@camstack/system 1.2.201 → 1.2.202

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as StorageCleanupJobSchema, Et as settingsStoreCapability, I as collectSecretConfigKeys, It as BaseAddon, Ot as storageCapability, T as StorageMigrationJobSchema, h as REDACTED_SECRET, kt as storageMigrationCapability, nn as parseJsonObject, w as StorageLocationTypeSchema } from "../../dist-BmJNnb_s.mjs";
+import { At as storageCapability, E as StorageMigrationJobSchema, L as collectSecretConfigKeys, Ot as settingsStoreCapability, Rt as BaseAddon, T as StorageLocationTypeSchema, g as REDACTED_SECRET, in as parseJsonObject, jt as storageMigrationCapability, m as LegacyStorageLocationDefaultSchema, rt as isLocationEnabled, w as StorageCleanupJobSchema } from "../../dist-CiHYspij.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
@@ -188,7 +188,7 @@ function mapLocationToRow(loc) {
 		display_name: loc.displayName,
 		provider_id: loc.providerId,
 		config: storedConfig,
-		is_default: loc.isDefault ? 1 : 0,
+		is_default: 0,
 		is_system: loc.isSystem ? 1 : 0,
 		created_at: loc.createdAt,
 		updated_at: loc.updatedAt
@@ -222,7 +222,7 @@ function mapRowToLocation(row) {
 		config,
 		...nodeId !== void 0 ? { nodeId } : {},
 		...enabled !== void 0 ? { enabled } : {},
-		isDefault: row["is_default"] === 1 || row["is_default"] === true,
+		...LegacyStorageLocationDefaultSchema.parse({ isDefault: row["is_default"] === 1 || row["is_default"] === true }),
 		isSystem: row["is_system"] === 1 || row["is_system"] === true,
 		createdAt: Number(row["created_at"] ?? 0),
 		updatedAt: Number(row["updated_at"] ?? 0)
@@ -290,16 +290,18 @@ var StorageMigrationCoordinator = class {
 			const targetId = input.destinations[storageClass];
 			if (targetId === void 0) continue;
 			const namedSourceId = input.sources?.[storageClass];
-			const defaultLoc = this.deps.locations.getDefaultLocation(storageClass);
-			const source = namedSourceId ? this.deps.locations.getLocationById(namedSourceId) : defaultLoc;
-			if (!source) throw new Error(namedSourceId ? `Storage location "${namedSourceId}" not found` : `No default storage location for "${storageClass}"`);
+			const writeSet = this.deps.locations.writeTargets(storageClass);
+			const implicitSources = writeSet.filter((loc) => loc.id !== targetId);
+			if (!namedSourceId && implicitSources.length > 1) throw new Error(`"${storageClass}" writes to ${String(implicitSources.length)} locations (${implicitSources.map((loc) => loc.id).join(", ")}) — name the one to cut over explicitly with \`sources\`.`);
+			const source = namedSourceId ? this.deps.locations.getLocationById(namedSourceId) : implicitSources[0];
+			if (!source) throw new Error(namedSourceId ? `Storage location "${namedSourceId}" not found` : `Storage location "${targetId}" is already the only write target for "${storageClass}" — there is nothing to cut over. Use storageMigration.drain to move what is left behind.`);
 			if (source.type !== storageClass) throw new Error(`Storage location "${source.id}" is type "${source.type}", expected "${storageClass}"`);
 			const target = this.deps.locations.getLocationById(targetId);
 			if (!target) throw new Error(`Storage location "${targetId}" not found`);
 			if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
-			if (source.id === target.id) throw new Error(namedSourceId ? `Source and destination are the same location ("${targetId}")` : `Storage location "${targetId}" is already the "${storageClass}" default`);
-			const freezeSource = defaultLoc === null || source.id !== defaultLoc.id;
-			if (!MOVER_CLASSES.includes(storageClass)) throw new Error(`No mover owns "${storageClass}" — the migration can repoint its default but cannot move its bytes. Move it by hand, then repoint the default with upsertLocation.`);
+			if (source.id === target.id) throw new Error(namedSourceId ? `Source and destination are the same location ("${targetId}")` : `Storage location "${targetId}" is already the only write target for "${storageClass}"`);
+			const freezeSource = !writeSet.some((loc) => loc.id === source.id);
+			if (!MOVER_CLASSES.includes(storageClass)) throw new Error(`No mover owns "${storageClass}" — the migration can move its write set but cannot move its bytes. Move it by hand, then enable the destination (and disable the source) with upsertLocation.`);
 			moves.push({
 				storageClass,
 				fromLocationId: source.id,
@@ -316,7 +318,7 @@ var StorageMigrationCoordinator = class {
 		if (moves.some((move) => move.storageClass === "eventMedia")) {
 			const unstamped = await this.deps.participants.analytics.countUnstamped();
 			if (unstamped === null) {
-				if (mode === "nonBlocking") throw new Error("could not determine whether any event-media row still carries no locationId. A non-blocking cutover repoints the default and would silently orphan every such row, so an unmeasured collection is refused exactly like a non-empty one. Retry, or run the blocking mode, which stamps rows as it moves them.");
+				if (mode === "nonBlocking") throw new Error("could not determine whether any event-media row still carries no locationId. A non-blocking cutover moves the write set and would silently orphan every such row, so an unmeasured collection is refused exactly like a non-empty one. Retry, or run the blocking mode, which stamps rows as it moves them.");
 				findings.push({
 					code: "unstampedEventMediaRows",
 					storageClass: "eventMedia",
@@ -325,7 +327,7 @@ var StorageMigrationCoordinator = class {
 			} else if (unstamped.anyPresent) {
 				const scale = unstamped.total === null ? "an unknown number of" : unstamped.total.toString();
 				const perLane = `${describeUnstamped(unstamped.media)} media, ${describeUnstamped(unstamped.retrainFrames)} retrain frames`;
-				if (mode === "nonBlocking") throw new Error(`${scale} event-media row(s) still carry no locationId (${perLane}). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+				if (mode === "nonBlocking") throw new Error(`${scale} event-media row(s) still carry no locationId (${perLane}). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.writeTargets("eventMedia")[0]?.id ?? "eventMedia"}" }).`);
 				findings.push({
 					code: "unstampedEventMediaRows",
 					storageClass: "eventMedia",
@@ -464,7 +466,7 @@ var StorageMigrationCoordinator = class {
 	* remaining" action.
 	*
 	* A class appears here only when something is (or might be) left on a
-	* location that is not its default. An empty result therefore means exactly
+	* location outside its write set. An empty result therefore means exactly
 	* "there is nothing to drain", which is what lets the UI offer the action
 	* only when it is true, and what lets {@link drain} refuse rather than start
 	* a job that would move nothing and report `done` — the failure mode D295
@@ -478,11 +480,13 @@ var StorageMigrationCoordinator = class {
 		const out = [];
 		for (const storageClass of STORAGE_CLASSES) {
 			if (!MOVER_CLASSES.includes(storageClass)) continue;
-			const target = this.deps.locations.getDefaultLocation(storageClass);
+			const writeSet = this.deps.locations.writeTargets(storageClass);
+			const target = writeSet[0];
 			if (!target) continue;
+			const inWriteSet = new Set(writeSet.map((loc) => loc.id));
 			if (laneOf(storageClass) === "media") {
 				for (const source of this.deps.locations.listLocations({ type: storageClass })) {
-					if (source.id === target.id) continue;
+					if (inWriteSet.has(source.id)) continue;
 					const count = await unanswerable(this.deps.participants.analytics.residue({
 						toLocationId: target.id,
 						fromLocationId: source.id,
@@ -500,7 +504,7 @@ var StorageMigrationCoordinator = class {
 				continue;
 			}
 			for (const source of this.deps.locations.listLocations({ type: storageClass })) {
-				if (source.id === target.id) continue;
+				if (inWriteSet.has(source.id)) continue;
 				const census = await unanswerable(this.deps.participants.recorder.residue({
 					fromLocationId: source.id,
 					footageClass: storageClass === "recordingsLow" ? "recordingsLow" : "recordings"
@@ -518,12 +522,12 @@ var StorageMigrationCoordinator = class {
 		return out;
 	}
 	/**
-	* Run the DRAIN half alone, against classes whose default has already moved.
+	* Run the DRAIN half alone, against classes whose write set has already moved.
 	*
 	* ## Why this is a second verb rather than a looser `start`
 	*
-	* `start` refuses a destination that is already the class's default
-	* (`"recordingsLow:ssd" is already the "recordingsLow" default`). That refusal
+	* `start` refuses a destination that is already the class's only write target
+	* (`"recordingsLow:ssd" is already the only write target for "recordingsLow"`). That refusal
 	* is correct and it is load-bearing: there is genuinely nothing left to
 	* repoint, and an operator must never be able to re-repoint a migrated class
 	* by accident. Making `start` idempotent — "an already-repointed class
@@ -532,7 +536,7 @@ var StorageMigrationCoordinator = class {
 	* operator reads ("pauses the writers…") would be a lie half the time.
 	*
 	* `drain` instead cannot repoint AT ALL: it never touches
-	* `setDefaultLocations`, and its job starts in `draining` with `repointed`
+	* `setWriteTargets`, and its job starts in `draining` with `repointed`
 	* already true, so the `repointing` / `refreshing` / `resuming` blocks of
 	* {@link run} are behind it and unreachable. The two verbs are disjoint, and
 	* `start`'s refusal keeps meaning exactly what it meant.
@@ -542,7 +546,7 @@ var StorageMigrationCoordinator = class {
 	* The finished job is the audit of what happened; re-opening it destroys
 	* that. And a drain is needed in cases where no migration job ever existed
 	* (a mover armed by hand, footage stranded on a location an operator added
-	* and then un-defaulted). One job = one operation, and the work list comes
+	* and then disabled again). One job = one operation, and the work list comes
 	* from {@link residue} — the archive — not from what a previous job believed.
 	*/
 	async drain(input) {
@@ -565,9 +569,9 @@ var StorageMigrationCoordinator = class {
 			const destinations = {};
 			for (const storageClass of input.classes) {
 				const remaining = residue.filter((entry) => entry.storageClass === storageClass);
-				if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its default location — there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
+				if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its write set — there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
 				for (const entry of remaining) {
-					if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED — a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen, or make an enabled location the "${storageClass}" default first.`);
+					if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED — a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen first.`);
 					moves.push({
 						storageClass,
 						fromLocationId: entry.fromLocationId,
@@ -685,8 +689,13 @@ var StorageMigrationCoordinator = class {
 				await this.setPhase(job, "repointing");
 			}
 			if (job.phase === "repointing") {
-				const targets = new Map(job.moves.filter((move) => move.freezeSource !== true).map((move) => [move.storageClass, move.toLocationId]));
-				if (targets.size > 0) await this.deps.locations.setDefaultLocations(targets);
+				const targets = /* @__PURE__ */ new Map();
+				for (const move of job.moves) {
+					if (move.freezeSource === true) continue;
+					targets.set(move.toLocationId, true);
+					targets.set(move.fromLocationId, false);
+				}
+				if (targets.size > 0) await this.deps.locations.setWriteTargets(targets);
 				job.repointed = true;
 				await this.setPhase(job, "refreshing");
 			}
@@ -885,9 +894,9 @@ var StorageMigrationCoordinator = class {
 		for (const move of job.moves) if (move.state !== "done") throw new Error(`${move.storageClass} move did not complete verification`);
 	}
 	/**
-	* After a from→to copy whose source was NOT the class default: stop new
-	* writes to `from`. The default is unchanged (that is the whole point of
-	* naming a non-default source). A location that is already disabled is
+	* After a from→to copy whose source was NOT a write target: stop new writes
+	* to `from`. The rest of the write set is unchanged (that is the whole point
+	* of naming a source outside it). A location that is already disabled is
 	* left alone.
 	*/
 	freezeDrainedSources(job) {
@@ -1832,33 +1841,77 @@ var StorageOrchestratorService = class {
 			backfilled: backfill.length,
 			total: this.locations.size
 		} });
-		this.reportDisabledDefaults();
+		this.migrateOntoTheWriteSet(rows);
 	}
 	/**
-	* Shout about a persisted row that is BOTH the type default and disabled.
+	* ONE explicit migration onto the enabled write set (D383), run once per
+	* boot against the rows that came off disk. Idempotent: the second boot finds
+	* nothing to do.
+	*
+	* Two steps, in order, and each one is a WRITE — the point is that "absent"
+	* stops existing rather than being re-interpreted on every read forever:
 	*
-	* `upsertLocation` can now produce this (enabled is the write set; `isDefault`
-	* is store residue). Hydrate also writes rows straight into the map, so a
-	* hand-edited store or a row written by another build can too. It matters
-	* because every bare-type ref still resolves through {@link getDefaultLocation}
-	* until Stage 5 of the enabled-write-set design: on such a row
-	* `storage.write({ location: 'eventMedia' })` and the migration coordinator's
-	* drain destination both point at a disk the operator turned off.
+	*   1. A flagless row (persisted before `enabled` existed) is stamped
+	*      `enabled: true`. Absence already meant active, so this preserves
+	*      behaviour exactly; it is the operator's "the initial locations are
+	*      enabled" spelled into the store.
+	*   2. A type left with NO enabled row — only reachable from a hand-edited
+	*      store or a row an older build wrote — gets one enabled back, chosen as
+	*      the row the RETIRED default flag named, else the `:default`-slugged
+	*      row, else the lexicographically first. Loudly: a class with no write
+	*      target records nowhere, and refusing to repair it here would leave the
+	*      hub silently unable to write with no operator action pending.
 	*
-	* Reported, never repaired: flipping an operator's flag back on at boot would
-	* be the system overruling the switch instead of obeying it. The coordinator
-	* refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
-	* path is deliberately left working, because narrowing a READ is a worse bug
-	* than the one this line reports.
+	* An operator's explicit `enabled: false` is never reversed by step 1 — only
+	* step 2 touches it, and only when the alternative is a class that cannot
+	* write at all.
 	*/
-	reportDisabledDefaults() {
+	migrateOntoTheWriteSet(rows) {
+		const legacyDefaultOfType = /* @__PURE__ */ new Map();
+		for (const row of rows) if (row.isDefault === true) legacyDefaultOfType.set(row.type, row.id);
+		const stamped = [];
 		for (const loc of this.locations.values()) {
-			if (!loc.isDefault || loc.enabled !== false) continue;
-			this.logger.error("storage-orchestrator: the type DEFAULT is disabled — every bare-type ref for this type resolves to a location the operator turned off. Enable it, or make another location the default.", { meta: {
-				id: loc.id,
-				type: loc.type
-			} });
+			if (loc.enabled !== void 0) continue;
+			this.persistMigrated({
+				...loc,
+				enabled: true
+			});
+			stamped.push(loc.id);
+		}
+		const repaired = [];
+		for (const type of new Set([...this.locations.values()].map((l) => l.type))) {
+			const ofType = [...this.locations.values()].filter((l) => l.type === type);
+			if (ofType.some((l) => isLocationEnabled(l))) continue;
+			const legacyDefault = legacyDefaultOfType.get(type);
+			const pick = ofType.find((l) => l.id === legacyDefault) ?? ofType.find((l) => l.id === `${type}:default`) ?? ofType.toSorted((a, b) => a.id.localeCompare(b.id))[0];
+			if (!pick) continue;
+			this.persistMigrated({
+				...pick,
+				enabled: true
+			});
+			repaired.push(pick.id);
 		}
+		if (stamped.length > 0 || repaired.length > 0) this.logger.info("storage-orchestrator: migrated locations onto the enabled write set", { meta: {
+			stamped,
+			repaired
+		} });
+		for (const id of repaired) this.logger.warn("storage-orchestrator: a storage type had NO enabled location — re-enabled one so it can write. Every other location of that type stays read-only until you enable it.", { meta: { id } });
+	}
+	/** Apply one migrated row in memory and mirror it to the store. */
+	persistMigrated(next) {
+		const withStamp = {
+			...next,
+			updatedAt: Date.now()
+		};
+		this.locations.set(withStamp.id, withStamp);
+		const store = this.locationStore;
+		if (!store) return;
+		store.upsert(withStamp).catch((err) => {
+			this.logger.error("storage-orchestrator: write-set migration persist failed", { meta: {
+				id: withStamp.id,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		});
 	}
 	/**
 	* Inject the declaration-driven cardinality source. Called once by the
@@ -1913,7 +1966,7 @@ var StorageOrchestratorService = class {
 		const rows = await this.locationStore.loadAll();
 		for (const loc of rows) this.locations.set(loc.id, loc);
 		this.logger.info("storage-orchestrator: hydrated locations from store", { meta: { loaded: this.locations.size } });
-		this.reportDisabledDefaults();
+		this.migrateOntoTheWriteSet(rows);
 	}
 	/**
 	* Boot backfill (SP1): stamp `nodeId` on every persisted node-local
@@ -1962,40 +2015,51 @@ var StorageOrchestratorService = class {
 		const all = [...this.locations.values()];
 		return filter?.type ? all.filter((l) => l.type === filter.type) : all;
 	}
-	getDefaultLocation(type) {
-		for (const loc of this.locations.values()) if (loc.type === type && loc.isDefault) return loc;
-		return null;
+	/**
+	* The WRITE SET of a type: every enabled location of it, in stable id order.
+	* This replaced `getDefaultLocation` (D383) — a type does not have one write
+	* target any more, it has a pool, and every consumer that must pick one picks
+	* from here by its own rule (the recorder by headroom, a drain by an operator
+	* -named destination).
+	*/
+	writeTargets(type) {
+		return [...this.locations.values()].filter((loc) => loc.type === type && isLocationEnabled(loc)).toSorted((a, b) => a.id.localeCompare(b.id));
 	}
 	/**
-	* Repoint several logical defaults as one in-memory commit. The migration
-	* coordinator persists its `repointing` phase before calling this method, so
-	* a process crash during the backing-store writes is recovered by replaying
-	* the same idempotent target set before anyone resumes writers.
+	* Change the WRITE SET as one compensated commit: each named location is
+	* enabled (it joins the pool) or disabled (it becomes read-only — still read,
+	* still played back, still age-swept, still drained).
+	*
+	* This is the cutover verb, and its only caller is the migration coordinator,
+	* which persists its `repointing` phase BEFORE calling so a crash mid-write
+	* is recovered by replaying the same idempotent set before writers resume.
+	*
+	* It moves ONLY the locations it is given: a cutover from A to C on a class
+	* that also writes to B leaves B in the pool, because the operator's pool is
+	* the authority and a migration is not a licence to shrink it. The commit is
+	* refused when it would leave a write-serving type with nothing enabled —
+	* the same refusal `upsertLocation` applies, judged on the RESULT so an
+	* enable and a disable in one commit are weighed together.
 	*/
-	async setDefaultLocations(targetByType) {
-		if (targetByType.size === 0) return;
+	async setWriteTargets(enabledByLocationId) {
+		if (enabledByLocationId.size === 0) return;
 		const now = Date.now();
 		const nextById = new Map(this.locations);
 		const touched = /* @__PURE__ */ new Map();
-		for (const [type, targetId] of targetByType) {
-			const target = nextById.get(targetId);
-			if (!target) throw new Error(`Storage location "${targetId}" not found`);
-			if (target.type !== type) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${type}"`);
-			for (const [id, location] of nextById) {
-				if (location.type !== type) continue;
-				const isDefault = id === targetId;
-				const enable = isDefault && location.enabled === false;
-				if (location.isDefault === isDefault && !enable) continue;
-				const updated = {
-					...location,
-					isDefault,
-					...enable ? { enabled: true } : {},
-					updatedAt: now
-				};
-				nextById.set(id, updated);
-				touched.set(id, updated);
-			}
+		for (const [id, enabled] of enabledByLocationId) {
+			const location = nextById.get(id);
+			if (!location) throw new Error(`Storage location "${id}" not found`);
+			if (location.enabled === enabled) continue;
+			const updated = {
+				...location,
+				enabled,
+				updatedAt: now
+			};
+			nextById.set(id, updated);
+			touched.set(id, updated);
 		}
+		if (touched.size === 0) return;
+		refuseTypeWithoutWriteTarget(touched.values(), nextById.values());
 		if (this.locationStore) {
 			const previous = /* @__PURE__ */ new Map();
 			for (const id of touched.keys()) {
@@ -2015,13 +2079,10 @@ var StorageOrchestratorService = class {
 		for (const [id, location] of nextById) this.locations.set(id, location);
 	}
 	/**
-	* Insert or update a location. If `isDefault: true`, atomically
-	* demotes any other default for the same type — operators always see
-	* exactly one default per type.
+	* Insert or update a location.
 	*
-	* When a persistence store is wired (Task 6), the new record AND any
-	* implicitly-demoted siblings are persisted before the in-memory map
-	* mutation returns. Persistence errors propagate to the caller.
+	* When a persistence store is wired (Task 6), the record is mirrored to it;
+	* the mirror is fire-and-forget and its errors reach the logger.
 	*/
 	/**
 	* Refuse a `(location kind, provider)` pair the kind cannot use.
@@ -2107,30 +2168,17 @@ var StorageOrchestratorService = class {
 			updatedAt: now
 		};
 		refuseLastWriteTargetDisabled(existing, next, this.locations.values());
-		const demoted = [];
-		if (next.isDefault) {
-			for (const [otherId, otherLoc] of this.locations) if (otherLoc.type === next.type && otherLoc.id !== next.id && otherLoc.isDefault) {
-				const updated = {
-					...otherLoc,
-					isDefault: false,
-					updatedAt: now
-				};
-				this.locations.set(otherId, updated);
-				demoted.push(updated);
-			}
-		}
 		this.locations.set(next.id, next);
 		this.logger.debug("storage-orchestrator: upsertLocation", { meta: {
 			id: next.id,
 			type: next.type,
 			providerId: next.providerId,
-			isDefault: next.isDefault
+			enabled: next.enabled
 		} });
 		if (this.locationStore) {
 			const store = this.locationStore;
 			(async () => {
 				try {
-					for (const d of demoted) await store.upsert(d);
 					await store.upsert(next);
 				} catch (err) {
 					this.logger.error("storage-orchestrator: upsert persistence failed", { meta: {
@@ -2145,8 +2193,7 @@ var StorageOrchestratorService = class {
 	/**
 	* Remove a location. Refuses the last location of a type and the last
 	* enabled location of a type. `isSystem` is informational — a frozen
-	* recordings `:default` is deletable once a sibling is live. Deleting
-	* the flagged default promotes an enabled sibling. Occupancy still
+	* recordings `:default` is deletable once a sibling is live. Occupancy still
 	* refuses unless `force` is set; force never overrides uniqueness /
 	* last-enabled.
 	*/
@@ -2157,8 +2204,6 @@ var StorageOrchestratorService = class {
 		if (ofType.length <= 1) throw new Error(`Cannot delete "${id}" — it is the only location for type "${loc.type}"`);
 		const enabledOfType = ofType.filter((l) => l.enabled !== false);
 		if (loc.enabled !== false && enabledOfType.length <= 1) throw new Error(`Cannot delete "${id}" — it is the only enabled location for type "${loc.type}"`);
-		const successor = loc.isDefault === true ? ofType.find((l) => l.id !== id && l.enabled !== false) : void 0;
-		if (loc.isDefault === true && successor === void 0) throw new Error(`Cannot delete "${id}" — it is the only enabled location for type "${loc.type}"`);
 		const occupancy = await this.probeOccupancy(loc);
 		if (occupancy !== "empty") {
 			if (options?.force !== true) throw new Error(occupancy === "occupied" ? `Storage location "${id}" still holds data — drain it first (storage migration / relocate), or pass force to delete the record anyway and strand what is on it` : `Storage location "${id}" could not be checked for remaining data (unreachable provider, another node, or an unmounted root) — pass force to delete the record anyway`);
@@ -2168,21 +2213,6 @@ var StorageOrchestratorService = class {
 				occupancy
 			} });
 		}
-		if (successor !== void 0 && successor.isDefault !== true) {
-			const now = Date.now();
-			const promoted = {
-				...successor,
-				isDefault: true,
-				updatedAt: now
-			};
-			this.locations.set(successor.id, promoted);
-			if (this.locationStore) this.locationStore.upsert(promoted).catch((err) => {
-				this.logger.error("storage-orchestrator: default promotion persist failed", { meta: {
-					id: successor.id,
-					error: err instanceof Error ? err.message : String(err)
-				} });
-			});
-		}
 		this.locations.delete(id);
 		if (this.locationStore) this.locationStore.delete(id).catch((err) => {
 			this.logger.error("storage-orchestrator: delete persistence failed", { meta: {
@@ -2261,9 +2291,17 @@ var StorageOrchestratorService = class {
 			if (!loc) throw new Error(`Storage location "${ref}" not found`);
 			return loc;
 		}
-		const def = this.getDefaultLocation(ref);
-		if (!def) throw new Error(`No default storage location configured for type "${ref}" — register one or pass a fully-qualified id (\`<type>:<slug>\`)`);
-		return def;
+		const ofType = [...this.locations.values()].filter((loc) => loc.type === ref);
+		if (ofType.length === 1) return ofType[0];
+		if (ofType.length === 0) throw new Error(`No storage location configured for type "${ref}" — register one or pass a fully-qualified id (\`<type>:<slug>\`)`);
+		const slugged = ofType.find((loc) => loc.id === `${ref}:default`);
+		if (!slugged) throw new Error(`Storage type "${ref}" has ${String(ofType.length)} locations (${ofType.map((loc) => loc.id).toSorted().join(", ")}) — a bare type ref is ambiguous, pass a fully-qualified id (\`<type>:<slug>\`)`);
+		this.logger.warn("storage-orchestrator: DEPRECATED bare-type ref on a type with several locations — resolved to the legacy `:default`-slugged row. Pass a fully-qualified location id.", { meta: {
+			ref,
+			resolved: slugged.id,
+			candidates: ofType.length
+		} });
+		return slugged;
 	}
 	/**
 	* Find the storage-provider that backs a given location — the entry point
@@ -2367,9 +2405,11 @@ var StorageOrchestratorService = class {
 	* declarations on a populated map is a no-op (each declared `id`
 	* already resolves to an existing `<id>:default`).
 	*
-	* Convention: the bare-type ref `'recordings'` resolves via
-	* `getDefaultLocation('recordings')` (walks `isDefault === true`); the
-	* actual stored `id` is `'recordings:default'` so it satisfies the
+	* The seeded row is born ENABLED — a fresh install must be able to write the
+	* moment it boots, and `enabled` is the only write switch there is (D383).
+	* The `:default` suffix is a NAME kept for idempotency across existing
+	* installs, not a flag: the stored `id` is `'recordings:default'` so it
+	* satisfies the
 	* `^[a-z][a-z0-9-]*:[a-z0-9-]+$` regex on `StorageLocationSchema.id`.
 	*
 	* `basePath` is the storage root (e.g. `<CAMSTACK_DATA>`). Each
@@ -2394,7 +2434,7 @@ var StorageOrchestratorService = class {
 				displayName: d.displayName,
 				providerId: input.providerId,
 				config: { basePath: base },
-				isDefault: true,
+				enabled: true,
 				isSystem: false
 			});
 			added++;
@@ -2418,7 +2458,7 @@ function resolveEnabled(input, existing, typeAlreadyHasLocation) {
 	const requested = input.enabled ?? existing?.enabled;
 	if (requested === void 0) {
 		if (existing) return {};
-		return { enabled: input.isDefault || !typeAlreadyHasLocation };
+		return { enabled: !typeAlreadyHasLocation };
 	}
 	return { enabled: requested };
 }
@@ -2427,8 +2467,7 @@ var OPTIONAL_WRITE_TYPES = new Set(["backups"]);
 /**
 * Refuse an UPDATE that would leave a write-serving type with no enabled
 * location. Creates are exempt (an explicit `enabled: false` on the first
-* location is already a named test). `isDefault` is not consulted — enabled
-* is the write set.
+* location is already a named test). Enabled IS the write set.
 */
 function refuseLastWriteTargetDisabled(existing, next, locations) {
 	if (OPTIONAL_WRITE_TYPES.has(next.type)) return;
@@ -2441,6 +2480,23 @@ function refuseLastWriteTargetDisabled(existing, next, locations) {
 	}
 	throw new Error(`Cannot disable "${next.id}": it is the last enabled location of type "${next.type}". Enable another location of this type first.`);
 }
+/**
+* The same refusal, judged on a whole COMMIT rather than one row: a
+* multi-location change (a cutover enables its destination and disables its
+* source in one go) must be weighed on its RESULT, or the disable half looks
+* like the last write target leaving while the enable half is already in the
+* same map.
+*/
+function refuseTypeWithoutWriteTarget(touched, result) {
+	const rows = [...result];
+	for (const type of new Set([...touched].map((loc) => loc.type))) {
+		if (OPTIONAL_WRITE_TYPES.has(type)) continue;
+		const ofType = rows.filter((loc) => loc.type === type);
+		if (ofType.length === 0) continue;
+		if (ofType.some((loc) => isLocationEnabled(loc))) continue;
+		throw new Error(`Refusing the write-set change: it would leave type "${type}" with no enabled location. Enable one of ${ofType.map((loc) => loc.id).toSorted().join(", ")} first.`);
+	}
+}
 //#endregion
 //#region src/builtins/storage-orchestrator/storage-pressure-manager.ts
 var DEFAULT_MAX_ROUNDS = 8;
@@ -2682,13 +2738,9 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				const rows = type !== void 0 ? service.listLocations({ type }) : service.listLocations();
 				return Promise.all(rows.map(async (loc) => ({
 					...this.redacted(loc),
-					capacity: loc.enabled === false ? null : await this.localCapacityOf(loc)
+					capacity: isLocationEnabled(loc) ? await this.localCapacityOf(loc) : null
 				})));
 			},
-			getDefaultLocation: async ({ type }) => {
-				const loc = service.getDefaultLocation(type);
-				return loc === null ? null : this.redacted(loc);
-			},
 			listLocationDeclarations: async () => service.listDeclarations(),
 			upsertLocation: async (input) => {
 				const stored = service.getLocationById(input.id);