@camstack/addon-pipeline 1.2.375 → 1.2.601

package/dist/recorder/index.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-C0Mg8e3I.js");
-const require_node = require("../node-CifGKjsd.js");
+const require_dist = require("../dist-BqI10eLV.js");
+const require_node = require("../node-CgwqjGz0.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 let node_crypto = require("node:crypto");
@@ -5203,29 +5203,6 @@ function activeModeForConfig(config) {
 * pays for ten minutes, not until the next restart.
 */
 var CENSUS_MAX_WINDOW_MS = 10 * 6e4;
-/** Store procedures worth attributing. Reads only: a write is an operator
-*  gesture or a pipeline product, and neither is a mystery. */
-var CENSUSED_PROCEDURES = new Set([
-	"query",
-	"count",
-	"aggregate",
-	"get",
-	"histogram",
-	"getAll"
-]);
-/**
-* Can `new Proxy` wrap this, and is it worth wrapping?
-*
-* Functions count. The generated store client is a **tRPC proxy** and every
-* intermediate node of one is CALLABLE — `typeof client.query` is `'function'`,
-* not `'object'`. A wrapper that tested only for `'object'` handed the whole
-* client back unwrapped, deployed, and reported zero `query` and zero `count`
-* call sites while the engine was recording thousands a minute against the same
-* tables. Silence read as "nobody in this addon does it".
-*/
-function isProxyable(value) {
-	return typeof value === "object" && value !== null || typeof value === "function";
-}
 function rowsOf(value) {
 	if (Array.isArray(value)) return value.length;
 	if (typeof value === "number") return value;
@@ -5349,34 +5326,6 @@ var StoreReadCensus = class {
 		})).sort((a, b) => b.calls - a.calls);
 	}
 };
-/**
-* Wrap a settings-store client so every read is counted.
-*
-* A `Proxy` over the generated tRPC client rather than a hand-written facade:
-* the client has a procedure per cap method and a facade would need updating
-* every time the cap gains one - which is how a diagnostic quietly stops seeing
-* half the traffic. Unrecognised procedures pass straight through.
-*/
-function censusStoreClient(client, census) {
-	return new Proxy(client, { get(target, prop, receiver) {
-		const procedure = Reflect.get(target, prop, receiver);
-		if (typeof prop !== "string" || !CENSUSED_PROCEDURES.has(prop)) return procedure;
-		if (!isProxyable(procedure)) return procedure;
-		const op = prop;
-		return new Proxy(procedure, { get(procTarget, procProp, procReceiver) {
-			const call = Reflect.get(procTarget, procProp, procReceiver);
-			if (procProp !== "query" && procProp !== "mutate") return call;
-			if (typeof call !== "function") return call;
-			const wrapped = async (...args) => {
-				const site = census.siteOf(wrapped);
-				const result = await Reflect.apply(call, procTarget, args);
-				census.record(op, site, result);
-				return result;
-			};
-			return wrapped;
-		} });
-	} });
-}
 /** Log the census as one line, including when it collected nothing - silence
 *  after an arm is indistinguishable from a census that never armed. */
 function logCensus(census, logger, topN) {
@@ -8369,259 +8318,76 @@ function buildExportArgs(input) {
 		outPath
 	];
 }
-var ROW_MAP_VALUE_COLUMN = "value";
-var RowMapStore = class RowMapStore {
-	spec;
-	store;
-	logger;
-	constructor(deps) {
-		this.spec = deps.spec;
-		this.store = deps.store;
-		this.logger = deps.logger;
-	}
-	/** The collection this store owns — for the caller's own log lines. */
-	get collection() {
-		return this.spec.collection;
-	}
-	/**
-	* Register the collection. MUST run at boot, before any read or write: the
-	* SQLite backend answers 412 for an undeclared collection.
-	*/
-	static declare(store, spec) {
-		return store.declareCollection.mutate({
-			collection: spec.collection,
-			columns: [
-				{
-					name: "id",
-					type: "TEXT",
-					primaryKey: true,
-					notNull: true
-				},
-				...spec.columns,
-				{
-					name: ROW_MAP_VALUE_COLUMN,
-					type: "JSON",
-					notNull: true
-				}
-			],
-			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
-		});
-	}
-	declare() {
-		return RowMapStore.declare(this.store, this.spec);
-	}
-	/** One entry, by key. `null` when absent OR unparseable (which is said aloud). */
-	async read(key) {
-		const raw = await this.store.get.query({
-			collection: this.spec.collection,
-			key
-		});
-		if (!isRecord(raw)) return null;
-		const row = raw;
-		const parsed = this.spec.schema.safeParse(row[ROW_MAP_VALUE_COLUMN]);
-		if (!parsed.success) {
-			this.logger.warn("row-map row skipped as unparseable", {
-				...this.deviceTags(row),
-				meta: {
-					collection: this.spec.collection,
-					key,
-					error: parsed.error.message
-				}
-			});
-			return null;
-		}
-		return parsed.data;
-	}
-	/**
-	* Every entry, keyed. Unparseable rows are skipped — one bad entry costs that
-	* entry, never the map.
-	*/
-	async readAll() {
-		const records = await this.store.query.query({
-			collection: this.spec.collection,
-			filter: { limit: this.spec.loadLimit }
-		});
-		const out = /* @__PURE__ */ new Map();
-		let skipped = 0;
-		for (const record of records) {
-			const parsed = this.spec.schema.safeParse(record.data[ROW_MAP_VALUE_COLUMN]);
-			if (!parsed.success) {
-				skipped += 1;
-				continue;
-			}
-			out.set(record.id, parsed.data);
-		}
-		if (skipped > 0) this.logger.warn("row-map rows skipped as unparseable", { meta: {
-			collection: this.spec.collection,
-			skipped,
-			kept: out.size
-		} });
-		if (records.length >= this.spec.loadLimit) this.logger.warn("row-map read hit its own bound — the map may be truncated", { meta: {
-			collection: this.spec.collection,
-			loadLimit: this.spec.loadLimit
-		} });
-		return out;
-	}
-	/**
-	* Every entry as it was WRITTEN, unvalidated and unparsed — the read a
-	* MIGRATION needs.
-	*
-	* {@link readAll} answers through the CURRENT schema, which is exactly what a
-	* migration must not do: a retired key is stripped by a non-strict `z.object`
-	* before the migration could see it, so the row it is there to rescue looks
-	* like a row that never needed rescuing. Only a migration should call this;
-	* everything else wants the validated read.
-	*/
-	async readAllRaw() {
-		const records = await this.store.query.query({
-			collection: this.spec.collection,
-			filter: { limit: this.spec.loadLimit }
-		});
-		const out = /* @__PURE__ */ new Map();
-		for (const record of records) out.set(record.id, record.data[ROW_MAP_VALUE_COLUMN]);
-		return out;
-	}
-	/** Insert or replace ONE entry. Validates at the boundary. */
-	async write(key, value) {
-		const validated = this.spec.schema.parse(value);
-		const columns = this.spec.project(key, validated);
-		await this.store.set.mutate({
-			collection: this.spec.collection,
-			key,
-			value: {
-				...columns,
-				[ROW_MAP_VALUE_COLUMN]: validated
-			}
-		});
-	}
-	/** Drop ONE entry. Idempotent. */
-	async remove(key) {
-		await this.store.delete.mutate({
-			collection: this.spec.collection,
-			key
-		});
-	}
+var recorderRecordKinds = require_dist.defineRecordKinds({
 	/**
-	* Make the collection hold exactly `next` — the write path for an owner whose
-	* in-memory map IS the authority (a persister handed the complete set).
+	* One row per export job, inserted by `createExport` and updated as the
+	* render progresses. The system NEVER deletes a row — it is the export AUDIT.
+	* `deleteExport` and the janitor flip `state` and clear the file, keeping
+	* the row. The record's `at` field maps to `createdAt`.
 	*
-	* Returns how many rows were DELETED, and says so out loud when any were: a
-	* replace that silently drops rows is indistinguishable from one that never
-	* had them. Only an owner holding an authoritative set may call this — a
-	* prune driven by a fallible read is work destroyed (D130, D49).
-	*/
-	async replaceAll(next) {
-		const held = await this.store.query.query({
-			collection: this.spec.collection,
-			filter: { limit: this.spec.loadLimit }
-		});
-		for (const [key, value] of next) await this.write(key, value);
-		const doomed = held.filter((record) => !next.has(record.id));
-		for (const record of doomed) await this.remove(record.id);
-		if (doomed.length > 0) this.logger.warn("row-map replaceAll dropped rows", { meta: {
-			collection: this.spec.collection,
-			dropped: doomed.length,
-			keys: doomed.slice(0, 20).map((r) => r.id),
-			remaining: next.size
-		} });
-		return doomed.length;
-	}
+	* Indexed by `deviceId` to serve the per-device listing efficiently.
+	*/
+	exports: {
+		schema: require_dist.ExportRecordSchema,
+		class: "ledger",
+		writeTrigger: "one row per export job, inserted by createExport; rewritten by the render engine (progress / state patches) and the download hook",
+		device: "none",
+		at: "required",
+		indexes: [{
+			name: "device",
+			fields: ["deviceId"]
+		}],
+		retention: { none: "operator intent — a row is the export AUDIT and survives forever; deleteExport and the janitor flip state and remove the file without removing the row; removeExport is a deliberate operator purge" },
+		adoptsFrom: "recorder:exports"
+	},
 	/**
-	* The entries matching a projected-column predicate, in the order asked for.
+	* A bounded ring of per-operation audit rows. One row per recordings
+	* operation (prune, evict, relocate, export, …), appended best-effort by
+	* `createRecordingOpsLogSink().append`. The ring is trimmed to the newest
+	* `OPS_LOG_RING_DEFAULT_MAX` (500) rows after every append.
 	*
-	* This is what projecting columns BUYS: "every export for camera 617, newest
-	* first, capped at 50" is an indexed `WHERE` + `ORDER BY` + `LIMIT`, not a
-	* parse of the whole map followed by a filter in JS.
-	*
-	* A `limit` is REQUIRED — `settings-store.query` silently caps an unbounded
-	* read at 2 000 rows and answers as if that were everything.
-	*/
-	async readWhere(filter) {
-		const records = await this.store.query.query({
-			collection: this.spec.collection,
-			filter: {
-				...filter.where !== void 0 ? { where: filter.where } : {},
-				...filter.whereIn !== void 0 ? { whereIn: filter.whereIn } : {},
-				...filter.whereBetween !== void 0 ? { whereBetween: filter.whereBetween } : {},
-				...filter.orderBy !== void 0 ? { orderBy: filter.orderBy } : {},
-				...filter.offset !== void 0 ? { offset: filter.offset } : {},
-				limit: filter.limit ?? this.spec.loadLimit
-			}
-		});
-		const out = [];
-		let skipped = 0;
-		for (const record of records) {
-			const parsed = this.spec.schema.safeParse(record.data[ROW_MAP_VALUE_COLUMN]);
-			if (!parsed.success) {
-				skipped += 1;
-				continue;
-			}
-			out.push({
-				key: record.id,
-				value: parsed.data
-			});
-		}
-		if (skipped > 0) this.logger.warn("row-map rows skipped as unparseable", { meta: {
-			collection: this.spec.collection,
-			skipped,
-			kept: out.length
-		} });
-		return out;
-	}
-	/** How many rows match, without materialising one. */
-	async count(filter) {
-		return this.store.count.query({
-			collection: this.spec.collection,
-			...filter !== void 0 ? { filter: {
-				...filter.where !== void 0 ? { where: filter.where } : {},
-				...filter.whereIn !== void 0 ? { whereIn: filter.whereIn } : {},
-				...filter.whereBetween !== void 0 ? { whereBetween: filter.whereBetween } : {}
-			} } : {}
-		});
-	}
-	/**
-	* Delete every row matching a predicate, in ONE statement. Returns how many
-	* went, and says so — a retention trim that silently drops rows is
-	* indistinguishable from one that had nothing to do.
+	* Indexed by `deviceId` so a per-device listing is an indexed query, not a
+	* full scan of the ring.
 	*
-	* The predicate is REQUIRED and the engine REFUSES one that compiles to
-	* nothing: deleting a whole collection is a legitimate intent, but it must be
-	* asked for by name rather than reached through an empty object.
-	*/
-	async deleteWhere(filter) {
-		const { deleted } = await this.store.deleteWhere.mutate({
-			collection: this.spec.collection,
-			filter
-		});
-		if (deleted > 0) this.logger.warn("row-map deleteWhere dropped rows", { meta: {
-			collection: this.spec.collection,
-			deleted,
-			filter
-		} });
-		return deleted;
-	}
-	/** `tags: { deviceId }` off the PROJECTED column, when the spec names one. */
-	deviceTags(row) {
-		const column = this.spec.deviceIdColumn;
-		if (column === void 0) return {};
-		const raw = row[column];
-		return typeof raw === "number" && Number.isInteger(raw) ? { tags: { deviceId: raw } } : {};
+	* The record's `at` field maps to `OpsLogEntry.at`.
+	*/
+	"ops-log": {
+		schema: require_dist.OpsLogEntrySchema,
+		class: "ledger",
+		writeTrigger: "one row per recordings operation (prune, evict, relocate, export, …), appended best-effort by createRecordingOpsLogSink().append; the ring is trimmed to the newest 500 rows in application code after every write",
+		device: "none",
+		at: "required",
+		indexes: [{
+			name: "device",
+			fields: ["deviceId"]
+		}],
+		retention: { none: "a bounded ring of the newest 500 rows; older rows are removed in application code (trimOpsLog) after each append — owner-pruned" },
+		adoptsFrom: "recorder:ops-log"
 	}
-};
-/** A store payload that is a plain object, or `null`. A type guard, not a cast. */
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
+});
 //#endregion
 //#region src/recorder/addon/export-store.ts
 /**
 * Recording-export persistence for the recorder addon.
 *
-* ONE ROW PER EXPORT in `recorder:exports`, through {@link RowMapStore}. History
-* rows are never removed by the system (audit) — `deleteExport` / the janitor
-* flip `state` and clear the file, keeping the row.
+* ONE ROW PER EXPORT in the `recorder` / `exports` record kind, through a
+* {@link RecordKindHandle}. History rows are never removed by the system
+* (audit) — `deleteExport` / the janitor flip `state` and clear the file,
+* keeping the row.
+*
+* ## Records migration (phase 2, step 25)
+*
+* The store was previously backed by a {@link RowMapStore} over a SettingsStore
+* collection named `recorder:exports`. It is now backed by a
+* `RecordKindHandle<ExportRecord>` obtained from `ctx.records`. The record's
+* `at` field maps to `ExportRecord.createdAt`.
+*
+* The per-ID serialiser ({@link serialize}) is preserved: two overlapping
+* patches on the SAME export row are still read-modify-write, so they must
+* be ordered. The `RecordKindHandle` (an object) is used as the WeakMap key,
+* keeping the same compaction semantics.
 *
-* ## What this replaced, and why it mattered here more than anywhere
+* ## What the RowMapStore replaced, and why it mattered
 *
 * Every job used to live in one key of the recorder's `addon-settings` / `root`
 * blob — 201 833 bytes on the reference hub, of which the export history was
@@ -8636,11 +8402,6 @@ function isRecord(value) {
 * erased, and the poll answered `unknown export "547ea182-…"`; the scheduler
 * read the vanished row as a failed render and re-queued forever. A per-row
 * upsert makes that class of loss unrepresentable — a write names ONE row.
-*
-* What is still needed is a per-ID serialiser: two patches to the SAME export
-* still read-modify-write the same row. That is what {@link serialize} bounds,
-* and it is now per (store, id) rather than per store, so two exports never
-* queue behind each other.
 */
 /**
 * The storage class export MP4s live in: `artifacts`, SHARED with the
@@ -8685,76 +8446,26 @@ function exportOutPathFor(root, deviceId, exportId) {
 	return node_path.default.join(exportTenantDirFor(root, deviceId), `${exportId}.mp4`);
 }
 /**
-* @durable class=ledger owner=recorder
-*   write="one row per export job, inserted by `createExport` and rewritten by the
-*     render engine's progress/state patches and by the download hook"
-*   retention="the SYSTEM never deletes a row — it is the export AUDIT. `deleteExport`
-*     and the janitor flip `state` to 'deleted'/'expired' and remove the FILE, keeping
-*     the row. `removeExport` exists for an operator-driven purge and nothing calls it
-*     on a schedule."
+* Bound for the whole-history read. Explicit because a records query without
+* an explicit limit uses the default cap (100); an export list that silently
+* loses its oldest entries looks exactly like a purge.
 */
-var RECORDING_EXPORTS_COLLECTION = "recorder:exports";
+var RECORDING_EXPORTS_LIMIT = 2e4;
 /**
-* Bound for the whole-history read. Explicit because `settings-store.query`
-* caps an unbounded read at 2 000 rows SILENTLY, and an export list that
-* silently loses its oldest half looks exactly like a purge.
+* Obtain the `recorder` / `exports` record kind handle.
+* `ctx.records.declare(recorderRecordKinds)` MUST have run before any read or
+* write (called at boot in `onInitialize`).
 */
-var RECORDING_EXPORTS_LIMIT = 2e4;
-var RECORDING_EXPORTS_SPEC = {
-	collection: RECORDING_EXPORTS_COLLECTION,
-	schema: require_dist.ExportRecordSchema,
-	columns: [
-		{
-			name: "deviceId",
-			type: "INTEGER",
-			notNull: true
-		},
-		{
-			name: "createdAt",
-			type: "INTEGER",
-			notNull: true
-		},
-		{
-			name: "state",
-			type: "TEXT",
-			notNull: true
-		}
-	],
-	indexes: [{
-		name: "idx_recorder_exports_device",
-		columns: ["deviceId"]
-	}, {
-		name: "idx_recorder_exports_created",
-		columns: ["createdAt"]
-	}],
-	project: (_key, value) => ({
-		deviceId: value.deviceId,
-		createdAt: value.createdAt,
-		state: value.state
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: RECORDING_EXPORTS_LIMIT
-};
-/** Build the handle. `declare()` MUST run once at boot before any read/write. */
-function recordingExportsState(store, logger) {
-	return new RowMapStore({
-		spec: RECORDING_EXPORTS_SPEC,
-		store,
-		logger
-	});
+function recordingExportsState(records) {
+	return records.kind(recorderRecordKinds["exports"]);
 }
 /**
 * One in-flight mutation chain per (handle, export id).
 *
-* A row upsert removed the cross-export clobber; it does not order two
-* read-modify-writes of the SAME row. `patchExport` reads the row, merges and
-* writes — so two overlapping patches on one export still race, and the loser's
-* fields vanish. Serialising per ID keeps those pairs atomic while leaving
-* unrelated exports fully concurrent (the old chain was per HANDLE, so a slow
-* patch queued every other export behind it).
-*
-* A `WeakMap` keyed by the handle keeps a disposed store collectable; the inner
-* map is keyed by export id.
+* Two overlapping patches on the SAME export still read-modify-write one row.
+* Serialising per id keeps them atomic while leaving unrelated exports fully
+* concurrent. A `WeakMap` keyed by the handle keeps a disposed handle
+* collectable; the inner map is keyed by export id.
 */
 var mutationChains = /* @__PURE__ */ new WeakMap();
 /** Run `work` after every mutation already queued for `(state, id)`, never before. */
@@ -8774,7 +8485,11 @@ async function serialize(state, id, work) {
 async function upsertExport(state, record) {
 	const validated = require_dist.ExportRecordSchema.parse(record);
 	return serialize(state, validated.id, async () => {
-		await state.write(validated.id, validated);
+		await state.put({
+			id: validated.id,
+			at: validated.createdAt,
+			data: validated
+		});
 		return validated;
 	});
 }
@@ -8784,13 +8499,17 @@ async function upsertExport(state, record) {
 */
 async function patchExport(state, id, patch) {
 	return serialize(state, id, async () => {
-		const existing = await state.read(id);
-		if (existing === null) return null;
+		const row = await state.get(id);
+		if (row === null) return null;
 		const merged = require_dist.ExportRecordSchema.parse({
-			...existing,
+			...row.data,
 			...patch
 		});
-		await state.write(id, merged);
+		await state.put({
+			id,
+			at: merged.createdAt,
+			data: merged
+		});
 		return merged;
 	});
 }
@@ -8801,17 +8520,21 @@ async function patchExport(state, id, patch) {
 */
 async function patchExportUnless(state, id, patch, refuse) {
 	return serialize(state, id, async () => {
-		const existing = await state.read(id);
-		if (existing === null) return { kind: "missing" };
-		if (refuse(existing)) return {
+		const row = await state.get(id);
+		if (row === null) return { kind: "missing" };
+		if (refuse(row.data)) return {
 			kind: "refused",
-			record: existing
+			record: row.data
 		};
 		const merged = require_dist.ExportRecordSchema.parse({
-			...existing,
+			...row.data,
 			...patch
 		});
-		await state.write(id, merged);
+		await state.put({
+			id,
+			at: merged.createdAt,
+			data: merged
+		});
 		return {
 			kind: "patched",
 			record: merged
@@ -8820,24 +8543,22 @@ async function patchExportUnless(state, id, patch, refuse) {
 }
 /** Read one export row by id — ONE keyed row read. */
 async function getExportRecord(state, id) {
-	return state.read(id);
+	const row = await state.get(id);
+	return row === null ? null : row.data;
 }
 /**
-* List export rows, newest-first, optionally scoped to one device.
+* List export rows, newest-first (by `createdAt` / record `at`), optionally
+* scoped to one device.
 *
-* Scoped to a device this is an INDEXED query on the projected `deviceId`
-* column — not a parse of every export in the installation followed by a filter
-* in JS.
+* Scoped to a device this is an INDEXED query on the `device` index — not a
+* parse of every export in the installation followed by a filter in JS.
 */
 async function listExportsFor(state, deviceId) {
-	return (await state.readWhere({
+	return (await state.query({
 		...deviceId === void 0 ? {} : { where: { deviceId } },
-		orderBy: {
-			field: "createdAt",
-			direction: "desc"
-		},
+		desc: true,
 		limit: RECORDING_EXPORTS_LIMIT
-	})).map((entry) => entry.value);
+	})).records.map((r) => r.data);
 }
 //#endregion
 //#region src/recorder/addon/export-timelapse-chunks.ts
@@ -11795,36 +11516,125 @@ function runFfmpeg(renderDeps, ffmpegPath, args, ext) {
 	});
 }
 //#endregion
+//#region src/durable/durable-legacy-kind-handle.ts
+function notImpl(method) {
+	throw new Error(`DurableLegacyKindHandle.${method}() is not available on the legacy (agent) path`);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toRecordRow(id, data) {
+	return {
+		id,
+		data,
+		deviceId: null,
+		at: null,
+		expiresAt: null,
+		rev: 0,
+		updatedAt: 0
+	};
+}
+var DurableLegacyKindHandle = class {
+	name;
+	spec;
+	store;
+	constructor(opts) {
+		this.name = opts.spec.collection;
+		this.spec = opts.spec;
+		this.store = opts.store;
+	}
+	async get(id) {
+		const row = (await this.store.query.query({
+			collection: this.spec.collection,
+			filter: {
+				where: { [this.pkColumn()]: id },
+				limit: 1
+			}
+		}))[0];
+		if (row === void 0 || !isRecord(row.data)) return null;
+		const parsed = this.spec.fromRecord(row.id, row.data);
+		if (parsed === null) return null;
+		return toRecordRow(row.id, this.spec.toValue(parsed));
+	}
+	async query(q) {
+		const rows = await this.store.query.query({
+			collection: this.spec.collection,
+			filter: { limit: q.limit ?? 1e4 }
+		});
+		const records = [];
+		for (const row of rows) {
+			if (!isRecord(row.data)) continue;
+			const parsed = this.spec.fromRecord(row.id, row.data);
+			if (parsed === null) continue;
+			records.push(toRecordRow(row.id, this.spec.toValue(parsed)));
+		}
+		return {
+			records,
+			nextCursor: null
+		};
+	}
+	async put(input) {
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key: input.id,
+			value: input.data
+		});
+		return { rev: 0 };
+	}
+	async delete(id) {
+		await this.store.delete.mutate({
+			collection: this.spec.collection,
+			key: id
+		});
+		return true;
+	}
+	getMany = () => notImpl("getMany");
+	getResolved = () => notImpl("getResolved");
+	putMany = () => notImpl("putMany");
+	patch = () => notImpl("patch");
+	deleteMany = () => notImpl("deleteMany");
+	count = () => notImpl("count");
+	histogram = () => notImpl("histogram");
+	aggregate = () => notImpl("aggregate");
+	deleteWhere = () => notImpl("deleteWhere");
+	allocateId = () => notImpl("allocateId");
+	pkColumn() {
+		return this.spec.columns.find((c) => c.primaryKey === true)?.name ?? "id";
+	}
+};
+/** Legacy settings-store handle for one {@link DurableLedgerSpec}. */
+function durableLegacyKind(spec, store) {
+	return new DurableLegacyKindHandle({
+		spec,
+		store
+	});
+}
+/** Agent boot: declare the SQLite collection behind a durable ledger spec. */
+function declareDurableLegacyCollection(store, spec) {
+	return store.declareCollection.mutate({
+		collection: spec.collection,
+		columns: [...spec.columns],
+		...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+	});
+}
+//#endregion
 //#region src/durable/durable-ledger.ts
 /** Default reseed cap — every current consumer's row set is installation-bounded. */
 var DEFAULT_LOAD_LIMIT = 1e5;
-var DurableLedger = class DurableLedger {
+/** Page size for records reseed queries. */
+var QUERY_PAGE = 1e3;
+var DurableLedger = class {
 	mirror = /* @__PURE__ */ new Map();
 	/** Whether ANY load has read the store successfully — see {@link hasAnswered}. */
 	answered = false;
 	spec;
-	store;
+	kind;
 	logger;
 	constructor(deps) {
 		this.spec = deps.spec;
-		this.store = deps.store;
+		this.kind = deps.kind;
 		this.logger = deps.logger;
 	}
-	/**
-	* Register the collection. MUST run at boot, before any read or write: the
-	* SQLite backend answers 412 for an undeclared collection and takes the whole
-	* runner down with it (the addon-ai boot-crash lesson).
-	*/
-	static declare(store, spec) {
-		return store.declareCollection.mutate({
-			collection: spec.collection,
-			columns: [...spec.columns],
-			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
-		});
-	}
-	declare() {
-		return DurableLedger.declare(this.store, this.spec);
-	}
 	/** The collection this ledger owns — for the caller's own log lines. */
 	get collection() {
 		return this.spec.collection;
@@ -11841,31 +11651,43 @@ var DurableLedger = class DurableLedger {
 	*/
 	async load() {
 		try {
-			const records = await this.store.query.query({
-				collection: this.spec.collection,
-				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
-			});
 			const next = /* @__PURE__ */ new Map();
 			let skipped = 0;
-			for (const record of records) {
-				const row = this.spec.fromRecord(record.id, record.data);
-				if (row === null) {
-					skipped += 1;
-					continue;
+			let seen = 0;
+			const cap = this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT;
+			let cursor;
+			for (;;) {
+				const limit = Math.min(QUERY_PAGE, cap - seen);
+				if (limit <= 0) break;
+				const page = await this.kind.query({
+					limit,
+					...cursor === void 0 ? {} : { cursor }
+				});
+				seen += page.records.length;
+				for (const record of page.records) {
+					const row = this.spec.fromRecord(record.id, record.data);
+					if (row === null) {
+						skipped += 1;
+						continue;
+					}
+					next.set(this.spec.keyOf(row), row);
 				}
-				next.set(this.spec.keyOf(row), row);
+				if (page.nextCursor === null) break;
+				cursor = page.nextCursor;
 			}
 			this.mirror.clear();
 			for (const [key, row] of next) this.mirror.set(key, row);
 			this.answered = true;
 			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
 				collection: this.spec.collection,
+				kind: this.kind.name,
 				skipped
 			} });
 			return [...this.mirror.values()];
 		} catch (err) {
 			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
 				collection: this.spec.collection,
+				kind: this.kind.name,
 				error: String(err),
 				held: this.mirror.size
 			} });
@@ -11930,15 +11752,15 @@ var DurableLedger = class DurableLedger {
 	*/
 	async put(row) {
 		const key = this.spec.keyOf(row);
+		const body = this.spec.toValue(row);
 		if (this.spec.writeMode === "write-behind") {
 			this.mirror.set(key, row);
-			await this.persist(row);
+			await this.persistRow(key, body);
 			return;
 		}
-		await this.store.set.mutate({
-			collection: this.spec.collection,
-			key,
-			value: this.spec.toValue(row)
+		await this.kind.put({
+			id: key,
+			data: body
 		});
 		this.mirror.set(key, row);
 	}
@@ -11979,13 +11801,11 @@ var DurableLedger = class DurableLedger {
 	async forget(key) {
 		this.mirror.delete(key);
 		try {
-			await this.store.delete.mutate({
-				collection: this.spec.collection,
-				key
-			});
+			await this.kind.delete(key);
 		} catch (err) {
 			this.logger.debug("durable delete failed", { meta: {
 				collection: this.spec.collection,
+				kind: this.kind.name,
 				key,
 				error: String(err)
 			} });
@@ -12021,15 +11841,13 @@ var DurableLedger = class DurableLedger {
 		for (const key of [...this.mirror.keys()]) {
 			if (activeKeys.has(key)) continue;
 			try {
-				await this.store.delete.mutate({
-					collection: this.spec.collection,
-					key
-				});
+				await this.kind.delete(key);
 				this.mirror.delete(key);
 				pruned += 1;
 			} catch (err) {
 				this.logger.debug("durable prune delete failed", { meta: {
 					collection: this.spec.collection,
+					kind: this.kind.name,
 					key,
 					error: String(err)
 				} });
@@ -12042,25 +11860,34 @@ var DurableLedger = class DurableLedger {
 	* decision path: the mirror already holds the truth for this process, and the
 	* worst a lost write can do is one silent re-seed after the next restart.
 	*/
-	async persist(row) {
-		const deviceId = this.spec.deviceIdOf?.(row);
+	persist(row) {
+		const key = this.spec.keyOf(row);
+		this.persistRow(key, this.spec.toValue(row));
+	}
+	async persistRow(key, body) {
+		const deviceId = this.deviceIdFromBody(body);
 		try {
-			await this.store.set.mutate({
-				collection: this.spec.collection,
-				key: this.spec.keyOf(row),
-				value: this.spec.toValue(row)
+			await this.kind.put({
+				id: key,
+				data: body
 			});
 		} catch (err) {
 			this.logger.warn("durable persist failed — this key may re-seed on boot", {
 				...deviceId !== void 0 ? { tags: { deviceId } } : {},
 				meta: {
 					collection: this.spec.collection,
-					key: this.spec.keyOf(row),
+					kind: this.kind.name,
+					key,
 					error: String(err)
 				}
 			});
 		}
 	}
+	deviceIdFromBody(body) {
+		const raw = body["deviceId"];
+		const n = typeof raw === "number" ? raw : Number(raw);
+		return Number.isFinite(n) ? n : void 0;
+	}
 };
 //#endregion
 //#region src/recorder/addon/segment-hour-ledger.ts
@@ -12621,15 +12448,15 @@ var SegmentHourLedger = class SegmentHourLedger {
 		this.rowCap = deps.loadPacing?.rowCap ?? 25e4;
 		this.ledger = new DurableLedger({
 			spec: SPEC,
-			store: deps.store,
+			kind: durableLegacyKind(SPEC, deps.store),
 			logger: deps.logger
 		});
 	}
 	static declare(store) {
-		return DurableLedger.declare(store, SPEC);
+		return declareDurableLegacyCollection(store, SPEC);
 	}
 	declare() {
-		return this.ledger.declare();
+		return declareDurableLegacyCollection(this.store, SPEC);
 	}
 	/**
 	* Boot load — every hour row, in one query.
@@ -15040,63 +14867,61 @@ var LocationRefresher = class {
 		}
 	}
 };
-var RECORDING_OPS_LOG_SPEC = {
-	collection: "recorder:ops-log",
-	schema: require_dist.OpsLogEntrySchema,
-	columns: [{
-		name: "at",
-		type: "INTEGER",
-		notNull: true
-	}, {
-		name: "deviceId",
-		type: "INTEGER"
-	}],
-	indexes: [{
-		name: "idx_recorder_ops_log_at",
-		columns: ["at"]
-	}, {
-		name: "idx_recorder_ops_log_device",
-		columns: ["deviceId"]
-	}],
-	project: (_key, value) => ({
-		at: value.at,
-		deviceId: value.deviceId
-	}),
-	deviceIdColumn: "deviceId",
-	loadLimit: 2e4
-};
-/** Build the handle. `declare()` MUST run once at boot before any read/write. */
-function recordingOpsLogState(store, logger) {
-	return new RowMapStore({
-		spec: RECORDING_OPS_LOG_SPEC,
-		store,
-		logger
-	});
+//#endregion
+//#region src/recorder/addon/ops-log-store.ts
+/**
+* Recordings ops-log persistence for the recorder addon.
+*
+* ONE ROW PER OPERATION in the `recorder` / `ops-log` record kind, through a
+* {@link RecordKindHandle}. The ring is bounded — `maxEntries` newest rows
+* survive — trimmed with one `deleteWhere({ atBefore })` per append.
+*
+* ## Records migration (phase 2, step 26)
+*
+* The store was previously backed by a {@link RowMapStore} over a SettingsStore
+* collection named `recorder:ops-log`. It is now backed by a
+* `RecordKindHandle<OpsLogEntry>` obtained from `ctx.records`. The record's
+* `at` field maps to `OpsLogEntry.at`.
+*
+* ## What the RowMapStore replaced
+*
+* The ring lived in ONE key of the recorder's `addon-settings` / `root` blob,
+* as a flat JSON array. On the reference hub it was 147 437 bytes of that row's
+* 201 833 — so appending one audit line read, parsed, re-serialised and rewrote
+* ~200 KB, and so did every unrelated reader of that row. The ops log is the
+* CHEAPEST thing in the recorder and it was paying for the most expensive.
+*
+* Writes stay BEST-EFFORT: `createRecordingOpsLogSink().append` never throws —
+* a failed audit write must not fail the operation it records.
+*/
+/**
+* Obtain the `recorder` / `ops-log` record kind handle.
+* `ctx.records.declare(recorderRecordKinds)` MUST have run before any read or
+* write (called at boot in `onInitialize`).
+*/
+function recordingOpsLogState(records) {
+	return records.kind(recorderRecordKinds["ops-log"]);
 }
 /**
 * Trim the ring to the newest `maxEntries` rows. Returns how many went.
 *
 * The cursor is the OLDEST row that must SURVIVE — offset `maxEntries - 1`
-* newest-first — and the delete is strictly older than it (`[0, at - 1]`).
+* newest-first — and the delete removes everything strictly BEFORE its `at`
+* (`atBefore: cursor.at` deletes rows where `at < cursor.at`).
 *
-* Strictly, because `whereBetween` is inclusive and the filter surface has no
-* `<`: including the cursor's own millisecond would take every row tied on it,
-* and a ring whose rows all shared one millisecond would be deleted whole.
-* Erring this way keeps a few EXTRA audit rows on a tie and never fewer than
-* the cap.
+* Strictly, to avoid dropping the cursor row itself and any rows tied on its
+* millisecond. The ring may hold a few MORE than the cap on a millisecond tie
+* and never FEWER.
 */
 async function trimOpsLog(state, maxEntries = 500) {
-	if (await state.count() <= maxEntries) return 0;
-	const oldestKept = (await state.readWhere({
-		orderBy: {
-			field: "at",
-			direction: "desc"
-		},
-		limit: 1,
-		offset: maxEntries - 1
-	}))[0];
-	if (oldestKept === void 0) return 0;
-	return state.deleteWhere({ whereBetween: { at: [0, oldestKept.value.at - 1] } });
+	if (await state.count({}) <= maxEntries) return 0;
+	const page = await state.query({
+		desc: true,
+		limit: maxEntries
+	});
+	const oldest = page.records[page.records.length - 1];
+	if (oldest === void 0) return 0;
+	return state.deleteWhere({ atBefore: oldest.at ?? 0 });
 }
 /**
 * Append one row and persist, then trim the ring. Validates at the boundary.
@@ -15104,7 +14929,11 @@ async function trimOpsLog(state, maxEntries = 500) {
 */
 async function appendOpsLog(state, entry, maxEntries = 500) {
 	const validated = require_dist.OpsLogEntrySchema.parse(entry);
-	await state.write(validated.id, validated);
+	await state.put({
+		id: validated.id,
+		at: validated.at,
+		data: validated
+	});
 	await trimOpsLog(state, maxEntries);
 	return validated;
 }
@@ -15112,18 +14941,15 @@ async function appendOpsLog(state, entry, maxEntries = 500) {
 * List ops-log rows newest-first, optionally scoped to one device, capped at
 * `limit` (default {@link OPS_LOG_DEFAULT_LIMIT}).
 *
-* Scoped to a device this is an INDEXED query, not a read of the whole ring
-* followed by a filter and a sort in JS.
+* Scoped to a device this is an INDEXED query on the `device` index — not a
+* read of the whole ring followed by a filter and a sort in JS.
 */
 async function listOpsLog(state, query) {
-	return (await state.readWhere({
+	return (await state.query({
 		...query.deviceId === void 0 ? {} : { where: { deviceId: query.deviceId } },
-		orderBy: {
-			field: "at",
-			direction: "desc"
-		},
+		desc: true,
 		limit: query.limit ?? 200
-	})).map((entry) => entry.value);
+	})).records.map((r) => r.data);
 }
 /**
 * Build the recorder's ops-log sink. `append` stamps `domain:'recording'`,
@@ -23581,7 +23407,6 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	readCensus = new StoreReadCensus();
 	/** Memoised so every `configStore()` / `exportsStore()` / `opsLogStore()`
 	*  call shares ONE census instead of each wrapping the raw client afresh. */
-	censusedSettingsStoreClient = null;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -23618,6 +23443,9 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			} });
 			return { providers: [] };
 		}
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("recorder (recording node) needs ctx.records — recording node must be the hub");
+		await records.declare(recorderRecordKinds);
 		await this.declareRowCollections();
 		this.segmentHours = new SegmentHourLedger({
 			store: this.ctx.api.settingsStore,
@@ -25438,26 +25266,16 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		} });
 	}
 	/**
-	* Declare the three row collections that replaced the `recordingConfigs`,
-	* `recordingExports` and `recordingOpsLog` blob keys. Idempotent — a
-	* re-declaration of the same shape is a no-op in the engine.
+	* Declare the remaining RowMapStore collection that replaced the
+	* `recordingConfigs` blob key. Idempotent — a re-declaration of the same
+	* shape is a no-op in the engine.
+	*
+	* `recorder:exports` and `recorder:ops-log` are now record kinds declared
+	* via `ctx.records.declare(recorderRecordKinds)` at the top of
+	* `onInitialize`.
 	*/
 	async declareRowCollections() {
 		await this.configStore().declare();
-		await this.exportsStore().declare();
-		await this.opsLogStore().declare();
-	}
-	/**
-	* `ctx.api.settingsStore`, wrapped ONCE through {@link censusStoreClient}.
-	*
-	* LAZY (see `calendar` above): `ctx` is not assigned until `initialize()`
-	* runs, so this cannot be a field initialiser. The wrap is permanent and
-	* cheap when disarmed (one `get` trap and a comparison) — what is armed and
-	* disarmed is `this.readCensus`, through `debug.storeCensus`, not this seam.
-	*/
-	censusedSettingsStore() {
-		this.censusedSettingsStoreClient ??= censusStoreClient(this.ctx.api.settingsStore, this.readCensus);
-		return this.censusedSettingsStoreClient;
 	}
 	configsState = null;
 	/** A camera's recording config — its per-device settings (D865), migrated on read. */
@@ -25470,14 +25288,23 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		});
 		return this.configsState;
 	}
-	/** Durable handle over the exportId→ExportRecord blob (same `BaseAddon.state()`
-	*  wrapper as the config store). */
+	/** Record kind handle over the `recorder` / `exports` kind (hub recording node only). */
 	exportsStore() {
-		return recordingExportsState(this.censusedSettingsStore(), this.ctx.logger);
+		return recordingExportsState(this.requireRecords());
 	}
-	/** Durable handle over the bounded recordings ops-log ring. */
+	/** Record kind handle over the `recorder` / `ops-log` kind (hub recording node only). */
 	opsLogStore() {
-		return recordingOpsLogState(this.censusedSettingsStore(), this.ctx.logger);
+		return recordingOpsLogState(this.requireRecords());
+	}
+	/**
+	* Returns `ctx.records`, throwing clearly when it is absent.
+	* Only called on the designated recording node (hub by default); an agent
+	* exits before `onInitialize` reaches any store call.
+	*/
+	requireRecords() {
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("recorder (recording node) needs ctx.records — recording node must be the hub");
+		return records;
 	}
 	/** Durable handle over the recorder-owned placement blob (assignments + volume ids). */
 	placementStore() {