camstack 1.2.61 → 1.2.63

package/dist/{launcher-AZ7QXACO.js → launcher-RA6HGFNQ.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-BPlfW-CG.js
-var require_dist_BPlfW_CG = __commonJS({
-  "../system/dist/dist-BPlfW-CG.js"(exports) {
+// ../system/dist/dist-CDgIzo82.js
+var require_dist_CDgIzo82 = __commonJS({
+  "../system/dist/dist-CDgIzo82.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -26256,29 +26256,50 @@ var require_dist_BPlfW_CG = __commonJS({
     });
     var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
     var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
+    var MediaRelocateModeSchema = zod.z.enum([
+      "move",
+      "seal",
+      "gallery"
+    ]);
     var RelocateMediaInputSchema = zod.z.object({
       toLocationId: zod.z.string(),
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `move`, the pre-existing behaviour. */
+      mode: MediaRelocateModeSchema.optional()
+    });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: zod.z.number().int().nonnegative(),
+      retrainFrames: zod.z.number().int().nonnegative(),
+      total: zod.z.number().int().nonnegative()
     });
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
       "recordingsLow",
-      "eventMedia"
+      "eventMedia",
+      "backups",
+      "galleryMedia"
     ]);
     var StorageMigrationDestinationsSchema = zod.z.object({
       recordings: zod.z.string().min(1).optional(),
       recordingsLow: zod.z.string().min(1).optional(),
-      eventMedia: zod.z.string().min(1).optional()
+      eventMedia: zod.z.string().min(1).optional(),
+      backups: zod.z.string().min(1).optional(),
+      galleryMedia: zod.z.string().min(1).optional()
     }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+    var StorageMigrationModeSchema = zod.z.enum(["blocking", "nonBlocking"]);
     var StorageMigrationInputSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `blocking`, which stays the default. */
+      mode: StorageMigrationModeSchema.optional()
     });
     var StorageMigrationPhaseSchema = zod.z.enum([
       "planning",
+      "sealing",
       "pausing",
       "moving",
+      "draining",
       "verifying",
       "repointing",
       "refreshing",
@@ -26303,6 +26324,9 @@ var require_dist_BPlfW_CG = __commonJS({
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
       phase: StorageMigrationPhaseSchema,
+      /** Which order this job is running. `status` is the only place an operator
+      *  can tell a seconds-long cutover from a thirty-hour one. */
+      mode: StorageMigrationModeSchema,
       destinations: StorageMigrationDestinationsSchema,
       throttleMbps: zod.z.number(),
       moves: zod.z.array(StorageMigrationMoveSchema),
@@ -26315,13 +26339,31 @@ var require_dist_BPlfW_CG = __commonJS({
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
     });
+    var StorageMigrationFindingCodeSchema = zod.z.enum([
+      "sharesDeviceWithSource",
+      "deviceIdentityUnknown",
+      "unstampedEventMediaRows",
+      "blockingOnly",
+      "noMover"
+    ]);
+    var StorageMigrationFindingSchema = zod.z.object({
+      code: StorageMigrationFindingCodeSchema,
+      storageClass: StorageMigrationClassSchema,
+      /** Human-readable, already carrying the ids and counts. */
+      message: zod.z.string()
+    });
     var StorageMigrationPlanSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
+      /** The mode this plan was built for. A plan is only valid for its mode: the
+      *  `eventMedia` seal gate and the single-cardinality refusal both depend on
+      *  it. */
+      mode: StorageMigrationModeSchema,
       moves: zod.z.array(zod.z.object({
         storageClass: StorageMigrationClassSchema,
         fromLocationId: zod.z.string(),
         toLocationId: zod.z.string()
-      }))
+      })),
+      findings: zod.z.array(StorageMigrationFindingSchema)
     });
     var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
     var StorageLocationSchema = zod.z.object({
@@ -37316,6 +37358,17 @@ var require_dist_BPlfW_CG = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * How many media / retrain rows still carry NO `locationId`.
+        *
+        * A NULL row means "wherever `eventMedia` points NOW", so the instant a
+        * repoint moves that pointer every such row reads from the new disk while
+        * its bytes are on the old one — the archive goes dark until a drain
+        * happens to stamp it. This count is what the migration planner's
+        * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+        * it to zero.
+        */
+        countUnstampedEventMedia: method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -39768,7 +39821,24 @@ var require_dist_BPlfW_CG = __commonJS({
           kind: "mutation",
           auth: "admin"
         }),
-        deleteLocation: method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+        /**
+        * Remove a location record. REFUSES a location that still holds data —
+        * deleting a drained location whose durable rows still name it is how this
+        * hub acquired 2 131 ghost `recordings:high` segments, and playback does
+        * not stat, so the operator sees a silent black window rather than an
+        * error.
+        *
+        * `force` exists because the occupancy check is BEST-EFFORT and refuses on
+        * "unknown" as well as on "occupied" (a read that fails must not authorise
+        * a destruction — D49). A location on a removed disk, on another node, or
+        * behind a remote provider answers "unknown" forever, and a refusal an
+        * operator cannot override is its own failure mode. `force: true` is
+        * logged, loudly, with what the check saw.
+        */
+        deleteLocation: method(zod.z.object({
+          id: zod.z.string(),
+          force: zod.z.boolean().optional()
+        }), zod.z.void(), {
           kind: "mutation",
           auth: "admin"
         }),
@@ -52862,6 +52932,12 @@ var require_dist_BPlfW_CG = __commonJS({
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countUnstampedEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.deleteDeviceEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -58713,7 +58789,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59532,7 +59608,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59626,7 +59702,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60523,11 +60599,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-DBY6ebwV.js
-var require_retired_settings_keys_DBY6ebwV = __commonJS({
-  "../system/dist/retired-settings-keys-DBY6ebwV.js"(exports) {
+// ../system/dist/retired-settings-keys-BfAzWvPC.js
+var require_retired_settings_keys_BfAzWvPC = __commonJS({
+  "../system/dist/retired-settings-keys-BfAzWvPC.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62741,8 +62817,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
-    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
+    var require_dist10 = require_dist_CDgIzo82();
+    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67491,7 +67567,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67628,7 +67704,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67818,7 +67894,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75631,7 +75707,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76196,7 +76272,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -78818,7 +78894,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -79934,8 +80010,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
-    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
+    var require_dist10 = require_dist_CDgIzo82();
+    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -82214,7 +82290,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82397,8 +82473,19 @@ var require_storage_orchestrator_addon = __commonJS({
     var STORAGE_CLASSES = [
       "recordings",
       "recordingsLow",
-      "eventMedia"
+      "eventMedia",
+      "backups",
+      "galleryMedia"
+    ];
+    var MOVER_CLASSES = [
+      "recordings",
+      "recordingsLow",
+      "eventMedia",
+      "galleryMedia"
     ];
+    var BLOCKING_ONLY_CLASSES = ["galleryMedia"];
+    var GALLERY_FORBIDDEN_NEIGHBOUR_TYPES = ["recordings", "recordingsLow"];
+    var MOVE_LANES = ["media", "footage"];
     var PARTICIPANTS = [
       "pipeline",
       "recorder",
@@ -82418,7 +82505,9 @@ var require_storage_orchestrator_addon = __commonJS({
         this.deps = deps;
       }
       async plan(input) {
+        const mode = input.mode ?? "blocking";
         const moves = [];
+        const findings = [];
         for (const storageClass of STORAGE_CLASSES) {
           const targetId = input.destinations[storageClass];
           if (targetId === void 0) continue;
@@ -82428,6 +82517,9 @@ var require_storage_orchestrator_addon = __commonJS({
           if (!target) throw new Error(`Storage location "${targetId}" not found`);
           if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
           if (source.id === target.id) throw new Error(`Storage location "${targetId}" is already the "${storageClass}" default`);
+          if (!MOVER_CLASSES.includes(storageClass)) throw new Error(`No mover owns "${storageClass}" \u2014 the migration can repoint its default but cannot move its bytes. Move it by hand, then repoint the default with upsertLocation.`);
+          if (mode === "nonBlocking" && BLOCKING_ONLY_CLASSES.includes(storageClass)) throw new Error(`"${storageClass}" is a single-cardinality storage class: it can never exist at two locations at once, so it cannot be repointed first and drained behind. Use mode "blocking".`);
+          await this.refuseGalleryOntoRecordingsVolume(storageClass, targetId);
           moves.push({
             storageClass,
             fromLocationId: source.id,
@@ -82436,17 +82528,79 @@ var require_storage_orchestrator_addon = __commonJS({
             state: null,
             error: null
           });
+          if (BLOCKING_ONLY_CLASSES.includes(storageClass)) findings.push({
+            code: "blockingOnly",
+            storageClass,
+            message: `"${storageClass}" is single-cardinality: this move is stop-the-world for its whole duration, in every mode. It is a few KB per enrolled sample, which is why that is acceptable.`
+          });
+          findings.push(...await this.deviceFindings(storageClass, source.id, target.id));
         }
         if (moves.length === 0) throw new Error("select at least one storage class");
+        if (moves.some((move) => move.storageClass === "eventMedia")) {
+          const unstamped = await this.deps.participants.analytics.countUnstamped();
+          if (unstamped.total > 0) {
+            if (mode === "nonBlocking") throw new Error(`${unstamped.total.toString()} event-media row(s) still carry no locationId (${unstamped.media.toString()} media, ${unstamped.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+            findings.push({
+              code: "unstampedEventMediaRows",
+              storageClass: "eventMedia",
+              message: `${unstamped.total.toString()} event-media row(s) carry no locationId. This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
+            });
+          }
+        }
         return {
           destinations: input.destinations,
+          mode,
           moves: moves.map(({ storageClass, fromLocationId, toLocationId }) => ({
             storageClass,
             fromLocationId,
             toLocationId
-          }))
+          })),
+          findings
         };
       }
+      /**
+      * HARD refusal: `galleryMedia` onto a volume a recordings class lives on.
+      *
+      * This is the one same-device case that is a refusal rather than a finding,
+      * because its consequence is silent and arrives months later — the gallery is
+      * wiped by the next footage wipe, quota eviction or recordings disk swap, and
+      * nothing at that moment points back at this migration.
+      *
+      * It can only refuse what it can SEE. `deviceKeyOf` is a realpath, so it
+      * catches a symlink, a bind mount and a literally-shared directory — and
+      * misses two distinct directories on one filesystem, and any location pinned
+      * to another node. Those come back `null`/distinct and produce a
+      * `deviceIdentityUnknown` finding instead.
+      */
+      async refuseGalleryOntoRecordingsVolume(storageClass, targetId) {
+        if (storageClass !== "galleryMedia") return;
+        const targetKey = await this.deviceKey(targetId);
+        if (targetKey === null) return;
+        for (const type of GALLERY_FORBIDDEN_NEIGHBOUR_TYPES) for (const neighbour of this.deps.locations.listLocations({ type })) {
+          if (await this.deviceKey(neighbour.id) !== targetKey) continue;
+          throw new Error(`Storage location "${targetId}" shares a volume with "${neighbour.id}" (${type}). galleryMedia is deliberately NOT on the recordings volume: enrolment images survive every retention sweep, so they must also survive a footage wipe, a quota eviction and a recordings disk swap. Choose a destination on another volume.`);
+        }
+      }
+      /** Same-device observations that are reported, not refused. */
+      async deviceFindings(storageClass, sourceId, targetId) {
+        if (this.deps.deviceKeyOf === void 0) return [];
+        const [sourceKey, targetKey] = await Promise.all([this.deviceKey(sourceId), this.deviceKey(targetId)]);
+        if (sourceKey === null || targetKey === null) return [{
+          code: "deviceIdentityUnknown",
+          storageClass,
+          message: `Could not establish whether "${sourceId}" and "${targetId}" are on the same device (a location with no basePath, or pinned to another node \u2014 the realpath would have to be taken there). Note also that this check is PATH identity, not st_dev: two distinct directories on one filesystem are never detected as one device.`
+        }];
+        if (sourceKey !== targetKey) return [];
+        return [{
+          code: "sharesDeviceWithSource",
+          storageClass,
+          message: `"${targetId}" resolves to the same path as "${sourceId}". The move will re-stamp rows rather than copy bytes, and it buys no redundancy \u2014 both "locations" are one disk.`
+        }];
+      }
+      async deviceKey(locationId) {
+        if (this.deps.deviceKeyOf === void 0) return null;
+        return this.deps.deviceKeyOf(locationId);
+      }
       async start(input) {
         if (this.startReserved) throw new Error("storage migration is already active");
         this.startReserved = true;
@@ -82463,6 +82617,7 @@ var require_storage_orchestrator_addon = __commonJS({
           const job = {
             jobId: this.deps.newId(),
             phase: "planning",
+            mode: plan.mode,
             destinations: input.destinations,
             throttleMbps: input.throttleMbps ?? 40,
             moves: plan.moves.map((move) => ({
@@ -82480,8 +82635,8 @@ var require_storage_orchestrator_addon = __commonJS({
             finishedAt: null,
             error: null
           };
-          this.active = job;
           await this.persist(job);
+          this.active = job;
           this.runPromise = this.run(job);
           this.runPromise;
           return job.jobId;
@@ -82496,7 +82651,8 @@ var require_storage_orchestrator_addon = __commonJS({
       }
       async cancel(jobId) {
         const job = await this.status(jobId);
-        if (!job || isTerminal(job) || job.repointed) return false;
+        const cutoverInFlight = job !== null && job.repointed && (job.phase === "refreshing" || job.phase === "resuming");
+        if (!job || isTerminal(job) || cutoverInFlight) return false;
         job.cancelRequested = true;
         await this.persist(job);
         await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
@@ -82527,7 +82683,7 @@ var require_storage_orchestrator_addon = __commonJS({
         job.pauseLeaseId ??= this.deps.newId();
         if (job.repointed && job.phase === "resuming") job.phase = "refreshing";
         await this.persist(job);
-        try {
+        if (!runsUnleased(job)) try {
           await this.pauseParticipants(job, true);
         } catch (err) {
           job.error = err instanceof Error ? err.message : String(err);
@@ -82539,14 +82695,34 @@ var require_storage_orchestrator_addon = __commonJS({
           this.runPromise;
         }
       }
+      /**
+      * The state machine. Both modes run the SAME phase handlers; only the order
+      * differs, which is the whole of the non-blocking design — no second mover,
+      * no parallel code path, nothing that can drift between the two.
+      *
+      *   blocking:    planning → pausing → moving → verifying → repointing →
+      *                refreshing → resuming → done
+      *   nonBlocking: planning → sealing → pausing → repointing → refreshing →
+      *                resuming → draining → verifying → done
+      *
+      * Written as a straight-line sequence of `if (phase === X)` blocks so boot
+      * recovery re-enters at whatever phase the durable record says, exactly as
+      * before.
+      */
       async run(job) {
+        const nonBlocking = job.mode === "nonBlocking";
         try {
-          if (job.phase === "planning") await this.setPhase(job, "pausing");
+          if (job.phase === "planning") await this.setPhase(job, nonBlocking ? "sealing" : "pausing");
+          if (job.phase === "sealing") {
+            await this.sealEventMedia(job);
+            if (job.cancelRequested) return this.finishCancelled(job);
+            await this.setPhase(job, "pausing");
+          }
           if (job.phase === "pausing") {
             job.pauseLeaseId ??= job.jobId;
             await this.pauseParticipants(job);
             if (job.cancelRequested) return this.finishCancelled(job);
-            await this.setPhase(job, "moving");
+            await this.setPhase(job, nonBlocking ? "repointing" : "moving");
           }
           if (job.phase === "moving") {
             await this.startOrResumeMoves(job);
@@ -82554,7 +82730,7 @@ var require_storage_orchestrator_addon = __commonJS({
             if (job.cancelRequested) return this.finishCancelled(job);
             await this.setPhase(job, "verifying");
           }
-          if (job.phase === "verifying") {
+          if (job.phase === "verifying" && !nonBlocking) {
             await this.verifyMoves(job);
             if (job.cancelRequested) return this.finishCancelled(job);
             await this.setPhase(job, "repointing");
@@ -82567,17 +82743,28 @@ var require_storage_orchestrator_addon = __commonJS({
           }
           if (job.phase === "refreshing") {
             const leaseId = requireLease(job);
-            if (job.moves.some((move) => move.storageClass !== "eventMedia")) await this.deps.participants.recorder.refresh(leaseId);
-            if (job.moves.some((move) => move.storageClass === "eventMedia")) await this.deps.participants.analytics.refresh(leaseId);
+            if (job.moves.some((move) => laneOf(move.storageClass) === "footage")) await this.deps.participants.recorder.refresh(leaseId);
+            if (job.moves.some((move) => laneOf(move.storageClass) === "media")) await this.deps.participants.analytics.refresh(leaseId);
             await this.setPhase(job, "resuming");
           }
           if (job.phase === "resuming") {
             await this.resumeParticipants(job);
+            await this.setPhase(job, nonBlocking ? "draining" : "done");
+          }
+          if (job.phase === "draining") {
+            await this.startOrResumeMoves(job);
+            await this.waitForMoves(job);
+            if (job.cancelRequested) return this.finishCancelled(job);
+            await this.setPhase(job, "verifying");
+          }
+          if (job.phase === "verifying" && nonBlocking) {
+            await this.verifyMoves(job);
+            if (job.cancelRequested) return this.finishCancelled(job);
             await this.setPhase(job, "done");
           }
         } catch (err) {
           job.error = err instanceof Error ? err.message : String(err);
-          if (job.repointed) {
+          if (job.repointed && job.pausedParticipants.length > 0) {
             job.phase = "refreshing";
             job.finishedAt = null;
             await this.persist(job);
@@ -82626,21 +82813,28 @@ var require_storage_orchestrator_addon = __commonJS({
           }
         }
       }
+      /**
+      * Start whatever is startable, honouring the ONE constraint the engines
+      * impose: each is single-flight.
+      *
+      * Two lanes — the recorder's footage engine and post-analysis's media engine
+      * — run in parallel with each other and strictly FIFO within themselves.
+      * `galleryMedia` shares the media lane with `eventMedia` because it shares
+      * the same `MediaRelocateEngine`, which refuses a second running job; starting
+      * both would fail the second one instantly.
+      */
       async startOrResumeMoves(job) {
         if (job.cancelRequested) return;
-        const mediaMove = job.moves.find((move) => move.storageClass === "eventMedia");
-        if (mediaMove?.moverJobId === null) {
-          mediaMove.moverJobId = await this.startMove(job, mediaMove);
-          await this.persist(job);
-        }
-        const footageMoves = job.moves.filter((move) => move.storageClass !== "eventMedia");
-        for (let index = 0; index < footageMoves.length; index++) {
-          const move = footageMoves[index];
-          if (move.moverJobId !== null) continue;
-          if (!footageMoves.slice(0, index).every((predecessor) => predecessor.state === "done")) return;
-          move.moverJobId = await this.startMove(job, move);
-          await this.persist(job);
-          return;
+        for (const lane of MOVE_LANES) {
+          const laneMoves = job.moves.filter((move) => laneOf(move.storageClass) === lane);
+          for (let index = 0; index < laneMoves.length; index++) {
+            const move = laneMoves[index];
+            if (move === void 0 || move.moverJobId !== null) continue;
+            if (!laneMoves.slice(0, index).every((predecessor) => predecessor.state === "done")) break;
+            move.moverJobId = await this.startMove(job, move);
+            await this.persist(job);
+            break;
+          }
         }
       }
       async waitForMoves(job) {
@@ -82651,7 +82845,7 @@ var require_storage_orchestrator_addon = __commonJS({
           let complete = true;
           for (const [index, move] of job.moves.entries()) {
             if (job.cancelRequested && move.moverJobId === null) continue;
-            if (move.storageClass !== "eventMedia" && job.moves.slice(0, index).filter((predecessor) => predecessor.storageClass !== "eventMedia").some((predecessor) => predecessor.state !== "done")) {
+            if (job.moves.slice(0, index).filter((predecessor) => laneOf(predecessor.storageClass) === laneOf(move.storageClass)).some((predecessor) => predecessor.state !== "done")) {
               complete = false;
               continue;
             }
@@ -82685,30 +82879,92 @@ var require_storage_orchestrator_addon = __commonJS({
           await sleep(pollMs);
         }
       }
+      /**
+      * Nail every unstamped `eventMedia`/retrain row to the location its bytes are
+      * ALREADY on, before anything repoints. Runs with every writer up — it moves
+      * no bytes at all.
+      *
+      * The gate is the RE-COUNT, not the seal job's terminal state: a seal that
+      * failed some rows still finishes, and "finished" is not "there are none
+      * left". A non-zero count here fails the job while nothing has been paused
+      * and nothing has been repointed, which is the cheapest possible place to
+      * discover it.
+      *
+      * The seal's own mover job id is deliberately NOT durable. It is idempotent
+      * and cheap, so a coordinator restart mid-seal simply re-runs the whole
+      * phase — and the count that follows is what actually decides, so a lost job
+      * id cannot make the gate pass.
+      */
+      async sealEventMedia(job) {
+        const move = job.moves.find((candidate) => candidate.storageClass === "eventMedia");
+        if (move === void 0) return;
+        if ((await this.deps.participants.analytics.countUnstamped()).total > 0) {
+          const started = await this.deps.participants.analytics.startDrain({
+            toLocationId: move.fromLocationId,
+            mode: "seal"
+          });
+          await this.waitForSeal(job, started.jobId);
+          if (job.cancelRequested) return;
+        }
+        const after = await this.deps.participants.analytics.countUnstamped();
+        if (after.total > 0) throw new Error(`event-media seal left ${after.total.toString()} row(s) without a locationId (${after.media.toString()} media, ${after.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
+      }
+      async waitForSeal(job, moverJobId) {
+        const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        const pollMs = this.deps.pollMs ?? 250;
+        for (; ; ) {
+          if (job.cancelRequested) {
+            await this.deps.participants.analytics.cancelMove(moverJobId);
+            return;
+          }
+          const status = await this.deps.participants.analytics.getMove(moverJobId);
+          if (status === null || status.state === "done" || status.state === "cancelled") return;
+          if (status.state === "failed") throw new Error(status.error ?? "event-media seal failed");
+          await sleep(pollMs);
+        }
+      }
       async verifyMoves(job) {
         for (const move of job.moves) if (move.state !== "done") throw new Error(`${move.storageClass} move did not complete verification`);
       }
+      /**
+      * Arm one class's mover.
+      *
+      * `draining` runs after every writer has been resumed, so there is no lease
+      * left to present — it goes through the participants' UNLEASED entry points
+      * (`recording.relocateFootage` / `pipelineAnalytics.relocateMedia`), which
+      * are the same engines, not a second mover.
+      */
       async startMove(job, move) {
-        if (move.storageClass === "eventMedia") return (await this.deps.participants.analytics.startMove({
-          toLocationId: move.toLocationId,
-          throttleMbps: job.throttleMbps,
-          leaseId: requireLease(job)
-        })).jobId;
-        return (await this.deps.participants.recorder.startMove({
+        const unleased = runsUnleased(job);
+        if (laneOf(move.storageClass) === "media") {
+          const input2 = {
+            toLocationId: move.toLocationId,
+            throttleMbps: job.throttleMbps,
+            mode: move.storageClass === "galleryMedia" ? "gallery" : "move"
+          };
+          return (unleased ? await this.deps.participants.analytics.startDrain(input2) : await this.deps.participants.analytics.startMove({
+            ...input2,
+            leaseId: requireLease(job)
+          })).jobId;
+        }
+        const input = {
           fromLocationId: move.fromLocationId,
           toLocationId: move.toLocationId,
-          footageClass: move.storageClass,
-          throttleMbps: job.throttleMbps,
+          footageClass: move.storageClass === "recordingsLow" ? "recordingsLow" : "recordings",
+          throttleMbps: job.throttleMbps
+        };
+        return (unleased ? await this.deps.participants.recorder.startDrain(input) : await this.deps.participants.recorder.startMove({
+          ...input,
           leaseId: requireLease(job)
         })).jobId;
       }
       async moveStatus(move) {
         if (move.moverJobId === null) return null;
-        return move.storageClass === "eventMedia" ? this.deps.participants.analytics.getMove(move.moverJobId) : this.deps.participants.recorder.getMove(move.moverJobId);
+        return laneOf(move.storageClass) === "media" ? this.deps.participants.analytics.getMove(move.moverJobId) : this.deps.participants.recorder.getMove(move.moverJobId);
       }
       async cancelMove(move) {
         if (move.moverJobId === null) return;
-        if (move.storageClass === "eventMedia") await this.deps.participants.analytics.cancelMove(move.moverJobId);
+        if (laneOf(move.storageClass) === "media") await this.deps.participants.analytics.cancelMove(move.moverJobId);
         else await this.deps.participants.recorder.cancelMove(move.moverJobId);
       }
       participant(name) {
@@ -82737,6 +82993,13 @@ var require_storage_orchestrator_addon = __commonJS({
     function isTerminal(job) {
       return job.phase === "done" || job.phase === "failed" || job.phase === "cancelled";
     }
+    function laneOf(storageClass) {
+      return storageClass === "eventMedia" || storageClass === "galleryMedia" ? "media" : "footage";
+    }
+    function runsUnleased(job) {
+      if (job.phase === "sealing" || job.phase === "draining") return true;
+      return job.phase === "verifying" && job.mode === "nonBlocking";
+    }
     function buildStorageLocationRegistry(perAddon) {
       const map = /* @__PURE__ */ new Map();
       for (const addonDeclarations of perAddon) for (const declaration of addonDeclarations) {
@@ -82842,6 +83105,14 @@ var require_storage_orchestrator_addon = __commonJS({
       * early-boot path that predates the resolver wiring.
       */
       nodeLocalResolver = null;
+      /**
+      * Injected occupancy probe (see {@link LocationOccupancyProbe}). `null` until
+      * {@link setOccupancyProbe} runs, and a `null` probe answers `unknown` — so a
+      * service with no probe REFUSES an unforced delete rather than performing one
+      * it could not check. The check is the point; a check that defaults to
+      * "permit" is a paragraph, not a guard.
+      */
+      occupancyProbe = null;
       /** `localNodeId` with any forked-child `/addon` suffix stripped. */
       localNode;
       /**
@@ -82941,6 +83212,15 @@ var require_storage_orchestrator_addon = __commonJS({
         this.nodeLocalResolver = resolver;
       }
       /**
+      * Inject the "does this location still hold anything" probe read by
+      * {@link deleteLocation}. Absent → every delete sees `unknown` and therefore
+      * REFUSES without `force`, which is the safe direction for a service wired
+      * without one.
+      */
+      setOccupancyProbe(probe) {
+        this.occupancyProbe = probe;
+      }
+      /**
       * The full set of addon-declared storage locations, as aggregated by
       * the kernel and injected via {@link setRegistry}. Powers the admin-UI
       * Data screen's per-declaration grouping. Empty until the registry is
@@ -83164,13 +83444,22 @@ var require_storage_orchestrator_addon = __commonJS({
       * Persistence (Task 6) mirrors the delete asynchronously, with errors
       * routed to the logger — see `upsertLocation` for the rationale.
       */
-      deleteLocation(id) {
+      async deleteLocation(id, options) {
         const loc = this.locations.get(id);
         if (!loc) throw new Error(`Storage location "${id}" not found`);
         if (loc.isSystem) throw new Error(`Storage location "${id}" is system-managed and cannot be deleted. Edit its config (path / providerId) instead.`);
         if (loc.isDefault) {
           if (![...this.locations.values()].find((l) => l.type === loc.type && l.id !== id && l.isDefault)) throw new Error(`Cannot delete default location "${id}" for type "${loc.type}" \u2014 promote another location to default first`);
         }
+        const occupancy = await this.probeOccupancy(loc);
+        if (occupancy !== "empty") {
+          if (options?.force !== true) throw new Error(occupancy === "occupied" ? `Storage location "${id}" still holds data \u2014 drain it first (storage migration / relocate), or pass force to delete the record anyway and strand what is on it` : `Storage location "${id}" could not be checked for remaining data (unreachable provider, another node, or an unmounted root) \u2014 pass force to delete the record anyway`);
+          this.logger.warn("storage-orchestrator: FORCED delete of a location that was not verified empty", { meta: {
+            id,
+            type: loc.type,
+            occupancy
+          } });
+        }
         this.locations.delete(id);
         if (this.locationStore) this.locationStore.delete(id).catch((err) => {
           this.logger.error("storage-orchestrator: delete persistence failed", { meta: {
@@ -83180,6 +83469,23 @@ var require_storage_orchestrator_addon = __commonJS({
         });
       }
       /**
+      * Run the injected occupancy probe, converting "no probe" and "the probe
+      * threw" into `unknown` rather than into a permit.
+      */
+      async probeOccupancy(location) {
+        const probe = this.occupancyProbe;
+        if (probe === null) return "unknown";
+        try {
+          return await probe(location);
+        } catch (err) {
+          this.logger.warn("storage-orchestrator: occupancy probe failed", { meta: {
+            id: location.id,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+          return "unknown";
+        }
+      }
+      /**
       * Remove system-seeded locations whose type is no longer declared by any
       * addon (stale defaults from a removed location type). Operator-added
       * (non-system) locations of an undeclared type are KEPT but warned — the
@@ -83575,6 +83881,7 @@ var require_storage_orchestrator_addon = __commonJS({
         });
         this.service = service;
         service.setNodeLocalResolver((providerId) => this.nodeLocalByProvider.get(providerId));
+        service.setOccupancyProbe((location) => this.locationOccupancy(location));
         await service.initialize();
         const provider = {
           listLocations: async ({ type }) => {
@@ -83587,8 +83894,8 @@ var require_storage_orchestrator_addon = __commonJS({
           getDefaultLocation: async ({ type }) => service.getDefaultLocation(type),
           listLocationDeclarations: async () => service.listDeclarations(),
           upsertLocation: async (input) => service.upsertLocation(input),
-          deleteLocation: async ({ id }) => {
-            service.deleteLocation(id);
+          deleteLocation: async ({ id, force }) => {
+            await service.deleteLocation(id, { force: force === true });
           },
           testLocation: async ({ id }) => {
             const loc = service.getLocationById(id);
@@ -83751,6 +84058,7 @@ var require_storage_orchestrator_addon = __commonJS({
                 await this.ctx.api.recording.resumeForStorageMigration.mutate({ leaseId });
               },
               startMove: (input) => this.ctx.api.recording.startStorageMigrationMove.mutate(input),
+              startDrain: (input) => this.ctx.api.recording.relocateFootage.mutate(input),
               getMove: (jobId) => this.ctx.api.recording.getStorageMigrationMoveStatus.query({ jobId }),
               cancelMove: async (jobId) => (await this.ctx.api.recording.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
@@ -83765,6 +84073,8 @@ var require_storage_orchestrator_addon = __commonJS({
                 await this.ctx.api.pipelineAnalytics.resumeForStorageMigration.mutate({ leaseId });
               },
               startMove: (input) => this.ctx.api.pipelineAnalytics.startStorageMigrationMove.mutate(input),
+              startDrain: (input) => this.ctx.api.pipelineAnalytics.relocateMedia.mutate(input),
+              countUnstamped: () => this.ctx.api.pipelineAnalytics.countUnstampedEventMedia.query({}),
               getMove: (jobId) => this.ctx.api.pipelineAnalytics.getStorageMigrationMoveStatus.query({ jobId }),
               cancelMove: async (jobId) => (await this.ctx.api.pipelineAnalytics.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
@@ -83773,7 +84083,8 @@ var require_storage_orchestrator_addon = __commonJS({
             }
           },
           now: () => Date.now(),
-          newId: () => (0, node_crypto.randomUUID)()
+          newId: () => (0, node_crypto.randomUUID)(),
+          deviceKeyOf: (locationId) => this.locationDeviceKey(locationId)
         });
         this.migration = migration;
         const migrationProvider = {
@@ -83988,6 +84299,44 @@ var require_storage_orchestrator_addon = __commonJS({
           return node_path.resolve(bp);
         }
       }
+      /**
+      * Does this location still hold anything? A SHALLOW `readdir` of its
+      * `basePath` — one syscall, never a walk. `/recordings` holds one entry per
+      * camera, so this is cheap on a volume with millions of segments, and a
+      * `find`-style walk of a saturated recordings disk is precisely what must
+      * not happen here.
+      *
+      * **What it cannot see, stated rather than papered over:**
+      *
+      *  - A location on ANOTHER node, or behind a remote provider (S3 / SFTP /
+      *    WebDAV): its bytes are not on this filesystem and this probe answers
+      *    `unknown`, never `empty`.
+      *  - A location with no `basePath` — same answer.
+      *  - The difference between "holds live footage" and "holds one stray
+      *    lock-file". It measures BYTES ON DISK, not durable rows, so it refuses
+      *    a location holding orphan files that no index names. That direction is
+      *    the safe one, and `force` is the escape hatch for it.
+      *
+      * A missing root (`ENOENT`) is `empty`, not `unknown`: an unmounted disk and
+      * a deleted directory are indistinguishable here, and if the record's own
+      * path does not exist there is nothing this delete can strand. Every OTHER
+      * errno — `EACCES`, `EIO`, a stale NFS handle — is `unknown` and refuses.
+      */
+      async locationOccupancy(location) {
+        if ((location.nodeId === void 0 || location.nodeId === "" ? HUB_NODE_ID : location.nodeId) !== (this.service?.getLocalNodeId() ?? HUB_NODE_ID)) return "unknown";
+        const basePath = this.locationBasePath(location.id);
+        if (basePath === null) return "unknown";
+        try {
+          return (await node_fs_promises.readdir(basePath)).length > 0 ? "occupied" : "empty";
+        } catch (err) {
+          if (err instanceof Error && "code" in err && err.code === "ENOENT") return "empty";
+          this.ctx.logger.warn("storage-orchestrator: could not read a location root to check it", { meta: {
+            id: location.id,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+          return "unknown";
+        }
+      }
       /** Free capacity (%) on a location's volume via `statfs`; 100 (guard inert) when unstattable. */
       async locationFreePercent(locationId) {
         const bp = this.locationBasePath(locationId);
@@ -84095,7 +84444,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -102156,7 +102505,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -104099,9 +104448,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-DUxF5DdC.js
-var require_sleep_DUxF5DdC = __commonJS({
-  "../types/dist/sleep-DUxF5DdC.js"(exports) {
+// ../types/dist/sleep-CJrvRDlD.js
+var require_sleep_CJrvRDlD = __commonJS({
+  "../types/dist/sleep-CJrvRDlD.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -106801,6 +107150,7 @@ var require_sleep_DUxF5DdC = __commonJS({
           getStorageMigrationMoveStatus: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getStorageMigrationMoveStatus", "query", input),
           cancelStorageMigrationMove: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelStorageMigrationMove", "mutation", input),
           relocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "relocateMedia", "mutation", input),
+          countUnstampedEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "countUnstampedEventMedia", "query", input),
           listRelocateMediaJobs: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRelocateMediaJobs", "query", input),
           cancelRelocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelRelocateMedia", "mutation", input),
           listOpsLog: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listOpsLog", "query", input),
@@ -107765,7 +108115,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_DUxF5DdC();
+    var require_sleep = require_sleep_CJrvRDlD();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -114644,12 +114994,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-w48vOhGR.js
-var require_manifest_python_deps_w48vOhGR = __commonJS({
-  "../system/dist/manifest-python-deps-w48vOhGR.js"(exports) {
+// ../system/dist/manifest-python-deps-DVODn-qc.js
+var require_manifest_python_deps_DVODn_qc = __commonJS({
+  "../system/dist/manifest-python-deps-DVODn-qc.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_BPlfW_CG();
+    require_dist_CDgIzo82();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -126390,7 +126740,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_BPlfW_CG();
+    var require_dist10 = require_dist_CDgIzo82();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -126416,7 +126766,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_python_deps = require_manifest_python_deps_w48vOhGR();
+    var require_manifest_python_deps = require_manifest_python_deps_DVODn_qc();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -135078,20 +135428,63 @@ var require_dist3 = __commonJS({
         if (this.settingsStore === null) return;
         this.settingsStore.clearDeviceRuntimeState(deviceId);
       }
+      /**
+      * The addon's `ctx.settings`.
+      *
+      * The backend is chosen on EVERY call, never frozen when the view is built.
+      * That is not a nicety: `settings-store` is owned by `storage-orchestrator`,
+      * so the door is wired by `registerProvider` STRICTLY AFTER that addon's
+      * context — and therefore its settings view — already exists. A view bound at
+      * construction handed the door's own owner the sync-store backend, whose
+      * writes throw for the whole life of the process once `sqlite-settings` runs
+      * isolated (D181: no sync `ISettingsStore` reaches hub-main, only the async
+      * door). Reads were worse than the writes: they answered `{}` in silence.
+      * That is what made `storageMigration.start` fail on its first durable write
+      * while every other addon's persistence worked. See D294.
+      */
       createSettingsView(addonId) {
-        if (this.settingsStore === null && this.settingsDoor !== null) {
+        const storeBacked = this.createStoreSettingsView(addonId);
+        let doorBacked = null;
+        let doorBackedSource = null;
+        const active = () => {
+          if (this.settingsStore !== null) return storeBacked;
           const door = this.settingsDoor;
-          return createDoorSettingsView(addonId, door, {
-            getSection: (section) => this.getSection(section),
-            setSection: async (section, patch) => {
-              for (const [key, value] of Object.entries(patch)) await door.set({
-                collection: "system-settings",
-                key: `${section}.${key}`,
-                value
-              });
-            }
-          });
-        }
+          if (door === null) return storeBacked;
+          if (doorBacked === null || doorBackedSource !== door) {
+            doorBackedSource = door;
+            doorBacked = this.createDoorBackedSettingsView(addonId, door);
+          }
+          return doorBacked;
+        };
+        return {
+          readAddonStore: () => active().readAddonStore(),
+          writeAddonStore: (patch) => active().writeAddonStore(patch),
+          readDeviceStore: (deviceId) => active().readDeviceStore(deviceId),
+          readDeviceStoreBatch: (deviceIds) => active().readDeviceStoreBatch(deviceIds),
+          writeDeviceStore: (deviceId, patch) => active().writeDeviceStore(deviceId, patch),
+          clearDeviceStore: (deviceId) => active().clearDeviceStore(deviceId),
+          getSection: (section) => active().getSection(section),
+          setSection: (section, patch) => active().setSection(section, patch),
+          readDeviceRuntimeState: (deviceId) => active().readDeviceRuntimeState(deviceId),
+          writeDeviceRuntimeState: (deviceId, data) => active().writeDeviceRuntimeState(deviceId, data),
+          clearDeviceRuntimeState: (deviceId) => active().clearDeviceRuntimeState(deviceId)
+        };
+      }
+      /** The async-door backend of {@link createSettingsView}. */
+      createDoorBackedSettingsView(addonId, door) {
+        return createDoorSettingsView(addonId, door, {
+          getSection: (section) => this.getSection(section),
+          setSection: async (section, patch) => {
+            for (const [key, value] of Object.entries(patch)) await door.set({
+              collection: "system-settings",
+              key: `${section}.${key}`,
+              value
+            });
+          }
+        });
+      }
+      /** The sync-`ISettingsStore` backend of {@link createSettingsView}. */
+      createStoreSettingsView(addonId) {
         const cm = this;
         return {
           async readAddonStore() {
@@ -135107,6 +135500,15 @@ var require_dist3 = __commonJS({
           async readDeviceStore(deviceId) {
             return cm.getAddonDevice(addonId, String(deviceId));
           },
+          async readDeviceStoreBatch(deviceIds) {
+            const out = /* @__PURE__ */ new Map();
+            for (const deviceId of deviceIds) try {
+              out.set(deviceId, cm.getAddonDevice(addonId, String(deviceId)));
+            } catch {
+              out.set(deviceId, {});
+            }
+            return out;
+          },
           async writeDeviceStore(deviceId, patch) {
             const key = String(deviceId);
             const existing = cm.getAddonDevice(addonId, key);
@@ -207165,7 +207567,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_DUxF5DdC();
+    var require_sleep = require_sleep_CJrvRDlD();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -208486,29 +208888,50 @@ var require_dist4 = __commonJS({
     });
     var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
     var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
+    var MediaRelocateModeSchema = zod.z.enum([
+      "move",
+      "seal",
+      "gallery"
+    ]);
     var RelocateMediaInputSchema = zod.z.object({
       toLocationId: zod.z.string(),
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `move`, the pre-existing behaviour. */
+      mode: MediaRelocateModeSchema.optional()
+    });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: zod.z.number().int().nonnegative(),
+      retrainFrames: zod.z.number().int().nonnegative(),
+      total: zod.z.number().int().nonnegative()
     });
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
       "recordingsLow",
-      "eventMedia"
+      "eventMedia",
+      "backups",
+      "galleryMedia"
     ]);
     var StorageMigrationDestinationsSchema = zod.z.object({
       recordings: zod.z.string().min(1).optional(),
       recordingsLow: zod.z.string().min(1).optional(),
-      eventMedia: zod.z.string().min(1).optional()
+      eventMedia: zod.z.string().min(1).optional(),
+      backups: zod.z.string().min(1).optional(),
+      galleryMedia: zod.z.string().min(1).optional()
     }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+    var StorageMigrationModeSchema = zod.z.enum(["blocking", "nonBlocking"]);
     var StorageMigrationInputSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Omitted = `blocking`, which stays the default. */
+      mode: StorageMigrationModeSchema.optional()
     });
     var StorageMigrationPhaseSchema = zod.z.enum([
       "planning",
+      "sealing",
       "pausing",
       "moving",
+      "draining",
       "verifying",
       "repointing",
       "refreshing",
@@ -208533,6 +208956,9 @@ var require_dist4 = __commonJS({
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
       phase: StorageMigrationPhaseSchema,
+      /** Which order this job is running. `status` is the only place an operator
+      *  can tell a seconds-long cutover from a thirty-hour one. */
+      mode: StorageMigrationModeSchema,
       destinations: StorageMigrationDestinationsSchema,
       throttleMbps: zod.z.number(),
       moves: zod.z.array(StorageMigrationMoveSchema),
@@ -208545,13 +208971,31 @@ var require_dist4 = __commonJS({
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
     });
+    var StorageMigrationFindingCodeSchema = zod.z.enum([
+      "sharesDeviceWithSource",
+      "deviceIdentityUnknown",
+      "unstampedEventMediaRows",
+      "blockingOnly",
+      "noMover"
+    ]);
+    var StorageMigrationFindingSchema = zod.z.object({
+      code: StorageMigrationFindingCodeSchema,
+      storageClass: StorageMigrationClassSchema,
+      /** Human-readable, already carrying the ids and counts. */
+      message: zod.z.string()
+    });
     var StorageMigrationPlanSchema = zod.z.object({
       destinations: StorageMigrationDestinationsSchema,
+      /** The mode this plan was built for. A plan is only valid for its mode: the
+      *  `eventMedia` seal gate and the single-cardinality refusal both depend on
+      *  it. */
+      mode: StorageMigrationModeSchema,
       moves: zod.z.array(zod.z.object({
         storageClass: StorageMigrationClassSchema,
         fromLocationId: zod.z.string(),
         toLocationId: zod.z.string()
-      }))
+      })),
+      findings: zod.z.array(StorageMigrationFindingSchema)
     });
     var SUB_DETECTION_TYPES = ["face", "plate"];
     var RECOGNITION_TYPES = [
@@ -221527,6 +221971,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
+        /**
+        * How many media / retrain rows still carry NO `locationId`.
+        *
+        * A NULL row means "wherever `eventMedia` points NOW", so the instant a
+        * repoint moves that pointer every such row reads from the new disk while
+        * its bytes are on the old one — the archive goes dark until a drain
+        * happens to stamp it. This count is what the migration planner's
+        * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+        * it to zero.
+        */
+        countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: require_sleep.method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -224143,7 +224598,24 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "mutation",
           auth: "admin"
         }),
-        deleteLocation: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+        /**
+        * Remove a location record. REFUSES a location that still holds data —
+        * deleting a drained location whose durable rows still name it is how this
+        * hub acquired 2 131 ghost `recordings:high` segments, and playback does
+        * not stat, so the operator sees a silent black window rather than an
+        * error.
+        *
+        * `force` exists because the occupancy check is BEST-EFFORT and refuses on
+        * "unknown" as well as on "occupied" (a read that fails must not authorise
+        * a destruction — D49). A location on a removed disk, on another node, or
+        * behind a remote provider answers "unknown" forever, and a refusal an
+        * operator cannot override is its own failure mode. `force: true` is
+        * logged, loudly, with what the check saw.
+        */
+        deleteLocation: require_sleep.method(zod.z.object({
+          id: zod.z.string(),
+          force: zod.z.boolean().optional()
+        }), zod.z.void(), {
           kind: "mutation",
           auth: "admin"
         }),
@@ -240182,6 +240654,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countUnstampedEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.deleteDeviceEvents": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -249205,6 +249683,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
     exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
     exports.MediaPlayerStatusSchema = MediaPlayerStatusSchema;
+    exports.MediaRelocateModeSchema = MediaRelocateModeSchema;
     exports.MeshPeerSchema = MeshPeerSchema;
     exports.MeshStatusSchema = MeshStatusSchema;
     exports.MethodAccessSchema = MethodAccessSchema;
@@ -249582,11 +250061,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
     exports.StorageMigrationClassSchema = StorageMigrationClassSchema;
     exports.StorageMigrationDestinationsSchema = StorageMigrationDestinationsSchema;
+    exports.StorageMigrationFindingCodeSchema = StorageMigrationFindingCodeSchema;
+    exports.StorageMigrationFindingSchema = StorageMigrationFindingSchema;
     exports.StorageMigrationFootageMoveInputSchema = StorageMigrationFootageMoveInputSchema;
     exports.StorageMigrationInputSchema = StorageMigrationInputSchema;
     exports.StorageMigrationJobSchema = StorageMigrationJobSchema;
     exports.StorageMigrationLeaseInputSchema = StorageMigrationLeaseInputSchema;
     exports.StorageMigrationMediaMoveInputSchema = StorageMigrationMediaMoveInputSchema;
+    exports.StorageMigrationModeSchema = StorageMigrationModeSchema;
     exports.StorageMigrationMoveSchema = StorageMigrationMoveSchema;
     exports.StorageMigrationParticipantSchema = StorageMigrationParticipantSchema;
     exports.StorageMigrationPhaseSchema = StorageMigrationPhaseSchema;
@@ -249662,6 +250144,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.UNIT_TABLE = UNIT_TABLE;
     exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
     exports.UnitConversionError = UnitConversionError;
+    exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
     exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
     exports.UpdateStatusSchema = UpdateStatusSchema;
     exports.UpdateUserInputSchema = UpdateUserInputSchema;