@camstack/addon-post-analysis 1.2.63 → 1.2.65

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-D4fGaA71.js");
+const require_dist = require("../dist-DTClXZLm.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -1119,6 +1119,25 @@ var NcArtifactPlane = class {
 			return null;
 		}
 	}
+	/**
+	* Absolutize a path against the SAME base URL an artifact link would use.
+	*
+	* For links this plane does not host but a RECIPIENT still has to open — a
+	* recorder export download, served `access: 'authenticated'`. It is not
+	* signed and it is not public: it is a tap-through the person opens where
+	* they already hold a session, which is why it goes on `clickUrl` and never
+	* on an attachment.
+	*
+	* Reuses `resolveBaseUrl` rather than re-deriving one, because "which
+	* address can the recipient actually reach" is a question this repo has
+	* already answered wrongly once (the first artifact link went out on the LAN
+	* address while a tunnel was connected).
+	*/
+	async resolveExternalUrl(pathname) {
+		const baseUrl = await this.resolveBaseUrl().catch(() => null);
+		if (baseUrl === null) return null;
+		return `${baseUrl.replace(/\/+$/, "")}/${pathname.replace(/^\/+/, "")}`;
+	}
 	/** The data-plane handler for `<prefix>/<id>?exp=&sig=`. */
 	handler = async (req, res) => {
 		const url = new URL(req.url ?? "/", "http://placeholder");
@@ -2733,7 +2752,7 @@ var NcDispatcher = class {
 		const vars = buildTemplateVars(entry, deviceName, zoneLabels);
 		const title = renderTemplate(entry.payload.template?.title, vars) ?? systemEvent?.title ?? entry.payload.ruleName;
 		const body = renderTemplate(entry.payload.template?.body, vars) ?? defaultBody(entry, deviceName, zoneLabels);
-		const attachments = await this.withArtifactUrls(await this.resolveAttachments(entry));
+		const attachments = [...await this.withArtifactUrls(await this.resolveAttachments(entry)), ...frozenArtifactAttachments(entry)];
 		const params = pickParams(entry.payload.params);
 		const actions = await this.mintActions(entry, target);
 		return {
@@ -3001,6 +3020,33 @@ function occupancyOpWord(occupied) {
 	return occupied ? "occupied" : "free";
 }
 /** `{{var}}` interpolation; missing vars render empty. Null template → null. */
+/**
+* The attachment a row was CREATED with, if any.
+*
+* Url-only by construction: the bytes were never in this process (a timelapse
+* is rendered by the recorder and republished on the artifact plane), and a
+* durable outbox row must never carry an mp4. The degrade engine turns this
+* into an upload for a bytes-only backend and a plain link for a url-mode one
+* — which is the whole reason a url-mode target now receives the video at all.
+*/
+function frozenArtifactAttachments(entry) {
+	const artifact = entry.payload.artifact;
+	if (artifact === void 0) return [];
+	return [{
+		mediaType: artifact.mediaType,
+		url: artifact.url,
+		mime: artifact.mime,
+		name: artifact.name
+	}];
+}
+/**
+* `{{var}}` substitution over a frozen variable map. An unknown name renders
+* EMPTY rather than leaving the braces on screen.
+*
+* Exported so the timelapse producer renders its title/body with the SAME
+* vocabulary and the same missing-var rule. A second `{{}}` renderer in this
+* package would be free to disagree about exactly that.
+*/
 function renderTemplate(template, vars) {
 	if (template === void 0 || template.trim().length === 0) return null;
 	return template.replace(/\{\{\s*(\w+)\s*\}\}/g, (_m, name) => vars[name] ?? "");
@@ -5430,6 +5476,7 @@ var TimelapseStore = class {
 			id: existing.id,
 			ownerUserId: existing.ownerUserId,
 			lastGeneratedAt: existing.lastGeneratedAt,
+			generatedByDevice: existing.generatedByDevice,
 			createdBy: existing.createdBy,
 			createdAt: existing.createdAt,
 			updatedAt: this.now()
@@ -5440,16 +5487,39 @@ var TimelapseStore = class {
 		return this.update(ruleId, { enabled });
 	}
 	/**
-	* Record a successful generation. `at` is the generation epoch-ms — the
-	* durable state behind the 1-hour re-generation guard. Does NOT bump
-	* `updatedAt` (generation is not an edit of the rule definition).
+	* Record a successful generation for ONE camera of the rule. `at` is the
+	* generation epoch-ms — the durable state behind the re-generation guard.
+	* Does NOT bump `updatedAt` (a generation is not an edit of the rule).
+	*
+	* PER-DEVICE, and that is the whole point: a rule covering three cameras
+	* renders three videos, and stamping the rule when the first one succeeds
+	* tells the other two they are already done. Their night is then gone for
+	* good — a closed window does not come back. Call this ONLY after the export
+	* reached `ready` and the notification was enqueued; a failed render must
+	* leave the pair unstamped so the next tick can retry it.
+	*
+	* The rule-wide `lastGeneratedAt` is kept as the NEWEST of the stamps (what
+	* a UI shows) and never regresses when an older device generation lands.
+	*
+	* A rule that still carries only the LEGACY rule-wide stamp has its map
+	* SEEDED from it for every camera the rule covers, before the new stamp is
+	* applied — writing `{ [deviceId]: at }` alone would drop the other cameras
+	* to "never generated" and re-render them once.
 	*/
-	async markGenerated(ruleId, at) {
+	async markGenerated(ruleId, deviceId, at) {
 		const existing = this.byId.get(ruleId);
 		if (!existing) throw new Error(`timelapse rule not found: ${ruleId}`);
+		const seeded = {};
+		if (existing.generatedByDevice === void 0 && existing.lastGeneratedAt !== void 0) for (const id of existing.deviceIds) seeded[String(id)] = existing.lastGeneratedAt;
+		const generatedByDevice = {
+			...seeded,
+			...existing.generatedByDevice,
+			[String(deviceId)]: at
+		};
 		return this.write({
 			...existing,
-			lastGeneratedAt: at
+			generatedByDevice,
+			lastGeneratedAt: Math.max(existing.lastGeneratedAt ?? 0, at)
 		});
 	}
 	/** Idempotent delete — unknown ids are a no-op. */
@@ -5494,6 +5564,656 @@ var TimelapseStore = class {
 	}
 };
 //#endregion
+//#region src/notification-center/timelapse/dense-ranges.ts
+/**
+* The POST-HOC timelapse's render plan: which seconds of the closed window
+* deserve the fast cadence.
+*
+* Pure — no clock, no I/O, no store. The scheduler hands over the tracks the
+* window actually contained (`pipelineAnalytics.listTracks`, which carry
+* `firstSeen`/`lastSeen`) and gets back ranges expressed as SECONDS FROM THE
+* WINDOW START, which is exactly the coordinate system
+* `ExportTimelapseSchema.dense.ranges` speaks.
+*
+* Why post-hoc and not a live sampler: the footage already exists, the tracks
+* already exist, and the recorder already knows how to render a range. A live
+* sampler would hold a frame ring open for eight hours per camera to
+* reconstruct information the database already has.
+*
+* The coalescing rule is `2 × base cadence`: two tracks closer together than
+* two base frames would render as one continuous busy stretch anyway, so
+* splitting them buys nothing and costs a range out of the budget.
+*/
+/** Re-exported so a caller plans and validates against the SAME ceiling the
+*  cap enforces — two constants would be free to drift, and the drift would
+*  surface as a rejected export at render time, hours after the window. */
+var DENSE_MAX_RANGES = 200;
+/** Clamp a track to the window and pad it, dropping what falls outside. */
+function clampTrack(track, windowStartMs, windowEndMs, padMs) {
+	const rawFrom = Math.min(track.firstSeen, track.lastSeen);
+	const rawTo = Math.max(track.firstSeen, track.lastSeen);
+	if (rawTo < windowStartMs || rawFrom > windowEndMs) return null;
+	const fromMs = Math.max(windowStartMs, rawFrom - padMs);
+	const toMs = Math.min(windowEndMs, rawTo + padMs);
+	return toMs > fromMs ? {
+		fromMs,
+		toMs
+	} : null;
+}
+/**
+* Merge the window's tracks into dense ranges.
+*
+* @returns ranges in seconds from `windowStartMs`, already coalesced, sorted
+*   and clamped — or an empty capped plan.
+*/
+function planDenseRanges(input) {
+	const maxRanges = Math.max(1, input.maxRanges ?? DENSE_MAX_RANGES);
+	const padMs = Math.max(0, input.padSec) * 1e3;
+	const gapMs = Math.max(1, input.baseCadenceSec) * 2e3;
+	const clamped = [];
+	for (const track of input.tracks) {
+		const r = clampTrack(track, input.windowStartMs, input.windowEndMs, padMs);
+		if (r !== null) clamped.push(r);
+	}
+	clamped.sort((a, b) => a.fromMs - b.fromMs);
+	const merged = [];
+	for (const r of clamped) {
+		const last = merged[merged.length - 1];
+		if (last !== void 0 && r.fromMs - last.toMs < gapMs) {
+			merged[merged.length - 1] = {
+				fromMs: last.fromMs,
+				toMs: Math.max(last.toMs, r.toMs)
+			};
+			continue;
+		}
+		merged.push(r);
+	}
+	if (merged.length > maxRanges) return {
+		ranges: [],
+		capped: true,
+		mergedCount: merged.length,
+		denseSec: 0
+	};
+	const ranges = merged.map((r) => ({
+		fromSec: (r.fromMs - input.windowStartMs) / 1e3,
+		toSec: (r.toMs - input.windowStartMs) / 1e3
+	}));
+	const denseSec = ranges.reduce((sum, r) => sum + (r.toSec - r.fromSec), 0);
+	return {
+		ranges,
+		capped: false,
+		mergedCount: merged.length,
+		denseSec
+	};
+}
+//#endregion
+//#region src/notification-center/timelapse/footage-coverage.ts
+/**
+* Slack at the window edges before a window counts as incomplete.
+*
+* Recorded footage is segment-granular, so the last segment almost never lands
+* exactly on the boundary. Without slack every complete night reports "99% of
+* the window" — noise the operator learns to skip, which is how the genuinely
+* short video gets skipped too.
+*/
+var COVERAGE_COMPLETE_SLACK_MS = 3e4;
+/** Merge + clamp + sum. */
+function footageCoverage(ranges, windowStartMs, windowEndMs) {
+	const windowMs = Math.max(0, windowEndMs - windowStartMs);
+	if (windowMs === 0) return {
+		fraction: 0,
+		percent: 0,
+		coveredMs: 0,
+		windowMs: 0,
+		complete: false
+	};
+	const clamped = ranges.map((r) => ({
+		startMs: Math.max(windowStartMs, Math.min(r.startMs, r.endMs)),
+		endMs: Math.min(windowEndMs, Math.max(r.startMs, r.endMs))
+	})).filter((r) => r.endMs > r.startMs).sort((a, b) => a.startMs - b.startMs);
+	let coveredMs = 0;
+	let curStart = null;
+	let curEnd = 0;
+	for (const r of clamped) {
+		if (curStart === null) {
+			curStart = r.startMs;
+			curEnd = r.endMs;
+			continue;
+		}
+		if (r.startMs <= curEnd) {
+			curEnd = Math.max(curEnd, r.endMs);
+			continue;
+		}
+		coveredMs += curEnd - curStart;
+		curStart = r.startMs;
+		curEnd = r.endMs;
+	}
+	if (curStart !== null) coveredMs += curEnd - curStart;
+	const fraction = coveredMs / windowMs;
+	return {
+		fraction,
+		percent: Math.round(fraction * 100),
+		coveredMs,
+		windowMs,
+		complete: windowMs - coveredMs <= COVERAGE_COMPLETE_SLACK_MS
+	};
+}
+/** How long a scheduled timelapse's file is kept by the export engine. */
+var TIMELAPSE_EXPORT_LIFE_MS = 7 * 864e5;
+var TimelapseRenderError = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.name = "TimelapseRenderError";
+		this.reason = reason;
+	}
+};
+/** The profile with the most footage over the window; ties broken by name so
+*  the same window always renders from the same source. */
+function pickProfile(ranges, window) {
+	const byProfile = /* @__PURE__ */ new Map();
+	for (const r of ranges) {
+		const list = byProfile.get(r.profile);
+		if (list === void 0) byProfile.set(r.profile, [r]);
+		else list.push(r);
+	}
+	let best = null;
+	for (const [profile, rows] of [...byProfile].sort((a, b) => a[0].localeCompare(b[0]))) {
+		const coverage = footageCoverage(rows, window.startMs, window.endMs);
+		if (best === null || coverage.coveredMs > best.coverage.coveredMs) best = {
+			profile,
+			coverage
+		};
+	}
+	return best;
+}
+/** `HH:MM`, for the export title an operator sees in the exports list. */
+function clockOf$1(atMs) {
+	const d = new Date(atMs);
+	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+var TimelapseRenderer = class {
+	ports;
+	pollMs;
+	timeoutMs;
+	constructor(ports) {
+		this.ports = ports;
+		this.pollMs = ports.pollMs ?? 5e3;
+		this.timeoutMs = ports.timeoutMs ?? 18e5;
+	}
+	async render(request) {
+		const { deviceId, window } = request;
+		const tags = { deviceId };
+		const chosen = pickProfile(await this.ports.getAvailability({
+			deviceId,
+			fromMs: window.startMs,
+			toMs: window.endMs
+		}), window);
+		if (chosen === null || chosen.coverage.coveredMs === 0) {
+			this.ports.logger.warn("timelapse skipped: no footage covers the window", {
+				tags,
+				meta: {
+					ruleId: request.ruleId,
+					windowStart: window.startMs,
+					windowEnd: window.endMs
+				}
+			});
+			throw new TimelapseRenderError("no-footage", `no footage for ${deviceId} in ${window.startMs}..${window.endMs}`);
+		}
+		const plan = planDenseRanges({
+			tracks: await this.ports.listTracks({
+				deviceId,
+				since: window.startMs,
+				until: window.endMs
+			}).catch((err) => {
+				this.ports.logger.warn("timelapse dense plan unavailable — rendering uniform", {
+					tags,
+					meta: {
+						ruleId: request.ruleId,
+						error: String(err)
+					}
+				});
+				return [];
+			}),
+			windowStartMs: window.startMs,
+			windowEndMs: window.endMs,
+			padSec: 5,
+			baseCadenceSec: request.cadenceSec
+		});
+		const everyMs = request.cadenceSec * 1e3;
+		const denseEveryMs = Math.max(1e3, Math.round(everyMs / 10));
+		const dense = plan.ranges.length > 0 && denseEveryMs < everyMs ? {
+			everyMs: denseEveryMs,
+			ranges: [...plan.ranges]
+		} : void 0;
+		if (plan.capped) this.ports.logger.info("timelapse dense plan exceeded the range ceiling — uniform cadence", {
+			tags,
+			meta: {
+				ruleId: request.ruleId,
+				mergedRanges: plan.mergedCount
+			}
+		});
+		const queued = await this.ports.createExport({
+			deviceId,
+			profile: chosen.profile,
+			fromMs: window.startMs,
+			toMs: window.endMs,
+			options: {
+				includeAudio: false,
+				maxLifeMs: TIMELAPSE_EXPORT_LIFE_MS,
+				deleteAfterDownload: false,
+				title: `${request.ruleName} ${clockOf$1(window.startMs)}→${clockOf$1(window.endMs)}`,
+				timelapse: {
+					everyMs,
+					outputFps: request.framerate,
+					...dense !== void 0 ? { dense } : {}
+				}
+			}
+		});
+		this.ports.logger.info("timelapse export queued", {
+			tags,
+			meta: {
+				ruleId: request.ruleId,
+				exportId: queued.id,
+				profile: chosen.profile,
+				everyMs,
+				denseRanges: plan.ranges.length,
+				coveragePct: chosen.coverage.percent
+			}
+		});
+		const finished = await this.awaitReady(queued, tags);
+		const artifact = await this.publish(finished.id, deviceId, tags);
+		const downloadUrl = await this.ports.resolveDownloadUrl?.({ exportId: finished.id }).catch(() => null);
+		return {
+			exportId: finished.id,
+			profile: chosen.profile,
+			coverage: chosen.coverage,
+			plan,
+			artifact,
+			downloadUrl: downloadUrl ?? null,
+			fileBytes: finished.fileBytes
+		};
+	}
+	/** Poll to a terminal state, under a bound. */
+	async awaitReady(queued, tags) {
+		if (queued.state === "ready") return queued;
+		const deadline = this.ports.now() + this.timeoutMs;
+		let current = queued;
+		while (this.ports.now() < deadline) {
+			await this.ports.sleep(this.pollMs);
+			current = await this.ports.getExport({ exportId: queued.id });
+			if (current.state === "ready") return current;
+			if (current.state === "failed" || current.state === "expired" || current.state === "deleted") {
+				this.ports.logger.warn("timelapse export did not finish", {
+					tags,
+					meta: {
+						exportId: queued.id,
+						state: current.state,
+						error: current.error
+					}
+				});
+				throw new TimelapseRenderError("export-failed", current.error ?? `export ${queued.id} ended ${current.state}`);
+			}
+		}
+		this.ports.logger.warn("timelapse export timed out", {
+			tags,
+			meta: {
+				exportId: queued.id,
+				timeoutMs: this.timeoutMs,
+				lastState: current.state
+			}
+		});
+		throw new TimelapseRenderError("export-timeout", `export ${queued.id} timed out after ${this.timeoutMs}ms`);
+	}
+	/**
+	* Mint the public link, or say why there is none.
+	*
+	* Never throws: a video that exists and cannot be linked is a degraded
+	* notification, not a failed window — and failing here would leave the pair
+	* unstamped and re-render the same eight hours on the next tick.
+	*/
+	async publish(exportId, deviceId, tags) {
+		const publish = this.ports.publishArtifact;
+		if (publish === void 0) {
+			this.ports.logger.info("timelapse artifact publishing is not wired — link-less delivery", {
+				tags,
+				meta: { exportId }
+			});
+			return null;
+		}
+		try {
+			const ref = await publish({
+				exportId,
+				deviceId
+			});
+			if (ref === null) this.ports.logger.warn("timelapse artifact could not be published — link-less delivery", {
+				tags,
+				meta: { exportId }
+			});
+			return ref;
+		} catch (err) {
+			this.ports.logger.warn("timelapse artifact publish threw — link-less delivery", {
+				tags,
+				meta: {
+					exportId,
+					error: String(err)
+				}
+			});
+			return null;
+		}
+	}
+};
+//#endregion
+//#region src/notification-center/timelapse/timelapse-delivery.ts
+/** `HH:MM` in the host timezone — the two numbers a body actually needs. */
+function clockOf(atMs) {
+	const d = new Date(atMs);
+	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+/** Template vocabulary. Deliberately the same NAMES the rule templates use
+*  (`camera`, `rule`, `time`) plus the timelapse-only ones. */
+function templateVars(input) {
+	return {
+		camera: input.deviceName ?? `camera ${input.deviceId}`,
+		rule: input.ruleName,
+		from: clockOf(input.window.startMs),
+		to: clockOf(input.window.endMs),
+		time: clockOf(input.generatedAt),
+		coverage: String(input.coverage.percent),
+		events: String(input.denseRanges)
+	};
+}
+/**
+* The body an operator reads when he did not author one.
+*
+* The COVERAGE sentence is the load-bearing part and only appears when it
+* carries information: a video assembled from two of the eight hours it claims
+* to show is visually indistinguishable from a very quiet night, and shipping
+* it silently is how a three-hour recorder outage looks like nothing happened.
+* A complete window says nothing — a line every night is a line nobody reads.
+*/
+function derivedBody(input) {
+	const vars = templateVars(input);
+	const parts = [`${vars.rule} — ${vars.from}→${vars.to}`];
+	if (input.denseCapped === true) parts.push("troppi eventi per il campionamento denso: video a cadenza uniforme");
+	else if (input.denseRanges > 0) parts.push(`${input.denseRanges} intervalli ripresi a cadenza fitta`);
+	if (!input.coverage.complete) parts.push(`ATTENZIONE: registrazione disponibile solo per il ${vars.coverage}% della finestra`);
+	return parts.join(" · ");
+}
+/** Per-target params with the derived `clickUrl` filled in where absent. */
+function paramsFor(target, clickUrl) {
+	if (clickUrl === void 0) return target.params;
+	if (target.params === void 0) return { clickUrl };
+	if (typeof target.params["clickUrl"] === "string") return target.params;
+	return {
+		...target.params,
+		clickUrl
+	};
+}
+/** Stable, retry-safe outbox record id for one (device, closed window). */
+function timelapseRecordId(deviceId, windowEndMs) {
+	return `timelapse:${deviceId}:${windowEndMs}`;
+}
+/**
+* One outbox row per (still-enabled) target.
+*
+* @returns rows ready for `NcOutbox.enqueue` — never sent from here.
+*/
+function buildTimelapseOutboxInputs(input) {
+	const vars = templateVars(input);
+	const optedOut = new Set(input.disabledTargetIds ?? []);
+	const title = renderTemplate(input.template?.title, vars) ?? `Timelapse — ${vars.camera}`;
+	const body = renderTemplate(input.template?.body, vars) ?? derivedBody(input);
+	const recordId = timelapseRecordId(input.deviceId, input.window.endMs);
+	return input.targets.filter((t) => !optedOut.has(t.targetId)).map((target) => {
+		const payload = {
+			ruleName: input.ruleName,
+			delivery: "timelapse",
+			priority: input.priority,
+			template: {
+				title,
+				body
+			},
+			media: "none",
+			...input.artifact !== void 0 ? { artifact: {
+				mediaType: "video",
+				...input.artifact
+			} } : {},
+			...paramsFor(target, input.clickUrl) !== void 0 ? { params: paramsFor(target, input.clickUrl) } : {},
+			subject: {
+				deviceId: input.deviceId,
+				className: "timelapse",
+				zones: [],
+				timestamp: input.window.endMs
+			}
+		};
+		return {
+			ruleId: input.ruleId,
+			targetId: target.targetId,
+			deviceId: input.deviceId,
+			recordKind: "timelapse",
+			recordId,
+			payload
+		};
+	});
+}
+/**
+* The most recent window that had already CLOSED at `nowMs`.
+*
+* Standing INSIDE a window returns the PREVIOUS one — a scheduler that
+* answered "the one I am in" would render half a night and burn the guard on
+* it.
+*
+* @returns `null` when no close falls inside `lookbackMs`, when the schedule
+*   never closes (always active), OR when the close was found but its OPEN
+*   predates the lookback floor. The last case is null and not a clamped
+*   window on purpose: reporting the scan floor as the start ships a video
+*   that silently begins hours late.
+*/
+function findLastClosedWindow(input) {
+	const step = Math.max(1e3, input.stepMs ?? 6e4);
+	const from = Math.floor(input.nowMs / step) * step;
+	const floor = input.nowMs - input.lookbackMs;
+	const active = (t) => require_dist.isScheduleActive(input.schedule, t);
+	let endMs = null;
+	for (let t = from; t - step >= floor; t -= step) if (!active(t) && active(t - step)) {
+		endMs = t;
+		break;
+	}
+	if (endMs === null) return null;
+	for (let t = endMs - step; t - step >= floor; t -= step) if (!active(t - step)) return {
+		startMs: t,
+		endMs
+	};
+	return null;
+}
+var TimelapseScheduler = class {
+	deps;
+	timer = null;
+	tickInFlight = false;
+	settleMs;
+	lookbackMs;
+	tickMs;
+	constructor(deps) {
+		this.deps = deps;
+		this.settleMs = deps.settleMs ?? 3e5;
+		this.lookbackMs = deps.lookbackMs ?? 6912e5;
+		this.tickMs = deps.tickMs ?? 6e4;
+	}
+	/**
+	* Boot: one tick (the back-fill) and then the interval.
+	*
+	* The back-fill needs no special path — it IS a tick. A window that closed
+	* while the process was down is simply a window whose pair has no stamp.
+	*/
+	async start() {
+		await this.tick();
+		this.timer = setInterval(() => {
+			this.tick();
+		}, this.tickMs);
+	}
+	stop() {
+		if (this.timer !== null) {
+			clearInterval(this.timer);
+			this.timer = null;
+		}
+	}
+	/** One pass over every enabled rule × camera. Single-flight. */
+	async tick() {
+		if (this.tickInFlight) return {
+			produced: 0,
+			waiting: 0,
+			alreadyDone: 0,
+			failed: 0,
+			idle: 0
+		};
+		this.tickInFlight = true;
+		const report = {
+			produced: 0,
+			waiting: 0,
+			alreadyDone: 0,
+			failed: 0,
+			idle: 0
+		};
+		try {
+			const now = this.deps.now();
+			for (const rule of this.deps.store.listEnabled()) {
+				const window = findLastClosedWindow({
+					schedule: rule.schedule,
+					nowMs: now,
+					lookbackMs: this.lookbackMs
+				});
+				if (window === null) {
+					report.idle += rule.deviceIds.length;
+					continue;
+				}
+				if (now < window.endMs + this.settleMs) {
+					report.waiting += rule.deviceIds.length;
+					continue;
+				}
+				for (const deviceId of rule.deviceIds) {
+					if (require_dist.readTimelapseGeneratedAt(rule, deviceId) >= window.endMs) {
+						report.alreadyDone += 1;
+						continue;
+					}
+					if ((await this.produce(rule, deviceId, window, { stamp: true })).produced > 0) report.produced += 1;
+					else report.failed += 1;
+				}
+			}
+		} finally {
+			this.tickInFlight = false;
+		}
+		return report;
+	}
+	/**
+	* The operator's Test button: produce the last closed window for one camera
+	* of one rule, ignoring the settle delay and the guard.
+	*
+	* It DELIVERS — same as `nc.injectTestEvent`, and for the same reason: a
+	* test that stops short of the notifier does not test the thing that breaks.
+	* It deliberately does NOT stamp: pressing Test at noon must not cancel
+	* tonight's scheduled run.
+	*/
+	async runNow(input) {
+		const rule = this.deps.store.get(input.ruleId);
+		if (rule === null) throw new Error(`timelapse rule not found: ${input.ruleId}`);
+		if (!rule.deviceIds.includes(input.deviceId)) throw new Error(`rule ${rule.name} does not cover camera ${input.deviceId}`);
+		const window = findLastClosedWindow({
+			schedule: rule.schedule,
+			nowMs: this.deps.now(),
+			lookbackMs: this.lookbackMs
+		});
+		if (window === null) return {
+			produced: 0,
+			window: null,
+			error: "no schedule window has closed recently"
+		};
+		return this.produce(rule, input.deviceId, window, { stamp: false });
+	}
+	/**
+	* Render → enqueue → (optionally) stamp. Never throws.
+	*
+	* The stamp is LAST and conditional on both steps: a render that failed, or
+	* a queue that refused the rows, must leave the pair eligible. A window does
+	* not come back.
+	*/
+	async produce(rule, deviceId, window, opts) {
+		const tags = { deviceId };
+		try {
+			const outcome = await this.deps.render({
+				ruleId: rule.id,
+				ruleName: rule.name,
+				deviceId,
+				window,
+				cadenceSec: rule.cadenceSec,
+				framerate: rule.framerate
+			});
+			const deviceName = await this.resolveDeviceName(deviceId);
+			const rows = buildTimelapseOutboxInputs({
+				ruleId: rule.id,
+				ruleName: rule.name,
+				deviceId,
+				...deviceName !== null ? { deviceName } : {},
+				window,
+				targets: rule.targets,
+				...this.deps.disabledTargetIds !== void 0 ? { disabledTargetIds: this.deps.disabledTargetIds(rule.id) } : {},
+				priority: rule.priority,
+				coverage: outcome.coverage,
+				...outcome.artifact !== null ? { artifact: outcome.artifact } : {},
+				...outcome.downloadUrl !== null ? { clickUrl: outcome.downloadUrl } : {},
+				exportId: outcome.exportId,
+				denseRanges: outcome.plan.ranges.length,
+				...outcome.plan.capped ? { denseCapped: true } : {},
+				generatedAt: this.deps.now(),
+				...rule.template !== void 0 ? { template: rule.template } : {}
+			});
+			const enqueued = await this.deps.enqueue(rows);
+			if (opts.stamp) await this.deps.store.markGenerated(rule.id, deviceId, this.deps.now());
+			this.deps.logger.info("timelapse produced", {
+				tags,
+				meta: {
+					ruleId: rule.id,
+					exportId: outcome.exportId,
+					windowStart: window.startMs,
+					windowEnd: window.endMs,
+					coveragePct: outcome.coverage.percent,
+					denseRanges: outcome.plan.ranges.length,
+					enqueued,
+					stamped: opts.stamp,
+					...outcome.artifact === null ? { artifact: "none" } : {}
+				}
+			});
+			return {
+				produced: 1,
+				window,
+				exportId: outcome.exportId,
+				coveragePercent: outcome.coverage.percent,
+				enqueued
+			};
+		} catch (err) {
+			this.deps.logger.warn("timelapse not produced — the window stays eligible", {
+				tags,
+				meta: {
+					ruleId: rule.id,
+					windowStart: window.startMs,
+					windowEnd: window.endMs,
+					error: String(err)
+				}
+			});
+			return {
+				produced: 0,
+				window,
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+	}
+	async resolveDeviceName(deviceId) {
+		const get = this.deps.getDeviceName;
+		if (get === void 0) return null;
+		return get(deviceId).catch(() => null);
+	}
+};
+//#endregion
 //#region src/notification-center/index.ts
 /**
 * NotificationCenter — the P1 core of the Notification Center (spec
@@ -5623,16 +6343,21 @@ function packagePhaseOf(ev) {
 * never disagree. `ruleName` + `subject` come from the intent snapshot
 * frozen at enqueue; `error` surfaces only on a dead row (`lastError`).
 */
+function historyRecordKind(kind) {
+	if (kind === "audio-event") return "object-event";
+	if (kind === "timelapse") return "system-event";
+	return kind;
+}
 function outboxEntryToHistory(entry) {
 	const s = entry.payload.subject;
 	return {
 		id: entry.id,
 		ruleId: entry.ruleId,
 		ruleName: entry.payload.ruleName,
-		delivery: entry.payload.delivery,
+		delivery: entry.payload.delivery === "timelapse" ? "system-event" : entry.payload.delivery,
 		targetId: entry.targetId,
 		deviceId: entry.deviceId,
-		recordKind: entry.recordKind === "audio-event" ? "object-event" : entry.recordKind,
+		recordKind: historyRecordKind(entry.recordKind),
 		recordId: entry.recordId,
 		...entry.trackId !== void 0 ? { trackId: entry.trackId } : {},
 		status: entry.status,
@@ -5675,6 +6400,13 @@ var NotificationCenter = class NotificationCenter {
 	/** Grants behind the tap-through buttons. In-process and single-use — read
 	*  `action-token.ts` before assuming anything about what a tap proves. */
 	actionTokens = new NcActionTokenRegistry();
+	/**
+	* The scheduled-timelapse rule set. Held on EVERY node so the bridge actions
+	* can serve CRUD from wherever they are asked (same reasoning as the rule
+	* store); only the hub, with `deps.timelapse` wired, gets a scheduler.
+	*/
+	timelapseRules;
+	timelapseScheduler = null;
 	/** True when ≥1 enabled `device-event` rule declares an occupancy condition —
 	*  the watcher is idle (zero per-frame cost) otherwise. */
 	occupancyEnabled = false;
@@ -5864,6 +6596,47 @@ var NotificationCenter = class NotificationCenter {
 			deliver: (entry) => this.dispatcher.deliver(entry),
 			...deps.now !== void 0 ? { now: deps.now } : {}
 		});
+		this.timelapseRules = new TimelapseStore({
+			store: deps.store,
+			logger: this.logger.child("timelapse"),
+			...deps.now !== void 0 ? { now: deps.now } : {}
+		});
+		const timelapsePorts = deps.timelapse;
+		if (timelapsePorts !== void 0) {
+			const logger = this.logger.child("timelapse");
+			const renderer = new TimelapseRenderer({
+				...timelapsePorts,
+				logger,
+				now: this.now,
+				sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+			});
+			this.timelapseScheduler = new TimelapseScheduler({
+				logger,
+				now: this.now,
+				store: this.timelapseRules,
+				render: (request) => renderer.render(request),
+				enqueue: (rows) => this.outbox.enqueue(rows),
+				getDeviceName: (deviceId) => deps.dispatcher.getDeviceName(deviceId)
+			});
+		}
+	}
+	/**
+	* The durable timelapse rule set — exposed for the `nc.*Timelapse*` bridge
+	* actions, exactly as {@link ruleStore} is for the detection rules.
+	*/
+	get timelapseStore() {
+		return this.timelapseRules;
+	}
+	/**
+	* Produce the last closed window for one camera of one timelapse rule, now.
+	*
+	* Throws when this node hosts no producer — an honest refusal beats a
+	* `produced: 0` an operator reads as "there was nothing to make".
+	*/
+	async runTimelapseNow(input) {
+		const scheduler = this.timelapseScheduler;
+		if (scheduler === null) throw new Error("this node does not host the timelapse producer — produce it on the hub");
+		return scheduler.runNow(input);
 	}
 	/**
 	* The durable rule store — exposed so the hub-only `nc.*` bridge actions
@@ -5900,6 +6673,7 @@ var NotificationCenter = class NotificationCenter {
 		await this.rules.load();
 		await this.snoozes.load();
 		await this.deviceMutes.load();
+		await this.timelapseRules.load();
 		this.refreshOccupancyWatch();
 		if (!opts.evaluation) return;
 		await this.deviceStates.refresh();
@@ -5915,9 +6689,14 @@ var NotificationCenter = class NotificationCenter {
 		this.reloadTimer = setInterval(() => {
 			this.reloadRules();
 		}, this.deps.ruleReloadIntervalMs ?? DEFAULT_RULE_RELOAD_INTERVAL_MS);
+		if (this.timelapseScheduler !== null) await this.timelapseScheduler.start().catch((err) => {
+			this.logger.warn("timelapse producer did not start", { meta: { error: String(err) } });
+		});
 		this.logger.info("notification center started", { meta: {
 			rules: this.rules.list().length,
-			pendingOutbox: this.outbox.pendingCount()
+			pendingOutbox: this.outbox.pendingCount(),
+			timelapseRules: this.timelapseRules.list().length,
+			timelapseProducer: this.timelapseScheduler !== null
 		} });
 	}
 	async stop() {
@@ -5929,6 +6708,7 @@ var NotificationCenter = class NotificationCenter {
 			clearInterval(this.reloadTimer);
 			this.reloadTimer = null;
 		}
+		this.timelapseScheduler?.stop();
 		this.evaluationActive = false;
 	}
 	/**
@@ -6727,6 +7507,7 @@ var NotificationCenter = class NotificationCenter {
 	*  recompute the occupancy watched set + prune stale durable rows. */
 	async reloadRules() {
 		await this.rules.load();
+		await this.timelapseRules.load();
 		this.refreshOccupancyWatch();
 		if (!this.evaluationActive) return;
 		await this.deviceStates.refresh();
@@ -6965,6 +7746,75 @@ var NotificationCenter = class NotificationCenter {
 	}
 };
 //#endregion
+//#region src/notification-center/timelapse/artifact-publish.ts
+/**
+* Build the renderer's `publishArtifact` port.
+*
+* @returns a function answering the artifact ref, or `null` with a logged
+*          reason. It never rejects.
+*/
+function buildTimelapseArtifactPublisher(ports) {
+	return async ({ exportId, deviceId }) => {
+		const tags = { deviceId };
+		let read;
+		try {
+			read = await ports.readExportBytes({ exportId });
+		} catch (err) {
+			ports.logger.warn("timelapse artifact not published: export bytes unavailable", {
+				tags,
+				meta: {
+					exportId,
+					error: String(err)
+				}
+			});
+			return null;
+		}
+		if (read.bytes > 52428800) {
+			ports.logger.warn("timelapse artifact not published: video too large to republish", {
+				tags,
+				meta: {
+					exportId,
+					bytes: read.bytes,
+					maxBytes: require_dist.RECORDING_EXPORT_MAX_READ_BYTES
+				}
+			});
+			return null;
+		}
+		try {
+			const url = await ports.publish(Buffer.from(read.base64, "base64"), read.contentType);
+			if (url === null) {
+				ports.logger.warn("timelapse artifact not published: no reachable public endpoint", {
+					tags,
+					meta: { exportId }
+				});
+				return null;
+			}
+			ports.logger.info("timelapse artifact published", {
+				tags,
+				meta: {
+					exportId,
+					bytes: read.bytes,
+					name: read.name
+				}
+			});
+			return {
+				url,
+				mime: read.contentType,
+				name: read.name
+			};
+		} catch (err) {
+			ports.logger.warn("timelapse artifact not published: artifact plane refused the bytes", {
+				tags,
+				meta: {
+					exportId,
+					error: String(err)
+				}
+			});
+			return null;
+		}
+	};
+}
+//#endregion
 //#region src/notification-center/nc-actions.ts
 /**
 * nc-actions — the `pipeline-analytics` rule-bridge action catalog.
@@ -6992,6 +7842,8 @@ var NotificationCenter = class NotificationCenter {
 */
 /** A rule as served to the viewer — carries the server's `readOnly` verdict. */
 var NcViewerRuleSchema = require_dist.NcRuleSchema.extend({ readOnly: require_dist.boolean() });
+/** Same verdict, for a timelapse rule. */
+var NcViewerTimelapseRuleSchema = require_dist.TimelapseRuleSchema.extend({ readOnly: require_dist.boolean() });
 /**
 * The action catalog — the tRPC contract Group B (the viewer client) consumes
 * against `addonId: 'pipeline-analytics'`. Every entry that depends on the
@@ -7059,6 +7911,54 @@ var ncActions = require_dist.defineCustomActions({
 		kind: "mutation",
 		auth: "admin",
 		caller: "required"
+	}),
+	"nc.listTimelapseRules": require_dist.customAction(require_dist.object({}), require_dist.object({ rules: require_dist.array(NcViewerTimelapseRuleSchema) }), { caller: "required" }),
+	/**
+	* ONE action for create AND update, unlike the detection-rule pair.
+	*
+	* A timelapse rule is edited as a whole in a single form (schedule +
+	* cameras + targets), and the guards a create must pass — every camera
+	* actually records, every target is owned — are the SAME ones a patch that
+	* adds a camera must pass. Two entry points would be two places to forget
+	* the recording check, and forgetting it is invisible until 06:05.
+	*
+	* `ruleId` absent ⇒ create from `rule`; `ruleId` present ⇒ patch.
+	*/
+	"nc.upsertTimelapseRule": require_dist.customAction(require_dist.object({
+		ruleId: require_dist.string().optional(),
+		rule: require_dist.TimelapseRuleInputSchema.optional(),
+		patch: require_dist.TimelapseRulePatchSchema.optional()
+	}), require_dist.object({ rule: require_dist.TimelapseRuleSchema }), {
+		kind: "mutation",
+		caller: "required"
+	}),
+	"nc.deleteTimelapseRule": require_dist.customAction(require_dist.object({ ruleId: require_dist.string() }), require_dist.object({ success: require_dist.literal(true) }), {
+		kind: "mutation",
+		caller: "required"
+	}),
+	/**
+	* Produce the LAST CLOSED window for one camera of one rule, right now.
+	*
+	* `auth: 'admin'` for the same reason as `nc.injectTestEvent`: it DELIVERS,
+	* to every target the rule addresses, on other people's phones. It does not
+	* consume the schedule guard — pressing Test at noon must not cancel
+	* tonight's run.
+	*/
+	"nc.testTimelapseRule": require_dist.customAction(require_dist.object({
+		ruleId: require_dist.string(),
+		deviceId: require_dist.number()
+	}), require_dist.object({
+		produced: require_dist.number().int(),
+		exportId: require_dist.string().optional(),
+		coveragePercent: require_dist.number().optional(),
+		enqueued: require_dist.number().int().optional(),
+		windowStartMs: require_dist.number().optional(),
+		windowEndMs: require_dist.number().optional(),
+		error: require_dist.string().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
 	})
 });
 /** Fail-closed caller resolution — an absent forwarded caller is NEVER admin. */
@@ -7097,6 +7997,44 @@ function makeNcActionHandlers(deps) {
 		if (rule.ownerUserId !== void 0 && rule.ownerUserId !== caller.userId) throw new Error(`forbidden: rule not owned: ${ruleId}`);
 		return rule;
 	};
+	/** The producer half, or an honest refusal. */
+	const requireTimelapse = () => {
+		const tl = deps.timelapse;
+		if (tl === void 0) throw new Error("this node does not host the timelapse producer — use the hub");
+		return tl;
+	};
+	/** A timelapse rule the caller may EDIT. Same admin bypass as `NcRule`. */
+	const assertTimelapseEditable = (ruleId, caller, tl) => {
+		const rule = tl.store.get(ruleId);
+		if (rule === null) throw new Error(`forbidden: timelapse rule not found: ${ruleId}`);
+		if (caller.isAdmin) return rule;
+		if (rule.ownerUserId !== caller.userId) throw new Error(`forbidden: timelapse rule not owned: ${ruleId}`);
+		return rule;
+	};
+	/**
+	* THE RECORDING GUARD.
+	*
+	* A post-hoc timelapse renders RECORDED footage — a camera that is not
+	* recording can never produce one, no matter how the rule is written. Save
+	* time is the only moment an operator is present to be told: at 06:05 the
+	* next morning the window is closed, the footage was never written, and the
+	* only signal available is a log line nobody is reading.
+	*
+	* The authority is `RecordingConfig` through `deriveRecordingMode` — the
+	* same pair camera-status reads. Never a second opinion, and never a guess:
+	* `enabled: true` with no bands records NOTHING, which is exactly the case a
+	* naive `config.enabled` check would wave through.
+	*
+	* FAIL-CLOSED on an unreadable config: a read that failed is not permission
+	* to save.
+	*/
+	const assertCamerasRecord = async (deviceIds, tl) => {
+		for (const deviceId of deviceIds) {
+			const config = await tl.getRecordingConfig(deviceId).catch(() => null);
+			if (config === null) throw new Error(`camera ${deviceId}: recording configuration could not be read — cannot save a timelapse rule for it`);
+			if (require_dist.deriveRecordingMode(config) === "off") throw new Error(`camera ${deviceId}: recording is not enabled — a timelapse renders recorded footage, so enable recording for this camera first`);
+		}
+	};
 	const assertTargetsOwned = async (targetIds, caller) => {
 		if (caller.isAdmin) return;
 		const owned = new Set(await deps.listCallerTargetIds(caller.userId));
@@ -7189,6 +8127,83 @@ function makeNcActionHandlers(deps) {
 			});
 			return inject(parsed);
 		},
+		"nc.listTimelapseRules": async (_input, caller) => {
+			const c = requireCaller(caller);
+			const tl = requireTimelapse();
+			return { rules: (c.isAdmin ? tl.store.list() : tl.store.listForOwner(c.userId)).map((r) => ({
+				...r,
+				readOnly: !c.isAdmin && r.ownerUserId !== c.userId
+			})) };
+		},
+		"nc.upsertTimelapseRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			const tl = requireTimelapse();
+			if (input.ruleId === void 0) {
+				if (input.rule === void 0) throw new Error("upsertTimelapseRule: rule or ruleId required");
+				const parsed = require_dist.TimelapseRuleInputSchema.parse(input.rule);
+				await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
+				await assertCamerasRecord(parsed.deviceIds, tl);
+				const rule = await tl.store.create(parsed, c.userId, c.isAdmin ? void 0 : c.userId);
+				deps.logger.info("timelapse rule created", { meta: {
+					ruleId: rule.id,
+					owner: c.userId,
+					devices: rule.deviceIds.join(",")
+				} });
+				return { rule };
+			}
+			const existing = assertTimelapseEditable(input.ruleId, c, tl);
+			if (input.patch === void 0) throw new Error("upsertTimelapseRule: patch required");
+			const patch = require_dist.TimelapseRulePatchSchema.parse(input.patch);
+			if (patch.targets !== void 0) await assertTargetsOwned(patch.targets.map((t) => t.targetId), c);
+			if (patch.deviceIds !== void 0) {
+				const known = new Set(existing.deviceIds);
+				await assertCamerasRecord(patch.deviceIds.filter((id) => !known.has(id)), tl);
+			}
+			const rule = await tl.store.update(input.ruleId, patch);
+			deps.logger.info("timelapse rule updated", { meta: {
+				ruleId: rule.id,
+				owner: c.userId
+			} });
+			return { rule };
+		},
+		"nc.deleteTimelapseRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			const tl = requireTimelapse();
+			assertTimelapseEditable(input.ruleId, c, tl);
+			await tl.store.delete(input.ruleId);
+			deps.logger.info("timelapse rule deleted", { meta: {
+				ruleId: input.ruleId,
+				owner: c.userId
+			} });
+			return { success: true };
+		},
+		"nc.testTimelapseRule": async (input, caller) => {
+			const c = requireCaller(caller);
+			if (!c.isAdmin) throw new Error("forbidden: admin required to produce a test timelapse");
+			const tl = requireTimelapse();
+			deps.logger.info("timelapse test requested", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					by: c.userId,
+					ruleId: input.ruleId
+				}
+			});
+			const out = await tl.runNow({
+				ruleId: input.ruleId,
+				deviceId: input.deviceId
+			});
+			return {
+				produced: out.produced,
+				...out.exportId !== void 0 ? { exportId: out.exportId } : {},
+				...out.coveragePercent !== void 0 ? { coveragePercent: out.coveragePercent } : {},
+				...out.enqueued !== void 0 ? { enqueued: out.enqueued } : {},
+				...out.window !== null ? {
+					windowStartMs: out.window.startMs,
+					windowEndMs: out.window.endMs
+				} : {},
+				...out.error !== void 0 ? { error: out.error } : {}
+			};
+		},
 		"nc.setRuleTargetEnabled": async (input, caller) => {
 			const c = requireCaller(caller);
 			assertRuleVisible(input.ruleId, c);
@@ -15784,6 +16799,7 @@ function resolveFaceSettings(raw) {
 */
 function createLocationAwareMediaStorage(deps) {
 	const roots = /* @__PURE__ */ new Map();
+	let defaultBypassInvalidated = false;
 	const rootOf = async (locationId) => {
 		const cached = roots.get(locationId);
 		if (cached !== void 0) return cached;
@@ -15794,21 +16810,55 @@ function createLocationAwareMediaStorage(deps) {
 	const absOf = async (locationId, relativePath) => node_path.default.join(await rootOf(locationId), relativePath);
 	return {
 		write: async (input) => {
-			if (input.location === deps.defaultLocation) return deps.base.write(input);
+			if (input.location === deps.defaultLocation && !defaultBypassInvalidated) return deps.base.write(input);
 			const abs = await absOf(input.location, input.relativePath);
 			await node_fs.promises.mkdir(node_path.default.dirname(abs), { recursive: true });
 			await node_fs.promises.writeFile(abs, input.data);
 		},
 		read: async (input) => {
-			if (input.location === deps.defaultLocation) return deps.base.read(input);
+			if (input.location === deps.defaultLocation && !defaultBypassInvalidated) return deps.base.read(input);
 			return node_fs.promises.readFile(await absOf(input.location, input.relativePath));
 		},
 		delete: async (input) => {
-			if (input.location === deps.defaultLocation) return deps.base.delete(input);
+			if (input.location === deps.defaultLocation && !defaultBypassInvalidated) return deps.base.delete(input);
 			await node_fs.promises.rm(await absOf(input.location, input.relativePath), { force: true });
+		},
+		invalidateRoots: () => {
+			roots.clear();
+			defaultBypassInvalidated = true;
 		}
 	};
 }
+//#endregion
+//#region src/pipeline-analytics/media-write-gate.ts
+/**
+* Reversible writer gate for storage maintenance. `pause()` closes admission
+* first, then waits for writes already admitted to settle; callers never
+* mutate device bindings or analytics configuration to quiesce media.
+*/
+var MediaWriteGate = class {
+	paused = false;
+	active = 0;
+	drainedWaiters = [];
+	async run(write) {
+		if (this.paused) throw new Error("event-media writes are paused for storage migration");
+		this.active++;
+		try {
+			return await write();
+		} finally {
+			this.active--;
+			if (this.active === 0) for (const resolve of this.drainedWaiters.splice(0)) resolve();
+		}
+	}
+	pause() {
+		this.paused = true;
+		if (this.active === 0) return Promise.resolve();
+		return new Promise((resolve) => this.drainedWaiters.push(resolve));
+	}
+	resume() {
+		this.paused = false;
+	}
+};
 var MACRO_SET = new Set([
 	"person",
 	"vehicle",
@@ -16679,7 +17729,14 @@ var RETRAIN_FRAME_COLUMNS = [
 		name: "copiedAt",
 		type: "INTEGER",
 		notNull: true
-	}
+	},
+	(
+	/** NULL = current eventMedia default; stamped when migration moves a copy
+	* before the logical default is repointed. */
+	{
+		name: "locationId",
+		type: "TEXT"
+	})
 ];
 var RETRAIN_FRAME_INDEXES = [{
 	name: "idx_retrain_frames_track",
@@ -16708,12 +17765,14 @@ var RetrainFrameStore = class {
 	logger;
 	readSource;
 	now;
+	writeGate;
 	constructor(deps) {
 		this.store = deps.store;
 		this.storage = deps.storage;
 		this.logger = deps.logger;
 		this.readSource = deps.readSource;
 		this.now = deps.now;
+		this.writeGate = deps.writeGate;
 	}
 	static async declare(store) {
 		await store.declareCollection.mutate({
@@ -16732,7 +17791,8 @@ var RetrainFrameStore = class {
 			sizeBytes: Number(data["sizeBytes"] ?? 0),
 			width: Number(data["width"] ?? 0),
 			height: Number(data["height"] ?? 0),
-			copiedAt: Number(data["copiedAt"] ?? 0)
+			copiedAt: Number(data["copiedAt"] ?? 0),
+			locationId: typeof data["locationId"] === "string" && data["locationId"].length > 0 ? data["locationId"] : null
 		};
 	}
 	/** The copy with this id, or `null`. Index read only — no blob is touched. */
@@ -16800,7 +17860,7 @@ var RetrainFrameStore = class {
 	async readFrame(frame) {
 		try {
 			return await this.storage.read({
-				location: RETRAIN_MEDIA_LOCATION,
+				location: frame.locationId ?? "eventMedia",
 				relativePath: framePath(frame.deviceId, frame.trackId, frame.frameId)
 			});
 		} catch (err) {
@@ -16880,9 +17940,10 @@ var RetrainFrameStore = class {
 			sizeBytes: bytes.length,
 			width: size.width,
 			height: size.height,
-			copiedAt: this.now()
+			copiedAt: this.now(),
+			locationId: null
 		};
-		try {
+		const persist = async () => {
 			await this.storage.write({
 				location: RETRAIN_MEDIA_LOCATION,
 				relativePath: path,
@@ -16900,9 +17961,14 @@ var RetrainFrameStore = class {
 					sizeBytes: frame.sizeBytes,
 					width: frame.width,
 					height: frame.height,
-					copiedAt: frame.copiedAt
+					copiedAt: frame.copiedAt,
+					locationId: null
 				}
 			});
+		};
+		try {
+			if (this.writeGate) await this.writeGate.run(persist);
+			else await persist();
 		} catch (err) {
 			this.logger.error("retrain copy failed to persist", {
 				tags: { deviceId: input.deviceId },
@@ -16943,26 +18009,30 @@ var RetrainFrameStore = class {
 	* best-effort write is how a half-deleted annotation set happens.
 	*/
 	async deleteFrame(frame) {
-		try {
-			await this.storage.delete({
-				location: RETRAIN_MEDIA_LOCATION,
-				relativePath: framePath(frame.deviceId, frame.trackId, frame.frameId)
-			});
-		} catch {}
-		try {
-			await this.store.delete.mutate({
-				collection: RETRAIN_FRAMES_COLLECTION,
-				key: frame.frameId
-			});
-		} catch (err) {
-			this.logger.warn("RetrainFrameStore.deleteFrame row delete failed", {
-				tags: { deviceId: frame.deviceId },
-				meta: {
-					frameId: frame.frameId,
-					error: String(err)
-				}
-			});
-		}
+		const remove = async () => {
+			try {
+				await this.storage.delete({
+					location: frame.locationId ?? "eventMedia",
+					relativePath: framePath(frame.deviceId, frame.trackId, frame.frameId)
+				});
+			} catch {}
+			try {
+				await this.store.delete.mutate({
+					collection: RETRAIN_FRAMES_COLLECTION,
+					key: frame.frameId
+				});
+			} catch (err) {
+				this.logger.warn("RetrainFrameStore.deleteFrame row delete failed", {
+					tags: { deviceId: frame.deviceId },
+					meta: {
+						frameId: frame.frameId,
+						error: String(err)
+					}
+				});
+			}
+		};
+		if (this.writeGate) await this.writeGate.run(remove);
+		else await remove();
 	}
 };
 //#endregion
@@ -18001,10 +19071,15 @@ var MediaStore = class {
 	storage;
 	store;
 	logger;
+	writeGate;
 	constructor(deps) {
 		this.storage = deps.storage;
 		this.store = deps.store;
 		this.logger = deps.logger;
+		this.writeGate = deps.writeGate;
+	}
+	gated(mutation) {
+		return this.writeGate ? this.writeGate.run(mutation) : mutation();
 	}
 	static async declare(store) {
 		await store.declareCollection.mutate({
@@ -18016,6 +19091,10 @@ var MediaStore = class {
 	/** Persist a media blob and register its metadata row. Returns the
 	*  collection key (MediaFile.key) that callers store as reference. */
 	async put(params) {
+		if (this.writeGate) return this.writeGate.run(() => this.putUnchecked(params));
+		return this.putUnchecked(params);
+	}
+	async putUnchecked(params) {
 		const key = buildKey(params);
 		const path = buildPath(params);
 		const record = {
@@ -18086,6 +19165,9 @@ var MediaStore = class {
 	* scheme (transition back-compat); once migrated it is a no-op.
 	*/
 	async putReplacing(params) {
+		return this.gated(() => this.putReplacingUnchecked(params));
+	}
+	async putReplacingUnchecked(params) {
 		const existing = await this.store.query.query({
 			collection: MEDIA_COLLECTION,
 			filter: { where: {
@@ -18094,7 +19176,7 @@ var MediaStore = class {
 				kind: params.kind
 			} }
 		});
-		const newKey = await this.put(params);
+		const newKey = await this.putUnchecked(params);
 		for (const row of existing) {
 			if (row.id === newKey) continue;
 			const rowData = row.data;
@@ -18137,8 +19219,11 @@ var MediaStore = class {
 	* own kind.
 	*/
 	async promoteToLastFrame(input) {
+		return this.gated(() => this.promoteToLastFrameUnchecked(input));
+	}
+	async promoteToLastFrameUnchecked(input) {
 		const data = Buffer.from(input.snapshot.base64, "base64");
-		const newKey = await this.putReplacing({
+		const newKey = await this.putReplacingUnchecked({
 			deviceId: input.deviceId,
 			ownerKind: "track",
 			ownerId: input.trackId,
@@ -18146,7 +19231,7 @@ var MediaStore = class {
 			timestamp: input.snapshot.timestamp,
 			data
 		});
-		if (input.keepSource !== true) await this.deleteByKey(input.snapshot.key);
+		if (input.keepSource !== true) await this.deleteByKeyUnchecked(input.snapshot.key);
 		return newKey;
 	}
 	/**
@@ -18184,6 +19269,9 @@ var MediaStore = class {
 	* Deletes the blob from storage (best-effort) and removes the index row.
 	*/
 	async deleteByKey(key) {
+		await this.gated(() => this.deleteByKeyUnchecked(key));
+	}
+	async deleteByKeyUnchecked(key) {
 		const row = await this.store.get.query({
 			collection: MEDIA_COLLECTION,
 			key
@@ -18294,6 +19382,9 @@ var MediaStore = class {
 	* Best-effort per row; returns the number of index rows removed.
 	*/
 	async deleteForOwner(ownerKind, ownerIds) {
+		return this.gated(() => this.deleteForOwnerUnchecked(ownerKind, ownerIds));
+	}
+	async deleteForOwnerUnchecked(ownerKind, ownerIds) {
 		let removed = 0;
 		for (const ownerId of ownerIds) {
 			const rows = await this.store.query.query({
@@ -18375,6 +19466,9 @@ var MediaStore = class {
 	*  The old-entry deletion is best-effort: on failure a warning is logged
 	*  and the method still returns the new key. */
 	async reown(input) {
+		return this.gated(() => this.reownUnchecked(input));
+	}
+	async reownUnchecked(input) {
 		const { fromOwnerKind, fromOwnerId, toOwnerKind, toOwnerId, key } = input;
 		const row = (await this.store.query.query({
 			collection: MEDIA_COLLECTION,
@@ -18408,7 +19502,7 @@ var MediaStore = class {
 				relativePath: oldPath
 			})
 		};
-		const newKey = await this.put(newParams);
+		const newKey = await this.putUnchecked(newParams);
 		try {
 			await this.storage.delete({
 				location: mediaRowLocation(meta),
@@ -18462,8 +19556,10 @@ var MediaStore = class {
 	* batch.
 	*/
 	async deleteByTracks(trackIds) {
-		await this.deleteForOwner("track", trackIds);
-		await this.deleteForOwner("face", trackIds.map((id) => FACE_MEDIA_OWNER_PREFIX + id));
+		await this.gated(async () => {
+			await this.deleteForOwnerUnchecked("track", trackIds);
+			await this.deleteForOwnerUnchecked("face", trackIds.map((id) => FACE_MEDIA_OWNER_PREFIX + id));
+		});
 		await this.deleteForOwner("plate", trackIds.map((id) => PLATE_MEDIA_OWNER_PREFIX + id));
 	}
 	/**
@@ -18505,7 +19601,7 @@ function snapshot(j) {
 		fromLocationId: j.fromLocationId,
 		toLocationId: j.toLocationId,
 		deviceId: j.deviceId,
-		entities: ["media"],
+		entities: ["media", "retrainFrames"],
 		filesMoved: j.filesMoved,
 		bytesMoved: j.bytesMoved,
 		filesTotal: null,
@@ -18536,7 +19632,7 @@ var MediaRelocateEngine = class {
 			state: "running",
 			fromLocationId: "*",
 			toLocationId: input.toLocationId,
-			deviceId: input.deviceId ?? null,
+			deviceId: null,
 			filesMoved: 0,
 			bytesMoved: 0,
 			startedAt: this.deps.now(),
@@ -18553,24 +19649,25 @@ var MediaRelocateEngine = class {
 		const bytesPerMs = throttleMbps * 1024 * 1024 / 1e3;
 		try {
 			await this.deps.resolveTargetRoot(job.toLocationId);
+			let failedRows = 0;
 			let cursor = 0;
-			let seenAtCursor = /* @__PURE__ */ new Set();
+			let offsetAtCursor = 0;
 			for (;;) {
 				if (job.cancelRequested) break;
-				const fresh = (await this.deps.store.query.query({
+				const rows = await this.deps.store.query.query({
 					collection: MEDIA_COLLECTION,
 					filter: {
-						...job.deviceId !== null ? { where: { deviceId: job.deviceId } } : {},
 						whereBetween: { timestamp: [cursor, Number.MAX_SAFE_INTEGER] },
 						orderBy: {
 							field: "timestamp",
 							direction: "asc"
 						},
-						limit: PAGE_SIZE
+						limit: PAGE_SIZE,
+						offset: offsetAtCursor
 					}
-				})).filter((r) => !seenAtCursor.has(r.id));
-				if (fresh.length === 0) break;
-				for (const row of fresh) {
+				});
+				if (rows.length === 0) break;
+				for (const row of rows) {
 					if (job.cancelRequested) break;
 					const data = row.data;
 					const from = mediaRowLocation(data);
@@ -18578,6 +19675,17 @@ var MediaRelocateEngine = class {
 					const relativePath = String(data["path"] ?? "");
 					if (relativePath.length === 0) continue;
 					try {
+						if (await this.samePhysicalLocation(from, job.toLocationId)) {
+							await this.deps.store.set.mutate({
+								collection: MEDIA_COLLECTION,
+								key: row.id,
+								value: {
+									...data,
+									locationId: job.toLocationId
+								}
+							});
+							continue;
+						}
 						const bytes = await this.deps.storage.read({
 							location: from,
 							relativePath
@@ -18587,6 +19695,10 @@ var MediaRelocateEngine = class {
 							relativePath,
 							data: bytes
 						});
+						if ((await this.deps.storage.read({
+							location: job.toLocationId,
+							relativePath
+						})).length !== bytes.length) throw new Error(`relocated media size mismatch for ${relativePath}`);
 						await this.deps.store.set.mutate({
 							collection: MEDIA_COLLECTION,
 							key: row.id,
@@ -18603,20 +19715,99 @@ var MediaRelocateEngine = class {
 						job.bytesMoved += bytes.length;
 						await sleep(bytes.length / bytesPerMs);
 					} catch (err) {
+						failedRows++;
 						this.deps.logger.debug("media relocate row failed", { meta: {
 							key: row.id,
 							error: String(err)
 						} });
 					}
 				}
-				const last = fresh[fresh.length - 1];
+				const last = rows[rows.length - 1];
 				const lastTs = Number(last.data["timestamp"] ?? cursor);
-				if (lastTs === cursor) for (const r of fresh) seenAtCursor.add(r.id);
+				if (lastTs === cursor) offsetAtCursor += rows.length;
 				else {
 					cursor = lastTs;
-					seenAtCursor = new Set(fresh.filter((r) => Number(r.data["timestamp"]) === lastTs).map((r) => r.id));
+					offsetAtCursor = rows.filter((row) => Number(row.data["timestamp"]) === lastTs).length;
 				}
+				if (rows.length < PAGE_SIZE) break;
 			}
+			let retrainOffset = 0;
+			for (;;) {
+				if (job.cancelRequested) break;
+				const rows = await this.deps.store.query.query({
+					collection: RETRAIN_FRAMES_COLLECTION,
+					filter: {
+						orderBy: {
+							field: "copiedAt",
+							direction: "asc"
+						},
+						limit: PAGE_SIZE,
+						offset: retrainOffset
+					}
+				});
+				if (rows.length === 0) break;
+				for (const row of rows) {
+					if (job.cancelRequested) break;
+					const data = row.data;
+					const from = mediaRowLocation(data);
+					if (from === job.toLocationId) continue;
+					const relativePath = String(data["path"] ?? "");
+					if (relativePath.length === 0) {
+						failedRows++;
+						continue;
+					}
+					try {
+						if (await this.samePhysicalLocation(from, job.toLocationId)) {
+							await this.deps.store.set.mutate({
+								collection: RETRAIN_FRAMES_COLLECTION,
+								key: row.id,
+								value: {
+									...data,
+									locationId: job.toLocationId
+								}
+							});
+							continue;
+						}
+						const bytes = await this.deps.storage.read({
+							location: from,
+							relativePath
+						});
+						await this.deps.storage.write({
+							location: job.toLocationId,
+							relativePath,
+							data: bytes
+						});
+						if ((await this.deps.storage.read({
+							location: job.toLocationId,
+							relativePath
+						})).length !== bytes.length) throw new Error(`relocated retrain frame size mismatch for ${relativePath}`);
+						await this.deps.store.set.mutate({
+							collection: RETRAIN_FRAMES_COLLECTION,
+							key: row.id,
+							value: {
+								...data,
+								locationId: job.toLocationId
+							}
+						});
+						await this.deps.storage.delete({
+							location: from,
+							relativePath
+						});
+						job.filesMoved++;
+						job.bytesMoved += bytes.length;
+						await sleep(bytes.length / bytesPerMs);
+					} catch (err) {
+						failedRows++;
+						this.deps.logger.debug("retrain frame relocate row failed", { meta: {
+							key: row.id,
+							error: String(err)
+						} });
+					}
+				}
+				retrainOffset += rows.length;
+				if (rows.length < PAGE_SIZE) break;
+			}
+			if (failedRows > 0) throw new Error(`event-media relocation left ${failedRows} row(s) unmoved`);
 			job.state = job.cancelRequested ? "cancelled" : "done";
 		} catch (err) {
 			job.state = "failed";
@@ -18630,6 +19821,18 @@ var MediaRelocateEngine = class {
 			this.deps.onFinished?.(snapshot(job));
 		}
 	}
+	async samePhysicalLocation(from, to) {
+		if (from === to) return true;
+		try {
+			const [fromRoot, toRoot] = await Promise.all([this.deps.resolveTargetRoot(from), this.deps.resolveTargetRoot(to)]);
+			const [fromStat, toStat] = await Promise.all([node_fs.promises.stat(fromRoot), node_fs.promises.stat(toRoot)]);
+			if (fromStat.dev === toStat.dev && fromStat.ino === toStat.ino) return true;
+			const [fromReal, toReal] = await Promise.all([node_fs.promises.realpath(node_path.default.resolve(fromRoot)), node_fs.promises.realpath(node_path.default.resolve(toRoot))]);
+			return fromReal === toReal;
+		} catch {
+			return false;
+		}
+	}
 };
 //#endregion
 //#region src/pipeline-analytics/media-settings.ts
@@ -31182,6 +32385,9 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	eventsOpsLog = null;
 	/** Event-media relocation engine (entity-routing Phase 4). */
 	mediaRelocate = null;
+	mediaLocationStorage = null;
+	mediaWriteGate = new MediaWriteGate();
+	storageMigrationLeaseId = null;
 	/** Per-camera history of LINKED-device sensor state changes (Part B). */
 	sensorEventStore = null;
 	/** Ingest-side reverse index (sensor device → linked camera ids), TTL-cached
@@ -31869,7 +33075,12 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			listCallerTargetIds: async (userId) => {
 				return (await api.notificationOutput.listTargets.query({})).filter((t) => t.config["ownerUserId"] === userId).map((t) => t.id);
 			},
-			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) })
+			injectTestEvent: (input) => center.injectTestEvent(input, { getSnapshot: (deviceId) => api.snapshot.getSnapshot.query({ deviceId }) }),
+			timelapse: {
+				store: center.timelapseStore,
+				getRecordingConfig: (deviceId) => api.recording.getDeviceConfig.query({ deviceId }).catch(() => null),
+				runNow: (input) => center.runTimelapseNow(input)
+			}
 		});
 	}
 	/** Declare typed collections up-front so the first insert doesn't race with
@@ -31982,7 +33193,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			logger.info("pipeline-analytics: event media rooted at CAMSTACK_MEDIA_ROOT", { meta: { mediaRoot } });
 		}
 		if (!storage) throw new Error("pipeline-analytics requires ctx.kernel.storage");
-		return createLocationAwareMediaStorage({
+		const routed = createLocationAwareMediaStorage({
 			base: storage,
 			defaultLocation: "eventMedia",
 			resolveRoot: (locationId) => this.ctx.api.storage.resolve.query({
@@ -31990,6 +33201,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				relativePath: ""
 			})
 		});
+		this.mediaLocationStorage = routed;
+		return routed;
 	}
 	/** Constructs every SQLite-backed store plus the stationary/package-drop/
 	*  sensor plumbing, in the exact pre-S7 order. Returns the non-null bundle
@@ -32034,7 +33247,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		const mediaStore = new MediaStore({
 			storage,
 			store: api.settingsStore,
-			logger: logger.child("MediaStore")
+			logger: logger.child("MediaStore"),
+			writeGate: this.mediaWriteGate
 		});
 		this.mediaStore = mediaStore;
 		const retrainFrames = new RetrainFrameStore({
@@ -32042,6 +33256,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			storage,
 			logger: logger.child("RetrainFrames"),
 			now: () => Date.now(),
+			writeGate: this.mediaWriteGate,
 			readSource: async (mediaKey) => {
 				const file = await mediaStore.getByKey(mediaKey);
 				return file === null ? null : Buffer.from(file.base64, "base64");
@@ -32478,12 +33693,91 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					limit,
 					projection: "slim"
 				})).tracks;
-			}
+			},
+			...this.isPostProcessingNode ? { timelapse: this.buildTimelapsePorts(api, stores) } : {}
 		});
 		this.wireAlarmPanel(this.notificationCenter);
 		await this.serveNcActionPlane(this.notificationCenter);
 		await this.notificationCenter.start({ evaluation: this.isPostProcessingNode });
 	}
+	/**
+	* The scheduled-timelapse producer's ports.
+	*
+	* Every one of them is something that already exists: `recording` for the
+	* footage index, the LOCAL track store for the history (no self-cap call, and
+	* `projection: 'slim'` because the planner reads two timestamps per track and
+	* nothing else), `recordingExport` for the render.
+	*
+	* TWO links, two audiences, and they are not interchangeable:
+	*
+	*  - `publishArtifact` produces the one a notifier BACKEND fetches. It reads
+	*    the finished mp4 once through `recordingExport.readExportBytes` and
+	*    republishes it on the NC artifact plane — the same signed, expiring,
+	*    public surface a detection rule's still and clip already ride. Bounded
+	*    at `RECORDING_EXPORT_MAX_READ_BYTES`; above it there is no attachment
+	*    and a log line saying so.
+	*  - `resolveDownloadUrl` produces the one the RECIPIENT taps. The export's
+	*    own download route is served `access: 'authenticated'`, so it is a
+	*    perfectly good `clickUrl` and a useless attachment URL — a backend
+	*    fetching it holds no session and gets a 401.
+	*/
+	buildTimelapsePorts(api, stores) {
+		return {
+			getAvailability: async ({ deviceId, fromMs, toMs }) => {
+				return (await api.recording.getAvailability.query({
+					deviceId,
+					fromMs,
+					toMs
+				})).ranges;
+			},
+			listTracks: async ({ deviceId, since, until }) => {
+				return (await stores.trackStore.queryHistorical({
+					deviceId,
+					since,
+					until,
+					projection: "slim"
+				})).map((t) => ({
+					firstSeen: t.firstSeen,
+					lastSeen: t.lastSeen
+				}));
+			},
+			createExport: (input) => api.recordingExport.createExport.mutate({
+				deviceId: input.deviceId,
+				profile: input.profile,
+				fromMs: input.fromMs,
+				toMs: input.toMs,
+				options: {
+					includeAudio: input.options.includeAudio,
+					maxLifeMs: input.options.maxLifeMs,
+					deleteAfterDownload: input.options.deleteAfterDownload,
+					title: input.options.title,
+					timelapse: {
+						everyMs: input.options.timelapse.everyMs,
+						outputFps: input.options.timelapse.outputFps,
+						...input.options.timelapse.dense !== void 0 ? { dense: {
+							everyMs: input.options.timelapse.dense.everyMs,
+							ranges: input.options.timelapse.dense.ranges.map((r) => ({
+								fromSec: r.fromSec,
+								toSec: r.toSec
+							}))
+						} } : {}
+					}
+				}
+			}),
+			getExport: ({ exportId }) => api.recordingExport.getExport.query({ exportId }),
+			publishArtifact: buildTimelapseArtifactPublisher({
+				logger: this.ctx.logger.child("Timelapse"),
+				readExportBytes: ({ exportId }) => api.recordingExport.readExportBytes.query({ exportId }),
+				publish: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null
+			}),
+			resolveDownloadUrl: async ({ exportId }) => {
+				const plane = this.ncArtifactPlane;
+				if (plane === null) return null;
+				const download = await api.recordingExport.getDownloadUrl.query({ exportId });
+				return plane.resolveExternalUrl(download.url);
+			}
+		};
+	}
 	/** Event-media data-plane: serve thumbnail JPEGs at
 	*  `/addon/<addonId>/event-media/<eventId>` through the hub's port.
 	*  Mirror the recorder playback pattern: try/warn, store handle for dispose.
@@ -36283,14 +37577,38 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		return this.queryFacade.deleteDeviceEvents(input);
 	}
 	/** The events ops-log rows (newest-first), optionally scoped to one camera. */
-	async relocateMedia(input) {
+	async pauseForStorageMigration(input) {
+		if (this.storageMigrationLeaseId !== null && this.storageMigrationLeaseId !== input.leaseId) throw new Error("event-media writes are already paused by another storage migration");
+		this.storageMigrationLeaseId = input.leaseId;
+		try {
+			await this.mediaWriteGate.pause();
+			return { paused: true };
+		} catch (err) {
+			this.storageMigrationLeaseId = null;
+			throw err;
+		}
+	}
+	async resumeForStorageMigration(input) {
+		if (this.storageMigrationLeaseId === null) return { resumed: true };
+		if (this.storageMigrationLeaseId !== input.leaseId) throw new Error("event-media storage migration lease does not match");
+		this.mediaWriteGate.resume();
+		this.storageMigrationLeaseId = null;
+		return { resumed: true };
+	}
+	async refreshStorageLocationsForMigration(input) {
+		if (this.storageMigrationLeaseId !== input.leaseId) throw new Error("event-media storage migration lease does not match");
+		this.mediaLocationStorage?.invalidateRoots();
+		return { refreshed: true };
+	}
+	async startStorageMigrationMove(input) {
 		if (!this.mediaRelocate) throw new Error("media relocation unavailable");
+		if (this.storageMigrationLeaseId !== input.leaseId) throw new Error("event-media storage migration lease does not match");
 		return { jobId: this.mediaRelocate.start(input) };
 	}
-	async getMediaRelocateStatus() {
-		return this.mediaRelocate?.list() ?? [];
+	async getStorageMigrationMoveStatus(input) {
+		return this.mediaRelocate?.list().find((job) => job.jobId === input.jobId) ?? null;
 	}
-	async cancelMediaRelocate(input) {
+	async cancelStorageMigrationMove(input) {
 		return { cancelled: this.mediaRelocate?.cancel(input.jobId) ?? false };
 	}
 	async listOpsLog(input) {