@camstack/addon-post-analysis 1.2.126 → 1.2.128

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BarcMD8R.js");
+const require_dist = require("../dist-D6O14xf_.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -31823,11 +31823,13 @@ var MediaStore = class {
 	store;
 	logger;
 	writeGate;
+	resolveEventMediaLocation;
 	constructor(deps) {
 		this.storage = deps.storage;
 		this.store = deps.store;
 		this.logger = deps.logger;
 		this.writeGate = deps.writeGate;
+		this.resolveEventMediaLocation = deps.resolveEventMediaLocation;
 	}
 	gated(mutation) {
 		return this.writeGate ? this.writeGate.run(mutation) : mutation();
@@ -31848,7 +31850,8 @@ var MediaStore = class {
 	async putUnchecked(params) {
 		const key = buildKey(params);
 		const path = buildPath(params);
-		const location = locationForOwnerKind(params.ownerKind);
+		const staticLocation = locationForOwnerKind(params.ownerKind);
+		const location = staticLocation === "eventMedia" && this.resolveEventMediaLocation ? await this.resolveEventMediaLocation(params.deviceId) : staticLocation;
 		const record = {
 			deviceId: params.deviceId,
 			ownerKind: params.ownerKind,
@@ -41541,6 +41544,21 @@ var MediaCaptureLogAggregator = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/media-locations.ts
+/**
+* Picks the location a new `eventMedia` blob should be written to, or `null`
+* when none is writable — the caller MUST refuse the write rather than fall
+* back to a read-only location, which would fail far downstream as an opaque
+* filesystem error instead of a named storage decision.
+*/
+function pickWritableMediaLocation(locations, currentDefaultId) {
+	const writable = locations.filter((l) => l.enabled && !l.readOnly);
+	if (writable.length === 0) return null;
+	const keep = writable.find((l) => l.id === currentDefaultId);
+	if (keep) return keep.id;
+	return writable.toSorted((a, b) => b.headroomBytes - a.headroomBytes)[0]?.id ?? null;
+}
+//#endregion
 //#region src/pipeline-analytics/media-relocate-engine.ts
 var PAGE_SIZE = 200;
 var DEFAULT_THROTTLE_MBPS = 40;
@@ -46374,6 +46392,50 @@ var AUDIO_COLUMNS = [
 		type: "JSON"
 	}
 ];
+/**
+* The columns `slimMotion` reads. `id` is the primary key — always returned,
+* never part of a projection.
+*
+* What it leaves behind is the point: `regions` is a JSON array with one entry
+* per motion rectangle, and it is the only reason a motion row is not tiny.
+* `frameWidth` / `frameHeight` go with it — they exist to interpret `regions`
+* and mean nothing without it.
+*/
+var SLIM_MOTION_COLUMNS = [
+	"deviceId",
+	"timestamp",
+	"regionCount"
+];
+/**
+* The columns `slimObject` reads — and ONLY those.
+*
+* Four JSON columns are dropped (`bbox`, `zones`, `labelMeta`, `subLabelMeta`)
+* plus the numbers that only exist to argue about a value after the fact
+* (`confidence`, `labelScore`, `subLabelScore`) and the frame geometry that,
+* like motion's, is meaningless without the box it describes.
+*
+* `label` / `subLabel` stay because the timeline renders `subLabel ?? label`,
+* which cannot be evaluated from half a row. `frameId` / `trackId` /
+* `importance` stay because they are the grouping and sort keys the events page
+* needs — all three are light.
+*
+* ⚠ `slimObject` calls `readTieredLabelColumns`, which reads all SIX tiered
+* columns and returns the four unprojected ones as `undefined`. That is
+* harmless here only because `slimObject` uses exactly `label` and `subLabel`
+* from what it gets back. If it ever starts reading a score, this list is the
+* thing that has to learn about it — the failure would otherwise be a score
+* that reads as absent on every slim row.
+*/
+var SLIM_OBJECT_COLUMNS = [
+	"deviceId",
+	"timestamp",
+	"className",
+	"frameId",
+	"trackId",
+	"importance",
+	"label",
+	"subLabel"
+];
 var COMMON_INDEXES = (prefix) => [{
 	name: `idx_${prefix}_device_ts`,
 	columns: ["deviceId", "timestamp"]
@@ -46557,6 +46619,19 @@ var EventStore = class {
 			filter
 		})]);
 	}
+	/**
+	* Spreadable `columns` for a slim read — omitted entirely for `full`.
+	*
+	* The projection is decided in ONE place per collection ({@link
+	* SLIM_MOTION_COLUMNS} / {@link SLIM_OBJECT_COLUMNS}) because a projection is
+	* a promise between the SELECT and the mapper: the day they disagree nothing
+	* fails. SQLite returns the row without the column, `slimObject` reads
+	* `data['className']`, gets `undefined`, and hands back an event whose class
+	* is missing — indistinguishable from a row that never had one.
+	*/
+	slimColumns(projection, columns) {
+		return projection === "slim" ? { columns } : {};
+	}
 	buildFilter(q) {
 		const filter = {
 			where: { deviceId: q.deviceId },
@@ -46572,7 +46647,8 @@ var EventStore = class {
 	async queryMotion(q) {
 		const rows = await this.store.query.query({
 			collection: MOTION_EVENTS_COLLECTION,
-			filter: this.buildFilter(q)
+			filter: this.buildFilter(q),
+			...this.slimColumns(q.projection, SLIM_MOTION_COLUMNS)
 		});
 		if (q.projection === "slim") return rows.map((r) => slimMotion(r.id, stripNulls$1(r.data)));
 		return rows.map((r) => {
@@ -46642,7 +46718,8 @@ var EventStore = class {
 		}
 		const rows = await this.store.query.query({
 			collection: OBJECT_EVENTS_COLLECTION,
-			filter
+			filter,
+			...this.slimColumns(q.projection, SLIM_OBJECT_COLUMNS)
 		});
 		if (q.projection === "slim") return rows.map((r) => slimObject(r.id, stripNulls$1(r.data)));
 		return rows.map((r) => {
@@ -49301,6 +49378,16 @@ function trackColumnsFor(projection, needsPositions = false) {
 	if (projection !== "slim") return void 0;
 	return needsPositions ? [...SLIM_TRACK_COLUMN_NAMES, "positions"] : SLIM_TRACK_COLUMN_NAMES;
 }
+/**
+* The SELECT list for an IDS-ONLY recent page: the primary key (free, always
+* returned) plus `lastSeen`.
+*
+* `lastSeen` is not an optimisation to shave off later — {@link
+* TrackStore.recentPage} orders on it, windows on it and breaks
+* same-millisecond ties with it. Reading ids without it would produce a page in
+* whatever order the engine felt like and a cursor that cannot resume.
+*/
+var RECENT_IDS_COLUMNS = ["lastSeen"];
 /** Spreadable `columns` for a store query — omitted entirely for `full`. */
 function projectionArg(projection, needsPositions = false) {
 	const columns = trackColumnsFor(projection, needsPositions);
@@ -50555,10 +50642,48 @@ var TrackStore = class {
 	* Errors propagate (no partial merges): a failed device query fails the
 	* page rather than silently returning an incomplete window.
 	*/
+	/**
+	* A page of RECENT track ids, and nothing else.
+	*
+	* Two callers only ever wanted the strings — `collectLiveTrackIds` (the
+	* orphan audit's live set) and `listTrackIdPage` (the embedding rebuild's
+	* cursor walk) — and both were reading whole tracks to build them. This reads
+	* the primary key plus `lastSeen`, which is not a saving to be traded away:
+	* the cursor, the descending order and the same-millisecond tie-break are all
+	* defined on `lastSeen`, so a page without it would be unordered and
+	* unresumable.
+	*
+	* It shares {@link recentPage} with {@link queryRecent} rather than repeating
+	* the window/cursor arithmetic. Two copies of a paging rule is how one of
+	* them learns about a new bound and the other does not.
+	*/
+	async queryRecentIds(params) {
+		const { page, nextCursor } = await this.recentPage(params, RECENT_IDS_COLUMNS);
+		return {
+			trackIds: page.map((r) => r.id),
+			nextCursor
+		};
+	}
 	async queryRecent(params) {
+		const { page, nextCursor } = await this.recentPage(params, trackColumnsFor(params.projection));
+		return {
+			tracks: page.map((r) => this.rowToTrack(r.id, r.data, params.projection)),
+			nextCursor
+		};
+	}
+	/**
+	* The window, cursor and fan-out arithmetic behind every "recent tracks"
+	* read — shared so the SELECT list is the only thing a caller varies.
+	*
+	* `columns` is passed straight through to the engine (`undefined` = the whole
+	* row). Everything else here is projection-agnostic on purpose: which rows a
+	* page contains, and in what order, must not depend on how much of each row
+	* the caller asked to read.
+	*/
+	async recentPage(params, columns) {
 		const deviceIds = [...new Set(params.deviceIds)];
 		if (deviceIds.length === 0) return {
-			tracks: [],
+			page: [],
 			nextCursor: null
 		};
 		const requested = Math.min(Math.max(params.limit ?? RECENT_DEFAULT_LIMIT, 1), RECENT_MAX_LIMIT);
@@ -50582,7 +50707,7 @@ var TrackStore = class {
 		const winHi = params.until ?? Number.MAX_SAFE_INTEGER;
 		const hi = cursor !== null ? Math.min(cursor.lastSeen, winHi) : winHi;
 		if (hi < lo) return {
-			tracks: [],
+			page: [],
 			nextCursor: null
 		};
 		const stationaryExclusion = params.excludeStationaryPromotions === true ? { whereNot: { closedReason: "stationary-promotion" } } : {};
@@ -50598,7 +50723,7 @@ var TrackStore = class {
 				},
 				...pageLimit !== void 0 ? { limit: pageLimit } : {}
 			},
-			...projectionArg(params.projection)
+			...columns === void 0 ? {} : { columns }
 		});
 		const perDevice = await Promise.all(deviceIds.map(async (deviceId) => {
 			if (cursor === null || cursor.lastSeen > hi) return fetchRange(deviceId, [lo, hi], limit + 1);
@@ -50622,10 +50747,9 @@ var TrackStore = class {
 		}
 		candidates.sort(compareRecentDesc);
 		const page = candidates.slice(0, limit);
-		const tracks = page.map((r) => this.rowToTrack(r.id, r.data, params.projection));
 		const last = page[page.length - 1];
 		return {
-			tracks,
+			page,
 			nextCursor: candidates.length > limit && last !== void 0 ? encodeRecentCursor({
 				lastSeen: last.lastSeen,
 				trackId: last.id
@@ -56928,6 +57052,144 @@ function rowFromMetadata(id, metadata) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/store/settings-raw-mirror.ts
+/** How long a mirrored entry is served before a refresh is started behind the
+*  next reader. See the module doc for why this matches the per-kind caches'
+*  own window rather than introducing a second staleness bound. */
+var RAW_SETTINGS_STALE_MS = 5e3;
+/**
+* How long a FAILED refresh is not retried.
+*
+* A refresh that throws leaves `fetchedAt` where it was, so without a
+* cooldown every subsequent reader would start another attempt — a broken
+* settings store would be hammered at frame rate by the very mechanism built
+* to stop that.
+*/
+var RAW_SETTINGS_MISS_COOLDOWN_MS = 5e3;
+/**
+* The addon's per-device raw blob (`pipeline-analytics:addon-devices`), kept
+* fresh OFF every per-kind settings cache's hot path.
+*
+* `resolve` is COLD-awaiting and single-flight: a burst of settings kinds
+* (or frames) missing on the same device in the same tick costs ONE read,
+* not one per caller — the exact failure this class exists to remove.
+*/
+var RawDeviceBlobMirror = class {
+	deps;
+	staleMs;
+	missCooldownMs;
+	entries = /* @__PURE__ */ new Map();
+	inFlight = /* @__PURE__ */ new Map();
+	now;
+	constructor(deps, staleMs = RAW_SETTINGS_STALE_MS, missCooldownMs = RAW_SETTINGS_MISS_COOLDOWN_MS) {
+		this.deps = deps;
+		this.staleMs = staleMs;
+		this.missCooldownMs = missCooldownMs;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	/**
+	* The device's raw stored blob.
+	*
+	* COLD awaits — the first settings kind to touch a device has to get the
+	* real answer. WARM returns immediately, stale or not, and starts the
+	* refresh behind the caller.
+	*/
+	async resolve(deviceId) {
+		const entry = this.entries.get(deviceId);
+		if (entry === void 0) return this.load(deviceId);
+		if (this.now() - entry.fetchedAt >= this.staleMs) this.load(deviceId);
+		return entry.value;
+	}
+	/** Drop a device's entry. Called by every in-process writer of this
+	*  device's row, so an operator's own change is never served stale. */
+	invalidate(deviceId) {
+		this.entries.delete(deviceId);
+	}
+	invalidateAll() {
+		this.entries.clear();
+	}
+	async load(deviceId) {
+		const pending = this.inFlight.get(deviceId);
+		if (pending !== void 0) return pending;
+		const run = this.deps.read(deviceId).then((value) => {
+			this.entries.set(deviceId, {
+				value,
+				fetchedAt: this.now()
+			});
+			return value;
+		}).catch((err) => {
+			this.deps.onRefreshFailed?.(deviceId, err);
+			const existing = this.entries.get(deviceId);
+			if (existing !== void 0) {
+				existing.fetchedAt = this.now() - this.staleMs + this.missCooldownMs;
+				return existing.value;
+			}
+			return {};
+		}).finally(() => {
+			this.inFlight.delete(deviceId);
+		});
+		this.inFlight.set(deviceId, run);
+		return run;
+	}
+};
+/**
+* The addon's ONE `addon_settings` row (`pipeline-analytics:addon-settings`),
+* kept fresh OFF every per-kind settings cache's hot path. Same shape as
+* {@link RawDeviceBlobMirror}, singleton rather than keyed — there is exactly
+* one addon store per process.
+*/
+var RawGlobalStoreMirror = class {
+	deps;
+	staleMs;
+	missCooldownMs;
+	entry = null;
+	inFlight = null;
+	now;
+	constructor(deps, staleMs = RAW_SETTINGS_STALE_MS, missCooldownMs = RAW_SETTINGS_MISS_COOLDOWN_MS) {
+		this.deps = deps;
+		this.staleMs = staleMs;
+		this.missCooldownMs = missCooldownMs;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	async resolve() {
+		const entry = this.entry;
+		if (entry === null) return this.load();
+		if (this.now() - entry.fetchedAt >= this.staleMs) this.load();
+		return entry.value;
+	}
+	/** Drop the mirrored store. Called by every in-process global-settings
+	*  writer (`onConfigChanged`), so an operator's own change is never served
+	*  stale. */
+	invalidate() {
+		this.entry = null;
+	}
+	async load() {
+		if (this.inFlight !== null) return this.inFlight;
+		const run = this.deps.read().then((value) => {
+			this.entry = {
+				value,
+				fetchedAt: this.now()
+			};
+			return value;
+		}).catch((err) => {
+			this.deps.onRefreshFailed?.(err);
+			const existing = this.entry;
+			if (existing !== null) {
+				this.entry = {
+					value: existing.value,
+					fetchedAt: this.now() - this.staleMs + this.missCooldownMs
+				};
+				return existing.value;
+			}
+			return {};
+		}).finally(() => {
+			this.inFlight = null;
+		});
+		this.inFlight = run;
+		return run;
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/track-retention-sweep.ts
 /**
 * Sweep every device with persisted tracks: skip retention-disabled devices,
@@ -57984,6 +58246,14 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	/** Event-media relocation engine (entity-routing Phase 4). */
 	mediaRelocate = null;
 	mediaLocationStorage = null;
+	/**
+	* Cached pick for NEW `eventMedia` writes (`pickWritableMediaLocation`).
+	* Resolved once, never per blob (no-RPC-per-blob, same discipline as
+	* `mediaLocationStorage`'s own root cache) — dropped together with it by
+	* `refreshStorageLocationsForMigration`, since a location's `readOnly` /
+	* `enabled` flags only change via operator reconfig.
+	*/
+	eventMediaWriteLocationCache = null;
 	mediaWriteGate = new MediaWriteGate();
 	storageMigrationLeaseId = null;
 	/** Per-camera history of LINKED-device sensor state changes (Part B). */
@@ -58383,6 +58653,33 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	audioEpisodeTracks = /* @__PURE__ */ new Map();
 	audioEpisodeLastPersistMs = /* @__PURE__ */ new Map();
 	settingsCaches = new DeviceSettingsCacheHub();
+	/**
+	* The addon-level store and per-device blob, mirrored ONCE and shared by
+	* every settings kind above — see `store/settings-raw-mirror.ts`. Before
+	* this, each kind's cache miss called `resolveGlobalStore()` +
+	* `readDeviceBlob()` directly, so eight kinds expiring in the same window
+	* paid for the same two reads eight times: `get
+	* pipeline-analytics:addon-settings` at 547–694/min, `get
+	* pipeline-analytics:addon-devices` at ~700/min, live 2026-08-26. Invalidated
+	* by every in-process writer: `applyDeviceSettingsPatch` and the retired-
+	* setting purges drop the device mirror, `onConfigChanged` (this process's
+	* own `updateGlobalSettings`) drops the global mirror.
+	*/
+	rawDeviceBlobMirror = new RawDeviceBlobMirror({
+		read: (deviceId) => this.readDeviceBlob(deviceId),
+		onRefreshFailed: (deviceId, err) => {
+			this.ctx.logger.debug("raw device-blob mirror refresh failed — serving last value", {
+				tags: { deviceId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+	});
+	rawGlobalStoreMirror = new RawGlobalStoreMirror({
+		read: () => this.resolveGlobalStore(),
+		onRefreshFailed: (err) => {
+			this.ctx.logger.debug("raw global-store mirror refresh failed — serving last value", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	});
 	/** Avoids a store read every ~30 Hz audio frame. */
 	audioSettingsCache = this.settingsCaches.registerDeviceCache("audio-detection", SETTINGS_CACHE_TTL_MS);
 	sensitivitySettingsCache = this.settingsCaches.registerDeviceCache("detection-sensitivity", SETTINGS_CACHE_TTL_MS);
@@ -59102,6 +59399,53 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.mediaLocationStorage = routed;
 		return routed;
 	}
+	/**
+	* Resolves which `eventMedia` location a NEW footage-class blob should be
+	* written to (`MediaStoreDeps.resolveEventMediaLocation`). Reflects
+	* `config.readOnly` — an operator draining a location marks it read-only,
+	* and new writes must never land there (the relocate mover, exposed as
+	* `relocateMedia`, empties what is already on it in the background).
+	*
+	* Cached after the first successful resolution — this is a per-blob write
+	* path, and the write-side provider is a declared no-RPC-per-blob bypass
+	* (D-note in `location-aware-media-storage.ts`); re-querying the storage
+	* cap on every blob would undo that. Dropped by
+	* `refreshStorageLocationsForMigration`, same trigger as
+	* `mediaLocationStorage.invalidateRoots()`.
+	*
+	* Degrades to the bare `eventMedia` type ref (pre-2026-08-26 behaviour)
+	* when the storage cap itself is unreachable — a transient RPC failure (or
+	* a test harness that never wires `api.storage`) must not turn every media
+	* write into a hard failure the way "no writable location" does.
+	*/
+	async resolveEventMediaWriteLocation(api, logger, deviceId) {
+		const cached = this.eventMediaWriteLocationCache;
+		if (cached !== null) return cached;
+		let locations;
+		try {
+			locations = await api.storage.listLocations.query({ type: DEFAULT_MEDIA_LOCATION });
+		} catch (err) {
+			logger.debug("pipeline-analytics: eventMedia location list unavailable — writing through the default ref", { meta: { error: require_dist.errMsg(err) } });
+			this.eventMediaWriteLocationCache = DEFAULT_MEDIA_LOCATION;
+			return DEFAULT_MEDIA_LOCATION;
+		}
+		const picked = pickWritableMediaLocation(locations.map((l) => ({
+			id: l.id,
+			readOnly: l.config["readOnly"] === true,
+			enabled: l.enabled !== false,
+			headroomBytes: l.capacity?.availableBytes ?? 0
+		})), locations.find((l) => l.isDefault)?.id ?? "eventMedia");
+		if (picked === null) {
+			const seen = locations.length > 0 ? locations.map((l) => l.id).join(", ") : "(none registered)";
+			logger.error("pipeline-analytics: no writable eventMedia storage location — refusing the write instead of failing far downstream as a filesystem error", {
+				tags: { deviceId },
+				meta: { locationsSeen: seen }
+			});
+			throw new Error(`no writable eventMedia storage location (seen: ${seen})`);
+		}
+		this.eventMediaWriteLocationCache = picked;
+		return picked;
+	}
 	/** Constructs every SQLite-backed store plus the stationary/package-drop/
 	*  sensor plumbing, in the exact pre-S7 order. Returns the non-null bundle
 	*  so the rest of boot consumes the stores without re-narrowing. */
@@ -59160,7 +59504,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			storage,
 			store: api.settingsStore,
 			logger: logger.child("MediaStore"),
-			writeGate: this.mediaWriteGate
+			writeGate: this.mediaWriteGate,
+			resolveEventMediaLocation: (deviceId) => this.resolveEventMediaWriteLocation(api, logger, deviceId)
 		});
 		this.mediaStore = mediaStore;
 		const retrainFrames = new RetrainFrameStore({
@@ -60468,6 +60813,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			this.forgetDeviceProcessors(data.deviceId);
 			this.levelStateByDevice.delete(data.deviceId);
 			this.settingsCaches.clearDevice(data.deviceId);
+			this.rawDeviceBlobMirror.invalidate(data.deviceId);
 		}
 	}
 	/** `DeviceUnregistered` handler — subscription topology lives in
@@ -60492,6 +60838,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		}
 		this.audioMarkers?.forgetDevice(deviceId);
 		this.settingsCaches.clearDevice(deviceId);
+		this.rawDeviceBlobMirror.invalidate(deviceId);
 		this.bindingCache?.invalidate(deviceId);
 		this.detectionCoverage?.forget(deviceId);
 		this.zoneAnalytics?.forgetDevice(deviceId);
@@ -60920,6 +61267,17 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			}] : []
 		];
 	}
+	/**
+	* `BaseAddon.updateGlobalSettings` calls this after the write lands —
+	* gated to the LOCAL node's own write (a sibling-node write returns before
+	* reaching it), which is exactly the scope `rawGlobalStoreMirror` needs to
+	* invalidate: the mirror only ever answers for THIS process, so it only
+	* needs to drop on THIS process's own write (D224).
+	*/
+	async onConfigChanged() {
+		await super.onConfigChanged();
+		this.rawGlobalStoreMirror.invalidate();
+	}
 	async onShutdown() {
 		this.shuttingDown = true;
 		this.sceneEngine?.stop();
@@ -60975,6 +61333,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.gatedNodeByDevice.clear();
 		this.levelStateByDevice.clear();
 		this.settingsCaches.clearAll();
+		this.rawDeviceBlobMirror.invalidateAll();
+		this.rawGlobalStoreMirror.invalidate();
 		this.confirmationDetectorStepByNode.clear();
 		this.trackStore?.clearAll();
 		this.stationaryRegistry = null;
@@ -61687,10 +62047,16 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	*  auto-assigning — see `__tests__/global-settings-cascade.spec.ts`).
 	*  `resolveGlobalStore()` is the sanctioned BaseAddon read (per-node
 	*  projection applied; a raw `readAddonStore` would leak `@node` keys if a
-	*  perNode field is ever declared). */
+	*  perNode field is ever declared).
+	*
+	*  Both raw reads go through `rawGlobalStoreMirror` / `rawDeviceBlobMirror`
+	*  rather than straight to the store: this method is the ONE place all
+	*  eight settings kinds funnel through on a cache miss, so calling the raw
+	*  reads directly here means eight kinds expiring in the same window each
+	*  pay for the same two reads — see `store/settings-raw-mirror.ts`. */
 	async readDeviceSettings(deviceId, resolve) {
-		const globalRaw = this.ctxIfReady !== null ? await this.resolveGlobalStore() : {};
-		const deviceRaw = await this.readDeviceBlob(deviceId);
+		const globalRaw = this.ctxIfReady !== null ? await this.rawGlobalStoreMirror.resolve() : {};
+		const deviceRaw = await this.rawDeviceBlobMirror.resolve(deviceId);
 		return resolve({
 			...globalRaw,
 			...deviceRaw
@@ -63361,6 +63727,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					});
 				}
 				await settings.writeDeviceStore(deviceId, plan.patch);
+				this.rawDeviceBlobMirror.invalidate(deviceId);
 			} catch (err) {
 				this.retiredSettingsChecked.delete(deviceId);
 				this.ctx.logger.warn("retired retention settings migration failed — will retry", {
@@ -63432,6 +63799,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					deviceId
 				});
 				await settings.writeDeviceStore(deviceId, plan.patch);
+				this.rawDeviceBlobMirror.invalidate(deviceId);
 			} catch (err) {
 				this.storedSuggestionCheckedDevices.delete(deviceId);
 				this.ctx.logger.warn("face suggestion threshold purge failed — will retry", {
@@ -64417,11 +64785,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const trackStore = this.trackStore;
 		if (!trackStore) return live;
 		for (const deviceId of deviceIds) {
-			const page = await trackStore.queryRecent({
+			const page = await trackStore.queryRecentIds({
 				deviceIds: [deviceId],
 				limit: EMBEDDING_ORPHAN_SCAN_LIMIT
 			});
-			for (const track of page.tracks) live.add(track.trackId);
+			for (const trackId of page.trackIds) live.add(trackId);
 		}
 		return live;
 	}
@@ -64744,19 +65112,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			logger: this.ctx.logger
 		}));
 		const deps = {
-			listTrackIdPage: async (cursor) => {
-				const page = await trackStore.queryRecent({
-					deviceIds,
-					...input.since !== void 0 ? { since: input.since } : {},
-					...input.until !== void 0 ? { until: input.until } : {},
-					...cursor !== null ? { cursor } : {},
-					limit: REBUILD_PAGE_SIZE
-				});
-				return {
-					trackIds: page.tracks.map((t) => t.trackId),
-					nextCursor: page.nextCursor
-				};
-			},
+			listTrackIdPage: async (cursor) => trackStore.queryRecentIds({
+				deviceIds,
+				...input.since !== void 0 ? { since: input.since } : {},
+				...input.until !== void 0 ? { until: input.until } : {},
+				...cursor !== null ? { cursor } : {},
+				limit: REBUILD_PAGE_SIZE
+			}),
 			loadSource: (trackId) => loadRebuildSource({
 				media: mediaStore,
 				events: eventStore
@@ -65584,6 +65946,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	async refreshStorageLocationsForMigration(input) {
 		if (this.storageMigrationLeaseId !== input.leaseId) throw new Error("event-media storage migration lease does not match");
 		this.mediaLocationStorage?.invalidateRoots();
+		this.eventMediaWriteLocationCache = null;
 		return { refreshed: true };
 	}
 	async startStorageMigrationMove(input) {
@@ -65597,6 +65960,32 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	async cancelStorageMigrationMove(input) {
 		return { cancelled: this.mediaRelocate?.cancel(input.jobId) ?? false };
 	}
+	/**
+	* Move event media between locations — the OPERATOR's mover, no lease.
+	* Twin of `recording.relocateFootage`: same engine (`this.mediaRelocate`)
+	* the lease-gated coordinator move uses, runnable in the background
+	* without pausing anything. `startStorageMigrationMove` above stays
+	* lease-gated for the orchestrated migration; this method must never touch
+	* `storageMigrationLeaseId`.
+	*/
+	async relocateMedia(input) {
+		if (!this.mediaRelocate) throw new Error("media relocation unavailable");
+		const jobId = this.mediaRelocate.start(input);
+		this.ctx.logger.info("pipeline-analytics: media relocate job enqueued", { meta: {
+			jobId,
+			to: input.toLocationId
+		} });
+		return { jobId };
+	}
+	/** Every relocate job this addon knows about, newest first (in RAM: the
+	*  move is resumable, so a lost list costs nothing but the display). */
+	async listRelocateMediaJobs() {
+		return this.mediaRelocate?.list() ?? [];
+	}
+	/** Cancel a running or queued relocate job. */
+	async cancelRelocateMedia(input) {
+		return { cancelled: this.mediaRelocate?.cancel(input.jobId) ?? false };
+	}
 	async listOpsLog(input) {
 		return this.queryFacade.listOpsLog(input);
 	}
@@ -65990,6 +66379,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	}
 	async applyDeviceSettingsPatch(input) {
 		await this.updateDeviceSettings(input.deviceId, input.patch);
+		this.rawDeviceBlobMirror.invalidate(input.deviceId);
 		this.audioSettingsCache.delete(input.deviceId);
 		this.sensitivitySettingsCache.delete(input.deviceId);
 		this.trackingSettingsCache.delete(input.deviceId);