@camstack/addon-pipeline 1.2.256 → 1.2.258

package/dist/recorder/index.mjs

@@ -1,7 +1,7 @@
-import { $t as hydrateSchema, C as OpsLogEntrySchema, Ct as recordingExportCapability, D as RECORDING_EXPORT_MAX_READ_BYTES, Dt as resolveLocationMode, H as deriveBatteryPresence, I as batteryCapability, Kt as DeviceFeature, Lt as errMsg, Mt as storageOccupancyCapability, O as RecordingConfigSchema, Pt as stripRetiredBandPreBufferSec, Q as evictionPolicyOfLocation, St as recordingCapability, W as deriveRecordingMode, Wt as BaseAddon, Xt as customAction, Y as evaluateSensorEdge, Z as evictionPolicyForMode, Zt as defineCustomActions, _n as record, bn as EventCategory, cn as _enum, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as modeMayWrite, et as gbToBytes, g as ExportRecordSchema, gn as preprocess, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, jt as storageEvictableCapability, k as RecordingSignalStatusSchema, kt as resolveRecordingProfiles, ln as array, lt as mayWriteToLocation, mn as number, on as selectAssignedProfileSlots, qt as DeviceType, rn as nodePin, rt as isFirstLevelMacroClass, sn as sleep$1, un as boolean, ut as migrateLegacyDeviceSignalConfig, vn as string, wt as recordingSignalCapability } from "../dist-MJ4ji7um.mjs";
-import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-DdXmHLK4.mjs";
+import { $t as hydrateSchema, C as OpsLogEntrySchema, Ct as recordingExportCapability, D as RECORDING_EXPORT_MAX_READ_BYTES, Dt as resolveLocationMode, H as deriveBatteryPresence, I as batteryCapability, Kt as DeviceFeature, Lt as errMsg, Mt as storageOccupancyCapability, O as RecordingConfigSchema, Pt as stripRetiredBandPreBufferSec, Q as evictionPolicyOfLocation, St as recordingCapability, W as deriveRecordingMode, Wt as BaseAddon, Xt as customAction, Y as evaluateSensorEdge, Z as evictionPolicyForMode, Zt as defineCustomActions, _n as record, bn as EventCategory, cn as _enum, ct as mayReadLocation, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, dt as modeMayWrite, et as gbToBytes, g as ExportRecordSchema, gn as preprocess, hn as object, i as BatteryStatusSchema, it as loadContributionCapability, jt as storageEvictableCapability, k as RecordingSignalStatusSchema, kt as resolveRecordingProfiles, ln as array, lt as mayWriteToLocation, mn as number, on as selectAssignedProfileSlots, qt as DeviceType, rn as nodePin, rt as isFirstLevelMacroClass, sn as sleep$1, un as boolean, ut as migrateLegacyDeviceSignalConfig, vn as string, wt as recordingSignalCapability } from "../dist-D3w2fwD4.mjs";
+import { a as physicalRootOf, i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-IHGNrWH9.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { c as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-D2VT97-U.mjs";
+import { l as PREBUFFER_MAX_MS, r as RECORDING_PRE_ROLL_REQUEST_MS, s as withRecordingIntent } from "../restream-intent-CgyZI565.mjs";
 import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";
@@ -9,7 +9,6 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { open } from "node:fs/promises";
 import { contentTypeFor, createFileDataPlaneHandler, parseRangeHeader, startEventLoopStallMonitor } from "@camstack/system/addon-utils";
-import { gunzipSync, gzipSync } from "node:zlib";
 //#region src/recorder/event-capture.ts
 /**
 * La sottoscrizione motion del recorder: bus → `onTrigger(deviceId, atMs)`.
@@ -815,14 +814,22 @@ function parseSegmentPath(relPath) {
 /** Hour bucket, the granularity the path convention (`.../YYYY/MM/DD/HH/`)
 *  already gives us — so "have I walked this?" costs one Set lookup. */
 var HOUR_MS$9 = 36e5;
-/** A device walked end-to-end. Cheaper and clearer than inserting every hour of
-*  the retention window into the set. */
-var ALL_HOURS = Symbol("all-hours");
 /** The hour buckets a half-open span touches. */
 function* hourBuckets(fromMs, toMs) {
 	const first = Math.floor(fromMs / HOUR_MS$9) * HOUR_MS$9;
 	for (let h = first; h < toMs; h += HOUR_MS$9) yield h;
 }
+/** The hour bucket a segment belongs to — the same one its path encodes. */
+function hourOf$1(startMs) {
+	return Math.floor(startMs / HOUR_MS$9) * HOUR_MS$9;
+}
+/** The production bound. See {@link RecordingIndexBudget} for the measurement. */
+var DEFAULT_RECORDING_INDEX_BUDGET = {
+	residentRowBudget: 25e4,
+	residentHourBudget: 2e4,
+	evictToFraction: .8,
+	pinnedTailHours: 2
+};
 /**
 * Index of the first element whose `startMs` is GREATER than `startMs` (upper
 * bound). Inserting there keeps equal-start rows in arrival order — exactly
@@ -870,10 +877,35 @@ var RecordingIndex = class {
 	/** See {@link HydrateReuseStats}. */
 	rowsReused = 0;
 	rowsAllocated = 0;
-	/** Hour buckets this device has been walked for; `ALL_HOURS` after a full
-	*  hydrate. Empty = nothing has been looked at, which is NOT the same as
-	*  "there is nothing" — see {@link hydrationOf}. */
+	/**
+	* Hour buckets this device has been walked for → when anything last ASKED
+	* about that hour ({@link useTick}, 0 = never since the walk). Empty =
+	* nothing has been looked at, which is NOT the same as "there is nothing" —
+	* see {@link hydrationOf}.
+	*
+	* The tick is the eviction order, and it lives here rather than in a side
+	* map because an evicted hour must lose its marker in the SAME operation
+	* that loses its rows: a walked marker outliving its rows would report
+	* `hydrated` over an hour the index no longer holds, which is the one
+	* failure a forgetting index must not have.
+	*
+	* There used to be an `ALL_HOURS` sentinel here for a device walked
+	* end-to-end. It had no production caller (2026-08-30 census) and a bounded
+	* index can never truthfully claim it, so it is gone.
+	*/
 	walked = /* @__PURE__ */ new Map();
+	/** Monotonic "somebody asked" counter. Only ever compared, never read out. */
+	useTick = 0;
+	/** `null` until {@link armResidency}. An unarmed index never evicts. */
+	residencyDeps = null;
+	evictedRows = 0;
+	evictedHours = 0;
+	evictionPasses = 0;
+	/** Hours dropped per device, for the life of the process. One number per
+	*  camera — the input to {@link droppedDuringWalk}, nothing else. */
+	evictedHoursByDevice = /* @__PURE__ */ new Map();
+	/** {@link evictedHoursByDevice} as it stood when a whole-device walk began. */
+	walkBaseline = /* @__PURE__ */ new Map();
 	/**
 	* Upper bound on the `durMs` of any row the index holds — the ONLY thing that
 	* turns "walk the whole sorted view" into "walk backwards a bounded number of
@@ -1047,7 +1079,9 @@ var RecordingIndex = class {
 	* Deliberately NOT delete-all-then-reinsert: the archive walk re-reports rows
 	* this index already holds, with freshly built path strings, and dropping the
 	* held rows first would make those fresh strings the permanent ones — a
-	* second copy of the whole archive's paths. See {@link retainedPathStrings}.
+	* second copy of the whole archive's paths. See {@link RecordingIndex.rowFor}
+	* for the measurement (`retainedPathStrings`, which this used to point at,
+	* never existed — a leftover that read as a verification, removed 2026-09-17).
 	* @residency mutation
 	*/
 	hydrateDevice(deviceId, locationId, relPaths) {
@@ -1061,6 +1095,7 @@ var RecordingIndex = class {
 		}
 		for (const [path, existing] of m) if (existing.locationId === locationId && !seen.has(path)) m.delete(path);
 		this.invalidateSorted(deviceId);
+		this.enforceResidency();
 	}
 	/**
 	* Whether the index has WALKED `[fromMs, toMs)` for a device.
@@ -1074,7 +1109,6 @@ var RecordingIndex = class {
 	hydrationOf(deviceId, fromMs, toMs) {
 		const w = this.walked.get(deviceId);
 		if (w === void 0) return "unknown";
-		if (w === ALL_HOURS) return "hydrated";
 		let seen = 0;
 		let total = 0;
 		for (const h of hourBuckets(fromMs, toMs)) {
@@ -1086,15 +1120,225 @@ var RecordingIndex = class {
 	}
 	/** Record that `[fromMs, toMs)` has been walked, whatever it contained. @residency mutation */
 	markHydrated(deviceId, fromMs, toMs) {
+		let w = this.walked.get(deviceId);
+		if (w === void 0) {
+			w = /* @__PURE__ */ new Map();
+			this.walked.set(deviceId, w);
+		}
+		const tick = ++this.useTick;
+		for (const h of hourBuckets(fromMs, toMs)) w.set(h, tick);
+	}
+	/**
+	* Bound this index, and give it somewhere to SAY what it dropped.
+	*
+	* Called once, from the recorder addon's initialize — `ctx.logger` does not
+	* exist when the field is constructed. Until it runs the index never evicts,
+	* which is honest for the pre-init window (it holds nothing) and is the one
+	* state in which {@link ResidencyCensus.budget} is `null`.
+	* @residency mutation
+	*/
+	armResidency(deps) {
+		this.residencyDeps = deps;
+		this.enforceResidency();
+	}
+	/**
+	* A whole-device walk is starting: remember how much this index had already
+	* forgotten about that camera, so {@link droppedDuringWalk} can say whether
+	* the walk's result is a COMPLETE view of what it read.
+	* @residency mutation
+	*/
+	beginWalk(deviceId) {
+		this.walkBaseline.set(deviceId, this.evictedHoursByDevice.get(deviceId) ?? 0);
+	}
+	/**
+	* Did this index drop anything for `deviceId` since {@link beginWalk}?
+	*
+	* The one question a PRUNE has to ask. An hour the index dropped is
+	* indistinguishable, from the outside, from an hour disk no longer has — so
+	* a consumer that deletes durable state on the index's silence must refuse
+	* when the answer is `true`. `false` when nobody called `beginWalk`: an
+	* unarmed index never drops, and a caller that never announced a walk is
+	* asking about one that did not happen.
+	* @residency resident-scoped
+	*/
+	droppedDuringWalk(deviceId) {
+		const baseline = this.walkBaseline.get(deviceId);
+		if (baseline === void 0) return false;
+		return (this.evictedHoursByDevice.get(deviceId) ?? 0) > baseline;
+	}
+	/** What is held, what was let go, and under which bound. @residency resident-scoped */
+	residency() {
+		return {
+			residentRows: this.residentRowCount(),
+			residentHours: this.residentHourCount(),
+			evictedRows: this.evictedRows,
+			evictedHours: this.evictedHours,
+			evictionPasses: this.evictionPasses,
+			budget: this.residencyDeps?.budget ?? null
+		};
+	}
+	residentRowCount() {
+		let n = 0;
+		for (const m of this.byDevice.values()) n += m.size;
+		return n;
+	}
+	residentHourCount() {
+		let n = 0;
+		for (const w of this.walked.values()) n += w.size;
+		return n;
+	}
+	/**
+	* Note that something ASKED about `[fromMs, toMs)` — the only input to the
+	* eviction order.
+	*
+	* Walks whichever side is smaller: a read whose span is wider than the
+	* device's whole walked map (a month-wide `ranges`, an availability sweep)
+	* would otherwise iterate one hour at a time across the span.
+	*/
+	touch(deviceId, fromMs, toMs) {
 		const w = this.walked.get(deviceId);
-		if (w === ALL_HOURS) return;
-		const set = w ?? /* @__PURE__ */ new Set();
-		for (const h of hourBuckets(fromMs, toMs)) set.add(h);
-		this.walked.set(deviceId, set);
+		if (w === void 0 || w.size === 0) return;
+		const tick = ++this.useTick;
+		if (Math.ceil(Math.max(0, toMs - fromMs) / HOUR_MS$9) > w.size) {
+			for (const h of w.keys()) if (h < toMs && h + HOUR_MS$9 > fromMs) w.set(h, tick);
+			return;
+		}
+		for (const h of hourBuckets(fromMs, toMs)) if (w.has(h)) w.set(h, tick);
 	}
-	/** Record that the device was walked end-to-end (the background full walk). @residency mutation */
-	markHydratedAll(deviceId) {
-		this.walked.set(deviceId, ALL_HOURS);
+	/**
+	* Drop the least-recently-asked-about hours until the index is back inside
+	* its budget.
+	*
+	* ## What a dropped hour costs, and why that is safe
+	*
+	* The directory is the authority for which segments exist — every row here
+	* is derived from a path the walk read, and `hydrateHour` /
+	* `hydrateWindowFromStorage` rebuild it from one shallow `readdir` (or one
+	* ledger point read). So a drop costs a re-read, never a segment. The
+	* property that makes it costs-a-read rather than loses-a-segment is that
+	* the walked marker goes with the rows: `hydrationOf` then answers `unknown`
+	* and the reader walks. A marker left behind would answer `hydrated` over an
+	* hour holding nothing, which is exactly the silent gap this class spent
+	* D295 learning not to report.
+	*
+	* ## What is never a candidate
+	*
+	* The live tail ({@link RecordingIndexBudget.pinnedTailHours}). Those hours
+	* are write-through from the writer (`addSegment`), not walked, and a
+	* `readdir` of an hour a writer is still filling cannot give back what it
+	* had — D445's lost tail, from the other direction.
+	*/
+	enforceResidency() {
+		const deps = this.residencyDeps;
+		if (deps === null) return;
+		const { budget } = deps;
+		let rows = this.residentRowCount();
+		let hours = this.residentHourCount();
+		if (rows <= budget.residentRowBudget && hours <= budget.residentHourBudget) return;
+		const rowTarget = Math.floor(budget.residentRowBudget * budget.evictToFraction);
+		const hourTarget = Math.floor(budget.residentHourBudget * budget.evictToFraction);
+		const pinnedFrom = hourOf$1(deps.now()) - Math.max(0, budget.pinnedTailHours - 1) * HOUR_MS$9;
+		const counts = this.hourHistogram();
+		const candidates = [];
+		for (const [deviceId, byHour] of counts) {
+			const walkedHours = this.walked.get(deviceId);
+			for (const [hourStartMs, count] of byHour) {
+				if (hourStartMs >= pinnedFrom) continue;
+				candidates.push({
+					deviceId,
+					hourStartMs,
+					rows: count,
+					lastUse: walkedHours?.get(hourStartMs) ?? 0
+				});
+			}
+		}
+		candidates.sort((a, b) => a.lastUse - b.lastUse || a.hourStartMs - b.hourStartMs);
+		const victims = /* @__PURE__ */ new Map();
+		let droppedRows = 0;
+		let droppedHours = 0;
+		for (const c of candidates) {
+			if (rows <= rowTarget && hours <= hourTarget) break;
+			let forDevice = victims.get(c.deviceId);
+			if (!forDevice) {
+				forDevice = /* @__PURE__ */ new Set();
+				victims.set(c.deviceId, forDevice);
+			}
+			forDevice.add(c.hourStartMs);
+			rows -= c.rows;
+			droppedRows += c.rows;
+			if (this.walked.get(c.deviceId)?.has(c.hourStartMs) === true) {
+				hours -= 1;
+				droppedHours += 1;
+			}
+		}
+		if (victims.size === 0) return;
+		this.evictionPasses += 1;
+		this.evictedRows += droppedRows;
+		this.evictedHours += droppedHours;
+		for (const [deviceId, hoursToDrop] of victims) this.dropHours(deviceId, hoursToDrop, rows, budget, deps.logger);
+	}
+	/** `deviceId → hourStartMs → resident rows`, including hours walked and found
+	*  empty (count 0) — those hold no rows and would otherwise never be dropped,
+	*  leaving the walked map to grow without bound on its own. */
+	hourHistogram() {
+		const out = /* @__PURE__ */ new Map();
+		for (const [deviceId, m] of this.byDevice) {
+			const byHour = /* @__PURE__ */ new Map();
+			for (const s of m.values()) {
+				const h = hourOf$1(s.startMs);
+				byHour.set(h, (byHour.get(h) ?? 0) + 1);
+			}
+			out.set(deviceId, byHour);
+		}
+		for (const [deviceId, w] of this.walked) {
+			let byHour = out.get(deviceId);
+			if (!byHour) {
+				byHour = /* @__PURE__ */ new Map();
+				out.set(deviceId, byHour);
+			}
+			for (const h of w.keys()) if (!byHour.has(h)) byHour.set(h, 0);
+		}
+		return out;
+	}
+	/** Delete one device's victim hours — rows and walked markers together — and
+	*  say so. A structure that silently forgets is how this class of bug hides. */
+	dropHours(deviceId, hoursToDrop, residentRowsAfter, budget, logger) {
+		const m = this.byDevice.get(deviceId);
+		let droppedRows = 0;
+		if (m) {
+			for (const [path, s] of m) {
+				if (!hoursToDrop.has(hourOf$1(s.startMs))) continue;
+				m.delete(path);
+				droppedRows += 1;
+			}
+			if (m.size === 0) this.byDevice.delete(deviceId);
+		}
+		const w = this.walked.get(deviceId);
+		if (w) {
+			for (const h of hoursToDrop) w.delete(h);
+			if (w.size === 0) this.walked.delete(deviceId);
+		}
+		this.invalidateSorted(deviceId);
+		this.evictedHoursByDevice.set(deviceId, (this.evictedHoursByDevice.get(deviceId) ?? 0) + hoursToDrop.size);
+		let oldestHourMs = Infinity;
+		let newestHourMs = -Infinity;
+		for (const h of hoursToDrop) {
+			if (h < oldestHourMs) oldestHourMs = h;
+			if (h > newestHourMs) newestHourMs = h;
+		}
+		logger.info("recorder: index dropped resident hours — over the residency budget", {
+			tags: { deviceId },
+			meta: {
+				hours: hoursToDrop.size,
+				rows: droppedRows,
+				oldestHourMs,
+				newestHourMs,
+				residentRowsAfter,
+				rowBudget: budget.residentRowBudget,
+				hourBudget: budget.residentHourBudget,
+				costOfRecovery: "readdir-per-hour"
+			}
+		});
 	}
 	/**
 	* Merge one hour's segments for a location, and mark that hour walked.
@@ -1116,6 +1360,39 @@ var RecordingIndex = class {
 		}
 		if (changed) this.invalidateSorted(deviceId);
 		this.markHydrated(deviceId, hourStartMs, hourStartMs + HOUR_MS$9);
+		this.enforceResidency();
+	}
+	/**
+	* Make one hour of ONE location exactly `relPaths` — merge what is there and
+	* drop what is not.
+	*
+	* {@link hydrateHour} merges, which is right for a reader: a listing it took
+	* of a live hour is a lower bound, and dropping on it would delete the index
+	* of footage the readdir merely raced. This is for the one caller that has
+	* TRUSTED evidence the hour is over and the volume it listed is the volume it
+	* started on — the operator-armed ledger walk — where the directory is the
+	* whole truth about the hour and an index row naming a file that is not in it
+	* is a ghost (D523, D148's "trusted walk" arm).
+	*
+	* Scoped to the (device, location, hour) triple: a path filed under another
+	* hour, or held for another location, is none of this call's business.
+	* @residency mutation
+	*/
+	resetHour(deviceId, locationId, hourStartMs, relPaths) {
+		const m = this.mapFor(deviceId);
+		const keep = new Set(relPaths);
+		const dropped = [];
+		for (const [path, row] of m) {
+			if (row.locationId !== locationId) continue;
+			if (Math.floor(row.startMs / HOUR_MS$9) * HOUR_MS$9 !== hourStartMs) continue;
+			if (keep.has(path)) continue;
+			dropped.push(path);
+		}
+		for (const path of dropped) m.delete(path);
+		if (dropped.length > 0) this.invalidateSorted(deviceId);
+		this.hydrateHour(deviceId, locationId, hourStartMs, relPaths);
+		this.enforceResidency();
+		return dropped;
 	}
 	/**
 	* Insert/replace one finalized segment (idempotent by path).
@@ -1139,6 +1416,7 @@ var RecordingIndex = class {
 			return;
 		}
 		this.insertIntoSortedViews(s);
+		this.enforceResidency();
 	}
 	/** Remove segments by relative path, routing each path to the correct device map via its encoded deviceId. @residency mutation */
 	removeSegments(paths) {
@@ -1166,6 +1444,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	segmentsStartingIn(deviceId, profile, fromMs, toMs) {
+		this.touch(deviceId, fromMs, toMs);
 		const segs = this.sortedSegments(deviceId, profile);
 		let lo = 0;
 		let hi = segs.length;
@@ -1194,6 +1473,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	segmentStartingAt(deviceId, profile, startMs) {
+		this.touch(deviceId, startMs, startMs + 1);
 		const segs = this.sortedSegments(deviceId, profile);
 		const at = segs[lowerBoundByStart(segs, startMs)];
 		return at !== void 0 && at.startMs === startMs ? at : null;
@@ -1217,6 +1497,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	segmentsOverlapping(deviceId, profile, fromMs, toMs) {
+		this.touch(deviceId, fromMs - this.maxDurMs, toMs);
 		const segs = this.sortedSegments(deviceId, profile);
 		const end = lowerBoundByStart(segs, toMs);
 		let head = lowerBoundByStart(segs, fromMs);
@@ -1378,6 +1659,7 @@ var RecordingIndex = class {
 	}
 	/** The segment whose [startMs, startMs+durMs) window contains `epochMs`, or null if `epochMs` falls in a gap / there is no footage. @residency resident-scoped */
 	segmentAt(deviceId, profile, epochMs) {
+		this.touch(deviceId, epochMs - this.maxDurMs, epochMs + 1);
 		return this.segmentAtIn(this.sortedSegments(deviceId, profile), epochMs);
 	}
 	/**
@@ -1387,6 +1669,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	nearestCoveredEdge(deviceId, profile, epochMs) {
+		this.touch(deviceId, epochMs - this.maxDurMs, epochMs + 1);
 		const segs = this.sortedSegments(deviceId, profile);
 		if (segs.length === 0) return null;
 		if (this.segmentAtIn(segs, epochMs) !== null) return epochMs;
@@ -1440,6 +1723,7 @@ var RecordingIndex = class {
 	* @residency resident-scoped
 	*/
 	coveredEdgeBefore(deviceId, profile, epochMs) {
+		this.touch(deviceId, epochMs - this.maxDurMs, epochMs + 1);
 		const segs = this.sortedSegments(deviceId, profile);
 		let best = null;
 		for (let i = upperBoundByStart(segs, epochMs) - 1; i >= 0; i--) {
@@ -1452,6 +1736,7 @@ var RecordingIndex = class {
 	}
 	/** @residency resident-scoped */
 	ranges(deviceId, profile, fromMs, toMs, gapToleranceMs) {
+		this.touch(deviceId, fromMs, toMs);
 		return mergeRanges(this.sortedSegments(deviceId, profile).filter((s) => s.startMs + s.durMs > fromMs && s.startMs < toMs), gapToleranceMs).map((r) => ({
 			startMs: Math.max(r.startMs, fromMs),
 			endMs: Math.min(r.endMs, toMs)
@@ -1686,6 +1971,7 @@ async function resolveRecordingsLocations(api, logger) {
 async function hydrateDeviceFromStorage(_api, index, deviceId, locations, logger, options = {}) {
 	const yieldBetween = options.yieldBetween ?? macrotask$3;
 	const chunkSize = options.chunkSize ?? HYDRATE_CHUNK;
+	index.beginWalk(deviceId);
 	for (const [root, aliases] of aliasesByRoot(locations)) {
 		const deviceDir = path.join(root, String(deviceId));
 		const startedMs = Date.now();
@@ -1766,40 +2052,6 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 	const verify = options?.verifyClosedHours === true;
 	if (!verify && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
 	const liveHour = Math.floor(Date.now() / HOUR_MS$8) * HOUR_MS$8;
-	/** Per (locationId, profile, hour): what the LEDGER claimed, for the diff. */
-	const claimed = /* @__PURE__ */ new Map();
-	const claimKey = (locationId, hour) => `${locationId}:${hour}`;
-	/**
-	* Closed hours the ledger answered for with a row nobody SEALED (D451): what
-	* a writer had persisted when it was last heard from, which is a legitimate
-	* answer and not a complete one. Each is read from the array once and the
-	* row is unioned and sealed, so the second reader pays a point read.
-	*/
-	const unsealed = /* @__PURE__ */ new Set();
-	if (ledger !== void 0) {
-		const startedMs = Date.now();
-		const hours = await ledger.detailForWindow(deviceId, fromMs, toMs);
-		let segments = 0;
-		let served = 0;
-		for (const hour of hours) {
-			if (hour.hourStartMs >= liveHour) continue;
-			index.hydrateHour(deviceId, hour.locationId, hour.hourStartMs, hour.paths);
-			claimed.set(claimKey(hour.locationId, hour.hourStartMs), hour.paths.length);
-			if (!hour.sealed) unsealed.add(hour.hourStartMs);
-			segments += hour.paths.length;
-			served += 1;
-		}
-		if (served > 0) logger.info("recorder: hydrated a window from the hour ledger", {
-			tags: { deviceId },
-			meta: {
-				hours: served,
-				segments,
-				unsealedHours: unsealed.size,
-				ms: Date.now() - startedMs
-			}
-		});
-		if (!verify && unsealed.size === 0 && index.hydrationOf(deviceId, fromMs, toMs) === "hydrated") return;
-	}
 	for (const [root, aliases] of aliasesByRoot(locations)) {
 		const deviceDir = path.join(root, String(deviceId));
 		let profiles;
@@ -1823,7 +2075,7 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 		let forgottenHours = 0;
 		let sealed = 0;
 		for (let hour = first; hour < toMs; hour += HOUR_MS$8) {
-			if (!verify && hour < liveHour && !unsealed.has(hour) && index.hydrationOf(deviceId, hour, hour + HOUR_MS$8) === "hydrated") continue;
+			if (!verify && hour < liveHour && index.hydrationOf(deviceId, hour, hour + HOUR_MS$8) === "hydrated") continue;
 			for (const profile of profiles) {
 				const rel = hourDirRelPath(deviceId, profile, hour);
 				let files;
@@ -1837,11 +2089,10 @@ async function hydrateWindowFromStorage(index, deviceId, fromMs, toMs, locations
 				const relPaths = files.filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
 				index.hydrateHour(deviceId, locationId, hour, relPaths);
 				if (ledger === void 0 || relPaths.length === 0 || hour + HOUR_MS$8 > Date.now()) continue;
-				const claimedHere = claimed.get(claimKey(locationId, hour));
 				const outcome = await ledger.adoptWalkedHour(deviceId, profile, locationId, hour, relPaths);
 				if (outcome === null) continue;
 				if (outcome.created) repaired += 1;
-				else if (claimedHere !== void 0 && outcome.added > 0) {
+				else if (outcome.added > 0) {
 					forgottenSegments += outcome.added;
 					forgottenHours += 1;
 				}
@@ -2478,10 +2729,12 @@ var RelocateEngine = class {
 	*
 	* The order is the whole point. Between the copy and the delete both
 	* locations hold every byte, so the ledger re-point in the middle can only
-	* ever name a location that HAS the file — which is what makes a crash
-	* recoverable instead of a black window. A ledger that refuses (a failed
-	* point read: D49/D287) stops this hour dead with nothing deleted; the
-	* copies at the target are adopted by the next run.
+	* ever account for a location that HAS the files — which is what makes a
+	* crash recoverable instead of a black window.
+	*
+	* There is no ledger refusal to handle any more (D523): the durable half is
+	* arithmetic over a row the mirror already holds, so nothing on that path can
+	* fail and stop an hour dead.
 	*/
 	async moveHour(job, rows, from, to, samePhysicalRoot, sleep, bytesPerMs) {
 		const movable = [];
@@ -2517,17 +2770,7 @@ var RelocateEngine = class {
 				toLocationId: to.id
 			}
 		});
-		else if (!await ledger.repointSegments(movable, to.id)) {
-			this.deps.logger.warn("relocate: hour NOT moved — the durable ledger refused the re-point, so the source bytes are kept", {
-				tags: { deviceId: movable[0].deviceId },
-				meta: {
-					jobId: job.jobId,
-					files: movable.length,
-					toLocationId: to.id
-				}
-			});
-			return;
-		}
+		else await ledger.repointSegments(movable, to.id);
 		if (!samePhysicalRoot) for (const row of movable) await promises.rm(path.join(from.root, row.fromPath ?? row.path), { force: true });
 		for (const row of movable) {
 			this.deps.index.removeSegments([row.fromPath ?? row.path]);
@@ -2920,23 +3163,21 @@ var SegmentStore = class SegmentStore {
 	*  work now the per-bucket archive scan is gone. */
 	static DEFAULT_EVICT_CHUNK = 25;
 	/**
-	* True when `victims` cover EVERY segment the ARCHIVE says the bucket holds,
-	* AND the bucket's hour has fully elapsed.
+	* True when `victims` cover EVERY segment the bucket DIRECTORY holds, AND the
+	* bucket's hour has fully elapsed.
 	*
 	* The current-hour guard matters because `onFinalized` relocates new segments
 	* INTO the current bucket concurrently — an rm racing that rename would
 	* orphan a just-indexed segment.
 	*
-	* The cover test is against `SegmentHourLedger`'s own hour row, never
-	* `RecordingIndex`. A bucketDir is `<dev>/<profile>/Y/M/D/H`, so it names
-	* exactly one durable hour row: "every path that row lists is a victim" is
-	* the same question the `rm -rf` answers, asked of the authority for what
-	* EXISTS (D295). Asked of the resident index it read EQUAL whenever the hour
-	* was partly resident — both sides short by the same rows — and the directory
-	* went with every file the round never named, leaving their durable rows
-	* behind as ghosts.
+	* The cover test is a listing of the directory the `rm -rf` is about to take,
+	* never `RecordingIndex` and never a durable row (D523). A bucketDir is
+	* `<dev>/<profile>/Y/M/D/H`, so one listing answers exactly the question the
+	* delete asks. Asked of the resident index it read EQUAL whenever the hour was
+	* partly resident — both sides short by the same rows — and the directory went
+	* with every file the round never named.
 	*
-	* An unanswerable archive returns `false`: per-file deletes are slower and
+	* An unanswerable listing returns `false`: per-file deletes are slower and
 	* always correct, and the alternative is a recursive delete computed from a
 	* fraction of the truth.
 	*/
@@ -2945,7 +3186,7 @@ var SegmentStore = class SegmentStore {
 		if (!first) return false;
 		const bucketStartMs = Math.floor(first.startMs / SegmentStore.HOUR_MS) * SegmentStore.HOUR_MS;
 		if ((this.deps.now?.() ?? Date.now()) < bucketStartMs + SegmentStore.HOUR_MS) return false;
-		const ask = this.deps.archiveHourPaths;
+		const ask = this.deps.hourDirectoryPaths;
 		if (ask === void 0) return false;
 		const held = await ask(first.deviceId, first.profile, location, bucketStartMs);
 		if (held === null || held.length === 0) return false;
@@ -4078,8 +4319,9 @@ var CalendarIndex = class {
 	*
 	* Also used to warm the days ADJACENT to one being viewed — changing day is a
 	* single click and the operator expects the summary to be there. That warm
-	* belongs in the background: at ~650 ms per cold read, doing it inline would
-	* only move the wait.
+	* belongs in the background: a cold read costs whatever the array charges
+	* that day (see the header — the ~650 ms figure is from the retired FUSE
+	* share), and doing it inline would only move the wait onto the click.
 	*/
 	async warm(deviceId, fromMs, toMs) {
 		for (let day = utcDayOf(fromMs); day <= utcDayOf(toMs); day += DAY_MS$3) {
@@ -5200,22 +5442,18 @@ function createFootageDiscardJob(deps) {
 	const forgetLedger = async (location) => {
 		const ledger = deps.ledger;
 		if (ledger === null) return 0;
-		let forgotten = 0;
 		const profiles = profilesForType(location.type);
-		for await (const page of ledger.streamSegments({
+		const scope = {
 			locationId: location.id,
 			profiles
-		})) {
-			if (cancelRequested) return forgotten;
-			deps.index.removeSegments(page.map((row) => row.path));
-			await ledger.dropSegments(page);
-			forgotten += page.length;
-			report({
-				dbRowsDeleted: forgotten,
-				detail: `forgot ${forgotten} ledger segments`
-			});
-			await sleep(0);
-		}
+		};
+		const hours = ledger.snapshot().filter((row) => row.locationId === location.id && profiles.includes(row.profile));
+		const forgotten = await ledger.forgetScope(scope);
+		for (const hour of hours) deps.index.resetHour(hour.deviceId, hour.locationId, hour.hourStartMs, []);
+		report({
+			dbRowsDeleted: forgotten,
+			detail: `forgot ${forgotten} ledger segments`
+		});
 		return forgotten;
 	};
 	return {
@@ -8268,63 +8506,6 @@ function runFfmpeg(renderDeps, args, ext) {
 	});
 }
 //#endregion
-//#region src/recorder/addon/paths-codec.ts
-/**
-* How an hour row's `paths` becomes text, and back (D471).
-*
-* `recorder:segment-hours` is 66 MB of the settings database and **99.2 % of it
-* is this one column** — 15 643 bytes per row over 4 036 rows. The content is a
-* list of location-relative segment paths that nearly all share the same
-* directory prefix, repeated in full on every entry. Measured per column on a
-* copy of the live database, never the live file (D468).
-*
-* Compressing it is unusually safe here because of D287's two-tier mirror: boot
-* loads the aggregate half of every row and NOT `paths`, so this column is read
-* only on a point materialise, never on the hot path.
-*
-* A local copy of the same idea `pipeline-analytics` uses for `positions` —
-* addons never import each other (CLAUDE.md), so twenty duplicated lines are
-* the correct shape, not a shared dependency across an addon boundary.
-*/
-/** Marks a value this module wrote. A plain JSON array always starts `[`. */
-var ENCODED_PREFIX = "z1:";
-function encodePaths(paths) {
-	return ENCODED_PREFIX + gzipSync(Buffer.from(JSON.stringify(paths), "utf8"), { level: 6 }).toString("base64");
-}
-/**
-* Decode whichever era wrote the value: the `z1:` string this writes, the plain
-* JSON string every pre-D471 row holds, or an array the store already parsed.
-*
-* `null` means "this row is unreadable", which the caller turns into a DISCARDED
-* row — the same contract the bare `JSON.parse` had. An hour whose paths cannot
-* be read must not silently become an hour with no segments: that would report
-* an empty disk, which is the failure `recordToRow` was already written to
-* avoid.
-*/
-function decodePaths(value) {
-	if (Array.isArray(value)) return isPathList(value) ? value : null;
-	if (typeof value !== "string") return null;
-	const json = value.startsWith(ENCODED_PREFIX) ? tryGunzip(value.slice(3)) : value;
-	if (json === null) return null;
-	try {
-		const parsed = JSON.parse(json);
-		if (!Array.isArray(parsed)) return null;
-		return isPathList(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-function isPathList(v) {
-	return v.every((p) => typeof p === "string" && p.length > 0);
-}
-function tryGunzip(b64) {
-	try {
-		return gunzipSync(Buffer.from(b64, "base64")).toString("utf8");
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/durable/durable-ledger.ts
 /** Default reseed cap — every current consumer's row set is installation-bounded. */
 var DEFAULT_LOAD_LIMIT = 1e5;
@@ -8579,19 +8760,19 @@ var macrotask$1 = () => new Promise((resolve) => {
 });
 /**
 * @durable class=mirror owner=recorder
-*   write="write-behind on every finalized segment (hour-row upsert, serialised per hour); the writer SEALS the hour it leaves (one write per hour); a disk walk of a closed hour unions what it found and seals; eviction drops paths"
+*   write="write-behind on every finalized segment (hour-row upsert, serialised per hour); the writer SEALS the hour it leaves (one write per hour); a listing of a closed hour re-derives the aggregate and seals; eviction and relocation shrink it"
 *   retention="a row goes when the walk or eviction confirms the hour is empty — never by age, never from the ledger alone (D148)"
 */
 var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
 /**
-* The four aggregate columns exist so "how much footage is on this disk" is a
-* `SUM`/`MIN`/`MAX` over ~19 k hour rows instead of a walk over ~7.1 M in-RAM
-* segment rows. They are DERIVED from `paths` — never a second authority — by
-* {@link withSegmentPath} and nothing else: {@link hourAggregate} is that step
-* over every path and {@link appendSegmentPath} is that step over one, so there
-* is no second derivation to drift. A row loaded from a database that predates
-* these columns is corrected in the mirror the moment it is read and repaired
-* on disk by {@link SegmentHourLedger.repairAggregates}.
+* The four aggregate columns are what this table IS (D523).
+*
+* They exist so "how much footage is on this disk" is a `SUM`/`MIN`/`MAX` over
+* ~19 k hour rows instead of a walk over ~7.1 M in-RAM segment rows, and they
+* are derived from segment NAMES — by {@link withSegmentPath} and nothing else.
+* {@link hourAggregate} is that step over a whole listing and
+* {@link appendSegmentPath} is that step over the one path that just arrived,
+* so there is no second derivation to drift.
 */
 var RECORDING_SEGMENT_HOURS_COLUMNS = [
 	{
@@ -8620,11 +8801,6 @@ var RECORDING_SEGMENT_HOURS_COLUMNS = [
 		type: "INTEGER",
 		notNull: true
 	},
-	{
-		name: "paths",
-		type: "TEXT",
-		notNull: true
-	},
 	{
 		name: "bytes",
 		type: "INTEGER",
@@ -8683,15 +8859,9 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 	* `MAX(maxStartMs)` over `locationId IN (…)` — one row back, and with this
 	* index not one table row read to produce it (D447).
 	*
-	* `idx_recorder_segment_hours_loc_hour` finds the same range, but the four
-	* aggregates live in the table row, next to `paths` — up to 360 segment
-	* paths of ~80 characters per hour — so the eviction index served the
-	* accounting read at the price of ~30 KB of table page per hour row. On the
-	* live hub that was `durationMs=1001…2902` once a MINUTE on
-	* `hub/sqlite-settings` (174 slow-call WARNs in ten hours on 2026-09-10/11),
-	* every one of them holding the thread every configuration read in the
-	* cluster waits on. The index is ~50 bytes a row over ~19 k rows — nothing —
-	* and the first declare after it ships builds it in well under a second.
+	* Since D523 dropped `paths` the table row is ten scalars, so the covering
+	* index no longer saves ~30 KB of page per row; it still saves the row
+	* fetch, and the accounting read is the one this hub runs on a schedule.
 	*/
 	{
 		name: "idx_recorder_segment_hours_loc_accounting",
@@ -8716,13 +8886,13 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 * nominal `-segment_time` (ffmpeg cuts on the next GOP, never on the clock).
 *
 * It is a guess, and this is the shape of being wrong in each direction.
-* TIGHTER: a normal rollover stops sealing, every hour of the archive is walked
-* once by its first reader, and D451's "at rest nothing is unsealed" is undone
-* — at ~3.6 ms per hour directory cold, affordable but pointless. LOOSER: a
-* runner respawn inside the window seals an hour it entered late, which is
-* exactly the 2026-09-17 defect; the observed hole there was ~29 minutes, so
-* anything under a few minutes would have caught it and 90 s is the smallest
-* number that does not fire on a legitimate rollover.
+* TIGHTER: a normal rollover stops sealing and every hour of the archive is
+* listed once by the adoption sweep — at ~1 ms per hour directory on this hub's
+* SATA SSD, affordable but pointless. LOOSER: a runner respawn inside the
+* window seals an hour it entered late, which is exactly the 2026-09-17 defect;
+* the observed hole there was ~29 minutes, so anything under a few minutes
+* would have caught it and 90 s is the smallest number that does not fire on a
+* legitimate rollover.
 */
 var WRITER_HOUR_ENTRY_GRACE_MS = 9e4;
 /** The identity of the {@link hourAggregate} fold — an hour holding nothing. */
@@ -8736,12 +8906,11 @@ var EMPTY_HOUR_AGGREGATE = {
 * ONE path folded into an aggregate — the whole derivation, expressed as its
 * single step.
 *
-* {@link hourAggregate} is this step over every path, and {@link
+* {@link hourAggregate} is this step over a whole listing, and {@link
 * SegmentHourLedger.recordSegment} is this step over the one path that just
 * arrived. That is not two implementations that happen to agree: the full
 * derivation is *defined* as this function repeated, so an append is the fold
-* resumed from the state the held row already carries — a `SegmentHourRow`'s
-* aggregate half IS the fold state over its `paths`.
+* resumed from the state the held row already carries.
 *
 * Why it had to become a step: `recordSegment` re-derived the whole hour on
 * every finalize. Σ1..360 ≈ 65 k path parses per camera-profile-hour at 10 s
@@ -8764,49 +8933,57 @@ function withSegmentPath(agg, path) {
 	};
 }
 /**
-* Bytes / count / oldest / newest for one hour's paths — the sole FULL
-* derivation, used by rebuilds ({@link recordToRow}, `dropSegments`) and never
-* by the append path.
+* Bytes / count / oldest / newest for one hour's LISTING — the sole FULL
+* derivation, and since D523 the only thing that can produce an EXACT row.
 *
 * Every field of a segment path encodes its own facts (`parseSegmentPath`), so
-* this is a derivation, not a measurement: it can never disagree with the paths
-* it was computed from.
+* this is a derivation, not a measurement: it can never disagree with the
+* listing it was computed from.
 */
 function hourAggregate(paths) {
 	let agg = EMPTY_HOUR_AGGREGATE;
 	for (const path of paths) agg = withSegmentPath(agg, path);
 	return agg;
 }
-/** Build the persisted row for an hour from its paths — the ONE constructor. */
+/** Build the persisted row for an hour from a LISTING of it — the ONE
+*  constructor that can produce an exact aggregate. */
 function segmentHourRow(base) {
+	const { paths, sealed, ...identity } = base;
 	return {
-		...base,
-		sealed: base.sealed ?? false,
-		pathsResident: true,
-		...hourAggregate(base.paths)
+		...identity,
+		sealed: sealed ?? false,
+		...hourAggregate(paths)
+	};
+}
+/**
+* Build the persisted row for an hour from an aggregate somebody already folded
+* — a relocation moving one, or a listing that has already been reduced.
+*
+* `sealed` is a NAMED field and never a positional boolean, because
+* `scripts/check-seal-authority.ts` attributes every literal `sealed: true` in
+* the recorder to the method that wrote it. A seal smuggled in as a third
+* argument is a seal the guard cannot see.
+*/
+function hourRowOf(identity, row) {
+	return {
+		...identity,
+		...row
 	};
 }
 /**
 * The row an hour becomes when ONE more path joins it.
 *
-* Identical to `segmentHourRow({ ...held, paths: [...held.paths, path] })` and
-* strictly cheaper: the aggregate half of `held` is already the fold over
-* `held.paths`, so this resumes that fold instead of restarting it. The
+* Identical to `segmentHourRow({ …held, paths: [...everything, path] })` and
+* strictly cheaper: the aggregate half of `held` is already the fold over the
+* hour's names, so this resumes that fold instead of restarting it. The
 * equality is not an assumption — `segment-hour-append.spec.ts` pins it on
 * generated hours including out-of-order arrival, duplicate paths, unparseable
 * paths and storm-sized hours.
-*
-* The four fields are named rather than spread on purpose. {@link
-* withSegmentPath} hands its argument straight back for a path the parser
-* refuses, and `held` is a whole row — spreading that return would put the
-* PREVIOUS `paths` array back over the appended one. Which is exactly what it
-* did until the generated-hours test caught it.
 */
 function appendSegmentPath(held, path) {
 	const { bytes, segments, minStartMs, maxStartMs } = withSegmentPath(held, path);
 	return {
 		...held,
-		paths: [...held.paths, path],
 		bytes,
 		segments,
 		minStartMs,
@@ -8824,6 +9001,20 @@ function appendSegmentPath(held, path) {
 * `readdir` over an unmounted root deletes all of it.
 */
 var LEDGER_PRUNE_MAX_SHARE = .5;
+/**
+* The largest share of ONE hour's accounted segments a single listing may
+* erase (D523).
+*
+* The directory is the authority for WHICH segments exist, so a listing of a
+* closed hour replaces that hour's aggregate — including downwards, which is
+* what makes an over-counted row self-correcting. The guard is the same
+* argument {@link LEDGER_PRUNE_MAX_SHARE} makes one level up: a root that has
+* gone away, or a bucket half-deleted by a round that died, answers SHORT, and
+* a short answer that halves an hour is indistinguishable from one that is
+* simply right. Under the bar the listing wins; over it the row stands, the
+* hour stays unsealed, and the disagreement is named.
+*/
+var HOUR_LISTING_MAX_SHRINK_SHARE = .5;
 /** Backstop on the oldest-first probe. A bounded read must stay bounded even if
 *  a caller asks for a target no archive can cover. */
 var OLDEST_MAX_PAGES = 16;
@@ -8833,9 +9024,6 @@ var OLDEST_PROBE_COLUMNS = [
 	"bytes",
 	"locationId"
 ];
-/** Aggregate-repair probe: the primary key always comes back, so this asks for
-*  the predicate column alone. */
-var REPAIR_PROBE_COLUMNS = ["segments"];
 /**
 * Backstop on {@link SegmentHourLedger.streamSegments}.
 *
@@ -8874,47 +9062,8 @@ var CENSUS_FIELDS = [
 		op: "max"
 	}
 ];
-/** Rows repaired per boot. The live archive is ~19 k hour rows. */
-var REPAIR_MAX_ROWS = 5e4;
-/**
-* The boot projection (D287): everything the recorder's always-resident tier
-* needs, and deliberately NOT `paths`.
-*
-* `paths` is ~55 B per segment and the archive is the only thing that grows:
-* ~16 MB of JSON today, a projected ~460 MB at 28 TB of today's bitrate mix
-* and ~5.9 GB at a low-bitrate mix — one tRPC response, parsed on the main
-* thread, before the index exists. The summary half is O(writers × days) and
-* stays ~10–15 MB at any archive size.
-*/
-var SEGMENT_HOUR_SUMMARY_COLUMNS = [
-	"deviceId",
-	"profile",
-	"locationId",
-	"hourStartMs",
-	"bytes",
-	"segments",
-	"minStartMs",
-	"maxStartMs",
-	"sealed"
-];
 /** Summary rows folded into the mirror between yields. */
 var LOAD_CHUNK = 5e3;
-/** Hour rows materialised per point-read page. One page covers a day of one
-*  camera's three profiles with room to spare. */
-var HOUR_DETAIL_PAGE = 64;
-/**
-* The live tail materialised at boot: the current hour and the one before it.
-*
-* `recordSegment` must gate from RAM (D49), and the hour it appends to at boot
-* is exactly the hour the previous process was writing. Two hours × the active
-* writers is ~60 rows — one point-read page — and it is what makes the write
-* path's materialise a case that essentially never happens.
-*/
-var LIVE_TAIL_HOURS = 2;
-/** Rows the one-shot aggregate repair may materialise in a single boot. The
-*  backfill is bounded so it cannot re-become the whole-archive read D287
-*  removed; a partial pass finishes on the next boot. */
-var REPAIR_MAX_MATERIALIZE = 2e3;
 /** The four scalars an accounting answer is made of, asked in one statement. */
 var ACCOUNTING_FIELDS = [
 	{
@@ -8967,14 +9116,6 @@ function writerKey(deviceId, profile) {
 function writerHourKey(deviceId, profile, hour) {
 	return `${deviceId}|${profile}|${hour}`;
 }
-function detailOf(row) {
-	return {
-		locationId: row.locationId,
-		hourStartMs: row.hourStartMs,
-		paths: row.paths,
-		sealed: row.sealed
-	};
-}
 /**
 * The `hourStartMs` of one probe record.
 *
@@ -8986,21 +9127,31 @@ function hourOfRecord(record) {
 	const raw = record.data["hourStartMs"];
 	return typeof raw === "number" && Number.isFinite(raw) ? raw : -1;
 }
-function uniquePaths(paths) {
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const p of paths) {
-		if (seen.has(p)) continue;
-		seen.add(p);
-		out.push(p);
+/** One listing turned into the segment rows a caller can act on — the only
+*  place a `SegmentRow` is built out of a directory read. */
+function segmentRowsOf(locationId, paths) {
+	const rows = [];
+	let unparseable = 0;
+	for (const path of paths) {
+		const parsed = parseSegmentPath(path);
+		if (parsed === null) {
+			unparseable += 1;
+			continue;
+		}
+		rows.push({
+			deviceId: parsed.deviceId,
+			profile: parsed.profile,
+			startMs: parsed.startMs,
+			durMs: parsed.durMs,
+			bytes: parsed.bytes,
+			path,
+			locationId
+		});
 	}
-	return out;
-}
-function samePaths(a, b) {
-	if (a.length !== b.length) return false;
-	const set = new Set(a);
-	for (const p of b) if (!set.has(p)) return false;
-	return true;
+	return {
+		rows,
+		unparseable
+	};
 }
 function rowToValue(row) {
 	return {
@@ -9008,7 +9159,6 @@ function rowToValue(row) {
 		profile: row.profile,
 		locationId: row.locationId,
 		hourStartMs: row.hourStartMs,
-		paths: encodePaths(row.paths),
 		bytes: row.bytes,
 		segments: row.segments,
 		minStartMs: row.minStartMs,
@@ -9021,44 +9171,21 @@ function rowToValue(row) {
 function sealedOf(raw) {
 	return raw === 1 || raw === true;
 }
-function recordToRow(key, data) {
-	const deviceId = Number(data["deviceId"]);
-	const profile = data["profile"];
-	const locationId = data["locationId"];
-	const hour = Number(data["hourStartMs"]);
-	const decodedPaths = decodePaths(data["paths"]);
-	if (decodedPaths === null) return null;
-	const raw = decodedPaths;
-	if (!Number.isFinite(deviceId) || deviceId <= 0 || typeof profile !== "string" || profile.length === 0 || typeof locationId !== "string" || locationId.length === 0 || !Number.isFinite(hour) || !Array.isArray(raw) || !raw.every((p) => typeof p === "string" && p.length > 0)) return null;
-	return segmentHourRow({
-		key,
-		deviceId,
-		profile,
-		locationId,
-		hourStartMs: hour,
-		paths: raw,
-		sealed: sealedOf(data["sealed"])
-	});
-}
-/** The paths of a summary row: one shared empty array, never a per-row
-*  allocation, and never mistakable for "this hour holds nothing". */
-var NO_PATHS = Object.freeze([]);
 function finiteOr0(raw) {
 	const n = Number(raw);
 	return Number.isFinite(n) ? n : 0;
 }
 /**
-* One row of the boot projection ({@link SEGMENT_HOUR_SUMMARY_COLUMNS}).
+* One persisted row.
 *
-* The identity half is validated exactly as {@link recordToRow} validates it —
-* a row that cannot say which camera, profile, location and hour it is about
-* is skipped, because a summary keyed on garbage would refuse the write path
-* for an hour that is perfectly fine. The aggregate half is taken as the
-* database wrote it: a row that predates the aggregate columns reports zeros,
-* which UNDER-reports its disk (prunes less, never more) until
-* {@link SegmentHourLedger.repairAggregates} rewrites it.
+* The identity half is validated: a row that cannot say which camera, profile,
+* location and hour it is about is DISCARDED, because a row keyed on garbage
+* would refuse the write path for an hour that is perfectly fine. The aggregate
+* half is taken as the database wrote it — a row that predates the aggregate
+* columns reports zeros, which UNDER-reports its disk (prunes less, never more)
+* until a listing of that hour re-derives it.
 */
-function summaryToRow(key, data) {
+function recordToRow(key, data) {
 	const deviceId = Number(data["deviceId"]);
 	const profile = data["profile"];
 	const locationId = data["locationId"];
@@ -9070,8 +9197,6 @@ function summaryToRow(key, data) {
 		profile,
 		locationId,
 		hourStartMs: hour,
-		paths: NO_PATHS,
-		pathsResident: false,
 		sealed: sealedOf(data["sealed"]),
 		bytes: finiteOr0(data["bytes"]),
 		segments: finiteOr0(data["segments"]),
@@ -9093,11 +9218,12 @@ var SPEC = {
 var SegmentHourLedger = class SegmentHourLedger {
 	ledger;
 	logger;
-	/** Held for the two ARCHIVE reads below, which are queries rather than mirror
+	/** Held for the ARCHIVE reads below, which are queries rather than mirror
 	*  lookups. Every DECISION path (`recordSegment`, `dropSegments`, the prune
 	*  refusals) still answers from the mirror alone — D49 is about gates, and an
 	*  accounting number is not a gate. */
 	store;
+	listHour;
 	isLocationUsable;
 	now;
 	loadChunk;
@@ -9111,6 +9237,19 @@ var SegmentHourLedger = class SegmentHourLedger {
 	lanes = /* @__PURE__ */ new Map();
 	/** Per (device, profile): the hour its writer last appended to. */
 	writerHours = /* @__PURE__ */ new Map();
+	/**
+	* Segment paths THIS PROCESS has already accounted for, per hour key.
+	*
+	* The `paths` column used to make the write path idempotent for free: an
+	* append checked `held.paths.includes(path)`. With the column gone the
+	* aggregate cannot say whether it already counted a name, so the dedup lives
+	* here — bounded to the hours this process actually writes (two per writer:
+	* the current hour and the one it just left), dropped when the writer moves
+	* on. A duplicate that survives a RESTART is not caught here and is not
+	* silent either: the row is unsealed, and the first listing of the closed
+	* hour re-derives the aggregate exactly ({@link adoptWalkedHour}).
+	*/
+	accounted = /* @__PURE__ */ new Map();
 	/** Hour keys a write was REFUSED for in this process — never sealed by it. */
 	refused = /* @__PURE__ */ new Set();
 	/**
@@ -9123,6 +9262,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.store = deps.store;
+		this.listHour = deps.listHour ?? null;
 		this.isLocationUsable = deps.isLocationUsable ?? (() => true);
 		this.now = deps.now ?? (() => Date.now());
 		this.loadChunk = deps.loadPacing?.chunkSize ?? LOAD_CHUNK;
@@ -9141,22 +9281,17 @@ var SegmentHourLedger = class SegmentHourLedger {
 		return this.ledger.declare();
 	}
 	/**
-	* Boot load — **T1 only** (D287).
+	* Boot load — every hour row, in one query.
 	*
-	* One projected query over {@link SEGMENT_HOUR_SUMMARY_COLUMNS}, folded into
-	* the mirror in chunks with a yield between them, then one point-read page
-	* that materialises the live tail so the write path can gate from RAM.
+	* Since D523 the whole row is ten scalars, so there is no second tier to
+	* materialise and no projection to choose: the mirror this returns is the
+	* ledger, entire. It keeps `DurableLedger.load`'s two rules — a failed read
+	* RETURNS WHAT IS ALREADY MIRRORED rather than clearing it, and a malformed
+	* row is skipped rather than repaired.
 	*
-	* It replaces `DurableLedger.load`, which fetches whole rows and therefore
-	* the whole archive's path strings, and it keeps that primitive's two rules:
-	* a failed read RETURNS WHAT IS ALREADY MIRRORED rather than clearing it,
-	* and a malformed row is skipped rather than repaired.
-	*
-	* It deliberately does NOT replay the archive into {@link RecordingIndex}.
-	* `hydrated` now means "the rows are resident", so a ledger-known hour is
-	* merely *hydratable from T3*: the first read of it pays one point read
-	* ({@link detailForWindow}), and an hour whose tail the ledger is missing is
-	* no longer permanently invisible to playback.
+	* It deliberately does NOT replay the archive into {@link RecordingIndex}: a
+	* row says how MUCH an hour holds, never which files, so only a listing can
+	* seed the index (D523).
 	*/
 	async load() {
 		const startedMs = this.now();
@@ -9164,7 +9299,6 @@ var SegmentHourLedger = class SegmentHourLedger {
 		try {
 			records = await this.store.query.query({
 				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				columns: SEGMENT_HOUR_SUMMARY_COLUMNS,
 				filter: { limit: this.rowCap }
 			});
 		} catch (err) {
@@ -9181,7 +9315,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 			const end = Math.min(i + this.loadChunk, records.length);
 			for (let j = i; j < end; j += 1) {
 				const record = records[j];
-				const row = summaryToRow(record.id, record.data);
+				const row = recordToRow(record.id, record.data);
 				if (row === null) {
 					skipped += 1;
 					continue;
@@ -9190,7 +9324,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 			}
 			if (end < records.length) await this.yieldBetween();
 		}
-		if (skipped > 0) this.logger.warn("recorder: segment-hour summaries skipped as malformed — they gate NOTHING", { meta: {
+		if (skipped > 0) this.logger.warn("recorder: segment-hour rows skipped as malformed — they gate NOTHING", { meta: {
 			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
 			skipped
 		} });
@@ -9198,11 +9332,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 			limit: this.rowCap,
 			loaded: records.length
 		} });
-		const tail = await this.materializeLiveTail();
 		this.logger.info("recorder: segment-hour ledger loaded", { meta: {
 			hours: this.ledger.size,
-			pathsLoaded: false,
-			liveTailHours: tail,
 			skipped,
 			queryMs: queriedMs - startedMs,
 			ms: this.now() - startedMs,
@@ -9210,8 +9341,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 		} });
 		return this.ledger.snapshot();
 	}
-	/** Every hour the ledger knows — summaries included. A row whose
-	*  `pathsResident` is false carries real aggregates and empty `paths`. */
+	/** Every hour row held. Pure RAM. */
 	snapshot() {
 		return this.ledger.snapshot();
 	}
@@ -9221,10 +9351,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* The archive's answer to "what should placement plan for", and the reason it
 	* is here rather than a `census` loop or an index read:
 	*
-	*   - `RecordingIndex.accountingByProfile` is the wrong authority. Since D287
-	*     it holds the live tail plus whatever an operator hydrated, so a camera
-	*     nobody has viewed since boot reports NO profiles — and the placement
-	*     pass then never plans it (D295 §3a #9, D299).
+	*   - `RecordingIndex.accountingByProfile` is the wrong authority. It holds
+	*     the live tail plus whatever a reader hydrated, so a camera nobody has
+	*     viewed since boot reports NO profiles — and the placement pass then
+	*     never plans it (D295 §3a #9, D299).
 	*   - `census({ deviceId, profiles: [p] })` is the right authority but the
 	*     wrong shape for a 30 s tick: it is one SQL round trip per (camera,
 	*     profile), so a 16-camera fleet pays 48 SERIAL trips over the UDS door
@@ -9232,10 +9362,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*     240003` pass (see `PLACEMENT_STORE_TIMEOUT_MS`), and it grows with the
 	*     fleet.
 	*
-	* So it is answered from T1, the hour summary D287 made permanently resident
-	* precisely so that O(writers × days) questions cost no I/O: ~10–15 MB and
-	* ~47 k rows even at 30 TB, one fold, no query. A hydrated segment row is not
-	* needed to know that an hour exists.
+	* So it is answered from the mirror: one fold, no query, no I/O.
 	*
 	* An EMPTY result for a device is a real answer — "the archive knows no hour
 	* for this camera" — and it is also what a ledger whose load failed reports,
@@ -9252,136 +9379,111 @@ var SegmentHourLedger = class SegmentHourLedger {
 		}
 		return out;
 	}
-	/** Does the ledger hold a row for this hour at all? Pure RAM — the gate the
-	*  storage-walk repair consults before it upserts a rebuilt hour. */
+	/** Does the ledger hold a row for this hour at all? Pure RAM. */
 	knowsHour(deviceId, profile, locationId, hour) {
 		return this.ledger.has(segmentHourKey(deviceId, profile, locationId, hour));
 	}
-	/**
-	* The paths of ONE held hour row, materialised — or `null` when they could
-	* not be read.
-	*
-	* {@link detailForWindow} answers per (device, window) and drops the profile
-	* on the way out, which is fine for a reader assembling a playlist and wrong
-	* for a caller that must act on one hour ROW: the ghost-location reconcile
-	* decides per `(deviceId, profile, locationId, hour)` and hands the resulting
-	* paths straight back to {@link dropSegments} / {@link repointSegments},
-	* whose bucket key is that same tuple.
-	*
-	* `null` is "known, and its detail could not be had" — never an empty array.
-	* The one caller FORGETS rows on this answer, and a failed point read that
-	* came back as `[]` would read as "this hour holds nothing", which is the
-	* D148 prune-on-no-evidence this ledger refuses to make.
-	*/
-	async hourPaths(deviceId, profile, locationId, hour) {
-		const key = segmentHourKey(deviceId, profile, locationId, hour);
-		if (!this.ledger.has(key)) return null;
-		const held = await this.resident(key, deviceId);
-		return held === null ? null : held.paths;
+	/** One held hour row, or `undefined`. Pure RAM — since D523 a row carries
+	*  everything it has. */
+	hourRow(deviceId, profile, locationId, hour) {
+		return this.ledger.get(segmentHourKey(deviceId, profile, locationId, hour));
 	}
 	/**
-	* The hours of `[fromMs, toMs)` the ledger knows, with their paths — the
-	* cold-hour detail read that replaces the boot replay (D287).
+	* A LISTING of a CLOSED hour is adopted as that hour's account, and SEALS it.
 	*
-	* One bounded point read against the settings store, never the media array:
-	* a `readdir` of one hour directory was measured at ~650 ms under load on
-	* the live share, and the array is the resource the scrub feeder is
-	* competing for. Hours the ledger does NOT know are absent from the result,
-	* and the caller walks those from disk exactly as it always did.
+	* The directory is the authority for which segments exist (D523), so a
+	* listing of an hour that is OVER is the one complete answer there is — it
+	* replaces the row's aggregate rather than merging with it, which is what
+	* makes an hour that was over-counted (a duplicate finalize across a restart)
+	* or under-counted (a writer torn down mid-hour) self-correcting. The caller
+	* guarantees the hour is CLOSED: a live hour's directory races its writer, so
+	* a listing of it is a lower bound.
 	*
-	* **A read that fails returns what it already had** (D49). The caller sees
-	* fewer hours, the index stays `unknown` for the rest, and the window falls
-	* through to the walk — nothing is destroyed and nothing renders as an
-	* empty hour that was merely unread.
-	*/
-	async detailForWindow(deviceId, fromMs, toMs) {
-		const first = hourStartMs(fromMs);
-		const out = [];
-		const wanted = [];
-		for (const row of this.ledger.snapshot()) {
-			if (row.deviceId !== deviceId) continue;
-			if (row.hourStartMs < first || row.hourStartMs >= toMs) continue;
-			if (row.pathsResident) {
-				out.push(detailOf(row));
-				continue;
-			}
-			wanted.push(row.key);
-		}
-		for (const row of await this.materialize(wanted, deviceId)) out.push(detailOf(row));
-		return out;
-	}
-	/**
-	* Union a CLOSED hour the storage walk read into its row, and SEAL it.
-	*
-	* The reader repairs the durable index it just reconstructed, so the next
-	* cold read of this hour is a point read instead of another `readdir`
-	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2), and it
-	* seals the row because a directory read of a closed hour is the one
-	* complete answer there is. The caller guarantees the hour is CLOSED — a
-	* live hour's directory races its writer, so a walk of it is a lower bound.
-	*
-	* A row the ledger already holds is UNIONED, never replaced: the walk can
-	* only add (D148) — a path the row names and the directory lacks stays,
-	* because "the reader did not see it" is not evidence it is gone. This is
-	* the repair D445 described and did not perform: its predecessor returned
-	* on any known key, so a row known INCOMPLETELY — the only kind that needs
-	* repairing — was exactly the row it refused to touch, and the export's
-	* `forgottenSegments=9758` was counted again the next morning.
-	*
-	* `null` when the row is known and its detail could not be read: nothing
-	* is written from a row whose paths are not resident.
+	* A listing that would erase more than {@link HOUR_LISTING_MAX_SHRINK_SHARE}
+	* of what the row accounts for is REFUSED and named. That is the one thing a
+	* listing cannot be trusted about: a root that has gone away and a bucket a
+	* dead round half-deleted both answer short, and neither is distinguishable
+	* from an hour that is simply smaller than the row thought.
 	*
 	* @seal-authority closed-hour-listing — a directory read of an hour that is
 	* OVER is the one complete answer there is; the caller guarantees the hour is
-	* closed (D451, D521).
+	* closed (D451, D521, D523).
 	*/
 	async adoptWalkedHour(deviceId, profile, locationId, hour, paths) {
 		const key = segmentHourKey(deviceId, profile, locationId, hour);
+		const identity = {
+			key,
+			deviceId,
+			profile,
+			locationId,
+			hourStartMs: hour
+		};
+		const walked = hourAggregate(paths);
 		return this.serialized(key, async () => {
-			if (!this.ledger.has(key)) {
-				if (paths.length === 0) return {
+			const held = this.ledger.get(key);
+			if (held === void 0) {
+				if (walked.segments === 0) return {
 					created: false,
 					added: 0,
 					sealedNow: false
 				};
-				const row = segmentHourRow({
-					key,
-					deviceId,
-					profile,
-					locationId,
-					hourStartMs: hour,
-					paths: uniquePaths(paths),
+				await this.ledger.put(hourRowOf(identity, {
+					...walked,
 					sealed: true
-				});
-				await this.ledger.put(row);
-				this.logger.info("recorder: adopted a closed hour the disk walk rebuilt and the ledger never held", {
+				}));
+				this.logger.info("recorder: adopted a closed hour the disk listing rebuilt and the ledger never held", {
 					tags: { deviceId },
 					meta: {
 						profile,
 						locationId,
 						hourStartMs: hour,
-						segments: row.segments,
-						bytes: row.bytes
+						segments: walked.segments,
+						bytes: walked.bytes
 					}
 				});
 				return {
 					created: true,
-					added: row.paths.length,
+					added: walked.segments,
 					sealedNow: true
 				};
 			}
-			const held = await this.resident(key, deviceId);
-			if (held === null) return null;
-			const union = uniquePaths([...held.paths, ...paths]);
-			const added = union.length - held.paths.length;
-			if (added === 0 && held.sealed) return {
+			const shrink = held.segments - walked.segments;
+			if (shrink > 0 && shrink > held.segments * .5) {
+				this.logger.warn("recorder: hour listing REFUSED — it accounts for less than half of what this hour row holds, which is what an unmounted root looks like; the row stands and stays unsealed", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						locationId,
+						hourStartMs: hour,
+						held: held.segments,
+						listed: walked.segments,
+						maxShare: HOUR_LISTING_MAX_SHRINK_SHARE
+					}
+				});
+				return {
+					created: false,
+					added: 0,
+					sealedNow: false
+				};
+			}
+			const added = Math.max(0, walked.segments - held.segments);
+			if (added === 0 && shrink === 0 && held.sealed) return {
 				created: false,
 				added: 0,
 				sealedNow: false
 			};
-			await this.ledger.put(segmentHourRow({
-				...held,
-				paths: union,
+			if (shrink > 0) this.logger.info("recorder: hour listing accounts for FEWER segments than the row did — the directory decides", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					locationId,
+					hourStartMs: hour,
+					held: held.segments,
+					listed: walked.segments
+				}
+			});
+			await this.ledger.put(hourRowOf(identity, {
+				...walked,
 				sealed: true
 			}));
 			return {
@@ -9411,9 +9513,9 @@ var SegmentHourLedger = class SegmentHourLedger {
 	}
 	/**
 	* A finalize this ledger was NEVER handed — the fire-and-forget lane refused
-	* it. The hour's row is short by that path and this process is the only
-	* party that knows, so the hour must not be sealed by it; a reader walks it
-	* once instead, which is exactly what an unsealed row is for.
+	* it. The hour's row is short by that segment and this process is the only
+	* party that knows, so the hour must not be sealed by it; a listing corrects
+	* it instead, which is exactly what an unsealed row is for.
 	*/
 	markRefused(row) {
 		this.refused.add(hourOf(row).key);
@@ -9441,7 +9543,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 			marked += 1;
 		}
 		if (marked === 0) return 0;
-		this.logger.warn("recorder: segments this writer produced never reached the hour ledger — these hours stay UNSEALED and a reader walks them", {
+		this.logger.warn("recorder: segments this writer produced never reached the hour ledger — these hours stay UNSEALED and a listing corrects them", {
 			tags: { deviceId: span.deviceId },
 			meta: {
 				profile: span.profile,
@@ -9474,10 +9576,11 @@ var SegmentHourLedger = class SegmentHourLedger {
 						graceMs: WRITER_HOUR_ENTRY_GRACE_MS
 					}
 				});
+				this.accounted.delete(target.key);
 				return;
 			}
 			if (this.refused.has(target.key) || this.refusedWriterHours.has(writerHourKey(target.deviceId, target.profile, target.hourStartMs))) {
-				this.logger.warn("recorder: hour left unsealed — a ledger write for it was refused, so its row is short and a reader must walk it", {
+				this.logger.warn("recorder: hour left unsealed — a ledger write for it was refused, so its row is short and a listing must correct it", {
 					tags: { deviceId: target.deviceId },
 					meta: {
 						profile: target.profile,
@@ -9485,10 +9588,12 @@ var SegmentHourLedger = class SegmentHourLedger {
 						hourStartMs: target.hourStartMs
 					}
 				});
+				this.accounted.delete(target.key);
 				return;
 			}
-			const held = await this.resident(target.key, target.deviceId);
-			if (held === null || held.sealed) return;
+			const held = this.ledger.get(target.key);
+			this.accounted.delete(target.key);
+			if (held === void 0 || held.sealed) return;
 			await this.ledger.put({
 				...held,
 				sealed: true
@@ -9516,11 +9621,25 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/**
 	* Run `fn` after every mutation already queued on `key`.
 	*
-	* A row is read, appended to and written back with awaits in between; two
-	* such runs on one key interleave, and the second write carries a paths
-	* array that never saw the first — the write-behind's own lost update. The
-	* lane makes "read, append, write" one step per key. A rejected step must
-	* not poison the lane: the next step still runs.
+	* It was the lost-update guard: a row was read from the STORE, folded into
+	* and written back with awaits in between, so two such runs on one key
+	* interleaved and the second write carried a path set that never saw the
+	* first — the sparse rows D451 found. Since D523 there is no store read on
+	* any of these paths (the mirror holds the whole row) and `DurableLedger.put`
+	* sets the mirror synchronously before it awaits the store, so every
+	* get→fold→put here is synchronous up to the mirror and the interleaving
+	* window is gone.
+	*
+	* What the lane still buys is the ORDER of the durable writes per hour key —
+	* a rollover seal fired without an await must not land over an append that
+	* was queued before it — and a handle for {@link flush} to wait on at
+	* shutdown. A rejected step must not poison the lane: the next step still
+	* runs.
+	*
+	* Note for anyone tempted to delete it: `segment-hour-seal.spec.ts` does NOT
+	* catch its removal any more, and says so. Pinning durable write ORDER needs
+	* a store whose latency a test can control, which `fakeSettingsStore` has no
+	* way to express.
 	*/
 	serialized(key, fn) {
 		const run = (this.lanes.get(key) ?? Promise.resolve()).then(fn, fn);
@@ -9532,116 +9651,59 @@ var SegmentHourLedger = class SegmentHourLedger {
 		return run;
 	}
 	/**
-	* Fetch whole rows for `keys` and promote them in the mirror.
+	* List the hour directories of `rows`, paced, and expand them into segment
+	* rows.
 	*
-	* Paged and yielding: an export window can name thousands of hours, and one
-	* `whereIn` over all of them would rebuild the very whole-archive response
-	* D287 removed. A page that FAILS ends the materialise and returns what
-	* landed — partial detail is real detail, and the caller's fallback (a disk
-	* walk, or refusing a write) is strictly safer than a guess.
-	*
-	* A row the store returns but this cannot parse is EVICTED from the mirror
-	* rather than left as a summary that can never become resident: it re-seeds
-	* cold on the next write, which is `DurableLedger`'s rule 4 and the only
-	* escape from an hour permanently frozen against its own writer.
+	* The one place the ledger touches the array. An hour whose listing FAILED
+	* takes no part in the caller's pass and is SAID — a branch that drops work
+	* silently reads as "there was nothing there", which for a drain or a prune
+	* is the difference between "moved everything" and "moved what it could see".
 	*/
-	async materialize(keys, deviceId) {
+	async listHours(rows, reason) {
 		const out = [];
-		if (keys.length === 0) return out;
-		const tags = deviceId === void 0 ? {} : { tags: { deviceId } };
-		for (let i = 0; i < keys.length; i += HOUR_DETAIL_PAGE) {
-			const page = keys.slice(i, i + HOUR_DETAIL_PAGE);
-			let records;
-			try {
-				records = await this.store.query.query({
-					collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-					filter: {
-						whereIn: { key: page },
-						limit: page.length
-					}
-				});
-			} catch (err) {
-				this.logger.warn("recorder: hour-detail point read failed — these hours stay summaries, and the caller walks the disk or declines the write", {
-					...tags,
+		if (rows.length === 0) return out;
+		const lister = this.listHour;
+		if (lister === null) {
+			this.logger.warn("recorder: no hour lister on this ledger — nothing that needs segment NAMES can run here", { meta: {
+				hours: rows.length,
+				reason
+			} });
+			return out;
+		}
+		let listed = 0;
+		for (const row of rows) {
+			const paths = await lister(row.locationId, row.deviceId, row.profile, row.hourStartMs);
+			if (paths === null) {
+				this.logger.warn("recorder: hour directory could not be listed — this hour takes NO part in this pass", {
+					tags: { deviceId: row.deviceId },
 					meta: {
-						collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-						asked: page.length,
-						materialized: out.length,
-						error: String(err)
+						profile: row.profile,
+						locationId: row.locationId,
+						hourStartMs: row.hourStartMs,
+						accounted: row.segments,
+						reason
 					}
 				});
-				return out;
+				continue;
 			}
-			for (const record of records) {
-				const row = recordToRow(record.id, record.data);
-				if (row === null) {
-					this.ledger.evict(record.id);
-					this.logger.warn("recorder: hour row is unparseable — dropping the summary so the hour re-seeds cold instead of freezing its writer", {
-						...tags,
-						meta: { key: record.id }
-					});
-					continue;
+			const { rows: segments, unparseable } = segmentRowsOf(row.locationId, paths);
+			if (unparseable > 0) this.logger.warn("recorder: hour directory holds names that are not segments", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					profile: row.profile,
+					locationId: row.locationId,
+					hourStartMs: row.hourStartMs,
+					unparseable,
+					reason
 				}
-				this.ledger.stage(row);
-				out.push(row);
-			}
-			if (i + HOUR_DETAIL_PAGE < keys.length) await this.yieldBetween();
+			});
+			out.push(...segments);
+			listed += 1;
+			if (listed % 8 === 0) await this.yieldBetween();
 		}
 		return out;
 	}
 	/**
-	* Materialise every hour these devices hold, and report how many stayed
-	* summaries.
-	*
-	* The reconcile is the one path that DELETES durable rows, so it may not run
-	* against a mirror that only half knows what it holds. This is a whole-device
-	* read and it is deliberately confined here: `reconcileFromIndex` follows an
-	* operator-armed rescan of that same device — a recursive `readdir` over
-	* >1M files — so a paged point read alongside it is noise, and it is the one
-	* caller whose correctness depends on completeness.
-	*/
-	async materializeDevices(deviceIds) {
-		const keys = [];
-		for (const row of this.ledger.snapshot()) if (!row.pathsResident && deviceIds.has(row.deviceId)) keys.push(row.key);
-		if (keys.length === 0) return;
-		await this.materialize(keys);
-		const stillSummary = /* @__PURE__ */ new Map();
-		for (const row of this.ledger.snapshot()) {
-			if (row.pathsResident || !deviceIds.has(row.deviceId)) continue;
-			stillSummary.set(row.deviceId, (stillSummary.get(row.deviceId) ?? 0) + 1);
-		}
-		for (const [deviceId, unreadable] of stillSummary) this.logger.warn("recorder: hours without readable detail take NO part in this reconcile — they are neither pruned nor unioned", {
-			tags: { deviceId },
-			meta: {
-				asked: keys.length,
-				unreadable
-			}
-		});
-	}
-	/** The hour a write path may touch: current + previous. Materialised at boot
-	*  so {@link recordSegment}'s dedup gate answers from RAM (D49). */
-	async materializeLiveTail() {
-		const oldest = hourStartMs(this.now()) - (LIVE_TAIL_HOURS - 1) * HOUR_MS$4;
-		const keys = [];
-		for (const row of this.ledger.snapshot()) if (row.hourStartMs >= oldest && !row.pathsResident) keys.push(row.key);
-		return (await this.materialize(keys)).length;
-	}
-	/**
-	* Promote one HELD row to paths-resident, or answer `null`.
-	*
-	* `null` means "this hour is known and its detail could not be had" — the
-	* only honest answer to a failed point read, and every caller turns it into
-	* "do nothing". It is deliberately distinct from `this.ledger.get(key) ===
-	* undefined`, which means "no such hour" and is what licenses a fresh row.
-	*/
-	async resident(key, deviceId) {
-		const held = this.ledger.get(key);
-		if (held !== void 0 && held.pathsResident) return held;
-		await this.materialize([key], deviceId);
-		const after = this.ledger.get(key);
-		return after !== void 0 && after.pathsResident ? after : null;
-	}
-	/**
 	* Bytes / count / oldest / newest across a SET of storage locations, as ONE
 	* `SUM`/`COUNT`/`MIN`/`MAX` over the hour rows.
 	*
@@ -9682,9 +9744,9 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* ## Why two phases
 	*
 	* Phase one reads only the small columns and walks oldest-first until the
-	* accumulated bytes cover the target — normally one page. `paths` is by far
-	* the fattest column in the row and phase one never touches it. Phase two
-	* fetches paths for exactly the hours phase one chose.
+	* accumulated bytes cover the target — normally one page. Phase two LISTS the
+	* hour directories phase one chose, which is the only thing that can name the
+	* files eviction is about to delete (D523).
 	*
 	* `exhausted` means the stream ran out before the target was met — the
 	* caller's stop condition, and the one thing a bounded read must still be
@@ -9718,11 +9780,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/**
 	* Every camera the ledger holds an hour for on these locations.
 	*
-	* Answered from T1 — the always-resident hour summary, which carries
-	* `deviceId` and `locationId` — exactly like {@link profilesWithFootage},
-	* and for the same reason: this is an O(writers × days) question and it must
-	* cost no I/O. It runs on the disk-pressure path, where an I/O that fails
-	* would have to be turned into a verdict.
+	* Answered from the mirror, exactly like {@link profilesWithFootage}, and for
+	* the same reason: this is an O(writers × days) question and it must cost no
+	* I/O. It runs on the disk-pressure path, where an I/O that fails would have
+	* to be turned into a verdict.
 	*
 	* An EMPTY answer is "the mirror knows no hour here", which is also what a
 	* ledger whose load failed reports — so the caller must treat it as "decide
@@ -9737,7 +9798,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* Bytes / segments / oldest / newest per CAMERA on these locations — the
 	* per-camera half of the storage page, answered by the ARCHIVE (D418).
 	*
-	* ## Why the T1 fold and not `census({ deviceId })` per camera
+	* ## Why the mirror fold and not `census({ deviceId })` per camera
 	*
 	* `census` is the right authority for a SCOPE, and it cannot express this
 	* scope: {@link SegmentHourLedger.predicate} takes ONE `locationId`, so
@@ -9747,14 +9808,10 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* accounts for. Per camera per volume that is `cameras × volumes` SQL
 	* aggregates for one operator click, and it grows with the fleet.
 	*
-	* The T1 hour summary answers all of them in ONE pass with no I/O, exactly
-	* as {@link devicesWithFootage} and {@link profilesWithFootage} already do,
-	* and it is the same rows `accountingForLocations` sums in SQL — the mirror
-	* is write-behind, so it is never BEHIND the store. The cost is one pass
-	* over the hour rows the mirror holds — O(writers × profiles × hours), ~19 k
-	* on the live hub (see {@link REPAIR_MAX_ROWS}) against 98 445 segments,
-	* i.e. it does NOT scale with the segment count — and it is capped for good
-	* by {@link SEGMENT_HOUR_SUMMARY_LIMIT}, the mirror's own ceiling.
+	* The mirror answers all of them in ONE pass with no I/O, exactly as
+	* {@link devicesWithFootage} and {@link profilesWithFootage} already do, and
+	* it is the same rows `accountingForLocations` sums in SQL — the mirror is
+	* write-behind, so it is never BEHIND the store.
 	*
 	* ## What an empty answer means
 	*
@@ -9828,44 +9885,28 @@ var SegmentHourLedger = class SegmentHourLedger {
 			rows: [],
 			exhausted: true
 		};
-		const full = await this.store.query.query({
-			collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-			filter: {
-				whereIn: { key: chosen },
-				limit: chosen.length
-			}
-		});
-		const rows = [];
-		for (const record of full) {
-			const hour = recordToRow(record.id, record.data);
-			if (hour === null) continue;
-			this.ledger.stage(hour);
-			for (const path of hour.paths) {
-				const parsed = parseSegmentPath(path);
-				if (parsed === null) continue;
-				rows.push({
-					deviceId: parsed.deviceId,
-					profile: parsed.profile,
-					startMs: parsed.startMs,
-					durMs: parsed.durMs,
-					bytes: parsed.bytes,
-					path,
-					locationId: hour.locationId
-				});
-			}
-		}
 		return {
-			rows: rows.toSorted((a, b) => a.startMs - b.startMs),
+			rows: (await this.listHours(this.rowsOfKeys(chosen), "oldest-segments")).toSorted((a, b) => a.startMs - b.startMs),
 			exhausted
 		};
 	}
+	/** Mirror rows for keys a probe named. A key the mirror does not hold is
+	*  skipped: the probe and the mirror describe the same table, and an hour the
+	*  mirror never loaded is one this process may not act on. */
+	rowsOfKeys(keys) {
+		const out = [];
+		for (const key of keys) {
+			const row = this.ledger.get(key);
+			if (row !== void 0) out.push(row);
+		}
+		return out;
+	}
 	/**
 	* The predicate half of an {@link ArchiveScope}, as one filter.
 	*
 	* REFUSES an empty scope rather than compiling to "the whole collection".
-	* There is no read here that may be unscoped: at 30 TB the unscoped form is
-	* the ~460 MB boot query D287 deleted, and a helper that quietly allows it is
-	* how that query comes back under a new name.
+	* There is no read here that may be unscoped: an unscoped stream lists every
+	* hour directory on the hub.
 	*/
 	static predicate(scope) {
 		const where = {};
@@ -9878,6 +9919,15 @@ var SegmentHourLedger = class SegmentHourLedger {
 			...profiles.length > 0 ? { whereIn: { profile: [...profiles] } } : {}
 		};
 	}
+	/** Does this row fall inside `scope`? The mirror-side twin of
+	*  {@link SegmentHourLedger.predicate}, for the passes that fold the mirror
+	*  instead of querying. */
+	static inScope(row, scope) {
+		if (scope.locationId !== void 0 && row.locationId !== scope.locationId) return false;
+		if (scope.deviceId !== void 0 && row.deviceId !== scope.deviceId) return false;
+		const profiles = scope.profiles ?? [];
+		return profiles.length === 0 || profiles.includes(row.profile);
+	}
 	/**
 	* What the ARCHIVE holds in this scope — segments and bytes, as ONE
 	* `SUM` over the hour rows.
@@ -9921,6 +9971,15 @@ var SegmentHourLedger = class SegmentHourLedger {
 	/**
 	* Every segment in `scope`, oldest-first, ONE PAGE at a time.
 	*
+	* ## Two phases, and which authority answers which
+	*
+	* Phase one asks the TABLE which hours the scope holds, oldest-first — the
+	* ordered aggregate no directory read can answer. Phase two LISTS those hour
+	* directories, which is the only authority for the file names the caller is
+	* about to move or delete (D523). An hour whose listing fails is skipped and
+	* said; the caller's own N-versus-M report is what makes the short walk
+	* visible.
+	*
 	* ## Why a keyset cursor and not `offset`
 	*
 	* Both callers MUTATE the scope while they walk it: the drain re-points each
@@ -9937,10 +9996,9 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*
 	* ## What a failed read does
 	*
-	* It ENDS the stream (D49: a fallible read destroys nothing) — and the
-	* caller's own N-versus-M report is what makes the short walk visible. A
-	* stream that swallowed the error and returned would be indistinguishable
-	* from a scope that was genuinely empty.
+	* It ENDS the stream (D49: a fallible read destroys nothing). A stream that
+	* swallowed the error and returned would be indistinguishable from a scope
+	* that was genuinely empty.
 	*/
 	async *streamSegments(scope) {
 		const predicate = SegmentHourLedger.predicate(scope);
@@ -9993,8 +10051,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 			if (nextCursor !== cursor) emittedAtCursor = /* @__PURE__ */ new Set();
 			for (const record of fresh) if (hourOfRecord(record) === nextCursor) emittedAtCursor.add(record.id);
 			cursor = nextCursor;
-			const rows = await this.rowsForHours(fresh.map((record) => record.id), scope);
-			if (rows.length > 0) yield rows;
+			const rows = await this.listHours(this.rowsOfKeys(fresh.map((record) => record.id)), "archive-stream");
+			if (rows.length > 0) yield rows.toSorted((a, b) => a.startMs - b.startMs);
 			if (probe.length < 128 && fresh.length === probe.length) return;
 		}
 		this.logger.warn("recorder: archive stream hit its page backstop — the rest of this scope was NOT walked", {
@@ -10008,110 +10066,50 @@ var SegmentHourLedger = class SegmentHourLedger {
 		});
 	}
 	/**
-	* Phase two of {@link streamSegments}: the paths of exactly the hours phase
-	* one chose, expanded into segment rows.
+	* Forget every hour row in `scope` — the durable half of an operator's
+	* "discard this location's footage".
+	*
+	* It exists because the files are already GONE by the time it runs: the
+	* discard wipes the class subtrees first, so every hour directory in the
+	* scope answers ENOENT and nothing that needs a listing can name a single
+	* segment. The rows are forgotten by their own identity instead, and the
+	* count returned is the SEGMENTS they accounted for, which is the number the
+	* operator is shown.
 	*
-	* Staged into the mirror on the way through, exactly as `oldestSegments`
-	* does and for the same reason: both consumers immediately call a write path
-	* (`repointSegments` / `dropSegments`) which needs the hour paths-resident,
-	* and which `forget`s the row as it empties — so the staging is
-	* self-cleaning and the alternative is two reads per hour.
+	* Never reachable except from that explicitly-armed action: this is the one
+	* surface here that deletes durable rows with no evidence from the array at
+	* all, because the operator's own instruction is the evidence.
 	*/
-	async rowsForHours(keys, scope) {
-		if (keys.length === 0) return [];
-		let records;
-		try {
-			records = await this.store.query.query({
-				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				filter: {
-					whereIn: { key: [...keys] },
-					limit: keys.length
-				}
-			});
-		} catch (err) {
-			this.logger.warn("recorder: archive page detail unavailable — these hours take NO part in this pass", {
-				...scope.deviceId !== void 0 ? { tags: { deviceId: scope.deviceId } } : {},
-				meta: {
-					collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-					hours: keys.length,
-					error: String(err)
-				}
-			});
-			return [];
-		}
-		const rows = [];
-		for (const record of records) {
-			const hour = recordToRow(record.id, record.data);
-			if (hour === null) continue;
-			this.ledger.stage(hour);
-			for (const path of hour.paths) {
-				const parsed = parseSegmentPath(path);
-				if (parsed === null) continue;
-				rows.push({
-					deviceId: parsed.deviceId,
-					profile: parsed.profile,
-					startMs: parsed.startMs,
-					durMs: parsed.durMs,
-					bytes: parsed.bytes,
-					path,
-					locationId: hour.locationId
-				});
-			}
-		}
-		return rows.toSorted((a, b) => a.startMs - b.startMs);
-	}
 	/**
-	* Rewrite, once, the rows whose aggregate columns are still the schema
-	* default.
+	* Forget ONE hour row outright, and answer the segments it accounted for.
 	*
-	* `declareCollection` adds a column additively, so every row written before
-	* the aggregate columns existed holds `segments = 0` — and an hour row with
-	* no segments cannot exist any other way (`dropSegments` forgets an hour that
-	* empties). So `segments = 0` IS the backfill predicate, and after one pass
-	* it selects nothing. A partial repair finishes on the next boot; until then
-	* the affected disks UNDER-report, which prunes less and never more.
+	* The caller must have TRUSTED evidence that the hour holds nothing — a
+	* directory listing under a volume anchor that agreed twice (D49), or a
+	* per-path confirmation against every root there is. This method makes no
+	* such check itself and can make none: it is handed a verdict, not evidence.
 	*
-	* Since D287 the boot load carries no `paths`, and `paths` is the authority
-	* this repair derives from — so the stale rows are MATERIALISED first, at
-	* most {@link REPAIR_MAX_MATERIALIZE} per boot. That bound is the point: an
-	* unbounded materialise here would be the whole-archive read this stage
-	* removed, wearing a different name.
+	* It exists because {@link adoptWalkedHour} deliberately refuses an EMPTY
+	* listing — "the walk found nothing" is what an unmounted root looks like —
+	* so the one repair a listing cannot express is the one that empties an hour.
 	*/
-	async repairAggregates() {
-		let repaired = 0;
-		try {
-			const stale = await this.store.query.query({
-				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				columns: REPAIR_PROBE_COLUMNS,
-				filter: {
-					where: { segments: 0 },
-					limit: REPAIR_MAX_ROWS
-				}
-			});
-			const pending = stale.map((record) => record.id).filter((key) => this.ledger.get(key)?.pathsResident === false);
-			if (pending.length > REPAIR_MAX_MATERIALIZE) this.logger.info("recorder: segment-hour aggregate backfill is bounded this boot — the rest is repaired on the next one", { meta: {
-				pending: pending.length,
-				perBoot: REPAIR_MAX_MATERIALIZE
-			} });
-			await this.materialize(pending.slice(0, REPAIR_MAX_MATERIALIZE));
-			for (const record of stale) {
-				const held = this.ledger.get(record.id);
-				if (held === void 0 || !held.pathsResident || held.segments === 0) continue;
-				await this.ledger.put(held);
-				repaired += 1;
-			}
-		} catch (err) {
-			this.logger.warn("recorder: segment-hour aggregate repair failed — disks under-report", { meta: {
-				collection: RECORDING_SEGMENT_HOURS_COLLECTION,
-				error: String(err)
-			} });
-			return repaired;
+	async forgetHour(deviceId, profile, locationId, hour) {
+		const key = segmentHourKey(deviceId, profile, locationId, hour);
+		return this.serialized(key, async () => {
+			const held = this.ledger.get(key);
+			if (held === void 0) return 0;
+			await this.ledger.forget(key);
+			this.accounted.delete(key);
+			return held.segments;
+		});
+	}
+	async forgetScope(scope) {
+		let forgotten = 0;
+		for (const row of this.ledger.snapshot()) {
+			if (!SegmentHourLedger.inScope(row, scope)) continue;
+			await this.ledger.forget(row.key);
+			forgotten += row.segments;
 		}
-		if (repaired > 0) this.logger.info("recorder: segment-hour aggregate columns backfilled", { meta: {
-			rows: repaired,
-			collection: RECORDING_SEGMENT_HOURS_COLLECTION
-		} });
-		return repaired;
+		return forgotten;
 	}
 	/**
 	* Write-behind: a just-finalized segment joins its hour row.
@@ -10119,8 +10117,8 @@ var SegmentHourLedger = class SegmentHourLedger {
 	* THE hot path — every profile-writer lands here every `segmentSeconds`,
 	* ~3.4 times a second fleet-wide. The append is {@link appendSegmentPath}:
 	* one `parseSegmentPath` and four scalar updates, whatever the hour already
-	* holds. It used to re-derive the whole hour, which made one hour
-	* O(N²) — 65 k parses at 360 segments, 1.46 M in a restart-storm hour.
+	* holds — and since D523 it needs no read of the store at all, because the
+	* mirror carries the whole row.
 	*/
 	async recordSegment(row) {
 		const { key, hourStartMs: hour } = hourOf(row);
@@ -10133,7 +10131,12 @@ var SegmentHourLedger = class SegmentHourLedger {
 			entryMs: row.startMs
 		});
 		await this.serialized(key, async () => {
-			if (!this.ledger.has(key)) {
+			const seen = this.accounted.get(key);
+			if (seen !== void 0 && seen.has(row.path)) return;
+			if (seen === void 0) this.accounted.set(key, new Set([row.path]));
+			else seen.add(row.path);
+			const held = this.ledger.get(key);
+			if (held === void 0) {
 				await this.ledger.put(segmentHourRow({
 					key,
 					deviceId: row.deviceId,
@@ -10144,25 +10147,19 @@ var SegmentHourLedger = class SegmentHourLedger {
 				}));
 				return;
 			}
-			const held = await this.resident(key, row.deviceId);
-			if (held === null) {
-				this.refused.add(key);
-				this.logger.warn("recorder: hour detail unavailable — this finalized segment is NOT in the durable hour row yet", {
-					tags: { deviceId: row.deviceId },
-					meta: {
-						key,
-						path: row.path
-					}
-				});
-				return;
-			}
-			if (held.paths.includes(row.path)) return;
 			await this.ledger.put(appendSegmentPath(held, row.path));
 		});
 	}
 	/**
-	* Eviction confirmed these paths are gone from disk. Drop them; forget the
-	* hour when it holds nothing.
+	* Eviction confirmed these segments are gone from disk. Take them out of the
+	* hour's account; forget the hour when nothing is left.
+	*
+	* The aggregate shrinks by exactly what was removed. `minStartMs` /
+	* `maxStartMs` are NOT re-derived — they cannot be, without a listing — so a
+	* partly-evicted hour keeps extremes that may be older or newer than what
+	* survives. That error is bounded by the hour itself (both values always lie
+	* inside `[hourStartMs, hourStartMs + 1h)`), and the row is UNSEALED so the
+	* next listing of it re-derives both exactly.
 	*/
 	async dropSegments(rows) {
 		const doomed = /* @__PURE__ */ new Map();
@@ -10172,70 +10169,50 @@ var SegmentHourLedger = class SegmentHourLedger {
 			if (entry === void 0) {
 				doomed.set(key, {
 					deviceId: row.deviceId,
-					paths: new Set([row.path])
-				});
-				continue;
-			}
-			entry.paths.add(row.path);
-		}
-		for (const [key, { deviceId, paths }] of doomed) {
-			if (!this.ledger.has(key)) continue;
-			const held = await this.resident(key, deviceId);
-			if (held === null) {
-				this.logger.warn("recorder: hour detail unavailable — these evicted paths stay in the durable hour row until a walk or the next eviction confirms them", {
-					tags: { deviceId },
-					meta: {
-						key,
-						paths: paths.size
-					}
+					bytes: row.bytes,
+					segments: 1
 				});
 				continue;
 			}
-			const next = held.paths.filter((p) => !paths.has(p));
-			if (next.length === 0) {
+			entry.bytes += row.bytes;
+			entry.segments += 1;
+		}
+		for (const [key, dropped] of doomed) await this.serialized(key, async () => {
+			const held = this.ledger.get(key);
+			if (held === void 0) return;
+			const segments = held.segments - dropped.segments;
+			if (segments <= 0) {
 				await this.ledger.forget(key);
-				continue;
+				this.accounted.delete(key);
+				return;
 			}
-			if (next.length === held.paths.length) continue;
-			await this.ledger.put(segmentHourRow({
+			await this.ledger.put({
 				...held,
-				paths: next
-			}));
-		}
+				sealed: false,
+				segments,
+				bytes: Math.max(0, held.bytes - dropped.bytes)
+			});
+		});
 	}
 	/**
-	* Move `rows` from the hour rows they are listed in today to the SAME hours
+	* Move `rows` from the hour they are accounted under today to the SAME hour
 	* at `toLocationId` — the DURABLE half of a relocation.
 	*
-	* Without this the mover re-points only `RecordingIndex`, which is RAM. Since
-	* D287 a closed hour is hydrated from the ledger FIRST and the disk is not
-	* consulted at all when the ledger covered the window, so a relocated hour
-	* comes back at its OLD location on the next boot — paths under a root that
-	* no longer holds the file. Playback does not stat (that syscall per segment
-	* was removed deliberately), so the result is a silent black window; and once
-	* the drained location is deleted, `collectRangeSegments` drops the rows
-	* outright and the footage is invisible. That is the shape of the 2 131
-	* `recordings:high` ghost segments already on this hub.
+	* Without this the mover re-points only `RecordingIndex`, which is RAM, and
+	* the drained location keeps the bytes on every storage page for the life of
+	* the hub. That is the shape of the 2 131 `recordings:high` ghost rows this
+	* hub carried.
 	*
 	* **The ordering is the invariant, not an implementation detail.** The
 	* destination row is written BEFORE the source row is shrunk, and the caller
 	* has not yet deleted the source bytes — so the only state a crash can leave
-	* is "listed at BOTH locations, both of which hold the file", which resolves
-	* correctly whichever row hydrate happens to apply last. The reverse order
-	* has a window in which the path is in NO row, and a ledger-known hour marks
-	* the index `hydrated`: nothing would ever walk that hour again, and the
-	* segment would sit on disk permanently unreachable.
-	*
-	* **Two path sets, not one.** A path can arrive at the target under a
-	* DIFFERENT name than it leaves the source under: a mover that found a file
-	* larger than its recorded size reconciles the row, and the byte count is
-	* part of the name. So the source row is shrunk by what is LEAVING it and the
-	* target row grows by what is ARRIVING — conflating them would leave the
-	* source row naming a file the caller is about to delete.
+	* is "accounted at BOTH locations, both of which hold the files", which a
+	* listing of either hour resolves. The reverse order has a window in which
+	* the segments are accounted NOWHERE.
 	*
-	* Returns `false` when NOTHING was repointed and the caller must delete
-	* nothing. An hour whose detail could not be read decides nothing (D49) —
-	* the same refusal {@link dropSegments} makes for eviction.
+	* Both rows come out UNSEALED: each carries an aggregate that arithmetic
+	* moved rather than a listing derived, and the next walk of either hour fixes
+	* whatever the arithmetic rounded.
 	*/
 	async repointSegments(rows, toLocationId) {
 		const byHour = /* @__PURE__ */ new Map();
@@ -10243,87 +10220,75 @@ var SegmentHourLedger = class SegmentHourLedger {
 			if (row.locationId === toLocationId) continue;
 			const { key } = hourOf(row);
 			const entry = byHour.get(key);
-			if (entry === void 0) byHour.set(key, {
-				row,
-				leaving: new Set([row.fromPath ?? row.path]),
-				arriving: new Set([row.path])
-			});
-			else {
-				entry.leaving.add(row.fromPath ?? row.path);
-				entry.arriving.add(row.path);
-			}
-		}
-		for (const [sourceKey, { row, leaving, arriving }] of byHour) {
-			const held = await this.resident(sourceKey, row.deviceId);
-			if (held === null) {
-				this.logger.warn("recorder: hour detail unavailable — this relocation is REFUSED and nothing is deleted; the segments stay where they are", {
-					tags: { deviceId: row.deviceId },
-					meta: {
-						key: sourceKey,
-						toLocationId,
-						paths: leaving.size
-					}
-				});
-				return false;
-			}
-			const targetKey = segmentHourKey(row.deviceId, row.profile, toLocationId, held.hourStartMs);
-			const target = this.ledger.has(targetKey) ? await this.resident(targetKey, row.deviceId) : void 0;
-			if (target === null) {
-				this.logger.warn("recorder: TARGET hour detail unavailable — this relocation is REFUSED; appending to a summary would rewrite the hour as these paths alone", {
-					tags: { deviceId: row.deviceId },
-					meta: {
-						key: targetKey,
-						fromLocationId: row.locationId,
-						paths: arriving.size
-					}
+			if (entry === void 0) {
+				byHour.set(key, {
+					row,
+					bytes: row.bytes,
+					segments: 1,
+					minStartMs: row.startMs,
+					maxStartMs: row.startMs
 				});
-				return false;
+				continue;
 			}
-			const merged = uniquePaths([...target?.paths ?? [], ...arriving]);
-			await this.ledger.put(segmentHourRow({
+			entry.bytes += row.bytes;
+			entry.segments += 1;
+			entry.minStartMs = Math.min(entry.minStartMs, row.startMs);
+			entry.maxStartMs = Math.max(entry.maxStartMs, row.startMs);
+		}
+		for (const [sourceKey, moved] of byHour) {
+			const hour = hourStartMs(moved.row.startMs);
+			const targetKey = segmentHourKey(moved.row.deviceId, moved.row.profile, toLocationId, hour);
+			const target = this.ledger.get(targetKey);
+			const targetIdentity = {
 				key: targetKey,
-				deviceId: row.deviceId,
-				profile: row.profile,
+				deviceId: moved.row.deviceId,
+				profile: moved.row.profile,
 				locationId: toLocationId,
-				hourStartMs: held.hourStartMs,
-				paths: merged
+				hourStartMs: hour
+			};
+			const targetEmpty = target === void 0 || target.segments === 0;
+			await this.ledger.put(hourRowOf(targetIdentity, {
+				sealed: false,
+				bytes: (target?.bytes ?? 0) + moved.bytes,
+				segments: (target?.segments ?? 0) + moved.segments,
+				minStartMs: targetEmpty ? moved.minStartMs : Math.min(target.minStartMs, moved.minStartMs),
+				maxStartMs: targetEmpty ? moved.maxStartMs : Math.max(target.maxStartMs, moved.maxStartMs)
 			}));
-			const next = held.paths.filter((p) => !leaving.has(p));
-			if (next.length === 0) await this.ledger.forget(sourceKey);
-			else await this.ledger.put(segmentHourRow({
+			const held = this.ledger.get(sourceKey);
+			if (held === void 0) continue;
+			const segments = held.segments - moved.segments;
+			if (segments <= 0) {
+				await this.ledger.forget(sourceKey);
+				continue;
+			}
+			await this.ledger.put({
 				...held,
-				paths: next
-			}));
+				sealed: false,
+				segments,
+				bytes: Math.max(0, held.bytes - moved.bytes)
+			});
 		}
-		return true;
 	}
 	/**
-	* After a disk walk of `deviceIds`, make the ledger match the index — with
-	* two D148 exceptions:
+	* After a disk walk of `deviceIds`, make the ledger match what the index now
+	* holds — with two D148 exceptions:
 	*
 	*  - an hour the walk did not see is dropped ONLY if it is in the past;
 	*    the current hour may still hold a live writer whose file the readdir
 	*    raced;
-	*  - the current hour UNIONs ledger paths with index paths rather than
-	*    replacing, for the same race.
+	*  - the current hour takes the LARGER of the two accounts rather than the
+	*    walk's, for the same race.
 	*
 	* Devices not in `deviceIds` are left untouched (a partial walk must not
 	* prune cameras it did not look at).
 	*
 	* And a walk this ledger does not TRUST prunes nothing at all — see
-	* {@link refusedPrunes}. What such a walk FOUND is still real, so its paths
-	* are unioned in; what it did not find decides nothing (D49).
-	*
-	* Since D287 the walked devices' hours are MATERIALISED first: every
-	* comparison below reads `row.paths`, and a summary's empty `paths` would
-	* read as "the ledger holds nothing here" — which is the union collapsing to
-	* the walk's own view, i.e. the prune the refusal machinery exists to
-	* prevent. An hour whose detail could not be read is left additive-only.
+	* {@link refusedPrunes}. What such a walk FOUND is still real, so its larger
+	* account is taken; what it did not find decides nothing (D49).
 	*/
 	async reconcileFromIndex(index, deviceIds, nowMs) {
 		const walked = new Set(deviceIds);
 		const currentHour = hourStartMs(nowMs);
-		await this.materializeDevices(walked);
 		const fromIndex = /* @__PURE__ */ new Map();
 		for (const deviceId of deviceIds) for (const seg of index.segments(deviceId)) {
 			const { key, hourStartMs: hour } = hourOf(seg);
@@ -10340,25 +10305,26 @@ var SegmentHourLedger = class SegmentHourLedger {
 			else fromIndex.set(key, appendSegmentPath(existing, seg.path));
 		}
 		const refused = this.refusedPrunes(walked, fromIndex);
+		const trimmed = /* @__PURE__ */ new Set();
+		for (const deviceId of walked) {
+			if (!index.droppedDuringWalk(deviceId)) continue;
+			trimmed.add(deviceId);
+			this.logger.warn("recorder: ledger prune REFUSED — the RAM index dropped hours during this walk, so its silence is not evidence", { tags: { deviceId } });
+		}
 		for (const row of this.ledger.snapshot()) {
 			if (!walked.has(row.deviceId)) continue;
-			if (!row.pathsResident) continue;
 			const disk = fromIndex.get(row.key);
-			const additiveOnly = row.hourStartMs === currentHour || refused.devices.has(row.deviceId) || refused.locations.has(locationKey(row.deviceId, row.locationId));
+			const additiveOnly = row.hourStartMs === currentHour || trimmed.has(row.deviceId) || refused.devices.has(row.deviceId) || refused.locations.has(locationKey(row.deviceId, row.locationId));
 			if (disk === void 0) {
 				if (additiveOnly) continue;
 				await this.ledger.forget(row.key);
 				continue;
 			}
 			if (additiveOnly) {
-				const union = uniquePaths([...disk.paths, ...row.paths]);
-				if (!samePaths(union, row.paths)) await this.ledger.put(segmentHourRow({
-					...row,
-					paths: union
-				}));
+				if (disk.segments > row.segments) await this.ledger.put(disk);
 				continue;
 			}
-			if (!samePaths(row.paths, disk.paths)) await this.ledger.put(disk);
+			if (disk.segments !== row.segments || disk.bytes !== row.bytes) await this.ledger.put(disk);
 		}
 		for (const [key, disk] of fromIndex) {
 			if (this.ledger.has(key)) continue;
@@ -10477,44 +10443,45 @@ function locationKey(deviceId, locationId) {
 * skips it forever. Under D148 as written, a ghost row can never be forgotten
 * by any mechanism — which is why the live ones have stood for thirteen days.
 *
-* The resolution is that a walk is not the only trusted confirmation; it is a
-* BULK one. The paths in an hour row are relative to a root
-* (`590/high/2026/08/15/04/…m4s`), so each one can be resolved against every
-* currently-resolvable root and asked about directly. **Per-path
-* `storage.exists`, over every candidate root, for EVERY path of the hour, is
-* the same confirmation a walk gives — done one syscall at a time instead of
-* one `readdir` at a time.** That, and nothing weaker, is what licenses the
+* The resolution is that the ghost row's root does not resolve but its hour
+* DIRECTORY is addressable anywhere: the path convention
+* (`590/high/2026/08/15/04/`) is a function of the row's own fields, so the same
+* hour can be listed under every currently-resolvable root. **A listing of the
+* hour directory at every candidate root is exactly the walk D148 sanctions,
+* done one root at a time.** That, and nothing weaker, is what licenses the
 * forget. Two consequences ride with it:
 *
-* - **Sampling is not evidence.** An hour is forgotten only when every one of
-*   its paths came back absent from every root. One unprobed path and the hour
-*   stands.
-* - **An error is not an absence** (D49). A probe that THROWS ends the hour
-*   with nothing decided — never "not found".
+* - **Every root must answer.** An hour is forgotten only when every candidate
+*   root listed its directory and every one of them came back EMPTY. One root
+*   that could not answer and the hour stands.
+* - **An error is not an absence** (D49). A listing that fails, or that reports
+*   "I could not decide", ends the hour with nothing decided — never "not
+*   found". Whether an absent directory means "empty" or "this disk is gone" is
+*   the lister's question, and it answers it by reading the ROOT.
+*
+* Until D523 this probed each of the row's `paths` at each root, one
+* `storage.exists` at a time — up to ~1 000 syscalls to prove one hour absent.
+* The column is gone and the row names no file, so the unit is the directory,
+* which is both cheaper and the same evidence.
 *
 * ## Repoint versus forget
 *
 * The asymmetry is the whole safety argument, and it is deliberately cheap in
 * the safe direction:
 *
-* - **one path found anywhere ⇒ the row is MIS-POINTED, not orphaned.** It is
-*   repointed to that root's location and the hour is finished — no further
-*   probing. A renamed or re-created location produces exactly this shape, and
-*   deleting here would destroy the index of footage that EXISTS, which is the
-*   failure D291 was written to prevent.
-* - **every path absent everywhere ⇒ orphaned**, and only then forgotten.
-*
-* So proving presence costs one probe and proving absence costs all of them,
-* which is the right way round: the expensive proof is the destructive one.
+* - **a non-empty listing at any root ⇒ the row is MIS-POINTED, not orphaned.**
+*   It is repointed to that root's location, with the segments that listing
+*   names, and the hour is finished. A renamed or re-created location produces
+*   exactly this shape, and deleting here would destroy the index of footage
+*   that EXISTS, which is the failure D291 was written to prevent.
+* - **every root lists an EMPTY hour ⇒ orphaned**, and only then forgotten.
 *
 * ## Pacing
 *
-* The recordings array is saturated and slow (a `readdir` of one hour
-* directory measured ~650 ms under load, and a `find` over it hung an SSH
-* session on 2026-08-29). This is a janitor: bounded hours per pass, a hard
-* probe ceiling, and a caller-supplied `pace()` awaited between probe batches.
-* Work it does not finish is left for the next pass and REPORTED, never
-* silently dropped.
+* The recordings array is the resource every live read competes for. This is a
+* janitor: bounded hours per pass, a hard probe ceiling, and a caller-supplied
+* `pace()` awaited between probe batches. Work it does not finish is left for
+* the next pass and REPORTED, never silently dropped.
 */
 var HOUR_MS$3 = 36e5;
 /**
@@ -10663,22 +10630,12 @@ var GhostLocationSweeper = class {
 				refuse(row, "live-tail", `hourStartMs=${row.hourStartMs}`);
 				continue;
 			}
-			const paths = await this.deps.ledger.hourPaths(row.deviceId, row.profile, row.locationId, row.hourStartMs);
-			if (paths === null) {
-				refuse(row, "detail-unavailable", "point read failed");
-				continue;
-			}
-			if (paths.length === 0) {
-				refuse(row, "no-paths", "the row materialised empty");
-				continue;
-			}
-			const rows = this.rowsOf(row, paths);
-			if (rows === null) {
-				refuse(row, "unparseable-paths", "a path does not parse into this hour");
+			if (row.segments === 0) {
+				refuse(row, "no-paths", "the row accounts for no segments");
 				continue;
 			}
 			const before = probes;
-			const verdict = await this.probeHour(rows, roots, maxProbes - probes);
+			const verdict = await this.probeHour(row, roots, maxProbes - probes, probes);
 			probes += verdict.probes;
 			tallyOf(row.deviceId).probes += probes - before;
 			if (verdict.outcome.kind === "refused") {
@@ -10687,10 +10644,12 @@ var GhostLocationSweeper = class {
 			}
 			if (verdict.outcome.kind === "found") {
 				const target = locationForHydratedProfile(verdict.outcome.root.aliases, row.profile);
-				if (!await this.deps.ledger.repointSegments(rows, target.id)) {
-					refuse(row, "durable-refused", `repoint to ${target.id} refused`);
+				const rows = this.rowsOf(row, verdict.outcome.paths);
+				if (rows === null) {
+					refuse(row, "unparseable-paths", "a listed name does not parse into this hour");
 					continue;
 				}
+				await this.deps.ledger.repointSegments(rows, target.id);
 				this.deps.applyToIndex(rows, target.id);
 				repointedHours += 1;
 				segmentsRepointed += rows.length;
@@ -10700,19 +10659,19 @@ var GhostLocationSweeper = class {
 				tally.targets.add(target.id);
 				continue;
 			}
-			await this.deps.ledger.dropSegments(rows);
+			const forgotten = await this.deps.ledger.forgetHour(row.deviceId, row.profile, row.locationId, row.hourStartMs);
 			if (this.deps.ledger.knowsHour(row.deviceId, row.profile, row.locationId, row.hourStartMs)) {
-				refuse(row, "durable-refused", "the ledger still holds the hour after the drop");
+				refuse(row, "durable-refused", "the ledger still holds the hour after the forget");
 				continue;
 			}
-			this.deps.applyToIndex(rows, null);
+			this.deps.forgetInIndex(row.deviceId, row.locationId, row.hourStartMs);
 			forgottenHours += 1;
-			segmentsForgotten += rows.length;
-			bytesForgotten += rows.reduce((sum, r) => sum + r.bytes, 0);
+			segmentsForgotten += forgotten;
+			bytesForgotten += row.bytes;
 			const tally = tallyOf(row.deviceId);
 			tally.forgottenHours += 1;
-			tally.forgottenSegments += rows.length;
-			tally.forgottenBytes += rows.reduce((sum, r) => sum + r.bytes, 0);
+			tally.forgottenSegments += forgotten;
+			tally.forgottenBytes += row.bytes;
 		}
 		for (const [deviceId, tally] of byDevice) this.deps.logger.info("recorder: ghost-location reconcile — camera summary", {
 			tags: { deviceId },
@@ -10794,60 +10753,82 @@ var GhostLocationSweeper = class {
 		return out;
 	}
 	/**
-	* Ask every root about the hour's paths until one answers `true`.
+	* List this hour's directory under EVERY candidate root.
+	*
+	* A non-empty listing at one root makes the hour mis-pointed. Two roots
+	* holding it is a refusal, not a choice: repointing would be a guess about
+	* which copy is the footage. Absence is only concluded when every root
+	* answered and every answer was empty — a listing that could not decide
+	* (`null`) or threw ends the hour with nothing decided (D49).
 	*
-	* Presence short-circuits the hour (one confirmed file makes it mis-pointed);
-	* absence does not, and cannot — the hour is orphaned only when EVERY path
-	* came back absent from EVERY root. A throw ends the hour with nothing
-	* decided.
+	* The whole loop runs even after a hit, because "found at exactly one root"
+	* is a claim about every root and cannot be short-circuited without giving up
+	* the multi-root refusal.
+	*
+	* `spent` is the listings the PASS has already made, not this hour's, and the
+	* brake fires on that running total. Since D523 an hour costs one listing per
+	* physical root — two or three on this hub — so a counter that reset per hour
+	* would never reach {@link GHOST_PROBE_BATCH} and the `pace()` dep would be
+	* dead on every real topology.
 	*/
-	async probeHour(rows, roots, budget) {
+	async probeHour(row, roots, budget, spent) {
 		let used = 0;
-		for (const row of rows) {
-			const found = [];
-			for (const root of roots) {
-				if (used >= budget) return {
+		const found = [];
+		for (const root of roots) {
+			if (used >= budget) return {
+				outcome: {
+					kind: "refused",
+					reason: "probe-budget",
+					detail: `stopped after ${used} listings with ${roots.length} roots to probe`
+				},
+				probes: used
+			};
+			const alias = locationForHydratedProfile(root.aliases, row.profile);
+			used += 1;
+			if ((spent + used) % 16 === 0) await this.deps.pace();
+			let listing;
+			try {
+				listing = await this.deps.listHour(alias.id, row.deviceId, row.profile, row.hourStartMs);
+			} catch (err) {
+				return {
 					outcome: {
 						kind: "refused",
-						reason: "probe-budget",
-						detail: `stopped after ${used} probes with ${rows.length} paths in the hour`
+						reason: "probe-error",
+						detail: `${alias.id}: ${errMsg(err)}`
 					},
 					probes: used
 				};
-				const alias = locationForHydratedProfile(root.aliases, row.profile);
-				used += 1;
-				if (used % 16 === 0) await this.deps.pace();
-				try {
-					if (await this.deps.exists(alias.id, row.path)) found.push(root);
-				} catch (err) {
-					return {
-						outcome: {
-							kind: "refused",
-							reason: "probe-error",
-							detail: `${alias.id}: ${errMsg(err)}`
-						},
-						probes: used
-					};
-				}
 			}
-			if (found.length > 1) return {
+			if (listing === null) return {
 				outcome: {
 					kind: "refused",
-					reason: "found-at-multiple-roots",
-					detail: found.map((root) => root.key).join(", ")
-				},
-				probes: used
-			};
-			const only = found[0];
-			if (only !== void 0) return {
-				outcome: {
-					kind: "found",
-					root: only,
-					path: row.path
+					reason: "detail-unavailable",
+					detail: `${alias.id} could not say what its copy of this hour holds`
 				},
 				probes: used
 			};
+			if (listing.length > 0) found.push({
+				root,
+				paths: listing
+			});
 		}
+		if (found.length > 1) return {
+			outcome: {
+				kind: "refused",
+				reason: "found-at-multiple-roots",
+				detail: found.map((hit) => hit.root.key).join(", ")
+			},
+			probes: used
+		};
+		const only = found[0];
+		if (only !== void 0) return {
+			outcome: {
+				kind: "found",
+				root: only.root,
+				paths: only.paths
+			},
+			probes: used
+		};
 		return {
 			outcome: { kind: "absent" },
 			probes: used
@@ -11228,34 +11209,12 @@ function emptyTally() {
 		orphanFiles: 0
 	};
 }
-/** The basename of a segment path — what a listing returns. */
-function fileName(relPath) {
-	const cut = relPath.lastIndexOf("/");
-	return cut === -1 ? relPath : relPath.slice(cut + 1);
-}
-/** Group one archive page into whole hours. A page always carries complete hour
-*  rows (`streamSegments` expands them whole), so no hour is ever split. */
-function claimsOf(rows) {
-	const byHour = /* @__PURE__ */ new Map();
-	for (const row of rows) {
-		const hour = hourStartMs(row.startMs);
-		const key = `${row.deviceId}|${row.profile}|${hour}`;
-		const held = byHour.get(key);
-		if (held) held.push(row);
-		else byHour.set(key, [row]);
-	}
-	const out = [];
-	for (const group of byHour.values()) {
-		const first = group[0];
-		if (first === void 0) continue;
-		out.push({
-			deviceId: first.deviceId,
-			profile: first.profile,
-			hourStartMs: hourStartMs(first.startMs),
-			rows: group
-		});
-	}
-	return out.toSorted((a, b) => a.hourStartMs - b.hourStartMs || a.deviceId - b.deviceId);
+/** Does this hour row fall inside the scope the operator asked for? */
+function inScope(row, scope) {
+	if (scope.locationId !== void 0 && row.locationId !== scope.locationId) return false;
+	if (scope.deviceId !== void 0 && row.deviceId !== scope.deviceId) return false;
+	const profiles = scope.profiles ?? [];
+	return profiles.length === 0 || profiles.includes(row.profile);
 }
 /**
 * One reconcile pass over one location's claimed hours.
@@ -11353,20 +11312,35 @@ var LedgerWalkReconciler = class {
 		this.reportPass(report);
 		return report;
 	}
-	/** Walk the archive page by page, one hour at a time. */
+	/**
+	* Walk the hour ROWS of the scope, oldest first.
+	*
+	* From the MIRROR, not a query. Since D523 a row is ten scalars, so the whole
+	* claim set is already in RAM and costs nothing to fold — and the pass mutates
+	* what it walks, which is exactly the shape that makes `offset` paging skip
+	* half a scope. A snapshot taken once cannot skip.
+	*/
 	async walk(state, scope) {
-		for await (const page of state.ledger.streamSegments(scope)) for (const claim of claimsOf(page)) {
+		const claims = state.ledger.snapshot().filter((row) => inScope(row, scope)).toSorted((a, b) => a.hourStartMs - b.hourStartMs || a.deviceId - b.deviceId);
+		for (const claim of claims) {
 			if (state.hoursClaimed >= state.maxHours) {
 				state.bounded = true;
 				return;
 			}
 			state.hoursClaimed += 1;
-			state.segmentsClaimed += claim.rows.length;
+			state.segmentsClaimed += claim.segments;
 			if (!await this.reconcileHour(state, claim)) return;
 		}
 	}
 	/**
-	* Diff ONE hour, and forget what it proved absent.
+	* Reconcile ONE hour: what its row ACCOUNTS FOR against what its directory
+	* HOLDS, and repair the account from the directory.
+	*
+	* Since D523 the row names no files, so this is a comparison of counts and
+	* bytes — and it does not need to name them: the repair is "make the account
+	* the listing's", which is exact, and the RESIDENT index is reset to the same
+	* listing so a row it holds for a file the directory does not is dropped with
+	* it.
 	*
 	* `false` ends the whole pass — the only thing that returns it is an anchor
 	* that stopped agreeing, and every listing taken after that point is about a
@@ -11379,10 +11353,6 @@ var LedgerWalkReconciler = class {
 			return true;
 		}
 		const relDir = hourDirRelPath(claim.deviceId, claim.profile, claim.hourStartMs);
-		for (const row of claim.rows) if (parseSegmentPath(row.path) === null || row.path !== `${relDir}/${fileName(row.path)}`) {
-			this.skip(state, claim, "path-mismatch", row.path);
-			return true;
-		}
 		let listing;
 		try {
 			listing = await this.deps.listHour(state.location.root, relDir);
@@ -11394,36 +11364,55 @@ var LedgerWalkReconciler = class {
 		if (state.listings % 8 === 0) await this.deps.pace();
 		state.hoursWalked += 1;
 		tally.hoursWalked += 1;
-		const diff = this.diff(claim, listing);
-		if (diff.missingDirectory) {
+		const missingDirectory = listing === null;
+		if (missingDirectory) {
 			state.hoursMissing += 1;
 			tally.hoursMissing += 1;
 		}
-		if (diff.orphans.length > 0) {
-			state.orphanFiles += diff.orphans.length;
-			tally.orphanFiles += diff.orphans.length;
-			for (const orphan of diff.orphans) {
+		const present = [];
+		for (const name of listing ?? []) {
+			if (!name.endsWith(".m4s")) continue;
+			const relPath = `${relDir}/${name}`;
+			const parsed = parseSegmentPath(relPath);
+			if (parsed === null || hourStartMs(parsed.startMs) !== claim.hourStartMs) {
+				this.skip(state, claim, "path-mismatch", relPath);
+				return true;
+			}
+			present.push(relPath);
+		}
+		const listed = hourAggregate(present);
+		const orphans = Math.max(0, listed.segments - claim.segments);
+		if (orphans > 0) {
+			state.orphanFiles += orphans;
+			tally.orphanFiles += orphans;
+			for (const path of present) {
 				if (state.orphanSample.length >= 50) break;
-				state.orphanSample.push(`${relDir}/${orphan}`);
+				state.orphanSample.push(path);
 			}
-			this.deps.logger.warn("recorder: files under a claimed hour that the durable ledger does NOT name — reported, never deleted", {
+			this.deps.logger.warn("recorder: an hour directory holds more segments than its durable row accounts for", {
 				tags: { deviceId: claim.deviceId },
 				meta: {
 					locationId: state.location.id,
 					profile: claim.profile,
 					hourStartMs: claim.hourStartMs,
-					orphans: diff.orphans.length,
-					sample: diff.orphans.slice(0, 5)
+					accounted: claim.segments,
+					listed: listed.segments,
+					apply: state.apply
 				}
 			});
 		}
-		if (diff.ghosts.length === 0) return true;
-		const ghostBytes = diff.ghosts.reduce((sum, row) => sum + row.bytes, 0);
-		state.ghostSegments += diff.ghosts.length;
+		const ghosts = Math.max(0, claim.segments - listed.segments);
+		if (ghosts === 0) {
+			if (state.apply && listed.segments > 0 && listed.bytes !== claim.bytes) await state.ledger.adoptWalkedHour(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs, present);
+			if (state.apply) this.resetIndex(state, claim, present);
+			return true;
+		}
+		const ghostBytes = Math.max(0, claim.bytes - listed.bytes);
+		state.ghostSegments += ghosts;
 		state.ghostBytes += ghostBytes;
-		tally.ghostSegments += diff.ghosts.length;
+		tally.ghostSegments += ghosts;
 		tally.ghostBytes += ghostBytes;
-		if (diff.ghosts.length === claim.rows.length) state.ghostHoursWhole += 1;
+		if (listed.segments === 0) state.ghostHoursWhole += 1;
 		const anchor = await this.readAnchor(state.location);
 		if (!anchor.ok || anchor.volumeId !== state.anchor) {
 			state.refused = anchor.ok ? "anchor-moved" : anchor.refusal;
@@ -11439,56 +11428,52 @@ var LedgerWalkReconciler = class {
 			});
 			return false;
 		}
-		this.deps.logger.warn("recorder: durable hour row claims segments the directory does not hold", {
+		this.deps.logger.warn("recorder: durable hour row accounts for segments the directory does not hold", {
 			tags: { deviceId: claim.deviceId },
 			meta: {
 				locationId: state.location.id,
 				profile: claim.profile,
 				hourStartMs: claim.hourStartMs,
-				claimed: claim.rows.length,
-				ghosts: diff.ghosts.length,
+				accounted: claim.segments,
+				listed: listed.segments,
+				ghosts,
 				ghostBytes,
-				wholeHour: diff.ghosts.length === claim.rows.length,
-				missingDirectory: diff.missingDirectory,
+				wholeHour: listed.segments === 0,
+				missingDirectory,
 				apply: state.apply
 			}
 		});
 		if (!state.apply) return true;
-		await state.ledger.dropSegments(diff.ghosts);
-		if (!await this.forgetLanded(state, claim, diff.ghosts)) {
-			this.skip(state, claim, "durable-refused", "the ledger still lists a dropped path");
+		const forgotten = listed.segments === 0 ? await state.ledger.forgetHour(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs) : await this.adoptLanded(state, claim, present, ghosts);
+		if (forgotten === null) {
+			this.skip(state, claim, "durable-refused", "the ledger still accounts for the ghosts");
 			return true;
 		}
-		this.deps.applyToIndex(diff.ghosts.map((row) => row.path));
-		state.forgottenSegments += diff.ghosts.length;
+		this.resetIndex(state, claim, present);
+		state.forgottenSegments += forgotten;
 		state.forgottenBytes += ghostBytes;
-		tally.forgottenSegments += diff.ghosts.length;
+		tally.forgottenSegments += forgotten;
 		return true;
 	}
-	/** Did the durable drop actually land? */
-	async forgetLanded(state, claim, ghosts) {
-		const { deviceId, profile, hourStartMs: hour } = claim;
-		if (!state.ledger.knowsHour(deviceId, profile, state.location.id, hour)) return true;
-		const held = await state.ledger.hourPaths(deviceId, profile, state.location.id, hour);
-		if (held === null) return false;
-		const remaining = new Set(held);
-		return ghosts.every((row) => !remaining.has(row.path));
-	}
 	/**
-	* What the hour row claims, against what the directory holds — BOTH ways.
+	* Adopt the listing, then READ THE ROW BACK.
 	*
-	* A missing directory is an empty listing here, which makes every claim a
-	* ghost. That is only admissible because the caller re-reads the volume
-	* anchor before acting on it.
+	* `adoptWalkedHour` refuses a listing that would erase more than half of what
+	* the row accounts for — the guard against a root that answered short — and it
+	* refuses silently, which a caller that counted it as done would turn into
+	* telling the resident index a row is gone that the archive still holds.
+	* `null` is that refusal.
 	*/
-	diff(claim, listing) {
-		const present = new Set((listing ?? []).filter((name) => name.endsWith(".m4s")));
-		const claimed = new Set(claim.rows.map((row) => fileName(row.path)));
-		return {
-			ghosts: claim.rows.filter((row) => !present.has(fileName(row.path))),
-			orphans: [...present].filter((name) => !claimed.has(name)).toSorted(),
-			missingDirectory: listing === null
-		};
+	async adoptLanded(state, claim, present, ghosts) {
+		await state.ledger.adoptWalkedHour(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs, present);
+		const after = state.ledger.hourRow(claim.deviceId, claim.profile, state.location.id, claim.hourStartMs);
+		if (after === void 0) return claim.segments;
+		return after.segments === claim.segments - ghosts ? ghosts : null;
+	}
+	/** Make the resident index's view of the hour the listing's, and say how many
+	*  index rows that dropped. */
+	resetIndex(state, claim, present) {
+		return this.deps.applyToIndex(claim.deviceId, state.location.id, claim.hourStartMs, present);
 	}
 	/** The volume anchor, or the refusal its absence produces. */
 	async readAnchor(location) {
@@ -17777,12 +17762,17 @@ var GHOST_LOCATION_PROBE_PAUSE_MS = 50;
 /**
 * Awaited every `WALK_HOUR_BATCH` hour listings by the ledger↔disk walk (D319).
 *
-* Twice the ghost sweep's brake, because the syscall between brakes is far
-* heavier: that pass paces `storage.exists` on one path, this one paces a
-* `readdir` of a whole hour directory — measured at ~650 ms on the live share
-* under load. The walk is operator-armed and one-off, so the right trade is to
-* be slower and invisible rather than fast and felt: a `find` over this array
-* hung an SSH session on 2026-08-29.
+* Twice the ghost sweep's brake. That used to be because the syscall between
+* brakes was far heavier — the sweep paced one `storage.exists`, this one an
+* hour `readdir` "measured at ~650 ms on the live share under load". Both
+* halves of that have changed: the sweep paces a directory listing too since
+* D523, and the 650 ms belonged to a FUSE mount that has been retired (an hour
+* of 345–349 files on `/recordings-2` lists in ~1 ms).
+*
+* It stays at twice anyway, for the reason that never depended on the number:
+* the walk is operator-armed and one-off, so the right trade is to be slower
+* and invisible rather than fast and felt — a `find` over this array hung an
+* SSH session on 2026-08-29.
 */
 var LEDGER_WALK_PAUSE_MS = 100;
 /**
@@ -18062,6 +18052,11 @@ var RecorderV2Addon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		this.stopStallMonitor = startEventLoopStallMonitor(this.ctx.logger);
+		this.index.armResidency({
+			logger: this.ctx.logger,
+			now: () => Date.now(),
+			budget: DEFAULT_RECORDING_INDEX_BUDGET
+		});
 		const raw = this.ctx.kernel.localNodeId ?? this.ctx.id;
 		this.nodeId = raw.includes("/") ? raw.split("/")[0] : raw;
 		const configuredNode = this.config.recordingNodeId;
@@ -18079,6 +18074,7 @@ var RecorderV2Addon = class extends BaseAddon {
 		this.segmentHours = new SegmentHourLedger({
 			store: this.ctx.api.settingsStore,
 			logger: this.ctx.logger,
+			listHour: (locationId, deviceId, profile, hourStartMs) => this.listHourDirectory(locationId, deviceId, profile, hourStartMs),
 			isLocationUsable: (locationId) => this.placement?.isLocationUsable(locationId) ?? true
 		});
 		try {
@@ -18112,7 +18108,7 @@ var RecorderV2Addon = class extends BaseAddon {
 					await promises.unlink(fromAbs);
 				}
 			},
-			archiveHourPaths: async (deviceId, profile, locationId, hourStartMs) => await this.segmentHours?.hourPaths(deviceId, profile, locationId, hourStartMs) ?? null,
+			hourDirectoryPaths: (deviceId, profile, locationId, hourStartMs) => this.listHourDirectory(locationId, deviceId, profile, hourStartMs),
 			removeDir: async (locationId, relDir) => {
 				const loc = requireReadableLocation(this.resolvedLocations, locationId, "recorder");
 				await promises.rm(path.join(loc.root, relDir), {
@@ -18597,8 +18593,8 @@ var RecorderV2Addon = class extends BaseAddon {
 			localNodeId: this.nodeId,
 			index: this.index,
 			ledger: this.segmentHours === null ? null : {
-				streamSegments: (scope) => this.segmentHours.streamSegments(scope),
-				dropSegments: (rows) => this.segmentHours.dropSegments(rows)
+				forgetScope: (scope) => this.segmentHours.forgetScope(scope),
+				snapshot: () => this.segmentHours.snapshot()
 			},
 			now: () => Date.now()
 		});
@@ -18705,9 +18701,7 @@ var RecorderV2Addon = class extends BaseAddon {
 				}
 			},
 			anchorOf: async (root) => (await readLocationMarker(root))?.volumeId ?? null,
-			applyToIndex: (paths) => {
-				this.index.removeSegments(paths);
-			},
+			applyToIndex: (deviceId, locationId, hour, paths) => this.index.resetHour(deviceId, locationId, hour, paths),
 			logger: this.ctx.logger,
 			now: () => Date.now(),
 			pace: () => sleep$1(LEDGER_WALK_PAUSE_MS)
@@ -18835,7 +18829,6 @@ var RecorderV2Addon = class extends BaseAddon {
 		});
 		try {
 			await this.segmentHours?.load();
-			this.segmentHours?.repairAggregates();
 		} catch (err) {
 			this.ctx.logger.warn("recorder: segment-hour ledger load failed — hours stay unknown until a read walks them", { meta: { error: errMsg(err) } });
 		}
@@ -18878,18 +18871,15 @@ var RecorderV2Addon = class extends BaseAddon {
 			const sweeper = new GhostLocationSweeper({
 				ledger,
 				locations: () => this.resolvedLocations,
-				exists: (location, relativePath) => this.ctx.api.storage.exists.query({
-					location,
-					relativePath
-				}),
+				listHour: (locationId, deviceId, profile, hourStartMs) => this.listHourDirectory(locationId, deviceId, profile, hourStartMs),
 				applyToIndex: (rows, toLocationId) => {
 					this.index.removeSegments(rows.map((row) => row.path));
-					if (toLocationId === null) return;
 					for (const row of rows) this.index.addSegment({
 						...row,
 						locationId: toLocationId
 					});
 				},
+				forgetInIndex: (deviceId, locationId, hourStartMs) => this.index.resetHour(deviceId, locationId, hourStartMs, []),
 				logger: this.ctx.logger,
 				now: () => Date.now(),
 				pace: () => sleep$1(GHOST_LOCATION_PROBE_PAUSE_MS)
@@ -19062,9 +19052,16 @@ var RecorderV2Addon = class extends BaseAddon {
 		const census = this.index.sortedViewCensus();
 		const views = this.index.sortedViewStats();
 		const reuse = this.index.hydrateReuseStats();
+		const residency = this.index.residency();
 		this.ctx.logger.info("recorder: index census", {
 			...census.largestDeviceId > 0 ? { tags: { deviceId: census.largestDeviceId } } : {},
 			meta: {
+				residentRows: residency.residentRows,
+				residentHours: residency.residentHours,
+				rowBudget: residency.budget?.residentRowBudget ?? null,
+				evictedRows: residency.evictedRows,
+				evictedHours: residency.evictedHours,
+				evictionPasses: residency.evictionPasses,
 				sortedViews: census.views,
 				rowSlots: census.rowSlots,
 				largestViewRows: census.largestRows,
@@ -19164,6 +19161,63 @@ var RecorderV2Addon = class extends BaseAddon {
 		return this.resolvedLocations;
 	}
 	/**
+	* ONE hour bucket's segment files, location-relative — the recorder's single
+	* implementation of {@link HourLister} (D523).
+	*
+	* The directory is the authority for WHICH segments exist, and the segment
+	* NAME carries start, duration and bytes, so this is a complete description
+	* of the hour and no file is ever opened.
+	*
+	* Three answers, and the difference between the last two is the whole point:
+	*
+	*  - `null` — **undecided.** The location does not resolve, may not be read,
+	*    or the read failed for a reason that is not "this directory is not
+	*    there". Every caller turns it into "this hour takes no part in this
+	*    pass".
+	*  - `[]` — **the hour holds nothing**, and the volume confirmed it: an
+	*    ENOENT on the hour directory is only reported as empty once the
+	*    location's ROOT has answered a read. A root that has gone away answers
+	*    ENOENT for every hour on it, and reporting that as "empty" is how a pass
+	*    deletes an operator's index of real footage (D148, D393).
+	*  - the paths.
+	*/
+	async listHourDirectory(locationId, deviceId, profile, hourStartMs) {
+		const location = this.resolvedLocations.find((l) => l.id === locationId);
+		if (location === void 0 || !locationMayBeRead(location)) return null;
+		const rel = hourDirRelPath(deviceId, profile, hourStartMs);
+		try {
+			return (await promises.readdir(path.join(location.root, rel))).filter((f) => f.endsWith(".m4s")).map((f) => `${rel}/${f}`);
+		} catch (err) {
+			if (err.code !== "ENOENT") {
+				this.ctx.logger.warn("recorder: hour directory read failed — this hour decides nothing", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						locationId,
+						hourStartMs,
+						error: errMsg(err)
+					}
+				});
+				return null;
+			}
+			try {
+				await promises.readdir(location.root);
+			} catch {
+				this.ctx.logger.warn("recorder: hour directory is absent AND its location root cannot be read — this hour decides nothing", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						locationId,
+						root: location.root,
+						hourStartMs
+					}
+				});
+				return null;
+			}
+			return [];
+		}
+	}
+	/**
 	* Attach-boundary placement for one (device, profile). Falls back to the pure
 	* resolver when the service is not built (non-recording node / early boot),
 	* which is byte-identical to the pre-placement behaviour.