@camstack/system 1.2.227 → 1.2.228

package/dist/builtins/storage-orchestrator/location-volume-capacity.d.ts

@@ -0,0 +1,58 @@
+import { StorageLocation } from '@camstack/types';
+import { ProviderLocality } from './access-guards.js';
+/** The three `statfs` fields capacity is derived from (`node:fs` StatsFs). */
+export interface StatfsFacts {
+    readonly blocks: number;
+    readonly bsize: number;
+    readonly bavail: number;
+}
+/** The filesystem reads the probe takes, injected so the decision is testable. */
+export interface VolumeProbe {
+    readonly access: (target: string) => Promise<void>;
+    readonly statfs: (target: string) => Promise<StatfsFacts>;
+}
+export interface VolumeProbeDeps {
+    readonly probe: VolumeProbe;
+    /** Only ever used to REJECT a relative `basePath` by naming what it would
+     *  have resolved against — never to resolve one. */
+    readonly cwd: string;
+}
+/**
+ * A measurement, or the reason there is none. `unknown` is never folded into a
+ * number: `0` free means "full" to every reader of this figure (D393).
+ */
+export type LocalVolumeCapacity = {
+    readonly kind: 'measured';
+    /** The path actually stat'd — the location's root, or an ancestor of it. */
+    readonly path: string;
+    readonly totalBytes: number;
+    readonly availableBytes: number;
+} | {
+    readonly kind: 'unknown';
+    readonly reason: string;
+};
+/** The two figures the cap carries, or `null` — never a zero standing in. */
+export interface MeasuredVolume {
+    readonly totalBytes: number;
+    readonly availableBytes: number;
+}
+/**
+ * Free percent for the pressure guard. An unmeasurable volume answers `100`,
+ * which is the value that keeps the guard INERT: a disk nobody measured must
+ * never be the reason footage is deleted (D393).
+ */
+export declare function freePercentOf(capacity: MeasuredVolume | null): number;
+/**
+ * Volume total for turning a deficit percentage into a byte target. `0` on an
+ * unmeasurable volume — the guard's own stop condition reads that as "no
+ * target", so nothing is evicted on a reading nobody took.
+ */
+export declare function volumeTotalBytesOf(capacity: MeasuredVolume | null): number;
+/**
+ * Free + total bytes on the volume backing `location`, or why there are none.
+ *
+ * Never throws: an unreachable volume is one degraded ROW, not a failed
+ * `listLocations` — a NAS that stops answering must not blank the capacity of
+ * every other disk on the node.
+ */
+export declare function readLocalVolumeCapacity(location: StorageLocation, locality: ProviderLocality, localNodeId: string, deps: VolumeProbeDeps): Promise<LocalVolumeCapacity>;

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.d.ts

@@ -177,9 +177,22 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
     private providerIsNodeLocal;
     /** See the call site in the `resolve` dispatch, and `access-guards.ts`. */
     private refuseRemoteResolve;
-    /** statfs capacity of a location's basePath, walking up to the nearest
-     *  existing ancestor. Null for remote-node locations or unstattable paths. */
+    /**
+     * The volume figures for one location, or `null` when this node cannot take
+     * a measurement that is genuinely about it.
+     *
+     * The decision lives in `location-volume-capacity.ts` — including why a
+     * remote-provider location (the SMB share that was reporting the hub's own
+     * disk) gets nothing rather than a number. Here we only supply the node id,
+     * the provider's declared locality and the real filesystem, and log the
+     * reason once per distinct fault: `listLocations` is on the admin UI's poll,
+     * so a line per call would be a line per second.
+     */
     private localCapacityOf;
+    /** locationId → the last unmeasurable reason logged for it. */
+    private readonly capacityUnknownLogged;
+    private logCapacityUnknownOnce;
+    private clearCapacityUnknown;
     /** Per-location cap on EVICTABLE bytes (`config.maxUsedGb`): the operator's
      *  "recordings may use at most N GB in total" — enforced by the pressure
      *  manager alongside the free-percent guard. */
@@ -225,9 +238,22 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
      * errno — `EACCES`, `EIO`, a stale NFS handle — is `unknown` and refuses.
      */
     private locationOccupancy;
-    /** Free capacity (%) on a location's volume via `statfs`; 100 (guard inert) when unstattable. */
+    /**
+     * The pressure guard's two readings come from the SAME probe the UI's
+     * capacity does — one capacity truth per location, not two.
+     *
+     * They used to `statfs` the raw `basePath` themselves, which on this node
+     * answers for whatever local path happens to carry that name: a location
+     * owned by another node, or served by a remote provider, could decide
+     * eviction from the hub's own disk. Both now degrade exactly as they did
+     * when the path was unstattable — `100` (guard inert) and `0` (no byte
+     * target) — but they do so for every reading that is not ABOUT the location,
+     * not only for the ones that threw.
+     */
+    private volumeCapacityOf;
+    /** Free capacity (%) on a location's volume; 100 (guard inert) when unmeasurable. */
     private locationFreePercent;
-    /** Total bytes on a location's volume via `statfs`; 0 when unstattable. */
+    /** Total bytes on a location's volume; 0 when unmeasurable. */
     private locationVolumeTotalBytes;
     /**
      * Seed default storage locations from the addon-declared

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -1725,6 +1725,128 @@ function resolveMinFreePercent(config, providerDefaultPercent, capacity, notice)
 	return Math.min(100, percent);
 }
 //#endregion
+//#region src/builtins/storage-orchestrator/location-volume-capacity.ts
+/**
+* `StorageLocation.capacity` — the ONE place a location's volume is measured,
+* and the one place that decides a volume cannot be measured from here.
+*
+* ## What it is measuring
+*
+* `statfs` answers "how big is the volume, and how much of it is free". It is a
+* fact about a MOUNT on THIS node. A location only has such a fact when three
+* things hold at once: the provider serves a genuine local filesystem
+* (`getProviderInfo().nodeLocal`), the location belongs to this node, and its
+* `basePath` names an absolute path on it. Miss any of them and the correct
+* answer is `unknown` — which the cap carries as a null `capacity` and the
+* admin UI renders as "Capacity unknown", with no bar (D315: an empty bar reads
+* as plenty of room).
+*
+* ## The defect that made this a module
+*
+* Measured on the live hub, 2026-09-13. `storage.listLocations` returned two
+* `backups` locations with byte-identical capacity — `/data/backups` on
+* `filesystem-storage` and `//192.168.1.89/backups` on `smb-storage`, both
+* `total 506107977728 / available 193348673536`. `owned` differed correctly
+* (9.9 GB vs 1.6 GB), so nothing about the rendering was at fault: the probe
+* simply never looked at the provider. It `path.resolve`d the SMB row's
+* share-relative `basePath: "camstack"` against the hub process's cwd, found no
+* such directory, walked up to the nearest existing ancestor — the container
+* root — and reported the HUB's own disk as the share's. The operator was told
+* an SMB share was 62% full by a reading nobody had taken of it.
+*
+* This is D296's shape in a third place. `access-guards.ts` already refuses
+* `resolve` and occupancy probes on a remote-backed location for the same
+* reason; a `statfs` is the same mistake with a number attached instead of a
+* path. It is also D393: a measurement that failed is `null`, never a figure —
+* and the reason travels with it so the caller can log which fault it is.
+*
+* ## The ancestor walk, and where it stops
+*
+* A node-local root that has not been created yet is normal (first boot, a new
+* location). Measuring the nearest EXISTING ancestor is honest there: it is the
+* volume a write would land on today. It stops being honest at the filesystem
+* root — reaching `/` means every named segment is missing, which is what an
+* unmounted array looks like, and reporting the root disk's size as the array's
+* is the same lie in a smaller font. That case is `unknown`.
+*/
+function unknown(reason) {
+	return {
+		kind: "unknown",
+		reason
+	};
+}
+/**
+* Free percent for the pressure guard. An unmeasurable volume answers `100`,
+* which is the value that keeps the guard INERT: a disk nobody measured must
+* never be the reason footage is deleted (D393).
+*/
+function freePercentOf(capacity) {
+	if (capacity === null || capacity.totalBytes <= 0) return 100;
+	return capacity.availableBytes / capacity.totalBytes * 100;
+}
+/**
+* Volume total for turning a deficit percentage into a byte target. `0` on an
+* unmeasurable volume — the guard's own stop condition reads that as "no
+* target", so nothing is evicted on a reading nobody took.
+*/
+function volumeTotalBytesOf(capacity) {
+	return capacity === null ? 0 : capacity.totalBytes;
+}
+/**
+* May this node take a `statfs` that is genuinely ABOUT this location?
+*
+* Unlike `resolveRefusalFor`, an unclassified provider (`undefined`) answers
+* no. That guard protects a WRITE, where refusing on a read nobody made would
+* break a working location (D49); here the product is a number an operator
+* reads, and a number justified by an unmade read is exactly what this module
+* exists to stop.
+*/
+function probePathFor(location, locality, localNodeId, cwd) {
+	if (locality !== true) {
+		const why = locality === false ? `is served by the remote provider "${location.providerId}" (nodeLocal: false) — its bytes live on the remote host and no local statfs describes them` : `is served by "${location.providerId}", which this node has not classified yet (no getProviderInfo answer) — a local statfs would be a guess`;
+		return { reason: `location "${location.id}" ${why}` };
+	}
+	if (location.nodeId !== void 0 && location.nodeId !== localNodeId) return { reason: `location "${location.id}" lives on node "${location.nodeId}" and this is "${localNodeId}" — only the owning node can statfs its own volumes` };
+	const basePath = location.config["basePath"];
+	if (typeof basePath !== "string" || basePath.length === 0) return { reason: `location "${location.id}" declares no basePath to measure` };
+	if (!node_path.default.isAbsolute(basePath)) return { reason: `location "${location.id}" declares a RELATIVE basePath ("${basePath}") — that is a path inside its provider's own namespace, not on this node's filesystem, and resolving it against "${cwd}" would measure an unrelated volume` };
+	return { path: node_path.default.resolve(basePath) };
+}
+/**
+* Free + total bytes on the volume backing `location`, or why there are none.
+*
+* Never throws: an unreachable volume is one degraded ROW, not a failed
+* `listLocations` — a NAS that stops answering must not blank the capacity of
+* every other disk on the node.
+*/
+async function readLocalVolumeCapacity(location, locality, localNodeId, deps) {
+	const target = probePathFor(location, locality, localNodeId, deps.cwd);
+	if ("reason" in target) return unknown(target.reason);
+	const root = node_path.default.parse(target.path).root;
+	let probed = target.path;
+	for (;;) try {
+		await deps.probe.access(probed);
+		break;
+	} catch {
+		const parent = node_path.default.dirname(probed);
+		if (parent === probed) return unknown(`nothing on the path "${target.path}" exists on this node — the volume is not mounted, so the root filesystem's size is not an answer about it`);
+		probed = parent;
+	}
+	if (probed === root && target.path !== root) return unknown(`only the filesystem root exists on the path "${target.path}" — the volume is not mounted, so the root filesystem's size is not an answer about it`);
+	try {
+		const st = await deps.probe.statfs(probed);
+		return {
+			kind: "measured",
+			path: probed,
+			totalBytes: st.blocks * st.bsize,
+			availableBytes: st.bavail * st.bsize
+		};
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		return unknown(`statfs("${probed}") failed: ${reason}`);
+	}
+}
+//#endregion
 //#region src/builtins/storage-orchestrator/location-secrets.ts
 /**
 * The config keys the ORCHESTRATOR itself owns, as opposed to the ones a
@@ -3976,31 +4098,53 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 		} });
 		throw new Error(refusal);
 	}
-	/** statfs capacity of a location's basePath, walking up to the nearest
-	*  existing ancestor. Null for remote-node locations or unstattable paths. */
+	/**
+	* The volume figures for one location, or `null` when this node cannot take
+	* a measurement that is genuinely about it.
+	*
+	* The decision lives in `location-volume-capacity.ts` — including why a
+	* remote-provider location (the SMB share that was reporting the hub's own
+	* disk) gets nothing rather than a number. Here we only supply the node id,
+	* the provider's declared locality and the real filesystem, and log the
+	* reason once per distinct fault: `listLocations` is on the admin UI's poll,
+	* so a line per call would be a line per second.
+	*/
 	async localCapacityOf(loc) {
-		const localNode = this.service?.getLocalNodeId() ?? "hub";
-		if (loc.nodeId !== void 0 && loc.nodeId !== localNode) return null;
-		const bp = loc.config["basePath"];
-		if (typeof bp !== "string" || bp.length === 0) return null;
-		try {
-			let target = node_path.resolve(bp);
-			for (;;) try {
-				await node_fs_promises.access(target);
-				break;
-			} catch {
-				const parent = node_path.dirname(target);
-				if (!parent || parent === target) return null;
-				target = parent;
-			}
-			const st = await node_fs_promises.statfs(target);
-			return {
-				totalBytes: st.blocks * st.bsize,
-				availableBytes: st.bavail * st.bsize
-			};
-		} catch {
+		const localNode = this.service?.getLocalNodeId() ?? HUB_NODE_ID;
+		const result = await readLocalVolumeCapacity(loc, this.providerIsNodeLocal(loc), localNode, {
+			probe: {
+				access: (target) => node_fs_promises.access(target),
+				statfs: async (target) => node_fs_promises.statfs(target)
+			},
+			cwd: node_path.resolve(".")
+		});
+		if (result.kind === "unknown") {
+			this.logCapacityUnknownOnce(loc.id, result.reason);
 			return null;
 		}
+		this.clearCapacityUnknown(loc.id, result.path);
+		return {
+			totalBytes: result.totalBytes,
+			availableBytes: result.availableBytes
+		};
+	}
+	/** locationId → the last unmeasurable reason logged for it. */
+	capacityUnknownLogged = /* @__PURE__ */ new Map();
+	logCapacityUnknownOnce(locationId, reason) {
+		if (this.capacityUnknownLogged.get(locationId) === reason) return;
+		this.capacityUnknownLogged.set(locationId, reason);
+		this.ctx.logger.warn("storage-orchestrator: capacity is UNKNOWN for a location — reporting nothing rather than another volume’s figures", { meta: {
+			locationId,
+			reason
+		} });
+	}
+	clearCapacityUnknown(locationId, measuredPath) {
+		if (!this.capacityUnknownLogged.has(locationId)) return;
+		this.capacityUnknownLogged.delete(locationId);
+		this.ctx.logger.info("storage-orchestrator: capacity is measurable again", { meta: {
+			locationId,
+			measuredPath
+		} });
 	}
 	/** Per-location cap on EVICTABLE bytes (`config.maxUsedGb`): the operator's
 	*  "recordings may use at most N GB in total" — enforced by the pressure
@@ -4089,28 +4233,30 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 		} });
 		return occupancy;
 	}
-	/** Free capacity (%) on a location's volume via `statfs`; 100 (guard inert) when unstattable. */
+	/**
+	* The pressure guard's two readings come from the SAME probe the UI's
+	* capacity does — one capacity truth per location, not two.
+	*
+	* They used to `statfs` the raw `basePath` themselves, which on this node
+	* answers for whatever local path happens to carry that name: a location
+	* owned by another node, or served by a remote provider, could decide
+	* eviction from the hub's own disk. Both now degrade exactly as they did
+	* when the path was unstattable — `100` (guard inert) and `0` (no byte
+	* target) — but they do so for every reading that is not ABOUT the location,
+	* not only for the ones that threw.
+	*/
+	async volumeCapacityOf(locationId) {
+		const loc = this.service?.listLocations().find((l) => l.id === locationId);
+		if (!loc) return null;
+		return this.localCapacityOf(loc);
+	}
+	/** Free capacity (%) on a location's volume; 100 (guard inert) when unmeasurable. */
 	async locationFreePercent(locationId) {
-		const bp = this.locationBasePath(locationId);
-		if (!bp) return 100;
-		try {
-			const st = await node_fs_promises.statfs(bp);
-			if (st.blocks <= 0) return 100;
-			return st.bavail / st.blocks * 100;
-		} catch {
-			return 100;
-		}
+		return freePercentOf(await this.volumeCapacityOf(locationId));
 	}
-	/** Total bytes on a location's volume via `statfs`; 0 when unstattable. */
+	/** Total bytes on a location's volume; 0 when unmeasurable. */
 	async locationVolumeTotalBytes(locationId) {
-		const bp = this.locationBasePath(locationId);
-		if (!bp) return 0;
-		try {
-			const st = await node_fs_promises.statfs(bp);
-			return st.blocks * st.bsize;
-		} catch {
-			return 0;
-		}
+		return volumeTotalBytesOf(await this.volumeCapacityOf(locationId));
 	}
 	/**
 	* Seed default storage locations from the addon-declared

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1720,6 +1720,128 @@ function resolveMinFreePercent(config, providerDefaultPercent, capacity, notice)
 	return Math.min(100, percent);
 }
 //#endregion
+//#region src/builtins/storage-orchestrator/location-volume-capacity.ts
+/**
+* `StorageLocation.capacity` — the ONE place a location's volume is measured,
+* and the one place that decides a volume cannot be measured from here.
+*
+* ## What it is measuring
+*
+* `statfs` answers "how big is the volume, and how much of it is free". It is a
+* fact about a MOUNT on THIS node. A location only has such a fact when three
+* things hold at once: the provider serves a genuine local filesystem
+* (`getProviderInfo().nodeLocal`), the location belongs to this node, and its
+* `basePath` names an absolute path on it. Miss any of them and the correct
+* answer is `unknown` — which the cap carries as a null `capacity` and the
+* admin UI renders as "Capacity unknown", with no bar (D315: an empty bar reads
+* as plenty of room).
+*
+* ## The defect that made this a module
+*
+* Measured on the live hub, 2026-09-13. `storage.listLocations` returned two
+* `backups` locations with byte-identical capacity — `/data/backups` on
+* `filesystem-storage` and `//192.168.1.89/backups` on `smb-storage`, both
+* `total 506107977728 / available 193348673536`. `owned` differed correctly
+* (9.9 GB vs 1.6 GB), so nothing about the rendering was at fault: the probe
+* simply never looked at the provider. It `path.resolve`d the SMB row's
+* share-relative `basePath: "camstack"` against the hub process's cwd, found no
+* such directory, walked up to the nearest existing ancestor — the container
+* root — and reported the HUB's own disk as the share's. The operator was told
+* an SMB share was 62% full by a reading nobody had taken of it.
+*
+* This is D296's shape in a third place. `access-guards.ts` already refuses
+* `resolve` and occupancy probes on a remote-backed location for the same
+* reason; a `statfs` is the same mistake with a number attached instead of a
+* path. It is also D393: a measurement that failed is `null`, never a figure —
+* and the reason travels with it so the caller can log which fault it is.
+*
+* ## The ancestor walk, and where it stops
+*
+* A node-local root that has not been created yet is normal (first boot, a new
+* location). Measuring the nearest EXISTING ancestor is honest there: it is the
+* volume a write would land on today. It stops being honest at the filesystem
+* root — reaching `/` means every named segment is missing, which is what an
+* unmounted array looks like, and reporting the root disk's size as the array's
+* is the same lie in a smaller font. That case is `unknown`.
+*/
+function unknown(reason) {
+	return {
+		kind: "unknown",
+		reason
+	};
+}
+/**
+* Free percent for the pressure guard. An unmeasurable volume answers `100`,
+* which is the value that keeps the guard INERT: a disk nobody measured must
+* never be the reason footage is deleted (D393).
+*/
+function freePercentOf(capacity) {
+	if (capacity === null || capacity.totalBytes <= 0) return 100;
+	return capacity.availableBytes / capacity.totalBytes * 100;
+}
+/**
+* Volume total for turning a deficit percentage into a byte target. `0` on an
+* unmeasurable volume — the guard's own stop condition reads that as "no
+* target", so nothing is evicted on a reading nobody took.
+*/
+function volumeTotalBytesOf(capacity) {
+	return capacity === null ? 0 : capacity.totalBytes;
+}
+/**
+* May this node take a `statfs` that is genuinely ABOUT this location?
+*
+* Unlike `resolveRefusalFor`, an unclassified provider (`undefined`) answers
+* no. That guard protects a WRITE, where refusing on a read nobody made would
+* break a working location (D49); here the product is a number an operator
+* reads, and a number justified by an unmade read is exactly what this module
+* exists to stop.
+*/
+function probePathFor(location, locality, localNodeId, cwd) {
+	if (locality !== true) {
+		const why = locality === false ? `is served by the remote provider "${location.providerId}" (nodeLocal: false) — its bytes live on the remote host and no local statfs describes them` : `is served by "${location.providerId}", which this node has not classified yet (no getProviderInfo answer) — a local statfs would be a guess`;
+		return { reason: `location "${location.id}" ${why}` };
+	}
+	if (location.nodeId !== void 0 && location.nodeId !== localNodeId) return { reason: `location "${location.id}" lives on node "${location.nodeId}" and this is "${localNodeId}" — only the owning node can statfs its own volumes` };
+	const basePath = location.config["basePath"];
+	if (typeof basePath !== "string" || basePath.length === 0) return { reason: `location "${location.id}" declares no basePath to measure` };
+	if (!path.isAbsolute(basePath)) return { reason: `location "${location.id}" declares a RELATIVE basePath ("${basePath}") — that is a path inside its provider's own namespace, not on this node's filesystem, and resolving it against "${cwd}" would measure an unrelated volume` };
+	return { path: path.resolve(basePath) };
+}
+/**
+* Free + total bytes on the volume backing `location`, or why there are none.
+*
+* Never throws: an unreachable volume is one degraded ROW, not a failed
+* `listLocations` — a NAS that stops answering must not blank the capacity of
+* every other disk on the node.
+*/
+async function readLocalVolumeCapacity(location, locality, localNodeId, deps) {
+	const target = probePathFor(location, locality, localNodeId, deps.cwd);
+	if ("reason" in target) return unknown(target.reason);
+	const root = path.parse(target.path).root;
+	let probed = target.path;
+	for (;;) try {
+		await deps.probe.access(probed);
+		break;
+	} catch {
+		const parent = path.dirname(probed);
+		if (parent === probed) return unknown(`nothing on the path "${target.path}" exists on this node — the volume is not mounted, so the root filesystem's size is not an answer about it`);
+		probed = parent;
+	}
+	if (probed === root && target.path !== root) return unknown(`only the filesystem root exists on the path "${target.path}" — the volume is not mounted, so the root filesystem's size is not an answer about it`);
+	try {
+		const st = await deps.probe.statfs(probed);
+		return {
+			kind: "measured",
+			path: probed,
+			totalBytes: st.blocks * st.bsize,
+			availableBytes: st.bavail * st.bsize
+		};
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		return unknown(`statfs("${probed}") failed: ${reason}`);
+	}
+}
+//#endregion
 //#region src/builtins/storage-orchestrator/location-secrets.ts
 /**
 * The config keys the ORCHESTRATOR itself owns, as opposed to the ones a
@@ -3971,31 +4093,53 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		} });
 		throw new Error(refusal);
 	}
-	/** statfs capacity of a location's basePath, walking up to the nearest
-	*  existing ancestor. Null for remote-node locations or unstattable paths. */
+	/**
+	* The volume figures for one location, or `null` when this node cannot take
+	* a measurement that is genuinely about it.
+	*
+	* The decision lives in `location-volume-capacity.ts` — including why a
+	* remote-provider location (the SMB share that was reporting the hub's own
+	* disk) gets nothing rather than a number. Here we only supply the node id,
+	* the provider's declared locality and the real filesystem, and log the
+	* reason once per distinct fault: `listLocations` is on the admin UI's poll,
+	* so a line per call would be a line per second.
+	*/
 	async localCapacityOf(loc) {
-		const localNode = this.service?.getLocalNodeId() ?? "hub";
-		if (loc.nodeId !== void 0 && loc.nodeId !== localNode) return null;
-		const bp = loc.config["basePath"];
-		if (typeof bp !== "string" || bp.length === 0) return null;
-		try {
-			let target = path$1.resolve(bp);
-			for (;;) try {
-				await fs.access(target);
-				break;
-			} catch {
-				const parent = path$1.dirname(target);
-				if (!parent || parent === target) return null;
-				target = parent;
-			}
-			const st = await fs.statfs(target);
-			return {
-				totalBytes: st.blocks * st.bsize,
-				availableBytes: st.bavail * st.bsize
-			};
-		} catch {
+		const localNode = this.service?.getLocalNodeId() ?? HUB_NODE_ID;
+		const result = await readLocalVolumeCapacity(loc, this.providerIsNodeLocal(loc), localNode, {
+			probe: {
+				access: (target) => fs.access(target),
+				statfs: async (target) => fs.statfs(target)
+			},
+			cwd: path$1.resolve(".")
+		});
+		if (result.kind === "unknown") {
+			this.logCapacityUnknownOnce(loc.id, result.reason);
 			return null;
 		}
+		this.clearCapacityUnknown(loc.id, result.path);
+		return {
+			totalBytes: result.totalBytes,
+			availableBytes: result.availableBytes
+		};
+	}
+	/** locationId → the last unmeasurable reason logged for it. */
+	capacityUnknownLogged = /* @__PURE__ */ new Map();
+	logCapacityUnknownOnce(locationId, reason) {
+		if (this.capacityUnknownLogged.get(locationId) === reason) return;
+		this.capacityUnknownLogged.set(locationId, reason);
+		this.ctx.logger.warn("storage-orchestrator: capacity is UNKNOWN for a location — reporting nothing rather than another volume’s figures", { meta: {
+			locationId,
+			reason
+		} });
+	}
+	clearCapacityUnknown(locationId, measuredPath) {
+		if (!this.capacityUnknownLogged.has(locationId)) return;
+		this.capacityUnknownLogged.delete(locationId);
+		this.ctx.logger.info("storage-orchestrator: capacity is measurable again", { meta: {
+			locationId,
+			measuredPath
+		} });
 	}
 	/** Per-location cap on EVICTABLE bytes (`config.maxUsedGb`): the operator's
 	*  "recordings may use at most N GB in total" — enforced by the pressure
@@ -4084,28 +4228,30 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		} });
 		return occupancy;
 	}
-	/** Free capacity (%) on a location's volume via `statfs`; 100 (guard inert) when unstattable. */
+	/**
+	* The pressure guard's two readings come from the SAME probe the UI's
+	* capacity does — one capacity truth per location, not two.
+	*
+	* They used to `statfs` the raw `basePath` themselves, which on this node
+	* answers for whatever local path happens to carry that name: a location
+	* owned by another node, or served by a remote provider, could decide
+	* eviction from the hub's own disk. Both now degrade exactly as they did
+	* when the path was unstattable — `100` (guard inert) and `0` (no byte
+	* target) — but they do so for every reading that is not ABOUT the location,
+	* not only for the ones that threw.
+	*/
+	async volumeCapacityOf(locationId) {
+		const loc = this.service?.listLocations().find((l) => l.id === locationId);
+		if (!loc) return null;
+		return this.localCapacityOf(loc);
+	}
+	/** Free capacity (%) on a location's volume; 100 (guard inert) when unmeasurable. */
 	async locationFreePercent(locationId) {
-		const bp = this.locationBasePath(locationId);
-		if (!bp) return 100;
-		try {
-			const st = await fs.statfs(bp);
-			if (st.blocks <= 0) return 100;
-			return st.bavail / st.blocks * 100;
-		} catch {
-			return 100;
-		}
+		return freePercentOf(await this.volumeCapacityOf(locationId));
 	}
-	/** Total bytes on a location's volume via `statfs`; 0 when unstattable. */
+	/** Total bytes on a location's volume; 0 when unmeasurable. */
 	async locationVolumeTotalBytes(locationId) {
-		const bp = this.locationBasePath(locationId);
-		if (!bp) return 0;
-		try {
-			const st = await fs.statfs(bp);
-			return st.blocks * st.bsize;
-		} catch {
-			return 0;
-		}
+		return volumeTotalBytesOf(await this.volumeCapacityOf(locationId));
 	}
 	/**
 	* Seed default storage locations from the addon-declared

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.227",
+  "version": "1.2.228",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",