rigscope 0.1.8 → 0.2.1

package/dist/system.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/cli/system.ts
@@ -86,23 +96,23 @@ __export(system_exports, {
   verifySystemHealth: () => verifySystemHealth
 });
 module.exports = __toCommonJS(system_exports);
-var import_node_fs3 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var import_node_child_process = require("node:child_process");
-var import_node_crypto5 = require("node:crypto");
-var import_node_path4 = require("node:path");
-var import_node_sqlite = require("node:sqlite");
+var import_node_crypto7 = require("node:crypto");
+var import_node_path6 = require("node:path");
+var import_node_sqlite3 = require("node:sqlite");
 var import_node_util = require("node:util");
 
 // src/cli/health.ts
 var import_node_http = require("node:http");
 var MAX_HEALTH_BODY_BYTES = 64 * 1024;
 function probeHealth(target, timeoutMs = 3e3) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let settled = false;
     const finish = (result) => {
       if (settled) return;
       settled = true;
-      resolve4(result);
+      resolve5(result);
     };
     const options = target.kind === "unix" ? { socketPath: target.socketPath, path: target.path, method: "GET", headers: { Host: target.hostHeader } } : { host: target.host, port: target.port, path: target.path, method: "GET" };
     let req;
@@ -185,7 +195,7 @@ function bounded(value, min, max) {
   return Math.min(max, Math.max(min, Number.isFinite(value) ? value : min));
 }
 function delay(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function errorText(error) {
   return error instanceof Error ? error.message : String(error);
@@ -377,6 +387,9 @@ var SHARING_KEYS = [
   "processArguments"
 ];
 
+// collector/destinations/queue.ts
+var DEFAULT_COLLECTOR_QUEUE_MODE = "memory";
+
 // collector/config.ts
 var ConfigError = class extends Error {
   issues;
@@ -582,6 +595,18 @@ function parseDestinations(env, issues, destinations) {
     }
   }
 }
+var QUEUE_MODES = ["memory", "durable"];
+function parseQueueMode(env, issues) {
+  const raw = env["COLLECTOR_QUEUE_MODE"]?.trim();
+  if (raw === void 0 || raw === "") {
+    return DEFAULT_COLLECTOR_QUEUE_MODE;
+  }
+  if (!QUEUE_MODES.includes(raw)) {
+    issues.push(`COLLECTOR_QUEUE_MODE must be one of ${QUEUE_MODES.join(" or ")}`);
+    return DEFAULT_COLLECTOR_QUEUE_MODE;
+  }
+  return raw;
+}
 function parseIntervalMs(env, issues) {
   const raw = env["COLLECTOR_INTERVAL_MS"]?.trim();
   if (raw === void 0 || raw === "") {
@@ -612,6 +637,7 @@ function parseCollectorConfig(env) {
   }
   const destinations = [];
   const intervalMs = parseIntervalMs(env, issues);
+  const queueMode = parseQueueMode(env, issues);
   parseDestinations(env, issues, destinations);
   if (issues.length > 0) {
     throw new ConfigError(issues);
@@ -621,7 +647,8 @@ function parseCollectorConfig(env) {
     hostname,
     hostnameIsMockDefault: rawHostname === "",
     intervalMs,
-    destinations
+    destinations,
+    queueMode
   };
 }
 
@@ -789,6 +816,13 @@ async function enrollCollector(path, connectUrl, enrollmentToken, sharing, repla
 // src/hub/config.ts
 var import_node_net = require("node:net");
 var import_node_path3 = require("node:path");
+
+// src/contracts/telemetry.ts
+var MAX_PERSISTENT_FLUSH_MS = 5e3;
+var MIN_EPOCH = Date.parse("2000-01-01T00:00:00Z");
+var MAX_EPOCH = Date.parse("2200-01-01T00:00:00Z");
+
+// src/hub/config.ts
 var MAX_HUB_COLLECTORS_BYTES = 1024 * 1024;
 var MAX_COLLECTOR_ID_LENGTH = 128;
 var MAX_MACHINE_ID_LENGTH = 128;
@@ -816,6 +850,7 @@ function parseHubConfig(env) {
     maxCollectorConnections = parsed;
   }
   const connectionBudget = maxCollectorConnections === void 0 ? {} : { maxCollectorConnections };
+  const history = parseHistoryConfig(env);
   if (publicOrigin === void 0 !== (socketPath === void 0)) {
     throw new HubConfigError(
       "HUB_PUBLIC_ORIGIN and HUB_SOCKET_PATH must be set together: remote mode needs both the exact HTTPS origin and the Unix socket path"
@@ -835,6 +870,7 @@ function parseHubConfig(env) {
       collectors,
       development,
       remote: parseRemoteConfig(publicOrigin, socketPath),
+      history,
       ...connectionBudget
     };
   }
@@ -844,9 +880,65 @@ function parseHubConfig(env) {
     collectors,
     development,
     remote: null,
+    history,
     ...connectionBudget
   };
 }
+var DEFAULT_MEMORY_BUDGET_BYTES = 128 * 1024 * 1024;
+var DEFAULT_PERSISTENT_FLUSH_MS = MAX_PERSISTENT_FLUSH_MS;
+var DEFAULT_RECORDING_MAX_DURATION_MS = 60 * 6e4;
+var DEFAULT_RECORDING_MAX_BYTES = 64 * 1024 * 1024;
+var DEFAULT_RECORDING_BACKLOG_MS = 10 * 6e4;
+var DEFAULT_MAX_ACTIVE_RECORDINGS = 4;
+var HOUR_MS = 36e5;
+var DAY_MS = 864e5;
+function parseHistoryConfig(env) {
+  const modeValue = env.HUB_TELEMETRY_MODE ?? "memory";
+  if (modeValue !== "memory" && modeValue !== "persistent") {
+    throw new HubConfigError("HUB_TELEMETRY_MODE must be memory or persistent");
+  }
+  const memoryBudgetBytes = envInteger(
+    env.HUB_HISTORY_MEMORY_BYTES,
+    DEFAULT_MEMORY_BUDGET_BYTES,
+    1 * 1024 * 1024,
+    16 * 1024 * 1024 * 1024,
+    "HUB_HISTORY_MEMORY_BYTES"
+  );
+  const flushIntervalMs = envInteger(
+    env.HUB_TELEMETRY_FLUSH_MS,
+    DEFAULT_PERSISTENT_FLUSH_MS,
+    1e3,
+    MAX_PERSISTENT_FLUSH_MS,
+    "HUB_TELEMETRY_FLUSH_MS"
+  );
+  const retention = {
+    rawMs: envInteger(env.HUB_RETENTION_RAW_MS, 2 * DAY_MS, 0, 400 * DAY_MS, "HUB_RETENTION_RAW_MS"),
+    tenSecondMs: envInteger(env.HUB_RETENTION_10S_MS, 2 * HOUR_MS, 0, 30 * DAY_MS, "HUB_RETENTION_10S_MS"),
+    oneMinuteMs: envInteger(env.HUB_RETENTION_1M_MS, 30 * DAY_MS, 0, 400 * DAY_MS, "HUB_RETENTION_1M_MS"),
+    oneHourMs: envInteger(env.HUB_RETENTION_1H_MS, 400 * DAY_MS, 0, 800 * DAY_MS, "HUB_RETENTION_1H_MS"),
+    receiptsMs: envInteger(env.HUB_RECEIPT_RETENTION_MS, 7 * DAY_MS, HOUR_MS, 400 * DAY_MS, "HUB_RECEIPT_RETENTION_MS"),
+    gapsMs: envInteger(env.HUB_GAP_RETENTION_MS, 400 * DAY_MS, 0, 800 * DAY_MS, "HUB_GAP_RETENTION_MS")
+  };
+  const recordings = {
+    directory: nonEmpty(env.HUB_RECORDINGS_DIR) ?? null,
+    maxDurationMs: envInteger(env.HUB_RECORDING_MAX_DURATION_MS, DEFAULT_RECORDING_MAX_DURATION_MS, 1e3, 24 * 60 * 6e4, "HUB_RECORDING_MAX_DURATION_MS"),
+    maxBytes: envInteger(env.HUB_RECORDING_MAX_BYTES, DEFAULT_RECORDING_MAX_BYTES, 64 * 1024, 1024 * 1024 * 1024, "HUB_RECORDING_MAX_BYTES"),
+    backlogMs: envInteger(env.HUB_RECORDING_BACKLOG_MS, DEFAULT_RECORDING_BACKLOG_MS, 0, 24 * 60 * 6e4, "HUB_RECORDING_BACKLOG_MS"),
+    maxActive: envInteger(env.HUB_RECORDING_MAX_ACTIVE, DEFAULT_MAX_ACTIVE_RECORDINGS, 1, 32, "HUB_RECORDING_MAX_ACTIVE")
+  };
+  return { mode: modeValue, memoryBudgetBytes, flushIntervalMs, retention, recordings };
+}
+function envInteger(raw, fallback, min, max, name) {
+  if (raw === void 0 || raw === "") return fallback;
+  if (!/^\d+$/.test(raw)) {
+    throw new HubConfigError(`${name} must be a nonnegative integer`);
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < min || value > max) {
+    throw new HubConfigError(`${name} must be between ${min} and ${max}`);
+  }
+  return value;
+}
 function nonEmpty(value) {
   return value === void 0 || value === "" ? void 0 : value;
 }
@@ -1020,6 +1112,851 @@ function boundedString(value, field, message, maxLength) {
   return value;
 }
 
+// src/cli/machine-transition.ts
+var import_node_fs5 = require("node:fs");
+var import_node_path5 = require("node:path");
+var import_node_crypto6 = require("node:crypto");
+
+// src/operations/database.ts
+var import_node_fs4 = require("node:fs");
+var import_node_sqlite2 = require("node:sqlite");
+var sqlite2 = __toESM(require("node:sqlite"));
+
+// src/hub/storage/db.ts
+var import_node_sqlite = require("node:sqlite");
+var sqlite = __toESM(require("node:sqlite"));
+
+// src/hub/auth/sessions.ts
+var DEFAULT_SESSION_TTL_MS = 12 * 60 * 60 * 1e3;
+
+// src/hub/admin/store.ts
+var MAX_SCOPE_BYTES = 16 * 1024;
+function adminSchema(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS users (
+      username TEXT PRIMARY KEY,
+      password_hash TEXT NOT NULL,
+      scope_json TEXT NOT NULL,
+      is_admin INTEGER NOT NULL DEFAULT 0,
+      disabled INTEGER NOT NULL DEFAULT 0
+    );
+
+    CREATE TABLE IF NOT EXISTS admin_audit (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      actor TEXT NOT NULL,
+      action TEXT NOT NULL,
+      target TEXT NOT NULL,
+      at_ms INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS admin_meta (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS admin_audit_at ON admin_audit (at_ms DESC);
+  `);
+}
+
+// src/hub/alerts/schema.ts
+function installAlertSchema(db) {
+  db.exec(`
+    -- Rules are durable. Per-rule pending/incident state lives here so a
+    -- restart can continue a duration or avoid opening a duplicate incident.
+    CREATE TABLE IF NOT EXISTS alert_rules (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      machine_id TEXT NOT NULL,
+      metric TEXT NOT NULL,
+      resource_id TEXT NOT NULL DEFAULT '',
+      condition TEXT NOT NULL,
+      threshold REAL,
+      duration_ms INTEGER NOT NULL DEFAULT 0,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      maintenance_until_ms INTEGER,
+      state TEXT NOT NULL DEFAULT 'ok',
+      pending_since_ms INTEGER,
+      active_incident_id TEXT,
+      last_value REAL,
+      last_observed_at_ms INTEGER,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS alert_rules_machine
+      ON alert_rules (machine_id);
+
+    -- Incident history is bounded by the engine, but never loses an open row.
+    CREATE TABLE IF NOT EXISTS alert_incidents (
+      id TEXT PRIMARY KEY,
+      rule_id TEXT NOT NULL,
+      rule_name TEXT NOT NULL,
+      machine_id TEXT NOT NULL,
+      metric TEXT NOT NULL,
+      resource_id TEXT NOT NULL DEFAULT '',
+      condition TEXT NOT NULL,
+      status TEXT NOT NULL,
+      started_at_ms INTEGER NOT NULL,
+      resolved_at_ms INTEGER,
+      started_value REAL,
+      resolved_value REAL,
+      last_observed_at_ms INTEGER NOT NULL,
+      message TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS alert_incidents_started
+      ON alert_incidents (started_at_ms DESC);
+    CREATE INDEX IF NOT EXISTS alert_incidents_machine_started
+      ON alert_incidents (machine_id, started_at_ms DESC);
+    CREATE INDEX IF NOT EXISTS alert_incidents_rule_status
+      ON alert_incidents (rule_id, status);
+    CREATE UNIQUE INDEX IF NOT EXISTS alert_incidents_one_open
+      ON alert_incidents (rule_id) WHERE status = 'open';
+
+    -- One durable job per logical incident event. The primary key is the
+    -- deterministic idempotency key sent to the webhook receiver.
+    CREATE TABLE IF NOT EXISTS alert_jobs (
+      id TEXT PRIMARY KEY,
+      rule_id TEXT NOT NULL,
+      incident_id TEXT NOT NULL,
+      machine_id TEXT NOT NULL,
+      event TEXT NOT NULL,
+      status TEXT NOT NULL,
+      attempts INTEGER NOT NULL DEFAULT 0,
+      max_attempts INTEGER NOT NULL DEFAULT 6,
+      next_attempt_ms INTEGER,
+      last_attempt_ms INTEGER,
+      last_error TEXT,
+      created_at_ms INTEGER NOT NULL,
+      delivered_at_ms INTEGER,
+      payload_json TEXT NOT NULL,
+      UNIQUE (incident_id, event)
+    );
+
+    CREATE INDEX IF NOT EXISTS alert_jobs_due
+      ON alert_jobs (status, next_attempt_ms);
+    CREATE INDEX IF NOT EXISTS alert_jobs_created
+      ON alert_jobs (created_at_ms DESC);
+
+    -- Exactly one webhook channel. URL, headers and optional HMAC secret are
+    -- private database state and are never returned by the browser API.
+    CREATE TABLE IF NOT EXISTS alert_webhook (
+      id INTEGER PRIMARY KEY CHECK (id = 1),
+      url TEXT NOT NULL,
+      headers_json TEXT NOT NULL DEFAULT '{}',
+      secret TEXT,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      updated_at_ms INTEGER NOT NULL,
+      last_test_at_ms INTEGER,
+      last_test_ok INTEGER,
+      last_error TEXT
+    );
+
+    -- Last LIVE record accepted by the engine. Used to ignore duplicate or
+    -- older records after restart; replay never calls observe.
+    CREATE TABLE IF NOT EXISTS alert_machine_progress (
+      machine_id TEXT PRIMARY KEY,
+      collector_id TEXT NOT NULL,
+      run_id TEXT NOT NULL,
+      seq INTEGER NOT NULL,
+      received_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL
+    );
+
+    -- Resources this rule has actually observed. A resource missing from an
+    -- otherwise-ok family after being seen is unavailable, not a silent
+    -- recovery to "normal".
+    CREATE TABLE IF NOT EXISTS alert_observed_resources (
+      rule_id TEXT NOT NULL,
+      metric TEXT NOT NULL,
+      resource_id TEXT NOT NULL,
+      first_seen_ms INTEGER NOT NULL,
+      last_seen_ms INTEGER NOT NULL,
+      PRIMARY KEY (rule_id, metric, resource_id)
+    );
+  `);
+}
+
+// src/hub/enrollment/registry.ts
+function installRegistrySchema(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS collector_registry (
+      collector_id TEXT PRIMARY KEY, machine_id TEXT NOT NULL UNIQUE, token TEXT NOT NULL UNIQUE,
+      revoked INTEGER NOT NULL DEFAULT 0, created_at_ms INTEGER NOT NULL, updated_at_ms INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS collector_registry_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS collector_grants (
+      token_hash TEXT PRIMARY KEY, expires_at_ms INTEGER NOT NULL, replace_machine_id TEXT,
+      consumed_by TEXT, request_id TEXT, recovery_hash TEXT, recovery_until_ms INTEGER, actor TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS collector_audit (
+      id INTEGER PRIMARY KEY, at_ms INTEGER NOT NULL, actor TEXT NOT NULL, action TEXT NOT NULL, target TEXT NOT NULL
+    );
+  `);
+}
+
+// src/hub/storage/migrations.ts
+var MIGRATIONS = [
+  {
+    version: 1,
+    name: "telemetry",
+    up(db) {
+      db.exec(`
+        -- Hub-local machine presentation metadata; never required for ingest.
+        CREATE TABLE machine_meta (
+          machine_id TEXT PRIMARY KEY,
+          display_name TEXT,
+          tags_json TEXT NOT NULL DEFAULT '[]',
+          updated_at_ms INTEGER NOT NULL
+        );
+
+        -- Integer series catalog. resource_id is '' for single-resource
+        -- families and e.g. "core:3", a GPU/filesystem/disk/interface id for
+        -- per-resource families.
+        CREATE TABLE series (
+          series_id INTEGER PRIMARY KEY,
+          machine_id TEXT NOT NULL,
+          metric TEXT NOT NULL,
+          resource_id TEXT NOT NULL DEFAULT '',
+          UNIQUE (machine_id, metric, resource_id)
+        );
+
+        -- Raw samples. WITHOUT ROWID makes (series_id, ts_ms) the clustered
+        -- primary key, so a history range read is one index range scan.
+        -- A NULL value is an explicit unavailable reading, never zero.
+        CREATE TABLE points_raw (
+          series_id INTEGER NOT NULL,
+          ts_ms INTEGER NOT NULL,
+          value REAL,
+          PRIMARY KEY (series_id, ts_ms)
+        ) WITHOUT ROWID;
+
+        -- One-minute rollups, maintained on insert (including late/replayed
+        -- data): min/max preserved, count of non-NULL values, null_count of
+        -- explicit unavailable readings. sum is 0 for a null-only bucket and
+        -- is only interpreted together with count.
+        CREATE TABLE points_1m (
+          series_id INTEGER NOT NULL,
+          bucket_ms INTEGER NOT NULL,
+          min REAL,
+          max REAL,
+          sum REAL NOT NULL DEFAULT 0,
+          count INTEGER NOT NULL DEFAULT 0,
+          null_count INTEGER NOT NULL DEFAULT 0,
+          PRIMARY KEY (series_id, bucket_ms)
+        ) WITHOUT ROWID;
+
+        CREATE TABLE points_1h (
+          series_id INTEGER NOT NULL,
+          bucket_ms INTEGER NOT NULL,
+          min REAL,
+          max REAL,
+          sum REAL NOT NULL DEFAULT 0,
+          count INTEGER NOT NULL DEFAULT 0,
+          null_count INTEGER NOT NULL DEFAULT 0,
+          PRIMARY KEY (series_id, bucket_ms)
+        ) WITHOUT ROWID;
+
+        -- Durable receipt / dedup key. Every accepted record kind has a row
+        -- here before its side effects are committed.
+        CREATE TABLE sample_receipts (
+          collector_id TEXT NOT NULL,
+          run_id TEXT NOT NULL,
+          seq INTEGER NOT NULL,
+          machine_id TEXT NOT NULL,
+          kind TEXT NOT NULL,
+          mode TEXT NOT NULL,
+          captured_at_ms INTEGER NOT NULL,
+          received_at_ms INTEGER NOT NULL,
+          expected_interval_ms INTEGER,
+          PRIMARY KEY (collector_id, run_id, seq)
+        ) WITHOUT ROWID;
+
+        -- Freshness and gap detection scan a machine's receipt timeline.
+        CREATE INDEX sample_receipts_machine_captured
+          ON sample_receipts (machine_id, captured_at_ms);
+        -- Retention deletes oldest receipts without an unbounded scan.
+        CREATE INDEX sample_receipts_captured
+          ON sample_receipts (captured_at_ms);
+
+        -- Collector-reported dropped intervals.
+        CREATE TABLE gaps (
+          collector_id TEXT NOT NULL,
+          run_id TEXT NOT NULL,
+          seq INTEGER NOT NULL,
+          machine_id TEXT NOT NULL,
+          from_ms INTEGER NOT NULL,
+          to_ms INTEGER NOT NULL,
+          dropped INTEGER NOT NULL,
+          reason TEXT NOT NULL,
+          received_at_ms INTEGER NOT NULL,
+          PRIMARY KEY (collector_id, run_id, seq)
+        ) WITHOUT ROWID;
+
+        CREATE INDEX gaps_machine_to ON gaps (machine_id, to_ms);
+        -- Retention deletes oldest gaps without a full scan.
+        CREATE INDEX gaps_to ON gaps (to_ms);
+
+        -- Latest LIVE metrics per machine, persisted across restart. A replay
+        -- batch never touches this table.
+        CREATE TABLE machine_latest (
+          machine_id TEXT PRIMARY KEY,
+          collector_id TEXT NOT NULL,
+          run_id TEXT NOT NULL,
+          seq INTEGER NOT NULL,
+          captured_at_ms INTEGER NOT NULL,
+          received_at_ms INTEGER NOT NULL,
+          payload_json TEXT NOT NULL
+        );
+
+        -- Latest inventory per machine. Inventory is not time-series data.
+        CREATE TABLE inventory (
+          machine_id TEXT PRIMARY KEY,
+          captured_at_ms INTEGER NOT NULL,
+          received_at_ms INTEGER NOT NULL,
+          inventory_json TEXT NOT NULL
+        );
+      `);
+    }
+  },
+  {
+    version: 2,
+    name: "latest_session_identity",
+    up(db) {
+      const columns = new Set(
+        db.prepare("PRAGMA table_info(machine_latest)").all().map(
+          (column) => column.name
+        )
+      );
+      if (!columns.has("boot_id")) {
+        db.exec("ALTER TABLE machine_latest ADD COLUMN boot_id TEXT NOT NULL DEFAULT ''");
+      }
+      if (!columns.has("expected_interval_ms")) {
+        db.exec("ALTER TABLE machine_latest ADD COLUMN expected_interval_ms INTEGER");
+      }
+      if (!columns.has("hostname")) {
+        db.exec("ALTER TABLE machine_latest ADD COLUMN hostname TEXT");
+      }
+    }
+  },
+  { version: 3, name: "admin", up: adminSchema },
+  { version: 4, name: "alerts", up: installAlertSchema },
+  { version: 5, name: "collector_registry", up: installRegistrySchema },
+  { version: 6, name: "telemetry_modes_and_recordings", up: telemetryModesAndRecordings }
+];
+function telemetryModesAndRecordings(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS points_10s (
+      series_id INTEGER NOT NULL,
+      bucket_ms INTEGER NOT NULL,
+      min REAL,
+      max REAL,
+      sum REAL NOT NULL DEFAULT 0,
+      count INTEGER NOT NULL DEFAULT 0,
+      null_count INTEGER NOT NULL DEFAULT 0,
+      PRIMARY KEY (series_id, bucket_ms)
+    ) WITHOUT ROWID;
+
+    CREATE TABLE IF NOT EXISTS recordings (
+      id TEXT PRIMARY KEY,
+      created_by TEXT NOT NULL,
+      status TEXT NOT NULL,
+      machines_json TEXT NOT NULL,
+      metrics_json TEXT NOT NULL,
+      resolution_ms INTEGER NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      started_at_ms INTEGER NOT NULL,
+      stopped_at_ms INTEGER,
+      deadline_ms INTEGER NOT NULL,
+      max_bytes INTEGER NOT NULL,
+      bytes_written INTEGER NOT NULL DEFAULT 0,
+      file_name TEXT NOT NULL,
+      include_backlog INTEGER NOT NULL DEFAULT 0,
+      reason TEXT,
+      error TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS recordings_created
+      ON recordings (created_at_ms DESC);
+  `);
+}
+
+// src/hub/storage/db.ts
+var DEFAULT_MAX_DATABASE_DISK_BYTES = 2 * 1024 * 1024 * 1024;
+var HUB_WAL_RESERVE_BYTES = 128 * 1024 * 1024;
+
+// src/operations/fs.ts
+var import_node_fs3 = require("node:fs");
+var import_node_crypto5 = require("node:crypto");
+var import_node_path4 = require("node:path");
+var PRIVATE_DIR_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+var OperationsError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "OperationsError";
+    this.code = code;
+  }
+};
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function timestampSlug(ms = Date.now()) {
+  return new Date(ms).toISOString().replace(/[:.]/g, "-");
+}
+function isPrivateMode(mode) {
+  return (mode & 63) === 0;
+}
+function ensurePrivateDir(path) {
+  const absolute = (0, import_node_path4.resolve)(path);
+  (0, import_node_fs3.mkdirSync)(absolute, { recursive: true, mode: PRIVATE_DIR_MODE });
+  const stat = (0, import_node_fs3.lstatSync)(absolute);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new OperationsError("unsafe-path", `${absolute} must be a real directory`);
+  }
+  if (!isPrivateMode(stat.mode)) {
+    throw new OperationsError(
+      "insecure-permissions",
+      `${absolute} must be private (0700 or stricter); found ${formatMode(stat.mode)}`
+    );
+  }
+}
+function assertPrivateRegularFile(path, label) {
+  const absolute = (0, import_node_path4.resolve)(path);
+  let stat;
+  try {
+    stat = (0, import_node_fs3.lstatSync)(absolute);
+  } catch (error) {
+    throw new OperationsError("missing-file", `${label} does not exist: ${absolute}`, { cause: error });
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new OperationsError("unsafe-path", `${label} must be a regular file, not a symlink: ${absolute}`);
+  }
+  if (!isPrivateMode(stat.mode)) {
+    throw new OperationsError(
+      "insecure-permissions",
+      `${label} must be private (0600/0400); found ${formatMode(stat.mode)}: ${absolute}`
+    );
+  }
+  return stat;
+}
+function formatMode(mode) {
+  return `0${(mode & 511).toString(8).padStart(3, "0")}`;
+}
+function writeFileAtomic(path, content, mode) {
+  const absolute = (0, import_node_path4.resolve)(path);
+  const parent = (0, import_node_path4.dirname)(absolute);
+  const temporary = (0, import_node_path4.join)(parent, `.${(0, import_node_path4.basename)(absolute)}.tmp-${(0, import_node_crypto5.randomUUID)()}`);
+  let fd = null;
+  try {
+    fd = (0, import_node_fs3.openSync)(temporary, "wx", mode);
+    (0, import_node_fs3.writeFileSync)(fd, content);
+    (0, import_node_fs3.fsyncSync)(fd);
+    (0, import_node_fs3.closeSync)(fd);
+    fd = null;
+    (0, import_node_fs3.chmodSync)(temporary, mode);
+    (0, import_node_fs3.renameSync)(temporary, absolute);
+    fsyncDir(parent);
+  } catch (error) {
+    if (fd !== null) {
+      try {
+        (0, import_node_fs3.closeSync)(fd);
+      } catch {
+      }
+    }
+    removeIfExists(temporary);
+    throw error;
+  }
+}
+function writePrivateFile(path, content) {
+  ensurePrivateDir((0, import_node_path4.dirname)((0, import_node_path4.resolve)(path)));
+  writeFileAtomic(path, content, PRIVATE_FILE_MODE);
+}
+function fsyncDir(path) {
+  let fd = null;
+  try {
+    fd = (0, import_node_fs3.openSync)(path, "r");
+    (0, import_node_fs3.fsyncSync)(fd);
+  } catch {
+  } finally {
+    if (fd !== null) {
+      try {
+        (0, import_node_fs3.closeSync)(fd);
+      } catch {
+      }
+    }
+  }
+}
+function removeIfExists(path) {
+  try {
+    (0, import_node_fs3.unlinkSync)(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function fileSize(path) {
+  try {
+    const stat = (0, import_node_fs3.statSync)(path);
+    return stat.isFile() ? stat.size : 0;
+  } catch (error) {
+    if (error.code === "ENOENT") return 0;
+    throw error;
+  }
+}
+function resolvePath(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new OperationsError("invalid-argument", `${label} must be a nonempty path`);
+  }
+  return (0, import_node_path4.resolve)(value);
+}
+function findHubLock(databasePath) {
+  const absolute = (0, import_node_path4.resolve)(databasePath);
+  const parent = (0, import_node_path4.dirname)(absolute);
+  const envLock = process.env.RIGSCOPE_HUB_LOCK_FILE;
+  const candidates = [
+    ...envLock ? [(0, import_node_path4.resolve)(envLock)] : [],
+    `${absolute}.lock`,
+    `${absolute}-lock`,
+    `${absolute}.hub.lock`,
+    (0, import_node_path4.join)(parent, "hub.lock"),
+    (0, import_node_path4.join)(parent, "hub.pid")
+    // `run/hub.lock` is the component supervisor lease, not a database
+    // lease. Treating it as a hub lock would make an upgrade's own held lease
+    // look like a live hub during database backup/restore.
+  ];
+  for (const candidate of candidates) {
+    try {
+      (0, import_node_fs3.lstatSync)(candidate);
+      return candidate;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  return null;
+}
+function assertNoActiveHubLock(databasePath) {
+  const lock = findHubLock(databasePath);
+  if (lock !== null) {
+    throw new OperationsError(
+      "hub-active",
+      `an active hub lock exists at ${lock}; stop the hub, verify no process owns it, and remove the lock only after explicit inspection`
+    );
+  }
+}
+
+// src/operations/database.ts
+var SUPPORTED_SCHEMA_VERSION = MIGRATIONS.length === 0 ? 0 : MIGRATIONS[MIGRATIONS.length - 1].version;
+var BUSY_TIMEOUT_MS = 5e3;
+var PRIVATE_FILE_MODE2 = 384;
+var COUNTED_TABLES = /* @__PURE__ */ new Set([
+  "schema_migrations",
+  "collector_registry",
+  "collector_registry_meta",
+  "collector_grants",
+  "collector_audit",
+  "users",
+  "admin_audit",
+  "admin_meta",
+  "machine_meta",
+  "machine_latest",
+  "inventory",
+  "points_10s",
+  "gaps",
+  "recordings",
+  "alert_rules",
+  "alert_incidents",
+  "alert_jobs",
+  "alert_webhook",
+  "alert_machine_progress"
+]);
+function openReadOnly(path) {
+  const db = new import_node_sqlite2.DatabaseSync(path, { readOnly: true, timeout: BUSY_TIMEOUT_MS });
+  db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
+  return db;
+}
+function rowsOf(statement) {
+  return statement.all();
+}
+function firstValue(row) {
+  return row === void 0 ? void 0 : Object.values(row)[0];
+}
+function integrityResult(db) {
+  const rows = rowsOf(db.prepare("PRAGMA integrity_check"));
+  const lines = rows.map((row) => String(firstValue(row) ?? ""));
+  const text = lines.length === 0 ? "no integrity result" : lines.join("; ");
+  return { text, ok: lines.length === 1 && lines[0] === "ok" };
+}
+function tableNames(db) {
+  return rowsOf(
+    db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name")
+  ).map((row) => String(row.name));
+}
+function readLedger(db, hasTable) {
+  if (!hasTable) return [];
+  return rowsOf(db.prepare("SELECT version, name FROM schema_migrations ORDER BY version")).map((row) => ({
+    version: Number(row.version),
+    name: String(row.name)
+  }));
+}
+function ledgerProblem(ledger) {
+  if (ledger.length === 0) return "schema_migrations exists but has no applied migrations";
+  for (const [index, row] of ledger.entries()) {
+    if (!Number.isSafeInteger(row.version) || row.version < 1) return `invalid migration version ${row.version}`;
+    if (row.version !== index + 1) {
+      return `migration history is not contiguous at version ${row.version}`;
+    }
+    const expected = MIGRATIONS.find((migration) => migration.version === row.version);
+    if (expected === void 0) {
+      return row.version > SUPPORTED_SCHEMA_VERSION ? `schema version ${row.version} is newer than this build (${SUPPORTED_SCHEMA_VERSION})` : `unknown migration version ${row.version}`;
+    }
+    if (row.name !== expected.name) {
+      return `migration ${row.version} is named "${row.name}", expected "${expected.name}"`;
+    }
+  }
+  return null;
+}
+function describeOpenDatabase(db, path, statMode) {
+  const integrity = integrityResult(db);
+  const tables = tableNames(db);
+  const hasSchemaMigrations = tables.includes("schema_migrations");
+  const ledger = readLedger(db, hasSchemaMigrations);
+  const schemaVersion = ledger.length === 0 ? 0 : ledger[ledger.length - 1].version;
+  const problem = hasSchemaMigrations ? ledgerProblem(ledger) : "schema_migrations is missing";
+  const journal = db.prepare("PRAGMA journal_mode").get();
+  const pageSize = Number(db.prepare("PRAGMA page_size").get()?.page_size ?? 0);
+  const pageCount = Number(db.prepare("PRAGMA page_count").get()?.page_count ?? 0);
+  const counted = tables.map((name) => {
+    if (!COUNTED_TABLES.has(name)) return { name };
+    try {
+      const row = db.prepare(`SELECT COUNT(*) AS n FROM "${name.replace(/"/g, '""')}"`).get();
+      return { name, rows: Number(row?.n ?? 0) };
+    } catch {
+      return { name };
+    }
+  });
+  return {
+    path,
+    fileBytes: fileSize(path),
+    walBytes: fileSize(`${path}-wal`),
+    shmBytes: fileSize(`${path}-shm`),
+    mode: `0${(statMode & 511).toString(8).padStart(3, "0")}`,
+    integrity: integrity.text,
+    integrityOk: integrity.ok,
+    journalMode: String(firstValue(journal) ?? "unknown"),
+    pageSize,
+    pageCount,
+    hasSchemaMigrations,
+    schemaVersion,
+    supportedSchemaVersion: SUPPORTED_SCHEMA_VERSION,
+    newerSchema: schemaVersion > SUPPORTED_SCHEMA_VERSION,
+    ledger,
+    ledgerProblem: problem,
+    tables: counted,
+    registryPresent: tables.includes("collector_registry"),
+    adminPresent: tables.includes("users"),
+    alertsPresent: tables.includes("alert_rules") && tables.includes("alert_incidents") && tables.includes("alert_jobs")
+  };
+}
+function chmodSidecars(path) {
+  for (const sidecar of [`${path}-wal`, `${path}-shm`]) {
+    try {
+      const stat = (0, import_node_fs4.lstatSync)(sidecar);
+      if (stat.isFile() && !isPrivateMode(stat.mode)) (0, import_node_fs4.chmodSync)(sidecar, PRIVATE_FILE_MODE2);
+    } catch {
+    }
+  }
+}
+function inspectDatabase(path) {
+  const absolute = resolvePath(path, "database");
+  const stat = assertPrivateRegularFile(absolute, "database");
+  const db = openReadOnly(absolute);
+  try {
+    return describeOpenDatabase(db, absolute, stat.mode);
+  } finally {
+    db.close();
+    chmodSidecars(absolute);
+  }
+}
+var MACHINE_HISTORY_TABLES = [
+  "points_raw",
+  "points_10s",
+  "points_1m",
+  "points_1h",
+  "sample_receipts",
+  "gaps",
+  "machine_latest",
+  "inventory",
+  "alert_observed_resources",
+  "alert_machine_progress",
+  "alert_incidents",
+  "series"
+];
+function clearMachineHistory(database) {
+  const path = resolvePath(database, "database");
+  if (!(0, import_node_fs4.existsSync)(path)) return { deleted: {}, integrity: "absent" };
+  assertPrivateRegularFile(path, "database");
+  assertNoActiveHubLock(path);
+  const db = new import_node_sqlite2.DatabaseSync(path, { timeout: BUSY_TIMEOUT_MS });
+  const deleted = {};
+  try {
+    db.exec("PRAGMA busy_timeout = 5000");
+    const present = new Set(
+      db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((row) => row.name)
+    );
+    db.exec("BEGIN IMMEDIATE");
+    try {
+      for (const table of MACHINE_HISTORY_TABLES) {
+        if (!present.has(table)) continue;
+        const result = db.prepare(`DELETE FROM ${table}`).run();
+        deleted[table] = Number(result.changes);
+      }
+      db.exec("COMMIT");
+    } catch (error) {
+      try {
+        db.exec("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    }
+    const autoVacuum = db.prepare("PRAGMA auto_vacuum").get();
+    if (autoVacuum && Object.values(autoVacuum)[0] === 2) db.exec("PRAGMA incremental_vacuum(1024)");
+    try {
+      db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+    } catch {
+    }
+  } finally {
+    db.close();
+  }
+  return { deleted, integrity: inspectDatabase(path).integrity };
+}
+
+// src/cli/machine-transition.ts
+var MACHINE_DATA_TRANSITION_FILE = "machine-data-transition.json";
+var STAGED_QUEUE_PREFIX = "outbox.pre-transition-";
+function machineDataTransitionPath(stateRoot) {
+  return (0, import_node_path5.join)(stateRoot, MACHINE_DATA_TRANSITION_FILE);
+}
+function readMachineDataTransition(stateRoot) {
+  const path = machineDataTransitionPath(stateRoot);
+  try {
+    const stat = (0, import_node_fs5.lstatSync)(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 63) !== 0) {
+      throw new Error("marker must be a private regular file");
+    }
+    const value = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
+    if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid marker");
+    const record = value;
+    if (typeof record.transitionedAt !== "string" || !Number.isFinite(Date.parse(record.transitionedAt))) {
+      throw new Error("invalid transition date");
+    }
+    return { transitionedAt: record.transitionedAt, release: typeof record.release === "string" ? record.release : null };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new OperationsError(
+      "invalid-transition-marker",
+      `Cannot determine whether the one-time reset completed; preserving machine data. Repair ${path}: ${errorMessage(error)}`,
+      { cause: error }
+    );
+  }
+}
+function recordMachineDataTransition(stateRoot, release, write = (path, content) => writePrivateFile(path, content)) {
+  const marker = { transitionedAt: (/* @__PURE__ */ new Date()).toISOString(), release };
+  write(machineDataTransitionPath(stateRoot), `${JSON.stringify(marker, null, 2)}
+`);
+}
+function newMachineDataCleanup(transitioned) {
+  return {
+    report: { transitioned, databaseRows: null, collectorQueuesRemoved: false, warning: null },
+    stagedQueues: null,
+    databaseCleared: false
+  };
+}
+function performMachineDataCleanup(stateRoot, paths, now = Date.now, deps = {}) {
+  if (readMachineDataTransition(stateRoot) !== null) return newMachineDataCleanup(false);
+  const cleanup = newMachineDataCleanup(true);
+  const clear = deps.clear ?? clearMachineHistory;
+  const warnings = [];
+  try {
+    if ((0, import_node_fs5.existsSync)(paths.queueTree)) {
+      const staged = (0, import_node_path5.join)((0, import_node_path5.dirname)(paths.queueTree), `${STAGED_QUEUE_PREFIX}${timestampSlug(now())}-${(0, import_node_crypto6.randomUUID)()}`);
+      (0, import_node_fs5.renameSync)(paths.queueTree, staged);
+      cleanup.stagedQueues = staged;
+      cleanup.report.collectorQueuesRemoved = true;
+    }
+  } catch (error) {
+    warnings.push(`collector queues: ${errorMessage(error)}`);
+  }
+  try {
+    if ((0, import_node_fs5.existsSync)(paths.database)) {
+      cleanup.databaseCleared = true;
+      cleanup.report.databaseRows = clear(paths.database).deleted;
+    }
+  } catch (error) {
+    warnings.push(`hub database: ${errorMessage(error)}`);
+  }
+  cleanup.report.warning = warnings.length > 0 ? warnings.join("; ") : null;
+  return cleanup;
+}
+function undoMachineDataCleanup(paths, stagedQueues) {
+  if (stagedQueues === null || !(0, import_node_fs5.existsSync)(stagedQueues)) return [];
+  try {
+    if ((0, import_node_fs5.existsSync)(paths.queueTree)) {
+      const failedQueue = `${paths.queueTree}.failed-transition-${(0, import_node_crypto6.randomUUID)()}`;
+      (0, import_node_fs5.renameSync)(paths.queueTree, failedQueue);
+      try {
+        (0, import_node_fs5.renameSync)(stagedQueues, paths.queueTree);
+      } catch (error) {
+        (0, import_node_fs5.renameSync)(failedQueue, paths.queueTree);
+        throw error;
+      }
+      return [`restored the collector queue tree; replacement runtime queue preserved at ${failedQueue}`];
+    }
+    (0, import_node_fs5.renameSync)(stagedQueues, paths.queueTree);
+    return ["restored the collector queue tree the transition had staged aside"];
+  } catch (error) {
+    return [`machine data rollback could not restore the collector queue: ${errorMessage(error)}`];
+  }
+}
+function completeMachineDataCleanup(stateRoot, cleanup, release, write) {
+  if (!cleanup.report.transitioned) return;
+  if (cleanup.report.warning !== null) return;
+  try {
+    recordMachineDataTransition(stateRoot, release, write);
+  } catch (error) {
+    cleanup.report.warning = `could not record transition completion: ${errorMessage(error)}`;
+    return;
+  }
+  if (cleanup.stagedQueues !== null) {
+    try {
+      (0, import_node_fs5.rmSync)(cleanup.stagedQueues, { recursive: true, force: true });
+    } catch (error) {
+      cleanup.report.warning = `transition completed; staged queue remains at ${cleanup.stagedQueues}: ${errorMessage(error)}`;
+    }
+  }
+}
+function machineDataReportRows(report) {
+  if (report.databaseRows === null) return null;
+  return Object.values(report.databaseRows).reduce((sum, rows) => sum + rows, 0);
+}
+function machineDataKeptNote() {
+  return "accounts, sessions, enrollment and grants, settings, alert rules/jobs/webhook settings, machine names/tags and recordings were kept";
+}
+function describeMachineDataReport(report) {
+  const summary = report.transitioned ? (() => {
+    const rows = machineDataReportRows(report);
+    const parts = [
+      rows === null ? "no hub database" : `${rows} database row(s)`,
+      ...report.collectorQueuesRemoved ? ["the collector queue tree"] : []
+    ];
+    return `Machine data: one-time RAM-first transition discarded ${parts.join(" and ")}. The ${machineDataKeptNote()}.`;
+  })() : "Machine data: one-time transition already completed; durable history and collector queues preserved.";
+  return {
+    summary,
+    warning: report.warning === null ? null : `Machine-data cleanup warning (${report.warning}). The upgrade is healthy; cleanup without a completion marker is retried on the next upgrade.`
+  };
+}
+
 // src/cli/system.ts
 var SYSTEM_SCOPE = "system";
 var DEFAULT_SYSTEM_ACCOUNTS = {
@@ -1129,13 +2066,13 @@ function createSystemHost(overrides = {}) {
 }
 function defaultSystemPaths(overrides = {}) {
   return {
-    prefix: (0, import_node_path4.resolve)(overrides.prefix ?? "/opt/rigscope"),
-    configDir: (0, import_node_path4.resolve)(overrides.configDir ?? "/etc/rigscope"),
-    stateDir: (0, import_node_path4.resolve)(overrides.stateDir ?? "/var/lib/rigscope"),
-    unitsDir: (0, import_node_path4.resolve)(overrides.unitsDir ?? "/etc/systemd/system"),
-    sysusersDir: (0, import_node_path4.resolve)(overrides.sysusersDir ?? "/etc/sysusers.d"),
-    udevRulesDir: (0, import_node_path4.resolve)(overrides.udevRulesDir ?? "/etc/udev/rules.d"),
-    powercapRoot: (0, import_node_path4.resolve)(overrides.powercapRoot ?? "/sys/class/powercap")
+    prefix: (0, import_node_path6.resolve)(overrides.prefix ?? "/opt/rigscope"),
+    configDir: (0, import_node_path6.resolve)(overrides.configDir ?? "/etc/rigscope"),
+    stateDir: (0, import_node_path6.resolve)(overrides.stateDir ?? "/var/lib/rigscope"),
+    unitsDir: (0, import_node_path6.resolve)(overrides.unitsDir ?? "/etc/systemd/system"),
+    sysusersDir: (0, import_node_path6.resolve)(overrides.sysusersDir ?? "/etc/sysusers.d"),
+    udevRulesDir: (0, import_node_path6.resolve)(overrides.udevRulesDir ?? "/etc/udev/rules.d"),
+    powercapRoot: (0, import_node_path6.resolve)(overrides.powercapRoot ?? "/sys/class/powercap")
   };
 }
 function unitNamesFor(role) {
@@ -1150,11 +2087,11 @@ function rolesFor(role) {
   return { hub: role !== "collector", collector: role !== "hub" };
 }
 function isWithin(parent, candidate) {
-  const rel = (0, import_node_path4.relative)((0, import_node_path4.resolve)(parent), (0, import_node_path4.resolve)(candidate));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${import_node_path4.sep}`) && !(0, import_node_path4.isAbsolute)(rel);
+  const rel = (0, import_node_path6.relative)((0, import_node_path6.resolve)(parent), (0, import_node_path6.resolve)(candidate));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${import_node_path6.sep}`) && !(0, import_node_path6.isAbsolute)(rel);
 }
 function ensureAbsolute(path, label) {
-  const absolute = (0, import_node_path4.resolve)(path);
+  const absolute = (0, import_node_path6.resolve)(path);
   if (/[\0\r\n]/.test(absolute)) throw new SystemError("unsafe-path", `${label} contains control characters`);
   if (absolute === "/") throw new SystemError("unsafe-path", `${label} must not be the filesystem root`);
   for (const forbidden of ["/home", "/root", "/proc", "/sys", "/dev", "/boot"]) {
@@ -1168,7 +2105,7 @@ function validateSystemPaths(input = {}) {
   const paths = defaultSystemPaths(input);
   for (const [label, value] of Object.entries(paths)) {
     if (label === "powercapRoot") {
-      if (!(0, import_node_path4.isAbsolute)(value) || /[\0\r\n]/.test(value) || (0, import_node_path4.resolve)(value) === "/") {
+      if (!(0, import_node_path6.isAbsolute)(value) || /[\0\r\n]/.test(value) || (0, import_node_path6.resolve)(value) === "/") {
         throw new SystemError("unsafe-path", `powercap root is unsafe: ${value}`);
       }
     } else {
@@ -1223,19 +2160,19 @@ function runRequired(host, command, args, label, options) {
 function runMaybe(host, command, args, options) {
   return host.run(command, args, options);
 }
-function sha256File(path) {
-  return (0, import_node_crypto5.createHash)("sha256").update((0, import_node_fs3.readFileSync)(path)).digest("hex");
+function sha256File2(path) {
+  return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs6.readFileSync)(path)).digest("hex");
 }
 function atomicWrite(path, content, mode) {
-  (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true, mode: 493 });
-  const temporary = (0, import_node_path4.join)((0, import_node_path4.dirname)(path), `.${(0, import_node_path4.basename)(path)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  (0, import_node_fs6.mkdirSync)((0, import_node_path6.dirname)(path), { recursive: true, mode: 493 });
+  const temporary = (0, import_node_path6.join)((0, import_node_path6.dirname)(path), `.${(0, import_node_path6.basename)(path)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
   try {
-    (0, import_node_fs3.writeFileSync)(temporary, content, { mode });
-    (0, import_node_fs3.chmodSync)(temporary, mode);
-    (0, import_node_fs3.renameSync)(temporary, path);
+    (0, import_node_fs6.writeFileSync)(temporary, content, { mode });
+    (0, import_node_fs6.chmodSync)(temporary, mode);
+    (0, import_node_fs6.renameSync)(temporary, path);
   } catch (error) {
     try {
-      (0, import_node_fs3.unlinkSync)(temporary);
+      (0, import_node_fs6.unlinkSync)(temporary);
     } catch {
     }
     throw error;
@@ -1244,12 +2181,12 @@ function atomicWrite(path, content, mode) {
 function ensureDirectory(path, mode, privateDirectory = false) {
   let stat;
   try {
-    stat = (0, import_node_fs3.lstatSync)(path);
+    stat = (0, import_node_fs6.lstatSync)(path);
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
-    (0, import_node_fs3.mkdirSync)(path, { recursive: true, mode });
-    (0, import_node_fs3.chmodSync)(path, mode);
-    stat = (0, import_node_fs3.lstatSync)(path);
+    (0, import_node_fs6.mkdirSync)(path, { recursive: true, mode });
+    (0, import_node_fs6.chmodSync)(path, mode);
+    stat = (0, import_node_fs6.lstatSync)(path);
   }
   if (!stat.isDirectory() || stat.isSymbolicLink()) {
     throw new SystemError("unsafe-path", `${path} must be a real directory`);
@@ -1264,8 +2201,8 @@ function isDefaultSystemLayout(paths) {
 }
 function assertManagedPathSafety(paths, enforceRoot) {
   for (const path of [paths.prefix, paths.configDir, paths.stateDir, paths.unitsDir, paths.sysusersDir, paths.udevRulesDir]) {
-    if (!(0, import_node_fs3.existsSync)(path)) continue;
-    const stat = (0, import_node_fs3.lstatSync)(path);
+    if (!(0, import_node_fs6.existsSync)(path)) continue;
+    const stat = (0, import_node_fs6.lstatSync)(path);
     if (!stat.isDirectory() || stat.isSymbolicLink()) {
       throw new SystemError("unsafe-path", `${path} must be a real directory`);
     }
@@ -1278,8 +2215,8 @@ function assertManagedPathSafety(paths, enforceRoot) {
   }
 }
 function writeManagedFile(path, content, mode, replace) {
-  if ((0, import_node_fs3.existsSync)(path)) {
-    const stat = (0, import_node_fs3.lstatSync)(path);
+  if ((0, import_node_fs6.existsSync)(path)) {
+    const stat = (0, import_node_fs6.lstatSync)(path);
     if (!stat.isFile() || stat.isSymbolicLink()) {
       throw new SystemError("unsafe-path", `${path} must be a regular file, not a symlink`);
     }
@@ -1318,7 +2255,7 @@ function parseEnvValue(value) {
 function readEnvDocument(path) {
   let raw;
   try {
-    raw = (0, import_node_fs3.readFileSync)(path, "utf8");
+    raw = (0, import_node_fs6.readFileSync)(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
@@ -1365,43 +2302,43 @@ function connectDestinationUrl(value) {
   return url.href;
 }
 function hubDatabasePath(paths) {
-  return (0, import_node_path4.join)(paths.stateDir, "hub", "telemetry.sqlite");
+  return (0, import_node_path6.join)(paths.stateDir, "hub", "telemetry.sqlite");
 }
 function hubEnrollmentPath(paths) {
-  return (0, import_node_path4.join)(paths.stateDir, "hub", "enrollment.json");
+  return (0, import_node_path6.join)(paths.stateDir, "hub", "enrollment.json");
 }
 function hubSocketPath(paths) {
-  return (0, import_node_path4.join)(paths.stateDir, "hub", "run", "hub.sock");
+  return (0, import_node_path6.join)(paths.stateDir, "hub", "run", "hub.sock");
 }
 function collectorStatePath(paths) {
-  return (0, import_node_path4.join)(paths.stateDir, "collector", "state.json");
+  return (0, import_node_path6.join)(paths.stateDir, "collector", "state.json");
 }
 function hubEnvPath(paths) {
-  return (0, import_node_path4.join)(paths.configDir, "hub.env");
+  return (0, import_node_path6.join)(paths.configDir, "hub.env");
 }
 function collectorEnvPath(paths) {
-  return (0, import_node_path4.join)(paths.configDir, "collector.env");
+  return (0, import_node_path6.join)(paths.configDir, "collector.env");
 }
 function sysusersPath(paths) {
-  return (0, import_node_path4.join)(paths.sysusersDir, SYSUSERS_NAME);
+  return (0, import_node_path6.join)(paths.sysusersDir, SYSUSERS_NAME);
 }
 function powerSysusersPath(paths) {
-  return (0, import_node_path4.join)(paths.sysusersDir, POWER_SYSUSERS_NAME);
+  return (0, import_node_path6.join)(paths.sysusersDir, POWER_SYSUSERS_NAME);
 }
 function raplRulePath(paths) {
-  return (0, import_node_path4.join)(paths.udevRulesDir, RAPL_RULE_NAME);
+  return (0, import_node_path6.join)(paths.udevRulesDir, RAPL_RULE_NAME);
 }
 function stateFilePath(paths) {
-  return (0, import_node_path4.join)(paths.stateDir, STATE_FILE_NAME);
+  return (0, import_node_path6.join)(paths.stateDir, STATE_FILE_NAME);
 }
 function readCollectorIdentity(path) {
-  if (!(0, import_node_fs3.existsSync)(path)) return null;
-  const stat = (0, import_node_fs3.lstatSync)(path);
+  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  const stat = (0, import_node_fs6.lstatSync)(path);
   if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("unsafe-path", `${path} must be a regular file`);
   if ((stat.mode & 63) !== 0) throw new SystemError("insecure-permissions", `${path} must be private (0600)`);
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    raw = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
   } catch {
     throw new SystemError("invalid-file", `${path} is not valid JSON`);
   }
@@ -1435,7 +2372,7 @@ function readCollectorIdentity(path) {
   return { collectorId: record.collectorId, destinations };
 }
 function writeCollectorIdentity(path, identity) {
-  ensureDirectory((0, import_node_path4.dirname)(path), 448, true);
+  ensureDirectory((0, import_node_path6.dirname)(path), 448, true);
   atomicWrite(path, `${JSON.stringify(identity)}
 `, 384);
 }
@@ -1475,7 +2412,7 @@ function ensureHubOwner(paths) {
     if (!Array.isArray(parsed)) throw new SystemError("invalid-config", "HUB_BROWSER_USERS must be a JSON array");
     if (parsed.length > 0) return void 0;
   }
-  const password = (0, import_node_crypto5.randomBytes)(18).toString("base64url");
+  const password = (0, import_node_crypto7.randomBytes)(18).toString("base64url");
   const users = [{ username: "owner", passwordHash: hashPassword(password), machineIds: "*", admin: true }];
   writeEnvValue(hubEnvPath(paths), "HUB_BROWSER_USERS", JSON.stringify(users));
   return password;
@@ -1526,8 +2463,8 @@ function updateHubCollectorRegistry(paths, identity) {
 }
 function registerCollectorInHubDatabase(paths, identity, host) {
   const database = hubDatabasePath(paths);
-  if (!(0, import_node_fs3.existsSync)(database)) return { inserted: false };
-  const db = new import_node_sqlite.DatabaseSync(database, { timeout: 5e3 });
+  if (!(0, import_node_fs6.existsSync)(database)) return { inserted: false };
+  const db = new import_node_sqlite3.DatabaseSync(database, { timeout: 5e3 });
   try {
     const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='collector_registry'").get();
     if (!table) return { inserted: false };
@@ -1541,8 +2478,8 @@ function registerCollectorInHubDatabase(paths, identity, host) {
 }
 function findCollectorInHubDatabase(paths, collectorId) {
   const database = hubDatabasePath(paths);
-  if (!(0, import_node_fs3.existsSync)(database)) return null;
-  const db = new import_node_sqlite.DatabaseSync(database, { readOnly: true, timeout: 5e3 });
+  if (!(0, import_node_fs6.existsSync)(database)) return null;
+  const db = new import_node_sqlite3.DatabaseSync(database, { readOnly: true, timeout: 5e3 });
   try {
     const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='collector_registry'").get();
     if (!table) return null;
@@ -1554,11 +2491,11 @@ function findCollectorInHubDatabase(paths, collectorId) {
 }
 function createLocalEnrollmentGrant(paths, host) {
   const database = hubDatabasePath(paths);
-  if (!(0, import_node_fs3.existsSync)(database)) throw new SystemError("hub-unavailable", "the hub database does not exist yet");
-  const token = (0, import_node_crypto5.randomBytes)(32).toString("base64url");
-  const tokenHash = (0, import_node_crypto5.createHash)("sha256").update(token).digest("hex");
+  if (!(0, import_node_fs6.existsSync)(database)) throw new SystemError("hub-unavailable", "the hub database does not exist yet");
+  const token = (0, import_node_crypto7.randomBytes)(32).toString("base64url");
+  const tokenHash = (0, import_node_crypto7.createHash)("sha256").update(token).digest("hex");
   const expiresAt = host.now() + 10 * 60 * 1e3;
-  const db = new import_node_sqlite.DatabaseSync(database, { timeout: 5e3 });
+  const db = new import_node_sqlite3.DatabaseSync(database, { timeout: 5e3 });
   try {
     const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='collector_grants'").get();
     if (!table) throw new SystemError("hub-unavailable", "the hub registry is not initialized");
@@ -1608,7 +2545,7 @@ async function pairCollectorWithHub(options) {
       note: "the local hub has no reachable loopback or HTTPS destination"
     };
   }
-  if (!(0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, UNIT_NAMES.hub))) {
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path6.join)(paths.unitsDir, UNIT_NAMES.hub))) {
     return { paired: false, awaiting: true, hubWasActive: false, note: "the local hub unit is not installed" };
   }
   const hubWasActive = systemdActive(host, UNIT_NAMES.hub);
@@ -1621,7 +2558,7 @@ async function pairCollectorWithHub(options) {
           destinations: [{ url: destination.url, token: registered.token, sharing: { ...SYSTEM_DEFAULT_SHARING } }]
         };
         writeCollectorIdentity(collectorStatePath(paths), adopted);
-        chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+        chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
         return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
       }
     }
@@ -1629,7 +2566,7 @@ async function pairCollectorWithHub(options) {
     try {
       grant = createLocalEnrollmentGrant(paths, host);
     } catch (error) {
-      chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+      chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
       return {
         paired: false,
         awaiting: true,
@@ -1647,18 +2584,18 @@ async function pairCollectorWithHub(options) {
         note: `enrollment through the live hub failed: ${error instanceof Error ? error.message : String(error)}`
       };
     } finally {
-      chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+      chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
     }
     if (!collectorConfigured(paths).configured) {
       return { paired: false, awaiting: true, hubWasActive, note: "the hub accepted enrollment but no destination was saved" };
     }
-    chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+    chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
     return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
   }
   const identity = {
-    collectorId: existing?.collectorId ?? (0, import_node_crypto5.randomUUID)(),
-    machineId: (0, import_node_crypto5.randomUUID)(),
-    token: (0, import_node_crypto5.randomBytes)(32).toString("base64url")
+    collectorId: existing?.collectorId ?? (0, import_node_crypto7.randomUUID)(),
+    machineId: (0, import_node_crypto7.randomUUID)(),
+    token: (0, import_node_crypto7.randomBytes)(32).toString("base64url")
   };
   const registry = registerCollectorInHubDatabase(paths, identity, host);
   let token = identity.token;
@@ -1685,7 +2622,7 @@ async function pairCollectorWithHub(options) {
     }
   ];
   writeCollectorIdentity(collectorStatePath(paths), next);
-  chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+  chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
   return { paired: true, awaiting: false, hubWasActive, destination: destination.url };
 }
 function unitCommon(name, description, paths, account, envPath, execStart, extraService = []) {
@@ -1702,7 +2639,7 @@ function unitCommon(name, description, paths, account, envPath, execStart, extra
     "Type=simple",
     `User=${account}`,
     `Group=${account}`,
-    `WorkingDirectory=${(0, import_node_path4.join)(paths.prefix, "current").replace(/%/g, "%%")}`,
+    `WorkingDirectory=${(0, import_node_path6.join)(paths.prefix, "current").replace(/%/g, "%%")}`,
     `EnvironmentFile=${envPath.replace(/%/g, "%%")}`,
     "Environment=NODE_ENV=production",
     "Restart=on-failure",
@@ -1737,13 +2674,13 @@ function unitCommon(name, description, paths, account, envPath, execStart, extra
 }
 function renderSystemHubUnit(options) {
   const { paths, accounts } = options;
-  const hubScript = (0, import_node_path4.join)(paths.prefix, "current", "dist", "hub.cjs");
+  const hubScript = (0, import_node_path6.join)(paths.prefix, "current", "dist", "hub.cjs");
   const extra = [
     `Environment=${systemdQuote(`HUB_DATABASE_PATH=${options.database}`)}`,
     `Environment=${systemdQuote(`HUB_STATE_FILE=${options.enrollment}`)}`,
     ...options.remote ? [`Environment=${systemdQuote(`HUB_SOCKET_PATH=${options.socket}`)}`] : [],
-    `ReadWritePaths=${systemdQuote((0, import_node_path4.join)(paths.stateDir, "hub"))}`,
-    `ReadOnlyPaths=${systemdQuote((0, import_node_path4.join)(paths.prefix, "current"))}`,
+    `ReadWritePaths=${systemdQuote((0, import_node_path6.join)(paths.stateDir, "hub"))}`,
+    `ReadOnlyPaths=${systemdQuote((0, import_node_path6.join)(paths.prefix, "current"))}`,
     "PrivateDevices=yes",
     "TimeoutStopSec=15s"
   ];
@@ -1762,14 +2699,14 @@ function renderSystemHubUnit(options) {
 }
 function renderSystemCollectorUnit(options) {
   const { paths, accounts } = options;
-  const collectorScript = (0, import_node_path4.join)(paths.prefix, "current", "dist", "collector.cjs");
+  const collectorScript = (0, import_node_path6.join)(paths.prefix, "current", "dist", "collector.cjs");
   const extra = [
     ...options.powerAccess ? [`SupplementaryGroups=${accounts.powerGroup}`] : [],
     `Environment=${systemdQuote(`COLLECTOR_MODE=real`)}`,
     `Environment=${systemdQuote(`COLLECTOR_STATE_FILE=${options.collectorState}`)}`,
-    `Environment=${systemdQuote(`COLLECTOR_HEALTH_FILE=${(0, import_node_path4.join)(paths.stateDir, "collector", "health.json")}`)}`,
-    `ReadWritePaths=${systemdQuote((0, import_node_path4.join)(paths.stateDir, "collector"))}`,
-    `ReadOnlyPaths=${systemdQuote((0, import_node_path4.join)(paths.prefix, "current"))}`,
+    `Environment=${systemdQuote(`COLLECTOR_HEALTH_FILE=${(0, import_node_path6.join)(paths.stateDir, "collector", "health.json")}`)}`,
+    `ReadWritePaths=${systemdQuote((0, import_node_path6.join)(paths.stateDir, "collector"))}`,
+    `ReadOnlyPaths=${systemdQuote((0, import_node_path6.join)(paths.prefix, "current"))}`,
     "TimeoutStopSec=10s"
   ];
   return [
@@ -1842,11 +2779,15 @@ function collectorEnvTemplate() {
     "# COLLECTOR_ENROLL_URL=ws://127.0.0.1:8081/api/collector/connect",
     "# COLLECTOR_ENROLL_TOKEN=<one-use grant>",
     "# COLLECTOR_MODE=real",
+    "# Unacknowledged samples wait in RAM by default: no queue is written to disk",
+    "# and a collector restart loses what was never acknowledged. Set this to durable",
+    "# to keep them in a per-hub SQLite outbox across collector restarts.",
+    "# COLLECTOR_QUEUE_MODE=durable",
     ""
   ].join("\n");
 }
 function assertPrivateSourceFile(path, label) {
-  const stat = (0, import_node_fs3.lstatSync)(path);
+  const stat = (0, import_node_fs6.lstatSync)(path);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new SystemError("unsafe-adoption", `${label} must be a regular file: ${path}`);
   }
@@ -1857,7 +2798,7 @@ function assertPrivateSourceFile(path, label) {
 function readJsonObject(path) {
   let raw;
   try {
-    raw = (0, import_node_fs3.readFileSync)(path, "utf8");
+    raw = (0, import_node_fs6.readFileSync)(path, "utf8");
   } catch (error) {
     throw new SystemError("missing-file", `cannot read ${path}: ${error.message}`);
   }
@@ -1880,8 +2821,8 @@ function isCanonicalComponents(value) {
 }
 function readSystemState(paths) {
   const path = stateFilePath(paths);
-  if (!(0, import_node_fs3.existsSync)(path)) return null;
-  const stat = (0, import_node_fs3.lstatSync)(path);
+  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  const stat = (0, import_node_fs6.lstatSync)(path);
   if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("unsafe-path", `${path} must be a regular file`);
   if ((stat.mode & 63) !== 0) throw new SystemError("insecure-permissions", `${path} must be 0600`);
   const raw = readJsonObject(path);
@@ -1913,7 +2854,7 @@ function readSystemState(paths) {
 }
 function systemStateIsLegacy(paths) {
   const path = stateFilePath(paths);
-  if (!(0, import_node_fs3.existsSync)(path)) return false;
+  if (!(0, import_node_fs6.existsSync)(path)) return false;
   let raw;
   try {
     raw = readJsonObject(path);
@@ -1964,24 +2905,24 @@ function validateVersion(value) {
   return value;
 }
 function releaseVersion(root) {
-  const metadata = readJsonObject((0, import_node_path4.join)(root, "package.json"));
+  const metadata = readJsonObject((0, import_node_path6.join)(root, "package.json"));
   if (Object.hasOwn(metadata, "rigscopeConfigVersion")) {
     throw new SystemError("invalid-release", "release uses unfinished configuration metadata; select a canonical release");
   }
   return validateVersion(metadata.version);
 }
 function releaseSchemaVersion(root) {
-  const manifestPath = (0, import_node_path4.join)(root, "manifest.json");
-  if (!(0, import_node_fs3.existsSync)(manifestPath)) return null;
+  const manifestPath = (0, import_node_path6.join)(root, "manifest.json");
+  if (!(0, import_node_fs6.existsSync)(manifestPath)) return null;
   const manifest = readJsonObject(manifestPath);
   return Number.isSafeInteger(manifest.schemaVersion) ? Number(manifest.schemaVersion) : null;
 }
 function assertReleaseArtifacts(root) {
   for (const artifact of REQUIRED_ARTIFACTS) {
-    const path = (0, import_node_path4.join)(root, artifact);
+    const path = (0, import_node_path6.join)(root, artifact);
     let stat;
     try {
-      stat = (0, import_node_fs3.lstatSync)(path);
+      stat = (0, import_node_fs6.lstatSync)(path);
     } catch {
       throw new SystemError("missing-artifact", `release is missing ${artifact}`);
     }
@@ -1989,12 +2930,12 @@ function assertReleaseArtifacts(root) {
       throw new SystemError("invalid-artifact", `release artifact is not a non-empty regular file: ${artifact}`);
     }
   }
-  const buildId = (0, import_node_fs3.readFileSync)((0, import_node_path4.join)(root, ".next", "BUILD_ID"), "utf8").trim();
+  const buildId = (0, import_node_fs6.readFileSync)((0, import_node_path6.join)(root, ".next", "BUILD_ID"), "utf8").trim();
   if (buildId === "" || /\s/.test(buildId)) throw new SystemError("invalid-artifact", ".next/BUILD_ID is invalid");
   for (const directory of [".next/server", ".next/static"]) {
     let stat;
     try {
-      stat = (0, import_node_fs3.lstatSync)((0, import_node_path4.join)(root, directory));
+      stat = (0, import_node_fs6.lstatSync)((0, import_node_path6.join)(root, directory));
     } catch {
       throw new SystemError("missing-artifact", `release is missing ${directory}/`);
     }
@@ -2002,10 +2943,10 @@ function assertReleaseArtifacts(root) {
   }
 }
 function verifyReleaseManifest(root) {
-  const manifestPath = (0, import_node_path4.join)(root, "manifest.json");
-  if (!(0, import_node_fs3.existsSync)(manifestPath)) return;
+  const manifestPath = (0, import_node_path6.join)(root, "manifest.json");
+  if (!(0, import_node_fs6.existsSync)(manifestPath)) return;
   const manifest = readJsonObject(manifestPath);
-  const packageJson = readJsonObject((0, import_node_path4.join)(root, "package.json"));
+  const packageJson = readJsonObject((0, import_node_path6.join)(root, "package.json"));
   if (manifest.name !== void 0 && manifest.name !== packageJson.name) {
     throw new SystemError("manifest-mismatch", "release manifest name does not match package.json");
   }
@@ -2024,17 +2965,17 @@ function verifyReleaseManifest(root) {
     if (typeof relativePath !== "string" || relativePath === "" || relativePath.startsWith("/") || relativePath.includes("\\") || relativePath.split("/").includes("..")) {
       throw new SystemError("invalid-manifest", `release manifest contains an unsafe path: ${String(relativePath)}`);
     }
-    const absolute = (0, import_node_path4.join)(root, relativePath);
-    const stat = (0, import_node_fs3.lstatSync)(absolute);
+    const absolute = (0, import_node_path6.join)(root, relativePath);
+    const stat = (0, import_node_fs6.lstatSync)(absolute);
     if (!stat.isFile() || stat.isSymbolicLink()) throw new SystemError("invalid-manifest", `release artifact is not a regular file: ${relativePath}`);
     if (entry.bytes !== stat.size) throw new SystemError("artifact-mismatch", `release artifact size changed: ${relativePath}`);
-    if (entry.sha256 !== sha256File(absolute)) throw new SystemError("artifact-mismatch", `release artifact hash changed: ${relativePath}`);
+    if (entry.sha256 !== sha256File2(absolute)) throw new SystemError("artifact-mismatch", `release artifact hash changed: ${relativePath}`);
     listed.add(relativePath);
   }
   const visit = (current) => {
-    for (const entry of (0, import_node_fs3.readdirSync)(current, { withFileTypes: true })) {
-      const absolute = (0, import_node_path4.join)(current, entry.name);
-      const rel = (0, import_node_path4.relative)(root, absolute).split(import_node_path4.sep).join("/");
+    for (const entry of (0, import_node_fs6.readdirSync)(current, { withFileTypes: true })) {
+      const absolute = (0, import_node_path6.join)(current, entry.name);
+      const rel = (0, import_node_path6.relative)(root, absolute).split(import_node_path6.sep).join("/");
       if (rel === "node_modules" || rel.startsWith("node_modules/") || rel === ".next/cache" || rel.startsWith(".next/cache/")) continue;
       if (entry.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${rel}`);
       if (entry.isDirectory()) {
@@ -2049,49 +2990,49 @@ function verifyReleaseManifest(root) {
 }
 function assertNoSymlinks(root) {
   const visit = (path) => {
-    const stat = (0, import_node_fs3.lstatSync)(path);
-    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${(0, import_node_path4.relative)(root, path)}`);
+    const stat = (0, import_node_fs6.lstatSync)(path);
+    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `release contains a symlink: ${(0, import_node_path6.relative)(root, path)}`);
     if (!stat.isDirectory()) return;
-    for (const entry of (0, import_node_fs3.readdirSync)(path)) visit((0, import_node_path4.join)(path, entry));
+    for (const entry of (0, import_node_fs6.readdirSync)(path)) visit((0, import_node_path6.join)(path, entry));
   };
   visit(root);
 }
 function copyReleaseTree(source, destination) {
   const visit = (current, target) => {
-    const stat = (0, import_node_fs3.lstatSync)(current);
-    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${(0, import_node_path4.relative)(source, current)}`);
+    const stat = (0, import_node_fs6.lstatSync)(current);
+    if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${(0, import_node_path6.relative)(source, current)}`);
     if (stat.isDirectory()) {
-      (0, import_node_fs3.mkdirSync)(target, { recursive: true, mode: 493 });
-      for (const entry of (0, import_node_fs3.readdirSync)(current)) {
-        const child = (0, import_node_path4.join)(current, entry);
-        const rel = (0, import_node_path4.relative)(source, child);
+      (0, import_node_fs6.mkdirSync)(target, { recursive: true, mode: 493 });
+      for (const entry of (0, import_node_fs6.readdirSync)(current)) {
+        const child = (0, import_node_path6.join)(current, entry);
+        const rel = (0, import_node_path6.relative)(source, child);
         if (rel === ".git" || rel === ".next-dev" || rel === ".next/cache" || rel === "node_modules" || rel.startsWith("node_modules/")) {
           continue;
         }
-        visit(child, (0, import_node_path4.join)(target, entry));
+        visit(child, (0, import_node_path6.join)(target, entry));
       }
       return;
     }
-    if (!stat.isFile()) throw new SystemError("unsafe-release", `source contains a non-regular file: ${(0, import_node_path4.relative)(source, current)}`);
-    (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(target), { recursive: true, mode: 493 });
-    (0, import_node_fs3.copyFileSync)(current, target);
-    (0, import_node_fs3.chmodSync)(target, 420);
+    if (!stat.isFile()) throw new SystemError("unsafe-release", `source contains a non-regular file: ${(0, import_node_path6.relative)(source, current)}`);
+    (0, import_node_fs6.mkdirSync)((0, import_node_path6.dirname)(target), { recursive: true, mode: 493 });
+    (0, import_node_fs6.copyFileSync)(current, target);
+    (0, import_node_fs6.chmodSync)(target, 420);
   };
   visit(source, destination);
 }
 function copyReleaseAllowlisted(source, destination) {
-  for (const entry of (0, import_node_fs3.readdirSync)(source)) {
+  for (const entry of (0, import_node_fs6.readdirSync)(source)) {
     if (!PACKAGE_TOP_LEVEL.has(entry)) continue;
     if (entry === "node_modules") continue;
-    const child = (0, import_node_path4.join)(source, entry);
-    const target = (0, import_node_path4.join)(destination, entry);
-    const stat = (0, import_node_fs3.lstatSync)(child);
+    const child = (0, import_node_path6.join)(source, entry);
+    const target = (0, import_node_path6.join)(destination, entry);
+    const stat = (0, import_node_fs6.lstatSync)(child);
     if (stat.isSymbolicLink()) throw new SystemError("unsafe-release", `source contains a symlink: ${entry}`);
     if (stat.isDirectory()) {
       copyReleaseTree(child, target);
     } else if (stat.isFile()) {
-      (0, import_node_fs3.copyFileSync)(child, target);
-      (0, import_node_fs3.chmodSync)(target, 420);
+      (0, import_node_fs6.copyFileSync)(child, target);
+      (0, import_node_fs6.chmodSync)(target, 420);
     }
   }
 }
@@ -2126,28 +3067,28 @@ function extractArchive(archive, stage, host) {
 }
 function discardStagedRelease(staged) {
   if (staged === null) return;
-  (0, import_node_fs3.rmSync)(staged.stageDir, { recursive: true, force: true });
+  (0, import_node_fs6.rmSync)(staged.stageDir, { recursive: true, force: true });
 }
 function releaseTargetDir(paths, version) {
-  return (0, import_node_path4.join)(paths.prefix, "releases", version);
+  return (0, import_node_path6.join)(paths.prefix, "releases", version);
 }
 function assertReleaseTargetAvailable(paths, releaseDir, replaceRelease) {
-  if (!(0, import_node_fs3.existsSync)(releaseDir)) return;
+  if (!(0, import_node_fs6.existsSync)(releaseDir)) return;
   const current = currentReleaseDir(paths);
   const previous = previousReleaseDir(paths);
   if (!replaceRelease || current === releaseDir || previous === releaseDir) {
     throw new SystemError(
       "release-exists",
-      `release ${(0, import_node_path4.basename)(releaseDir)} is already installed${current === releaseDir || previous === releaseDir ? " or retained" : ""}; choose a new version`
+      `release ${(0, import_node_path6.basename)(releaseDir)} is already installed${current === releaseDir || previous === releaseDir ? " or retained" : ""}; choose a new version`
     );
   }
 }
 function stageRelease(options) {
-  const source = (0, import_node_fs3.realpathSync)((0, import_node_path4.resolve)(options.source));
-  const stat = (0, import_node_fs3.lstatSync)(source);
+  const source = (0, import_node_fs6.realpathSync)((0, import_node_path6.resolve)(options.source));
+  const stat = (0, import_node_fs6.lstatSync)(source);
   ensureDirectory(options.paths.prefix, 493);
-  const stageDir = (0, import_node_path4.join)(options.paths.prefix, `.stage-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  (0, import_node_fs3.mkdirSync)(stageDir, { recursive: true, mode: 448 });
+  const stageDir = (0, import_node_path6.join)(options.paths.prefix, `.stage-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  (0, import_node_fs6.mkdirSync)(stageDir, { recursive: true, mode: 448 });
   try {
     if (stat.isDirectory() && !stat.isSymbolicLink()) {
       copyReleaseAllowlisted(source, stageDir);
@@ -2165,7 +3106,7 @@ function stageRelease(options) {
       artifacts: [...REQUIRED_ARTIFACTS]
     };
   } catch (error) {
-    (0, import_node_fs3.rmSync)(stageDir, { recursive: true, force: true });
+    (0, import_node_fs6.rmSync)(stageDir, { recursive: true, force: true });
     throw error;
   }
 }
@@ -2191,13 +3132,13 @@ function prepareStagedRelease(options) {
   }
 }
 function commitStagedRelease(options) {
-  const releasesDir = (0, import_node_path4.join)(options.paths.prefix, "releases");
+  const releasesDir = (0, import_node_path6.join)(options.paths.prefix, "releases");
   ensureDirectory(releasesDir, 493);
   const releaseDir = releaseTargetDir(options.paths, options.staged.version);
   assertReleaseTargetAvailable(options.paths, releaseDir, options.replaceRelease);
-  if ((0, import_node_fs3.existsSync)(releaseDir)) (0, import_node_fs3.rmSync)(releaseDir, { recursive: true, force: true });
-  (0, import_node_fs3.renameSync)(options.staged.stageDir, releaseDir);
-  ensureDirectory((0, import_node_path4.join)(releaseDir, ".next", "cache"), 493);
+  if ((0, import_node_fs6.existsSync)(releaseDir)) (0, import_node_fs6.rmSync)(releaseDir, { recursive: true, force: true });
+  (0, import_node_fs6.renameSync)(options.staged.stageDir, releaseDir);
+  ensureDirectory((0, import_node_path6.join)(releaseDir, ".next", "cache"), 493);
   return {
     version: options.staged.version,
     releaseDir,
@@ -2206,20 +3147,20 @@ function commitStagedRelease(options) {
   };
 }
 function dependencyNames(root) {
-  const pkg = readJsonObject((0, import_node_path4.join)(root, "package.json"));
+  const pkg = readJsonObject((0, import_node_path6.join)(root, "package.json"));
   const dependencies = pkg.dependencies;
   if (dependencies === null || typeof dependencies !== "object" || Array.isArray(dependencies)) return [];
   return Object.keys(dependencies).filter((name) => /^[A-Za-z0-9@/._-]+$/.test(name));
 }
 function missingDependencies(root) {
-  return dependencyNames(root).filter((name) => !(0, import_node_fs3.existsSync)((0, import_node_path4.join)(root, "node_modules", name, "package.json")));
+  return dependencyNames(root).filter((name) => !(0, import_node_fs6.existsSync)((0, import_node_path6.join)(root, "node_modules", name, "package.json")));
 }
 function installDependencies(root, host, command = "npm") {
-  const hasLock = (0, import_node_fs3.existsSync)((0, import_node_path4.join)(root, "package-lock.json"));
+  const hasLock = (0, import_node_fs6.existsSync)((0, import_node_path6.join)(root, "package-lock.json"));
   const args = hasLock ? ["ci", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"];
-  const siblingNpm = (0, import_node_path4.join)((0, import_node_path4.dirname)(process.execPath), "npm");
-  const executable = command === "npm" && (0, import_node_fs3.existsSync)(siblingNpm) ? siblingNpm : command;
-  const nodeBin = (0, import_node_path4.dirname)(process.execPath);
+  const siblingNpm = (0, import_node_path6.join)((0, import_node_path6.dirname)(process.execPath), "npm");
+  const executable = command === "npm" && (0, import_node_fs6.existsSync)(siblingNpm) ? siblingNpm : command;
+  const nodeBin = (0, import_node_path6.dirname)(process.execPath);
   const path = [nodeBin, process.env.PATH ?? ""].filter(Boolean).join(":");
   runRequired(host, executable, args, "production dependency installation", {
     cwd: root,
@@ -2228,21 +3169,21 @@ function installDependencies(root, host, command = "npm") {
   });
 }
 function currentReleaseDir(paths) {
-  const link = (0, import_node_path4.join)(paths.prefix, "current");
+  const link = (0, import_node_path6.join)(paths.prefix, "current");
   try {
-    const target = (0, import_node_fs3.readlinkSync)(link);
-    const absolute = (0, import_node_path4.isAbsolute)(target) ? target : (0, import_node_path4.resolve)(paths.prefix, target);
-    return isWithin((0, import_node_path4.join)(paths.prefix, "releases"), absolute) ? absolute : null;
+    const target = (0, import_node_fs6.readlinkSync)(link);
+    const absolute = (0, import_node_path6.isAbsolute)(target) ? target : (0, import_node_path6.resolve)(paths.prefix, target);
+    return isWithin((0, import_node_path6.join)(paths.prefix, "releases"), absolute) ? absolute : null;
   } catch {
     return null;
   }
 }
 function previousReleaseDir(paths) {
-  const link = (0, import_node_path4.join)(paths.prefix, "previous");
+  const link = (0, import_node_path6.join)(paths.prefix, "previous");
   try {
-    const target = (0, import_node_fs3.readlinkSync)(link);
-    const absolute = (0, import_node_path4.isAbsolute)(target) ? target : (0, import_node_path4.resolve)(paths.prefix, target);
-    return isWithin((0, import_node_path4.join)(paths.prefix, "releases"), absolute) ? absolute : null;
+    const target = (0, import_node_fs6.readlinkSync)(link);
+    const absolute = (0, import_node_path6.isAbsolute)(target) ? target : (0, import_node_path6.resolve)(paths.prefix, target);
+    return isWithin((0, import_node_path6.join)(paths.prefix, "releases"), absolute) ? absolute : null;
   } catch {
     return null;
   }
@@ -2250,11 +3191,11 @@ function previousReleaseDir(paths) {
 function replaceSymlink(link, target, host) {
   const temporary = `${link}.tmp-${process.pid}-${Date.now()}`;
   try {
-    (0, import_node_fs3.symlinkSync)(target, temporary);
-    (0, import_node_fs3.renameSync)(temporary, link);
+    (0, import_node_fs6.symlinkSync)(target, temporary);
+    (0, import_node_fs6.renameSync)(temporary, link);
   } catch (error) {
     try {
-      (0, import_node_fs3.unlinkSync)(temporary);
+      (0, import_node_fs6.unlinkSync)(temporary);
     } catch {
     }
     throw error;
@@ -2263,8 +3204,8 @@ function replaceSymlink(link, target, host) {
 }
 function removeSymlink(link) {
   try {
-    const stat = (0, import_node_fs3.lstatSync)(link);
-    if (stat.isSymbolicLink()) (0, import_node_fs3.unlinkSync)(link);
+    const stat = (0, import_node_fs6.lstatSync)(link);
+    if (stat.isSymbolicLink()) (0, import_node_fs6.unlinkSync)(link);
   } catch {
   }
 }
@@ -2277,18 +3218,18 @@ function nodeVersion(host, nodePath) {
   return output;
 }
 function ensureRootOwnedNode(options) {
-  const selected = (0, import_node_path4.resolve)(options.nodePath ?? process.execPath);
-  const real = (0, import_node_fs3.realpathSync)(selected);
+  const selected = (0, import_node_path6.resolve)(options.nodePath ?? process.execPath);
+  const real = (0, import_node_fs6.realpathSync)(selected);
   nodeVersion(options.host, real);
-  const stat = (0, import_node_fs3.statSync)(real);
-  const insideRelease = isWithin((0, import_node_path4.join)(options.paths.prefix, "releases"), real);
+  const stat = (0, import_node_fs6.statSync)(real);
+  const insideRelease = isWithin((0, import_node_path6.join)(options.paths.prefix, "releases"), real);
   const unsafe = stat.uid !== 0 || (stat.mode & 18) !== 0 || options.copyNode === true || insideRelease;
   if (!unsafe || options.trustedNode === true) return real;
-  const target = (0, import_node_path4.join)(options.paths.prefix, "node", "node");
+  const target = (0, import_node_path6.join)(options.paths.prefix, "node", "node");
   if (!options.apply) return target;
-  ensureDirectory((0, import_node_path4.join)(options.paths.prefix, "node"), 493);
-  (0, import_node_fs3.copyFileSync)(real, target);
-  (0, import_node_fs3.chmodSync)(target, 493);
+  ensureDirectory((0, import_node_path6.join)(options.paths.prefix, "node"), 493);
+  (0, import_node_fs6.copyFileSync)(real, target);
+  (0, import_node_fs6.chmodSync)(target, 493);
   runRequired(options.host, "chown", ["root:root", target], "node ownership");
   nodeVersion(options.host, target);
   return target;
@@ -2317,8 +3258,8 @@ function validatedOrigin(value) {
   return value;
 }
 function readAdoptionSetup(source) {
-  const configPath = (0, import_node_path4.join)(source, "config.json");
-  if (!(0, import_node_fs3.existsSync)(configPath)) {
+  const configPath = (0, import_node_path6.join)(source, "config.json");
+  if (!(0, import_node_fs6.existsSync)(configPath)) {
     throw new SystemError("invalid-adoption", "adopted installation has no config.json");
   }
   assertPrivateSourceFile(configPath, "adopted setup");
@@ -2366,35 +3307,35 @@ function detectUserInstallations(options = {}) {
   const roots = options.homeRoots ?? ["/home", "/root"];
   const found = [];
   for (const homeRoot of roots) {
-    if (!(0, import_node_fs3.existsSync)(homeRoot)) continue;
-    const homes = homeRoot === "/root" ? ["/root"] : (0, import_node_fs3.readdirSync)(homeRoot).map((entry) => (0, import_node_path4.join)(homeRoot, entry));
+    if (!(0, import_node_fs6.existsSync)(homeRoot)) continue;
+    const homes = homeRoot === "/root" ? ["/root"] : (0, import_node_fs6.readdirSync)(homeRoot).map((entry) => (0, import_node_path6.join)(homeRoot, entry));
     for (const home of homes) {
       let stat;
       try {
-        stat = (0, import_node_fs3.lstatSync)(home);
+        stat = (0, import_node_fs6.lstatSync)(home);
       } catch {
         continue;
       }
       if (!stat.isDirectory()) continue;
-      const unitDir = (0, import_node_path4.join)(home, ".config", "systemd", "user");
+      const unitDir = (0, import_node_path6.join)(home, ".config", "systemd", "user");
       let units = [];
       try {
-        units = (0, import_node_fs3.readdirSync)(unitDir);
+        units = (0, import_node_fs6.readdirSync)(unitDir);
       } catch {
         units = [];
       }
       for (const unitName of units) {
         if (!/^rigscope(?:-[0-9a-f]{12})?(?:-(?:hub|collector))?\.service$/.test(unitName)) continue;
-        const unitPath = (0, import_node_path4.join)(unitDir, unitName);
+        const unitPath = (0, import_node_path6.join)(unitDir, unitName);
         let execStart = null;
         try {
-          const line = (0, import_node_fs3.readFileSync)(unitPath, "utf8").split("\n").find((item) => item.startsWith("ExecStart="));
+          const line = (0, import_node_fs6.readFileSync)(unitPath, "utf8").split("\n").find((item) => item.startsWith("ExecStart="));
           execStart = line ? line.slice("ExecStart=".length) : null;
         } catch {
         }
-        const stateCandidates = [(0, import_node_path4.join)(home, ".local", "state", "rigscope")];
-        const stateDir = stateCandidates.find((candidate) => (0, import_node_fs3.existsSync)(candidate)) ?? null;
-        found.push({ user: (0, import_node_path4.basename)(home), home, unitPath, unitName, execStart, stateDir });
+        const stateCandidates = [(0, import_node_path6.join)(home, ".local", "state", "rigscope")];
+        const stateDir = stateCandidates.find((candidate) => (0, import_node_fs6.existsSync)(candidate)) ?? null;
+        found.push({ user: (0, import_node_path6.basename)(home), home, unitPath, unitName, execStart, stateDir });
       }
     }
   }
@@ -2402,9 +3343,9 @@ function detectUserInstallations(options = {}) {
 }
 function lockIsLive(path) {
   try {
-    const stat = (0, import_node_fs3.lstatSync)(path);
+    const stat = (0, import_node_fs6.lstatSync)(path);
     if (!stat.isFile() || stat.size > 4096) return { exists: true, live: false, pid: null, ambiguous: true };
-    const owner = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    const owner = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
     const pid = owner.pid;
     if (!Number.isSafeInteger(pid) || pid < 1) return { exists: true, live: false, pid: null, ambiguous: true };
     try {
@@ -2422,9 +3363,9 @@ function lockIsLive(path) {
 }
 function directoryLocks(directory) {
   return [
-    (0, import_node_path4.join)(directory, "hub", "telemetry.sqlite.hub.lock"),
-    (0, import_node_path4.join)(directory, "run", "rigscope.lock"),
-    (0, import_node_path4.join)(directory, "collector", "collector-runtime.lock")
+    (0, import_node_path6.join)(directory, "hub", "telemetry.sqlite.hub.lock"),
+    (0, import_node_path6.join)(directory, "run", "rigscope.lock"),
+    (0, import_node_path6.join)(directory, "collector", "collector-runtime.lock")
   ];
 }
 function assertDirectoryStopped(directory, scope = "local") {
@@ -2455,13 +3396,13 @@ function assertSystemStartAllowed(paths, components) {
 }
 function detectPowerDriver(moduleRoot = "/sys/module") {
   const candidates = ["intel_rapl_msr", "intel_rapl_common", "intel_rapl_tpmi", "intel_rapl", "amd_energy"];
-  return candidates.filter((name) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(moduleRoot, name)));
+  return candidates.filter((name) => (0, import_node_fs6.existsSync)((0, import_node_path6.join)(moduleRoot, name)));
 }
 function readPasswd(path = "/etc/passwd") {
   const users = /* @__PURE__ */ new Map();
   let lines;
   try {
-    lines = (0, import_node_fs3.readFileSync)(path, "utf8").split("\n");
+    lines = (0, import_node_fs6.readFileSync)(path, "utf8").split("\n");
   } catch {
     return users;
   }
@@ -2478,7 +3419,7 @@ function readGroups(path = "/etc/group") {
   const groups = /* @__PURE__ */ new Map();
   let lines;
   try {
-    lines = (0, import_node_fs3.readFileSync)(path, "utf8").split("\n");
+    lines = (0, import_node_fs6.readFileSync)(path, "utf8").split("\n");
   } catch {
     return groups;
   }
@@ -2506,7 +3447,7 @@ function inspectPowerAccess(options = {}) {
   const sysusers = options.sysusersPath ?? powerSysusersPath(paths);
   let ruleText = null;
   try {
-    ruleText = (0, import_node_fs3.readFileSync)(rulePath, "utf8");
+    ruleText = (0, import_node_fs6.readFileSync)(rulePath, "utf8");
   } catch {
     ruleText = null;
   }
@@ -2523,27 +3464,27 @@ function inspectPowerAccess(options = {}) {
   const domains = [];
   let entries = [];
   try {
-    entries = (0, import_node_fs3.readdirSync)(paths.powercapRoot);
+    entries = (0, import_node_fs6.readdirSync)(paths.powercapRoot);
   } catch {
     entries = [];
   }
   for (const entry of entries.filter((name) => /^intel-rapl:\d+$/.test(name)).sort()) {
-    const domainPath = (0, import_node_path4.join)(paths.powercapRoot, entry);
+    const domainPath = (0, import_node_path6.join)(paths.powercapRoot, entry);
     let name = entry;
     try {
-      name = (0, import_node_fs3.readFileSync)((0, import_node_path4.join)(domainPath, "name"), "utf8").trim() || entry;
+      name = (0, import_node_fs6.readFileSync)((0, import_node_path6.join)(domainPath, "name"), "utf8").trim() || entry;
     } catch {
     }
     if (!/^package/.test(name)) continue;
-    const energyPath = (0, import_node_path4.join)(domainPath, "energy_uj");
-    const maxRangePath = (0, import_node_path4.join)(domainPath, "max_energy_range_uj");
+    const energyPath = (0, import_node_path6.join)(domainPath, "energy_uj");
+    const maxRangePath = (0, import_node_path6.join)(domainPath, "max_energy_range_uj");
     const readStat = (path) => {
       if (options.statOverride) {
         const override = options.statOverride(path);
         return override === null ? null : { mode: modeString(override.mode), uid: override.uid, gid: override.gid };
       }
       try {
-        const stat = (0, import_node_fs3.statSync)(path);
+        const stat = (0, import_node_fs6.statSync)(path);
         return { mode: modeString(stat.mode), uid: stat.uid, gid: stat.gid };
       } catch {
         return null;
@@ -2577,7 +3518,7 @@ function inspectPowerAccess(options = {}) {
     problems.push(`collector account ${accounts.collector} is not a member of ${accounts.powerGroup}`);
   }
   if (!compliant) problems.push(`persistent udev rule is missing or not compliant: ${rulePath}`);
-  if (!(0, import_node_fs3.existsSync)(sysusers)) problems.push(`power sysusers definition is missing: ${sysusers}`);
+  if (!(0, import_node_fs6.existsSync)(sysusers)) problems.push(`power sysusers definition is missing: ${sysusers}`);
   for (const domain of domains) {
     if (!domain.energyExists) problems.push(`${domain.name}: energy_uj is unavailable`);
     else if (domain.energy?.worldReadable) problems.push(`${domain.name}: energy_uj is world-readable`);
@@ -2596,7 +3537,7 @@ function inspectPowerAccess(options = {}) {
     collectorGids,
     group: { name: accounts.powerGroup, exists: group !== null, gid: group?.gid ?? null, members: group?.members ?? [] },
     rule: { path: rulePath, present: ruleText !== null, compliant },
-    sysusers: { path: sysusers, present: (0, import_node_fs3.existsSync)(sysusers) },
+    sysusers: { path: sysusers, present: (0, import_node_fs6.existsSync)(sysusers) },
     collectorCanRead,
     persistent: compliant && group !== null && collector !== null && group.members.includes(accounts.collector),
     worldReadable,
@@ -2605,15 +3546,15 @@ function inspectPowerAccess(options = {}) {
   };
 }
 async function backupDatabase(source, output, host) {
-  ensureDirectory((0, import_node_path4.dirname)(output), 448, true);
-  const db = new import_node_sqlite.DatabaseSync(source, { readOnly: true, timeout: 5e3 });
+  ensureDirectory((0, import_node_path6.dirname)(output), 448, true);
+  const db = new import_node_sqlite3.DatabaseSync(source, { readOnly: true, timeout: 5e3 });
   try {
-    await (0, import_node_sqlite.backup)(db, output);
+    await (0, import_node_sqlite3.backup)(db, output);
   } finally {
     db.close();
   }
-  (0, import_node_fs3.chmodSync)(output, 384);
-  const check = new import_node_sqlite.DatabaseSync(output, { readOnly: true });
+  (0, import_node_fs6.chmodSync)(output, 384);
+  const check = new import_node_sqlite3.DatabaseSync(output, { readOnly: true });
   try {
     const result = check.prepare("PRAGMA integrity_check").get();
     if (!result || Object.values(result)[0] !== "ok") throw new SystemError("invalid-backup", `backup integrity check failed: ${output}`);
@@ -2623,8 +3564,8 @@ async function backupDatabase(source, output, host) {
   void host;
 }
 function databaseSchema(path) {
-  if (!(0, import_node_fs3.existsSync)(path)) return null;
-  const db = new import_node_sqlite.DatabaseSync(path, { readOnly: true, timeout: 5e3 });
+  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  const db = new import_node_sqlite3.DatabaseSync(path, { readOnly: true, timeout: 5e3 });
   try {
     const table = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='schema_migrations'").get();
     if (!table) return null;
@@ -2636,34 +3577,34 @@ function databaseSchema(path) {
 }
 function replaceDatabaseFromBackup(backupPath, target, safetyBackup, host) {
   assertPrivateSourceFile(backupPath, "database backup");
-  const backup = new import_node_sqlite.DatabaseSync(backupPath, { readOnly: true });
+  const backup3 = new import_node_sqlite3.DatabaseSync(backupPath, { readOnly: true });
   try {
-    if (Object.values(backup.prepare("PRAGMA integrity_check").get())[0] !== "ok") throw new SystemError("invalid-backup", "rollback backup integrity failed");
+    if (Object.values(backup3.prepare("PRAGMA integrity_check").get())[0] !== "ok") throw new SystemError("invalid-backup", "rollback backup integrity failed");
   } finally {
-    backup.close();
+    backup3.close();
   }
-  ensureDirectory((0, import_node_path4.dirname)(target), 448, true);
-  if (safetyBackup !== null && (0, import_node_fs3.existsSync)(target)) {
+  ensureDirectory((0, import_node_path6.dirname)(target), 448, true);
+  if (safetyBackup !== null && (0, import_node_fs6.existsSync)(target)) {
     void host;
   }
-  const temporary = (0, import_node_path4.join)((0, import_node_path4.dirname)(target), `.restore-${process.pid}-${Date.now()}.sqlite`);
-  (0, import_node_fs3.copyFileSync)(backupPath, temporary);
-  (0, import_node_fs3.chmodSync)(temporary, 384);
+  const temporary = (0, import_node_path6.join)((0, import_node_path6.dirname)(target), `.restore-${process.pid}-${Date.now()}.sqlite`);
+  (0, import_node_fs6.copyFileSync)(backupPath, temporary);
+  (0, import_node_fs6.chmodSync)(temporary, 384);
   for (const sidecar of [`${target}-wal`, `${target}-shm`]) {
     try {
-      (0, import_node_fs3.unlinkSync)(sidecar);
+      (0, import_node_fs6.unlinkSync)(sidecar);
     } catch {
     }
   }
-  (0, import_node_fs3.renameSync)(temporary, target);
-  (0, import_node_fs3.chmodSync)(target, 384);
+  (0, import_node_fs6.renameSync)(temporary, target);
+  (0, import_node_fs6.chmodSync)(target, 384);
 }
 function newestTimestamp() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
 function adoptUserState(options) {
-  const source = (0, import_node_path4.resolve)(options.source);
-  if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("invalid-adoption", `user installation does not exist: ${source}`);
+  const source = (0, import_node_path6.resolve)(options.source);
+  if (!(0, import_node_fs6.existsSync)(source)) throw new SystemError("invalid-adoption", `user installation does not exist: ${source}`);
   if (isWithin(options.paths.prefix, source) || isWithin(options.paths.stateDir, source) || isWithin(source, options.paths.stateDir)) {
     throw new SystemError("invalid-adoption", "adoption source and system paths must not overlap");
   }
@@ -2673,10 +3614,10 @@ function adoptUserState(options) {
   const { port, origin } = setup;
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-adoption", "adopted hub port is invalid");
   if (options.role !== "collector") {
-    const sourceDatabase = (0, import_node_path4.join)(source, "hub", "telemetry.sqlite");
-    if ((0, import_node_fs3.existsSync)(sourceDatabase)) {
+    const sourceDatabase = (0, import_node_path6.join)(source, "hub", "telemetry.sqlite");
+    if ((0, import_node_fs6.existsSync)(sourceDatabase)) {
       assertPrivateSourceFile(sourceDatabase, "adopted database");
-      const database = new import_node_sqlite.DatabaseSync(sourceDatabase, { readOnly: true });
+      const database = new import_node_sqlite3.DatabaseSync(sourceDatabase, { readOnly: true });
       try {
         const row = database.prepare("PRAGMA integrity_check").get();
         if (!row || Object.values(row)[0] !== "ok") throw new SystemError("invalid-adoption", "adopted database failed its integrity check");
@@ -2684,12 +3625,12 @@ function adoptUserState(options) {
         database.close();
       }
     }
-    const sourceEnrollment = (0, import_node_path4.join)(source, "hub", "enrollment.json");
-    if ((0, import_node_fs3.existsSync)(sourceEnrollment)) assertPrivateSourceFile(sourceEnrollment, "adopted enrollment");
+    const sourceEnrollment = (0, import_node_path6.join)(source, "hub", "enrollment.json");
+    if ((0, import_node_fs6.existsSync)(sourceEnrollment)) assertPrivateSourceFile(sourceEnrollment, "adopted enrollment");
   }
   if (options.role !== "hub") {
-    const sourceCollectorState = (0, import_node_path4.join)(source, "collector", "state.json");
-    if ((0, import_node_fs3.existsSync)(sourceCollectorState)) {
+    const sourceCollectorState = (0, import_node_path6.join)(source, "collector", "state.json");
+    if ((0, import_node_fs6.existsSync)(sourceCollectorState)) {
       assertPrivateSourceFile(sourceCollectorState, "adopted collector state");
       readCollectorIdentity(sourceCollectorState);
     }
@@ -2698,7 +3639,7 @@ function adoptUserState(options) {
   const warnings = [];
   const targetDatabase = hubDatabasePath(options.paths);
   const targetCollector = collectorStatePath(options.paths);
-  if (options.apply && (0, import_node_fs3.existsSync)(targetDatabase)) {
+  if (options.apply && (0, import_node_fs6.existsSync)(targetDatabase)) {
     throw new SystemError("destination-exists", `refusing to overwrite ${targetDatabase}`);
   }
   const hubEnv = options.role === "collector" ? null : [
@@ -2733,62 +3674,42 @@ function adoptUserState(options) {
     port
   };
 }
-function copyAdoptedTree(source, target, copied, skipLocks = true) {
-  const visit = (current, destination) => {
-    const stat = (0, import_node_fs3.lstatSync)(current);
-    if (stat.isSymbolicLink()) return;
-    if (stat.isDirectory()) {
-      (0, import_node_fs3.mkdirSync)(destination, { recursive: true, mode: 448 });
-      for (const entry of (0, import_node_fs3.readdirSync)(current)) visit((0, import_node_path4.join)(current, entry), (0, import_node_path4.join)(destination, entry));
-      return;
-    }
-    if (!stat.isFile()) return;
-    if (skipLocks && /\.(lock|sock)$/.test(current)) return;
-    (0, import_node_fs3.mkdirSync)((0, import_node_path4.dirname)(destination), { recursive: true, mode: 448 });
-    (0, import_node_fs3.copyFileSync)(current, destination);
-    (0, import_node_fs3.chmodSync)(destination, 384);
-    copied.push({ source: current, target: destination, sha256: sha256File(destination), bytes: stat.size });
-  };
-  visit(source, target);
-}
 async function performAdoptionCopyAsync(options) {
   const { source, paths, role, host, copy } = options;
   assertDirectoryStopped(source, role);
   const targetDatabase = hubDatabasePath(paths);
-  const sourceDatabase = (0, import_node_path4.join)(source, "hub", "telemetry.sqlite");
-  if (role !== "collector" && (0, import_node_fs3.existsSync)(sourceDatabase) && !(0, import_node_fs3.existsSync)(targetDatabase)) {
+  const sourceDatabase = (0, import_node_path6.join)(source, "hub", "telemetry.sqlite");
+  if (role !== "collector" && (0, import_node_fs6.existsSync)(sourceDatabase) && !(0, import_node_fs6.existsSync)(targetDatabase)) {
     assertPrivateSourceFile(sourceDatabase, "adopted database");
-    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub"), 448, true);
+    ensureDirectory((0, import_node_path6.join)(paths.stateDir, "hub"), 448, true);
     await backupDatabase(sourceDatabase, targetDatabase, host);
     copy.record.files.push({
       source: sourceDatabase,
       target: targetDatabase,
-      sha256: sha256File(targetDatabase),
-      bytes: (0, import_node_fs3.statSync)(targetDatabase).size
+      sha256: sha256File2(targetDatabase),
+      bytes: (0, import_node_fs6.statSync)(targetDatabase).size
     });
   }
-  const sourceCollectorState = (0, import_node_path4.join)(source, "collector", "state.json");
-  if (role !== "hub" && (0, import_node_fs3.existsSync)(sourceCollectorState)) {
+  const sourceCollectorState = (0, import_node_path6.join)(source, "collector", "state.json");
+  if (role !== "hub" && (0, import_node_fs6.existsSync)(sourceCollectorState)) {
     assertPrivateSourceFile(sourceCollectorState, "adopted collector state");
-    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "collector"), 448, true);
+    ensureDirectory((0, import_node_path6.join)(paths.stateDir, "collector"), 448, true);
     const targetCollector = collectorStatePath(paths);
-    (0, import_node_fs3.copyFileSync)(sourceCollectorState, targetCollector);
-    (0, import_node_fs3.chmodSync)(targetCollector, 384);
+    (0, import_node_fs6.copyFileSync)(sourceCollectorState, targetCollector);
+    (0, import_node_fs6.chmodSync)(targetCollector, 384);
     copy.record.files.push({
       source: sourceCollectorState,
       target: targetCollector,
-      sha256: sha256File(targetCollector),
-      bytes: (0, import_node_fs3.statSync)(targetCollector).size
+      sha256: sha256File2(targetCollector),
+      bytes: (0, import_node_fs6.statSync)(targetCollector).size
     });
-    const outbox = (0, import_node_path4.join)(source, "collector", "outbox");
-    if ((0, import_node_fs3.existsSync)(outbox)) copyAdoptedTree(outbox, (0, import_node_path4.join)(paths.stateDir, "collector", "outbox"), copy.record.files);
   }
-  const enrollment = (0, import_node_path4.join)(source, "hub", "enrollment.json");
-  if (role !== "collector" && (0, import_node_fs3.existsSync)(enrollment)) {
+  const enrollment = (0, import_node_path6.join)(source, "hub", "enrollment.json");
+  if (role !== "collector" && (0, import_node_fs6.existsSync)(enrollment)) {
     const target = hubEnrollmentPath(paths);
-    (0, import_node_fs3.copyFileSync)(enrollment, target);
-    (0, import_node_fs3.chmodSync)(target, 384);
-    copy.record.files.push({ source: enrollment, target, sha256: sha256File(target), bytes: (0, import_node_fs3.statSync)(target).size });
+    (0, import_node_fs6.copyFileSync)(enrollment, target);
+    (0, import_node_fs6.chmodSync)(target, 384);
+    copy.record.files.push({ source: enrollment, target, sha256: sha256File2(target), bytes: (0, import_node_fs6.statSync)(target).size });
   }
 }
 function writeSysusersFiles(paths, accounts, role, power, host) {
@@ -2828,15 +3749,15 @@ function writePowerRule(paths, accounts) {
   writeManagedFile(raplRulePath(paths), renderRaplRule(accounts), 420, true);
 }
 function powerOriginalPath(paths) {
-  return (0, import_node_path4.join)(paths.stateDir, POWER_STATE_FILE_NAME);
+  return (0, import_node_path6.join)(paths.stateDir, POWER_STATE_FILE_NAME);
 }
 function capturePowerOriginals(paths) {
   const files = {};
   for (const domain of packageDomainPaths(paths.powercapRoot)) {
     for (const name of ["energy_uj", "max_energy_range_uj"]) {
-      const path = (0, import_node_path4.join)(domain, name);
+      const path = (0, import_node_path6.join)(domain, name);
       try {
-        const stat = (0, import_node_fs3.statSync)(path);
+        const stat = (0, import_node_fs6.statSync)(path);
         files[path] = { mode: stat.mode & 511, uid: stat.uid, gid: stat.gid };
       } catch {
       }
@@ -2848,8 +3769,8 @@ function capturePowerOriginals(paths) {
 function applyPowerAccess(paths, accounts, host) {
   for (const domain of packageDomainPaths(paths.powercapRoot)) {
     for (const name of ["energy_uj", "max_energy_range_uj"]) {
-      const path = (0, import_node_path4.join)(domain, name);
-      if (!(0, import_node_fs3.existsSync)(path)) continue;
+      const path = (0, import_node_path6.join)(domain, name);
+      if (!(0, import_node_fs6.existsSync)(path)) continue;
       runRequired(host, "chgrp", [accounts.powerGroup, path], `power counter group ${path}`);
       runRequired(host, "chmod", ["0440", path], `power counter mode ${path}`);
     }
@@ -2862,9 +3783,9 @@ function resumePowerRule(paths, host) {
 }
 function packageDomainPaths(root) {
   try {
-    return (0, import_node_fs3.readdirSync)(root).filter((entry) => /^intel-rapl:\d+$/.test(entry)).map((entry) => (0, import_node_path4.join)(root, entry)).filter((path) => {
+    return (0, import_node_fs6.readdirSync)(root).filter((entry) => /^intel-rapl:\d+$/.test(entry)).map((entry) => (0, import_node_path6.join)(root, entry)).filter((path) => {
       try {
-        return /^package/.test((0, import_node_fs3.readFileSync)((0, import_node_path4.join)(path, "name"), "utf8").trim());
+        return /^package/.test((0, import_node_fs6.readFileSync)((0, import_node_path6.join)(path, "name"), "utf8").trim());
       } catch {
         return false;
       }
@@ -2884,8 +3805,8 @@ function restorePowerOriginals(paths, host) {
   const files = { ...originals?.files ?? {} };
   for (const domain of packageDomainPaths(paths.powercapRoot)) {
     for (const name of ["energy_uj", "max_energy_range_uj"]) {
-      const path = (0, import_node_path4.join)(domain, name);
-      if (!(0, import_node_fs3.existsSync)(path)) continue;
+      const path = (0, import_node_path6.join)(domain, name);
+      if (!(0, import_node_fs6.existsSync)(path)) continue;
       const original = files[path];
       if (original) {
         runRequired(host, "chown", [`${original.uid}:${original.gid}`, path], "restore counter ownership");
@@ -2901,7 +3822,7 @@ function restorePowerOriginals(paths, host) {
     }
   }
   try {
-    (0, import_node_fs3.unlinkSync)(powerOriginalPath(paths));
+    (0, import_node_fs6.unlinkSync)(powerOriginalPath(paths));
   } catch {
   }
   return restored;
@@ -2925,7 +3846,7 @@ function stopUnits(host, units) {
   if (units.some((unit) => systemdActive(host, unit))) throw new SystemError("service-active", "system services did not stop; no files were restored");
 }
 function unitsForCleanup(paths, host) {
-  const legacy = LEGACY_UNIT_NAMES.filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, unit)) || systemdActive(host, unit));
+  const legacy = LEGACY_UNIT_NAMES.filter((unit) => (0, import_node_fs6.existsSync)((0, import_node_path6.join)(paths.unitsDir, unit)) || systemdActive(host, unit));
   return [...Object.values(UNIT_NAMES), ...legacy];
 }
 function startUnits(host, units) {
@@ -2963,7 +3884,7 @@ async function verifySystemHealth(paths, state, host, timeoutMs, components = en
     const report = runRequired(
       host,
       state.nodePath,
-      [(0, import_node_path4.join)(paths.prefix, "current/dist/ops.cjs"), "inspect", "--database", hubDatabasePath(paths), "--json"],
+      [(0, import_node_path6.join)(paths.prefix, "current/dist/ops.cjs"), "inspect", "--database", hubDatabasePath(paths), "--json"],
       "activated database verification",
       { timeoutMs: Math.max(100, deadline - Date.now()) }
     );
@@ -2979,8 +3900,8 @@ async function verifySystemHealth(paths, state, host, timeoutMs, components = en
     let problem = "no sampling marker";
     while (Date.now() < deadline) {
       try {
-        const marker = readJsonObject((0, import_node_path4.join)(paths.stateDir, "collector/health.json"));
-        const lease = readJsonObject((0, import_node_path4.join)(paths.stateDir, "collector/collector-runtime.lock"));
+        const marker = readJsonObject((0, import_node_path6.join)(paths.stateDir, "collector/health.json"));
+        const lease = readJsonObject((0, import_node_path6.join)(paths.stateDir, "collector/collector-runtime.lock"));
         if (marker.pid !== lease.pid || !Number.isSafeInteger(marker.pid)) throw new Error("sampling marker belongs to another process");
         process.kill(Number(marker.pid), 0);
         if (marker.version !== state.currentVersion || !Number.isFinite(marker.sampledAt) || Date.now() - Number(marker.sampledAt) > 15e3) throw new Error("collector version or sampling freshness is wrong");
@@ -2988,32 +3909,35 @@ async function verifySystemHealth(paths, state, host, timeoutMs, components = en
       } catch (error) {
         problem = error instanceof Error ? error.message : String(error);
       }
-      await new Promise((resolve4) => setTimeout(resolve4, 100));
+      await new Promise((resolve5) => setTimeout(resolve5, 100));
     }
     throw new SystemError("collector-unready", `system collector did not sample: ${problem}`);
   }
 }
 function chownAccount(paths, owner, group, host) {
   for (const path of paths) {
-    if (!(0, import_node_fs3.existsSync)(path)) continue;
+    if (!(0, import_node_fs6.existsSync)(path)) continue;
     runRequired(host, "chown", ["-R", `${owner}:${group}`, path], `ownership ${path}`);
   }
 }
 function chmodTree(path, host) {
-  if (!(0, import_node_fs3.existsSync)(path)) return;
+  if (!(0, import_node_fs6.existsSync)(path)) return;
   runRequired(host, "chmod", ["-R", "u=rwX,go=rX", path], `release permissions ${path}`);
 }
 function pickRollbackBackup(state, previousSchema) {
   const backups = Object.values(state.backups).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
   if (previousSchema === null) return null;
-  return [...backups].reverse().find((backup) => backup.fromVersion === state.previousVersion && backup.toVersion === state.currentVersion && backup.schemaVersion !== null && backup.schemaVersion <= previousSchema) ?? null;
+  return [...backups].reverse().find((backup3) => backup3.fromVersion === state.previousVersion && backup3.toVersion === state.currentVersion && backup3.schemaVersion !== null && backup3.schemaVersion <= previousSchema) ?? null;
 }
 async function recoverFailedUpgrade(options) {
   stopUnits(options.host, options.units);
   assertDirectoryStopped(options.paths.stateDir);
-  replaceSymlink((0, import_node_path4.join)(options.paths.prefix, "current"), options.oldCurrent, options.host);
-  if (options.oldPrevious === null) removeSymlink((0, import_node_path4.join)(options.paths.prefix, "previous"));
-  else replaceSymlink((0, import_node_path4.join)(options.paths.prefix, "previous"), options.oldPrevious, options.host);
+  for (const message of undoMachineDataCleanup(systemMachineDataPaths(options.paths), options.machineData?.stagedQueues ?? null)) {
+    console.warn(`rigscope system upgrade recovery: ${message}`);
+  }
+  replaceSymlink((0, import_node_path6.join)(options.paths.prefix, "current"), options.oldCurrent, options.host);
+  if (options.oldPrevious === null) removeSymlink((0, import_node_path6.join)(options.paths.prefix, "previous"));
+  else replaceSymlink((0, import_node_path6.join)(options.paths.prefix, "previous"), options.oldPrevious, options.host);
   const database = hubDatabasePath(options.paths);
   let afterSchema = null;
   try {
@@ -3021,13 +3945,13 @@ async function recoverFailedUpgrade(options) {
   } catch {
     afterSchema = null;
   }
-  if (options.backupPath !== null && (0, import_node_fs3.existsSync)(options.backupPath) && (afterSchema === null || options.beforeSchema === null || afterSchema > options.beforeSchema)) {
-    await backupDatabase(database, (0, import_node_path4.join)(options.paths.stateDir, "backups", `failed-upgrade-${newestTimestamp()}.sqlite`), options.host);
+  if (options.backupPath !== null && (0, import_node_fs6.existsSync)(options.backupPath) && (afterSchema === null || options.beforeSchema === null || afterSchema > options.beforeSchema || options.machineData?.databaseCleared === true)) {
+    await backupDatabase(database, (0, import_node_path6.join)(options.paths.stateDir, "backups", `failed-upgrade-${newestTimestamp()}.sqlite`), options.host);
     replaceDatabaseFromBackup(options.backupPath, database, null, options.host);
     runRequired(options.host, "chown", [`${options.state.accounts.hub}:${options.state.accounts.hub}`, database], "restored database ownership");
   }
-  options.state.previousVersion = options.oldPrevious === null ? null : (0, import_node_path4.basename)(options.oldPrevious);
-  options.state.currentVersion = (0, import_node_path4.basename)(options.oldCurrent);
+  options.state.previousVersion = options.oldPrevious === null ? null : (0, import_node_path6.basename)(options.oldPrevious);
+  options.state.currentVersion = (0, import_node_path6.basename)(options.oldCurrent);
   writeSystemState(options.paths, options.state);
   if (options.activeComponents.length > 0) {
     startUnits(options.host, options.units);
@@ -3036,14 +3960,14 @@ async function recoverFailedUpgrade(options) {
 }
 function assertManagedFileOwnership(paths, path) {
   if (!isDefaultSystemLayout(paths)) return;
-  if (!(0, import_node_fs3.existsSync)(path)) return;
-  const stat = (0, import_node_fs3.lstatSync)(path);
+  if (!(0, import_node_fs6.existsSync)(path)) return;
+  const stat = (0, import_node_fs6.lstatSync)(path);
   if (stat.isSymbolicLink() || !stat.isFile()) throw new SystemError("unsafe-path", `${path} must be a regular managed file`);
   if (stat.uid !== 0) throw new SystemError("insecure-ownership", `${path} must be root-owned before replacement`);
   if ((stat.mode & 18) !== 0) throw new SystemError("insecure-permissions", `${path} must not be group/world-writable`);
 }
 function writeUnitFile(paths, unit, content, replace) {
-  const path = (0, import_node_path4.join)(paths.unitsDir, unit);
+  const path = (0, import_node_path6.join)(paths.unitsDir, unit);
   assertManagedFileOwnership(paths, path);
   writeManagedFile(path, content, 420, replace);
 }
@@ -3058,19 +3982,19 @@ function ensureComponentSetup(options) {
   ensureDirectory(paths.configDir, 493);
   ensureDirectory(paths.stateDir, 493);
   ensureDirectory(paths.unitsDir, 493);
-  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub"), 448, true);
-  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub", "run"), 448, true);
-  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "collector"), 448, true);
-  ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
+  ensureDirectory((0, import_node_path6.join)(paths.stateDir, "hub"), 448, true);
+  ensureDirectory((0, import_node_path6.join)(paths.stateDir, "hub", "run"), 448, true);
+  ensureDirectory((0, import_node_path6.join)(paths.stateDir, "collector"), 448, true);
+  ensureDirectory((0, import_node_path6.join)(paths.stateDir, "backups"), 448, true);
   const release = currentReleaseOrThrow(paths);
   void release;
   writeSysusersFiles(paths, accounts, "local", power, host);
   if (component === "hub") {
-    if (!(0, import_node_fs3.existsSync)(hubEnvPath(paths))) {
+    if (!(0, import_node_fs6.existsSync)(hubEnvPath(paths))) {
       const env = hubEnvTemplate(paths);
       writeManagedFile(hubEnvPath(paths), env, 384, false);
     }
-    if (!(0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, UNIT_NAMES.hub))) {
+    if (!(0, import_node_fs6.existsSync)((0, import_node_path6.join)(paths.unitsDir, UNIT_NAMES.hub))) {
       const env = readHubEnvironment(paths);
       const remote = env.HUB_PUBLIC_ORIGIN !== void 0 && env.HUB_PUBLIC_ORIGIN !== "";
       const unit = renderSystemHubUnit({
@@ -3087,7 +4011,7 @@ function ensureComponentSetup(options) {
 `, false);
     }
   } else {
-    if (!(0, import_node_fs3.existsSync)(collectorEnvPath(paths))) {
+    if (!(0, import_node_fs6.existsSync)(collectorEnvPath(paths))) {
       writeManagedFile(collectorEnvPath(paths), collectorEnvTemplate(), 384, false);
     }
     const unit = renderSystemCollectorUnit({
@@ -3103,17 +4027,17 @@ function ensureComponentSetup(options) {
   const validation = runRequired(
     host,
     "systemd-analyze",
-    ["verify", "--man=no", (0, import_node_path4.join)(paths.unitsDir, unitFor(component))],
+    ["verify", "--man=no", (0, import_node_path6.join)(paths.unitsDir, unitFor(component))],
     "native systemd unit validation"
   );
   if (/path is not absolute|bad unit file|fatal error|unknown (?:key|lvalue)|ignoring/i.test(validation.stderr)) {
     throw new SystemError("invalid-unit", "native systemd validation rejected a generated directive");
   }
-  if (component === "hub") chownAccount([(0, import_node_path4.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
-  if (component === "collector") chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+  if (component === "hub") chownAccount([(0, import_node_path6.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
+  if (component === "collector") chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
 }
 function ensurePowerAccess(paths, accounts, host) {
-  if (!(0, import_node_fs3.existsSync)(powerOriginalPath(paths))) capturePowerOriginals(paths);
+  if (!(0, import_node_fs6.existsSync)(powerOriginalPath(paths))) capturePowerOriginals(paths);
   writePowerRule(paths, accounts);
   resumePowerRule(paths, host);
   applyPowerAccess(paths, accounts, host);
@@ -3131,7 +4055,7 @@ function resetUnfinishedSystemState(options) {
 }
 function installPreset(options, role) {
   if (options.adoptFrom !== void 0) {
-    return componentSet(readAdoptionSetup((0, import_node_path4.resolve)(options.adoptFrom)).components);
+    return componentSet(readAdoptionSetup((0, import_node_path6.resolve)(options.adoptFrom)).components);
   }
   return componentsForRole(role);
 }
@@ -3143,11 +4067,11 @@ function planSystemInstall(options) {
   const power = options.power !== false && preset.collector;
   const initial = options.enable === true ? preset : { hub: false, collector: false };
   const files = [
-    { path: (0, import_node_path4.join)(paths.prefix, "current"), mode: "symlink", purpose: "active root-owned release" },
+    { path: (0, import_node_path6.join)(paths.prefix, "current"), mode: "symlink", purpose: "active root-owned release" },
     { path: hubEnvPath(paths), mode: "0600", purpose: "root-owned hub configuration" },
     { path: collectorEnvPath(paths), mode: "0600", purpose: "root-owned collector configuration" },
     { path: sysusersPath(paths), mode: "0644", purpose: "dedicated nologin accounts" },
-    ...COMPONENTS.map((component) => ({ path: (0, import_node_path4.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }))
+    ...COMPONENTS.map((component) => ({ path: (0, import_node_path6.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }))
   ];
   if (power) {
     files.push({ path: raplRulePath(paths), mode: "0644", purpose: "package RAPL read rule" });
@@ -3162,7 +4086,7 @@ function planSystemInstall(options) {
   ];
   const notes = [
     "Nothing is changed without --apply and root.",
-    options.adoptFrom ? `Adopts ${(0, import_node_path4.resolve)(options.adoptFrom)} by copy only; the original user setup is preserved.` : "Existing user services are not modified.",
+    options.adoptFrom ? `Adopts ${(0, import_node_path6.resolve)(options.adoptFrom)} by copy only; the original user setup is preserved.` : "Existing user services are not modified.",
     "One complete package: both runtimes, units and accounts are installed; --role only sets the initial enabled preset.",
     "Hub and collector use separate unprivileged accounts; Node gets no capabilities.",
     ...options.enable && preset.hub ? ["Enabling the hub creates its owner account once and prints the password once."] : [],
@@ -3195,8 +4119,8 @@ async function installSystemUnlocked(options) {
       `existing user service(s) detected (${detail}); stop them and use --adopt-user-state for explicit copy-based adoption`
     );
   }
-  const source = (0, import_node_path4.resolve)(options.source);
-  if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
+  const source = (0, import_node_path6.resolve)(options.source);
+  if (!(0, import_node_fs6.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
   const port = options.port ?? 8081;
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new SystemError("invalid-argument", "--port must be 1-65535");
   parseHubConfig(options.origin === void 0 ? { HUB_HOST: "127.0.0.1", HUB_PORT: String(port) } : { HUB_PUBLIC_ORIGIN: options.origin, HUB_SOCKET_PATH: hubSocketPath(paths) });
@@ -3217,14 +4141,14 @@ async function installSystemUnlocked(options) {
   });
   try {
     if (legacy) resetUnfinishedSystemState({ paths, host, now });
-    ensureDirectory((0, import_node_path4.join)(paths.prefix, "releases"), 493);
+    ensureDirectory((0, import_node_path6.join)(paths.prefix, "releases"), 493);
     ensureDirectory(paths.stateDir, 493);
     ensureDirectory(paths.configDir, 493);
     ensureDirectory(paths.unitsDir, 493);
-    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub"), 448, true);
-    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "collector"), 448, true);
-    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
-    ensureDirectory((0, import_node_path4.join)(paths.stateDir, "hub", "run"), 448, true);
+    ensureDirectory((0, import_node_path6.join)(paths.stateDir, "hub"), 448, true);
+    ensureDirectory((0, import_node_path6.join)(paths.stateDir, "collector"), 448, true);
+    ensureDirectory((0, import_node_path6.join)(paths.stateDir, "backups"), 448, true);
+    ensureDirectory((0, import_node_path6.join)(paths.stateDir, "hub", "run"), 448, true);
     const release = commitStagedRelease({ staged, paths, replaceRelease: options.replaceRelease });
     let adoption = null;
     if (options.adoptFrom) {
@@ -3257,13 +4181,13 @@ async function installSystemUnlocked(options) {
 `, true);
     writeUnitFile(paths, UNIT_NAMES.collector, `${collectorUnit}
 `, true);
-    const validation = runRequired(host, "systemd-analyze", ["verify", "--man=no", ...COMPONENTS.map((component) => (0, import_node_path4.join)(paths.unitsDir, unitFor(component)))], "native systemd unit validation");
+    const validation = runRequired(host, "systemd-analyze", ["verify", "--man=no", ...COMPONENTS.map((component) => (0, import_node_path6.join)(paths.unitsDir, unitFor(component)))], "native systemd unit validation");
     if (/path is not absolute|bad unit file|fatal error|unknown (?:key|lvalue)|ignoring/i.test(validation.stderr)) {
       throw new SystemError("invalid-unit", "native systemd validation rejected a generated directive");
     }
     if (power) ensurePowerAccess(paths, accounts, host);
-    chownAccount([(0, import_node_path4.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
-    chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
+    chownAccount([(0, import_node_path6.join)(paths.stateDir, "hub")], accounts.hub, accounts.hub, host);
+    chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], accounts.collector, accounts.collector, host);
     const state = emptyState({ paths, accounts, role, components: { hub: false, collector: false }, nodePath, now });
     state.currentVersion = release.version;
     state.releases[release.version] = {
@@ -3273,7 +4197,7 @@ async function installSystemUnlocked(options) {
     };
     state.adoption = adoption?.record ?? null;
     state.power = power ? { enabled: true, rulePath: raplRulePath(paths), group: accounts.powerGroup } : null;
-    replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), release.releaseDir, host);
+    replaceSymlink((0, import_node_path6.join)(paths.prefix, "current"), release.releaseDir, host);
     writeSystemState(paths, state);
     const wantsHub = preset.hub && (options.enable === true || options.start === true);
     const wantsCollector = preset.collector && (options.enable === true || options.start === true);
@@ -3299,6 +4223,7 @@ async function installSystemUnlocked(options) {
         await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, started);
       }
     }
+    recordMachineDataTransition(paths.stateDir, release.version, (path, content) => atomicWrite(path, content, 384));
     return {
       operation: "install",
       ok: true,
@@ -3327,14 +4252,14 @@ function systemStatus(options = {}) {
   } catch (error) {
     stateError = error instanceof Error ? error.message : String(error);
   }
-  const presentUnits = [UNIT_NAMES.hub, UNIT_NAMES.collector].filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, unit)));
+  const presentUnits = [UNIT_NAMES.hub, UNIT_NAMES.collector].filter((unit) => (0, import_node_fs6.existsSync)((0, import_node_path6.join)(paths.unitsDir, unit)));
   const publicRole = presentUnits.length === 2 ? "local" : presentUnits[0] === UNIT_NAMES.hub ? "hub" : presentUnits[0] === UNIT_NAMES.collector ? "collector" : null;
   const role = state?.role ?? publicRole ?? "local";
   const current = currentReleaseDir(paths);
   let publicVersion = null;
   if (current) {
     try {
-      const manifest = JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path4.join)(current, "package.json"), "utf8"));
+      const manifest = JSON.parse((0, import_node_fs6.readFileSync)((0, import_node_path6.join)(current, "package.json"), "utf8"));
       if (typeof manifest.version === "string") publicVersion = manifest.version;
     } catch {
     }
@@ -3345,7 +4270,7 @@ function systemStatus(options = {}) {
   const componentReports = {};
   for (const component of COMPONENTS) {
     const unit = unitFor(component);
-    const present = (0, import_node_fs3.existsSync)((0, import_node_path4.join)(paths.unitsDir, unit));
+    const present = (0, import_node_fs6.existsSync)((0, import_node_path6.join)(paths.unitsDir, unit));
     const active = present && systemdActive(host, unit);
     const unitEnabled = present && systemdEnabled(host, unit);
     const enabled = state !== null ? state.components[component].enabled : unitEnabled;
@@ -3354,7 +4279,7 @@ function systemStatus(options = {}) {
     componentReports[component] = {
       component,
       unit,
-      path: (0, import_node_path4.join)(paths.unitsDir, unit),
+      path: (0, import_node_path6.join)(paths.unitsDir, unit),
       present,
       enabled,
       unitEnabled,
@@ -3398,16 +4323,16 @@ function systemStatus(options = {}) {
     })),
     database: {
       path: database,
-      exists: (0, import_node_fs3.existsSync)(database),
+      exists: (0, import_node_fs6.existsSync)(database),
       schema,
-      mode: (0, import_node_fs3.existsSync)(database) ? modeString((0, import_node_fs3.statSync)(database).mode) : null,
+      mode: (0, import_node_fs6.existsSync)(database) ? modeString((0, import_node_fs6.statSync)(database).mode) : null,
       lock
     },
-    socket: { path: hubSocketPath(paths), exists: (0, import_node_fs3.existsSync)(hubSocketPath(paths)) },
+    socket: { path: hubSocketPath(paths), exists: (0, import_node_fs6.existsSync)(hubSocketPath(paths)) },
     config: {
       dir: paths.configDir,
-      hubEnv: { path: hubEnvPath(paths), present: (0, import_node_fs3.existsSync)(hubEnvPath(paths)) },
-      collectorEnv: { path: collectorEnvPath(paths), present: (0, import_node_fs3.existsSync)(collectorEnvPath(paths)) }
+      hubEnv: { path: hubEnvPath(paths), present: (0, import_node_fs6.existsSync)(hubEnvPath(paths)) },
+      collectorEnv: { path: collectorEnvPath(paths), present: (0, import_node_fs6.existsSync)(collectorEnvPath(paths)) }
     },
     adoption: state?.adoption ?? null,
     power,
@@ -3576,7 +4501,7 @@ async function enableSystem(options) {
     ],
     files: [
       { path: component === "hub" ? hubEnvPath(paths) : collectorEnvPath(paths), mode: "0600", purpose: `${component} configuration` },
-      { path: (0, import_node_path4.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }
+      { path: (0, import_node_path6.join)(paths.unitsDir, unitFor(component)), mode: "0644", purpose: `${component} boot unit` }
     ],
     notes: [
       "Enables only the requested component; the other component keeps running.",
@@ -3644,7 +4569,7 @@ function disableSystem(options) {
     accounts: state.accounts,
     commands: [`systemctl stop ${unitFor(component)}`, `systemctl disable ${unitFor(component)}`],
     files: [],
-    notes: ["Settings, credentials, history and outboxes are retained while the component is disabled."]
+    notes: ["Settings, credentials and stored history are retained while the component is disabled; unacknowledged samples held in the collector's RAM delivery queue drain with the process."]
   };
   if (options.apply !== true) return { operation: "disable", ok: true, apply: false, message: "plan only", plan };
   assertApply(host);
@@ -3666,7 +4591,7 @@ function disableSystem(options) {
 function readPrivateToken(path, read) {
   let stat;
   try {
-    stat = (0, import_node_fs3.lstatSync)(path);
+    stat = (0, import_node_fs6.lstatSync)(path);
   } catch (error) {
     if (error.code === "ENOENT") {
       throw new SystemError("missing-grant", `grant file does not exist: ${path}`);
@@ -3677,7 +4602,7 @@ function readPrivateToken(path, read) {
   if ((stat.mode & 63) !== 0) throw new SystemError("insecure-permissions", `grant file must be private (0600): ${path}`);
   if (stat.size < 1 || stat.size > 4096) throw new SystemError("invalid-token", `grant file must contain 1-4096 bytes: ${path}`);
   if (!read) return void 0;
-  const token = (0, import_node_fs3.readFileSync)(path, "utf8").trim();
+  const token = (0, import_node_fs6.readFileSync)(path, "utf8").trim();
   if (token === "" || /[\r\n\0]/.test(token) || !/^[\x21-\x7e]{1,256}$/.test(token)) {
     throw new SystemError("invalid-token", "grant file contains an invalid token");
   }
@@ -3689,7 +4614,7 @@ async function connectSystem(options) {
   const state = readSystemState(paths);
   if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
   const destination = connectDestinationUrl(options.url);
-  const tokenFile = (0, import_node_path4.resolve)(options.tokenFile);
+  const tokenFile = (0, import_node_path6.resolve)(options.tokenFile);
   const configured = collectorConfigured(paths);
   if (configured.configured) {
     throw new SystemError(
@@ -3737,12 +4662,12 @@ async function connectSystem(options) {
       `collector enrollment failed: ${error instanceof Error ? error.message : String(error)}`
     );
   } finally {
-    chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
+    chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
   }
   if (!collectorConfigured(paths).configured) {
     throw new SystemError("enrollment-failed", "the hub accepted enrollment but no destination was saved; check private state");
   }
-  chownAccount([(0, import_node_path4.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
+  chownAccount([(0, import_node_path6.join)(paths.stateDir, "collector")], state.accounts.collector, state.accounts.collector, host);
   writeSystemState(paths, state);
   const enabled = state.components.collector.enabled;
   if (enabled || wasActive) {
@@ -3759,13 +4684,16 @@ async function connectSystem(options) {
     state
   };
 }
+function systemMachineDataPaths(paths) {
+  return { database: hubDatabasePath(paths), queueTree: (0, import_node_path6.join)(paths.stateDir, "collector", "outbox") };
+}
 async function upgradeSystemUnlocked(options) {
   const host = options.host ?? createSystemHost();
   const now = options.now ?? Date.now;
   const paths = validateSystemPaths(options.paths);
   if (systemStateIsLegacy(paths)) {
-    const source2 = (0, import_node_path4.resolve)(options.source);
-    if (!(0, import_node_fs3.existsSync)(source2)) throw new SystemError("missing-source", `release source does not exist: ${source2}`);
+    const source2 = (0, import_node_path6.resolve)(options.source);
+    if (!(0, import_node_fs6.existsSync)(source2)) throw new SystemError("missing-source", `release source does not exist: ${source2}`);
     const role = legacySystemRole(paths);
     const preset = componentsForRole(role);
     const enable = options.enable ?? (options.start === true || unitNamesForComponents(preset).some((unit) => systemdEnabled(host, unit)));
@@ -3788,7 +4716,7 @@ async function upgradeSystemUnlocked(options) {
       ],
       files: [
         { path: stateFilePath(paths), mode: "0600", purpose: "canonical replacement state" },
-        { path: (0, import_node_path4.join)(paths.stateDir, "backups"), mode: "0700", purpose: "removed with unfinished history" }
+        { path: (0, import_node_path6.join)(paths.stateDir, "backups"), mode: "0700", purpose: "removed with unfinished history" }
       ],
       notes: [
         "An unfinished installation is reset, not migrated; its history and credentials are removed.",
@@ -3821,6 +4749,7 @@ async function upgradeSystemUnlocked(options) {
   if (state === null || !state.active) throw new SystemError("not-installed", "no active system installation; run install first");
   const activeComponents = COMPONENTS.filter((component) => systemdActive(host, unitFor(component)));
   const activeUnits = activeComponents.map(unitFor);
+  const transitionPending = readMachineDataTransition(paths.stateDir) === null;
   const plan = {
     operation: "upgrade",
     apply: options.apply === true,
@@ -3828,19 +4757,34 @@ async function upgradeSystemUnlocked(options) {
     components: { hub: state.components.hub.enabled, collector: state.components.collector.enabled },
     paths,
     accounts: state.accounts,
-    commands: ["stage new release", ...activeUnits.map((unit) => `systemctl stop ${unit}`), "backup database", "switch current", ...activeUnits.map((unit) => `systemctl start ${unit}`)],
-    files: [{ path: (0, import_node_path4.join)(paths.stateDir, "backups"), mode: "0700", purpose: "pre-upgrade database backup" }],
+    commands: [
+      "stage new release",
+      ...activeUnits.map((unit) => `systemctl stop ${unit}`),
+      "backup database",
+      ...transitionPending ? ["discard legacy machine data and collector queues once (irreversible after success)"] : [],
+      "switch current",
+      ...activeUnits.map((unit) => `systemctl start ${unit}`)
+    ],
+    files: [
+      { path: (0, import_node_path6.join)(paths.stateDir, "backups"), mode: "0700", purpose: "pre-upgrade database backup" },
+      ...transitionPending ? [{ path: (0, import_node_path6.join)(paths.stateDir, "machine-data-transition.json"), mode: "0600", purpose: "written once after the transition completes" }] : []
+    ],
     notes: [
       "Staging happens before any service is stopped.",
       "The exact active component set is restored; --start does not start a component that was stopped.",
-      "A failed post-upgrade start restores the previous release and matching database backup."
+      "A failed post-upgrade start restores the previous release and matching database backup.",
+      ...transitionPending ? [
+        "This upgrade completes the one-time RAM-first machine-data transition: telemetry rows, summaries, receipts, gaps, latest snapshots, inventory and machine-derived alert history are discarded, plus the pre-RAM-first durable collector queue. The transition's database copy restores the rows and the staged queue is renamed back if activation fails.",
+        `The transition always keeps ${machineDataKeptNote()}.`,
+        "Later upgrades keep the marker and preserve durable history and queues."
+      ] : ["The one-time machine-data transition already completed; durable history and collector queues are preserved."]
     ]
   };
   if (options.apply !== true) return { operation: "upgrade", ok: true, apply: false, message: "plan only", plan };
   assertApply(host);
   assertManagedPathSafety(paths, isDefaultSystemLayout(paths));
-  const source = (0, import_node_path4.resolve)(options.source);
-  if (!(0, import_node_fs3.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
+  const source = (0, import_node_path6.resolve)(options.source);
+  if (!(0, import_node_fs6.existsSync)(source)) throw new SystemError("missing-source", `release source does not exist: ${source}`);
   const staged = prepareStagedRelease({
     source,
     paths,
@@ -3859,21 +4803,22 @@ async function upgradeSystemUnlocked(options) {
     let backupPath = null;
     let beforeSchema = null;
     let release = null;
+    let machineData = null;
     try {
       stopUnits(host, activeUnits);
       assertDirectoryStopped(paths.stateDir);
       const lock = systemLockState(paths);
       if (lock.live) throw new SystemError("duplicate-runtime", `hub did not stop cleanly; lock remains at ${lock.path}`);
       const database = hubDatabasePath(paths);
-      if ((0, import_node_fs3.existsSync)(database)) {
-        ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
+      if ((0, import_node_fs6.existsSync)(database)) {
+        ensureDirectory((0, import_node_path6.join)(paths.stateDir, "backups"), 448, true);
         beforeSchema = databaseSchema(database);
-        backupPath = (0, import_node_path4.join)(paths.stateDir, "backups", `pre-upgrade-${staged.version}-${newestTimestamp()}.sqlite`);
+        backupPath = (0, import_node_path6.join)(paths.stateDir, "backups", `pre-upgrade-${staged.version}-${newestTimestamp()}.sqlite`);
         await backupDatabase(database, backupPath, host);
       }
       release = commitStagedRelease({ staged, paths, replaceRelease: options.replaceRelease });
-      replaceSymlink((0, import_node_path4.join)(paths.prefix, "previous"), oldCurrent, host);
-      replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), release.releaseDir, host);
+      replaceSymlink((0, import_node_path6.join)(paths.prefix, "previous"), oldCurrent, host);
+      replaceSymlink((0, import_node_path6.join)(paths.prefix, "current"), release.releaseDir, host);
       state.previousVersion = state.currentVersion;
       state.currentVersion = release.version;
       state.releases[release.version] = {
@@ -3882,7 +4827,7 @@ async function upgradeSystemUnlocked(options) {
         installedAt: new Date(now()).toISOString()
       };
       if (backupPath !== null) {
-        state.backups[(0, import_node_path4.basename)(backupPath)] = {
+        state.backups[(0, import_node_path6.basename)(backupPath)] = {
           path: backupPath,
           schemaVersion: beforeSchema,
           fromSchema: beforeSchema,
@@ -3893,6 +4838,7 @@ async function upgradeSystemUnlocked(options) {
         };
       }
       writeSystemState(paths, state);
+      machineData = performMachineDataCleanup(paths.stateDir, systemMachineDataPaths(paths), now);
       if (activeComponents.length > 0) {
         startUnits(host, activeUnits);
         await verifySystemHealth(paths, state, host, options.startupTimeoutMs ?? 2e4, activeComponents);
@@ -3905,6 +4851,7 @@ async function upgradeSystemUnlocked(options) {
         oldPrevious,
         beforeSchema,
         backupPath,
+        machineData,
         host,
         activeComponents,
         units: activeUnits
@@ -3912,6 +4859,10 @@ async function upgradeSystemUnlocked(options) {
       throw error;
     }
     const upgraded = release;
+    if (machineData !== null) {
+      completeMachineDataCleanup(paths.stateDir, machineData, upgraded.version, (path, content) => atomicWrite(path, content, 384));
+    }
+    const machineHistory = machineData?.report;
     return {
       operation: "upgrade",
       ok: true,
@@ -3921,6 +4872,7 @@ async function upgradeSystemUnlocked(options) {
       current: upgraded.releaseDir,
       previous: oldCurrent,
       backupPath,
+      ...machineHistory ? { machineHistory } : {},
       state
     };
   } finally {
@@ -3928,7 +4880,7 @@ async function upgradeSystemUnlocked(options) {
   }
 }
 function systemOperationLockPath(paths) {
-  return (0, import_node_path4.join)(paths.prefix, "run", "operation.lock");
+  return (0, import_node_path6.join)(paths.prefix, "run", "operation.lock");
 }
 async function withSystemOperation(options, operation) {
   if (!options.apply) return operation();
@@ -3936,7 +4888,7 @@ async function withSystemOperation(options, operation) {
   assertApply(host);
   const paths = validateSystemPaths(options.paths);
   ensureDirectory(paths.prefix, 493);
-  ensureDirectory((0, import_node_path4.join)(paths.prefix, "run"), 448, true);
+  ensureDirectory((0, import_node_path6.join)(paths.prefix, "run"), 448, true);
   const release = acquireProcessLease(systemOperationLockPath(paths));
   try {
     return await operation();
@@ -3988,24 +4940,24 @@ async function rollbackSystemUnlocked(options = {}) {
   try {
     stopUnits(host, units);
     assertDirectoryStopped(paths.stateDir);
-    if (systemLockState(paths).live || lockIsLive((0, import_node_path4.join)(paths.stateDir, "collector/collector-runtime.lock")).live) {
+    if (systemLockState(paths).live || lockIsLive((0, import_node_path6.join)(paths.stateDir, "collector/collector-runtime.lock")).live) {
       throw new SystemError("runtime-active", "runtime lease remains after stop; rollback refused");
     }
     const database = hubDatabasePath(paths);
-    const currentSchema = (0, import_node_fs3.existsSync)(database) ? databaseSchema(database) : null;
+    const currentSchema = (0, import_node_fs6.existsSync)(database) ? databaseSchema(database) : null;
     let backupToRestore = null;
     if (currentSchema !== null && (previousSchema === null || currentSchema > previousSchema)) {
       backupToRestore = pickRollbackBackup(state, previousSchema);
-      if (backupToRestore === null || !(0, import_node_fs3.existsSync)(backupToRestore.path)) {
+      if (backupToRestore === null || !(0, import_node_fs6.existsSync)(backupToRestore.path)) {
         throw new SystemError(
           "incompatible-schema",
           `current database schema ${currentSchema} is newer than release ${previousVersion}; no matching pre-upgrade backup is recorded`
         );
       }
     }
-    if ((0, import_node_fs3.existsSync)(database)) {
-      ensureDirectory((0, import_node_path4.join)(paths.stateDir, "backups"), 448, true);
-      safetyBackup = (0, import_node_path4.join)(paths.stateDir, "backups", `pre-rollback-${newestTimestamp()}.sqlite`);
+    if ((0, import_node_fs6.existsSync)(database)) {
+      ensureDirectory((0, import_node_path6.join)(paths.stateDir, "backups"), 448, true);
+      safetyBackup = (0, import_node_path6.join)(paths.stateDir, "backups", `pre-rollback-${newestTimestamp()}.sqlite`);
       await backupDatabase(database, safetyBackup, host);
     }
     if (backupToRestore !== null) {
@@ -4013,8 +4965,8 @@ async function rollbackSystemUnlocked(options = {}) {
       restoredDatabase = true;
       runRequired(host, "chown", [`${state.accounts.hub}:${state.accounts.hub}`, database], "restored database ownership");
     }
-    replaceSymlink((0, import_node_path4.join)(paths.prefix, "previous"), oldCurrent, host);
-    replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), previous, host);
+    replaceSymlink((0, import_node_path6.join)(paths.prefix, "previous"), oldCurrent, host);
+    replaceSymlink((0, import_node_path6.join)(paths.prefix, "current"), previous, host);
     state.previousVersion = state.currentVersion;
     state.currentVersion = previousVersion;
     state.updatedAt = new Date(now()).toISOString();
@@ -4036,10 +4988,10 @@ async function rollbackSystemUnlocked(options = {}) {
     };
   } catch (error) {
     stopUnits(host, units);
-    replaceSymlink((0, import_node_path4.join)(paths.prefix, "current"), oldCurrent, host);
-    replaceSymlink((0, import_node_path4.join)(paths.prefix, "previous"), previous, host);
+    replaceSymlink((0, import_node_path6.join)(paths.prefix, "current"), oldCurrent, host);
+    replaceSymlink((0, import_node_path6.join)(paths.prefix, "previous"), previous, host);
     if (restoredDatabase && safetyBackup) {
-      const failed = (0, import_node_path4.join)(paths.stateDir, "backups", `failed-rollback-${newestTimestamp()}.sqlite`);
+      const failed = (0, import_node_path6.join)(paths.stateDir, "backups", `failed-rollback-${newestTimestamp()}.sqlite`);
       await backupDatabase(hubDatabasePath(paths), failed, host);
       replaceDatabaseFromBackup(safetyBackup, hubDatabasePath(paths), null, host);
       runRequired(host, "chown", [`${state.accounts.hub}:${state.accounts.hub}`, hubDatabasePath(paths)], "restored database ownership");
@@ -4096,31 +5048,31 @@ function uninstallSystem(options = {}) {
   assertDirectoryStopped(paths.stateDir);
   for (const unit of units) runMaybe(host, "systemctl", ["disable", unit]);
   for (const unit of units) {
-    const path = (0, import_node_path4.join)(paths.unitsDir, unit);
+    const path = (0, import_node_path6.join)(paths.unitsDir, unit);
     assertManagedFileOwnership(paths, path);
     try {
-      (0, import_node_fs3.unlinkSync)(path);
+      (0, import_node_fs6.unlinkSync)(path);
     } catch {
     }
   }
   runMaybe(host, "systemctl", ["daemon-reload"]);
-  const hadPowerAccess = state?.power?.enabled === true || (0, import_node_fs3.existsSync)(raplRulePath(paths)) || (0, import_node_fs3.existsSync)(powerOriginalPath(paths));
+  const hadPowerAccess = state?.power?.enabled === true || (0, import_node_fs6.existsSync)(raplRulePath(paths)) || (0, import_node_fs6.existsSync)(powerOriginalPath(paths));
   if (hadPowerAccess) {
     try {
-      (0, import_node_fs3.unlinkSync)(raplRulePath(paths));
+      (0, import_node_fs6.unlinkSync)(raplRulePath(paths));
     } catch {
     }
     try {
-      (0, import_node_fs3.unlinkSync)(powerSysusersPath(paths));
+      (0, import_node_fs6.unlinkSync)(powerSysusersPath(paths));
     } catch {
     }
     restorePowerOriginals(paths, host);
     resumePowerRule(paths, host);
   }
-  removeSymlink((0, import_node_path4.join)(paths.prefix, "current"));
-  removeSymlink((0, import_node_path4.join)(paths.prefix, "previous"));
-  (0, import_node_fs3.rmSync)((0, import_node_path4.join)(paths.prefix, "releases"), { recursive: true, force: true });
-  if (options.preserveNode !== true) (0, import_node_fs3.rmSync)((0, import_node_path4.join)(paths.prefix, "node"), { recursive: true, force: true });
+  removeSymlink((0, import_node_path6.join)(paths.prefix, "current"));
+  removeSymlink((0, import_node_path6.join)(paths.prefix, "previous"));
+  (0, import_node_fs6.rmSync)((0, import_node_path6.join)(paths.prefix, "releases"), { recursive: true, force: true });
+  if (options.preserveNode !== true) (0, import_node_fs6.rmSync)((0, import_node_path6.join)(paths.prefix, "node"), { recursive: true, force: true });
   if (state !== null) {
     state.active = false;
     state.power = null;
@@ -4133,8 +5085,8 @@ function uninstallSystem(options = {}) {
     for (const group of [accounts.powerGroup, accounts.hub, accounts.collector]) runMaybe(host, "groupdel", [group]);
   }
   if (options.purgeData === true) {
-    (0, import_node_fs3.rmSync)(paths.stateDir, { recursive: true, force: true });
-    (0, import_node_fs3.rmSync)(paths.configDir, { recursive: true, force: true });
+    (0, import_node_fs6.rmSync)(paths.stateDir, { recursive: true, force: true });
+    (0, import_node_fs6.rmSync)(paths.configDir, { recursive: true, force: true });
   }
   return {
     operation: "uninstall",
@@ -4184,7 +5136,7 @@ function grantPower(options = {}) {
   writeManagedFile(powerSysusersPath(paths), renderPowerSysusers(paths, accounts), 420, true);
   runRequired(host, "systemd-sysusers", [], "power group creation");
   assertSystemAccounts(host, accounts, true, ["collector"]);
-  if (!(0, import_node_fs3.existsSync)(powerOriginalPath(paths))) capturePowerOriginals(paths);
+  if (!(0, import_node_fs6.existsSync)(powerOriginalPath(paths))) capturePowerOriginals(paths);
   writePowerRule(paths, accounts);
   resumePowerRule(paths, host);
   applyPowerAccess(paths, accounts, host);
@@ -4213,11 +5165,11 @@ function revokePower(options = {}) {
   if (options.apply !== true) return { operation: "power-revoke", ok: true, apply: false, message: "plan only", plan };
   assertApply(host);
   try {
-    (0, import_node_fs3.unlinkSync)(raplRulePath(paths));
+    (0, import_node_fs6.unlinkSync)(raplRulePath(paths));
   } catch {
   }
   try {
-    (0, import_node_fs3.unlinkSync)(powerSysusersPath(paths));
+    (0, import_node_fs6.unlinkSync)(powerSysusersPath(paths));
   } catch {
   }
   restorePowerOriginals(paths, host);
@@ -4433,6 +5385,12 @@ function printMutationReport(report) {
     console.log("then run `rigscope system connect https://<hub> --token-file <file> --apply`.");
   }
 }
+function printMachineDataOutcome(machineHistory) {
+  if (machineHistory === void 0) return;
+  const described = describeMachineDataReport(machineHistory);
+  console.log(described.summary);
+  if (described.warning) console.log(`Warning: ${described.warning}`);
+}
 async function runSystemCommand(argv) {
   const parsed = parseSystemArgs(argv);
   if (parsed.command === "help") {
@@ -4504,7 +5462,7 @@ ${humanPlan(report.plan)}`);
     if (parsed.command === "logs") {
       const selected = validateSystemPaths(paths);
       const component = componentFrom(parsed, false);
-      const units = (component ? [unitFor(component)] : [UNIT_NAMES.hub, UNIT_NAMES.collector]).filter((unit) => (0, import_node_fs3.existsSync)((0, import_node_path4.join)(selected.unitsDir, unit)));
+      const units = (component ? [unitFor(component)] : [UNIT_NAMES.hub, UNIT_NAMES.collector]).filter((unit) => (0, import_node_fs6.existsSync)((0, import_node_path6.join)(selected.unitsDir, unit)));
       if (units.length === 0) throw new SystemError("not-installed", component ? `${component} logs are unavailable; its unit is not installed` : "no system services installed");
       const result = (0, import_node_child_process.spawnSync)("journalctl", [...units.flatMap((unit) => ["--unit", unit]), "--lines=100", "--no-pager", ...boolValue(values, "follow") ? ["--follow"] : []], { stdio: "inherit" });
       if (result.error) throw result.error;
@@ -4580,6 +5538,7 @@ ${humanPlan(report.plan)}`);
       else {
         printMutationReport(report);
         console.log(`Backup: ${report.backupPath ?? "none"}`);
+        printMachineDataOutcome(report.machineHistory);
       }
       return 0;
     }