@camstack/addon-osd-manager 0.1.15 → 0.1.16

package/dist/_stub.js

@@ -1,5 +1,5 @@
 import "./virtualExposes-BgZ5Cn7S.mjs";
-import "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-7VFK3Vnq.mjs";
+import "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-CsJNPlNP.mjs";
 import { _ as e, c as t, d as n, h as r, i, l as a, m as o, n as s, p as c, r as l, t as u, u as d, y as f } from "./_virtual_mf___mfe_internal__addon_osd_manager_page__loadShare__react__loadShare__.js-Bs1t18EM.mjs";
 import { i as p, o as m, r as h, s as g } from "./responsive-B6685e2G.mjs";
 import { c as _, l as v, u as y } from "./use-device-snapshot-BDmozw2y.mjs";

package/dist/{_virtual_mf-localSharedImportMap___mfe_internal__addon_osd_manager_page-DAdBzUD3.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_osd_manager_page-Yo6BXk0X.mjs}

@@ -1,4 +1,4 @@
-import "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-7VFK3Vnq.mjs";
+import "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-CsJNPlNP.mjs";
 //#region \0virtual:mf-localSharedImportMap:__mfe_internal__addon_osd_manager_page
 var e = {
 	"@camstack/sdk": {
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.89",
+		version: "1.2.90",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_osd_manager_page",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.61",
+		version: "1.2.62",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_osd_manager_page",

package/dist/{hostInit-BB5iEVB7.mjs → hostInit-Df_NHE4W.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.89",
+				version: "1.2.90",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.61",
+				version: "1.2.62",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/index.js

@@ -41255,6 +41255,37 @@ var OsdBindingsStore = class {
 	}
 };
 //#endregion
+//#region src/bound-index.ts
+/**
+* The durable index of cameras that have at least one OSD binding.
+*
+* WHY IT EXISTS. The render loop's work list used to be DERIVED at boot: list
+* every device in the directory, read each one's binding block, keep the ones
+* that answered non-empty. Every one of those reads is a UDS round-trip to the
+* settings store, and they ran one at a time. Measured on the boot of
+* 2026-08-19: 976 devices × 559 ms under boot load = 546 s in which
+* `OsdManager.start()` had not returned — and `start()` was awaited inside
+* `onInitialize()`, so for nine minutes the `osd-manager` and
+* `addon-pages-source` capabilities did not exist ANYWHERE in the cluster
+* (docs/architecture/addon-lifecycle.md). The answer it took nine minutes to
+* compute was `boundDevices = 0`.
+*
+* Filtering to cameras and fanning the reads out makes that scan cheap, but it
+* is still a scan. The index is the actual fix: the work list is WRITTEN where
+* bindings are written, so boot reads one key and is done in milliseconds. The
+* scan stays, in the background, as the reconcile — because an index nothing
+* checks is an index that eventually lies.
+*
+* The value is the SET of bound camera ids, serialised as a sorted array.
+* `null` is not "no cameras are bound", it is "this hub has never written the
+* index" — the two must stay distinguishable, because the first is authoritative
+* and the second means seed it from a scan. An empty ARRAY is the authoritative
+* "nothing is bound".
+*/
+/** Store key inside the addon's own (global) store. */
+var OSD_BOUND_INDEX_KEY = "boundDeviceIds";
+var OsdBoundIndexSchema = array(number().int().positive()).nullable();
+//#endregion
 //#region src/gate.ts
 /**
 * The display gate — "should this slot show its value right now?".
@@ -41331,6 +41362,27 @@ function evaluateGate(input) {
 	return OPEN;
 }
 //#endregion
+//#region src/lane-pool.ts
+/**
+* Apply `mapper` to every item with at most `limit` in flight at once.
+*
+* A rejecting mapper rejects the whole call (same contract as `Promise.all`);
+* a caller that must not fail the sweep for one bad unit catches INSIDE the
+* mapper — which is what every caller in this package does, because a unit that
+* threw must never be the reason the next camera is not reconciled.
+*/
+async function mapWithConcurrency(items, limit, mapper) {
+	const results = new Array(items.length);
+	if (items.length === 0) return results;
+	const lanes = Math.max(1, Math.min(Math.trunc(limit), items.length));
+	const entries = items.entries();
+	const lane = async () => {
+		for (const [index, item] of entries) results[index] = await mapper(item, index);
+	};
+	await Promise.all(Array.from({ length: lanes }, () => lane()));
+	return results;
+}
+//#endregion
 //#region src/format.ts
 /** Tokens `formatClock` understands. Anything else in the pattern is literal. */
 var CLOCK_TOKENS = [
@@ -41663,31 +41715,61 @@ var OsdManager = class {
 	recognitionGeneration = /* @__PURE__ */ new Map();
 	recognitionInvalidatedAt = /* @__PURE__ */ new Map();
 	timer = null;
+	/** The background reconcile, while one is running. Held so a second arming
+	*  cannot overlap the first — two concurrent passes would race on the index
+	*  write and could persist the older of the two answers. */
+	reconcile = null;
 	constructor(deps) {
 		this.deps = deps;
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
 	}
 	/**
-	* Learn which cameras have bindings, then start ticking. A camera with no
-	* binding costs nothing — it is never in `boundDevices`, so the loop
-	* never reads its state and never touches its firmware.
+	* Read the durable work list, start ticking, and arm the reconcile BEHIND
+	* both.
+	*
+	* This used to derive the work list first: list every device, read every
+	* device's binding block, one at a time. On 2026-08-19 that was 976 devices ×
+	* 559 ms = 546 s, awaited inside `onInitialize`, so every capability this
+	* addon declares was absent cluster-wide for nine minutes — and the answer was
+	* `boundDevices = 0`. A camera with no binding still costs nothing at runtime;
+	* what it used to cost was the boot.
+	*
+	* The scan did not go away, it moved: it is the reconcile, it runs in the
+	* background, and it is the only thing that keeps the index from silently
+	* lying.
 	*/
 	async start(tickMs) {
-		await this.reloadBoundDevices();
+		const stored = await this.readBoundIndex();
+		if (stored !== null) {
+			this.boundDevices.clear();
+			for (const deviceId of stored) this.boundDevices.add(deviceId);
+		}
 		this.timer = setInterval(() => {
 			this.renderAllBound();
 		}, tickMs);
 		this.logger.info("osd-manager: render loop started", { meta: {
 			tickMs,
-			boundDevices: this.boundDevices.size
+			boundDevices: this.boundDevices.size,
+			source: stored === null ? "seed" : "durable-index"
 		} });
+		this.armReconcile(stored === null ? "seed" : "reconcile");
 	}
 	stop() {
 		if (this.timer !== null) clearInterval(this.timer);
 		this.timer = null;
 		this.lastWritten.clear();
 	}
+	/** Resolves when the armed reconcile has settled. Tests await it; production
+	*  never does — that is the entire point of arming it. */
+	async settleReconcile() {
+		await this.reconcile;
+	}
+	/** Every camera currently on the work list, sorted — the value persisted as
+	*  the durable index. */
+	get boundDeviceIds() {
+		return [...this.boundDevices].sort((a, b) => a - b);
+	}
 	/**
 	* Keep recognition overlays event-fresh. The persisted-track hydration below
 	* remains the restart/cold-start authority; lifecycle events only advance it.
@@ -41719,19 +41801,124 @@ var OsdManager = class {
 		});
 	}
 	/**
-	* Reconcile the work list against the store rather than trusting an event
-	* to have arrived (D8). Cheap: one settings read per camera, on the tick
-	* cadence, not per frame.
+	* Reconcile the durable index against the store rather than trusting it to be
+	* right (D8 — an index nothing checks is an index that eventually lies).
+	*
+	* Background work, and BOUNDED: cameras only, four reads in flight. Two rules
+	* keep it from destroying work:
+	*
+	* - a binding read that FAILED decides nothing — the camera keeps whatever the
+	*   index already said (D49);
+	* - a camera absent from the listing is left alone. The device restore pass
+	*   runs for minutes after boot (D167), so "not published yet" and "deleted"
+	*   look identical from here, and only one of them may unbind a camera. A
+	*   real removal comes from `clearSlotBinding`, which is authoritative.
+	*
+	* Every correction is logged with its `deviceId`, because a silent repair is
+	* indistinguishable from an index that was right all along.
+	*/
+	async reconcileBoundDevices(mode = "reconcile") {
+		const cameras = await this.deps.listCameras();
+		const probes = await mapWithConcurrency(cameras, this.deps.reconcileConcurrency ?? 4, async (camera) => ({
+			deviceId: camera.id,
+			bindings: await this.probeBindings(camera.id)
+		}));
+		const listed = new Set(cameras.map((camera) => camera.id));
+		let unreadable = 0;
+		const added = [];
+		const removed = [];
+		for (const probe of probes) {
+			if (probe.bindings === null) {
+				unreadable += 1;
+				continue;
+			}
+			const bound = Object.keys(probe.bindings).length > 0;
+			if (bound && !this.boundDevices.has(probe.deviceId)) {
+				this.boundDevices.add(probe.deviceId);
+				added.push(probe.deviceId);
+			} else if (!bound && this.boundDevices.has(probe.deviceId)) {
+				this.boundDevices.delete(probe.deviceId);
+				removed.push(probe.deviceId);
+			}
+		}
+		if (mode === "reconcile") {
+			for (const deviceId of added) this.logger.warn("osd-manager: bound-device index was missing a camera that HAS bindings — corrected", {
+				tags: { deviceId },
+				meta: { correction: "added" }
+			});
+			for (const deviceId of removed) this.logger.warn("osd-manager: bound-device index claimed a camera with NO bindings — corrected", {
+				tags: { deviceId },
+				meta: { correction: "removed" }
+			});
+		}
+		const notListed = [...this.boundDevices].filter((deviceId) => !listed.has(deviceId)).length;
+		this.logger.info("osd-manager: bound-device reconcile complete", { meta: {
+			mode,
+			cameras: cameras.length,
+			bound: this.boundDevices.size,
+			added: added.length,
+			removed: removed.length,
+			unreadable,
+			notListed
+		} });
+		if (mode === "seed" || added.length > 0 || removed.length > 0) await this.persistBoundIndex(null);
+	}
+	/**
+	* Run the reconcile in the BACKGROUND, once at a time.
+	*
+	* Nothing on the boot path may await it — that await is what took the
+	* capability graph down for nine minutes. A second arming while one is in
+	* flight is dropped rather than queued: both passes would compute over the
+	* same store and race on the index write.
+	*/
+	armReconcile(mode) {
+		if (this.reconcile !== null) return;
+		this.reconcile = this.reconcileBoundDevices(mode).catch((err) => {
+			this.logger.warn("osd-manager: bound-device reconcile failed — the index keeps its current contents", { meta: {
+				mode,
+				error: String(err)
+			} });
+		}).finally(() => {
+			this.reconcile = null;
+		});
+	}
+	/** The persisted index, or `null` when it has never been written (or could
+	*  not be read — both mean "derive it from a scan", which is safe). */
+	async readBoundIndex() {
+		try {
+			return await this.deps.boundIndex.get();
+		} catch (err) {
+			this.logger.warn("osd-manager: bound-device index unreadable — seeding from a camera scan", { meta: { error: String(err) } });
+			return null;
+		}
+	}
+	/**
+	* Persist the work list. Called from every place a binding is written, so the
+	* index cannot drift from the bindings without the write that caused the drift
+	* also failing — and that failure is logged, and repaired by the reconcile.
 	*/
-	async reloadBoundDevices() {
-		const devices = await this.safeListDevices();
-		const next = /* @__PURE__ */ new Set();
-		for (const device of devices) {
-			const bindings = await this.readBindings(device.id);
-			if (Object.keys(bindings).length > 0) next.add(device.id);
+	async persistBoundIndex(deviceId) {
+		try {
+			await this.deps.boundIndex.set([...this.boundDeviceIds]);
+		} catch (err) {
+			this.logger.warn("osd-manager: bound-device index write failed — the next reconcile repairs it", {
+				...deviceId === null ? {} : { tags: { deviceId } },
+				meta: { error: String(err) }
+			});
+		}
+	}
+	/** One camera's bindings, or `null` when the read FAILED. Distinct from an
+	*  empty map on purpose: only the second may unbind a camera (D49). */
+	async probeBindings(deviceId) {
+		try {
+			return await this.deps.bindings(deviceId).get();
+		} catch (err) {
+			this.logger.warn("osd-manager: binding read failed during reconcile — this camera keeps its index entry", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+			return null;
 		}
-		this.boundDevices.clear();
-		for (const id of next) this.boundDevices.add(id);
 	}
 	getDeviceOsd = async ({ deviceId }) => {
 		const status = await this.deps.readOsdStatus(deviceId);
@@ -41782,6 +41969,7 @@ var OsdManager = class {
 		await this.assertSlotExists(deviceId, slotId);
 		await this.deps.bindings(deviceId).update((prev) => withBinding(prev, slotId, binding));
 		this.boundDevices.add(deviceId);
+		await this.persistBoundIndex(deviceId);
 		this.logger.info("osd-manager: slot binding saved", {
 			tags: { deviceId },
 			meta: {
@@ -41806,6 +41994,7 @@ var OsdManager = class {
 		this.lastWritten.delete(cacheKey(deviceId, slotId));
 		const remaining = await this.readBindings(deviceId);
 		if (Object.keys(remaining).length === 0) this.boundDevices.delete(deviceId);
+		await this.persistBoundIndex(deviceId);
 		this.logger.info("osd-manager: slot binding cleared — slot keeps its last text", {
 			tags: { deviceId },
 			meta: { slotId }
@@ -41846,6 +42035,7 @@ var OsdManager = class {
 		for (const key of [...this.lastWritten.keys()]) if (key.startsWith(`${targetDeviceId}:`)) this.lastWritten.delete(key);
 		if (Object.keys(copiedBindings).length > 0) this.boundDevices.add(targetDeviceId);
 		else this.boundDevices.delete(targetDeviceId);
+		await this.persistBoundIndex(targetDeviceId);
 		await this.renderDeviceInternal(targetDeviceId, null);
 		this.logger.info("osd-manager: camera configuration copied", {
 			tags: { deviceId: targetDeviceId },
@@ -42074,6 +42264,7 @@ var OsdManagerAddon = class extends BaseAddon {
 	async onInitialize() {
 		const ctx = this.ctx;
 		const store = new OsdBindingsStore((deviceId, key, schema, fallback) => this.deviceState(deviceId, key, schema, fallback));
+		const boundIndex = this.state(OSD_BOUND_INDEX_KEY, OsdBoundIndexSchema, null);
 		const manager = new OsdManager({
 			logger: ctx.logger,
 			readOsdStatus: async (deviceId) => {
@@ -42110,6 +42301,15 @@ var OsdManagerAddon = class extends BaseAddon {
 					name: d.name
 				}));
 			},
+			listCameras: async () => {
+				return (await ctx.api.deviceManager.listAll.query({
+					isCamera: true,
+					projection: "slim"
+				})).map((d) => ({
+					id: d.id,
+					name: d.name
+				}));
+			},
 			listDeviceCaps: async (deviceId) => {
 				const bindings = await ctx.api.deviceManager.getBindings.query({ deviceId });
 				return [...new Set(bindings.entries.map((e) => e.capName))];
@@ -42137,7 +42337,8 @@ var OsdManagerAddon = class extends BaseAddon {
 					} } : {}
 				};
 			},
-			bindings: (deviceId) => store.forDevice(deviceId)
+			bindings: (deviceId) => store.forDevice(deviceId),
+			boundIndex
 		});
 		this.manager = manager;
 		this.subscribe({ category: EventCategory.PipelineAnalyticsTrackLifecycle }, (event) => {
@@ -42149,7 +42350,9 @@ var OsdManagerAddon = class extends BaseAddon {
 		this.subscribe({ category: EventCategory.PipelineAnalyticsPlateGalleryChanged }, (event) => {
 			manager.onRecognitionGalleryChanged(event.data.deviceId);
 		});
-		await manager.start(Math.max(1, this.config.tickSeconds) * 1e3);
+		manager.start(Math.max(1, this.config.tickSeconds) * 1e3).catch((err) => {
+			ctx.logger.error("osd-manager: render loop failed to start — no camera will be re-rendered", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
 		const pagesProvider = {
 			id: this.id,
 			listPages: () => this.pages

package/dist/index.mjs

@@ -41251,6 +41251,37 @@ var OsdBindingsStore = class {
 	}
 };
 //#endregion
+//#region src/bound-index.ts
+/**
+* The durable index of cameras that have at least one OSD binding.
+*
+* WHY IT EXISTS. The render loop's work list used to be DERIVED at boot: list
+* every device in the directory, read each one's binding block, keep the ones
+* that answered non-empty. Every one of those reads is a UDS round-trip to the
+* settings store, and they ran one at a time. Measured on the boot of
+* 2026-08-19: 976 devices × 559 ms under boot load = 546 s in which
+* `OsdManager.start()` had not returned — and `start()` was awaited inside
+* `onInitialize()`, so for nine minutes the `osd-manager` and
+* `addon-pages-source` capabilities did not exist ANYWHERE in the cluster
+* (docs/architecture/addon-lifecycle.md). The answer it took nine minutes to
+* compute was `boundDevices = 0`.
+*
+* Filtering to cameras and fanning the reads out makes that scan cheap, but it
+* is still a scan. The index is the actual fix: the work list is WRITTEN where
+* bindings are written, so boot reads one key and is done in milliseconds. The
+* scan stays, in the background, as the reconcile — because an index nothing
+* checks is an index that eventually lies.
+*
+* The value is the SET of bound camera ids, serialised as a sorted array.
+* `null` is not "no cameras are bound", it is "this hub has never written the
+* index" — the two must stay distinguishable, because the first is authoritative
+* and the second means seed it from a scan. An empty ARRAY is the authoritative
+* "nothing is bound".
+*/
+/** Store key inside the addon's own (global) store. */
+var OSD_BOUND_INDEX_KEY = "boundDeviceIds";
+var OsdBoundIndexSchema = array(number().int().positive()).nullable();
+//#endregion
 //#region src/gate.ts
 /**
 * The display gate — "should this slot show its value right now?".
@@ -41327,6 +41358,27 @@ function evaluateGate(input) {
 	return OPEN;
 }
 //#endregion
+//#region src/lane-pool.ts
+/**
+* Apply `mapper` to every item with at most `limit` in flight at once.
+*
+* A rejecting mapper rejects the whole call (same contract as `Promise.all`);
+* a caller that must not fail the sweep for one bad unit catches INSIDE the
+* mapper — which is what every caller in this package does, because a unit that
+* threw must never be the reason the next camera is not reconciled.
+*/
+async function mapWithConcurrency(items, limit, mapper) {
+	const results = new Array(items.length);
+	if (items.length === 0) return results;
+	const lanes = Math.max(1, Math.min(Math.trunc(limit), items.length));
+	const entries = items.entries();
+	const lane = async () => {
+		for (const [index, item] of entries) results[index] = await mapper(item, index);
+	};
+	await Promise.all(Array.from({ length: lanes }, () => lane()));
+	return results;
+}
+//#endregion
 //#region src/format.ts
 /** Tokens `formatClock` understands. Anything else in the pattern is literal. */
 var CLOCK_TOKENS = [
@@ -41659,31 +41711,61 @@ var OsdManager = class {
 	recognitionGeneration = /* @__PURE__ */ new Map();
 	recognitionInvalidatedAt = /* @__PURE__ */ new Map();
 	timer = null;
+	/** The background reconcile, while one is running. Held so a second arming
+	*  cannot overlap the first — two concurrent passes would race on the index
+	*  write and could persist the older of the two answers. */
+	reconcile = null;
 	constructor(deps) {
 		this.deps = deps;
 		this.logger = deps.logger;
 		this.now = deps.now ?? (() => Date.now());
 	}
 	/**
-	* Learn which cameras have bindings, then start ticking. A camera with no
-	* binding costs nothing — it is never in `boundDevices`, so the loop
-	* never reads its state and never touches its firmware.
+	* Read the durable work list, start ticking, and arm the reconcile BEHIND
+	* both.
+	*
+	* This used to derive the work list first: list every device, read every
+	* device's binding block, one at a time. On 2026-08-19 that was 976 devices ×
+	* 559 ms = 546 s, awaited inside `onInitialize`, so every capability this
+	* addon declares was absent cluster-wide for nine minutes — and the answer was
+	* `boundDevices = 0`. A camera with no binding still costs nothing at runtime;
+	* what it used to cost was the boot.
+	*
+	* The scan did not go away, it moved: it is the reconcile, it runs in the
+	* background, and it is the only thing that keeps the index from silently
+	* lying.
 	*/
 	async start(tickMs) {
-		await this.reloadBoundDevices();
+		const stored = await this.readBoundIndex();
+		if (stored !== null) {
+			this.boundDevices.clear();
+			for (const deviceId of stored) this.boundDevices.add(deviceId);
+		}
 		this.timer = setInterval(() => {
 			this.renderAllBound();
 		}, tickMs);
 		this.logger.info("osd-manager: render loop started", { meta: {
 			tickMs,
-			boundDevices: this.boundDevices.size
+			boundDevices: this.boundDevices.size,
+			source: stored === null ? "seed" : "durable-index"
 		} });
+		this.armReconcile(stored === null ? "seed" : "reconcile");
 	}
 	stop() {
 		if (this.timer !== null) clearInterval(this.timer);
 		this.timer = null;
 		this.lastWritten.clear();
 	}
+	/** Resolves when the armed reconcile has settled. Tests await it; production
+	*  never does — that is the entire point of arming it. */
+	async settleReconcile() {
+		await this.reconcile;
+	}
+	/** Every camera currently on the work list, sorted — the value persisted as
+	*  the durable index. */
+	get boundDeviceIds() {
+		return [...this.boundDevices].sort((a, b) => a - b);
+	}
 	/**
 	* Keep recognition overlays event-fresh. The persisted-track hydration below
 	* remains the restart/cold-start authority; lifecycle events only advance it.
@@ -41715,19 +41797,124 @@ var OsdManager = class {
 		});
 	}
 	/**
-	* Reconcile the work list against the store rather than trusting an event
-	* to have arrived (D8). Cheap: one settings read per camera, on the tick
-	* cadence, not per frame.
+	* Reconcile the durable index against the store rather than trusting it to be
+	* right (D8 — an index nothing checks is an index that eventually lies).
+	*
+	* Background work, and BOUNDED: cameras only, four reads in flight. Two rules
+	* keep it from destroying work:
+	*
+	* - a binding read that FAILED decides nothing — the camera keeps whatever the
+	*   index already said (D49);
+	* - a camera absent from the listing is left alone. The device restore pass
+	*   runs for minutes after boot (D167), so "not published yet" and "deleted"
+	*   look identical from here, and only one of them may unbind a camera. A
+	*   real removal comes from `clearSlotBinding`, which is authoritative.
+	*
+	* Every correction is logged with its `deviceId`, because a silent repair is
+	* indistinguishable from an index that was right all along.
+	*/
+	async reconcileBoundDevices(mode = "reconcile") {
+		const cameras = await this.deps.listCameras();
+		const probes = await mapWithConcurrency(cameras, this.deps.reconcileConcurrency ?? 4, async (camera) => ({
+			deviceId: camera.id,
+			bindings: await this.probeBindings(camera.id)
+		}));
+		const listed = new Set(cameras.map((camera) => camera.id));
+		let unreadable = 0;
+		const added = [];
+		const removed = [];
+		for (const probe of probes) {
+			if (probe.bindings === null) {
+				unreadable += 1;
+				continue;
+			}
+			const bound = Object.keys(probe.bindings).length > 0;
+			if (bound && !this.boundDevices.has(probe.deviceId)) {
+				this.boundDevices.add(probe.deviceId);
+				added.push(probe.deviceId);
+			} else if (!bound && this.boundDevices.has(probe.deviceId)) {
+				this.boundDevices.delete(probe.deviceId);
+				removed.push(probe.deviceId);
+			}
+		}
+		if (mode === "reconcile") {
+			for (const deviceId of added) this.logger.warn("osd-manager: bound-device index was missing a camera that HAS bindings — corrected", {
+				tags: { deviceId },
+				meta: { correction: "added" }
+			});
+			for (const deviceId of removed) this.logger.warn("osd-manager: bound-device index claimed a camera with NO bindings — corrected", {
+				tags: { deviceId },
+				meta: { correction: "removed" }
+			});
+		}
+		const notListed = [...this.boundDevices].filter((deviceId) => !listed.has(deviceId)).length;
+		this.logger.info("osd-manager: bound-device reconcile complete", { meta: {
+			mode,
+			cameras: cameras.length,
+			bound: this.boundDevices.size,
+			added: added.length,
+			removed: removed.length,
+			unreadable,
+			notListed
+		} });
+		if (mode === "seed" || added.length > 0 || removed.length > 0) await this.persistBoundIndex(null);
+	}
+	/**
+	* Run the reconcile in the BACKGROUND, once at a time.
+	*
+	* Nothing on the boot path may await it — that await is what took the
+	* capability graph down for nine minutes. A second arming while one is in
+	* flight is dropped rather than queued: both passes would compute over the
+	* same store and race on the index write.
+	*/
+	armReconcile(mode) {
+		if (this.reconcile !== null) return;
+		this.reconcile = this.reconcileBoundDevices(mode).catch((err) => {
+			this.logger.warn("osd-manager: bound-device reconcile failed — the index keeps its current contents", { meta: {
+				mode,
+				error: String(err)
+			} });
+		}).finally(() => {
+			this.reconcile = null;
+		});
+	}
+	/** The persisted index, or `null` when it has never been written (or could
+	*  not be read — both mean "derive it from a scan", which is safe). */
+	async readBoundIndex() {
+		try {
+			return await this.deps.boundIndex.get();
+		} catch (err) {
+			this.logger.warn("osd-manager: bound-device index unreadable — seeding from a camera scan", { meta: { error: String(err) } });
+			return null;
+		}
+	}
+	/**
+	* Persist the work list. Called from every place a binding is written, so the
+	* index cannot drift from the bindings without the write that caused the drift
+	* also failing — and that failure is logged, and repaired by the reconcile.
 	*/
-	async reloadBoundDevices() {
-		const devices = await this.safeListDevices();
-		const next = /* @__PURE__ */ new Set();
-		for (const device of devices) {
-			const bindings = await this.readBindings(device.id);
-			if (Object.keys(bindings).length > 0) next.add(device.id);
+	async persistBoundIndex(deviceId) {
+		try {
+			await this.deps.boundIndex.set([...this.boundDeviceIds]);
+		} catch (err) {
+			this.logger.warn("osd-manager: bound-device index write failed — the next reconcile repairs it", {
+				...deviceId === null ? {} : { tags: { deviceId } },
+				meta: { error: String(err) }
+			});
+		}
+	}
+	/** One camera's bindings, or `null` when the read FAILED. Distinct from an
+	*  empty map on purpose: only the second may unbind a camera (D49). */
+	async probeBindings(deviceId) {
+		try {
+			return await this.deps.bindings(deviceId).get();
+		} catch (err) {
+			this.logger.warn("osd-manager: binding read failed during reconcile — this camera keeps its index entry", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+			return null;
 		}
-		this.boundDevices.clear();
-		for (const id of next) this.boundDevices.add(id);
 	}
 	getDeviceOsd = async ({ deviceId }) => {
 		const status = await this.deps.readOsdStatus(deviceId);
@@ -41778,6 +41965,7 @@ var OsdManager = class {
 		await this.assertSlotExists(deviceId, slotId);
 		await this.deps.bindings(deviceId).update((prev) => withBinding(prev, slotId, binding));
 		this.boundDevices.add(deviceId);
+		await this.persistBoundIndex(deviceId);
 		this.logger.info("osd-manager: slot binding saved", {
 			tags: { deviceId },
 			meta: {
@@ -41802,6 +41990,7 @@ var OsdManager = class {
 		this.lastWritten.delete(cacheKey(deviceId, slotId));
 		const remaining = await this.readBindings(deviceId);
 		if (Object.keys(remaining).length === 0) this.boundDevices.delete(deviceId);
+		await this.persistBoundIndex(deviceId);
 		this.logger.info("osd-manager: slot binding cleared — slot keeps its last text", {
 			tags: { deviceId },
 			meta: { slotId }
@@ -41842,6 +42031,7 @@ var OsdManager = class {
 		for (const key of [...this.lastWritten.keys()]) if (key.startsWith(`${targetDeviceId}:`)) this.lastWritten.delete(key);
 		if (Object.keys(copiedBindings).length > 0) this.boundDevices.add(targetDeviceId);
 		else this.boundDevices.delete(targetDeviceId);
+		await this.persistBoundIndex(targetDeviceId);
 		await this.renderDeviceInternal(targetDeviceId, null);
 		this.logger.info("osd-manager: camera configuration copied", {
 			tags: { deviceId: targetDeviceId },
@@ -42070,6 +42260,7 @@ var OsdManagerAddon = class extends BaseAddon {
 	async onInitialize() {
 		const ctx = this.ctx;
 		const store = new OsdBindingsStore((deviceId, key, schema, fallback) => this.deviceState(deviceId, key, schema, fallback));
+		const boundIndex = this.state(OSD_BOUND_INDEX_KEY, OsdBoundIndexSchema, null);
 		const manager = new OsdManager({
 			logger: ctx.logger,
 			readOsdStatus: async (deviceId) => {
@@ -42106,6 +42297,15 @@ var OsdManagerAddon = class extends BaseAddon {
 					name: d.name
 				}));
 			},
+			listCameras: async () => {
+				return (await ctx.api.deviceManager.listAll.query({
+					isCamera: true,
+					projection: "slim"
+				})).map((d) => ({
+					id: d.id,
+					name: d.name
+				}));
+			},
 			listDeviceCaps: async (deviceId) => {
 				const bindings = await ctx.api.deviceManager.getBindings.query({ deviceId });
 				return [...new Set(bindings.entries.map((e) => e.capName))];
@@ -42133,7 +42333,8 @@ var OsdManagerAddon = class extends BaseAddon {
 					} } : {}
 				};
 			},
-			bindings: (deviceId) => store.forDevice(deviceId)
+			bindings: (deviceId) => store.forDevice(deviceId),
+			boundIndex
 		});
 		this.manager = manager;
 		this.subscribe({ category: EventCategory.PipelineAnalyticsTrackLifecycle }, (event) => {
@@ -42145,7 +42346,9 @@ var OsdManagerAddon = class extends BaseAddon {
 		this.subscribe({ category: EventCategory.PipelineAnalyticsPlateGalleryChanged }, (event) => {
 			manager.onRecognitionGalleryChanged(event.data.deviceId);
 		});
-		await manager.start(Math.max(1, this.config.tickSeconds) * 1e3);
+		manager.start(Math.max(1, this.config.tickSeconds) * 1e3).catch((err) => {
+			ctx.logger.error("osd-manager: render loop failed to start — no camera will be re-rendered", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
 		const pagesProvider = {
 			id: this.id,
 			listPages: () => this.pages

package/dist/remoteEntry.js

@@ -1,2 +1,2 @@
-import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-7VFK3Vnq.mjs";
+import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-CsJNPlNP.mjs";
 export { t as get, e as init };

package/dist/{virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-7VFK3Vnq.mjs → virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_osd_manager_page__remoteEntry_js-CsJNPlNP.mjs}

@@ -2753,7 +2753,7 @@ async function rr(e) {
 	}
 }
 async function ir() {
-	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_osd_manager_page-DAdBzUD3.mjs")).catch((e) => {
+	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_osd_manager_page-Yo6BXk0X.mjs")).catch((e) => {
 		throw tr = void 0, e;
 	}), tr;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-osd-manager",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Binds camera on-screen-display slots to live state and recognitions",
   "keywords": [
     "camstack",