@camstack/system 1.2.470 → 1.2.472

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DRL3rEfN.js");
+const require_dist = require("../../dist-DX5Fu3mV.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_composition_sources = require("../../composition-sources-CRJffEiB.js");
+const require_composition_sources = require("../../composition-sources-D3h-tNoJ.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 let zod = require("zod");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,6 +1,6 @@
-import { $r as errMsg, Bt as coreBlockComposition, Ht as coreBlockSourceKind, Ki as defineRecordKinds, Kn as normalizeCoreBlockWrite, Kr as compositionSourceKey, Mr as validateComposition, N as DeclaredDevices, Ot as buildCapabilityLookup, Qi as hydrateSchema, Qn as planComposition, Rt as compositionSourceRefs, Ut as coreBlocksCapability, Vi as collectSecretMarkerRefs, Vr as composedDeviceRef, Vt as coreBlockIdFromAddonId, Zt as describeComposableCaps, _a as resolveSecretMarkers, aa as isSecretRefOwnedBy, ar as replacedFieldKeys, ba as secretTreeFromSchema, cr as resolveCoreBlockEntry, ei as BaseAddon, f as COMPOSER_RUNNER_ID, lr as resolveCoreBlockFiles, m as CORE_BLOCK_ADDON_PREFIX, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretMarker, v as CoreBlockSchema, wa as transformSecretWrite, zt as coreBlockAddonId } from "../../dist-X1r44BdF.mjs";
+import { $r as errMsg, Bt as coreBlockComposition, Ht as coreBlockSourceKind, Ki as defineRecordKinds, Kn as normalizeCoreBlockWrite, Kr as compositionSourceKey, Mr as validateComposition, N as DeclaredDevices, Ot as buildCapabilityLookup, Qi as hydrateSchema, Qn as planComposition, Rt as compositionSourceRefs, Ut as coreBlocksCapability, Vi as collectSecretMarkerRefs, Vr as composedDeviceRef, Vt as coreBlockIdFromAddonId, Zt as describeComposableCaps, _a as resolveSecretMarkers, aa as isSecretRefOwnedBy, ar as replacedFieldKeys, ba as secretTreeFromSchema, cr as resolveCoreBlockEntry, ei as BaseAddon, f as COMPOSER_RUNNER_ID, lr as resolveCoreBlockFiles, m as CORE_BLOCK_ADDON_PREFIX, p as CORE_BLOCKS_ADDON_ID, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretMarker, v as CoreBlockSchema, wa as transformSecretWrite, zt as coreBlockAddonId } from "../../dist-CdFkkmXW.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-B0tqvf0t.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-BY6rFuAE.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { n as unwrapStoredValue, t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/device-history/device-history.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DRL3rEfN.js");
+const require_dist = require("../../dist-DX5Fu3mV.js");
 //#region src/builtins/device-history/time/bucket-time.ts
 /**
 * Bucket arithmetic for the three rollup tiers (D850, plan §4/§5.5).

package/dist/builtins/device-history/device-history.addon.mjs

@@ -1,4 +1,4 @@
-import { B as HISTORY_ITEM_CATALOG, Ct as armRemovalReconcile, D as DEVICE_HISTORY_ENERGY_KEY, Da as EventCategory, Ji as emitReadiness, Qr as DeviceType, Zi as historyItemFieldPath, ei as BaseAddon, en as deviceHistoryCapability, li as HISTORY_DEFAULT_MIN_INTERVAL_MS, nn as deviceRemovalHookCapability, z as HISTORY_CATALOG } from "../../dist-X1r44BdF.mjs";
+import { B as HISTORY_ITEM_CATALOG, Ct as armRemovalReconcile, D as DEVICE_HISTORY_ENERGY_KEY, Da as EventCategory, Ji as emitReadiness, Qr as DeviceType, Zi as historyItemFieldPath, ei as BaseAddon, en as deviceHistoryCapability, li as HISTORY_DEFAULT_MIN_INTERVAL_MS, nn as deviceRemovalHookCapability, z as HISTORY_CATALOG } from "../../dist-CdFkkmXW.mjs";
 //#region src/builtins/device-history/time/bucket-time.ts
 /**
 * Bucket arithmetic for the three rollup tiers (D850, plan §4/§5.5).

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DRL3rEfN.js");
+const require_dist = require("../../dist-DX5Fu3mV.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $i as isDeviceConfigCap, $r as errMsg, $t as deviceExtensionCapability, Ca as toSecretFieldView, Da as EventCategory, Di as SECRET_CLEAR, F as DeviceTombstoneSchema, Hi as collectZodSecretPaths, In as locationIconKey, Ki as defineRecordKinds, L as FieldClaimModeSchema, Mi as WELL_KNOWN_TAB_MAP, Mn as legacyAutoLinkIds, P as DeviceStatusSchema, Pt as canonicalIconKey, Qr as DeviceType, R as FieldClaimSchema, Ta as userError, Wt as createDeviceExtensionProvider, Xn as parseStreamParamsFormPatch, Xr as DeviceFeature, Y as MINUTES_PER_DAY, Yt as defineExtensionSlotProvider, Zr as DeviceRole, _a as resolveSecretMarkers, br as siteZoneKey, ei as BaseAddon, gn as formatMinutes, ia as isSecretMarkerLike, in as deviceStatusCapability, jt as buildStreamParamsConfigSchema, l as CAP_NAMES_WITH_STATUS, mr as runtimeStatePolicyFor, na as isSecretClear, on as enumerateItemArrayFields, ot as STREAM_PROFILE_META, qn as normalizeUnit, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretMarker, rn as deviceStateCapability, s as CAMERA_SWITCH_ORDER, sn as enumerateSchemaFields, ta as isKeychainStoredField, tn as deviceManagerCapability, un as expandContainer, w as DAY_NAMES, wa as transformSecretWrite, xa as sleep$1, ya as secretTreeFromPaths } from "../../dist-X1r44BdF.mjs";
+import { $i as isDeviceConfigCap, $r as errMsg, $t as deviceExtensionCapability, Ca as toSecretFieldView, Da as EventCategory, Di as SECRET_CLEAR, F as DeviceTombstoneSchema, Hi as collectZodSecretPaths, In as locationIconKey, Ki as defineRecordKinds, L as FieldClaimModeSchema, Mi as WELL_KNOWN_TAB_MAP, Mn as legacyAutoLinkIds, P as DeviceStatusSchema, Pt as canonicalIconKey, Qr as DeviceType, R as FieldClaimSchema, Ta as userError, Wt as createDeviceExtensionProvider, Xn as parseStreamParamsFormPatch, Xr as DeviceFeature, Y as MINUTES_PER_DAY, Yt as defineExtensionSlotProvider, Zr as DeviceRole, _a as resolveSecretMarkers, br as siteZoneKey, ei as BaseAddon, gn as formatMinutes, ia as isSecretMarkerLike, in as deviceStatusCapability, jt as buildStreamParamsConfigSchema, l as CAP_NAMES_WITH_STATUS, mr as runtimeStatePolicyFor, na as isSecretClear, on as enumerateItemArrayFields, ot as STREAM_PROFILE_META, qn as normalizeUnit, r as ALL_CAPABILITY_DEFINITIONS, ra as isSecretMarker, rn as deviceStateCapability, s as CAMERA_SWITCH_ORDER, sn as enumerateSchemaFields, ta as isKeychainStoredField, tn as deviceManagerCapability, un as expandContainer, w as DAY_NAMES, wa as transformSecretWrite, xa as sleep$1, ya as secretTreeFromPaths } from "../../dist-CdFkkmXW.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DRL3rEfN.js");
+const require_dist = require("../../dist-DX5Fu3mV.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-X1r44BdF.mjs";
+import { Ln as logDestinationCapability, ei as BaseAddon } from "../../dist-CdFkkmXW.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DRL3rEfN.js");
-const require_device_ca = require("../../device-ca-R4MZZtc0.js");
+const require_dist = require("../../dist-DX5Fu3mV.js");
+const require_device_ca = require("../../device-ca-CfiIg3a9.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_constants = require("../../constants-WF1AqoKF.js");
+const require_constants = require("../../constants-CqbO6e9i.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,7 +1,7 @@
-import { An as keychainAdminCapability, Da as EventCategory, G as KeychainResetRecordSchema, Ki as defineRecordKinds, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Xi as formatSecretScope, ei as BaseAddon, jn as keychainCapability, pa as parseSecretRef, ua as normalizeSecretOwner } from "../../dist-X1r44BdF.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-DYmToMp8.mjs";
+import { An as keychainAdminCapability, Da as EventCategory, G as KeychainResetRecordSchema, Ki as defineRecordKinds, U as KEYCHAIN_RESET_TRIGGER_ACTOR, W as KeychainAuditEntrySchema, Xi as formatSecretScope, ei as BaseAddon, jn as keychainCapability, pa as parseSecretRef, ua as normalizeSecretOwner } from "../../dist-CdFkkmXW.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BWTWWBcc.mjs";
 import { t as require_read_all_rows } from "../../read-all-rows-TaPqdWNF.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants--A505iuO.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-zBiEodEM.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.d.ts

@@ -1,24 +1,3 @@
-/**
-* liveness-monitor — the node states, out loud, when it has stopped working.
-*
-* On 2026-08-03 the hub ran for four hours with zero devices, zero published
-* streams and zero recordings. Three separate defects caused it, each silent at
-* the point of failure, and the operator found out by opening the viewer. Every
-* one of those defects has since been fixed and given a log line — but a log
-* line per known bug does not cover the next one. This addon covers the class:
-* it asserts what must be true of a working node and reports when it is not.
-*
-* It emits `SystemLivenessFailed` / `SystemLivenessRecovered` on the event bus
-* with a STABLE finding id, exactly like the kernel's addon-health monitor, so
-* AlertCenter raises one persistent alert per fault and dismisses it on
-* recovery instead of producing a stream of them. The same lines go to the log
-* at ERROR, which is what makes them alertable in Loki.
-*
-* Deliberately hub-only and deliberately read-only: it observes through
-* `ctx.api` and changes nothing. A monitor that can act is a monitor that can
-* cause the outage it was meant to report — this repo has already stopped a
-* hub that way once (the remedial-action watcher, 2026-07-30).
-*/
 import { BaseAddon, type ProviderRegistration } from "@camstack/types";
 import { type LivenessFinding } from "./liveness-checks.js";
 interface LivenessMonitorConfig extends Record<string, unknown> {
@@ -27,8 +6,9 @@ interface LivenessMonitorConfig extends Record<string, unknown> {
 export declare class LivenessMonitorAddon extends BaseAddon<LivenessMonitorConfig> {
 	private tickTimer;
 	private startedAtMs;
-	/** Finding ids currently reported, so recovery can be detected and announced. */
-	private active;
+	private reporter;
+	/** Roots whose writability could not be read, already said once. */
+	private readonly unknownRootsSaid;
 	constructor();
 	protected onInitialize(): Promise<ProviderRegistration[]>;
 	protected onShutdown(): Promise<void>;
@@ -56,7 +36,11 @@ export declare class LivenessMonitorAddon extends BaseAddon<LivenessMonitorConfi
 	* names it, per camera (D393, and CLAUDE.md's logging rule).
 	*/
 	private unreadable;
-	/** Announce new faults and recoveries; say nothing about an unchanged fault. */
-	private report;
+	/**
+	* Every storage root this node writes to must be writable BY THIS PROCESS.
+	* Reported through the same finding path (one ERROR, one alert, a recovery
+	* when it is fixed). Never throws: an unreadable list is said and skipped.
+	*/
+	checkStorageRoots(): Promise<readonly LivenessFinding[]>;
 }
 export {};

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DRL3rEfN.js");
+const require_chunk = require("../../chunk-Cek0wNdY.js");
+const require_dist = require("../../dist-DX5Fu3mV.js");
+let node_fs_promises = require("node:fs/promises");
+node_fs_promises = require_chunk.__toESM(node_fs_promises);
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
+let node_fs = require("node:fs");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";
@@ -52,6 +57,198 @@ function isLivenessFindingId(id) {
 	return id === NO_DEVICES || id === ALL_OFFLINE || id.startsWith(NO_FOOTAGE_PREFIX);
 }
 //#endregion
+//#region src/builtins/liveness-monitor/liveness-reporter.ts
+/**
+* Announce new liveness faults and their recoveries — never an unchanged fault.
+*
+* One ERROR line and one `SystemLivenessFailed` event per NEW finding id (the
+* alert centre turns it into one persistent alert), one INFO line and one
+* `SystemLivenessRecovered` when it is gone. Several families of checks run on
+* different cadences (the device checks wait out the boot grace, the storage
+* check does not), so a recovery is judged only within the family that was
+* just evaluated: a storage check that found nothing must not "recover" a
+* device finding it never looked at.
+*/
+/** Event source stamped on every emission — the addon that observed it. */
+var LIVENESS_SOURCE = {
+	type: "addon",
+	id: "liveness-monitor"
+};
+var LivenessReporter = class {
+	deps;
+	/** Finding ids currently reported, so recovery can be detected and announced. */
+	active = /* @__PURE__ */ new Set();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* @param findings what the family found this evaluation
+	* @param inFamily which ids the family owns — only those can recover here
+	*/
+	report(findings, inFamily) {
+		const current = new Set(findings.map((f) => f.id));
+		for (const finding of findings) {
+			if (this.active.has(finding.id)) continue;
+			this.active.add(finding.id);
+			this.deps.logger.error(`liveness: ${finding.title} — ${finding.message}`, {
+				...finding.deviceId !== void 0 ? { tags: { deviceId: finding.deviceId } } : {},
+				meta: {
+					findingId: finding.id,
+					severity: finding.severity
+				}
+			});
+			this.deps.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessFailed, LIVENESS_SOURCE, {
+				findingId: finding.id,
+				severity: finding.severity,
+				title: finding.title,
+				message: finding.message,
+				...finding.deviceId !== void 0 ? { deviceId: finding.deviceId } : {},
+				...finding.deviceName !== void 0 ? { name: finding.deviceName } : {}
+			}));
+		}
+		for (const id of [...this.active]) {
+			if (current.has(id) || !inFamily(id)) continue;
+			this.active.delete(id);
+			this.deps.logger.info(`liveness: recovered — ${id}`, { meta: { findingId: id } });
+			this.deps.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessRecovered, LIVENESS_SOURCE, { findingId: id }));
+		}
+	}
+};
+//#endregion
+//#region src/builtins/liveness-monitor/storage-root-access.ts
+/**
+* Can this node WRITE where its storage locations say media goes?
+*
+* 2026-10-23, a fresh install of the dev hub: the bind mounted at
+* `/recordings` was `root:root 0755` while the hub runs as uid 1001. Nothing
+* said so at boot; the first sign was an `EACCES` on `/recordings/artifacts`,
+* and recordings would have failed one write at a time. A root the process
+* cannot write is a fact known the moment the node starts, so it is reported
+* then — once, naming the path, its owner, its mode and the uid — instead of
+* as a stream of per-write errors.
+*
+* Only a location this node may WRITE (`mayWriteToLocation`), served by the
+* local filesystem provider, on this node, with an absolute `basePath`, is
+* judged. A root that does not exist yet is judged by its nearest existing
+* ancestor: that is the directory the node would have to create it in.
+*
+* A probe that cannot answer (a stat that fails for a reason other than
+* permission) is `unknown` and never a finding (D393): an unreadable fact is
+* not an unwritable disk.
+*/
+/** The local filesystem storage provider's id (`FilesystemStorageProvider.providerId`). */
+var FILESYSTEM_PROVIDER_ID = "filesystem-storage";
+var UNWRITABLE_PREFIX = "liveness:storage-root-unwritable:";
+/** The hub-local, writable filesystem roots among `locations`, deduplicated by path. */
+function storageRootTargets(locations, localNodeId) {
+	const byPath = /* @__PURE__ */ new Map();
+	for (const location of locations) {
+		if (location.providerId !== FILESYSTEM_PROVIDER_ID) continue;
+		if (location.nodeId !== void 0 && location.nodeId !== localNodeId) continue;
+		if (!require_dist.mayWriteToLocation(location)) continue;
+		const basePath = location.config["basePath"];
+		if (typeof basePath !== "string" || !node_path.default.isAbsolute(basePath)) continue;
+		const root = node_path.default.resolve(basePath);
+		byPath.set(root, [...byPath.get(root) ?? [], location.id]);
+	}
+	return [...byPath.entries()].map(([root, locationIds]) => ({
+		path: root,
+		locationIds: locationIds.toSorted()
+	})).toSorted((a, b) => a.path.localeCompare(b.path));
+}
+function isMissing(err) {
+	return err instanceof Error && "code" in err && (err.code === "ENOENT" || err.code === "ENOTDIR");
+}
+/** Probe one root: the root itself, or the nearest ancestor that exists. */
+async function probeStorageRoot(target, probe) {
+	let dir = target.path;
+	let stat;
+	for (;;) try {
+		stat = await probe.stat(dir);
+		break;
+	} catch (err) {
+		const parent = node_path.default.dirname(dir);
+		if (!isMissing(err) || parent === dir) return {
+			kind: "unknown",
+			target,
+			reason: `stat ${dir} failed: ${require_dist.errMsg(err)}`
+		};
+		dir = parent;
+	}
+	try {
+		await probe.canWrite(dir);
+		return {
+			kind: "writable",
+			target
+		};
+	} catch (err) {
+		return {
+			kind: "unwritable",
+			target,
+			blockedAt: dir,
+			stat,
+			reason: require_dist.errMsg(err)
+		};
+	}
+}
+function octalMode(mode) {
+	return (mode & 4095).toString(8).padStart(4, "0");
+}
+function processIdentity(probe) {
+	if (probe.processUid === null) return "this process";
+	return `uid ${String(probe.processUid)}` + (probe.processGid === null ? "" : ` (gid ${String(probe.processGid)})`);
+}
+/**
+* One finding per DIRECTORY that refused — several roots under one unwritable
+* mount (`/recordings` holding recordings, event media and artifacts) are one
+* cause and one alert. Stable id = that directory.
+*/
+function storageRootFindings(results, probe) {
+	const byBlocked = /* @__PURE__ */ new Map();
+	for (const result of results) {
+		if (result.kind !== "unwritable") continue;
+		const entry = byBlocked.get(result.blockedAt) ?? {
+			stat: result.stat,
+			roots: [],
+			locationIds: []
+		};
+		entry.roots.push(result.target.path);
+		entry.locationIds.push(...result.target.locationIds);
+		byBlocked.set(result.blockedAt, entry);
+	}
+	const uidFix = probe.processUid === null ? "<uid>" : String(probe.processUid);
+	const gidFix = probe.processGid === null ? "<gid>" : String(probe.processGid);
+	return [...byBlocked.entries()].toSorted(([a], [b]) => a.localeCompare(b)).map(([blockedAt, { stat, roots, locationIds }]) => {
+		const missing = roots.filter((r) => r !== blockedAt);
+		const below = missing.length > 0 ? ` (${missing.join(", ")} must be created inside it)` : "";
+		return {
+			id: `${UNWRITABLE_PREFIX}${blockedAt}`,
+			severity: "error",
+			title: "Storage location not writable",
+			message: `${blockedAt} is owned by ${String(stat.uid)}:${String(stat.gid)} with mode ${octalMode(stat.mode)}, and CamStack runs as ${processIdentity(probe)} — nothing can be written there${below}. Locations affected: ${locationIds.toSorted().join(", ")}. Fix the ownership on the host, e.g. chown -R ${uidFix}:${gidFix} <the host directory bound at ${blockedAt}>.`
+		};
+	});
+}
+function isStorageRootFindingId(id) {
+	return id.startsWith(UNWRITABLE_PREFIX);
+}
+/** The real probe: `fs.access(W_OK | X_OK)` as THIS process, and `fs.stat`. */
+function nodeStorageRootProbe(fs) {
+	return {
+		canWrite: (dir) => fs.access(dir, node_fs.constants.W_OK | node_fs.constants.X_OK),
+		stat: async (dir) => {
+			const st = await fs.stat(dir);
+			return {
+				uid: st.uid,
+				gid: st.gid,
+				mode: st.mode
+			};
+		},
+		processUid: typeof process.getuid === "function" ? process.getuid() : null,
+		processGid: typeof process.getgid === "function" ? process.getgid() : null
+	};
+}
+//#endregion
 //#region src/builtins/liveness-monitor/liveness-monitor.addon.ts
 /**
 * liveness-monitor — the node states, out loud, when it has stopped working.
@@ -74,11 +271,8 @@ function isLivenessFindingId(id) {
 * cause the outage it was meant to report — this repo has already stopped a
 * hub that way once (the remedial-action watcher, 2026-07-30).
 */
-/** Event source stamped on every emission — the addon that observed it. */
-var LIVENESS_SOURCE = {
-	type: "addon",
-	id: "liveness-monitor"
-};
+/** The node this monitor runs on (it is hub-only). */
+var HUB_NODE_ID = "hub";
 /** How often the invariants are checked. */
 var TICK_INTERVAL_MS = 5 * 6e4;
 /**
@@ -101,13 +295,19 @@ var RECORDING_LOOKBACK_MS = 1440 * 6e4;
 var LivenessMonitorAddon = class extends require_dist.BaseAddon {
 	tickTimer = null;
 	startedAtMs = 0;
-	/** Finding ids currently reported, so recovery can be detected and announced. */
-	active = /* @__PURE__ */ new Set();
+	reporter = null;
+	/** Roots whose writability could not be read, already said once. */
+	unknownRootsSaid = /* @__PURE__ */ new Set();
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
 		this.startedAtMs = Date.now();
+		this.reporter = new LivenessReporter({
+			logger: this.ctx.logger,
+			emit: (event) => this.ctx.eventBus.emit(event)
+		});
+		this.checkStorageRoots();
 		this.tickTimer = setInterval(() => {
 			this.tick();
 		}, TICK_INTERVAL_MS);
@@ -127,11 +327,12 @@ var LivenessMonitorAddon = class extends require_dist.BaseAddon {
 	* without waiting out the interval.
 	*/
 	async tick() {
-		if (Date.now() - this.startedAtMs < BOOT_GRACE_MS) return [];
+		const storage = await this.checkStorageRoots();
+		if (Date.now() - this.startedAtMs < BOOT_GRACE_MS) return storage;
 		try {
 			const findings = evaluateLiveness(await this.gather());
-			this.report(findings);
-			return findings;
+			this.reporter?.report(findings, isLivenessFindingId);
+			return [...storage, ...findings];
 		} catch (err) {
 			this.ctx.logger.error("liveness-monitor: check failed — node health is UNKNOWN this tick", { meta: { error: require_dist.errMsg(err) } });
 			return [];
@@ -206,33 +407,33 @@ var LivenessMonitorAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.warn(`liveness: recording availability was unreadable (${window}) — this camera is not judged this tick`, { tags: { deviceId } });
 		return null;
 	}
-	/** Announce new faults and recoveries; say nothing about an unchanged fault. */
-	report(findings) {
-		const current = new Set(findings.map((f) => f.id));
-		for (const finding of findings) {
-			if (this.active.has(finding.id)) continue;
-			this.active.add(finding.id);
-			this.ctx.logger.error(`liveness: ${finding.title} — ${finding.message}`, {
-				...finding.deviceId !== void 0 ? { tags: { deviceId: finding.deviceId } } : {},
-				meta: {
-					findingId: finding.id,
-					severity: finding.severity
-				}
-			});
-			this.ctx.eventBus.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessFailed, LIVENESS_SOURCE, {
-				findingId: finding.id,
-				severity: finding.severity,
-				title: finding.title,
-				message: finding.message,
-				...finding.deviceId !== void 0 ? { deviceId: finding.deviceId } : {},
-				...finding.deviceName !== void 0 ? { name: finding.deviceName } : {}
-			}));
-		}
-		for (const id of [...this.active]) {
-			if (current.has(id)) continue;
-			this.active.delete(id);
-			this.ctx.logger.info(`liveness: recovered — ${id}`, { meta: { findingId: id } });
-			this.ctx.eventBus.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessRecovered, LIVENESS_SOURCE, { findingId: id }));
+	/**
+	* Every storage root this node writes to must be writable BY THIS PROCESS.
+	* Reported through the same finding path (one ERROR, one alert, a recovery
+	* when it is fixed). Never throws: an unreadable list is said and skipped.
+	*/
+	async checkStorageRoots() {
+		const reporter = this.reporter;
+		if (reporter === null) return [];
+		try {
+			const locations = await this.ctx.api.storage.listLocations.query({});
+			const probe = nodeStorageRootProbe(node_fs_promises);
+			const results = await Promise.all(storageRootTargets(locations, HUB_NODE_ID).map((t) => probeStorageRoot(t, probe)));
+			for (const result of results) {
+				if (result.kind !== "unknown" || this.unknownRootsSaid.has(result.target.path)) continue;
+				this.unknownRootsSaid.add(result.target.path);
+				this.ctx.logger.warn("liveness: storage root writability could not be read — not judged", { meta: {
+					path: result.target.path,
+					locationIds: result.target.locationIds,
+					reason: result.reason
+				} });
+			}
+			const findings = storageRootFindings(results, probe);
+			reporter.report(findings, isStorageRootFindingId);
+			return findings;
+		} catch (err) {
+			this.ctx.logger.warn("liveness: storage locations unreadable — storage roots not checked", { meta: { error: require_dist.errMsg(err) } });
+			return [];
 		}
 	}
 };