@camstack/addon-mqtt-broker 1.2.151 → 1.2.153

package/dist/mqtt-broker.addon.mjs

@@ -6021,7 +6021,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DEZaLbiu.mjs
+//#region ../types/dist/sleep-CmjWurK5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6705,137 +6705,86 @@ async function runAddonMigrations(host, migrations, logger, options = {}) {
 		blockOwner
 	};
 }
-/**
-* Build a {@link DurableState} over a single store key. Transport-agnostic:
-* `read`/`write` are the addon-store or device-store accessors. The whole
-* validated value round-trips on every read/write — the schema is the
-* single source of truth for what is persisted, so no hand-listed field
-* set can drop a key on save.
-*/
-function createDurableState(deps) {
-	const get = async () => {
-		const raw = (await deps.read())[deps.key];
-		if (raw === void 0) return deps.fallback;
-		const parsed = deps.schema.safeParse(raw);
-		if (!parsed.success) {
-			deps.onParseError?.(deps.key, parsed.error);
-			return deps.fallback;
-		}
-		return parsed.data;
-	};
-	const set = async (next) => {
-		const validated = deps.schema.parse(next);
-		await deps.write({ [deps.key]: validated });
-	};
-	const update = async (fn) => {
-		await set(fn(await get()));
-	};
+/** The record calls the one-switch migration makes, over the migration API. */
+function switchRecordsOverMigrationApi(api) {
+	return { kind: (definition) => {
+		const handle = api.records.kind(definition);
+		return {
+			get: (id) => handle.get({ id }),
+			put: (input, opts) => handle.put({
+				...input,
+				...opts?.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+			}),
+			patch: (id, partial) => handle.patch({
+				id,
+				partial
+			})
+		};
+	} };
+}
+function integrationRowsApiOver(api) {
 	return {
-		get,
-		set,
-		update
+		list: async () => (await api.integrations.list({})).integrations,
+		readLegacyIntegrationRows: (input) => api.legacyRows.read(input),
+		clearLegacyIntegrationRows: (input) => api.legacyRows.clear(input)
 	};
 }
-/**
-* Per-node scoping for the shared addon-settings blob.
-*
-* An addon's settings store is hub-central (the `addon-settings` cap is
-* hub-routed — the hub instance answers for every node), so fields whose
-* value is a NODE fact (decoder backend, engine pick, probed hardware
-* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
-* the single shared blob. The SCHEMA field key stays bare: the write path
-* ({@link scopePatch}) maps the bare field onto the target node's scoped
-* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
-* back, so UI forms and `resolveConfig` only ever see the bare key.
-*
-* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
-* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
-* schema and routes reads/writes through these helpers.
-*
-* ## No bare-key fallback — deliberate
-*
-* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
-* scoped key resolves to `undefined` so the field's schema `default` wins —
-* NEVER `store[base]` and never another node's value. A bare legacy key in
-* the store is invisible to every node, hub included, so one node's
-* selection can never leak onto another. (This generalizes the
-* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
-* arbitrary set of per-node field keys.)
-*
-* Pure functions only — no I/O, no imports beyond the language. This is a
-* LEAF module: import it via its deep path, never from the root barrel.
-*/
-/**
-* Normalize a raw kernel node id to the bare node id used for scoping.
-* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
-* processes; per-node settings are per-NODE, so strip the addon segment.
-* `undefined` / `null` / empty falls back to `'hub'`.
-*/
-function normalizeNodeId(raw) {
-	if (raw === void 0 || raw === null || raw === "") return "hub";
-	const slashIdx = raw.indexOf("/");
-	if (slashIdx < 0) return raw;
-	const bare = raw.slice(0, slashIdx);
-	return bare === "" ? "hub" : bare;
-}
-/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
-function nodeScopedKey(base, nodeId) {
-	return `${base}@${normalizeNodeId(nodeId)}`;
-}
-/**
-* Read a node's value for a per-node field from the raw shared store:
-* the node-scoped key when present, otherwise `undefined`.
-* Deliberately NO bare-key fallback (see module doc) — the caller lets the
-* schema `default` win on `undefined`.
-*/
-function readNodeValue(store, base, nodeId) {
-	return store[nodeScopedKey(base, nodeId)];
-}
-/**
-* Re-map a UI/settings patch so every bare perNode field persists under the
-* TARGET node's scoped key; all other keys pass through unchanged. Used on
-* the write path so a save for one node never clobbers another node's value
-* (and the bare key is never written). Returns a new object — the input
-* patch is not mutated.
-*/
-function scopePatch(patch, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
-	return out;
-}
-/**
-* Project the raw shared store onto the bare schema keys for ONE node so a
-* UI schema (whose field keys are bare) hydrates from that node's own
-* values:
-*
-* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
-* - Every bare perNode key is dropped from the pass-through (a stray bare
-*   legacy key must never hydrate any node — no bare fallback).
-* - THIS node's effective value ({@link readNodeValue}) is then laid onto
-*   each bare perNode key; when the node has no scoped key the bare key is
-*   left ABSENT so the field's schema `default` wins.
-*
-* Returns a new object — the input store is not mutated.
-*/
-function projectStore(store, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(store)) {
-		if (key.includes("@")) continue;
-		if (perNodeKeys.has(key)) continue;
-		out[key] = value;
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
 	}
-	for (const base of perNodeKeys) {
-		const value = readNodeValue(store, base, nodeId);
-		if (value !== void 0) out[base] = value;
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
 	}
-	return out;
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+function linkTargetOf(meta) {
+	if (typeof meta !== "object" || meta === null) return void 0;
+	const link = Reflect.get(meta, "link");
+	const parsed = LinkTargetSchema.safeParse(link);
+	return parsed.success ? parsed.data : void 0;
+}
+var LinkTargetSchema = object({
+	cap: string().min(1),
+	kind: string().min(1).optional()
+});
+/** The links a kind declares, read from the meta of its body fields. */
+function linksOfKind(kind) {
+	const schema = kind.schema;
+	if (!(schema instanceof ZodObject)) return [];
+	const links = [];
+	for (const [field, fieldSchema] of Object.entries(schema.shape)) {
+		const to = linkTargetOf(globalRegistry.get(fieldSchema));
+		if (to !== void 0) links.push({
+			field,
+			to
+		});
+	}
+	return links;
 }
-/** Every scope, in the order the guard and the docs list them. */
-var SCOPED_SETTINGS_SCOPES = [
-	"cluster",
-	"device-defaults",
-	"node"
-];
 /**
 * The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
 *
@@ -6970,6 +6919,643 @@ function parseSecretRef(ref) {
 		fieldPath
 	};
 }
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each,
+			map
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$6(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$6(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$6(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	if (segment.map) {
+		if (!isRecord$6(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* A stored secret, as an admin read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by ref
+* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
+* stored secret (the records door reads a view as KEEP).
+*
+* ONE implementation for the entries service and for every addon that serves
+* its own instances (`RecordIntegrationInstances`).
+*/
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function secretViewsOf(owner, kind, id, decl, data) {
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord$5(shown) ? shown : data;
+}
+/** The most instances one addon lists (an integrations page, not a table). */
+var INSTANCES_LIST_MAX = 1e3;
+/**
+* The ONE reader of an instance's switch (D996): an absent field means on, so a row written
+* before the field existed needs no migration. Every consumer of an instance body asks this.
+*/
+function isInstanceEnabled(body) {
+	return body.enabled !== false;
+}
+/** The body key of the switch; only {@link RecordIntegrationInstances.setInstanceEnabled} writes it. */
+var SWITCH_KEY = "enabled";
+/** The keys of the kind's secret fields that sit at the top level of the body. */
+function topLevelSecretKeys(paths) {
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+var RecordIntegrationInstances = class {
+	records;
+	kind;
+	hooks;
+	handle;
+	secretKeys;
+	secretMaps;
+	nameField;
+	switchListeners = /* @__PURE__ */ new Set();
+	constructor(records, kind, hooks) {
+		this.records = records;
+		this.kind = kind;
+		this.hooks = hooks;
+		this.handle = records.kind(kind);
+		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
+		this.nameField = kind.declaration.entry?.nameField ?? "name";
+	}
+	/**
+	* One instance read for the addon's own runtime; null when absent. When the keychain is
+	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
+	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
+	*/
+	async readResolved(id) {
+		try {
+			const record = await this.handle.getResolved(id);
+			return record === null ? null : {
+				id,
+				body: record.data,
+				enabled: isInstanceEnabled(record.data),
+				secrets: "resolved"
+			};
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.handle.get(id);
+			if (stored === null) return null;
+			return {
+				id,
+				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
+				enabled: isInstanceEnabled(stored.data),
+				secrets: "unavailable"
+			};
+		}
+	}
+	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
+	async getResolved(id) {
+		return (await this.readResolved(id))?.body ?? null;
+	}
+	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
+	async listResolved() {
+		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
+		const out = [];
+		for (const record of page.records) {
+			const read = await this.readResolved(record.id);
+			if (read !== null) out.push(read);
+		}
+		return out;
+	}
+	viewOf(record) {
+		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
+		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
+		return {
+			id: record.id,
+			name: typeof rawName === "string" ? rawName : record.id,
+			configured: this.hooks.configured(record.data),
+			enabled: isInstanceEnabled(record.data),
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
+		};
+	}
+	describe = async () => {
+		const declared = linksOfKind(this.kind);
+		const links = this.hooks.description.links !== void 0 || declared.length === 0 ? {} : { links: declared.map((link) => ({
+			kind: this.kind.name,
+			field: link.field,
+			to: link.to
+		})) };
+		return {
+			...this.hooks.description,
+			...links,
+			...this.hooks.mintId === void 0 ? {} : { mintsId: true }
+		};
+	};
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
+	listInstances = async () => {
+		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
+	};
+	getInstance = async ({ id }) => {
+		const record = await this.handle.get(id);
+		return record === null ? null : this.viewOf(record);
+	};
+	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
+	createInstance = async ({ id, name, kind, values }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		await this.handle.put({
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
+		}, { ifRev: 0 });
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
+	};
+	updateInstance = async ({ id, name, values }) => {
+		const patch = this.patchOf(values);
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
+	patchOf(values) {
+		const patch = {};
+		for (const [key, value] of Object.entries(values)) {
+			if (value === void 0) continue;
+			if (key === "enabled") continue;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
+			else if (isSecretClear(value)) patch[key] = null;
+			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
+		}
+		return patch;
+	}
+	/**
+	* Listen to the switch of ANY instance of this helper (in the process that serves it). The
+	* durable replacement of the `integration.enabled` / `integration.disabled` events (D8): the
+	* addon reconciles from the record, whichever way it flipped.
+	*/
+	onSwitched(listener) {
+		this.switchListeners.add(listener);
+	}
+	/**
+	* The ONE writer of the switch (D996, D1014): the record body's `enabled`, for every role. A
+	* configured thing is an instance, so an id with no record yet (a default integration that was
+	* never configured) gets its record from `initialBody` before the switch is written.
+	*/
+	setInstanceEnabled = async ({ id, enabled }) => {
+		if (await this.handle.get(id) === null) await this.handle.put({
+			id,
+			data: this.hooks.initialBody(id)
+		}, { ifRev: 0 });
+		await this.handle.patch(id, { [SWITCH_KEY]: enabled });
+		await this.hooks.onChanged?.(id, "enabled");
+		for (const listener of this.switchListeners) await listener(id, enabled);
+		return { ok: true };
+	};
+	/** The row and its keychain refs go together (the records door). */
+	deleteInstance = async ({ id }) => {
+		await this.handle.delete(id);
+		await this.hooks.onChanged?.(id, "deleted");
+		return { ok: true };
+	};
+	testInstance = async (input) => {
+		if (this.hooks.test === void 0) return {
+			success: false,
+			status: "unsupported",
+			error: "This integration declares no connection test"
+		};
+		return this.hooks.test(input);
+	};
+	/** The flat provider object to hand to `registerProvider`. */
+	toProvider() {
+		return {
+			describe: this.describe,
+			instanceFormSchema: this.instanceFormSchema,
+			listInstances: this.listInstances,
+			getInstance: this.getInstance,
+			createInstance: this.createInstance,
+			updateInstance: this.updateInstance,
+			setInstanceEnabled: this.setInstanceEnabled,
+			deleteInstance: this.deleteInstance,
+			testInstance: this.testInstance
+		};
+	}
+};
+/**
+* The one-switch migration (epic #440, step 3). An integration's on/off state used to live in the
+* registry's `enabled` column for a device addon; it now lives only in the instance record's
+* body (`enabled`, D1007 superseded). This moves a registry `enabled = false` into the body, once.
+*
+* For every registry row of the addon that is OFF:
+*  - no record under its id: the record is created from `initialBody(name)` with `enabled: false`
+*    (a default integration that never had settings, Reolink's among them);
+*  - a record whose body states no `enabled`: `enabled: false` is written into it;
+*  - a record that already states `enabled` (either way) is the newer truth and is left alone.
+* A row that is ON writes nothing: an absent field reads as on. A rerun finds every off row with
+* a stated switch and does nothing, so nothing switched off comes back on and nothing switched on
+* goes off. The registry column itself is neither read afterwards nor written; its drop is step 5.
+*
+* It runs in the addon process, BEFORE the addon registers its `integration-instances` provider,
+* which is also why `integrations.list` still answers the stored column at that point.
+*/
+function registrySwitchToBodyId(addonId, date) {
+	return `${addonId}/${date}-registry-switch-to-body`;
+}
+async function moveRegistrySwitchToBody(ports, spec) {
+	const rows = await ports.listIntegrations(spec.addonId);
+	let created = 0;
+	let switched = 0;
+	let kept = 0;
+	for (const row of rows) {
+		if (row.enabled) continue;
+		const body = await ports.readBody(row.id);
+		if (body === null) {
+			if (await ports.createRecord(row.id, {
+				...spec.initialBody(row.name),
+				["enabled"]: false
+			}) === "created") created += 1;
+			else kept += 1;
+			continue;
+		}
+		if ("enabled" in body) {
+			kept += 1;
+			continue;
+		}
+		await ports.switchOff(row.id);
+		switched += 1;
+	}
+	const summary = {
+		integrations: rows.length,
+		off: rows.filter((r) => !r.enabled).length,
+		created,
+		switched,
+		kept
+	};
+	return created === 0 && switched === 0 ? {
+		outcome: "already-done",
+		summary
+	} : {
+		outcome: "done",
+		summary
+	};
+}
+/** A migration entry: an addon states its kind and how a new body starts, nothing else. */
+function registrySwitchToBodyMigration(spec) {
+	return {
+		meta: {
+			id: registrySwitchToBodyId(spec.addonId, spec.date),
+			owner: spec.addonId,
+			level: "addon-state",
+			seq: spec.seq,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Move the registry enabled flag of every switched-off integration into its instance record body, creating the record when there is none",
+			fixtureMark: "enabled"
+		},
+		procedure: (ports) => moveRegistrySwitchToBody(ports, {
+			addonId: spec.addonId,
+			initialBody: spec.initialBody
+		})
+	};
+}
+/** The hub and records sides of {@link registrySwitchToBodyMigration}. */
+function registrySwitchPortsOver(deps) {
+	const handle = deps.records.kind({
+		name: deps.kind.name,
+		declaration: deps.kind.declaration,
+		schema: record(string(), unknown())
+	});
+	return {
+		listIntegrations: async (addonId) => (await deps.api.list()).filter((i) => i.addonId === addonId).map((i) => ({
+			id: i.id,
+			name: i.name,
+			enabled: i.enabled !== false
+		})),
+		readBody: async (id) => (await handle.get(id))?.data ?? null,
+		createRecord: async (id, body) => {
+			if (await handle.get(id) !== null) return "exists";
+			await handle.put({
+				id,
+				data: body
+			}, { ifRev: 0 });
+			return "created";
+		},
+		switchOff: async (id) => {
+			await handle.patch(id, { [SWITCH_KEY]: false });
+		}
+	};
+}
+/**
+* Build a {@link DurableState} over a single store key. Transport-agnostic:
+* `read`/`write` are the addon-store or device-store accessors. The whole
+* validated value round-trips on every read/write — the schema is the
+* single source of truth for what is persisted, so no hand-listed field
+* set can drop a key on save.
+*/
+function createDurableState(deps) {
+	const get = async () => {
+		const raw = (await deps.read())[deps.key];
+		if (raw === void 0) return deps.fallback;
+		const parsed = deps.schema.safeParse(raw);
+		if (!parsed.success) {
+			deps.onParseError?.(deps.key, parsed.error);
+			return deps.fallback;
+		}
+		return parsed.data;
+	};
+	const set = async (next) => {
+		const validated = deps.schema.parse(next);
+		await deps.write({ [deps.key]: validated });
+	};
+	const update = async (fn) => {
+		await set(fn(await get()));
+	};
+	return {
+		get,
+		set,
+		update
+	};
+}
+/**
+* Per-node scoping for the shared addon-settings blob.
+*
+* An addon's settings store is hub-central (the `addon-settings` cap is
+* hub-routed — the hub instance answers for every node), so fields whose
+* value is a NODE fact (decoder backend, engine pick, probed hardware
+* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
+* the single shared blob. The SCHEMA field key stays bare: the write path
+* ({@link scopePatch}) maps the bare field onto the target node's scoped
+* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
+* back, so UI forms and `resolveConfig` only ever see the bare key.
+*
+* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
+* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
+* schema and routes reads/writes through these helpers.
+*
+* ## No bare-key fallback — deliberate
+*
+* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
+* scoped key resolves to `undefined` so the field's schema `default` wins —
+* NEVER `store[base]` and never another node's value. A bare legacy key in
+* the store is invisible to every node, hub included, so one node's
+* selection can never leak onto another. (This generalizes the
+* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
+* arbitrary set of per-node field keys.)
+*
+* Pure functions only — no I/O, no imports beyond the language. This is a
+* LEAF module: import it via its deep path, never from the root barrel.
+*/
+/**
+* Normalize a raw kernel node id to the bare node id used for scoping.
+* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
+* processes; per-node settings are per-NODE, so strip the addon segment.
+* `undefined` / `null` / empty falls back to `'hub'`.
+*/
+function normalizeNodeId(raw) {
+	if (raw === void 0 || raw === null || raw === "") return "hub";
+	const slashIdx = raw.indexOf("/");
+	if (slashIdx < 0) return raw;
+	const bare = raw.slice(0, slashIdx);
+	return bare === "" ? "hub" : bare;
+}
+/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
+function nodeScopedKey(base, nodeId) {
+	return `${base}@${normalizeNodeId(nodeId)}`;
+}
+/**
+* Read a node's value for a per-node field from the raw shared store:
+* the node-scoped key when present, otherwise `undefined`.
+* Deliberately NO bare-key fallback (see module doc) — the caller lets the
+* schema `default` win on `undefined`.
+*/
+function readNodeValue(store, base, nodeId) {
+	return store[nodeScopedKey(base, nodeId)];
+}
+/**
+* Re-map a UI/settings patch so every bare perNode field persists under the
+* TARGET node's scoped key; all other keys pass through unchanged. Used on
+* the write path so a save for one node never clobbers another node's value
+* (and the bare key is never written). Returns a new object — the input
+* patch is not mutated.
+*/
+function scopePatch(patch, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
+	return out;
+}
+/**
+* Project the raw shared store onto the bare schema keys for ONE node so a
+* UI schema (whose field keys are bare) hydrates from that node's own
+* values:
+*
+* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
+* - Every bare perNode key is dropped from the pass-through (a stray bare
+*   legacy key must never hydrate any node — no bare fallback).
+* - THIS node's effective value ({@link readNodeValue}) is then laid onto
+*   each bare perNode key; when the node has no scoped key the bare key is
+*   left ABSENT so the field's schema `default` wins.
+*
+* Returns a new object — the input store is not mutated.
+*/
+function projectStore(store, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(store)) {
+		if (key.includes("@")) continue;
+		if (perNodeKeys.has(key)) continue;
+		out[key] = value;
+	}
+	for (const base of perNodeKeys) {
+		const value = readNodeValue(store, base, nodeId);
+		if (value !== void 0) out[base] = value;
+	}
+	return out;
+}
+/** Every scope, in the order the guard and the docs list them. */
+var SCOPED_SETTINGS_SCOPES = [
+	"cluster",
+	"device-defaults",
+	"node"
+];
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -6980,7 +7566,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$6(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6993,7 +7579,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$6(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -7048,7 +7634,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$6) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -7064,7 +7650,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$6(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -7089,7 +7675,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$6(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -7097,7 +7683,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$6(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -7220,7 +7806,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$6(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -7252,7 +7838,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$5(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -7281,7 +7867,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$5(item) && isRecord$5(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -7292,7 +7878,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$5(value) && isRecord$5(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -7300,7 +7886,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$5(incoming) || !isRecord$5(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -7331,7 +7917,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$5(a) && isRecord$5(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -7355,7 +7941,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$5(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7650,6 +8236,28 @@ var SECRET_RETRY_MAX_MS = 5 * 6e4;
 /** Coalesces a burst of `keychain.changed` events into one re-resolve. */
 var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
+* Pair a catalogue with the function that builds its ports FROM THE MIGRATION API. The one
+* place a catalogue is bound: a migration reaches nothing a ports binder cannot reach
+* through `api` (guard `check-migration-ports-surface`).
+*/
+function migrationSet(catalogue, bindPorts) {
+	return { bind: (api) => defineAddonMigrations(catalogue, bindPorts(api)) };
+}
+/** A mixed array is a mistake: the other kind would be dropped without a word. */
+function refuseMixed(form, kept, dropped) {
+	if (dropped > 0) throw new Error(`runMigrations(${form}): ${dropped} of ${kept + dropped} entries are of the other kind and would be dropped; pass one kind per call`);
+}
+function catalogueOf(list) {
+	const kept = list.filter((entry) => !("execute" in entry));
+	refuseMixed("catalogue, (api) => ports", kept.length, list.length - kept.length);
+	return kept;
+}
+function boundOf(list) {
+	const kept = list.filter((entry) => "execute" in entry);
+	refuseMixed("bound migrations", kept.length, list.length - kept.length);
+	return kept;
+}
+/**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
@@ -7816,29 +8424,62 @@ var BaseAddon = class {
 		await this.loadScopedSchemas();
 		return normalized;
 	}
-	/**
-	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
-	* engine. Call it at the point of the boot where the data must already have the new
-	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
-	* restored devices — with the catalogue bound to the addon's ports
-	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
-	*
-	* An engine that cannot be reached or refuses the catalogue is logged and runs
-	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
-	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
-	* serve data whose shape it cannot trust; `tolerate` migrations never do.
-	*
-	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
-	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
-	* omitted applied ids "newer").
-	*/
-	async runMigrations(migrations, options) {
+	async runMigrations(first, second, third) {
+		if (typeof second === "function") return this.runMigrationSets([migrationSet(catalogueOf(first), second)], third);
+		return this.runBound(boundOf(first), second);
+	}
+	/**
+	* Several catalogues of ONE owner in one declaration (the engine replaces an owner's
+	* catalogue on every declare, so two calls would each judge the other's ids "newer").
+	* Build each entry with `migrationSet(catalogue, (api) => ports)`.
+	*/
+	async runMigrationSets(sets, options) {
+		const api = this.ctx.migrationApi;
+		if (api === void 0) throw new Error(`${this.ctx.id}: the migration API is not available on this context`);
+		return this.runBound(sets.flatMap((set) => set.bind(api)), options);
+	}
+	/**
+	* A device addon states its instance kind once, before its migrations run, and the one-switch
+	* migration (registry `enabled` to the instance body, epic #440 step 3) joins whatever
+	* catalogue the addon runs, in the SAME declaration (the engine replaces an owner's catalogue
+	* on every declare).
+	*/
+	declareRegistrySwitch(spec) {
+		this.registrySwitchSpec = spec;
+	}
+	registrySwitchSpec = null;
+	registrySwitchBound() {
+		const spec = this.registrySwitchSpec;
+		if (spec === null) return [];
+		const api = this.ctx.migrationApi;
+		if (api === void 0) {
+			this.ctx.logger.warn("the registry switch migration is skipped: the migration API is not available on this context");
+			return [];
+		}
+		return migrationSet([registrySwitchToBodyMigration({
+			addonId: this.ctx.id,
+			date: "2026-11-06",
+			seq: 1e3,
+			initialBody: spec.initialBody
+		})], (a) => registrySwitchPortsOver({
+			api: integrationRowsApiOver(a),
+			records: switchRecordsOverMigrationApi(a),
+			kind: spec.kind
+		})).bind(api);
+	}
+	async runBound(declared, options) {
+		const added = this.registrySwitchBound();
+		const migrations = [...declared, ...added];
+		const phased = options?.only === void 0 || added.length === 0 ? options : {
+			...options,
+			only: [...options.only, ...added.map((m) => m.meta.id)]
+		};
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger, options);
+		}, migrations, this.ctx.logger, phased);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -8911,221 +9552,6 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
-var PREFIX = "records/";
-/** The base of every records failure. `detail` is the human part of the message. */
-var RecordsError = class extends Error {
-	code;
-	detail;
-	constructor(code, detail) {
-		super(`${PREFIX}${code}: ${detail}`);
-		this.name = "RecordsError";
-		this.code = code;
-		this.detail = detail;
-	}
-};
-/** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
-	constructor(detail) {
-		super("secret-unavailable", detail);
-		this.name = "RecordSecretUnavailableError";
-	}
-};
-var InvalidRecordError = class extends RecordsError {
-	constructor(detail) {
-		super("invalid-record", detail);
-		this.name = "InvalidRecordError";
-	}
-};
-/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
-	constructor(detail) {
-		super("declaration-refused", detail);
-		this.name = "DeclarationRefusedError";
-	}
-};
-/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
-/** The files a kind may live in. `history` is device-history's (D850), never records. */
-var RECORD_DATABASES = ["settings", "events"];
-/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
-var RECORD_CLASSES = [
-	"config",
-	"ledger",
-	"audit",
-	"mirror",
-	"ephemeral"
-];
-var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
-var RECORD_MAX_DATA_BYTES = 1024 * 1024;
-var RECORD_BATCH_MAX = 1e3;
-var RECORD_QUERY_MAX = 1e3;
-/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
-var RECORD_SETTINGS_MAX_ROWS = 5e4;
-/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
-var RECORD_SECRET_COLLECTION_PREFIX = "records:";
-/**
-* Secret fields of a record, addressed the way a Zod schema declares them
-* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
-* (`auth.accessToken`, `headers[].value`).
-*
-* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
-* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
-* key releases exactly that key's secret.
-*
-* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
-* `{ headers: 'name' }`), never by index, so reordering a list keeps every
-* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
-* leaf names its element: `headers[X-Api].value`.
-*
-* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
-*/
-/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
-function parseSecretPath(path) {
-	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
-	return path.split(".").map((raw) => {
-		const each = raw.endsWith("[]");
-		const map = raw.endsWith("{}");
-		const key = each || map ? raw.slice(0, -2) : raw;
-		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
-		return {
-			key,
-			each,
-			map
-		};
-	});
-}
-/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
-function secretArrayPrefixes(path) {
-	const segments = parseSecretPath(path);
-	const prefixes = [];
-	const walked = [];
-	for (const segment of segments) {
-		walked.push(segment.key);
-		if (segment.each) prefixes.push(walked.join("."));
-	}
-	return prefixes;
-}
-function isRecord$4(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function elementId(element, idKey, declared, prefix) {
-	const id = isRecord$4(element) ? element[idKey] : void 0;
-	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
-	return id;
-}
-/**
-* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
-* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
-* result is a new body, `data` is untouched.
-*/
-var REMOVE_LEAF = Symbol("remove-leaf");
-function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
-	if (!isRecord$4(node)) return node;
-	const segment = segments[index];
-	if (segment === void 0) return node;
-	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
-	const child = node[segment.key];
-	const keys = [...walkedKeys, segment.key];
-	const last = index === segments.length - 1;
-	if (segment.each) {
-		if (!Array.isArray(child)) return node;
-		const prefix = keys.join(".");
-		const idKey = arrayKeys[prefix];
-		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
-		const mapped = child.map((element) => {
-			const id = elementId(element, idKey, declared, prefix);
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
-			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
-		});
-		return {
-			...node,
-			[segment.key]: mapped
-		};
-	}
-	if (segment.map) {
-		if (!isRecord$4(child)) return node;
-		const kept = Object.entries(child).map(([mapKey, value]) => {
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
-			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
-			return [mapKey, visit({
-				declared,
-				concrete,
-				value
-			})];
-		}).filter(([, value]) => value !== REMOVE_LEAF);
-		return {
-			...node,
-			[segment.key]: Object.fromEntries(kept)
-		};
-	}
-	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
-	if (last) {
-		const replacement = visit({
-			declared,
-			concrete,
-			value: child
-		});
-		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
-		return {
-			...node,
-			[segment.key]: replacement
-		};
-	}
-	return {
-		...node,
-		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
-	};
-}
-/** Replace/remove every present secret leaf; returns a NEW body. */
-function mapSecretLeaves(data, paths, arrayKeys, visit) {
-	let current = data;
-	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
-	return current;
-}
-/**
-* The keychain collection name a kind's secrets live under. Prefixed so a
-* record's refs never collide with the refs a legacy collection of the same name
-* already holds during an adoption.
-*/
-function recordSecretCollection(kind) {
-	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
-}
-/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
-function recordSecretRef(owner, kind, rowId, concretePath) {
-	return buildSecretRef({
-		owner,
-		scope: {
-			kind: "row",
-			collection: recordSecretCollection(kind),
-			rowId
-		},
-		fieldPath: concretePath
-	});
-}
-/**
-* A stored secret, as an admin read shows it: a VIEW naming the row's own
-* keychain ref (`set: true`), never the value and no longer the bare redaction
-* token. The form hands it to the secret field, which reveals the value by ref
-* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
-* stored secret (the records door reads a view as KEEP).
-*
-* ONE implementation for the entries service and for every addon that serves
-* its own instances (`RecordIntegrationInstances`).
-*/
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function secretViewsOf(owner, kind, id, decl, data) {
-	if (decl.secretPaths.length === 0) return data;
-	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
-		if (leaf.value !== "__camstack_redacted__") return leaf.value;
-		return {
-			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
-			v: 1,
-			set: true
-		};
-	});
-	return isRecord$3(shown) ? shown : data;
-}
 /**
 * The share-view scope kinds a share-link token can carry. The hub mints
 * and validates them (`ShareViewGrantSchema` builds its
@@ -9379,6 +9805,7 @@ function defineRecordKinds(specs) {
 function entryBody(shape) {
 	return object({
 		name: string().min(1),
+		enabled: boolean().optional(),
 		...shape
 	});
 }
@@ -11218,6 +11645,10 @@ Object.freeze({
 				"all",
 				"one"
 			]
+		},
+		{
+			"path": "positionUpdatedAt",
+			"valueType": "number"
 		}
 	],
 	"meter": [{
@@ -11472,22 +11903,6 @@ Object.freeze({
 			"path": "pumpRunning",
 			"valueType": "boolean"
 		},
-		{
-			"path": "lastDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "currentHourDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "last24hDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "todayDrink",
-			"valueType": "number"
-		},
 		{
 			"path": "error",
 			"valueType": "string"
@@ -12053,12 +12468,66 @@ Object.freeze({
 		}
 	]
 });
+Object.freeze({
+	"actions": { "run": 363e4 },
+	"audio-analyzer": { "classify": 3e4 },
+	"custom-model-registry": { "importModelBundle": 18e5 },
+	"database-snapshot": { "writeSnapshot": 18e5 },
+	"device-manager": {
+		"migrateDevice": 72e4,
+		"runDiscoverySweep": 12e4
+	},
+	"device-provider": { "reloadDevice": 18e4 },
+	"llm": {
+		"generate": 6e5,
+		"generateVision": 6e5,
+		"testProfile": 6e5
+	},
+	"llm-runtime": {
+		"complete": 6e5,
+		"completeApple": 6e5,
+		"ensureStarted": 6e5,
+		"installModel": 36e5
+	},
+	"local-network": { "scanNetwork": 9e4 },
+	"model-convert": { "convert": 6e5 },
+	"pipeline-analytics": {
+		"addRetrainFrameFromRecording": 6e4,
+		"offerRetrainArchive": 12e4,
+		"proposeRetrainAnnotationsWithLlm": 18e4,
+		"resolveRetrainTrainingCorpus": 6e4,
+		"writeRetrainArchive": 36e5
+	},
+	"server-management": { "applyServerUpdate": 96e4 },
+	"terminal-session": { "pullOutput": 15e3 },
+	"training": {
+		"canaryResult": 12e4,
+		"cancelJob": 12e4,
+		"planJob": 6e4,
+		"registerResult": 18e5,
+		"rollbackCanary": 12e4,
+		"startJob": 12e4,
+		"startJobBatch": 12e4
+	},
+	"training-provider": {
+		"cancelJob": 6e4,
+		"cleanupJob": 3e5,
+		"getJob": 6e4,
+		"listJobEvents": 6e4,
+		"listJobs": 12e4,
+		"offerArtifact": 3e5,
+		"readResult": 3e5,
+		"submitJob": 18e5,
+		"uploadDataset": 72e5,
+		"validateCredentials": 3e4
+	}
+});
 object({
 	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-pOHbTzRB.mjs
+//#region ../types/dist/composition-BmBHuDTQ.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12362,7 +12831,7 @@ var table = {
 	},
 	dwell: {
 		minArgs: 3,
-		maxArgs: 3,
+		maxArgs: 4,
 		apply: () => {
 			throw new ExpressionEvalError("dwell: stateful evaluation context is required");
 		}
@@ -13405,205 +13874,6 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string().optional()
 });
-/**
-* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
-* entry kind, so an addon that holds a connection serves it in ~30 lines.
-*
-* Every instance is one record of the addon's own kind, keyed by the
-* `integrations` registry id. The records door does the secret work: a field the
-* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
-* deleting the row deletes the secret, and one row's value is never another's.
-*
-* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
-* token or the view the form was given KEEP the stored secret;
-* `{ $secretClear: true }` clears it; any other string replaces it.
-*/
-/** The most instances one addon lists (an integrations page, not a table). */
-var INSTANCES_LIST_MAX = 1e3;
-/** The keys of the kind's secret fields that sit at the top level of the body. */
-function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
-}
-/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
-function secretMapKeys(paths) {
-	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
-}
-/**
-* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
-* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
-* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
-*/
-function secretMapPatch(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-	const out = {};
-	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
-	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
-	return Object.keys(out).length > 0 ? out : null;
-}
-/** Does the kind's body schema carry an `enabled` field? */
-function declaresEnabled(kind) {
-	const json = toJSONSchema(kind.schema, {
-		unrepresentable: "any",
-		io: "input"
-	});
-	const properties = Reflect.get(json, "properties");
-	return typeof properties === "object" && properties !== null && "enabled" in properties;
-}
-var RecordIntegrationInstances = class {
-	records;
-	kind;
-	hooks;
-	handle;
-	secretKeys;
-	secretMaps;
-	nameField;
-	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
-	registryOwnsEnabled;
-	constructor(records, kind, hooks) {
-		this.records = records;
-		this.kind = kind;
-		this.hooks = hooks;
-		this.handle = records.kind(kind);
-		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
-		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
-		this.nameField = kind.declaration.entry?.nameField ?? "name";
-		this.registryOwnsEnabled = hooks.description.role === "devices";
-		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
-	}
-	/**
-	* One instance read for the addon's own runtime; null when absent. When the keychain is
-	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
-	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
-	*/
-	async readResolved(id) {
-		try {
-			const record = await this.handle.getResolved(id);
-			return record === null ? null : {
-				id,
-				body: record.data,
-				enabled: record.data.enabled !== false,
-				secrets: "resolved"
-			};
-		} catch (err) {
-			if (!(err instanceof RecordSecretUnavailableError)) throw err;
-			const stored = await this.handle.get(id);
-			if (stored === null) return null;
-			return {
-				id,
-				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
-				enabled: stored.data.enabled !== false,
-				secrets: "unavailable"
-			};
-		}
-	}
-	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
-	async getResolved(id) {
-		return (await this.readResolved(id))?.body ?? null;
-	}
-	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
-	async listResolved() {
-		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
-		const out = [];
-		for (const record of page.records) {
-			const read = await this.readResolved(record.id);
-			if (read !== null) out.push(read);
-		}
-		return out;
-	}
-	viewOf(record) {
-		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
-		const rawName = record.data[this.nameField];
-		const kind = this.hooks.kindOf?.(record.data);
-		const health = this.hooks.health?.(record.data, record.id);
-		return {
-			id: record.id,
-			name: typeof rawName === "string" ? rawName : record.id,
-			configured: this.hooks.configured(record.data),
-			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
-			formValues: shown,
-			...kind !== void 0 ? { kind } : {},
-			...health?.status !== void 0 ? { status: health.status } : {},
-			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
-		};
-	}
-	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
-		...this.hooks.description,
-		mintsId: true
-	};
-	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
-	listInstances = async () => {
-		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
-	};
-	getInstance = async ({ id }) => {
-		const record = await this.handle.get(id);
-		return record === null ? null : this.viewOf(record);
-	};
-	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name, kind }) => {
-		const minted = id ?? this.hooks.mintId?.({
-			name,
-			...kind !== void 0 ? { kind } : {}
-		});
-		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
-		await this.handle.put({
-			id: minted,
-			data: this.hooks.initialBody(name, kind)
-		}, { ifRev: 0 });
-		await this.hooks.onChanged?.(minted, "created");
-		return { id: minted };
-	};
-	updateInstance = async ({ id, name, values }) => {
-		const patch = {};
-		for (const [key, value] of Object.entries(values)) {
-			if (value === void 0) continue;
-			if (this.secretMaps.has(key)) {
-				const entries = secretMapPatch(value);
-				if (entries !== null) patch[key] = entries;
-			} else if (!this.secretKeys.has(key)) patch[key] = value;
-			else if (isSecretClear(value)) patch[key] = null;
-			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
-		}
-		if (name !== void 0) patch[this.nameField] = name;
-		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id, "updated");
-		return { ok: true };
-	};
-	/** The switch lives in the record body; the addon is told so it applies it (D996). */
-	setInstanceEnabled = async ({ id, enabled }) => {
-		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
-		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id, "enabled");
-		return { ok: true };
-	};
-	/** The row and its keychain refs go together (the records door). */
-	deleteInstance = async ({ id }) => {
-		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id, "deleted");
-		return { ok: true };
-	};
-	testInstance = async (input) => {
-		if (this.hooks.test === void 0) return {
-			success: false,
-			status: "unsupported",
-			error: "This integration declares no connection test"
-		};
-		return this.hooks.test(input);
-	};
-	/** The flat provider object to hand to `registerProvider`. */
-	toProvider() {
-		return {
-			describe: this.describe,
-			instanceFormSchema: this.instanceFormSchema,
-			listInstances: this.listInstances,
-			getInstance: this.getInstance,
-			createInstance: this.createInstance,
-			updateInstance: this.updateInstance,
-			setInstanceEnabled: this.setInstanceEnabled,
-			deleteInstance: this.deleteInstance,
-			testInstance: this.testInstance
-		};
-	}
-};
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -15776,6 +16046,39 @@ var UnstampedEventMediaCountSchema = object({
 	/** Sum across both, or `null` when either lane could not be counted. */
 	total: number().int().nonnegative().nullable()
 }).nullable();
+/**
+* Where the stored event media sits, per storage location: how many media rows
+* and how many bytes carry each location id, how many carry none (legacy,
+* resolved to the default `eventMedia` location), and how many name a location
+* that was not asked about (a deleted or never-listed one).
+*
+* One covering-index aggregate per asked location plus the NULL one, and one
+* unfiltered total that scans the covering index: O(rows), not a walk of the
+* rows themselves. `unlisted` is total minus the ASKED locations minus NULL, so
+* it is a deleted location only when every location id was asked.
+* `null` is "could not be measured", never zero.
+*/
+var MediaLocationCensusInputSchema = object({ locationIds: array(string().min(1)).max(50).readonly() });
+var MediaLocationCensusSchema = object({
+	locations: array(object({
+		locationId: string(),
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})).readonly(),
+	unstamped: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	/** Rows stamped with a location id that was not in the asked list. */
+	unlisted: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	total: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})
+});
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -19755,31 +20058,21 @@ var APPLIANCE_CAP_VOCABULARY = {
 	"pet-fountain": {
 		scope: "device",
 		noun: t("Pet fountain", "Fontana per animali"),
-		actions: [
-			{
-				id: "petFountain.pumpOn",
-				method: "setPump",
-				label: t("Pump on", "Pompa accesa"),
-				phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
-				icon: "play",
-				args: { on: true }
-			},
-			{
-				id: "petFountain.pumpOff",
-				method: "setPump",
-				label: t("Pump off", "Pompa spenta"),
-				phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
-				icon: "square",
-				args: { on: false }
-			},
-			{
-				id: "petFountain.resetDailyConsumption",
-				method: "resetDailyConsumption",
-				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
-				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
-				icon: "rotate-ccw"
-			}
-		],
+		actions: [{
+			id: "petFountain.pumpOn",
+			method: "setPump",
+			label: t("Pump on", "Pompa accesa"),
+			phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
+			icon: "play",
+			args: { on: true }
+		}, {
+			id: "petFountain.pumpOff",
+			method: "setPump",
+			label: t("Pump off", "Pompa spenta"),
+			phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
+			icon: "square",
+			args: { on: false }
+		}],
 		state: [{
 			kind: "boolean",
 			field: "empty",
@@ -43673,8 +43966,15 @@ var ActionInputSchema = object({
 var ActionRunOriginSchema = object({ 
 /** The automation block whose step started it. */
 blockId: string().min(1).optional() });
-/** `started` = the caller did not ask to wait. */
-var ActionRunOutcomeSchema = union([AutomationRunOutcomeSchema, literal("started")]);
+/**
+* `started` = the caller did not ask to wait. `timed-out` = the run reached the
+* ceiling (`ACTION_RUN_MAX_MS`) and was stopped; it is never a `ran`.
+*/
+var ActionRunOutcomeSchema = union([
+	AutomationRunOutcomeSchema,
+	literal("started"),
+	literal("timed-out")
+]);
 var ActionRunResultSchema = object({
 	runId: string().min(1),
 	outcome: ActionRunOutcomeSchema,
@@ -44196,6 +44496,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	kind: "mutation",
 	auth: "admin"
 });
+/** `timeoutMs` of `actions.run`: a waited call outlives any legal run. */
+var ACTION_RUN_TIMEOUT_MS = 363e4;
 /**
 * actions — the ONE surface for runnable actions, for the UI and for
 * automations. Provided by the core-blocks builtin on the hub.
@@ -44214,6 +44516,12 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 * An admin, and an in-process caller (an automation block), may run any action.
 * Every refusal is typed (`[not-linked] …`) and logged.
 *
+* **A run lasts at most `ACTION_RUN_MAX_MS` (60 min).** The provider stops a
+* run that reaches it and answers `timed-out` (never `ran`); an action whose
+* `wait` steps alone add up to more is refused at create/update
+* (`[invalid-steps]`). `run` declares a `timeoutMs` above that ceiling, so a
+* waited call (an automation step) is never cut by the 60 s transport default.
+*
 * A second `run` of an action that is already running is REFUSED — traced and
 * logged — never queued.
 */
@@ -44240,7 +44548,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	role: "viewer",
 	auth: "protected",
 	kind: "mutation",
-	caller: "required"
+	caller: "required",
+	timeoutMs: ACTION_RUN_TIMEOUT_MS
 }), method(ActionIdInput, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -46296,52 +46605,7 @@ DeviceType.Light, method(object({
 	level: number().min(0).max(100),
 	lastChangedAt: number()
 });
-/**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
-*
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
-*
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
-*
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
-*
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
-*/
-var BrokerStatusEnum = _enum([
+_enum([
 	"connected",
 	"disconnected",
 	"connecting",
@@ -46349,141 +46613,12 @@ var BrokerStatusEnum = _enum([
 	"unreachable",
 	"error"
 ]);
-var BrokerInfoSchema = object({
-	/** Stable broker id. Persisted; survives addon restarts. */
-	id: string(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
-	addonId: string(),
-	/** Human-readable name (operator-chosen at add-time). */
-	name: string(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: string(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: record(string(), unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: number().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: string().nullable()
-});
 var RegistryStatusSchema = object({
 	brokerCount: number().int().nonnegative(),
 	connectedCount: number().int().nonnegative()
 });
-/**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
-*/
-var BrokerProviderInfoSchema = object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: string(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: array(object({
-		kind: string(),
-		label: string(),
-		/**
-		* Relative hub path to start an interactive account link (OAuth popup).
-		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
-		*/
-		interactiveConnectPath: string().min(1).optional(),
-		/** Relative hub path to disconnect the linked account (same popup pattern). */
-		interactiveDisconnectPath: string().min(1).optional(),
-		/**
-		* The kind signs in through a server-held interactive session instead of
-		* (or before) typed credentials. `basePath` is a hub-relative route set
-		* served by the owning addon (`/addon/<id>/...`) speaking the sign-in
-		* contract: `POST {basePath}/start` (body: the form's settings) answers
-		* `{ sessionId, loginUrl }`; `GET {basePath}/status?sessionId=` answers
-		* `{ phase: 'starting' | 'awaiting-login' | 'captured' | 'error' |
-		* 'cancelled', loginUrl, error }`; `POST {basePath}/commit`
-		* (`{ sessionId, name, brokerId? }`) stores the credentials on a new or
-		* existing broker and answers `{ brokerId }`; `POST {basePath}/cancel`
-		* (`{ sessionId }`) drops the session. The dialog that edits a broker
-		* offers it as the default path; the fields the session fills are
-		* marked `filledBySignIn` in the kind's settings schema.
-		*
-		* `methods` lists the ways the session can sign in, recommended first:
-		* `'device-code'` adds `POST {basePath}/code/start` (body: the form's
-		* settings) answering `{ sessionId, userCode, verificationUrl,
-		* expiresAt }` — the operator types `userCode` at `verificationUrl` on
-		* any device, and the same `status` / `commit` / `cancel` routes follow
-		* (status then carries `method`, `userCode`, `verificationUrl`,
-		* `expiresAt` and the phases `'awaiting-code'` / `'expired'`);
-		* `'proxy'` is the `{basePath}/start` flow above. Absent means
-		* `['proxy']`.
-		*/
-		signIn: object({
-			basePath: string().min(1),
-			methods: array(_enum(["device-code", "proxy"])).optional()
-		}).optional()
-	}))
-});
-var ListInputSchema = object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: string().optional() });
 var GetInputSchema = object({ id: string() });
-var AddInputSchema = object({
-	kind: string().min(1),
-	name: string().min(1),
-	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
-	*/
-	id: string().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: record(string(), unknown())
-});
-var AddResultSchema = object({ id: string() });
-var RemoveInputSchema = object({ id: string() });
-var TestConnectionResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
 var SettingsRecordSchema$1 = record(string(), unknown());
-var SettingsSchemaInputSchema = object({ kind: string() });
-var TestSettingsInputSchema = object({
-	kind: string(),
-	settings: SettingsRecordSchema$1
-});
-var TestSettingsResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative().optional()
-}).strict(), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsSchemaResultSchema = unknown().nullable();
 var PublishInputSchema = object({
 	brokerId: string(),
 	/** Kind-specific routing target.
@@ -46527,51 +46662,12 @@ var brokerCapability = {
 		kind: "poll"
 	},
 	methods: {
-		list: method(ListInputSchema, array(BrokerInfoSchema)),
-		get: method(GetInputSchema, BrokerInfoSchema.nullable()),
-		/** Enumerate which addon provides which broker kind(s) for the
-		*  unified create picker. The auto-mount fans this array across
-		*  every registered `broker` provider (array-output method), so the
-		*  picker sees every kind from every provider in one call. */
-		listProviders: method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }),
-		add: method(AddInputSchema, AddResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		remove: method(RemoveInputSchema, _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testConnection: method(GetInputSchema, TestConnectionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Read the persisted settings record for a broker (kind-specific
-		*  shape). Admin-only — settings may contain secrets. Returns `null`
-		*  when the broker id is unknown to the provider (the collection
-		*  fallback may route a foreign id to the first provider). */
-		getSettings: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		/** Overwrite the persisted settings record. The kind-specific
-		*  provider validates the shape and applies the change (reconnects
-		*  if credentials changed). */
-		setSettings: method(object({
-			id: string(),
-			settings: SettingsRecordSchema$1
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Returns the kind-specific connection config the consumer needs
 		*  to open its own client (MQTT pattern: `{url, username, password,
 		*  clientIdPrefix}`). HA providers MAY return the auth envelope
 		*  but typical HA consumers use `publish` / `subscribe` instead.
 		*  Returns `null` when the broker id is unknown to the provider. */
 		getBrokerConfig: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		getSettingsSchema: method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }),
-		testSettings: method(TestSettingsInputSchema, TestSettingsResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		publish: method(PublishInputSchema, unknown(), {
 			kind: "mutation",
 			auth: "admin"
@@ -48498,6 +48594,9 @@ var MediaPlayerStatusSchema = object({
 	/** Repeat mode. Null when no repeat surface.
 	*  Pair with `DeviceFeature.MediaPlayerRepeat`. */
 	repeat: MediaPlayerRepeatSchema.nullable(),
+	/** Ms epoch when `position` was read from the device. Null when the driver
+	*  does not say; a UI that advances the position while playing counts from it. */
+	positionUpdatedAt: number().nullable().default(null),
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
@@ -49077,7 +49176,9 @@ var ThresholdTransformDraftSchema = object({
 	comparison: _enum(["gte", "lte"]),
 	threshold: number(),
 	startDwellMs: number().nonnegative(),
-	stopDwellMs: number().nonnegative()
+	stopDwellMs: number().nonnegative(),
+	/** Samples a start needs; absent = the compiler's default for the source (2 for running power, else 1). */
+	minSamples: number().int().min(1).optional()
 });
 var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
 	IdentityTransformDraftSchema,
@@ -50644,7 +50745,14 @@ var DiscoveryCandidateSchema = object({
 	/** `stableId` of the gateway candidate this device was found BEHIND. */
 	parentStableId: string().optional(),
 	/** `false` = shown for context but not pickable. Default true. */
-	selectable: boolean().optional()
+	selectable: boolean().optional(),
+	/**
+	* Keys of the provider's creation form (`getChildCreationSchema`) this candidate
+	* cannot be adopted without — a key for an encrypted board, a pairing code. The
+	* admin asks for exactly these, on the creation form prefilled with
+	* `prefilledConfig`, before it adopts. Absent or empty = adopt as it is.
+	*/
+	needsParams: array(string()).optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -50703,12 +50811,24 @@ method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind:
 }), array(DiscoveryCandidateSchema), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+}), method(object({}), CreationSchemaOutputSchema), method(object({ 
+/** The integration asked about; a provider whose integrations differ answers per one. */
+integrationId: string().optional() }), object({ deviceType: _enum(DeviceType).nullable() })), method(object({
+	candidate: DiscoveryCandidateSchema,
+	/** The integration the operator adopts into; a provider with several instances needs it. */
+	integrationId: string().optional()
+}), DeviceSummarySchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
+}), method(object({}), boolean()), method(object({
 	type: _enum(DeviceType),
-	config: record(string(), unknown())
+	/** The integration asked about; a provider whose integrations differ answers per one. */
+	integrationId: string().optional()
+}), CreationSchemaOutputSchema), method(object({
+	type: _enum(DeviceType),
+	config: record(string(), unknown()),
+	/** The integration the operator adds the device to; a provider with several instances needs it. */
+	integrationId: string().optional()
 }), DeviceSummarySchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -51418,7 +51538,10 @@ method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string(),
-	type: _enum(DeviceType)
+	type: _enum(DeviceType),
+	/** The integration the form is for; a provider whose integrations differ (a hub
+	*  integration takes no manual add) answers per integration. Absent = the addon's own. */
+	integrationId: string().optional()
 }), unknown().nullable()), method(object({
 	addonId: string(),
 	type: _enum(DeviceType),
@@ -51502,7 +51625,11 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12e4
-}), method(object({ addonId: string() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
+}), method(object({
+	addonId: string(),
+	/** The integration the Add-Device dialog is open on; absent = the addon's own. */
+	integrationId: string().optional()
+}), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
 	deviceId: number(),
 	key: string(),
 	value: unknown()
@@ -54004,6 +54131,7 @@ var IntegrationWithStateSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -54016,6 +54144,7 @@ var IntegrationLiteSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -54098,7 +54227,7 @@ var TestConnectionStatusEnum = _enum([
 	"inconclusive",
 	"unsupported"
 ]);
-var TestConnectionResultSchema$1 = object({
+var TestConnectionResultSchema = object({
 	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
 	error: string().optional(),
@@ -54115,7 +54244,6 @@ var TestConnectionResultSchema$1 = object({
 var CreateIntegrationInputSchema = object({
 	addonId: string(),
 	name: string(),
-	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
@@ -54124,6 +54252,11 @@ var CreateIntegrationInputSchema = object({
 var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
+	/**
+	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
+	* terminal), which keeps no instance record: the registry flag is its one store. Any other
+	* integration is switched through `integration-instances.setInstanceEnabled`.
+	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
 });
@@ -54143,7 +54276,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string(),
 	settings: record(string(), unknown())
-}), TestConnectionResultSchema$1, {
+}), TestConnectionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -54170,6 +54303,14 @@ var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
+* What the addon's instances ARE for the Integrations page (planning#416). `devices`: each
+* instance is an integration that brings devices (its record body owns the on/off switch);
+* `services`: a connection configured from the addon's own function page, never listed on
+* Integrations.
+* It is the same vocabulary as the manifest's `integrationRole`, which stays as an override.
+*/
+var IntegrationInstanceRoleSchema = _enum(["devices", "services"]);
+/**
 * One kind of instance a provider can create (an adapter, an account type). The sign-in and
 * connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
 * hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
@@ -54180,6 +54321,22 @@ var IntegrationInstanceKindSchema = object({
 	/** Stable id of the kind, sent back as `createInstance.kind`. */
 	id: string().min(1),
 	label: string().min(1),
+	/**
+	* The function capability this kind is configured for (`broker`, `smtp-provider`,
+	* `device-provider`, ...). A page section is the kinds whose `functionCap` it names (D1013); a
+	* provider with more than one section must name it on every kind.
+	*/
+	functionCap: string().min(1),
+	/**
+	* For `functionCap: 'broker'`: the registry kind of the broker an instance of this kind is
+	* (`matter`, `home-assistant`, ...). A caller that needs a broker of one kind (a link field)
+	* finds the instances whose kind names it; absent takes the kind `id`.
+	*/
+	brokerKind: string().min(1).optional(),
+	/** What instances of this kind are for the Integrations page; absent takes the provider's `role`. */
+	role: IntegrationInstanceRoleSchema.optional(),
+	/** `testInstance` really probes the remote for this kind; absent takes the provider's `canTest`. */
+	canTest: boolean().optional(),
 	/** The kind signs in through a server-held interactive session. */
 	signIn: object({
 		basePath: string().min(1),
@@ -54190,22 +54347,38 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to disconnect that account. */
 	disconnectPath: string().min(1).optional()
 });
+/**
+* How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
+* scans the network before any instance exists (the wizard offers the candidates); `account`: the
+* devices appear after the instance signs in. `scopedToInstance`: a discovery run belongs to ONE
+* instance and its candidates are claimed by it.
+*/
+var IntegrationInstanceDiscoverySchema = object({
+	mode: _enum([
+		"none",
+		"lan",
+		"account"
+	]),
+	scopedToInstance: boolean()
+});
+/**
+* One link a kind of this provider declares (D1013 rule 5): the body `field` of an instance of
+* `kind` holds the id of an instance of the function cap `to.cap` (of kind `to.kind`, when set).
+* The hub indexes these so the target's delete is refused while a link names it.
+*/
+var IntegrationInstanceLinkSchema = object({
+	kind: string().min(1),
+	field: string().min(1),
+	to: object({
+		cap: string().min(1),
+		kind: string().min(1).optional()
+	})
+});
 var IntegrationInstanceDescriptionSchema = object({
 	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
-	role: _enum([
-		"devices",
-		"services",
-		"both"
-	]),
+	role: IntegrationInstanceRoleSchema,
 	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
-	discovery: object({
-		mode: _enum([
-			"none",
-			"lan",
-			"account"
-		]),
-		scopedToInstance: boolean()
-	}).optional(),
+	discovery: IntegrationInstanceDiscoverySchema.optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -54226,7 +54399,9 @@ var IntegrationInstanceDescriptionSchema = object({
 	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
 	* send an id (the UI then mints an opaque one).
 	*/
-	mintsId: boolean().optional()
+	mintsId: boolean().optional(),
+	/** The links to other instances the provider's kinds declare; absent means none. */
+	links: array(IntegrationInstanceLinkSchema).optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -54246,8 +54421,8 @@ var IntegrationInstanceSchema = object({
 	configured: boolean(),
 	/**
 	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
-	* so a row written before the field existed is on). Absent when the `integrations` registry
-	* owns the switch (`describe().role` is `devices`): read it from the registry row.
+	* so a row written before the field existed is on). The same for every role, `devices` included:
+	* the body is the one store, `setInstanceEnabled` the one writer (epic #440, step 3).
 	*/
 	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
@@ -54271,7 +54446,11 @@ var integrationInstancesCapability = {
 	methods: {
 		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
 		/** The form; `id: null` is the create form. */
-		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		instanceFormSchema: method(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			/** The kind of the create form (`id: null`) of a provider with several. */
+			kind: string().min(1).optional()
+		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -54281,7 +54460,9 @@ var integrationInstancesCapability = {
 		createInstance: method(object({
 			id: IntegrationInstanceIdSchema.optional(),
 			name: string().min(1),
-			kind: string().min(1).optional()
+			kind: string().min(1).optional(),
+			/** Form values written with the record (a link picked in the create dialog). */
+			values: record(string(), unknown()).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -54291,7 +54472,8 @@ var integrationInstancesCapability = {
 			auth: "admin"
 		}),
 		/**
-		* Switch ONE instance on or off. A row control, not a form field: `updateInstance.values` is the
+		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
+		* initial body. A row control, not a form field: `updateInstance.values` is the
 		* form patch (D62, D996). An off instance keeps its record and secrets and does no work.
 		*/
 		setInstanceEnabled: method(object({
@@ -54308,8 +54490,10 @@ var integrationInstancesCapability = {
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
-			values: record(string(), unknown())
-		}), TestConnectionResultSchema$1, {
+			values: record(string(), unknown()),
+			/** The kind to test when `id` is null and the provider has several. */
+			kind: string().min(1).optional()
+		}), TestConnectionResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -56814,6 +56998,382 @@ var SystemMetricsSchema = object({
 	gpuMemoryPercent: number().optional()
 });
 method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema);
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number()]).optional(),
+		gte: union([string(), number()]).optional(),
+		lt: union([string(), number()]).optional(),
+		lte: union([string(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string())
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+/**
+* One op of a `transact`: the single-row writes, each on a kind of the caller.
+* All ops of one call share ONE database file and ONE `transactFamily`.
+*/
+var RecordTransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("put"),
+		kind: RecordKindNameSchema,
+		record: RecordInputSchema,
+		ifRev: number().int().min(0).optional()
+	}),
+	object({
+		op: literal("patch"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema,
+		data: RecordBodySchema,
+		at: number().int().nullable().optional(),
+		expiresAt: number().int().nullable().optional(),
+		ifRev: number().int().min(1).optional()
+	}),
+	object({
+		op: literal("delete"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema
+	})
+]);
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
+	results: array(object({
+		rev: number().int().nullable(),
+		deleted: boolean()
+	})),
+	releasedRefs: SecretRefsList,
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* The wire shapes of the migration API, version 1 (planning#447).
+*
+* A migration is code that outlives the server it was written against: an addon at
+* version 1.4 that is brought to 1.9 in one jump still runs its 1.4 catalogue, against
+* the 1.9 kernel. The only thing that code may call is {@link MigrationApiV1}; this file
+* is the contract of every method of it, one Zod pair per method.
+*
+* APPEND-ONLY. A released method is never removed and never changes meaning: an input
+* field is never removed or made required, an enum never narrows, an output field is
+* never removed. A change that cannot be expressed that way is `migration-api.v2`, next
+* to this file. `scripts/check-migration-api-append-only.ts` holds the line against
+* `scripts/migration-api-contract.json`, and every `behaviours` id below must have an
+* `it('<id>'` in `migration-api.contract.spec.ts`.
+*/
+var Rows = record(string(), unknown());
+var IntegrationId = object({ integrationId: string().min(1) });
+var RecordId = object({ id: string().min(1) });
+var RecordRowSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: Rows
+});
+var RecordPutShape = {
+	id: string().min(1),
+	deviceId: number().int().optional(),
+	at: number().int().optional(),
+	expiresAt: number().int().optional(),
+	data: Rows
+};
+var MigrationIntegrationSchema = object({
+	id: string(),
+	addonId: string(),
+	name: string(),
+	info: Rows,
+	/** The registry's stored switch: read by the one-switch migration, nothing else. */
+	enabled: boolean().optional(),
+	originStableId: string().optional()
+});
+var MigrationDeviceSchema = object({
+	id: number().int(),
+	integrationId: string().nullable().optional(),
+	/** The owning device; null or absent for a root. */
+	parentDeviceId: number().int().nullable().optional(),
+	type: string().optional(),
+	name: string().optional(),
+	stableId: string().optional()
+});
+/** What the engine says about the migration API it serves: lets an addon notice an older server. */
+var MigrationApiInfoSchema = object({
+	version: number().int(),
+	methods: array(string())
+});
+object({
+	message: string(),
+	meta: Rows.optional(),
+	/** Grouping tags of the line; a line about a device carries `{ deviceId }`. */
+	tags: object({ deviceId: number().int().optional() }).optional()
+});
+object({
+	owner: string().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API the engine serves; absent from a server that predates it. */
+	migrationApi: MigrationApiInfoSchema.optional()
+}), object({ id: string().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string().nullable()
+}), object({
+	id: string().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative()
+}), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), IntegrationId.extend({ patch: Rows }), object({ written: boolean() }), IntegrationId.extend({ keys: array(string().min(1)) }), object({
+	present: boolean(),
+	removed: Rows
+}), RecordRowSchema.nullable(), RecordRowSchema.nullable(), object({
+	...RecordPutShape,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ records: array(object(RecordPutShape)) }), object({ count: number().int().nonnegative() }), RecordId.extend({
+	partial: Rows,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ deleted: boolean() }), object({
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional(),
+	where: RecordWhereSchema.optional(),
+	limit: number().int().min(1).optional(),
+	cursor: string().min(1).optional(),
+	resolveSecrets: boolean().optional()
+}), object({
+	records: array(RecordRowSchema),
+	nextCursor: string().nullable()
+}), object({
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int().nonnegative() }), object({}), object({ store: Rows }), object({ patch: Rows }), object({}), object({ keys: array(string().min(1)) }), object({ removed: array(string()) }), object({ refs: array(string()) }), object({ values: record(string(), string().nullable()) }), object({
+	ref: string().min(1),
+	value: string()
+}), object({}), object({ refs: array(string()) }), object({ deleted: number().int().nonnegative() }), object({}), object({ integrations: array(MigrationIntegrationSchema) }), object({ id: string().min(1) }), MigrationIntegrationSchema.nullable(), object({
+	addonId: string().min(1),
+	integrationId: string().min(1).optional()
+}), object({ devices: array(MigrationDeviceSchema) }), object({ deviceId: number().int() }), object({
+	id: number().int(),
+	integrationId: string().nullable(),
+	/** Whether the device carries any stored config; its content is not offered. */
+	hasConfig: boolean()
+}).nullable(), object({
+	deviceId: number().int(),
+	integrationId: string().min(1)
+}), object({}), object({}), object({ nodeId: string() }), object({}), object({});
 method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
 	id: string().min(1),
 	error: string().min(1)
@@ -56843,7 +57403,9 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 		"written",
 		"refused"
 	]),
-	steps: array(MigrationOwnerStepSchema)
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API this engine serves (additive: a server that predates it omits it). */
+	migrationApi: MigrationApiInfoSchema.optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -59510,7 +60072,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(MediaLocationCensusInputSchema, MediaLocationCensusSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({}), array(RelocateJobSchema).readonly(), {
@@ -61917,7 +62482,7 @@ var BrokerStatusSchema$1 = _enum([
 	"unreachable",
 	"tls-error"
 ]);
-var BrokerInfoSchema$1 = object({
+var BrokerInfoSchema = object({
 	id: string(),
 	name: string(),
 	url: string(),
@@ -61990,7 +62555,7 @@ var mqttBrokerCapability = {
 		kind: "poll"
 	},
 	methods: {
-		listBrokers: method(_void(), array(BrokerInfoSchema$1)),
+		listBrokers: method(_void(), array(BrokerInfoSchema)),
 		getBrokerConfig: method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }),
 		addBroker: method(AddBrokerInputSchema, AddBrokerResultSchema, {
 			kind: "mutation",
@@ -66258,14 +66823,6 @@ object({
 	empty: boolean().nullable(),
 	/** True while the pump is running. Null while unknown. */
 	pumpRunning: boolean().nullable(),
-	/** Water drunk in the last drink, in litres. */
-	lastDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk in the current hour, in litres. */
-	currentHourDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk over the last 24 hours (rolling), in litres. */
-	last24hDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk since local midnight, in litres. Null when the fountain has no such sensor. */
-	todayDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
 	error: string().nullable(),
 	/** Ms epoch when the slice was last refreshed. */
@@ -66278,9 +66835,6 @@ DeviceType.PetFountain, method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
-}), method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
-	kind: "mutation",
-	auth: "protected"
 });
 /**
 * The wire shapes of the Auto tune plan and apply (D745), used by the
@@ -68317,253 +68871,6 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, DeviceType.Gateway, met
 	auth: "admin"
 });
 /**
-* records - an addon's own facts and documents (D881): ledgers, audit rows,
-* config documents, mirrors. The third storage API next to `ctx.settings`
-* (operator intent, D870) and device-history (numbers over time, D850).
-*
-* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
-* crossed a process and stated by a hub in-process caller (`ctx.records` does
-* that with the addon id closed over). It is deliberately NOT in any input
-* schema, so a session can never supply it, and a call with no stamp is refused
-* `records/no-caller`. A kind is readable and writable only by its owner; other
-* addons go through the owner's capability.
-*
-* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
-* never `[]`. Secret fields are never on the wire: a read shows the
-* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
-* resolves itself, and a write may carry only a keychain marker bound to the
-* row's own ref.
-*
-* Internal: addons reach it through `ctx.records`, never directly.
-*/
-var RecordIdSchema = string().min(1).max(256);
-/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
-var RecordBodySchema = record(string(), unknown());
-var RecordInputSchema = object({
-	id: RecordIdSchema,
-	/** The device this row belongs to (D865 removal, per-device reads). */
-	deviceId: number().int().optional(),
-	/** The domain clock, ms: observed / created / opened. */
-	at: number().int().optional(),
-	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
-	expiresAt: number().int().optional(),
-	data: RecordBodySchema
-});
-var RecordViewSchema = object({
-	id: string(),
-	deviceId: number().int().nullable(),
-	at: number().nullable(),
-	expiresAt: number().nullable(),
-	rev: number().int(),
-	updatedAt: number(),
-	data: RecordBodySchema
-});
-/** Declared index fields only. Anything else does not compile, by design. */
-var RecordWhereSchema = record(RecordFieldPathSchema, union([
-	string(),
-	number(),
-	boolean(),
-	object({ in: array(union([
-		string(),
-		number(),
-		boolean()
-	])).min(1).max(RECORD_BATCH_MAX) }),
-	object({
-		gt: union([string(), number()]).optional(),
-		gte: union([string(), number()]).optional(),
-		lt: union([string(), number()]).optional(),
-		lte: union([string(), number()]).optional()
-	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
-]));
-var KindShape = { kind: RecordKindNameSchema };
-var TimeWindowShape = {
-	deviceId: number().int().optional(),
-	atFrom: number().optional(),
-	atTo: number().optional()
-};
-var RecordQueryInputSchema = object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional(),
-	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
-	order: _enum(["at", "id"]).optional(),
-	desc: boolean().optional(),
-	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
-	/** Opaque keyset cursor from a previous answer. There is no offset. */
-	cursor: string().min(1).optional()
-});
-var RecordQueryResultSchema = object({
-	records: array(RecordViewSchema),
-	nextCursor: string().nullable()
-});
-var RecordKindStateSchema = _enum([
-	"created",
-	"unchanged",
-	"updated"
-]);
-var DeclareKindResultSchema = object({
-	kindId: number().int(),
-	state: RecordKindStateSchema,
-	createdIndexes: array(string())
-});
-/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
-var SecretRefsList = array(string());
-/**
-* One op of a `transact`: the single-row writes, each on a kind of the caller.
-* All ops of one call share ONE database file and ONE `transactFamily`.
-*/
-var RecordTransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("put"),
-		kind: RecordKindNameSchema,
-		record: RecordInputSchema,
-		ifRev: number().int().min(0).optional()
-	}),
-	object({
-		op: literal("patch"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema,
-		data: RecordBodySchema,
-		at: number().int().nullable().optional(),
-		expiresAt: number().int().nullable().optional(),
-		ifRev: number().int().min(1).optional()
-	}),
-	object({
-		op: literal("delete"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema
-	})
-]);
-var RecordSecretRefsSchema = record(string(), record(string(), string()));
-method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), array(RecordViewSchema), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	record: RecordInputSchema,
-	/** Compare-and-set. `0` means "the row must not exist". */
-	ifRev: number().int().min(0).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	count: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema,
-	data: RecordBodySchema,
-	at: number().int().nullable().optional(),
-	expiresAt: number().int().nullable().optional(),
-	ifRev: number().int().min(1).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), object({
-	deleted: boolean(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional()
-}), object({ count: number().int() }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	from: number(),
-	to: number(),
-	bucketMs: number().int().positive()
-}), object({ buckets: array(object({
-	bucketStart: number(),
-	count: number().int()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	op: _enum([
-		"sum",
-		"min",
-		"max",
-		"count"
-	]),
-	field: RecordFieldPathSchema.optional(),
-	groupBy: RecordFieldPathSchema.optional(),
-	where: RecordWhereSchema.optional()
-}), object({ rows: array(object({
-	group: union([
-		string(),
-		number(),
-		_null()
-	]),
-	value: number().nullable()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	atBefore: number().optional(),
-	where: RecordWhereSchema.optional()
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
-	results: array(object({
-		rev: number().int().nullable(),
-		deleted: boolean()
-	})),
-	releasedRefs: SecretRefsList,
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int(),
-	kinds: array(RecordKindNameSchema).optional()
-}), object({
-	deleted: record(string(), number().int()),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object(KindShape), object({ id: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
 * declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
@@ -77106,20 +77413,6 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
-	"broker.add": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.get": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getBrokerConfig": {
 		capName: "broker",
 		capScope: "system",
@@ -77127,20 +77420,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.getSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.getSettingsSchema": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getState": {
 		capName: "broker",
 		capScope: "system",
@@ -77155,20 +77434,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.list": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.listProviders": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.publish": {
 		capName: "broker",
 		capScope: "system",
@@ -77176,20 +77441,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.remove": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"broker.setSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.subscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -77197,20 +77448,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.testConnection": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.testSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.unsubscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -81971,13 +82208,6 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
-	"petFountain.resetDailyConsumption": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "delete",
-		role: "viewer"
-	},
 	"petFountain.setPump": {
 		capName: "pet-fountain",
 		capScope: "device",
@@ -82174,6 +82404,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"pipelineAnalytics.getMediaLocationCensus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"pipelineAnalytics.getMediaReclaimStatus": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -88367,11 +88604,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"petFountain.resetDailyConsumption": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"petFountain.setPump": [{
 		name: "deviceId",
 		form: "single",
@@ -91115,6 +91347,53 @@ object({
 	delay: number().nonnegative().optional(),
 	commands: record(string(), unknown())
 });
+var InstanceInUseError = class extends Error {
+	instanceId;
+	users;
+	name = "InstanceInUseError";
+	constructor(instanceId, users) {
+		super(`instance '${instanceId}' is still in use by ${users.map((u) => `${u.kind} '${u.name ?? u.id}' (${u.id})`).join(", ")}; unlink them first`);
+		this.instanceId = instanceId;
+		this.users = users;
+	}
+};
+/** Throw {@link InstanceInUseError} when any finder names a user of `instanceId`. */
+async function assertInstanceUnused(instanceId, finders) {
+	const users = [];
+	for (const finder of finders) users.push(...await finder.find(instanceId));
+	if (users.length > 0) throw new InstanceInUseError(instanceId, users);
+}
+function namesInstance(value, instanceId) {
+	if (Array.isArray(value)) return value.includes(instanceId);
+	return value === instanceId;
+}
+/**
+* Users reached through another addon's listed rows (an addon cannot read a record kind it does
+* not own): every row whose `field` holds the instance id, as a string or in a string list.
+* `list` is a cap call the owner serves.
+*/
+function fieldUserFinder(spec) {
+	const fields = typeof spec.field === "string" ? [spec.field] : spec.field;
+	return { find: async (instanceId) => (await spec.list()).filter((row) => fields.some((f) => namesInstance(row.formValues[f], instanceId))).map((row) => ({
+		kind: spec.kind,
+		id: row.id,
+		...row.name !== void 0 ? { name: row.name } : {}
+	})) };
+}
+/**
+* A provider whose `deleteInstance` is refused while anything still uses the instance. The
+* account is an `integration-instances` kind (D1013), so the refusal lives on the delete the
+* instances page calls.
+*/
+function guardInstanceDelete(base, users) {
+	return {
+		...base,
+		deleteInstance: async (input) => {
+			await assertInstanceUnused(input.id, users());
+			return base.deleteInstance(input);
+		}
+	};
+}
 //#endregion
 //#region ../../node_modules/xtend/immutable.js
 var require_immutable = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -123159,7 +123438,7 @@ function readOnboardPort(settings) {
 	return raw;
 }
 /**
-* Build an onboard {@link BuiltOnboardEntry} from `broker.add` settings.
+* Build an onboard {@link BuiltOnboardEntry} from the create form's values.
 * Pure — the port is pre-resolved by the caller (auto-allocation is a
 * side-effecting concern kept out of this helper), so the helper performs no
 * I/O of its own.
@@ -123245,7 +123524,7 @@ function resolveStoredPassword(value, legacy) {
 function retiredCiphertextPaths(config) {
 	const out = [];
 	for (const b of config.brokers) if (b.password?.startsWith("enc:v1:") === true) out.push(`brokers[${b.id}].password`);
-	if (config.embeddedPassword.startsWith("enc:v1:")) out.push("embeddedPassword");
+	if (config.embeddedPassword?.startsWith("enc:v1:") === true) out.push("embeddedPassword");
 	return out;
 }
 //#endregion
@@ -123279,6 +123558,229 @@ var mqttBrokersEntryKind = defineEntryKind("brokers", {
 	writeTrigger: "an operator adds or removes an external MQTT broker entry"
 });
 //#endregion
+//#region src/mqtt-broker-users.ts
+/** The addon whose integrations name an MQTT broker, and the field they keep that id in. */
+var MQTT_HA_ADDON_ID = "provider-mqtt-ha";
+var MQTT_HA_BROKER_FIELD = "mqttBrokerId";
+/** The finders for everything that still points at an MQTT broker. */
+function mqttBrokerUsers(listMqttHaInstances) {
+	return [fieldUserFinder({
+		kind: "integration",
+		field: MQTT_HA_BROKER_FIELD,
+		list: listMqttHaInstances
+	})];
+}
+/** MQTT Discovery is installed but has not registered as a provider: not known, NOT absent (D315). */
+var MqttDiscoveryNotReadyError = class extends Error {
+	constructor() {
+		super("MQTT Discovery is installed but not answering yet (still starting, or switched off), so its integrations cannot be checked: try again once it is running");
+		this.name = "MqttDiscoveryNotReadyError";
+	}
+};
+/**
+* The integrations of the MQTT Discovery addon. Nothing can name a broker only when the registry
+* ANSWERED that the addon supplies no `integration-instances` AND the addon roster ANSWERED that
+* it is not installed: then the answer is none. An addon that is installed but has not registered
+* (booting, switched off) is not-yet-known, and a registry or roster that does not answer, or a
+* read that fails, is unknown too: all of those throw, so the delete is refused (D49, D315).
+*/
+async function listMqttHaInstancesOver(api) {
+	const info = await api.capabilities.getCapability.query({ name: "integration-instances" });
+	if (info === null) throw new Error("the capability registry did not answer");
+	if (!info.providers.includes("provider-mqtt-ha")) {
+		if ((await api.addons.list.query()).some((row) => row.manifest.id === "provider-mqtt-ha")) throw new MqttDiscoveryNotReadyError();
+		return [];
+	}
+	return api.integrationInstances.listInstances.query({ addonId: MQTT_HA_ADDON_ID });
+}
+//#endregion
+//#region src/mqtt-broker-instances.ts
+/**
+* The MQTT brokers as `integration-instances` (D1013): one instance per `brokers` record. An
+* external broker is a URL; an ONBOARD broker (`onboard: true` on the create form) is a CamStack
+* `aedes` server on this hub: the create allocates its port (or honours the operator's) and the
+* addon spawns it from the record, the delete tears it down. Removing a broker an MQTT Discovery
+* integration still names is refused (D1012).
+*/
+var MQTT_INSTANCE_KIND = "mqtt";
+/** The create-form keys that only mean "run an onboard broker"; the record keeps a descriptor. */
+var ONBOARD_FORM_KEYS = new Set([
+	"onboard",
+	"port",
+	"allowAnonymous"
+]);
+var PROBE_LABELS = {
+	connected: "Connected",
+	disconnected: "Disconnected",
+	"auth-failed": "Authentication failed",
+	unreachable: "Unreachable",
+	"tls-error": "TLS error"
+};
+/** The instance's health word: connected / auth-failed / unreachable / tls-error, latency, clients. */
+function mqttHealthOf(body, live, now) {
+	if (!isInstanceEnabled(body)) return { status: {
+		state: "off",
+		label: "Switched off"
+	} };
+	if (body.onboard !== void 0) return live.onboard === null ? {
+		status: {
+			state: "error",
+			label: "Not listening"
+		},
+		lastCheckedAt: now
+	} : {
+		status: {
+			state: "ok",
+			label: "Listening",
+			detail: `${live.onboard.connectedClients} connected clients`
+		},
+		lastCheckedAt: now
+	};
+	const probe = live.probe;
+	if (probe === void 0) return { status: {
+		state: "unknown",
+		label: "Not checked yet"
+	} };
+	const detail = probe.status === "connected" ? probe.latencyMs !== null ? `${probe.latencyMs} ms` : void 0 : probe.error;
+	return {
+		status: {
+			state: probe.status === "connected" ? "ok" : "error",
+			label: PROBE_LABELS[probe.status],
+			...detail !== void 0 ? { detail } : {}
+		},
+		lastCheckedAt: probe.lastCheckedAt
+	};
+}
+function withoutOnboardKeys(values) {
+	return Object.fromEntries(Object.entries(values).filter(([key]) => !ONBOARD_FORM_KEYS.has(key)));
+}
+function typedText(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value : void 0;
+}
+/** A password the form really typed: not blank, not the redaction token, not the hidden view. */
+function typedSecret(value) {
+	const text = typedText(value);
+	return text === void 0 || text === "__camstack_redacted__" || isSecretFieldView(text) ? void 0 : text;
+}
+function resultOf(probe) {
+	return probe.ok ? {
+		success: true,
+		status: "validated",
+		...probe.latencyMs !== void 0 ? { latencyMs: probe.latencyMs } : {}
+	} : {
+		success: false,
+		status: "rejected",
+		error: probe.error ?? "The broker did not answer"
+	};
+}
+function buildMqttBrokerInstances(records, deps) {
+	const instances = new RecordIntegrationInstances(records, mqttBrokersEntryKind, {
+		description: {
+			role: "services",
+			instanceMode: "multiple",
+			kind: "brokers",
+			canTest: true,
+			kinds: [{
+				id: MQTT_INSTANCE_KIND,
+				label: "MQTT broker",
+				functionCap: "broker",
+				brokerKind: "mqtt",
+				canTest: true
+			}]
+		},
+		formSchema: (id) => deps.formSchema(id, false),
+		kindOf: () => MQTT_INSTANCE_KIND,
+		initialBody: (name) => ({
+			name,
+			url: "mqtt://"
+		}),
+		configured: (body) => body.url.trim().length > 0 && body.url.trim() !== "mqtt://",
+		health: (body, id) => mqttHealthOf(body, deps.liveState(id), Date.now()),
+		onChanged: deps.onChanged,
+		test: async ({ id, values }) => {
+			if (id === null && isOnboardRequested(values)) return {
+				success: true,
+				status: "validated",
+				detail: "A free port is picked when the broker is created"
+			};
+			const saved = id === null ? null : await instances.readResolved(id);
+			if (saved?.body.onboard !== void 0) return deps.onboardListening(saved.id) ? {
+				success: true,
+				status: "validated",
+				detail: `Listening on port ${saved.body.onboard.port}`
+			} : {
+				success: false,
+				status: "rejected",
+				error: "The onboard broker is not listening"
+			};
+			const url = typedText(values["url"]) ?? saved?.body.url;
+			if (url === void 0 || url === "mqtt://") return {
+				success: false,
+				status: "rejected",
+				error: "Enter the broker URL first"
+			};
+			const username = typedText(values["username"]) ?? saved?.body.username;
+			const password = typedSecret(values["password"]) ?? saved?.body.password;
+			return resultOf(await deps.probe({
+				url,
+				...username !== void 0 ? { username } : {},
+				...password !== void 0 ? { password } : {}
+			}));
+		}
+	});
+	const base = instances.toProvider();
+	/** Port, descriptor and URL of an onboard broker the form asked for. */
+	const onboardValues = async (id, name, values) => {
+		const built = buildOnboardEntry({
+			id,
+			name,
+			port: readOnboardPort(values) ?? await deps.freePort(),
+			settings: values
+		});
+		return {
+			...withoutOnboardKeys(values),
+			url: built.url,
+			onboard: built.onboard
+		};
+	};
+	return guardInstanceDelete({
+		...base,
+		instanceFormSchema: async ({ id }) => {
+			const saved = id === null ? null : await instances.getResolved(id);
+			return deps.formSchema(id, saved?.onboard !== void 0);
+		},
+		createInstance: async (input) => {
+			const values = input.values ?? {};
+			if (!isOnboardRequested(values)) return base.createInstance({
+				...input,
+				values: withoutOnboardKeys(values)
+			});
+			const id = input.id ?? randomUUID();
+			return base.createInstance({
+				...input,
+				id,
+				values: await onboardValues(id, input.name, values)
+			});
+		},
+		updateInstance: async (input) => {
+			if (!isOnboardRequested(input.values)) return base.updateInstance({
+				...input,
+				values: withoutOnboardKeys(input.values)
+			});
+			const current = await instances.getResolved(input.id);
+			if (current === null) throw new Error(`mqtt-broker: broker '${input.id}' not found`);
+			if (current.onboard !== void 0) return base.updateInstance({
+				...input,
+				values: withoutOnboardKeys(input.values)
+			});
+			return base.updateInstance({
+				...input,
+				values: await onboardValues(input.id, input.name ?? current.name, input.values)
+			});
+		}
+	}, () => mqttBrokerUsers(deps.listMqttHaInstances));
+}
+//#endregion
 //#region src/migrations/brokers-to-records.ts
 /**
 * The external MQTT brokers live in the `brokers` records (D985, D996); the old addon-settings
@@ -123368,46 +123870,163 @@ async function planDropBrokersKey(ports) {
 	}] };
 }
 //#endregion
+//#region src/migrations/embedded-to-onboard.ts
+/**
+* The legacy single embedded broker lived in FLAT addon-settings keys (`embeddedEnabled`,
+* `embeddedPort`, ...). It is an ONBOARD broker record now, so the instance list, the pickers,
+* the test and the delete all see it (D1013). Two migrations of the catalogue, in this order:
+*
+*  1. `embeddedToOnboardRecord` (procedure): a legacy broker (a stopped one as a switched-off
+*     record) becomes a `brokers` record
+*     under the SAME id (`embeddedId`, else the `'embedded'` id the old code derived), so a
+*     consumer that stored that id still resolves. It never overwrites a record of that id.
+*  2. `planDropEmbeddedKeys` (plan): the flat keys are deleted from the canonical
+*     `addon-settings` rows, and only while the record that replaces them exists and carries the
+*     password the legacy key held. `embeddedClients` / `embeddedAcl` are not flat broker keys
+*     and stay.
+*/
+/** The flat keys that described the legacy embedded broker. */
+var LEGACY_EMBEDDED_KEYS = [
+	"embeddedEnabled",
+	"embeddedId",
+	"embeddedPort",
+	"embeddedAllowAnonymous",
+	"embeddedUsername",
+	"embeddedPassword"
+];
+var LEGACY_EMBEDDED_NAME = "Embedded broker";
+function onboardBodyOf(legacy) {
+	return {
+		name: LEGACY_EMBEDDED_NAME,
+		url: `mqtt://127.0.0.1:${legacy.port}`,
+		...legacy.username !== void 0 ? { username: legacy.username } : {},
+		...legacy.password !== void 0 ? { password: legacy.password } : {},
+		onboard: {
+			port: legacy.port,
+			allowAnonymous: legacy.allowAnonymous
+		},
+		...legacy.enabled ? {} : { enabled: false }
+	};
+}
+async function embeddedToOnboardRecord(ports) {
+	const legacy = await ports.readLegacyEmbedded();
+	if (legacy === null) return {
+		outcome: "already-done",
+		summary: { migrated: 0 }
+	};
+	if ((await ports.readRecords()).has(legacy.id)) return {
+		outcome: "already-done",
+		summary: { migrated: 0 }
+	};
+	await ports.putOnboardRecord(legacy.id, onboardBodyOf(legacy));
+	return {
+		outcome: "done",
+		summary: { migrated: 1 }
+	};
+}
+async function planDropEmbeddedKeys(ports) {
+	const raw = await ports.readRawEmbeddedKeys();
+	const present = LEGACY_EMBEDDED_KEYS.filter((key) => key in raw);
+	if (present.length === 0) return { edits: [] };
+	const refuse = (reason) => {
+		ports.warn(`mqtt-broker migration: the legacy embedded keys are kept: ${reason}`);
+		throw new Error(`the legacy embedded broker keys are not deleted: ${reason}`);
+	};
+	const legacy = await ports.readLegacyEmbedded();
+	if (legacy !== null) {
+		const record = (await ports.readRecords()).get(legacy.id);
+		if (record === void 0) return refuse(`the record '${legacy.id}' does not exist`);
+		if ((legacy.password ?? "").length > 0 && !record.hasPassword) return refuse(`the record '${legacy.id}' holds no password`);
+	}
+	return { edits: [{
+		op: "deleteKeys",
+		scope: ADDON_SETTINGS_TABLE,
+		keys: present.map((key) => `${MQTT_BROKER_ADDON_ID}.${key}`),
+		precondition: preconditionOf(Object.fromEntries(present.map((key) => [`${MQTT_BROKER_ADDON_ID}.${key}`, {
+			addonId: MQTT_BROKER_ADDON_ID,
+			key,
+			value: raw[key]
+		}])))
+	}] };
+}
+//#endregion
 //#region src/migrations/index.ts
 var BROKERS_TO_RECORDS_ID = "mqtt-broker/2026-11-03-brokers-settings-to-records";
 var DROP_BROKERS_KEY_ID = "mqtt-broker/2026-11-03-drop-brokers-key";
+var EMBEDDED_TO_ONBOARD_ID = "mqtt-broker/2026-11-05-embedded-broker-to-onboard-record";
+var DROP_EMBEDDED_KEYS_ID = "mqtt-broker/2026-11-05-drop-embedded-keys";
 var FIXTURE_MARK = "a setting key the migration does not know";
 /**
 * The `mqtt-broker` catalogue (D987), offered to the engine when the addon initialises. Both
 * entries are `tolerate`: the embedded broker and every record keep working while a legacy key
 * stays where it is.
 */
-var ADDON_MIGRATIONS = [{
-	meta: {
-		id: BROKERS_TO_RECORDS_ID,
-		owner: "mqtt-broker",
-		level: "addon-state",
-		seq: 1,
-		dependsOn: [],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "procedure",
-		description: "Check that every external broker of the old settings list is a brokers record; never deletes",
-		fixtureMark: FIXTURE_MARK
-	},
-	procedure: verifyBrokersAreRecords
-}, {
-	meta: {
-		id: DROP_BROKERS_KEY_ID,
-		owner: "mqtt-broker",
-		level: "addon-state",
-		seq: 2,
-		dependsOn: [BROKERS_TO_RECORDS_ID],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "plan",
-		description: "Delete the legacy brokers settings key once every broker is a record",
-		fixtureMark: FIXTURE_MARK
-	},
-	plan: planDropBrokersKey
-}];
+var ADDON_MIGRATIONS = [
+	{
+		meta: {
+			id: BROKERS_TO_RECORDS_ID,
+			owner: "mqtt-broker",
+			level: "addon-state",
+			seq: 1,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "Check that every external broker of the old settings list is a brokers record; never deletes",
+			fixtureMark: FIXTURE_MARK
+		},
+		procedure: verifyBrokersAreRecords
+	},
+	{
+		meta: {
+			id: DROP_BROKERS_KEY_ID,
+			owner: "mqtt-broker",
+			level: "addon-state",
+			seq: 2,
+			dependsOn: [BROKERS_TO_RECORDS_ID],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the legacy brokers settings key once every broker is a record",
+			fixtureMark: FIXTURE_MARK
+		},
+		plan: planDropBrokersKey
+	},
+	{
+		meta: {
+			id: EMBEDDED_TO_ONBOARD_ID,
+			owner: "mqtt-broker",
+			level: "addon-state",
+			seq: 3,
+			dependsOn: [DROP_BROKERS_KEY_ID],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "The legacy embedded broker (flat embedded* keys) becomes an onboard brokers record under the same id; never overwrites a record",
+			fixtureMark: FIXTURE_MARK
+		},
+		procedure: embeddedToOnboardRecord
+	},
+	{
+		meta: {
+			id: DROP_EMBEDDED_KEYS_ID,
+			owner: "mqtt-broker",
+			level: "addon-state",
+			seq: 4,
+			dependsOn: [EMBEDDED_TO_ONBOARD_ID],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the flat embedded broker keys once the onboard record holds them",
+			fixtureMark: FIXTURE_MARK
+		},
+		plan: planDropEmbeddedKeys
+	}
+];
 //#endregion
 //#region src/mqtt-entry-record-kinds.ts
 var aclAccessSchema = _enum([
@@ -123615,123 +124234,25 @@ var MqttAclStore = class MqttAclStore {
 *
 * Lifecycle:
 *   - External broker entries are persisted in `this.activeExternalBrokers`.
-*   - The embedded broker is persisted as flat `embedded*` config keys
-*     (`embeddedEnabled`, `embeddedPort`, …) so the standard settings
-*     form can drive it; {@link MqttBrokerAddon.deriveEmbeddedEntry}
-*     reassembles them into an `EmbeddedBrokerEntry`.
-*   - On boot we start the embedded broker when `embeddedEnabled`.
-*   - `addBroker` / `removeBroker` / `startEmbeddedBroker` /
-*     `stopEmbeddedBroker` mutate the config and the runtime state.
+*   - The legacy single embedded broker is an onboard `brokers` record (migrated from the flat
+*     `embedded*` keys, same id); `startEmbeddedBroker` / `stopEmbeddedBroker` act on that record.
+*   - `addBroker` / `removeBroker` mutate the records and the runtime state.
 *   - `testConnection` does a one-shot `mqtt.connect` race against a 3s
 *     timeout AND refreshes the probe cache for the broker.
 */
 /** bcrypt cost factor — exported for tests. */
 var MQTT_EMBEDDED_BCRYPT_ROUNDS = 10;
 var PROBE_INTERVAL_MS = 3e4;
-var DEFAULT_EMBEDDED_PORT = 1883;
-/**
-* Per-kind broker creation form for kind='mqtt', rendered by the unified
-* Broker manager / create picker (via `broker.getSettingsSchema`). PURE
-* DATA — emits the flat `{ url, username, password, clientIdPrefix }`
-* shape `broker.add`'s `settings` payload consumes. Mirrors the external
-* broker fields `addBroker` accepts.
-*/
-var mqttBrokerSettingsSchema = { sections: [{
-	id: "mqtt-broker-connection",
-	title: "MQTT connection",
-	titleKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.title",
-	columns: 1,
-	fields: [
-		{
-			type: "boolean",
-			key: "onboard",
-			label: "Run an onboard broker",
-			labelKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.onboard.label",
-			description: "Spin up a CamStack-hosted aedes broker on this hub instead of connecting to an external one. Each onboard broker gets its own dedicated server + port.",
-			descriptionKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.onboard.description",
-			default: false
-		},
-		{
-			type: "number",
-			key: "port",
-			label: "Port",
-			labelKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.port.label",
-			placeholder: "(auto)",
-			description: "TCP port for the onboard broker. Leave blank to auto-allocate a free port.",
-			descriptionKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.port.description",
-			showWhen: {
-				field: "onboard",
-				equals: true
-			}
-		},
-		{
-			type: "boolean",
-			key: "allowAnonymous",
-			label: "Allow anonymous",
-			labelKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.allowAnonymous.label",
-			description: "Permit clients to connect without a username/password.",
-			descriptionKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.allowAnonymous.description",
-			default: false,
-			showWhen: {
-				field: "onboard",
-				equals: true
-			}
-		},
-		{
-			type: "text",
-			key: "url",
-			label: "Broker URL",
-			labelKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.url.label",
-			placeholder: "mqtt://localhost:1883",
-			showWhen: {
-				field: "onboard",
-				equals: false
-			}
-		},
-		{
-			type: "text",
-			key: "username",
-			label: "Username",
-			labelKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.username.label",
-			placeholder: "(optional)"
-		},
-		{
-			type: "password",
-			key: "password",
-			label: "Password",
-			labelKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.password.label",
-			showToggle: true
-		},
-		{
-			type: "text",
-			key: "clientIdPrefix",
-			label: "Client ID prefix",
-			labelKey: "mqtt-broker:mqttBrokerSettings.s_mqtt-broker-connection.clientIdPrefix.label",
-			placeholder: "(optional)",
-			showWhen: {
-				field: "onboard",
-				equals: false
-			}
-		}
-	]
-}] };
 var DEFAULT_CONFIG = {
-	embeddedEnabled: false,
-	embeddedId: "",
-	embeddedPort: DEFAULT_EMBEDDED_PORT,
-	embeddedAllowAnonymous: false,
-	embeddedUsername: "",
-	embeddedPassword: "",
 	embeddedClients: [],
 	embeddedAcl: []
 };
 var MqttBrokerAddon = class extends BaseAddon {
-	embeddedRuntime = null;
-	/** Per-entry onboard `aedes` runtimes, keyed by `ExternalBrokerEntry.id`. */
+	/** Per-record onboard `aedes` runtimes, keyed by `ExternalBrokerEntry.id`. */
 	onboardRuntimes = /* @__PURE__ */ new Map();
 	probeCache = null;
 	brokerStore = null;
-	instances = null;
+	brokerInstances = null;
 	clientStore = null;
 	aclStore = null;
 	/** The external broker rows: the `brokers` records, secrets resolved. */
@@ -123745,6 +124266,20 @@ var MqttBrokerAddon = class extends BaseAddon {
 		if (this.brokerStore === null) throw new Error("mqtt-broker: the broker records are not open");
 		return this.brokerStore;
 	}
+	/** What the addon knows of a broker right now: its onboard server or its last probe. */
+	liveState(id) {
+		const running = this.onboardRuntimes.get(id);
+		const probe = this.probeCache?.get(id);
+		return {
+			onboard: running === void 0 ? null : { connectedClients: running.aedes.connectedClients },
+			...probe !== void 0 ? { probe: {
+				status: probe.status,
+				latencyMs: probe.latencyMs,
+				...probe.error !== void 0 ? { error: probe.error } : {},
+				lastCheckedAt: probe.lastCheckedAt
+			} } : {}
+		};
+	}
 	async persistExternalBrokers(entries) {
 		this.activeExternalBrokers = [...entries];
 		await this.requireBrokerStore().replaceAll(entries);
@@ -123794,19 +124329,13 @@ var MqttBrokerAddon = class extends BaseAddon {
 		this.brokerStore = MqttBrokerStore.of(records);
 		this.clientStore = MqttClientStore.of(records);
 		this.aclStore = MqttAclStore.of(records);
-		this.instances = new RecordIntegrationInstances(records, mqttBrokersEntryKind, {
-			description: {
-				role: "services",
-				instanceMode: "multiple",
-				kind: "brokers",
-				canTest: false
-			},
-			formSchema: () => this.brokerForm(),
-			initialBody: (name) => ({
-				name,
-				url: "mqtt://"
-			}),
-			configured: (body) => body.url.trim().length > 0 && body.url.trim() !== "mqtt://",
+		this.brokerInstances = buildMqttBrokerInstances(records, {
+			formSchema: (id, onboard) => this.brokerForm(id, onboard),
+			listMqttHaInstances: () => listMqttHaInstancesOver(this.ctx.api),
+			freePort: () => findFreePort(),
+			probe: (cfg) => this.probeMqtt(cfg),
+			onboardListening: (id) => this.onboardRuntimes.has(id),
+			liveState: (id) => this.liveState(id),
 			onChanged: async () => {
 				await this.refreshExternalBrokers();
 			}
@@ -123835,29 +124364,9 @@ var MqttBrokerAddon = class extends BaseAddon {
 		});
 		this.probeCache.setBrokersSource(() => this.collectExternalProbeInputs());
 		this.probeCache.start();
-		const persistedEmbedded = this.deriveEmbeddedEntry();
-		if (persistedEmbedded) try {
-			await this.spawnEmbedded(persistedEmbedded);
-			this.ctx.logger.info("embedded mqtt broker restarted", {
-				meta: { port: persistedEmbedded.port },
-				tags: {
-					topic: "mqtt-broker",
-					phase: "embedded-restarted"
-				}
-			});
-		} catch (err) {
-			this.ctx.logger.warn("embedded mqtt broker failed to restart", {
-				meta: { error: errMsg(err) },
-				tags: {
-					topic: "mqtt-broker",
-					phase: "embedded-restart-failed"
-				}
-			});
-		}
 		await this.reconcileOnboardRuntimes();
 		this.ctx.addDisposer(async () => {
 			await this.probeCache?.stop();
-			await this.shutdownEmbedded().catch(() => void 0);
 			await this.shutdownAllOnboard();
 		});
 		const provider = {
@@ -123869,11 +124378,13 @@ var MqttBrokerAddon = class extends BaseAddon {
 			startEmbeddedBroker: async (input) => this.startEmbeddedBroker(input),
 			stopEmbeddedBroker: async ({ id }) => this.stopEmbeddedBroker(id),
 			getStatus: async () => ({
-				brokerCount: this.activeExternalBrokers.length + (this.config.embeddedEnabled ? 1 : 0),
-				embeddedRunning: this.embeddedRuntime !== null
+				brokerCount: this.activeExternalBrokers.length,
+				embeddedRunning: this.onboardRuntimes.size > 0
 			})
 		};
 		const unifiedProvider = this.buildUnifiedBrokerProvider();
+		const brokerInstances = this.brokerInstances;
+		if (brokerInstances === null) throw new Error("mqtt-broker: the broker instances are not built");
 		return [
 			{
 				capability: mqttBrokerCapability,
@@ -123885,111 +124396,21 @@ var MqttBrokerAddon = class extends BaseAddon {
 			},
 			{
 				capability: integrationInstancesCapability,
-				provider: this.instances.toProvider()
+				provider: brokerInstances
 			}
 		];
 	}
+	/**
+	* The bus-only `broker` cap (D1013). The brokers themselves are the `integration-instances`
+	* provider; this one only answers the config read and the status.
+	*/
 	buildUnifiedBrokerProvider() {
-		const KIND = "mqtt";
-		const ownerAddonId = this.ctx.id;
-		const adapt = (info) => ({
-			id: info.id,
-			addonId: ownerAddonId,
-			name: info.name,
-			kind: KIND,
-			status: mapMqttStatus(info.status),
-			info: {
-				...info.latencyMs !== null ? { latencyMs: info.latencyMs } : {},
-				...info.kind === "embedded" ? {
-					embedded: true,
-					connectedClients: info.connectedClients ?? 0
-				} : {}
-			},
-			lastCheckedAt: info.lastCheckedAt ?? null,
-			error: info.error ?? null
-		});
-		const owns = (id) => {
-			if (this.activeExternalBrokers.some((b) => b.id === id)) return true;
-			const embedded = this.deriveEmbeddedEntry();
-			return embedded !== null && embedded.id === id;
-		};
+		const owns = (id) => this.activeExternalBrokers.some((b) => b.id === id);
 		return {
-			list: async ({ kind }) => {
-				if (kind && kind !== KIND) return [];
-				return (await this.listBrokers()).map(adapt);
-			},
-			get: async ({ id }) => {
-				const match = (await this.listBrokers()).find((b) => b.id === id);
-				return match ? adapt(match) : null;
-			},
-			listProviders: async () => [{
-				addonId: ownerAddonId,
-				kinds: [{
-					kind: KIND,
-					label: "MQTT"
-				}]
-			}],
-			add: async ({ kind, name, settings, id }) => {
-				if (kind !== KIND) throw new Error(`mqtt-broker: only kind '${KIND}' is handled here (got '${kind}')`);
-				if (id !== void 0) throw new Error("mqtt-broker: adopting an existing broker id is not supported by this provider");
-				if (isOnboardRequested(settings)) return this.addOnboardBroker(name, settings);
-				const url = typeof settings["url"] === "string" ? settings["url"] : "";
-				if (!url) throw new Error("mqtt-broker.add: settings.url is required");
-				const input = {
-					name,
-					url,
-					...typeof settings["username"] === "string" ? { username: settings["username"] } : {},
-					...typeof settings["password"] === "string" ? { password: settings["password"] } : {},
-					...typeof settings["clientIdPrefix"] === "string" ? { clientIdPrefix: settings["clientIdPrefix"] } : {}
-				};
-				return this.addBroker(input);
-			},
-			remove: async ({ id }) => {
-				if (!owns(id)) return;
-				await this.removeBroker(id);
-			},
-			testConnection: async ({ id }) => {
-				if (!owns(id)) return {
-					ok: false,
-					error: "unknown broker"
-				};
-				return this.testConnection(id);
-			},
-			getSettings: async ({ id }) => {
-				if (!owns(id)) return null;
-				return this.getBrokerConfig(id);
-			},
-			setSettings: async () => {
-				throw new Error("mqtt-broker.setSettings: not supported — use remove + add to replace a broker");
-			},
 			getBrokerConfig: async ({ id }) => {
 				if (!owns(id)) return null;
 				return this.getBrokerConfig(id);
 			},
-			getSettingsSchema: async ({ kind }) => {
-				if (kind !== KIND) return null;
-				return mqttBrokerSettingsSchema;
-			},
-			testSettings: async ({ kind, settings }) => {
-				if (kind !== KIND) return {
-					ok: false,
-					error: `unsupported kind: ${kind}`
-				};
-				if (isOnboardRequested(settings)) return {
-					ok: true,
-					latencyMs: 0
-				};
-				const url = typeof settings["url"] === "string" ? settings["url"] : "";
-				if (!url) return {
-					ok: false,
-					error: "settings.url is required"
-				};
-				return this.probeMqtt({
-					url,
-					...typeof settings["username"] === "string" ? { username: settings["username"] } : {},
-					...typeof settings["password"] === "string" ? { password: settings["password"] } : {}
-				});
-			},
 			publish: async () => {
 				throw new Error("mqtt-broker.publish: not supported — fetch getBrokerConfig + open your own mqtt.js client (see \"NOT a pub/sub proxy\" in mqtt-broker.cap.ts)");
 			},
@@ -124003,7 +124424,7 @@ var MqttBrokerAddon = class extends BaseAddon {
 			getStatus: async () => {
 				const all = await this.listBrokers();
 				return {
-					brokerCount: this.activeExternalBrokers.length + (this.config.embeddedEnabled ? 1 : 0),
+					brokerCount: this.activeExternalBrokers.length,
 					connectedCount: all.filter((b) => b.status === "connected").length
 				};
 			}
@@ -124011,35 +124432,13 @@ var MqttBrokerAddon = class extends BaseAddon {
 	}
 	async onShutdown() {
 		await this.probeCache?.stop();
-		await this.shutdownEmbedded().catch(() => void 0);
 		await this.shutdownAllOnboard();
 	}
 	async onConfigChanged() {
 		this.activeExternalBrokers = await this.requireBrokerStore().listResolved();
 		await this.syncEmbeddedEntriesFromConfig();
 		await this.reconcileOnboardRuntimes();
-		const desired = this.deriveEmbeddedEntry();
-		const running = this.embeddedRuntime?.entry ?? null;
-		if (!desired && running) {
-			await this.shutdownEmbedded();
-			return;
-		}
-		if (desired && !running) {
-			await this.spawnEmbedded(desired).catch((err) => {
-				this.ctx.logger.warn("embedded mqtt broker spawn (on config change) failed", { meta: { error: errMsg(err) } });
-			});
-			return;
-		}
-		if (desired && running) {
-			if (requiresEmbeddedRespawn(desired, running)) {
-				await this.shutdownEmbedded();
-				await this.spawnEmbedded(desired).catch((err) => {
-					this.ctx.logger.warn("embedded mqtt broker respawn failed", { meta: { error: errMsg(err) } });
-				});
-				return;
-			}
-			this.reconcileEmbeddedClients();
-		}
+		this.reconcileEmbeddedClients();
 	}
 	async listBrokers() {
 		const out = [];
@@ -124073,28 +124472,12 @@ var MqttBrokerAddon = class extends BaseAddon {
 			};
 			out.push(info);
 		}
-		const embedded = this.deriveEmbeddedEntry();
-		if (embedded) {
-			const running = this.embeddedRuntime;
-			const status = running !== null ? "connected" : "disconnected";
-			const info = {
-				id: embedded.id,
-				name: embedded.name,
-				url: `mqtt://127.0.0.1:${embedded.port}`,
-				kind: "embedded",
-				status,
-				latencyMs: null,
-				...running ? { connectedClients: running.aedes.connectedClients } : {},
-				lastCheckedAt: Date.now()
-			};
-			out.push(info);
-		}
 		return out;
 	}
 	getBrokerConfig(id) {
 		const external = this.activeExternalBrokers.find((b) => b.id === id);
 		if (external) {
-			if (external.enabled === false) throw new Error(`mqtt-broker: broker '${id}' is switched off`);
+			if (!isInstanceEnabled(external)) throw new Error(`mqtt-broker: broker '${id}' is switched off`);
 			const password = this.storedPassword(external.password);
 			return {
 				url: external.url,
@@ -124103,15 +124486,6 @@ var MqttBrokerAddon = class extends BaseAddon {
 				...external.clientIdPrefix !== void 0 ? { clientIdPrefix: external.clientIdPrefix } : {}
 			};
 		}
-		const embedded = this.deriveEmbeddedEntry();
-		if (embedded && embedded.id === id) {
-			const password = this.storedPassword(embedded.password);
-			return {
-				url: `mqtt://127.0.0.1:${embedded.port}`,
-				...embedded.username !== void 0 ? { username: embedded.username } : {},
-				...password !== void 0 ? { password } : {}
-			};
-		}
 		throw new Error(`mqtt-broker: broker '${id}' not found`);
 	}
 	async addBroker(input) {
@@ -124132,44 +124506,6 @@ var MqttBrokerAddon = class extends BaseAddon {
 		} });
 		return { id };
 	}
-	/**
-	* Create a per-entry ONBOARD broker from `broker.add` settings: allocate
-	* (or honour) a port, persist an `ExternalBrokerEntry` carrying an
-	* `onboard` descriptor, then spawn its dedicated `aedes` server.
-	*/
-	async addOnboardBroker(name, settings) {
-		const id = randomUUID();
-		const port = readOnboardPort(settings) ?? await findFreePort();
-		const built = buildOnboardEntry({
-			id,
-			name,
-			port,
-			settings
-		});
-		const entry = {
-			id: built.id,
-			name: built.name,
-			url: built.url,
-			...built.username !== void 0 ? { username: built.username } : {},
-			...built.password !== void 0 ? { password: built.password } : {},
-			onboard: built.onboard
-		};
-		const next = [...this.activeExternalBrokers, entry];
-		await this.persistExternalBrokers(next);
-		const spawn = this.onboardSpawnEntry(entry);
-		if (spawn) await this.spawnOnboard(spawn);
-		this.ctx.logger.info("onboard mqtt broker added", {
-			meta: {
-				id,
-				port
-			},
-			tags: {
-				topic: "mqtt-broker",
-				phase: "onboard-started"
-			}
-		});
-		return { id };
-	}
 	async removeBroker(id) {
 		const removed = this.activeExternalBrokers.find((b) => b.id === id);
 		if (removed) {
@@ -124180,13 +124516,6 @@ var MqttBrokerAddon = class extends BaseAddon {
 			this.ctx.logger.info("mqtt broker removed", { meta: { id } });
 			return;
 		}
-		const embedded = this.deriveEmbeddedEntry();
-		if (embedded && embedded.id === id) {
-			await this.shutdownEmbedded();
-			await this.updateGlobalSettings({ embeddedEnabled: false });
-			this.ctx.logger.info("embedded mqtt broker removed", { meta: { id } });
-			return;
-		}
 	}
 	async testConnection(id) {
 		let cfg;
@@ -124205,7 +124534,7 @@ var MqttBrokerAddon = class extends BaseAddon {
 	* One-shot connectivity probe against an MQTT endpoint built from a
 	* flat config (`{url, username?, password?}`). Shared by the
 	* id-keyed `testConnection` (existing broker) and the pre-creation
-	* `testSettings` (throwaway settings the operator hasn't saved yet).
+	* the instance test (`testInstance`) of a broker not saved yet (the typed values).
 	* Never throws — every failure resolves to `{ ok: false, error }`.
 	*/
 	async probeMqtt(cfg) {
@@ -124250,30 +124579,46 @@ var MqttBrokerAddon = class extends BaseAddon {
 			});
 		});
 	}
+	/** The `brokers` records, for the two legacy cap methods that create or switch off one. */
+	brokerRecordHandle() {
+		const handle = this.ctx.records?.kind(mqttBrokersEntryKind);
+		if (handle === void 0) throw new Error("mqtt-broker: the broker records are not open");
+		return handle;
+	}
+	/** Create an ONBOARD broker record; the reconcile then spawns its `aedes` server. */
 	async startEmbeddedBroker(input) {
-		if (this.embeddedRuntime) throw new Error("embedded broker already running — call stopEmbeddedBroker first");
-		const id = this.config.embeddedId || randomUUID();
-		const entry = {
+		const id = randomUUID();
+		const built = buildOnboardEntry({
 			id,
-			name: "Embedded broker",
+			name: LEGACY_EMBEDDED_NAME,
 			port: input.port,
-			allowAnonymous: input.allowAnonymous,
-			...input.username !== void 0 ? { username: input.username } : {},
-			...input.password !== void 0 ? { password: input.password } : {}
-		};
-		await this.spawnEmbedded(entry);
-		await this.updateGlobalSettings({
-			embeddedEnabled: true,
-			embeddedId: id,
-			embeddedPort: input.port,
-			embeddedAllowAnonymous: input.allowAnonymous,
-			embeddedUsername: input.username ?? "",
-			embeddedPassword: input.password ?? ""
+			settings: {
+				allowAnonymous: input.allowAnonymous,
+				...input.username !== void 0 ? { username: input.username } : {},
+				...input.password !== void 0 ? { password: input.password } : {}
+			}
 		});
+		const handle = this.brokerRecordHandle();
+		await handle.put({
+			id,
+			data: mqttBrokersEntryKind.schema.parse({
+				name: built.name,
+				url: built.url,
+				...built.username !== void 0 ? { username: built.username } : {},
+				...built.password !== void 0 ? { password: built.password } : {},
+				onboard: built.onboard
+			})
+		}, { ifRev: 0 });
+		await this.refreshExternalBrokers();
+		if (!this.onboardRuntimes.has(id)) {
+			await handle.delete(id);
+			await this.refreshExternalBrokers();
+			throw new Error(`embedded broker could not listen on port ${input.port}`);
+		}
 		this.ctx.logger.info("embedded mqtt broker started", {
 			meta: {
 				id,
-				port: entry.port
+				port: input.port
 			},
 			tags: {
 				topic: "mqtt-broker",
@@ -124295,20 +124640,22 @@ var MqttBrokerAddon = class extends BaseAddon {
 		});
 		return {
 			id,
-			url: `mqtt://127.0.0.1:${entry.port}`
+			url: built.url
 		};
 	}
+	/** Switch an onboard broker off (its record stays, so it can be switched on again). */
 	async stopEmbeddedBroker(id) {
-		if (!this.embeddedRuntime || this.embeddedRuntime.entry.id !== id) return;
-		await this.shutdownEmbedded();
-		await this.updateGlobalSettings({ embeddedEnabled: false });
+		const handle = this.brokerRecordHandle();
+		const row = await handle.get(id);
+		if (row === null || row.data.onboard === void 0) return;
+		await handle.patch(id, { enabled: false });
+		await this.refreshExternalBrokers();
 		this.ctx.logger.info("embedded mqtt broker stopped", { meta: { id } });
 	}
 	/**
 	* Build + listen an `aedes` server for `entry` and RETURN the runtime
-	* without assigning it to any field. Shared by the legacy single
-	* embedded broker ({@link spawnEmbedded}) and the per-entry onboard
-	* brokers ({@link spawnOnboard}).
+	* without assigning it to any field (the onboard brokers keep theirs in
+	* {@link spawnOnboard}).
 	*/
 	async spawnAedes(entry) {
 		const aedes = new import_aedes.default();
@@ -124347,15 +124694,6 @@ var MqttBrokerAddon = class extends BaseAddon {
 			aedes.close(() => resolve());
 		});
 	}
-	async spawnEmbedded(entry) {
-		this.embeddedRuntime = await this.spawnAedes(entry);
-	}
-	async shutdownEmbedded() {
-		if (!this.embeddedRuntime) return;
-		const runtime = this.embeddedRuntime;
-		this.embeddedRuntime = null;
-		await this.closeRuntime(runtime);
-	}
 	/** Spawn a dedicated onboard `aedes` server for an onboard entry. */
 	async spawnOnboard(entry) {
 		const runtime = await this.spawnAedes(entry);
@@ -124395,7 +124733,7 @@ var MqttBrokerAddon = class extends BaseAddon {
 	* entry disappeared, and respawn runtimes whose port changed.
 	*/
 	async reconcileOnboardRuntimes() {
-		const desiredEntries = this.activeExternalBrokers.filter(hasOnboard).filter((b) => b.enabled !== false);
+		const desiredEntries = this.activeExternalBrokers.filter(hasOnboard).filter((b) => isInstanceEnabled(b));
 		const desired = desiredEntries.map((b) => ({
 			id: b.id,
 			port: b.onboard.port
@@ -124492,8 +124830,9 @@ var MqttBrokerAddon = class extends BaseAddon {
 	* (or whose username was removed entirely) get force-closed.
 	*/
 	reconcileEmbeddedClients() {
-		const runtime = this.embeddedRuntime;
-		if (!runtime) return;
+		for (const runtime of this.onboardRuntimes.values()) this.reconcileRuntimeClients(runtime);
+	}
+	reconcileRuntimeClients(runtime) {
 		const prevSnapshot = runtime.credentialsSnapshot;
 		const nextSnapshot = this.buildCredentialsSnapshot();
 		const affectedUsers = [];
@@ -124532,30 +124871,10 @@ var MqttBrokerAddon = class extends BaseAddon {
 		for (const c of this.activeEmbeddedClients) m.set(c.username, c.passwordHash);
 		return m;
 	}
-	/**
-	* Reassemble the internal {@link EmbeddedBrokerEntry} from the flat
-	* `embedded*` config keys the settings form writes. Returns `null`
-	* when the embedded broker is disabled — that's the signal
-	* `onConfigChanged` / `onInitialize` use to decide whether to spawn
-	* or shut down the `aedes` instance.
-	*/
-	deriveEmbeddedEntry() {
-		if (!this.config.embeddedEnabled) return null;
-		const username = this.config.embeddedUsername;
-		const password = this.config.embeddedPassword;
-		return {
-			id: this.config.embeddedId || "embedded",
-			name: "Embedded broker",
-			port: this.config.embeddedPort,
-			allowAnonymous: this.config.embeddedAllowAnonymous,
-			...username.length > 0 ? { username } : {},
-			...password.length > 0 ? { password } : {}
-		};
-	}
 	collectExternalProbeInputs() {
 		const out = [];
 		for (const b of this.activeExternalBrokers) {
-			if (b.onboard !== void 0 || b.enabled === false) continue;
+			if (b.onboard !== void 0 || !isInstanceEnabled(b)) continue;
 			let password;
 			try {
 				password = this.storedPassword(b.password);
@@ -124588,19 +124907,13 @@ var MqttBrokerAddon = class extends BaseAddon {
 	* here (no migration code ships): the operator's one-off `mqtt` step does.
 	*/
 	reportRetiredCiphertext() {
-		const paths = retiredCiphertextPaths({
-			brokers: this.activeExternalBrokers,
-			embeddedPassword: this.config.embeddedPassword
-		});
+		const paths = retiredCiphertextPaths({ brokers: this.activeExternalBrokers });
 		if (paths.length === 0) return;
 		const unreadable = [];
 		const values = [...this.activeExternalBrokers.map((b) => ({
 			id: `brokers[${b.id}].password`,
 			v: b.password
-		})), {
-			id: "embeddedPassword",
-			v: this.config.embeddedPassword
-		}];
+		}))];
 		for (const { id, v } of values) try {
 			this.storedPassword(v);
 		} catch (err) {
@@ -124624,13 +124937,79 @@ var MqttBrokerAddon = class extends BaseAddon {
 			}
 		});
 	}
-	brokerForm() {
+	/**
+	* The broker form. The create form (`id` null) offers "run an onboard broker" (CamStack hosts an
+	* `aedes` server on this hub: a port, anonymous access) or an external URL; an existing onboard
+	* broker edits only its credentials, since its address is the one it was given.
+	*/
+	brokerForm(id, onboard) {
+		const credentials = [{
+			type: "text",
+			key: "username",
+			label: "Username",
+			labelKey: "mqtt-broker:fullSettings.brokers.username.label"
+		}, {
+			type: "password",
+			key: "password",
+			label: "Password",
+			labelKey: "mqtt-broker:fullSettings.brokers.password.label",
+			showToggle: true
+		}];
+		if (onboard) return this.schema({ sections: [{
+			id: "broker",
+			title: "Onboard broker",
+			description: "A CamStack-hosted broker on this hub. Its port was chosen when it was created.",
+			columns: 1,
+			fields: credentials
+		}] });
+		const creating = id === null;
+		const external = {
+			field: "onboard",
+			equals: false
+		};
 		return this.schema({ sections: [{
 			id: "broker",
-			title: "External broker",
-			description: "A broker running outside CamStack (mosquitto, EMQX, HiveMQ, cloud bridges, …). The password is kept in the keychain.",
+			title: creating ? "MQTT broker" : "External broker",
+			description: creating ? "Run a broker on this hub, or connect to one running outside CamStack (mosquitto, EMQX, HiveMQ, cloud bridges, …). The password is kept in the keychain." : "A broker running outside CamStack (mosquitto, EMQX, HiveMQ, cloud bridges, …). The password is kept in the keychain.",
 			columns: 1,
 			fields: [
+				...creating ? [
+					{
+						type: "boolean",
+						key: "onboard",
+						label: "Run an onboard broker",
+						labelKey: "mqtt-broker:fullSettings.brokers.onboard.label",
+						description: "Spin up a CamStack-hosted aedes broker on this hub instead of connecting to an external one. Each onboard broker gets its own dedicated server + port.",
+						descriptionKey: "mqtt-broker:fullSettings.brokers.onboard.description",
+						default: false
+					},
+					{
+						type: "number",
+						key: "port",
+						label: "Port",
+						labelKey: "mqtt-broker:fullSettings.brokers.port.label",
+						placeholder: "(auto)",
+						description: "TCP port for the onboard broker. Leave blank to auto-allocate a free port.",
+						descriptionKey: "mqtt-broker:fullSettings.brokers.port.description",
+						showWhen: {
+							field: "onboard",
+							equals: true
+						}
+					},
+					{
+						type: "boolean",
+						key: "allowAnonymous",
+						label: "Allow anonymous",
+						labelKey: "mqtt-broker:fullSettings.brokers.allowAnonymous.label",
+						description: "Permit clients to connect without a username/password.",
+						descriptionKey: "mqtt-broker:fullSettings.brokers.allowAnonymous.description",
+						default: false,
+						showWhen: {
+							field: "onboard",
+							equals: true
+						}
+					}
+				] : [],
 				{
 					type: "text",
 					key: "url",
@@ -124638,26 +125017,15 @@ var MqttBrokerAddon = class extends BaseAddon {
 					labelKey: "mqtt-broker:fullSettings.brokers.url.label",
 					description: "mqtt://, mqtts://, ws://, wss://",
 					descriptionKey: "mqtt-broker:fullSettings.brokers.url.description",
-					required: true
-				},
-				{
-					type: "text",
-					key: "username",
-					label: "Username",
-					labelKey: "mqtt-broker:fullSettings.brokers.username.label"
-				},
-				{
-					type: "password",
-					key: "password",
-					label: "Password",
-					labelKey: "mqtt-broker:fullSettings.brokers.password.label",
-					showToggle: true
+					...creating ? { showWhen: external } : { required: true }
 				},
+				...credentials,
 				{
 					type: "text",
 					key: "clientIdPrefix",
 					label: "Client id prefix",
-					labelKey: "mqtt-broker:fullSettings.brokers.clientIdPrefix.label"
+					labelKey: "mqtt-broker:fullSettings.brokers.clientIdPrefix.label",
+					...creating ? { showWhen: external } : {}
 				}
 			]
 		}] });
@@ -124668,6 +125036,41 @@ var MqttBrokerAddon = class extends BaseAddon {
 		if (handle === void 0) throw new Error("records are not available");
 		return {
 			readRawBrokers: async () => (await this.ctx.settings?.readAddonStore())?.["brokers"],
+			readLegacyEmbedded: async () => {
+				const raw = await this.ctx.settings?.readAddonStore() ?? {};
+				const secrets = this.ctx.secrets;
+				const { value } = secrets === void 0 ? { value: raw } : await resolveSecretMarkers(raw, secrets, {
+					unresolved: "keep-marker",
+					ownedBy: secrets.owner
+				});
+				const text = (key) => {
+					const v = value[key];
+					return typeof v === "string" && v.length > 0 ? v : void 0;
+				};
+				const port = value["embeddedPort"];
+				const username = text("embeddedUsername");
+				const password = this.storedPassword(text("embeddedPassword"));
+				const enabled = value["embeddedEnabled"] === true;
+				if (!(enabled || text("embeddedId") !== void 0 || username !== void 0 || password !== void 0)) return null;
+				return {
+					enabled,
+					id: text("embeddedId") ?? "embedded",
+					port: typeof port === "number" && Number.isInteger(port) ? port : 1883,
+					allowAnonymous: value["embeddedAllowAnonymous"] === true,
+					...username !== void 0 ? { username } : {},
+					...password !== void 0 ? { password } : {}
+				};
+			},
+			readRawEmbeddedKeys: async () => {
+				const raw = await this.ctx.settings?.readAddonStore() ?? {};
+				return Object.fromEntries(LEGACY_EMBEDDED_KEYS.filter((key) => key in raw).map((key) => [key, raw[key]]));
+			},
+			putOnboardRecord: async (id, body) => {
+				await handle.put({
+					id,
+					data: mqttBrokersEntryKind.schema.parse(body)
+				}, { ifRev: 0 });
+			},
 			readRecords: async () => {
 				const page = await handle.query({ limit: 1e3 });
 				return new Map(page.records.map((r) => [r.id, { hasPassword: (r.data.password ?? "").length > 0 }]));
@@ -124684,184 +125087,105 @@ var MqttBrokerAddon = class extends BaseAddon {
 		return ["mqtt-broker", "broker"];
 	}
 	/**
-	* The embedded broker, its credentials and the ACL. The external brokers are records, listed
+	* The credentials and the ACL of the onboard brokers. The brokers are records, listed
 	* on the Brokers page and edited as integration instances (`brokerForm`).
 	*/
 	async clusterSettingsSchema(cap) {
 		if (cap !== "mqtt-broker" && cap !== "broker") return null;
-		return this.schema({ sections: [
-			{
-				id: "mqtt-broker-embedded",
-				title: "Embedded broker",
-				titleKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.title",
-				description: "Optional CamStack-hosted aedes broker. Enable it to run a broker on this hub without standing up an external one — its connection details are exposed through the `mqtt-broker` cap like any external entry.",
-				descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.description",
-				columns: 2,
-				fields: [
-					this.field({
-						type: "boolean",
-						key: "embeddedEnabled",
-						label: "Run embedded broker",
-						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedEnabled.label",
-						description: "Starts an aedes broker on this hub. Disabling it shuts the broker down and disconnects clients.",
-						descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedEnabled.description",
-						style: "switch",
-						default: false
-					}),
-					this.field({
-						type: "number",
-						key: "embeddedPort",
-						label: "Port",
-						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedPort.label",
-						description: "TCP port the embedded broker listens on.",
-						descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedPort.description",
-						min: 1,
-						max: 65535,
-						default: DEFAULT_EMBEDDED_PORT,
-						showWhen: {
-							field: "embeddedEnabled",
-							equals: true
-						}
-					}),
-					this.field({
-						type: "boolean",
-						key: "embeddedAllowAnonymous",
-						label: "Allow anonymous",
-						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedAllowAnonymous.label",
-						description: "Permit clients to connect without a username/password.",
-						descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedAllowAnonymous.description",
-						style: "switch",
-						default: false,
-						showWhen: {
-							field: "embeddedEnabled",
-							equals: true
-						}
-					}),
-					this.field({
-						type: "text",
-						key: "embeddedUsername",
-						label: "Shared username",
-						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedUsername.label",
-						description: "Legacy single-user fallback — used only when no per-client credentials are configured below.",
-						descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedUsername.description",
-						default: "",
-						showWhen: {
-							field: "embeddedEnabled",
-							equals: true
-						}
-					}),
-					this.field({
-						type: "password",
-						key: "embeddedPassword",
-						label: "Shared password",
-						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedPassword.label",
-						description: "Kept in the keychain. Paired with the shared username above.",
-						descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded.embeddedPassword.description",
-						showToggle: true,
-						default: "",
-						showWhen: {
-							field: "embeddedEnabled",
-							equals: true
-						}
-					})
-				]
-			},
-			{
-				id: "mqtt-broker-embedded-clients",
-				title: "Embedded broker — credentials",
-				titleKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.title",
-				description: "Per-client username + bcrypt password hash for the embedded aedes broker. Generate the hash with `npx bcrypt-cli` (or any bcrypt tool, cost factor 10) and paste it here.",
-				descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.description",
-				columns: 1,
-				fields: [{
-					type: "editable-array",
-					key: "embeddedClients",
-					label: "Clients",
-					labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.label",
-					emptyMessage: "No clients configured — embedded broker is in shared-creds / anonymous mode.",
-					addLabel: "Add client",
-					rowTitleTemplate: "{username}",
-					defaultItem: {
-						username: "",
-						passwordHash: ""
-					},
-					itemFields: [{
+		return this.schema({ sections: [{
+			id: "mqtt-broker-embedded-clients",
+			title: "Embedded broker — credentials",
+			titleKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.title",
+			description: "Per-client username + bcrypt password hash for the embedded aedes broker. Generate the hash with `npx bcrypt-cli` (or any bcrypt tool, cost factor 10) and paste it here.",
+			descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.description",
+			columns: 1,
+			fields: [{
+				type: "editable-array",
+				key: "embeddedClients",
+				label: "Clients",
+				labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.label",
+				emptyMessage: "No clients configured — embedded broker is in shared-creds / anonymous mode.",
+				addLabel: "Add client",
+				rowTitleTemplate: "{username}",
+				defaultItem: {
+					username: "",
+					passwordHash: ""
+				},
+				itemFields: [{
+					type: "text",
+					key: "username",
+					label: "Username",
+					labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.username.label"
+				}, {
+					type: "text",
+					key: "passwordHash",
+					label: "bcrypt hash",
+					labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.passwordHash.label",
+					description: "bcrypt hash of the password (cost factor 10).",
+					descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.passwordHash.description"
+				}]
+			}]
+		}, {
+			id: "mqtt-broker-embedded-acl",
+			title: "Embedded broker — topic ACL",
+			titleKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.title",
+			description: "Per-user pub/sub allow-list. With zero rules the broker is fully open to authenticated clients. With at least one rule, every user needs at least one rule that matches the topic.",
+			descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.description",
+			columns: 1,
+			fields: [{
+				type: "editable-array",
+				key: "embeddedAcl",
+				label: "Rules",
+				labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.label",
+				emptyMessage: "No ACL rules — embedded broker is wide open to authenticated users.",
+				addLabel: "Add rule",
+				rowTitleTemplate: "{username} → {topicPattern} ({access})",
+				defaultItem: {
+					username: "",
+					topicPattern: "#",
+					access: "both"
+				},
+				itemFields: [
+					{
 						type: "text",
 						key: "username",
 						label: "Username",
-						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.username.label"
-					}, {
+						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.username.label"
+					},
+					{
 						type: "text",
-						key: "passwordHash",
-						label: "bcrypt hash",
-						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.passwordHash.label",
-						description: "bcrypt hash of the password (cost factor 10).",
-						descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-clients.embeddedClients.passwordHash.description"
-					}]
-				}]
-			},
-			{
-				id: "mqtt-broker-embedded-acl",
-				title: "Embedded broker — topic ACL",
-				titleKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.title",
-				description: "Per-user pub/sub allow-list. With zero rules the broker is fully open to authenticated clients. With at least one rule, every user needs at least one rule that matches the topic.",
-				descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.description",
-				columns: 1,
-				fields: [{
-					type: "editable-array",
-					key: "embeddedAcl",
-					label: "Rules",
-					labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.label",
-					emptyMessage: "No ACL rules — embedded broker is wide open to authenticated users.",
-					addLabel: "Add rule",
-					rowTitleTemplate: "{username} → {topicPattern} ({access})",
-					defaultItem: {
-						username: "",
-						topicPattern: "#",
-						access: "both"
+						key: "topicPattern",
+						label: "Topic pattern",
+						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.topicPattern.label",
+						description: "MQTT wildcards: `+` = single level, `#` = multi-level.",
+						descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.topicPattern.description"
 					},
-					itemFields: [
-						{
-							type: "text",
-							key: "username",
-							label: "Username",
-							labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.username.label"
-						},
-						{
-							type: "text",
-							key: "topicPattern",
-							label: "Topic pattern",
-							labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.topicPattern.label",
-							description: "MQTT wildcards: `+` = single level, `#` = multi-level.",
-							descriptionKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.topicPattern.description"
-						},
-						{
-							type: "select",
-							key: "access",
-							label: "Access",
-							labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.label",
-							options: [
-								{
-									value: "sub",
-									label: "Subscribe only",
-									labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.o_sub.label"
-								},
-								{
-									value: "pub",
-									label: "Publish only",
-									labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.o_pub.label"
-								},
-								{
-									value: "both",
-									label: "Subscribe + publish",
-									labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.o_both.label"
-								}
-							]
-						}
-					]
-				}]
-			}
-		] });
+					{
+						type: "select",
+						key: "access",
+						label: "Access",
+						labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.label",
+						options: [
+							{
+								value: "sub",
+								label: "Subscribe only",
+								labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.o_sub.label"
+							},
+							{
+								value: "pub",
+								label: "Publish only",
+								labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.o_pub.label"
+							},
+							{
+								value: "both",
+								label: "Subscribe + publish",
+								labelKey: "mqtt-broker:fullSettings.s_mqtt-broker-embedded-acl.embeddedAcl.access.o_both.label"
+							}
+						]
+					}
+				]
+			}]
+		}] });
 	}
 };
 /**
@@ -124891,13 +125215,6 @@ function bcryptCompareSafe(plain, hash) {
 	}
 }
 /**
-* Decide whether a config update to the embedded broker requires a full
-* restart (port change) or can be hot-reloaded (credential / ACL change).
-*/
-function requiresEmbeddedRespawn(desired, running) {
-	return desired.id !== running.id || desired.port !== running.port || desired.allowAnonymous !== running.allowAnonymous || desired.username !== running.username || desired.password !== running.password;
-}
-/**
 * Read the `username` field off an aedes Client without leaking a cast.
 * aedes attaches the username at runtime but its `.d.ts` doesn't carry
 * it — we narrow with a small structural check.
@@ -124950,15 +125267,5 @@ async function findFreePort() {
 		});
 	});
 }
-function mapMqttStatus(s) {
-	switch (s) {
-		case "connected": return "connected";
-		case "disconnected": return "disconnected";
-		case "auth-failed": return "auth-failed";
-		case "unreachable": return "unreachable";
-		case "tls-error": return "error";
-		default: return "error";
-	}
-}
 //#endregion
 export { MQTT_EMBEDDED_BCRYPT_ROUNDS, MqttBrokerAddon, MqttBrokerAddon as default };