@camstack/addon-provider-reolink 1.2.100 → 1.2.102

package/dist/addon.mjs

@@ -7648,1709 +7648,1713 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
+* Ops-log — the durable, append-only operations audit shared by the
+* recordings and events management surfaces.
 *
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
+* ONE row shape is reused for both domains so a single "Activity" view can
+* merge the recorder's DurableState ring (recordings ops-log) and the
+* pipeline-analytics SQLite collection (events ops-log). Each row records a
+* management operation, WHY it ran (reason), and its measurable effect
+* (itemsAffected + bytesReclaimed). Writes are best-effort — a failed log must
+* never fail the operation it records.
+*/
+/** Which management domain the operation belongs to. */
+var OpsLogDomainSchema = _enum(["recording", "events"]);
+/** The kind of management operation performed. */
+var OpsLogOpSchema = _enum([
+	"prune",
+	"manual-delete",
+	"rescan",
+	"retention-run",
+	"relocate",
+	"orphan-audit"
+]);
+/** Why the operation ran. */
+var OpsLogReasonSchema = _enum([
+	"retention",
+	"quota",
+	"manual",
+	"operator",
+	"maintenance",
+	"orphaned-device"
+]);
+/** One audit row, shared verbatim by both domains. */
+var OpsLogEntrySchema = object({
+	/** Unique row id. */
+	id: string(),
+	/** Epoch ms the operation completed. */
+	at: number(),
+	domain: OpsLogDomainSchema,
+	op: OpsLogOpSchema,
+	reason: OpsLogReasonSchema,
+	/** The camera the op targeted; null for a cluster/global op. */
+	deviceId: number().nullable(),
+	/** Node that performed the op (the log carries nodeId — no cross-node aggregation). */
+	nodeId: string(),
+	/** Buckets / rows deleted (op-specific unit). */
+	itemsAffected: number(),
+	/** Bytes reclaimed by the op (0 when not measurable). */
+	bytesReclaimed: number(),
+	/** Free-text detail (e.g. "floor moved to <ts>"); null when none. */
+	detail: string().nullable(),
+	/** Who/what triggered the op. */
+	actor: string()
+});
+/** Shared query input for the per-domain `listOpsLog` cap methods. */
+var OpsLogQueryInputSchema = object({
+	/** Restrict to a single camera; omit for every row. */
+	deviceId: number().optional(),
+	/** Max rows returned, newest-first. */
+	limit: number().int().min(1).max(1e3).optional()
+});
+var LabelDefinitionSchema = object({
+	id: string(),
+	name: string(),
+	category: string().optional(),
+	description: string().optional(),
+	icon: string().optional()
+});
+/** Detection-macro targets a catalog `classMap` may resolve to. */
+var CLASS_MAP_MACRO_TARGETS = [
+	"person",
+	"vehicle",
+	"animal",
+	"package"
+];
+/**
+* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
+* un operatore può selezionare.
 *
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
+* Sono le tre offerte dallo step `object-detection`
+* (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
+* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
+* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
+* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
+* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
+* (suitcase/backpack/handbag) lasciando spento il detector dedicato.
 *
-* ## Why a channel emits at `info`
+* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
+* dello step e una seconda volta come union `FirstLevelMacro`
+* (`types/detection.ts`); una terza copia per il trigger di registrazione
+* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
+* successiva.
+*/
+var FIRST_LEVEL_MACRO_CLASSES = [
+	"person",
+	"vehicle",
+	"animal"
+];
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
 *
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
 */
+var DetectionCatalogClassMapSchema = object({
+	mapping: record(string(), _enum(CLASS_MAP_MACRO_TARGETS)),
+	preserveOriginal: boolean()
+});
 /**
-* The level a channel writes at once armed.
+* Numeric day-of-week: 0 = Sunday … 6 = Saturday (matches `Date.getDay`).
+* Named `RecordingWeekday` to avoid collision with the string-union
+* `Weekday` exported from `interfaces/timezones.ts`.
+*/
+var RecordingWeekdaySchema = number().int().min(0).max(6);
+var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
+/**
+* DERIVED per-camera storage summary — the single field cheap consumers read
+* (the viewer's status dot, the camera list) instead of walking `bands`:
+*  - `off`               — no band covers the camera (or it is disabled).
+*  - `events`            — every band records around triggers only.
+*  - `continuous`        — at least one band records continuously.
+*  - `on-device-decision`— the DEVICE decides: recording runs for as long as the
+*    camera raises its own `recording-signal` level (a robot that cleans). There
+*    is no schedule to author, because there is no hour to program — see
+*    {@link RecordingConfigSchema}`.deviceDecision`.
 *
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
+* NEVER authored: the recorder stamps it from the authoritative intent
+* (`bands` + `deviceDecision`) on every save (`activeModeForConfig`). Writing it
+* has no effect.
+*
+* `on-device-decision` is named for WHO decides, not for how the recording is
+* requested. `on-demand` was rejected: in this repo's vocabulary a "demand" is
+* something the operator makes (the live gate is the recorder's own "demand
+* window"), and a knob whose name suggests the operator starts it while the
+* device actually does is the D62 shape — a control nobody can predict.
 */
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
+var RecordingStorageModeSchema = _enum([
+	"off",
+	"events",
+	"continuous",
+	"on-device-decision"
 ]);
 /**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
+* Le macro classi che possono aprire una finestra di registrazione — le stesse
+* tre offerte dallo step `object-detection`, da UNA lista
+* ({@link FIRST_LEVEL_MACRO_CLASSES}).
 */
-var LogChannelDescriptorSchema = object({
+var RecordingObjectTriggerClassSchema = _enum(FIRST_LEVEL_MACRO_CLASSES);
+/**
+* True quando `values` non ripete un elemento.
+*
+* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
+* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
+* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+*/
+var noDuplicates = (values) => new Set(values).size === values.length;
+/** Which detectors trigger an `events`-mode band. */
+var RecordingTriggersSchema = object({
+	motion: boolean().optional(),
+	audioThresholdDbfs: number().optional(),
 	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
+	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
+	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
+	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
+	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+	*
+	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
+	* quelle che hanno attraversato `enabledMacroClasses`, i
+	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
+	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
+	* finestre — vedi `recorder/object-trigger.ts`.
 	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
+	objectClasses: array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
 	/**
-	* Whether this channel can be narrowed to a camera.
+	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
+	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+	* `objectClasses`.
 	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
+	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
+	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
+	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
+	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+	* device (D12) — mai un elenco globale di cap.
 	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
+	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
+	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
+	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+	* il livello: un contatto trovato già aperto al riavvio del runner non fa
+	* registrare.
 	*/
-	perDevice: boolean()
+	sensorDeviceIds: array(number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
 /**
-* An armed window over one channel, as the document hands it to a mirror.
+* Mode of a single recording band — the recorder per-band vocabulary.
 *
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
+* Distinct from `RecordingStorageModeSchema` (which carries `off`): a band is
+* only ever `continuous` or `events`; "off" is expressed by the absence of a
+* covering band, not by a band value.
 */
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
+var RecordingBandModeSchema = _enum(["continuous", "events"]);
 /**
-* The gate a hot path holds.
+* Triggers for an `events`-mode band. Identical shape to
+* `RecordingTriggersSchema` — reuse that schema as the band trigger type so the
+* two never drift.
+*/
+var RecordingBandTriggersSchema = RecordingTriggersSchema;
+/**
+* A single mode-per-band window — the canonical recorder band shape, the
+* single source of truth re-used by `addon-pipeline/recorder`.
 *
-* Obtain it ONCE — at module scope or in a constructor — and keep the
-* reference. Looking a channel up by name per line would put a Map lookup on
-* the path this class exists to keep free.
+* `days` lists the weekdays the band covers (empty = every day, matching the
+* band engine's `applies` rule). `start`/`end` are `HH:MM`; an `end <= start`
+* span wraps past midnight (handled by the band engine).
 */
-var LogChannelGate = class {
-	descriptor;
+var RecordingBandSchema = object({
+	days: array(RecordingWeekdaySchema),
+	start: string().regex(HHMM),
+	end: string().regex(HHMM),
+	mode: RecordingBandModeSchema,
+	triggers: RecordingBandTriggersSchema.optional(),
 	/**
-	* HOT PATH GUARD. A plain data FIELD, and it must stay one.
+	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
 	*
-	* `log-channel.spec.ts` asserts the property descriptor has no getter and
-	* booby-traps the device set, so turning this into an accessor — or reading
-	* anything before it — fails the spec instead of taxing every line the
-	* process emits.
+	* It was the retroactive KEEP bound — which already-written segments survive
+	* a trigger — and it had to be at least as wide as the widest pre-roll the
+	* broker could serve, or the gate would delete the seconds the ring had just
+	* handed the writer. That "at least as wide as" is the tell: it was a second
+	* expression of the broker's retention, in different units, in a different
+	* addon, with an invariant the operator had to maintain by hand. The keep
+	* bound is now derived from the one prebuffer ceiling and there is nothing
+	* left to configure here.
+	*
+	* The key survives in the SHAPE so a config written before that record still
+	* parses and can be migrated deliberately — `RecordingBandSchema` is not
+	* strict, so simply deleting it would strip an operator's value in silence on
+	* the next save (the failure D380 came one commit from shipping). Nothing
+	* reads it: {@link stripRetiredBandPreBufferSec} removes it on load.
 	*/
-	on = false;
-	/** `null` while armed for every camera. Never read while `on` is false. */
-	devices = null;
-	level;
-	closesAtMs = 0;
-	constructor(descriptor) {
-		this.descriptor = descriptor;
-		this.level = descriptor.defaultLevel;
-	}
-	/** Epoch ms this channel disarms itself at. 0 when disarmed. */
-	get armedUntilMs() {
-		return this.on ? this.closesAtMs : 0;
-	}
+	preBufferSec: number().min(0).optional(),
+	postBufferSec: number().min(0).optional()
+});
+({ postBufferSec: 30 }).postBufferSec * 1e3;
+/**
+* Per-device retention overrides. Every field is optional; an unset or `0`
+* value inherits the node-wide recorder default. Only footage-lifetime limits
+* live per-camera: `maxAgeDays` and `maxSizeGb`. The disk-occupancy threshold
+* (when the volume is too full to keep recording) is NOT a per-camera concern —
+* it belongs to the StorageLocation (`StorageLocation.config.minFreePercent`),
+* shared by every camera writing to that volume.
+*/
+var RecordingRetentionSchema = object({
+	maxAgeDays: number().min(0).optional(),
+	maxSizeGb: number().min(0).optional()
+});
+/**
+* The full per-camera recording intent — the wire shape of a RecordingTarget.
+*
+* `bands` is the ONLY authored recording intent: what to record, when, and on
+* which trigger. `mode` is a derived summary the recorder stamps on save; every
+* other field is a storage knob (profiles, segment length, retention, scrub).
+*
+* STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
+* A stale caller must fail loudly — silently stripping its legacy intent would
+* persist a band-less config, i.e. silently stop recording the camera.
+*/
+var RecordingConfigSchema = object({
+	enabled: boolean(),
+	/** DERIVED summary of `bands`, stamped by the recorder on every save.
+	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
+	mode: RecordingStorageModeSchema.optional(),
 	/**
-	* Does this channel want a line about `deviceId`?
-	*
-	* Call it only behind `gate.on &&`. On its own it is still correct — the
-	* guard is repeated inside — but the point of the prefix is that a disarmed
-	* channel must not pay the call at all.
+	* Which assigned broker slots to record. Absent / empty = {@link
+	* DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
+	* camera's currently assigned slots — never `mid` unless the operator
+	* picks it, and never a slot the broker has not assigned.
 	*/
-	wants(deviceId) {
-		if (!this.on) return false;
-		return this.devices === null || this.devices.has(deviceId);
-	}
+	profiles: array(CamProfileSchema).optional(),
+	segmentSeconds: number().int().positive().optional(),
 	/**
-	* Emit one line on this channel, at the channel's declared level.
-	*
-	* The channel name is added as `tags.logChannel` so LogQL can select the
-	* channel without matching on the message text, and whatever `tags` the
-	* caller passed — `deviceId` above all — is preserved.
+	* AUTHORITATIVE mode-per-band recording model — the single source of truth
+	* the recorder's band engine consumes. An empty array = record nothing;
+	* "off" is the absence of a covering band, never a band value.
 	*/
-	log(logger, message, extras) {
-		if (!this.on) return;
-		const tags = {
-			...extras.tags,
-			logChannel: this.descriptor.name
-		};
-		const line = {
-			...extras,
-			tags
-		};
-		if (this.level === "error") logger.error(message, line);
-		else if (this.level === "warn") logger.warn(message, line);
-		else logger.info(message, line);
-	}
+	bands: array(RecordingBandSchema).default([]),
 	/**
-	* Arm (or RE-arm, restarting) this channel. Off the hot path only.
+	* THE device-decided intent: record for as long as the camera itself raises
+	* `recording-signal` (`active: true` while the device is in function — a
+	* robot that cleans). AUTHORED, unlike `mode`, and the only authored
+	* recording intent that is not a band.
 	*
-	* An empty `deviceIds` list is treated as "every camera" rather than "no
-	* camera": a window that matches nothing is indistinguishable from a
-	* disarmed one, and the operator who asked for it would wait for lines that
-	* can never come.
+	* It carries NO schedule on purpose. A band is an HOUR, and this feature has
+	* no hour to program: the device decides. What it costs the operator is one
+	* flag — "this camera can record on its own" — and what it buys is the same
+	* hold/release the recorder already implements (D371, `holdTrigger` /
+	* `releaseTrigger`): the window opens on the rise, stays open for the whole
+	* job however long it is, and closes one pad after the fall.
+	*
+	* EXCLUSIVE with `bands` (below): two authorities deciding when the same
+	* camera records is the D62 failure. `off` remains `enabled: false`, so an
+	* operator switching this camera off is REPORTED off, never as broken.
 	*/
-	arm(window) {
-		const ids = window.deviceIds;
-		this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
-		this.closesAtMs = window.armedUntilMs;
-		this.on = true;
-	}
-	/** Disarm. Off the hot path only. */
-	disarm() {
-		this.on = false;
-		this.devices = null;
-		this.closesAtMs = 0;
-	}
-};
+	deviceDecision: boolean().optional(),
+	retention: RecordingRetentionSchema.optional()
+}).strict().refine((config) => config.deviceDecision !== true || config.bands.length === 0, {
+	message: "deviceDecision is a whole-config mode and carries no schedule: it cannot be combined with bands",
+	path: ["bands"]
+});
 /**
-* Every channel this PROCESS declares, and the mirror of what is armed on it.
+* Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
-* One per process. A forked runner has its own, and it is refreshed through
-* the `log-channels` capability by the hub that owns the document — the
-* registry never reaches for a value itself.
+* One shape shared by the recorder and pipeline-analytics internal movers.
+* The public admin surface is `storage-migration`; child jobs remain in RAM
+* because copy-if-absent, verify, delete and index/row repoint are resumable.
+* Each completed/failed run also lands one durable ops-log row on its owning
+* addon surface.
 */
-var LogChannelRegistry = class {
-	gates = /* @__PURE__ */ new Map();
+/**
+* `queued` exists because the recorder mover is SINGLE-FLIGHT and an operator
+* rebalance enqueues one job per (camera, profile). Refusing the second job —
+* what the engine did before — turned a fifteen-camera rebalance into fifteen
+* manual retries. Queued jobs run FIFO; a queued job that is cancelled never
+* runs at all.
+*/
+var RelocateJobStateSchema = _enum([
+	"queued",
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var RelocateJobSchema = object({
+	jobId: string(),
+	state: RelocateJobStateSchema,
+	/** Source location — for media relocation this is informational ('*': rows
+	*  move from wherever they are to the target). */
+	fromLocationId: string(),
+	toLocationId: string(),
+	/** Scoped device, or null = every device. */
+	deviceId: number().nullable(),
+	/** What the job moves (owner-addon specific: segments or media). */
+	entities: array(string()),
+	filesMoved: number().int(),
+	bytesMoved: number().int(),
+	/** Total files discovered up front; null while (or when) unknown. */
+	filesTotal: number().int().nullable(),
 	/**
-	* Declare a channel and get its gate.
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
 	*
-	* A duplicate name throws. Two declarations of one name is a programming
-	* error, not a merge: the operator would arm one and the other would stay
-	* dark, which is the dead-knob shape (D62) with an extra step.
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
 	*/
-	declare(descriptor) {
-		const parsed = LogChannelDescriptorSchema.parse(descriptor);
-		if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process — two declarations of one name is a programming error, not a merge`);
-		const gate = new LogChannelGate(parsed);
-		this.gates.set(parsed.name, gate);
-		return gate;
-	}
-	/** The declarations, sorted by name so a list is stable to read and diff. */
-	list() {
-		return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
-	}
-	/** The gate for a declared channel, or `undefined`. */
-	gate(name) {
-		return this.gates.get(name);
-	}
+	rowsReconciled: number().int().nonnegative().optional(),
 	/**
-	* Apply the FULL set of armed windows. Off the hot path.
-	*
-	* Full, not incremental, and that is the whole design: the document is the
-	* authority, so a channel the document does not name is disarmed here. An
-	* incremental apply would let a disarm get lost in transit and leave a
-	* channel running that nobody can see is running.
+	* Rows this run FORGOT because the file they name is not on disk.
 	*
-	* A window already past its deadline is ignored rather than armed — a
-	* restore that re-armed an expired window would make a forgotten diagnostic
-	* immortal across restarts.
+	* The mover derived the path from the row's own fields and `stat`ed it; an
+	* ENOENT there is a per-path confirmation that the segment is gone (D296),
+	* and the durable row is dropped through the same channel eviction uses. It
+	* is reported for the same reason `rowsReconciled` is: this is a durable
+	* mutation nobody asked for, and a migration that quietly erases hour rows is
+	* the same failure as one that quietly skips them (D295).
 	*
-	* Returns the names it could not place, so the caller can log them: a
-	* channel named in the document that this process does not declare is
-	* either a typo or an addon that has not booted yet, and both deserve a
-	* line rather than silence.
+	* The production drain of 2026-08-30 would have reported 11 074 here — the
+	* ledger claimed 5.65 GB of footage that no longer existed.
 	*/
-	apply(windows, nowMs) {
-		const wanted = /* @__PURE__ */ new Map();
-		const unknown = [];
-		for (const window of windows) {
-			if (window.armedUntilMs <= nowMs) continue;
-			if (!this.gates.has(window.channel)) {
-				unknown.push(window.channel);
-				continue;
-			}
-			wanted.set(window.channel, window);
-		}
-		for (const [name, gate] of this.gates) {
-			const window = wanted.get(name);
-			if (window === void 0) gate.disarm();
-			else gate.arm(window);
-		}
-		return unknown;
-	}
+	rowsForgotten: number().int().nonnegative().optional(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	error: string().nullable()
+});
+/** Profile-derived footage selection used only by the migration coordinator:
+* `recordings` owns high+mid; `recordingsLow` owns low. */
+var RelocateFootageClassSchema = _enum(["recordings", "recordingsLow"]);
+var RelocateFootageInputSchema = object({
+	fromLocationId: string(),
+	toLocationId: string(),
+	entities: array(_enum(["segments"])).optional(),
+	/** Limits relocation to the logical profile class. Omit only for the
+	* pre-orchestration compatibility path. */
+	footageClass: RelocateFootageClassSchema.optional(),
+	/** Scope the move to ONE camera. Absent = every camera on the source, which
+	*  is what a whole-disk drain means. The rebalance path always sets it: its
+	*  unit is a (camera, profile) pile, not a disk. */
+	deviceId: number().int().optional(),
+	/** Scope the move to specific segment profiles (`high` / `mid` / `low`).
+	*  Finer than `footageClass`, which cannot separate high from mid — and the
+	*  placement plan assigns those two independently, so a rebalance that could
+	*  only say "recordings" would move footage the plan never asked to move. */
+	profiles: array(string()).optional(),
+	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
+	*  never allowed to starve live writers. */
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Move only segments whose startMs is >= this. Absent = the whole source
+	*  pile. Used when a full drain is too expensive and the operator only
+	*  wants the recent window on the new disk. */
+	sinceMs: number().int().optional()
+});
+/** Internal, lease-scoped participant operation. It is intentionally separate
+* from persistent recording settings: a migration never changes
+* `RecordingConfig.enabled` or camera wrapper bindings. */
+var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
+var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
+/**
+* What a `relocateMedia` pass DOES. One engine, three passes — never a second
+* mover (the engine already walks both collections with a timestamp cursor and
+* already has a stamp-without-copy path).
+*
+*  - `move`    — the default and the historical behaviour: event-media and
+*                retrain blobs move to `toLocationId` and their rows are
+*                stamped. The enrolled gallery is skipped (D197).
+*  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
+*                stamped with `toLocationId`. `toLocationId` here is the id the
+*                bytes ALREADY sit on — today's `eventMedia` default — because
+*                a NULL row means "wherever `eventMedia` points *now*", and the
+*                instant a repoint moves that pointer the row reads from the
+*                new disk while its bytes are on the old one.
+*  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
+*                (enrolled-gallery) rows, which `move` deliberately skips.
+*                `galleryMedia` is `cardinality: 'single'`, so this pass can
+*                never run beside a live second location: it is stop-the-world
+*                by construction, which is acceptable only because the gallery
+*                is a few KB per enrolled sample.
+*/
+var MediaRelocateModeSchema = _enum([
+	"move",
+	"seal",
+	"gallery"
+]);
+var RelocateMediaInputSchema = object({
+	toLocationId: string(),
 	/**
-	* Disarm whatever has run out. Called on a timer, NEVER from a log path — a
-	* diagnostic that adds a `Date.now()` to the path it is measuring measures
-	* itself.
-	*
-	* Returns the names it closed, so the caller can write the one line that
-	* says a window ended and stops "it went quiet" from reading as "the branch
-	* was not taken".
+	* Restrict the pass to rows currently on this location. Omitted / `'*'` =
+	* every row that is not already on `toLocationId` (the historical
+	* behaviour). A named source is what a from→to migration needs: without it
+	* "move events off disk 2" also emptied disk 1.
 	*/
-	tick(nowMs) {
-		const closed = [];
-		for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
-			gate.disarm();
-			closed.push(name);
-		}
-		return closed;
-	}
-	/** The channels armed right now, as the document would describe them. */
-	armed() {
-		const out = [];
-		for (const [name, gate] of this.gates) if (gate.on) out.push({
-			channel: name,
-			armedUntilMs: gate.armedUntilMs,
-			deviceIds: null
-		});
-		return out;
-	}
-};
+	fromLocationId: string().optional(),
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Omitted = `move`, the pre-existing behaviour. */
+	mode: MediaRelocateModeSchema.optional()
+});
 /**
-* Process-wide holder for the {@link LogChannelRegistry}.
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
 *
-* Three call sites that never meet need the SAME instance: the hot paths that
-* declare a gate at module scope, the `log-channels` provider that enumerates
-* the declarations for the hub, and the same provider applying the windows the
-* document hands down. A registry built inside any one of them would be
-* refreshed and collected — the shape of a knob that never does anything.
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
 *
-* Same idiom as `logging-gate.singleton.ts` and
-* `http-request-census.singleton.ts`.
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
 */
-var instance = null;
-/** The process-wide log channel registry. Created empty on first use. */
-function getLogChannelRegistry() {
-	instance ??= new LogChannelRegistry();
-	return instance;
-}
+var UnstampedRowsSchema = object({
+	present: boolean(),
+	rows: number().int().nonnegative().nullable()
+});
 /**
-* Declare a channel on the process-wide registry and get its gate.
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
 *
-* The one call an addon makes. Keep the returned gate in a module-scope
-* `const`: looking a channel up by name per line would put a Map lookup on
-* exactly the path this mechanism exists to keep free.
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: number().int().nonnegative().nullable()
+}).nullable();
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
+/** The independently selectable logical storage classes — every class
+* `storage.listLocationDeclarations` reports, so an operator never meets a
+* Zod enum error where they should meet an explanation.
 *
-* `scripts/check-log-channel-gated.ts` reads these call sites. It pairs the
-* declared name with the binding it is assigned to and refuses to let a
-* channel ship that no `<binding>.on` anywhere consults — a declared channel
-* nobody reads is a knob the operator turns with nothing happening, forever,
-* and without a line. That is D62, and this repo has now shipped it three
-* times (`audioThresholdDbfs`, the HA entities with no source, the second
-* per-camera switch that wrote a store nobody read).
+* `recordings` encompasses the high and mid segment profiles; `recordingsLow`
+* is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
+* enrolled gallery; `backups` is the system backup archive. The last two have
+* their own rules — see {@link StorageMigrationFindingCodeSchema}. */
+var StorageMigrationClassSchema = _enum([
+	"recordings",
+	"recordingsLow",
+	"eventMedia",
+	"backups",
+	"galleryMedia"
+]);
+/** A destination is always an existing, fully-qualified location id. The
+* migration API intentionally never changes a source location's `basePath`:
+* callers create a new `<type>:<slug>` location, then select it here. */
+var StorageMigrationDestinationsSchema = object({
+	recordings: string().min(1).optional(),
+	recordingsLow: string().min(1).optional(),
+	eventMedia: string().min(1).optional(),
+	backups: string().min(1).optional(),
+	galleryMedia: string().min(1).optional()
+}).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+/**
+* Optional named source per class. Omitted = the class's current default
+* (the historical behaviour). A named source that is NOT the default is a
+* drain of that disk: bytes move, the default stays, and the source is
+* disabled when the move finishes.
 */
-function declareLogChannel(descriptor) {
-	return getLogChannelRegistry().declare(descriptor);
-}
+var StorageMigrationSourcesSchema = object({
+	recordings: string().min(1).optional(),
+	recordingsLow: string().min(1).optional(),
+	eventMedia: string().min(1).optional(),
+	backups: string().min(1).optional(),
+	galleryMedia: string().min(1).optional()
+}).optional();
 /**
-* Build the `log-channels` provider for this process.
+* How a migration sequences the cutover against the byte move.
 *
-* `logger` is used ONLY off the hot path — for the arm/expiry lines — so a
-* channel that is never armed costs this module nothing but a timer.
+*  - `blocking`     — the historical order: pause, move every byte, repoint,
+*                     resume. Recording is stopped for the whole move. Right
+*                     for a small or a cold class, and the only legal mode for
+*                     a `cardinality: 'single'` class.
+*  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
+*                     refresh, resume, then move the past with everything
+*                     running. The pause is three bounded instants (a detach +
+*                     attach round, a write-gate drain, a lease) instead of one
+*                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
+*                     stopped recording under `blocking`; the same move is
+*                     seconds of stopped recording under `nonBlocking`.
+*
+* The mode is on the JOB, not only on the input, because `status` is where an
+* operator finds out which one is running.
 */
-function createLogChannelsProvider(logger, options = {}) {
-	const registry = getLogChannelRegistry();
-	const now = options.now ?? Date.now;
-	const tickMs = options.tickMs ?? 5e3;
-	const timer = setInterval(() => {
-		const closed = registry.tick(now());
-		for (const name of closed) logger.info("log channel window closed", {
-			tags: { logChannel: name },
-			meta: { channel: name }
-		});
-	}, tickMs);
-	timer.unref?.();
-	return {
-		list: () => registry.list(),
-		apply: (input) => {
-			const unknown = registry.apply(input.windows, now());
-			const armed = registry.armed();
-			logger.info("log channels applied", { meta: {
-				armed: armed.map((window) => window.channel),
-				unknown,
-				declared: registry.list().length
-			} });
-			return {
-				armed: armed.length,
-				unknown
-			};
-		},
-		stop: () => {
-			clearInterval(timer);
-		}
-	};
-}
+var StorageMigrationModeSchema = _enum(["blocking", "nonBlocking"]);
+/** Shared input for planning and starting an orchestrated storage migration. */
+var StorageMigrationInputSchema = object({
+	destinations: StorageMigrationDestinationsSchema,
+	/** Omitted = each class's current default. */
+	sources: StorageMigrationSourcesSchema,
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Omitted = `blocking`, which stays the default. */
+	mode: StorageMigrationModeSchema.optional()
+});
 /**
-* Ops-log — the durable, append-only operations audit shared by the
-* recordings and events management surfaces.
+* The durable coordinator state machine.
 *
-* ONE row shape is reused for both domains so a single "Activity" view can
-* merge the recorder's DurableState ring (recordings ops-log) and the
-* pipeline-analytics SQLite collection (events ops-log). Each row records a
-* management operation, WHY it ran (reason), and its measurable effect
-* (itemsAffected + bytesReclaimed). Writes are best-effort — a failed log must
-* never fail the operation it records.
+* `blocking`:
+*   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
+*
+* `nonBlocking`:
+*   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
+*
+* Same phases, different order plus two new ones — not a second mover.
+* `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
+* `draining` runs the same movers UNLEASED, after every writer is back up.
+* `repointing` is still the only phase that changes a default location.
 */
-/** Which management domain the operation belongs to. */
-var OpsLogDomainSchema = _enum(["recording", "events"]);
-/** The kind of management operation performed. */
-var OpsLogOpSchema = _enum([
-	"prune",
-	"manual-delete",
-	"rescan",
-	"retention-run",
-	"relocate",
-	"orphan-audit"
+var StorageMigrationPhaseSchema = _enum([
+	"planning",
+	"sealing",
+	"pausing",
+	"moving",
+	"draining",
+	"verifying",
+	"repointing",
+	"refreshing",
+	"resuming",
+	"done",
+	"failed",
+	"cancelled"
 ]);
-/** Why the operation ran. */
-var OpsLogReasonSchema = _enum([
-	"retention",
-	"quota",
-	"manual",
-	"operator",
-	"maintenance",
-	"orphaned-device"
+var StorageMigrationParticipantSchema = _enum([
+	"pipeline",
+	"recorder",
+	"analytics"
 ]);
-/** One audit row, shared verbatim by both domains. */
-var OpsLogEntrySchema = object({
-	/** Unique row id. */
-	id: string(),
-	/** Epoch ms the operation completed. */
-	at: number(),
-	domain: OpsLogDomainSchema,
-	op: OpsLogOpSchema,
-	reason: OpsLogReasonSchema,
-	/** The camera the op targeted; null for a cluster/global op. */
-	deviceId: number().nullable(),
-	/** Node that performed the op (the log carries nodeId — no cross-node aggregation). */
-	nodeId: string(),
-	/** Buckets / rows deleted (op-specific unit). */
-	itemsAffected: number(),
-	/** Bytes reclaimed by the op (0 when not measurable). */
-	bytesReclaimed: number(),
-	/** Free-text detail (e.g. "floor moved to <ts>"); null when none. */
-	detail: string().nullable(),
-	/** Who/what triggered the op. */
-	actor: string()
+/**
+* The mover's own numbers, folded onto the coordinator's durable move record.
+*
+* The long half of a non-blocking migration is `draining`, and it is measured
+* in hours: 136 885 files at ~4 MB/s is about five of them. Before this shape
+* existed the only place those numbers appeared was a Loki line, so an operator
+* watching the Admin UI saw `phase: draining` and nothing else for a whole
+* afternoon.
+*
+* It is POLLED, never pushed. Events are telemetry and may be dropped
+* (D8/D11), and a dropped progress event is indistinguishable from a stalled
+* mover — which is the exact failure this is meant to end. The coordinator's
+* `waitForMoves` already fetches the whole {@link RelocateJob} on every tick to
+* read `state`; folding the counters costs no extra read and makes the durable
+* record say afterwards how far a move actually got.
+*
+* `filesTotal` is `null` for "no honest denominator" and is never zero-filled:
+* a windowed footage job (`sinceMs`) and a node with no ledger both genuinely
+* cannot say M, and a 0 there would render as "100 % done".
+*/
+var StorageMigrationMoveProgressSchema = object({
+	filesMoved: number().int().nonnegative(),
+	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
+	filesTotal: number().int().nonnegative().nullable(),
+	bytesMoved: number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: number().int().nonnegative().optional(),
+	/** The MOVER's start, not the migration's: a drain restarted after an addon
+	*  crash gets a new mover, and a rate computed from the migration's start
+	*  would silently average in the time nothing was running. */
+	startedAt: number(),
+	/** When the coordinator last read these numbers. Paired with `startedAt` it
+	*  is the only honest rate: both clocks are the hub's, so a UI never has to
+	*  subtract its own. */
+	observedAt: number()
 });
-/** Shared query input for the per-domain `listOpsLog` cap methods. */
-var OpsLogQueryInputSchema = object({
-	/** Restrict to a single camera; omit for every row. */
-	deviceId: number().optional(),
-	/** Max rows returned, newest-first. */
-	limit: number().int().min(1).max(1e3).optional()
+var StorageMigrationMoveSchema = object({
+	storageClass: StorageMigrationClassSchema,
+	fromLocationId: string(),
+	toLocationId: string(),
+	/**
+	* True when `from` was NOT the class default at plan time. The move still
+	* copies bytes, but the default is left alone and the source is disabled
+	* once the copy verifies. Absent on jobs planned before this field existed
+	* — those jobs always repointed, which is `false`.
+	*/
+	freezeSource: boolean().optional(),
+	moverJobId: string().nullable(),
+	state: RelocateJobStateSchema.nullable(),
+	error: string().nullable(),
+	/** Last observed mover counters; `null` until the mover has been polled once. */
+	progress: StorageMigrationMoveProgressSchema.nullable()
 });
-var LabelDefinitionSchema = object({
-	id: string(),
-	name: string(),
-	category: string().optional(),
-	description: string().optional(),
-	icon: string().optional()
+var StorageMigrationJobSchema = object({
+	jobId: string(),
+	phase: StorageMigrationPhaseSchema,
+	/** Which order this job is running. `status` is the only place an operator
+	*  can tell a seconds-long cutover from a thirty-hour one. */
+	mode: StorageMigrationModeSchema,
+	destinations: StorageMigrationDestinationsSchema,
+	sources: StorageMigrationSourcesSchema,
+	throttleMbps: number(),
+	moves: array(StorageMigrationMoveSchema),
+	pauseLeaseId: string().nullable(),
+	pausedParticipants: array(StorageMigrationParticipantSchema),
+	repointed: boolean(),
+	cancelRequested: boolean(),
+	startedAt: number(),
+	updatedAt: number(),
+	finishedAt: number().nullable(),
+	error: string().nullable()
+});
+var StorageMigrationFindingSchema = object({
+	code: _enum([
+		"sharesDeviceWithSource",
+		"deviceIdentityUnknown",
+		"unstampedEventMediaRows",
+		"blockingOnly",
+		"noMover"
+	]),
+	storageClass: StorageMigrationClassSchema,
+	/** Human-readable, already carrying the ids and counts. */
+	message: string()
+});
+var StorageMigrationPlanSchema = object({
+	destinations: StorageMigrationDestinationsSchema,
+	sources: StorageMigrationSourcesSchema,
+	/** The mode this plan was built for. A plan is only valid for its mode: the
+	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
+	*  it. */
+	mode: StorageMigrationModeSchema,
+	moves: array(object({
+		storageClass: StorageMigrationClassSchema,
+		fromLocationId: string(),
+		toLocationId: string(),
+		freezeSource: boolean().optional()
+	})),
+	findings: array(StorageMigrationFindingSchema)
 });
-/** Detection-macro targets a catalog `classMap` may resolve to. */
-var CLASS_MAP_MACRO_TARGETS = [
-	"person",
-	"vehicle",
-	"animal",
-	"package"
-];
 /**
-* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
-* un operatore può selezionare.
+* A mover as it exists RIGHT NOW, whether or not a migration job owns it.
 *
-* Sono le tre offerte dallo step `object-detection`
-* (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
-* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
-* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
-* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
-* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
-* (suitcase/backpack/handbag) lasciando spento il detector dedicato.
+* The coordinator's job record is the state of record for a migration, and its
+* moves carry {@link StorageMigrationMoveProgress}. But the movers are usable
+* standalone — `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+* are both operator-callable, and on 2026-08-29 a five-hour drain was armed that
+* way because no supported UI path existed. A mover armed like that has no job
+* to fold progress into, so it has to be readable on its own or it is invisible.
 *
-* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
-* dello step e una seconda volta come union `FirstLevelMacro`
-* (`types/detection.ts`); una terza copia per il trigger di registrazione
-* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
-* successiva.
+* `migrationJobId` is what tells the two apart: `null` means nothing here
+* orchestrated it.
 */
-var FIRST_LEVEL_MACRO_CLASSES = [
-	"person",
-	"vehicle",
-	"animal"
-];
+var StorageMigrationMoverSchema = object({
+	lane: _enum(["footage", "media"]),
+	job: RelocateJobSchema,
+	/** The coordinator job that armed this mover, or `null` for a mover armed
+	*  directly against the owning addon. */
+	migrationJobId: string().nullable(),
+	/** When the hub read these counters. Stamped here so a rate is `bytesMoved`
+	*  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
+	*  a browser subtracting its own `Date.now()` from a server `startedAt` is a
+	*  rate made of two different clocks. */
+	observedAt: number()
+});
 /**
-* Wire schema for a per-model CATALOG classMap override
-* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
-* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
-* detection pipeline executor actually routes.
+* What a SOURCE still holds for one storage class — the number that makes a
+* "drain remaining" action honest rather than hopeful.
 *
-* This is deliberately a DIFFERENT, narrower shape than the general-purpose
-* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
-* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
-* enum) — the two used to share the name `ClassMapDefinition`/
-* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
-* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
-* are not: it is two different concepts colliding on a name. Keep this type
-* under its own name rather than reusing `ClassMapDefinition` — reusing it
-* would either narrow every `ClassMapDefinition` consumer to the four
-* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
-* schema exists for (see the "rejects a classMap whose target is not a
-* detection macro" test in `model-catalog-schema.test.ts`).
+* It comes from the archive (`SegmentHourLedger.census` for footage, the media
+* engine's own selection count for media), never from the resident index: a
+* drain sized off `RecordingIndex` is what reported `done` over 80.3 GB it had
+* never been told about (D295).
+*
+* `items`/`bytes` are `null` for "the archive could not be asked", which is
+* deliberately NOT zero: a drain is still offered for an unknown residue,
+* because refusing on an unanswerable read would hide exactly the case an
+* operator needs to act on.
 */
-var DetectionCatalogClassMapSchema = object({
-	mapping: record(string(), _enum(CLASS_MAP_MACRO_TARGETS)),
-	preserveOriginal: boolean()
+var StorageMigrationResidueSchema = object({
+	storageClass: StorageMigrationClassSchema,
+	/** The location still holding the data. `'*'` for the media lane, whose rows
+	*  move from wherever they are rather than from one named source. */
+	fromLocationId: string(),
+	/** Where a drain would move it — the class's CURRENT default. */
+	toLocationId: string(),
+	/** Segments (footage lane) or rows (media lane) still on the source. */
+	items: number().int().nonnegative().nullable(),
+	/** Bytes on the source; `null` when the lane counts rows rather than bytes. */
+	bytes: number().int().nonnegative().nullable()
 });
 /**
-* Numeric day-of-week: 0 = Sunday … 6 = Saturday (matches `Date.getDay`).
-* Named `RecordingWeekday` to avoid collision with the string-union
-* `Weekday` exported from `interfaces/timezones.ts`.
-*/
-var RecordingWeekdaySchema = number().int().min(0).max(6);
-var HHMM = /^([01]\d|2[0-3]):[0-5]\d$/;
-/**
-* DERIVED per-camera storage summary — the single field cheap consumers read
-* (the viewer's status dot, the camera list) instead of walking `bands`:
-*  - `off`               — no band covers the camera (or it is disabled).
-*  - `events`            — every band records around triggers only.
-*  - `continuous`        — at least one band records continuously.
-*  - `on-device-decision`— the DEVICE decides: recording runs for as long as the
-*    camera raises its own `recording-signal` level (a robot that cleans). There
-*    is no schedule to author, because there is no hour to program — see
-*    {@link RecordingConfigSchema}`.deviceDecision`.
+* Run the DRAIN half and nothing else.
 *
-* NEVER authored: the recorder stamps it from the authoritative intent
-* (`bands` + `deviceDecision`) on every save (`activeModeForConfig`). Writing it
-* has no effect.
+* A migration that reached `done` has already repointed, so `start` correctly
+* refuses its destination ("already the default") — there is nothing left to
+* repoint. But the drain can fail, be cancelled, be interrupted by a restart,
+* or finish against a work list that was a tenth of the archive (D295), and
+* before this there was no supported way to run only that half: the only way
+* through was calling `recording.relocateFootage` by hand over admin tRPC.
 *
-* `on-device-decision` is named for WHO decides, not for how the recording is
-* requested. `on-demand` was rejected: in this repo's vocabulary a "demand" is
-* something the operator makes (the live gate is the recorder's own "demand
-* window"), and a knob whose name suggests the operator starts it while the
-* device actually does is the D62 shape — a control nobody can predict.
-*/
-var RecordingStorageModeSchema = _enum([
-	"off",
-	"events",
-	"continuous",
-	"on-device-decision"
-]);
-/**
-* Le macro classi che possono aprire una finestra di registrazione — le stesse
-* tre offerte dallo step `object-detection`, da UNA lista
-* ({@link FIRST_LEVEL_MACRO_CLASSES}).
+* `drain` NEVER calls `setDefaultLocations`. That is what keeps `start`'s
+* refusal meaningful: the two verbs are disjoint, so nothing here can silently
+* re-repoint a class that is already migrated.
 */
-var RecordingObjectTriggerClassSchema = _enum(FIRST_LEVEL_MACRO_CLASSES);
+var StorageMigrationDrainInputSchema = object({
+	/** The classes to drain. Each must appear in `storageMigration.residue`, so
+	*  a class whose source is already empty is refused rather than started. */
+	classes: array(StorageMigrationClassSchema).min(1),
+	throttleMbps: number().min(1).max(1e3).optional()
+});
+/** What a footage source still holds, asked of the durable hour ledger. */
+var RelocateResidueInputSchema = object({
+	fromLocationId: string().min(1),
+	/** Narrow to one logical class; omit for every profile on the location. */
+	footageClass: RelocateFootageClassSchema.optional()
+});
+/** `null` = the archive could not answer (no ledger on this node, or the
+*  aggregate failed). Never conflated with an empty source. */
+var RelocateResidueSchema = object({
+	segments: number().int().nonnegative(),
+	bytes: number().int().nonnegative()
+}).nullable();
 /**
-* True quando `values` non ripete un elemento.
+* Ask one location whether its durable hour rows describe the disk — the walk
+* (D319).
 *
-* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
-* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
-* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+* `apply` DEFAULTS TO FALSE and that default is the product: the operator's
+* missing tool is the question, and the dry run is how they sanity-check the
+* destructive run before authorising it.
 */
-var noDuplicates = (values) => new Set(values).size === values.length;
-/** Which detectors trigger an `events`-mode band. */
-var RecordingTriggersSchema = object({
-	motion: boolean().optional(),
-	audioThresholdDbfs: number().optional(),
-	/**
-	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
-	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
-	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
-	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
-	*
-	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
-	* quelle che hanno attraversato `enabledMacroClasses`, i
-	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
-	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
-	* finestre — vedi `recorder/object-trigger.ts`.
-	*/
-	objectClasses: array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
-	/**
-	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
-	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
-	* `objectClasses`.
-	*
-	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
-	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
-	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
-	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
-	* device (D12) — mai un elenco globale di cap.
-	*
-	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
-	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
-	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
-	* il livello: un contatto trovato già aperto al riavvio del runner non fa
-	* registrare.
-	*/
-	sensorDeviceIds: array(number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
+var LedgerWalkInputSchema = object({
+	locationId: string().min(1),
+	/** Forget the confirmed-absent rows, rather than only counting them. */
+	apply: boolean().optional(),
+	/** Narrow to one camera. */
+	deviceId: number().int().positive().optional(),
+	/** Narrow to these recording profiles; empty/absent = every profile. */
+	profiles: array(string().min(1)).optional()
+});
+/** Why a whole walk did nothing. Every one leaves the ledger untouched. */
+var LedgerWalkRefusalSchema = _enum([
+	"location-unknown",
+	"source-writable",
+	"no-ledger",
+	"archive-unreadable",
+	"anchor-absent",
+	"anchor-unreadable",
+	"anchor-moved"
+]);
+_enum([
+	"live-tail",
+	"listing-error",
+	"path-mismatch",
+	"durable-refused"
+]);
+/** Every skip reason, always present, always a number — so a reason that never
+*  fired reports as zero rather than absent and the report shape is constant
+*  between passes. Spelled out rather than `z.record` for exactly that. */
+var LedgerWalkSkipCountsSchema = object({
+	"live-tail": number().int().nonnegative(),
+	"listing-error": number().int().nonnegative(),
+	"path-mismatch": number().int().nonnegative(),
+	"durable-refused": number().int().nonnegative()
+});
+/** One camera's share of a walk, so a report names cameras and not rows. */
+var LedgerWalkDeviceReportSchema = object({
+	deviceId: number().int(),
+	hoursWalked: number().int().nonnegative(),
+	hoursMissing: number().int().nonnegative(),
+	ghostSegments: number().int().nonnegative(),
+	ghostBytes: number().int().nonnegative(),
+	forgottenSegments: number().int().nonnegative(),
+	orphanFiles: number().int().nonnegative()
 });
 /**
-* Mode of a single recording band — the recorder per-band vocabulary.
+* What one walk claimed, listed, found and (only when armed) forgot.
 *
-* Distinct from `RecordingStorageModeSchema` (which carries `off`): a band is
-* only ever `continuous` or `events`; "off" is expressed by the absence of a
-* covering band, not by a band value.
+* `archiveSegments` is the **M** and `segmentsClaimed` the **N** (D295), so a
+* walk that saw a fraction of the location is visible in its own report rather
+* than in the absence of one.
 */
-var RecordingBandModeSchema = _enum(["continuous", "events"]);
+var LedgerWalkReportSchema = object({
+	locationId: string(),
+	applied: boolean(),
+	refused: LedgerWalkRefusalSchema.nullable(),
+	archiveSegments: number().int().nonnegative().nullable(),
+	archiveBytes: number().int().nonnegative().nullable(),
+	hoursClaimed: number().int().nonnegative(),
+	hoursWalked: number().int().nonnegative(),
+	hoursMissing: number().int().nonnegative(),
+	/** `readdir` calls issued — the cost, stated in the unit that is paid. */
+	listings: number().int().nonnegative(),
+	segmentsClaimed: number().int().nonnegative(),
+	ghostSegments: number().int().nonnegative(),
+	ghostBytes: number().int().nonnegative(),
+	ghostHoursWhole: number().int().nonnegative(),
+	forgottenSegments: number().int().nonnegative(),
+	forgottenBytes: number().int().nonnegative(),
+	/** Files under a claimed hour that no durable row names. Never deleted. */
+	orphanFiles: number().int().nonnegative(),
+	orphanSample: array(string()).readonly(),
+	hoursSkipped: number().int().nonnegative(),
+	skippedByReason: LedgerWalkSkipCountsSchema,
+	/** The walk stopped at its per-pass hour bound with claims unwalked. */
+	bounded: boolean(),
+	byDevice: array(LedgerWalkDeviceReportSchema).readonly()
+});
+/** How many rows a media pass would still act on against a given target — the
+*  media lane's denominator AND its residue, from ONE derivation so the two can
+*  never disagree. `null` = the count could not be taken. */
+var RelocatableMediaCountSchema = object({ rows: number().int().nonnegative() }).nullable();
+var RelocatableMediaCountInputSchema = object({
+	toLocationId: string().min(1),
+	/** Restrict the count to one source; omitted / `'*'` = every non-target row. */
+	fromLocationId: string().optional(),
+	/** Omitted = `move`. */
+	mode: MediaRelocateModeSchema.optional()
+});
 /**
-* Triggers for an `events`-mode band. Identical shape to
-* `RecordingTriggersSchema` — reuse that schema as the band trigger type so the
-* two never drift.
+* Operator cleanup of leftover analytics rows, optional debug media, and
+* ghost ledger entries on frozen footage locations.
+*
+* A pass is tens of minutes on a standing backlog. The hub method RETURNS
+* `{ jobId }` immediately; progress is `cleanupStatus`. Awaiting the work
+* is how `addons.custom` hit the 60 s UDS deadline while reclaim continued
+* with no operator-visible status.
 */
-var RecordingBandTriggersSchema = RecordingTriggersSchema;
+var StorageCleanupPhaseSchema = _enum([
+	"orphans",
+	"debug-media",
+	"ghost-ledger",
+	"done",
+	"failed",
+	"cancelled"
+]);
+var StorageCleanupInputSchema = object({ 
+/** Also walk motion stills / track filmstrips. Off by default. */
+includeDebugMedia: boolean().optional() });
+var StorageCleanupJobSchema = object({
+	jobId: string(),
+	phase: StorageCleanupPhaseSchema,
+	includeDebugMedia: boolean(),
+	orphansReclaimed: number().int().nonnegative(),
+	orphanBytesReclaimed: number().int().nonnegative(),
+	debugMediaReclaimed: number().int().nonnegative(),
+	debugMediaBytesReclaimed: number().int().nonnegative(),
+	ghostsForgotten: number().int().nonnegative(),
+	ghostBytesForgotten: number().int().nonnegative(),
+	/** Short operator-facing line: current collection, pass, or location. */
+	detail: string().nullable(),
+	cancelRequested: boolean(),
+	startedAt: number(),
+	updatedAt: number(),
+	finishedAt: number().nullable(),
+	error: string().nullable()
+});
+var StorageCleanupStatusInputSchema = object({ jobId: string().optional() });
 /**
-* A single mode-per-band window — the canonical recorder band shape, the
-* single source of truth re-used by `addon-pipeline/recorder`.
+* `StorageLocationType` — an addon-declared id that identifies the *kind* of
+* storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
+* so the persisted record schema and the consumer-facing cap can both consume it
+* without forming a circular import. The `storage` cap re-exports it
+* verbatim for back-compat.
 *
-* `days` lists the weekdays the band covers (empty = every day, matching the
-* band engine's `applies` rule). `start`/`end` are `HH:MM`; an `end <= start`
-* span wraps past midnight (handled by the band engine).
+* This Zod schema is the **authoritative source** for `StorageLocationType`.
+* The TS alias in `./storage.ts` re-exports `z.infer<typeof
+* StorageLocationTypeSchema>` so the wire surface (cap) and the legacy
+* `IStorageProvider` interface stay in lockstep.
+*
+* The type is now an **open string** (not a closed enum) — addons declare
+* their own location kinds via `StorageLocationDeclaration.id`. The regex
+* enforces a safe id format: lowercase-start, alphanumeric + hyphens.
 */
-var RecordingBandSchema = object({
-	days: array(RecordingWeekdaySchema),
-	start: string().regex(HHMM),
-	end: string().regex(HHMM),
-	mode: RecordingBandModeSchema,
-	triggers: RecordingBandTriggersSchema.optional(),
+var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
+/**
+* Persisted record for a storage location instance. Operators can register
+* multiple instances for multi-cardinality types (e.g. two `backups`
+* locations with different `providerId`s). Cardinality is now declared per
+* location via `StorageLocationDeclaration.cardinality` — the static
+* `STORAGE_LOCATION_CARDINALITY` map has been removed.
+*
+* `id` is a stable namespaced string of the form `<type>:<slug>`.
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
+*
+* `isSystem` is a legacy persisted flag. Seed still creates the initial
+* `<type>:default` locations; the flag is no longer a lock, a badge, or a
+* prune selector. New writes leave it false. Deletion is gated on uniqueness
+* / last-enabled, not on this bit.
+*/
+var StorageLocationSchema = object({
+	id: string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
+	type: string(),
+	displayName: string().min(1),
+	providerId: string().min(1),
+	config: record(string(), unknown()),
 	/**
-	* RETIRED (D381). A band no longer carries a pre-buffer of its own.
-	*
-	* It was the retroactive KEEP bound — which already-written segments survive
-	* a trigger — and it had to be at least as wide as the widest pre-roll the
-	* broker could serve, or the gate would delete the seconds the ring had just
-	* handed the writer. That "at least as wide as" is the tell: it was a second
-	* expression of the broker's retention, in different units, in a different
-	* addon, with an invariant the operator had to maintain by hand. The keep
-	* bound is now derived from the one prebuffer ceiling and there is nothing
-	* left to configure here.
+	* Cluster node this location physically lives on. REQUIRED for node-local
+	* providers (filesystem — the path exists on one node's disk), null/absent
+	* for node-agnostic providers (S3/SFTP/WebDAV, reachable from any node).
+	* `'hub'` is the hub node. Validated against the provider's `nodeLocal`
+	* flag at upsert time, not here (the schema is provider-agnostic).
+	*/
+	nodeId: string().optional(),
+	isSystem: boolean().default(false),
+	/**
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* The key survives in the SHAPE so a config written before that record still
-	* parses and can be migrated deliberately — `RecordingBandSchema` is not
-	* strict, so simply deleting it would strip an operator's value in silence on
-	* the next save (the failure D380 came one commit from shipping). Nothing
-	* reads it: {@link stripRetiredBandPreBufferSec} removes it on load.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
-	preBufferSec: number().min(0).optional(),
-	postBufferSec: number().min(0).optional()
+	enabled: boolean().optional(),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: object({
+		totalBytes: number(),
+		availableBytes: number()
+	}).nullable().optional(),
+	createdAt: number(),
+	updatedAt: number()
 });
-({ postBufferSec: 30 }).postBufferSec * 1e3;
+object({ isDefault: boolean().optional() });
 /**
-* Per-device retention overrides. Every field is optional; an unset or `0`
-* value inherits the node-wide recorder default. Only footage-lifetime limits
-* live per-camera: `maxAgeDays` and `maxSizeGb`. The disk-occupancy threshold
-* (when the volume is too full to keep recording) is NOT a per-camera concern —
-* it belongs to the StorageLocation (`StorageLocation.config.minFreePercent`),
-* shared by every camera writing to that volume.
+* Reference accepted by consumer-facing `api.storage.*` calls.
+* Either:
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
+*  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
+*
+* The orchestrator's `resolveRef(ref)` handles both cases.
 */
-var RecordingRetentionSchema = object({
-	maxAgeDays: number().min(0).optional(),
-	maxSizeGb: number().min(0).optional()
-});
+var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
 /**
-* The full per-camera recording intent — the wire shape of a RecordingTarget.
+* `StorageLocationDeclaration` — a single storage-location entry declared by
+* an addon in its `package.json` under `camstack.storageLocations`.
 *
-* `bands` is the ONLY authored recording intent: what to record, when, and on
-* which trigger. `mode` is a derived summary the recorder stamps on save; every
-* other field is a storage knob (profiles, segment length, retention, scrub).
+* Design intent:
+* - **Addon declares its needs** — each addon describes the logical storage
+*   slots it requires (e.g. `recordings`, `recordingsLow`) without caring
+*   about the physical path.
+* - **Kernel aggregates** — at boot the kernel collects declarations from all
+*   installed addons, deduplicates by `id`, and exposes the union via the
+*   storage-locations settings surface.
+* - **Orchestrator seeds** — for every declared `id` the orchestrator ensures
+*   at least one instance named `<id>:default` is present, using
+*   `defaultsTo` to inherit the resolved root from another location when the
+*   declaration is a derivative slot (e.g. `recordingsLow` defaults to
+*   `recordings`).
+* - **ids are global** — `id` values are shared across the entire deployment;
+*   two addons declaring the same `id` must agree on `cardinality` (validated
+*   at kernel aggregation time, not here).
+*/
+/**
+* `StorageAccess` — how the service that DECLARED a storage-location kind
+* actually reaches the bytes. It is the constraint that decides which
+* `storage-provider`s may back a location of that kind.
 *
-* STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
-* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
-* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
-* (D62: a switch that writes a store nobody reads is worse than no switch).
-* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
-* A stale caller must fail loudly — silently stripping its legacy intent would
-* persist a band-less config, i.e. silently stop recording the camera.
+* - `'local-path'` — the service asks `storage.resolve` for a path string and
+*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
+*   post-analysis media roots). Only a provider that serves a genuine local
+*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
+*   remote provider's `resolve` returns a path on the REMOTE host, and
+*   `fs.readdir` of it on this node either fails or — far worse — succeeds
+*   against a same-named local directory that is something else entirely.
+*
+* - `'cap-mediated'` — every byte travels through the `storage` cap
+*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
+*   service never sees a path, so any provider can back it. `backups` is the
+*   one kind that qualifies today.
+*
+* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
+* an EMERGENT property of how the recorder happened to be written. Nothing
+* refused the configuration; the first write simply went somewhere wrong, and
+* a recording write that goes wrong surfaces as a silent black window rather
+* than an error (the read path does not `stat`). This turns that accident into
+* a declared, enforced, testable refusal.
 */
-var RecordingConfigSchema = object({
-	enabled: boolean(),
-	/** DERIVED summary of `bands`, stamped by the recorder on every save.
-	*  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
-	mode: RecordingStorageModeSchema.optional(),
+var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
+var StorageLocationDeclarationSchema = object({
 	/**
-	* Which assigned broker slots to record. Absent / empty = {@link
-	* DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
-	* camera's currently assigned slots — never `mid` unless the operator
-	* picks it, and never a slot the broker has not assigned.
+	* Global location identifier, e.g. `recordings` or `recordingsLow`.
+	* Must start with a lowercase letter and may contain letters, digits, and
+	* hyphens.
 	*/
-	profiles: array(CamProfileSchema).optional(),
-	segmentSeconds: number().int().positive().optional(),
+	id: string().regex(/^[a-z][a-zA-Z0-9-]*$/, { message: "id must start with a lowercase letter and contain only letters, digits, or hyphens" }),
+	/** Human-readable name shown in the admin UI. */
+	displayName: string().min(1, { message: "displayName must not be empty" }),
+	/** Optional longer explanation of what data this location stores. */
+	description: string().optional(),
 	/**
-	* AUTHORITATIVE mode-per-band recording model — the single source of truth
-	* the recorder's band engine consumes. An empty array = record nothing;
-	* "off" is the absence of a covering band, never a band value.
+	* `single` — exactly one instance of this location is allowed system-wide
+	* (e.g. `logs`, `models`). The operator can edit it but not add more.
+	* `multi`  — the operator may register several instances (e.g. a second
+	* `recordings` on a NAS for disk tiering); one is the default at any time.
 	*/
-	bands: array(RecordingBandSchema).default([]),
+	cardinality: _enum(["single", "multi"]),
 	/**
-	* THE device-decided intent: record for as long as the camera itself raises
-	* `recording-signal` (`active: true` while the device is in function — a
-	* robot that cleans). AUTHORED, unlike `mode`, and the only authored
-	* recording intent that is not a band.
-	*
-	* It carries NO schedule on purpose. A band is an HOUR, and this feature has
-	* no hour to program: the device decides. What it costs the operator is one
-	* flag — "this camera can record on its own" — and what it buys is the same
-	* hold/release the recorder already implements (D371, `holdTrigger` /
-	* `releaseTrigger`): the window opens on the rise, stays open for the whole
-	* job however long it is, and closes one pad after the fall.
+	* HOW the declaring service reaches the bytes — and therefore WHICH
+	* providers may back a location of this kind. See {@link StorageAccessSchema}
+	* and {@link STORAGE_ACCESS_FALLBACK}.
 	*
-	* EXCLUSIVE with `bands` (below): two authorities deciding when the same
-	* camera records is the D62 failure. `off` remains `enabled: false`, so an
-	* operator switching this camera off is REPORTED off, never as broken.
+	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+	* can only over-restrict (refuse a remote provider for a kind that might
+	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+	* permissive direction and is therefore never inferred — a repo guard
+	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+	* reached by omission.
 	*/
-	deviceDecision: boolean().optional(),
-	retention: RecordingRetentionSchema.optional()
-}).strict().refine((config) => config.deviceDecision !== true || config.bands.length === 0, {
-	message: "deviceDecision is a whole-config mode and carries no schedule: it cannot be combined with bands",
-	path: ["bands"]
-});
-/**
-* Entity-relocation job state (storage entity-routing spec, Phase 4).
-*
-* One shape shared by the recorder and pipeline-analytics internal movers.
-* The public admin surface is `storage-migration`; child jobs remain in RAM
-* because copy-if-absent, verify, delete and index/row repoint are resumable.
-* Each completed/failed run also lands one durable ops-log row on its owning
-* addon surface.
-*/
-/**
-* `queued` exists because the recorder mover is SINGLE-FLIGHT and an operator
-* rebalance enqueues one job per (camera, profile). Refusing the second job —
-* what the engine did before — turned a fifteen-camera rebalance into fifteen
-* manual retries. Queued jobs run FIFO; a queued job that is cancelled never
-* runs at all.
-*/
-var RelocateJobStateSchema = _enum([
-	"queued",
-	"running",
-	"done",
-	"failed",
-	"cancelled"
-]);
-var RelocateJobSchema = object({
-	jobId: string(),
-	state: RelocateJobStateSchema,
-	/** Source location — for media relocation this is informational ('*': rows
-	*  move from wherever they are to the target). */
-	fromLocationId: string(),
-	toLocationId: string(),
-	/** Scoped device, or null = every device. */
-	deviceId: number().nullable(),
-	/** What the job moves (owner-addon specific: segments or media). */
-	entities: array(string()),
-	filesMoved: number().int(),
-	bytesMoved: number().int(),
-	/** Total files discovered up front; null while (or when) unknown. */
-	filesTotal: number().int().nullable(),
+	access: StorageAccessSchema.optional(),
 	/**
-	* Rows this run CORRECTED while moving them — a durable mutation the move
-	* made that nobody asked for, so it is reported where the operator reads the
-	* job rather than only in a log line.
-	*
-	* A footage segment records its byte count in its own NAME, and the durable
-	* hour row derives its aggregates from those names. A file that does not
-	* match its name therefore makes the ledger's sums — and with them quota and
-	* pressure eviction — wrong by the difference, and only a rename can fix it.
-	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
-	*
-	* Absent on lanes where the question has no meaning: a media blob's size is
-	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	* When set, the default instance for this location inherits its resolved
+	* root from the named location's default instance. Useful for derivative
+	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
+	* configure the primary location.
 	*/
-	rowsReconciled: number().int().nonnegative().optional(),
+	defaultsTo: string().optional(),
 	/**
-	* Rows this run FORGOT because the file they name is not on disk.
-	*
-	* The mover derived the path from the row's own fields and `stat`ed it; an
-	* ENOENT there is a per-path confirmation that the segment is gone (D296),
-	* and the durable row is dropped through the same channel eviction uses. It
-	* is reported for the same reason `rowsReconciled` is: this is a durable
-	* mutation nobody asked for, and a migration that quietly erases hour rows is
-	* the same failure as one that quietly skips them (D295).
+	* Which node root the seeded `<id>:default` instance is placed under on a
+	* FRESH install:
+	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
+	*   the appData volume. Right for small/durable data (logs, models).
+	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
+	*   env is set, else falls back to the data root. Right for bulky, hot media
+	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
 	*
-	* The production drain of 2026-08-30 would have reported 11 074 here — the
-	* ledger claimed 5.65 GB of footage that no longer existed.
+	* Only affects the seeded default's `basePath`; operators can repoint any
+	* location afterwards, and a `defaultsTo` slot inherits its parent's root
+	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	rowsForgotten: number().int().nonnegative().optional(),
-	startedAt: number(),
-	finishedAt: number().nullable(),
-	error: string().nullable()
+	defaultRoot: _enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
 });
-/** Profile-derived footage selection used only by the migration coordinator:
-* `recordings` owns high+mid; `recordingsLow` owns low. */
-var RelocateFootageClassSchema = _enum(["recordings", "recordingsLow"]);
-var RelocateFootageInputSchema = object({
-	fromLocationId: string(),
-	toLocationId: string(),
-	entities: array(_enum(["segments"])).optional(),
-	/** Limits relocation to the logical profile class. Omit only for the
-	* pre-orchestration compatibility path. */
-	footageClass: RelocateFootageClassSchema.optional(),
-	/** Scope the move to ONE camera. Absent = every camera on the source, which
-	*  is what a whole-disk drain means. The rebalance path always sets it: its
-	*  unit is a (camera, profile) pile, not a disk. */
-	deviceId: number().int().optional(),
-	/** Scope the move to specific segment profiles (`high` / `mid` / `low`).
-	*  Finer than `footageClass`, which cannot separate high from mid — and the
-	*  placement plan assigns those two independently, so a rebalance that could
-	*  only say "recordings" would move footage the plan never asked to move. */
-	profiles: array(string()).optional(),
-	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
-	*  never allowed to starve live writers. */
-	throttleMbps: number().min(1).max(1e3).optional(),
-	/** Move only segments whose startMs is >= this. Absent = the whole source
-	*  pile. Used when a full drain is too expensive and the operator only
-	*  wants the recent window on the new disk. */
-	sinceMs: number().int().optional()
+var DecoderStatsSchema = object({
+	inputFps: number(),
+	outputFps: number(),
+	avgDecodeTimeMs: number(),
+	droppedFrames: number(),
+	/**
+	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
+	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
+	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
+	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
+	*/
+	lagMs: number().optional(),
+	effectiveFps: number().optional(),
+	adaptiveFps: number().optional()
 });
-/** Internal, lease-scoped participant operation. It is intentionally separate
-* from persistent recording settings: a migration never changes
-* `RecordingConfig.enabled` or camera wrapper bindings. */
-var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
-var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
-/**
-* What a `relocateMedia` pass DOES. One engine, three passes — never a second
-* mover (the engine already walks both collections with a timestamp cursor and
-* already has a stamp-without-copy path).
-*
-*  - `move`    — the default and the historical behaviour: event-media and
-*                retrain blobs move to `toLocationId` and their rows are
-*                stamped. The enrolled gallery is skipped (D197).
-*  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
-*                stamped with `toLocationId`. `toLocationId` here is the id the
-*                bytes ALREADY sit on — today's `eventMedia` default — because
-*                a NULL row means "wherever `eventMedia` points *now*", and the
-*                instant a repoint moves that pointer the row reads from the
-*                new disk while its bytes are on the old one.
-*  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
-*                (enrolled-gallery) rows, which `move` deliberately skips.
-*                `galleryMedia` is `cardinality: 'single'`, so this pass can
-*                never run beside a live second location: it is stop-the-world
-*                by construction, which is acceptable only because the gallery
-*                is a few KB per enrolled sample.
-*/
-var MediaRelocateModeSchema = _enum([
-	"move",
-	"seal",
-	"gallery"
-]);
-var RelocateMediaInputSchema = object({
-	toLocationId: string(),
+var DecoderSessionConfigSchema = object({
+	codec: string(),
+	maxFps: number().default(0),
+	outputFormat: _enum([
+		"jpeg",
+		"rgb",
+		"bgr",
+		"yuv420",
+		"gray"
+	]).default("jpeg"),
+	scale: number().default(1),
+	width: number().optional(),
+	height: number().optional(),
 	/**
-	* Restrict the pass to rows currently on this location. Omitted / `'*'` =
-	* every row that is not already on `toLocationId` (the historical
-	* behaviour). A named source is what a from→to migration needs: without it
-	* "move events off disk 2" also emptied disk 1.
+	* Identifier of the camera this decoder session serves. Optional
+	* because the cap is generic (any caller could request decode), but
+	* stream-broker passes it so decoder logs include `deviceId` for
+	* per-camera filtering when diagnosing failures (e.g. node-av
+	* sendPacket errors on a single hung camera).
 	*/
-	fromLocationId: string().optional(),
-	throttleMbps: number().min(1).max(1e3).optional(),
-	/** Omitted = `move`, the pre-existing behaviour. */
-	mode: MediaRelocateModeSchema.optional()
+	deviceId: number().int().nonnegative().optional(),
+	/**
+	* Free-form tag for log scoping. Stream-broker uses
+	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
+	* on every line so `grep tag=broker:5/high` filters one camera
+	* profile cleanly.
+	*/
+	tag: string().optional(),
+	/**
+	* Where the session delivers decoded frames (Phase 5 / D9):
+	*
+	* - `'callback'` (default) — the legacy pixel path: decoded frames are
+	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
+	* - `'shm'` — the shared-memory frame plane: decoded frames are written
+	*   into an OS shared-memory ring and drained as zero-pixel
+	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
+	*   other — `pullFrames` returns nothing for an `'shm'` session and
+	*   `pullHandles` returns nothing for a `'callback'` session.
+	*/
+	frameSink: _enum(["callback", "shm"]).default("callback"),
+	/**
+	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
+	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
+	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
+	* stream-broker's `streamingDebug` gate — off by default so production logs
+	* stay quiet and the emit path pays zero per-frame cost when disabled.
+	*/
+	debug: boolean().optional()
 });
+var EU_DST = {
+	offsetHours: 1,
+	startMonth: 3,
+	startWeekIndex: 5,
+	startWeekday: "Sunday",
+	startHour: 2,
+	endMonth: 10,
+	endWeekIndex: 5,
+	endWeekday: "Sunday",
+	endHour: 3
+};
+var US_DST = {
+	offsetHours: 1,
+	startMonth: 3,
+	startWeekIndex: 2,
+	startWeekday: "Sunday",
+	startHour: 2,
+	endMonth: 11,
+	endWeekIndex: 1,
+	endWeekday: "Sunday",
+	endHour: 2
+};
 /**
-* The unstamped population of ONE collection — split, because the gate and the
-* operator ask two different questions and only one of them has to be cheap.
-*
-* `present` is the GATE: "is there at least one row that would be orphaned by a
-* repoint". It is a single indexed seek to the first matching row, so it stays
-* answerable on a saturated disk and answers in O(log n) precisely in the state
-* that matters — after a seal, when the population is empty.
-*
-* `rows` is the NUMBER, for the refusal message and the operator's sense of
-* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
-* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
-* and useful answer: "there are some, and this read could not say how many"
-* still refuses the cutover, which is the whole job.
+* Curated catalogue of common world zones, grouped by region. Not
+* exhaustive — covers the everyday zones an operator is likely to pick.
 */
-var UnstampedRowsSchema = object({
-	present: boolean(),
-	rows: number().int().nonnegative().nullable()
-});
-/**
-* How many rows still carry NO `locationId` — the population a repoint would
-* silently re-aim at a disk that does not hold their bytes.
-*
-* **`null` = the count could not be taken**, and it is NOT permission to cut
-* over. The gate opens on a measured absence and on nothing else; an unread
-* collection and an empty one are different facts, and this repo has already
-* paid for conflating them (`RelocateResidueSchema`, D295).
-*/
-var UnstampedEventMediaCountSchema = object({
-	media: UnstampedRowsSchema,
-	retrainFrames: UnstampedRowsSchema,
-	/** True when EITHER collection holds one. The refusal reads this. */
-	anyPresent: boolean(),
-	/** Sum across both, or `null` when either lane could not be counted. */
-	total: number().int().nonnegative().nullable()
-}).nullable();
-var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
-/** The independently selectable logical storage classes — every class
-* `storage.listLocationDeclarations` reports, so an operator never meets a
-* Zod enum error where they should meet an explanation.
-*
-* `recordings` encompasses the high and mid segment profiles; `recordingsLow`
-* is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
-* enrolled gallery; `backups` is the system backup archive. The last two have
-* their own rules — see {@link StorageMigrationFindingCodeSchema}. */
-var StorageMigrationClassSchema = _enum([
-	"recordings",
-	"recordingsLow",
-	"eventMedia",
-	"backups",
-	"galleryMedia"
-]);
-/** A destination is always an existing, fully-qualified location id. The
-* migration API intentionally never changes a source location's `basePath`:
-* callers create a new `<type>:<slug>` location, then select it here. */
-var StorageMigrationDestinationsSchema = object({
-	recordings: string().min(1).optional(),
-	recordingsLow: string().min(1).optional(),
-	eventMedia: string().min(1).optional(),
-	backups: string().min(1).optional(),
-	galleryMedia: string().min(1).optional()
-}).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
-/**
-* Optional named source per class. Omitted = the class's current default
-* (the historical behaviour). A named source that is NOT the default is a
-* drain of that disk: bytes move, the default stays, and the source is
-* disabled when the move finishes.
-*/
-var StorageMigrationSourcesSchema = object({
-	recordings: string().min(1).optional(),
-	recordingsLow: string().min(1).optional(),
-	eventMedia: string().min(1).optional(),
-	backups: string().min(1).optional(),
-	galleryMedia: string().min(1).optional()
-}).optional();
-/**
-* How a migration sequences the cutover against the byte move.
-*
-*  - `blocking`     — the historical order: pause, move every byte, repoint,
-*                     resume. Recording is stopped for the whole move. Right
-*                     for a small or a cold class, and the only legal mode for
-*                     a `cardinality: 'single'` class.
-*  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
-*                     refresh, resume, then move the past with everything
-*                     running. The pause is three bounded instants (a detach +
-*                     attach round, a write-gate drain, a lease) instead of one
-*                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
-*                     stopped recording under `blocking`; the same move is
-*                     seconds of stopped recording under `nonBlocking`.
-*
-* The mode is on the JOB, not only on the input, because `status` is where an
-* operator finds out which one is running.
-*/
-var StorageMigrationModeSchema = _enum(["blocking", "nonBlocking"]);
-/** Shared input for planning and starting an orchestrated storage migration. */
-var StorageMigrationInputSchema = object({
-	destinations: StorageMigrationDestinationsSchema,
-	/** Omitted = each class's current default. */
-	sources: StorageMigrationSourcesSchema,
-	throttleMbps: number().min(1).max(1e3).optional(),
-	/** Omitted = `blocking`, which stays the default. */
-	mode: StorageMigrationModeSchema.optional()
-});
-/**
-* The durable coordinator state machine.
-*
-* `blocking`:
-*   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
-*
-* `nonBlocking`:
-*   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
-*
-* Same phases, different order plus two new ones — not a second mover.
-* `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
-* `draining` runs the same movers UNLEASED, after every writer is back up.
-* `repointing` is still the only phase that changes a default location.
-*/
-var StorageMigrationPhaseSchema = _enum([
-	"planning",
-	"sealing",
-	"pausing",
-	"moving",
-	"draining",
-	"verifying",
-	"repointing",
-	"refreshing",
-	"resuming",
-	"done",
-	"failed",
-	"cancelled"
-]);
-var StorageMigrationParticipantSchema = _enum([
-	"pipeline",
-	"recorder",
-	"analytics"
-]);
-/**
-* The mover's own numbers, folded onto the coordinator's durable move record.
-*
-* The long half of a non-blocking migration is `draining`, and it is measured
-* in hours: 136 885 files at ~4 MB/s is about five of them. Before this shape
-* existed the only place those numbers appeared was a Loki line, so an operator
-* watching the Admin UI saw `phase: draining` and nothing else for a whole
-* afternoon.
-*
-* It is POLLED, never pushed. Events are telemetry and may be dropped
-* (D8/D11), and a dropped progress event is indistinguishable from a stalled
-* mover — which is the exact failure this is meant to end. The coordinator's
-* `waitForMoves` already fetches the whole {@link RelocateJob} on every tick to
-* read `state`; folding the counters costs no extra read and makes the durable
-* record say afterwards how far a move actually got.
-*
-* `filesTotal` is `null` for "no honest denominator" and is never zero-filled:
-* a windowed footage job (`sinceMs`) and a node with no ledger both genuinely
-* cannot say M, and a 0 there would render as "100 % done".
-*/
-var StorageMigrationMoveProgressSchema = object({
-	filesMoved: number().int().nonnegative(),
-	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
-	filesTotal: number().int().nonnegative().nullable(),
-	bytesMoved: number().int().nonnegative(),
-	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
-	*  a lane that cannot reconcile. A migration that silently rewrote durable
-	*  rows would be the same failure as one that silently skipped them. */
-	rowsReconciled: number().int().nonnegative().optional(),
-	/** The MOVER's start, not the migration's: a drain restarted after an addon
-	*  crash gets a new mover, and a rate computed from the migration's start
-	*  would silently average in the time nothing was running. */
-	startedAt: number(),
-	/** When the coordinator last read these numbers. Paired with `startedAt` it
-	*  is the only honest rate: both clocks are the hub's, so a UI never has to
-	*  subtract its own. */
-	observedAt: number()
-});
-var StorageMigrationMoveSchema = object({
-	storageClass: StorageMigrationClassSchema,
-	fromLocationId: string(),
-	toLocationId: string(),
-	/**
-	* True when `from` was NOT the class default at plan time. The move still
-	* copies bytes, but the default is left alone and the source is disabled
-	* once the copy verifies. Absent on jobs planned before this field existed
-	* — those jobs always repointed, which is `false`.
-	*/
-	freezeSource: boolean().optional(),
-	moverJobId: string().nullable(),
-	state: RelocateJobStateSchema.nullable(),
-	error: string().nullable(),
-	/** Last observed mover counters; `null` until the mover has been polled once. */
-	progress: StorageMigrationMoveProgressSchema.nullable()
-});
-var StorageMigrationJobSchema = object({
-	jobId: string(),
-	phase: StorageMigrationPhaseSchema,
-	/** Which order this job is running. `status` is the only place an operator
-	*  can tell a seconds-long cutover from a thirty-hour one. */
-	mode: StorageMigrationModeSchema,
-	destinations: StorageMigrationDestinationsSchema,
-	sources: StorageMigrationSourcesSchema,
-	throttleMbps: number(),
-	moves: array(StorageMigrationMoveSchema),
-	pauseLeaseId: string().nullable(),
-	pausedParticipants: array(StorageMigrationParticipantSchema),
-	repointed: boolean(),
-	cancelRequested: boolean(),
-	startedAt: number(),
-	updatedAt: number(),
-	finishedAt: number().nullable(),
-	error: string().nullable()
-});
-var StorageMigrationFindingSchema = object({
-	code: _enum([
-		"sharesDeviceWithSource",
-		"deviceIdentityUnknown",
-		"unstampedEventMediaRows",
-		"blockingOnly",
-		"noMover"
-	]),
-	storageClass: StorageMigrationClassSchema,
-	/** Human-readable, already carrying the ids and counts. */
-	message: string()
-});
-var StorageMigrationPlanSchema = object({
-	destinations: StorageMigrationDestinationsSchema,
-	sources: StorageMigrationSourcesSchema,
-	/** The mode this plan was built for. A plan is only valid for its mode: the
-	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
-	*  it. */
-	mode: StorageMigrationModeSchema,
-	moves: array(object({
-		storageClass: StorageMigrationClassSchema,
-		fromLocationId: string(),
-		toLocationId: string(),
-		freezeSource: boolean().optional()
-	})),
-	findings: array(StorageMigrationFindingSchema)
-});
-/**
-* A mover as it exists RIGHT NOW, whether or not a migration job owns it.
-*
-* The coordinator's job record is the state of record for a migration, and its
-* moves carry {@link StorageMigrationMoveProgress}. But the movers are usable
-* standalone — `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
-* are both operator-callable, and on 2026-08-29 a five-hour drain was armed that
-* way because no supported UI path existed. A mover armed like that has no job
-* to fold progress into, so it has to be readable on its own or it is invisible.
-*
-* `migrationJobId` is what tells the two apart: `null` means nothing here
-* orchestrated it.
-*/
-var StorageMigrationMoverSchema = object({
-	lane: _enum(["footage", "media"]),
-	job: RelocateJobSchema,
-	/** The coordinator job that armed this mover, or `null` for a mover armed
-	*  directly against the owning addon. */
-	migrationJobId: string().nullable(),
-	/** When the hub read these counters. Stamped here so a rate is `bytesMoved`
-	*  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
-	*  a browser subtracting its own `Date.now()` from a server `startedAt` is a
-	*  rate made of two different clocks. */
-	observedAt: number()
-});
-/**
-* What a SOURCE still holds for one storage class — the number that makes a
-* "drain remaining" action honest rather than hopeful.
-*
-* It comes from the archive (`SegmentHourLedger.census` for footage, the media
-* engine's own selection count for media), never from the resident index: a
-* drain sized off `RecordingIndex` is what reported `done` over 80.3 GB it had
-* never been told about (D295).
-*
-* `items`/`bytes` are `null` for "the archive could not be asked", which is
-* deliberately NOT zero: a drain is still offered for an unknown residue,
-* because refusing on an unanswerable read would hide exactly the case an
-* operator needs to act on.
-*/
-var StorageMigrationResidueSchema = object({
-	storageClass: StorageMigrationClassSchema,
-	/** The location still holding the data. `'*'` for the media lane, whose rows
-	*  move from wherever they are rather than from one named source. */
-	fromLocationId: string(),
-	/** Where a drain would move it — the class's CURRENT default. */
-	toLocationId: string(),
-	/** Segments (footage lane) or rows (media lane) still on the source. */
-	items: number().int().nonnegative().nullable(),
-	/** Bytes on the source; `null` when the lane counts rows rather than bytes. */
-	bytes: number().int().nonnegative().nullable()
-});
-/**
-* Run the DRAIN half and nothing else.
-*
-* A migration that reached `done` has already repointed, so `start` correctly
-* refuses its destination ("already the default") — there is nothing left to
-* repoint. But the drain can fail, be cancelled, be interrupted by a restart,
-* or finish against a work list that was a tenth of the archive (D295), and
-* before this there was no supported way to run only that half: the only way
-* through was calling `recording.relocateFootage` by hand over admin tRPC.
-*
-* `drain` NEVER calls `setDefaultLocations`. That is what keeps `start`'s
-* refusal meaningful: the two verbs are disjoint, so nothing here can silently
-* re-repoint a class that is already migrated.
-*/
-var StorageMigrationDrainInputSchema = object({
-	/** The classes to drain. Each must appear in `storageMigration.residue`, so
-	*  a class whose source is already empty is refused rather than started. */
-	classes: array(StorageMigrationClassSchema).min(1),
-	throttleMbps: number().min(1).max(1e3).optional()
-});
-/** What a footage source still holds, asked of the durable hour ledger. */
-var RelocateResidueInputSchema = object({
-	fromLocationId: string().min(1),
-	/** Narrow to one logical class; omit for every profile on the location. */
-	footageClass: RelocateFootageClassSchema.optional()
-});
-/** `null` = the archive could not answer (no ledger on this node, or the
-*  aggregate failed). Never conflated with an empty source. */
-var RelocateResidueSchema = object({
-	segments: number().int().nonnegative(),
-	bytes: number().int().nonnegative()
-}).nullable();
-/**
-* Ask one location whether its durable hour rows describe the disk — the walk
-* (D319).
-*
-* `apply` DEFAULTS TO FALSE and that default is the product: the operator's
-* missing tool is the question, and the dry run is how they sanity-check the
-* destructive run before authorising it.
-*/
-var LedgerWalkInputSchema = object({
-	locationId: string().min(1),
-	/** Forget the confirmed-absent rows, rather than only counting them. */
-	apply: boolean().optional(),
-	/** Narrow to one camera. */
-	deviceId: number().int().positive().optional(),
-	/** Narrow to these recording profiles; empty/absent = every profile. */
-	profiles: array(string().min(1)).optional()
-});
-/** Why a whole walk did nothing. Every one leaves the ledger untouched. */
-var LedgerWalkRefusalSchema = _enum([
-	"location-unknown",
-	"source-writable",
-	"no-ledger",
-	"archive-unreadable",
-	"anchor-absent",
-	"anchor-unreadable",
-	"anchor-moved"
-]);
-_enum([
-	"live-tail",
-	"listing-error",
-	"path-mismatch",
-	"durable-refused"
-]);
-/** Every skip reason, always present, always a number — so a reason that never
-*  fired reports as zero rather than absent and the report shape is constant
-*  between passes. Spelled out rather than `z.record` for exactly that. */
-var LedgerWalkSkipCountsSchema = object({
-	"live-tail": number().int().nonnegative(),
-	"listing-error": number().int().nonnegative(),
-	"path-mismatch": number().int().nonnegative(),
-	"durable-refused": number().int().nonnegative()
-});
-/** One camera's share of a walk, so a report names cameras and not rows. */
-var LedgerWalkDeviceReportSchema = object({
-	deviceId: number().int(),
-	hoursWalked: number().int().nonnegative(),
-	hoursMissing: number().int().nonnegative(),
-	ghostSegments: number().int().nonnegative(),
-	ghostBytes: number().int().nonnegative(),
-	forgottenSegments: number().int().nonnegative(),
-	orphanFiles: number().int().nonnegative()
-});
-/**
-* What one walk claimed, listed, found and (only when armed) forgot.
-*
-* `archiveSegments` is the **M** and `segmentsClaimed` the **N** (D295), so a
-* walk that saw a fraction of the location is visible in its own report rather
-* than in the absence of one.
-*/
-var LedgerWalkReportSchema = object({
-	locationId: string(),
-	applied: boolean(),
-	refused: LedgerWalkRefusalSchema.nullable(),
-	archiveSegments: number().int().nonnegative().nullable(),
-	archiveBytes: number().int().nonnegative().nullable(),
-	hoursClaimed: number().int().nonnegative(),
-	hoursWalked: number().int().nonnegative(),
-	hoursMissing: number().int().nonnegative(),
-	/** `readdir` calls issued — the cost, stated in the unit that is paid. */
-	listings: number().int().nonnegative(),
-	segmentsClaimed: number().int().nonnegative(),
-	ghostSegments: number().int().nonnegative(),
-	ghostBytes: number().int().nonnegative(),
-	ghostHoursWhole: number().int().nonnegative(),
-	forgottenSegments: number().int().nonnegative(),
-	forgottenBytes: number().int().nonnegative(),
-	/** Files under a claimed hour that no durable row names. Never deleted. */
-	orphanFiles: number().int().nonnegative(),
-	orphanSample: array(string()).readonly(),
-	hoursSkipped: number().int().nonnegative(),
-	skippedByReason: LedgerWalkSkipCountsSchema,
-	/** The walk stopped at its per-pass hour bound with claims unwalked. */
-	bounded: boolean(),
-	byDevice: array(LedgerWalkDeviceReportSchema).readonly()
-});
-/** How many rows a media pass would still act on against a given target — the
-*  media lane's denominator AND its residue, from ONE derivation so the two can
-*  never disagree. `null` = the count could not be taken. */
-var RelocatableMediaCountSchema = object({ rows: number().int().nonnegative() }).nullable();
-var RelocatableMediaCountInputSchema = object({
-	toLocationId: string().min(1),
-	/** Restrict the count to one source; omitted / `'*'` = every non-target row. */
-	fromLocationId: string().optional(),
-	/** Omitted = `move`. */
-	mode: MediaRelocateModeSchema.optional()
-});
+var TIMEZONES = [
+	{
+		id: "UTC",
+		label: "UTC (UTC+0)",
+		region: "Universal",
+		stdOffsetMinutes: 0,
+		dst: null
+	},
+	{
+		id: "Europe/London",
+		label: "Europe/London (UTC+0 / BST)",
+		region: "Europe",
+		stdOffsetMinutes: 0,
+		dst: EU_DST
+	},
+	{
+		id: "Europe/Rome",
+		label: "Europe/Rome (UTC+1 / CEST)",
+		region: "Europe",
+		stdOffsetMinutes: 60,
+		dst: EU_DST
+	},
+	{
+		id: "Europe/Paris",
+		label: "Europe/Paris (UTC+1 / CEST)",
+		region: "Europe",
+		stdOffsetMinutes: 60,
+		dst: EU_DST
+	},
+	{
+		id: "Europe/Berlin",
+		label: "Europe/Berlin (UTC+1 / CEST)",
+		region: "Europe",
+		stdOffsetMinutes: 60,
+		dst: EU_DST
+	},
+	{
+		id: "Europe/Madrid",
+		label: "Europe/Madrid (UTC+1 / CEST)",
+		region: "Europe",
+		stdOffsetMinutes: 60,
+		dst: EU_DST
+	},
+	{
+		id: "Europe/Amsterdam",
+		label: "Europe/Amsterdam (UTC+1 / CEST)",
+		region: "Europe",
+		stdOffsetMinutes: 60,
+		dst: EU_DST
+	},
+	{
+		id: "Europe/Istanbul",
+		label: "Europe/Istanbul (UTC+3)",
+		region: "Europe",
+		stdOffsetMinutes: 180,
+		dst: null
+	},
+	{
+		id: "America/New_York",
+		label: "America/New York (UTC−5 / EDT)",
+		region: "Americas",
+		stdOffsetMinutes: -300,
+		dst: US_DST
+	},
+	{
+		id: "America/Chicago",
+		label: "America/Chicago (UTC−6 / CDT)",
+		region: "Americas",
+		stdOffsetMinutes: -360,
+		dst: US_DST
+	},
+	{
+		id: "America/Denver",
+		label: "America/Denver (UTC−7 / MDT)",
+		region: "Americas",
+		stdOffsetMinutes: -420,
+		dst: US_DST
+	},
+	{
+		id: "America/Los_Angeles",
+		label: "America/Los Angeles (UTC−8 / PDT)",
+		region: "Americas",
+		stdOffsetMinutes: -480,
+		dst: US_DST
+	},
+	{
+		id: "America/Sao_Paulo",
+		label: "America/Sao Paulo (UTC−3)",
+		region: "Americas",
+		stdOffsetMinutes: -180,
+		dst: null
+	},
+	{
+		id: "Asia/Dubai",
+		label: "Asia/Dubai (UTC+4)",
+		region: "Asia",
+		stdOffsetMinutes: 240,
+		dst: null
+	},
+	{
+		id: "Asia/Kolkata",
+		label: "Asia/Kolkata (UTC+5:30)",
+		region: "Asia",
+		stdOffsetMinutes: 330,
+		dst: null
+	},
+	{
+		id: "Asia/Singapore",
+		label: "Asia/Singapore (UTC+8)",
+		region: "Asia",
+		stdOffsetMinutes: 480,
+		dst: null
+	},
+	{
+		id: "Asia/Shanghai",
+		label: "Asia/Shanghai (UTC+8)",
+		region: "Asia",
+		stdOffsetMinutes: 480,
+		dst: null
+	},
+	{
+		id: "Asia/Tokyo",
+		label: "Asia/Tokyo (UTC+9)",
+		region: "Asia",
+		stdOffsetMinutes: 540,
+		dst: null
+	},
+	{
+		id: "Australia/Sydney",
+		label: "Australia/Sydney (UTC+10 / AEDT)",
+		region: "Oceania",
+		stdOffsetMinutes: 600,
+		dst: {
+			offsetHours: 1,
+			startMonth: 10,
+			startWeekIndex: 1,
+			startWeekday: "Sunday",
+			startHour: 2,
+			endMonth: 4,
+			endWeekIndex: 1,
+			endWeekday: "Sunday",
+			endHour: 3
+		}
+	}
+];
+/** Resolve an IANA id to its `Timezone`, or `undefined` if unknown. */
+function findTimezone(id) {
+	return TIMEZONES.find((tz) => tz.id === id);
+}
 /**
-* Operator cleanup of leftover analytics rows, optional debug media, and
-* ghost ledger entries on frozen footage locations.
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
 *
-* A pass is tens of minutes on a standing backlog. The hub method RETURNS
-* `{ jobId }` immediately; progress is `cleanupStatus`. Awaiting the work
-* is how `addons.custom` hit the 60 s UDS deadline while reclaim continued
-* with no operator-visible status.
-*/
-var StorageCleanupPhaseSchema = _enum([
-	"orphans",
-	"debug-media",
-	"ghost-ledger",
-	"done",
-	"failed",
-	"cancelled"
-]);
-var StorageCleanupInputSchema = object({ 
-/** Also walk motion stills / track filmstrips. Off by default. */
-includeDebugMedia: boolean().optional() });
-var StorageCleanupJobSchema = object({
-	jobId: string(),
-	phase: StorageCleanupPhaseSchema,
-	includeDebugMedia: boolean(),
-	orphansReclaimed: number().int().nonnegative(),
-	orphanBytesReclaimed: number().int().nonnegative(),
-	debugMediaReclaimed: number().int().nonnegative(),
-	debugMediaBytesReclaimed: number().int().nonnegative(),
-	ghostsForgotten: number().int().nonnegative(),
-	ghostBytesForgotten: number().int().nonnegative(),
-	/** Short operator-facing line: current collection, pass, or location. */
-	detail: string().nullable(),
-	cancelRequested: boolean(),
-	startedAt: number(),
-	updatedAt: number(),
-	finishedAt: number().nullable(),
-	error: string().nullable()
-});
-var StorageCleanupStatusInputSchema = object({ jobId: string().optional() });
-/**
-* `StorageLocationType` — an addon-declared id that identifies the *kind* of
-* storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
-* so the persisted record schema and the consumer-facing cap can both consume it
-* without forming a circular import. The `storage` cap re-exports it
-* verbatim for back-compat.
+* ## Two axes, deliberately separated
 *
-* This Zod schema is the **authoritative source** for `StorageLocationType`.
-* The TS alias in `./storage.ts` re-exports `z.infer<typeof
-* StorageLocationTypeSchema>` so the wire surface (cap) and the legacy
-* `IStorageProvider` interface stay in lockstep.
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
 *
-* The type is now an **open string** (not a closed enum) — addons declare
-* their own location kinds via `StorageLocationDeclaration.id`. The regex
-* enforces a safe id format: lowercase-start, alphanumeric + hyphens.
-*/
-var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
-/**
-* Persisted record for a storage location instance. Operators can register
-* multiple instances for multi-cardinality types (e.g. two `backups`
-* locations with different `providerId`s). Cardinality is now declared per
-* location via `StorageLocationDeclaration.cardinality` — the static
-* `STORAGE_LOCATION_CARDINALITY` map has been removed.
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
 *
-* `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* ## The canonical call shape
 *
-* `isSystem` is a legacy persisted flag. Seed still creates the initial
-* `<type>:default` locations; the flag is no longer a lock, a badge, or a
-* prune selector. New writes leave it false. Deletion is gated on uniqueness
-* / last-enabled, not on this bit.
-*/
-var StorageLocationSchema = object({
-	id: string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
-	type: string(),
-	displayName: string().min(1),
-	providerId: string().min(1),
-	config: record(string(), unknown()),
-	/**
-	* Cluster node this location physically lives on. REQUIRED for node-local
-	* providers (filesystem — the path exists on one node's disk), null/absent
-	* for node-agnostic providers (S3/SFTP/WebDAV, reachable from any node).
-	* `'hub'` is the hub node. Validated against the provider's `nodeLocal`
-	* flag at upsert time, not here (the schema is provider-agnostic).
-	*/
-	nodeId: string().optional(),
-	isDefault: boolean().default(false),
-	isSystem: boolean().default(false),
-	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
-	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
-	*/
-	enabled: boolean().optional(),
-	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
-	*  for node-local locations it can reach) — never persisted, absent when the
-	*  volume is remote/unreachable. The single capacity truth every UI reads. */
-	capacity: object({
-		totalBytes: number(),
-		availableBytes: number()
-	}).nullable().optional(),
-	createdAt: number(),
-	updatedAt: number()
-});
-/**
-* Reference accepted by consumer-facing `api.storage.*` calls.
-* Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
-*  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
 *
-* The orchestrator's `resolveRef(ref)` handles both cases.
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
 */
-var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
 /**
-* `StorageLocationDeclaration` — a single storage-location entry declared by
-* an addon in its `package.json` under `camstack.storageLocations`.
+* The level a channel writes at once armed.
 *
-* Design intent:
-* - **Addon declares its needs** — each addon describes the logical storage
-*   slots it requires (e.g. `recordings`, `recordingsLow`) without caring
-*   about the physical path.
-* - **Kernel aggregates** — at boot the kernel collects declarations from all
-*   installed addons, deduplicates by `id`, and exposes the union via the
-*   storage-locations settings surface.
-* - **Orchestrator seeds** — for every declared `id` the orchestrator ensures
-*   at least one instance named `<id>:default` is present, using
-*   `defaultsTo` to inherit the resolved root from another location when the
-*   declaration is a derivative slot (e.g. `recordingsLow` defaults to
-*   `recordings`).
-* - **ids are global** — `id` values are shared across the entire deployment;
-*   two addons declaring the same `id` must agree on `cardinality` (validated
-*   at kernel aggregation time, not here).
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
 */
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
 /**
-* `StorageAccess` — how the service that DECLARED a storage-location kind
-* actually reaches the bytes. It is the constraint that decides which
-* `storage-provider`s may back a location of that kind.
-*
-* - `'local-path'` — the service asks `storage.resolve` for a path string and
-*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
-*   post-analysis media roots). Only a provider that serves a genuine local
-*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
-*   remote provider's `resolve` returns a path on the REMOTE host, and
-*   `fs.readdir` of it on this node either fails or — far worse — succeeds
-*   against a same-named local directory that is something else entirely.
-*
-* - `'cap-mediated'` — every byte travels through the `storage` cap
-*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
-*   service never sees a path, so any provider can back it. `backups` is the
-*   one kind that qualifies today.
-*
-* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
-* an EMERGENT property of how the recorder happened to be written. Nothing
-* refused the configuration; the first write simply went somewhere wrong, and
-* a recording write that goes wrong surfaces as a silent black window rather
-* than an error (the read path does not `stat`). This turns that accident into
-* a declared, enforced, testable refusal.
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
 */
-var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
-var StorageLocationDeclarationSchema = object({
-	/**
-	* Global location identifier, e.g. `recordings` or `recordingsLow`.
-	* Must start with a lowercase letter and may contain letters, digits, and
-	* hyphens.
-	*/
-	id: string().regex(/^[a-z][a-zA-Z0-9-]*$/, { message: "id must start with a lowercase letter and contain only letters, digits, or hyphens" }),
-	/** Human-readable name shown in the admin UI. */
-	displayName: string().min(1, { message: "displayName must not be empty" }),
-	/** Optional longer explanation of what data this location stores. */
-	description: string().optional(),
+var LogChannelDescriptorSchema = object({
 	/**
-	* `single` — exactly one instance of this location is allowed system-wide
-	* (e.g. `logs`, `models`). The operator can edit it but not add more.
-	* `multi`  — the operator may register several instances (e.g. a second
-	* `recordings` on a NAS for disk tiering); one is the default at any time.
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
 	*/
-	cardinality: _enum(["single", "multi"]),
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
 	/**
-	* HOW the declaring service reaches the bytes — and therefore WHICH
-	* providers may back a location of this kind. See {@link StorageAccessSchema}
-	* and {@link STORAGE_ACCESS_FALLBACK}.
+	* Whether this channel can be narrowed to a camera.
 	*
-	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
-	* can only over-restrict (refuse a remote provider for a kind that might
-	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
-	* permissive direction and is therefore never inferred — a repo guard
-	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
-	* reached by omission.
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
 	*/
-	access: StorageAccessSchema.optional(),
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* The gate a hot path holds.
+*
+* Obtain it ONCE — at module scope or in a constructor — and keep the
+* reference. Looking a channel up by name per line would put a Map lookup on
+* the path this class exists to keep free.
+*/
+var LogChannelGate = class {
+	descriptor;
 	/**
-	* When set, the default instance for this location inherits its resolved
-	* root from the named location's default instance. Useful for derivative
-	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
-	* configure the primary location.
+	* HOT PATH GUARD. A plain data FIELD, and it must stay one.
+	*
+	* `log-channel.spec.ts` asserts the property descriptor has no getter and
+	* booby-traps the device set, so turning this into an accessor — or reading
+	* anything before it — fails the spec instead of taxing every line the
+	* process emits.
 	*/
-	defaultsTo: string().optional(),
+	on = false;
+	/** `null` while armed for every camera. Never read while `on` is false. */
+	devices = null;
+	level;
+	closesAtMs = 0;
+	constructor(descriptor) {
+		this.descriptor = descriptor;
+		this.level = descriptor.defaultLevel;
+	}
+	/** Epoch ms this channel disarms itself at. 0 when disarmed. */
+	get armedUntilMs() {
+		return this.on ? this.closesAtMs : 0;
+	}
 	/**
-	* Which node root the seeded `<id>:default` instance is placed under on a
-	* FRESH install:
-	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (logs, models).
-	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
-	*   env is set, else falls back to the data root. Right for bulky, hot media
-	*   (recordings, event media) that should stay off the appData disk.
-	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
-	*   `/backups` in the image) so archives live on their own mount rather than
-	*   filling the appData disk. Falls back to the data root when unset.
+	* Does this channel want a line about `deviceId`?
 	*
-	* Only affects the seeded default's `basePath`; operators can repoint any
-	* location afterwards, and a `defaultsTo` slot inherits its parent's root
-	* regardless of this field. Absent (the common case) is treated as `'data'`.
+	* Call it only behind `gate.on &&`. On its own it is still correct — the
+	* guard is repeated inside — but the point of the prefix is that a disarmed
+	* channel must not pay the call at all.
 	*/
-	defaultRoot: _enum([
-		"data",
-		"media",
-		"backup"
-	]).optional()
-});
-var DecoderStatsSchema = object({
-	inputFps: number(),
-	outputFps: number(),
-	avgDecodeTimeMs: number(),
-	droppedFrames: number(),
+	wants(deviceId) {
+		if (!this.on) return false;
+		return this.devices === null || this.devices.has(deviceId);
+	}
 	/**
-	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
-	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
-	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
-	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
+	* Emit one line on this channel, at the channel's declared level.
+	*
+	* The channel name is added as `tags.logChannel` so LogQL can select the
+	* channel without matching on the message text, and whatever `tags` the
+	* caller passed — `deviceId` above all — is preserved.
 	*/
-	lagMs: number().optional(),
-	effectiveFps: number().optional(),
-	adaptiveFps: number().optional()
-});
-var DecoderSessionConfigSchema = object({
-	codec: string(),
-	maxFps: number().default(0),
-	outputFormat: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]).default("jpeg"),
-	scale: number().default(1),
-	width: number().optional(),
-	height: number().optional(),
+	log(logger, message, extras) {
+		if (!this.on) return;
+		const tags = {
+			...extras.tags,
+			logChannel: this.descriptor.name
+		};
+		const line = {
+			...extras,
+			tags
+		};
+		if (this.level === "error") logger.error(message, line);
+		else if (this.level === "warn") logger.warn(message, line);
+		else logger.info(message, line);
+	}
 	/**
-	* Identifier of the camera this decoder session serves. Optional
-	* because the cap is generic (any caller could request decode), but
-	* stream-broker passes it so decoder logs include `deviceId` for
-	* per-camera filtering when diagnosing failures (e.g. node-av
-	* sendPacket errors on a single hung camera).
+	* Arm (or RE-arm, restarting) this channel. Off the hot path only.
+	*
+	* An empty `deviceIds` list is treated as "every camera" rather than "no
+	* camera": a window that matches nothing is indistinguishable from a
+	* disarmed one, and the operator who asked for it would wait for lines that
+	* can never come.
 	*/
-	deviceId: number().int().nonnegative().optional(),
+	arm(window) {
+		const ids = window.deviceIds;
+		this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
+		this.closesAtMs = window.armedUntilMs;
+		this.on = true;
+	}
+	/** Disarm. Off the hot path only. */
+	disarm() {
+		this.on = false;
+		this.devices = null;
+		this.closesAtMs = 0;
+	}
+};
+/**
+* Every channel this PROCESS declares, and the mirror of what is armed on it.
+*
+* One per process. A forked runner has its own, and it is refreshed through
+* the `log-channels` capability by the hub that owns the document — the
+* registry never reaches for a value itself.
+*/
+var LogChannelRegistry = class {
+	gates = /* @__PURE__ */ new Map();
 	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
+	* Declare a channel and get its gate.
+	*
+	* A duplicate name throws. Two declarations of one name is a programming
+	* error, not a merge: the operator would arm one and the other would stay
+	* dark, which is the dead-knob shape (D62) with an extra step.
 	*/
-	tag: string().optional(),
+	declare(descriptor) {
+		const parsed = LogChannelDescriptorSchema.parse(descriptor);
+		if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process — two declarations of one name is a programming error, not a merge`);
+		const gate = new LogChannelGate(parsed);
+		this.gates.set(parsed.name, gate);
+		return gate;
+	}
+	/** The declarations, sorted by name so a list is stable to read and diff. */
+	list() {
+		return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
+	}
+	/** The gate for a declared channel, or `undefined`. */
+	gate(name) {
+		return this.gates.get(name);
+	}
 	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
+	* Apply the FULL set of armed windows. Off the hot path.
 	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
+	* Full, not incremental, and that is the whole design: the document is the
+	* authority, so a channel the document does not name is disarmed here. An
+	* incremental apply would let a disarm get lost in transit and leave a
+	* channel running that nobody can see is running.
+	*
+	* A window already past its deadline is ignored rather than armed — a
+	* restore that re-armed an expired window would make a forgotten diagnostic
+	* immortal across restarts.
+	*
+	* Returns the names it could not place, so the caller can log them: a
+	* channel named in the document that this process does not declare is
+	* either a typo or an addon that has not booted yet, and both deserve a
+	* line rather than silence.
 	*/
-	frameSink: _enum(["callback", "shm"]).default("callback"),
+	apply(windows, nowMs) {
+		const wanted = /* @__PURE__ */ new Map();
+		const unknown = [];
+		for (const window of windows) {
+			if (window.armedUntilMs <= nowMs) continue;
+			if (!this.gates.has(window.channel)) {
+				unknown.push(window.channel);
+				continue;
+			}
+			wanted.set(window.channel, window);
+		}
+		for (const [name, gate] of this.gates) {
+			const window = wanted.get(name);
+			if (window === void 0) gate.disarm();
+			else gate.arm(window);
+		}
+		return unknown;
+	}
 	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
+	* Disarm whatever has run out. Called on a timer, NEVER from a log path — a
+	* diagnostic that adds a `Date.now()` to the path it is measuring measures
+	* itself.
+	*
+	* Returns the names it closed, so the caller can write the one line that
+	* says a window ended and stops "it went quiet" from reading as "the branch
+	* was not taken".
 	*/
-	debug: boolean().optional()
-});
-var EU_DST = {
-	offsetHours: 1,
-	startMonth: 3,
-	startWeekIndex: 5,
-	startWeekday: "Sunday",
-	startHour: 2,
-	endMonth: 10,
-	endWeekIndex: 5,
-	endWeekday: "Sunday",
-	endHour: 3
-};
-var US_DST = {
-	offsetHours: 1,
-	startMonth: 3,
-	startWeekIndex: 2,
-	startWeekday: "Sunday",
-	startHour: 2,
-	endMonth: 11,
-	endWeekIndex: 1,
-	endWeekday: "Sunday",
-	endHour: 2
+	tick(nowMs) {
+		const closed = [];
+		for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
+			gate.disarm();
+			closed.push(name);
+		}
+		return closed;
+	}
+	/** The channels armed right now, as the document would describe them. */
+	armed() {
+		const out = [];
+		for (const [name, gate] of this.gates) if (gate.on) out.push({
+			channel: name,
+			armedUntilMs: gate.armedUntilMs,
+			deviceIds: null
+		});
+		return out;
+	}
 };
 /**
-* Curated catalogue of common world zones, grouped by region. Not
-* exhaustive — covers the everyday zones an operator is likely to pick.
+* Process-wide holder for the {@link LogChannelRegistry}.
+*
+* Three call sites that never meet need the SAME instance: the hot paths that
+* declare a gate at module scope, the `log-channels` provider that enumerates
+* the declarations for the hub, and the same provider applying the windows the
+* document hands down. A registry built inside any one of them would be
+* refreshed and collected — the shape of a knob that never does anything.
+*
+* Same idiom as `logging-gate.singleton.ts` and
+* `http-request-census.singleton.ts`.
 */
-var TIMEZONES = [
-	{
-		id: "UTC",
-		label: "UTC (UTC+0)",
-		region: "Universal",
-		stdOffsetMinutes: 0,
-		dst: null
-	},
-	{
-		id: "Europe/London",
-		label: "Europe/London (UTC+0 / BST)",
-		region: "Europe",
-		stdOffsetMinutes: 0,
-		dst: EU_DST
-	},
-	{
-		id: "Europe/Rome",
-		label: "Europe/Rome (UTC+1 / CEST)",
-		region: "Europe",
-		stdOffsetMinutes: 60,
-		dst: EU_DST
-	},
-	{
-		id: "Europe/Paris",
-		label: "Europe/Paris (UTC+1 / CEST)",
-		region: "Europe",
-		stdOffsetMinutes: 60,
-		dst: EU_DST
-	},
-	{
-		id: "Europe/Berlin",
-		label: "Europe/Berlin (UTC+1 / CEST)",
-		region: "Europe",
-		stdOffsetMinutes: 60,
-		dst: EU_DST
-	},
-	{
-		id: "Europe/Madrid",
-		label: "Europe/Madrid (UTC+1 / CEST)",
-		region: "Europe",
-		stdOffsetMinutes: 60,
-		dst: EU_DST
-	},
-	{
-		id: "Europe/Amsterdam",
-		label: "Europe/Amsterdam (UTC+1 / CEST)",
-		region: "Europe",
-		stdOffsetMinutes: 60,
-		dst: EU_DST
-	},
-	{
-		id: "Europe/Istanbul",
-		label: "Europe/Istanbul (UTC+3)",
-		region: "Europe",
-		stdOffsetMinutes: 180,
-		dst: null
-	},
-	{
-		id: "America/New_York",
-		label: "America/New York (UTC−5 / EDT)",
-		region: "Americas",
-		stdOffsetMinutes: -300,
-		dst: US_DST
-	},
-	{
-		id: "America/Chicago",
-		label: "America/Chicago (UTC−6 / CDT)",
-		region: "Americas",
-		stdOffsetMinutes: -360,
-		dst: US_DST
-	},
-	{
-		id: "America/Denver",
-		label: "America/Denver (UTC−7 / MDT)",
-		region: "Americas",
-		stdOffsetMinutes: -420,
-		dst: US_DST
-	},
-	{
-		id: "America/Los_Angeles",
-		label: "America/Los Angeles (UTC−8 / PDT)",
-		region: "Americas",
-		stdOffsetMinutes: -480,
-		dst: US_DST
-	},
-	{
-		id: "America/Sao_Paulo",
-		label: "America/Sao Paulo (UTC−3)",
-		region: "Americas",
-		stdOffsetMinutes: -180,
-		dst: null
-	},
-	{
-		id: "Asia/Dubai",
-		label: "Asia/Dubai (UTC+4)",
-		region: "Asia",
-		stdOffsetMinutes: 240,
-		dst: null
-	},
-	{
-		id: "Asia/Kolkata",
-		label: "Asia/Kolkata (UTC+5:30)",
-		region: "Asia",
-		stdOffsetMinutes: 330,
-		dst: null
-	},
-	{
-		id: "Asia/Singapore",
-		label: "Asia/Singapore (UTC+8)",
-		region: "Asia",
-		stdOffsetMinutes: 480,
-		dst: null
-	},
-	{
-		id: "Asia/Shanghai",
-		label: "Asia/Shanghai (UTC+8)",
-		region: "Asia",
-		stdOffsetMinutes: 480,
-		dst: null
-	},
-	{
-		id: "Asia/Tokyo",
-		label: "Asia/Tokyo (UTC+9)",
-		region: "Asia",
-		stdOffsetMinutes: 540,
-		dst: null
-	},
-	{
-		id: "Australia/Sydney",
-		label: "Australia/Sydney (UTC+10 / AEDT)",
-		region: "Oceania",
-		stdOffsetMinutes: 600,
-		dst: {
-			offsetHours: 1,
-			startMonth: 10,
-			startWeekIndex: 1,
-			startWeekday: "Sunday",
-			startHour: 2,
-			endMonth: 4,
-			endWeekIndex: 1,
-			endWeekday: "Sunday",
-			endHour: 3
+var instance = null;
+/** The process-wide log channel registry. Created empty on first use. */
+function getLogChannelRegistry() {
+	instance ??= new LogChannelRegistry();
+	return instance;
+}
+/**
+* Declare a channel on the process-wide registry and get its gate.
+*
+* The one call an addon makes. Keep the returned gate in a module-scope
+* `const`: looking a channel up by name per line would put a Map lookup on
+* exactly the path this mechanism exists to keep free.
+*
+* `scripts/check-log-channel-gated.ts` reads these call sites. It pairs the
+* declared name with the binding it is assigned to and refuses to let a
+* channel ship that no `<binding>.on` anywhere consults — a declared channel
+* nobody reads is a knob the operator turns with nothing happening, forever,
+* and without a line. That is D62, and this repo has now shipped it three
+* times (`audioThresholdDbfs`, the HA entities with no source, the second
+* per-camera switch that wrote a store nobody read).
+*/
+function declareLogChannel(descriptor) {
+	return getLogChannelRegistry().declare(descriptor);
+}
+/**
+* Build the `log-channels` provider for this process.
+*
+* `logger` is used ONLY off the hot path — for the arm/expiry lines — so a
+* channel that is never armed costs this module nothing but a timer.
+*/
+function createLogChannelsProvider(logger, options = {}) {
+	const registry = getLogChannelRegistry();
+	const now = options.now ?? Date.now;
+	const tickMs = options.tickMs ?? 5e3;
+	const timer = setInterval(() => {
+		const closed = registry.tick(now());
+		for (const name of closed) logger.info("log channel window closed", {
+			tags: { logChannel: name },
+			meta: { channel: name }
+		});
+	}, tickMs);
+	timer.unref?.();
+	return {
+		list: () => registry.list(),
+		apply: (input) => {
+			const unknown = registry.apply(input.windows, now());
+			const armed = registry.armed();
+			logger.info("log channels applied", { meta: {
+				armed: armed.map((window) => window.channel),
+				unknown,
+				declared: registry.list().length
+			} });
+			return {
+				armed: armed.length,
+				unknown
+			};
+		},
+		stop: () => {
+			clearInterval(timer);
 		}
-	}
-];
-/** Resolve an IANA id to its `Timezone`, or `undefined` if unknown. */
-function findTimezone(id) {
-	return TIMEZONES.find((tz) => tz.id === id);
+	};
 }
 /**
 * Distinct (device, family, variant) counters one instance will hold.
@@ -11114,12 +11118,30 @@ var BackupDestinationInfoSchema = object({
 	lastSuccessAt: number().optional(),
 	/** Newest-archive size from `manifests.json`, or undefined. */
 	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
 	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
 	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
@@ -11282,8 +11304,16 @@ var BackupScheduleSchema = object({
 	retentionCount: number().int().min(1).max(1e3),
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
+	/**
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
+	*/
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
 	/** ms-epoch of next computed firing (read-only, filled on list). */
 	nextRunAt: number().optional()
 });
@@ -11332,14 +11362,7 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	locationId: string(),
 	enabled: boolean(),
 	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
-	*/
-	cron: string().optional()
+	label: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -22649,7 +22672,7 @@ method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -39977,12 +40000,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storage.list": {
 		capName: "storage",
 		capScope: "system",