@camstack/system 1.2.452 → 1.2.454

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { An as memoizePinnedFfmpeg, Br as DeviceType, Hr as BaseAddon, Rr as DeviceFeature, Vr as errMsg, Vt as deriveBatteryPresence, _r as streamQualityLabel, _t as bareAddonId, lr as snapshotCapability, ma as EventCategory, qi as nodePin, s as BatteryStatusSchema, vt as batteryCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Gr as errMsg, Hr as DeviceFeature, Kr as BaseAddon, Pn as memoizePinnedFfmpeg, Ut as deriveBatteryPresence, Wr as DeviceType, Zi as nodePin, bt as batteryCapability, pr as snapshotCapability, s as BatteryStatusSchema, va as EventCategory, xr as streamQualityLabel, yt as bareAddonId } from "../../dist-7ZciHCIp.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Hr as BaseAddon, hr as storageProviderCapability, in as filesystemBrowseCapability } from "../../dist-DV2ll9Hi.mjs";
+import { Kr as BaseAddon, on as filesystemBrowseCapability, yr as storageProviderCapability } from "../../dist-7ZciHCIp.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-BspX29jz.js");
+const require_wal_maintenance = require("../../wal-maintenance-Bo_lo3Dh.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-BNIaf3QP.mjs";
+import { A as SQLITE_MMAP_CEILING_BYTES, B as SQLITE_SLOW_CALL_MS, F as sqlitePageCacheKibFor, H as sqliteEngineStorm, I as SQLITE_ENGINE_STORM_WALL_SHARE, L as SQLITE_PROFILE_REPORT_FLOOR_MS, M as SQLITE_PAGE_CACHE_CEILING_KIB, N as SQLITE_PAGE_CACHE_FLOOR_KIB, P as sqliteMmapSizeFor, R as SQLITE_PROFILE_REPORT_INTERVAL_MS, V as SqliteOpProfiler, a as WalMaintenance, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_MMAP_FLOOR_BYTES, k as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, l as SqliteSettingsBackend, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SQLITE_PROFILE_TOP_N } from "../../wal-maintenance-Df89xxrK.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/records/records-engine.d.ts

@@ -27,6 +27,19 @@ export declare class RecordsEngine implements RecordsEngineOps {
 	private readonly now;
 	private readonly writesSinceTrim;
 	constructor(db: Database.Database, options: RecordsEngineOptions);
+	/**
+	* Boot correction: every kind that ever allocated an id has its counter raised
+	* above the highest numeric id it holds. Adopted legacy rows (or any caller
+	* chosen numeric id) kept ids far above a counter that started at 1, and the
+	* upsert would have overwritten another device's row on the first collision.
+	* Runs on the engine's own connection, over the (kind_id, id) unique index.
+	*/
+	private correctSequences;
+	/** Ids handed out by allocateId and not yet written: their first write is insert-only. */
+	private readonly pendingAllocated;
+	private static readonly PENDING_ALLOCATED_MAX;
+	/** Raise a kind's counter above the numeric ids of a caller-supplied batch (adoption). */
+	private raiseSequenceFor;
 	private schemaReady;
 	private kindOf;
 	declareKinds(input: OwnedInput<"declareKinds">): Promise<RecordsOutput<"declareKinds">>;

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Ct88catN.js");
+const require_dist = require("../../dist-Bi4Ioxop.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");
-const require_wal_maintenance = require("../../wal-maintenance-BspX29jz.js");
+const require_wal_maintenance = require("../../wal-maintenance-Bo_lo3Dh.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { $ as STORAGE_ADMIN_SCOPED_BASES, $i as parseSettingsArrayAdoptsFrom, $r as NoCallerError, Gn as recordsCapability, Hr as BaseAddon, It as dataStoreProviderCapability, Jr as DeclarationRefusedError, Lt as databaseSnapshotCapability, Q as STORAGE_ADMIN_MOVED_COLLECTIONS, S as DATA_STORE_DATABASES, Vr as errMsg, Yi as normalizeSecretOwner, _i as UnknownRecordKindError, _t as bareAddonId, b as DATABASE_SNAPSHOT_SUFFIX, dr as storageAdminCapability, ea as parseSettingsBrokersAdoptsFrom, ii as RECORD_SWEEP_INTERVAL_MS, si as RUNTIME_DEFAULTS, ui as RecordKindDeclarationSchema, wr as vectorStoreCapability, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-DV2ll9Hi.mjs";
+import { $ as STORAGE_ADMIN_SCOPED_BASES, $i as normalizeSecretOwner, Gr as errMsg, Kr as BaseAddon, Or as vectorStoreCapability, Q as STORAGE_ADMIN_MOVED_COLLECTIONS, Qr as DeclarationRefusedError, Rt as dataStoreProviderCapability, S as DATA_STORE_DATABASES, Yn as recordsCapability, b as DATABASE_SNAPSHOT_SUFFIX, ci as RECORD_SWEEP_INTERVAL_MS, di as RUNTIME_DEFAULTS, hr as storageAdminCapability, ia as parseSettingsBrokersAdoptsFrom, mi as RecordKindDeclarationSchema, ra as parseSettingsArrayAdoptsFrom, ri as NoCallerError, x as DATABASE_SNAPSHOT_TIMEOUT_MS, xi as UnknownRecordKindError, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, yt as bareAddonId, zt as databaseSnapshotCapability } from "../../dist-7ZciHCIp.mjs";
 import { i as retiredKeyStoreOf, n as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Bhwe4ymb.mjs";
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-BNIaf3QP.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, S as trustResult, T as callData, _ as collectTransferables, a as WalMaintenance, c as vectorProviderOfOwnedFile, d as CrossDatabaseTransactError, f as DatabaseBusyError, l as SqliteSettingsBackend, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callControl } from "../../wal-maintenance-Df89xxrK.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/location-class-paths.d.ts

@@ -0,0 +1,13 @@
+/** Class → top-level directories directly under the root (no camera segment). */
+export declare const STORAGE_CLASS_ROOT_SUBTREES: Readonly<Record<string, readonly string[]>>;
+/**
+* - `own`     — at or under the class subtree: copy it, delete it.
+* - `descend` — an ancestor of the subtree (the camera directory): walk into
+*               it, but it is not itself a file to move.
+* - `foreign` — another class's data: never read, never copied, never deleted.
+*/
+export type PathVerdict = "own" | "descend" | "foreign";
+/** Does this class own only part of its root? */
+export declare function isSubtreeScoped(type: string): boolean;
+/** Classify a root-relative path (`/` separators) for a location of `type`. */
+export declare function classifyPath(type: string, relativePath: string): PathVerdict;

package/dist/builtins/storage-orchestrator/location-repoint-move.d.ts

@@ -28,6 +28,7 @@
 * I/O is injected: the walk and the ordering are what matter and they are
 * testable without a filesystem.
 */
+import type { PathVerdict } from "./location-class-paths.js";
 /** The four operations a move needs, in the caller's own terms. */
 export interface RepointMoveIo {
 	/** Entries directly under `prefix` (undefined = the root), as relative paths. */
@@ -45,8 +46,12 @@ export interface RepointMoveResult {
 	readonly files: number;
 	readonly bytes: number;
 }
+/** Decides, per root-relative path, whether it belongs to the moving location. */
+export type RepointScope = (relativePath: string) => PathVerdict;
+/** The whole root — only correct for a class that owns all of it. */
+export declare const WHOLE_ROOT: RepointScope;
 /**
 * Copy every file from the source root to the destination, verify each, then
 * delete the originals. Throws with NOTHING deleted if any copy fails.
 */
-export declare function moveLocationTree(io: RepointMoveIo): Promise<RepointMoveResult>;
+export declare function moveLocationTree(io: RepointMoveIo, scope?: RepointScope): Promise<RepointMoveResult>;

package/dist/builtins/storage-orchestrator/location-repointer.d.ts

@@ -0,0 +1,97 @@
+/**
+* Re-pointing a SINGLE location, as one guarded operation.
+*
+* ## What went wrong (2026-10-20, ~8.6k event-media files lost)
+*
+* `homekitClips:default` shared `/recordings/recordings` with
+* `eventMedia:default`. Repointing it ran a tree move over the WHOLE shared root
+* and deleted the originals — every camera's `<cam>/events` included — while a
+* `pipelineAnalytics.relocateMedia` job of the other location was moving the very
+* same files. Nothing arbitrated between the two writers of one disk.
+*
+* ## The two rules
+*
+* 1. **Scope** — a repoint copies and deletes only its class's own subtree
+*    ({@link classifyPath}, D327). A foreign file is never even read.
+* 2. **One claim per physical root, owned here.** A repoint holds a claim on the
+*    realpath of the root it reads and the root it writes. It starts only when no
+*    mover (`relocateMedia`, `relocateFootage`, a migration drain) touches an
+*    overlapping root, and a mover asks {@link clearance} before it runs and
+*    refuses while a repoint holds the root. No timers and no retries (D3): the
+*    answer is "now" and a refusal is typed.
+*
+* ## Why it cannot race
+*
+* Both sides ANNOUNCE first, then look: the repoint takes its claim and then
+* lists the movers; a mover registers its job (so it appears in the list) and
+* then asks {@link clearance}. Whichever announces second sees the other. The
+* mover list is read fail-CLOSED here: this is the destructive side, and an
+* unreadable list is not "no movers" (the opposite of D49's rule for a one-shot
+* event, which this is not — a refusal costs the operator one retry).
+*
+* The claim is in memory and dies with the process. A crash in the middle of a
+* repoint leaves the bytes in the old root or a verified copy in the new one (see
+* `location-repoint-move.ts`), never a stale lock.
+*/
+import type { IScopedLogger, StorageLocation, StorageMigrationMover } from "@camstack/types";
+import { type RepointMoveIo } from "./location-repoint-move.js";
+/** Why a repoint, or a mover, was turned away. Typed so callers can branch. */
+export type RepointRefusalReason = "mover-active" | "repoint-active" | "movers-unreadable";
+export declare class RepointRefusedError extends Error {
+	readonly reason: RepointRefusalReason;
+	override readonly name = "RepointRefusedError";
+	constructor(reason: RepointRefusalReason, message: string);
+}
+/** The answer a mover gets before it touches a root. */
+export type RootClearance = {
+	readonly clear: true;
+} | {
+	readonly clear: false;
+	readonly reason: "repoint-active";
+	/** The location whose repoint holds the root. */
+	readonly repointLocationId: string;
+};
+/** The row fields a repoint reads — `next` is the incoming upsert, not a stored row. */
+export interface RepointTarget {
+	readonly id: string;
+	readonly type: string;
+	readonly config: Readonly<Record<string, unknown>>;
+}
+export interface LocationRepointerDeps {
+	readonly logger: IScopedLogger;
+	/** The physical key of a path (realpath, or the resolved path when it does not exist yet). */
+	readonly resolveKey: (basePath: string) => Promise<string>;
+	/** The CURRENT basePath of a stored location, or null when it has none / is unknown. */
+	readonly locationBasePath: (locationId: string) => string | null;
+	readonly locationIdsOfType: (type: string) => readonly string[];
+	/** Every mover in both lanes. A throw refuses the repoint. */
+	readonly listMovers: () => Promise<readonly StorageMigrationMover[]>;
+	/** I/O over the source (stored) and destination (next) roots. */
+	readonly ioFor: (stored: StorageLocation, next: RepointTarget) => Promise<RepointMoveIo>;
+}
+/** Does `a` equal `b`, or sit inside it, or contain it? Segment-wise, never by raw prefix. */
+export declare function rootsOverlap(a: string, b: string): boolean;
+export declare class LocationRepointer {
+	private readonly deps;
+	private readonly claims;
+	constructor(deps: LocationRepointerDeps);
+	/**
+	* Move `stored`'s own subtree to `next`'s root, then run `commit` (the row
+	* save) while the claim is still held. Throws {@link RepointRefusedError}
+	* with NOTHING copied or deleted when a mover is on the root.
+	*/
+	run<T>(stored: StorageLocation, next: RepointTarget, commit: () => T | Promise<T>): Promise<T>;
+	/**
+	* May a mover that touches `locationIds` run? Refuses while a repoint holds
+	* an overlapping root. Called by the owning addon AFTER its job is
+	* registered, so the repoint's mover listing and this check cannot both miss.
+	*/
+	clearance(locationIds: readonly string[]): Promise<RootClearance>;
+	private claim;
+	private refuseWhileMovers;
+	private locationsTouchedBy;
+	/** `*` is the media mover's "from wherever the rows are": every eventMedia location. */
+	private keysOf;
+	private refuse;
+	private logMoved;
+}

package/dist/builtins/storage-orchestrator/location-store.d.ts

@@ -8,7 +8,7 @@
 * pattern as `IntegrationRegistry` in `sqlite-storage/`.
 */
 import type { ISettingsStoreProvider, LegacyStorageLocationDefault, RecordKindHandle, RecordsAccess, StorageLocation } from "@camstack/types";
-import { type StorageLocationBody } from "./record-kinds.js";
+import { type StorageLocationBody, type StorageSeedMarkerBody } from "./record-kinds.js";
 /**
 * A location as it comes back OFF DISK: the live record plus the retired
 * `isDefault` column, which exists only so the orchestrator's boot migration
@@ -31,6 +31,13 @@ export interface ILocationStore {
 	upsert(loc: StorageLocation): Promise<void>;
 	/** Remove a location by id. */
 	delete(id: string): Promise<void>;
+	/**
+	* The location types a default was ever seeded for (or that already existed
+	* when this memory began). Absent on a store that cannot remember — such a
+	* store seeds on "type has no row", as before.
+	*/
+	loadSeededTypes?(): Promise<readonly string[]>;
+	markTypeSeeded?(type: string): Promise<void>;
 }
 /**
 * @durable class=config owner=storage-orchestrator
@@ -49,7 +56,11 @@ export declare class SqliteLocationStore implements ILocationStore {
 	private readonly store;
 	private declared;
 	private readonly locationsKind;
-	constructor(store: ISettingsStoreProvider, locationsKind?: RecordKindHandle<StorageLocationBody> | null);
+	constructor(store: ISettingsStoreProvider, locationsKind?: RecordKindHandle<StorageLocationBody> | null, seedMarkersKind?: RecordKindHandle<StorageSeedMarkerBody> | null);
+	private readonly seedMarkersKind;
+	static seedMarkersOf(records: Pick<RecordsAccess, "kind">): RecordKindHandle<StorageSeedMarkerBody>;
+	loadSeededTypes(): Promise<readonly string[]>;
+	markTypeSeeded(type: string): Promise<void>;
 	static recordStoresOf(records: Pick<RecordsAccess, "kind">): RecordKindHandle<StorageLocationBody>;
 	/**
 	* Lazy `declareCollection` — keeps the constructor cheap and async-free.

package/dist/builtins/storage-orchestrator/record-kinds.d.ts

@@ -18,6 +18,10 @@ export type StorageLocationBody = {
 	readonly isDefault?: boolean;
 };
 export declare const StorageLocationBodySchema: z.ZodType<StorageLocationBody>;
+export type StorageSeedMarkerBody = {
+	readonly seededAt: number;
+};
+export declare const StorageSeedMarkerBodySchema: z.ZodType<StorageSeedMarkerBody>;
 export type StorageDrainStateBody = {
 	readonly locationId: string;
 	readonly startedAtMs: number;
@@ -31,6 +35,7 @@ export type StorageDrainStateBody = {
 export declare const StorageDrainStateBodySchema: z.ZodType<StorageDrainStateBody>;
 export type StorageOrchestratorRecordKindsMap = {
 	readonly locations: DefinedRecordKind<z.ZodType<StorageLocationBody>>;
+	readonly "seed-markers": DefinedRecordKind<z.ZodType<StorageSeedMarkerBody>>;
 	readonly "drain-state": DefinedRecordKind<z.ZodType<StorageDrainStateBody>>;
 };
 export declare const storageOrchestratorRecordKinds: StorageOrchestratorRecordKindsMap;

package/dist/builtins/storage-orchestrator/storage-location-band-monitor.d.ts

@@ -1,9 +1,28 @@
 /**
 * StorageLocationBandMonitor — free-space bands for Notification Center.
 *
-* Capacity that failed to measure is `null` and becomes CRITICAL (D393) —
-* never folded into 0% or 100%. Disabled / non-managed locations are absent
-* from the sweep input and clear any open episode without an `ok` event.
+* Two rules, picked per sample:
+*
+* - UNMANAGED (no `floorPercent`): the fixed percentage bands (low <= 15 %,
+*   critical <= 5 %), now with hysteresis so a value hovering at an edge
+*   emits ONE edge.
+* - MANAGED BY EVICTION (`floorPercent` = the free-space floor the evictor
+*   holds): sitting AT the floor is the evictor doing its job, not an
+*   incident. A recordings volume kept at 150 GB free of 3.7 TB is ~4 % free
+*   for ever; the fixed 5 % critical bar flapped it low <-> critical every few
+*   minutes. Bands are relative to the floor instead:
+*     - `low`: free below 80 % of the floor for the whole grace window
+*       (the evictor is falling behind). Exit at 90 %.
+*     - `critical`: free below 50 % of the floor, no grace (writes are about to
+*       fail; the evictor is losing). Exit at 60 %.
+*   "Half the floor" was chosen over an absolute byte minimum because it scales
+*   with the operator's own setting and needs no second knob; it is far above
+*   the few MB a segment needs, so it fires before writes fail.
+*
+* A measurement that FAILED (`freePercent === null`) never changes the band and
+* never opens an episode (D393): "could not read" is not evidence about space.
+* Disabled / non-managed locations are absent from the sweep input and clear
+* any open episode without an `ok` event.
 *
 * Pure, injected clock, one transition per band change.
 */
@@ -21,6 +40,12 @@ export interface StorageLocationBandSample {
 	readonly locationName?: string;
 	/** Free percent, or `null` when the probe failed. */
 	readonly freePercent: number | null;
+	/** Free-space floor (percent) an evictor holds this location at; absent when
+	*  the location is not managed by eviction. */
+	readonly floorPercent?: number;
+	/** Absolute figures, carried only so an edge can be logged with them. */
+	readonly freeBytes?: number;
+	readonly floorBytes?: number;
 }
 export interface StorageLocationBandEvent {
 	readonly locationId: string;
@@ -28,13 +53,22 @@ export interface StorageLocationBandEvent {
 	readonly locationName?: string;
 	readonly band: StorageLocationBand;
 	readonly freePercent: number | null;
+	readonly floorPercent?: number;
+	readonly freeBytes?: number;
+	readonly floorBytes?: number;
 	readonly reason: string;
 	readonly previous: StorageLocationBand | null;
 }
+/** How long the evictor may sit below the low margin before it counts as behind. */
+export declare const MANAGED_LOW_GRACE_MS: number;
 export declare class StorageLocationBandMonitor {
 	private readonly config;
+	private readonly now;
 	private readonly band;
-	constructor(config?: StorageLocationBandConfig);
+	/** When free first went under `lowEnter` and has stayed there. */
+	private readonly belowLowSince;
+	constructor(config?: StorageLocationBandConfig, now?: () => number);
+	private nextBand;
 	/**
 	* Observe one sweep of managed locations. Locations missing from `samples`
 	* drop their episode without emitting `ok` (disabled / removed).

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.d.ts

@@ -3,6 +3,7 @@ import { BaseAddon } from "@camstack/types";
 interface StorageOrchestratorConfig extends Record<string, unknown> {}
 export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestratorConfig> {
 	private locationsKind;
+	private seedMarkersKind;
 	private drainStateKind;
 	private service;
 	private pressureManager;
@@ -19,6 +20,8 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
 	private pressureTimer;
 	private pressureSweepInFlight;
 	private migration;
+	/** Guards every single-location repoint and arbitrates movers per physical root. */
+	private repointer;
 	/**
 	* Cached `providerId → nodeLocal` snapshot (SP1). Backs the orchestrator's
 	* synchronous `NodeLocalResolver` — `getProviderInfo()` is async, so we
@@ -98,13 +101,15 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
 	* restart — the service never hydrates from / persists to SQLite.
 	*/
 	private storeWireInFlight;
+	/** True while the locations kind is empty and its legacy table still holds rows. */
+	private adoptionIsPending;
 	private ensureStoreWired;
 	private storageProviders;
 	/** Single-flighted pressure sweep — never overlaps a slow eviction round. */
 	private runPressureSweep;
 	/**
 	* Sample free space for every managed location and emit NC band edges.
-	* A failed capacity read stays `null` (critical) — never folded to 0 (D393).
+	* A failed capacity read stays `null` and changes no band — never folded to 0 (D393).
 	*/
 	private emitLocationBandEvents;
 	/**
@@ -153,7 +158,8 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
 	* A no-op for everything else — a rename, a mode change, a `multi` kind, or a
 	* location being created for the first time.
 	*/
-	private carryDataOnRepoint;
+	private upsertCarryingData;
+	private requireRepointer;
 	private secretKeysFor;
 	/**
 	* Ring the doorbell: the SET of storage locations changed (D387).