means "nobody has recorded an authority yet", and that is never read
-	* as a repoint: shipping this field must not invalidate assignments that were
-	* made under an authority nothing wrote down. The first pass stamps it and
-	* invalidates nothing; every later change of it is a repoint.
+	* DEAD KEY (D383) — the class authority a pass planned against, back when a
+	* class had a default distinct from its pool. Declared so an existing blob
+	* round-trips unchanged and so its removal is a decision on the record rather
+	* than a silent strip. Never read, never written.
 	*/
 	defaultLocations: require_dist.record(require_dist.string(), require_dist.string()).default({}),
 	/** When the blob was last written (operator-facing debugging only). */
 	updatedAt: require_dist.number().optional()
 });
-/** Cold-start value: nothing assigned, nothing claimed, no authority recorded. */
+/** Cold-start value: nothing assigned, nothing claimed. */
 var EMPTY_PLACEMENT = {
 	assignments: {},
 	pins: {},
@@ -11557,31 +11750,27 @@ async function replaceAssignments(state, base, assignments) {
 	});
 }
 /**
-* The assignment record a pass leaves behind: the stored one, with the repoint
-* applied, then the plan merged over it. **Nothing is ever removed** — a pass
-* that plans a subset cannot delete a key it did not mention.
+* The assignment record a pass leaves behind: the stored one with the plan
+* merged over it. **Nothing is ever removed** — a pass that plans a subset
+* cannot delete a key it did not mention.
 *
-* PURE, and shared by the write and the divergence report — a report computed
+* PURE, and shared by the write and the placement census — a report computed
 * from a second reading of the same rule is a report that can describe a record
 * the write did not produce.
 */
 function applyPlacementPass(base, pass) {
 	const next = new Map(Object.entries(base));
-	for (const [key, locationId] of pass.repointed) next.set(key, locationId);
 	for (const [key, locationId] of pass.planned) next.set(key, locationId);
 	return next;
 }
-/** Persist one work-scoped pass: apply the repoint, merge its plan, and stamp
-*  the authority the plan was resolved against. One write. */
+/** Persist one work-scoped pass: merge its plan over the stored record. One
+*  write. */
 async function writePlacementPass(state, base, pass) {
 	const assignments = {};
 	for (const [key, locationId] of applyPlacementPass(base.assignments, pass)) assignments[key] = locationId;
-	const defaultLocations = {};
-	for (const [type, locationId] of pass.defaultLocations) defaultLocations[type] = locationId;
 	await state.set({
 		...base,
 		assignments,
-		defaultLocations,
 		updatedAt: Date.now()
 	});
 }
@@ -11830,14 +12019,6 @@ var NO_PLAN = {
 	assignments: /* @__PURE__ */ new Map(),
 	changes: []
 };
-/** Is the authority already stamped, exactly? A pass that would change the
-*  stamp always writes, even when it moved nothing: an unstamped authority is
-*  an undetectable repoint. */
-function sameStamp(stamped, authority) {
-	if (stamped.size !== authority.size) return false;
-	for (const [type, locationId] of authority) if (stamped.get(type) !== locationId) return false;
-	return true;
-}
 /** Operator pins win over the planner for high/mid of the pinned camera. */
 function overlayPins(planned, pins) {
 	const next = new Map(planned);
@@ -11865,14 +12046,11 @@ var PlacementService = class {
 	/** The fair tie-break the PURE planner defers to (D37). Advisory state, and
 	*  consulted only for a tie the capacity signal cannot separate. */
 	rotation = new PlacementRotation();
-	/** The divergent set last announced, as a stable signature. `null` ⇒ nothing
-	*  announced yet, which is why an all-aligned fleet says nothing at boot. */
-	divergenceSignature = null;
-	/** When the standing divergence was last announced. */
-	divergenceReportedAt = null;
-	/** Repoint episodes already announced (`type:from->to`). Cleared the moment a
-	*  pass sees no repoint at all — the next one is a NEW episode. */
-	repointAnnounced = /* @__PURE__ */ new Set();
+	/** The census last announced, as a stable signature. `null` ⇒ nothing
+	*  announced yet. */
+	censusSignature = null;
+	/** When the census was last announced. */
+	censusReportedAt = null;
 	constructor(deps) {
 		this.deps = deps;
 	}
@@ -11907,15 +12085,14 @@ var PlacementService = class {
 	async place(deviceId, profile) {
 		const pool = this.pool();
 		this.reprobeAfterBackoff(pool);
-		const authority = authorityLocations(pool);
-		const resolved = await this.assignedLocation(deviceId, profile, pool, authority) ?? resolvePlacement(pool, profile);
+		const resolved = await this.assignedLocation(deviceId, profile, pool) ?? resolvePlacement(await this.withHeadroom(pool), profile);
 		const usable = await this.ensureUsable(resolved, pool, profile, deviceId);
 		if (this.everyLocationUnusable(pool)) {
 			this.reportEveryLocationUnusable(deviceId, profile, resolved, pool);
 			return resolved;
 		}
 		this.allUnusableReported.delete(deviceId);
-		await this.recordDecision(deviceId, profile, usable, resolved.id === usable.id, authority.get(placementTypeForProfile(profile)) ?? null);
+		await this.recordDecision(deviceId, profile, usable, resolved.id === usable.id);
 		return usable;
 	}
 	/**
@@ -11999,35 +12176,30 @@ var PlacementService = class {
 	* to it, so an unknown flag is the only thing that counts as opted in.
 	*/
 	pool() {
-		const { locations, fellBackToDefault } = placementPool(this.deps.locations());
-		if (fellBackToDefault) this.deps.logger.warn("recorder placement: NO recordings location is enabled for writing — falling back to the type default. Enable a location in Storage, or recordings will keep landing on the default.", { meta: { locationIds: locations.map((l) => l.id) } });
+		const { locations, fellBackToDisabled } = placementPool(this.deps.locations());
+		if (fellBackToDisabled) this.deps.logger.warn("recorder placement: NO recordings location is enabled for writing — writing to a DISABLED location under protest. Enable one in Storage.", { meta: { locationIds: locations.map((l) => l.id) } });
 		return locations;
 	}
 	/**
 	* The stored assignment for one (camera, profile), when it is still valid.
 	*
-	* Three things invalidate it, and the third is the one this used to miss:
+	* Two things invalidate it, and under the operator's model (D383) there is
+	* nothing else that can:
 	*
-	*   1. the location is absent from the current pool (deleted, opted out);
-	*   2. the location is read-only (an operator drain);
-	*   3. **the class was REPOINTED under it** — the authority stamped in the
-	*      blob is not the authority now, and the assignment names neither.
+	*   1. the location is absent from the current POOL — deleted, or the
+	*      operator disabled it. The pool is the single write authority, so an
+	*      assignment naming a location outside it is not a divergence to report,
+	*      it is unrepresentable;
+	*   2. the location is read-only (an operator drain).
 	*
-	* (1) and (2) both mean "this location is not a write target any more", so
-	* they only ever caught a repoint that took the old location out of service.
-	* A repoint of a class the operator is MIGRATING does the opposite: the
-	* source must stay enabled and writable, because it holds the history. So the
-	* assignment survived every attach, indefinitely, and `resolvePlacement`
-	* returning the new default changed nothing — it is the fallback, not the
-	* authority. On 2026-08-29 that left two of thirteen cameras writing to the
-	* disk the fleet was migrating off, silently (D298).
-	*
-	* The invalidation is a TRANSITION, not a policy: it fires only while the
-	* stamped authority disagrees with the live one, which the next placement pass
-	* ends by stamping. After that the plan is the authority again and a
-	* deliberate spread is honoured — and reported (`reportDivergence`).
+	* There used to be a third — "the class was REPOINTED under it", measured
+	* against the class default stamped in the blob (D301). It existed only
+	* because the default was a SECOND write authority layered over the pool and
+	* the two could disagree. With the default deleted the disagreement cannot be
+	* expressed: a location leaving the pool already invalidates every assignment
+	* naming it, and the planner then moves those keys with `reason: 'gone'`.
 	*/
-	async assignedLocation(deviceId, profile, pool, authority) {
+	async assignedLocation(deviceId, profile, pool) {
 		let blob;
 		try {
 			blob = await readPlacementState(this.deps.state);
@@ -12049,23 +12221,28 @@ var PlacementService = class {
 		}
 		if (assignedId === void 0) return null;
 		const location = pool.find((l) => l.id === assignedId && !l.readOnly) ?? null;
-		if (location === null) return null;
-		const type = placementTypeForProfile(profile);
-		const target = authority.get(type);
-		const stamped = blob.defaultLocations[type];
-		if (target === void 0 || stamped === void 0) return location;
-		if (stamped === target || location.id === target) return location;
-		this.deps.logger.warn("recorder placement: stored assignment INVALIDATED — this recordings class was repointed and the assignment still names the location it was repointed away from", {
+		if (location === null) this.deps.logger.info("recorder placement: stored assignment INVALIDATED — its location is not a write target any more (disabled, read-only, or gone). Resolving fresh from the pool.", {
 			tags: { deviceId },
 			meta: {
 				profile,
-				assignedLocationId: location.id,
-				repointedFrom: stamped,
-				repointedTo: target,
-				locationType: type
+				assignedLocationId: assignedId,
+				poolLocationIds: pool.filter((l) => !l.readOnly).map((l) => l.id)
 			}
 		});
-		return null;
+		return location;
+	}
+	/** The pool, with each member's measured headroom attached. One capacity read
+	*  per location; used only on the bootstrap path, never per segment. */
+	async withHeadroom(pool) {
+		const candidates = await this.candidatesFor(pool);
+		const byId = new Map(candidates.map((c) => [c.locationId, c.headroomBytes]));
+		return pool.map((location) => {
+			const headroomBytes = byId.get(location.id);
+			return headroomBytes === void 0 ? location : {
+				...location,
+				headroomBytes
+			};
+		});
 	}
 	/**
 	* Re-plan the (camera, profile) pairs in `work` over the current locations.
@@ -12087,7 +12264,6 @@ var PlacementService = class {
 	*/
 	async recompute(work) {
 		const pool = this.pool();
-		const authority = authorityLocations(pool);
 		const candidates = await this.candidatesFor(pool);
 		const demands = work.map((item) => ({
 			key: assignmentKey(item.deviceId, item.profile),
@@ -12104,17 +12280,7 @@ var PlacementService = class {
 			} });
 			return NO_PLAN;
 		}
-		const stamped = new Map(Object.entries(blob.defaultLocations));
-		const repoints = this.detectRepoints(blob.assignments, stamped, authority, blob.pins);
-		if (repoints.length === 0) this.repointAnnounced.clear();
-		for (const repoint of repoints) this.announceRepoint(repoint);
-		const repointed = /* @__PURE__ */ new Map();
-		for (const repoint of repoints) for (const key of repoint.keys) repointed.set(key, repoint.to);
-		const current = applyPlacementPass(blob.assignments, {
-			repointed,
-			planned: /* @__PURE__ */ new Map(),
-			defaultLocations: authority
-		});
+		const current = new Map(Object.entries(blob.assignments));
 		const evacuate = new Set(candidates.filter((c) => c.headroomBytes <= 0).map((c) => c.locationId));
 		for (const location of pool) if (location.readOnly) evacuate.add(location.id);
 		const plan = planPlacement({
@@ -12124,13 +12290,9 @@ var PlacementService = class {
 			evacuate,
 			breakTie: (tied) => this.rotation.next(tied)
 		});
-		const pass = {
-			repointed,
-			planned: overlayPins(plan.assignments, blob.pins),
-			defaultLocations: authority
-		};
-		this.reportDivergence(applyPlacementPass(blob.assignments, pass), authority);
-		if (plan.changes.length === 0 && repointed.size === 0 && sameStamp(stamped, authority)) return plan;
+		const pass = { planned: overlayPins(plan.assignments, blob.pins) };
+		this.reportCensus(applyPlacementPass(blob.assignments, pass), pool);
+		if (plan.changes.length === 0) return plan;
 		for (const change of plan.changes) {
 			const deviceId = Number(change.key.split(":")[0]);
 			this.deps.logger.info("recorder placement: plan moves a profile to another location", {
@@ -12154,129 +12316,60 @@ var PlacementService = class {
 		return plan;
 	}
 	/**
-	* Which recordings classes were REPOINTED under the stored plan, and which of
-	* its keys that invalidates.
-	*
-	* PURE. A class is repointed when the blob stamped an authority for it and
-	* the authority now is a different location. A class with NO stamp is not a
-	* repoint — it is the first pass after this shipped, and inferring a repoint
-	* from an absent stamp would throw away every deliberate assignment on the
-	* first tick after a deploy.
-	*/
-	detectRepoints(stored, stamped, authority, pins) {
-		const out = [];
-		for (const [type, to] of authority) {
-			const from = stamped.get(type);
-			if (from === void 0 || from === to) continue;
-			const keys = [];
-			for (const [key, locationId] of Object.entries(stored)) {
-				const [devicePart, profilePart] = key.split(":");
-				if (placementTypeForProfile(profilePart ?? "") !== type) continue;
-				if (locationId === to) continue;
-				if (type === "recordings" && devicePart !== void 0 && pins[devicePart] !== void 0) continue;
-				keys.push(key);
-			}
-			out.push({
-				type,
-				from,
-				to,
-				keys
-			});
-		}
-		return out;
-	}
-	/**
-	* One line PER CAMERA (a repoint is asked per-camera: "did 3839 move?"), plus
-	* one audit row per class. A repoint is a rare operator event, so the volume
-	* is one burst of fleet-size, not a stream.
-	*
-	* Announced ONCE per episode: the detection is a comparison against the
-	* stamp, so a write that fails leaves the stamp behind and the next tick sees
-	* the same repoint again. Without the latch, a settings door that accepts
-	* reads and refuses writes would repeat the whole burst every 30 s.
-	*/
-	announceRepoint(repoint) {
-		const episode = `${repoint.type}:${repoint.from}->${repoint.to}`;
-		if (this.repointAnnounced.has(episode)) return;
-		this.repointAnnounced.add(episode);
-		for (const key of repoint.keys) {
-			const deviceId = Number(key.split(":")[0]);
-			this.deps.logger.warn("recorder placement: recordings class REPOINTED — moving this assignment onto the class`s new authority location", {
-				...Number.isFinite(deviceId) ? { tags: { deviceId } } : {},
-				meta: {
-					key,
-					locationType: repoint.type,
-					repointedFrom: repoint.from,
-					repointedTo: repoint.to
-				}
-			});
-		}
-		this.deps.opsLog.append({
-			op: "relocate",
-			reason: "operator",
-			deviceId: null,
-			itemsAffected: repoint.keys.length,
-			bytesReclaimed: 0,
-			actor: "system",
-			detail: `placement: ${repoint.type} repointed ${repoint.from} → ${repoint.to}; ${repoint.keys.length.toString()} assignment(s) moved (${repoint.keys.join(", ")})`
-		});
-	}
-	/**
-	* Say which (camera, profile) the plan writes somewhere other than its class
-	* authority — per camera, WITH its denominator (D277).
+	* WHERE THE FLEET WRITES — one line per (class, location), always with its
+	* denominator (D277).
 	*
-	* This is not an error path. The planner spreads a class across its pool on
-	* purpose, and a location with headroom is a legitimate target. What was
-	* wrong is that a deliberate spread and a leftover from a repoint nobody
-	* noticed produced the *same* absence of output: `recordDecision` audits only
-	* a CHANGE, so a camera that keeps using its old assignment writes no row and
-	* no line, forever. An operator read "migration done" while two cameras were
-	* still filling the disk they were migrating off.
+	* This replaced the class-authority divergence report (D301) when the default
+	* was deleted: with every enabled location of a class a legitimate target,
+	* "this camera does not write to THE location" is not a fact any more, while
+	* "recordings: 9 of 13 on recordings:default, 4 on recordings:hgst" is
+	* exactly the question an operator asks after enabling a second disk. A pool
+	* member holding ZERO assignments is listed too — an enabled disk nothing
+	* lands on is the failure this whole model exists to make visible.
 	*
-	* Fires on a CHANGE of the divergent set, and otherwise at most once per
-	* {@link PLACEMENT_DIVERGENCE_REPORT_MS}. An all-aligned fleet says nothing —
-	* until it stops being all-aligned, and again when it recovers.
+	* Fires on a CHANGE of the distribution, and otherwise at most once per
+	* {@link PLACEMENT_CENSUS_REPORT_MS}.
 	*/
-	reportDivergence(assignments, authority) {
-		const divergent = [];
+	reportCensus(assignments, pool) {
+		const counts = /* @__PURE__ */ new Map();
+		const perClass = /* @__PURE__ */ new Map();
+		for (const location of pool) if (!location.readOnly) counts.set(location.id, 0);
 		for (const [key, locationId] of assignments) {
-			const profile = key.split(":")[1] ?? "";
-			const authorityLocationId = authority.get(placementTypeForProfile(profile));
-			if (authorityLocationId === void 0 || authorityLocationId === locationId) continue;
-			divergent.push({
-				key,
-				deviceId: Number(key.split(":")[0]),
-				profile,
-				locationId,
-				authorityLocationId
-			});
+			counts.set(locationId, (counts.get(locationId) ?? 0) + 1);
+			const type = placementTypeForProfile(key.split(":")[1] ?? "");
+			perClass.set(type, (perClass.get(type) ?? 0) + 1);
 		}
-		const signature = divergent.map((d) => `${d.key}=${d.locationId}`).toSorted().join(",");
-		const previous = this.divergenceSignature;
+		const typeOf = new Map(pool.map((location) => [location.id, location.type]));
+		const lines = [...counts.entries()].toSorted(([a], [b]) => a.localeCompare(b)).map(([locationId, count]) => {
+			const type = typeOf.get(locationId) ?? locationId.split(":")[0] ?? locationId;
+			return {
+				locationId,
+				type,
+				assignments: count,
+				ofClass: perClass.get(type) ?? 0
+			};
+		});
+		const signature = lines.map((line) => `${line.locationId}=${String(line.assignments)}`).join(",");
 		const now = this.now;
-		const due = this.divergenceReportedAt === null || now - this.divergenceReportedAt >= 36e5;
-		if (signature === previous && !due) return;
-		this.divergenceSignature = signature;
-		this.divergenceReportedAt = now;
-		if (divergent.length === 0) {
-			if (previous !== null && previous !== "") this.deps.logger.info("recorder placement: every assignment now writes to its class authority location", { meta: { assignments: assignments.size } });
-			return;
+		const due = this.censusReportedAt === null || now - this.censusReportedAt >= 36e5;
+		if (signature === this.censusSignature && !due) return;
+		this.censusSignature = signature;
+		this.censusReportedAt = now;
+		if (lines.length === 0) return;
+		this.deps.logger.info("recorder placement: census — which locations the fleet writes to", { meta: { locations: lines.map((line) => ({
+			locationId: line.locationId,
+			type: line.type,
+			assignments: line.assignments,
+			ofClass: line.ofClass
+		})) } });
+		for (const line of lines) {
+			if (line.assignments > 0) continue;
+			this.deps.logger.warn("recorder placement: this location is ENABLED but holds no assignment — nothing writes to it", { meta: {
+				locationId: line.locationId,
+				type: line.type,
+				ofClass: line.ofClass
+			} });
 		}
-		this.deps.logger.warn("recorder placement: assignments write somewhere other than their class authority location", { meta: {
-			divergent: divergent.length,
-			assignments: assignments.size,
-			authority: Object.fromEntries(authority)
-		} });
-		for (const entry of divergent) this.deps.logger.warn("recorder placement: this profile does NOT write to its class authority location", {
-			...Number.isFinite(entry.deviceId) ? { tags: { deviceId: entry.deviceId } } : {},
-			meta: {
-				profile: entry.profile,
-				locationId: entry.locationId,
-				authorityLocationId: entry.authorityLocationId,
-				divergent: divergent.length,
-				assignments: assignments.size
-			}
-		});
 	}
 	/** Bound one addon-store round trip. See {@link PLACEMENT_STORE_TIMEOUT_MS}. */
 	bounded(promise, label) {
@@ -12366,7 +12459,7 @@ var PlacementService = class {
 			}
 			if (location.maxUsedGb !== void 0) {
 				const used = await this.deps.usedOnLocation?.(location.id) ?? 0;
-				limits.push(location.maxUsedGb * 1e9 - used);
+				limits.push(require_dist.gbToBytes(location.maxUsedGb) - used);
 			}
 			out.push({
 				locationId: location.id,
@@ -12457,13 +12550,13 @@ var PlacementService = class {
 	* Persist the assignment and audit it — but only when it actually changed.
 	* The steady state (every attach after the first) writes nothing.
 	*
-	* The per-attach line carries `authorityLocationId` and `divergent` so a
-	* single camera's line answers "is 3839 writing where the class default
-	* says?" on its own. Without it, a camera pinned to a location the class was
-	* repointed away from logged `reason: 'resolved'` — byte-identical to a
-	* camera correctly on the current default.
+	* The per-attach line carries the camera's location and the one it replaced,
+	* tagged with `deviceId`, so "where does 3839 write, and did it move?" is
+	* answerable per camera. Which locations the FLEET is spread over is the
+	* census's job (D383) — there is no class authority for a single line to be
+	* measured against any more.
 	*/
-	async recordDecision(deviceId, profile, location, verbatim, authorityLocationId) {
+	async recordDecision(deviceId, profile, location, verbatim) {
 		const key = assignmentKey(deviceId, profile);
 		let previous;
 		try {
@@ -12484,8 +12577,6 @@ var PlacementService = class {
 				locationId: location.id,
 				root: location.root,
 				previousLocationId: previous ?? null,
-				authorityLocationId,
-				divergent: authorityLocationId !== null && authorityLocationId !== location.id,
 				reason: verbatim ? "resolved" : "failover"
 			}
 		});
@@ -12613,7 +12704,7 @@ function effectiveBands(config) {
 */
 function resolveBandBufferMs(band) {
 	return {
-		preMs: require_prebuffer.PREBUFFER_MAX_MS,
+		preMs: require_restream_intent.PREBUFFER_MAX_MS,
 		postMs: (band.postBufferSec ?? require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec) * 1e3
 	};
 }
@@ -14456,6 +14547,26 @@ var RecordingController = class {
 		this.wakeups.arm(deviceId, next.atMs, next.reason);
 	}
 	/**
+	* Where every LIVE writer is writing right now — the directory ffmpeg was
+	* spawned against, per (device, profile).
+	*
+	* The plan and the disk disagree for as long as a writer outlives the tick
+	* that re-planned it: placement applies at ATTACH BOUNDARIES only (the
+	* `.rec-tmp` staging dir lives under the chosen root so the finalize
+	* relocate is a same-filesystem rename), so a continuously-recording camera
+	* keeps its root until something detaches it. That is a legitimate state and
+	* a silent one, which is why it is READABLE from here (D387).
+	*/
+	activeWriterDirs() {
+		const out = [];
+		for (const [deviceId, recordings] of this.active) for (const r of recordings) out.push({
+			deviceId,
+			profile: r.profile,
+			outDir: r.outDir
+		});
+		return out;
+	}
+	/**
 	* Boot restore: seed the readiness-gated queue with every persisted device and
 	* (re)evaluate each on every `stream-broker` ready transition. Also arms the
 	* periodic passes. Idempotent — safe to call once after the index is hydrated.
@@ -15383,7 +15494,7 @@ var RecordingController = class {
 			tag: `recorder:${deviceId}/${profile}`
 		}, require_dist.nodePin(this.deps.ownerNodeId)), ATTACH_RPC_TIMEOUT_MS, "getStreamWithCodec"));
 		const streamAcquiredMs = this.now();
-		const rtspUrl = require_restream_intent.withRecordingIntent(source.url);
+		const rtspUrl = require_restream_intent.withRecordingIntent(source.url, require_restream_intent.RECORDING_PRE_ROLL_REQUEST_MS);
 		this.attachSeq++;
 		const consumerTag = `recorder/${deviceId}/${profile}/${this.attachSeq}`;
 		if (rtspUrl === source.url) this.deps.logger.info("recorder: dial carries no recording intent — no pre-roll", {
@@ -16841,6 +16952,21 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*  per episode, not one per 30 s tick. `null` ⇒ the last pass had work. */
 	placementWorkGap = null;
 	/**
+	* When the recorder re-resolves its storage locations (D387): coalesced off
+	* the `StorageLocationsChanged` doorbell, and converged on the placement
+	* pass's own timer whether or not that doorbell ever arrives. Built on the
+	* recording node only, with the rest of the write path.
+	*/
+	locationRefresher = null;
+	/** Unsubscribe handle for the `StorageLocationsChanged` subscription. */
+	locationChangeUnsub = null;
+	/**
+	* How many live writers are recording somewhere other than their planned
+	* location, latched so the line is one per episode rather than one per 30 s
+	* tick. `null` ⇒ nothing pending (or nothing measured yet).
+	*/
+	pendingWriterMoves = null;
+	/**
 	* The calendar rungs — which days, which hours, and a day's exact ranges.
 	*
 	* Hours the RAM index has already walked (or the live hour it is
@@ -17065,8 +17191,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			},
 			archiveHourPaths: async (deviceId, profile, locationId, hourStartMs) => await this.segmentHours?.hourPaths(deviceId, profile, locationId, hourStartMs) ?? null,
 			removeDir: async (locationId, relDir) => {
-				const loc = this.resolvedLocations.find((l) => l.id === locationId);
-				if (!loc) throw new Error(`recorder: unknown recordings location ${locationId}`);
+				const loc = requireReadableLocation(this.resolvedLocations, locationId, "recorder");
 				await node_fs.promises.rm(node_path.default.join(loc.root, relDir), {
 					recursive: true,
 					force: true
@@ -17104,8 +17229,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				});
 			},
 			removeDirIfEmpty: async (locationId, relDir) => {
-				const loc = this.resolvedLocations.find((l) => l.id === locationId);
-				if (!loc) throw new Error(`recorder: unknown recordings location ${locationId}`);
+				const loc = requireReadableLocation(this.resolvedLocations, locationId, "recorder");
 				await node_fs.promises.rmdir(node_path.default.join(loc.root, relDir));
 			},
 			logger: {
@@ -17318,7 +17442,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			logger: this.ctx.logger,
 			store: this.segmentStore,
 			resolveDomain: (locationId) => this.locationDomain(locationId),
-			isReadOnly: (locationId) => this.resolvedLocations.find((l) => l.id === locationId)?.readOnly === true,
+			isEvictionFrozen: (locationId) => {
+				const location = this.resolvedLocations.find((l) => l.id === locationId);
+				return location !== void 0 && require_dist.evictionPolicyForMode(location.mode) === "never";
+			},
 			deviceRegistry: async () => {
 				try {
 					const devices = await this.ctx.api.deviceManager.listAll.query({ projection: "slim" });
@@ -17498,6 +17625,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				capability: require_dist.storageEvictableCapability,
 				provider: evictableProvider
 			},
+			{
+				capability: require_dist.storageOccupancyCapability,
+				provider: evictableProvider
+			},
 			{
 				capability: require_dist.recordingExportCapability,
 				provider: exportProvider
@@ -17548,6 +17679,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.sensorTriggerUnsub = null;
 		this.signalTriggerUnsub?.();
 		this.signalTriggerUnsub = null;
+		this.locationChangeUnsub?.();
+		this.locationChangeUnsub = null;
+		this.locationRefresher?.dispose();
+		this.locationRefresher = null;
 		await this.controller?.stop();
 		this.controller = null;
 		this.segmentStore = null;
@@ -17663,6 +17798,13 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			this.ctx.logger.warn("recorder: controller start failed", { meta: { error: require_dist.errMsg(err) } });
 		}
 		this.recoverStagedOrphans(stagingBootMs);
+		if (this.locationRefresher === null) this.locationRefresher = new LocationRefresher({
+			logger: this.ctx.logger,
+			refresh: () => this.refreshLocations()
+		});
+		if (this.locationChangeUnsub === null) this.locationChangeUnsub = this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.StorageLocationsChanged }, (event) => {
+			this.locationRefresher?.ring(event.data.locationId, event.data.reason);
+		});
 		if (this.eventUnsub === null) this.eventUnsub = subscribeEventCapture({
 			eventBus: this.ctx.eventBus,
 			onMotion: (deviceId, atMs) => {
@@ -18069,6 +18211,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*/
 	async recomputePlacement(deviceIds) {
 		if (!this.placement) return;
+		await (this.locationRefresher?.convergeIfDue() ?? Promise.resolve());
 		const archive = this.segmentHours;
 		if (!archive) {
 			this.reportPlacementWorkGap("no segment-hour ledger on this node", deviceIds.length, 0);
@@ -18085,7 +18228,48 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			return;
 		}
 		this.placementWorkGap = null;
-		await this.placement.recompute(work);
+		const plan = await this.placement.recompute(work);
+		this.reportPendingWriterMoves(plan.assignments);
+	}
+	/**
+	* Cameras whose plan says one disk and whose live writer says another —
+	* REPORTED, per camera, for as long as it stands (D387).
+	*
+	* Placement applies at attach boundaries only, so a re-planned camera moves
+	* when it next attaches. A camera on a schedule attaches again within
+	* minutes; a CONTINUOUSLY recording one never does, and its plan can sit
+	* unapplied forever. Repointing a live writer is not the fix — the
+	* `.rec-tmp` staging dir lives under the chosen root precisely so the
+	* finalize relocate is a same-filesystem rename — and detaching the fleet to
+	* apply a plan costs a recording gap on every affected camera at once, on
+	* the very day the operator added a disk to relieve pressure. So the honest
+	* behaviour is to say it, name the cameras, and let the operator decide.
+	*
+	* Latched on WHAT is pending: a line per 30 s tick would be its own defect.
+	*/
+	reportPendingWriterMoves(planned) {
+		const controller = this.controller;
+		if (!controller) return;
+		const moves = pendingWriterMoves(controller.activeWriterDirs(), planned, this.resolvedLocations);
+		const signature = pendingMovesSignature(moves);
+		if (signature === this.pendingWriterMoves) return;
+		this.pendingWriterMoves = signature;
+		if (moves.length === 0) return;
+		for (const move of moves) this.ctx.logger.warn("recorder placement: this camera is PLANNED for another location and its writer will not move until it next attaches", {
+			tags: { deviceId: move.deviceId },
+			meta: {
+				profile: move.profile,
+				writingTo: move.writingTo,
+				plannedFor: move.plannedFor,
+				hint: "a continuously-recording camera never re-attaches on its own — toggle its recording switch, or restart the recorder, to apply the plan (each costs one gap on that camera)"
+			}
+		});
+		this.emitAlert({
+			severity: "warning",
+			title: "Recording placement waiting on a writer restart",
+			message: `${String(moves.length)} recording profile(s) are planned for a different storage location and will keep writing to their current one until each camera next attaches. Continuously-recording cameras never re-attach on their own.`,
+			locationId: moves[0]?.plannedFor ?? ""
+		});
 	}
 	/**
 	* A placement pass that plans NOTHING says so — once per episode.
@@ -18248,12 +18432,22 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	* still be shouted about in the log even when it is unreachable.
 	*/
 	emitPlacementAlert(input) {
-		this.ctx.api.alerts.emit.mutate({
-			id: (0, node_crypto.randomUUID)(),
-			category: "storage",
+		this.emitAlert({
 			severity: "error",
 			title: "Recordings storage location unusable",
 			message: input.detail,
+			locationId: input.locationId
+		});
+	}
+	/** One storage-category alert. Advisory: the LOG line is the durable record,
+	*  so a failed emit is swallowed rather than raised. */
+	emitAlert(input) {
+		this.ctx.api.alerts.emit.mutate({
+			id: (0, node_crypto.randomUUID)(),
+			category: "storage",
+			severity: input.severity,
+			title: input.title,
+			message: input.message,
 			status: "active",
 			read: false,
 			createdAt: Date.now(),
@@ -18410,7 +18604,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*/
 	async purgeFlattenedSettingsKeys() {
 		try {
-			await require_prebuffer.retireRootKeys({
+			await require_retire_root_keys.retireRootKeys({
 				store: this.ctx.api.settingsStore,
 				addonId: RECORDER_ADDON_ID,
 				logger: this.ctx.logger,
@@ -18491,8 +18685,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	* manifest uses). The scrub packs read the SAME source segments as playback.
 	*/
 	resolveSegmentAbsPath(row) {
-		const loc = this.resolvedLocations.find((l) => l.id === row.locationId);
-		if (loc === void 0) throw new Error(`recorder scrub: unknown recordings location ${row.locationId}`);
+		const loc = requireReadableLocation(this.resolvedLocations, row.locationId, "recorder scrub");
 		return node_path.default.join(loc.root, row.path);
 	}
 	/**