@camstack/system 1.2.159 → 1.2.161

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { A as bareAddonId, Gt as createEvent, Mt as BaseAddon, Rt as DeviceType, U as doorbellCapability, _ as SOURCE_DEVICE_TYPES, et as isSameAddonId, g as SOURCE_CAPS, in as EventCategory, jt as errMsg, q as evaluateSensorEdge, tt as isSourceCap } from "../../dist-DLh4_rn3.mjs";
+import { A as bareAddonId, Gt as createEvent, Mt as BaseAddon, Rt as DeviceType, U as doorbellCapability, _ as SOURCE_DEVICE_TYPES, et as isSameAddonId, g as SOURCE_CAPS, in as EventCategory, jt as errMsg, q as evaluateSensorEdge, tt as isSourceCap } from "../../dist-D4xNBlJM.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-DLh4_rn3.mjs";
+import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-D4xNBlJM.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as createEvent, Mt as BaseAddon, in as EventCategory, jt as errMsg } from "../../dist-DLh4_rn3.mjs";
+import { Gt as createEvent, Mt as BaseAddon, in as EventCategory, jt as errMsg } from "../../dist-D4xNBlJM.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { C as UserRecordSchema, Mt as BaseAddon, O as authProviderCapability, Ot as userManagementCapability, b as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-DLh4_rn3.mjs";
+import { C as UserRecordSchema, Mt as BaseAddon, O as authProviderCapability, Ot as userManagementCapability, b as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-D4xNBlJM.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 const require_tls = require("../../tls-BxQlomxd.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, at as localNetworkCapability, in as EventCategory } from "../../dist-DLh4_rn3.mjs";
+import { Mt as BaseAddon, at as localNetworkCapability, in as EventCategory } from "../../dist-D4xNBlJM.mjs";
 import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-DOTmtLCW.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-DLh4_rn3.mjs";
+import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-D4xNBlJM.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 let node_fs_promises = require("node:fs/promises");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as createEvent, Mt as BaseAddon, X as foldSnapshotByFunction, gt as resolveBucketMs, ht as reducePoints, in as EventCategory, jt as errMsg, lt as metricsProviderCapability } from "../../dist-DLh4_rn3.mjs";
+import { Gt as createEvent, Mt as BaseAddon, X as foldSnapshotByFunction, gt as resolveBucketMs, ht as reducePoints, in as EventCategory, jt as errMsg, lt as metricsProviderCapability } from "../../dist-D4xNBlJM.mjs";
 import { readFile, readdir } from "node:fs/promises";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Mt as BaseAddon, W as enumerateInferenceDevices, in as EventCategory, jt as errMsg, pt as platformProbeCapability, qt as emitReadiness, xt as scoreRuntimes } from "../../dist-DLh4_rn3.mjs";
+import { Mt as BaseAddon, W as enumerateInferenceDevices, in as EventCategory, jt as errMsg, pt as platformProbeCapability, qt as emitReadiness, xt as scoreRuntimes } from "../../dist-D4xNBlJM.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, in as EventCategory } from "../../dist-DLh4_rn3.mjs";
+import { Mt as BaseAddon, in as EventCategory } from "../../dist-D4xNBlJM.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { A as bareAddonId, Ct as snapshotCapability, Dt as streamQualityLabel, It as DeviceFeature, Mt as BaseAddon, Rt as DeviceType, Zt as nodePin, i as BatteryStatusSchema, in as EventCategory, j as batteryCapability, jt as errMsg, z as deriveBatteryPresence } from "../../dist-DLh4_rn3.mjs";
+import { A as bareAddonId, Ct as snapshotCapability, Dt as streamQualityLabel, It as DeviceFeature, Mt as BaseAddon, Rt as DeviceType, Zt as nodePin, i as BatteryStatusSchema, in as EventCategory, j as batteryCapability, jt as errMsg, z as deriveBatteryPresence } from "../../dist-D4xNBlJM.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as storageProviderCapability, Mt as BaseAddon, Y as filesystemBrowseCapability } from "../../dist-DLh4_rn3.mjs";
+import { Et as storageProviderCapability, Mt as BaseAddon, Y as filesystemBrowseCapability } from "../../dist-D4xNBlJM.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/filter-compiler.d.ts

@@ -17,6 +17,22 @@
  * was written against it. `mutate` mode refuses both, before any SQL exists.
  * Emptying a collection is a legitimate thing to want, and it should be a
  * differently-named operation rather than a filter that happens to be empty.
+ * `measure` mode sits between them — see {@link FilterMode}.
+ *
+ * ── NULL is a value the language can name ────────────────────────────────
+ *
+ * A `null` on the right-hand side of `where` / `whereNot` compiles to `IS NULL`
+ * / `IS NOT NULL`, and binds no parameter. It used to compile to `= ?` / `!= ?`
+ * with a NULL parameter, and SQL three-valued logic makes both of those NULL
+ * for every row: the filter matched NOTHING and the caller got a `0` that
+ * looked like an answer. `pipelineAnalytics.countUnstampedEventMedia` — the
+ * gate that decides whether 152 GB of event media may be repointed onto
+ * another disk — asks exactly "how many rows have no `locationId`", and `0` is
+ * the one value that opens it. `whereNot: { field: null }` was the same defect
+ * mirrored: `(expr IS NULL OR expr != NULL)` is TRUE for a NULL row and NULL
+ * for every other, so it selected precisely the rows it was asked to exclude.
+ *
+ * Nothing could ever have MEANT `= NULL`; there is no caller to preserve.
  */
 /** The part of a declared collection this compiler needs. */
 export interface CollectionShape {
@@ -29,10 +45,28 @@ export interface CollectionShape {
      */
     readonly kvBlobColumn: string | null;
 }
-export type FilterMode = 'select' | 'mutate';
+/**
+ * How forgiving this compilation is allowed to be.
+ *
+ * - `select` — a predicate naming a field the collection cannot express is
+ *   SKIPPED. The caller receives the rows and can see for itself that the
+ *   filter did not bite; the cost is extra rows, not a wrong belief.
+ * - `measure` — the same predicate is REFUSED. A count, an aggregate or a
+ *   histogram hands back a NUMBER: the whole collection and the intended
+ *   subset are the same shape, and the caller has no way to tell which one it
+ *   was given. An empty filter is still fine — `COUNT(*)` over everything is a
+ *   legitimate question, unlike `DELETE` over everything. This closes the
+ *   asymmetry `aggregate` already applied to its FIELDS ("a dropped aggregate
+ *   returns a number that is wrong and looks exactly like a real one") but not
+ *   to its predicate.
+ * - `mutate` — refuses that AND an empty filter, which on a bulk write is the
+ *   entire collection.
+ */
+export type FilterMode = 'select' | 'measure' | 'mutate';
 /** Marshals a JS value to what the driver should bind. */
 export type SerializeValue = (value: unknown) => unknown;
 export interface QueryFilterInput {
+    /** Equality. A `null` value means `IS NULL` — see the file docblock. */
     readonly where?: Readonly<Record<string, unknown>>;
     readonly whereIn?: Readonly<Record<string, readonly unknown[]>>;
     readonly whereBetween?: Readonly<Record<string, readonly [unknown, unknown]>>;
@@ -40,6 +74,10 @@ export interface QueryFilterInput {
      * NULL-safe exclusion, compiled as `(expr IS NULL OR expr != ?)`. SQL `!=`
      * alone drops NULL rows, and on a nullable column those are precisely the
      * rows a "not this kind" filter must keep (they predate the column).
+     *
+     * A `null` VALUE means `IS NOT NULL` instead: "everything except the rows
+     * that carry no value" is the only reading of `whereNot: { f: null }` that
+     * is not a contradiction.
      */
     readonly whereNot?: Readonly<Record<string, unknown>>;
 }
@@ -53,7 +91,8 @@ export interface CompiledFilter {
     readonly whereSql: string;
     readonly params: readonly unknown[];
 }
-/** Thrown by `mutate` mode. Distinct type so a caller can map it to a 400. */
+/** Thrown by `measure` and `mutate` mode. Distinct type so a caller can map it
+ *  to a 400. */
 export declare class UnsafeFilterError extends Error {
     constructor(message: string);
 }

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -210,8 +210,12 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * (visibility, kind, device, time window, expiry) — so `total` counted rows
      * the page could never show, including other users'.
      *
-     * `select` mode, deliberately: `count` must be forgiving in exactly the way
-     * `query` is, or the two disagree again for a new reason.
+     * `measure` mode. `count` compiles the same predicates `query` does — the
+     * two must never disagree about WHICH rows they are talking about — but it
+     * refuses a predicate it cannot express rather than skipping it. `query`
+     * hands back rows and a caller can see the filter did not bite; a count
+     * hands back a number, and the whole collection and the intended subset are
+     * the same shape.
      */
     count({ namespace, collection, filter }: SettingsCountInput): Promise<number>;
     /**
@@ -223,8 +227,10 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * projection — an unresolvable field THROWS rather than being dropped, because
      * a missing aggregate comes back as a number that looks real.
      *
-     * `select` mode on the filter, so this agrees with `query` and `count` about
-     * which rows it is talking about.
+     * `measure` mode on the filter, so this agrees with `query` and `count`
+     * about which rows it is talking about — and, since 2026-08-30, refuses an
+     * unresolvable PREDICATE for the same reason it already refused an
+     * unresolvable FIELD. Both come back as a number that looks real.
      */
     aggregate({ namespace, collection, fields, filter, }: SettingsAggregateInput): Promise<SettingsAggregateResult>;
     histogram({ namespace, collection, field, bucketSize, origin, filter, }: SettingsHistogramInput): Promise<readonly HistogramBucket[]>;
@@ -305,15 +311,17 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * connection whose `sqlite_stat1` visibility and temp schema match.
      *
      * `EXPLAIN QUERY PLAN` prepares and plans; it does not execute the statement,
-     * so it costs no page reads of its own. It is still called only from the
-     * slow-call path, once per shape per window.
+     * so it costs no page reads of its own. In production it is called only from
+     * the slow-call path, once per shape per window; it is public so a guard can
+     * assert that a declared index is the one the planner actually picks — "we
+     * added an index" and "the query uses it" are different claims.
      *
      * Never throws. A plan that cannot be taken (a statement the engine will no
      * longer prepare, a closed handle mid-shutdown) is a missing ANSWER, not a
      * failure worth turning a slow query into a crash — the profiler falls back
      * to the line it would have printed anyway.
      */
-    private explainQueryPlan;
+    explainQueryPlan(sql: string, params: readonly unknown[]): readonly string[];
     /**
      * Run one synchronous statement under the profiler.
      *

package/dist/builtins/storage-orchestrator/storage-migration-coordinator.d.ts

@@ -213,9 +213,10 @@ export declare class StorageMigrationCoordinator {
      *
      * The gate is the RE-COUNT, not the seal job's terminal state: a seal that
      * failed some rows still finishes, and "finished" is not "there are none
-     * left". A non-zero count here fails the job while nothing has been paused
+     * left". A remaining row here fails the job while nothing has been paused
      * and nothing has been repointed, which is the cheapest possible place to
-     * discover it.
+     * discover it. So does a re-count that could not be TAKEN: the gate opens on
+     * a measured absence, and only on that.
      *
      * The seal's own mover job id is deliberately NOT durable. It is idempotent
      * and cheap, so a coordinator restart mid-seal simply re-runs the whole

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ck2jkBZk.js");
+const require_dist = require("../../dist-Keu5TDO7.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -284,6 +284,18 @@ var REVERSE_PARTICIPANTS = [
 	"pipeline"
 ];
 /**
+* One lane of the seal gate, as an operator reads it.
+*
+* "0" and "unknown" must not print the same, and neither may be silently
+* turned into the other: `{ present: true, rows: null }` is "there are some
+* and the count did not land", which is a refusal with a missing number, not a
+* clean lane.
+*/
+function describeUnstamped(lane) {
+	if (!lane.present) return "0";
+	return lane.rows === null ? "an unknown number of" : lane.rows.toString();
+}
+/**
 * Durable orchestration layer over the independent recorder and event-media
 * movers. It owns the only public migration state machine; participants expose
 * intentionally narrow lease/move primitives and never alter camera settings.
@@ -331,12 +343,21 @@ var StorageMigrationCoordinator = class {
 		if (moves.length === 0) throw new Error("select at least one storage class");
 		if (moves.some((move) => move.storageClass === "eventMedia")) {
 			const unstamped = await this.deps.participants.analytics.countUnstamped();
-			if (unstamped.total > 0) {
-				if (mode === "nonBlocking") throw new Error(`${unstamped.total.toString()} event-media row(s) still carry no locationId (${unstamped.media.toString()} media, ${unstamped.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+			if (unstamped === null) {
+				if (mode === "nonBlocking") throw new Error("could not determine whether any event-media row still carries no locationId. A non-blocking cutover repoints the default and would silently orphan every such row, so an unmeasured collection is refused exactly like a non-empty one. Retry, or run the blocking mode, which stamps rows as it moves them.");
 				findings.push({
 					code: "unstampedEventMediaRows",
 					storageClass: "eventMedia",
-					message: `${unstamped.total.toString()} event-media row(s) carry no locationId. This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
+					message: "the count of event-media rows carrying no locationId could not be taken — treat it as unknown, not as zero. This blocking migration stamps them as it moves them, so it is safe regardless; a non-blocking one would be refused."
+				});
+			} else if (unstamped.anyPresent) {
+				const scale = unstamped.total === null ? "an unknown number of" : unstamped.total.toString();
+				const perLane = `${describeUnstamped(unstamped.media)} media, ${describeUnstamped(unstamped.retrainFrames)} retrain frames`;
+				if (mode === "nonBlocking") throw new Error(`${scale} event-media row(s) still carry no locationId (${perLane}). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+				findings.push({
+					code: "unstampedEventMediaRows",
+					storageClass: "eventMedia",
+					message: `${scale} event-media row(s) carry no locationId (${perLane}). This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
 				});
 			}
 		}
@@ -585,6 +606,7 @@ var StorageMigrationCoordinator = class {
 				const remaining = residue.filter((entry) => entry.storageClass === storageClass);
 				if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its default location — there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
 				for (const entry of remaining) {
+					if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED — a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen, or make an enabled location the "${storageClass}" default first.`);
 					moves.push({
 						storageClass,
 						fromLocationId: entry.fromLocationId,
@@ -835,6 +857,7 @@ var StorageMigrationCoordinator = class {
 					filesMoved: status.filesMoved,
 					filesTotal: status.filesTotal,
 					bytesMoved: status.bytesMoved,
+					...status.rowsReconciled === void 0 ? {} : { rowsReconciled: status.rowsReconciled },
 					startedAt: status.startedAt,
 					observedAt: this.deps.now()
 				};
@@ -857,9 +880,10 @@ var StorageMigrationCoordinator = class {
 	*
 	* The gate is the RE-COUNT, not the seal job's terminal state: a seal that
 	* failed some rows still finishes, and "finished" is not "there are none
-	* left". A non-zero count here fails the job while nothing has been paused
+	* left". A remaining row here fails the job while nothing has been paused
 	* and nothing has been repointed, which is the cheapest possible place to
-	* discover it.
+	* discover it. So does a re-count that could not be TAKEN: the gate opens on
+	* a measured absence, and only on that.
 	*
 	* The seal's own mover job id is deliberately NOT durable. It is idempotent
 	* and cheap, so a coordinator restart mid-seal simply re-runs the whole
@@ -869,7 +893,8 @@ var StorageMigrationCoordinator = class {
 	async sealEventMedia(job) {
 		const move = job.moves.find((candidate) => candidate.storageClass === "eventMedia");
 		if (move === void 0) return;
-		if ((await this.deps.participants.analytics.countUnstamped()).total > 0) {
+		const before = await this.deps.participants.analytics.countUnstamped();
+		if (before === null || before.anyPresent) {
 			const started = await this.deps.participants.analytics.startDrain({
 				toLocationId: move.fromLocationId,
 				mode: "seal"
@@ -878,7 +903,8 @@ var StorageMigrationCoordinator = class {
 			if (job.cancelRequested) return;
 		}
 		const after = await this.deps.participants.analytics.countUnstamped();
-		if (after.total > 0) throw new Error(`event-media seal left ${after.total.toString()} row(s) without a locationId (${after.media.toString()} media, ${after.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
+		if (after === null) throw new Error("event-media seal ran, but whether any row still carries no locationId could not be measured afterwards. Unknown is not zero; nothing has been paused or repointed.");
+		if (after.anyPresent) throw new Error(`event-media seal left ${after.total === null ? "an unknown number of" : after.total.toString()} row(s) without a locationId (${describeUnstamped(after.media)} media, ${describeUnstamped(after.retrainFrames)} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
 	}
 	async waitForSeal(job, moverJobId) {
 		const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -1426,6 +1452,34 @@ var StorageOrchestratorService = class {
 			backfilled: backfill.length,
 			total: this.locations.size
 		} });
+		this.reportDisabledDefaults();
+	}
+	/**
+	* Shout about a persisted row that is BOTH the type default and disabled.
+	*
+	* `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
+	* default) and neither can `setDefaultLocations` — but hydrate writes rows
+	* straight into the map without either, so a hand-edited store, a partial
+	* migration or a row written by another build can. It matters because every
+	* bare-type ref resolves through {@link getDefaultLocation}: on such a row
+	* `storage.write({ location: 'eventMedia' })` and the migration coordinator's
+	* drain destination both point at a disk the operator turned off. That is the
+	* one thing this model must never do silently.
+	*
+	* Reported, never repaired: flipping an operator's flag back on at boot would
+	* be the system overruling the switch instead of obeying it. The coordinator
+	* refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
+	* path is deliberately left working, because narrowing a READ is a worse bug
+	* than the one this line reports.
+	*/
+	reportDisabledDefaults() {
+		for (const loc of this.locations.values()) {
+			if (!loc.isDefault || loc.enabled !== false) continue;
+			this.logger.error("storage-orchestrator: the type DEFAULT is disabled — every bare-type ref for this type resolves to a location the operator turned off. Enable it, or make another location the default.", { meta: {
+				id: loc.id,
+				type: loc.type
+			} });
+		}
 	}
 	/**
 	* Inject the declaration-driven cardinality source. Called once by the
@@ -1497,6 +1551,7 @@ var StorageOrchestratorService = class {
 			loaded: this.locations.size,
 			isSystemUpgraded: upgraded
 		} });
+		this.reportDisabledDefaults();
 	}
 	/**
 	* Boot backfill (SP1): stamp `nodeId` on every persisted node-local

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, N as collectSecretConfigKeys, Qt as parseJsonObject, S as StorageMigrationJobSchema, St as settingsStoreCapability, Tt as storageMigrationCapability, m as REDACTED_SECRET, wt as storageCapability, x as StorageLocationTypeSchema } from "../../dist-DLh4_rn3.mjs";
+import { Mt as BaseAddon, N as collectSecretConfigKeys, Qt as parseJsonObject, S as StorageMigrationJobSchema, St as settingsStoreCapability, Tt as storageMigrationCapability, m as REDACTED_SECRET, wt as storageCapability, x as StorageLocationTypeSchema } from "../../dist-D4xNBlJM.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -277,6 +277,18 @@ var REVERSE_PARTICIPANTS = [
 	"pipeline"
 ];
 /**
+* One lane of the seal gate, as an operator reads it.
+*
+* "0" and "unknown" must not print the same, and neither may be silently
+* turned into the other: `{ present: true, rows: null }` is "there are some
+* and the count did not land", which is a refusal with a missing number, not a
+* clean lane.
+*/
+function describeUnstamped(lane) {
+	if (!lane.present) return "0";
+	return lane.rows === null ? "an unknown number of" : lane.rows.toString();
+}
+/**
 * Durable orchestration layer over the independent recorder and event-media
 * movers. It owns the only public migration state machine; participants expose
 * intentionally narrow lease/move primitives and never alter camera settings.
@@ -324,12 +336,21 @@ var StorageMigrationCoordinator = class {
 		if (moves.length === 0) throw new Error("select at least one storage class");
 		if (moves.some((move) => move.storageClass === "eventMedia")) {
 			const unstamped = await this.deps.participants.analytics.countUnstamped();
-			if (unstamped.total > 0) {
-				if (mode === "nonBlocking") throw new Error(`${unstamped.total.toString()} event-media row(s) still carry no locationId (${unstamped.media.toString()} media, ${unstamped.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+			if (unstamped === null) {
+				if (mode === "nonBlocking") throw new Error("could not determine whether any event-media row still carries no locationId. A non-blocking cutover repoints the default and would silently orphan every such row, so an unmeasured collection is refused exactly like a non-empty one. Retry, or run the blocking mode, which stamps rows as it moves them.");
 				findings.push({
 					code: "unstampedEventMediaRows",
 					storageClass: "eventMedia",
-					message: `${unstamped.total.toString()} event-media row(s) carry no locationId. This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
+					message: "the count of event-media rows carrying no locationId could not be taken — treat it as unknown, not as zero. This blocking migration stamps them as it moves them, so it is safe regardless; a non-blocking one would be refused."
+				});
+			} else if (unstamped.anyPresent) {
+				const scale = unstamped.total === null ? "an unknown number of" : unstamped.total.toString();
+				const perLane = `${describeUnstamped(unstamped.media)} media, ${describeUnstamped(unstamped.retrainFrames)} retrain frames`;
+				if (mode === "nonBlocking") throw new Error(`${scale} event-media row(s) still carry no locationId (${perLane}). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+				findings.push({
+					code: "unstampedEventMediaRows",
+					storageClass: "eventMedia",
+					message: `${scale} event-media row(s) carry no locationId (${perLane}). This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
 				});
 			}
 		}
@@ -578,6 +599,7 @@ var StorageMigrationCoordinator = class {
 				const remaining = residue.filter((entry) => entry.storageClass === storageClass);
 				if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its default location — there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
 				for (const entry of remaining) {
+					if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED — a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen, or make an enabled location the "${storageClass}" default first.`);
 					moves.push({
 						storageClass,
 						fromLocationId: entry.fromLocationId,
@@ -828,6 +850,7 @@ var StorageMigrationCoordinator = class {
 					filesMoved: status.filesMoved,
 					filesTotal: status.filesTotal,
 					bytesMoved: status.bytesMoved,
+					...status.rowsReconciled === void 0 ? {} : { rowsReconciled: status.rowsReconciled },
 					startedAt: status.startedAt,
 					observedAt: this.deps.now()
 				};
@@ -850,9 +873,10 @@ var StorageMigrationCoordinator = class {
 	*
 	* The gate is the RE-COUNT, not the seal job's terminal state: a seal that
 	* failed some rows still finishes, and "finished" is not "there are none
-	* left". A non-zero count here fails the job while nothing has been paused
+	* left". A remaining row here fails the job while nothing has been paused
 	* and nothing has been repointed, which is the cheapest possible place to
-	* discover it.
+	* discover it. So does a re-count that could not be TAKEN: the gate opens on
+	* a measured absence, and only on that.
 	*
 	* The seal's own mover job id is deliberately NOT durable. It is idempotent
 	* and cheap, so a coordinator restart mid-seal simply re-runs the whole
@@ -862,7 +886,8 @@ var StorageMigrationCoordinator = class {
 	async sealEventMedia(job) {
 		const move = job.moves.find((candidate) => candidate.storageClass === "eventMedia");
 		if (move === void 0) return;
-		if ((await this.deps.participants.analytics.countUnstamped()).total > 0) {
+		const before = await this.deps.participants.analytics.countUnstamped();
+		if (before === null || before.anyPresent) {
 			const started = await this.deps.participants.analytics.startDrain({
 				toLocationId: move.fromLocationId,
 				mode: "seal"
@@ -871,7 +896,8 @@ var StorageMigrationCoordinator = class {
 			if (job.cancelRequested) return;
 		}
 		const after = await this.deps.participants.analytics.countUnstamped();
-		if (after.total > 0) throw new Error(`event-media seal left ${after.total.toString()} row(s) without a locationId (${after.media.toString()} media, ${after.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
+		if (after === null) throw new Error("event-media seal ran, but whether any row still carries no locationId could not be measured afterwards. Unknown is not zero; nothing has been paused or repointed.");
+		if (after.anyPresent) throw new Error(`event-media seal left ${after.total === null ? "an unknown number of" : after.total.toString()} row(s) without a locationId (${describeUnstamped(after.media)} media, ${describeUnstamped(after.retrainFrames)} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
 	}
 	async waitForSeal(job, moverJobId) {
 		const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -1419,6 +1445,34 @@ var StorageOrchestratorService = class {
 			backfilled: backfill.length,
 			total: this.locations.size
 		} });
+		this.reportDisabledDefaults();
+	}
+	/**
+	* Shout about a persisted row that is BOTH the type default and disabled.
+	*
+	* `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
+	* default) and neither can `setDefaultLocations` — but hydrate writes rows
+	* straight into the map without either, so a hand-edited store, a partial
+	* migration or a row written by another build can. It matters because every
+	* bare-type ref resolves through {@link getDefaultLocation}: on such a row
+	* `storage.write({ location: 'eventMedia' })` and the migration coordinator's
+	* drain destination both point at a disk the operator turned off. That is the
+	* one thing this model must never do silently.
+	*
+	* Reported, never repaired: flipping an operator's flag back on at boot would
+	* be the system overruling the switch instead of obeying it. The coordinator
+	* refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
+	* path is deliberately left working, because narrowing a READ is a worse bug
+	* than the one this line reports.
+	*/
+	reportDisabledDefaults() {
+		for (const loc of this.locations.values()) {
+			if (!loc.isDefault || loc.enabled !== false) continue;
+			this.logger.error("storage-orchestrator: the type DEFAULT is disabled — every bare-type ref for this type resolves to a location the operator turned off. Enable it, or make another location the default.", { meta: {
+				id: loc.id,
+				type: loc.type
+			} });
+		}
 	}
 	/**
 	* Inject the declaration-driven cardinality source. Called once by the
@@ -1490,6 +1544,7 @@ var StorageOrchestratorService = class {
 			loaded: this.locations.size,
 			isSystemUpgraded: upgraded
 		} });
+		this.reportDisabledDefaults();
 	}
 	/**
 	* Boot backfill (SP1): stamp `nodeId` on every persisted node-local