@camstack/system 1.2.83 → 1.2.84

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,793 +1,574 @@
-import { It as parseJsonObject, ct as storageCapability, g as StorageMigrationJobSchema, gt as BaseAddon, h as StorageLocationTypeSchema, lt as storageMigrationCapability, ot as settingsStoreCapability } from "../../dist-EAvNJD24.mjs";
+import { It as parseJsonObject, ct as storageCapability, g as StorageMigrationJobSchema, gt as BaseAddon, h as StorageLocationTypeSchema, lt as storageMigrationCapability, ot as settingsStoreCapability } from "../../dist-BAwlOEUy.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
 import { buildStorageLocationRegistry } from "@camstack/system";
-//#region src/builtins/storage-orchestrator/storage-orchestrator.service.ts
-var SESSION_VOCABULARY = {
-	upload: {
-		idLabel: "uploadId",
-		openMethod: "beginUpload"
+//#region src/builtins/storage-orchestrator/location-store.ts
+var STORAGE_LOCATIONS = "storage_locations";
+/**
+* Reserved key under which the cluster `nodeId` (SP1) is persisted INSIDE
+* the `config` JSON blob. Storing it in the blob rather than a dedicated
+* column avoids a destructive `ensureTable` DROP+recreate on deploy (a
+* newly-declared column counts as a missing column → the structured
+* backend drops the table, wiping operator location customizations such
+* as `recordings:default`'s `minFreePercent`). The double-underscore
+* prefix keeps it out of the provider-facing config namespace
+* (`basePath`, `minFreePercent`, …) — the mapper strips it on read so
+* API consumers and providers never see it.
+*/
+var NODE_ID_CONFIG_KEY = "__nodeId";
+/**
+* Reserved key under which the operator opt-in flag (`StorageLocation.enabled`)
+* is persisted INSIDE the `config` JSON blob — same channel, same reason, as
+* {@link NODE_ID_CONFIG_KEY}: a newly-declared COLUMN counts as a missing
+* column, and the structured backend answers that by dropping and recreating
+* the table, wiping every operator customization on it.
+*
+* ABSENT means ACTIVE. A row written before the flag existed carries no key and
+* reads back with `enabled: undefined`, which every consumer treats as enabled —
+* that is why this ships with no migration and no backfill pass.
+*/
+var ENABLED_CONFIG_KEY = "__enabled";
+/**
+* `config` is declared `JSON`, so the store hands the surface an object and
+* gets an object back. There is deliberately NO `node_id` column — `nodeId`
+* rides inside the blob under a reserved key (see {@link NODE_ID_CONFIG_KEY}),
+* because a newly-declared column would put this table through
+* `declareCollection`'s destructive rebuild and wipe operator customizations
+* such as `recordings:default`'s `minFreePercent`.
+*/
+var STORAGE_LOCATIONS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true
 	},
-	download: {
-		idLabel: "downloadId",
-		openMethod: "beginDownload"
+	{
+		name: "type",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "display_name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "provider_id",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "config",
+		type: "JSON",
+		notNull: true,
+		defaultValue: "{}"
+	},
+	{
+		name: "is_default",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "is_system",
+		type: "INTEGER",
+		notNull: true,
+		defaultValue: 0
+	},
+	{
+		name: "created_at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updated_at",
+		type: "INTEGER",
+		notNull: true
 	}
-};
-/** Map key for a tracked chunked session — the id spaces never collide. */
-function sessionKey(kind, sessionId) {
-	return `${kind}:${sessionId}`;
-}
+];
+var STORAGE_LOCATIONS_INDEXES = [{
+	name: "idx_storage_locations_type",
+	columns: ["type"]
+}];
 /**
-* Bare node id for a raw kernel `localNodeId`. Forked children carry a
-* `<node>/<addon>` suffix; routing is per-NODE, so the addon segment is
-* dropped. (Mirrors `normalizeNodeId` in `@camstack/types/addon`, which is a
-* leaf module not re-exported on any subpath this package can import.)
+* `ILocationStore` on the `settings-store` collection surface — the same door
+* every other consumer uses. It holds the `data-store-provider` engine object
+* directly (not the `settings-store` singleton) because since D44 the
+* storage-orchestrator IS that singleton, and asking the registry for it would
+* route this table back through the orchestrator itself.
 */
-function bareNodeId(raw) {
-	if (raw === void 0 || raw === "") return "hub";
-	const slash = raw.indexOf("/");
-	if (slash < 0) return raw;
-	const bare = raw.slice(0, slash);
-	return bare === "" ? "hub" : bare;
-}
-var StorageOrchestratorService = class {
-	logger;
-	getProviders;
-	locationStore;
-	getRemoteProvider;
-	locations = /* @__PURE__ */ new Map();
-	/**
-	* Declaration-driven cardinality source, injected by the addon after
-	* the kernel aggregates `storageLocations` declarations. `null` until
-	* `setRegistry` runs — `upsertLocation` then treats every type as
-	* `'multi'` (no singleton enforcement), the safe default for the
-	* in-memory-only / early-boot path.
-	*/
-	registry = null;
-	/**
-	* Injected `providerId → nodeLocal` resolver (see {@link NodeLocalResolver}).
-	* `null` until {@link setNodeLocalResolver} runs — `upsertLocation` then
-	* skips the node-local requirement check entirely (every provider is
-	* treated as node-agnostic), the safe default for the in-memory-only /
-	* early-boot path that predates the resolver wiring.
-	*/
-	nodeLocalResolver = null;
-	/** `localNodeId` with any forked-child `/addon` suffix stripped. */
-	localNode;
-	/**
-	* `<kind>:<sessionId>` → the dispatch target that OPENED the session.
-	* Chunked I/O carries no `StorageLocation` after the first hop, so without
-	* this the follow-up chunks fall back to a `providerId`-only lookup — which
-	* on a multi-node cluster means the hub's filesystem, not the agent's.
-	*/
-	sessionTargets = /* @__PURE__ */ new Map();
-	constructor(logger, getProviders, locationStore = null, localNodeId = "hub", getRemoteProvider) {
-		this.logger = logger;
-		this.getProviders = getProviders;
-		this.locationStore = locationStore;
-		this.getRemoteProvider = getRemoteProvider;
-		this.localNode = bareNodeId(localNodeId);
+var SqliteLocationStore = class {
+	store;
+	declared = false;
+	constructor(store) {
+		this.store = store;
 	}
 	/**
-	* The node this orchestrator runs on, with any forked-child `/addon`
-	* suffix stripped. A location whose `nodeId` differs is NOT this node's
-	* to touch — its bytes, and its free space, live elsewhere.
+	* Lazy `declareCollection` — keeps the constructor cheap and async-free.
+	* Called from every mutation/read path; `declareCollection` is idempotent
+	* (and additive on shape changes), so repeated calls collapse to a no-op.
 	*/
-	getLocalNodeId() {
-		return this.localNode;
+	async ensureDeclared() {
+		if (this.declared) return;
+		await this.store.declareCollection({
+			collection: STORAGE_LOCATIONS,
+			columns: STORAGE_LOCATIONS_COLUMNS,
+			indexes: STORAGE_LOCATIONS_INDEXES
+		});
+		this.declared = true;
 	}
-	/** True once a persistence store is wired (constructor or {@link attachStore}). */
-	hasStore() {
-		return this.locationStore !== null;
+	async loadAll() {
+		await this.ensureDeclared();
+		const rows = await this.store.query({
+			collection: STORAGE_LOCATIONS,
+			filter: { orderBy: {
+				field: "created_at",
+				direction: "asc"
+			} }
+		});
+		const out = [];
+		for (const row of rows) {
+			const mapped = mapRowToLocation(row.data);
+			if (mapped) out.push(mapped);
+		}
+		return out;
 	}
 	/**
-	* Late-bind the persistence store (production boot: the `settings-store`
-	* cap registers after the orchestrator initializes, so the service runs
-	* in-memory-only until then). Idempotent — a second call once a store is
-	* wired is a no-op.
-	*
-	* Reconciles both directions so operator edits survive a reboot:
-	*   1. hydrate — DB rows win over any early in-memory seed (restores
-	*      operator config like `minFreePercent` that the pre-store boot
-	*      can't see), with the same `isSystem` upgrade as {@link initialize};
-	*   2. backfill — in-memory locations the DB doesn't have yet (the
-	*      pre-store seed defaults on a fresh install) are persisted, so the
-	*      store becomes the durable source of truth from here on.
+	* Replace-or-insert. Implemented as delete + insert rather than a
+	* conditional update because the orchestrator serializes every mutation
+	* through the in-memory map before dispatching to the store — there's no
+	* contention to lose, and delete-then-insert is unconditionally simpler.
 	*/
-	async attachStore(store) {
-		if (this.locationStore) return;
-		this.locationStore = store;
-		const rows = await store.loadAll();
-		const dbIds = new Set(rows.map((r) => r.id));
-		for (const loc of rows) {
-			const upgraded = !loc.isSystem && loc.id === `${loc.type}:default` ? {
-				...loc,
-				isSystem: true
-			} : loc;
-			this.locations.set(upgraded.id, upgraded);
-			if (upgraded !== loc) store.upsert(upgraded).catch(() => {});
-		}
-		const backfill = [...this.locations.values()].filter((l) => !dbIds.has(l.id));
-		for (const loc of backfill) store.upsert(loc).catch((err) => {
-			this.logger.warn("storage-orchestrator: attachStore backfill persist failed", { meta: {
+	async upsert(loc) {
+		await this.ensureDeclared();
+		await this.store.deleteWhere({
+			collection: STORAGE_LOCATIONS,
+			filter: { where: { id: loc.id } }
+		});
+		await this.store.insert({
+			collection: STORAGE_LOCATIONS,
+			record: {
 				id: loc.id,
-				error: err instanceof Error ? err.message : String(err)
-			} });
+				data: mapLocationToRow(loc)
+			}
 		});
-		this.logger.info("storage-orchestrator: store attached + reconciled", { meta: {
-			hydrated: rows.length,
-			backfilled: backfill.length,
-			total: this.locations.size
-		} });
-	}
-	/**
-	* Inject the declaration-driven cardinality source. Called once by the
-	* addon after the kernel aggregates every addon's `storageLocations`
-	* declarations into a `StorageLocationRegistry`.
-	*/
-	setRegistry(registry) {
-		this.registry = registry;
 	}
-	/**
-	* Inject the synchronous `providerId → nodeLocal` resolver (SP1). Called
-	* by the addon from a cached snapshot of every `storage-provider`'s
-	* `getProviderInfo().nodeLocal`, refreshed when the provider collection
-	* changes. Powers the node-local upsert guard and the boot backfill.
-	*/
-	setNodeLocalResolver(resolver) {
-		this.nodeLocalResolver = resolver;
+	async delete(id) {
+		await this.ensureDeclared();
+		await this.store.deleteWhere({
+			collection: STORAGE_LOCATIONS,
+			filter: { where: { id } }
+		});
 	}
-	/**
-	* The full set of addon-declared storage locations, as aggregated by
-	* the kernel and injected via {@link setRegistry}. Powers the admin-UI
-	* Data screen's per-declaration grouping. Empty until the registry is
-	* injected (early-boot / in-memory-only path).
-	*/
-	listDeclarations() {
-		return this.registry ? this.registry.list() : [];
+};
+function isPlainObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readConfig(raw) {
+	if (isPlainObject(raw)) return { ...raw };
+	if (typeof raw === "string" && raw.length > 0) return parseJsonObject(raw) ?? {};
+	return {};
+}
+function mapLocationToRow(loc) {
+	const storedConfig = { ...loc.config };
+	if (loc.nodeId !== void 0) storedConfig[NODE_ID_CONFIG_KEY] = loc.nodeId;
+	if (loc.enabled !== void 0) storedConfig[ENABLED_CONFIG_KEY] = loc.enabled;
+	return {
+		id: loc.id,
+		type: loc.type,
+		display_name: loc.displayName,
+		provider_id: loc.providerId,
+		config: storedConfig,
+		is_default: loc.isDefault ? 1 : 0,
+		is_system: loc.isSystem ? 1 : 0,
+		created_at: loc.createdAt,
+		updated_at: loc.updatedAt
+	};
+}
+/**
+* Decode a row read from the collection. Returns `null` when the row's `type`
+* fails the id-format schema or the row has no id — a corrupt row (hand-edited,
+* partial migration) is skipped rather than taking the boot read down with it.
+*/
+function mapRowToLocation(row) {
+	const typeRaw = row["type"];
+	const parsedType = StorageLocationTypeSchema.safeParse(typeRaw);
+	if (!parsedType.success) return null;
+	const type = parsedType.data;
+	const id = String(row["id"] ?? "");
+	if (!id) return null;
+	const storedConfig = readConfig(row["config"]);
+	const nodeIdRaw = storedConfig[NODE_ID_CONFIG_KEY];
+	const nodeId = typeof nodeIdRaw === "string" && nodeIdRaw.length > 0 ? nodeIdRaw : void 0;
+	const enabledRaw = storedConfig[ENABLED_CONFIG_KEY];
+	const enabled = typeof enabledRaw === "boolean" ? enabledRaw : void 0;
+	const config = { ...storedConfig };
+	delete config[NODE_ID_CONFIG_KEY];
+	delete config[ENABLED_CONFIG_KEY];
+	return {
+		id,
+		type,
+		displayName: String(row["display_name"] ?? ""),
+		providerId: String(row["provider_id"] ?? ""),
+		config,
+		...nodeId !== void 0 ? { nodeId } : {},
+		...enabled !== void 0 ? { enabled } : {},
+		isDefault: row["is_default"] === 1 || row["is_default"] === true,
+		isSystem: row["is_system"] === 1 || row["is_system"] === true,
+		createdAt: Number(row["created_at"] ?? 0),
+		updatedAt: Number(row["updated_at"] ?? 0)
+	};
+}
+//#endregion
+//#region src/builtins/storage-orchestrator/storage-migration-coordinator.ts
+var STORAGE_CLASSES = [
+	"recordings",
+	"recordingsLow",
+	"eventMedia"
+];
+var PARTICIPANTS = [
+	"pipeline",
+	"recorder",
+	"analytics"
+];
+var REVERSE_PARTICIPANTS = [
+	"analytics",
+	"recorder",
+	"pipeline"
+];
+/**
+* Durable orchestration layer over the independent recorder and event-media
+* movers. It owns the only public migration state machine; participants expose
+* intentionally narrow lease/move primitives and never alter camera settings.
+*/
+var StorageMigrationCoordinator = class {
+	deps;
+	active = null;
+	runPromise = null;
+	startReserved = false;
+	constructor(deps) {
+		this.deps = deps;
 	}
-	/**
-	* Hydrate the in-memory map from the persistence layer. Called once
-	* by the addon during `onInitialize`, before the eager seed pass.
-	* Idempotent — running it twice with the same store contents
-	* produces the same map. No-op when the service was constructed
-	* without a store.
-	*
-	* Errors loading individual rows are tolerated: the bad row is
-	* skipped and logged so a single corrupted record doesn't lock the
-	* whole orchestrator out of boot. (The store-side validation pass
-	* before insert means only schema-invalid SQL state can produce
-	* such a row.)
-	*/
-	async initialize() {
-		if (!this.locationStore) return;
-		const rows = await this.locationStore.loadAll();
-		let upgraded = 0;
-		for (const loc of rows) if (!loc.isSystem && loc.id === `${loc.type}:default`) {
-			const upgradedLoc = {
-				...loc,
-				isSystem: true
-			};
-			this.locations.set(upgradedLoc.id, upgradedLoc);
-			this.locationStore.upsert(upgradedLoc).catch((err) => {
-				this.logger.warn("storage-orchestrator: isSystem upgrade persist failed", { meta: {
-					id: upgradedLoc.id,
-					error: err instanceof Error ? err.message : String(err)
-				} });
+	async plan(input) {
+		const moves = [];
+		for (const storageClass of STORAGE_CLASSES) {
+			const targetId = input.destinations[storageClass];
+			if (targetId === void 0) continue;
+			const source = this.deps.locations.getDefaultLocation(storageClass);
+			if (!source) throw new Error(`No default storage location for "${storageClass}"`);
+			const target = this.deps.locations.getLocationById(targetId);
+			if (!target) throw new Error(`Storage location "${targetId}" not found`);
+			if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
+			if (source.id === target.id) throw new Error(`Storage location "${targetId}" is already the "${storageClass}" default`);
+			moves.push({
+				storageClass,
+				fromLocationId: source.id,
+				toLocationId: target.id,
+				moverJobId: null,
+				state: null,
+				error: null
 			});
-			upgraded++;
-		} else this.locations.set(loc.id, loc);
-		this.logger.info("storage-orchestrator: hydrated locations from store", { meta: {
-			loaded: this.locations.size,
-			isSystemUpgraded: upgraded
-		} });
+		}
+		if (moves.length === 0) throw new Error("select at least one storage class");
+		return {
+			destinations: input.destinations,
+			moves: moves.map(({ storageClass, fromLocationId, toLocationId }) => ({
+				storageClass,
+				fromLocationId,
+				toLocationId
+			}))
+		};
 	}
-	/**
-	* Boot backfill (SP1): stamp `nodeId` on every persisted node-local
-	* location that lacks one. Single-node deployments seeded their
-	* filesystem locations before `nodeId` existed — they live on `hubNodeId`
-	* (the hub). Node-agnostic (remote) locations are left untouched: their
-	* absent `nodeId` is correct (reachable from any node).
-	*
-	* Idempotent — a location that already carries a `nodeId` (any value) is
-	* never re-touched, so re-running on a populated map (or a re-boot) is a
-	* no-op. A plain local update, not versioned-migration machinery: only
-	* the rows missing `nodeId` are mutated + persisted.
-	*
-	* No-op until the node-local resolver is wired (it classifies which
-	* providers are node-local).
-	*/
-	async backfillNodeIds(hubNodeId) {
-		const resolver = this.nodeLocalResolver;
-		if (!resolver) return;
-		let stamped = 0;
-		for (const [id, loc] of Array.from(this.locations)) {
-			if (loc.nodeId) continue;
-			if (resolver(loc.providerId) !== true) continue;
-			const updated = {
-				...loc,
-				nodeId: hubNodeId,
-				updatedAt: Date.now()
-			};
-			this.locations.set(id, updated);
-			stamped++;
-			if (this.locationStore) try {
-				await this.locationStore.upsert(updated);
-			} catch (err) {
-				this.logger.error("storage-orchestrator: nodeId backfill persist failed", { meta: {
-					id,
-					error: err instanceof Error ? err.message : String(err)
-				} });
+	async start(input) {
+		if (this.startReserved) throw new Error("storage migration is already active");
+		this.startReserved = true;
+		try {
+			const existing = await this.status();
+			if (existing && isTerminal(existing) && existing.pausedParticipants.length > 0) {
+				await this.releaseAfterTerminal(existing);
+				await this.persist(existing);
+				if (existing.pausedParticipants.length > 0) throw new Error(`storage migration ${existing.jobId} still holds maintenance leases`);
 			}
+			if (existing && !isTerminal(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
+			const plan = await this.plan(input);
+			const now = this.deps.now();
+			const job = {
+				jobId: this.deps.newId(),
+				phase: "planning",
+				destinations: input.destinations,
+				throttleMbps: input.throttleMbps ?? 40,
+				moves: plan.moves.map((move) => ({
+					...move,
+					moverJobId: null,
+					state: null,
+					error: null
+				})),
+				pauseLeaseId: null,
+				pausedParticipants: [],
+				repointed: false,
+				cancelRequested: false,
+				startedAt: now,
+				updatedAt: now,
+				finishedAt: null,
+				error: null
+			};
+			this.active = job;
+			await this.persist(job);
+			this.runPromise = this.run(job);
+			this.runPromise;
+			return job.jobId;
+		} finally {
+			this.startReserved = false;
 		}
-		if (stamped > 0) this.logger.info("storage-orchestrator: backfilled nodeId on node-local locations", { meta: {
-			stamped,
-			hubNodeId
-		} });
 	}
-	listLocations(filter) {
-		const all = [...this.locations.values()];
-		return filter?.type ? all.filter((l) => l.type === filter.type) : all;
+	async status(jobId) {
+		const job = this.active ?? await this.deps.state.get();
+		if (jobId !== void 0 && job?.jobId !== jobId) return null;
+		return job;
 	}
-	getDefaultLocation(type) {
-		for (const loc of this.locations.values()) if (loc.type === type && loc.isDefault) return loc;
-		return null;
+	async cancel(jobId) {
+		const job = await this.status(jobId);
+		if (!job || isTerminal(job) || job.repointed) return false;
+		job.cancelRequested = true;
+		await this.persist(job);
+		await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
+		return true;
 	}
-	/**
-	* Repoint several logical defaults as one in-memory commit. The migration
-	* coordinator persists its `repointing` phase before calling this method, so
-	* a process crash during the backing-store writes is recovered by replaying
-	* the same idempotent target set before anyone resumes writers.
-	*/
-	async setDefaultLocations(targetByType) {
-		if (targetByType.size === 0) return;
-		const now = Date.now();
-		const nextById = new Map(this.locations);
-		const touched = /* @__PURE__ */ new Map();
-		for (const [type, targetId] of targetByType) {
-			const target = nextById.get(targetId);
-			if (!target) throw new Error(`Storage location "${targetId}" not found`);
-			if (target.type !== type) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${type}"`);
-			for (const [id, location] of nextById) {
-				if (location.type !== type) continue;
-				const isDefault = id === targetId;
-				if (location.isDefault === isDefault) continue;
-				const updated = {
-					...location,
-					isDefault,
-					updatedAt: now
-				};
-				nextById.set(id, updated);
-				touched.set(id, updated);
-			}
+	/** Boot recovery resumes a durable unfinished state. A missing in-memory
+	* child mover is recreated from the same copy-if-absent input. */
+	async recover() {
+		const job = await this.deps.state.get();
+		if (!job) return;
+		if (job.cancelRequested) {
+			await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
+			await this.waitForMoves(job);
+			await this.releaseAfterTerminal(job);
+			job.phase = "cancelled";
+			job.finishedAt ??= this.deps.now();
+			await this.persist(job);
+			return;
 		}
-		if (this.locationStore) {
-			const previous = /* @__PURE__ */ new Map();
-			for (const id of touched.keys()) {
-				const location = this.locations.get(id);
-				if (location) previous.set(id, location);
-			}
-			try {
-				for (const location of touched.values()) await this.locationStore.upsert(location);
-			} catch (err) {
-				for (const location of previous.values()) try {
-					await this.locationStore.upsert(location);
-				} catch {}
-				throw err;
+		if (isTerminal(job)) {
+			if (job.pausedParticipants.length > 0) {
+				await this.releaseAfterTerminal(job);
+				await this.persist(job);
 			}
+			return;
+		}
+		this.active = job;
+		job.pauseLeaseId ??= this.deps.newId();
+		if (job.repointed && job.phase === "resuming") job.phase = "refreshing";
+		await this.persist(job);
+		try {
+			await this.pauseParticipants(job, true);
+		} catch (err) {
+			job.error = err instanceof Error ? err.message : String(err);
+			await this.persist(job);
+			return;
+		}
+		if (this.runPromise === null) {
+			this.runPromise = this.run(job);
+			this.runPromise;
 		}
-		this.locations.clear();
-		for (const [id, location] of nextById) this.locations.set(id, location);
 	}
-	/**
-	* Insert or update a location. If `isDefault: true`, atomically
-	* demotes any other default for the same type — operators always see
-	* exactly one default per type.
-	*
-	* When a persistence store is wired (Task 6), the new record AND any
-	* implicitly-demoted siblings are persisted before the in-memory map
-	* mutation returns. Persistence errors propagate to the caller.
-	*/
-	upsertLocation(input) {
-		const now = Date.now();
-		const existing = this.locations.get(input.id);
-		if (!existing) {
-			if ((this.registry?.cardinalityOf(input.type) ?? "multi") === "single") {
-				const already = [...this.locations.values()].find((l) => l.type === input.type);
-				if (already) throw new Error(`Storage type "${input.type}" is single — only one location allowed (existing: "${already.id}"). Edit it instead of adding a new one.`);
+	async run(job) {
+		try {
+			if (job.phase === "planning") await this.setPhase(job, "pausing");
+			if (job.phase === "pausing") {
+				job.pauseLeaseId ??= job.jobId;
+				await this.pauseParticipants(job);
+				if (job.cancelRequested) return this.finishCancelled(job);
+				await this.setPhase(job, "moving");
 			}
-		}
-		if (this.nodeLocalResolver?.(input.providerId) === true && !input.nodeId) input = {
-			...input,
-			nodeId: "hub"
-		};
-		if (existing?.isSystem === true) input = {
-			...input,
-			isSystem: true
-		};
-		const next = {
-			...input,
-			createdAt: existing?.createdAt ?? now,
-			updatedAt: now
-		};
-		const demoted = [];
-		if (next.isDefault) {
-			for (const [otherId, otherLoc] of this.locations) if (otherLoc.type === next.type && otherLoc.id !== next.id && otherLoc.isDefault) {
-				const updated = {
-					...otherLoc,
-					isDefault: false,
-					updatedAt: now
-				};
-				this.locations.set(otherId, updated);
-				demoted.push(updated);
+			if (job.phase === "moving") {
+				await this.startOrResumeMoves(job);
+				await this.waitForMoves(job);
+				if (job.cancelRequested) return this.finishCancelled(job);
+				await this.setPhase(job, "verifying");
+			}
+			if (job.phase === "verifying") {
+				await this.verifyMoves(job);
+				if (job.cancelRequested) return this.finishCancelled(job);
+				await this.setPhase(job, "repointing");
+			}
+			if (job.phase === "repointing") {
+				const targets = new Map(job.moves.map((move) => [move.storageClass, move.toLocationId]));
+				await this.deps.locations.setDefaultLocations(targets);
+				job.repointed = true;
+				await this.setPhase(job, "refreshing");
+			}
+			if (job.phase === "refreshing") {
+				const leaseId = requireLease(job);
+				if (job.moves.some((move) => move.storageClass !== "eventMedia")) await this.deps.participants.recorder.refresh(leaseId);
+				if (job.moves.some((move) => move.storageClass === "eventMedia")) await this.deps.participants.analytics.refresh(leaseId);
+				await this.setPhase(job, "resuming");
+			}
+			if (job.phase === "resuming") {
+				await this.resumeParticipants(job);
+				await this.setPhase(job, "done");
+			}
+		} catch (err) {
+			job.error = err instanceof Error ? err.message : String(err);
+			if (job.repointed) {
+				job.phase = "refreshing";
+				job.finishedAt = null;
+				await this.persist(job);
+				return;
+			}
+			job.phase = "failed";
+			job.finishedAt = this.deps.now();
+			await this.releaseAfterTerminal(job);
+			await this.persist(job);
+		} finally {
+			if (isTerminal(job)) {
+				await this.releaseAfterTerminal(job);
+				this.active = job;
 			}
+			this.runPromise = null;
 		}
-		this.locations.set(next.id, next);
-		this.logger.debug("storage-orchestrator: upsertLocation", { meta: {
-			id: next.id,
-			type: next.type,
-			providerId: next.providerId,
-			isDefault: next.isDefault
-		} });
-		if (this.locationStore) {
-			const store = this.locationStore;
-			(async () => {
-				try {
-					for (const d of demoted) await store.upsert(d);
-					await store.upsert(next);
-				} catch (err) {
-					this.logger.error("storage-orchestrator: upsert persistence failed", { meta: {
-						id: next.id,
-						error: err instanceof Error ? err.message : String(err)
-					} });
-				}
-			})();
+	}
+	async pauseParticipants(job, reacquire = false) {
+		const leaseId = requireLease(job);
+		for (const name of PARTICIPANTS) {
+			if (job.cancelRequested) return;
+			if (!reacquire && job.pausedParticipants.includes(name)) continue;
+			await this.participant(name).pause(leaseId);
+			if (!job.pausedParticipants.includes(name)) job.pausedParticipants.push(name);
+			await this.persist(job);
 		}
-		return next;
 	}
-	/**
-	* Remove a location. Refuses to remove the default of a type unless a
-	* sibling default exists (defensive — `upsertLocation` already ensures
-	* at most one default per type, but the logic guards against future
-	* bypass paths e.g. SQLite migration that imports two defaults).
-	*
-	* Persistence (Task 6) mirrors the delete asynchronously, with errors
-	* routed to the logger — see `upsertLocation` for the rationale.
-	*/
-	deleteLocation(id) {
-		const loc = this.locations.get(id);
-		if (!loc) throw new Error(`Storage location "${id}" not found`);
-		if (loc.isSystem) throw new Error(`Storage location "${id}" is system-managed and cannot be deleted. Edit its config (path / providerId) instead.`);
-		if (loc.isDefault) {
-			if (![...this.locations.values()].find((l) => l.type === loc.type && l.id !== id && l.isDefault)) throw new Error(`Cannot delete default location "${id}" for type "${loc.type}" — promote another location to default first`);
+	async resumeParticipants(job) {
+		const leaseId = requireLease(job);
+		for (const name of REVERSE_PARTICIPANTS) {
+			if (!job.pausedParticipants.includes(name)) continue;
+			await this.participant(name).resume(leaseId);
+			job.pausedParticipants = job.pausedParticipants.filter((participant) => participant !== name);
+			await this.persist(job);
 		}
-		this.locations.delete(id);
-		if (this.locationStore) this.locationStore.delete(id).catch((err) => {
-			this.logger.error("storage-orchestrator: delete persistence failed", { meta: {
-				id,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-		});
 	}
-	/**
-	* Remove system-seeded locations whose type is no longer declared by any
-	* addon (stale defaults from a removed location type). Operator-added
-	* (non-system) locations of an undeclared type are KEPT but warned — the
-	* operator owns them. Requires the registry to be set first.
-	*
-	* FAIL-SAFE: if the registry is EMPTY (no addon declared any location), we
-	* refuse to prune anything. An empty registry almost always means
-	* declarations failed to load (boot ordering, a stale install) — pruning
-	* "everything undeclared" in that state would wipe every system location
-	* (data/logs/recordings/…). Better to keep stale rows than destroy live ones.
-	*/
-	pruneUndeclaredSystemLocations() {
-		if (!this.registry) return;
-		if (this.registry.list().length === 0) {
-			this.logger.warn("storage-orchestrator: skipping prune — no location declarations loaded (fail-safe)");
+	async releaseAfterTerminal(job) {
+		if (job.pauseLeaseId === null) return;
+		for (const name of REVERSE_PARTICIPANTS) {
+			if (!job.pausedParticipants.includes(name)) continue;
+			try {
+				await this.participant(name).resume(job.pauseLeaseId);
+				job.pausedParticipants = job.pausedParticipants.filter((participant) => participant !== name);
+				await this.persist(job);
+			} catch {}
+		}
+	}
+	async startOrResumeMoves(job) {
+		if (job.cancelRequested) return;
+		const mediaMove = job.moves.find((move) => move.storageClass === "eventMedia");
+		if (mediaMove?.moverJobId === null) {
+			mediaMove.moverJobId = await this.startMove(job, mediaMove);
+			await this.persist(job);
+		}
+		const footageMoves = job.moves.filter((move) => move.storageClass !== "eventMedia");
+		for (let index = 0; index < footageMoves.length; index++) {
+			const move = footageMoves[index];
+			if (move.moverJobId !== null) continue;
+			if (!footageMoves.slice(0, index).every((predecessor) => predecessor.state === "done")) return;
+			move.moverJobId = await this.startMove(job, move);
+			await this.persist(job);
 			return;
 		}
-		for (const [id, loc] of Array.from(this.locations)) {
-			if (this.registry.cardinalityOf(loc.type) !== null) continue;
-			if (loc.isSystem) {
-				this.locations.delete(id);
-				if (this.locationStore) this.locationStore.delete(id).catch((err) => {
-					this.logger.error("storage-orchestrator: prune persistence failed", { meta: {
-						id,
-						error: err instanceof Error ? err.message : String(err)
-					} });
-				});
-				this.logger.info("storage-orchestrator: pruned stale system location", { meta: {
-					id,
-					type: loc.type
-				} });
-			} else this.logger.warn("storage-orchestrator: location of undeclared type kept (operator-owned)", { meta: {
-				id,
-				type: loc.type
-			} });
-		}
 	}
-	/**
-	* Resolve a `StorageLocationRef` to a concrete `StorageLocation`.
-	*  - bare type (e.g. `'backups'`) → default location of that type
-	*  - fully-qualified id (e.g. `'backups:nas-01'`) → that exact instance
-	*
-	* Throws an actionable error when nothing matches — every consumer of
-	* the singleton `storage` cap funnels through here, so the error
-	* message is what operators see when the orchestrator's view of the
-	* world doesn't match expectations.
-	*/
-	resolveRef(ref) {
-		if (ref.includes(":")) {
-			const loc = this.locations.get(ref);
-			if (!loc) throw new Error(`Storage location "${ref}" not found`);
-			return loc;
+	async waitForMoves(job) {
+		const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+		const pollMs = this.deps.pollMs ?? 250;
+		for (;;) {
+			if (!job.cancelRequested) await this.startOrResumeMoves(job);
+			let complete = true;
+			for (const [index, move] of job.moves.entries()) {
+				if (job.cancelRequested && move.moverJobId === null) continue;
+				if (move.storageClass !== "eventMedia" && job.moves.slice(0, index).filter((predecessor) => predecessor.storageClass !== "eventMedia").some((predecessor) => predecessor.state !== "done")) {
+					complete = false;
+					continue;
+				}
+				if (move.moverJobId === null) {
+					if (!job.cancelRequested) complete = false;
+					continue;
+				}
+				const status = await this.moveStatus(move);
+				if (status === null) {
+					if (job.cancelRequested) {
+						move.state = "cancelled";
+						continue;
+					}
+					move.moverJobId = await this.startMove(job, move);
+					move.state = "running";
+					await this.persist(job);
+					complete = false;
+					continue;
+				}
+				move.state = status.state;
+				move.error = status.error;
+				if (status.state === "failed") throw new Error(move.error ?? `${move.storageClass} move failed`);
+				if (status.state === "cancelled") {
+					job.cancelRequested = true;
+					continue;
+				}
+				if (status.state !== "done") complete = false;
+			}
+			await this.persist(job);
+			if (complete) return;
+			await sleep(pollMs);
 		}
-		const def = this.getDefaultLocation(ref);
-		if (!def) throw new Error(`No default storage location configured for type "${ref}" — register one or pass a fully-qualified id (\`<type>:<slug>\`)`);
-		return def;
-	}
-	/**
-	* Find the storage-provider that backs a given location — the entry point
-	* every consumer-facing `storage` cap method funnels through.
-	*
-	* Routing key is `(providerId, nodeId)`, never `providerId` alone: every
-	* node's FilesystemStorageProvider registers under the SAME providerId, so
-	* a providerId-only match resolves to whichever node asked. That is how a
-	* location created on an agent ended up writing to the HUB's filesystem
-	* (root-caused 2026-07-29).
-	*/
-	async getProviderFor(location) {
-		return this.getProviderForTarget({
-			providerId: location.providerId,
-			...location.nodeId !== void 0 && { nodeId: location.nodeId }
-		}, `location "${location.id}"`, location.id);
 	}
-	/**
-	* Resolve one dispatch target to the provider that must execute it.
-	*
-	* `descriptor` is the operator-facing subject of the error message
-	* (`location "recordings:disk"`, `uploadId "u-42"`); `locationId` is the
-	* structured tag for the log line when there is a location behind the
-	* dispatch (chunked sessions carry only the session id).
-	*
-	* Both failure branches LOG before throwing, and NEITHER falls back to the
-	* local provider — a silent fallback is the bug this method exists to fix.
-	*/
-	async getProviderForTarget(target, descriptor, locationId) {
-		const nodeId = target.nodeId;
-		if (nodeId !== void 0 && bareNodeId(nodeId) !== this.localNode) {
-			const remote = this.getRemoteProvider?.(nodeId);
-			if (remote) return remote;
-			this.logger.error("storage-orchestrator: target node has no reachable storage-provider — dispatch refused", { meta: {
-				...locationId !== void 0 && { locationId },
-				descriptor,
-				nodeId,
-				providerId: target.providerId,
-				localNodeId: this.localNode,
-				crossNodeResolverWired: this.getRemoteProvider !== void 0
-			} });
-			throw new Error(`storage-provider for ${descriptor} lives on node "${nodeId}" which is not reachable`);
-		}
-		const providers = this.getProviders();
-		for (const p of providers) if ((await p.getProviderInfo()).providerId === target.providerId) return p;
-		this.logger.error("storage-orchestrator: no local storage-provider for providerId", { meta: {
-			...locationId !== void 0 && { locationId },
-			descriptor,
-			providerId: target.providerId,
-			localNodeId: this.localNode,
-			registered: providers.length
-		} });
-		throw new Error(`No storage-provider registered for providerId "${target.providerId}" (${descriptor})`);
+	async verifyMoves(job) {
+		for (const move of job.moves) if (move.state !== "done") throw new Error(`${move.storageClass} move did not complete verification`);
 	}
-	/**
-	* Remember which provider — and on which NODE — opened a chunked session.
-	* `beginUpload` / `beginDownload` carry a `StorageLocation`; every later
-	* chunk carries only the session id, and a session id issued by an agent
-	* means nothing to the hub's provider.
-	*/
-	rememberSession(kind, sessionId, location) {
-		this.sessionTargets.set(sessionKey(kind, sessionId), {
-			providerId: location.providerId,
-			...location.nodeId !== void 0 && { nodeId: location.nodeId }
-		});
+	async startMove(job, move) {
+		if (move.storageClass === "eventMedia") return (await this.deps.participants.analytics.startMove({
+			toLocationId: move.toLocationId,
+			throttleMbps: job.throttleMbps,
+			leaseId: requireLease(job)
+		})).jobId;
+		return (await this.deps.participants.recorder.startMove({
+			fromLocationId: move.fromLocationId,
+			toLocationId: move.toLocationId,
+			footageClass: move.storageClass,
+			throttleMbps: job.throttleMbps,
+			leaseId: requireLease(job)
+		})).jobId;
 	}
-	/** Drop a session's routing entry (finalize / abort / end). */
-	forgetSession(kind, sessionId) {
-		this.sessionTargets.delete(sessionKey(kind, sessionId));
+	async moveStatus(move) {
+		if (move.moverJobId === null) return null;
+		return move.storageClass === "eventMedia" ? this.deps.participants.analytics.getMove(move.moverJobId) : this.deps.participants.recorder.getMove(move.moverJobId);
 	}
-	/** Drop every session entry (addon shutdown). */
-	clearSessions() {
-		this.sessionTargets.clear();
+	async cancelMove(move) {
+		if (move.moverJobId === null) return;
+		if (move.storageClass === "eventMedia") await this.deps.participants.analytics.cancelMove(move.moverJobId);
+		else await this.deps.participants.recorder.cancelMove(move.moverJobId);
 	}
-	/**
-	* Resolve the provider that owns an in-flight chunked session, on the node
-	* that opened it. Throws when the orchestrator has no record of the open
-	* call (provider gone, or a chunk for a session it never issued).
-	*/
-	async getProviderForSession(kind, sessionId) {
-		const vocabulary = SESSION_VOCABULARY[kind];
-		const descriptor = `${vocabulary.idLabel} "${sessionId}"`;
-		const target = this.sessionTargets.get(sessionKey(kind, sessionId));
-		if (!target) {
-			this.logger.error("storage-orchestrator: chunk for an unknown session — dispatch refused", { meta: {
-				descriptor,
-				kind,
-				sessionId
-			} });
-			throw new Error(`Unknown ${vocabulary.idLabel} "${sessionId}" — orchestrator has no record of ${vocabulary.openMethod}`);
-		}
-		return this.getProviderForTarget(target, descriptor);
+	participant(name) {
+		return this.deps.participants[name];
 	}
-	/** Convenience: lookup by id (returns `undefined` if not found). */
-	getLocationById(id) {
-		return this.locations.get(id);
+	async setPhase(job, phase) {
+		job.phase = phase;
+		if (isTerminal(job)) job.finishedAt = this.deps.now();
+		await this.persist(job);
 	}
-	/**
-	* Seed one default `StorageLocation` per addon-declared location that
-	* doesn't already have one. Idempotent — re-running with the same
-	* declarations on a populated map is a no-op (each declared `id`
-	* already resolves to an existing `<id>:default`).
-	*
-	* Convention: the bare-type ref `'recordings'` resolves via
-	* `getDefaultLocation('recordings')` (walks `isDefault === true`); the
-	* actual stored `id` is `'recordings:default'` so it satisfies the
-	* `^[a-z][a-z0-9-]*:[a-z0-9-]+$` regex on `StorageLocationSchema.id`.
-	*
-	* `basePath` is the storage root (e.g. `<CAMSTACK_DATA>`). Each
-	* location's `config.basePath` is `<basePath>/<id>`, except when the
-	* declaration sets `defaultsTo` — then it inherits the resolved root of
-	* the referenced location's default instance (sharing the same root
-	* directory for derivative slots like `recordingsLow` → `recordings`).
-	*/
-	seedDefaults(input) {
-		let added = 0;
-		const declById = new Map(input.declarations.map((d) => [d.id, d]));
-		const rootFor = (d) => {
-			const dedicated = d.defaultRoot === "media" ? input.mediaBasePath : d.defaultRoot === "backup" ? input.backupBasePath : void 0;
-			return path$1.join(dedicated ?? input.basePath, d.id);
-		};
-		for (const d of input.declarations) {
-			if (this.hasAnyLocationOfType(d.id)) continue;
-			const base = d.defaultsTo ? this.getLocationById(`${d.defaultsTo}:default`)?.config["basePath"] ?? rootFor(declById.get(d.defaultsTo) ?? d) : rootFor(d);
-			this.upsertLocation({
-				id: `${d.id}:default`,
-				type: d.id,
-				displayName: d.displayName,
-				providerId: input.providerId,
-				config: { basePath: base },
-				isDefault: true,
-				isSystem: true
-			});
-			added++;
-		}
-		if (added > 0) this.logger.info("storage-orchestrator: seeded default locations", { meta: {
-			added,
-			basePath: input.basePath
-		} });
+	async finishCancelled(job) {
+		job.phase = "cancelled";
+		job.finishedAt = this.deps.now();
+		await this.releaseAfterTerminal(job);
+		await this.persist(job);
 	}
-	/** Internal: check whether any location of the given type exists. */
-	hasAnyLocationOfType(type) {
-		for (const loc of this.locations.values()) if (loc.type === type) return true;
-		return false;
+	async persist(job) {
+		job.updatedAt = this.deps.now();
+		await this.deps.state.set(job);
 	}
 };
-//#endregion
-//#region src/builtins/storage-orchestrator/location-store.ts
-var STORAGE_LOCATIONS = "storage_locations";
-/**
-* Reserved key under which the cluster `nodeId` (SP1) is persisted INSIDE
-* the `config` JSON blob. Storing it in the blob rather than a dedicated
-* column avoids a destructive `ensureTable` DROP+recreate on deploy (a
-* newly-declared column counts as a missing column → the structured
-* backend drops the table, wiping operator location customizations such
-* as `recordings:default`'s `minFreePercent`). The double-underscore
-* prefix keeps it out of the provider-facing config namespace
-* (`basePath`, `minFreePercent`, …) — the mapper strips it on read so
-* API consumers and providers never see it.
-*/
-var NODE_ID_CONFIG_KEY = "__nodeId";
-/**
-* `config` is declared `JSON`, so the store hands the surface an object and
-* gets an object back. There is deliberately NO `node_id` column — `nodeId`
-* rides inside the blob under a reserved key (see {@link NODE_ID_CONFIG_KEY}),
-* because a newly-declared column would put this table through
-* `declareCollection`'s destructive rebuild and wipe operator customizations
-* such as `recordings:default`'s `minFreePercent`.
-*/
-var STORAGE_LOCATIONS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true
-	},
-	{
-		name: "type",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "display_name",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "provider_id",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "config",
-		type: "JSON",
-		notNull: true,
-		defaultValue: "{}"
-	},
-	{
-		name: "is_default",
-		type: "INTEGER",
-		notNull: true,
-		defaultValue: 0
-	},
-	{
-		name: "is_system",
-		type: "INTEGER",
-		notNull: true,
-		defaultValue: 0
-	},
-	{
-		name: "created_at",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "updated_at",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var STORAGE_LOCATIONS_INDEXES = [{
-	name: "idx_storage_locations_type",
-	columns: ["type"]
-}];
-/**
-* `ILocationStore` on the `settings-store` collection surface — the same door
-* every other consumer uses. It holds the `data-store-provider` engine object
-* directly (not the `settings-store` singleton) because since D44 the
-* storage-orchestrator IS that singleton, and asking the registry for it would
-* route this table back through the orchestrator itself.
-*/
-var SqliteLocationStore = class {
-	store;
-	declared = false;
-	constructor(store) {
-		this.store = store;
-	}
-	/**
-	* Lazy `declareCollection` — keeps the constructor cheap and async-free.
-	* Called from every mutation/read path; `declareCollection` is idempotent
-	* (and additive on shape changes), so repeated calls collapse to a no-op.
-	*/
-	async ensureDeclared() {
-		if (this.declared) return;
-		await this.store.declareCollection({
-			collection: STORAGE_LOCATIONS,
-			columns: STORAGE_LOCATIONS_COLUMNS,
-			indexes: STORAGE_LOCATIONS_INDEXES
-		});
-		this.declared = true;
-	}
-	async loadAll() {
-		await this.ensureDeclared();
-		const rows = await this.store.query({
-			collection: STORAGE_LOCATIONS,
-			filter: { orderBy: {
-				field: "created_at",
-				direction: "asc"
-			} }
-		});
-		const out = [];
-		for (const row of rows) {
-			const mapped = mapRowToLocation(row.data);
-			if (mapped) out.push(mapped);
-		}
-		return out;
-	}
-	/**
-	* Replace-or-insert. Implemented as delete + insert rather than a
-	* conditional update because the orchestrator serializes every mutation
-	* through the in-memory map before dispatching to the store — there's no
-	* contention to lose, and delete-then-insert is unconditionally simpler.
-	*/
-	async upsert(loc) {
-		await this.ensureDeclared();
-		await this.store.deleteWhere({
-			collection: STORAGE_LOCATIONS,
-			filter: { where: { id: loc.id } }
-		});
-		await this.store.insert({
-			collection: STORAGE_LOCATIONS,
-			record: {
-				id: loc.id,
-				data: mapLocationToRow(loc)
-			}
-		});
-	}
-	async delete(id) {
-		await this.ensureDeclared();
-		await this.store.deleteWhere({
-			collection: STORAGE_LOCATIONS,
-			filter: { where: { id } }
-		});
-	}
-};
-function isPlainObject(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function readConfig(raw) {
-	if (isPlainObject(raw)) return { ...raw };
-	if (typeof raw === "string" && raw.length > 0) return parseJsonObject(raw) ?? {};
-	return {};
-}
-function mapLocationToRow(loc) {
-	const storedConfig = loc.nodeId !== void 0 ? {
-		...loc.config,
-		[NODE_ID_CONFIG_KEY]: loc.nodeId
-	} : { ...loc.config };
-	return {
-		id: loc.id,
-		type: loc.type,
-		display_name: loc.displayName,
-		provider_id: loc.providerId,
-		config: storedConfig,
-		is_default: loc.isDefault ? 1 : 0,
-		is_system: loc.isSystem ? 1 : 0,
-		created_at: loc.createdAt,
-		updated_at: loc.updatedAt
-	};
-}
-/**
-* Decode a row read from the collection. Returns `null` when the row's `type`
-* fails the id-format schema or the row has no id — a corrupt row (hand-edited,
-* partial migration) is skipped rather than taking the boot read down with it.
-*/
-function mapRowToLocation(row) {
-	const typeRaw = row["type"];
-	const parsedType = StorageLocationTypeSchema.safeParse(typeRaw);
-	if (!parsedType.success) return null;
-	const type = parsedType.data;
-	const id = String(row["id"] ?? "");
-	if (!id) return null;
-	const storedConfig = readConfig(row["config"]);
-	const nodeIdRaw = storedConfig[NODE_ID_CONFIG_KEY];
-	const nodeId = typeof nodeIdRaw === "string" && nodeIdRaw.length > 0 ? nodeIdRaw : void 0;
-	const config = { ...storedConfig };
-	delete config[NODE_ID_CONFIG_KEY];
-	return {
-		id,
-		type,
-		displayName: String(row["display_name"] ?? ""),
-		providerId: String(row["provider_id"] ?? ""),
-		config,
-		...nodeId !== void 0 ? { nodeId } : {},
-		isDefault: row["is_default"] === 1 || row["is_default"] === true,
-		isSystem: row["is_system"] === 1 || row["is_system"] === true,
-		createdAt: Number(row["created_at"] ?? 0),
-		updatedAt: Number(row["updated_at"] ?? 0)
-	};
-}
-//#endregion
-//#region src/builtins/storage-orchestrator/provider-discovery.ts
-async function collectProviderInfos(providers, onError) {
-	const out = [];
-	for (const [index, p] of providers.entries()) try {
-		const info = await p.getProviderInfo();
-		out.push(info);
-	} catch (err) {
-		onError(p, err, index);
-	}
-	return out;
-}
+function requireLease(job) {
+	if (job.pauseLeaseId === null) throw new Error("storage migration has no maintenance lease");
+	return job.pauseLeaseId;
+}
+function isTerminal(job) {
+	return job.phase === "done" || job.phase === "failed" || job.phase === "cancelled";
+}
 //#endregion
 //#region src/builtins/storage-orchestrator/data-store-dispatch.ts
 /**
@@ -838,491 +619,771 @@ function createDataStoreDispatch(getEngines) {
 	};
 }
 //#endregion
-//#region src/builtins/storage-orchestrator/storage-pressure-manager.ts
-var DEFAULT_MAX_ROUNDS = 8;
-var DEFAULT_HYSTERESIS_PERCENT = 1;
-var StoragePressureManager = class {
-	deps;
-	constructor(deps) {
-		this.deps = deps;
+//#region src/builtins/storage-orchestrator/provider-discovery.ts
+async function collectProviderInfos(providers, onError) {
+	const out = [];
+	for (const [index, p] of providers.entries()) try {
+		const info = await p.getProviderInfo();
+		out.push(info);
+	} catch (err) {
+		onError(p, err, index);
+	}
+	return out;
+}
+//#endregion
+//#region src/builtins/storage-orchestrator/storage-orchestrator.service.ts
+/**
+* Routing core for the `storage-orchestrator` builtin.
+*
+* Owns the in-memory `locationId → StorageLocation` map and the
+* `(providerId, nodeId) → IStorageProviderImpl` lookup. Every consumer-facing
+* `storage` cap call lands here:
+*   1. `resolveRef(ref)` — bare type or fully-qualified id → concrete location
+*   2. `getProviderFor(location)` — route `(providerId, nodeId)` to either a
+*      local `storage-provider` registrant or the provider ON the node the
+*      location lives on. `providerId` alone is NOT a routing key: every
+*      node's filesystem provider shares it.
+*   3. `getProviderForSession(kind, id)` — the same routing for chunked I/O,
+*      which carries no location after the opening call.
+*
+* The provider lookup is injected (`getProviders`) so unit tests can
+* pass fixtures without booting a real CapabilityRegistry. The addon
+* wires the production lookup to
+* `ctx.kernel.capabilityRegistry?.getCollection<IStorageProviderImpl>('storage-provider')`.
+*
+* Task 5 adds first-boot seeding of default locations from addon-declared
+* location types (providers no longer gate by type).
+* Task 6 adds an optional `ILocationStore` for SQLite persistence —
+* `initialize()` hydrates the in-memory map from the store, and every
+* `upsertLocation` / `deleteLocation` mirrors the change to the store.
+* Tests pass `null` (or a fake `ILocationStore`) for in-memory-only
+* operation; production wires `SqliteLocationStore`.
+*/
+var SESSION_VOCABULARY = {
+	upload: {
+		idLabel: "uploadId",
+		openMethod: "beginUpload"
+	},
+	download: {
+		idLabel: "downloadId",
+		openMethod: "beginDownload"
+	}
+};
+/** Map key for a tracked chunked session — the id spaces never collide. */
+function sessionKey(kind, sessionId) {
+	return `${kind}:${sessionId}`;
+}
+/**
+* Bare node id for a raw kernel `localNodeId`. Forked children carry a
+* `<node>/<addon>` suffix; routing is per-NODE, so the addon segment is
+* dropped. (Mirrors `normalizeNodeId` in `@camstack/types/addon`, which is a
+* leaf module not re-exported on any subpath this package can import.)
+*/
+function bareNodeId(raw) {
+	if (raw === void 0 || raw === "") return "hub";
+	const slash = raw.indexOf("/");
+	if (slash < 0) return raw;
+	const bare = raw.slice(0, slash);
+	return bare === "" ? "hub" : bare;
+}
+var StorageOrchestratorService = class {
+	logger;
+	getProviders;
+	locationStore;
+	getRemoteProvider;
+	locations = /* @__PURE__ */ new Map();
+	/**
+	* Declaration-driven cardinality source, injected by the addon after
+	* the kernel aggregates `storageLocations` declarations. `null` until
+	* `setRegistry` runs — `upsertLocation` then treats every type as
+	* `'multi'` (no singleton enforcement), the safe default for the
+	* in-memory-only / early-boot path.
+	*/
+	registry = null;
+	/**
+	* Injected `providerId → nodeLocal` resolver (see {@link NodeLocalResolver}).
+	* `null` until {@link setNodeLocalResolver} runs — `upsertLocation` then
+	* skips the node-local requirement check entirely (every provider is
+	* treated as node-agnostic), the safe default for the in-memory-only /
+	* early-boot path that predates the resolver wiring.
+	*/
+	nodeLocalResolver = null;
+	/** `localNodeId` with any forked-child `/addon` suffix stripped. */
+	localNode;
+	/**
+	* `<kind>:<sessionId>` → the dispatch target that OPENED the session.
+	* Chunked I/O carries no `StorageLocation` after the first hop, so without
+	* this the follow-up chunks fall back to a `providerId`-only lookup — which
+	* on a multi-node cluster means the hub's filesystem, not the agent's.
+	*/
+	sessionTargets = /* @__PURE__ */ new Map();
+	constructor(logger, getProviders, locationStore = null, localNodeId = "hub", getRemoteProvider) {
+		this.logger = logger;
+		this.getProviders = getProviders;
+		this.locationStore = locationStore;
+		this.getRemoteProvider = getRemoteProvider;
+		this.localNode = bareNodeId(localNodeId);
+	}
+	/**
+	* The node this orchestrator runs on, with any forked-child `/addon`
+	* suffix stripped. A location whose `nodeId` differs is NOT this node's
+	* to touch — its bytes, and its free space, live elsewhere.
+	*/
+	getLocalNodeId() {
+		return this.localNode;
+	}
+	/** True once a persistence store is wired (constructor or {@link attachStore}). */
+	hasStore() {
+		return this.locationStore !== null;
+	}
+	/**
+	* Late-bind the persistence store (production boot: the `settings-store`
+	* cap registers after the orchestrator initializes, so the service runs
+	* in-memory-only until then). Idempotent — a second call once a store is
+	* wired is a no-op.
+	*
+	* Reconciles both directions so operator edits survive a reboot:
+	*   1. hydrate — DB rows win over any early in-memory seed (restores
+	*      operator config like `minFreePercent` that the pre-store boot
+	*      can't see), with the same `isSystem` upgrade as {@link initialize};
+	*   2. backfill — in-memory locations the DB doesn't have yet (the
+	*      pre-store seed defaults on a fresh install) are persisted, so the
+	*      store becomes the durable source of truth from here on.
+	*/
+	async attachStore(store) {
+		if (this.locationStore) return;
+		this.locationStore = store;
+		const rows = await store.loadAll();
+		const dbIds = new Set(rows.map((r) => r.id));
+		for (const loc of rows) {
+			const upgraded = !loc.isSystem && loc.id === `${loc.type}:default` ? {
+				...loc,
+				isSystem: true
+			} : loc;
+			this.locations.set(upgraded.id, upgraded);
+			if (upgraded !== loc) store.upsert(upgraded).catch(() => {});
+		}
+		const backfill = [...this.locations.values()].filter((l) => !dbIds.has(l.id));
+		for (const loc of backfill) store.upsert(loc).catch((err) => {
+			this.logger.warn("storage-orchestrator: attachStore backfill persist failed", { meta: {
+				id: loc.id,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		});
+		this.logger.info("storage-orchestrator: store attached + reconciled", { meta: {
+			hydrated: rows.length,
+			backfilled: backfill.length,
+			total: this.locations.size
+		} });
+	}
+	/**
+	* Inject the declaration-driven cardinality source. Called once by the
+	* addon after the kernel aggregates every addon's `storageLocations`
+	* declarations into a `StorageLocationRegistry`.
+	*/
+	setRegistry(registry) {
+		this.registry = registry;
+	}
+	/**
+	* Inject the synchronous `providerId → nodeLocal` resolver (SP1). Called
+	* by the addon from a cached snapshot of every `storage-provider`'s
+	* `getProviderInfo().nodeLocal`, refreshed when the provider collection
+	* changes. Powers the node-local upsert guard and the boot backfill.
+	*/
+	setNodeLocalResolver(resolver) {
+		this.nodeLocalResolver = resolver;
+	}
+	/**
+	* The full set of addon-declared storage locations, as aggregated by
+	* the kernel and injected via {@link setRegistry}. Powers the admin-UI
+	* Data screen's per-declaration grouping. Empty until the registry is
+	* injected (early-boot / in-memory-only path).
+	*/
+	listDeclarations() {
+		return this.registry ? this.registry.list() : [];
+	}
+	/**
+	* Hydrate the in-memory map from the persistence layer. Called once
+	* by the addon during `onInitialize`, before the eager seed pass.
+	* Idempotent — running it twice with the same store contents
+	* produces the same map. No-op when the service was constructed
+	* without a store.
+	*
+	* Errors loading individual rows are tolerated: the bad row is
+	* skipped and logged so a single corrupted record doesn't lock the
+	* whole orchestrator out of boot. (The store-side validation pass
+	* before insert means only schema-invalid SQL state can produce
+	* such a row.)
+	*/
+	async initialize() {
+		if (!this.locationStore) return;
+		const rows = await this.locationStore.loadAll();
+		let upgraded = 0;
+		for (const loc of rows) if (!loc.isSystem && loc.id === `${loc.type}:default`) {
+			const upgradedLoc = {
+				...loc,
+				isSystem: true
+			};
+			this.locations.set(upgradedLoc.id, upgradedLoc);
+			this.locationStore.upsert(upgradedLoc).catch((err) => {
+				this.logger.warn("storage-orchestrator: isSystem upgrade persist failed", { meta: {
+					id: upgradedLoc.id,
+					error: err instanceof Error ? err.message : String(err)
+				} });
+			});
+			upgraded++;
+		} else this.locations.set(loc.id, loc);
+		this.logger.info("storage-orchestrator: hydrated locations from store", { meta: {
+			loaded: this.locations.size,
+			isSystemUpgraded: upgraded
+		} });
+	}
+	/**
+	* Boot backfill (SP1): stamp `nodeId` on every persisted node-local
+	* location that lacks one. Single-node deployments seeded their
+	* filesystem locations before `nodeId` existed — they live on `hubNodeId`
+	* (the hub). Node-agnostic (remote) locations are left untouched: their
+	* absent `nodeId` is correct (reachable from any node).
+	*
+	* Idempotent — a location that already carries a `nodeId` (any value) is
+	* never re-touched, so re-running on a populated map (or a re-boot) is a
+	* no-op. A plain local update, not versioned-migration machinery: only
+	* the rows missing `nodeId` are mutated + persisted.
+	*
+	* No-op until the node-local resolver is wired (it classifies which
+	* providers are node-local).
+	*/
+	async backfillNodeIds(hubNodeId) {
+		const resolver = this.nodeLocalResolver;
+		if (!resolver) return;
+		let stamped = 0;
+		for (const [id, loc] of Array.from(this.locations)) {
+			if (loc.nodeId) continue;
+			if (resolver(loc.providerId) !== true) continue;
+			const updated = {
+				...loc,
+				nodeId: hubNodeId,
+				updatedAt: Date.now()
+			};
+			this.locations.set(id, updated);
+			stamped++;
+			if (this.locationStore) try {
+				await this.locationStore.upsert(updated);
+			} catch (err) {
+				this.logger.error("storage-orchestrator: nodeId backfill persist failed", { meta: {
+					id,
+					error: err instanceof Error ? err.message : String(err)
+				} });
+			}
+		}
+		if (stamped > 0) this.logger.info("storage-orchestrator: backfilled nodeId on node-local locations", { meta: {
+			stamped,
+			hubNodeId
+		} });
+	}
+	listLocations(filter) {
+		const all = [...this.locations.values()];
+		return filter?.type ? all.filter((l) => l.type === filter.type) : all;
+	}
+	getDefaultLocation(type) {
+		for (const loc of this.locations.values()) if (loc.type === type && loc.isDefault) return loc;
+		return null;
+	}
+	/**
+	* Repoint several logical defaults as one in-memory commit. The migration
+	* coordinator persists its `repointing` phase before calling this method, so
+	* a process crash during the backing-store writes is recovered by replaying
+	* the same idempotent target set before anyone resumes writers.
+	*/
+	async setDefaultLocations(targetByType) {
+		if (targetByType.size === 0) return;
+		const now = Date.now();
+		const nextById = new Map(this.locations);
+		const touched = /* @__PURE__ */ new Map();
+		for (const [type, targetId] of targetByType) {
+			const target = nextById.get(targetId);
+			if (!target) throw new Error(`Storage location "${targetId}" not found`);
+			if (target.type !== type) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${type}"`);
+			for (const [id, location] of nextById) {
+				if (location.type !== type) continue;
+				const isDefault = id === targetId;
+				const enable = isDefault && location.enabled === false;
+				if (location.isDefault === isDefault && !enable) continue;
+				const updated = {
+					...location,
+					isDefault,
+					...enable ? { enabled: true } : {},
+					updatedAt: now
+				};
+				nextById.set(id, updated);
+				touched.set(id, updated);
+			}
+		}
+		if (this.locationStore) {
+			const previous = /* @__PURE__ */ new Map();
+			for (const id of touched.keys()) {
+				const location = this.locations.get(id);
+				if (location) previous.set(id, location);
+			}
+			try {
+				for (const location of touched.values()) await this.locationStore.upsert(location);
+			} catch (err) {
+				for (const location of previous.values()) try {
+					await this.locationStore.upsert(location);
+				} catch {}
+				throw err;
+			}
+		}
+		this.locations.clear();
+		for (const [id, location] of nextById) this.locations.set(id, location);
+	}
+	/**
+	* Insert or update a location. If `isDefault: true`, atomically
+	* demotes any other default for the same type — operators always see
+	* exactly one default per type.
+	*
+	* When a persistence store is wired (Task 6), the new record AND any
+	* implicitly-demoted siblings are persisted before the in-memory map
+	* mutation returns. Persistence errors propagate to the caller.
+	*/
+	upsertLocation(input) {
+		const now = Date.now();
+		const existing = this.locations.get(input.id);
+		if (!existing) {
+			if ((this.registry?.cardinalityOf(input.type) ?? "multi") === "single") {
+				const already = [...this.locations.values()].find((l) => l.type === input.type);
+				if (already) throw new Error(`Storage type "${input.type}" is single — only one location allowed (existing: "${already.id}"). Edit it instead of adding a new one.`);
+			}
+		}
+		if (this.nodeLocalResolver?.(input.providerId) === true && !input.nodeId) input = {
+			...input,
+			nodeId: "hub"
+		};
+		if (existing?.isSystem === true) input = {
+			...input,
+			isSystem: true
+		};
+		input = {
+			...input,
+			...resolveEnabled(input, existing, this.hasAnyLocationOfType(input.type))
+		};
+		const next = {
+			...input,
+			createdAt: existing?.createdAt ?? now,
+			updatedAt: now
+		};
+		const demoted = [];
+		if (next.isDefault) {
+			for (const [otherId, otherLoc] of this.locations) if (otherLoc.type === next.type && otherLoc.id !== next.id && otherLoc.isDefault) {
+				const updated = {
+					...otherLoc,
+					isDefault: false,
+					updatedAt: now
+				};
+				this.locations.set(otherId, updated);
+				demoted.push(updated);
+			}
+		}
+		this.locations.set(next.id, next);
+		this.logger.debug("storage-orchestrator: upsertLocation", { meta: {
+			id: next.id,
+			type: next.type,
+			providerId: next.providerId,
+			isDefault: next.isDefault
+		} });
+		if (this.locationStore) {
+			const store = this.locationStore;
+			(async () => {
+				try {
+					for (const d of demoted) await store.upsert(d);
+					await store.upsert(next);
+				} catch (err) {
+					this.logger.error("storage-orchestrator: upsert persistence failed", { meta: {
+						id: next.id,
+						error: err instanceof Error ? err.message : String(err)
+					} });
+				}
+			})();
+		}
+		return next;
+	}
+	/**
+	* Remove a location. Refuses to remove the default of a type unless a
+	* sibling default exists (defensive — `upsertLocation` already ensures
+	* at most one default per type, but the logic guards against future
+	* bypass paths e.g. SQLite migration that imports two defaults).
+	*
+	* Persistence (Task 6) mirrors the delete asynchronously, with errors
+	* routed to the logger — see `upsertLocation` for the rationale.
+	*/
+	deleteLocation(id) {
+		const loc = this.locations.get(id);
+		if (!loc) throw new Error(`Storage location "${id}" not found`);
+		if (loc.isSystem) throw new Error(`Storage location "${id}" is system-managed and cannot be deleted. Edit its config (path / providerId) instead.`);
+		if (loc.isDefault) {
+			if (![...this.locations.values()].find((l) => l.type === loc.type && l.id !== id && l.isDefault)) throw new Error(`Cannot delete default location "${id}" for type "${loc.type}" — promote another location to default first`);
+		}
+		this.locations.delete(id);
+		if (this.locationStore) this.locationStore.delete(id).catch((err) => {
+			this.logger.error("storage-orchestrator: delete persistence failed", { meta: {
+				id,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		});
 	}
-	/** Relieve every managed location currently under its threshold. */
-	async sweep() {
-		const thresholds = await this.deps.getLocationThresholds();
-		const relievedDevices = /* @__PURE__ */ new Set();
-		for (const [locationId, threshold] of thresholds) {
-			if (threshold <= 0) continue;
-			const deviceKey = await this.deps.getLocationDeviceKey?.(locationId) ?? null;
-			if (deviceKey !== null && relievedDevices.has(deviceKey)) {
-				this.deps.logger.debug("storage pressure: skipping location — physical device already relieved this sweep", { meta: {
-					locationId,
-					deviceKey
-				} });
-				continue;
-			}
-			try {
-				if (await this.relieveLocation(locationId, threshold) && deviceKey !== null) relievedDevices.add(deviceKey);
-			} catch (err) {
-				this.deps.logger.warn("storage pressure: relief failed for location", { meta: {
-					locationId,
-					error: err instanceof Error ? err.message : String(err)
-				} });
-			}
+	/**
+	* Remove system-seeded locations whose type is no longer declared by any
+	* addon (stale defaults from a removed location type). Operator-added
+	* (non-system) locations of an undeclared type are KEPT but warned — the
+	* operator owns them. Requires the registry to be set first.
+	*
+	* FAIL-SAFE: if the registry is EMPTY (no addon declared any location), we
+	* refuse to prune anything. An empty registry almost always means
+	* declarations failed to load (boot ordering, a stale install) — pruning
+	* "everything undeclared" in that state would wipe every system location
+	* (data/logs/recordings/…). Better to keep stale rows than destroy live ones.
+	*/
+	pruneUndeclaredSystemLocations() {
+		if (!this.registry) return;
+		if (this.registry.list().length === 0) {
+			this.logger.warn("storage-orchestrator: skipping prune — no location declarations loaded (fail-safe)");
+			return;
 		}
-		const caps = await this.deps.getLocationMaxUsedBytes?.() ?? /* @__PURE__ */ new Map();
-		for (const [locationId, maxBytes] of caps) {
-			if (relievedDevices.size > 0) {
-				const deviceKey = await this.deps.getLocationDeviceKey?.(locationId) ?? null;
-				if (deviceKey !== null && relievedDevices.has(deviceKey)) continue;
-			}
-			try {
-				await this.relieveToUsageCap(locationId, maxBytes);
-			} catch (err) {
-				this.deps.logger.warn("storage pressure: usage-cap relief failed", { meta: {
-					locationId,
-					error: err instanceof Error ? err.message : String(err)
+		for (const [id, loc] of Array.from(this.locations)) {
+			if (this.registry.cardinalityOf(loc.type) !== null) continue;
+			if (loc.isSystem) {
+				this.locations.delete(id);
+				if (this.locationStore) this.locationStore.delete(id).catch((err) => {
+					this.logger.error("storage-orchestrator: prune persistence failed", { meta: {
+						id,
+						error: err instanceof Error ? err.message : String(err)
+					} });
+				});
+				this.logger.info("storage-orchestrator: pruned stale system location", { meta: {
+					id,
+					type: loc.type
 				} });
-			}
+			} else this.logger.warn("storage-orchestrator: location of undeclared type kept (operator-owned)", { meta: {
+				id,
+				type: loc.type
+			} });
 		}
 	}
-	/** Evict oldest-first until the location's evictable usage fits `maxBytes`. */
-	async relieveToUsageCap(locationId, maxBytes) {
-		const maxRounds = this.deps.maxRounds ?? DEFAULT_MAX_ROUNDS;
-		for (let round = 0; round < maxRounds; round++) {
-			const providers = this.deps.getEvictableProviders();
-			const usages = await Promise.all(providers.map(async (p) => ({
-				p,
-				bytes: (await p.getEvictableUsage({ locationId })).bytes
-			})));
-			const totalUsed = usages.reduce((s, u) => s + u.bytes, 0);
-			const excess = totalUsed - maxBytes;
-			if (excess <= 0) return;
-			let reclaimed = 0;
-			for (const u of usages) {
-				if (u.bytes <= 0) continue;
-				const share = Math.max(1, Math.ceil(excess * u.bytes / totalUsed));
-				const res = await u.p.evict({
-					locationId,
-					targetBytes: share
-				});
-				reclaimed += res.reclaimedBytes;
-			}
-			this.deps.logger.info("storage pressure: usage-cap relief round", { meta: {
-				locationId,
-				round,
-				totalUsed,
-				maxBytes,
-				reclaimedBytes: reclaimed
+	/**
+	* Resolve a `StorageLocationRef` to a concrete `StorageLocation`.
+	*  - bare type (e.g. `'backups'`) → default location of that type
+	*  - fully-qualified id (e.g. `'backups:nas-01'`) → that exact instance
+	*
+	* Throws an actionable error when nothing matches — every consumer of
+	* the singleton `storage` cap funnels through here, so the error
+	* message is what operators see when the orchestrator's view of the
+	* world doesn't match expectations.
+	*/
+	resolveRef(ref) {
+		if (ref.includes(":")) {
+			const loc = this.locations.get(ref);
+			if (!loc) throw new Error(`Storage location "${ref}" not found`);
+			return loc;
+		}
+		const def = this.getDefaultLocation(ref);
+		if (!def) throw new Error(`No default storage location configured for type "${ref}" — register one or pass a fully-qualified id (\`<type>:<slug>\`)`);
+		return def;
+	}
+	/**
+	* Find the storage-provider that backs a given location — the entry point
+	* every consumer-facing `storage` cap method funnels through.
+	*
+	* Routing key is `(providerId, nodeId)`, never `providerId` alone: every
+	* node's FilesystemStorageProvider registers under the SAME providerId, so
+	* a providerId-only match resolves to whichever node asked. That is how a
+	* location created on an agent ended up writing to the HUB's filesystem
+	* (root-caused 2026-07-29).
+	*/
+	async getProviderFor(location) {
+		return this.getProviderForTarget({
+			providerId: location.providerId,
+			...location.nodeId !== void 0 && { nodeId: location.nodeId }
+		}, `location "${location.id}"`, location.id);
+	}
+	/**
+	* Resolve one dispatch target to the provider that must execute it.
+	*
+	* `descriptor` is the operator-facing subject of the error message
+	* (`location "recordings:disk"`, `uploadId "u-42"`); `locationId` is the
+	* structured tag for the log line when there is a location behind the
+	* dispatch (chunked sessions carry only the session id).
+	*
+	* Both failure branches LOG before throwing, and NEITHER falls back to the
+	* local provider — a silent fallback is the bug this method exists to fix.
+	*/
+	async getProviderForTarget(target, descriptor, locationId) {
+		const nodeId = target.nodeId;
+		if (nodeId !== void 0 && bareNodeId(nodeId) !== this.localNode) {
+			const remote = this.getRemoteProvider?.(nodeId);
+			if (remote) return remote;
+			this.logger.error("storage-orchestrator: target node has no reachable storage-provider — dispatch refused", { meta: {
+				...locationId !== void 0 && { locationId },
+				descriptor,
+				nodeId,
+				providerId: target.providerId,
+				localNodeId: this.localNode,
+				crossNodeResolverWired: this.getRemoteProvider !== void 0
 			} });
-			if (reclaimed <= 0) return;
+			throw new Error(`storage-provider for ${descriptor} lives on node "${nodeId}" which is not reachable`);
 		}
+		const providers = this.getProviders();
+		for (const p of providers) if ((await p.getProviderInfo()).providerId === target.providerId) return p;
+		this.logger.error("storage-orchestrator: no local storage-provider for providerId", { meta: {
+			...locationId !== void 0 && { locationId },
+			descriptor,
+			providerId: target.providerId,
+			localNodeId: this.localNode,
+			registered: providers.length
+		} });
+		throw new Error(`No storage-provider registered for providerId "${target.providerId}" (${descriptor})`);
 	}
 	/**
-	* Relieve one location until it recovers, nothing is evictable, or a round
-	* makes no progress. Returns `true` when at least one relief round actually
-	* reclaimed bytes (so the caller marks the location's physical device relieved
-	* for this sweep — the trigger for the over-eviction dedup: freed bytes mean a
-	* sibling alias may re-read a not-yet-settled `statfs`), `false` when nothing
-	* was freed (never breached, or breached with no evictable data).
+	* Remember which provider — and on which NODE — opened a chunked session.
+	* `beginUpload` / `beginDownload` carry a `StorageLocation`; every later
+	* chunk carries only the session id, and a session id issued by an agent
+	* means nothing to the hub's provider.
 	*/
-	async relieveLocation(locationId, threshold) {
-		const maxRounds = this.deps.maxRounds ?? DEFAULT_MAX_ROUNDS;
-		const hysteresis = this.deps.hysteresisPercent ?? DEFAULT_HYSTERESIS_PERCENT;
-		let reclaimedAny = false;
-		for (let round = 0; round < maxRounds; round++) {
-			const free = await this.deps.getFreePercent(locationId);
-			if (free >= threshold) return reclaimedAny;
-			const total = await this.deps.getVolumeTotalBytes(locationId);
-			const deficitPercent = threshold - free + hysteresis;
-			const targetBytes = Math.ceil(total * deficitPercent / 100);
-			if (targetBytes <= 0) return reclaimedAny;
-			const providers = this.deps.getEvictableProviders();
-			const usages = await Promise.all(providers.map(async (p) => ({
-				p,
-				bytes: (await p.getEvictableUsage({ locationId })).bytes
-			})));
-			const totalEvictable = usages.reduce((s, u) => s + u.bytes, 0);
-			if (totalEvictable <= 0) {
-				this.deps.logger.debug("storage pressure: breach but no evictable data on location", { meta: {
-					locationId,
-					freePercent: free,
-					threshold
-				} });
-				return reclaimedAny;
-			}
-			let reclaimed = 0;
-			for (const u of usages) {
-				if (u.bytes <= 0) continue;
-				const share = Math.max(1, Math.ceil(targetBytes * u.bytes / totalEvictable));
-				const res = await u.p.evict({
-					locationId,
-					targetBytes: share
-				});
-				reclaimed += res.reclaimedBytes;
-			}
-			if (reclaimed > 0) reclaimedAny = true;
-			this.deps.logger.info("storage pressure: relief round", { meta: {
-				locationId,
-				round,
-				freePercent: free,
-				threshold,
-				targetBytes,
-				reclaimedBytes: reclaimed
+	rememberSession(kind, sessionId, location) {
+		this.sessionTargets.set(sessionKey(kind, sessionId), {
+			providerId: location.providerId,
+			...location.nodeId !== void 0 && { nodeId: location.nodeId }
+		});
+	}
+	/** Drop a session's routing entry (finalize / abort / end). */
+	forgetSession(kind, sessionId) {
+		this.sessionTargets.delete(sessionKey(kind, sessionId));
+	}
+	/** Drop every session entry (addon shutdown). */
+	clearSessions() {
+		this.sessionTargets.clear();
+	}
+	/**
+	* Resolve the provider that owns an in-flight chunked session, on the node
+	* that opened it. Throws when the orchestrator has no record of the open
+	* call (provider gone, or a chunk for a session it never issued).
+	*/
+	async getProviderForSession(kind, sessionId) {
+		const vocabulary = SESSION_VOCABULARY[kind];
+		const descriptor = `${vocabulary.idLabel} "${sessionId}"`;
+		const target = this.sessionTargets.get(sessionKey(kind, sessionId));
+		if (!target) {
+			this.logger.error("storage-orchestrator: chunk for an unknown session — dispatch refused", { meta: {
+				descriptor,
+				kind,
+				sessionId
 			} });
-			if (reclaimed <= 0) return reclaimedAny;
+			throw new Error(`Unknown ${vocabulary.idLabel} "${sessionId}" — orchestrator has no record of ${vocabulary.openMethod}`);
 		}
-		return reclaimedAny;
+		return this.getProviderForTarget(target, descriptor);
+	}
+	/** Convenience: lookup by id (returns `undefined` if not found). */
+	getLocationById(id) {
+		return this.locations.get(id);
+	}
+	/**
+	* Seed one default `StorageLocation` per addon-declared location that
+	* doesn't already have one. Idempotent — re-running with the same
+	* declarations on a populated map is a no-op (each declared `id`
+	* already resolves to an existing `<id>:default`).
+	*
+	* Convention: the bare-type ref `'recordings'` resolves via
+	* `getDefaultLocation('recordings')` (walks `isDefault === true`); the
+	* actual stored `id` is `'recordings:default'` so it satisfies the
+	* `^[a-z][a-z0-9-]*:[a-z0-9-]+$` regex on `StorageLocationSchema.id`.
+	*
+	* `basePath` is the storage root (e.g. `<CAMSTACK_DATA>`). Each
+	* location's `config.basePath` is `<basePath>/<id>`, except when the
+	* declaration sets `defaultsTo` — then it inherits the resolved root of
+	* the referenced location's default instance (sharing the same root
+	* directory for derivative slots like `recordingsLow` → `recordings`).
+	*/
+	seedDefaults(input) {
+		let added = 0;
+		const declById = new Map(input.declarations.map((d) => [d.id, d]));
+		const rootFor = (d) => {
+			const dedicated = d.defaultRoot === "media" ? input.mediaBasePath : d.defaultRoot === "backup" ? input.backupBasePath : void 0;
+			return path$1.join(dedicated ?? input.basePath, d.id);
+		};
+		for (const d of input.declarations) {
+			if (this.hasAnyLocationOfType(d.id)) continue;
+			const base = d.defaultsTo ? this.getLocationById(`${d.defaultsTo}:default`)?.config["basePath"] ?? rootFor(declById.get(d.defaultsTo) ?? d) : rootFor(d);
+			this.upsertLocation({
+				id: `${d.id}:default`,
+				type: d.id,
+				displayName: d.displayName,
+				providerId: input.providerId,
+				config: { basePath: base },
+				isDefault: true,
+				isSystem: true
+			});
+			added++;
+		}
+		if (added > 0) this.logger.info("storage-orchestrator: seeded default locations", { meta: {
+			added,
+			basePath: input.basePath
+		} });
+	}
+	/** Internal: check whether any location of the given type exists. */
+	hasAnyLocationOfType(type) {
+		for (const loc of this.locations.values()) if (loc.type === type) return true;
+		return false;
 	}
 };
-//#endregion
-//#region src/builtins/storage-orchestrator/storage-migration-coordinator.ts
-var STORAGE_CLASSES = [
-	"recordings",
-	"recordingsLow",
-	"eventMedia"
-];
-var PARTICIPANTS = [
-	"pipeline",
-	"recorder",
-	"analytics"
-];
-var REVERSE_PARTICIPANTS = [
-	"analytics",
-	"recorder",
-	"pipeline"
-];
 /**
-* Durable orchestration layer over the independent recorder and event-media
-* movers. It owns the only public migration state machine; participants expose
-* intentionally narrow lease/move primitives and never alter camera settings.
+* Resolve `enabled` for one upsert — see the call site in `upsertLocation` for
+* the ordered rules. Pure: every input it needs is a parameter.
 */
-var StorageMigrationCoordinator = class {
+function resolveEnabled(input, existing, typeAlreadyHasLocation) {
+	const requested = input.enabled ?? existing?.enabled;
+	if (requested === void 0) {
+		if (existing) return {};
+		return { enabled: input.isDefault || !typeAlreadyHasLocation };
+	}
+	if (input.isDefault && requested === false) return { enabled: true };
+	return { enabled: requested };
+}
+//#endregion
+//#region src/builtins/storage-orchestrator/storage-pressure-manager.ts
+var DEFAULT_MAX_ROUNDS = 8;
+var DEFAULT_HYSTERESIS_PERCENT = 1;
+var StoragePressureManager = class {
 	deps;
-	active = null;
-	runPromise = null;
-	startReserved = false;
 	constructor(deps) {
 		this.deps = deps;
 	}
-	async plan(input) {
-		const moves = [];
-		for (const storageClass of STORAGE_CLASSES) {
-			const targetId = input.destinations[storageClass];
-			if (targetId === void 0) continue;
-			const source = this.deps.locations.getDefaultLocation(storageClass);
-			if (!source) throw new Error(`No default storage location for "${storageClass}"`);
-			const target = this.deps.locations.getLocationById(targetId);
-			if (!target) throw new Error(`Storage location "${targetId}" not found`);
-			if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
-			if (source.id === target.id) throw new Error(`Storage location "${targetId}" is already the "${storageClass}" default`);
-			moves.push({
-				storageClass,
-				fromLocationId: source.id,
-				toLocationId: target.id,
-				moverJobId: null,
-				state: null,
-				error: null
-			});
-		}
-		if (moves.length === 0) throw new Error("select at least one storage class");
-		return {
-			destinations: input.destinations,
-			moves: moves.map(({ storageClass, fromLocationId, toLocationId }) => ({
-				storageClass,
-				fromLocationId,
-				toLocationId
-			}))
-		};
-	}
-	async start(input) {
-		if (this.startReserved) throw new Error("storage migration is already active");
-		this.startReserved = true;
-		try {
-			const existing = await this.status();
-			if (existing && isTerminal(existing) && existing.pausedParticipants.length > 0) {
-				await this.releaseAfterTerminal(existing);
-				await this.persist(existing);
-				if (existing.pausedParticipants.length > 0) throw new Error(`storage migration ${existing.jobId} still holds maintenance leases`);
-			}
-			if (existing && !isTerminal(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
-			const plan = await this.plan(input);
-			const now = this.deps.now();
-			const job = {
-				jobId: this.deps.newId(),
-				phase: "planning",
-				destinations: input.destinations,
-				throttleMbps: input.throttleMbps ?? 40,
-				moves: plan.moves.map((move) => ({
-					...move,
-					moverJobId: null,
-					state: null,
-					error: null
-				})),
-				pauseLeaseId: null,
-				pausedParticipants: [],
-				repointed: false,
-				cancelRequested: false,
-				startedAt: now,
-				updatedAt: now,
-				finishedAt: null,
-				error: null
-			};
-			this.active = job;
-			await this.persist(job);
-			this.runPromise = this.run(job);
-			this.runPromise;
-			return job.jobId;
-		} finally {
-			this.startReserved = false;
-		}
-	}
-	async status(jobId) {
-		const job = this.active ?? await this.deps.state.get();
-		if (jobId !== void 0 && job?.jobId !== jobId) return null;
-		return job;
-	}
-	async cancel(jobId) {
-		const job = await this.status(jobId);
-		if (!job || isTerminal(job) || job.repointed) return false;
-		job.cancelRequested = true;
-		await this.persist(job);
-		await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
-		return true;
-	}
-	/** Boot recovery resumes a durable unfinished state. A missing in-memory
-	* child mover is recreated from the same copy-if-absent input. */
-	async recover() {
-		const job = await this.deps.state.get();
-		if (!job) return;
-		if (job.cancelRequested) {
-			await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
-			await this.waitForMoves(job);
-			await this.releaseAfterTerminal(job);
-			job.phase = "cancelled";
-			job.finishedAt ??= this.deps.now();
-			await this.persist(job);
-			return;
-		}
-		if (isTerminal(job)) {
-			if (job.pausedParticipants.length > 0) {
-				await this.releaseAfterTerminal(job);
-				await this.persist(job);
-			}
-			return;
-		}
-		this.active = job;
-		job.pauseLeaseId ??= this.deps.newId();
-		if (job.repointed && job.phase === "resuming") job.phase = "refreshing";
-		await this.persist(job);
-		try {
-			await this.pauseParticipants(job, true);
-		} catch (err) {
-			job.error = err instanceof Error ? err.message : String(err);
-			await this.persist(job);
-			return;
-		}
-		if (this.runPromise === null) {
-			this.runPromise = this.run(job);
-			this.runPromise;
-		}
-	}
-	async run(job) {
-		try {
-			if (job.phase === "planning") await this.setPhase(job, "pausing");
-			if (job.phase === "pausing") {
-				job.pauseLeaseId ??= job.jobId;
-				await this.pauseParticipants(job);
-				if (job.cancelRequested) return this.finishCancelled(job);
-				await this.setPhase(job, "moving");
-			}
-			if (job.phase === "moving") {
-				await this.startOrResumeMoves(job);
-				await this.waitForMoves(job);
-				if (job.cancelRequested) return this.finishCancelled(job);
-				await this.setPhase(job, "verifying");
-			}
-			if (job.phase === "verifying") {
-				await this.verifyMoves(job);
-				if (job.cancelRequested) return this.finishCancelled(job);
-				await this.setPhase(job, "repointing");
-			}
-			if (job.phase === "repointing") {
-				const targets = new Map(job.moves.map((move) => [move.storageClass, move.toLocationId]));
-				await this.deps.locations.setDefaultLocations(targets);
-				job.repointed = true;
-				await this.setPhase(job, "refreshing");
-			}
-			if (job.phase === "refreshing") {
-				const leaseId = requireLease(job);
-				if (job.moves.some((move) => move.storageClass !== "eventMedia")) await this.deps.participants.recorder.refresh(leaseId);
-				if (job.moves.some((move) => move.storageClass === "eventMedia")) await this.deps.participants.analytics.refresh(leaseId);
-				await this.setPhase(job, "resuming");
-			}
-			if (job.phase === "resuming") {
-				await this.resumeParticipants(job);
-				await this.setPhase(job, "done");
-			}
-		} catch (err) {
-			job.error = err instanceof Error ? err.message : String(err);
-			if (job.repointed) {
-				job.phase = "refreshing";
-				job.finishedAt = null;
-				await this.persist(job);
-				return;
+	/** Relieve every managed location currently under its threshold. */
+	async sweep() {
+		const thresholds = await this.deps.getLocationThresholds();
+		const relievedDevices = /* @__PURE__ */ new Set();
+		for (const [locationId, threshold] of thresholds) {
+			if (threshold <= 0) continue;
+			const deviceKey = await this.deps.getLocationDeviceKey?.(locationId) ?? null;
+			if (deviceKey !== null && relievedDevices.has(deviceKey)) {
+				this.deps.logger.debug("storage pressure: skipping location — physical device already relieved this sweep", { meta: {
+					locationId,
+					deviceKey
+				} });
+				continue;
 			}
-			job.phase = "failed";
-			job.finishedAt = this.deps.now();
-			await this.releaseAfterTerminal(job);
-			await this.persist(job);
-		} finally {
-			if (isTerminal(job)) {
-				await this.releaseAfterTerminal(job);
-				this.active = job;
+			try {
+				if (await this.relieveLocation(locationId, threshold) && deviceKey !== null) relievedDevices.add(deviceKey);
+			} catch (err) {
+				this.deps.logger.warn("storage pressure: relief failed for location", { meta: {
+					locationId,
+					error: err instanceof Error ? err.message : String(err)
+				} });
 			}
-			this.runPromise = null;
-		}
-	}
-	async pauseParticipants(job, reacquire = false) {
-		const leaseId = requireLease(job);
-		for (const name of PARTICIPANTS) {
-			if (job.cancelRequested) return;
-			if (!reacquire && job.pausedParticipants.includes(name)) continue;
-			await this.participant(name).pause(leaseId);
-			if (!job.pausedParticipants.includes(name)) job.pausedParticipants.push(name);
-			await this.persist(job);
-		}
-	}
-	async resumeParticipants(job) {
-		const leaseId = requireLease(job);
-		for (const name of REVERSE_PARTICIPANTS) {
-			if (!job.pausedParticipants.includes(name)) continue;
-			await this.participant(name).resume(leaseId);
-			job.pausedParticipants = job.pausedParticipants.filter((participant) => participant !== name);
-			await this.persist(job);
 		}
-	}
-	async releaseAfterTerminal(job) {
-		if (job.pauseLeaseId === null) return;
-		for (const name of REVERSE_PARTICIPANTS) {
-			if (!job.pausedParticipants.includes(name)) continue;
+		const caps = await this.deps.getLocationMaxUsedBytes?.() ?? /* @__PURE__ */ new Map();
+		for (const [locationId, maxBytes] of caps) {
+			if (relievedDevices.size > 0) {
+				const deviceKey = await this.deps.getLocationDeviceKey?.(locationId) ?? null;
+				if (deviceKey !== null && relievedDevices.has(deviceKey)) continue;
+			}
 			try {
-				await this.participant(name).resume(job.pauseLeaseId);
-				job.pausedParticipants = job.pausedParticipants.filter((participant) => participant !== name);
-				await this.persist(job);
-			} catch {}
+				await this.relieveToUsageCap(locationId, maxBytes);
+			} catch (err) {
+				this.deps.logger.warn("storage pressure: usage-cap relief failed", { meta: {
+					locationId,
+					error: err instanceof Error ? err.message : String(err)
+				} });
+			}
 		}
 	}
-	async startOrResumeMoves(job) {
-		if (job.cancelRequested) return;
-		const mediaMove = job.moves.find((move) => move.storageClass === "eventMedia");
-		if (mediaMove?.moverJobId === null) {
-			mediaMove.moverJobId = await this.startMove(job, mediaMove);
-			await this.persist(job);
-		}
-		const footageMoves = job.moves.filter((move) => move.storageClass !== "eventMedia");
-		for (let index = 0; index < footageMoves.length; index++) {
-			const move = footageMoves[index];
-			if (move.moverJobId !== null) continue;
-			if (!footageMoves.slice(0, index).every((predecessor) => predecessor.state === "done")) return;
-			move.moverJobId = await this.startMove(job, move);
-			await this.persist(job);
-			return;
+	/** Evict oldest-first until the location's evictable usage fits `maxBytes`. */
+	async relieveToUsageCap(locationId, maxBytes) {
+		const maxRounds = this.deps.maxRounds ?? DEFAULT_MAX_ROUNDS;
+		for (let round = 0; round < maxRounds; round++) {
+			const providers = this.deps.getEvictableProviders();
+			const usages = await Promise.all(providers.map(async (p) => ({
+				p,
+				bytes: (await p.getEvictableUsage({ locationId })).bytes
+			})));
+			const totalUsed = usages.reduce((s, u) => s + u.bytes, 0);
+			const excess = totalUsed - maxBytes;
+			if (excess <= 0) return;
+			let reclaimed = 0;
+			for (const u of usages) {
+				if (u.bytes <= 0) continue;
+				const share = Math.max(1, Math.ceil(excess * u.bytes / totalUsed));
+				const res = await u.p.evict({
+					locationId,
+					targetBytes: share
+				});
+				reclaimed += res.reclaimedBytes;
+			}
+			this.deps.logger.info("storage pressure: usage-cap relief round", { meta: {
+				locationId,
+				round,
+				totalUsed,
+				maxBytes,
+				reclaimedBytes: reclaimed
+			} });
+			if (reclaimed <= 0) return;
 		}
 	}
-	async waitForMoves(job) {
-		const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-		const pollMs = this.deps.pollMs ?? 250;
-		for (;;) {
-			if (!job.cancelRequested) await this.startOrResumeMoves(job);
-			let complete = true;
-			for (const [index, move] of job.moves.entries()) {
-				if (job.cancelRequested && move.moverJobId === null) continue;
-				if (move.storageClass !== "eventMedia" && job.moves.slice(0, index).filter((predecessor) => predecessor.storageClass !== "eventMedia").some((predecessor) => predecessor.state !== "done")) {
-					complete = false;
-					continue;
-				}
-				if (move.moverJobId === null) {
-					if (!job.cancelRequested) complete = false;
-					continue;
-				}
-				const status = await this.moveStatus(move);
-				if (status === null) {
-					if (job.cancelRequested) {
-						move.state = "cancelled";
-						continue;
-					}
-					move.moverJobId = await this.startMove(job, move);
-					move.state = "running";
-					await this.persist(job);
-					complete = false;
-					continue;
-				}
-				move.state = status.state;
-				move.error = status.error;
-				if (status.state === "failed") throw new Error(move.error ?? `${move.storageClass} move failed`);
-				if (status.state === "cancelled") {
-					job.cancelRequested = true;
-					continue;
-				}
-				if (status.state !== "done") complete = false;
+	/**
+	* Relieve one location until it recovers, nothing is evictable, or a round
+	* makes no progress. Returns `true` when at least one relief round actually
+	* reclaimed bytes (so the caller marks the location's physical device relieved
+	* for this sweep — the trigger for the over-eviction dedup: freed bytes mean a
+	* sibling alias may re-read a not-yet-settled `statfs`), `false` when nothing
+	* was freed (never breached, or breached with no evictable data).
+	*/
+	async relieveLocation(locationId, threshold) {
+		const maxRounds = this.deps.maxRounds ?? DEFAULT_MAX_ROUNDS;
+		const hysteresis = this.deps.hysteresisPercent ?? DEFAULT_HYSTERESIS_PERCENT;
+		let reclaimedAny = false;
+		for (let round = 0; round < maxRounds; round++) {
+			const free = await this.deps.getFreePercent(locationId);
+			if (free >= threshold) return reclaimedAny;
+			const total = await this.deps.getVolumeTotalBytes(locationId);
+			const deficitPercent = threshold - free + hysteresis;
+			const targetBytes = Math.ceil(total * deficitPercent / 100);
+			if (targetBytes <= 0) return reclaimedAny;
+			const providers = this.deps.getEvictableProviders();
+			const usages = await Promise.all(providers.map(async (p) => ({
+				p,
+				bytes: (await p.getEvictableUsage({ locationId })).bytes
+			})));
+			const totalEvictable = usages.reduce((s, u) => s + u.bytes, 0);
+			if (totalEvictable <= 0) {
+				this.deps.logger.debug("storage pressure: breach but no evictable data on location", { meta: {
+					locationId,
+					freePercent: free,
+					threshold
+				} });
+				return reclaimedAny;
 			}
-			await this.persist(job);
-			if (complete) return;
-			await sleep(pollMs);
+			let reclaimed = 0;
+			for (const u of usages) {
+				if (u.bytes <= 0) continue;
+				const share = Math.max(1, Math.ceil(targetBytes * u.bytes / totalEvictable));
+				const res = await u.p.evict({
+					locationId,
+					targetBytes: share
+				});
+				reclaimed += res.reclaimedBytes;
+			}
+			if (reclaimed > 0) reclaimedAny = true;
+			this.deps.logger.info("storage pressure: relief round", { meta: {
+				locationId,
+				round,
+				freePercent: free,
+				threshold,
+				targetBytes,
+				reclaimedBytes: reclaimed
+			} });
+			if (reclaimed <= 0) return reclaimedAny;
 		}
-	}
-	async verifyMoves(job) {
-		for (const move of job.moves) if (move.state !== "done") throw new Error(`${move.storageClass} move did not complete verification`);
-	}
-	async startMove(job, move) {
-		if (move.storageClass === "eventMedia") return (await this.deps.participants.analytics.startMove({
-			toLocationId: move.toLocationId,
-			throttleMbps: job.throttleMbps,
-			leaseId: requireLease(job)
-		})).jobId;
-		return (await this.deps.participants.recorder.startMove({
-			fromLocationId: move.fromLocationId,
-			toLocationId: move.toLocationId,
-			footageClass: move.storageClass,
-			throttleMbps: job.throttleMbps,
-			leaseId: requireLease(job)
-		})).jobId;
-	}
-	async moveStatus(move) {
-		if (move.moverJobId === null) return null;
-		return move.storageClass === "eventMedia" ? this.deps.participants.analytics.getMove(move.moverJobId) : this.deps.participants.recorder.getMove(move.moverJobId);
-	}
-	async cancelMove(move) {
-		if (move.moverJobId === null) return;
-		if (move.storageClass === "eventMedia") await this.deps.participants.analytics.cancelMove(move.moverJobId);
-		else await this.deps.participants.recorder.cancelMove(move.moverJobId);
-	}
-	participant(name) {
-		return this.deps.participants[name];
-	}
-	async setPhase(job, phase) {
-		job.phase = phase;
-		if (isTerminal(job)) job.finishedAt = this.deps.now();
-		await this.persist(job);
-	}
-	async finishCancelled(job) {
-		job.phase = "cancelled";
-		job.finishedAt = this.deps.now();
-		await this.releaseAfterTerminal(job);
-		await this.persist(job);
-	}
-	async persist(job) {
-		job.updatedAt = this.deps.now();
-		await this.deps.state.set(job);
+		return reclaimedAny;
 	}
 };
-function requireLease(job) {
-	if (job.pauseLeaseId === null) throw new Error("storage migration has no maintenance lease");
-	return job.pauseLeaseId;
-}
-function isTerminal(job) {
-	return job.phase === "done" || job.phase === "failed" || job.phase === "cancelled";
-}
 //#endregion
 //#region src/builtins/storage-orchestrator/storage-orchestrator.addon.ts
 /**
@@ -1890,4 +1951,4 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { StorageOrchestratorAddon, StorageOrchestratorAddon as default, SqliteLocationStore as n, StorageOrchestratorService as r, StorageMigrationCoordinator as t };
+export { StorageOrchestratorAddon, StorageOrchestratorAddon as default, StorageMigrationCoordinator as n, SqliteLocationStore as r, StorageOrchestratorService as t };