@camstack/system 1.2.165 → 1.2.167

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,7 +1,10 @@
-import { Mt as BaseAddon, N as collectSecretConfigKeys, Qt as parseJsonObject, S as StorageMigrationJobSchema, St as settingsStoreCapability, Tt as storageMigrationCapability, m as REDACTED_SECRET, wt as storageCapability, x as StorageLocationTypeSchema } from "../../dist-BpsHt11f.mjs";
+import { $t as parseJsonObject, C as StorageMigrationJobSchema, Ct as settingsStoreCapability, Et as storageMigrationCapability, Nt as BaseAddon, P as collectSecretConfigKeys, S as StorageLocationTypeSchema, Tt as storageCapability, m as REDACTED_SECRET, x as StorageCleanupJobSchema } from "../../dist-Dw9cm1NS.mjs";
+import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
+import { opendir, readdir } from "node:fs/promises";
 import * as path$1 from "node:path";
+import path from "node:path";
 //#region src/builtins/storage-orchestrator/location-store.ts
 /**
 * @durable class=config owner=storage-orchestrator
@@ -285,17 +288,22 @@ var StorageMigrationCoordinator = class {
 		for (const storageClass of STORAGE_CLASSES) {
 			const targetId = input.destinations[storageClass];
 			if (targetId === void 0) continue;
-			const source = this.deps.locations.getDefaultLocation(storageClass);
-			if (!source) throw new Error(`No default storage location for "${storageClass}"`);
+			const namedSourceId = input.sources?.[storageClass];
+			const defaultLoc = this.deps.locations.getDefaultLocation(storageClass);
+			const source = namedSourceId ? this.deps.locations.getLocationById(namedSourceId) : defaultLoc;
+			if (!source) throw new Error(namedSourceId ? `Storage location "${namedSourceId}" not found` : `No default storage location for "${storageClass}"`);
+			if (source.type !== storageClass) throw new Error(`Storage location "${source.id}" is type "${source.type}", expected "${storageClass}"`);
 			const target = this.deps.locations.getLocationById(targetId);
 			if (!target) throw new Error(`Storage location "${targetId}" not found`);
 			if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
-			if (source.id === target.id) throw new Error(`Storage location "${targetId}" is already the "${storageClass}" default`);
+			if (source.id === target.id) throw new Error(namedSourceId ? `Source and destination are the same location ("${targetId}")` : `Storage location "${targetId}" is already the "${storageClass}" default`);
+			const freezeSource = defaultLoc !== void 0 && source.id !== defaultLoc.id;
 			if (!MOVER_CLASSES.includes(storageClass)) throw new Error(`No mover owns "${storageClass}" — the migration can repoint its default but cannot move its bytes. Move it by hand, then repoint the default with upsertLocation.`);
 			moves.push({
 				storageClass,
 				fromLocationId: source.id,
 				toLocationId: target.id,
+				freezeSource,
 				moverJobId: null,
 				state: null,
 				error: null,
@@ -326,11 +334,13 @@ var StorageMigrationCoordinator = class {
 		}
 		return {
 			destinations: input.destinations,
+			sources: input.sources,
 			mode,
-			moves: moves.map(({ storageClass, fromLocationId, toLocationId }) => ({
+			moves: moves.map(({ storageClass, fromLocationId, toLocationId, freezeSource }) => ({
 				storageClass,
 				fromLocationId,
-				toLocationId
+				toLocationId,
+				freezeSource
 			})),
 			findings
 		};
@@ -360,12 +370,12 @@ var StorageMigrationCoordinator = class {
 		this.startReserved = true;
 		try {
 			const existing = await this.status();
-			if (existing && isTerminal(existing) && existing.pausedParticipants.length > 0) {
+			if (existing && isTerminal$1(existing) && existing.pausedParticipants.length > 0) {
 				await this.releaseAfterTerminal(existing);
 				await this.persist(existing);
 				if (existing.pausedParticipants.length > 0) throw new Error(`storage migration ${existing.jobId} still holds maintenance leases`);
 			}
-			if (existing && !isTerminal(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
+			if (existing && !isTerminal$1(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
 			const plan = await this.plan(input);
 			const now = this.deps.now();
 			const job = {
@@ -373,6 +383,7 @@ var StorageMigrationCoordinator = class {
 				phase: "planning",
 				mode: plan.mode,
 				destinations: input.destinations,
+				sources: input.sources,
 				throttleMbps: input.throttleMbps ?? 40,
 				moves: plan.moves.map((move) => ({
 					...move,
@@ -404,10 +415,15 @@ var StorageMigrationCoordinator = class {
 		if (jobId !== void 0 && job?.jobId !== jobId) return null;
 		return job;
 	}
+	/** Finished jobs, newest first, excluding the one `status` currently shows. */
+	async history() {
+		const current = await this.status();
+		return (await this.deps.history?.get() ?? []).filter((job) => job.jobId !== current?.jobId);
+	}
 	async cancel(jobId) {
 		const job = await this.status(jobId);
 		const cutoverInFlight = job !== null && job.repointed && (job.phase === "refreshing" || job.phase === "resuming");
-		if (!job || isTerminal(job) || cutoverInFlight) return false;
+		if (!job || isTerminal$1(job) || cutoverInFlight) return false;
 		job.cancelRequested = true;
 		await this.persist(job);
 		await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
@@ -464,18 +480,22 @@ var StorageMigrationCoordinator = class {
 			const target = this.deps.locations.getDefaultLocation(storageClass);
 			if (!target) continue;
 			if (laneOf(storageClass) === "media") {
-				const count = await unanswerable(this.deps.participants.analytics.residue({
-					toLocationId: target.id,
-					mode: "move"
-				}));
-				if (count !== null && count.rows === 0) continue;
-				out.push({
-					storageClass,
-					fromLocationId: "*",
-					toLocationId: target.id,
-					items: count?.rows ?? null,
-					bytes: null
-				});
+				for (const source of this.deps.locations.listLocations({ type: storageClass })) {
+					if (source.id === target.id) continue;
+					const count = await unanswerable(this.deps.participants.analytics.residue({
+						toLocationId: target.id,
+						fromLocationId: source.id,
+						mode: "move"
+					}));
+					if (count !== null && count.rows === 0) continue;
+					out.push({
+						storageClass,
+						fromLocationId: source.id,
+						toLocationId: target.id,
+						items: count?.rows ?? null,
+						bytes: null
+					});
+				}
 				continue;
 			}
 			for (const source of this.deps.locations.listLocations({ type: storageClass })) {
@@ -529,12 +549,12 @@ var StorageMigrationCoordinator = class {
 		this.startReserved = true;
 		try {
 			const existing = await this.status();
-			if (existing && isTerminal(existing) && existing.pausedParticipants.length > 0) {
+			if (existing && isTerminal$1(existing) && existing.pausedParticipants.length > 0) {
 				await this.releaseAfterTerminal(existing);
 				await this.persist(existing);
 				if (existing.pausedParticipants.length > 0) throw new Error(`storage migration ${existing.jobId} still holds maintenance leases`);
 			}
-			if (existing && !isTerminal(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
+			if (existing && !isTerminal$1(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
 			for (const storageClass of input.classes) {
 				if (MOVER_CLASSES.includes(storageClass)) continue;
 				throw new Error(`No mover owns "${storageClass}" — there is nothing that can drain it. Move it by hand.`);
@@ -599,7 +619,7 @@ var StorageMigrationCoordinator = class {
 			await this.persist(job);
 			return;
 		}
-		if (isTerminal(job)) {
+		if (isTerminal$1(job)) {
 			if (job.pausedParticipants.length > 0) {
 				await this.releaseAfterTerminal(job);
 				await this.persist(job);
@@ -660,11 +680,12 @@ var StorageMigrationCoordinator = class {
 			if (job.phase === "verifying" && !nonBlocking) {
 				await this.verifyMoves(job);
 				if (job.cancelRequested) return this.finishCancelled(job);
+				await this.freezeDrainedSources(job);
 				await this.setPhase(job, "repointing");
 			}
 			if (job.phase === "repointing") {
-				const targets = new Map(job.moves.map((move) => [move.storageClass, move.toLocationId]));
-				await this.deps.locations.setDefaultLocations(targets);
+				const targets = new Map(job.moves.filter((move) => move.freezeSource !== true).map((move) => [move.storageClass, move.toLocationId]));
+				if (targets.size > 0) await this.deps.locations.setDefaultLocations(targets);
 				job.repointed = true;
 				await this.setPhase(job, "refreshing");
 			}
@@ -687,6 +708,7 @@ var StorageMigrationCoordinator = class {
 			if (job.phase === "verifying" && nonBlocking) {
 				await this.verifyMoves(job);
 				if (job.cancelRequested) return this.finishCancelled(job);
+				await this.freezeDrainedSources(job);
 				await this.setPhase(job, "done");
 			}
 		} catch (err) {
@@ -702,7 +724,7 @@ var StorageMigrationCoordinator = class {
 			await this.releaseAfterTerminal(job);
 			await this.persist(job);
 		} finally {
-			if (isTerminal(job)) {
+			if (isTerminal$1(job)) {
 				await this.releaseAfterTerminal(job);
 				this.active = job;
 			}
@@ -862,6 +884,24 @@ var StorageMigrationCoordinator = class {
 		for (const move of job.moves) if (move.state !== "done") throw new Error(`${move.storageClass} move did not complete verification`);
 	}
 	/**
+	* After a from→to copy whose source was NOT the class default: stop new
+	* writes to `from`. The default is unchanged (that is the whole point of
+	* naming a non-default source). A location that is already disabled is
+	* left alone.
+	*/
+	freezeDrainedSources(job) {
+		for (const move of job.moves) {
+			if (move.freezeSource !== true) continue;
+			const loc = this.deps.locations.getLocationById(move.fromLocationId);
+			if (!loc || loc.enabled === false) continue;
+			const { createdAt: _c, updatedAt: _u, capacity: _cap, ...rest } = loc;
+			this.deps.locations.upsertLocation({
+				...rest,
+				enabled: false
+			});
+		}
+	}
+	/**
 	* Arm one class's mover.
 	*
 	* `draining` runs after every writer has been resumed, so there is no lease
@@ -874,6 +914,7 @@ var StorageMigrationCoordinator = class {
 		if (laneOf(move.storageClass) === "media") {
 			const input = {
 				toLocationId: move.toLocationId,
+				fromLocationId: move.fromLocationId,
 				throttleMbps: job.throttleMbps,
 				mode: "move"
 			};
@@ -907,7 +948,7 @@ var StorageMigrationCoordinator = class {
 	}
 	async setPhase(job, phase) {
 		job.phase = phase;
-		if (isTerminal(job)) job.finishedAt = this.deps.now();
+		if (isTerminal$1(job)) job.finishedAt = this.deps.now();
 		await this.persist(job);
 	}
 	async finishCancelled(job) {
@@ -919,6 +960,9 @@ var StorageMigrationCoordinator = class {
 	async persist(job) {
 		job.updatedAt = this.deps.now();
 		await this.deps.state.set(job);
+		if (!isTerminal$1(job) || this.deps.history === void 0) return;
+		const prev = [...await this.deps.history.get() ?? []];
+		await this.deps.history.set([job, ...prev.filter((row) => row.jobId !== job.jobId)].slice(0, HISTORY_CAP));
 	}
 };
 /**
@@ -944,9 +988,10 @@ function requireLease(job) {
 	if (job.pauseLeaseId === null) throw new Error("storage migration has no maintenance lease");
 	return job.pauseLeaseId;
 }
-function isTerminal(job) {
+function isTerminal$1(job) {
 	return job.phase === "done" || job.phase === "failed" || job.phase === "cancelled";
 }
+var HISTORY_CAP = 20;
 /**
 * Which single-flight engine owns a class.
 */
@@ -1068,6 +1113,78 @@ function canProbeOccupancyLocally(locality) {
 	return locality === true;
 }
 //#endregion
+//#region src/builtins/storage-orchestrator/location-occupancy.ts
+/**
+* Delete-time occupancy of a location's on-disk root.
+*
+* A recordings disk may host several classes at one `basePath`
+* (`<camera>/high|mid`, `<camera>/low`, `<camera>/events`). Occupancy for
+* a class is therefore the class subtree, not the shared root — otherwise a
+* drained `eventMedia:default` still looks full because high footage is
+* writing next to it (observed 2026-09-01).
+*
+* The walk is shallow: one `readdir` of the root (one dirent per camera)
+* plus `opendir`+first-entry of each named subtree. No recursive find of
+* segments — that is the walk that saturates a USB disk.
+*/
+/**
+* Class → directories under `<root>/<camera>/`. Same map as the discard
+* wipe (`DISCARD_SUBTREES` in the recorder / pipeline-analytics addons).
+* Types not listed keep the legacy "any non-dot entry at the root" rule
+* (backups, addon-data, …).
+*/
+var STORAGE_CLASS_SUBTREES = {
+	eventMedia: ["events"],
+	recordingsLow: ["low"],
+	recordings: ["high", "mid"]
+};
+function isDotEntry(name) {
+	return name.startsWith(".");
+}
+/**
+* True when `dir` exists and contains at least one dirent. Missing → false.
+* Any other errno throws so the caller can answer `unknown` (D49).
+*/
+async function dirHasAnyEntry(dir) {
+	let handle;
+	try {
+		handle = await opendir(dir);
+	} catch (err) {
+		if (err.code === "ENOENT") return false;
+		throw err;
+	}
+	try {
+		return await handle.read() !== null;
+	} finally {
+		await handle.close();
+	}
+}
+/**
+* Occupancy of `basePath` for a location of `type`.
+*
+*  - missing root → `empty` (nothing this delete can strand)
+*  - class-mapped type → occupied iff any `<camera>/<subtree>` has an entry
+*  - other types → occupied iff the root has a non-dot entry
+*/
+async function probeLocalDirectoryOccupancy(input) {
+	let names;
+	try {
+		names = await readdir(input.basePath);
+	} catch (err) {
+		if (err.code === "ENOENT") return "empty";
+		return "unknown";
+	}
+	const visible = names.filter((name) => !isDotEntry(name));
+	const subtrees = STORAGE_CLASS_SUBTREES[input.type];
+	if (subtrees === void 0) return visible.length > 0 ? "occupied" : "empty";
+	try {
+		for (const camera of visible) for (const subtree of subtrees) if (await dirHasAnyEntry(path.join(input.basePath, camera, subtree))) return "occupied";
+	} catch {
+		return "unknown";
+	}
+	return "empty";
+}
+//#endregion
 //#region src/builtins/storage-orchestrator/data-store-dispatch.ts
 /**
 * Pick the engine to serve a call.
@@ -1246,6 +1363,173 @@ async function collectProviderInfos(providers, onError) {
 	return out;
 }
 //#endregion
+//#region src/builtins/storage-orchestrator/storage-cleanup-coordinator.ts
+var FOOTAGE_TYPES = new Set(["recordings", "recordingsLow"]);
+function isTerminal(job) {
+	return job.phase === "done" || job.phase === "failed" || job.phase === "cancelled";
+}
+function footageFrozen(location) {
+	return location.enabled === false || location.config["readOnly"] === true;
+}
+/**
+* One operator-facing cleanup of leftover analytics rows/blobs, optional
+* debug media, and ghost ledger rows on frozen footage locations.
+*
+* Each addon call either returns immediately (start+poll) or is a bounded
+* ledger walk. The HTTP caller never waits on the full pass.
+*/
+var StorageCleanupCoordinator = class {
+	deps;
+	active = null;
+	startReserved = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async start(input) {
+		if (this.startReserved) throw new Error("storage cleanup is already active");
+		this.startReserved = true;
+		try {
+			const existing = await this.status();
+			if (existing && !isTerminal(existing)) throw new Error(`storage cleanup is already active (${existing.jobId})`);
+			const now = this.deps.now();
+			const job = {
+				jobId: this.deps.newId(),
+				phase: "orphans",
+				includeDebugMedia: input.includeDebugMedia === true,
+				orphansReclaimed: 0,
+				orphanBytesReclaimed: 0,
+				debugMediaReclaimed: 0,
+				debugMediaBytesReclaimed: 0,
+				ghostsForgotten: 0,
+				ghostBytesForgotten: 0,
+				detail: "Starting orphan reclaim",
+				cancelRequested: false,
+				startedAt: now,
+				updatedAt: now,
+				finishedAt: null,
+				error: null
+			};
+			await this.persist(job);
+			this.active = job;
+			this.run(job);
+			return job.jobId;
+		} finally {
+			this.startReserved = false;
+		}
+	}
+	async status(jobId) {
+		const job = this.active ?? await this.deps.state.get();
+		if (jobId !== void 0 && job?.jobId !== jobId) return null;
+		return job;
+	}
+	async cancel(jobId) {
+		const job = await this.status(jobId);
+		if (!job || isTerminal(job)) return false;
+		job.cancelRequested = true;
+		job.detail = "Cancel requested — finishing the current step";
+		await this.persist(job);
+		return true;
+	}
+	async run(job) {
+		try {
+			await this.reclaimOrphans(job);
+			if (await this.stopped(job)) return;
+			if (job.includeDebugMedia) {
+				await this.setPhase(job, "debug-media", "Reclaiming debug media");
+				await this.reclaimDebugMedia(job);
+				if (await this.stopped(job)) return;
+			}
+			await this.setPhase(job, "ghost-ledger", "Forgetting ghost footage rows");
+			await this.forgetGhosts(job);
+			if (await this.stopped(job)) return;
+			await this.finish(job, "done", null);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			await this.finish(job, "failed", message);
+		}
+	}
+	async reclaimOrphans(job) {
+		let restart = true;
+		for (;;) {
+			if (await this.stopped(job)) return;
+			const start = await this.deps.participants.startOrphan(restart);
+			restart = false;
+			if (!start.started && !start.alreadyRunning) throw new Error("orphan reclaim did not start");
+			const status = await this.waitUntilIdle(() => this.deps.participants.orphanStatus(), job, (s) => `Orphan reclaim: ${s.totalReclaimed} rows / ${String(s.totalBytesReclaimed)} bytes`);
+			job.orphansReclaimed += status.totalReclaimed;
+			job.orphanBytesReclaimed += status.totalBytesReclaimed;
+			job.detail = `Orphans: ${job.orphansReclaimed} rows, ${String(job.orphanBytesReclaimed)} bytes`;
+			await this.persist(job);
+			if (status.error) throw new Error(status.error);
+			if (status.complete === true) return;
+		}
+	}
+	async reclaimDebugMedia(job) {
+		const start = await this.deps.participants.startDebugMedia();
+		if (!start.started && !start.alreadyRunning) throw new Error("debug-media reclaim did not start");
+		const status = await this.waitUntilIdle(() => this.deps.participants.debugMediaStatus(), job, (s) => `Debug media: ${s.totalReclaimed} files`);
+		job.debugMediaReclaimed = status.totalReclaimed;
+		job.debugMediaBytesReclaimed = status.totalBytesReclaimed;
+		await this.persist(job);
+		if (status.error) throw new Error(status.error);
+	}
+	async forgetGhosts(job) {
+		const frozen = this.deps.locations.listLocations().filter((l) => FOOTAGE_TYPES.has(l.type) && footageFrozen(l));
+		if (frozen.length === 0) {
+			job.detail = "No frozen footage locations";
+			await this.persist(job);
+			return;
+		}
+		for (const loc of frozen) {
+			if (await this.stopped(job)) return;
+			job.detail = `Ghost ledger: ${loc.id}`;
+			await this.persist(job);
+			const report = await this.deps.participants.walkLedger({
+				locationId: loc.id,
+				apply: true
+			});
+			job.ghostsForgotten += report.forgottenSegments;
+			job.ghostBytesForgotten += report.forgottenBytes;
+			await this.persist(job);
+		}
+	}
+	async waitUntilIdle(read, job, detail) {
+		const pollMs = this.deps.pollMs ?? 2e3;
+		const sleep = this.deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+		for (;;) {
+			const status = await read();
+			job.detail = detail(status);
+			await this.persist(job);
+			if (!status.running) return status;
+			await sleep(pollMs);
+		}
+	}
+	async stopped(job) {
+		if ((await this.status(job.jobId))?.cancelRequested === true) {
+			await this.finish(job, "cancelled", null);
+			return true;
+		}
+		return false;
+	}
+	async setPhase(job, phase, detail) {
+		job.phase = phase;
+		job.detail = detail;
+		await this.persist(job);
+	}
+	async finish(job, phase, error) {
+		job.phase = phase;
+		job.error = error;
+		job.finishedAt = this.deps.now();
+		job.detail = phase === "done" ? "Cleanup finished" : job.detail;
+		await this.persist(job);
+	}
+	async persist(job) {
+		job.updatedAt = this.deps.now();
+		this.active = job;
+		await this.deps.state.set(job);
+	}
+};
+//#endregion
 //#region src/builtins/storage-orchestrator/storage-orchestrator.service.ts
 /**
 * Routing core for the `storage-orchestrator` builtin.
@@ -1368,7 +1652,7 @@ var StorageOrchestratorService = class {
 	* Reconciles both directions so operator edits survive a reboot:
 	*   1. hydrate — DB rows win over any early in-memory seed (restores
 	*      operator config like `minFreePercent` that the pre-store boot
-	*      can't see), with the same `isSystem` upgrade as {@link initialize};
+	*      can't see);
 	*   2. backfill — in-memory locations the DB doesn't have yet (the
 	*      pre-store seed defaults on a fresh install) are persisted, so the
 	*      store becomes the durable source of truth from here on.
@@ -1390,14 +1674,7 @@ var StorageOrchestratorService = class {
 		const rows = await store.loadAll();
 		this.locationStore = store;
 		const dbIds = new Set(rows.map((r) => r.id));
-		for (const loc of rows) {
-			const upgraded = !loc.isSystem && loc.id === `${loc.type}:default` ? {
-				...loc,
-				isSystem: true
-			} : loc;
-			this.locations.set(upgraded.id, upgraded);
-			if (upgraded !== loc) store.upsert(upgraded).catch(() => {});
-		}
+		for (const loc of rows) this.locations.set(loc.id, loc);
 		const backfill = [...this.locations.values()].filter((l) => !dbIds.has(l.id));
 		for (const loc of backfill) store.upsert(loc).catch((err) => {
 			this.logger.warn("storage-orchestrator: attachStore backfill persist failed", { meta: {
@@ -1489,25 +1766,8 @@ var StorageOrchestratorService = class {
 	async initialize() {
 		if (!this.locationStore) return;
 		const rows = await this.locationStore.loadAll();
-		let upgraded = 0;
-		for (const loc of rows) if (!loc.isSystem && loc.id === `${loc.type}:default`) {
-			const upgradedLoc = {
-				...loc,
-				isSystem: true
-			};
-			this.locations.set(upgradedLoc.id, upgradedLoc);
-			this.locationStore.upsert(upgradedLoc).catch((err) => {
-				this.logger.warn("storage-orchestrator: isSystem upgrade persist failed", { meta: {
-					id: upgradedLoc.id,
-					error: err instanceof Error ? err.message : String(err)
-				} });
-			});
-			upgraded++;
-		} else this.locations.set(loc.id, loc);
-		this.logger.info("storage-orchestrator: hydrated locations from store", { meta: {
-			loaded: this.locations.size,
-			isSystemUpgraded: upgraded
-		} });
+		for (const loc of rows) this.locations.set(loc.id, loc);
+		this.logger.info("storage-orchestrator: hydrated locations from store", { meta: { loaded: this.locations.size } });
 		this.reportDisabledDefaults();
 	}
 	/**
@@ -1692,10 +1952,6 @@ var StorageOrchestratorService = class {
 			...input,
 			nodeId: "hub"
 		};
-		if (existing?.isSystem === true) input = {
-			...input,
-			isSystem: true
-		};
 		input = {
 			...input,
 			...resolveEnabled(input, existing, this.hasAnyLocationOfType(input.type))
@@ -1742,21 +1998,22 @@ var StorageOrchestratorService = class {
 		return next;
 	}
 	/**
-	* Remove a location. Refuses to remove the default of a type unless a
-	* sibling default exists (defensive — `upsertLocation` already ensures
-	* at most one default per type, but the logic guards against future
-	* bypass paths e.g. SQLite migration that imports two defaults).
-	*
-	* Persistence (Task 6) mirrors the delete asynchronously, with errors
-	* routed to the logger — see `upsertLocation` for the rationale.
+	* Remove a location. Refuses the last location of a type and the last
+	* enabled location of a type. `isSystem` is informational — a frozen
+	* recordings `:default` is deletable once a sibling is live. Deleting
+	* the flagged default promotes an enabled sibling. Occupancy still
+	* refuses unless `force` is set; force never overrides uniqueness /
+	* last-enabled.
 	*/
 	async deleteLocation(id, options) {
 		const loc = this.locations.get(id);
 		if (!loc) throw new Error(`Storage location "${id}" not found`);
-		if (loc.isSystem) throw new Error(`Storage location "${id}" is system-managed and cannot be deleted. Edit its config (path / providerId) instead.`);
-		if (loc.isDefault) {
-			if (![...this.locations.values()].find((l) => l.type === loc.type && l.id !== id && l.isDefault)) throw new Error(`Cannot delete default location "${id}" for type "${loc.type}" — promote another location to default first`);
-		}
+		const ofType = [...this.locations.values()].filter((l) => l.type === loc.type);
+		if (ofType.length <= 1) throw new Error(`Cannot delete "${id}" — it is the only location for type "${loc.type}"`);
+		const enabledOfType = ofType.filter((l) => l.enabled !== false);
+		if (loc.enabled !== false && enabledOfType.length <= 1) throw new Error(`Cannot delete "${id}" — it is the only enabled location for type "${loc.type}"`);
+		const successor = loc.isDefault === true ? ofType.find((l) => l.id !== id && l.enabled !== false) : void 0;
+		if (loc.isDefault === true && successor === void 0) throw new Error(`Cannot delete "${id}" — it is the only enabled location for type "${loc.type}"`);
 		const occupancy = await this.probeOccupancy(loc);
 		if (occupancy !== "empty") {
 			if (options?.force !== true) throw new Error(occupancy === "occupied" ? `Storage location "${id}" still holds data — drain it first (storage migration / relocate), or pass force to delete the record anyway and strand what is on it` : `Storage location "${id}" could not be checked for remaining data (unreachable provider, another node, or an unmounted root) — pass force to delete the record anyway`);
@@ -1766,6 +2023,21 @@ var StorageOrchestratorService = class {
 				occupancy
 			} });
 		}
+		if (successor !== void 0 && successor.isDefault !== true) {
+			const now = Date.now();
+			const promoted = {
+				...successor,
+				isDefault: true,
+				updatedAt: now
+			};
+			this.locations.set(successor.id, promoted);
+			if (this.locationStore) this.locationStore.upsert(promoted).catch((err) => {
+				this.logger.error("storage-orchestrator: default promotion persist failed", { meta: {
+					id: successor.id,
+					error: err instanceof Error ? err.message : String(err)
+				} });
+			});
+		}
 		this.locations.delete(id);
 		if (this.locationStore) this.locationStore.delete(id).catch((err) => {
 			this.logger.error("storage-orchestrator: delete persistence failed", { meta: {
@@ -1792,15 +2064,14 @@ var StorageOrchestratorService = class {
 		}
 	}
 	/**
-	* Remove system-seeded locations whose type is no longer declared by any
-	* addon (stale defaults from a removed location type). Operator-added
-	* (non-system) locations of an undeclared type are KEPT but warned — the
-	* operator owns them. Requires the registry to be set first.
+	* Remove seed-shaped locations (`<type>:default`) whose type is no longer
+	* declared by any addon (stale defaults from a removed location type).
+	* Operator-added locations of an undeclared type are KEPT but warned.
 	*
 	* FAIL-SAFE: if the registry is EMPTY (no addon declared any location), we
 	* refuse to prune anything. An empty registry almost always means
 	* declarations failed to load (boot ordering, a stale install) — pruning
-	* "everything undeclared" in that state would wipe every system location
+	* "everything undeclared" in that state would wipe every seeded location
 	* (data/logs/recordings/…). Better to keep stale rows than destroy live ones.
 	*/
 	pruneUndeclaredSystemLocations() {
@@ -1811,7 +2082,7 @@ var StorageOrchestratorService = class {
 		}
 		for (const [id, loc] of Array.from(this.locations)) {
 			if (this.registry.cardinalityOf(loc.type) !== null) continue;
-			if (loc.isSystem) {
+			if (loc.id === `${loc.type}:default`) {
 				this.locations.delete(id);
 				if (this.locationStore) this.locationStore.delete(id).catch((err) => {
 					this.logger.error("storage-orchestrator: prune persistence failed", { meta: {
@@ -1819,7 +2090,7 @@ var StorageOrchestratorService = class {
 						error: err instanceof Error ? err.message : String(err)
 					} });
 				});
-				this.logger.info("storage-orchestrator: pruned stale system location", { meta: {
+				this.logger.info("storage-orchestrator: pruned stale seeded location", { meta: {
 					id,
 					type: loc.type
 				} });
@@ -1979,7 +2250,7 @@ var StorageOrchestratorService = class {
 				providerId: input.providerId,
 				config: { basePath: base },
 				isDefault: true,
-				isSystem: true
+				isSystem: false
 			});
 			added++;
 		}
@@ -2209,6 +2480,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 	pressureTimer = null;
 	pressureSweepInFlight = false;
 	migration = null;
+	cleanup = null;
 	/**
 	* Cached `providerId → nodeLocal` snapshot (SP1). Backs the orchestrator's
 	* synchronous `NodeLocalResolver` — `getProviderInfo()` is async, so we
@@ -2266,7 +2538,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				const rows = type !== void 0 ? service.listLocations({ type }) : service.listLocations();
 				return Promise.all(rows.map(async (loc) => ({
 					...this.redacted(loc),
-					capacity: await this.localCapacityOf(loc)
+					capacity: loc.enabled === false ? null : await this.localCapacityOf(loc)
 				})));
 			},
 			getDefaultLocation: async ({ type }) => {
@@ -2434,6 +2706,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		const migration = new StorageMigrationCoordinator({
 			locations: service,
 			state: this.state("storage-migration", StorageMigrationJobSchema.nullable(), null),
+			history: this.state("storage-migration-history", z.array(StorageMigrationJobSchema), []),
 			participants: {
 				pipeline: {
 					pause: async (leaseId) => {
@@ -2484,6 +2757,36 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 			deviceKeyOf: (locationId) => this.locationDeviceKey(locationId)
 		});
 		this.migration = migration;
+		const cleanup = new StorageCleanupCoordinator({
+			locations: service,
+			state: this.state("storage-cleanup", StorageCleanupJobSchema.nullable(), null),
+			participants: {
+				startOrphan: async (restart) => {
+					return parseStarted(await this.ctx.api.addons.custom.mutate({
+						addonId: "pipeline-analytics",
+						action: "retention.orphanAudit",
+						input: {
+							mode: "reclaim",
+							restart,
+							maxRowsPerScope: 2e4
+						}
+					}));
+				},
+				orphanStatus: async () => {
+					return parseOrphanStatus(await this.ctx.api.addons.custom.mutate({
+						addonId: "pipeline-analytics",
+						action: "retention.orphanAuditStatus",
+						input: {}
+					}));
+				},
+				startDebugMedia: () => this.ctx.api.pipelineAnalytics.reclaimDebugMedia.mutate({ mode: "reclaim" }),
+				debugMediaStatus: () => this.ctx.api.pipelineAnalytics.getMediaReclaimStatus.query({}),
+				walkLedger: (input) => this.ctx.api.recording.reconcileLedgerAgainstDisk.mutate(input)
+			},
+			now: () => Date.now(),
+			newId: () => randomUUID()
+		});
+		this.cleanup = cleanup;
 		const migrationProvider = {
 			plan: (input) => migration.plan(input),
 			start: async (input) => ({ jobId: await migration.start(input) }),
@@ -2491,7 +2794,11 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 			cancel: async ({ jobId }) => ({ cancelled: await migration.cancel(jobId) }),
 			movers: () => migration.movers(),
 			residue: () => migration.residue(),
-			drain: async (input) => ({ jobId: await migration.drain(input) })
+			drain: async (input) => ({ jobId: await migration.drain(input) }),
+			cleanupStart: async (input) => ({ jobId: await cleanup.start(input) }),
+			cleanupStatus: ({ jobId }) => cleanup.status(jobId),
+			cleanupCancel: async ({ jobId }) => ({ cancelled: await cleanup.cancel(jobId) }),
+			history: () => migration.history()
 		};
 		await this.seedFromDeclarations();
 		const eventBus = this.ctx.eventBus;
@@ -2734,11 +3041,14 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* Does this location still hold anything? A SHALLOW `readdir` of its
-	* `basePath` — one syscall, never a walk. `/recordings` holds one entry per
-	* camera, so this is cheap on a volume with millions of segments, and a
-	* `find`-style walk of a saturated recordings disk is precisely what must
-	* not happen here.
+	* Does this location still hold anything of ITS class?
+	*
+	* Shared roots (`/recordings` hosting high + low + events) are scored by
+	* class subtree (`<camera>/high|mid`, `/low`, `/events`), not by a raw
+	* `readdir` of the root — camera dirs and `.camstack-location` would
+	* otherwise make every class look occupied. The walk stays shallow: one
+	* dirent per camera, then first-entry of the named subtree. A `find` of
+	* segments is precisely what must not happen here.
 	*
 	* **What it cannot see, stated rather than papered over:**
 	*
@@ -2747,9 +3057,10 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 	*    `unknown`, never `empty`.
 	*  - A location with no `basePath` — same answer.
 	*  - The difference between "holds live footage" and "holds one stray
-	*    lock-file". It measures BYTES ON DISK, not durable rows, so it refuses
-	*    a location holding orphan files that no index names. That direction is
-	*    the safe one, and `force` is the escape hatch for it.
+	*    lock-file". It measures ON-DISK entries of this class, not durable
+	*    rows, so it refuses a location holding orphan files that no index
+	*    names. That direction is the safe one, and `force` is the escape
+	*    hatch for it.
 	*
 	* A missing root (`ENOENT`) is `empty`, not `unknown`: an unmounted disk and
 	* a deleted directory are indistinguishable here, and if the record's own
@@ -2767,16 +3078,16 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		if ((location.nodeId === void 0 || location.nodeId === "" ? HUB_NODE_ID : location.nodeId) !== (this.service?.getLocalNodeId() ?? HUB_NODE_ID)) return "unknown";
 		const basePath = this.locationBasePath(location.id);
 		if (basePath === null) return "unknown";
-		try {
-			return (await fs.readdir(basePath)).length > 0 ? "occupied" : "empty";
-		} catch (err) {
-			if (err instanceof Error && "code" in err && err.code === "ENOENT") return "empty";
-			this.ctx.logger.warn("storage-orchestrator: could not read a location root to check it", { meta: {
-				id: location.id,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-			return "unknown";
-		}
+		const occupancy = await probeLocalDirectoryOccupancy({
+			type: location.type,
+			basePath
+		});
+		if (occupancy === "unknown") this.ctx.logger.warn("storage-orchestrator: could not read a location root to check it", { meta: {
+			id: location.id,
+			basePath,
+			type: location.type
+		} });
+		return occupancy;
 	}
 	/** Free capacity (%) on a location's volume via `statfs`; 100 (guard inert) when unstattable. */
 	async locationFreePercent(locationId) {
@@ -2852,5 +3163,37 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		}
 	}
 };
+function parseStarted(raw) {
+	if (raw !== null && typeof raw === "object") {
+		const o = raw;
+		if (typeof o["started"] === "boolean" && typeof o["alreadyRunning"] === "boolean") return {
+			started: o["started"],
+			alreadyRunning: o["alreadyRunning"]
+		};
+	}
+	return {
+		started: false,
+		alreadyRunning: false
+	};
+}
+function parseOrphanStatus(raw) {
+	if (raw !== null && typeof raw === "object") {
+		const o = raw;
+		return {
+			running: o["running"] === true,
+			complete: typeof o["complete"] === "boolean" ? o["complete"] : null,
+			totalReclaimed: typeof o["totalReclaimed"] === "number" ? o["totalReclaimed"] : 0,
+			totalBytesReclaimed: typeof o["totalBytesReclaimed"] === "number" ? o["totalBytesReclaimed"] : 0,
+			error: typeof o["error"] === "string" ? o["error"] : null
+		};
+	}
+	return {
+		running: false,
+		complete: true,
+		totalReclaimed: 0,
+		totalBytesReclaimed: 0,
+		error: "orphan audit status unreadable"
+	};
+}
 //#endregion
 export { StorageOrchestratorAddon, StorageOrchestratorAddon as default, SqliteLocationStore as i, buildStorageLocationRegistry as n, StorageMigrationCoordinator as r, StorageOrchestratorService as t };