@camstack/addon-pipeline 1.2.256 → 1.2.257

package/dist/recorder/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-lqqUXDfs.js");
-const require_node = require("../node-80-uOMr8.js");
+const require_dist = require("../dist-BMARLLlX.js");
+const require_node = require("../node-Ca-vE0xX.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-VVJiUAkh.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
@@ -15,7 +15,6 @@ node_path = require_chunk.__toESM(node_path);
 let node_child_process = require("node:child_process");
 let node_fs_promises = require("node:fs/promises");
 let _camstack_system_addon_utils = require("@camstack/system/addon-utils");
-let node_zlib = require("node:zlib");
 //#region src/recorder/event-capture.ts
 /**
 * La sottoscrizione motion del recorder: bus → `onTrigger(deviceId, atMs)`.
@@ -1124,6 +1123,37 @@ var RecordingIndex = class {
 		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$9);
 	}
 	/**
+	* Make one hour of ONE location exactly `relPaths` — merge what is there and
+	* drop what is not.
+	*
+	* {@link hydrateHour} merges, which is right for a reader: a listing it took
+	* of a live hour is a lower bound, and dropping on it would delete the index
+	* of footage the readdir merely raced. This is for the one caller that has
+	* TRUSTED evidence the hour is over and the volume it listed is the volume it
+	* started on — the operator-armed ledger walk — where the directory is the
+	* whole truth about the hour and an index row naming a file that is not in it
+	* is a ghost (D523, D148's "trusted walk" arm).
+	*
+	* Scoped to the (device, location, hour) triple: a path filed under another
+	* hour, or held for another location, is none of this call's business.
+	* @residency mutation
+	*/
+	resetHour(deviceId, locationId, hourStartMs, relPaths) {
+		const m = this.mapFor(deviceId);
+		const keep = new Set(relPaths);
+		const dropped = [];
+		for (const [path, row] of m) {
+			if (row.locationId !== locationId) continue;
+			if (Math.floor(row.startMs / HOUR_MS$9) * HOUR_MS$9 !== hourStartMs) continue;
+			if (keep.has(path)) continue;
+			dropped.push(path);
+		}
+		for (const path of dropped) m.delete(path);
+		if (dropped.length > 0) this.invalidateSorted(deviceId);
+		this.hydrateHour(deviceId, locationId, hourStartMs, relPaths);
+		return dropped;
+	}
+	/**
 	* Insert/replace one finalized segment (idempotent by path).
 	*
 	* THE hot mutation: every profile-writer lands here every `segmentSeconds`,
@@ -1772,40 +1802,6 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 	const verify = options?.verifyClosedHours === true;
 	if (!verify && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
 	const liveHour = Math.floor(Date.now() / HOUR_MS$8) * HOUR_MS$8;
-	/** Per (locationId, profile, hour): what the LEDGER claimed, for the diff. */
-	const claimed = /* @__PURE__ */ new Map();
-	const claimKey = (locationId, hour) => `${locationId}:${hour}`;
-	/**
-	* Closed hours the ledger answered for with a row nobody SEALED (D451): what
-	* a writer had persisted when it was last heard from, which is a legitimate
-	* answer and not a complete one. Each is read from the array once and the
-	* row is unioned and sealed, so the second reader pays a point read.
-	*/
-	const unsealed = /* @__PURE__ */ new Set();
-	if (ledger !== void 0) {
-		const startedMs = Date.now();
-		const hours = await ledger.detailForWindow(deviceId, fromMs, toMs);
-		let segments = 0;
-		let served = 0;
-		for (const hour of hours) {
-			if (hour.hourStartMs >= liveHour) continue;
-			index.hydrateHour(deviceId, hour.locationId, hour.hourStartMs, hour.paths);
-			claimed.set(claimKey(hour.locationId, hour.hourStartMs), hour.paths.length);
-			if (!hour.sealed) unsealed.add(hour.hourStartMs);
-			segments += hour.paths.length;
-			served += 1;
-		}
-		if (served > 0) logger.info("recorder: hydrated a window from the hour ledger", {
-			tags: { deviceId },
-			meta: {
-				hours: served,
-				segments,
-				unsealedHours: unsealed.size,
-				ms: Date.now() - startedMs
-			}
-		});
-		if (!verify && unsealed.size === 0 && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
-	}
 	for (const [root, aliases] of aliasesByRoot(locations)) {
 		const deviceDir = node_path.default.join(root, String(deviceId));
 		let profiles;
@@ -1829,7 +1825,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 		let forgottenHours = 0;
 		let sealed = 0;
 		for (let hour = first; hour < toMs; hour += HOUR_MS$8) {
-			if (!verify && hour < liveHour && !unsealed.has(hour) && index.hydrationOf(deviceId, hour, hour + HOUR_MS$8) === "hydrated") continue;
+			if (!verify && hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$8) === "hydrated") continue;
 			for (const profile of profiles) {
 				const rel = hourDirRelPath(deviceId, profile, hour);
 				let files;
@@ -1843,11 +1839,10 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
 				index.hydrateHour(deviceId, locationId, hour, relPaths);
 				if (ledger === void 0 || relPaths.length === 0 || hour + HOUR_MS$8 > Date.now()) continue;
-				const claimedHere = claimed.get(claimKey(locationId, hour));
 				const outcome = await ledger.adoptWalkedHour(deviceId, profile, locationId, hour, relPaths);
 				if (outcome === null) continue;
 				if (outcome.created) repaired += 1;
-				else if (claimedHere !== void 0 && outcome.added > 0) {
+				else if (outcome.added > 0) {
 					forgottenSegments += outcome.added;
 					forgottenHours += 1;
 				}
@@ -2484,10 +2479,12 @@ var RelocateEngine = class {
 	*
 	* The order is the whole point. Between the copy and the delete both
 	* locations hold every byte, so the ledger re-point in the middle can only
-	* ever name a location that HAS the file — which is what makes a crash
-	* recoverable instead of a black window. A ledger that refuses (a failed
-	* point read: D49/D287) stops this hour dead with nothing deleted; the
-	* copies at the target are adopted by the next run.
+	* ever account for a location that HAS the files — which is what makes a
+	* crash recoverable instead of a black window.
+	*
+	* There is no ledger refusal to handle any more (D523): the durable half is
+	* arithmetic over a row the mirror already holds, so nothing on that path can
+	* fail and stop an hour dead.
 	*/
 	async moveHour(job, rows, from, to, samePhysicalRoot, sleep, bytesPerMs) {
 		const movable = [];
@@ -2523,17 +2520,7 @@ var RelocateEngine = class {
 				toLocationId: to.id
 			}
 		});
-		else if (!await ledger.repointSegments(movable, to.id)) {
-			this.deps.logger.warn("relocate: hour NOT moved — the durable ledger refused the re-point, so the source bytes are kept", {
-				tags: { deviceId: movable[0].deviceId },
-				meta: {
-					jobId: job.jobId,
-					files: movable.length,
-					toLocationId: to.id
-				}
-			});
-			return;
-		}
+		else await ledger.repointSegments(movable, to.id);
 		if (!samePhysicalRoot) for (const row of movable) await node_fs.promises.rm(node_path.default.join(from.root, row.fromPath ?? row.path), { force: true });
 		for (const row of movable) {
 			this.deps.index.removeSegments([row.fromPath ?? row.path]);
@@ -2926,23 +2913,21 @@ var SegmentStore = class SegmentStore {
 	*  work now the per-bucket archive scan is gone. */
 	static DEFAULT_EVICT_CHUNK = 25;
 	/**
-	* True when `victims` cover EVERY segment the ARCHIVE says the bucket holds,
-	* AND the bucket's hour has fully elapsed.
+	* True when `victims` cover EVERY segment the bucket DIRECTORY holds, AND the
+	* bucket's hour has fully elapsed.
 	*
 	* The current-hour guard matters because `onFinalized` relocates new segments
 	* INTO the current bucket concurrently — an rm racing that rename would
 	* orphan a just-indexed segment.
 	*
-	* The cover test is against `SegmentHourLedger`'s own hour row, never
-	* `RecordingIndex`. A bucketDir is `<dev>/<profile>/Y/M/D/H`, so it names
-	* exactly one durable hour row: "every path that row lists is a victim" is
-	* the same question the `rm -rf` answers, asked of the authority for what
-	* EXISTS (D295). Asked of the resident index it read EQUAL whenever the hour
-	* was partly resident — both sides short by the same rows — and the directory
-	* went with every file the round never named, leaving their durable rows
-	* behind as ghosts.
+	* The cover test is a listing of the directory the `rm -rf` is about to take,
+	* never `RecordingIndex` and never a durable row (D523). A bucketDir is
+	* `<dev>/<profile>/Y/M/D/H`, so one listing answers exactly the question the
+	* delete asks. Asked of the resident index it read EQUAL whenever the hour was
+	* partly resident — both sides short by the same rows — and the directory went
+	* with every file the round never named.
 	*
-	* An unanswerable archive returns `false`: per-file deletes are slower and
+	* An unanswerable listing returns `false`: per-file deletes are slower and
 	* always correct, and the alternative is a recursive delete computed from a
 	* fraction of the truth.
 	*/
@@ -2951,7 +2936,7 @@ var SegmentStore = class SegmentStore {
 		if (!first) return false;
 		const bucketStartMs = Math.floor(first.startMs / SegmentStore.HOUR_MS) * SegmentStore.HOUR_MS;
 		if ((this.deps.now?.() ?? Date.now()) < bucketStartMs + SegmentStore.HOUR_MS) return false;
-		const ask = this.deps.archiveHourPaths;
+		const ask = this.deps.hourDirectoryPaths;
 		if (ask === void 0) return false;
 		const held = await ask(first.deviceId, first.profile, location, bucketStartMs);
 		if (held === null || held.length === 0) return false;
@@ -4084,8 +4069,9 @@ var CalendarIndex = class {
 	*
 	* Also used to warm the days ADJACENT to one being viewed — changing day is a
 	* single click and the operator expects the summary to be there. That warm
-	* belongs in the background: at ~650 ms per cold read, doing it inline would
-	* only move the wait.
+	* belongs in the background: a cold read costs whatever the array charges
+	* that day (see the header — the ~650 ms figure is from the retired FUSE
+	* share), and doing it inline would only move the wait onto the click.
 	*/
 	async warm(deviceId, fromMs, toMs) {
 		for (let day = utcDayOf(fromMs); day <= utcDayOf(toMs); day += DAY_MS$3) {
@@ -5207,22 +5193,18 @@ function createFootageDiscardJob(deps) {
 	const forgetLedger = async (location) => {
 		const ledger = deps.ledger;
 		if (ledger === null) return 0;
-		let forgotten = 0;
 		const profiles = profilesForType(location.type);
-		for await (const page of ledger.streamSegments({
+		const scope = {
 			locationId: location.id,
 			profiles
-		})) {
-			if (cancelRequested) return forgotten;
-			deps.index.removeSegments(page.map((row) => row.path));
-			await ledger.dropSegments(page);
-			forgotten += page.length;
-			report({
-				dbRowsDeleted: forgotten,
-				detail: `forgot ${forgotten} ledger segments`
-			});
-			await sleep(0);
-		}
+		};
+		const hours = ledger.snapshot().filter((row) => row.locationId === location.id && profiles.includes(row.profile));
+		const forgotten = await ledger.forgetScope(scope);
+		for (const hour of hours) deps.index.resetHour(hour.deviceId, hour.locationId, hour.hourStartMs, []);
+		report({
+			dbRowsDeleted: forgotten,
+			detail: `forgot ${forgotten} ledger segments`
+		});
 		return forgotten;
 	};
 	return {
@@ -8275,63 +8257,6 @@ function runFfmpeg(renderDeps, args, ext) {
 	});
 }
 //#endregion
-//#region src/recorder/addon/paths-codec.ts
-/**
-* How an hour row's `paths` becomes text, and back (D471).
-*
-* `recorder:segment-hours` is 66 MB of the settings database and **99.2 % of it
-* is this one column** — 15 643 bytes per row over 4 036 rows. The content is a
-* list of location-relative segment paths that nearly all share the same
-* directory prefix, repeated in full on every entry. Measured per column on a
-* copy of the live database, never the live file (D468).
-*
-* Compressing it is unusually safe here because of D287's two-tier mirror: boot
-* loads the aggregate half of every row and NOT `paths`, so this column is read
-* only on a point materialise, never on the hot path.
-*
-* A local copy of the same idea `pipeline-analytics` uses for `positions` —
-* addons never import each other (CLAUDE.md), so twenty duplicated lines are
-* the correct shape, not a shared dependency across an addon boundary.
-*/
-/** Marks a value this module wrote. A plain JSON array always starts `[`. */
-var ENCODED_PREFIX = "z1:";
-function encodePaths(paths) {
-	return ENCODED_PREFIX + (0, node_zlib.gzipSync)(Buffer.from(JSON.stringify(paths), "utf8"), { level: 6 }).toString("base64");
-}
-/**
-* Decode whichever era wrote the value: the `z1:` string this writes, the plain
-* JSON string every pre-D471 row holds, or an array the store already parsed.
-*
-* `null` means "this row is unreadable", which the caller turns into a DISCARDED
-* row — the same contract the bare `JSON.parse` had. An hour whose paths cannot
-* be read must not silently become an hour with no segments: that would report
-* an empty disk, which is the failure `recordToRow` was already written to
-* avoid.
-*/
-function decodePaths(value) {
-	if (Array.isArray(value)) return isPathList(value) ? value : null;
-	if (typeof value !== "string") return null;
-	const json = value.startsWith(ENCODED_PREFIX) ? tryGunzip(value.slice(3)) : value;
-	if (json === null) return null;
-	try {
-		const parsed = JSON.parse(json);
-		if (!Array.isArray(parsed)) return null;
-		return isPathList(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-function isPathList(v) {
-	return v.every((p) => typeof p === "string" && p.length > 0);
-}
-function tryGunzip(b64) {
-	try {
-		return (0, node_zlib.gunzipSync)(Buffer.from(b64, "base64")).toString("utf8");
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/durable/durable-ledger.ts
 /** Default reseed cap — every current consumer's row set is installation-bounded. */
 var DEFAULT_LOAD_LIMIT = 1e5;
@@ -8586,19 +8511,19 @@ var macrotask$1 = () => new Promise((resolve) => {
 });
 /**
 * @durable class=mirror owner=recorder
-*   write="write-behind on every finalized segment (hour-row upsert, serialised per hour); the writer SEALS the hour it leaves (one write per hour); a disk walk of a closed hour unions what it found and seals; eviction drops paths"
+*   write="write-behind on every finalized segment (hour-row upsert, serialised per hour); the writer SEALS the hour it leaves (one write per hour); a listing of a closed hour re-derives the aggregate and seals; eviction and relocation shrink it"
 *   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
 */
 var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
 /**
-* The four aggregate columns exist so "how much footage is on this disk" is a
-* `SUM`/`MIN`/`MAX` over ~19 k hour rows instead of a walk over ~7.1 M in-RAM
-* segment rows. They are DERIVED from `paths` — never a second authority — by
-* {@link withSegmentPath} and nothing else: {@link hourAggregate} is that step
-* over every path and {@link appendSegmentPath} is that step over one, so there
-* is no second derivation to drift. A row loaded from a database that predates
-* these columns is corrected in the mirror the moment it is read and repaired
-* on disk by {@link SegmentHourLedger.repairAggregates}.
+* The four aggregate columns are what this table IS (D523).
+*
+* They exist so "how much footage is on this disk" is a `SUM`/`MIN`/`MAX` over
+* ~19 k hour rows instead of a walk over ~7.1 M in-RAM segment rows, and they
+* are derived from segment NAMES — by {@link withSegmentPath} and nothing else.
+* {@link hourAggregate} is that step over a whole listing and
+* {@link appendSegmentPath} is that step over the one path that just arrived,
+* so there is no second derivation to drift.
 */
 var RECORDING_SEGMENT_HOURS_COLUMNS = [
 	{
@@ -8627,11 +8552,6 @@ var RECORDING_SEGMENT_HOURS_COLUMNS = [
 		type: "INTEGER",
 		notNull: true
 	},
-	{
-		name: "paths",
-		type: "TEXT",
-		notNull: true
-	},
 	{
 		name: "bytes",
 		type: "INTEGER",
@@ -8690,15 +8610,9 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 	* `MAX(maxStartMs)` over `locationId IN (…)` — one row back, and with this
 	* index not one table row read to produce it (D447).
 	*
-	* `idx_recorder_segment_hours_loc_hour` finds the same range, but the four
-	* aggregates live in the table row, next to `paths` — up to 360 segment
-	* paths of ~80 characters per hour — so the eviction index served the
-	* accounting read at the price of ~30 KB of table page per hour row. On the
-	* live hub that was `durationMs=1001…2902` once a MINUTE on
-	* `hub/sqlite-settings` (174 slow-call WARNs in ten hours on 2026-09-10/11),
-	* every one of them holding the thread every configuration read in the
-	* cluster waits on. The index is ~50 bytes a row over ~19 k rows — nothing —
-	* and the first declare after it ships builds it in well under a second.
+	* Since D523 dropped `paths` the table row is ten scalars, so the covering
+	* index no longer saves ~30 KB of page per row; it still saves the row
+	* fetch, and the accounting read is the one this hub runs on a schedule.
 	*/
 	{
 		name: "idx_recorder_segment_hours_loc_accounting",
@@ -8723,13 +8637,13 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 * nominal `-segment_time` (ffmpeg cuts on the next GOP, never on the clock).
 *
 * It is a guess, and this is the shape of being wrong in each direction.
-* TIGHTER: a normal rollover stops sealing, every hour of the archive is walked
-* once by its first reader, and D451's "at rest nothing is unsealed" is undone
-* — at ~3.6 ms per hour directory cold, affordable but pointless. LOOSER: a
-* runner respawn inside the window seals an hour it entered late, which is
-* exactly the 2026-09-17 defect; the observed hole there was ~29 minutes, so
-* anything under a few minutes would have caught it and 90 s is the smallest
-* number that does not fire on a legitimate rollover.
+* TIGHTER: a normal rollover stops sealing and every hour of the archive is
+* listed once by the adoption sweep — at ~1 ms per hour directory on this hub's
+* SATA SSD, affordable but pointless. LOOSER: a runner respawn inside the
+* window seals an hour it entered late, which is exactly the 2026-09-17 defect;
+* the observed hole there was ~29 minutes, so anything under a few minutes
+* would have caught it and 90 s is the smallest number that does not fire on a
+* legitimate rollover.
 */
 var WRITER_HOUR_ENTRY_GRACE_MS = 9e4;
 /** The identity of the {@link hourAggregate} fold — an hour holding nothing. */
@@ -8743,12 +8657,11 @@ var EMPTY_HOUR_AGGREGATE = {
 * ONE path folded into an aggregate — the whole derivation, expressed as its
 * single step.
 *
-* {@link hourAggregate} is this step over every path, and {@link
+* {@link hourAggregate} is this step over a whole listing, and {@link
 * SegmentHourLedger.recordSegment} is this step over the one path that just
 * arrived. That is not two implementations that happen to agree: the full
 * derivation is *defined* as this function repeated, so an append is the fold
-* resumed from the state the held row already carries — a `SegmentHourRow`'s
-* aggregate half IS the fold state over its `paths`.
+* resumed from the state the held row already carries.
 *
 * Why it had to become a step: `recordSegment` re-derived the whole hour on
 * every finalize. Σ1..360 ≈ 65 k path parses per camera-profile-hour at 10 s
@@ -8771,49 +8684,57 @@ function withSegmentPath(agg, path) {
 	};
 }
 /**
-* Bytes / count / oldest / newest for one hour's paths — the sole FULL
-* derivation, used by rebuilds ({@link recordToRow}, `dropSegments`) and never
-* by the append path.
+* Bytes / count / oldest / newest for one hour's LISTING — the sole FULL
+* derivation, and since D523 the only thing that can produce an EXACT row.
 *
 * Every field of a segment path encodes its own facts (`parseSegmentPath`), so
-* this is a derivation, not a measurement: it can never disagree with the paths
-* it was computed from.
+* this is a derivation, not a measurement: it can never disagree with the
+* listing it was computed from.
 */
 function hourAggregate(paths) {
 	let agg = EMPTY_HOUR_AGGREGATE;
 	for (const path of paths) agg = withSegmentPath(agg, path);
 	return agg;
 }
-/** Build the persisted row for an hour from its paths — the ONE constructor. */
+/** Build the persisted row for an hour from a LISTING of it — the ONE
+*  constructor that can produce an exact aggregate. */
 function segmentHourRow(base) {
+	const { paths, sealed, ...identity } = base;
 	return {
-		...base,
-		sealed: base.sealed ?? false,
-		pathsResident: true,
-		...hourAggregate(base.paths)
+		...identity,
+		sealed: sealed ?? false,
+		...hourAggregate(paths)
+	};
+}
+/**
+* Build the persisted row for an hour from an aggregate somebody already folded
+* — a relocation moving one, or a listing that has already been reduced.
+*
+* `sealed` is a NAMED field and never a positional boolean, because
+* `scripts/check-seal-authority.ts` attributes every literal `sealed: true` in
+* the recorder to the method that wrote it. A seal smuggled in as a third
+* argument is a seal the guard cannot see.
+*/
+function hourRowOf(identity, row) {
+	return {
+		...identity,
+		...row
 	};
 }
 /**
 * The row an hour becomes when ONE more path joins it.
 *
-* Identical to `segmentHourRow({ ...held, paths: [...held.paths, path] })` and
-* strictly cheaper: the aggregate half of `held` is already the fold over
-* `held.paths`, so this resumes that fold instead of restarting it. The
+* Identical to `segmentHourRow({ …held, paths: [...everything, path] })` and
+* strictly cheaper: the aggregate half of `held` is already the fold over the
+* hour's names, so this resumes that fold instead of restarting it. The
 * equality is not an assumption — `segment-hour-append.spec.ts` pins it on
 * generated hours including out-of-order arrival, duplicate paths, unparseable
 * paths and storm-sized hours.
-*
-* The four fields are named rather than spread on purpose. {@link
-* withSegmentPath} hands its argument straight back for a path the parser
-* refuses, and `held` is a whole row — spreading that return would put the
-* PREVIOUS `paths` array back over the appended one. Which is exactly what it
-* did until the generated-hours test caught it.
 */
 function appendSegmentPath(held, path) {
 	const { bytes, segments, minStartMs, maxStartMs } = withSegmentPath(held, path);
 	return {
 		...held,
-		paths: [...held.paths, path],
 		bytes,
 		segments,
 		minStartMs,
@@ -8831,6 +8752,20 @@ function appendSegmentPath(held, path) {
 * `readdir` over an unmounted root deletes all of it.
 */
 var LEDGER_PRUNE_MAX_SHARE = .5;
+/**
+* The largest share of ONE hour's accounted segments a single listing may
+* erase (D523).
+*
+* The directory is the authority for WHICH segments exist, so a listing of a
+* closed hour replaces that hour's aggregate — including downwards, which is
+* what makes an over-counted row self-correcting. The guard is the same
+* argument {@link LEDGER_PRUNE_MAX_SHARE} makes one level up: a root that has
+* gone away, or a bucket half-deleted by a round that died, answers SHORT, and
+* a short answer that halves an hour is indistinguishable from one that is
+* simply right. Under the bar the listing wins; over it the row stands, the
+* hour stays unsealed, and the disagreement is named.
+*/
+var HOUR_LISTING_MAX_SHRINK_SHARE = .5;
 /** Backstop on the oldest-first probe. A bounded read must stay bounded even if
 *  a caller asks for a target no archive can cover. */
 var OLDEST_MAX_PAGES = 16;
@@ -8840,9 +8775,6 @@ var OLDEST_PROBE_COLUMNS = [
 	"bytes",
 	"locationId"
 ];
-/** Aggregate-repair probe: the primary key always comes back, so this asks for
-*  the predicate column alone. */
-var REPAIR_PROBE_COLUMNS = ["segments"];
 /**
 * Backstop on {@link SegmentHourLedger.streamSegments}.
 *
@@ -8881,47 +8813,8 @@ var CENSUS_FIELDS = [
 		op: "max"
 	}
 ];
-/** Rows repaired per boot. The live archive is ~19 k hour rows. */
-var REPAIR_MAX_ROWS = 5e4;
-/**
-* The boot projection (D287): everything the recorder's always-resident tier
-* needs, and deliberately NOT `paths`.
-*
-* `paths` is ~55 B per segment and the archive is the only thing that grows:
-* ~16 MB of JSON today, a projected ~460 MB at 28 TB of today's bitrate mix
-* and ~5.9 GB at a low-bitrate mix — one tRPC response, parsed on the main
-* thread, before the index exists. The summary half is O(writers × days) and
-* stays ~10–15 MB at any archive size.
-*/
-var SEGMENT_HOUR_SUMMARY_COLUMNS = [
-	"deviceId",
-	"profile",
-	"locationId",
-	"hourStartMs",
-	"bytes",
-	"segments",
-	"minStartMs",
-	"maxStartMs",
-	"sealed"
-];
 /** Summary rows folded into the mirror between yields. */
 var LOAD_CHUNK = 5e3;
-/** Hour rows materialised per point-read page. One page covers a day of one
-*  camera's three profiles with room to spare. */
-var HOUR_DETAIL_PAGE = 64;
-/**
-* The live tail materialised at boot: the current hour and the one before it.
-*
-* `recordSegment` must gate from RAM (D49), and the hour it appends to at boot
-* is exactly the hour the previous process was writing. Two hours × the active
-* writers is ~60 rows — one point-read page — and it is what makes the write
-* path's materialise a case that essentially never happens.
-*/
-var LIVE_TAIL_HOURS = 2;
-/** Rows the one-shot aggregate repair may materialise in a single boot. The
-*  backfill is bounded so it cannot re-become the whole-archive read D287
-*  removed; a partial pass finishes on the next boot. */
-var REPAIR_MAX_MATERIALIZE = 2e3;
 /** The four scalars an accounting answer is made of, asked in one statement. */
 var ACCOUNTING_FIELDS = [
 	{
@@ -8974,14 +8867,6 @@ function writerKey(deviceId, profile) {
 function writerHourKey(deviceId, profile, hour) {
 	return `${deviceId}|${profile}|${hour}`;
 }
-function detailOf(row) {
-	return {
-		locationId: row.locationId,
-		hourStartMs: row.hourStartMs,
-		paths: row.paths,
-		sealed: row.sealed
-	};
-}
 /**
 * The `hourStartMs` of one probe record.
 *
@@ -8993,21 +8878,31 @@ function hourOfRecord(record) {
 	const raw = record.data["hourStartMs"];
 	return typeof raw === "number" && Number.isFinite(raw) ? raw : -1;
 }
-function uniquePaths(paths) {
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const p of paths) {
-		if (seen.has(p)) continue;
-		seen.add(p);
-		out.push(p);
+/** One listing turned into the segment rows a caller can act on — the only
+*  place a `SegmentRow` is built out of a directory read. */
+function segmentRowsOf(locationId, paths) {
+	const rows = [];
+	let unparseable = 0;
+	for (const path of paths) {
+		const parsed = parseSegmentPath(path);
+		if (parsed === null) {
+			unparseable += 1;
+			continue;
+		}
+		rows.push({
+			deviceId: parsed.deviceId,
+			profile: parsed.profile,
+			startMs: parsed.startMs,
+			durMs: parsed.durMs,
+			bytes: parsed.bytes,
+			path,
+			locationId
+		});
 	}
-	return out;
-}
-function samePaths(a, b) {
-	if (a.length !== b.length) return false;
-	const set = new Set(a);
-	for (const p of b) if (!set.has(p)) return false;
-	return true;
+	return {
+		rows,
+		unparseable
+	};
 }
 function rowToValue(row) {
 	return {
@@ -9015,7 +8910,6 @@ function rowToValue(row) {
 		profile: row.profile,
 		locationId: row.locationId,
 		hourStartMs: row.hourStartMs,
-		paths: encodePaths(row.paths),
 		bytes: row.bytes,
 		segments: row.segments,
 		minStartMs: row.minStartMs,
@@ -9028,44 +8922,21 @@ function rowToValue(row) {
 function sealedOf(raw) {
 	return raw === 1 || raw === true;
 }
-function recordToRow(key, data) {
-	const deviceId = Number(data["deviceId"]);
-	const profile = data["profile"];
-	const locationId = data["locationId"];
-	const hour = Number(data["hourStartMs"]);
-	const decodedPaths = decodePaths(data["paths"]);
-	if (decodedPaths === null) return null;
-	const raw = decodedPaths;
-	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
-	return segmentHourRow({
-		key,
-		deviceId,
-		profile,
-		locationId,
-		hourStartMs: hour,
-		paths: raw,
-		sealed: sealedOf(data["sealed"])
-	});
-}
-/** The paths of a summary row: one shared empty array, never a per-row
-*  allocation, and never mistakable for "this hour holds nothing". */
-var NO_PATHS = Object.freeze([]);
 function finiteOr0(raw) {
 	const n = Number(raw);
 	return Number.isFinite(n) ? n : 0;
 }
 /**
-* One row of the boot projection ({@link SEGMENT_HOUR_SUMMARY_COLUMNS}).
+* One persisted row.
 *
-* The identity half is validated exactly as {@link recordToRow} validates it —
-* a row that cannot say which camera, profile, location and hour it is about
-* is skipped, because a summary keyed on garbage would refuse the write path
-* for an hour that is perfectly fine. The aggregate half is taken as the
-* database wrote it: a row that predates the aggregate columns reports zeros,
-* which UNDER-reports its disk (prunes less, never more) until
-* {@link SegmentHourLedger.repairAggregates} rewrites it.
+* The identity half is validated: a row that cannot say which camera, profile,
+* location and hour it is about is DISCARDED, because a row keyed on garbage
+* would refuse the write path for an hour that is perfectly fine. The aggregate
+* half is taken as the database wrote it — a row that predates the aggregate
+* columns reports zeros, which UNDER-reports its disk (prunes less, never more)
+* until a listing of that hour re-derives it.
 */
-function summaryToRow(key, data) {
+function recordToRow(key, data) {
 	const deviceId = Number(data["deviceId"]);
 	const profile = data["profile"];
 	const locationId = data["locationId"];
@@ -9077,8 +8948,6 @@ function summaryToRow(key, data) {
 		profile,
 		locationId,
 		hourStartMs: hour,
-		paths: NO_PATHS,
-		pathsResident: false,
 		sealed: sealedOf(data["sealed"]),
 		bytes: finiteOr0(data["bytes"]),
 		segments: finiteOr0(data["segments"]),
@@ -9100,11 +8969,12 @@ var SPEC = {
 var SegmentHourLedger = class SegmentHourLedger {
 	ledger;
 	logger;
-	/** Held for the two ARCHIVE reads below, which are queries rather than mirror
+	/** Held for the ARCHIVE reads below, which are queries rather than mirror
 	*  lookups. Every DECISION path (`recordSegment`, `dropSegments`, the prune
 	*  refusals) still answers from the mirror alone — D49 is about gates, and an
 	*  accounting number is not a gate. */
 	store;
+	listHour;
 	isLocationUsable;
 	now;
 	loadChunk;
@@ -9118,6 +8988,19 @@ var SegmentHourLedger = class SegmentHourLedger {
 	lanes = /* @__PURE__ */ new Map();
 	/** Per (device, profile): the hour its writer last appended to. */
 	writerHours = /* @__PURE__ */ new Map();
+	/**
+	* Segment paths THIS PROCESS has already accounted for, per hour key.
+	*
+	* The `paths` column used to make the write path idempotent for free: an
+	* append checked `held.paths.includes(path)`. With the column gone the
+	* aggregate cannot say whether it already counted a name, so the dedup lives
+	* here — bounded to the hours this process actually writes (two per writer:
+	* the current hour and the one it just left), dropped when the writer moves
+	* on. A duplicate that survives a RESTART is not caught here and is not
+	* silent either: the row is unsealed, and the first listing of the closed
+	* hour re-derives the aggregate exactly ({@link adoptWalkedHour}).
+	*/
+	accounted = /* @__PURE__ */ new Map();
 	/** Hour keys a write was REFUSED for in this process — never sealed by it. */
 	refused = /* @__PURE__ */ new Set();
 	/**
@@ -9130,6 +9013,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.store = deps.store;
+		this.listHour = deps.listHour ?? null;
 		this.isLocationUsable = deps.isLocationUsable ?? (() => true);
 		this.now = deps.now ?? (() => Date.now());
 		this.loadChunk = deps.loadPacing?.chunkSize ?? LOAD_CHUNK;
@@ -9148,22 +9032,17 @@ var SegmentHourLedger = class SegmentHourLedger {
 		return this.ledger.declare();
 	}
 	/**
-	* Boot load — **T1 only** (D287).
-	*
-	* One projected query over {@link SEGMENT_HOUR_SUMMARY_COLUMNS}, folded into
-	* the mirror in chunks with a yield between them, then one point-read page
-	* that materialises the live tail so the write path can gate from RAM.
+	* Boot load — every hour row, in one query.
 	*
-	* It replaces `DurableLedger.load`, which fetches whole rows and therefore
-	* the whole archive's path strings, and it keeps that primitive's two rules:
-	* a failed read RETURNS WHAT IS ALREADY MIRRORED rather than clearing it,
-	* and a malformed row is skipped rather than repaired.
+	* Since D523 the whole row is ten scalars, so there is no second tier to
+	* materialise and no projection to choose: the mirror this returns is the
+	* ledger, entire. It keeps `DurableLedger.load`'s two rules — a failed read
+	* RETURNS WHAT IS ALREADY MIRRORED rather than clearing it, and a malformed
+	* row is skipped rather than repaired.
 	*
-	* It deliberately does NOT replay the archive into {@link RecordingIndex}.
-	* `hydrated` now means "the rows are resident", so a ledger-known hour is
-	* merely *hydratable from T3*: the first read of it pays one point read
-	* ({@link detailForWindow}), and an hour whose tail the ledger is missing is
-	* no longer permanently invisible to playback.
+	* It deliberately does NOT replay the archive into {@link RecordingIndex}: a
+	* row says how MUCH an hour holds, never which files, so only a listing can
+	* seed the index (D523).
 	*/
 	async load() {
 		const startedMs = this.now();
@@ -9171,7 +9050,6 @@ var SegmentHourLedger = class SegmentHourLedger {
 		try {
 			records = await this.store.query.query({
 				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				columns: SEGMENT_HOUR_SUMMARY_COLUMNS,
 				filter: { limit: this.rowCap }
 			});
 		} catch (err) {
@@ -9188,7 +9066,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 			const end = Math.min(i + this.loadChunk, records.length);
 			for (let j = i; j < end; j += 1) {
 				const record = records[j];
-				const row = summaryToRow(record.id, record.data);
+				const row = recordToRow(record.id, record.data);
 				if (row === null) {
 					skipped += 1;
 					continue;
@@ -9197,7 +9075,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 			}
 			if (end < records.length) await this.yieldBetween();
 		}
-		if (skipped > 0) this.logger.warn("recorder: segment-hour summaries skipped as malformed — they gate NOTHING", { meta: {
+		if (skipped > 0) this.logger.warn("recorder: segment-hour rows skipped as malformed — they gate NOTHING", { meta: {
 			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
 			skipped
 		} });
@@ -9205,11 +9083,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 			limit: this.rowCap,
 			loaded: records.length
 		} });
-		const tail = await this.materializeLiveTail();
 		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
 			hours: this.ledger.size,
-			pathsLoaded: false,
-			liveTailHours: tail,
 			skipped,
 			queryMs: queriedMs - startedMs,
 			ms: this.now() - startedMs,
@@ -9217,8 +9092,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 		} });
 		return this.ledger.snapshot();
 	}
-	/** Every hour the ledger knows — summaries included. A row whose
-	*  `pathsResident` is false carries real aggregates and empty `paths`. */
+	/** Every hour row held. Pure RAM. */
 	snapshot() {
 		return this.ledger.snapshot();
 	}
@@ -9228,10 +9102,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* The archive's answer to "what should placement plan for", and the reason it
 	* is here rather than a `census` loop or an index read:
 	*
-	*   - `RecordingIndex.accountingByProfile` is the wrong authority. Since D287
-	*     it holds the live tail plus whatever an operator hydrated, so a camera
-	*     nobody has viewed since boot reports NO profiles — and the placement
-	*     pass then never plans it (D295 §3a #9, D299).
+	*   - `RecordingIndex.accountingByProfile` is the wrong authority. It holds
+	*     the live tail plus whatever a reader hydrated, so a camera nobody has
+	*     viewed since boot reports NO profiles — and the placement pass then
+	*     never plans it (D295 §3a #9, D299).
 	*   - `census({ deviceId, profiles: [p] })` is the right authority but the
 	*     wrong shape for a 30 s tick: it is one SQL round trip per (camera,
 	*     profile), so a 16-camera fleet pays 48 SERIAL trips over the UDS door
@@ -9239,10 +9113,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*     240003` pass (see `PLACEMENT_STORE_TIMEOUT_MS`), and it grows with the
 	*     fleet.
 	*
-	* So it is answered from T1, the hour summary D287 made permanently resident
-	* precisely so that O(writers × days) questions cost no I/O: ~10–15 MB and
-	* ~47 k rows even at 30 TB, one fold, no query. A hydrated segment row is not
-	* needed to know that an hour exists.
+	* So it is answered from the mirror: one fold, no query, no I/O.
 	*
 	* An EMPTY result for a device is a real answer — "the archive knows no hour
 	* for this camera" — and it is also what a ledger whose load failed reports,
@@ -9259,136 +9130,111 @@ var SegmentHourLedger = class SegmentHourLedger {
 		}
 		return out;
 	}
-	/** Does the ledger hold a row for this hour at all? Pure RAM — the gate the
-	*  storage-walk repair consults before it upserts a rebuilt hour. */
+	/** Does the ledger hold a row for this hour at all? Pure RAM. */
 	knowsHour(deviceId, profile, locationId, hour) {
 		return this.ledger.has(segmentHourKey(deviceId, profile, locationId, hour));
 	}
-	/**
-	* The paths of ONE held hour row, materialised — or `null` when they could
-	* not be read.
-	*
-	* {@link detailForWindow} answers per (device, window) and drops the profile
-	* on the way out, which is fine for a reader assembling a playlist and wrong
-	* for a caller that must act on one hour ROW: the ghost-location reconcile
-	* decides per `(deviceId, profile, locationId, hour)` and hands the resulting
-	* paths straight back to {@link dropSegments} / {@link repointSegments},
-	* whose bucket key is that same tuple.
-	*
-	* `null` is "known, and its detail could not be had" — never an empty array.
-	* The one caller FORGETS rows on this answer, and a failed point read that
-	* came back as `[]` would read as "this hour holds nothing", which is the
-	* D148 prune-on-no-evidence this ledger refuses to make.
-	*/
-	async hourPaths(deviceId, profile, locationId, hour) {
-		const key = segmentHourKey(deviceId, profile, locationId, hour);
-		if (!this.ledger.has(key)) return null;
-		const held = await this.resident(key, deviceId);
-		return held === null ? null : held.paths;
-	}
-	/**
-	* The hours of `[fromMs, toMs)` the ledger knows, with their paths — the
-	* cold-hour detail read that replaces the boot replay (D287).
-	*
-	* One bounded point read against the settings store, never the media array:
-	* a `readdir` of one hour directory was measured at ~650 ms under load on
-	* the live share, and the array is the resource the scrub feeder is
-	* competing for. Hours the ledger does NOT know are absent from the result,
-	* and the caller walks those from disk exactly as it always did.
-	*
-	* **A read that fails returns what it already had** (D49). The caller sees
-	* fewer hours, the index stays `unknown` for the rest, and the window falls
-	* through to the walk — nothing is destroyed and nothing renders as an
-	* empty hour that was merely unread.
-	*/
-	async detailForWindow(deviceId, fromMs, toMs) {
-		const first = hourStartMs(fromMs);
-		const out = [];
-		const wanted = [];
-		for (const row of this.ledger.snapshot()) {
-			if (row.deviceId !== deviceId) continue;
-			if (row.hourStartMs < first || row.hourStartMs >= toMs) continue;
-			if (row.pathsResident) {
-				out.push(detailOf(row));
-				continue;
-			}
-			wanted.push(row.key);
-		}
-		for (const row of await this.materialize(wanted, deviceId)) out.push(detailOf(row));
-		return out;
+	/** One held hour row, or `undefined`. Pure RAM — since D523 a row carries
+	*  everything it has. */
+	hourRow(deviceId, profile, locationId, hour) {
+		return this.ledger.get(segmentHourKey(deviceId, profile, locationId, hour));
 	}
 	/**
-	* Union a CLOSED hour the storage walk read into its row, and SEAL it.
-	*
-	* The reader repairs the durable index it just reconstructed, so the next
-	* cold read of this hour is a point read instead of another `readdir`
-	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2), and it
-	* seals the row because a directory read of a closed hour is the one
-	* complete answer there is. The caller guarantees the hour is CLOSED — a
-	* live hour's directory races its writer, so a walk of it is a lower bound.
+	* A LISTING of a CLOSED hour is adopted as that hour's account, and SEALS it.
 	*
-	* A row the ledger already holds is UNIONED, never replaced: the walk can
-	* only add (D148) — a path the row names and the directory lacks stays,
-	* because "the reader did not see it" is not evidence it is gone. This is
-	* the repair D445 described and did not perform: its predecessor returned
-	* on any known key, so a row known INCOMPLETELY — the only kind that needs
-	* repairing — was exactly the row it refused to touch, and the export's
-	* `forgottenSegments=9758` was counted again the next morning.
+	* The directory is the authority for which segments exist (D523), so a
+	* listing of an hour that is OVER is the one complete answer there is — it
+	* replaces the row's aggregate rather than merging with it, which is what
+	* makes an hour that was over-counted (a duplicate finalize across a restart)
+	* or under-counted (a writer torn down mid-hour) self-correcting. The caller
+	* guarantees the hour is CLOSED: a live hour's directory races its writer, so
+	* a listing of it is a lower bound.
 	*
-	* `null` when the row is known and its detail could not be read: nothing
-	* is written from a row whose paths are not resident.
+	* A listing that would erase more than {@link HOUR_LISTING_MAX_SHRINK_SHARE}
+	* of what the row accounts for is REFUSED and named. That is the one thing a
+	* listing cannot be trusted about: a root that has gone away and a bucket a
+	* dead round half-deleted both answer short, and neither is distinguishable
+	* from an hour that is simply smaller than the row thought.
 	*
 	* @seal-authority closed-hour-listing — a directory read of an hour that is
 	* OVER is the one complete answer there is; the caller guarantees the hour is
-	* closed (D451, D521).
+	* closed (D451, D521, D523).
 	*/
 	async adoptWalkedHour(deviceId, profile, locationId, hour, paths) {
 		const key = segmentHourKey(deviceId, profile, locationId, hour);
+		const identity = {
+			key,
+			deviceId,
+			profile,
+			locationId,
+			hourStartMs: hour
+		};
+		const walked = hourAggregate(paths);
 		return this.serialized(key, async () => {
-			if (!this.ledger.has(key)) {
-				if (paths.length === 0) return {
+			const held = this.ledger.get(key);
+			if (held === void 0) {
+				if (walked.segments === 0) return {
 					created: false,
 					added: 0,
 					sealedNow: false
 				};
-				const row = segmentHourRow({
-					key,
-					deviceId,
-					profile,
-					locationId,
-					hourStartMs: hour,
-					paths: uniquePaths(paths),
+				await this.ledger.put(hourRowOf(identity, {
+					...walked,
 					sealed: true
-				});
-				await this.ledger.put(row);
-				this.logger.info("recorder: adopted a closed hour the disk walk rebuilt and the ledger never held", {
+				}));
+				this.logger.info("recorder: adopted a closed hour the disk listing rebuilt and the ledger never held", {
 					tags: { deviceId },
 					meta: {
 						profile,
 						locationId,
 						hourStartMs: hour,
-						segments: row.segments,
-						bytes: row.bytes
+						segments: walked.segments,
+						bytes: walked.bytes
 					}
 				});
 				return {
 					created: true,
-					added: row.paths.length,
+					added: walked.segments,
 					sealedNow: true
 				};
 			}
-			const held = await this.resident(key, deviceId);
-			if (held === null) return null;
-			const union = uniquePaths([...held.paths, ...paths]);
-			const added = union.length - held.paths.length;
-			if (added === 0 && held.sealed) return {
+			const shrink = held.segments - walked.segments;
+			if (shrink > 0 && shrink > held.segments * .5) {
+				this.logger.warn("recorder: hour listing REFUSED — it accounts for less than half of what this hour row holds, which is what an unmounted root looks like; the row stands and stays unsealed", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						locationId,
+						hourStartMs: hour,
+						held: held.segments,
+						listed: walked.segments,
+						maxShare: HOUR_LISTING_MAX_SHRINK_SHARE
+					}
+				});
+				return {
+					created: false,
+					added: 0,
+					sealedNow: false
+				};
+			}
+			const added = Math.max(0, walked.segments - held.segments);
+			if (added === 0 && shrink === 0 && held.sealed) return {
 				created: false,
 				added: 0,
 				sealedNow: false
 			};
-			await this.ledger.put(segmentHourRow({
-				...held,
-				paths: union,
+			if (shrink > 0) this.logger.info("recorder: hour listing accounts for FEWER segments than the row did — the directory decides", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					locationId,
+					hourStartMs: hour,
+					held: held.segments,
+					listed: walked.segments
+				}
+			});
+			await this.ledger.put(hourRowOf(identity, {
+				...walked,
 				sealed: true
 			}));
 			return {
@@ -9418,9 +9264,9 @@ var SegmentHourLedger = class SegmentHourLedger {
 	}
 	/**
 	* A finalize this ledger was NEVER handed — the fire-and-forget lane refused
-	* it. The hour's row is short by that path and this process is the only
-	* party that knows, so the hour must not be sealed by it; a reader walks it
-	* once instead, which is exactly what an unsealed row is for.
+	* it. The hour's row is short by that segment and this process is the only
+	* party that knows, so the hour must not be sealed by it; a listing corrects
+	* it instead, which is exactly what an unsealed row is for.
 	*/
 	markRefused(row) {
 		this.refused.add(hourOf(row).key);
@@ -9448,7 +9294,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 			marked += 1;
 		}
 		if (marked === 0) return 0;
-		this.logger.warn("recorder: segments this writer produced never reached the hour ledger — these hours stay UNSEALED and a reader walks them", {
+		this.logger.warn("recorder: segments this writer produced never reached the hour ledger — these hours stay UNSEALED and a listing corrects them", {
 			tags: { deviceId: span.deviceId },
 			meta: {
 				profile: span.profile,
@@ -9481,10 +9327,11 @@ var SegmentHourLedger = class SegmentHourLedger {
 						graceMs: WRITER_HOUR_ENTRY_GRACE_MS
 					}
 				});
+				this.accounted.delete(target.key);
 				return;
 			}
 			if (this.refused.has(target.key) || this.refusedWriterHours.has(writerHourKey(target.deviceId, target.profile, target.hourStartMs))) {
-				this.logger.warn("recorder: hour left unsealed — a ledger write for it was refused, so its row is short and a reader must walk it", {
+				this.logger.warn("recorder: hour left unsealed — a ledger write for it was refused, so its row is short and a listing must correct it", {
 					tags: { deviceId: target.deviceId },
 					meta: {
 						profile: target.profile,
@@ -9492,10 +9339,12 @@ var SegmentHourLedger = class SegmentHourLedger {
 						hourStartMs: target.hourStartMs
 					}
 				});
+				this.accounted.delete(target.key);
 				return;
 			}
-			const held = await this.resident(target.key, target.deviceId);
-			if (held === null || held.sealed) return;
+			const held = this.ledger.get(target.key);
+			this.accounted.delete(target.key);
+			if (held === void 0 || held.sealed) return;
 			await this.ledger.put({
 				...held,
 				sealed: true
@@ -9523,11 +9372,25 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/**
 	* Run `fn` after every mutation already queued on `key`.
 	*
-	* A row is read, appended to and written back with awaits in between; two
-	* such runs on one key interleave, and the second write carries a paths
-	* array that never saw the first — the write-behind's own lost update. The
-	* lane makes "read, append, write" one step per key. A rejected step must
-	* not poison the lane: the next step still runs.
+	* It was the lost-update guard: a row was read from the STORE, folded into
+	* and written back with awaits in between, so two such runs on one key
+	* interleaved and the second write carried a path set that never saw the
+	* first — the sparse rows D451 found. Since D523 there is no store read on
+	* any of these paths (the mirror holds the whole row) and `DurableLedger.put`
+	* sets the mirror synchronously before it awaits the store, so every
+	* get→fold→put here is synchronous up to the mirror and the interleaving
+	* window is gone.
+	*
+	* What the lane still buys is the ORDER of the durable writes per hour key —
+	* a rollover seal fired without an await must not land over an append that
+	* was queued before it — and a handle for {@link flush} to wait on at
+	* shutdown. A rejected step must not poison the lane: the next step still
+	* runs.
+	*
+	* Note for anyone tempted to delete it: `segment-hour-seal.spec.ts` does NOT
+	* catch its removal any more, and says so. Pinning durable write ORDER needs
+	* a store whose latency a test can control, which `fakeSettingsStore` has no
+	* way to express.
 	*/
 	serialized(key, fn) {
 		const run = (this.lanes.get(key) ?? Promise.resolve()).then(fn, fn);
@@ -9539,116 +9402,59 @@ var SegmentHourLedger = class SegmentHourLedger {
 		return run;
 	}
 	/**
-	* Fetch whole rows for `keys` and promote them in the mirror.
+	* List the hour directories of `rows`, paced, and expand them into segment
+	* rows.
 	*
-	* Paged and yielding: an export window can name thousands of hours, and one
-	* `whereIn` over all of them would rebuild the very whole-archive response
-	* D287 removed. A page that FAILS ends the materialise and returns what
-	* landed — partial detail is real detail, and the caller's fallback (a disk
-	* walk, or refusing a write) is strictly safer than a guess.
-	*
-	* A row the store returns but this cannot parse is EVICTED from the mirror
-	* rather than left as a summary that can never become resident: it re-seeds
-	* cold on the next write, which is `DurableLedger`'s rule 4 and the only
-	* escape from an hour permanently frozen against its own writer.
+	* The one place the ledger touches the array. An hour whose listing FAILED
+	* takes no part in the caller's pass and is SAID — a branch that drops work
+	* silently reads as "there was nothing there", which for a drain or a prune
+	* is the difference between "moved everything" and "moved what it could see".
 	*/
-	async materialize(keys, deviceId) {
+	async listHours(rows, reason) {
 		const out = [];
-		if (keys.length === 0) return out;
-		const tags = deviceId === void 0 ? {} : { tags: { deviceId } };
-		for (let i = 0; i < keys.length; i += HOUR_DETAIL_PAGE) {
-			const page = keys.slice(i, i + HOUR_DETAIL_PAGE);
-			let records;
-			try {
-				records = await this.store.query.query({
-					collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-					filter: {
-						whereIn: { key: page },
-						limit: page.length
-					}
-				});
-			} catch (err) {
-				this.logger.warn("recorder: hour-detail point read failed — these hours stay summaries, and the caller walks the disk or declines the write", {
-					...tags,
+		if (rows.length === 0) return out;
+		const lister = this.listHour;
+		if (lister === null) {
+			this.logger.warn("recorder: no hour lister on this ledger — nothing that needs segment NAMES can run here", { meta: {
+				hours: rows.length,
+				reason
+			} });
+			return out;
+		}
+		let listed = 0;
+		for (const row of rows) {
+			const paths = await lister(row.locationId, row.deviceId, row.profile, row.hourStartMs);
+			if (paths === null) {
+				this.logger.warn("recorder: hour directory could not be listed — this hour takes NO part in this pass", {
+					tags: { deviceId: row.deviceId },
 					meta: {
-						collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-						asked: page.length,
-						materialized: out.length,
-						error: String(err)
+						profile: row.profile,
+						locationId: row.locationId,
+						hourStartMs: row.hourStartMs,
+						accounted: row.segments,
+						reason
 					}
 				});
-				return out;
+				continue;
 			}
-			for (const record of records) {
-				const row = recordToRow(record.id, record.data);
-				if (row === null) {
-					this.ledger.evict(record.id);
-					this.logger.warn("recorder: hour row is unparseable — dropping the summary so the hour re-seeds cold instead of freezing its writer", {
-						...tags,
-						meta: { key: record.id }
-					});
-					continue;
+			const { rows: segments, unparseable } = segmentRowsOf(row.locationId, paths);
+			if (unparseable > 0) this.logger.warn("recorder: hour directory holds names that are not segments", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					profile: row.profile,
+					locationId: row.locationId,
+					hourStartMs: row.hourStartMs,
+					unparseable,
+					reason
 				}
-				this.ledger.stage(row);
-				out.push(row);
-			}
-			if (i + HOUR_DETAIL_PAGE < keys.length) await this.yieldBetween();
+			});
+			out.push(...segments);
+			listed += 1;
+			if (listed % 8 === 0) await this.yieldBetween();
 		}
 		return out;
 	}
 	/**
-	* Materialise every hour these devices hold, and report how many stayed
-	* summaries.
-	*
-	* The reconcile is the one path that DELETES durable rows, so it may not run
-	* against a mirror that only half knows what it holds. This is a whole-device
-	* read and it is deliberately confined here: `reconcileFromIndex` follows an
-	* operator-armed rescan of that same device — a recursive `readdir` over
-	* >1M files — so a paged point read alongside it is noise, and it is the one
-	* caller whose correctness depends on completeness.
-	*/
-	async materializeDevices(deviceIds) {
-		const keys = [];
-		for (const row of this.ledger.snapshot()) if (!row.pathsResident && deviceIds.has(row.deviceId)) keys.push(row.key);
-		if (keys.length === 0) return;
-		await this.materialize(keys);
-		const stillSummary = /* @__PURE__ */ new Map();
-		for (const row of this.ledger.snapshot()) {
-			if (row.pathsResident || !deviceIds.has(row.deviceId)) continue;
-			stillSummary.set(row.deviceId, (stillSummary.get(row.deviceId) ?? 0) + 1);
-		}
-		for (const [deviceId, unreadable] of stillSummary) this.logger.warn("recorder: hours without readable detail take NO part in this reconcile — they are neither pruned nor unioned", {
-			tags: { deviceId },
-			meta: {
-				asked: keys.length,
-				unreadable
-			}
-		});
-	}
-	/** The hour a write path may touch: current + previous. Materialised at boot
-	*  so {@link recordSegment}'s dedup gate answers from RAM (D49). */
-	async materializeLiveTail() {
-		const oldest = hourStartMs(this.now()) - (LIVE_TAIL_HOURS - 1) * HOUR_MS$4;
-		const keys = [];
-		for (const row of this.ledger.snapshot()) if (row.hourStartMs >= oldest && !row.pathsResident) keys.push(row.key);
-		return (await this.materialize(keys)).length;
-	}
-	/**
-	* Promote one HELD row to paths-resident, or answer `null`.
-	*
-	* `null` means "this hour is known and its detail could not be had" — the
-	* only honest answer to a failed point read, and every caller turns it into
-	* "do nothing". It is deliberately distinct from `this.ledger.get(key) ===
-	* undefined`, which means "no such hour" and is what licenses a fresh row.
-	*/
-	async resident(key, deviceId) {
-		const held = this.ledger.get(key);
-		if (held !== void 0 && held.pathsResident) return held;
-		await this.materialize([key], deviceId);
-		const after = this.ledger.get(key);
-		return after !== void 0 && after.pathsResident ? after : null;
-	}
-	/**
 	* Bytes / count / oldest / newest across a SET of storage locations, as ONE
 	* `SUM`/`COUNT`/`MIN`/`MAX` over the hour rows.
 	*
@@ -9689,9 +9495,9 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* ## Why two phases
 	*
 	* Phase one reads only the small columns and walks oldest-first until the
-	* accumulated bytes cover the target — normally one page. `paths` is by far
-	* the fattest column in the row and phase one never touches it. Phase two
-	* fetches paths for exactly the hours phase one chose.
+	* accumulated bytes cover the target — normally one page. Phase two LISTS the
+	* hour directories phase one chose, which is the only thing that can name the
+	* files eviction is about to delete (D523).
 	*
 	* `exhausted` means the stream ran out before the target was met — the
 	* caller's stop condition, and the one thing a bounded read must still be
@@ -9725,11 +9531,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/**
 	* Every camera the ledger holds an hour for on these locations.
 	*
-	* Answered from T1 — the always-resident hour summary, which carries
-	* `deviceId` and `locationId` — exactly like {@link profilesWithFootage},
-	* and for the same reason: this is an O(writers × days) question and it must
-	* cost no I/O. It runs on the disk-pressure path, where an I/O that fails
-	* would have to be turned into a verdict.
+	* Answered from the mirror, exactly like {@link profilesWithFootage}, and for
+	* the same reason: this is an O(writers × days) question and it must cost no
+	* I/O. It runs on the disk-pressure path, where an I/O that fails would have
+	* to be turned into a verdict.
 	*
 	* An EMPTY answer is "the mirror knows no hour here", which is also what a
 	* ledger whose load failed reports — so the caller must treat it as "decide
@@ -9744,7 +9549,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* Bytes / segments / oldest / newest per CAMERA on these locations — the
 	* per-camera half of the storage page, answered by the ARCHIVE (D418).
 	*
-	* ## Why the T1 fold and not `census({ deviceId })` per camera
+	* ## Why the mirror fold and not `census({ deviceId })` per camera
 	*
 	* `census` is the right authority for a SCOPE, and it cannot express this
 	* scope: {@link SegmentHourLedger.predicate} takes ONE `locationId`, so
@@ -9754,14 +9559,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* accounts for. Per camera per volume that is `cameras × volumes` SQL
 	* aggregates for one operator click, and it grows with the fleet.
 	*
-	* The T1 hour summary answers all of them in ONE pass with no I/O, exactly
-	* as {@link devicesWithFootage} and {@link profilesWithFootage} already do,
-	* and it is the same rows `accountingForLocations` sums in SQL — the mirror
-	* is write-behind, so it is never BEHIND the store. The cost is one pass
-	* over the hour rows the mirror holds — O(writers × profiles × hours), ~19 k
-	* on the live hub (see {@link REPAIR_MAX_ROWS}) against 98 445 segments,
-	* i.e. it does NOT scale with the segment count — and it is capped for good
-	* by {@link SEGMENT_HOUR_SUMMARY_LIMIT}, the mirror's own ceiling.
+	* The mirror answers all of them in ONE pass with no I/O, exactly as
+	* {@link devicesWithFootage} and {@link profilesWithFootage} already do, and
+	* it is the same rows `accountingForLocations` sums in SQL — the mirror is
+	* write-behind, so it is never BEHIND the store.
 	*
 	* ## What an empty answer means
 	*
@@ -9835,44 +9636,28 @@ var SegmentHourLedger = class SegmentHourLedger {
 			rows: [],
 			exhausted: true
 		};
-		const full = await this.store.query.query({
-			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-			filter: {
-				whereIn: { key: chosen },
-				limit: chosen.length
-			}
-		});
-		const rows = [];
-		for (const record of full) {
-			const hour = recordToRow(record.id, record.data);
-			if (hour === null) continue;
-			this.ledger.stage(hour);
-			for (const path of hour.paths) {
-				const parsed = parseSegmentPath(path);
-				if (parsed === null) continue;
-				rows.push({
-					deviceId: parsed.deviceId,
-					profile: parsed.profile,
-					startMs: parsed.startMs,
-					durMs: parsed.durMs,
-					bytes: parsed.bytes,
-					path,
-					locationId: hour.locationId
-				});
-			}
-		}
 		return {
-			rows: rows.toSorted((a, b) => a.startMs - b.startMs),
+			rows: (await this.listHours(this.rowsOfKeys(chosen), "oldest-segments")).toSorted((a, b) => a.startMs - b.startMs),
 			exhausted
 		};
 	}
+	/** Mirror rows for keys a probe named. A key the mirror does not hold is
+	*  skipped: the probe and the mirror describe the same table, and an hour the
+	*  mirror never loaded is one this process may not act on. */
+	rowsOfKeys(keys) {
+		const out = [];
+		for (const key of keys) {
+			const row = this.ledger.get(key);
+			if (row !== void 0) out.push(row);
+		}
+		return out;
+	}
 	/**
 	* The predicate half of an {@link ArchiveScope}, as one filter.
 	*
 	* REFUSES an empty scope rather than compiling to "the whole collection".
-	* There is no read here that may be unscoped: at 30 TB the unscoped form is
-	* the ~460 MB boot query D287 deleted, and a helper that quietly allows it is
-	* how that query comes back under a new name.
+	* There is no read here that may be unscoped: an unscoped stream lists every
+	* hour directory on the hub.
 	*/
 	static predicate(scope) {
 		const where = {};
@@ -9885,6 +9670,15 @@ var SegmentHourLedger = class SegmentHourLedger {
 			...profiles.length > 0 ? { whereIn: { profile: [...profiles] } } : {}
 		};
 	}
+	/** Does this row fall inside `scope`? The mirror-side twin of
+	*  {@link SegmentHourLedger.predicate}, for the passes that fold the mirror
+	*  instead of querying. */
+	static inScope(row, scope) {
+		if (scope.locationId !== void 0 && row.locationId !== scope.locationId) return false;
+		if (scope.deviceId !== void 0 && row.deviceId !== scope.deviceId) return false;
+		const profiles = scope.profiles ?? [];
+		return profiles.length === 0 || profiles.includes(row.profile);
+	}
 	/**
 	* What the ARCHIVE holds in this scope — segments and bytes, as ONE
 	* `SUM` over the hour rows.
@@ -9928,6 +9722,15 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/**
 	* Every segment in `scope`, oldest-first, ONE PAGE at a time.
 	*
+	* ## Two phases, and which authority answers which
+	*
+	* Phase one asks the TABLE which hours the scope holds, oldest-first — the
+	* ordered aggregate no directory read can answer. Phase two LISTS those hour
+	* directories, which is the only authority for the file names the caller is
+	* about to move or delete (D523). An hour whose listing fails is skipped and
+	* said; the caller's own N-versus-M report is what makes the short walk
+	* visible.
+	*
 	* ## Why a keyset cursor and not `offset`
 	*
 	* Both callers MUTATE the scope while they walk it: the drain re-points each
@@ -9944,10 +9747,9 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*
 	* ## What a failed read does
 	*
-	* It ENDS the stream (D49: a fallible read destroys nothing) — and the
-	* caller's own N-versus-M report is what makes the short walk visible. A
-	* stream that swallowed the error and returned would be indistinguishable
-	* from a scope that was genuinely empty.
+	* It ENDS the stream (D49: a fallible read destroys nothing). A stream that
+	* swallowed the error and returned would be indistinguishable from a scope
+	* that was genuinely empty.
 	*/
 	async *streamSegments(scope) {
 		const predicate = SegmentHourLedger.predicate(scope);
@@ -10000,8 +9802,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 			if (nextCursor !== cursor) emittedAtCursor = /* @__PURE__ */ new Set();
 			for (const record of fresh) if (hourOfRecord(record) === nextCursor) emittedAtCursor.add(record.id);
 			cursor = nextCursor;
-			const rows = await this.rowsForHours(fresh.map((record) => record.id), scope);
-			if (rows.length > 0) yield rows;
+			const rows = await this.listHours(this.rowsOfKeys(fresh.map((record) => record.id)), "archive-stream");
+			if (rows.length > 0) yield rows.toSorted((a, b) => a.startMs - b.startMs);
 			if (probe.length < 128 && fresh.length === probe.length) return;
 		}
 		this.logger.warn("recorder: archive stream hit its page backstop — the rest of this scope was NOT walked", {
@@ -10015,110 +9817,50 @@ var SegmentHourLedger = class SegmentHourLedger {
 		});
 	}
 	/**
-	* Phase two of {@link streamSegments}: the paths of exactly the hours phase
-	* one chose, expanded into segment rows.
+	* Forget every hour row in `scope` — the durable half of an operator's
+	* "discard this location's footage".
+	*
+	* It exists because the files are already GONE by the time it runs: the
+	* discard wipes the class subtrees first, so every hour directory in the
+	* scope answers ENOENT and nothing that needs a listing can name a single
+	* segment. The rows are forgotten by their own identity instead, and the
+	* count returned is the SEGMENTS they accounted for, which is the number the
+	* operator is shown.
 	*
-	* Staged into the mirror on the way through, exactly as `oldestSegments`
-	* does and for the same reason: both consumers immediately call a write path
-	* (`repointSegments` / `dropSegments`) which needs the hour paths-resident,
-	* and which `forget`s the row as it empties — so the staging is
-	* self-cleaning and the alternative is two reads per hour.
+	* Never reachable except from that explicitly-armed action: this is the one
+	* surface here that deletes durable rows with no evidence from the array at
+	* all, because the operator's own instruction is the evidence.
 	*/
-	async rowsForHours(keys, scope) {
-		if (keys.length === 0) return [];
-		let records;
-		try {
-			records = await this.store.query.query({
-				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				filter: {
-					whereIn: { key: [...keys] },
-					limit: keys.length
-				}
-			});
-		} catch (err) {
-			this.logger.warn("recorder: archive page detail unavailable — these hours take NO part in this pass", {
-				...scope.deviceId !== void 0 ? { tags: { deviceId: scope.deviceId } } : {},
-				meta: {
-					collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-					hours: keys.length,
-					error: String(err)
-				}
-			});
-			return [];
-		}
-		const rows = [];
-		for (const record of records) {
-			const hour = recordToRow(record.id, record.data);
-			if (hour === null) continue;
-			this.ledger.stage(hour);
-			for (const path of hour.paths) {
-				const parsed = parseSegmentPath(path);
-				if (parsed === null) continue;
-				rows.push({
-					deviceId: parsed.deviceId,
-					profile: parsed.profile,
-					startMs: parsed.startMs,
-					durMs: parsed.durMs,
-					bytes: parsed.bytes,
-					path,
-					locationId: hour.locationId
-				});
-			}
-		}
-		return rows.toSorted((a, b) => a.startMs - b.startMs);
-	}
 	/**
-	* Rewrite, once, the rows whose aggregate columns are still the schema
-	* default.
+	* Forget ONE hour row outright, and answer the segments it accounted for.
 	*
-	* `declareCollection` adds a column additively, so every row written before
-	* the aggregate columns existed holds `segments = 0` — and an hour row with
-	* no segments cannot exist any other way (`dropSegments` forgets an hour that
-	* empties). So `segments = 0` IS the backfill predicate, and after one pass
-	* it selects nothing. A partial repair finishes on the next boot; until then
-	* the affected disks UNDER-report, which prunes less and never more.
+	* The caller must have TRUSTED evidence that the hour holds nothing — a
+	* directory listing under a volume anchor that agreed twice (D49), or a
+	* per-path confirmation against every root there is. This method makes no
+	* such check itself and can make none: it is handed a verdict, not evidence.
 	*
-	* Since D287 the boot load carries no `paths`, and `paths` is the authority
-	* this repair derives from — so the stale rows are MATERIALISED first, at
-	* most {@link REPAIR_MAX_MATERIALIZE} per boot. That bound is the point: an
-	* unbounded materialise here would be the whole-archive read this stage
-	* removed, wearing a different name.
+	* It exists because {@link adoptWalkedHour} deliberately refuses an EMPTY
+	* listing — "the walk found nothing" is what an unmounted root looks like —
+	* so the one repair a listing cannot express is the one that empties an hour.
 	*/
-	async repairAggregates() {
-		let repaired = 0;
-		try {
-			const stale = await this.store.query.query({
-				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				columns: REPAIR_PROBE_COLUMNS,
-				filter: {
-					where: { segments: 0 },
-					limit: REPAIR_MAX_ROWS
-				}
-			});
-			const pending = stale.map((record) => record.id).filter((key) => this.ledger.get(key)?.pathsResident === false);
-			if (pending.length > REPAIR_MAX_MATERIALIZE) this.logger.info("recorder: segment-hour aggregate backfill is bounded this boot — the rest is repaired on the next one", { meta: {
-				pending: pending.length,
-				perBoot: REPAIR_MAX_MATERIALIZE
-			} });
-			await this.materialize(pending.slice(0, REPAIR_MAX_MATERIALIZE));
-			for (const record of stale) {
-				const held = this.ledger.get(record.id);
-				if (held === void 0 || !held.pathsResident || held.segments === 0) continue;
-				await this.ledger.put(held);
-				repaired += 1;
-			}
-		} catch (err) {
-			this.logger.warn("recorder: segment-hour aggregate repair failed — disks under-report", { meta: {
-				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				error: String(err)
-			} });
-			return repaired;
+	async forgetHour(deviceId, profile, locationId, hour) {
+		const key = segmentHourKey(deviceId, profile, locationId, hour);
+		return this.serialized(key, async () => {
+			const held = this.ledger.get(key);
+			if (held === void 0) return 0;
+			await this.ledger.forget(key);
+			this.accounted.delete(key);
+			return held.segments;
+		});
+	}
+	async forgetScope(scope) {
+		let forgotten = 0;
+		for (const row of this.ledger.snapshot()) {
+			if (!SegmentHourLedger.inScope(row, scope)) continue;
+			await this.ledger.forget(row.key);
+			forgotten += row.segments;
 		}
-		if (repaired > 0) this.logger.info("recorder: segment-hour aggregate columns backfilled", { meta: {
-			rows: repaired,
-			collection: RECORDING_SEGMENT_HOURS_COLLECTION
-		} });
-		return repaired;
+		return forgotten;
 	}
 	/**
 	* Write-behind: a just-finalized segment joins its hour row.
@@ -10126,8 +9868,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* THE hot path — every profile-writer lands here every `segmentSeconds`,
 	* ~3.4 times a second fleet-wide. The append is {@link appendSegmentPath}:
 	* one `parseSegmentPath` and four scalar updates, whatever the hour already
-	* holds. It used to re-derive the whole hour, which made one hour
-	* O(N²) — 65 k parses at 360 segments, 1.46 M in a restart-storm hour.
+	* holds — and since D523 it needs no read of the store at all, because the
+	* mirror carries the whole row.
 	*/
 	async recordSegment(row) {
 		const { key, hourStartMs: hour } = hourOf(row);
@@ -10140,7 +9882,12 @@ var SegmentHourLedger = class SegmentHourLedger {
 			entryMs: row.startMs
 		});
 		await this.serialized(key, async () => {
-			if (!this.ledger.has(key)) {
+			const seen = this.accounted.get(key);
+			if (seen !== void 0 && seen.has(row.path)) return;
+			if (seen === void 0) this.accounted.set(key, new Set([row.path]));
+			else seen.add(row.path);
+			const held = this.ledger.get(key);
+			if (held === void 0) {
 				await this.ledger.put(segmentHourRow({
 					key,
 					deviceId: row.deviceId,
@@ -10151,25 +9898,19 @@ var SegmentHourLedger = class SegmentHourLedger {
 				}));
 				return;
 			}
-			const held = await this.resident(key, row.deviceId);
-			if (held === null) {
-				this.refused.add(key);
-				this.logger.warn("recorder: hour detail unavailable — this finalized segment is NOT in the durable hour row yet", {
-					tags: { deviceId: row.deviceId },
-					meta: {
-						key,
-						path: row.path
-					}
-				});
-				return;
-			}
-			if (held.paths.includes(row.path)) return;
 			await this.ledger.put(appendSegmentPath(held, row.path));
 		});
 	}
 	/**
-	* Eviction confirmed these paths are gone from disk. Drop them; forget the
-	* hour when it holds nothing.
+	* Eviction confirmed these segments are gone from disk. Take them out of the
+	* hour's account; forget the hour when nothing is left.
+	*
+	* The aggregate shrinks by exactly what was removed. `minStartMs` /
+	* `maxStartMs` are NOT re-derived — they cannot be, without a listing — so a
+	* partly-evicted hour keeps extremes that may be older or newer than what
+	* survives. That error is bounded by the hour itself (both values always lie
+	* inside `[hourStartMs, hourStartMs + 1h)`), and the row is UNSEALED so the
+	* next listing of it re-derives both exactly.
 	*/
 	async dropSegments(rows) {
 		const doomed = /* @__PURE__ */ new Map();
@@ -10179,70 +9920,50 @@ var SegmentHourLedger = class SegmentHourLedger {
 			if (entry === void 0) {
 				doomed.set(key, {
 					deviceId: row.deviceId,
-					paths: new Set([row.path])
-				});
-				continue;
-			}
-			entry.paths.add(row.path);
-		}
-		for (const [key, { deviceId, paths }] of doomed) {
-			if (!this.ledger.has(key)) continue;
-			const held = await this.resident(key, deviceId);
-			if (held === null) {
-				this.logger.warn("recorder: hour detail unavailable — these evicted paths stay in the durable hour row until a walk or the next eviction confirms them", {
-					tags: { deviceId },
-					meta: {
-						key,
-						paths: paths.size
-					}
+					bytes: row.bytes,
+					segments: 1
 				});
 				continue;
 			}
-			const next = held.paths.filter((p) => !paths.has(p));
-			if (next.length === 0) {
+			entry.bytes += row.bytes;
+			entry.segments += 1;
+		}
+		for (const [key, dropped] of doomed) await this.serialized(key, async () => {
+			const held = this.ledger.get(key);
+			if (held === void 0) return;
+			const segments = held.segments - dropped.segments;
+			if (segments <= 0) {
 				await this.ledger.forget(key);
-				continue;
+				this.accounted.delete(key);
+				return;
 			}
-			if (next.length === held.paths.length) continue;
-			await this.ledger.put(segmentHourRow({
+			await this.ledger.put({
 				...held,
-				paths: next
-			}));
-		}
+				sealed: false,
+				segments,
+				bytes: Math.max(0, held.bytes - dropped.bytes)
+			});
+		});
 	}
 	/**
-	* Move `rows` from the hour rows they are listed in today to the SAME hours
+	* Move `rows` from the hour they are accounted under today to the SAME hour
 	* at `toLocationId` — the DURABLE half of a relocation.
 	*
-	* Without this the mover re-points only `RecordingIndex`, which is RAM. Since
-	* D287 a closed hour is hydrated from the ledger FIRST and the disk is not
-	* consulted at all when the ledger covered the window, so a relocated hour
-	* comes back at its OLD location on the next boot — paths under a root that
-	* no longer holds the file. Playback does not stat (that syscall per segment
-	* was removed deliberately), so the result is a silent black window; and once
-	* the drained location is deleted, `collectRangeSegments` drops the rows
-	* outright and the footage is invisible. That is the shape of the 2 131
-	* `recordings:high` ghost segments already on this hub.
+	* Without this the mover re-points only `RecordingIndex`, which is RAM, and
+	* the drained location keeps the bytes on every storage page for the life of
+	* the hub. That is the shape of the 2 131 `recordings:high` ghost rows this
+	* hub carried.
 	*
 	* **The ordering is the invariant, not an implementation detail.** The
 	* destination row is written BEFORE the source row is shrunk, and the caller
 	* has not yet deleted the source bytes — so the only state a crash can leave
-	* is "listed at BOTH locations, both of which hold the file", which resolves
-	* correctly whichever row hydrate happens to apply last. The reverse order
-	* has a window in which the path is in NO row, and a ledger-known hour marks
-	* the index `hydrated`: nothing would ever walk that hour again, and the
-	* segment would sit on disk permanently unreachable.
-	*
-	* **Two path sets, not one.** A path can arrive at the target under a
-	* DIFFERENT name than it leaves the source under: a mover that found a file
-	* larger than its recorded size reconciles the row, and the byte count is
-	* part of the name. So the source row is shrunk by what is LEAVING it and the
-	* target row grows by what is ARRIVING — conflating them would leave the
-	* source row naming a file the caller is about to delete.
+	* is "accounted at BOTH locations, both of which hold the files", which a
+	* listing of either hour resolves. The reverse order has a window in which
+	* the segments are accounted NOWHERE.
 	*
-	* Returns `false` when NOTHING was repointed and the caller must delete
-	* nothing. An hour whose detail could not be read decides nothing (D49) —
-	* the same refusal {@link dropSegments} makes for eviction.
+	* Both rows come out UNSEALED: each carries an aggregate that arithmetic
+	* moved rather than a listing derived, and the next walk of either hour fixes
+	* whatever the arithmetic rounded.
 	*/
 	async repointSegments(rows, toLocationId) {
 		const byHour = /* @__PURE__ */ new Map();
@@ -10250,87 +9971,75 @@ var SegmentHourLedger = class SegmentHourLedger {
 			if (row.locationId === toLocationId) continue;
 			const { key } = hourOf(row);
 			const entry = byHour.get(key);
-			if (entry === void 0) byHour.set(key, {
-				row,
-				leaving: new Set([row.fromPath ?? row.path]),
-				arriving: new Set([row.path])
-			});
-			else {
-				entry.leaving.add(row.fromPath ?? row.path);
-				entry.arriving.add(row.path);
-			}
-		}
-		for (const [sourceKey, { row, leaving, arriving }] of byHour) {
-			const held = await this.resident(sourceKey, row.deviceId);
-			if (held === null) {
-				this.logger.warn("recorder: hour detail unavailable — this relocation is REFUSED and nothing is deleted; the segments stay where they are", {
-					tags: { deviceId: row.deviceId },
-					meta: {
-						key: sourceKey,
-						toLocationId,
-						paths: leaving.size
-					}
-				});
-				return false;
-			}
-			const targetKey = segmentHourKey(row.deviceId, row.profile, toLocationId, held.hourStartMs);
-			const target = this.ledger.has(targetKey) ? await this.resident(targetKey, row.deviceId) : void 0;
-			if (target === null) {
-				this.logger.warn("recorder: TARGET hour detail unavailable — this relocation is REFUSED; appending to a summary would rewrite the hour as these paths alone", {
-					tags: { deviceId: row.deviceId },
-					meta: {
-						key: targetKey,
-						fromLocationId: row.locationId,
-						paths: arriving.size
-					}
+			if (entry === void 0) {
+				byHour.set(key, {
+					row,
+					bytes: row.bytes,
+					segments: 1,
+					minStartMs: row.startMs,
+					maxStartMs: row.startMs
 				});
-				return false;
+				continue;
 			}
-			const merged = uniquePaths([...target?.paths ?? [], ...arriving]);
-			await this.ledger.put(segmentHourRow({
+			entry.bytes += row.bytes;
+			entry.segments += 1;
+			entry.minStartMs = Math.min(entry.minStartMs, row.startMs);
+			entry.maxStartMs = Math.max(entry.maxStartMs, row.startMs);
+		}
+		for (const [sourceKey, moved] of byHour) {
+			const hour = hourStartMs(moved.row.startMs);
+			const targetKey = segmentHourKey(moved.row.deviceId, moved.row.profile, toLocationId, hour);
+			const target = this.ledger.get(targetKey);
+			const targetIdentity = {
 				key: targetKey,
-				deviceId: row.deviceId,
-				profile: row.profile,
+				deviceId: moved.row.deviceId,
+				profile: moved.row.profile,
 				locationId: toLocationId,
-				hourStartMs: held.hourStartMs,
-				paths: merged
+				hourStartMs: hour
+			};
+			const targetEmpty = target === void 0 || target.segments === 0;
+			await this.ledger.put(hourRowOf(targetIdentity, {
+				sealed: false,
+				bytes: (target?.bytes ?? 0) + moved.bytes,
+				segments: (target?.segments ?? 0) + moved.segments,
+				minStartMs: targetEmpty ? moved.minStartMs : Math.min(target.minStartMs, moved.minStartMs),
+				maxStartMs: targetEmpty ? moved.maxStartMs : Math.max(target.maxStartMs, moved.maxStartMs)
 			}));
-			const next = held.paths.filter((p) => !leaving.has(p));
-			if (next.length === 0) await this.ledger.forget(sourceKey);
-			else await this.ledger.put(segmentHourRow({
+			const held = this.ledger.get(sourceKey);
+			if (held === void 0) continue;
+			const segments = held.segments - moved.segments;
+			if (segments <= 0) {
+				await this.ledger.forget(sourceKey);
+				continue;
+			}
+			await this.ledger.put({
 				...held,
-				paths: next
-			}));
+				sealed: false,
+				segments,
+				bytes: Math.max(0, held.bytes - moved.bytes)
+			});
 		}
-		return true;
 	}
 	/**
-	* After a disk walk of `deviceIds`, make the ledger match the index — with
-	* two D148 exceptions:
+	* After a disk walk of `deviceIds`, make the ledger match what the index now
+	* holds — with two D148 exceptions:
 	*
 	*  - an hour the walk did not see is dropped ONLY if it is in the past;
 	*    the current hour may still hold a live writer whose file the readdir
 	*    raced;
-	*  - the current hour UNIONs ledger paths with index paths rather than
-	*    replacing, for the same race.
+	*  - the current hour takes the LARGER of the two accounts rather than the
+	*    walk's, for the same race.
 	*
 	* Devices not in `deviceIds` are left untouched (a partial walk must not
 	* prune cameras it did not look at).
 	*
 	* And a walk this ledger does not TRUST prunes nothing at all — see
-	* {@link refusedPrunes}. What such a walk FOUND is still real, so its paths
-	* are unioned in; what it did not find decides nothing (D49).
-	*
-	* Since D287 the walked devices' hours are MATERIALISED first: every
-	* comparison below reads `row.paths`, and a summary's empty `paths` would
-	* read as "the ledger holds nothing here" — which is the union collapsing to
-	* the walk's own view, i.e. the prune the refusal machinery exists to
-	* prevent. An hour whose detail could not be read is left additive-only.
+	* {@link refusedPrunes}. What such a walk FOUND is still real, so its larger
+	* account is taken; what it did not find decides nothing (D49).
 	*/
 	async reconcileFromIndex(index, deviceIds, nowMs) {
 		const walked = new Set(deviceIds);
 		const currentHour = hourStartMs(nowMs);
-		await this.materializeDevices(walked);
 		const fromIndex = /* @__PURE__ */ new Map();
 		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
 			const { key, hourStartMs: hour } = hourOf(seg);
@@ -10349,7 +10058,6 @@ var SegmentHourLedger = class SegmentHourLedger {
 		const refused = this.refusedPrunes(walked, fromIndex);
 		for (const row of this.ledger.snapshot()) {
 			if (!walked.has(row.deviceId)) continue;
-			if (!row.pathsResident) continue;
 			const disk = fromIndex.get(row.key);
 			const additiveOnly = row.hourStartMs === currentHour || refused.devices.has(row.deviceId) || refused.locations.has(locationKey(row.deviceId, row.locationId));
 			if (disk === void 0) {
@@ -10358,14 +10066,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 				continue;
 			}
 			if (additiveOnly) {
-				const union = uniquePaths([...disk.paths, ...row.paths]);
-				if (!samePaths(union, row.paths)) await this.ledger.put(segmentHourRow({
-					...row,
-					paths: union
-				}));
+				if (disk.segments > row.segments) await this.ledger.put(disk);
 				continue;
 			}
-			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
+			if (disk.segments !== row.segments || disk.bytes !== row.bytes) await this.ledger.put(disk);
 		}
 		for (const [key, disk] of fromIndex) {
 			if (this.ledger.has(key)) continue;
@@ -10484,44 +10188,45 @@ function locationKey(deviceId, locationId) {
 * skips it forever. Under D148 as written, a ghost row can never be forgotten
 * by any mechanism — which is why the live ones have stood for thirteen days.
 *
-* The resolution is that a walk is not the only trusted confirmation; it is a
-* BULK one. The paths in an hour row are relative to a root
-* (`590/high/2026/08/15/04/…m4s`), so each one can be resolved against every
-* currently-resolvable root and asked about directly. **Per-path
-* `storage.exists`, over every candidate root, for EVERY path of the hour, is
-* the same confirmation a walk gives — done one syscall at a time instead of
-* one `readdir` at a time.** That, and nothing weaker, is what licenses the
+* The resolution is that the ghost row's root does not resolve but its hour
+* DIRECTORY is addressable anywhere: the path convention
+* (`590/high/2026/08/15/04/`) is a function of the row's own fields, so the same
+* hour can be listed under every currently-resolvable root. **A listing of the
+* hour directory at every candidate root is exactly the walk D148 sanctions,
+* done one root at a time.** That, and nothing weaker, is what licenses the
 * forget. Two consequences ride with it:
 *
-* - **Sampling is not evidence.** An hour is forgotten only when every one of
-*   its paths came back absent from every root. One unprobed path and the hour
-*   stands.
-* - **An error is not an absence** (D49). A probe that THROWS ends the hour
-*   with nothing decided — never "not found".
+* - **Every root must answer.** An hour is forgotten only when every candidate
+*   root listed its directory and every one of them came back EMPTY. One root
+*   that could not answer and the hour stands.
+* - **An error is not an absence** (D49). A listing that fails, or that reports
+*   "I could not decide", ends the hour with nothing decided — never "not
+*   found". Whether an absent directory means "empty" or "this disk is gone" is
+*   the lister's question, and it answers it by reading the ROOT.
+*
+* Until D523 this probed each of the row's `paths` at each root, one
+* `storage.exists` at a time — up to ~1 000 syscalls to prove one hour absent.
+* The column is gone and the row names no file, so the unit is the directory,
+* which is both cheaper and the same evidence.
 *
 * ## Repoint versus forget
 *
 * The asymmetry is the whole safety argument, and it is deliberately cheap in
 * the safe direction:
 *
-* - **one path found anywhere ⇒ the row is MIS-POINTED, not orphaned.** It is
-*   repointed to that root's location and the hour is finished — no further
-*   probing. A renamed or re-created location produces exactly this shape, and
-*   deleting here would destroy the index of footage that EXISTS, which is the
-*   failure D291 was written to prevent.
-* - **every path absent everywhere ⇒ orphaned**, and only then forgotten.
-*
-* So proving presence costs one probe and proving absence costs all of them,
-* which is the right way round: the expensive proof is the destructive one.
+* - **a non-empty listing at any root ⇒ the row is MIS-POINTED, not orphaned.**
+*   It is repointed to that root's location, with the segments that listing
+*   names, and the hour is finished. A renamed or re-created location produces
+*   exactly this shape, and deleting here would destroy the index of footage
+*   that EXISTS, which is the failure D291 was written to prevent.
+* - **every root lists an EMPTY hour ⇒ orphaned**, and only then forgotten.
 *
 * ## Pacing
 *
-* The recordings array is saturated and slow (a `readdir` of one hour
-* directory measured ~650 ms under load, and a `find` over it hung an SSH
-* session on 2026-08-29). This is a janitor: bounded hours per pass, a hard
-* probe ceiling, and a caller-supplied `pace()` awaited between probe batches.
-* Work it does not finish is left for the next pass and REPORTED, never
-* silently dropped.
+* The recordings array is the resource every live read competes for. This is a
+* janitor: bounded hours per pass, a hard probe ceiling, and a caller-supplied
+* `pace()` awaited between probe batches. Work it does not finish is left for
+* the next pass and REPORTED, never silently dropped.
 */
 var HOUR_MS$3 = 36e5;
 /**
@@ -10670,22 +10375,12 @@ var GhostLocationSweeper = class {
 				refuse(row, "live-tail", `hourStartMs=${row.hourStartMs}`);
 				continue;
 			}
-			const paths = await this.deps.ledger.hourPaths(row.deviceId, row.profile, row.locationId, row.hourStartMs);
-			if (paths === null) {
-				refuse(row, "detail-unavailable", "point read failed");
-				continue;
-			}
-			if (paths.length === 0) {
-				refuse(row, "no-paths", "the row materialised empty");
-				continue;
-			}
-			const rows = this.rowsOf(row, paths);
-			if (rows === null) {
-				refuse(row, "unparseable-paths", "a path does not parse into this hour");
+			if (row.segments === 0) {
+				refuse(row, "no-paths", "the row accounts for no segments");
 				continue;
 			}
 			const before = probes;
-			const verdict = await this.probeHour(rows, roots, maxProbes - probes);
+			const verdict = await this.probeHour(row, roots, maxProbes - probes, probes);
 			probes += verdict.probes;
 			tallyOf(row.deviceId).probes += probes - before;
 			if (verdict.outcome.kind === "refused") {
@@ -10694,10 +10389,12 @@ var GhostLocationSweeper = class {
 			}
 			if (verdict.outcome.kind === "found") {
 				const target = locationForHydratedProfile(verdict.outcome.root.aliases, row.profile);
-				if (!await this.deps.ledger.repointSegments(rows, target.id)) {
-					refuse(row, "durable-refused", `repoint to ${target.id} refused`);
+				const rows = this.rowsOf(row, verdict.outcome.paths);
+				if (rows === null) {
+					refuse(row, "unparseable-paths", "a listed name does not parse into this hour");
 					continue;
 				}
+				await this.deps.ledger.repointSegments(rows, target.id);
 				this.deps.applyToIndex(rows, target.id);
 				repointedHours += 1;
 				segmentsRepointed += rows.length;
@@ -10707,19 +10404,19 @@ var GhostLocationSweeper = class {
 				tally.targets.add(target.id);
 				continue;
 			}
-			await this.deps.ledger.dropSegments(rows);
+			const forgotten = await this.deps.ledger.forgetHour(row.deviceId, row.profile, row.locationId, row.hourStartMs);
 			if (this.deps.ledger.knowsHour(row.deviceId, row.profile, row.locationId, row.hourStartMs)) {
-				refuse(row, "durable-refused", "the ledger still holds the hour after the drop");
+				refuse(row, "durable-refused", "the ledger still holds the hour after the forget");
 				continue;
 			}
-			this.deps.applyToIndex(rows, null);
+			this.deps.forgetInIndex(row.deviceId, row.locationId, row.hourStartMs);
 			forgottenHours += 1;
-			segmentsForgotten += rows.length;
-			bytesForgotten += rows.reduce((sum, r) => sum + r.bytes, 0);
+			segmentsForgotten += forgotten;
+			bytesForgotten += row.bytes;
 			const tally = tallyOf(row.deviceId);
 			tally.forgottenHours += 1;
-			tally.forgottenSegments += rows.length;
-			tally.forgottenBytes += rows.reduce((sum, r) => sum + r.bytes, 0);
+			tally.forgottenSegments += forgotten;
+			tally.forgottenBytes += row.bytes;
 		}
 		for (const [deviceId, tally] of byDevice) this.deps.logger.info("recorder: ghost-location reconcile — camera summary", {
 			tags: { deviceId },
@@ -10801,60 +10498,82 @@ var GhostLocationSweeper = class {
 		return out;
 	}
 	/**
-	* Ask every root about the hour's paths until one answers `true`.
+	* List this hour's directory under EVERY candidate root.
+	*
+	* A non-empty listing at one root makes the hour mis-pointed. Two roots
+	* holding it is a refusal, not a choice: repointing would be a guess about
+	* which copy is the footage. Absence is only concluded when every root
+	* answered and every answer was empty — a listing that could not decide
+	* (`null`) or threw ends the hour with nothing decided (D49).
+	*
+	* The whole loop runs even after a hit, because "found at exactly one root"
+	* is a claim about every root and cannot be short-circuited without giving up
+	* the multi-root refusal.
 	*
-	* Presence short-circuits the hour (one confirmed file makes it mis-pointed);
-	* absence does not, and cannot — the hour is orphaned only when EVERY path
-	* came back absent from EVERY root. A throw ends the hour with nothing
-	* decided.
+	* `spent` is the listings the PASS has already made, not this hour's, and the
+	* brake fires on that running total. Since D523 an hour costs one listing per
+	* physical root — two or three on this hub — so a counter that reset per hour
+	* would never reach {@link GHOST_PROBE_BATCH} and the `pace()` dep would be
+	* dead on every real topology.
 	*/
-	async probeHour(rows, roots, budget) {
+	async probeHour(row, roots, budget, spent) {
 		let used = 0;
-		for (const row of rows) {
-			const found = [];
-			for (const root of roots) {
-				if (used >= budget) return {
+		const found = [];
+		for (const root of roots) {
+			if (used >= budget) return {
+				outcome: {
+					kind: "refused",
+					reason: "probe-budget",
+					detail: `stopped after ${used} listings with ${roots.length} roots to probe`
+				},
+				probes: used
+			};
+			const alias = locationForHydratedProfile(root.aliases, row.profile);
+			used += 1;
+			if ((spent + used) % 16 === 0) await this.deps.pace();
+			let listing;
+			try {
+				listing = await this.deps.listHour(alias.id, row.deviceId, row.profile, row.hourStartMs);
+			} catch (err) {
+				return {
 					outcome: {
 						kind: "refused",
-						reason: "probe-budget",
-						detail: `stopped after ${used} probes with ${rows.length} paths in the hour`
+						reason: "probe-error",
+						detail: `${alias.id}: ${require_dist.errMsg(err)}`
 					},
 					probes: used
 				};
-				const alias = locationForHydratedProfile(root.aliases, row.profile);
-				used += 1;
-				if (used % 16 === 0) await this.deps.pace();
-				try {
-					if (await this.deps.exists(alias.id, row.path)) found.push(root);
-				} catch (err) {
-					return {
-						outcome: {
-							kind: "refused",
-							reason: "probe-error",
-							detail: `${alias.id}: ${require_dist.errMsg(err)}`
-						},
-						probes: used
-					};
-				}
 			}
-			if (found.length > 1) return {
+			if (listing === null) return {
 				outcome: {
 					kind: "refused",
-					reason: "found-at-multiple-roots",
-					detail: found.map((root) => root.key).join(", ")
-				},
-				probes: used
-			};
-			const only = found[0];
-			if (only !== void 0) return {
-				outcome: {
-					kind: "found",
-					root: only,
-					path: row.path
+					reason: "detail-unavailable",
+					detail: `${alias.id} could not say what its copy of this hour holds`
 				},
 				probes: used
 			};
+			if (listing.length > 0) found.push({
+				root,
+				paths: listing
+			});
 		}
+		if (found.length > 1) return {
+			outcome: {
+				kind: "refused",
+				reason: "found-at-multiple-roots",
+				detail: found.map((hit) => hit.root.key).join(", ")
+			},
+			probes: used
+		};
+		const only = found[0];
+		if (only !== void 0) return {
+			outcome: {
+				kind: "found",
+				root: only.root,
+				paths: only.paths
+			},
+			probes: used
+		};
 		return {
 			outcome: { kind: "absent" },
 			probes: used
@@ -11235,34 +10954,12 @@ function emptyTally() {
 		orphanFiles: 0
 	};
 }
-/** The basename of a segment path — what a listing returns. */
-function fileName(relPath) {
-	const cut = relPath.lastIndexOf("/");
-	return cut === -1 ? relPath : relPath.slice(cut + 1);
-}
-/** Group one archive page into whole hours. A page always carries complete hour
-*  rows (`streamSegments` expands them whole), so no hour is ever split. */
-function claimsOf(rows) {
-	const byHour = /* @__PURE__ */ new Map();
-	for (const row of rows) {
-		const hour = hourStartMs(row.startMs);
-		const key = `${row.deviceId}|${row.profile}|${hour}`;
-		const held = byHour.get(key);
-		if (held) held.push(row);
-		else byHour.set(key, [row]);
-	}
-	const out = [];
-	for (const group of byHour.values()) {
-		const first = group[0];
-		if (first === void 0) continue;
-		out.push({
-			deviceId: first.deviceId,
-			profile: first.profile,
-			hourStartMs: hourStartMs(first.startMs),
-			rows: group
-		});
-	}
-	return out.toSorted((a, b) => a.hourStartMs - b.hourStartMs || a.deviceId - b.deviceId);
+/** Does this hour row fall inside the scope the operator asked for? */
+function inScope(row, scope) {
+	if (scope.locationId !== void 0 && row.locationId !== scope.locationId) return false;
+	if (scope.deviceId !== void 0 && row.deviceId !== scope.deviceId) return false;
+	const profiles = scope.profiles ?? [];
+	return profiles.length === 0 || profiles.includes(row.profile);
 }
 /**
 * One reconcile pass over one location's claimed hours.
@@ -11360,20 +11057,35 @@ var LedgerWalkReconciler = class {
 		this.reportPass(report);
 		return report;
 	}
-	/** Walk the archive page by page, one hour at a time. */
+	/**
+	* Walk the hour ROWS of the scope, oldest first.
+	*
+	* From the MIRROR, not a query. Since D523 a row is ten scalars, so the whole
+	* claim set is already in RAM and costs nothing to fold — and the pass mutates
+	* what it walks, which is exactly the shape that makes `offset` paging skip
+	* half a scope. A snapshot taken once cannot skip.
+	*/
 	async walk(state, scope) {
-		for await (const page of state.ledger.streamSegments(scope)) for (const claim of claimsOf(page)) {
+		const claims = state.ledger.snapshot().filter((row) => inScope(row, scope)).toSorted((a, b) => a.hourStartMs - b.hourStartMs || a.deviceId - b.deviceId);
+		for (const claim of claims) {
 			if (state.hoursClaimed >= state.maxHours) {
 				state.bounded = true;
 				return;
 			}
 			state.hoursClaimed += 1;
-			state.segmentsClaimed += claim.rows.length;
+			state.segmentsClaimed += claim.segments;
 			if (!await this.reconcileHour(state, claim)) return;
 		}
 	}
 	/**
-	* Diff ONE hour, and forget what it proved absent.
+	* Reconcile ONE hour: what its row ACCOUNTS FOR against what its directory
+	* HOLDS, and repair the account from the directory.
+	*
+	* Since D523 the row names no files, so this is a comparison of counts and
+	* bytes — and it does not need to name them: the repair is "make the account
+	* the listing's", which is exact, and the RESIDENT index is reset to the same
+	* listing so a row it holds for a file the directory does not is dropped with
+	* it.
 	*
 	* `false` ends the whole pass — the only thing that returns it is an anchor
 	* that stopped agreeing, and every listing taken after that point is about a
@@ -11386,10 +11098,6 @@ var LedgerWalkReconciler = class {
 			return true;
 		}
 		const relDir = hourDirRelPath(claim.deviceId, claim.profile, claim.hourStartMs);
-		for (const row of claim.rows) if (parseSegmentPath(row.path) === null || row.path !== `${relDir}/${fileName(row.path)}`) {
-			this.skip(state, claim, "path-mismatch", row.path);
-			return true;
-		}
 		let listing;
 		try {
 			listing = await this.deps.listHour(state.location.root, relDir);
@@ -11401,36 +11109,55 @@ var LedgerWalkReconciler = class {
 		if (state.listings % 8 === 0) await this.deps.pace();
 		state.hoursWalked += 1;
 		tally.hoursWalked += 1;
-		const diff = this.diff(claim, listing);
-		if (diff.missingDirectory) {
+		const missingDirectory = listing === null;
+		if (missingDirectory) {
 			state.hoursMissing += 1;
 			tally.hoursMissing += 1;
 		}
-		if (diff.orphans.length > 0) {
-			state.orphanFiles += diff.orphans.length;
-			tally.orphanFiles += diff.orphans.length;
-			for (const orphan of diff.orphans) {
+		const present = [];
+		for (const name of listing ?? []) {
+			if (!name.endsWith(".m4s")) continue;
+			const relPath = `${relDir}/${name}`;
+			const parsed = parseSegmentPath(relPath);
+			if (parsed === null || hourStartMs(parsed.startMs) !== claim.hourStartMs) {
+				this.skip(state, claim, "path-mismatch", relPath);
+				return true;
+			}
+			present.push(relPath);
+		}
+		const listed = hourAggregate(present);
+		const orphans = Math.max(0, listed.segments - claim.segments);
+		if (orphans > 0) {
+			state.orphanFiles += orphans;
+			tally.orphanFiles += orphans;
+			for (const path of present) {
 				if (state.orphanSample.length >= 50) break;
-				state.orphanSample.push(`${relDir}/${orphan}`);
+				state.orphanSample.push(path);
 			}
-			this.deps.logger.warn("recorder: files under a claimed hour that the durable ledger does NOT name — reported, never deleted", {
+			this.deps.logger.warn("recorder: an hour directory holds more segments than its durable row accounts for", {
 				tags: { deviceId: claim.deviceId },
 				meta: {
 					locationId: state.location.id,
 					profile: claim.profile,
 					hourStartMs: claim.hourStartMs,
-					orphans: diff.orphans.length,
-					sample: diff.orphans.slice(0, 5)
+					accounted: claim.segments,
+					listed: listed.segments,
+					apply: state.apply
 				}
 			});
 		}
-		if (diff.ghosts.length === 0) return true;
-		const ghostBytes = diff.ghosts.reduce((sum, row) => sum + row.bytes, 0);
-		state.ghostSegments += diff.ghosts.length;
+		const ghosts = Math.max(0, claim.segments - listed.segments);
+		if (ghosts === 0) {
+			if (state.apply && listed.segments > 0 && listed.bytes !== claim.bytes) await state.ledger.adoptWalkedHour(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs, present);
+			if (state.apply) this.resetIndex(state, claim, present);
+			return true;
+		}
+		const ghostBytes = Math.max(0, claim.bytes - listed.bytes);
+		state.ghostSegments += ghosts;
 		state.ghostBytes += ghostBytes;
-		tally.ghostSegments += diff.ghosts.length;
+		tally.ghostSegments += ghosts;
 		tally.ghostBytes += ghostBytes;
-		if (diff.ghosts.length === claim.rows.length) state.ghostHoursWhole += 1;
+		if (listed.segments === 0) state.ghostHoursWhole += 1;
 		const anchor = await this.readAnchor(state.location);
 		if (!anchor.ok || anchor.volumeId !== state.anchor) {
 			state.refused = anchor.ok ? "anchor-moved" : anchor.refusal;
@@ -11446,56 +11173,52 @@ var LedgerWalkReconciler = class {
 			});
 			return false;
 		}
-		this.deps.logger.warn("recorder: durable hour row claims segments the directory does not hold", {
+		this.deps.logger.warn("recorder: durable hour row accounts for segments the directory does not hold", {
 			tags: { deviceId: claim.deviceId },
 			meta: {
 				locationId: state.location.id,
 				profile: claim.profile,
 				hourStartMs: claim.hourStartMs,
-				claimed: claim.rows.length,
-				ghosts: diff.ghosts.length,
+				accounted: claim.segments,
+				listed: listed.segments,
+				ghosts,
 				ghostBytes,
-				wholeHour: diff.ghosts.length === claim.rows.length,
-				missingDirectory: diff.missingDirectory,
+				wholeHour: listed.segments === 0,
+				missingDirectory,
 				apply: state.apply
 			}
 		});
 		if (!state.apply) return true;
-		await state.ledger.dropSegments(diff.ghosts);
-		if (!await this.forgetLanded(state, claim, diff.ghosts)) {
-			this.skip(state, claim, "durable-refused", "the ledger still lists a dropped path");
+		const forgotten = listed.segments === 0 ? await state.ledger.forgetHour(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs) : await this.adoptLanded(state, claim, present, ghosts);
+		if (forgotten === null) {
+			this.skip(state, claim, "durable-refused", "the ledger still accounts for the ghosts");
 			return true;
 		}
-		this.deps.applyToIndex(diff.ghosts.map((row) => row.path));
-		state.forgottenSegments += diff.ghosts.length;
+		this.resetIndex(state, claim, present);
+		state.forgottenSegments += forgotten;
 		state.forgottenBytes += ghostBytes;
-		tally.forgottenSegments += diff.ghosts.length;
+		tally.forgottenSegments += forgotten;
 		return true;
 	}
-	/** Did the durable drop actually land? */
-	async forgetLanded(state, claim, ghosts) {
-		const { deviceId, profile, hourStartMs: hour } = claim;
-		if (!state.ledger.knowsHour(deviceId, profile, state.location.id, hour)) return true;
-		const held = await state.ledger.hourPaths(deviceId, profile, state.location.id, hour);
-		if (held === null) return false;
-		const remaining = new Set(held);
-		return ghosts.every((row) => !remaining.has(row.path));
-	}
 	/**
-	* What the hour row claims, against what the directory holds — BOTH ways.
+	* Adopt the listing, then READ THE ROW BACK.
 	*
-	* A missing directory is an empty listing here, which makes every claim a
-	* ghost. That is only admissible because the caller re-reads the volume
-	* anchor before acting on it.
+	* `adoptWalkedHour` refuses a listing that would erase more than half of what
+	* the row accounts for — the guard against a root that answered short — and it
+	* refuses silently, which a caller that counted it as done would turn into
+	* telling the resident index a row is gone that the archive still holds.
+	* `null` is that refusal.
 	*/
-	diff(claim, listing) {
-		const present = new Set((listing ?? []).filter((name) => name.endsWith(".m4s")));
-		const claimed = new Set(claim.rows.map((row) => fileName(row.path)));
-		return {
-			ghosts: claim.rows.filter((row) => !present.has(fileName(row.path))),
-			orphans: [...present].filter((name) => !claimed.has(name)).toSorted(),
-			missingDirectory: listing === null
-		};
+	async adoptLanded(state, claim, present, ghosts) {
+		await state.ledger.adoptWalkedHour(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs, present);
+		const after = state.ledger.hourRow(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs);
+		if (after === void 0) return claim.segments;
+		return after.segments === claim.segments - ghosts ? ghosts : null;
+	}
+	/** Make the resident index's view of the hour the listing's, and say how many
+	*  index rows that dropped. */
+	resetIndex(state, claim, present) {
+		return this.deps.applyToIndex(claim.deviceId, state.location.id, claim.hourStartMs, present);
 	}
 	/** The volume anchor, or the refusal its absence produces. */
 	async readAnchor(location) {
@@ -17784,12 +17507,17 @@ var GHOST_LOCATION_PROBE_PAUSE_MS = 50;
 /**
 * Awaited every `WALK_HOUR_BATCH` hour listings by the ledger↔disk walk (D319).
 *
-* Twice the ghost sweep's brake, because the syscall between brakes is far
-* heavier: that pass paces `storage.exists` on one path, this one paces a
-* `readdir` of a whole hour directory — measured at ~650 ms on the live share
-* under load. The walk is operator-armed and one-off, so the right trade is to
-* be slower and invisible rather than fast and felt: a `find` over this array
-* hung an SSH session on 2026-08-29.
+* Twice the ghost sweep's brake. That used to be because the syscall between
+* brakes was far heavier — the sweep paced one `storage.exists`, this one an
+* hour `readdir` "measured at ~650 ms on the live share under load". Both
+* halves of that have changed: the sweep paces a directory listing too since
+* D523, and the 650 ms belonged to a FUSE mount that has been retired (an hour
+* of 345–349 files on `/recordings-2` lists in ~1 ms).
+*
+* It stays at twice anyway, for the reason that never depended on the number:
+* the walk is operator-armed and one-off, so the right trade is to be slower
+* and invisible rather than fast and felt — a `find` over this array hung an
+* SSH session on 2026-08-29.
 */
 var LEDGER_WALK_PAUSE_MS = 100;
 /**
@@ -18086,6 +17814,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		this.segmentHours = new SegmentHourLedger({
 			store: this.ctx.api.settingsStore,
 			logger: this.ctx.logger,
+			listHour: (locationId, deviceId, profile, hourStartMs) => this.listHourDirectory(locationId, deviceId, profile, hourStartMs),
 			isLocationUsable: (locationId) => this.placement?.isLocationUsable(locationId) ?? true
 		});
 		try {
@@ -18119,7 +17848,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 					await node_fs.promises.unlink(fromAbs);
 				}
 			},
-			archiveHourPaths: async (deviceId, profile, locationId, hourStartMs) => await this.segmentHours?.hourPaths(deviceId, profile, locationId, hourStartMs) ?? null,
+			hourDirectoryPaths: (deviceId, profile, locationId, hourStartMs) => this.listHourDirectory(locationId, deviceId, profile, hourStartMs),
 			removeDir: async (locationId, relDir) => {
 				const loc = requireReadableLocation(this.resolvedLocations, locationId, "recorder");
 				await node_fs.promises.rm(node_path.default.join(loc.root, relDir), {
@@ -18604,8 +18333,8 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			localNodeId: this.nodeId,
 			index: this.index,
 			ledger: this.segmentHours === null ? null : {
-				streamSegments: (scope) => this.segmentHours.streamSegments(scope),
-				dropSegments: (rows) => this.segmentHours.dropSegments(rows)
+				forgetScope: (scope) => this.segmentHours.forgetScope(scope),
+				snapshot: () => this.segmentHours.snapshot()
 			},
 			now: () => Date.now()
 		});
@@ -18712,9 +18441,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				}
 			},
 			anchorOf: async (root) => (await readLocationMarker(root))?.volumeId ?? null,
-			applyToIndex: (paths) => {
-				this.index.removeSegments(paths);
-			},
+			applyToIndex: (deviceId, locationId, hour, paths) => this.index.resetHour(deviceId, locationId, hour, paths),
 			logger: this.ctx.logger,
 			now: () => Date.now(),
 			pace: () => require_dist.sleep(LEDGER_WALK_PAUSE_MS)
@@ -18842,7 +18569,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		});
 		try {
 			await this.segmentHours?.load();
-			this.segmentHours?.repairAggregates();
 		} catch (err) {
 			this.ctx.logger.warn("recorder: segment-hour ledger load failed — hours stay unknown until a read walks them", { meta: { error: require_dist.errMsg(err) } });
 		}
@@ -18885,18 +18611,15 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			const sweeper = new GhostLocationSweeper({
 				ledger,
 				locations: () => this.resolvedLocations,
-				exists: (location, relativePath) => this.ctx.api.storage.exists.query({
-					location,
-					relativePath
-				}),
+				listHour: (locationId, deviceId, profile, hourStartMs) => this.listHourDirectory(locationId, deviceId, profile, hourStartMs),
 				applyToIndex: (rows, toLocationId) => {
 					this.index.removeSegments(rows.map((row) => row.path));
-					if (toLocationId === null) return;
 					for (const row of rows) this.index.addSegment({
 						...row,
 						locationId: toLocationId
 					});
 				},
+				forgetInIndex: (deviceId, locationId, hourStartMs) => this.index.resetHour(deviceId, locationId, hourStartMs, []),
 				logger: this.ctx.logger,
 				now: () => Date.now(),
 				pace: () => require_dist.sleep(GHOST_LOCATION_PROBE_PAUSE_MS)
@@ -19171,6 +18894,63 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		return this.resolvedLocations;
 	}
 	/**
+	* ONE hour bucket's segment files, location-relative — the recorder's single
+	* implementation of {@link HourLister} (D523).
+	*
+	* The directory is the authority for WHICH segments exist, and the segment
+	* NAME carries start, duration and bytes, so this is a complete description
+	* of the hour and no file is ever opened.
+	*
+	* Three answers, and the difference between the last two is the whole point:
+	*
+	*  - `null` — **undecided.** The location does not resolve, may not be read,
+	*    or the read failed for a reason that is not "this directory is not
+	*    there". Every caller turns it into "this hour takes no part in this
+	*    pass".
+	*  - `[]` — **the hour holds nothing**, and the volume confirmed it: an
+	*    ENOENT on the hour directory is only reported as empty once the
+	*    location's ROOT has answered a read. A root that has gone away answers
+	*    ENOENT for every hour on it, and reporting that as "empty" is how a pass
+	*    deletes an operator's index of real footage (D148, D393).
+	*  - the paths.
+	*/
+	async listHourDirectory(locationId, deviceId, profile, hourStartMs) {
+		const location = this.resolvedLocations.find((l) => l.id === locationId);
+		if (location === void 0 || !locationMayBeRead(location)) return null;
+		const rel = hourDirRelPath(deviceId, profile, hourStartMs);
+		try {
+			return (await node_fs.promises.readdir(node_path.default.join(location.root, rel))).filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
+		} catch (err) {
+			if (err.code !== "ENOENT") {
+				this.ctx.logger.warn("recorder: hour directory read failed — this hour decides nothing", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						locationId,
+						hourStartMs,
+						error: require_dist.errMsg(err)
+					}
+				});
+				return null;
+			}
+			try {
+				await node_fs.promises.readdir(location.root);
+			} catch {
+				this.ctx.logger.warn("recorder: hour directory is absent AND its location root cannot be read — this hour decides nothing", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						locationId,
+						root: location.root,
+						hourStartMs
+					}
+				});
+				return null;
+			}
+			return [];
+		}
+	}
+	/**
 	* Attach-boundary placement for one (device, profile). Falls back to the pure
 	* resolver when the service is not built (non-recording node / early boot),
 	* which is byte-identical to the pre-placement behaviour.