camstack 1.2.112 → 1.2.114

package/dist/{launcher-4QDDQ4WQ.js → launcher-64OXE64I.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-jZb-HKI5.js
-var require_dist_jZb_HKI5 = __commonJS({
-  "../system/dist/dist-jZb-HKI5.js"(exports) {
+// ../system/dist/dist-BFvWv_bz.js
+var require_dist_BFvWv_bz = __commonJS({
+  "../system/dist/dist-BFvWv_bz.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -23684,6 +23684,7 @@ var require_dist_jZb_HKI5 = __commonJS({
       EventCategory2["ProcessCrashed"] = "process.crashed";
       EventCategory2["ProcessRestartScheduled"] = "process.restart_scheduled";
       EventCategory2["ProcessRestarted"] = "process.restarted";
+      EventCategory2["StorageLocationsChanged"] = "storage.locations-changed";
       EventCategory2["RecordingStarted"] = "recording.started";
       EventCategory2["RecordingStopped"] = "recording.stopped";
       EventCategory2["RecordingError"] = "recording.error";
@@ -26656,6 +26657,71 @@ var require_dist_jZb_HKI5 = __commonJS({
       error: zod.z.string().nullable()
     });
     var StorageCleanupStatusInputSchema = zod.z.object({ jobId: zod.z.string().optional() });
+    var STORAGE_LOCATION_MODES = [
+      "active",
+      "readonly",
+      "drain",
+      "disabled"
+    ];
+    var StorageLocationModeSchema = zod.z.enum(STORAGE_LOCATION_MODES);
+    zod.z.enum([
+      "normal",
+      "never",
+      "drain"
+    ]);
+    var LEGACY_READ_ONLY_CONFIG_KEY = "readOnly";
+    function modeMayWrite(mode) {
+      return mode === "active";
+    }
+    function modeMayRead(mode) {
+      return mode !== "disabled";
+    }
+    function evictionPolicyForMode(mode) {
+      switch (mode) {
+        case "active":
+          return "normal";
+        case "drain":
+          return "drain";
+        case "readonly":
+        case "disabled":
+          return "never";
+      }
+    }
+    function legacyModeOf(location) {
+      if (location.mode !== void 0) return null;
+      if (location.config["readOnly"] === true) return "readonly";
+      if (location.enabled === false) return "readonly";
+      return null;
+    }
+    function resolveLocationMode(location) {
+      return (isStorageLocationMode(location.mode) ? location.mode : void 0) ?? legacyModeOf(location) ?? "active";
+    }
+    function isStorageLocationMode(value) {
+      return STORAGE_LOCATION_MODES.some((mode) => mode === value);
+    }
+    function mayWriteToLocation(location) {
+      return modeMayWrite(resolveLocationMode(location));
+    }
+    function mayReadLocation(location) {
+      return modeMayRead(resolveLocationMode(location));
+    }
+    function evictionPolicyOfLocation(location) {
+      return evictionPolicyForMode(resolveLocationMode(location));
+    }
+    function strippedOfLegacyReadOnly(config) {
+      if (!("readOnly" in config)) return config;
+      const next = { ...config };
+      delete next[LEGACY_READ_ONLY_CONFIG_KEY];
+      return next;
+    }
+    function withLocationMode(location, mode) {
+      return {
+        ...location,
+        mode,
+        enabled: modeMayWrite(mode),
+        config: strippedOfLegacyReadOnly(location.config)
+      };
+    }
     var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
     var StorageLocationSchema = zod.z.object({
       id: zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
@@ -26687,6 +26753,21 @@ var require_dist_jZb_HKI5 = __commonJS({
       * stops existing rather than being re-derived on every read.
       */
       enabled: zod.z.boolean().optional(),
+      /**
+      * THE state of this location (D385), and the only authority on what may be
+      * written, read or evicted here. Interpreted in exactly one place —
+      * `storage-location-mode.ts` — which also folds the legacy
+      * `enabled` / `config.readOnly` pair into a mode so an old row is never
+      * ambiguous.
+      *
+      * OPTIONAL only for the wire and for rows written before D385: absence is
+      * resolved by `resolveLocationMode`, and the orchestrator stamps every
+      * unstamped row ONCE at hydrate so absence stops existing rather than being
+      * re-derived on every read. `enabled` survives one release as a DERIVED
+      * mirror (`mode === 'active'`); `withLocationMode` is the only writer of
+      * either, so the two cannot disagree.
+      */
+      mode: StorageLocationModeSchema.optional(),
       /** COMPUTED at read time by the orchestrator (statfs of the backing volume
       *  for node-local locations it can reach) — never persisted, absent when the
       *  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -26694,13 +26775,47 @@ var require_dist_jZb_HKI5 = __commonJS({
         totalBytes: zod.z.number(),
         availableBytes: zod.z.number()
       }).nullable().optional(),
+      /**
+      * How much of that volume CamStack ITSELF holds on this location (D388) —
+      * COMPUTED at read time from the `storage-occupancy` providers' own figures,
+      * never persisted, never a filesystem walk.
+      *
+      * **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
+      * location yet — nobody stores here, the owning addon is down, or the first
+      * refresh has not completed. A UI must omit the segment rather than draw it
+      * at zero, which would claim we occupy nothing (D315). It is an OBJECT and
+      * not a bare number precisely so that a `?? 0` on the consuming side has to
+      * be spelled out loud instead of appearing by accident.
+      *
+      * `measuredAtMs` is the OLDEST contributing measurement, so it is honest
+      * about the whole figure rather than about its freshest part.
+      */
+      owned: zod.z.object({
+        bytes: zod.z.number().int().nonnegative(),
+        measuredAtMs: zod.z.number().int().nonnegative()
+      }).optional(),
       createdAt: zod.z.number(),
       updatedAt: zod.z.number()
     });
     var LegacyStorageLocationDefaultSchema = zod.z.object({ isDefault: zod.z.boolean().optional() });
     function isLocationEnabled(location) {
-      return location.enabled !== false;
+      return mayWriteToLocation({
+        ...location,
+        config: location.config ?? {}
+      });
+    }
+    var STORAGE_BYTES_PER_GB = 1024 ** 3;
+    function gbToBytes(gb) {
+      return Math.floor(gb * STORAGE_BYTES_PER_GB);
     }
+    var StorageDrainProgressSchema = zod.z.object({
+      locationId: zod.z.string(),
+      startedAtMs: zod.z.number(),
+      startBytes: zod.z.number(),
+      bytesRemaining: zod.z.number(),
+      drained: zod.z.boolean(),
+      estimatedEmptyAtMs: zod.z.number().nullable()
+    });
     var StorageLocationRefSchema = zod.z.union([StorageLocationTypeSchema, zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
     var StorageAccessSchema = zod.z.enum(["local-path", "cap-mediated"]);
     var STORAGE_ACCESS_FALLBACK = "local-path";
@@ -40702,6 +40817,12 @@ var require_dist_jZb_HKI5 = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * How far each draining location has got (D386). A pure READ of what the
+        * last pressure sweep computed — it starts no work, and a location that is
+        * not draining simply does not appear.
+        */
+        listDrainProgress: method(zod.z.void(), zod.z.array(StorageDrainProgressSchema).readonly()),
         testLocation: method(zod.z.object({ id: zod.z.string() }), zod.z.object({
           ok: zod.z.boolean(),
           error: zod.z.string().optional()
@@ -40831,6 +40952,37 @@ var require_dist_jZb_HKI5 = __commonJS({
         history: method(zod.z.object({}), zod.z.array(StorageMigrationJobSchema).readonly(), { auth: "admin" })
       }
     };
+    var StorageOccupancyReportSchema = zod.z.object({
+      locationId: zod.z.string(),
+      /** Bytes this provider holds on THAT location — not its eviction domain, and
+      *  not net of what it is willing to delete. */
+      ownedBytes: zod.z.number().int().nonnegative(),
+      /** When the provider last actually measured this. The orchestrator carries it
+      *  through so a UI can say how old the figure is instead of implying "now". */
+      measuredAtMs: zod.z.number().int().nonnegative()
+    });
+    var storageOccupancyCapability = {
+      name: "storage-occupancy",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * Occupancy for the given locations, in ONE round trip.
+        *
+        * A provider answers only for the locations it actually holds bytes on and
+        * OMITS the rest — an omitted location is "I hold nothing measurable here",
+        * which the orchestrator merges as a contribution of nothing rather than as
+        * a claim that the location is empty. Only a location no provider reports
+        * at all stays unknown.
+        *
+        * This must be CHEAP and must never walk a filesystem: it is on the admin
+        * UI's `listLocations` path. The owner keeps its own figure fresh (D224) and
+        * answers from what it already has.
+        */
+        getOccupancy: method(zod.z.object({ locationIds: zod.z.array(zod.z.string()).readonly() }), zod.z.array(StorageOccupancyReportSchema).readonly(), { auth: "admin" })
+      }
+    };
     var ProviderInfoSchema = zod.z.discriminatedUnion("shouldSaveDiskSpace", [zod.z.object({
       providerId: zod.z.string().min(1),
       displayName: zod.z.string().min(1),
@@ -42788,83 +42940,6 @@ var require_dist_jZb_HKI5 = __commonJS({
       *  whether persisting is worth a SQLite commit. */
       volatileStateFields: ["lastUpdated"]
     };
-    var NetworkLinkStatusSchema = zod.z.object({
-      /** The link the device is on. `'unknown'` = not read yet, not "no link". */
-      type: zod.z.enum([
-        "wifi",
-        "ethernet",
-        "cellular",
-        "unknown"
-      ]),
-      /**
-      * Link quality, 0..100 inclusive, normalised by the provider from whatever
-      * the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
-      * KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
-      * one whose reading has not landed must not be drawn at 0 %. Consumers
-      * SKIP a null rather than coerce it.
-      */
-      signalPercent: zod.z.number().min(0).max(100).nullable(),
-      /** Raw received signal strength in dBm, when the firmware reports one. */
-      rssiDbm: zod.z.number().optional(),
-      /** Network name of a wireless link, when the firmware reports it. */
-      ssid: zod.z.string().optional(),
-      /** Ms epoch of the last observation. Lets consumers reason about freshness. */
-      lastUpdated: zod.z.number()
-    });
-    var networkLinkCapability = {
-      name: "network-link",
-      scope: "device",
-      deviceNative: true,
-      mode: "singleton",
-      deviceTypes: [
-        DeviceType.Camera,
-        DeviceType.Sensor,
-        DeviceType.Button,
-        DeviceType.Switch,
-        DeviceType.Light,
-        DeviceType.Lock,
-        DeviceType.Siren
-      ],
-      methods: {},
-      events: {
-        /**
-        * Emitted whenever the cached status changes (a link switch, a signal
-        * reading that moved). Mirrored on the parent chain by the
-        * DeviceEventPropagator like `battery.onStatusChanged`.
-        */
-        onStatusChanged: { data: zod.z.object({
-          deviceId: zod.z.number(),
-          status: NetworkLinkStatusSchema
-        }) }
-      },
-      status: {
-        schema: NetworkLinkStatusSchema,
-        kind: "push",
-        empty: {
-          type: "unknown",
-          signalPercent: null,
-          lastUpdated: 0
-        }
-      },
-      /**
-      * Runtime-state slice — every provider stores the same shape under
-      * `device.runtimeState['network-link']`, read once by the badge and the
-      * Home Assistant projector regardless of the driver.
-      */
-      runtimeState: NetworkLinkStatusSchema,
-      /**
-      * Runtime-state durability: **restored** — a link reading is slow to
-      * change and a sleeping battery camera may not report for hours; the
-      * restored slice is what the badge shows until the next read.
-      *
-      * See `RuntimeStateDurability`. Enforced by
-      * `scripts/check-runtime-state-durability.ts`.
-      */
-      durability: "restored",
-      /** Clock fields: written, but excluded from the compare that decides
-      *  whether persisting is worth a SQLite commit. */
-      volatileStateFields: ["lastUpdated"]
-    };
     var BinaryStatusSchema = zod.z.object({
       on: zod.z.boolean(),
       /** Ms epoch of the last transition. 0 if never observed. */
@@ -46005,6 +46080,246 @@ var require_dist_jZb_HKI5 = __commonJS({
       *  whether persisting is worth a SQLite commit. */
       volatileStateFields: ["lastFetchedAt"]
     };
+    var NavigationMoveCommandSchema = zod.z.object({
+      pan: zod.z.number().min(-1).max(1).optional(),
+      tilt: zod.z.number().min(-1).max(1).optional(),
+      speed: zod.z.number().min(0).max(1).optional()
+    });
+    var NavigationActionIdSchema = zod.z.enum([
+      "goHome",
+      "locate",
+      "spotClean",
+      "findPet",
+      "personFollow",
+      "stop",
+      "startClean",
+      "pauseClean",
+      "dockWash",
+      "autoEmpty",
+      "flashOn",
+      "flashOff"
+    ]);
+    var NavigationEntryKindSchema = zod.z.enum(["action", "sound"]);
+    var NavigationActionEntrySchema = zod.z.object({
+      id: zod.z.string(),
+      kind: NavigationEntryKindSchema,
+      label: zod.z.string(),
+      icon: zod.z.string(),
+      /** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
+      soundId: zod.z.number().int().optional(),
+      /** Per-device feature flag — render this entry only when true. */
+      enabled: zod.z.boolean()
+    });
+    var NavigationPointSchema = zod.z.object({
+      x: zod.z.number(),
+      y: zod.z.number()
+    });
+    var NavigationFeaturesSchema = zod.z.object({
+      move: zod.z.boolean(),
+      stop: zod.z.boolean(),
+      goToPoint: zod.z.boolean(),
+      runAction: zod.z.boolean(),
+      playSound: zod.z.boolean(),
+      light: zod.z.boolean(),
+      lightMode: zod.z.boolean()
+    });
+    var NavigationLightModeSchema = zod.z.enum(["auto", "manual"]);
+    var NavigationModeSchema = zod.z.enum([
+      "idle",
+      "cleaning",
+      "spot",
+      "following",
+      "goto",
+      "returning",
+      "paused",
+      "unknown"
+    ]);
+    var NavigationStatusSchema = zod.z.object({
+      mode: NavigationModeSchema,
+      following: zod.z.boolean(),
+      flash: zod.z.boolean(),
+      lightMode: NavigationLightModeSchema,
+      lightLevel: zod.z.number().min(40).max(100),
+      /** Ms epoch when the slice was last updated. */
+      lastChangedAt: zod.z.number()
+    });
+    var NavigationRuntimeStateSchema = NavigationStatusSchema.extend({ lastFetchedAt: zod.z.number() });
+    var navigationCapability = {
+      name: "navigation",
+      scope: "device",
+      deviceNative: true,
+      mode: "singleton",
+      deviceTypes: [DeviceType.Camera],
+      deviceConfig: { ui: {
+        kind: "widget",
+        widgetId: "host/navigation-panel",
+        tab: "navigation",
+        topTab: true,
+        label: "Navigation",
+        order: 0
+      } },
+      methods: {
+        /**
+        * Momentary drive nudge (the robot moves). `protected` — mirrors
+        * `ptz.continuousMove` so the Viewer navigation panel (and the PTZ-mimic
+        * path) works for any authenticated user, not admin-only. The UI sends
+        * these at ~1 Hz while a control is held; the provider forwards each one to
+        * a single drive write WITHOUT debouncing.
+        */
+        move: method(NavigationMoveCommandSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+        /** Halt all motion immediately (zero drive vector). */
+        stop: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+        /** Send the robot to a point on its live map. */
+        goToPoint: method(NavigationPointSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Enumerate the discrete controls THIS device supports (data-driven UI +
+        * PTZ mimic). Camera-probed subset of {@link NAVIGATION_ACTION_CATALOG}.
+        */
+        listActions: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(NavigationActionEntrySchema)),
+        /**
+        * Run one discrete action (a `kind:'action'` dictionary entry). Invalid /
+        * unsupported action ids are rejected by the provider.
+        */
+        runAction: method(zod.z.object({
+          deviceId: zod.z.number(),
+          actionId: NavigationActionIdSchema
+        }), zod.z.void(), { kind: "mutation" }),
+        /** Play a sound by its wire id (the `soundId` of a `kind:'sound'` entry). */
+        playSound: method(zod.z.object({
+          deviceId: zod.z.number(),
+          soundId: zod.z.number().int()
+        }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Turn the on-camera fill light on / off (the `OpenFullLight` control —
+        * works anytime, no active stream required).
+        */
+        setLightOn: method(zod.z.object({
+          deviceId: zod.z.number(),
+          on: zod.z.boolean()
+        }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Set the fill-light mode (auto vs manual). `manual` optionally carries the
+        * initial `level`. The auto/manual + level control is a CAMERA-service
+        * action that generally needs an active camera stream/monitor session — the
+        * UI shows the manual level slider ONLY when `mode === 'manual'`.
+        */
+        setLightMode: method(zod.z.object({
+          deviceId: zod.z.number(),
+          mode: NavigationLightModeSchema,
+          level: zod.z.number().min(40).max(100).optional()
+        }), zod.z.void(), { kind: "mutation" }),
+        /** Set the MANUAL fill-light level (40..100). Implies `manual` mode. */
+        setLightLevel: method(zod.z.object({
+          deviceId: zod.z.number(),
+          level: zod.z.number().min(40).max(100)
+        }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Per-device FEATURE-FLAG report for the general primitives — drives which
+        * controls the UI shows (the per-entry flags for the dictionary come back on
+        * `listActions`).
+        */
+        getFeatures: method(zod.z.object({ deviceId: zod.z.number() }), NavigationFeaturesSchema)
+      },
+      events: { onStatusChanged: { data: zod.z.object({
+        deviceId: zod.z.number(),
+        status: NavigationStatusSchema
+      }) } },
+      status: {
+        schema: NavigationStatusSchema,
+        kind: "push"
+      },
+      /**
+      * Runtime-state slice mirrored by the kernel. The navigation panel watches it
+      * for live mode / follow / flash changes.
+      */
+      runtimeState: NavigationRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **session** — like `vacuum-control`, a restored
+      * `mode: cleaning` / `following: true` is a robot that is not actually doing
+      * that. The live handle re-publishes on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
+    };
+    var NetworkLinkStatusSchema = zod.z.object({
+      /** The link the device is on. `'unknown'` = not read yet, not "no link". */
+      type: zod.z.enum([
+        "wifi",
+        "ethernet",
+        "cellular",
+        "unknown"
+      ]),
+      /**
+      * Link quality, 0..100 inclusive, normalised by the provider from whatever
+      * the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
+      * KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
+      * one whose reading has not landed must not be drawn at 0 %. Consumers
+      * SKIP a null rather than coerce it.
+      */
+      signalPercent: zod.z.number().min(0).max(100).nullable(),
+      /** Raw received signal strength in dBm, when the firmware reports one. */
+      rssiDbm: zod.z.number().optional(),
+      /** Network name of a wireless link, when the firmware reports it. */
+      ssid: zod.z.string().optional(),
+      /** Ms epoch of the last observation. Lets consumers reason about freshness. */
+      lastUpdated: zod.z.number()
+    });
+    var networkLinkCapability = {
+      name: "network-link",
+      scope: "device",
+      deviceNative: true,
+      mode: "singleton",
+      deviceTypes: [
+        DeviceType.Camera,
+        DeviceType.Sensor,
+        DeviceType.Button,
+        DeviceType.Switch,
+        DeviceType.Light,
+        DeviceType.Lock,
+        DeviceType.Siren
+      ],
+      methods: {},
+      events: {
+        /**
+        * Emitted whenever the cached status changes (a link switch, a signal
+        * reading that moved). Mirrored on the parent chain by the
+        * DeviceEventPropagator like `battery.onStatusChanged`.
+        */
+        onStatusChanged: { data: zod.z.object({
+          deviceId: zod.z.number(),
+          status: NetworkLinkStatusSchema
+        }) }
+      },
+      status: {
+        schema: NetworkLinkStatusSchema,
+        kind: "push",
+        empty: {
+          type: "unknown",
+          signalPercent: null,
+          lastUpdated: 0
+        }
+      },
+      /**
+      * Runtime-state slice — every provider stores the same shape under
+      * `device.runtimeState['network-link']`, read once by the badge and the
+      * Home Assistant projector regardless of the driver.
+      */
+      runtimeState: NetworkLinkStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a link reading is slow to
+      * change and a sleeping battery camera may not report for hours; the
+      * restored slice is what the badge shows until the next read.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastUpdated"]
+    };
     var StreamNetworkStatsSchema = zod.z.object({
       nominalBitrateKbps: zod.z.number(),
       observedBitrateKbps: zod.z.number(),
@@ -47570,169 +47885,6 @@ var require_dist_jZb_HKI5 = __commonJS({
       */
       durability: "session"
     };
-    var NavigationMoveCommandSchema = zod.z.object({
-      pan: zod.z.number().min(-1).max(1).optional(),
-      tilt: zod.z.number().min(-1).max(1).optional(),
-      speed: zod.z.number().min(0).max(1).optional()
-    });
-    var NavigationActionIdSchema = zod.z.enum([
-      "goHome",
-      "locate",
-      "spotClean",
-      "findPet",
-      "personFollow",
-      "stop",
-      "startClean",
-      "pauseClean",
-      "dockWash",
-      "autoEmpty",
-      "flashOn",
-      "flashOff"
-    ]);
-    var NavigationEntryKindSchema = zod.z.enum(["action", "sound"]);
-    var NavigationActionEntrySchema = zod.z.object({
-      id: zod.z.string(),
-      kind: NavigationEntryKindSchema,
-      label: zod.z.string(),
-      icon: zod.z.string(),
-      /** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
-      soundId: zod.z.number().int().optional(),
-      /** Per-device feature flag — render this entry only when true. */
-      enabled: zod.z.boolean()
-    });
-    var NavigationPointSchema = zod.z.object({
-      x: zod.z.number(),
-      y: zod.z.number()
-    });
-    var NavigationFeaturesSchema = zod.z.object({
-      move: zod.z.boolean(),
-      stop: zod.z.boolean(),
-      goToPoint: zod.z.boolean(),
-      runAction: zod.z.boolean(),
-      playSound: zod.z.boolean(),
-      light: zod.z.boolean(),
-      lightMode: zod.z.boolean()
-    });
-    var NavigationLightModeSchema = zod.z.enum(["auto", "manual"]);
-    var NavigationModeSchema = zod.z.enum([
-      "idle",
-      "cleaning",
-      "spot",
-      "following",
-      "goto",
-      "returning",
-      "paused",
-      "unknown"
-    ]);
-    var NavigationStatusSchema = zod.z.object({
-      mode: NavigationModeSchema,
-      following: zod.z.boolean(),
-      flash: zod.z.boolean(),
-      lightMode: NavigationLightModeSchema,
-      lightLevel: zod.z.number().min(40).max(100),
-      /** Ms epoch when the slice was last updated. */
-      lastChangedAt: zod.z.number()
-    });
-    var NavigationRuntimeStateSchema = NavigationStatusSchema.extend({ lastFetchedAt: zod.z.number() });
-    var navigationCapability = {
-      name: "navigation",
-      scope: "device",
-      deviceNative: true,
-      mode: "singleton",
-      deviceTypes: [DeviceType.Camera],
-      deviceConfig: { ui: {
-        kind: "widget",
-        widgetId: "host/navigation-panel",
-        tab: "navigation",
-        topTab: true,
-        label: "Navigation",
-        order: 0
-      } },
-      methods: {
-        /**
-        * Momentary drive nudge (the robot moves). `protected` — mirrors
-        * `ptz.continuousMove` so the Viewer navigation panel (and the PTZ-mimic
-        * path) works for any authenticated user, not admin-only. The UI sends
-        * these at ~1 Hz while a control is held; the provider forwards each one to
-        * a single drive write WITHOUT debouncing.
-        */
-        move: method(NavigationMoveCommandSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-        /** Halt all motion immediately (zero drive vector). */
-        stop: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-        /** Send the robot to a point on its live map. */
-        goToPoint: method(NavigationPointSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Enumerate the discrete controls THIS device supports (data-driven UI +
-        * PTZ mimic). Camera-probed subset of {@link NAVIGATION_ACTION_CATALOG}.
-        */
-        listActions: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(NavigationActionEntrySchema)),
-        /**
-        * Run one discrete action (a `kind:'action'` dictionary entry). Invalid /
-        * unsupported action ids are rejected by the provider.
-        */
-        runAction: method(zod.z.object({
-          deviceId: zod.z.number(),
-          actionId: NavigationActionIdSchema
-        }), zod.z.void(), { kind: "mutation" }),
-        /** Play a sound by its wire id (the `soundId` of a `kind:'sound'` entry). */
-        playSound: method(zod.z.object({
-          deviceId: zod.z.number(),
-          soundId: zod.z.number().int()
-        }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Turn the on-camera fill light on / off (the `OpenFullLight` control —
-        * works anytime, no active stream required).
-        */
-        setLightOn: method(zod.z.object({
-          deviceId: zod.z.number(),
-          on: zod.z.boolean()
-        }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Set the fill-light mode (auto vs manual). `manual` optionally carries the
-        * initial `level`. The auto/manual + level control is a CAMERA-service
-        * action that generally needs an active camera stream/monitor session — the
-        * UI shows the manual level slider ONLY when `mode === 'manual'`.
-        */
-        setLightMode: method(zod.z.object({
-          deviceId: zod.z.number(),
-          mode: NavigationLightModeSchema,
-          level: zod.z.number().min(40).max(100).optional()
-        }), zod.z.void(), { kind: "mutation" }),
-        /** Set the MANUAL fill-light level (40..100). Implies `manual` mode. */
-        setLightLevel: method(zod.z.object({
-          deviceId: zod.z.number(),
-          level: zod.z.number().min(40).max(100)
-        }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Per-device FEATURE-FLAG report for the general primitives — drives which
-        * controls the UI shows (the per-entry flags for the dictionary come back on
-        * `listActions`).
-        */
-        getFeatures: method(zod.z.object({ deviceId: zod.z.number() }), NavigationFeaturesSchema)
-      },
-      events: { onStatusChanged: { data: zod.z.object({
-        deviceId: zod.z.number(),
-        status: NavigationStatusSchema
-      }) } },
-      status: {
-        schema: NavigationStatusSchema,
-        kind: "push"
-      },
-      /**
-      * Runtime-state slice mirrored by the kernel. The navigation panel watches it
-      * for live mode / follow / flash changes.
-      */
-      runtimeState: NavigationRuntimeStateSchema,
-      /**
-      * Runtime-state durability: **session** — like `vacuum-control`, a restored
-      * `mode: cleaning` / `following: true` is a robot that is not actually doing
-      * that. The live handle re-publishes on connect.
-      *
-      * See `RuntimeStateDurability`. Enforced by
-      * `scripts/check-runtime-state-durability.ts`.
-      */
-      durability: "session"
-    };
     var rebootCapability = {
       name: "reboot",
       scope: "device",
@@ -51257,6 +51409,7 @@ var require_dist_jZb_HKI5 = __commonJS({
       storageCapability,
       storageEvictableCapability,
       storageMigrationCapability,
+      storageOccupancyCapability,
       storageProviderCapability,
       streamBrokerCapability,
       streamCatalogCapability,
@@ -56229,6 +56382,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "storage.listDrainProgress": {
+        capName: "storage",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storage.listLocationDeclarations": {
         capName: "storage",
         capScope: "system",
@@ -56373,6 +56532,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "storageOccupancy.getOccupancy": {
+        capName: "storage-occupancy",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageProvider.abortUpload": {
         capName: "storage-provider",
         capScope: "system",
@@ -60186,6 +60351,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         return StorageCleanupJobSchema;
       }
     });
+    Object.defineProperty(exports, "StorageLocationModeSchema", {
+      enumerable: true,
+      get: function() {
+        return StorageLocationModeSchema;
+      }
+    });
     Object.defineProperty(exports, "StorageLocationTypeSchema", {
       enumerable: true,
       get: function() {
@@ -60396,6 +60567,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         return evaluateSensorEdge;
       }
     });
+    Object.defineProperty(exports, "evictionPolicyOfLocation", {
+      enumerable: true,
+      get: function() {
+        return evictionPolicyOfLocation;
+      }
+    });
     Object.defineProperty(exports, "expandCapMethods", {
       enumerable: true,
       get: function() {
@@ -60420,6 +60597,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         return foldSnapshotByFunction;
       }
     });
+    Object.defineProperty(exports, "gbToBytes", {
+      enumerable: true,
+      get: function() {
+        return gbToBytes;
+      }
+    });
     Object.defineProperty(exports, "hydrateSchema", {
       enumerable: true,
       get: function() {
@@ -60480,6 +60663,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         return kebabToCamel;
       }
     });
+    Object.defineProperty(exports, "legacyModeOf", {
+      enumerable: true,
+      get: function() {
+        return legacyModeOf;
+      }
+    });
     Object.defineProperty(exports, "lifecycleJobSchema", {
       enumerable: true,
       get: function() {
@@ -60510,12 +60699,30 @@ var require_dist_jZb_HKI5 = __commonJS({
         return looseSchema;
       }
     });
+    Object.defineProperty(exports, "mayReadLocation", {
+      enumerable: true,
+      get: function() {
+        return mayReadLocation;
+      }
+    });
+    Object.defineProperty(exports, "mayWriteToLocation", {
+      enumerable: true,
+      get: function() {
+        return mayWriteToLocation;
+      }
+    });
     Object.defineProperty(exports, "metricsProviderCapability", {
       enumerable: true,
       get: function() {
         return metricsProviderCapability;
       }
     });
+    Object.defineProperty(exports, "modeMayWrite", {
+      enumerable: true,
+      get: function() {
+        return modeMayWrite;
+      }
+    });
     Object.defineProperty(exports, "nodePin", {
       enumerable: true,
       get: function() {
@@ -60594,6 +60801,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         return resolveContainerPrimaryChild;
       }
     });
+    Object.defineProperty(exports, "resolveLocationMode", {
+      enumerable: true,
+      get: function() {
+        return resolveLocationMode;
+      }
+    });
     Object.defineProperty(exports, "resolveMethodAuth", {
       enumerable: true,
       get: function() {
@@ -60660,6 +60873,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         return storageMigrationCapability;
       }
     });
+    Object.defineProperty(exports, "storageOccupancyCapability", {
+      enumerable: true,
+      get: function() {
+        return storageOccupancyCapability;
+      }
+    });
     Object.defineProperty(exports, "storageProviderCapability", {
       enumerable: true,
       get: function() {
@@ -60690,6 +60909,12 @@ var require_dist_jZb_HKI5 = __commonJS({
         return vectorStoreCapability;
       }
     });
+    Object.defineProperty(exports, "withLocationMode", {
+      enumerable: true,
+      get: function() {
+        return withLocationMode;
+      }
+    });
   }
 });
 
@@ -60702,7 +60927,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -61521,7 +61746,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -61615,7 +61840,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -62512,11 +62737,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-Dxv9S_lO.js
-var require_retired_settings_keys_Dxv9S_lO = __commonJS({
-  "../system/dist/retired-settings-keys-Dxv9S_lO.js"(exports) {
+// ../system/dist/retired-settings-keys-Dd7K3K3r.js
+var require_retired_settings_keys_Dd7K3K3r = __commonJS({
+  "../system/dist/retired-settings-keys-Dd7K3K3r.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63769,281 +63994,420 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
         hash
       } });
     }
-    var CLOCK_TICKS_PER_SEC = 100;
-    var PAGE_BYTES = 4096;
-    var NO_COST_CLAIM = { release: () => void 0 };
-    var nodeProcStatReader = {
-      readStat: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/stat`, "utf8"),
-      readStatm: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/statm`, "utf8")
-    };
-    function parseProcCpuSeconds(line) {
-      const close = line.lastIndexOf(")");
-      if (close < 0) return null;
-      const rest = line.slice(close + 1).trim().split(/\s+/);
-      const utime = Number(rest[11]);
-      const stime = Number(rest[12]);
-      if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
-      return (utime + stime) / CLOCK_TICKS_PER_SEC;
-    }
-    function parseProcRssBytes(line) {
-      const fields = line.trim().split(/\s+/);
-      const residentPages = Number(fields[1]);
-      if (!Number.isFinite(residentPages)) return null;
-      return residentPages * PAGE_BYTES;
-    }
-    async function readProcessCost(pid, reader = nodeProcStatReader) {
-      let cpuSeconds = null;
-      let rssBytes = null;
-      try {
-        cpuSeconds = parseProcCpuSeconds(await reader.readStat(pid));
-      } catch {
-        cpuSeconds = null;
+    var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
+    var FRAGMENT_LOG_EVERY = 30;
+    var Fmp4FragmentChild = class {
+      deps;
+      args;
+      child = null;
+      splitter = new require_canonical_hash.Fmp4BoxSplitter();
+      stopped = false;
+      unitsOut = 0;
+      activeHwAccel = null;
+      constructor(deps, args) {
+        this.deps = deps;
+        this.args = args;
       }
-      try {
-        rssBytes = parseProcRssBytes(await reader.readStatm(pid));
-      } catch {
-        rssBytes = null;
+      /** Spawn, and resolve once the INIT segment has been cut out of stdout. */
+      async start() {
+        const requested = this.args.invocation.decodeHwAccel;
+        this.activeHwAccel = requested;
+        try {
+          await this.spawnAttempt(requested);
+          return;
+        } catch (err) {
+          if (this.stopped) throw err;
+          if (requested === null || require_canonical_hash.isSoftwareDecode(requested)) throw err;
+          this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment \u2014 retrying in SOFTWARE", {
+            tags: { deviceId: this.args.deviceId },
+            meta: {
+              sourceId: this.args.sourceId,
+              decodeHwAccel: requested,
+              error: require_err_msg.errMsg(err)
+            }
+          });
+          this.killChild();
+          this.splitter = new require_canonical_hash.Fmp4BoxSplitter();
+          this.activeHwAccel = null;
+          await this.spawnAttempt(null);
+        }
       }
-      return {
-        ...cpuSeconds === null ? {} : { cpuSeconds },
-        ...rssBytes === null ? {} : { rssBytes }
-      };
-    }
-    var ChildCostRegistry = class {
-      reader;
-      now;
-      claims = /* @__PURE__ */ new Map();
-      constructor(reader = nodeProcStatReader, now = Date.now) {
-        this.reader = reader;
-        this.now = now;
+      /** The backend the child ACTUALLY ran with — `null` for software. */
+      activeDecodeHwAccel() {
+        const value = this.activeHwAccel;
+        return value === null || value === "none" || value === "copy" ? null : value;
       }
-      /**
-      * Record one child. The returned handle is the only way to remove it.
-      *
-      * A claim with no pid is dropped rather than stored: it could carry no
-      * measurement, and an entry with a camera and no numbers reads on a chart as
-      * a camera that cost nothing.
-      */
-      claim(input) {
-        const pid = input.pid;
-        if (pid === void 0 || !Number.isInteger(pid) || pid <= 0) return NO_COST_CLAIM;
-        const key = /* @__PURE__ */ Symbol("child-cost-claim");
-        this.claims.set(key, {
-          role: input.role,
-          deviceId: input.deviceId,
-          unit: input.unit,
-          attribution: input.attribution ?? "measured",
-          pid,
-          startedAtMs: this.now()
-        });
-        return { release: () => {
-          this.claims.delete(key);
-        } };
+      /** Kill ffmpeg and end the plane. Idempotent. */
+      async stop() {
+        if (this.stopped) return;
+        this.stopped = true;
+        this.killChild();
+        this.args.plane.end("the fragment child stopped");
       }
-      /** Live claims, in claim order. Diagnostics and tests; not a contribution. */
-      list() {
-        return [...this.claims.values()].map((c) => ({
-          role: c.role,
-          deviceId: c.deviceId,
-          unit: c.unit,
-          attribution: c.attribution,
-          pid: c.pid
-        }));
+      spawnAttempt(decodeHwAccel) {
+        const args = require_canonical_hash.buildFfmpegArgs({
+          ...this.args.invocation,
+          decodeHwAccel,
+          sink: {
+            kind: "stdout",
+            container: "mp4",
+            fragmentMs: this.args.fragmentMs
+          }
+        });
+        this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
+          tags: { deviceId: this.args.deviceId },
+          meta: {
+            sourceId: this.args.sourceId,
+            fragmentMs: this.args.fragmentMs,
+            decodeHwAccel: decodeHwAccel ?? "software",
+            argv: args.join(" ")
+          }
+        });
+        return new Promise((resolve, reject) => {
+          const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
+            "ignore",
+            "pipe",
+            "pipe"
+          ] });
+          this.child = child;
+          let settled = false;
+          let failed = false;
+          const isCurrent = () => !this.stopped && !failed;
+          const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
+          const settle = (fail) => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            if (fail) {
+              failed = true;
+              reject(fail);
+            } else resolve();
+          };
+          const timer = setTimeout(() => {
+            settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
+            this.killChild();
+          }, timeoutMs);
+          timer.unref?.();
+          child.stdout?.on("data", (chunk) => {
+            for (const unit of this.splitter.push(chunk)) {
+              this.unitsOut += 1;
+              this.args.plane.publish(unit);
+              if (unit.kind === "init") {
+                this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
+                  tags: { deviceId: this.args.deviceId },
+                  meta: {
+                    sourceId: this.args.sourceId,
+                    bytes: unit.data.length
+                  }
+                });
+                settle();
+              } else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
+                tags: { deviceId: this.args.deviceId },
+                meta: {
+                  sourceId: this.args.sourceId,
+                  unitsOut: this.unitsOut,
+                  bytes: unit.data.length,
+                  subscribers: this.args.plane.subscriberCount
+                }
+              });
+            }
+            const fault = this.splitter.fault;
+            if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
+          });
+          child.stderr?.setEncoding("utf8");
+          child.stderr?.on("data", (line) => {
+            this.deps.logger.debug("fmp4 fragment child ffmpeg", {
+              tags: { deviceId: this.args.deviceId },
+              meta: {
+                sourceId: this.args.sourceId,
+                line: line.trim()
+              }
+            });
+          });
+          child.once("error", (err) => {
+            if (!settled) {
+              settle(err);
+              return;
+            }
+            if (!isCurrent()) return;
+            this.args.plane.end("the fragment child errored");
+            this.deps.onChildExit?.(err);
+          });
+          child.once("exit", (code, signal) => {
+            if (!settled) {
+              settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
+              return;
+            }
+            if (!isCurrent()) return;
+            const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
+            this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
+              tags: { deviceId: this.args.deviceId },
+              meta: {
+                sourceId: this.args.sourceId,
+                code,
+                signal,
+                unitsOut: this.unitsOut
+              }
+            });
+            this.args.plane.end("the fragment child exited");
+            this.deps.onChildExit?.(error);
+          });
+        });
       }
       /**
-      * This addon's contribution: one entry per live claim, with whatever the OS
-      * will tell us about that child right now.
-      *
-      * A child that has exited between the claim and this read contributes an
-      * entry with no numbers rather than no entry — the unit exists, the addon
-      * believes it is running, and hiding it would make a dying writer look like
-      * a writer that was never started.
+      * The byte stream stopped being splittable. Not recoverable — the splitter
+      * cannot resynchronise mid-box — so the child is a corpse and every consumer
+      * has to be told, loudly, with the reason.
       */
-      async contributions() {
-        const out = [];
-        for (const claim of this.claims.values()) out.push({
-          role: claim.role,
-          deviceId: claim.deviceId,
-          attribution: claim.attribution,
-          unit: claim.unit,
-          pid: claim.pid,
-          startedAtMs: claim.startedAtMs,
-          ...await readProcessCost(claim.pid, this.reader)
+      onFault(reason, wasLive, current, settle) {
+        const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
+        this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
+          tags: { deviceId: this.args.deviceId },
+          meta: {
+            sourceId: this.args.sourceId,
+            unitsOut: this.unitsOut,
+            interstitial: this.splitter.discardedInterstitialTypes,
+            reason
+          }
         });
-        return out;
+        this.killChild();
+        settle(error);
+        if (wasLive && current) {
+          this.args.plane.end("the fragment child produced unsplittable output");
+          this.deps.onChildExit?.(error);
+        }
       }
-    };
-    var STORAGE_LOCATION_TYPES = [
-      "data",
-      "media",
-      "recordings",
-      "recordings-high",
-      "recordings-low",
-      "recordings-clips",
-      "event-images",
-      "models",
-      "addons-data",
-      "cache",
-      "logs",
-      "backups"
-    ];
-    var DEFAULT_LOCATION_SUBDIRS = {
-      data: "db",
-      media: "media",
-      recordings: "recordings",
-      "recordings-high": "recordings-high",
-      "recordings-low": "recordings-low",
-      "recordings-clips": "recordings-clips",
-      "event-images": "event-images",
-      models: "models",
-      "addons-data": "addons-data",
-      cache: "/tmp/camstack-cache",
-      logs: "logs",
-      backups: "backups"
-    };
-    var FilesystemStorageProvider = class {
-      id = "local";
-      name = "Local Filesystem";
-      supportedLocations = [...STORAGE_LOCATION_TYPES];
-      rootPath;
-      locationPaths;
-      constructor(rootPath, overrides) {
-        this.rootPath = node_path.resolve(rootPath);
-        this.locationPaths = /* @__PURE__ */ new Map();
-        for (const loc of STORAGE_LOCATION_TYPES) {
-          const override = overrides?.[loc];
-          if (override) this.locationPaths.set(loc, node_path.resolve(override));
-          else {
-            const subdir = DEFAULT_LOCATION_SUBDIRS[loc] ?? loc;
-            this.locationPaths.set(loc, node_path.isAbsolute(subdir) ? subdir : node_path.join(this.rootPath, subdir));
-          }
+      killChild() {
+        const child = this.child;
+        this.child = null;
+        if (child && !child.killed) try {
+          child.kill("SIGTERM");
+        } catch (err) {
+          this.deps.logger.warn("fmp4 fragment child: kill error", {
+            tags: { deviceId: this.args.deviceId },
+            meta: {
+              sourceId: this.args.sourceId,
+              error: require_err_msg.errMsg(err)
+            }
+          });
         }
-        for (const [loc, override] of Object.entries(overrides ?? {})) if (typeof override === "string" && !this.locationPaths.has(loc)) this.locationPaths.set(loc, node_path.resolve(override));
       }
-      async resolve({ location, relativePath }) {
-        const base = this.locationPaths.get(location) ?? node_path.join(this.rootPath, location);
-        return node_path.join(base, relativePath);
+    };
+    var DEFAULT_QUEUE_CAPACITY = 4;
+    var Fmp4FragmentPlane = class {
+      logger;
+      prebuffer;
+      now;
+      subscriptions = /* @__PURE__ */ new Map();
+      /** The last init unit seen, handed to every later subscriber. */
+      retainedInit = null;
+      ended = false;
+      /** Oldest first. Empty unless {@link Fmp4PrebufferOptions} was supplied. */
+      ring = [];
+      ringBytes = 0;
+      constructor(logger, prebuffer, now = Date.now) {
+        this.logger = logger;
+        this.prebuffer = prebuffer;
+        this.now = now;
       }
-      async write({ location, relativePath, data }) {
-        const filePath = await this.resolve({
-          location,
-          relativePath
-        });
-        await node_fs.promises.mkdir(node_path.dirname(filePath), { recursive: true });
-        if (Buffer.isBuffer(data)) await node_fs.promises.writeFile(filePath, data);
-        else {
-          const writeStream = node_fs.createWriteStream(filePath);
-          await new Promise((resolve, reject) => {
-            data.pipe(writeStream);
-            writeStream.on("finish", resolve);
-            writeStream.on("error", reject);
-          });
+      get subscriberCount() {
+        return this.subscriptions.size;
+      }
+      /** True once {@link end} has been called — no further units are accepted. */
+      get isEnded() {
+        return this.ended;
+      }
+      /** What the prebuffer ring holds right now. All zeroes when disabled. */
+      prebufferStats() {
+        const oldest = this.ring[0];
+        return {
+          fragments: this.ring.length,
+          bytes: this.ringBytes,
+          spanMs: oldest === void 0 ? 0 : this.now() - oldest.arrivedAt
+        };
+      }
+      subscribe(input) {
+        const replay = input.withPrebuffer === true ? this.trimmedRing() : [];
+        const requested = Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY);
+        const sub = {
+          id: `fmp4-${(0, node_crypto.randomUUID)()}`,
+          tag: input.tag,
+          subscribedAt: this.now(),
+          capacity: requested + replay.length,
+          queue: [],
+          delivered: 0,
+          closedReason: null,
+          wake: null,
+          iterating: false
+        };
+        this.subscriptions.set(sub.id, sub);
+        if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
+        for (const retained of replay) this.enqueue(sub, retained.unit);
+        if (this.ended) this.closeSubscription(sub, "ended");
+        this.logger?.info("fmp4 plane: subscribed", { meta: {
+          subscriptionId: sub.id,
+          tag: sub.tag,
+          hasRetainedInit: this.retainedInit !== null,
+          prebufferFragments: replay.length,
+          prebufferBytes: replay.reduce((n, r) => n + r.unit.data.length, 0)
+        } });
+        return this.facade(sub);
+      }
+      /**
+      * Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
+      * emits exactly one per child, and a second means the child was respawned, in
+      * which case the old one describes a stream that no longer exists.
+      */
+      publish(unit) {
+        if (this.ended) return;
+        if (unit.kind === "init") {
+          this.retainedInit = unit;
+          this.ring.length = 0;
+          this.ringBytes = 0;
+        } else this.retain(unit);
+        for (const sub of this.subscriptions.values()) {
+          if (sub.closedReason !== null) continue;
+          this.enqueue(sub, unit);
         }
       }
-      async read({ location, relativePath }) {
-        return node_fs.promises.readFile(await this.resolve({
-          location,
-          relativePath
+      /**
+      * The producer stopped. Every subscriber drains what it holds; its final
+      * packet carries `isLast`, and its generator then completes.
+      */
+      end(reason = "producer ended") {
+        if (this.ended) return;
+        this.ended = true;
+        this.logger?.info("fmp4 plane: ended", { meta: {
+          reason,
+          subscribers: this.subscriptions.size
+        } });
+        for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
+      }
+      listSubscribers() {
+        return [...this.subscriptions.values()].map((s) => ({
+          tag: s.tag,
+          subscribedAt: s.subscribedAt,
+          delivered: s.delivered,
+          closedReason: s.closedReason
         }));
       }
-      async exists({ location, relativePath }) {
-        try {
-          await node_fs.promises.access(await this.resolve({
-            location,
-            relativePath
-          }));
-          return true;
-        } catch {
-          return false;
-        }
+      /** End and forget everything. Idempotent. */
+      dispose() {
+        this.end("disposed");
+        this.subscriptions.clear();
+        this.retainedInit = null;
+        this.ring.length = 0;
+        this.ringBytes = 0;
       }
-      async list({ location, prefix }) {
-        const base = this.locationPaths.get(location);
-        if (!base) return [];
-        const dir = prefix ? node_path.join(base, prefix) : base;
-        try {
-          return (await node_fs.promises.readdir(dir, { withFileTypes: true })).map((e) => prefix ? `${prefix}/${e.name}` : e.name);
-        } catch {
-          return [];
+      /**
+      * Add one fragment to the ring and evict from the front until BOTH bounds
+      * hold. Eviction is oldest-first, which is the one place in this file where
+      * dropping is correct: the ring is context, not stream — nobody is mid-decode
+      * on it, and a subscriber only ever receives a contiguous tail of it.
+      */
+      retain(unit) {
+        const prebuffer = this.prebuffer;
+        if (prebuffer === void 0) return;
+        const arrivedAt = this.now();
+        this.ring.push({
+          unit,
+          arrivedAt
+        });
+        this.ringBytes += unit.data.length;
+        const cutoff = arrivedAt - prebuffer.windowMs;
+        while (this.ring.length > 0) {
+          const oldest = this.ring[0];
+          if (oldest === void 0) break;
+          const tooOld = oldest.arrivedAt < cutoff;
+          const tooBig = this.ringBytes > prebuffer.maxBytes;
+          if (!tooOld && !tooBig || this.ring.length === 1) break;
+          this.ring.shift();
+          this.ringBytes -= oldest.unit.data.length;
         }
       }
-      async delete({ location, relativePath }) {
-        const filePath = await this.resolve({
-          location,
-          relativePath
-        });
-        await node_fs.promises.rm(filePath, { force: true });
+      /**
+      * The ring as a subscriber should receive it — window applied AT SUBSCRIBE
+      * time, not only at publish time. A camera that went quiet keeps its last
+      * fragment in the ring indefinitely (see the never-evict-the-newest rule),
+      * and replaying a 40-second-old fragment as "prebuffer" would put stale video
+      * at the head of a clip iOS presents as the moment of the event.
+      */
+      trimmedRing() {
+        const prebuffer = this.prebuffer;
+        if (prebuffer === void 0) return [];
+        const cutoff = this.now() - prebuffer.windowMs;
+        return this.ring.filter((r) => r.arrivedAt >= cutoff);
       }
-      async getAvailableSpace({ location }) {
-        const base = this.locationPaths.get(location);
-        if (!base) return null;
-        try {
-          let target = base;
-          while (!node_fs.existsSync(target)) {
-            const parent = node_path.dirname(target);
-            if (!parent || parent === target) return null;
-            target = parent;
-          }
-          const stats = await node_fs.promises.statfs(target);
-          return stats.bavail * stats.bsize;
-        } catch {
-          return null;
+      enqueue(sub, unit) {
+        if (sub.queue.length >= sub.capacity) {
+          this.logger?.warn("fmp4 plane: subscriber fell behind \u2014 CLOSING it rather than gapping it", { meta: {
+            subscriptionId: sub.id,
+            tag: sub.tag,
+            capacity: sub.capacity,
+            delivered: sub.delivered
+          } });
+          this.closeSubscription(sub, "slow-consumer");
+          return;
         }
+        sub.queue.push({
+          kind: unit.kind,
+          data: unit.data,
+          sequence: unit.sequence,
+          isLast: false
+        });
+        this.wake(sub);
       }
-      /** Get the resolved path for a location type (addon-declared ids fall back
-      *  to `<rootPath>/<id>`). */
-      getLocationPath(location) {
-        return this.locationPaths.get(location) ?? node_path.join(this.rootPath, location);
+      closeSubscription(sub, reason) {
+        if (sub.closedReason !== null) return;
+        sub.closedReason = reason;
+        if (reason === "slow-consumer") sub.queue.length = 0;
+        this.wake(sub);
       }
-      /** Get the root path */
-      getRootPath() {
-        return this.rootPath;
+      wake(sub) {
+        const resume = sub.wake;
+        sub.wake = null;
+        resume?.();
       }
-    };
-    function signExpiringUrl(secret, id, expMs) {
-      return (0, node_crypto.createHmac)("sha256", secret).update(`${id}:${String(expMs)}`).digest("hex");
-    }
-    function verifyExpiringUrl(input) {
-      const { secret, id, exp, sig, nowMs } = input;
-      if (exp === void 0 || sig === void 0) return false;
-      const expMs = typeof exp === "number" ? exp : Number(exp);
-      if (!Number.isFinite(expMs)) return false;
-      if (expMs <= nowMs) return false;
-      const expected = signExpiringUrl(secret, id, expMs);
-      const a = Buffer.from(expected, "utf8");
-      const b = Buffer.from(sig, "utf8");
-      if (a.length !== b.length) return false;
-      return (0, node_crypto.timingSafeEqual)(a, b);
-    }
-    function canonicalDeviceFingerprint(shape) {
-      const features = [...new Set(shape.features)].toSorted();
-      return require_canonical_hash.canonicalHash({
-        deviceType: shape.deviceType,
-        features
-      });
-    }
-    function diffExportTargets(desired, lastAdvertised) {
-      const toAdd = [];
-      const toUpdate = [];
-      const desiredIds = /* @__PURE__ */ new Set();
-      for (const entry of desired) {
-        desiredIds.add(entry.deviceId);
-        const previous = lastAdvertised.get(entry.deviceId);
-        if (previous === void 0) toAdd.push(entry);
-        else if (previous.fingerprint !== entry.fingerprint) toUpdate.push(entry);
+      facade(sub) {
+        const plane = this;
+        return {
+          id: sub.id,
+          tag: sub.tag,
+          get delivered() {
+            return sub.delivered;
+          },
+          get closedReason() {
+            return sub.closedReason;
+          },
+          packets: () => plane.iterate(sub),
+          release: () => {
+            plane.closeSubscription(sub, "released");
+            plane.subscriptions.delete(sub.id);
+          }
+        };
       }
-      const toRemove = [];
-      for (const deviceId of lastAdvertised.keys()) if (!desiredIds.has(deviceId)) toRemove.push(deviceId);
-      return {
-        toAdd,
-        toUpdate,
-        toRemove
-      };
-    }
-    function resolveExportFingerprint(input) {
-      if (input.ready) return input.fresh;
-      return input.persisted ?? input.fresh;
-    }
+      async *iterate(sub) {
+        if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed \u2014 take a second subscription`);
+        sub.iterating = true;
+        for (; ; ) {
+          const next = sub.queue.shift();
+          if (next === void 0) {
+            if (sub.closedReason !== null) return;
+            await new Promise((resolve) => {
+              sub.wake = resolve;
+            });
+            continue;
+          }
+          const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
+          sub.delivered += 1;
+          yield {
+            ...next,
+            isLast
+          };
+          if (isLast) return;
+        }
+      }
+    };
     var DEFAULT_FIRST_DATA_TIMEOUT_MS = 8e3;
     var DEFAULT_RESTART_DELAY_MS = 1e3;
     var DEFAULT_STABLE_RUN_MS = 3e4;
@@ -64276,420 +64640,300 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
         if (typeof grace === "object" && grace !== null && "unref" in grace) grace.unref();
       }
     };
-    var DEFAULT_QUEUE_CAPACITY = 4;
-    var Fmp4FragmentPlane = class {
-      logger;
-      prebuffer;
-      now;
-      subscriptions = /* @__PURE__ */ new Map();
-      /** The last init unit seen, handed to every later subscriber. */
-      retainedInit = null;
-      ended = false;
-      /** Oldest first. Empty unless {@link Fmp4PrebufferOptions} was supplied. */
-      ring = [];
-      ringBytes = 0;
-      constructor(logger, prebuffer, now = Date.now) {
-        this.logger = logger;
-        this.prebuffer = prebuffer;
-        this.now = now;
-      }
-      get subscriberCount() {
-        return this.subscriptions.size;
-      }
-      /** True once {@link end} has been called — no further units are accepted. */
-      get isEnded() {
-        return this.ended;
-      }
-      /** What the prebuffer ring holds right now. All zeroes when disabled. */
-      prebufferStats() {
-        const oldest = this.ring[0];
-        return {
-          fragments: this.ring.length,
-          bytes: this.ringBytes,
-          spanMs: oldest === void 0 ? 0 : this.now() - oldest.arrivedAt
-        };
+    var CLOCK_TICKS_PER_SEC = 100;
+    var PAGE_BYTES = 4096;
+    var NO_COST_CLAIM = { release: () => void 0 };
+    var nodeProcStatReader = {
+      readStat: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/stat`, "utf8"),
+      readStatm: (pid) => (0, node_fs_promises.readFile)(`/proc/${pid}/statm`, "utf8")
+    };
+    function parseProcCpuSeconds(line) {
+      const close = line.lastIndexOf(")");
+      if (close < 0) return null;
+      const rest = line.slice(close + 1).trim().split(/\s+/);
+      const utime = Number(rest[11]);
+      const stime = Number(rest[12]);
+      if (!Number.isFinite(utime) || !Number.isFinite(stime)) return null;
+      return (utime + stime) / CLOCK_TICKS_PER_SEC;
+    }
+    function parseProcRssBytes(line) {
+      const fields = line.trim().split(/\s+/);
+      const residentPages = Number(fields[1]);
+      if (!Number.isFinite(residentPages)) return null;
+      return residentPages * PAGE_BYTES;
+    }
+    async function readProcessCost(pid, reader = nodeProcStatReader) {
+      let cpuSeconds = null;
+      let rssBytes = null;
+      try {
+        cpuSeconds = parseProcCpuSeconds(await reader.readStat(pid));
+      } catch {
+        cpuSeconds = null;
       }
-      subscribe(input) {
-        const replay = input.withPrebuffer === true ? this.trimmedRing() : [];
-        const requested = Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY);
-        const sub = {
-          id: `fmp4-${(0, node_crypto.randomUUID)()}`,
-          tag: input.tag,
-          subscribedAt: this.now(),
-          capacity: requested + replay.length,
-          queue: [],
-          delivered: 0,
-          closedReason: null,
-          wake: null,
-          iterating: false
-        };
-        this.subscriptions.set(sub.id, sub);
-        if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
-        for (const retained of replay) this.enqueue(sub, retained.unit);
-        if (this.ended) this.closeSubscription(sub, "ended");
-        this.logger?.info("fmp4 plane: subscribed", { meta: {
-          subscriptionId: sub.id,
-          tag: sub.tag,
-          hasRetainedInit: this.retainedInit !== null,
-          prebufferFragments: replay.length,
-          prebufferBytes: replay.reduce((n, r) => n + r.unit.data.length, 0)
-        } });
-        return this.facade(sub);
+      try {
+        rssBytes = parseProcRssBytes(await reader.readStatm(pid));
+      } catch {
+        rssBytes = null;
       }
-      /**
-      * Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
-      * emits exactly one per child, and a second means the child was respawned, in
-      * which case the old one describes a stream that no longer exists.
-      */
-      publish(unit) {
-        if (this.ended) return;
-        if (unit.kind === "init") {
-          this.retainedInit = unit;
-          this.ring.length = 0;
-          this.ringBytes = 0;
-        } else this.retain(unit);
-        for (const sub of this.subscriptions.values()) {
-          if (sub.closedReason !== null) continue;
-          this.enqueue(sub, unit);
-        }
+      return {
+        ...cpuSeconds === null ? {} : { cpuSeconds },
+        ...rssBytes === null ? {} : { rssBytes }
+      };
+    }
+    var ChildCostRegistry = class {
+      reader;
+      now;
+      claims = /* @__PURE__ */ new Map();
+      constructor(reader = nodeProcStatReader, now = Date.now) {
+        this.reader = reader;
+        this.now = now;
       }
       /**
-      * The producer stopped. Every subscriber drains what it holds; its final
-      * packet carries `isLast`, and its generator then completes.
+      * Record one child. The returned handle is the only way to remove it.
+      *
+      * A claim with no pid is dropped rather than stored: it could carry no
+      * measurement, and an entry with a camera and no numbers reads on a chart as
+      * a camera that cost nothing.
       */
-      end(reason = "producer ended") {
-        if (this.ended) return;
-        this.ended = true;
-        this.logger?.info("fmp4 plane: ended", { meta: {
-          reason,
-          subscribers: this.subscriptions.size
-        } });
-        for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
+      claim(input) {
+        const pid = input.pid;
+        if (pid === void 0 || !Number.isInteger(pid) || pid <= 0) return NO_COST_CLAIM;
+        const key = /* @__PURE__ */ Symbol("child-cost-claim");
+        this.claims.set(key, {
+          role: input.role,
+          deviceId: input.deviceId,
+          unit: input.unit,
+          attribution: input.attribution ?? "measured",
+          pid,
+          startedAtMs: this.now()
+        });
+        return { release: () => {
+          this.claims.delete(key);
+        } };
       }
-      listSubscribers() {
-        return [...this.subscriptions.values()].map((s) => ({
-          tag: s.tag,
-          subscribedAt: s.subscribedAt,
-          delivered: s.delivered,
-          closedReason: s.closedReason
+      /** Live claims, in claim order. Diagnostics and tests; not a contribution. */
+      list() {
+        return [...this.claims.values()].map((c) => ({
+          role: c.role,
+          deviceId: c.deviceId,
+          unit: c.unit,
+          attribution: c.attribution,
+          pid: c.pid
         }));
       }
-      /** End and forget everything. Idempotent. */
-      dispose() {
-        this.end("disposed");
-        this.subscriptions.clear();
-        this.retainedInit = null;
-        this.ring.length = 0;
-        this.ringBytes = 0;
-      }
       /**
-      * Add one fragment to the ring and evict from the front until BOTH bounds
-      * hold. Eviction is oldest-first, which is the one place in this file where
-      * dropping is correct: the ring is context, not stream — nobody is mid-decode
-      * on it, and a subscriber only ever receives a contiguous tail of it.
+      * This addon's contribution: one entry per live claim, with whatever the OS
+      * will tell us about that child right now.
+      *
+      * A child that has exited between the claim and this read contributes an
+      * entry with no numbers rather than no entry — the unit exists, the addon
+      * believes it is running, and hiding it would make a dying writer look like
+      * a writer that was never started.
       */
-      retain(unit) {
-        const prebuffer = this.prebuffer;
-        if (prebuffer === void 0) return;
-        const arrivedAt = this.now();
-        this.ring.push({
-          unit,
-          arrivedAt
+      async contributions() {
+        const out = [];
+        for (const claim of this.claims.values()) out.push({
+          role: claim.role,
+          deviceId: claim.deviceId,
+          attribution: claim.attribution,
+          unit: claim.unit,
+          pid: claim.pid,
+          startedAtMs: claim.startedAtMs,
+          ...await readProcessCost(claim.pid, this.reader)
         });
-        this.ringBytes += unit.data.length;
-        const cutoff = arrivedAt - prebuffer.windowMs;
-        while (this.ring.length > 0) {
-          const oldest = this.ring[0];
-          if (oldest === void 0) break;
-          const tooOld = oldest.arrivedAt < cutoff;
-          const tooBig = this.ringBytes > prebuffer.maxBytes;
-          if (!tooOld && !tooBig || this.ring.length === 1) break;
-          this.ring.shift();
-          this.ringBytes -= oldest.unit.data.length;
-        }
-      }
-      /**
-      * The ring as a subscriber should receive it — window applied AT SUBSCRIBE
-      * time, not only at publish time. A camera that went quiet keeps its last
-      * fragment in the ring indefinitely (see the never-evict-the-newest rule),
-      * and replaying a 40-second-old fragment as "prebuffer" would put stale video
-      * at the head of a clip iOS presents as the moment of the event.
-      */
-      trimmedRing() {
-        const prebuffer = this.prebuffer;
-        if (prebuffer === void 0) return [];
-        const cutoff = this.now() - prebuffer.windowMs;
-        return this.ring.filter((r) => r.arrivedAt >= cutoff);
+        return out;
       }
-      enqueue(sub, unit) {
-        if (sub.queue.length >= sub.capacity) {
-          this.logger?.warn("fmp4 plane: subscriber fell behind \u2014 CLOSING it rather than gapping it", { meta: {
-            subscriptionId: sub.id,
-            tag: sub.tag,
-            capacity: sub.capacity,
-            delivered: sub.delivered
-          } });
-          this.closeSubscription(sub, "slow-consumer");
-          return;
+    };
+    var STORAGE_LOCATION_TYPES = [
+      "data",
+      "media",
+      "recordings",
+      "recordings-high",
+      "recordings-low",
+      "recordings-clips",
+      "event-images",
+      "models",
+      "addons-data",
+      "cache",
+      "logs",
+      "backups"
+    ];
+    var DEFAULT_LOCATION_SUBDIRS = {
+      data: "db",
+      media: "media",
+      recordings: "recordings",
+      "recordings-high": "recordings-high",
+      "recordings-low": "recordings-low",
+      "recordings-clips": "recordings-clips",
+      "event-images": "event-images",
+      models: "models",
+      "addons-data": "addons-data",
+      cache: "/tmp/camstack-cache",
+      logs: "logs",
+      backups: "backups"
+    };
+    var FilesystemStorageProvider = class {
+      id = "local";
+      name = "Local Filesystem";
+      supportedLocations = [...STORAGE_LOCATION_TYPES];
+      rootPath;
+      locationPaths;
+      constructor(rootPath, overrides) {
+        this.rootPath = node_path.resolve(rootPath);
+        this.locationPaths = /* @__PURE__ */ new Map();
+        for (const loc of STORAGE_LOCATION_TYPES) {
+          const override = overrides?.[loc];
+          if (override) this.locationPaths.set(loc, node_path.resolve(override));
+          else {
+            const subdir = DEFAULT_LOCATION_SUBDIRS[loc] ?? loc;
+            this.locationPaths.set(loc, node_path.isAbsolute(subdir) ? subdir : node_path.join(this.rootPath, subdir));
+          }
         }
-        sub.queue.push({
-          kind: unit.kind,
-          data: unit.data,
-          sequence: unit.sequence,
-          isLast: false
-        });
-        this.wake(sub);
-      }
-      closeSubscription(sub, reason) {
-        if (sub.closedReason !== null) return;
-        sub.closedReason = reason;
-        if (reason === "slow-consumer") sub.queue.length = 0;
-        this.wake(sub);
-      }
-      wake(sub) {
-        const resume = sub.wake;
-        sub.wake = null;
-        resume?.();
+        for (const [loc, override] of Object.entries(overrides ?? {})) if (typeof override === "string" && !this.locationPaths.has(loc)) this.locationPaths.set(loc, node_path.resolve(override));
       }
-      facade(sub) {
-        const plane = this;
-        return {
-          id: sub.id,
-          tag: sub.tag,
-          get delivered() {
-            return sub.delivered;
-          },
-          get closedReason() {
-            return sub.closedReason;
-          },
-          packets: () => plane.iterate(sub),
-          release: () => {
-            plane.closeSubscription(sub, "released");
-            plane.subscriptions.delete(sub.id);
-          }
-        };
+      async resolve({ location, relativePath }) {
+        const base = this.locationPaths.get(location) ?? node_path.join(this.rootPath, location);
+        return node_path.join(base, relativePath);
       }
-      async *iterate(sub) {
-        if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed \u2014 take a second subscription`);
-        sub.iterating = true;
-        for (; ; ) {
-          const next = sub.queue.shift();
-          if (next === void 0) {
-            if (sub.closedReason !== null) return;
-            await new Promise((resolve) => {
-              sub.wake = resolve;
-            });
-            continue;
-          }
-          const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
-          sub.delivered += 1;
-          yield {
-            ...next,
-            isLast
-          };
-          if (isLast) return;
+      async write({ location, relativePath, data }) {
+        const filePath = await this.resolve({
+          location,
+          relativePath
+        });
+        await node_fs.promises.mkdir(node_path.dirname(filePath), { recursive: true });
+        if (Buffer.isBuffer(data)) await node_fs.promises.writeFile(filePath, data);
+        else {
+          const writeStream = node_fs.createWriteStream(filePath);
+          await new Promise((resolve, reject) => {
+            data.pipe(writeStream);
+            writeStream.on("finish", resolve);
+            writeStream.on("error", reject);
+          });
         }
       }
-    };
-    var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
-    var FRAGMENT_LOG_EVERY = 30;
-    var Fmp4FragmentChild = class {
-      deps;
-      args;
-      child = null;
-      splitter = new require_canonical_hash.Fmp4BoxSplitter();
-      stopped = false;
-      unitsOut = 0;
-      activeHwAccel = null;
-      constructor(deps, args) {
-        this.deps = deps;
-        this.args = args;
+      async read({ location, relativePath }) {
+        return node_fs.promises.readFile(await this.resolve({
+          location,
+          relativePath
+        }));
       }
-      /** Spawn, and resolve once the INIT segment has been cut out of stdout. */
-      async start() {
-        const requested = this.args.invocation.decodeHwAccel;
-        this.activeHwAccel = requested;
+      async exists({ location, relativePath }) {
         try {
-          await this.spawnAttempt(requested);
-          return;
-        } catch (err) {
-          if (this.stopped) throw err;
-          if (requested === null || require_canonical_hash.isSoftwareDecode(requested)) throw err;
-          this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment \u2014 retrying in SOFTWARE", {
-            tags: { deviceId: this.args.deviceId },
-            meta: {
-              sourceId: this.args.sourceId,
-              decodeHwAccel: requested,
-              error: require_err_msg.errMsg(err)
-            }
-          });
-          this.killChild();
-          this.splitter = new require_canonical_hash.Fmp4BoxSplitter();
-          this.activeHwAccel = null;
-          await this.spawnAttempt(null);
+          await node_fs.promises.access(await this.resolve({
+            location,
+            relativePath
+          }));
+          return true;
+        } catch {
+          return false;
         }
       }
-      /** The backend the child ACTUALLY ran with — `null` for software. */
-      activeDecodeHwAccel() {
-        const value = this.activeHwAccel;
-        return value === null || value === "none" || value === "copy" ? null : value;
-      }
-      /** Kill ffmpeg and end the plane. Idempotent. */
-      async stop() {
-        if (this.stopped) return;
-        this.stopped = true;
-        this.killChild();
-        this.args.plane.end("the fragment child stopped");
+      async list({ location, prefix }) {
+        const base = this.locationPaths.get(location);
+        if (!base) return [];
+        const dir = prefix ? node_path.join(base, prefix) : base;
+        try {
+          return (await node_fs.promises.readdir(dir, { withFileTypes: true })).map((e) => prefix ? `${prefix}/${e.name}` : e.name);
+        } catch {
+          return [];
+        }
       }
-      spawnAttempt(decodeHwAccel) {
-        const args = require_canonical_hash.buildFfmpegArgs({
-          ...this.args.invocation,
-          decodeHwAccel,
-          sink: {
-            kind: "stdout",
-            container: "mp4",
-            fragmentMs: this.args.fragmentMs
-          }
-        });
-        this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
-          tags: { deviceId: this.args.deviceId },
-          meta: {
-            sourceId: this.args.sourceId,
-            fragmentMs: this.args.fragmentMs,
-            decodeHwAccel: decodeHwAccel ?? "software",
-            argv: args.join(" ")
-          }
-        });
-        return new Promise((resolve, reject) => {
-          const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
-            "ignore",
-            "pipe",
-            "pipe"
-          ] });
-          this.child = child;
-          let settled = false;
-          let failed = false;
-          const isCurrent = () => !this.stopped && !failed;
-          const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
-          const settle = (fail) => {
-            if (settled) return;
-            settled = true;
-            clearTimeout(timer);
-            if (fail) {
-              failed = true;
-              reject(fail);
-            } else resolve();
-          };
-          const timer = setTimeout(() => {
-            settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
-            this.killChild();
-          }, timeoutMs);
-          timer.unref?.();
-          child.stdout?.on("data", (chunk) => {
-            for (const unit of this.splitter.push(chunk)) {
-              this.unitsOut += 1;
-              this.args.plane.publish(unit);
-              if (unit.kind === "init") {
-                this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
-                  tags: { deviceId: this.args.deviceId },
-                  meta: {
-                    sourceId: this.args.sourceId,
-                    bytes: unit.data.length
-                  }
-                });
-                settle();
-              } else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
-                tags: { deviceId: this.args.deviceId },
-                meta: {
-                  sourceId: this.args.sourceId,
-                  unitsOut: this.unitsOut,
-                  bytes: unit.data.length,
-                  subscribers: this.args.plane.subscriberCount
-                }
-              });
-            }
-            const fault = this.splitter.fault;
-            if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
-          });
-          child.stderr?.setEncoding("utf8");
-          child.stderr?.on("data", (line) => {
-            this.deps.logger.debug("fmp4 fragment child ffmpeg", {
-              tags: { deviceId: this.args.deviceId },
-              meta: {
-                sourceId: this.args.sourceId,
-                line: line.trim()
-              }
-            });
-          });
-          child.once("error", (err) => {
-            if (!settled) {
-              settle(err);
-              return;
-            }
-            if (!isCurrent()) return;
-            this.args.plane.end("the fragment child errored");
-            this.deps.onChildExit?.(err);
-          });
-          child.once("exit", (code, signal) => {
-            if (!settled) {
-              settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
-              return;
-            }
-            if (!isCurrent()) return;
-            const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
-            this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
-              tags: { deviceId: this.args.deviceId },
-              meta: {
-                sourceId: this.args.sourceId,
-                code,
-                signal,
-                unitsOut: this.unitsOut
-              }
-            });
-            this.args.plane.end("the fragment child exited");
-            this.deps.onChildExit?.(error);
-          });
+      async delete({ location, relativePath }) {
+        const filePath = await this.resolve({
+          location,
+          relativePath
         });
+        await node_fs.promises.rm(filePath, { force: true });
       }
-      /**
-      * The byte stream stopped being splittable. Not recoverable — the splitter
-      * cannot resynchronise mid-box — so the child is a corpse and every consumer
-      * has to be told, loudly, with the reason.
-      */
-      onFault(reason, wasLive, current, settle) {
-        const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
-        this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
-          tags: { deviceId: this.args.deviceId },
-          meta: {
-            sourceId: this.args.sourceId,
-            unitsOut: this.unitsOut,
-            interstitial: this.splitter.discardedInterstitialTypes,
-            reason
+      async getAvailableSpace({ location }) {
+        const base = this.locationPaths.get(location);
+        if (!base) return null;
+        try {
+          let target = base;
+          while (!node_fs.existsSync(target)) {
+            const parent = node_path.dirname(target);
+            if (!parent || parent === target) return null;
+            target = parent;
           }
-        });
-        this.killChild();
-        settle(error);
-        if (wasLive && current) {
-          this.args.plane.end("the fragment child produced unsplittable output");
-          this.deps.onChildExit?.(error);
+          const stats = await node_fs.promises.statfs(target);
+          return stats.bavail * stats.bsize;
+        } catch {
+          return null;
         }
       }
-      killChild() {
-        const child = this.child;
-        this.child = null;
-        if (child && !child.killed) try {
-          child.kill("SIGTERM");
-        } catch (err) {
-          this.deps.logger.warn("fmp4 fragment child: kill error", {
-            tags: { deviceId: this.args.deviceId },
-            meta: {
-              sourceId: this.args.sourceId,
-              error: require_err_msg.errMsg(err)
-            }
-          });
-        }
+      /** Get the resolved path for a location type (addon-declared ids fall back
+      *  to `<rootPath>/<id>`). */
+      getLocationPath(location) {
+        return this.locationPaths.get(location) ?? node_path.join(this.rootPath, location);
+      }
+      /** Get the root path */
+      getRootPath() {
+        return this.rootPath;
       }
     };
+    function physicalRootOf(root, realpath = node_fs.realpathSync) {
+      const resolved = node_path.default.resolve(root);
+      try {
+        return {
+          key: realpath(resolved),
+          resolved: true
+        };
+      } catch {
+        return {
+          key: resolved,
+          resolved: false
+        };
+      }
+    }
+    function containsOrEquals(outer, inner) {
+      if (outer === inner) return true;
+      const relative = node_path.default.relative(outer, inner);
+      return relative !== "" && !relative.startsWith("..") && !node_path.default.isAbsolute(relative);
+    }
+    function signExpiringUrl(secret, id, expMs) {
+      return (0, node_crypto.createHmac)("sha256", secret).update(`${id}:${String(expMs)}`).digest("hex");
+    }
+    function verifyExpiringUrl(input) {
+      const { secret, id, exp, sig, nowMs } = input;
+      if (exp === void 0 || sig === void 0) return false;
+      const expMs = typeof exp === "number" ? exp : Number(exp);
+      if (!Number.isFinite(expMs)) return false;
+      if (expMs <= nowMs) return false;
+      const expected = signExpiringUrl(secret, id, expMs);
+      const a = Buffer.from(expected, "utf8");
+      const b = Buffer.from(sig, "utf8");
+      if (a.length !== b.length) return false;
+      return (0, node_crypto.timingSafeEqual)(a, b);
+    }
+    function canonicalDeviceFingerprint(shape) {
+      const features = [...new Set(shape.features)].toSorted();
+      return require_canonical_hash.canonicalHash({
+        deviceType: shape.deviceType,
+        features
+      });
+    }
+    function diffExportTargets(desired, lastAdvertised) {
+      const toAdd = [];
+      const toUpdate = [];
+      const desiredIds = /* @__PURE__ */ new Set();
+      for (const entry of desired) {
+        desiredIds.add(entry.deviceId);
+        const previous = lastAdvertised.get(entry.deviceId);
+        if (previous === void 0) toAdd.push(entry);
+        else if (previous.fingerprint !== entry.fingerprint) toUpdate.push(entry);
+      }
+      const toRemove = [];
+      for (const deviceId of lastAdvertised.keys()) if (!desiredIds.has(deviceId)) toRemove.push(deviceId);
+      return {
+        toAdd,
+        toUpdate,
+        toRemove
+      };
+    }
+    function resolveExportFingerprint(input) {
+      if (input.ready) return input.fresh;
+      return input.persisted ?? input.fresh;
+    }
     exports.ChildCostRegistry = ChildCostRegistry;
     exports.FfmpegProcess = FfmpegProcess;
     exports.FilesystemStorageProvider = FilesystemStorageProvider;
@@ -64700,6 +64944,7 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
     exports.buildBinaryPath = buildBinaryPath;
     exports.canonicalDeviceFingerprint = canonicalDeviceFingerprint;
     exports.canonicalHash = require_canonical_hash.canonicalHash;
+    exports.containsOrEquals = containsOrEquals;
     exports.diffExportTargets = diffExportTargets;
     exports.downloadBinary = downloadBinary;
     exports.ensureBinary = ensureBinary;
@@ -64714,6 +64959,7 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
     exports.nodeProcStatReader = nodeProcStatReader;
     exports.parseProcCpuSeconds = parseProcCpuSeconds;
     exports.parseProcRssBytes = parseProcRssBytes;
+    exports.physicalRootOf = physicalRootOf;
     exports.readProcessCost = readProcessCost;
     exports.resolveExportFingerprint = resolveExportFingerprint;
     exports.signExpiringUrl = signExpiringUrl;
@@ -64730,8 +64976,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
-    var require_retired_settings_keys = require_retired_settings_keys_Dxv9S_lO();
+    var require_dist10 = require_dist_BFvWv_bz();
+    var require_retired_settings_keys = require_retired_settings_keys_Dd7K3K3r();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -70356,7 +70602,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -70493,7 +70739,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -70689,7 +70935,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -78502,7 +78748,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -79067,7 +79313,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -81651,7 +81897,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -82767,8 +83013,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
-    var require_retired_settings_keys = require_retired_settings_keys_Dxv9S_lO();
+    var require_dist10 = require_dist_BFvWv_bz();
+    var require_retired_settings_keys = require_retired_settings_keys_Dd7K3K3r();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -85258,10 +85504,11 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var require_hub_cap_forward = require_hub_cap_forward_DmHNjbB0();
     var zod = require_zod();
     var node_crypto = __require("crypto");
+    var _camstack_types_node = require_node();
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
     var node_path = __require("path");
@@ -85269,6 +85516,7 @@ var require_storage_orchestrator_addon = __commonJS({
     var STORAGE_LOCATIONS = "storage_locations";
     var NODE_ID_CONFIG_KEY = "__nodeId";
     var ENABLED_CONFIG_KEY = "__enabled";
+    var MODE_CONFIG_KEY = "__mode";
     var STORAGE_LOCATIONS_COLUMNS = [
       {
         name: "id",
@@ -85399,6 +85647,7 @@ var require_storage_orchestrator_addon = __commonJS({
       const storedConfig = { ...loc.config };
       if (loc.nodeId !== void 0) storedConfig[NODE_ID_CONFIG_KEY] = loc.nodeId;
       if (loc.enabled !== void 0) storedConfig[ENABLED_CONFIG_KEY] = loc.enabled;
+      if (loc.mode !== void 0) storedConfig[MODE_CONFIG_KEY] = loc.mode;
       return {
         id: loc.id,
         type: loc.type,
@@ -85423,9 +85672,12 @@ var require_storage_orchestrator_addon = __commonJS({
       const nodeId = typeof nodeIdRaw === "string" && nodeIdRaw.length > 0 ? nodeIdRaw : void 0;
       const enabledRaw = storedConfig[ENABLED_CONFIG_KEY];
       const enabled = typeof enabledRaw === "boolean" ? enabledRaw : void 0;
+      const parsedMode = require_dist10.StorageLocationModeSchema.safeParse(storedConfig[MODE_CONFIG_KEY]);
+      const mode = parsedMode.success ? parsedMode.data : void 0;
       const config = { ...storedConfig };
       delete config[NODE_ID_CONFIG_KEY];
       delete config[ENABLED_CONFIG_KEY];
+      delete config[MODE_CONFIG_KEY];
       return {
         id,
         type,
@@ -85434,6 +85686,7 @@ var require_storage_orchestrator_addon = __commonJS({
         config,
         ...nodeId !== void 0 ? { nodeId } : {},
         ...enabled !== void 0 ? { enabled } : {},
+        ...mode !== void 0 ? { mode } : {},
         ...require_dist10.LegacyStorageLocationDefaultSchema.parse({ isDefault: row["is_default"] === 1 || row["is_default"] === true }),
         isSystem: row["is_system"] === 1 || row["is_system"] === true,
         createdAt: Number(row["created_at"] ?? 0),
@@ -85764,7 +86017,8 @@ var require_storage_orchestrator_addon = __commonJS({
             const remaining = residue.filter((entry) => entry.storageClass === storageClass);
             if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its write set \u2014 there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
             for (const entry of remaining) {
-              if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED \u2014 a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen first.`);
+              const target = this.deps.locations.getLocationById(entry.toLocationId);
+              if (target !== void 0 && !require_dist10.mayWriteToLocation(target)) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is not a write target (mode: ${require_dist10.resolveLocationMode(target)}) \u2014 it takes no writes, and a drain is the largest write there is. Set it active on the Storage screen first.`);
               moves.push({
                 storageClass,
                 fromLocationId: entry.fromLocationId,
@@ -86097,12 +86351,9 @@ var require_storage_orchestrator_addon = __commonJS({
         for (const move of job.moves) {
           if (move.freezeSource !== true) continue;
           const loc = this.deps.locations.getLocationById(move.fromLocationId);
-          if (!loc || loc.enabled === false) continue;
+          if (!loc || !require_dist10.mayWriteToLocation(loc)) continue;
           const { createdAt: _c, updatedAt: _u, capacity: _cap, ...rest } = loc;
-          this.deps.locations.upsertLocation({
-            ...rest,
-            enabled: false
-          });
+          this.deps.locations.upsertLocation(require_dist10.withLocationMode(rest, "readonly"));
         }
       }
       /**
@@ -86267,6 +86518,126 @@ var require_storage_orchestrator_addon = __commonJS({
         declareCollection: async (input) => (await engine()).declareCollection(input)
       };
     }
+    var STORAGE_DRAIN_STATE = "storage_drain_state";
+    var STORAGE_DRAIN_STATE_COLUMNS = [
+      {
+        name: "location_id",
+        type: "TEXT",
+        primaryKey: true
+      },
+      {
+        name: "started_at_ms",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "start_bytes",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "cap_bytes",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "last_peer_bytes",
+        type: "INTEGER"
+      },
+      {
+        name: "last_sweep_ms",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "observed_growth_bytes",
+        type: "INTEGER",
+        notNull: true,
+        defaultValue: 0
+      },
+      {
+        name: "observed_elapsed_ms",
+        type: "INTEGER",
+        notNull: true,
+        defaultValue: 0
+      }
+    ];
+    function num(raw, fallback) {
+      return typeof raw === "number" && Number.isFinite(raw) ? raw : fallback;
+    }
+    function mapRow(row) {
+      const locationId = String(row["location_id"] ?? "");
+      if (!locationId) return null;
+      const lastPeerRaw = row["last_peer_bytes"];
+      return {
+        locationId,
+        startedAtMs: num(row["started_at_ms"], 0),
+        startBytes: num(row["start_bytes"], 0),
+        capBytes: num(row["cap_bytes"], 0),
+        lastPeerBytes: typeof lastPeerRaw === "number" && Number.isFinite(lastPeerRaw) ? lastPeerRaw : null,
+        lastSweepMs: num(row["last_sweep_ms"], 0),
+        observedGrowthBytes: num(row["observed_growth_bytes"], 0),
+        observedElapsedMs: num(row["observed_elapsed_ms"], 0)
+      };
+    }
+    function mapState(state) {
+      return {
+        location_id: state.locationId,
+        started_at_ms: state.startedAtMs,
+        start_bytes: state.startBytes,
+        cap_bytes: state.capBytes,
+        last_peer_bytes: state.lastPeerBytes,
+        last_sweep_ms: state.lastSweepMs,
+        observed_growth_bytes: state.observedGrowthBytes,
+        observed_elapsed_ms: state.observedElapsedMs
+      };
+    }
+    var SqliteDrainStateStore = class {
+      store;
+      declared = false;
+      constructor(store) {
+        this.store = store;
+      }
+      async ensureDeclared() {
+        if (this.declared) return;
+        await this.store.declareCollection({
+          collection: STORAGE_DRAIN_STATE,
+          columns: STORAGE_DRAIN_STATE_COLUMNS
+        });
+        this.declared = true;
+      }
+      async load() {
+        await this.ensureDeclared();
+        const rows = await this.store.query({ collection: STORAGE_DRAIN_STATE });
+        const out = [];
+        for (const row of rows) {
+          const mapped = mapRow(row.data);
+          if (mapped) out.push(mapped);
+        }
+        return out;
+      }
+      async save(state) {
+        await this.ensureDeclared();
+        await this.store.deleteWhere({
+          collection: STORAGE_DRAIN_STATE,
+          filter: { where: { location_id: state.locationId } }
+        });
+        await this.store.insert({
+          collection: STORAGE_DRAIN_STATE,
+          record: {
+            id: state.locationId,
+            data: mapState(state)
+          }
+        });
+      }
+      async clear(locationId) {
+        await this.ensureDeclared();
+        await this.store.deleteWhere({
+          collection: STORAGE_DRAIN_STATE,
+          filter: { where: { location_id: locationId } }
+        });
+      }
+    };
     function nodeOwnsItsDataStore(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -86346,6 +86717,101 @@ var require_storage_orchestrator_addon = __commonJS({
       }
       return "empty";
     }
+    var DEFAULT_STALE_AFTER_MS = 6e4;
+    var LocationOccupancySlice = class {
+      deps;
+      slice = /* @__PURE__ */ new Map();
+      refreshing = null;
+      lastRefreshMs = 0;
+      constructor(deps) {
+        this.deps = deps;
+      }
+      /**
+      * What the last completed refresh saw for this location, or `undefined` when
+      * nothing has reported for it. There is deliberately no fallback: unknown is
+      * the truth about a location nobody owns bytes on.
+      */
+      ownedFor(locationId) {
+        return this.slice.get(locationId);
+      }
+      /**
+      * Serve-and-revalidate. Called by every read: it returns immediately, and
+      * kicks a background refresh when the slice is older than the window. A read
+      * never awaits, and never joins a refresh already in flight (D224).
+      */
+      serveAndRevalidate() {
+        if (this.refreshing !== null) return;
+        const staleAfter = this.deps.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
+        if (this.lastRefreshMs !== 0 && this.deps.now() - this.lastRefreshMs < staleAfter) return;
+        this.refresh();
+      }
+      /**
+      * Ask every provider once and replace the slice.
+      *
+      * A provider that throws contributes NOTHING and is logged — it does not
+      * contribute a zero, and it does not take the other providers' answers down
+      * with it. A location that ends up with no contribution at all simply stays
+      * out of the slice, which is what makes it read back as unknown.
+      */
+      async refresh() {
+        if (this.refreshing !== null) return this.refreshing;
+        this.refreshing = this.runRefresh().finally(() => {
+          this.refreshing = null;
+        });
+        return this.refreshing;
+      }
+      async runRefresh() {
+        const locationIds = [...this.deps.locationIds()];
+        if (locationIds.length === 0) {
+          this.slice = /* @__PURE__ */ new Map();
+          this.lastRefreshMs = this.deps.now();
+          return;
+        }
+        const merged = /* @__PURE__ */ new Map();
+        for (const provider of this.deps.getProviders()) {
+          let reports;
+          try {
+            reports = await provider.getOccupancy({ locationIds });
+          } catch (err) {
+            this.deps.logger.warn("storage-orchestrator: a storage-occupancy provider failed \u2014 its bytes are MISSING from this refresh, not counted as zero", { meta: { error: err instanceof Error ? err.message : String(err) } });
+            continue;
+          }
+          for (const report of reports) {
+            const previous = merged.get(report.locationId);
+            merged.set(report.locationId, {
+              bytes: (previous?.bytes ?? 0) + report.ownedBytes,
+              measuredAtMs: previous === void 0 ? report.measuredAtMs : Math.min(previous.measuredAtMs, report.measuredAtMs)
+            });
+          }
+        }
+        this.slice = merged;
+        this.lastRefreshMs = this.deps.now();
+      }
+    };
+    function positiveNumber(raw) {
+      if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 0) return null;
+      return raw;
+    }
+    function resolveMinFreePercent(config, providerDefaultPercent, capacity, notice) {
+      const minFreeGb = positiveNumber(config["minFreeGb"]);
+      const minFreePercent = positiveNumber(config["minFreePercent"]);
+      const fallback = minFreePercent ?? providerDefaultPercent;
+      if (minFreeGb === null) return fallback;
+      if (minFreePercent !== null) notice("storage-orchestrator: location declares BOTH minFreeGb and minFreePercent \u2014 minFreeGb wins and minFreePercent is ignored. Remove one.", {
+        minFreeGb,
+        minFreePercent
+      });
+      const totalBytes = capacity?.totalBytes ?? 0;
+      if (totalBytes <= 0) {
+        notice("storage-orchestrator: minFreeGb cannot be converted \u2014 the volume total is unknown (remote node, or an unstattable path). Falling back to the percentage guard.", {
+          minFreeGb,
+          fallbackPercent: fallback
+        });
+        return fallback;
+      }
+      const percent = require_dist10.gbToBytes(minFreeGb) / totalBytes * 100;
+      return Math.min(100, percent);
+    }
     var FRAMEWORK_CONFIG_KEYS = /* @__PURE__ */ new Set([
       "basePath",
       "readOnly",
@@ -86413,7 +86879,7 @@ var require_storage_orchestrator_addon = __commonJS({
       return job.phase === "done" || job.phase === "failed" || job.phase === "cancelled";
     }
     function footageFrozen(location) {
-      return location.enabled === false || location.config["readOnly"] === true;
+      return require_dist10.evictionPolicyOfLocation(location) === "never";
     }
     var StorageCleanupCoordinator = class {
       deps;
@@ -86566,6 +87032,66 @@ var require_storage_orchestrator_addon = __commonJS({
         await this.deps.state.set(job);
       }
     };
+    function basePathOf(row) {
+      const raw = row.config["basePath"];
+      return typeof raw === "string" && raw.length > 0 ? raw : null;
+    }
+    function sameNode(a, b) {
+      return (a.nodeId ?? "hub") === (b.nodeId ?? "hub");
+    }
+    function findRootCollision(next, existing, resolveRoot, storedSelf) {
+      if (storedSelf !== void 0 && basePathOf(storedSelf) === basePathOf(next)) return { outcome: "clear" };
+      const basePath = basePathOf(next);
+      if (basePath === null) return { outcome: "clear" };
+      const root = resolveRoot(basePath);
+      if (!root.resolved) return {
+        outcome: "unknown",
+        unknown: {
+          reason: "unresolvable",
+          detail: `could not resolve "${basePath}" on this node`
+        }
+      };
+      for (const other of existing) {
+        if (other.id === next.id) continue;
+        if (other.type !== next.type) continue;
+        if (!sameNode(other, next)) continue;
+        const otherPath = basePathOf(other);
+        if (otherPath === null) continue;
+        const otherRoot = resolveRoot(otherPath);
+        if (!otherRoot.resolved) continue;
+        if (root.key === otherRoot.key) return {
+          outcome: "collides",
+          collision: {
+            otherId: other.id,
+            type: next.type,
+            sharedRoot: root.key,
+            kind: "equal"
+          }
+        };
+        if ((0, _camstack_types_node.containsOrEquals)(otherRoot.key, root.key)) return {
+          outcome: "collides",
+          collision: {
+            otherId: other.id,
+            type: next.type,
+            sharedRoot: otherRoot.key,
+            kind: "nested"
+          }
+        };
+        if ((0, _camstack_types_node.containsOrEquals)(root.key, otherRoot.key)) return {
+          outcome: "collides",
+          collision: {
+            otherId: other.id,
+            type: next.type,
+            sharedRoot: root.key,
+            kind: "nested"
+          }
+        };
+      }
+      return { outcome: "clear" };
+    }
+    function rootCollisionMessage(id, collision) {
+      return `Cannot save "${id}": it is ${collision.kind === "equal" ? `the same directory as "${collision.otherId}"` : `nested with "${collision.otherId}" (one is inside the other's tree)`}, and both are type "${collision.type}". Two locations of one type on the same disk share a class subtree, so every per-location figure double-counts and a deletion under one is a deletion under the other. Shared root: ${collision.sharedRoot}. Two locations of DIFFERENT types may share a root \u2014 that is how recordings and recordingsLow are configured by default.`;
+    }
     var SESSION_VOCABULARY = {
       upload: {
         idLabel: "uploadId",
@@ -86691,38 +87217,41 @@ var require_storage_orchestrator_addon = __commonJS({
         this.migrateOntoTheWriteSet(rows);
       }
       /**
-      * ONE explicit migration onto the enabled write set (D383), run once per
-      * boot against the rows that came off disk. Idempotent: the second boot finds
+      * ONE explicit migration onto the four-state model (D385), run once per boot
+      * against the rows that came off disk. Idempotent: the second boot finds
       * nothing to do.
       *
       * Two steps, in order, and each one is a WRITE — the point is that "absent"
       * stops existing rather than being re-interpreted on every read forever:
       *
-      *   1. A flagless row (persisted before `enabled` existed) is stamped
-      *      `enabled: true`. Absence already meant active, so this preserves
-      *      behaviour exactly; it is the operator's "the initial locations are
-      *      enabled" spelled into the store.
-      *   2. A type left with NO enabled row — only reachable from a hand-edited
-      *      store or a row an older build wrote — gets one enabled back, chosen as
+      *   1. A row with no `mode` is stamped with the mode its legacy flags imply
+      *      (`legacyModeOf`): `config.readOnly === true` → `readonly` and the
+      *      config key is DELETED; `enabled === false` → `readonly` (the
+      *      CONSERVATIVE direction — a state change must never start deleting
+      *      footage on its own); everything else → `active`. `withLocationMode`
+      *      derives `enabled` from the mode, so the two can never disagree, and
+      *      this subsumes the D383 pass that stamped flagless rows `enabled: true`.
+      *   2. A type left with NO write target — only reachable from a hand-edited
+      *      store or a row an older build wrote — gets one made `active`, chosen as
       *      the row the RETIRED default flag named, else the `:default`-slugged
       *      row, else the lexicographically first. Loudly: a class with no write
       *      target records nowhere, and refusing to repair it here would leave the
       *      hub silently unable to write with no operator action pending.
       *
-      * An operator's explicit `enabled: false` is never reversed by step 1 — only
-      * step 2 touches it, and only when the alternative is a class that cannot
-      * write at all.
+      * An operator's explicit `readonly`/`drain`/`disabled` is never reversed by
+      * step 1 — only step 2 touches it, and only when the alternative is a class
+      * that cannot write at all.
+      *
+      * On the live hub every location is enabled with no `readOnly`, so step 1 is
+      * a no-op that stamps `active` and nothing else changes.
       */
       migrateOntoTheWriteSet(rows) {
         const legacyDefaultOfType = /* @__PURE__ */ new Map();
         for (const row of rows) if (row.isDefault === true) legacyDefaultOfType.set(row.type, row.id);
         const stamped = [];
         for (const loc of this.locations.values()) {
-          if (loc.enabled !== void 0) continue;
-          this.persistMigrated({
-            ...loc,
-            enabled: true
-          });
+          if (loc.mode !== void 0) continue;
+          this.persistMigrated(require_dist10.withLocationMode(loc, require_dist10.legacyModeOf(loc) ?? "active"));
           stamped.push(loc.id);
         }
         const repaired = [];
@@ -86732,13 +87261,10 @@ var require_storage_orchestrator_addon = __commonJS({
           const legacyDefault = legacyDefaultOfType.get(type);
           const pick = ofType.find((l) => l.id === legacyDefault) ?? ofType.find((l) => l.id === `${type}:default`) ?? ofType.toSorted((a, b) => a.id.localeCompare(b.id))[0];
           if (!pick) continue;
-          this.persistMigrated({
-            ...pick,
-            enabled: true
-          });
+          this.persistMigrated(require_dist10.withLocationMode(pick, "active"));
           repaired.push(pick.id);
         }
-        if (stamped.length > 0 || repaired.length > 0) this.logger.info("storage-orchestrator: migrated locations onto the enabled write set", { meta: {
+        if (stamped.length > 0 || repaired.length > 0) this.logger.info("storage-orchestrator: migrated locations onto the state model", { meta: {
           stamped,
           repaired
         } });
@@ -86754,7 +87280,7 @@ var require_storage_orchestrator_addon = __commonJS({
         const store = this.locationStore;
         if (!store) return;
         store.upsert(withStamp).catch((err) => {
-          this.logger.error("storage-orchestrator: write-set migration persist failed", { meta: {
+          this.logger.error("storage-orchestrator: state-model migration persist failed", { meta: {
             id: withStamp.id,
             error: err instanceof Error ? err.message : String(err)
           } });
@@ -86896,12 +87422,11 @@ var require_storage_orchestrator_addon = __commonJS({
         for (const [id, enabled] of enabledByLocationId) {
           const location = nextById.get(id);
           if (!location) throw new Error(`Storage location "${id}" not found`);
-          if (location.enabled === enabled) continue;
-          const updated = {
+          if (require_dist10.isLocationEnabled(location) === enabled) continue;
+          const updated = require_dist10.withLocationMode({
             ...location,
-            enabled,
             updatedAt: now
-          };
+          }, enabled ? "active" : "readonly");
           nextById.set(id, updated);
           touched.set(id, updated);
         }
@@ -87006,22 +87531,19 @@ var require_storage_orchestrator_addon = __commonJS({
           ...input,
           nodeId: "hub"
         };
-        input = {
-          ...input,
-          ...resolveEnabled(input, existing, this.hasAnyLocationOfType(input.type))
-        };
-        const next = {
+        this.refuseSameTypeRootCollision(input, existing);
+        const next = require_dist10.withLocationMode({
           ...input,
           createdAt: existing?.createdAt ?? now,
           updatedAt: now
-        };
+        }, resolveUpsertMode(input, existing, this.hasAnyLocationOfType(input.type)));
         refuseLastWriteTargetDisabled(existing, next, this.locations.values());
         this.locations.set(next.id, next);
         this.logger.debug("storage-orchestrator: upsertLocation", { meta: {
           id: next.id,
           type: next.type,
           providerId: next.providerId,
-          enabled: next.enabled
+          mode: next.mode
         } });
         if (this.locationStore) {
           const store = this.locationStore;
@@ -87050,8 +87572,8 @@ var require_storage_orchestrator_addon = __commonJS({
         if (!loc) throw new Error(`Storage location "${id}" not found`);
         const ofType = [...this.locations.values()].filter((l) => l.type === loc.type);
         if (ofType.length <= 1) throw new Error(`Cannot delete "${id}" \u2014 it is the only location for type "${loc.type}"`);
-        const enabledOfType = ofType.filter((l) => l.enabled !== false);
-        if (loc.enabled !== false && enabledOfType.length <= 1) throw new Error(`Cannot delete "${id}" \u2014 it is the only enabled location for type "${loc.type}"`);
+        const enabledOfType = ofType.filter((l) => require_dist10.mayWriteToLocation(l));
+        if (require_dist10.mayWriteToLocation(loc) && enabledOfType.length <= 1) throw new Error(`Cannot delete "${id}" \u2014 it is the only enabled location for type "${loc.type}"`);
         const occupancy = await this.probeOccupancy(loc);
         if (occupancy !== "empty") {
           if (options?.force !== true) throw new Error(occupancy === "occupied" ? `Storage location "${id}" still holds data \u2014 drain it first (storage migration / relocate), or pass force to delete the record anyway and strand what is on it` : `Storage location "${id}" could not be checked for remaining data (unreachable provider, another node, or an unmounted root) \u2014 pass force to delete the record anyway`);
@@ -87292,29 +87814,57 @@ var require_storage_orchestrator_addon = __commonJS({
           basePath: input.basePath
         } });
       }
+      /**
+      * The same-type physical-root refusal (D389).
+      *
+      * An unresolvable root — another node's disk, a remote provider, a path that
+      * does not exist yet — WARNS and lets the write through. Refusing on a read
+      * that could not be taken blocks the operator on a doubt, and the recorder's
+      * demotion still catches what slips past (D49's spirit).
+      */
+      refuseSameTypeRootCollision(input, existing) {
+        const verdict = findRootCollision(input, this.locations.values(), this.resolveRoot, existing);
+        if (verdict.outcome === "clear") return;
+        if (verdict.outcome === "unknown") {
+          this.logger.warn("storage-orchestrator: could not check this location for a same-type root collision \u2014 saving it anyway. A read that fails is not a refusal; the recorder demotes a same-root duplicate it later finds.", { meta: {
+            id: input.id,
+            type: input.type,
+            ...verdict.unknown
+          } });
+          return;
+        }
+        throw new Error(rootCollisionMessage(input.id, verdict.collision));
+      }
+      /** Injectable so a test can drive symlinks and unresolvable paths without
+      *  touching a real filesystem. Production takes the shared derivation. */
+      resolveRoot = (basePath) => (0, _camstack_types_node.physicalRootOf)(basePath);
+      /** Test seam for {@link refuseSameTypeRootCollision}. */
+      setRootResolver(resolveRoot) {
+        this.resolveRoot = resolveRoot;
+      }
       /** Internal: check whether any location of the given type exists. */
       hasAnyLocationOfType(type) {
         for (const loc of this.locations.values()) if (loc.type === type) return true;
         return false;
       }
     };
-    function resolveEnabled(input, existing, typeAlreadyHasLocation) {
-      const requested = input.enabled ?? existing?.enabled;
-      if (requested === void 0) {
-        if (existing) return {};
-        return { enabled: !typeAlreadyHasLocation };
+    function resolveUpsertMode(input, existing, typeAlreadyHasLocation) {
+      if (input.mode !== void 0) {
+        if (input.enabled === void 0 || input.enabled === require_dist10.modeMayWrite(input.mode)) return input.mode;
       }
-      return { enabled: requested };
+      if (input.enabled !== void 0) return input.enabled ? "active" : "readonly";
+      if (existing) return require_dist10.resolveLocationMode(existing);
+      return typeAlreadyHasLocation ? "readonly" : "active";
     }
     var OPTIONAL_WRITE_TYPES = /* @__PURE__ */ new Set(["backups"]);
     function refuseLastWriteTargetDisabled(existing, next, locations) {
       if (OPTIONAL_WRITE_TYPES.has(next.type)) return;
-      if (next.enabled !== false) return;
+      if (require_dist10.mayWriteToLocation(next)) return;
       if (existing === void 0) return;
-      if (existing.enabled === false) return;
+      if (!require_dist10.mayWriteToLocation(existing)) return;
       for (const loc of locations) {
         if (loc.id === next.id || loc.type !== next.type) continue;
-        if (loc.enabled !== false) return;
+        if (require_dist10.mayWriteToLocation(loc)) return;
       }
       throw new Error(`Cannot disable "${next.id}": it is the last enabled location of type "${next.type}". Enable another location of this type first.`);
     }
@@ -87328,10 +87878,70 @@ var require_storage_orchestrator_addon = __commonJS({
         throw new Error(`Refusing the write-set change: it would leave type "${type}" with no enabled location. Enable one of ${ofType.map((loc) => loc.id).toSorted().join(", ")} first.`);
       }
     }
+    function beginDrain(observation) {
+      return {
+        locationId: observation.locationId,
+        startedAtMs: observation.atMs,
+        startBytes: observation.usedBytes,
+        capBytes: observation.usedBytes,
+        lastPeerBytes: observation.peerUsedBytes,
+        lastSweepMs: observation.atMs,
+        observedGrowthBytes: 0,
+        observedElapsedMs: 0
+      };
+    }
+    function stepDrain(previous, observation) {
+      if (previous === null) return {
+        state: beginDrain(observation),
+        capBytes: null,
+        drained: observation.usedBytes <= 0,
+        growthBytes: null
+      };
+      const growthBytes = previous.lastPeerBytes !== null && observation.peerUsedBytes !== null ? observation.peerUsedBytes - previous.lastPeerBytes : null;
+      const ceded = growthBytes !== null && growthBytes > 0 ? growthBytes : 0;
+      const nextCap = Math.max(0, Math.min(previous.capBytes, observation.usedBytes) - ceded);
+      const state = {
+        ...previous,
+        capBytes: nextCap,
+        lastPeerBytes: observation.peerUsedBytes ?? previous.lastPeerBytes,
+        lastSweepMs: observation.atMs,
+        observedGrowthBytes: previous.observedGrowthBytes + ceded,
+        observedElapsedMs: growthBytes === null ? previous.observedElapsedMs : previous.observedElapsedMs + Math.max(0, observation.atMs - previous.lastSweepMs)
+      };
+      if (observation.usedBytes <= 0) return {
+        state: {
+          ...state,
+          capBytes: 0
+        },
+        capBytes: null,
+        drained: true,
+        growthBytes
+      };
+      return {
+        state,
+        capBytes: nextCap,
+        drained: false,
+        growthBytes
+      };
+    }
+    function drainProgressOf(state, usedBytes, nowMs) {
+      const bytesRemaining = Math.max(0, usedBytes);
+      const rateBytesPerMs = state.observedGrowthBytes > 0 && state.observedElapsedMs > 0 ? state.observedGrowthBytes / state.observedElapsedMs : null;
+      return {
+        locationId: state.locationId,
+        startedAtMs: state.startedAtMs,
+        startBytes: state.startBytes,
+        bytesRemaining,
+        drained: bytesRemaining <= 0,
+        estimatedEmptyAtMs: rateBytesPerMs === null || bytesRemaining <= 0 ? null : nowMs + Math.ceil(bytesRemaining / rateBytesPerMs)
+      };
+    }
     var DEFAULT_MAX_ROUNDS = 8;
     var DEFAULT_HYSTERESIS_PERCENT = 1;
     var StoragePressureManager = class {
       deps;
+      /** Last sweep's drain progress, by location. Read-only surface for the UI. */
+      drainProgress = /* @__PURE__ */ new Map();
       constructor(deps) {
         this.deps = deps;
       }
@@ -87373,6 +87983,73 @@ var require_storage_orchestrator_addon = __commonJS({
             } });
           }
         }
+        await this.sweepDrains();
+      }
+      /**
+      * The drain pass (D386). A `drain` location is excluded from nothing — it is
+      * given a monotonically descending effective usage cap and handed to the SAME
+      * `relieveToUsageCap` machinery every other cap uses. There is no second
+      * eviction path, and no operator-facing rate.
+      */
+      async sweepDrains() {
+        const plan = await this.deps.getDrainPlan?.() ?? [];
+        const store = this.deps.drainState;
+        if (store === void 0) {
+          if (plan.length > 0) this.deps.logger.warn("storage drain: locations are draining but no durable state store is wired \u2014 the ratchet stays inert rather than restarting from scratch every boot", { meta: { locationIds: plan.map((e) => e.locationId) } });
+          this.drainProgress = /* @__PURE__ */ new Map();
+          return;
+        }
+        const persisted = new Map((await store.load()).map((state) => [state.locationId, state]));
+        const draining = new Set(plan.map((entry) => entry.locationId));
+        for (const locationId of persisted.keys()) {
+          if (draining.has(locationId)) continue;
+          await store.clear(locationId);
+          this.drainProgress.delete(locationId);
+          this.deps.logger.info("storage drain: stopped \u2014 location is no longer draining", { meta: { locationId } });
+        }
+        const nowMs = Date.now();
+        const progress = /* @__PURE__ */ new Map();
+        for (const entry of plan) try {
+          const usedBytes = await this.evictableUsageOf(entry.locationId);
+          const peerUsedBytes = entry.activePeerLocationIds.length === 0 ? null : await this.evictableUsageOfAll(entry.activePeerLocationIds);
+          const step = stepDrain(persisted.get(entry.locationId) ?? null, {
+            locationId: entry.locationId,
+            usedBytes,
+            peerUsedBytes,
+            atMs: nowMs
+          });
+          await store.save(step.state);
+          this.deps.logger.info("storage drain: sweep", { meta: {
+            locationId: entry.locationId,
+            usedBytes,
+            peerUsedBytes,
+            growthBytes: step.growthBytes,
+            capBytes: step.capBytes,
+            drained: step.drained
+          } });
+          if (step.capBytes !== null) await this.relieveToUsageCap(entry.locationId, step.capBytes);
+          progress.set(entry.locationId, drainProgressOf(step.state, await this.evictableUsageOf(entry.locationId), nowMs));
+        } catch (err) {
+          this.deps.logger.warn("storage drain: sweep failed for location", { meta: {
+            locationId: entry.locationId,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+        }
+        this.drainProgress = progress;
+      }
+      /** Progress for every draining location, as of the last sweep. The read a UI
+      *  asks for — it never triggers work of its own. */
+      drainProgressSnapshot() {
+        return [...this.drainProgress.values()];
+      }
+      /** Evictable bytes on one location, summed across every provider. */
+      async evictableUsageOf(locationId) {
+        const providers = this.deps.getEvictableProviders();
+        return (await Promise.all(providers.map(async (p) => (await p.getEvictableUsage({ locationId })).bytes))).reduce((sum, bytes) => sum + bytes, 0);
+      }
+      /** Evictable bytes across a set of locations. */
+      async evictableUsageOfAll(locationIds) {
+        return (await Promise.all(locationIds.map((id) => this.evictableUsageOf(id)))).reduce((sum, bytes) => sum + bytes, 0);
       }
       /** Evict oldest-first until the location's evictable usage fits `maxBytes`. */
       async relieveToUsageCap(locationId, maxBytes) {
@@ -87466,12 +88143,31 @@ var require_storage_orchestrator_addon = __commonJS({
     var STORAGE_PROVIDER_CAP_NAME = "storage-provider";
     var DATA_STORE_PROVIDER_CAP_NAME = "data-store-provider";
     var STORAGE_EVICTABLE_CAP_NAME = "storage-evictable";
+    var STORAGE_OCCUPANCY_CAP_NAME = "storage-occupancy";
     var HUB_NODE_ID = "hub";
     var PRESSURE_SWEEP_INTERVAL_MS = 6e4;
     var CAP_PROVIDER_REGISTERED_CATEGORY = "capability:provider-registered";
     var StorageOrchestratorAddon = class extends require_dist10.BaseAddon {
       service = null;
       pressureManager = null;
+      /**
+      * How much of each location CamStack itself holds (D388).
+      *
+      * Built on first use rather than in a field initializer: `this.ctx` does not
+      * exist until `initialize()` runs, and a field initializer touching it throws
+      * in the constructor.
+      */
+      occupancySlice = null;
+      get occupancy() {
+        if (this.occupancySlice) return this.occupancySlice;
+        this.occupancySlice = new LocationOccupancySlice({
+          logger: this.ctx.logger,
+          getProviders: () => this.ctx.kernel.capabilityRegistry?.getCollection(STORAGE_OCCUPANCY_CAP_NAME) ?? [],
+          locationIds: () => this.service?.listLocations().map((loc) => loc.id) ?? [],
+          now: () => Date.now()
+        });
+        return this.occupancySlice;
+      }
       pressureTimer = null;
       pressureSweepInFlight = false;
       migration = null;
@@ -87530,12 +88226,15 @@ var require_storage_orchestrator_addon = __commonJS({
         const provider = {
           listLocations: async ({ type }) => {
             const rows = type !== void 0 ? service.listLocations({ type }) : service.listLocations();
+            this.occupancy.serveAndRevalidate();
             return Promise.all(rows.map(async (loc) => ({
               ...this.redacted(loc),
+              ...this.occupancy.ownedFor(loc.id) !== void 0 ? { owned: this.occupancy.ownedFor(loc.id) } : {},
               capacity: require_dist10.isLocationEnabled(loc) ? await this.localCapacityOf(loc) : null
             })));
           },
           listLocationDeclarations: async () => service.listDeclarations(),
+          listDrainProgress: async () => this.drainProgress(),
           upsertLocation: async (input) => {
             const stored = service.getLocationById(input.id);
             const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
@@ -87543,10 +88242,13 @@ var require_storage_orchestrator_addon = __commonJS({
               ...input,
               config
             });
+            this.announceLocationsChanged(saved.id, saved.type, "upsert");
             return this.redacted(saved);
           },
           deleteLocation: async ({ id, force }) => {
+            const doomed = service.getLocationById(id);
             await service.deleteLocation(id, { force: force === true });
+            this.announceLocationsChanged(id, doomed?.type ?? "", "delete");
           },
           testLocation: async ({ id }) => {
             const loc = service.getLocationById(id);
@@ -87807,7 +88509,17 @@ var require_storage_orchestrator_addon = __commonJS({
           getEvictableProviders: () => this.ctx.kernel.capabilityRegistry?.getCollection(STORAGE_EVICTABLE_CAP_NAME) ?? [],
           getLocationThresholds: () => this.resolveLocationThresholds(),
           getLocationMaxUsedBytes: () => this.resolveLocationMaxUsedBytes(),
-          getLocationDeviceKey: (id) => this.locationDeviceKey(id)
+          getLocationDeviceKey: (id) => this.locationDeviceKey(id),
+          getDrainPlan: () => Promise.resolve(this.resolveDrainPlan()),
+          drainState: {
+            load: async () => await this.resolveDrainStore()?.load() ?? [],
+            save: async (state) => {
+              await this.resolveDrainStore()?.save(state);
+            },
+            clear: async (locationId) => {
+              await this.resolveDrainStore()?.clear(locationId);
+            }
+          }
         });
         this.pressureTimer = setInterval(() => {
           this.runPressureSweep();
@@ -87957,14 +88669,64 @@ var require_storage_orchestrator_addon = __commonJS({
         });
         const byProvider = new Map(infos.map((i) => [i.providerId, i]));
         for (const loc of svc.listLocations()) {
+          if (!require_dist10.mayReadLocation(loc)) continue;
           const info = byProvider.get(loc.providerId);
           if (!info || !info.shouldSaveDiskSpace) continue;
-          const override = loc.config["minFreePercent"];
-          const threshold = typeof override === "number" && Number.isFinite(override) && override >= 0 ? override : info.minFreePercent ?? 0;
+          const threshold = resolveMinFreePercent(loc.config, info.minFreePercent ?? 0, await this.localCapacityOf(loc), (message, meta) => this.logMinFreeRedundancyOnce(loc.id, message, meta));
           if (threshold > 0) out.set(loc.id, threshold);
         }
         return out;
       }
+      /** Location ids that have already logged the `minFreeGb` / `minFreePercent`
+      *  redundancy. The pressure sweep runs on a timer; the notice is worth
+      *  exactly one line per location per process, not one per minute. */
+      minFreeRedundancyLogged = /* @__PURE__ */ new Set();
+      logMinFreeRedundancyOnce(locationId, message, meta) {
+        if (this.minFreeRedundancyLogged.has(locationId)) return;
+        this.minFreeRedundancyLogged.add(locationId);
+        this.ctx.logger.warn(message, { meta: {
+          locationId,
+          ...meta
+        } });
+      }
+      /**
+      * The draining locations and the ACTIVE peers of their class whose growth
+      * paces them (D386). Rebuilt every sweep from the live mode of every
+      * location, so this is also what STOPS a drain: a location the operator
+      * switched back simply stops appearing.
+      */
+      drainStore = null;
+      /** The drain ratchet's durable home, once a data-store engine exists. Same
+      *  late-wiring window as the location table — on an agent it is never. */
+      resolveDrainStore() {
+        if (this.drainStore) return this.drainStore;
+        const engine = this.ctx.kernel.capabilityRegistry?.getCollection(DATA_STORE_PROVIDER_CAP_NAME)[0];
+        if (!engine) return null;
+        this.drainStore = new SqliteDrainStateStore(engine);
+        return this.drainStore;
+      }
+      drainPlanRefusalLogged = false;
+      resolveDrainPlan() {
+        const svc = this.service;
+        if (!svc) return [];
+        if (this.resolveDrainStore() === null) {
+          const draining = svc.listLocations().filter((l) => require_dist10.evictionPolicyOfLocation(l) === "drain");
+          if (draining.length > 0 && !this.drainPlanRefusalLogged) {
+            this.drainPlanRefusalLogged = true;
+            this.ctx.logger.warn("storage-orchestrator: REFUSING to drain \u2014 this node has no data-store engine to persist the drain cap, and a cap recomputed at every boot would delete on a pace nobody chose", { meta: { locationIds: draining.map((l) => l.id) } });
+          }
+          return [];
+        }
+        const locations = svc.listLocations();
+        return locations.filter((loc) => require_dist10.evictionPolicyOfLocation(loc) === "drain").map((loc) => ({
+          locationId: loc.id,
+          activePeerLocationIds: locations.filter((peer) => peer.type === loc.type && peer.id !== loc.id && require_dist10.mayWriteToLocation(peer)).map((peer) => peer.id)
+        }));
+      }
+      /** Drain progress for every draining location, as of the last sweep. */
+      drainProgress() {
+        return this.pressureManager?.drainProgressSnapshot() ?? [];
+      }
       /**
       * What the provider's own schema declared secret, or `undefined` when this
       * node has never heard from that provider. The distinction is the whole
@@ -87977,6 +88739,48 @@ var require_storage_orchestrator_addon = __commonJS({
       secretKeysFor(providerId, config) {
         return secretKeysForConfig(config, this.declaredSecretKeys(providerId));
       }
+      /**
+      * Ring the doorbell: the SET of storage locations changed (D387).
+      *
+      * A consumer that resolves locations at boot had no way to learn that the
+      * operator added, edited or removed one — the recorder kept writing to the
+      * disk set it resolved hours ago, and an operator who added a second
+      * recordings disk in the admin UI got nothing until something unrelated
+      * happened to re-resolve.
+      *
+      * Telemetry, and deliberately so (D8/D11): it carries no row, it is allowed
+      * to be dropped, and every consumer re-reads `listLocations` for itself and
+      * converges on its own periodic path anyway. A bulk edit rings it once per
+      * row — coalescing is the consumer's job, not this one's.
+      *
+      * Never throws into the mutation that produced it: the location IS saved,
+      * and a bus that will not take a telemetry event must not turn that into a
+      * failed upsert.
+      */
+      announceLocationsChanged(locationId, locationType, reason) {
+        try {
+          this.ctx.eventBus.emit({
+            id: (0, node_crypto.randomUUID)(),
+            timestamp: /* @__PURE__ */ new Date(),
+            source: {
+              type: "addon",
+              id: this.ctx.id
+            },
+            category: require_dist10.EventCategory.StorageLocationsChanged,
+            data: {
+              locationId,
+              locationType,
+              reason
+            }
+          });
+        } catch (err) {
+          this.ctx.logger.warn("storage-orchestrator: could not announce the location change \u2014 consumers will converge on their own periodic path", { meta: {
+            locationId,
+            reason,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+        }
+      }
       /** A location with its provider's declared secrets replaced by the sentinel. */
       redacted(location) {
         return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
@@ -88035,8 +88839,9 @@ var require_storage_orchestrator_addon = __commonJS({
         const svc = this.service;
         if (!svc) return out;
         for (const loc of svc.listLocations()) {
+          if (!require_dist10.mayReadLocation(loc)) continue;
           const raw = loc.config["maxUsedGb"];
-          if (typeof raw === "number" && Number.isFinite(raw) && raw > 0) out.set(loc.id, Math.floor(raw * 1024 ** 3));
+          if (typeof raw === "number" && Number.isFinite(raw) && raw > 0) out.set(loc.id, require_dist10.gbToBytes(raw));
         }
         return out;
       }
@@ -88255,7 +89060,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -106316,7 +107121,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -108092,9 +108897,9 @@ ${(0, node_fs.readFileSync)(ca.caCertPath, "utf-8").trimEnd()}
   }
 });
 
-// ../types/dist/event-category-b8kBSOTT.js
-var require_event_category_b8kBSOTT = __commonJS({
-  "../types/dist/event-category-b8kBSOTT.js"(exports) {
+// ../types/dist/event-category-BVo6ta6_.js
+var require_event_category_BVo6ta6 = __commonJS({
+  "../types/dist/event-category-BVo6ta6_.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
@@ -108142,6 +108947,7 @@ var require_event_category_b8kBSOTT = __commonJS({
       EventCategory2["ProcessCrashed"] = "process.crashed";
       EventCategory2["ProcessRestartScheduled"] = "process.restart_scheduled";
       EventCategory2["ProcessRestarted"] = "process.restarted";
+      EventCategory2["StorageLocationsChanged"] = "storage.locations-changed";
       EventCategory2["RecordingStarted"] = "recording.started";
       EventCategory2["RecordingStopped"] = "recording.stopped";
       EventCategory2["RecordingError"] = "recording.error";
@@ -108260,11 +109066,11 @@ var require_event_category_b8kBSOTT = __commonJS({
   }
 });
 
-// ../types/dist/sleep-DDIFZGbc.js
-var require_sleep_DDIFZGbc = __commonJS({
-  "../types/dist/sleep-DDIFZGbc.js"(exports) {
+// ../types/dist/sleep-BZtO-eFY.js
+var require_sleep_BZtO_eFY = __commonJS({
+  "../types/dist/sleep-BZtO-eFY.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_b8kBSOTT();
+    var require_event_category = require_event_category_BVo6ta6();
     var zod = require_zod();
     var WELL_KNOWN_TABS = [
       {
@@ -111993,8 +112799,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_b8kBSOTT();
-    var require_sleep = require_sleep_DDIFZGbc();
+    var require_event_category = require_event_category_BVo6ta6();
+    var require_sleep = require_sleep_BZtO_eFY();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -112270,6 +113076,7 @@ var require_addon = __commonJS({
         "listTargetKinds",
         "listTargets"
       ],
+      "storage-occupancy": ["getOccupancy"],
       "storage-provider": ["list"],
       "turn-provider": ["getTurnServers"],
       "user-passkeys": ["listPasskeys"]
@@ -130924,7 +131731,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_jZb_HKI5();
+    var require_dist10 = require_dist_BFvWv_bz();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -212020,7 +212827,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_b8kBSOTT();
+    var require_event_category = require_event_category_BVo6ta6();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -212040,8 +212847,8 @@ var require_dist4 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_b8kBSOTT();
-    var require_sleep = require_sleep_DDIFZGbc();
+    var require_event_category = require_event_category_BVo6ta6();
+    var require_sleep = require_sleep_BZtO_eFY();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -213621,6 +214428,71 @@ var require_dist4 = __commonJS({
       "clip",
       "custom"
     ];
+    var STORAGE_LOCATION_MODES = [
+      "active",
+      "readonly",
+      "drain",
+      "disabled"
+    ];
+    var StorageLocationModeSchema = zod.z.enum(STORAGE_LOCATION_MODES);
+    var StorageEvictionPolicySchema = zod.z.enum([
+      "normal",
+      "never",
+      "drain"
+    ]);
+    var LEGACY_READ_ONLY_CONFIG_KEY = "readOnly";
+    function modeMayWrite(mode) {
+      return mode === "active";
+    }
+    function modeMayRead(mode) {
+      return mode !== "disabled";
+    }
+    function evictionPolicyForMode(mode) {
+      switch (mode) {
+        case "active":
+          return "normal";
+        case "drain":
+          return "drain";
+        case "readonly":
+        case "disabled":
+          return "never";
+      }
+    }
+    function legacyModeOf(location) {
+      if (location.mode !== void 0) return null;
+      if (location.config["readOnly"] === true) return "readonly";
+      if (location.enabled === false) return "readonly";
+      return null;
+    }
+    function resolveLocationMode(location) {
+      return (isStorageLocationMode(location.mode) ? location.mode : void 0) ?? legacyModeOf(location) ?? "active";
+    }
+    function isStorageLocationMode(value) {
+      return STORAGE_LOCATION_MODES.some((mode) => mode === value);
+    }
+    function mayWriteToLocation(location) {
+      return modeMayWrite(resolveLocationMode(location));
+    }
+    function mayReadLocation(location) {
+      return modeMayRead(resolveLocationMode(location));
+    }
+    function evictionPolicyOfLocation(location) {
+      return evictionPolicyForMode(resolveLocationMode(location));
+    }
+    function strippedOfLegacyReadOnly(config) {
+      if (!("readOnly" in config)) return config;
+      const next = { ...config };
+      delete next[LEGACY_READ_ONLY_CONFIG_KEY];
+      return next;
+    }
+    function withLocationMode(location, mode) {
+      return {
+        ...location,
+        mode,
+        enabled: modeMayWrite(mode),
+        config: strippedOfLegacyReadOnly(location.config)
+      };
+    }
     var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
     var StorageLocationSchema = zod.z.object({
       id: zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
@@ -213652,6 +214524,21 @@ var require_dist4 = __commonJS({
       * stops existing rather than being re-derived on every read.
       */
       enabled: zod.z.boolean().optional(),
+      /**
+      * THE state of this location (D385), and the only authority on what may be
+      * written, read or evicted here. Interpreted in exactly one place —
+      * `storage-location-mode.ts` — which also folds the legacy
+      * `enabled` / `config.readOnly` pair into a mode so an old row is never
+      * ambiguous.
+      *
+      * OPTIONAL only for the wire and for rows written before D385: absence is
+      * resolved by `resolveLocationMode`, and the orchestrator stamps every
+      * unstamped row ONCE at hydrate so absence stops existing rather than being
+      * re-derived on every read. `enabled` survives one release as a DERIVED
+      * mirror (`mode === 'active'`); `withLocationMode` is the only writer of
+      * either, so the two cannot disagree.
+      */
+      mode: StorageLocationModeSchema.optional(),
       /** COMPUTED at read time by the orchestrator (statfs of the backing volume
       *  for node-local locations it can reach) — never persisted, absent when the
       *  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -213659,13 +214546,47 @@ var require_dist4 = __commonJS({
         totalBytes: zod.z.number(),
         availableBytes: zod.z.number()
       }).nullable().optional(),
+      /**
+      * How much of that volume CamStack ITSELF holds on this location (D388) —
+      * COMPUTED at read time from the `storage-occupancy` providers' own figures,
+      * never persisted, never a filesystem walk.
+      *
+      * **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
+      * location yet — nobody stores here, the owning addon is down, or the first
+      * refresh has not completed. A UI must omit the segment rather than draw it
+      * at zero, which would claim we occupy nothing (D315). It is an OBJECT and
+      * not a bare number precisely so that a `?? 0` on the consuming side has to
+      * be spelled out loud instead of appearing by accident.
+      *
+      * `measuredAtMs` is the OLDEST contributing measurement, so it is honest
+      * about the whole figure rather than about its freshest part.
+      */
+      owned: zod.z.object({
+        bytes: zod.z.number().int().nonnegative(),
+        measuredAtMs: zod.z.number().int().nonnegative()
+      }).optional(),
       createdAt: zod.z.number(),
       updatedAt: zod.z.number()
     });
     var LegacyStorageLocationDefaultSchema = zod.z.object({ isDefault: zod.z.boolean().optional() });
     function isLocationEnabled(location) {
-      return location.enabled !== false;
+      return mayWriteToLocation({
+        ...location,
+        config: location.config ?? {}
+      });
     }
+    var STORAGE_BYTES_PER_GB = 1024 ** 3;
+    function gbToBytes(gb) {
+      return Math.floor(gb * STORAGE_BYTES_PER_GB);
+    }
+    var StorageDrainProgressSchema = zod.z.object({
+      locationId: zod.z.string(),
+      startedAtMs: zod.z.number(),
+      startBytes: zod.z.number(),
+      bytesRemaining: zod.z.number(),
+      drained: zod.z.boolean(),
+      estimatedEmptyAtMs: zod.z.number().nullable()
+    });
     var StorageLocationRefSchema = zod.z.union([StorageLocationTypeSchema, zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
     var StorageAccessSchema = zod.z.enum(["local-path", "cap-mediated"]);
     var STORAGE_ACCESS_FALLBACK = "local-path";
@@ -230016,6 +230937,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * How far each draining location has got (D386). A pure READ of what the
+        * last pressure sweep computed — it starts no work, and a location that is
+        * not draining simply does not appear.
+        */
+        listDrainProgress: require_sleep.method(zod.z.void(), zod.z.array(StorageDrainProgressSchema).readonly()),
         testLocation: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({
           ok: zod.z.boolean(),
           error: zod.z.string().optional()
@@ -230145,6 +231072,37 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         history: require_sleep.method(zod.z.object({}), zod.z.array(StorageMigrationJobSchema).readonly(), { auth: "admin" })
       }
     };
+    var StorageOccupancyReportSchema = zod.z.object({
+      locationId: zod.z.string(),
+      /** Bytes this provider holds on THAT location — not its eviction domain, and
+      *  not net of what it is willing to delete. */
+      ownedBytes: zod.z.number().int().nonnegative(),
+      /** When the provider last actually measured this. The orchestrator carries it
+      *  through so a UI can say how old the figure is instead of implying "now". */
+      measuredAtMs: zod.z.number().int().nonnegative()
+    });
+    var storageOccupancyCapability = {
+      name: "storage-occupancy",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * Occupancy for the given locations, in ONE round trip.
+        *
+        * A provider answers only for the locations it actually holds bytes on and
+        * OMITS the rest — an omitted location is "I hold nothing measurable here",
+        * which the orchestrator merges as a contribution of nothing rather than as
+        * a claim that the location is empty. Only a location no provider reports
+        * at all stays unknown.
+        *
+        * This must be CHEAP and must never walk a filesystem: it is on the admin
+        * UI's `listLocations` path. The owner keeps its own figure fresh (D224) and
+        * answers from what it already has.
+        */
+        getOccupancy: require_sleep.method(zod.z.object({ locationIds: zod.z.array(zod.z.string()).readonly() }), zod.z.array(StorageOccupancyReportSchema).readonly(), { auth: "admin" })
+      }
+    };
     var ProviderInfoSchema = zod.z.discriminatedUnion("shouldSaveDiskSpace", [zod.z.object({
       providerId: zod.z.string().min(1),
       displayName: zod.z.string().min(1),
@@ -232104,94 +233062,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       *  whether persisting is worth a SQLite commit. */
       volatileStateFields: ["lastUpdated"]
     };
-    var NETWORK_LINK_TYPES = [
-      "wifi",
-      "ethernet",
-      "cellular",
-      "unknown"
-    ];
-    var NetworkLinkStatusSchema = zod.z.object({
-      /** The link the device is on. `'unknown'` = not read yet, not "no link". */
-      type: zod.z.enum(NETWORK_LINK_TYPES),
-      /**
-      * Link quality, 0..100 inclusive, normalised by the provider from whatever
-      * the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
-      * KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
-      * one whose reading has not landed must not be drawn at 0 %. Consumers
-      * SKIP a null rather than coerce it.
-      */
-      signalPercent: zod.z.number().min(0).max(100).nullable(),
-      /** Raw received signal strength in dBm, when the firmware reports one. */
-      rssiDbm: zod.z.number().optional(),
-      /** Network name of a wireless link, when the firmware reports it. */
-      ssid: zod.z.string().optional(),
-      /** Ms epoch of the last observation. Lets consumers reason about freshness. */
-      lastUpdated: zod.z.number()
-    });
-    var NETWORK_LINK_UNKNOWN = {
-      type: "unknown",
-      signalPercent: null,
-      lastUpdated: 0
-    };
-    function signalPercentFromBars(bars, maxBars) {
-      if (bars === void 0 || !Number.isFinite(bars) || maxBars <= 0) return null;
-      if (bars < 0 || bars > maxBars) return null;
-      return Math.round(bars / maxBars * 100);
-    }
-    function signalPercentFromRssi(rssiDbm) {
-      if (rssiDbm === void 0 || !Number.isFinite(rssiDbm) || rssiDbm > 0) return null;
-      return Math.round((Math.min(-50, Math.max(-100, rssiDbm)) + 100) * 2);
-    }
-    var networkLinkCapability = {
-      name: "network-link",
-      scope: "device",
-      deviceNative: true,
-      mode: "singleton",
-      deviceTypes: [
-        require_sleep.DeviceType.Camera,
-        require_sleep.DeviceType.Sensor,
-        require_sleep.DeviceType.Button,
-        require_sleep.DeviceType.Switch,
-        require_sleep.DeviceType.Light,
-        require_sleep.DeviceType.Lock,
-        require_sleep.DeviceType.Siren
-      ],
-      methods: {},
-      events: {
-        /**
-        * Emitted whenever the cached status changes (a link switch, a signal
-        * reading that moved). Mirrored on the parent chain by the
-        * DeviceEventPropagator like `battery.onStatusChanged`.
-        */
-        onStatusChanged: { data: zod.z.object({
-          deviceId: zod.z.number(),
-          status: NetworkLinkStatusSchema
-        }) }
-      },
-      status: {
-        schema: NetworkLinkStatusSchema,
-        kind: "push",
-        empty: NETWORK_LINK_UNKNOWN
-      },
-      /**
-      * Runtime-state slice — every provider stores the same shape under
-      * `device.runtimeState['network-link']`, read once by the badge and the
-      * Home Assistant projector regardless of the driver.
-      */
-      runtimeState: NetworkLinkStatusSchema,
-      /**
-      * Runtime-state durability: **restored** — a link reading is slow to
-      * change and a sleeping battery camera may not report for hours; the
-      * restored slice is what the badge shows until the next read.
-      *
-      * See `RuntimeStateDurability`. Enforced by
-      * `scripts/check-runtime-state-durability.ts`.
-      */
-      durability: "restored",
-      /** Clock fields: written, but excluded from the compare that decides
-      *  whether persisting is worth a SQLite commit. */
-      volatileStateFields: ["lastUpdated"]
-    };
     var BinaryStatusSchema = zod.z.object({
       on: zod.z.boolean(),
       /** Ms epoch of the last transition. 0 if never observed. */
@@ -235333,6 +236203,385 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       *  whether persisting is worth a SQLite commit. */
       volatileStateFields: ["lastFetchedAt"]
     };
+    var NavigationMoveCommandSchema = zod.z.object({
+      pan: zod.z.number().min(-1).max(1).optional(),
+      tilt: zod.z.number().min(-1).max(1).optional(),
+      speed: zod.z.number().min(0).max(1).optional()
+    });
+    var NavigationActionIdSchema = zod.z.enum([
+      "goHome",
+      "locate",
+      "spotClean",
+      "findPet",
+      "personFollow",
+      "stop",
+      "startClean",
+      "pauseClean",
+      "dockWash",
+      "autoEmpty",
+      "flashOn",
+      "flashOff"
+    ]);
+    var NavigationEntryKindSchema = zod.z.enum(["action", "sound"]);
+    var NavigationActionEntrySchema = zod.z.object({
+      id: zod.z.string(),
+      kind: NavigationEntryKindSchema,
+      label: zod.z.string(),
+      icon: zod.z.string(),
+      /** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
+      soundId: zod.z.number().int().optional(),
+      /** Per-device feature flag — render this entry only when true. */
+      enabled: zod.z.boolean()
+    });
+    var NAVIGATION_ACTION_CATALOG = [
+      {
+        id: "startClean",
+        kind: "action",
+        label: "Start cleaning",
+        icon: "play",
+        enabled: true
+      },
+      {
+        id: "pauseClean",
+        kind: "action",
+        label: "Pause cleaning",
+        icon: "pause",
+        enabled: true
+      },
+      {
+        id: "stop",
+        kind: "action",
+        label: "Stop",
+        icon: "hand",
+        enabled: true
+      },
+      {
+        id: "goHome",
+        kind: "action",
+        label: "Return to dock",
+        icon: "home",
+        enabled: true
+      },
+      {
+        id: "locate",
+        kind: "action",
+        label: "Locate",
+        icon: "bell",
+        enabled: true
+      },
+      {
+        id: "spotClean",
+        kind: "action",
+        label: "Spot clean here",
+        icon: "crosshair",
+        enabled: true
+      },
+      {
+        id: "findPet",
+        kind: "action",
+        label: "Find pet",
+        icon: "paw-print",
+        enabled: true
+      },
+      {
+        id: "personFollow",
+        kind: "action",
+        label: "Follow me",
+        icon: "footprints",
+        enabled: true
+      },
+      {
+        id: "dockWash",
+        kind: "action",
+        label: "Wash mop",
+        icon: "droplets",
+        enabled: true
+      },
+      {
+        id: "autoEmpty",
+        kind: "action",
+        label: "Empty dustbin",
+        icon: "trash-2",
+        enabled: true
+      },
+      {
+        id: "flashOn",
+        kind: "action",
+        label: "Flash on",
+        icon: "flashlight",
+        enabled: true
+      },
+      {
+        id: "flashOff",
+        kind: "action",
+        label: "Flash off",
+        icon: "flashlight-off",
+        enabled: true
+      },
+      {
+        id: "sound:meow",
+        kind: "sound",
+        label: "Meow",
+        icon: "cat",
+        soundId: 684,
+        enabled: true
+      },
+      {
+        id: "sound:bark",
+        kind: "sound",
+        label: "Woof",
+        icon: "dog",
+        soundId: 685,
+        enabled: true
+      },
+      {
+        id: "sound:footsteps",
+        kind: "sound",
+        label: "Footsteps",
+        icon: "footprints",
+        soundId: 686,
+        enabled: true
+      },
+      {
+        id: "sound:purring",
+        kind: "sound",
+        label: "Purring",
+        icon: "cat",
+        soundId: 687,
+        enabled: true
+      },
+      {
+        id: "sound:tickTock",
+        kind: "sound",
+        label: "Tick-tock",
+        icon: "clock",
+        soundId: 688,
+        enabled: true
+      }
+    ];
+    var NavigationPointSchema = zod.z.object({
+      x: zod.z.number(),
+      y: zod.z.number()
+    });
+    var NavigationFeaturesSchema = zod.z.object({
+      move: zod.z.boolean(),
+      stop: zod.z.boolean(),
+      goToPoint: zod.z.boolean(),
+      runAction: zod.z.boolean(),
+      playSound: zod.z.boolean(),
+      light: zod.z.boolean(),
+      lightMode: zod.z.boolean()
+    });
+    var NavigationLightModeSchema = zod.z.enum(["auto", "manual"]);
+    var NAVIGATION_LIGHT_LEVEL_MIN = 40;
+    var NAVIGATION_LIGHT_LEVEL_MAX = 100;
+    var NavigationModeSchema = zod.z.enum([
+      "idle",
+      "cleaning",
+      "spot",
+      "following",
+      "goto",
+      "returning",
+      "paused",
+      "unknown"
+    ]);
+    var NavigationStatusSchema = zod.z.object({
+      mode: NavigationModeSchema,
+      following: zod.z.boolean(),
+      flash: zod.z.boolean(),
+      lightMode: NavigationLightModeSchema,
+      lightLevel: zod.z.number().min(40).max(100),
+      /** Ms epoch when the slice was last updated. */
+      lastChangedAt: zod.z.number()
+    });
+    var NavigationRuntimeStateSchema = NavigationStatusSchema.extend({ lastFetchedAt: zod.z.number() });
+    var navigationCapability = {
+      name: "navigation",
+      scope: "device",
+      deviceNative: true,
+      mode: "singleton",
+      deviceTypes: [require_sleep.DeviceType.Camera],
+      deviceConfig: { ui: {
+        kind: "widget",
+        widgetId: "host/navigation-panel",
+        tab: "navigation",
+        topTab: true,
+        label: "Navigation",
+        order: 0
+      } },
+      methods: {
+        /**
+        * Momentary drive nudge (the robot moves). `protected` — mirrors
+        * `ptz.continuousMove` so the Viewer navigation panel (and the PTZ-mimic
+        * path) works for any authenticated user, not admin-only. The UI sends
+        * these at ~1 Hz while a control is held; the provider forwards each one to
+        * a single drive write WITHOUT debouncing.
+        */
+        move: require_sleep.method(NavigationMoveCommandSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+        /** Halt all motion immediately (zero drive vector). */
+        stop: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+        /** Send the robot to a point on its live map. */
+        goToPoint: require_sleep.method(NavigationPointSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Enumerate the discrete controls THIS device supports (data-driven UI +
+        * PTZ mimic). Camera-probed subset of {@link NAVIGATION_ACTION_CATALOG}.
+        */
+        listActions: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(NavigationActionEntrySchema)),
+        /**
+        * Run one discrete action (a `kind:'action'` dictionary entry). Invalid /
+        * unsupported action ids are rejected by the provider.
+        */
+        runAction: require_sleep.method(zod.z.object({
+          deviceId: zod.z.number(),
+          actionId: NavigationActionIdSchema
+        }), zod.z.void(), { kind: "mutation" }),
+        /** Play a sound by its wire id (the `soundId` of a `kind:'sound'` entry). */
+        playSound: require_sleep.method(zod.z.object({
+          deviceId: zod.z.number(),
+          soundId: zod.z.number().int()
+        }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Turn the on-camera fill light on / off (the `OpenFullLight` control —
+        * works anytime, no active stream required).
+        */
+        setLightOn: require_sleep.method(zod.z.object({
+          deviceId: zod.z.number(),
+          on: zod.z.boolean()
+        }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Set the fill-light mode (auto vs manual). `manual` optionally carries the
+        * initial `level`. The auto/manual + level control is a CAMERA-service
+        * action that generally needs an active camera stream/monitor session — the
+        * UI shows the manual level slider ONLY when `mode === 'manual'`.
+        */
+        setLightMode: require_sleep.method(zod.z.object({
+          deviceId: zod.z.number(),
+          mode: NavigationLightModeSchema,
+          level: zod.z.number().min(40).max(100).optional()
+        }), zod.z.void(), { kind: "mutation" }),
+        /** Set the MANUAL fill-light level (40..100). Implies `manual` mode. */
+        setLightLevel: require_sleep.method(zod.z.object({
+          deviceId: zod.z.number(),
+          level: zod.z.number().min(40).max(100)
+        }), zod.z.void(), { kind: "mutation" }),
+        /**
+        * Per-device FEATURE-FLAG report for the general primitives — drives which
+        * controls the UI shows (the per-entry flags for the dictionary come back on
+        * `listActions`).
+        */
+        getFeatures: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), NavigationFeaturesSchema)
+      },
+      events: { onStatusChanged: { data: zod.z.object({
+        deviceId: zod.z.number(),
+        status: NavigationStatusSchema
+      }) } },
+      status: {
+        schema: NavigationStatusSchema,
+        kind: "push"
+      },
+      /**
+      * Runtime-state slice mirrored by the kernel. The navigation panel watches it
+      * for live mode / follow / flash changes.
+      */
+      runtimeState: NavigationRuntimeStateSchema,
+      /**
+      * Runtime-state durability: **session** — like `vacuum-control`, a restored
+      * `mode: cleaning` / `following: true` is a robot that is not actually doing
+      * that. The live handle re-publishes on connect.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "session"
+    };
+    var NETWORK_LINK_TYPES = [
+      "wifi",
+      "ethernet",
+      "cellular",
+      "unknown"
+    ];
+    var NetworkLinkStatusSchema = zod.z.object({
+      /** The link the device is on. `'unknown'` = not read yet, not "no link". */
+      type: zod.z.enum(NETWORK_LINK_TYPES),
+      /**
+      * Link quality, 0..100 inclusive, normalised by the provider from whatever
+      * the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
+      * KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
+      * one whose reading has not landed must not be drawn at 0 %. Consumers
+      * SKIP a null rather than coerce it.
+      */
+      signalPercent: zod.z.number().min(0).max(100).nullable(),
+      /** Raw received signal strength in dBm, when the firmware reports one. */
+      rssiDbm: zod.z.number().optional(),
+      /** Network name of a wireless link, when the firmware reports it. */
+      ssid: zod.z.string().optional(),
+      /** Ms epoch of the last observation. Lets consumers reason about freshness. */
+      lastUpdated: zod.z.number()
+    });
+    var NETWORK_LINK_UNKNOWN = {
+      type: "unknown",
+      signalPercent: null,
+      lastUpdated: 0
+    };
+    function signalPercentFromBars(bars, maxBars) {
+      if (bars === void 0 || !Number.isFinite(bars) || maxBars <= 0) return null;
+      if (bars < 0 || bars > maxBars) return null;
+      return Math.round(bars / maxBars * 100);
+    }
+    function signalPercentFromRssi(rssiDbm) {
+      if (rssiDbm === void 0 || !Number.isFinite(rssiDbm) || rssiDbm > 0) return null;
+      return Math.round((Math.min(-50, Math.max(-100, rssiDbm)) + 100) * 2);
+    }
+    var networkLinkCapability = {
+      name: "network-link",
+      scope: "device",
+      deviceNative: true,
+      mode: "singleton",
+      deviceTypes: [
+        require_sleep.DeviceType.Camera,
+        require_sleep.DeviceType.Sensor,
+        require_sleep.DeviceType.Button,
+        require_sleep.DeviceType.Switch,
+        require_sleep.DeviceType.Light,
+        require_sleep.DeviceType.Lock,
+        require_sleep.DeviceType.Siren
+      ],
+      methods: {},
+      events: {
+        /**
+        * Emitted whenever the cached status changes (a link switch, a signal
+        * reading that moved). Mirrored on the parent chain by the
+        * DeviceEventPropagator like `battery.onStatusChanged`.
+        */
+        onStatusChanged: { data: zod.z.object({
+          deviceId: zod.z.number(),
+          status: NetworkLinkStatusSchema
+        }) }
+      },
+      status: {
+        schema: NetworkLinkStatusSchema,
+        kind: "push",
+        empty: NETWORK_LINK_UNKNOWN
+      },
+      /**
+      * Runtime-state slice — every provider stores the same shape under
+      * `device.runtimeState['network-link']`, read once by the badge and the
+      * Home Assistant projector regardless of the driver.
+      */
+      runtimeState: NetworkLinkStatusSchema,
+      /**
+      * Runtime-state durability: **restored** — a link reading is slow to
+      * change and a sleeping battery camera may not report for hours; the
+      * restored slice is what the badge shows until the next read.
+      *
+      * See `RuntimeStateDurability`. Enforced by
+      * `scripts/check-runtime-state-durability.ts`.
+      */
+      durability: "restored",
+      /** Clock fields: written, but excluded from the compare that decides
+      *  whether persisting is worth a SQLite commit. */
+      volatileStateFields: ["lastUpdated"]
+    };
     var StreamNetworkStatsSchema = zod.z.object({
       nominalBitrateKbps: zod.z.number(),
       observedBitrateKbps: zod.z.number(),
@@ -236904,297 +238153,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       durability: "session"
     };
-    var NavigationMoveCommandSchema = zod.z.object({
-      pan: zod.z.number().min(-1).max(1).optional(),
-      tilt: zod.z.number().min(-1).max(1).optional(),
-      speed: zod.z.number().min(0).max(1).optional()
-    });
-    var NavigationActionIdSchema = zod.z.enum([
-      "goHome",
-      "locate",
-      "spotClean",
-      "findPet",
-      "personFollow",
-      "stop",
-      "startClean",
-      "pauseClean",
-      "dockWash",
-      "autoEmpty",
-      "flashOn",
-      "flashOff"
-    ]);
-    var NavigationEntryKindSchema = zod.z.enum(["action", "sound"]);
-    var NavigationActionEntrySchema = zod.z.object({
-      id: zod.z.string(),
-      kind: NavigationEntryKindSchema,
-      label: zod.z.string(),
-      icon: zod.z.string(),
-      /** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
-      soundId: zod.z.number().int().optional(),
-      /** Per-device feature flag — render this entry only when true. */
-      enabled: zod.z.boolean()
-    });
-    var NAVIGATION_ACTION_CATALOG = [
-      {
-        id: "startClean",
-        kind: "action",
-        label: "Start cleaning",
-        icon: "play",
-        enabled: true
-      },
-      {
-        id: "pauseClean",
-        kind: "action",
-        label: "Pause cleaning",
-        icon: "pause",
-        enabled: true
-      },
-      {
-        id: "stop",
-        kind: "action",
-        label: "Stop",
-        icon: "hand",
-        enabled: true
-      },
-      {
-        id: "goHome",
-        kind: "action",
-        label: "Return to dock",
-        icon: "home",
-        enabled: true
-      },
-      {
-        id: "locate",
-        kind: "action",
-        label: "Locate",
-        icon: "bell",
-        enabled: true
-      },
-      {
-        id: "spotClean",
-        kind: "action",
-        label: "Spot clean here",
-        icon: "crosshair",
-        enabled: true
-      },
-      {
-        id: "findPet",
-        kind: "action",
-        label: "Find pet",
-        icon: "paw-print",
-        enabled: true
-      },
-      {
-        id: "personFollow",
-        kind: "action",
-        label: "Follow me",
-        icon: "footprints",
-        enabled: true
-      },
-      {
-        id: "dockWash",
-        kind: "action",
-        label: "Wash mop",
-        icon: "droplets",
-        enabled: true
-      },
-      {
-        id: "autoEmpty",
-        kind: "action",
-        label: "Empty dustbin",
-        icon: "trash-2",
-        enabled: true
-      },
-      {
-        id: "flashOn",
-        kind: "action",
-        label: "Flash on",
-        icon: "flashlight",
-        enabled: true
-      },
-      {
-        id: "flashOff",
-        kind: "action",
-        label: "Flash off",
-        icon: "flashlight-off",
-        enabled: true
-      },
-      {
-        id: "sound:meow",
-        kind: "sound",
-        label: "Meow",
-        icon: "cat",
-        soundId: 684,
-        enabled: true
-      },
-      {
-        id: "sound:bark",
-        kind: "sound",
-        label: "Woof",
-        icon: "dog",
-        soundId: 685,
-        enabled: true
-      },
-      {
-        id: "sound:footsteps",
-        kind: "sound",
-        label: "Footsteps",
-        icon: "footprints",
-        soundId: 686,
-        enabled: true
-      },
-      {
-        id: "sound:purring",
-        kind: "sound",
-        label: "Purring",
-        icon: "cat",
-        soundId: 687,
-        enabled: true
-      },
-      {
-        id: "sound:tickTock",
-        kind: "sound",
-        label: "Tick-tock",
-        icon: "clock",
-        soundId: 688,
-        enabled: true
-      }
-    ];
-    var NavigationPointSchema = zod.z.object({
-      x: zod.z.number(),
-      y: zod.z.number()
-    });
-    var NavigationFeaturesSchema = zod.z.object({
-      move: zod.z.boolean(),
-      stop: zod.z.boolean(),
-      goToPoint: zod.z.boolean(),
-      runAction: zod.z.boolean(),
-      playSound: zod.z.boolean(),
-      light: zod.z.boolean(),
-      lightMode: zod.z.boolean()
-    });
-    var NavigationLightModeSchema = zod.z.enum(["auto", "manual"]);
-    var NAVIGATION_LIGHT_LEVEL_MIN = 40;
-    var NAVIGATION_LIGHT_LEVEL_MAX = 100;
-    var NavigationModeSchema = zod.z.enum([
-      "idle",
-      "cleaning",
-      "spot",
-      "following",
-      "goto",
-      "returning",
-      "paused",
-      "unknown"
-    ]);
-    var NavigationStatusSchema = zod.z.object({
-      mode: NavigationModeSchema,
-      following: zod.z.boolean(),
-      flash: zod.z.boolean(),
-      lightMode: NavigationLightModeSchema,
-      lightLevel: zod.z.number().min(40).max(100),
-      /** Ms epoch when the slice was last updated. */
-      lastChangedAt: zod.z.number()
-    });
-    var NavigationRuntimeStateSchema = NavigationStatusSchema.extend({ lastFetchedAt: zod.z.number() });
-    var navigationCapability = {
-      name: "navigation",
-      scope: "device",
-      deviceNative: true,
-      mode: "singleton",
-      deviceTypes: [require_sleep.DeviceType.Camera],
-      deviceConfig: { ui: {
-        kind: "widget",
-        widgetId: "host/navigation-panel",
-        tab: "navigation",
-        topTab: true,
-        label: "Navigation",
-        order: 0
-      } },
-      methods: {
-        /**
-        * Momentary drive nudge (the robot moves). `protected` — mirrors
-        * `ptz.continuousMove` so the Viewer navigation panel (and the PTZ-mimic
-        * path) works for any authenticated user, not admin-only. The UI sends
-        * these at ~1 Hz while a control is held; the provider forwards each one to
-        * a single drive write WITHOUT debouncing.
-        */
-        move: require_sleep.method(NavigationMoveCommandSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-        /** Halt all motion immediately (zero drive vector). */
-        stop: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-        /** Send the robot to a point on its live map. */
-        goToPoint: require_sleep.method(NavigationPointSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Enumerate the discrete controls THIS device supports (data-driven UI +
-        * PTZ mimic). Camera-probed subset of {@link NAVIGATION_ACTION_CATALOG}.
-        */
-        listActions: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(NavigationActionEntrySchema)),
-        /**
-        * Run one discrete action (a `kind:'action'` dictionary entry). Invalid /
-        * unsupported action ids are rejected by the provider.
-        */
-        runAction: require_sleep.method(zod.z.object({
-          deviceId: zod.z.number(),
-          actionId: NavigationActionIdSchema
-        }), zod.z.void(), { kind: "mutation" }),
-        /** Play a sound by its wire id (the `soundId` of a `kind:'sound'` entry). */
-        playSound: require_sleep.method(zod.z.object({
-          deviceId: zod.z.number(),
-          soundId: zod.z.number().int()
-        }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Turn the on-camera fill light on / off (the `OpenFullLight` control —
-        * works anytime, no active stream required).
-        */
-        setLightOn: require_sleep.method(zod.z.object({
-          deviceId: zod.z.number(),
-          on: zod.z.boolean()
-        }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Set the fill-light mode (auto vs manual). `manual` optionally carries the
-        * initial `level`. The auto/manual + level control is a CAMERA-service
-        * action that generally needs an active camera stream/monitor session — the
-        * UI shows the manual level slider ONLY when `mode === 'manual'`.
-        */
-        setLightMode: require_sleep.method(zod.z.object({
-          deviceId: zod.z.number(),
-          mode: NavigationLightModeSchema,
-          level: zod.z.number().min(40).max(100).optional()
-        }), zod.z.void(), { kind: "mutation" }),
-        /** Set the MANUAL fill-light level (40..100). Implies `manual` mode. */
-        setLightLevel: require_sleep.method(zod.z.object({
-          deviceId: zod.z.number(),
-          level: zod.z.number().min(40).max(100)
-        }), zod.z.void(), { kind: "mutation" }),
-        /**
-        * Per-device FEATURE-FLAG report for the general primitives — drives which
-        * controls the UI shows (the per-entry flags for the dictionary come back on
-        * `listActions`).
-        */
-        getFeatures: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), NavigationFeaturesSchema)
-      },
-      events: { onStatusChanged: { data: zod.z.object({
-        deviceId: zod.z.number(),
-        status: NavigationStatusSchema
-      }) } },
-      status: {
-        schema: NavigationStatusSchema,
-        kind: "push"
-      },
-      /**
-      * Runtime-state slice mirrored by the kernel. The navigation panel watches it
-      * for live mode / follow / flash changes.
-      */
-      runtimeState: NavigationRuntimeStateSchema,
-      /**
-      * Runtime-state durability: **session** — like `vacuum-control`, a restored
-      * `mode: cleaning` / `following: true` is a robot that is not actually doing
-      * that. The live handle re-publishes on connect.
-      *
-      * See `RuntimeStateDurability`. Enforced by
-      * `scripts/check-runtime-state-durability.ts`.
-      */
-      durability: "session"
-    };
     var rebootCapability = {
       name: "reboot",
       scope: "device",
@@ -243303,6 +244261,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       storage: "storage",
       storageEvictable: "storage-evictable",
       storageMigration: "storage-migration",
+      storageOccupancy: "storage-occupancy",
       storageProvider: "storage-provider",
       streamBroker: "stream-broker",
       streamCatalog: "stream-catalog",
@@ -243847,6 +244806,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         key: "storageMigration",
         name: "storage-migration"
       },
+      {
+        key: "storageOccupancy",
+        name: "storage-occupancy"
+      },
       {
         key: "storageProvider",
         name: "storage-provider"
@@ -244082,6 +245045,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       storageCapability,
       storageEvictableCapability,
       storageMigrationCapability,
+      storageOccupancyCapability,
       storageProviderCapability,
       streamBrokerCapability,
       streamCatalogCapability,
@@ -249054,6 +250018,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "storage.listDrainProgress": {
+        capName: "storage",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storage.listLocationDeclarations": {
         capName: "storage",
         capScope: "system",
@@ -249198,6 +250168,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "storageOccupancy.getOccupancy": {
+        capName: "storage-occupancy",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageProvider.abortUpload": {
         capName: "storage-provider",
         capScope: "system",
@@ -250332,6 +251308,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "storage",
       "storage-evictable",
       "storage-migration",
+      "storage-occupancy",
       "storage-provider",
       "stream-broker",
       "stream-catalog",
@@ -250476,6 +251453,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "storage",
       "storage-evictable",
       "storage-migration",
+      "storage-occupancy",
       "storage-provider",
       "stream-broker",
       "system",
@@ -253426,6 +254404,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           listLocationDeclarations: (input) => dispatch("storage", "listLocationDeclarations", "query", input),
           upsertLocation: (input) => dispatch("storage", "upsertLocation", "mutation", input),
           deleteLocation: (input) => dispatch("storage", "deleteLocation", "mutation", input),
+          listDrainProgress: (input) => dispatch("storage", "listDrainProgress", "query", input),
           testLocation: (input) => dispatch("storage", "testLocation", "query", input),
           listProviders: (input) => dispatch("storage", "listProviders", "query", input),
           testConfig: (input) => dispatch("storage", "testConfig", "query", input)
@@ -256585,6 +257564,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.IntercomStatusSchema = IntercomStatusSchema;
     exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
     exports.KeyEventSchema = KeyEventSchema;
+    exports.LEGACY_READ_ONLY_CONFIG_KEY = LEGACY_READ_ONLY_CONFIG_KEY;
     exports.LOAD_CONTRIBUTION_ATTRIBUTIONS = LOAD_CONTRIBUTION_ATTRIBUTIONS;
     exports.LOAD_CONTRIBUTION_ROLES = LOAD_CONTRIBUTION_ROLES;
     exports.LOG_CHANNEL_TICK_MS = LOG_CHANNEL_TICK_MS;
@@ -257036,6 +258016,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.SOURCE_DEVICE_TYPES = SOURCE_DEVICE_TYPES;
     exports.SOURCE_INFO_METADATA_KEY = SOURCE_INFO_METADATA_KEY;
     exports.STORAGE_ACCESS_FALLBACK = STORAGE_ACCESS_FALLBACK;
+    exports.STORAGE_BYTES_PER_GB = STORAGE_BYTES_PER_GB;
+    exports.STORAGE_LOCATION_MODES = STORAGE_LOCATION_MODES;
     exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
     exports.STREAM_QUALITY_LABELS = STREAM_QUALITY_LABELS;
     exports.SUB_DETECTION_TYPES = SUB_DETECTION_TYPES;
@@ -257097,9 +258079,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StorageCleanupJobSchema = StorageCleanupJobSchema;
     exports.StorageCleanupPhaseSchema = StorageCleanupPhaseSchema;
     exports.StorageCleanupStatusInputSchema = StorageCleanupStatusInputSchema;
+    exports.StorageDrainProgressSchema = StorageDrainProgressSchema;
     exports.StorageEndDownloadInputSchema = EndDownloadInputSchema;
+    exports.StorageEvictionPolicySchema = StorageEvictionPolicySchema;
     exports.StorageFinalizeUploadInputSchema = FinalizeUploadInputSchema;
     exports.StorageLocationDeclarationSchema = StorageLocationDeclarationSchema;
+    exports.StorageLocationModeSchema = StorageLocationModeSchema;
     exports.StorageLocationRefSchema = StorageLocationRefSchema;
     exports.StorageLocationSchema = StorageLocationSchema;
     exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
@@ -257123,6 +258108,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StorageMigrationPlanSchema = StorageMigrationPlanSchema;
     exports.StorageMigrationResidueSchema = StorageMigrationResidueSchema;
     exports.StorageMigrationSourcesSchema = StorageMigrationSourcesSchema;
+    exports.StorageOccupancyReportSchema = StorageOccupancyReportSchema;
     exports.StorageProviderInfoSchema = ProviderInfoSchema;
     exports.StorageReadChunkInputSchema = ReadChunkInputSchema;
     exports.StorageTestLocationResultSchema = TestLocationResultSchema;
@@ -257404,6 +258390,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.event = require_sleep.event;
     exports.eventEmitterCapability = eventEmitterCapability;
     exports.eventsCapability = eventsCapability;
+    exports.evictionPolicyForMode = evictionPolicyForMode;
+    exports.evictionPolicyOfLocation = evictionPolicyOfLocation;
     exports.expandCapMethods = require_sleep.expandCapMethods;
     exports.extractNestedAddonId = extractNestedAddonId;
     exports.extractSourceInfoFromMetadata = extractSourceInfoFromMetadata;
@@ -257419,6 +258407,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.formatForBackend = formatForBackend;
     exports.formatForRuntime = formatForRuntime;
     exports.gasCapability = gasCapability;
+    exports.gbToBytes = gbToBytes;
     exports.generateAutomationBlock = generateAutomationBlock;
     exports.getAudioMacroClassIds = getAudioMacroClassIds;
     exports.getByPath = getByPath;
@@ -257463,12 +258452,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.isSecretConfigField = isSecretConfigField;
     exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
     exports.isSourceCap = isSourceCap;
+    exports.isStorageLocationMode = isStorageLocationMode;
     exports.isSystemDelivery = isSystemDelivery;
     exports.isVoidInput = isVoidInput;
     exports.jobKindSchema = jobKindSchema;
     exports.kebabToCamel = kebabToCamel;
     exports.knownValues = knownValues;
     exports.lawnMowerControlCapability = lawnMowerControlCapability;
+    exports.legacyModeOf = legacyModeOf;
     exports.lifecycleJobSchema = lifecycleJobSchema;
     exports.lifecycleJobScopeSchema = lifecycleJobScopeSchema;
     exports.lifecycleJobStateSchema = lifecycleJobStateSchema;
@@ -257491,6 +258482,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.markdownToHtmlLite = markdownToHtmlLite;
     exports.markdownToText = markdownToText;
     exports.maskUrlCredentials = maskUrlCredentials;
+    exports.mayReadLocation = mayReadLocation;
+    exports.mayWriteToLocation = mayWriteToLocation;
     exports.mediaPlayerCapability = mediaPlayerCapability;
     exports.mergeSourceInfo = mergeSourceInfo;
     exports.meshNetworkCapability = meshNetworkCapability;
@@ -257498,6 +258491,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.methodAccessForHttpMethod = methodAccessForHttpMethod;
     exports.metricsProviderCapability = metricsProviderCapability;
     exports.migrateLegacyDeviceSignalConfig = migrateLegacyDeviceSignalConfig;
+    exports.modeMayRead = modeMayRead;
+    exports.modeMayWrite = modeMayWrite;
     exports.modelConvertCapability = modelConvertCapability;
     exports.modelDistributorCapability = modelDistributorCapability;
     exports.modelFormatForRuntime = modelFormatForRuntime;
@@ -257593,6 +258588,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
     exports.resolveFormat = resolveFormat;
     exports.resolveHydratedFieldValue = require_sleep.resolveHydratedFieldValue;
+    exports.resolveLocationMode = resolveLocationMode;
     exports.resolveMethodAuth = resolveMethodAuth;
     exports.resolveModelFormat = resolveModelFormat;
     exports.resolveMutate = resolveMutate;
@@ -257639,6 +258635,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.storageCapability = storageCapability;
     exports.storageEvictableCapability = storageEvictableCapability;
     exports.storageMigrationCapability = storageMigrationCapability;
+    exports.storageOccupancyCapability = storageOccupancyCapability;
     exports.storageProviderCapability = storageProviderCapability;
     exports.streamBrokerCapability = streamBrokerCapability;
     exports.streamCatalogCapability = streamCatalogCapability;
@@ -257646,6 +258643,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.streamPixels = streamPixels;
     exports.streamQualityLabel = streamQualityLabel;
     exports.stripRetiredBandPreBufferSec = stripRetiredBandPreBufferSec;
+    exports.strippedOfLegacyReadOnly = strippedOfLegacyReadOnly;
     exports.subKindsOf = subKindsOf;
     exports.summarisePrivacyAudio = summarisePrivacyAudio;
     exports.summarizeEffectiveScope = summarizeEffectiveScope;
@@ -257696,6 +258694,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.wiringNodeHealthSchema = wiringNodeHealthSchema;
     exports.wiringProbeKindSchema = wiringProbeKindSchema;
     exports.wiringProbeResultSchema = wiringProbeResultSchema;
+    exports.withLocationMode = withLocationMode;
     exports.zodEntriesToConfigUI = zodEntriesToConfigUI;
     exports.zoneAnalyticsCapability = zoneAnalyticsCapability;
     exports.zoneRulesCapability = zoneRulesCapability;