@camstack/addon-mqtt-broker 1.2.77 → 1.2.79

package/dist/mqtt-broker.addon.js

@@ -7644,111 +7644,6 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
-/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -8694,8 +8589,11 @@ var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -8716,21 +8614,20 @@ var StorageLocationSchema = object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: string().optional(),
-	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
@@ -8743,10 +8640,12 @@ var StorageLocationSchema = object({
 	createdAt: number(),
 	updatedAt: number()
 });
+object({ isDefault: boolean().optional() });
 /**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -8922,6 +8821,111 @@ var DecoderSessionConfigSchema = object({
 	*/
 	debug: boolean().optional()
 });
+/**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10578,12 +10582,30 @@ var BackupDestinationInfoSchema = object({
 	lastSuccessAt: number().optional(),
 	/** Newest-archive size from `manifests.json`, or undefined. */
 	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
 	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
 	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
@@ -10746,8 +10768,16 @@ var BackupScheduleSchema = object({
 	retentionCount: number().int().min(1).max(1e3),
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
+	/**
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
+	*/
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
 	/** ms-epoch of next computed firing (read-only, filled on list). */
 	nextRunAt: number().optional()
 });
@@ -10796,14 +10826,7 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	locationId: string(),
 	enabled: boolean(),
 	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
-	*/
-	cron: string().optional()
+	label: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -21635,7 +21658,7 @@ method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -34484,12 +34507,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storage.list": {
 		capName: "storage",
 		capScope: "system",

package/dist/mqtt-broker.addon.mjs

@@ -7639,111 +7639,6 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
-/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -8689,8 +8584,11 @@ var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -8711,21 +8609,20 @@ var StorageLocationSchema = object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: string().optional(),
-	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
@@ -8738,10 +8635,12 @@ var StorageLocationSchema = object({
 	createdAt: number(),
 	updatedAt: number()
 });
+object({ isDefault: boolean().optional() });
 /**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -8917,6 +8816,111 @@ var DecoderSessionConfigSchema = object({
 	*/
 	debug: boolean().optional()
 });
+/**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10573,12 +10577,30 @@ var BackupDestinationInfoSchema = object({
 	lastSuccessAt: number().optional(),
 	/** Newest-archive size from `manifests.json`, or undefined. */
 	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
 	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
 	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
@@ -10741,8 +10763,16 @@ var BackupScheduleSchema = object({
 	retentionCount: number().int().min(1).max(1e3),
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
+	/**
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
+	*/
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
 	/** ms-epoch of next computed firing (read-only, filled on list). */
 	nextRunAt: number().optional()
 });
@@ -10791,14 +10821,7 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	locationId: string(),
 	enabled: boolean(),
 	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
-	*/
-	cron: string().optional()
+	label: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -21630,7 +21653,7 @@ method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -34479,12 +34502,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storage.list": {
 		capName: "storage",
 		capScope: "system",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-mqtt-broker",
-  "version": "1.2.77",
+  "version": "1.2.79",
   "description": "MQTT broker registry addon for CamStack — manages external broker entries + an optional embedded aedes broker. Consumers spin up their own `mqtt.js` clients via the `mqtt-broker` cap.",
   "keywords": [
     "camstack",