camstack 1.2.60 → 1.2.62

package/dist/{launcher-CL4LHR6D.js → launcher-GM4YFS5M.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-BPlfW-CG.js
-var require_dist_BPlfW_CG = __commonJS({
-  "../system/dist/dist-BPlfW-CG.js"(exports) {
+// ../system/dist/dist-CDgIzo82.js
+var require_dist_CDgIzo82 = __commonJS({
+  "../system/dist/dist-CDgIzo82.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -26256,29 +26256,50 @@ var require_dist_BPlfW_CG = __commonJS({
     });
     var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
     var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
+    var MediaRelocateModeSchema = zod.z.enum([
+      "move",
+      "seal",
+      "gallery"
+    ]);
     var RelocateMediaInputSchema = zod.z.object({
       toLocationId: zod.z.string(),
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `move`, the pre-existing behaviour. */
+      mode: MediaRelocateModeSchema.optional()
+    });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: zod.z.number().int().nonnegative(),
+      retrainFrames: zod.z.number().int().nonnegative(),
+      total: zod.z.number().int().nonnegative()
     });
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
       "recordingsLow",
-      "eventMedia"
+      "eventMedia",
+      "backups",
+      "galleryMedia"
     ]);
     var StorageMigrationDestinationsSchema = zod.z.object({
       recordings: zod.z.string().min(1).optional(),
       recordingsLow: zod.z.string().min(1).optional(),
-      eventMedia: zod.z.string().min(1).optional()
+      eventMedia: zod.z.string().min(1).optional(),
+      backups: zod.z.string().min(1).optional(),
+      galleryMedia: zod.z.string().min(1).optional()
     }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+    var StorageMigrationModeSchema = zod.z.enum(["blocking", "nonBlocking"]);
     var StorageMigrationInputSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `blocking`, which stays the default. */
+      mode: StorageMigrationModeSchema.optional()
     });
     var StorageMigrationPhaseSchema = zod.z.enum([
       "planning",
+      "sealing",
       "pausing",
       "moving",
+      "draining",
       "verifying",
       "repointing",
       "refreshing",
@@ -26303,6 +26324,9 @@ var require_dist_BPlfW_CG = __commonJS({
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
       phase: StorageMigrationPhaseSchema,
+      /** Which order this job is running. `status` is the only place an operator
+      *  can tell a seconds-long cutover from a thirty-hour one. */
+      mode: StorageMigrationModeSchema,
       destinations: StorageMigrationDestinationsSchema,
       throttleMbps: zod.z.number(),
       moves: zod.z.array(StorageMigrationMoveSchema),
@@ -26315,13 +26339,31 @@ var require_dist_BPlfW_CG = __commonJS({
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
     });
+    var StorageMigrationFindingCodeSchema = zod.z.enum([
+      "sharesDeviceWithSource",
+      "deviceIdentityUnknown",
+      "unstampedEventMediaRows",
+      "blockingOnly",
+      "noMover"
+    ]);
+    var StorageMigrationFindingSchema = zod.z.object({
+      code: StorageMigrationFindingCodeSchema,
+      storageClass: StorageMigrationClassSchema,
+      /** Human-readable, already carrying the ids and counts. */
+      message: zod.z.string()
+    });
     var StorageMigrationPlanSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
+      /** The mode this plan was built for. A plan is only valid for its mode: the
+      *  `eventMedia` seal gate and the single-cardinality refusal both depend on
+      *  it. */
+      mode: StorageMigrationModeSchema,
       moves: zod.z.array(zod.z.object({
         storageClass: StorageMigrationClassSchema,
         fromLocationId: zod.z.string(),
         toLocationId: zod.z.string()
-      }))
+      })),
+      findings: zod.z.array(StorageMigrationFindingSchema)
     });
     var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
     var StorageLocationSchema = zod.z.object({
@@ -37316,6 +37358,17 @@ var require_dist_BPlfW_CG = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * How many media / retrain rows still carry NO `locationId`.
+        *
+        * A NULL row means "wherever `eventMedia` points NOW", so the instant a
+        * repoint moves that pointer every such row reads from the new disk while
+        * its bytes are on the old one — the archive goes dark until a drain
+        * happens to stamp it. This count is what the migration planner's
+        * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+        * it to zero.
+        */
+        countUnstampedEventMedia: method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -39768,7 +39821,24 @@ var require_dist_BPlfW_CG = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
-        deleteLocation: method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+        /**
+        * Remove a location record. REFUSES a location that still holds data —
+        * deleting a drained location whose durable rows still name it is how this
+        * hub acquired 2 131 ghost `recordings:high` segments, and playback does
+        * not stat, so the operator sees a silent black window rather than an
+        * error.
+        *
+        * `force` exists because the occupancy check is BEST-EFFORT and refuses on
+        * "unknown" as well as on "occupied" (a read that fails must not authorise
+        * a destruction — D49). A location on a removed disk, on another node, or
+        * behind a remote provider answers "unknown" forever, and a refusal an
+        * operator cannot override is its own failure mode. `force: true` is
+        * logged, loudly, with what the check saw.
+        */
+        deleteLocation: method(zod.z.object({
+          id: zod.z.string(),
+          force: zod.z.boolean().optional()
+        }), zod.z.void(), {
           kind: "mutation",
           auth: "admin"
         }),
@@ -52862,6 +52932,12 @@ var require_dist_BPlfW_CG = __commonJS({
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countUnstampedEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.deleteDeviceEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -58713,7 +58789,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59532,7 +59608,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59626,7 +59702,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60523,11 +60599,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-DBY6ebwV.js
-var require_retired_settings_keys_DBY6ebwV = __commonJS({
-  "../system/dist/retired-settings-keys-DBY6ebwV.js"(exports) {
+// ../system/dist/retired-settings-keys-BfAzWvPC.js
+var require_retired_settings_keys_BfAzWvPC = __commonJS({
+  "../system/dist/retired-settings-keys-BfAzWvPC.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62741,8 +62817,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
-    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
+    var require_dist10 = require_dist_CDgIzo82();
+    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67491,7 +67567,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67628,7 +67704,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67818,7 +67894,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75631,7 +75707,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76196,7 +76272,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -78818,7 +78894,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -79934,8 +80010,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
-    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
+    var require_dist10 = require_dist_CDgIzo82();
+    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -82214,7 +82290,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82397,8 +82473,19 @@ var require_storage_orchestrator_addon = __commonJS({
     var STORAGE_CLASSES = [
       "recordings",
       "recordingsLow",
-      "eventMedia"
+      "eventMedia",
+      "backups",
+      "galleryMedia"
+    ];
+    var MOVER_CLASSES = [
+      "recordings",
+      "recordingsLow",
+      "eventMedia",
+      "galleryMedia"
     ];
+    var BLOCKING_ONLY_CLASSES = ["galleryMedia"];
+    var GALLERY_FORBIDDEN_NEIGHBOUR_TYPES = ["recordings", "recordingsLow"];
+    var MOVE_LANES = ["media", "footage"];
     var PARTICIPANTS = [
       "pipeline",
       "recorder",
@@ -82418,7 +82505,9 @@ var require_storage_orchestrator_addon = __commonJS({
         this.deps = deps;
       }
       async plan(input) {
+        const mode = input.mode ?? "blocking";
         const moves = [];
+        const findings = [];
         for (const storageClass of STORAGE_CLASSES) {
           const targetId = input.destinations[storageClass];
           if (targetId === void 0) continue;
@@ -82428,6 +82517,9 @@ var require_storage_orchestrator_addon = __commonJS({
           if (!target) throw new Error(`Storage location "${targetId}" not found`);
           if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
           if (source.id === target.id) throw new Error(`Storage location "${targetId}" is already the "${storageClass}" default`);
+          if (!MOVER_CLASSES.includes(storageClass)) throw new Error(`No mover owns "${storageClass}" \u2014 the migration can repoint its default but cannot move its bytes. Move it by hand, then repoint the default with upsertLocation.`);
+          if (mode === "nonBlocking" && BLOCKING_ONLY_CLASSES.includes(storageClass)) throw new Error(`"${storageClass}" is a single-cardinality storage class: it can never exist at two locations at once, so it cannot be repointed first and drained behind. Use mode "blocking".`);
+          await this.refuseGalleryOntoRecordingsVolume(storageClass, targetId);
           moves.push({
             storageClass,
             fromLocationId: source.id,
@@ -82436,17 +82528,79 @@ var require_storage_orchestrator_addon = __commonJS({
             state: null,
             error: null
           });
+          if (BLOCKING_ONLY_CLASSES.includes(storageClass)) findings.push({
+            code: "blockingOnly",
+            storageClass,
+            message: `"${storageClass}" is single-cardinality: this move is stop-the-world for its whole duration, in every mode. It is a few KB per enrolled sample, which is why that is acceptable.`
+          });
+          findings.push(...await this.deviceFindings(storageClass, source.id, target.id));
         }
         if (moves.length === 0) throw new Error("select at least one storage class");
+        if (moves.some((move) => move.storageClass === "eventMedia")) {
+          const unstamped = await this.deps.participants.analytics.countUnstamped();
+          if (unstamped.total > 0) {
+            if (mode === "nonBlocking") throw new Error(`${unstamped.total.toString()} event-media row(s) still carry no locationId (${unstamped.media.toString()} media, ${unstamped.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+            findings.push({
+              code: "unstampedEventMediaRows",
+              storageClass: "eventMedia",
+              message: `${unstamped.total.toString()} event-media row(s) carry no locationId. This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
+            });
+          }
+        }
         return {
           destinations: input.destinations,
+          mode,
           moves: moves.map(({ storageClass, fromLocationId, toLocationId }) => ({
             storageClass,
             fromLocationId,
             toLocationId
-          }))
+          })),
+          findings
         };
       }
+      /**
+      * HARD refusal: `galleryMedia` onto a volume a recordings class lives on.
+      *
+      * This is the one same-device case that is a refusal rather than a finding,
+      * because its consequence is silent and arrives months later — the gallery is
+      * wiped by the next footage wipe, quota eviction or recordings disk swap, and
+      * nothing at that moment points back at this migration.
+      *
+      * It can only refuse what it can SEE. `deviceKeyOf` is a realpath, so it
+      * catches a symlink, a bind mount and a literally-shared directory — and
+      * misses two distinct directories on one filesystem, and any location pinned
+      * to another node. Those come back `null`/distinct and produce a
+      * `deviceIdentityUnknown` finding instead.
+      */
+      async refuseGalleryOntoRecordingsVolume(storageClass, targetId) {
+        if (storageClass !== "galleryMedia") return;
+        const targetKey = await this.deviceKey(targetId);
+        if (targetKey === null) return;
+        for (const type of GALLERY_FORBIDDEN_NEIGHBOUR_TYPES) for (const neighbour of this.deps.locations.listLocations({ type })) {
+          if (await this.deviceKey(neighbour.id) !== targetKey) continue;
+          throw new Error(`Storage location "${targetId}" shares a volume with "${neighbour.id}" (${type}). galleryMedia is deliberately NOT on the recordings volume: enrolment images survive every retention sweep, so they must also survive a footage wipe, a quota eviction and a recordings disk swap. Choose a destination on another volume.`);
+        }
+      }
+      /** Same-device observations that are reported, not refused. */
+      async deviceFindings(storageClass, sourceId, targetId) {
+        if (this.deps.deviceKeyOf === void 0) return [];
+        const [sourceKey, targetKey] = await Promise.all([this.deviceKey(sourceId), this.deviceKey(targetId)]);
+        if (sourceKey === null || targetKey === null) return [{
+          code: "deviceIdentityUnknown",
+          storageClass,
+          message: `Could not establish whether "${sourceId}" and "${targetId}" are on the same device (a location with no basePath, or pinned to another node \u2014 the realpath would have to be taken there). Note also that this check is PATH identity, not st_dev: two distinct directories on one filesystem are never detected as one device.`
+        }];
+        if (sourceKey !== targetKey) return [];
+        return [{
+          code: "sharesDeviceWithSource",
+          storageClass,
+          message: `"${targetId}" resolves to the same path as "${sourceId}". The move will re-stamp rows rather than copy bytes, and it buys no redundancy \u2014 both "locations" are one disk.`
+        }];
+      }
+      async deviceKey(locationId) {
+        if (this.deps.deviceKeyOf === void 0) return null;
+        return this.deps.deviceKeyOf(locationId);
+      }
       async start(input) {
         if (this.startReserved) throw new Error("storage migration is already active");
         this.startReserved = true;
@@ -82463,6 +82617,7 @@ var require_storage_orchestrator_addon = __commonJS({
           const job = {
             jobId: this.deps.newId(),
             phase: "planning",
+            mode: plan.mode,
             destinations: input.destinations,
             throttleMbps: input.throttleMbps ?? 40,
             moves: plan.moves.map((move) => ({
@@ -82496,7 +82651,8 @@ var require_storage_orchestrator_addon = __commonJS({
       }
       async cancel(jobId) {
         const job = await this.status(jobId);
-        if (!job || isTerminal(job) || job.repointed) return false;
+        const cutoverInFlight = job !== null && job.repointed && (job.phase === "refreshing" || job.phase === "resuming");
+        if (!job || isTerminal(job) || cutoverInFlight) return false;
         job.cancelRequested = true;
         await this.persist(job);
         await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
@@ -82527,7 +82683,7 @@ var require_storage_orchestrator_addon = __commonJS({
         job.pauseLeaseId ??= this.deps.newId();
         if (job.repointed && job.phase === "resuming") job.phase = "refreshing";
         await this.persist(job);
-        try {
+        if (!runsUnleased(job)) try {
           await this.pauseParticipants(job, true);
         } catch (err) {
           job.error = err instanceof Error ? err.message : String(err);
@@ -82539,14 +82695,34 @@ var require_storage_orchestrator_addon = __commonJS({
           this.runPromise;
         }
       }
+      /**
+      * The state machine. Both modes run the SAME phase handlers; only the order
+      * differs, which is the whole of the non-blocking design — no second mover,
+      * no parallel code path, nothing that can drift between the two.
+      *
+      *   blocking:    planning → pausing → moving → verifying → repointing →
+      *                refreshing → resuming → done
+      *   nonBlocking: planning → sealing → pausing → repointing → refreshing →
+      *                resuming → draining → verifying → done
+      *
+      * Written as a straight-line sequence of `if (phase === X)` blocks so boot
+      * recovery re-enters at whatever phase the durable record says, exactly as
+      * before.
+      */
       async run(job) {
+        const nonBlocking = job.mode === "nonBlocking";
         try {
-          if (job.phase === "planning") await this.setPhase(job, "pausing");
+          if (job.phase === "planning") await this.setPhase(job, nonBlocking ? "sealing" : "pausing");
+          if (job.phase === "sealing") {
+            await this.sealEventMedia(job);
+            if (job.cancelRequested) return this.finishCancelled(job);
+            await this.setPhase(job, "pausing");
+          }
           if (job.phase === "pausing") {
             job.pauseLeaseId ??= job.jobId;
             await this.pauseParticipants(job);
             if (job.cancelRequested) return this.finishCancelled(job);
-            await this.setPhase(job, "moving");
+            await this.setPhase(job, nonBlocking ? "repointing" : "moving");
           }
           if (job.phase === "moving") {
             await this.startOrResumeMoves(job);
@@ -82554,7 +82730,7 @@ var require_storage_orchestrator_addon = __commonJS({
             if (job.cancelRequested) return this.finishCancelled(job);
             await this.setPhase(job, "verifying");
           }
-          if (job.phase === "verifying") {
+          if (job.phase === "verifying" && !nonBlocking) {
             await this.verifyMoves(job);
             if (job.cancelRequested) return this.finishCancelled(job);
             await this.setPhase(job, "repointing");
@@ -82567,17 +82743,28 @@ var require_storage_orchestrator_addon = __commonJS({
           }
           if (job.phase === "refreshing") {
             const leaseId = requireLease(job);
-            if (job.moves.some((move) => move.storageClass !== "eventMedia")) await this.deps.participants.recorder.refresh(leaseId);
-            if (job.moves.some((move) => move.storageClass === "eventMedia")) await this.deps.participants.analytics.refresh(leaseId);
+            if (job.moves.some((move) => laneOf(move.storageClass) === "footage")) await this.deps.participants.recorder.refresh(leaseId);
+            if (job.moves.some((move) => laneOf(move.storageClass) === "media")) await this.deps.participants.analytics.refresh(leaseId);
             await this.setPhase(job, "resuming");
           }
           if (job.phase === "resuming") {
             await this.resumeParticipants(job);
+            await this.setPhase(job, nonBlocking ? "draining" : "done");
+          }
+          if (job.phase === "draining") {
+            await this.startOrResumeMoves(job);
+            await this.waitForMoves(job);
+            if (job.cancelRequested) return this.finishCancelled(job);
+            await this.setPhase(job, "verifying");
+          }
+          if (job.phase === "verifying" && nonBlocking) {
+            await this.verifyMoves(job);
+            if (job.cancelRequested) return this.finishCancelled(job);
             await this.setPhase(job, "done");
           }
         } catch (err) {
           job.error = err instanceof Error ? err.message : String(err);
-          if (job.repointed) {
+          if (job.repointed && job.pausedParticipants.length > 0) {
             job.phase = "refreshing";
             job.finishedAt = null;
             await this.persist(job);
@@ -82626,21 +82813,28 @@ var require_storage_orchestrator_addon = __commonJS({
           }
         }
       }
+      /**
+      * Start whatever is startable, honouring the ONE constraint the engines
+      * impose: each is single-flight.
+      *
+      * Two lanes — the recorder's footage engine and post-analysis's media engine
+      * — run in parallel with each other and strictly FIFO within themselves.
+      * `galleryMedia` shares the media lane with `eventMedia` because it shares
+      * the same `MediaRelocateEngine`, which refuses a second running job; starting
+      * both would fail the second one instantly.
+      */
       async startOrResumeMoves(job) {
         if (job.cancelRequested) return;
-        const mediaMove = job.moves.find((move) => move.storageClass === "eventMedia");
-        if (mediaMove?.moverJobId === null) {
-          mediaMove.moverJobId = await this.startMove(job, mediaMove);
-          await this.persist(job);
-        }
-        const footageMoves = job.moves.filter((move) => move.storageClass !== "eventMedia");
-        for (let index = 0; index < footageMoves.length; index++) {
-          const move = footageMoves[index];
-          if (move.moverJobId !== null) continue;
-          if (!footageMoves.slice(0, index).every((predecessor) => predecessor.state === "done")) return;
-          move.moverJobId = await this.startMove(job, move);
-          await this.persist(job);
-          return;
+        for (const lane of MOVE_LANES) {
+          const laneMoves = job.moves.filter((move) => laneOf(move.storageClass) === lane);
+          for (let index = 0; index < laneMoves.length; index++) {
+            const move = laneMoves[index];
+            if (move === void 0 || move.moverJobId !== null) continue;
+            if (!laneMoves.slice(0, index).every((predecessor) => predecessor.state === "done")) break;
+            move.moverJobId = await this.startMove(job, move);
+            await this.persist(job);
+            break;
+          }
         }
       }
       async waitForMoves(job) {
@@ -82651,7 +82845,7 @@ var require_storage_orchestrator_addon = __commonJS({
           let complete = true;
           for (const [index, move] of job.moves.entries()) {
             if (job.cancelRequested && move.moverJobId === null) continue;
-            if (move.storageClass !== "eventMedia" && job.moves.slice(0, index).filter((predecessor) => predecessor.storageClass !== "eventMedia").some((predecessor) => predecessor.state !== "done")) {
+            if (job.moves.slice(0, index).filter((predecessor) => laneOf(predecessor.storageClass) === laneOf(move.storageClass)).some((predecessor) => predecessor.state !== "done")) {
               complete = false;
               continue;
             }
@@ -82685,30 +82879,92 @@ var require_storage_orchestrator_addon = __commonJS({
           await sleep(pollMs);
         }
       }
+      /**
+      * Nail every unstamped `eventMedia`/retrain row to the location its bytes are
+      * ALREADY on, before anything repoints. Runs with every writer up — it moves
+      * no bytes at all.
+      *
+      * The gate is the RE-COUNT, not the seal job's terminal state: a seal that
+      * failed some rows still finishes, and "finished" is not "there are none
+      * left". A non-zero count here fails the job while nothing has been paused
+      * and nothing has been repointed, which is the cheapest possible place to
+      * discover it.
+      *
+      * The seal's own mover job id is deliberately NOT durable. It is idempotent
+      * and cheap, so a coordinator restart mid-seal simply re-runs the whole
+      * phase — and the count that follows is what actually decides, so a lost job
+      * id cannot make the gate pass.
+      */
+      async sealEventMedia(job) {
+        const move = job.moves.find((candidate) => candidate.storageClass === "eventMedia");
+        if (move === void 0) return;
+        if ((await this.deps.participants.analytics.countUnstamped()).total > 0) {
+          const started = await this.deps.participants.analytics.startDrain({
+            toLocationId: move.fromLocationId,
+            mode: "seal"
+          });
+          await this.waitForSeal(job, started.jobId);
+          if (job.cancelRequested) return;
+        }
+        const after = await this.deps.participants.analytics.countUnstamped();
+        if (after.total > 0) throw new Error(`event-media seal left ${after.total.toString()} row(s) without a locationId (${after.media.toString()} media, ${after.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
+      }
+      async waitForSeal(job, moverJobId) {
+        const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        const pollMs = this.deps.pollMs ?? 250;
+        for (; ; ) {
+          if (job.cancelRequested) {
+            await this.deps.participants.analytics.cancelMove(moverJobId);
+            return;
+          }
+          const status = await this.deps.participants.analytics.getMove(moverJobId);
+          if (status === null || status.state === "done" || status.state === "cancelled") return;
+          if (status.state === "failed") throw new Error(status.error ?? "event-media seal failed");
+          await sleep(pollMs);
+        }
+      }
       async verifyMoves(job) {
         for (const move of job.moves) if (move.state !== "done") throw new Error(`${move.storageClass} move did not complete verification`);
       }
+      /**
+      * Arm one class's mover.
+      *
+      * `draining` runs after every writer has been resumed, so there is no lease
+      * left to present — it goes through the participants' UNLEASED entry points
+      * (`recording.relocateFootage` / `pipelineAnalytics.relocateMedia`), which
+      * are the same engines, not a second mover.
+      */
       async startMove(job, move) {
-        if (move.storageClass === "eventMedia") return (await this.deps.participants.analytics.startMove({
-          toLocationId: move.toLocationId,
-          throttleMbps: job.throttleMbps,
-          leaseId: requireLease(job)
-        })).jobId;
-        return (await this.deps.participants.recorder.startMove({
+        const unleased = runsUnleased(job);
+        if (laneOf(move.storageClass) === "media") {
+          const input2 = {
+            toLocationId: move.toLocationId,
+            throttleMbps: job.throttleMbps,
+            mode: move.storageClass === "galleryMedia" ? "gallery" : "move"
+          };
+          return (unleased ? await this.deps.participants.analytics.startDrain(input2) : await this.deps.participants.analytics.startMove({
+            ...input2,
+            leaseId: requireLease(job)
+          })).jobId;
+        }
+        const input = {
           fromLocationId: move.fromLocationId,
           toLocationId: move.toLocationId,
-          footageClass: move.storageClass,
-          throttleMbps: job.throttleMbps,
+          footageClass: move.storageClass === "recordingsLow" ? "recordingsLow" : "recordings",
+          throttleMbps: job.throttleMbps
+        };
+        return (unleased ? await this.deps.participants.recorder.startDrain(input) : await this.deps.participants.recorder.startMove({
+          ...input,
           leaseId: requireLease(job)
         })).jobId;
       }
       async moveStatus(move) {
         if (move.moverJobId === null) return null;
-        return move.storageClass === "eventMedia" ? this.deps.participants.analytics.getMove(move.moverJobId) : this.deps.participants.recorder.getMove(move.moverJobId);
+        return laneOf(move.storageClass) === "media" ? this.deps.participants.analytics.getMove(move.moverJobId) : this.deps.participants.recorder.getMove(move.moverJobId);
       }
       async cancelMove(move) {
         if (move.moverJobId === null) return;
-        if (move.storageClass === "eventMedia") await this.deps.participants.analytics.cancelMove(move.moverJobId);
+        if (laneOf(move.storageClass) === "media") await this.deps.participants.analytics.cancelMove(move.moverJobId);
         else await this.deps.participants.recorder.cancelMove(move.moverJobId);
       }
       participant(name) {
@@ -82737,6 +82993,13 @@ var require_storage_orchestrator_addon = __commonJS({
     function isTerminal(job) {
       return job.phase === "done" || job.phase === "failed" || job.phase === "cancelled";
     }
+    function laneOf(storageClass) {
+      return storageClass === "eventMedia" || storageClass === "galleryMedia" ? "media" : "footage";
+    }
+    function runsUnleased(job) {
+      if (job.phase === "sealing" || job.phase === "draining") return true;
+      return job.phase === "verifying" && job.mode === "nonBlocking";
+    }
     function buildStorageLocationRegistry(perAddon) {
       const map = /* @__PURE__ */ new Map();
       for (const addonDeclarations of perAddon) for (const declaration of addonDeclarations) {
@@ -82842,6 +83105,14 @@ var require_storage_orchestrator_addon = __commonJS({
       * early-boot path that predates the resolver wiring.
       */
       nodeLocalResolver = null;
+      /**
+      * Injected occupancy probe (see {@link LocationOccupancyProbe}). `null` until
+      * {@link setOccupancyProbe} runs, and a `null` probe answers `unknown` — so a
+      * service with no probe REFUSES an unforced delete rather than performing one
+      * it could not check. The check is the point; a check that defaults to
+      * "permit" is a paragraph, not a guard.
+      */
+      occupancyProbe = null;
       /** `localNodeId` with any forked-child `/addon` suffix stripped. */
       localNode;
       /**
@@ -82941,6 +83212,15 @@ var require_storage_orchestrator_addon = __commonJS({
         this.nodeLocalResolver = resolver;
       }
       /**
+      * Inject the "does this location still hold anything" probe read by
+      * {@link deleteLocation}. Absent → every delete sees `unknown` and therefore
+      * REFUSES without `force`, which is the safe direction for a service wired
+      * without one.
+      */
+      setOccupancyProbe(probe) {
+        this.occupancyProbe = probe;
+      }
+      /**
       * The full set of addon-declared storage locations, as aggregated by
       * the kernel and injected via {@link setRegistry}. Powers the admin-UI
       * Data screen's per-declaration grouping. Empty until the registry is
@@ -83164,13 +83444,22 @@ var require_storage_orchestrator_addon = __commonJS({
       * Persistence (Task 6) mirrors the delete asynchronously, with errors
       * routed to the logger — see `upsertLocation` for the rationale.
       */
-      deleteLocation(id) {
+      async deleteLocation(id, options) {
         const loc = this.locations.get(id);
         if (!loc) throw new Error(`Storage location "${id}" not found`);
         if (loc.isSystem) throw new Error(`Storage location "${id}" is system-managed and cannot be deleted. Edit its config (path / providerId) instead.`);
         if (loc.isDefault) {
           if (![...this.locations.values()].find((l) => l.type === loc.type && l.id !== id && l.isDefault)) throw new Error(`Cannot delete default location "${id}" for type "${loc.type}" \u2014 promote another location to default first`);
         }
+        const occupancy = await this.probeOccupancy(loc);
+        if (occupancy !== "empty") {
+          if (options?.force !== true) throw new Error(occupancy === "occupied" ? `Storage location "${id}" still holds data \u2014 drain it first (storage migration / relocate), or pass force to delete the record anyway and strand what is on it` : `Storage location "${id}" could not be checked for remaining data (unreachable provider, another node, or an unmounted root) \u2014 pass force to delete the record anyway`);
+          this.logger.warn("storage-orchestrator: FORCED delete of a location that was not verified empty", { meta: {
+            id,
+            type: loc.type,
+            occupancy
+          } });
+        }
         this.locations.delete(id);
         if (this.locationStore) this.locationStore.delete(id).catch((err) => {
           this.logger.error("storage-orchestrator: delete persistence failed", { meta: {
@@ -83180,6 +83469,23 @@ var require_storage_orchestrator_addon = __commonJS({
         });
       }
       /**
+      * Run the injected occupancy probe, converting "no probe" and "the probe
+      * threw" into `unknown` rather than into a permit.
+      */
+      async probeOccupancy(location) {
+        const probe = this.occupancyProbe;
+        if (probe === null) return "unknown";
+        try {
+          return await probe(location);
+        } catch (err) {
+          this.logger.warn("storage-orchestrator: occupancy probe failed", { meta: {
+            id: location.id,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+          return "unknown";
+        }
+      }
+      /**
       * Remove system-seeded locations whose type is no longer declared by any
       * addon (stale defaults from a removed location type). Operator-added
       * (non-system) locations of an undeclared type are KEPT but warned — the
@@ -83575,6 +83881,7 @@ var require_storage_orchestrator_addon = __commonJS({
         });
         this.service = service;
         service.setNodeLocalResolver((providerId) => this.nodeLocalByProvider.get(providerId));
+        service.setOccupancyProbe((location) => this.locationOccupancy(location));
         await service.initialize();
         const provider = {
           listLocations: async ({ type }) => {
@@ -83587,8 +83894,8 @@ var require_storage_orchestrator_addon = __commonJS({
           getDefaultLocation: async ({ type }) => service.getDefaultLocation(type),
           listLocationDeclarations: async () => service.listDeclarations(),
           upsertLocation: async (input) => service.upsertLocation(input),
-          deleteLocation: async ({ id }) => {
-            service.deleteLocation(id);
+          deleteLocation: async ({ id, force }) => {
+            await service.deleteLocation(id, { force: force === true });
           },
           testLocation: async ({ id }) => {
             const loc = service.getLocationById(id);
@@ -83751,6 +84058,7 @@ var require_storage_orchestrator_addon = __commonJS({
                 await this.ctx.api.recording.resumeForStorageMigration.mutate({ leaseId });
               },
               startMove: (input) => this.ctx.api.recording.startStorageMigrationMove.mutate(input),
+              startDrain: (input) => this.ctx.api.recording.relocateFootage.mutate(input),
               getMove: (jobId) => this.ctx.api.recording.getStorageMigrationMoveStatus.query({ jobId }),
               cancelMove: async (jobId) => (await this.ctx.api.recording.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
@@ -83765,6 +84073,8 @@ var require_storage_orchestrator_addon = __commonJS({
                 await this.ctx.api.pipelineAnalytics.resumeForStorageMigration.mutate({ leaseId });
               },
               startMove: (input) => this.ctx.api.pipelineAnalytics.startStorageMigrationMove.mutate(input),
+              startDrain: (input) => this.ctx.api.pipelineAnalytics.relocateMedia.mutate(input),
+              countUnstamped: () => this.ctx.api.pipelineAnalytics.countUnstampedEventMedia.query({}),
               getMove: (jobId) => this.ctx.api.pipelineAnalytics.getStorageMigrationMoveStatus.query({ jobId }),
               cancelMove: async (jobId) => (await this.ctx.api.pipelineAnalytics.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
@@ -83773,7 +84083,8 @@ var require_storage_orchestrator_addon = __commonJS({
             }
           },
           now: () => Date.now(),
-          newId: () => (0, node_crypto.randomUUID)()
+          newId: () => (0, node_crypto.randomUUID)(),
+          deviceKeyOf: (locationId) => this.locationDeviceKey(locationId)
         });
         this.migration = migration;
         const migrationProvider = {
@@ -83988,6 +84299,44 @@ var require_storage_orchestrator_addon = __commonJS({
           return node_path.resolve(bp);
         }
       }
+      /**
+      * Does this location still hold anything? A SHALLOW `readdir` of its
+      * `basePath` — one syscall, never a walk. `/recordings` holds one entry per
+      * camera, so this is cheap on a volume with millions of segments, and a
+      * `find`-style walk of a saturated recordings disk is precisely what must
+      * not happen here.
+      *
+      * **What it cannot see, stated rather than papered over:**
+      *
+      *  - A location on ANOTHER node, or behind a remote provider (S3 / SFTP /
+      *    WebDAV): its bytes are not on this filesystem and this probe answers
+      *    `unknown`, never `empty`.
+      *  - A location with no `basePath` — same answer.
+      *  - The difference between "holds live footage" and "holds one stray
+      *    lock-file". It measures BYTES ON DISK, not durable rows, so it refuses
+      *    a location holding orphan files that no index names. That direction is
+      *    the safe one, and `force` is the escape hatch for it.
+      *
+      * A missing root (`ENOENT`) is `empty`, not `unknown`: an unmounted disk and
+      * a deleted directory are indistinguishable here, and if the record's own
+      * path does not exist there is nothing this delete can strand. Every OTHER
+      * errno — `EACCES`, `EIO`, a stale NFS handle — is `unknown` and refuses.
+      */
+      async locationOccupancy(location) {
+        if ((location.nodeId === void 0 || location.nodeId === "" ? HUB_NODE_ID : location.nodeId) !== (this.service?.getLocalNodeId() ?? HUB_NODE_ID)) return "unknown";
+        const basePath = this.locationBasePath(location.id);
+        if (basePath === null) return "unknown";
+        try {
+          return (await node_fs_promises.readdir(basePath)).length > 0 ? "occupied" : "empty";
+        } catch (err) {
+          if (err instanceof Error && "code" in err && err.code === "ENOENT") return "empty";
+          this.ctx.logger.warn("storage-orchestrator: could not read a location root to check it", { meta: {
+            id: location.id,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+          return "unknown";
+        }
+      }
       /** Free capacity (%) on a location's volume via `statfs`; 100 (guard inert) when unstattable. */
       async locationFreePercent(locationId) {
         const bp = this.locationBasePath(locationId);
@@ -84095,7 +84444,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -102156,7 +102505,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -104099,9 +104448,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-DUxF5DdC.js
-var require_sleep_DUxF5DdC = __commonJS({
-  "../types/dist/sleep-DUxF5DdC.js"(exports) {
+// ../types/dist/sleep-CJrvRDlD.js
+var require_sleep_CJrvRDlD = __commonJS({
+  "../types/dist/sleep-CJrvRDlD.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -106801,6 +107150,7 @@ var require_sleep_DUxF5DdC = __commonJS({
           getStorageMigrationMoveStatus: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getStorageMigrationMoveStatus", "query", input),
           cancelStorageMigrationMove: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelStorageMigrationMove", "mutation", input),
           relocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "relocateMedia", "mutation", input),
+          countUnstampedEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "countUnstampedEventMedia", "query", input),
           listRelocateMediaJobs: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRelocateMediaJobs", "query", input),
           cancelRelocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelRelocateMedia", "mutation", input),
           listOpsLog: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listOpsLog", "query", input),
@@ -107765,7 +108115,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_DUxF5DdC();
+    var require_sleep = require_sleep_CJrvRDlD();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -114644,12 +114994,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-COeSr7el.js
-var require_manifest_python_deps_COeSr7el = __commonJS({
-  "../system/dist/manifest-python-deps-COeSr7el.js"(exports) {
+// ../system/dist/manifest-python-deps-DVODn-qc.js
+var require_manifest_python_deps_DVODn_qc = __commonJS({
+  "../system/dist/manifest-python-deps-DVODn-qc.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_BPlfW_CG();
+    require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -114755,6 +115105,152 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
       const top = window2.top.map((d) => `${d.childId}:${d.sent}/${d.suppressed}`).join(",");
       return ` fanoutMode=uds:${window2.udsMode}/cross-node:${window2.crossNodeMode} children=${window2.childrenConnected} childrenUndeclared=${window2.childrenUndeclared} fanoutSent=${window2.fanoutSent} fanoutSuppressed=${window2.fanoutSuppressed} crossNodeDelivered=${window2.crossNodeDelivered} crossNodeSuppressed=${window2.crossNodeSuppressed}` + (top.length === 0 ? "" : ` fanoutTop=${top}`);
     }
+    function createSocketDirectionCounters() {
+      return {
+        reqMessages: 0,
+        reqBytes: 0,
+        resMessages: 0,
+        resBytes: 0,
+        evtMessages: 0,
+        evtBytes: 0
+      };
+    }
+    function recordSocketFrame(counters, kind, bytes) {
+      if (kind === "evt") {
+        counters.evtMessages += 1;
+        counters.evtBytes += bytes;
+        return;
+      }
+      if (kind === "req") {
+        counters.reqMessages += 1;
+        counters.reqBytes += bytes;
+        return;
+      }
+      counters.resMessages += 1;
+      counters.resBytes += bytes;
+    }
+    function sampleSocketDirection(counters) {
+      return {
+        reqMessages: counters.reqMessages,
+        reqBytes: counters.reqBytes,
+        resMessages: counters.resMessages,
+        resBytes: counters.resBytes,
+        evtMessages: counters.evtMessages,
+        evtBytes: counters.evtBytes
+      };
+    }
+    var EMPTY_SOCKET_DIRECTION = {
+      reqMessages: 0,
+      reqBytes: 0,
+      resMessages: 0,
+      resBytes: 0,
+      evtMessages: 0,
+      evtBytes: 0
+    };
+    function socketDirectionMessages(sample) {
+      return sample.reqMessages + sample.resMessages + sample.evtMessages;
+    }
+    function socketDirectionBytes(sample) {
+      return sample.reqBytes + sample.resBytes + sample.evtBytes;
+    }
+    function createSocketPlaneReader(sources) {
+      return () => {
+        try {
+          const registry = sources.registry();
+          if (registry === null) return void 0;
+          const listed = registry.listChildren();
+          const peers = [];
+          for (const child of listed) {
+            const traffic = registry.getChildSocketTraffic(child.childId);
+            if (traffic === null) continue;
+            peers.push({
+              peerId: child.childId,
+              tx: traffic.tx,
+              rx: traffic.rx
+            });
+          }
+          return {
+            peers,
+            peersConnected: listed.length
+          };
+        } catch {
+          return;
+        }
+      };
+    }
+    var SOCKET_PLANE_TOP_N = 5;
+    var EMPTY_SOCKET_PLANE_BASELINE = { peers: /* @__PURE__ */ new Map() };
+    function diffDirection(current, before) {
+      const previous = before ?? EMPTY_SOCKET_DIRECTION;
+      return {
+        reqMessages: Math.max(0, current.reqMessages - previous.reqMessages),
+        reqBytes: Math.max(0, current.reqBytes - previous.reqBytes),
+        resMessages: Math.max(0, current.resMessages - previous.resMessages),
+        resBytes: Math.max(0, current.resBytes - previous.resBytes),
+        evtMessages: Math.max(0, current.evtMessages - previous.evtMessages),
+        evtBytes: Math.max(0, current.evtBytes - previous.evtBytes)
+      };
+    }
+    function addDirection(into, add) {
+      return {
+        reqMessages: into.reqMessages + add.reqMessages,
+        reqBytes: into.reqBytes + add.reqBytes,
+        resMessages: into.resMessages + add.resMessages,
+        resBytes: into.resBytes + add.resBytes,
+        evtMessages: into.evtMessages + add.evtMessages,
+        evtBytes: into.evtBytes + add.evtBytes
+      };
+    }
+    function peerMessages(delta) {
+      return socketDirectionMessages(delta.tx) + socketDirectionMessages(delta.rx);
+    }
+    function diffSocketPlane(baseline, current, topN = 5) {
+      const deltas = [];
+      let tx = EMPTY_SOCKET_DIRECTION;
+      let rx = EMPTY_SOCKET_DIRECTION;
+      for (const sample of current.peers) {
+        const before = baseline.peers.get(sample.peerId);
+        const delta = {
+          peerId: sample.peerId,
+          tx: diffDirection(sample.tx, before?.tx),
+          rx: diffDirection(sample.rx, before?.rx)
+        };
+        tx = addDirection(tx, delta.tx);
+        rx = addDirection(rx, delta.rx);
+        if (peerMessages(delta) > 0) deltas.push(delta);
+      }
+      return {
+        peersConnected: current.peersConnected,
+        peersMeasured: current.peers.length,
+        tx,
+        rx,
+        top: deltas.toSorted((a, b) => peerMessages(b) - peerMessages(a) || a.peerId.localeCompare(b.peerId)).slice(0, topN)
+      };
+    }
+    function createSocketPlaneMeter(reader, topN = 5) {
+      let baseline = EMPTY_SOCKET_PLANE_BASELINE;
+      return { read: () => {
+        const current = reader();
+        if (current === void 0) return void 0;
+        const window2 = diffSocketPlane(baseline, current, topN);
+        baseline = { peers: new Map(current.peers.map((p) => [p.peerId, p])) };
+        return window2;
+      } };
+    }
+    function kb(bytes) {
+      return Math.round(bytes / 1024);
+    }
+    function formatDirection(sample) {
+      return `req:${sample.reqMessages}/${kb(sample.reqBytes)}kB,res:${sample.resMessages}/${kb(sample.resBytes)}kB,evt:${sample.evtMessages}/${kb(sample.evtBytes)}kB`;
+    }
+    function formatPeer(delta) {
+      return `${delta.peerId}:tx=${delta.tx.reqMessages}/${delta.tx.resMessages}/${delta.tx.evtMessages}:rx=${delta.rx.reqMessages}/${delta.rx.resMessages}/${delta.rx.evtMessages}:kB=${kb(socketDirectionBytes(delta.tx))}/${kb(socketDirectionBytes(delta.rx))}`;
+    }
+    function formatSocketPlane(window2) {
+      if (window2 === void 0) return "";
+      const top = window2.top.map(formatPeer).join(",");
+      return ` socketPeers=${window2.peersMeasured}/${window2.peersConnected} socketTx=${formatDirection(window2.tx)} socketRx=${formatDirection(window2.rx)}` + (top.length === 0 ? "" : ` socketTop=${top}`);
+    }
     var DECISIVE_HEAP_SPACES = ["old_space", "large_object_space"];
     var HEAP_SPACE_REPORT_MIN_MB = 32;
     var BYTES_PER_MB = 1048576;
@@ -114968,6 +115464,7 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
     function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv, announceCeilingOrigin = true, rssBudget, probes) {
       const readSpaces = probes?.readSpaces ?? readHeapSpaces;
       const eventPlane = probes?.eventPlane === void 0 ? void 0 : createEventPlaneMeter(probes.eventPlane);
+      const socketPlane = probes?.socketPlane === void 0 ? void 0 : createSocketPlaneMeter(probes.socketPlane);
       const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
       const now = reclaimOptions?.now ?? (() => Date.now());
       const triggerMb = reclaimOptions?.triggerMb ?? 1024;
@@ -115003,7 +115500,7 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
           return;
         }
         const after = read();
-        sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB\u2192${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB\u2192${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
+        sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB\u2192${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB\u2192${after.arrayBuffersMb}MB took=${now() - startedAt}ms heapUsed=${sample.heapUsedMb}MB\u2192${after.heapUsedMb}MB`);
         if (passesAtFloor >= 6 && !steadyStateAnnounced) {
           steadyStateAnnounced = true;
           const nextFloorMs = reclaimIntervalMs(passesAtFloor, minIntervalMs, steadyStateIntervalMs);
@@ -115045,7 +115542,7 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
           const due = at - lastLoggedAt >= intervalMs;
           if (mode === "escalated" || due) {
             lastLoggedAt = at;
-            const line = format2(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}`);
+            const line = format2(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()));
             if (sample.nearLimit) sink.warn(`${line} \u2014 APPROACHING HEAP LIMIT`);
             else if (mode === "escalated") sink.warn(`${line} \u2014 heap elevated, sampling every ${probeIntervalMs}ms`);
             else sink.info(line);
@@ -118259,6 +118756,33 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
       chunks = [];
       /** Sum of `chunks[i].byteLength` — tracked so length checks cost nothing. */
       buffered = 0;
+      /** Backing store for {@link lastFrameBytes}; see that getter. */
+      sizes = [];
+      /**
+      * On-the-wire byte length (4-byte prefix included) of each frame returned by
+      * the most recent {@link push}, index-aligned with the returned array.
+      *
+      * It exists because the frames come back DECODED, and a decoded value has no
+      * memory of how many bytes it cost — so a caller counting received bytes per
+      * message kind (`SocketChannel`, feeding the `[mem]` line's per-peer socket
+      * attribution) could otherwise only charge a whole `data` chunk, which may
+      * hold several frames of different kinds, or half of one.
+      *
+      * **Only the first `frames.length` entries are meaningful**, and the array is
+      * never truncated. That is deliberate and it was measured on Node 24.17:
+      * `sizes.length = 0` + `push` costs **35.1–35.9 ns** per call — V8 shrinks the
+      * backing store and the next call re-grows it — which is 3 % of
+      * `FrameDecoder.push` itself and 15× the counter it feeds. Writing in place
+      * costs **0.06–0.13 ns**. On a path that runs ~22 000 times a second, an
+      * instrument may not be the most expensive thing on the line it measures.
+      *
+      * Read it immediately after the `push` that produced it — it is a window onto
+      * the decoder, not a value. Safe because `push` is only ever driven by a
+      * socket `data` event, which Node never delivers re-entrantly.
+      */
+      get lastFrameBytes() {
+        return this.sizes;
+      }
       push(chunk) {
         if (chunk.byteLength > 0) {
           this.chunks.push(chunk);
@@ -118276,6 +118800,7 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
             body = Buffer.allocUnsafeSlow(len);
             frame.copy(body, 0, HEADER_BYTES);
           } else body = frame.subarray(HEADER_BYTES);
+          this.sizes[frames.length] = total;
           frames.push(decode(body));
         }
         return frames;
@@ -118355,6 +118880,11 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
       };
       closed = false;
       closeFired = false;
+      /** Frames written to the peer, cumulative, split by kind. See
+      *  {@link readTraffic} and `transport/socket-traffic.ts`. */
+      txCounters = createSocketDirectionCounters();
+      /** Frames read from the peer, cumulative, split by kind. */
+      rxCounters = createSocketDirectionCounters();
       constructor(socket) {
         this.socket = socket;
         socket.on("data", (chunk) => this.onData(chunk));
@@ -118422,14 +118952,41 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         this.closed = true;
         this.socket.destroy();
       }
+      /**
+      * This channel's cumulative traffic, both directions, split by frame kind.
+      *
+      * Cumulative for the life of the channel: the reporting layer subtracts the
+      * previous reading, because the question is a RATE ("which peer receives the
+      * 22 500 writes/s") and not a total since boot.
+      */
+      readTraffic() {
+        return {
+          tx: sampleSocketDirection(this.txCounters),
+          rx: sampleSocketDirection(this.rxCounters)
+        };
+      }
       send(frame) {
         if (this.closed) return;
-        this.socket.write(encodeFrame(frame));
+        const encoded = encodeFrame(frame);
+        recordSocketFrame(this.txCounters, frame.k, encoded.byteLength);
+        this.socket.write(encoded);
       }
       onData(chunk) {
-        for (const f of this.decoder.push(chunk)) this.handleFrame(f);
+        const frames = this.decoder.push(chunk);
+        const sizes = this.decoder.lastFrameBytes;
+        for (let i = 0; i < frames.length; i += 1) this.handleFrame(frames[i], sizes[i] ?? 0);
       }
-      async handleFrame(frame) {
+      /**
+      * `wireBytes` is the frame's on-the-wire length, counted HERE rather than in
+      * `onData` on purpose: a peer that sends a frame this decoder can parse but
+      * whose shape is not a `Frame` throws on `frame.k`, and inside this async
+      * method that stays the rejected promise it has always been. Reading `.k`
+      * one frame earlier, synchronously in the socket's `data` handler, would
+      * turn the same malformed frame into an uncaught exception on the transport
+      * — a diagnostic that can crash the process it watches.
+      */
+      async handleFrame(frame, wireBytes) {
+        recordSocketFrame(this.rxCounters, frame.k, wireBytes);
         if (frame.k === "req") {
           try {
             const result = await this.requestHandler(frame.body);
@@ -119150,6 +119707,22 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         };
       }
       /**
+      * This child's socket traffic — bytes and messages, both directions, split by
+      * frame kind — or `null` when the child is gone or its channel keeps no
+      * counters (an in-process or test transport).
+      *
+      * The event counters above cover ONE kind of frame and, once surfaced on
+      * 2026-08-29, accounted for 4% of hub-main's ~44 000 socket syscalls/s. This
+      * is the same question asked of every frame the channel moves, and it is the
+      * only per-peer attribution that exists: `/proc` reports one `rchar`/`wchar`
+      * pair for the whole process and has no per-socket breakdown.
+      */
+      getChildSocketTraffic(childId) {
+        const entry = this.children.get(childId);
+        if (entry === void 0) return null;
+        return entry.channel.readTraffic?.() ?? null;
+      }
+      /**
       * The regime the counters above were produced under, read once from
       * `CAMSTACK_UDS_EVENT_FANOUT` at construction.
       *
@@ -121645,6 +122218,18 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return DeviceRegistry;
       }
     });
+    Object.defineProperty(exports, "EMPTY_SOCKET_DIRECTION", {
+      enumerable: true,
+      get: function() {
+        return EMPTY_SOCKET_DIRECTION;
+      }
+    });
+    Object.defineProperty(exports, "EMPTY_SOCKET_PLANE_BASELINE", {
+      enumerable: true,
+      get: function() {
+        return EMPTY_SOCKET_PLANE_BASELINE;
+      }
+    });
     Object.defineProperty(exports, "EVENT_PLANE_TOP_N", {
       enumerable: true,
       get: function() {
@@ -121777,6 +122362,12 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return RUNNER_RSS_BUDGET_ENV;
       }
     });
+    Object.defineProperty(exports, "SOCKET_PLANE_TOP_N", {
+      enumerable: true,
+      get: function() {
+        return SOCKET_PLANE_TOP_N;
+      }
+    });
     Object.defineProperty(exports, "SocketChannel", {
       enumerable: true,
       get: function() {
@@ -121975,6 +122566,24 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return createParentUnownedCallHandler;
       }
     });
+    Object.defineProperty(exports, "createSocketDirectionCounters", {
+      enumerable: true,
+      get: function() {
+        return createSocketDirectionCounters;
+      }
+    });
+    Object.defineProperty(exports, "createSocketPlaneMeter", {
+      enumerable: true,
+      get: function() {
+        return createSocketPlaneMeter;
+      }
+    });
+    Object.defineProperty(exports, "createSocketPlaneReader", {
+      enumerable: true,
+      get: function() {
+        return createSocketPlaneReader;
+      }
+    });
     Object.defineProperty(exports, "createUdsAddonContext", {
       enumerable: true,
       get: function() {
@@ -122029,6 +122638,12 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return diffEventPlane;
       }
     });
+    Object.defineProperty(exports, "diffSocketPlane", {
+      enumerable: true,
+      get: function() {
+        return diffSocketPlane;
+      }
+    });
     Object.defineProperty(exports, "emitHeapDiagnosticReport", {
       enumerable: true,
       get: function() {
@@ -122053,6 +122668,12 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return formatHeapSpaces;
       }
     });
+    Object.defineProperty(exports, "formatSocketPlane", {
+      enumerable: true,
+      get: function() {
+        return formatSocketPlane;
+      }
+    });
     Object.defineProperty(exports, "getBrokerEventBus", {
       enumerable: true,
       get: function() {
@@ -122191,6 +122812,12 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return reclaimIntervalMs;
       }
     });
+    Object.defineProperty(exports, "recordSocketFrame", {
+      enumerable: true,
+      get: function() {
+        return recordSocketFrame;
+      }
+    });
     Object.defineProperty(exports, "registerEventBusService", {
       enumerable: true,
       get: function() {
@@ -122221,6 +122848,12 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return runNpm;
       }
     });
+    Object.defineProperty(exports, "sampleSocketDirection", {
+      enumerable: true,
+      get: function() {
+        return sampleSocketDirection;
+      }
+    });
     Object.defineProperty(exports, "selectReportedSpaces", {
       enumerable: true,
       get: function() {
@@ -122257,6 +122890,18 @@ var require_manifest_python_deps_COeSr7el = __commonJS({
         return shouldReclaim;
       }
     });
+    Object.defineProperty(exports, "socketDirectionBytes", {
+      enumerable: true,
+      get: function() {
+        return socketDirectionBytes;
+      }
+    });
+    Object.defineProperty(exports, "socketDirectionMessages", {
+      enumerable: true,
+      get: function() {
+        return socketDirectionMessages;
+      }
+    });
     Object.defineProperty(exports, "startHeapWatch", {
       enumerable: true,
       get: function() {
@@ -126095,7 +126740,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -126121,7 +126766,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_python_deps = require_manifest_python_deps_COeSr7el();
+    var require_manifest_python_deps = require_manifest_python_deps_DVODn_qc();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -206502,6 +207147,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
     exports.DeviceRegistry = require_manifest_python_deps.DeviceRegistry;
     exports.DeviceStore = require_builtins_sqlite_storage_index.DeviceStore$1;
+    exports.EMPTY_SOCKET_DIRECTION = require_manifest_python_deps.EMPTY_SOCKET_DIRECTION;
+    exports.EMPTY_SOCKET_PLANE_BASELINE = require_manifest_python_deps.EMPTY_SOCKET_PLANE_BASELINE;
     exports.EVENT_PLANE_TOP_N = require_manifest_python_deps.EVENT_PLANE_TOP_N;
     exports.EVENT_TOPIC_PREFIX = require_manifest_python_deps.EVENT_TOPIC_PREFIX;
     exports.EngineManagerResolver = EngineManagerResolver;
@@ -206575,6 +207222,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
     exports.SERVER_AUTH_OID = require_tls$1.SERVER_AUTH_OID;
+    exports.SOCKET_PLANE_TOP_N = require_manifest_python_deps.SOCKET_PLANE_TOP_N;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
     exports.SocketChannel = require_manifest_python_deps.SocketChannel;
@@ -206660,6 +207308,9 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.createReadinessService = createReadinessService;
     exports.createReadinessServiceForRegistry = createReadinessServiceForRegistry;
     exports.createScopedProcessManager = createScopedProcessManager;
+    exports.createSocketDirectionCounters = require_manifest_python_deps.createSocketDirectionCounters;
+    exports.createSocketPlaneMeter = require_manifest_python_deps.createSocketPlaneMeter;
+    exports.createSocketPlaneReader = require_manifest_python_deps.createSocketPlaneReader;
     exports.createStreamProbeBrokerService = createStreamProbeBrokerService;
     exports.createUdsAddonContext = require_manifest_python_deps.createUdsAddonContext;
     exports.createUdsEventBridge = require_manifest_python_deps.createUdsEventBridge;
@@ -206673,6 +207324,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.describeRss = require_manifest_python_deps.describeRss;
     exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
     exports.diffEventPlane = require_manifest_python_deps.diffEventPlane;
+    exports.diffSocketPlane = require_manifest_python_deps.diffSocketPlane;
     Object.defineProperty(exports, "downloadBinary", {
       enumerable: true,
       get: function() {
@@ -206720,6 +207372,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.formatEventPlane = require_manifest_python_deps.formatEventPlane;
     exports.formatHeapSpaces = require_manifest_python_deps.formatHeapSpaces;
     exports.formatLogLine = require_formatter.formatLogLine;
+    exports.formatSocketPlane = require_manifest_python_deps.formatSocketPlane;
     exports.getBrokerEventBus = require_manifest_python_deps.getBrokerEventBus;
     exports.getCapUsageRegistry = require_manifest_python_deps.getCapUsageRegistry;
     Object.defineProperty(exports, "getFfmpegDownloadUrl", {
@@ -206799,6 +207452,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.readTlsMode = require_tls$1.readTlsMode;
     exports.readinessKey = require_dist10.readinessKey;
     exports.reclaimIntervalMs = require_manifest_python_deps.reclaimIntervalMs;
+    exports.recordSocketFrame = require_manifest_python_deps.recordSocketFrame;
     exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
     exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
     exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
@@ -206807,6 +207461,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
     exports.runHubAddonBoot = runHubAddonBoot;
     exports.runNpm = require_manifest_python_deps.runNpm;
+    exports.sampleSocketDirection = require_manifest_python_deps.sampleSocketDirection;
     exports.scheduleSelfRestart = scheduleSelfRestart;
     exports.scopeKey = require_dist10.scopeKey;
     exports.scopesAllowAddon = require_dist10.scopesAllowAddon;
@@ -206817,6 +207472,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.setHubConnected = require_manifest_python_deps.setHubConnected;
     exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
     exports.shouldReclaim = require_manifest_python_deps.shouldReclaim;
+    exports.socketDirectionBytes = require_manifest_python_deps.socketDirectionBytes;
+    exports.socketDirectionMessages = require_manifest_python_deps.socketDirectionMessages;
     exports.startHeapWatch = require_manifest_python_deps.startHeapWatch;
     exports.startRunnerHeapWatch = require_manifest_python_deps.startRunnerHeapWatch;
     exports.strandedMb = require_manifest_python_deps.strandedMb;
@@ -206858,7 +207515,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_DUxF5DdC();
+    var require_sleep = require_sleep_CJrvRDlD();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -208179,29 +208836,50 @@ var require_dist4 = __commonJS({
     });
     var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
     var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
+    var MediaRelocateModeSchema = zod.z.enum([
+      "move",
+      "seal",
+      "gallery"
+    ]);
     var RelocateMediaInputSchema = zod.z.object({
       toLocationId: zod.z.string(),
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `move`, the pre-existing behaviour. */
+      mode: MediaRelocateModeSchema.optional()
+    });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: zod.z.number().int().nonnegative(),
+      retrainFrames: zod.z.number().int().nonnegative(),
+      total: zod.z.number().int().nonnegative()
     });
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
       "recordingsLow",
-      "eventMedia"
+      "eventMedia",
+      "backups",
+      "galleryMedia"
     ]);
     var StorageMigrationDestinationsSchema = zod.z.object({
       recordings: zod.z.string().min(1).optional(),
       recordingsLow: zod.z.string().min(1).optional(),
-      eventMedia: zod.z.string().min(1).optional()
+      eventMedia: zod.z.string().min(1).optional(),
+      backups: zod.z.string().min(1).optional(),
+      galleryMedia: zod.z.string().min(1).optional()
     }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+    var StorageMigrationModeSchema = zod.z.enum(["blocking", "nonBlocking"]);
     var StorageMigrationInputSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `blocking`, which stays the default. */
+      mode: StorageMigrationModeSchema.optional()
     });
     var StorageMigrationPhaseSchema = zod.z.enum([
       "planning",
+      "sealing",
       "pausing",
       "moving",
+      "draining",
       "verifying",
       "repointing",
       "refreshing",
@@ -208226,6 +208904,9 @@ var require_dist4 = __commonJS({
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
       phase: StorageMigrationPhaseSchema,
+      /** Which order this job is running. `status` is the only place an operator
+      *  can tell a seconds-long cutover from a thirty-hour one. */
+      mode: StorageMigrationModeSchema,
       destinations: StorageMigrationDestinationsSchema,
       throttleMbps: zod.z.number(),
       moves: zod.z.array(StorageMigrationMoveSchema),
@@ -208238,13 +208919,31 @@ var require_dist4 = __commonJS({
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
     });
+    var StorageMigrationFindingCodeSchema = zod.z.enum([
+      "sharesDeviceWithSource",
+      "deviceIdentityUnknown",
+      "unstampedEventMediaRows",
+      "blockingOnly",
+      "noMover"
+    ]);
+    var StorageMigrationFindingSchema = zod.z.object({
+      code: StorageMigrationFindingCodeSchema,
+      storageClass: StorageMigrationClassSchema,
+      /** Human-readable, already carrying the ids and counts. */
+      message: zod.z.string()
+    });
     var StorageMigrationPlanSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
+      /** The mode this plan was built for. A plan is only valid for its mode: the
+      *  `eventMedia` seal gate and the single-cardinality refusal both depend on
+      *  it. */
+      mode: StorageMigrationModeSchema,
       moves: zod.z.array(zod.z.object({
         storageClass: StorageMigrationClassSchema,
         fromLocationId: zod.z.string(),
         toLocationId: zod.z.string()
-      }))
+      })),
+      findings: zod.z.array(StorageMigrationFindingSchema)
     });
     var SUB_DETECTION_TYPES = ["face", "plate"];
     var RECOGNITION_TYPES = [
@@ -221220,6 +221919,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * How many media / retrain rows still carry NO `locationId`.
+        *
+        * A NULL row means "wherever `eventMedia` points NOW", so the instant a
+        * repoint moves that pointer every such row reads from the new disk while
+        * its bytes are on the old one — the archive goes dark until a drain
+        * happens to stamp it. This count is what the migration planner's
+        * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+        * it to zero.
+        */
+        countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: require_sleep.method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -223836,7 +224546,24 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
-        deleteLocation: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+        /**
+        * Remove a location record. REFUSES a location that still holds data —
+        * deleting a drained location whose durable rows still name it is how this
+        * hub acquired 2 131 ghost `recordings:high` segments, and playback does
+        * not stat, so the operator sees a silent black window rather than an
+        * error.
+        *
+        * `force` exists because the occupancy check is BEST-EFFORT and refuses on
+        * "unknown" as well as on "occupied" (a read that fails must not authorise
+        * a destruction — D49). A location on a removed disk, on another node, or
+        * behind a remote provider answers "unknown" forever, and a refusal an
+        * operator cannot override is its own failure mode. `force: true` is
+        * logged, loudly, with what the check saw.
+        */
+        deleteLocation: require_sleep.method(zod.z.object({
+          id: zod.z.string(),
+          force: zod.z.boolean().optional()
+        }), zod.z.void(), {
           kind: "mutation",
           auth: "admin"
         }),
@@ -239875,6 +240602,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countUnstampedEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.deleteDeviceEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -248898,6 +249631,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
     exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
     exports.MediaPlayerStatusSchema = MediaPlayerStatusSchema;
+    exports.MediaRelocateModeSchema = MediaRelocateModeSchema;
     exports.MeshPeerSchema = MeshPeerSchema;
     exports.MeshStatusSchema = MeshStatusSchema;
     exports.MethodAccessSchema = MethodAccessSchema;
@@ -249275,11 +250009,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
     exports.StorageMigrationClassSchema = StorageMigrationClassSchema;
     exports.StorageMigrationDestinationsSchema = StorageMigrationDestinationsSchema;
+    exports.StorageMigrationFindingCodeSchema = StorageMigrationFindingCodeSchema;
+    exports.StorageMigrationFindingSchema = StorageMigrationFindingSchema;
     exports.StorageMigrationFootageMoveInputSchema = StorageMigrationFootageMoveInputSchema;
     exports.StorageMigrationInputSchema = StorageMigrationInputSchema;
     exports.StorageMigrationJobSchema = StorageMigrationJobSchema;
     exports.StorageMigrationLeaseInputSchema = StorageMigrationLeaseInputSchema;
     exports.StorageMigrationMediaMoveInputSchema = StorageMigrationMediaMoveInputSchema;
+    exports.StorageMigrationModeSchema = StorageMigrationModeSchema;
     exports.StorageMigrationMoveSchema = StorageMigrationMoveSchema;
     exports.StorageMigrationParticipantSchema = StorageMigrationParticipantSchema;
     exports.StorageMigrationPhaseSchema = StorageMigrationPhaseSchema;
@@ -249355,6 +250092,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.UNIT_TABLE = UNIT_TABLE;
     exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
     exports.UnitConversionError = UnitConversionError;
+    exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
     exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
     exports.UpdateStatusSchema = UpdateStatusSchema;
     exports.UpdateUserInputSchema = UpdateUserInputSchema;
@@ -421823,6 +422561,17 @@ var require_main4 = __commonJS({
             return broker === void 0 ? null : (0, system_1.getMoleculerEventStats)(broker);
           },
           crossNodeMode: () => (0, system_1.readMoleculerFanoutMode)()
+        }),
+        // The fan-out counters above answered their own question and sharpened
+        // this one: the event plane is 4% of this process's ~44 000 socket
+        // syscalls/s. The other 96% had no instrument — `/proc` reports one
+        // rchar/wchar pair per PROCESS and has no per-socket breakdown, so the
+        // best attribution available was a correlation with `hub/pipeline-
+        // analytics` computed from a runner whose rchar also counts page-cache
+        // reads. These counters live on the channel itself, so the attribution is
+        // per peer and per frame kind. Same lazy registry, same reason.
+        socketPlane: (0, system_1.createSocketPlaneReader)({
+          registry: () => moleculerForEventPlane?.childRegistry ?? null
         })
       });
       cleanupOrphanProcesses();