@camstack/addon-pipeline 1.2.69 → 1.2.70

package/dist/{event-loop-stall-monitor-D9d2e49f.js → event-loop-stall-monitor-STRdnQWm.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-tJF2BzWi.js");
+const require_dist = require("./dist-cR-pvD_z.js");
 let node_perf_hooks = require("node:perf_hooks");
 //#region src/detection-pipeline/registry/model-catalogs.ts
 var HF_REPO = "camstack/camstack-models";

package/dist/motion-wasm/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-tJF2BzWi.js");
+const require_dist = require("../dist-cR-pvD_z.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");

package/dist/motion-wasm/index.mjs

@@ -1,4 +1,4 @@
-import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-DGLqaonv.mjs";
+import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-BPaa4_z6.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/pipeline-runner/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-tJF2BzWi.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-D9d2e49f.js");
-const require_worker_protocol = require("../worker-protocol-D6tXz9Or.js");
+const require_dist = require("../dist-cR-pvD_z.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-STRdnQWm.js");
+const require_worker_protocol = require("../worker-protocol-C7V1qIIA.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
 const require_remote_restream = require("../remote-restream-BYbAsgUf.js");
@@ -3190,6 +3190,7 @@ var PipelineRunner = class {
 			motionQueue,
 			detectionQueue,
 			inferenceTimes: [],
+			shedFrames: 0,
 			processedCount: 0,
 			startTime: Date.now(),
 			phase: initialPhase,
@@ -3482,7 +3483,7 @@ var PipelineRunner = class {
 			actualFps,
 			queueDepth: state.motionQueue.size + state.detectionQueue.size,
 			avgInferenceTimeMs: avgInference,
-			droppedFrames: state.motionQueue.droppedFrames + state.detectionQueue.droppedFrames,
+			droppedFrames: state.motionQueue.droppedFrames + state.detectionQueue.droppedFrames + state.shedFrames,
 			phase: state.phase
 		};
 	}
@@ -3589,6 +3590,7 @@ var PipelineRunner = class {
 			if (state.inferenceTimes.length > 100) state.inferenceTimes.shift();
 			state.processedCount++;
 			if (result) {
+				if (result.shed === true) state.shedFrames++;
 				await this.notifyCallbacks(deviceId, frame, result, streamType, handle);
 				const emittedAt = Date.now();
 				const capturedAt = frame.capturedAt;
@@ -6102,11 +6104,12 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 		let image;
 		if (!this.executorCoLocated()) {
 			if (frame.format === "rgb") try {
-				image = await (0, sharp.default)(frame.data, { raw: {
+				const encoded = await (0, sharp.default)(frame.data, { raw: {
 					width: frame.width,
 					height: frame.height,
 					channels: 3
 				} }).jpeg({ quality: DETECTION_HOP_JPEG_QUALITY }).toBuffer();
+				image = new Uint8Array(encoded);
 			} catch (err) {
 				log.debug("runInference: frame JPEG encode failed — falling back to raw pixels", { meta: { error: require_dist.errMsg(err) } });
 			}

package/dist/pipeline-runner/index.mjs

@@ -1,6 +1,6 @@
-import { At as string, Ct as boolean, Dt as number, Et as literal, K as pipelineRunnerCapability, M as deriveDetailCropRect, Mt as EventCategory, Ot as object, St as array, Tt as lazy, U as pickDetailCropConvention, W as pickNativeLeaseOverride, dt as createEvent, gt as nodePin, j as defineCustomActions, k as customAction, s as DEFAULT_DETAIL_CROP_CONVENTION, st as BaseAddon, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT, xt as _enum } from "../dist-DGLqaonv.mjs";
-import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-C6_VDupx.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-DuftUFEI.mjs";
+import { At as string, Ct as boolean, Dt as number, Et as literal, K as pipelineRunnerCapability, M as deriveDetailCropRect, Mt as EventCategory, Ot as object, St as array, Tt as lazy, U as pickDetailCropConvention, W as pickNativeLeaseOverride, dt as createEvent, gt as nodePin, j as defineCustomActions, k as customAction, s as DEFAULT_DETAIL_CROP_CONVENTION, st as BaseAddon, tt as errMsg, u as DEVICE_BACKEND_TO_FORMAT, xt as _enum } from "../dist-BPaa4_z6.mjs";
+import { c as getStepDefinition, t as attributeStall } from "../event-loop-stall-monitor-B79REtL2.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-CBO8nwQj.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
 import { i as withDetectionIntent, n as profileForStreamId, t as isRemoteRestream } from "../remote-restream-Ci7RXNGb.mjs";
@@ -3182,6 +3182,7 @@ var PipelineRunner = class {
 			motionQueue,
 			detectionQueue,
 			inferenceTimes: [],
+			shedFrames: 0,
 			processedCount: 0,
 			startTime: Date.now(),
 			phase: initialPhase,
@@ -3474,7 +3475,7 @@ var PipelineRunner = class {
 			actualFps,
 			queueDepth: state.motionQueue.size + state.detectionQueue.size,
 			avgInferenceTimeMs: avgInference,
-			droppedFrames: state.motionQueue.droppedFrames + state.detectionQueue.droppedFrames,
+			droppedFrames: state.motionQueue.droppedFrames + state.detectionQueue.droppedFrames + state.shedFrames,
 			phase: state.phase
 		};
 	}
@@ -3581,6 +3582,7 @@ var PipelineRunner = class {
 			if (state.inferenceTimes.length > 100) state.inferenceTimes.shift();
 			state.processedCount++;
 			if (result) {
+				if (result.shed === true) state.shedFrames++;
 				await this.notifyCallbacks(deviceId, frame, result, streamType, handle);
 				const emittedAt = Date.now();
 				const capturedAt = frame.capturedAt;
@@ -6094,11 +6096,12 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 		let image;
 		if (!this.executorCoLocated()) {
 			if (frame.format === "rgb") try {
-				image = await sharp(frame.data, { raw: {
+				const encoded = await sharp(frame.data, { raw: {
 					width: frame.width,
 					height: frame.height,
 					channels: 3
 				} }).jpeg({ quality: DETECTION_HOP_JPEG_QUALITY }).toBuffer();
+				image = new Uint8Array(encoded);
 			} catch (err) {
 				log.debug("runInference: frame JPEG encode failed — falling back to raw pixels", { meta: { error: errMsg(err) } });
 			}

package/dist/recorder/index.js

@@ -1,5 +1,5 @@
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-tJF2BzWi.js");
+const require_dist = require("../dist-cR-pvD_z.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_addon_utils = require("../addon-utils-CQs-AjTJ.js");
 let node_crypto = require("node:crypto");
@@ -683,6 +683,36 @@ var RecordingIndex = class {
 		}
 		return out;
 	}
+	/**
+	* Every (device, profile, location) pile in ONE pass — bytes and file count,
+	* no sort and no cache rebuild.
+	*
+	* This is the input to the operator-armed rebalance (D116): it asks "where is
+	* each camera-profile's footage, and how much of it", which is exactly the
+	* unit the placement plan assigns and the relocate mover moves. Building it
+	* from `segmentsOnLocation` per location would sort the whole archive once
+	* per location instead.
+	*/
+	piles() {
+		const out = /* @__PURE__ */ new Map();
+		for (const m of this.byDevice.values()) for (const s of m.values()) {
+			const key = `${s.deviceId}:${s.profile}:${s.locationId}`;
+			const prev = out.get(key);
+			if (prev) {
+				prev.bytes += s.bytes;
+				prev.files += 1;
+				continue;
+			}
+			out.set(key, {
+				deviceId: s.deviceId,
+				profile: s.profile,
+				locationId: s.locationId,
+				bytes: s.bytes,
+				files: 1
+			});
+		}
+		return [...out.values()];
+	}
 	/** All segments on a storage location across every device, oldest-first. */
 	segmentsOnLocation(locationId) {
 		const out = [];
@@ -872,6 +902,19 @@ function resolveEvictionDomain(locations, locationId, realpath = node_fs.realpat
 *
 * Runs INSIDE the recorder process — container uid, same-uid files, no host
 * chown trap (see docs/history 2026-07-29).
+*
+* ── Phase 2 (D116, multi-location) ────────────────────────────────────────
+* Two additions the OPERATOR-ARMED rebalance needs:
+*
+*   - A move is scoped to one CAMERA (and optionally to specific profiles),
+*     not just to a whole disk. The rebalance's unit is a (camera, profile)
+*     pile, because that is the unit the placement plan assigns.
+*   - Concurrent starts QUEUE instead of being refused. The engine is still
+*     single-flight — two movers on one disk thrash both — but a rebalance
+*     enqueues one job per pile, and refusing the second turned a
+*     fifteen-camera rebalance into fifteen manual retries. Jobs run FIFO; a
+*     job cancelled while queued never runs, and a job that FAILS does not
+*     strand the queue behind it.
 */
 var DEFAULT_THROTTLE_MBPS = 40;
 /** Progress callback cadence (files) — cheap enough to fire often. */
@@ -915,22 +958,48 @@ async function moveFile(src, dst, srcBytes) {
 var RelocateEngine = class {
 	deps;
 	jobs = /* @__PURE__ */ new Map();
+	/** Job ids waiting for the mover, in enqueue order. */
+	queue = [];
+	/** Set while a job is executing — the single-flight latch. */
+	draining = false;
 	constructor(deps) {
 		this.deps = deps;
 	}
 	list() {
 		return [...this.jobs.values()].sort((a, b) => b.startedAt - a.startedAt).map(snapshot);
 	}
+	/**
+	* Cancel a running OR queued job. A running job stops after its current
+	* file; a queued job is terminated where it stands and never runs — which is
+	* why this returns true for both, and why the cancelled job still gets its
+	* `onFinished` audit row.
+	*/
 	cancel(jobId) {
 		const job = this.jobs.get(jobId);
-		if (!job || job.state !== "running") return false;
+		if (!job) return false;
+		if (job.state === "running") {
+			job.cancelRequested = true;
+			return true;
+		}
+		if (job.state !== "queued") return false;
 		job.cancelRequested = true;
+		job.state = "cancelled";
+		job.finishedAt = this.deps.now();
+		const at = this.queue.indexOf(jobId);
+		if (at >= 0) this.queue.splice(at, 1);
+		this.deps.onFinished?.(snapshot(job));
 		return true;
 	}
-	/** Start a relocation. Throws on invalid locations or when a job is already
-	*  running (single-flight — two movers on one disk thrash both). */
+	/**
+	* Enqueue a relocation and return its job id. Throws only on an input the
+	* mover could never satisfy (unknown/identical/read-only locations) —
+	* validated SYNCHRONOUSLY so a caller arming a rebalance learns about a bad
+	* target before any job runs.
+	*
+	* Concurrency: the returned job may be `queued` rather than `running`. The
+	* engine still moves one job at a time.
+	*/
 	start(input) {
-		for (const j of this.jobs.values()) if (j.state === "running") throw new Error(`a relocation is already running (${j.jobId})`);
 		const locs = this.deps.locations();
 		const from = locs.find((l) => l.id === input.fromLocationId);
 		const to = locs.find((l) => l.id === input.toLocationId);
@@ -940,10 +1009,13 @@ var RelocateEngine = class {
 		if (to.readOnly) throw new Error(`target location is read-only: ${to.id}`);
 		const job = {
 			jobId: this.deps.newId(),
-			state: "running",
+			state: "queued",
 			fromLocationId: from.id,
 			toLocationId: to.id,
-			deviceId: null,
+			deviceId: input.deviceId ?? null,
+			profiles: input.profiles ? [...input.profiles] : [],
+			footageClass: input.footageClass,
+			throttleMbps: input.throttleMbps ?? DEFAULT_THROTTLE_MBPS,
 			entities: input.entities ? [...input.entities] : ["segments"],
 			filesMoved: 0,
 			bytesMoved: 0,
@@ -954,15 +1026,56 @@ var RelocateEngine = class {
 			cancelRequested: false
 		};
 		this.jobs.set(job.jobId, job);
-		this.run(job, from, to, input.throttleMbps ?? DEFAULT_THROTTLE_MBPS, input.footageClass);
+		this.queue.push(job.jobId);
+		this.drain();
 		return job.jobId;
 	}
-	async run(job, from, to, throttleMbps, footageClass) {
+	/**
+	* Run queued jobs one at a time, in enqueue order. Re-entrant by design: the
+	* `draining` latch is the single-flight guarantee, and every terminal state
+	* (including `failed`) falls through to the next job — a queue stranded
+	* behind one bad camera is the failure mode FIFO exists to avoid.
+	*/
+	async drain() {
+		if (this.draining) return;
+		this.draining = true;
+		try {
+			for (;;) {
+				const jobId = this.queue.shift();
+				if (jobId === void 0) return;
+				const job = this.jobs.get(jobId);
+				if (!job || job.state !== "queued") continue;
+				const locs = this.deps.locations();
+				const from = locs.find((l) => l.id === job.fromLocationId);
+				const to = locs.find((l) => l.id === job.toLocationId);
+				if (!from || !to) {
+					job.state = "failed";
+					job.error = `location disappeared while queued: ${job.fromLocationId} → ${job.toLocationId}`;
+					job.finishedAt = this.deps.now();
+					this.deps.logger.warn("relocate job failed", {
+						...job.deviceId !== null ? { tags: { deviceId: job.deviceId } } : {},
+						meta: {
+							jobId: job.jobId,
+							error: job.error
+						}
+					});
+					this.deps.onFinished?.(snapshot(job));
+					continue;
+				}
+				job.state = "running";
+				job.startedAt = this.deps.now();
+				await this.run(job, from, to);
+			}
+		} finally {
+			this.draining = false;
+		}
+	}
+	async run(job, from, to) {
 		const sleep = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-		const bytesPerMs = throttleMbps * 1024 * 1024 / 1e3;
+		const bytesPerMs = job.throttleMbps * 1024 * 1024 / 1e3;
 		try {
 			const samePhysicalRoot = await rootsPhysicallySame(from.root, to.root);
-			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => profileBelongsToClass(r.profile, footageClass)).sort((a, b) => a.startMs - b.startMs);
+			const segRows = job.entities.includes("segments") === false ? [] : this.deps.index.segmentsOnLocation(from.id).filter((r) => job.deviceId === null || r.deviceId === job.deviceId).filter((r) => job.profiles.length === 0 || job.profiles.includes(r.profile)).filter((r) => profileBelongsToClass(r.profile, job.footageClass)).sort((a, b) => a.startMs - b.startMs);
 			job.filesTotal = segRows.length;
 			for (const row of segRows) {
 				if (job.cancelRequested) break;
@@ -985,10 +1098,13 @@ var RelocateEngine = class {
 		} catch (err) {
 			job.state = "failed";
 			job.error = err instanceof Error ? err.message : String(err);
-			this.deps.logger.warn("relocate job failed", { meta: {
-				jobId: job.jobId,
-				error: job.error
-			} });
+			this.deps.logger.warn("relocate job failed", {
+				...job.deviceId !== null ? { tags: { deviceId: job.deviceId } } : {},
+				meta: {
+					jobId: job.jobId,
+					error: job.error
+				}
+			});
 		} finally {
 			job.finishedAt = this.deps.now();
 			this.deps.onFinished?.(snapshot(job));
@@ -2470,20 +2586,6 @@ async function listExportsFor(state, deviceId) {
 }
 //#endregion
 //#region src/recorder/addon/export-engine.ts
-/**
-* Render engine for recording exports.
-*
-* A FIFO queue with ONE concurrent ffmpeg render (exports are heavy; serialising
-* protects the recording node). Each job: write the range's per-export source
-* playlist (`resolvePlaylist`) → build argv (`buildExportArgs`) → spawn ffmpeg →
-* parse `time=` from stderr for progress → on exit 0 stat the file and mark
-* `ready`; on non-zero mark `failed` and remove the partial; drop the source
-* playlist whatever the outcome. `cancel` SIGKILLs an in-flight render.
-* State transitions patch the DurableState store and emit telemetry events.
-*
-* Unlike `SegmentWriter` there is NO auto-restart — a render runs once; boot
-* re-queue of interrupted jobs is the provider's concern.
-*/
 /** Stderr lines retained for the failure LOG. ffmpeg prints one line per failed
 *  segment before the decisive "Error opening input" summary, so a short tail can
 *  push the actual cause out of the window (it very nearly did — the line that
@@ -2491,6 +2593,26 @@ async function listExportsFor(state, deviceId) {
 *  render writes one progress line per second. */
 var STDERR_TAIL_LINES$1 = 40;
 var TIME_RE = /time=(\d+):(\d+):(\d+(?:\.\d+)?)/;
+/**
+* The floor under which an MP4 cannot hold a single decodable frame.
+*
+* **Exit 0 is not the same question as "the file holds a video".** A timelapse
+* whose frame-select predicate matched nothing produced a **262-byte** MP4 —
+* `ftyp` + `moov` + an EMPTY `mdat`, `nb_streams=0` to ffprobe — and ffmpeg
+* exited 0 while doing it. The row went `ready`, `readExportBytes` served the
+* 262 bytes, the notification centre republished them on the artifact plane
+* and a phone was handed a video no player can open (2026-08-12; the operator
+* reported it as "il video è danneggiato", and the served artifact was
+* byte-identical to the file on disk, so the render was the only suspect).
+*
+* A frame-free MP4 tops out around 300 bytes (the box headers and nothing
+* else); the smallest REAL one-frame 640×360 h264 export measured here is
+* several kilobytes. 1 KiB sits between the two with room on both sides, and
+* it is deliberately a byte floor and not an ffprobe call: the engine must be
+* able to refuse an empty render without a second process, on every node,
+* whatever ffmpeg build is installed.
+*/
+var EXPORT_MIN_PLAUSIBLE_BYTES = 1024;
 /** Expected OUTPUT duration (seconds) for progress scaling. */
 function expectedOutSeconds(rec) {
 	const rangeSec = Math.max(.001, (rec.toMs - rec.fromMs) / 1e3);
@@ -2647,6 +2769,17 @@ var ExportEngine = class {
 			await this.fail(id, err instanceof Error ? err.message : String(err));
 			return;
 		}
+		if (bytes < 1024) {
+			this.deps.logger.error("export produced no video frames", { meta: {
+				exportId: id,
+				outPath,
+				bytes,
+				minBytes: EXPORT_MIN_PLAUSIBLE_BYTES
+			} });
+			await this.deps.removeFile(outPath);
+			await this.fail(id, `render produced no video frames (${bytes} bytes, < ${EXPORT_MIN_PLAUSIBLE_BYTES})`);
+			return;
+		}
 		await patchExport(this.deps.state, id, {
 			state: "ready",
 			progressPct: 100,
@@ -3028,6 +3161,73 @@ function buildRecordingDeviceSchema() {
 		}]
 	}] };
 }
+/** The placement-store key for one (camera, profile). Mirrors `assignmentKey`
+*  in `placement-store.ts`; kept local so this module stays dependency-free. */
+function sourceKey(source) {
+	return `${source.deviceId}:${source.profile}`;
+}
+/** Biggest pile first (the overloaded disk is relieved fastest), ties broken
+*  deterministically so the same input always yields the same plan. */
+function bySizeThenKey(a, b) {
+	return b.bytes - a.bytes || a.deviceId - b.deviceId || a.profile.localeCompare(b.profile);
+}
+/**
+* Plan the moves that would make stored footage agree with the placement plan.
+* Pure: the same input always yields the same plan, and the input is untouched.
+*/
+function planRebalance(input) {
+	const minMoveBytes = input.minMoveBytes ?? 1e9;
+	const remaining = new Map(input.headroom.map((h) => [h.locationId, h.headroomBytes]));
+	const moves = [];
+	const skipped = [];
+	let bytesToMove = 0;
+	for (const source of [...input.sources].sort(bySizeThenKey)) {
+		const target = input.assignments.get(sourceKey(source));
+		if (target === source.locationId) continue;
+		const skip = (reason, toLocationId) => {
+			skipped.push({
+				deviceId: source.deviceId,
+				profile: source.profile,
+				fromLocationId: source.locationId,
+				toLocationId,
+				bytes: source.bytes,
+				reason
+			});
+		};
+		if (target === void 0) {
+			skip("unassigned", null);
+			continue;
+		}
+		const headroomBytes = remaining.get(target);
+		if (headroomBytes === void 0) {
+			skip("target-not-writable", target);
+			continue;
+		}
+		if (source.bytes < minMoveBytes) {
+			skip("below-threshold", target);
+			continue;
+		}
+		if (source.bytes > headroomBytes) {
+			skip("no-headroom", target);
+			continue;
+		}
+		remaining.set(target, headroomBytes - source.bytes);
+		bytesToMove += source.bytes;
+		moves.push({
+			deviceId: source.deviceId,
+			profile: source.profile,
+			fromLocationId: source.locationId,
+			toLocationId: target,
+			bytes: source.bytes,
+			files: source.files
+		});
+	}
+	return {
+		moves,
+		skipped,
+		bytesToMove
+	};
+}
 //#endregion
 //#region src/recorder/addon/recording-provider.ts
 /**
@@ -3305,6 +3505,75 @@ async function openRangeFromDisk(absPath, size) {
 		close: () => handle.close()
 	};
 }
+/** Bytes in one operator-facing gigabyte — the same decimal GB `maxUsedGb`
+*  uses, so two knobs on the same page never mean two different things. */
+var BYTES_PER_GB = 1e9;
+/**
+* The operator-armed rebalance, both halves (D116, Phase 2).
+*
+* `arm: false` is the dry run the operator confirms; `arm: true` enqueues one
+* relocate job per planned move, FIFO behind the single-flight mover. The two
+* share this one body deliberately: what is confirmed is exactly what runs.
+*
+* Every refusal is LOGGED, per camera. A rebalance that quietly leaves half the
+* archive where it was is indistinguishable from one that had nothing to do,
+* and this repo has paid for that ambiguity twice.
+*/
+async function runRebalance(deps, input, arm) {
+	const relocate = deps.relocate;
+	if (!deps.placementSnapshot) throw new Error("placement is not active on this node");
+	if (arm && !relocate) throw new Error("relocation unavailable on this node");
+	const snapshot = await deps.placementSnapshot();
+	const plan = planRebalance({
+		assignments: snapshot.assignments,
+		sources: deps.index.piles(),
+		headroom: snapshot.headroom,
+		...input.minMoveGb !== void 0 ? { minMoveBytes: input.minMoveGb * BYTES_PER_GB } : {}
+	});
+	for (const skip of plan.skipped) deps.logger.info("recorder rebalance: footage left where it is", {
+		tags: { deviceId: skip.deviceId },
+		meta: {
+			profile: skip.profile,
+			from: skip.fromLocationId,
+			to: skip.toLocationId,
+			bytes: skip.bytes,
+			reason: skip.reason
+		}
+	});
+	const result = {
+		moves: [...plan.moves],
+		skipped: [...plan.skipped],
+		bytesToMove: plan.bytesToMove,
+		jobIds: []
+	};
+	if (!arm || !relocate) return result;
+	const jobIds = [];
+	for (const move of plan.moves) {
+		const jobId = relocate.start({
+			fromLocationId: move.fromLocationId,
+			toLocationId: move.toLocationId,
+			deviceId: move.deviceId,
+			profiles: [move.profile],
+			...input.throttleMbps !== void 0 ? { throttleMbps: input.throttleMbps } : {}
+		});
+		jobIds.push(jobId);
+		deps.logger.info("recorder rebalance: relocate job enqueued", {
+			tags: { deviceId: move.deviceId },
+			meta: {
+				jobId,
+				profile: move.profile,
+				from: move.fromLocationId,
+				to: move.toLocationId,
+				bytes: move.bytes,
+				files: move.files
+			}
+		});
+	}
+	return {
+		...result,
+		jobIds
+	};
+}
 /**
 * Build the `IRecordingProvider`. The provider is a thin façade over the v2
 * core; all storage I/O flows through the injected deps.
@@ -3368,11 +3637,12 @@ function buildRecordingProvider(deps) {
 			for (const loc of locations) for (const row of deps.index.segmentsOnLocation(loc.id)) seenDevices.add(row.deviceId);
 			let totalUsedBytes = 0;
 			for (const deviceId of seenDevices) {
-				const usedBytes = deps.index.accounting(deviceId).bytes;
-				totalUsedBytes += usedBytes;
+				const accounting = deps.index.accounting(deviceId);
+				totalUsedBytes += accounting.bytes;
 				devices.push({
 					deviceId,
-					usedBytes
+					usedBytes: accounting.bytes,
+					oldestMs: accounting.oldestMs
 				});
 			}
 			const byPhysical = /* @__PURE__ */ new Map();
@@ -3559,6 +3829,24 @@ function buildRecordingProvider(deps) {
 		},
 		getStorageMigrationMoveStatus: async ({ jobId }) => deps.relocate?.list().find((job) => job.jobId === jobId) ?? null,
 		cancelStorageMigrationMove: async ({ jobId }) => ({ cancelled: deps.relocate?.cancel(jobId) ?? false }),
+		relocateFootage: async (input) => {
+			if (!deps.relocate) throw new Error("relocation unavailable on this node");
+			const jobId = deps.relocate.start(input);
+			deps.logger.info("recorder: relocate job enqueued", {
+				...input.deviceId !== void 0 ? { tags: { deviceId: input.deviceId } } : {},
+				meta: {
+					jobId,
+					from: input.fromLocationId,
+					to: input.toLocationId,
+					profiles: input.profiles ?? null
+				}
+			});
+			return { jobId };
+		},
+		listRelocateJobs: async () => deps.relocate?.list() ?? [],
+		cancelRelocateJob: async ({ jobId }) => ({ cancelled: deps.relocate?.cancel(jobId) ?? false }),
+		planStorageRebalance: (input) => runRebalance(deps, input, false),
+		startStorageRebalance: (input) => runRebalance(deps, input, true),
 		getDeviceSettingsContribution: async ({ deviceId }) => {
 			if (deps.isCameraDevice && !await deps.isCameraDevice(deviceId)) return null;
 			return require_dist.hydrateSchema(buildRecordingDeviceSchema(), {});
@@ -4690,6 +4978,33 @@ var PlacementService = class {
 		return plan;
 	}
 	/**
+	* The write targets and what each can still absorb — the SAME pool and the
+	* SAME headroom `recompute` plans over.
+	*
+	* Exposed for the operator-armed rebalance (D116): weighing existing footage
+	* against a second, independently-derived idea of "what fits" is how the two
+	* halves end up disagreeing, and a rebalance that plans onto a location the
+	* planner would never write to is a rebalance that undoes itself on the next
+	* tick. A location absent from this list is not a write target at all.
+	*/
+	async candidates() {
+		return this.candidatesFor(this.pool());
+	}
+	/**
+	* The plan in force: `<deviceId>:<profile>` → locationId. Empty when the
+	* store cannot be read — a fallible read decides nothing (D49), and an empty
+	* plan makes the rebalance report every pile as `unassigned` rather than
+	* inventing moves.
+	*/
+	async currentAssignments() {
+		try {
+			return new Map(Object.entries((await readPlacementState(this.deps.state)).assignments));
+		} catch (err) {
+			this.deps.logger.warn("recorder placement: assignment read failed — reporting no plan", { meta: { error: require_dist.errMsg(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
 	* Turn each pool location into a planner candidate. Headroom is
 	* `min(free − minFree floor, maxUsedGb − used)`, clamped at zero: the first
 	* term is the per-location free-space guard the storage pressure manager also
@@ -6575,6 +6890,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			resumeForStorageMigration: (leaseId) => this.resumeForStorageMigration(leaseId),
 			refreshStorageLocationsForMigration: (leaseId) => this.refreshStorageLocationsForMigration(leaseId),
 			assertStorageMigrationLease: (leaseId) => this.assertStorageMigrationLease(leaseId),
+			placementSnapshot: () => this.placementSnapshot(),
 			dataDir: this.ctx.dataDir,
 			playbackBaseUrl: () => this.playbackBaseUrl,
 			isCameraDevice: async (deviceId) => {
@@ -7014,6 +7330,28 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 		await this.placement.recompute(work);
 	}
 	/**
+	* The plan in force plus each write target's headroom, for the operator-armed
+	* rebalance (D116, Phase 2). Both come from the SAME `PlacementService` the
+	* 30 s tick plans with: a rebalance computed against a second idea of "what
+	* fits" would plan moves the next tick undoes.
+	*
+	* Throws when placement is not active (a non-recording node, or early boot) —
+	* the rebalance is an operator action and a silent empty plan would read as
+	* "nothing to do".
+	*/
+	async placementSnapshot() {
+		const placement = this.placement;
+		if (!placement) throw new Error("placement is not active on this node");
+		const [assignments, candidates] = await Promise.all([placement.currentAssignments(), placement.candidates()]);
+		return {
+			assignments,
+			headroom: candidates.map((candidate) => ({
+				locationId: candidate.locationId,
+				headroomBytes: candidate.headroomBytes
+			}))
+		};
+	}
+	/**
 	* Measured bytes/day for one (camera, profile) — the demand signal the
 	* placement planner weights against each location's headroom. Derived from
 	* the index's own accounting (segment paths encode bytes + start), so it