@camstack/system 1.2.471 → 1.2.473

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BjcWEfRy.js");
+const require_chunk = require("../../chunk-Cek0wNdY.js");
+const require_dist = require("../../dist-Bmah6waF.js");
+let node_fs_promises = require("node:fs/promises");
+node_fs_promises = require_chunk.__toESM(node_fs_promises);
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
+let node_fs = require("node:fs");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";
@@ -52,6 +57,198 @@ function isLivenessFindingId(id) {
 	return id === NO_DEVICES || id === ALL_OFFLINE || id.startsWith(NO_FOOTAGE_PREFIX);
 }
 //#endregion
+//#region src/builtins/liveness-monitor/liveness-reporter.ts
+/**
+* Announce new liveness faults and their recoveries — never an unchanged fault.
+*
+* One ERROR line and one `SystemLivenessFailed` event per NEW finding id (the
+* alert centre turns it into one persistent alert), one INFO line and one
+* `SystemLivenessRecovered` when it is gone. Several families of checks run on
+* different cadences (the device checks wait out the boot grace, the storage
+* check does not), so a recovery is judged only within the family that was
+* just evaluated: a storage check that found nothing must not "recover" a
+* device finding it never looked at.
+*/
+/** Event source stamped on every emission — the addon that observed it. */
+var LIVENESS_SOURCE = {
+	type: "addon",
+	id: "liveness-monitor"
+};
+var LivenessReporter = class {
+	deps;
+	/** Finding ids currently reported, so recovery can be detected and announced. */
+	active = /* @__PURE__ */ new Set();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* @param findings what the family found this evaluation
+	* @param inFamily which ids the family owns — only those can recover here
+	*/
+	report(findings, inFamily) {
+		const current = new Set(findings.map((f) => f.id));
+		for (const finding of findings) {
+			if (this.active.has(finding.id)) continue;
+			this.active.add(finding.id);
+			this.deps.logger.error(`liveness: ${finding.title} — ${finding.message}`, {
+				...finding.deviceId !== void 0 ? { tags: { deviceId: finding.deviceId } } : {},
+				meta: {
+					findingId: finding.id,
+					severity: finding.severity
+				}
+			});
+			this.deps.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessFailed, LIVENESS_SOURCE, {
+				findingId: finding.id,
+				severity: finding.severity,
+				title: finding.title,
+				message: finding.message,
+				...finding.deviceId !== void 0 ? { deviceId: finding.deviceId } : {},
+				...finding.deviceName !== void 0 ? { name: finding.deviceName } : {}
+			}));
+		}
+		for (const id of [...this.active]) {
+			if (current.has(id) || !inFamily(id)) continue;
+			this.active.delete(id);
+			this.deps.logger.info(`liveness: recovered — ${id}`, { meta: { findingId: id } });
+			this.deps.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessRecovered, LIVENESS_SOURCE, { findingId: id }));
+		}
+	}
+};
+//#endregion
+//#region src/builtins/liveness-monitor/storage-root-access.ts
+/**
+* Can this node WRITE where its storage locations say media goes?
+*
+* 2026-10-23, a fresh install of the dev hub: the bind mounted at
+* `/recordings` was `root:root 0755` while the hub runs as uid 1001. Nothing
+* said so at boot; the first sign was an `EACCES` on `/recordings/artifacts`,
+* and recordings would have failed one write at a time. A root the process
+* cannot write is a fact known the moment the node starts, so it is reported
+* then — once, naming the path, its owner, its mode and the uid — instead of
+* as a stream of per-write errors.
+*
+* Only a location this node may WRITE (`mayWriteToLocation`), served by the
+* local filesystem provider, on this node, with an absolute `basePath`, is
+* judged. A root that does not exist yet is judged by its nearest existing
+* ancestor: that is the directory the node would have to create it in.
+*
+* A probe that cannot answer (a stat that fails for a reason other than
+* permission) is `unknown` and never a finding (D393): an unreadable fact is
+* not an unwritable disk.
+*/
+/** The local filesystem storage provider's id (`FilesystemStorageProvider.providerId`). */
+var FILESYSTEM_PROVIDER_ID = "filesystem-storage";
+var UNWRITABLE_PREFIX = "liveness:storage-root-unwritable:";
+/** The hub-local, writable filesystem roots among `locations`, deduplicated by path. */
+function storageRootTargets(locations, localNodeId) {
+	const byPath = /* @__PURE__ */ new Map();
+	for (const location of locations) {
+		if (location.providerId !== FILESYSTEM_PROVIDER_ID) continue;
+		if (location.nodeId !== void 0 && location.nodeId !== localNodeId) continue;
+		if (!require_dist.mayWriteToLocation(location)) continue;
+		const basePath = location.config["basePath"];
+		if (typeof basePath !== "string" || !node_path.default.isAbsolute(basePath)) continue;
+		const root = node_path.default.resolve(basePath);
+		byPath.set(root, [...byPath.get(root) ?? [], location.id]);
+	}
+	return [...byPath.entries()].map(([root, locationIds]) => ({
+		path: root,
+		locationIds: locationIds.toSorted()
+	})).toSorted((a, b) => a.path.localeCompare(b.path));
+}
+function isMissing(err) {
+	return err instanceof Error && "code" in err && (err.code === "ENOENT" || err.code === "ENOTDIR");
+}
+/** Probe one root: the root itself, or the nearest ancestor that exists. */
+async function probeStorageRoot(target, probe) {
+	let dir = target.path;
+	let stat;
+	for (;;) try {
+		stat = await probe.stat(dir);
+		break;
+	} catch (err) {
+		const parent = node_path.default.dirname(dir);
+		if (!isMissing(err) || parent === dir) return {
+			kind: "unknown",
+			target,
+			reason: `stat ${dir} failed: ${require_dist.errMsg(err)}`
+		};
+		dir = parent;
+	}
+	try {
+		await probe.canWrite(dir);
+		return {
+			kind: "writable",
+			target
+		};
+	} catch (err) {
+		return {
+			kind: "unwritable",
+			target,
+			blockedAt: dir,
+			stat,
+			reason: require_dist.errMsg(err)
+		};
+	}
+}
+function octalMode(mode) {
+	return (mode & 4095).toString(8).padStart(4, "0");
+}
+function processIdentity(probe) {
+	if (probe.processUid === null) return "this process";
+	return `uid ${String(probe.processUid)}` + (probe.processGid === null ? "" : ` (gid ${String(probe.processGid)})`);
+}
+/**
+* One finding per DIRECTORY that refused — several roots under one unwritable
+* mount (`/recordings` holding recordings, event media and artifacts) are one
+* cause and one alert. Stable id = that directory.
+*/
+function storageRootFindings(results, probe) {
+	const byBlocked = /* @__PURE__ */ new Map();
+	for (const result of results) {
+		if (result.kind !== "unwritable") continue;
+		const entry = byBlocked.get(result.blockedAt) ?? {
+			stat: result.stat,
+			roots: [],
+			locationIds: []
+		};
+		entry.roots.push(result.target.path);
+		entry.locationIds.push(...result.target.locationIds);
+		byBlocked.set(result.blockedAt, entry);
+	}
+	const uidFix = probe.processUid === null ? "<uid>" : String(probe.processUid);
+	const gidFix = probe.processGid === null ? "<gid>" : String(probe.processGid);
+	return [...byBlocked.entries()].toSorted(([a], [b]) => a.localeCompare(b)).map(([blockedAt, { stat, roots, locationIds }]) => {
+		const missing = roots.filter((r) => r !== blockedAt);
+		const below = missing.length > 0 ? ` (${missing.join(", ")} must be created inside it)` : "";
+		return {
+			id: `${UNWRITABLE_PREFIX}${blockedAt}`,
+			severity: "error",
+			title: "Storage location not writable",
+			message: `${blockedAt} is owned by ${String(stat.uid)}:${String(stat.gid)} with mode ${octalMode(stat.mode)}, and CamStack runs as ${processIdentity(probe)} — nothing can be written there${below}. Locations affected: ${locationIds.toSorted().join(", ")}. Fix the ownership on the host, e.g. chown -R ${uidFix}:${gidFix} <the host directory bound at ${blockedAt}>.`
+		};
+	});
+}
+function isStorageRootFindingId(id) {
+	return id.startsWith(UNWRITABLE_PREFIX);
+}
+/** The real probe: `fs.access(W_OK | X_OK)` as THIS process, and `fs.stat`. */
+function nodeStorageRootProbe(fs) {
+	return {
+		canWrite: (dir) => fs.access(dir, node_fs.constants.W_OK | node_fs.constants.X_OK),
+		stat: async (dir) => {
+			const st = await fs.stat(dir);
+			return {
+				uid: st.uid,
+				gid: st.gid,
+				mode: st.mode
+			};
+		},
+		processUid: typeof process.getuid === "function" ? process.getuid() : null,
+		processGid: typeof process.getgid === "function" ? process.getgid() : null
+	};
+}
+//#endregion
 //#region src/builtins/liveness-monitor/liveness-monitor.addon.ts
 /**
 * liveness-monitor — the node states, out loud, when it has stopped working.
@@ -74,11 +271,8 @@ function isLivenessFindingId(id) {
 * cause the outage it was meant to report — this repo has already stopped a
 * hub that way once (the remedial-action watcher, 2026-07-30).
 */
-/** Event source stamped on every emission — the addon that observed it. */
-var LIVENESS_SOURCE = {
-	type: "addon",
-	id: "liveness-monitor"
-};
+/** The node this monitor runs on (it is hub-only). */
+var HUB_NODE_ID = "hub";
 /** How often the invariants are checked. */
 var TICK_INTERVAL_MS = 5 * 6e4;
 /**
@@ -101,13 +295,19 @@ var RECORDING_LOOKBACK_MS = 1440 * 6e4;
 var LivenessMonitorAddon = class extends require_dist.BaseAddon {
 	tickTimer = null;
 	startedAtMs = 0;
-	/** Finding ids currently reported, so recovery can be detected and announced. */
-	active = /* @__PURE__ */ new Set();
+	reporter = null;
+	/** Roots whose writability could not be read, already said once. */
+	unknownRootsSaid = /* @__PURE__ */ new Set();
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
 		this.startedAtMs = Date.now();
+		this.reporter = new LivenessReporter({
+			logger: this.ctx.logger,
+			emit: (event) => this.ctx.eventBus.emit(event)
+		});
+		this.checkStorageRoots();
 		this.tickTimer = setInterval(() => {
 			this.tick();
 		}, TICK_INTERVAL_MS);
@@ -127,11 +327,12 @@ var LivenessMonitorAddon = class extends require_dist.BaseAddon {
 	* without waiting out the interval.
 	*/
 	async tick() {
-		if (Date.now() - this.startedAtMs < BOOT_GRACE_MS) return [];
+		const storage = await this.checkStorageRoots();
+		if (Date.now() - this.startedAtMs < BOOT_GRACE_MS) return storage;
 		try {
 			const findings = evaluateLiveness(await this.gather());
-			this.report(findings);
-			return findings;
+			this.reporter?.report(findings, isLivenessFindingId);
+			return [...storage, ...findings];
 		} catch (err) {
 			this.ctx.logger.error("liveness-monitor: check failed — node health is UNKNOWN this tick", { meta: { error: require_dist.errMsg(err) } });
 			return [];
@@ -206,33 +407,33 @@ var LivenessMonitorAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.warn(`liveness: recording availability was unreadable (${window}) — this camera is not judged this tick`, { tags: { deviceId } });
 		return null;
 	}
-	/** Announce new faults and recoveries; say nothing about an unchanged fault. */
-	report(findings) {
-		const current = new Set(findings.map((f) => f.id));
-		for (const finding of findings) {
-			if (this.active.has(finding.id)) continue;
-			this.active.add(finding.id);
-			this.ctx.logger.error(`liveness: ${finding.title} — ${finding.message}`, {
-				...finding.deviceId !== void 0 ? { tags: { deviceId: finding.deviceId } } : {},
-				meta: {
-					findingId: finding.id,
-					severity: finding.severity
-				}
-			});
-			this.ctx.eventBus.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessFailed, LIVENESS_SOURCE, {
-				findingId: finding.id,
-				severity: finding.severity,
-				title: finding.title,
-				message: finding.message,
-				...finding.deviceId !== void 0 ? { deviceId: finding.deviceId } : {},
-				...finding.deviceName !== void 0 ? { name: finding.deviceName } : {}
-			}));
-		}
-		for (const id of [...this.active]) {
-			if (current.has(id)) continue;
-			this.active.delete(id);
-			this.ctx.logger.info(`liveness: recovered — ${id}`, { meta: { findingId: id } });
-			this.ctx.eventBus.emit(require_dist.createEvent(require_dist.EventCategory.SystemLivenessRecovered, LIVENESS_SOURCE, { findingId: id }));
+	/**
+	* Every storage root this node writes to must be writable BY THIS PROCESS.
+	* Reported through the same finding path (one ERROR, one alert, a recovery
+	* when it is fixed). Never throws: an unreadable list is said and skipped.
+	*/
+	async checkStorageRoots() {
+		const reporter = this.reporter;
+		if (reporter === null) return [];
+		try {
+			const locations = await this.ctx.api.storage.listLocations.query({});
+			const probe = nodeStorageRootProbe(node_fs_promises);
+			const results = await Promise.all(storageRootTargets(locations, HUB_NODE_ID).map((t) => probeStorageRoot(t, probe)));
+			for (const result of results) {
+				if (result.kind !== "unknown" || this.unknownRootsSaid.has(result.target.path)) continue;
+				this.unknownRootsSaid.add(result.target.path);
+				this.ctx.logger.warn("liveness: storage root writability could not be read — not judged", { meta: {
+					path: result.target.path,
+					locationIds: result.target.locationIds,
+					reason: result.reason
+				} });
+			}
+			const findings = storageRootFindings(results, probe);
+			reporter.report(findings, isStorageRootFindingId);
+			return findings;
+		} catch (err) {
+			this.ctx.logger.warn("liveness: storage locations unreadable — storage roots not checked", { meta: { error: require_dist.errMsg(err) } });
+			return [];
 		}
 	}
 };

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,7 @@
-import { $r as errMsg, Da as EventCategory, Ui as createEvent, ei as BaseAddon, it as RecordingStatusSchema, nt as RECORDING_SOURCE_CAMSTACK_ADDON } from "../../dist-5XUG7iYJ.mjs";
+import { Oa as EventCategory, Vn as mayWriteToLocation, Wi as createEvent, ei as errMsg, it as RecordingStatusSchema, nt as RECORDING_SOURCE_CAMSTACK_ADDON, ti as BaseAddon } from "../../dist-C9lbdBL5.mjs";
+import * as fsp from "node:fs/promises";
+import path from "node:path";
+import { constants } from "node:fs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";
@@ -50,6 +53,198 @@ function isLivenessFindingId(id) {
 	return id === NO_DEVICES || id === ALL_OFFLINE || id.startsWith(NO_FOOTAGE_PREFIX);
 }
 //#endregion
+//#region src/builtins/liveness-monitor/liveness-reporter.ts
+/**
+* Announce new liveness faults and their recoveries — never an unchanged fault.
+*
+* One ERROR line and one `SystemLivenessFailed` event per NEW finding id (the
+* alert centre turns it into one persistent alert), one INFO line and one
+* `SystemLivenessRecovered` when it is gone. Several families of checks run on
+* different cadences (the device checks wait out the boot grace, the storage
+* check does not), so a recovery is judged only within the family that was
+* just evaluated: a storage check that found nothing must not "recover" a
+* device finding it never looked at.
+*/
+/** Event source stamped on every emission — the addon that observed it. */
+var LIVENESS_SOURCE = {
+	type: "addon",
+	id: "liveness-monitor"
+};
+var LivenessReporter = class {
+	deps;
+	/** Finding ids currently reported, so recovery can be detected and announced. */
+	active = /* @__PURE__ */ new Set();
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/**
+	* @param findings what the family found this evaluation
+	* @param inFamily which ids the family owns — only those can recover here
+	*/
+	report(findings, inFamily) {
+		const current = new Set(findings.map((f) => f.id));
+		for (const finding of findings) {
+			if (this.active.has(finding.id)) continue;
+			this.active.add(finding.id);
+			this.deps.logger.error(`liveness: ${finding.title} — ${finding.message}`, {
+				...finding.deviceId !== void 0 ? { tags: { deviceId: finding.deviceId } } : {},
+				meta: {
+					findingId: finding.id,
+					severity: finding.severity
+				}
+			});
+			this.deps.emit(createEvent(EventCategory.SystemLivenessFailed, LIVENESS_SOURCE, {
+				findingId: finding.id,
+				severity: finding.severity,
+				title: finding.title,
+				message: finding.message,
+				...finding.deviceId !== void 0 ? { deviceId: finding.deviceId } : {},
+				...finding.deviceName !== void 0 ? { name: finding.deviceName } : {}
+			}));
+		}
+		for (const id of [...this.active]) {
+			if (current.has(id) || !inFamily(id)) continue;
+			this.active.delete(id);
+			this.deps.logger.info(`liveness: recovered — ${id}`, { meta: { findingId: id } });
+			this.deps.emit(createEvent(EventCategory.SystemLivenessRecovered, LIVENESS_SOURCE, { findingId: id }));
+		}
+	}
+};
+//#endregion
+//#region src/builtins/liveness-monitor/storage-root-access.ts
+/**
+* Can this node WRITE where its storage locations say media goes?
+*
+* 2026-10-23, a fresh install of the dev hub: the bind mounted at
+* `/recordings` was `root:root 0755` while the hub runs as uid 1001. Nothing
+* said so at boot; the first sign was an `EACCES` on `/recordings/artifacts`,
+* and recordings would have failed one write at a time. A root the process
+* cannot write is a fact known the moment the node starts, so it is reported
+* then — once, naming the path, its owner, its mode and the uid — instead of
+* as a stream of per-write errors.
+*
+* Only a location this node may WRITE (`mayWriteToLocation`), served by the
+* local filesystem provider, on this node, with an absolute `basePath`, is
+* judged. A root that does not exist yet is judged by its nearest existing
+* ancestor: that is the directory the node would have to create it in.
+*
+* A probe that cannot answer (a stat that fails for a reason other than
+* permission) is `unknown` and never a finding (D393): an unreadable fact is
+* not an unwritable disk.
+*/
+/** The local filesystem storage provider's id (`FilesystemStorageProvider.providerId`). */
+var FILESYSTEM_PROVIDER_ID = "filesystem-storage";
+var UNWRITABLE_PREFIX = "liveness:storage-root-unwritable:";
+/** The hub-local, writable filesystem roots among `locations`, deduplicated by path. */
+function storageRootTargets(locations, localNodeId) {
+	const byPath = /* @__PURE__ */ new Map();
+	for (const location of locations) {
+		if (location.providerId !== FILESYSTEM_PROVIDER_ID) continue;
+		if (location.nodeId !== void 0 && location.nodeId !== localNodeId) continue;
+		if (!mayWriteToLocation(location)) continue;
+		const basePath = location.config["basePath"];
+		if (typeof basePath !== "string" || !path.isAbsolute(basePath)) continue;
+		const root = path.resolve(basePath);
+		byPath.set(root, [...byPath.get(root) ?? [], location.id]);
+	}
+	return [...byPath.entries()].map(([root, locationIds]) => ({
+		path: root,
+		locationIds: locationIds.toSorted()
+	})).toSorted((a, b) => a.path.localeCompare(b.path));
+}
+function isMissing(err) {
+	return err instanceof Error && "code" in err && (err.code === "ENOENT" || err.code === "ENOTDIR");
+}
+/** Probe one root: the root itself, or the nearest ancestor that exists. */
+async function probeStorageRoot(target, probe) {
+	let dir = target.path;
+	let stat;
+	for (;;) try {
+		stat = await probe.stat(dir);
+		break;
+	} catch (err) {
+		const parent = path.dirname(dir);
+		if (!isMissing(err) || parent === dir) return {
+			kind: "unknown",
+			target,
+			reason: `stat ${dir} failed: ${errMsg(err)}`
+		};
+		dir = parent;
+	}
+	try {
+		await probe.canWrite(dir);
+		return {
+			kind: "writable",
+			target
+		};
+	} catch (err) {
+		return {
+			kind: "unwritable",
+			target,
+			blockedAt: dir,
+			stat,
+			reason: errMsg(err)
+		};
+	}
+}
+function octalMode(mode) {
+	return (mode & 4095).toString(8).padStart(4, "0");
+}
+function processIdentity(probe) {
+	if (probe.processUid === null) return "this process";
+	return `uid ${String(probe.processUid)}` + (probe.processGid === null ? "" : ` (gid ${String(probe.processGid)})`);
+}
+/**
+* One finding per DIRECTORY that refused — several roots under one unwritable
+* mount (`/recordings` holding recordings, event media and artifacts) are one
+* cause and one alert. Stable id = that directory.
+*/
+function storageRootFindings(results, probe) {
+	const byBlocked = /* @__PURE__ */ new Map();
+	for (const result of results) {
+		if (result.kind !== "unwritable") continue;
+		const entry = byBlocked.get(result.blockedAt) ?? {
+			stat: result.stat,
+			roots: [],
+			locationIds: []
+		};
+		entry.roots.push(result.target.path);
+		entry.locationIds.push(...result.target.locationIds);
+		byBlocked.set(result.blockedAt, entry);
+	}
+	const uidFix = probe.processUid === null ? "<uid>" : String(probe.processUid);
+	const gidFix = probe.processGid === null ? "<gid>" : String(probe.processGid);
+	return [...byBlocked.entries()].toSorted(([a], [b]) => a.localeCompare(b)).map(([blockedAt, { stat, roots, locationIds }]) => {
+		const missing = roots.filter((r) => r !== blockedAt);
+		const below = missing.length > 0 ? ` (${missing.join(", ")} must be created inside it)` : "";
+		return {
+			id: `${UNWRITABLE_PREFIX}${blockedAt}`,
+			severity: "error",
+			title: "Storage location not writable",
+			message: `${blockedAt} is owned by ${String(stat.uid)}:${String(stat.gid)} with mode ${octalMode(stat.mode)}, and CamStack runs as ${processIdentity(probe)} — nothing can be written there${below}. Locations affected: ${locationIds.toSorted().join(", ")}. Fix the ownership on the host, e.g. chown -R ${uidFix}:${gidFix} <the host directory bound at ${blockedAt}>.`
+		};
+	});
+}
+function isStorageRootFindingId(id) {
+	return id.startsWith(UNWRITABLE_PREFIX);
+}
+/** The real probe: `fs.access(W_OK | X_OK)` as THIS process, and `fs.stat`. */
+function nodeStorageRootProbe(fs) {
+	return {
+		canWrite: (dir) => fs.access(dir, constants.W_OK | constants.X_OK),
+		stat: async (dir) => {
+			const st = await fs.stat(dir);
+			return {
+				uid: st.uid,
+				gid: st.gid,
+				mode: st.mode
+			};
+		},
+		processUid: typeof process.getuid === "function" ? process.getuid() : null,
+		processGid: typeof process.getgid === "function" ? process.getgid() : null
+	};
+}
+//#endregion
 //#region src/builtins/liveness-monitor/liveness-monitor.addon.ts
 /**
 * liveness-monitor — the node states, out loud, when it has stopped working.
@@ -72,11 +267,8 @@ function isLivenessFindingId(id) {
 * cause the outage it was meant to report — this repo has already stopped a
 * hub that way once (the remedial-action watcher, 2026-07-30).
 */
-/** Event source stamped on every emission — the addon that observed it. */
-var LIVENESS_SOURCE = {
-	type: "addon",
-	id: "liveness-monitor"
-};
+/** The node this monitor runs on (it is hub-only). */
+var HUB_NODE_ID = "hub";
 /** How often the invariants are checked. */
 var TICK_INTERVAL_MS = 5 * 6e4;
 /**
@@ -99,13 +291,19 @@ var RECORDING_LOOKBACK_MS = 1440 * 6e4;
 var LivenessMonitorAddon = class extends BaseAddon {
 	tickTimer = null;
 	startedAtMs = 0;
-	/** Finding ids currently reported, so recovery can be detected and announced. */
-	active = /* @__PURE__ */ new Set();
+	reporter = null;
+	/** Roots whose writability could not be read, already said once. */
+	unknownRootsSaid = /* @__PURE__ */ new Set();
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
 		this.startedAtMs = Date.now();
+		this.reporter = new LivenessReporter({
+			logger: this.ctx.logger,
+			emit: (event) => this.ctx.eventBus.emit(event)
+		});
+		this.checkStorageRoots();
 		this.tickTimer = setInterval(() => {
 			this.tick();
 		}, TICK_INTERVAL_MS);
@@ -125,11 +323,12 @@ var LivenessMonitorAddon = class extends BaseAddon {
 	* without waiting out the interval.
 	*/
 	async tick() {
-		if (Date.now() - this.startedAtMs < BOOT_GRACE_MS) return [];
+		const storage = await this.checkStorageRoots();
+		if (Date.now() - this.startedAtMs < BOOT_GRACE_MS) return storage;
 		try {
 			const findings = evaluateLiveness(await this.gather());
-			this.report(findings);
-			return findings;
+			this.reporter?.report(findings, isLivenessFindingId);
+			return [...storage, ...findings];
 		} catch (err) {
 			this.ctx.logger.error("liveness-monitor: check failed — node health is UNKNOWN this tick", { meta: { error: errMsg(err) } });
 			return [];
@@ -204,33 +403,33 @@ var LivenessMonitorAddon = class extends BaseAddon {
 		this.ctx.logger.warn(`liveness: recording availability was unreadable (${window}) — this camera is not judged this tick`, { tags: { deviceId } });
 		return null;
 	}
-	/** Announce new faults and recoveries; say nothing about an unchanged fault. */
-	report(findings) {
-		const current = new Set(findings.map((f) => f.id));
-		for (const finding of findings) {
-			if (this.active.has(finding.id)) continue;
-			this.active.add(finding.id);
-			this.ctx.logger.error(`liveness: ${finding.title} — ${finding.message}`, {
-				...finding.deviceId !== void 0 ? { tags: { deviceId: finding.deviceId } } : {},
-				meta: {
-					findingId: finding.id,
-					severity: finding.severity
-				}
-			});
-			this.ctx.eventBus.emit(createEvent(EventCategory.SystemLivenessFailed, LIVENESS_SOURCE, {
-				findingId: finding.id,
-				severity: finding.severity,
-				title: finding.title,
-				message: finding.message,
-				...finding.deviceId !== void 0 ? { deviceId: finding.deviceId } : {},
-				...finding.deviceName !== void 0 ? { name: finding.deviceName } : {}
-			}));
-		}
-		for (const id of [...this.active]) {
-			if (current.has(id)) continue;
-			this.active.delete(id);
-			this.ctx.logger.info(`liveness: recovered — ${id}`, { meta: { findingId: id } });
-			this.ctx.eventBus.emit(createEvent(EventCategory.SystemLivenessRecovered, LIVENESS_SOURCE, { findingId: id }));
+	/**
+	* Every storage root this node writes to must be writable BY THIS PROCESS.
+	* Reported through the same finding path (one ERROR, one alert, a recovery
+	* when it is fixed). Never throws: an unreadable list is said and skipped.
+	*/
+	async checkStorageRoots() {
+		const reporter = this.reporter;
+		if (reporter === null) return [];
+		try {
+			const locations = await this.ctx.api.storage.listLocations.query({});
+			const probe = nodeStorageRootProbe(fsp);
+			const results = await Promise.all(storageRootTargets(locations, HUB_NODE_ID).map((t) => probeStorageRoot(t, probe)));
+			for (const result of results) {
+				if (result.kind !== "unknown" || this.unknownRootsSaid.has(result.target.path)) continue;
+				this.unknownRootsSaid.add(result.target.path);
+				this.ctx.logger.warn("liveness: storage root writability could not be read — not judged", { meta: {
+					path: result.target.path,
+					locationIds: result.target.locationIds,
+					reason: result.reason
+				} });
+			}
+			const findings = storageRootFindings(results, probe);
+			reporter.report(findings, isStorageRootFindingId);
+			return findings;
+		} catch (err) {
+			this.ctx.logger.warn("liveness: storage locations unreadable — storage roots not checked", { meta: { error: errMsg(err) } });
+			return [];
 		}
 	}
 };

package/dist/builtins/liveness-monitor/liveness-reporter.d.ts

@@ -0,0 +1,28 @@
+/**
+* Announce new liveness faults and their recoveries — never an unchanged fault.
+*
+* One ERROR line and one `SystemLivenessFailed` event per NEW finding id (the
+* alert centre turns it into one persistent alert), one INFO line and one
+* `SystemLivenessRecovered` when it is gone. Several families of checks run on
+* different cadences (the device checks wait out the boot grace, the storage
+* check does not), so a recovery is judged only within the family that was
+* just evaluated: a storage check that found nothing must not "recover" a
+* device finding it never looked at.
+*/
+import { type IScopedLogger, type SystemEvent } from "@camstack/types";
+import type { LivenessFinding } from "./liveness-checks.js";
+export interface LivenessReporterDeps {
+	readonly logger: IScopedLogger;
+	readonly emit: (event: SystemEvent) => void;
+}
+export declare class LivenessReporter {
+	private readonly deps;
+	/** Finding ids currently reported, so recovery can be detected and announced. */
+	private readonly active;
+	constructor(deps: LivenessReporterDeps);
+	/**
+	* @param findings what the family found this evaluation
+	* @param inFamily which ids the family owns — only those can recover here
+	*/
+	report(findings: readonly LivenessFinding[], inFamily: (id: string) => boolean): void;
+}