@camstack/addon-pipeline-orchestrator 1.2.50 → 1.2.52

package/dist/index.js

@@ -13893,7 +13893,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14894,6 +14910,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -15270,15 +15289,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -15514,6 +15533,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -15613,6 +15656,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -15631,6 +15675,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15782,7 +15827,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15807,6 +15865,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -18059,7 +18121,14 @@ var zonesCapability = {
 	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
 	* (e.g. zone groupings) can sit alongside the polygon list.
 	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() })
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -25147,13 +25216,24 @@ method(object({
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -26402,7 +26482,14 @@ var zoneRulesCapability = {
 		motion: array(ZoneRuleSchema).readonly(),
 		detection: array(ZoneRuleSchema).readonly(),
 		package: array(ZoneRuleSchema).readonly()
-	})
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Accessory device helpers — shared across drivers.
@@ -32083,6 +32170,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -32395,8 +32483,8 @@ var DETAIL_CROP_PADDING_FIELD = {
 	default: DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio
 };
 /**
-* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
-* decode worker's native-resolution frame retention.
+* THE native-frame **lease** knobs — hold depth, RAM budget, demand window and
+* subject-tile budget for the decode worker's native-resolution retention.
 *
 * ## Why they live here and not in the addon that reads them
 *
@@ -32412,20 +32500,25 @@ var DETAIL_CROP_PADDING_FIELD = {
 * The lease is a per-decode-worker RAM window. Its purpose — the late
 * cross-process native crop landing on a full-resolution frame rather than the
 * ≤640 detection fallback — is a property of the PIPELINE, not of a node's
-* hardware: a per-node TTL would mean the same camera produces different crop
+* hardware: a per-node window would mean the same camera produces different crop
 * quality depending on which node the balancer placed it on, and nobody could
 * tell that from the stored media. Node-level RAM pressure is already handled
 * by the per-session budget ceiling, which is itself one of these knobs.
 *
 * ## What each knob costs
 *
-* A retained frame is a full NATIVE-resolution copy in system RAM. With the
+* A HELD frame is a full NATIVE-resolution copy in system RAM. With the
 * default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
 * 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
 * for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
-* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
-* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
-* admission" for what actually gets admitted.
+* resident RAM for ONE busy camera is now `frameBytes × holdFrames`, clamped by
+* the budget ceiling — bounded by a COUNT because a held frame is waiting for
+* one specific event (its own detection result), not for a clock.
+*
+* A TILE is one subject at native resolution, JPEG-encoded: ~60-120 KB on 4K,
+* and nothing at all on a frame that detected nothing. That is the asymmetry
+* this whole shape exists for — see
+* `docs/design/2026-08-13-native-lease-two-tier-redesign.md`.
 */
 /**
 * Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
@@ -32433,10 +32526,11 @@ var DETAIL_CROP_PADDING_FIELD = {
 * the reader can walk every section instead of trusting the section id.
 */
 var NATIVE_LEASE_SECTION_ID = "native-lease";
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
 var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -32458,25 +32552,32 @@ var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
 var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -32502,25 +32603,47 @@ object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
 /** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
-var NATIVE_LEASE_TTL_FIELD = {
-	min: 250,
-	max: 1e4,
-	step: 50,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+var NATIVE_LEASE_HOLD_FIELD = {
+	min: 1,
+	max: 64,
+	step: 1,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames
 };
 var NATIVE_LEASE_BUDGET_FIELD = {
 	min: 0,
@@ -32534,6 +32657,12 @@ var NATIVE_LEASE_ACTIVITY_FIELD = {
 	step: 1e3,
 	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
 };
+var NATIVE_LEASE_TILE_BUDGET_FIELD = {
+	min: 0,
+	max: 1024,
+	step: 16,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
+};
 /** Select options for the admission knob (orchestrator settings UI). */
 var NATIVE_LEASE_ADMISSION_FIELD = {
 	options: [{
@@ -32861,7 +32990,55 @@ var OrchestratorDiagnosticsSchema = object({
 	cameraConfigCount: number().int().min(0),
 	activeDetectionCount: number().int().min(0)
 });
-var pipelineOrchestratorActions = defineCustomActions({ dumpState: customAction(_void(), OrchestratorDiagnosticsSchema) });
+/**
+* The node-stress long-term-statistics read surface.
+*
+* A custom action rather than a cap method, matching how the orchestrator
+* already serves `dumpState`: this is a hub-local read over a table the hub
+* owns, and it ships with one `camstack deploy` instead of a release train.
+* The MEAN is derived here and returned alongside the addable `sum`/`samples`
+* — a chart wants the first, a re-bucketing caller wants the second, and a
+* stored mean is a field that can disagree with both.
+*/
+var NodeStressStatsInputSchema = object({
+	/** `node-score` | `node-queue-pressure` | `node-drop-ratio` | `node-fps-deficit`. */
+	series: string().optional(),
+	/** A node id. Omit for every node. */
+	subject: string().optional(),
+	/** Inclusive bucket-start bounds, ms. */
+	from: number().int().optional(),
+	to: number().int().optional(),
+	limit: number().int().positive().max(5e3).optional()
+});
+var NodeStressStatsRowSchema = object({
+	subject: string(),
+	series: string(),
+	scope: string(),
+	bucketStart: number(),
+	samples: number(),
+	sum: number(),
+	mean: number(),
+	min: number(),
+	max: number()
+});
+var NodeStressStatsOutputSchema = object({
+	rows: array(NodeStressStatsRowSchema).readonly(),
+	/** Buckets still accumulating — "is it running" answerable at once, rather
+	*  than after five minutes of indistinguishable silence. */
+	open: array(NodeStressStatsRowSchema).readonly(),
+	/** The durable failover history the anti-flap guards read, newest first.
+	*  Exposed for the same reason the heartbeat exists: "nothing moved" has to
+	*  be distinguishable from "nothing is watching". */
+	moves: array(object({
+		deviceId: number(),
+		fromNodeId: string(),
+		at: number()
+	})).readonly()
+});
+var pipelineOrchestratorActions = defineCustomActions({
+	dumpState: customAction(_void(), OrchestratorDiagnosticsSchema),
+	nodeStressStats: customAction(NodeStressStatsInputSchema, NodeStressStatsOutputSchema, { auth: "admin" })
+});
 /**
 * Sentinel returned by `buildDetectionConfig` when the profile-slot READ
 * itself failed transiently (e.g. `listAllProfileSlots` discovery timeout
@@ -32907,7 +33084,7 @@ var TRANSIENT_SLOT_READ = Symbol("transient-slot-read");
 * shape so video and audio plumbing self-heal identically.
 */
 /** Poll period — audio chunks arrive ~every 500ms; 200ms keeps latency low. */
-var POLL_INTERVAL_MS = 200;
+var POLL_INTERVAL_MS$1 = 200;
 /** How many chunks to drain per poll — a small burst absorbs jitter. */
 var PULL_MAX_COUNT = 8;
 /**
@@ -33090,7 +33267,7 @@ function startPolling(options, lifecycle) {
 			} });
 			if (!lifecycle.stopped && consecutiveFailures >= RESUBSCRIBE_AFTER_FAILURES && (consecutiveFailures - RESUBSCRIBE_AFTER_FAILURES) % RESUBSCRIBE_THROTTLE_TICKS === 0) await resubscribe();
 		}
-		if (!lifecycle.stopped) lifecycle.pollTimer = setTimeout(() => void tick(), POLL_INTERVAL_MS);
+		if (!lifecycle.stopped) lifecycle.pollTimer = setTimeout(() => void tick(), POLL_INTERVAL_MS$1);
 	};
 	tick();
 }
@@ -35581,12 +35758,341 @@ function buildRunnerConfig(base, overrides) {
 	};
 }
 //#endregion
-//#region src/device-features-mirror.ts
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
+		try {
+			await this.store.delete.mutate({
+				collection: this.spec.collection,
+				key
+			});
+		} catch (err) {
+			this.logger.debug("durable delete failed", { meta: {
+				collection: this.spec.collection,
+				key,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
+	*
+	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
+	* fallible read is work destroyed on an error (D49/D130) — that is why this
+	* is a method a feature opts into rather than a policy the primitive runs.
+	* Best-effort per row: a failed delete keeps the key (retried next prune)
+	* rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
+				});
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
+			}
+		}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
+var DEVICE_FEATURES_SPEC = {
+	collection: "pipeline-orchestrator:device-features",
+	columns: [
+		{
+			name: "deviceId",
+			type: "TEXT",
+			primaryKey: true,
+			notNull: true
+		},
+		(
+		/** The feature name list, verbatim. */
+		{
+			name: "features",
+			type: "JSON",
+			notNull: true
+		}),
+		{
+			name: "updatedAt",
+			type: "INTEGER",
+			notNull: true
+		}
+	],
+	writeMode: "write-behind",
+	keyOf: (row) => String(row.deviceId),
+	toValue: (row) => ({
+		features: [...row.features],
+		updatedAt: row.updatedAt
+	}),
+	fromRecord: (key, data) => {
+		const deviceId = Number(key);
+		const raw = data["features"];
+		if (!Number.isFinite(deviceId) || !Array.isArray(raw)) return null;
+		const features = raw.filter((f) => typeof f === "string");
+		if (features.length === 0) return null;
+		const updatedAt = Number(data["updatedAt"]);
+		return {
+			deviceId,
+			features,
+			updatedAt: Number.isFinite(updatedAt) ? updatedAt : 0,
+			restored: true
+		};
+	},
+	deviceIdOf: (row) => row.deviceId
+};
 var DeviceFeaturesMirror = class {
+	/** Process-local fallback, used only when no store was supplied. */
+	local = /* @__PURE__ */ new Map();
+	durable;
 	logger;
-	lastKnown = /* @__PURE__ */ new Map();
-	constructor(logger) {
-		this.logger = logger;
+	now;
+	constructor(deps) {
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+		this.durable = deps.store === void 0 ? null : new DurableLedger({
+			spec: DEVICE_FEATURES_SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, DEVICE_FEATURES_SPEC);
+	}
+	/**
+	* Seed the mirror from the last session. Call once at boot, after `declare`
+	* and BEFORE the first `resolve` — the whole value of the row is that it is
+	* already there when the first read fails.
+	*/
+	async hydrate() {
+		if (this.durable === null) return 0;
+		const rows = await this.durable.load();
+		this.logger.info("device-features mirror restored", { meta: { devices: rows.length } });
+		return rows.length;
+	}
+	held(deviceId) {
+		return this.durable === null ? this.local.get(deviceId) : this.durable.get(String(deviceId));
+	}
+	remember(deviceId, features) {
+		const row = {
+			deviceId,
+			features: [...features],
+			updatedAt: this.now(),
+			restored: false
+		};
+		if (this.durable === null) {
+			this.local.set(deviceId, row);
+			return;
+		}
+		const held = this.durable.get(String(deviceId));
+		if (held !== void 0 && !held.restored && sameFeatures(held.features, features)) return;
+		this.durable.put(row);
+	}
+	drop(deviceId) {
+		if (this.durable === null) {
+			this.local.delete(deviceId);
+			return;
+		}
+		this.durable.forget(String(deviceId));
 	}
 	/**
 	* Resolve a device's features, preferring a fresh read but never letting a
@@ -35595,15 +36101,19 @@ var DeviceFeaturesMirror = class {
 	async resolve(deviceId, read) {
 		const first = await read();
 		if (first !== null && first.length > 0) {
-			this.lastKnown.set(deviceId, [...first]);
+			this.remember(deviceId, first);
 			return first;
 		}
-		const mirrored = this.lastKnown.get(deviceId);
+		const heldRow = this.held(deviceId);
+		const mirrored = heldRow?.features;
 		if (first === null) {
 			if (mirrored !== void 0) {
 				this.logger.warn("device features unavailable — serving last-known mirror", {
 					tags: { deviceId },
-					meta: { mirrored: mirrored.length }
+					meta: {
+						mirrored: mirrored.length,
+						restored: heldRow?.restored === true
+					}
 				});
 				return mirrored;
 			}
@@ -35617,7 +36127,7 @@ var DeviceFeaturesMirror = class {
 				tags: { deviceId },
 				meta: { features: second.length }
 			});
-			this.lastKnown.set(deviceId, [...second]);
+			this.remember(deviceId, second);
 			return second;
 		}
 		if (second === null) {
@@ -35628,14 +36138,20 @@ var DeviceFeaturesMirror = class {
 			tags: { deviceId },
 			meta: { previously: mirrored.length }
 		});
-		this.lastKnown.delete(deviceId);
+		this.drop(deviceId);
 		return [];
 	}
 	/** Drop a device's mirror — call when the device is removed. */
 	forget(deviceId) {
-		this.lastKnown.delete(deviceId);
+		this.drop(deviceId);
 	}
 };
+/** Order-insensitive feature-set equality — the read's order is not a fact. */
+function sameFeatures(a, b) {
+	if (a.length !== b.length) return false;
+	const held = new Set(a);
+	return b.every((f) => held.has(f));
+}
 //#endregion
 //#region src/watchdog-camera.ts
 /**
@@ -35702,7 +36218,20 @@ var DetectionWiringController = class {
 	featuresMirror;
 	constructor(deps) {
 		this.deps = deps;
-		this.featuresMirror = new DeviceFeaturesMirror(deps.logger);
+		this.featuresMirror = new DeviceFeaturesMirror({
+			logger: deps.logger,
+			...deps.featuresStore !== void 0 ? { store: deps.featuresStore } : {}
+		});
+	}
+	/**
+	* Declare + seed the device-features mirror. Call once at boot, BEFORE the
+	* first detection start — the restored row is worth nothing after the read
+	* that would have needed it.
+	*/
+	async hydrateFeaturesMirror() {
+		if (this.deps.featuresStore === void 0) return;
+		await DeviceFeaturesMirror.declare(this.deps.featuresStore);
+		await this.featuresMirror.hydrate();
 	}
 	/** `activeDetections.get(deviceId)`. */
 	getActiveDetectionConfig(deviceId) {
@@ -36913,7 +37442,6 @@ var NodeStressController = class NodeStressController {
 	static HEARTBEAT_MS = 60 * 6e4;
 	samples = /* @__PURE__ */ new Map();
 	memories = /* @__PURE__ */ new Map();
-	history = [];
 	/** When the last heartbeat went out. `null` ⇒ the next sweep emits one. */
 	lastHeartbeatAt = null;
 	timer = null;
@@ -36957,6 +37485,18 @@ var NodeStressController = class NodeStressController {
 	forgetDevice(deviceId) {
 		this.samples.delete(deviceId);
 	}
+	/**
+	* Recover the move history from disk BEFORE the first sweep can act.
+	*
+	* Best-effort by construction (the ledger keeps whatever it already has on a
+	* read failure), and the count is logged out loud: a restart that recovers 0
+	* moves while the operator remembers three is the line that says the budget
+	* has been reset.
+	*/
+	async hydrate() {
+		const recovered = await this.deps.moves.load();
+		this.deps.logger.info("node-stress move history recovered", { meta: { moves: recovered } });
+	}
 	start() {
 		if (this.timer) return;
 		this.timer = setInterval(() => {
@@ -36972,12 +37512,24 @@ var NodeStressController = class NodeStressController {
 		}
 		this.samples.clear();
 		this.memories.clear();
-		this.history = [];
 	}
 	/** The last computed state per node — empty before the first sweep. */
 	statesView() {
 		return new Map([...this.memories].map(([nodeId, m]) => [nodeId, m.state]));
 	}
+	/** The durable move history, newest first — the guards' own evidence, so an
+	*  operator asking "why did nothing move" can read the budget. */
+	historyView() {
+		return this.deps.moves.entries().toSorted((a, b) => b.at - a.at);
+	}
+	/**
+	* The per-node stress signals as of `now`, for the LTS aggregator and for
+	* diagnostics. Computed from the same live samples the sweep uses, so a
+	* chart can never disagree with a verdict.
+	*/
+	signalsView(now) {
+		return new Map(this.buildInputs(now).map((input) => [input.nodeId, input.signals]));
+	}
 	/** Group live samples by node and reduce each group. Exposed for tests. */
 	buildInputs(now) {
 		const byNode = /* @__PURE__ */ new Map();
@@ -37008,6 +37560,7 @@ var NodeStressController = class NodeStressController {
 		const verdicts = evaluateNodeStress(this.memories, this.buildInputs(now), now, this.thresholds());
 		for (const v of verdicts) {
 			this.memories.set(v.nodeId, v.memory);
+			this.deps.lts?.noteSignals(v.nodeId, v.signals, now);
 			if (v.changed) this.logTransition(v);
 		}
 		this.maybeHeartbeat(mode, verdicts, now);
@@ -37066,11 +37619,12 @@ var NodeStressController = class NodeStressController {
 	async actOn(verdicts, now) {
 		if (this.moveInFlight) return;
 		if (!verdicts.some((v) => v.state === "saturated")) return;
-		this.history = this.history.filter((h) => now - h.at < NodeStressController.HISTORY_TTL_MS);
+		this.deps.moves.pruneOlderThan(now - NodeStressController.HISTORY_TTL_MS);
+		const history = this.deps.moves.entries().filter((h) => now - h.at < NodeStressController.HISTORY_TTL_MS);
 		const plan = planStressFailover({
 			verdicts,
 			candidates: await this.collectCandidates(now),
-			history: this.history,
+			history,
 			nodeCaps: await this.deps.settingsStore.buildNodeCaps(),
 			attachedByNode: this.attachedByNode()
 		}, now, this.guards());
@@ -37094,7 +37648,7 @@ var NodeStressController = class NodeStressController {
 			await this.deps.detach(plan.fromNodeId, plan.deviceId);
 			await this.deps.attach(plan.toNodeId, config);
 			this.deps.ledger.recordAssignment(plan.deviceId, plan.toNodeId, "rebalance", false);
-			this.history.push({
+			this.deps.moves.record({
 				deviceId: plan.deviceId,
 				fromNodeId: plan.fromNodeId,
 				at: now
@@ -37166,6 +37720,513 @@ var NodeStressController = class NodeStressController {
 	}
 };
 //#endregion
+//#region src/durable/lts-aggregator.ts
+/** Wall-clock bucket width. Five minutes, matching HA's statistics tier. */
+var LTS_BUCKET_MS = 5 * 6e4;
+/** How often the row cap is enforced. Rarely: it is a bound, not a deadline. */
+var CAP_SWEEP_INTERVAL_MS = 6 * 36e5;
+var LTS_COLUMNS = [
+	(
+	/** `<subject>|<series>|<scope>|<bucketStart>` — deterministic, so a bucket
+	*  flushed twice replaces itself rather than doubling. */
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	}),
+	(
+	/** The camera id, or the node id. One column, because every query is
+	*  "this thing over time" and the thing is one or the other. */
+	{
+		name: "subject",
+		type: "TEXT",
+		notNull: true
+	}),
+	(
+	/** Numeric mirror of `subject` for camera rows, so a per-camera question is
+	*  answered by an integer index — every log line and every query about a
+	*  device in this repo is keyed by the numeric id. `NULL` for node rows. */
+	{
+		name: "deviceId",
+		type: "INTEGER"
+	}),
+	{
+		name: "series",
+		type: "TEXT",
+		notNull: true
+	},
+	(
+	/** Sub-scope within a series: a zoneId for occupancy, `''` otherwise. */
+	{
+		name: "scope",
+		type: "TEXT",
+		notNull: true
+	}),
+	(
+	/** Bucket start, wall-clock aligned to {@link LTS_BUCKET_MS}. */
+	{
+		name: "bucketStart",
+		type: "INTEGER",
+		notNull: true
+	}),
+	{
+		name: "samples",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "sum",
+		type: "REAL",
+		notNull: true
+	},
+	{
+		name: "min",
+		type: "REAL",
+		notNull: true
+	},
+	{
+		name: "max",
+		type: "REAL",
+		notNull: true
+	}
+];
+var LTS_INDEXES = [{
+	name: "idx_lts_series_bucket",
+	columns: ["series", "bucketStart"]
+}, {
+	name: "idx_lts_device",
+	columns: ["deviceId"]
+}];
+function ltsBucketStart(at, bucketMs = LTS_BUCKET_MS) {
+	return Math.floor(at / bucketMs) * bucketMs;
+}
+var LtsAggregator = class {
+	open = /* @__PURE__ */ new Map();
+	/** Every (subject, series, scope) that has produced a row in this process —
+	*  the groups the cap sweep has any reason to look at. */
+	groups = /* @__PURE__ */ new Set();
+	lastCapSweepAt = 0;
+	collection;
+	store;
+	logger;
+	nowFn;
+	bucketMs;
+	maxRows;
+	constructor(deps) {
+		this.collection = deps.collection;
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.nowFn = deps.now ?? (() => Date.now());
+		this.bucketMs = deps.bucketMs ?? 3e5;
+		this.maxRows = deps.maxRowsPerSeries ?? 105120;
+	}
+	static declare(store, collection) {
+		return store.declareCollection.mutate({
+			collection,
+			columns: [...LTS_COLUMNS],
+			indexes: [...LTS_INDEXES]
+		});
+	}
+	/**
+	* Record one observation. Synchronous, allocation-free after the first
+	* sample of a bucket, and it cannot throw — it sits on paths that are
+	* already producing the value for another reason and must not learn a new
+	* failure mode.
+	*
+	* A non-finite value is DROPPED rather than folded in: one `NaN` would make
+	* `sum`, `min` and `max` all `NaN` for the whole bucket, turning a skewed
+	* row into a meaningless one.
+	*/
+	note(input) {
+		if (!Number.isFinite(input.value)) return;
+		const at = input.at ?? this.nowFn();
+		const scope = input.scope ?? "";
+		const bucketStart = ltsBucketStart(at, this.bucketMs);
+		const key = rowId(input.subject, input.series, scope, bucketStart);
+		const held = this.open.get(key);
+		if (held === void 0) {
+			this.open.set(key, {
+				subject: input.subject,
+				...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+				series: input.series,
+				scope,
+				bucketStart,
+				samples: 1,
+				sum: input.value,
+				min: input.value,
+				max: input.value
+			});
+			return;
+		}
+		held.samples += 1;
+		held.sum += input.value;
+		if (input.value < held.min) held.min = input.value;
+		if (input.value > held.max) held.max = input.value;
+	}
+	/** Buckets currently accumulating — diagnostics, and what a flush would write. */
+	openBuckets() {
+		return [...this.open.values()].map(toRow);
+	}
+	/**
+	* Write every bucket that has CLOSED (its window ended at or before `now`)
+	* and drop it from RAM. Returns the number of rows written.
+	*
+	* The current bucket is deliberately left alone: writing it early would mean
+	* rewriting it on the next tick, which turns one row into up to sixty and
+	* offers every one of them to the checkpoint lottery (D96).
+	*/
+	async flushDue(now = this.nowFn()) {
+		const currentBucket = ltsBucketStart(now, this.bucketMs);
+		const due = [...this.open.values()].filter((b) => b.bucketStart < currentBucket);
+		if (due.length === 0) {
+			await this.maybeSweepCap(now);
+			return 0;
+		}
+		let written = 0;
+		for (const bucket of due) {
+			const key = rowId(bucket.subject, bucket.series, bucket.scope, bucket.bucketStart);
+			try {
+				await this.store.set.mutate({
+					collection: this.collection,
+					key,
+					value: {
+						subject: bucket.subject,
+						...bucket.deviceId !== void 0 ? { deviceId: bucket.deviceId } : {},
+						series: bucket.series,
+						scope: bucket.scope,
+						bucketStart: bucket.bucketStart,
+						samples: bucket.samples,
+						sum: bucket.sum,
+						min: bucket.min,
+						max: bucket.max
+					}
+				});
+				written += 1;
+				this.groups.add(groupKey(bucket.subject, bucket.series, bucket.scope));
+			} catch (err) {
+				this.logger.warn("lts bucket write failed — this interval will be missing", {
+					...bucket.deviceId !== void 0 ? { tags: { deviceId: bucket.deviceId } } : {},
+					meta: {
+						collection: this.collection,
+						series: bucket.series,
+						subject: bucket.subject,
+						bucketStart: bucket.bucketStart,
+						error: String(err)
+					}
+				});
+			}
+			this.open.delete(key);
+		}
+		await this.maybeSweepCap(now);
+		return written;
+	}
+	/** Read closed buckets back. The read surface every chart will use. */
+	async read(query = {}) {
+		const where = {};
+		if (query.series !== void 0) where["series"] = query.series;
+		if (query.subject !== void 0) where["subject"] = query.subject;
+		if (query.scope !== void 0) where["scope"] = query.scope;
+		const records = await this.store.query.query({
+			collection: this.collection,
+			filter: {
+				...Object.keys(where).length > 0 ? { where } : {},
+				...query.from !== void 0 || query.to !== void 0 ? { whereBetween: { bucketStart: [query.from ?? 0, query.to ?? Number.MAX_SAFE_INTEGER] } } : {},
+				orderBy: {
+					field: "bucketStart",
+					direction: "asc"
+				},
+				limit: query.limit ?? 5e3
+			}
+		});
+		const rows = [];
+		for (const record of records) {
+			const row = recordToRow(record.data);
+			if (row !== null) rows.push(row);
+		}
+		return rows;
+	}
+	/**
+	* Enforce the per-(subject, series, scope) row cap, at most once every six
+	* hours. Only groups this process has written to are examined: a group with
+	* no new rows cannot have crossed a cap it was under.
+	*/
+	async maybeSweepCap(now) {
+		if (now - this.lastCapSweepAt < CAP_SWEEP_INTERVAL_MS) return;
+		this.lastCapSweepAt = now;
+		for (const group of this.groups) {
+			const [subject, series, scope] = group.split("\0");
+			if (subject === void 0 || series === void 0 || scope === void 0) continue;
+			const where = {
+				subject,
+				series,
+				scope
+			};
+			try {
+				const excess = await this.store.count.query({
+					collection: this.collection,
+					filter: { where }
+				}) - this.maxRows;
+				if (excess <= 0) continue;
+				const cutoff = (await this.store.query.query({
+					collection: this.collection,
+					filter: {
+						where,
+						orderBy: {
+							field: "bucketStart",
+							direction: "asc"
+						},
+						limit: excess
+					}
+				})).at(-1)?.data["bucketStart"];
+				if (typeof cutoff !== "number") continue;
+				const { deleted } = await this.store.deleteWhere.mutate({
+					collection: this.collection,
+					filter: {
+						where,
+						whereBetween: { bucketStart: [0, cutoff] }
+					}
+				});
+				this.logger.info("lts row cap enforced", { meta: {
+					collection: this.collection,
+					series,
+					subject,
+					deleted,
+					cap: this.maxRows
+				} });
+			} catch (err) {
+				this.logger.warn("lts row cap sweep failed — the series keeps growing this cycle", { meta: {
+					collection: this.collection,
+					series,
+					subject,
+					error: String(err)
+				} });
+			}
+		}
+	}
+};
+function groupKey(subject, series, scope) {
+	return `${subject}${series}${scope}`;
+}
+function rowId(subject, series, scope, bucketStart) {
+	return `${subject}|${series}|${scope}|${bucketStart}`;
+}
+function toRow(bucket) {
+	return {
+		subject: bucket.subject,
+		...bucket.deviceId !== void 0 ? { deviceId: bucket.deviceId } : {},
+		series: bucket.series,
+		scope: bucket.scope,
+		bucketStart: bucket.bucketStart,
+		samples: bucket.samples,
+		sum: bucket.sum,
+		min: bucket.min,
+		max: bucket.max
+	};
+}
+/** Structural validation on read. A malformed row is skipped, never charted. */
+function recordToRow(data) {
+	const subject = data["subject"];
+	const series = data["series"];
+	const scope = data["scope"];
+	if (typeof subject !== "string" || typeof series !== "string") return null;
+	const bucketStart = Number(data["bucketStart"]);
+	const samples = Number(data["samples"]);
+	const sum = Number(data["sum"]);
+	const min = Number(data["min"]);
+	const max = Number(data["max"]);
+	if (![
+		bucketStart,
+		samples,
+		sum,
+		min,
+		max
+	].every((n) => Number.isFinite(n))) return null;
+	const rawDeviceId = data["deviceId"];
+	const deviceId = typeof rawDeviceId === "number" && Number.isFinite(rawDeviceId) ? rawDeviceId : void 0;
+	return {
+		subject,
+		...deviceId !== void 0 ? { deviceId } : {},
+		series,
+		scope: typeof scope === "string" ? scope : "",
+		bucketStart,
+		samples,
+		sum,
+		min,
+		max
+	};
+}
+//#endregion
+//#region src/node-stress-lts.ts
+/**
+* @durable class=ledger owner=pipeline-orchestrator
+*   write="one row per (node, series, 5-min bucket), written ONCE when the bucket closes; a node reporting no samples writes nothing"
+*   retention="row CAP per (subject, series, scope) — 105,120 rows ≈ one year of 5-minute buckets. Not an age sweep: an LTS row summarises an interval and has no owner to be orphaned from."
+*/
+var NODE_STRESS_LTS_COLLECTION = "pipeline-orchestrator:stats-5m";
+var NodeStressLts = class {
+	lts;
+	constructor(deps) {
+		this.lts = new LtsAggregator({
+			collection: NODE_STRESS_LTS_COLLECTION,
+			store: deps.store,
+			logger: deps.logger,
+			...deps.now !== void 0 ? { now: deps.now } : {}
+		});
+	}
+	static declare(store) {
+		return LtsAggregator.declare(store, NODE_STRESS_LTS_COLLECTION);
+	}
+	/** Fold one sweep's verdict for one node into the open buckets. */
+	noteSignals(nodeId, signals, at) {
+		this.lts.note({
+			subject: nodeId,
+			series: "node-score",
+			value: signals.score,
+			at
+		});
+		this.lts.note({
+			subject: nodeId,
+			series: "node-queue-pressure",
+			value: signals.queuePressure,
+			at
+		});
+		this.lts.note({
+			subject: nodeId,
+			series: "node-drop-ratio",
+			value: signals.dropRatio,
+			at
+		});
+		this.lts.note({
+			subject: nodeId,
+			series: "node-fps-deficit",
+			value: signals.fpsDeficit,
+			at
+		});
+	}
+	flushDue(now) {
+		return this.lts.flushDue(now);
+	}
+	read(query) {
+		return this.lts.read(query);
+	}
+	openBuckets() {
+		return this.lts.openBuckets();
+	}
+};
+//#endregion
+//#region src/node-stress-move-ledger.ts
+/**
+* @durable class=ledger owner=pipeline-orchestrator
+*   write="one row per APPLIED failover move (never per attempt); write-behind"
+*   retention="pruned by the sweep once older than the longest guard window (2 h) — a move no guard can read is growth with no reader"
+*/
+var NODE_STRESS_MOVES_COLLECTION = "pipeline-orchestrator:node-stress-moves";
+var NODE_STRESS_MOVES_COLUMNS = [
+	(
+	/** `<deviceId>:<at>` — one camera can be moved more than once, and each move
+	*  spends its own slice of the budget. */
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	}),
+	(
+	/** Indexed: every question about a move is asked per-camera. */
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	}),
+	(
+	/** The node the camera LEFT — the return ban is about coming back here. */
+	{
+		name: "fromNodeId",
+		type: "TEXT",
+		notNull: true
+	}),
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var NODE_STRESS_MOVES_INDEXES = [{
+	name: "idx_node_stress_moves_device",
+	columns: ["deviceId"]
+}];
+function moveId(entry) {
+	return `${entry.deviceId}:${entry.at}`;
+}
+var NODE_STRESS_MOVES_SPEC = {
+	collection: NODE_STRESS_MOVES_COLLECTION,
+	columns: NODE_STRESS_MOVES_COLUMNS,
+	indexes: NODE_STRESS_MOVES_INDEXES,
+	writeMode: "write-behind",
+	keyOf: (row) => row.id,
+	toValue: (row) => ({
+		deviceId: row.deviceId,
+		fromNodeId: row.fromNodeId,
+		at: row.at
+	}),
+	fromRecord: (id, data) => {
+		const deviceId = Number(data["deviceId"]);
+		const at = Number(data["at"]);
+		const fromNodeId = data["fromNodeId"];
+		if (!Number.isFinite(deviceId) || !Number.isFinite(at)) return null;
+		if (typeof fromNodeId !== "string" || fromNodeId.length === 0) return null;
+		return {
+			id,
+			deviceId,
+			fromNodeId,
+			at
+		};
+	},
+	deviceIdOf: (row) => row.deviceId,
+	loadLimit: 1e4
+};
+var NodeStressMoveLedger = class {
+	ledger;
+	constructor(deps) {
+		this.ledger = new DurableLedger({
+			spec: NODE_STRESS_MOVES_SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, NODE_STRESS_MOVES_SPEC);
+	}
+	/** Boot reseed. Returns the row count so the caller can say out loud how much
+	*  budget it recovered — "moves recovered: 0" after a restart is the line that
+	*  explains a burst of relocations. */
+	async load() {
+		return (await this.ledger.load()).length;
+	}
+	/** The history the guards read. Pure RAM — a guard must never wait on I/O. */
+	entries() {
+		return this.ledger.snapshot().map(({ deviceId, fromNodeId, at }) => ({
+			deviceId,
+			fromNodeId,
+			at
+		}));
+	}
+	/** Record one APPLIED move. Mirror first; the durable write follows and its
+	*  failure is logged, never thrown at a relocation that already happened. */
+	record(entry) {
+		this.ledger.put({
+			...entry,
+			id: moveId(entry)
+		});
+	}
+	/** Drop moves older than `cutoff` — no guard can read them. Returns the count. */
+	pruneOlderThan(cutoff) {
+		const keep = new Set(this.ledger.snapshot().filter((row) => row.at >= cutoff).map((row) => row.id));
+		return this.ledger.pruneExcept(keep);
+	}
+};
+//#endregion
 //#region src/dispatch-reconcile.ts
 function runnerAttachmentKey(nodeId, deviceId) {
 	return `${nodeId}:${deviceId}`;
@@ -41631,6 +42692,79 @@ async function migrateStepGating(deps) {
 	} });
 }
 //#endregion
+//#region src/zone-mirror-hydration.ts
+/** How long to wait for a camera list: the hub wires `ctx.api` AFTER the addon
+*  init chain resolves, and `device-manager` answers a moment later still, so a
+*  task kicked off from `onInitialize` loses both races. Same shape as the
+*  bindings migration's poll — one budget covering "no api yet" and "api, but
+*  device-manager not answering yet", because to this sweep they are the same
+*  thing: no fleet to hydrate. */
+var CAMERA_LIST_WAIT_MS = 6e3;
+var POLL_INTERVAL_MS = 200;
+/**
+* Hydrate the `zones` mirror for every camera once, at boot. Never throws: a
+* hydration sweep that cannot run must not take the orchestrator's boot with
+* it — but it is never silent either, because a skipped sweep is exactly the
+* failure this exists to end.
+*/
+async function hydrateZoneMirrorsAtBoot(deps) {
+	const cameraIds = await readCameraIds(deps);
+	if (cameraIds === null) return;
+	for (const hydrator of deps.hydrators) {
+		let written = 0;
+		let unchanged = 0;
+		let failed = 0;
+		for (const deviceId of cameraIds) try {
+			const outcome = await hydrator.hydrate(deviceId);
+			if (outcome === "written") written++;
+			else if (outcome === "unchanged") unchanged++;
+			else failed++;
+		} catch (err) {
+			failed++;
+			deps.logger.warn("zone mirror boot hydration failed for this camera", {
+				tags: { deviceId },
+				meta: {
+					mirror: hydrator.mirror,
+					error: errMsg(err)
+				}
+			});
+		}
+		deps.logger.info("zone mirror boot hydration complete", { meta: {
+			mirror: hydrator.mirror,
+			cameras: cameraIds.length,
+			written,
+			unchanged,
+			failed
+		} });
+	}
+}
+/**
+* The camera fleet, or `null` when it never became readable inside the budget
+* — in which case this has already said so. Retried inside one budget rather
+* than once, because at orchestrator boot "no api yet" and "device-manager not
+* answering yet" are both transient and indistinguishable from here.
+*/
+async function readCameraIds(deps) {
+	const deadline = Date.now() + (deps.apiWaitMs ?? CAMERA_LIST_WAIT_MS);
+	let lastError = null;
+	for (;;) {
+		const api = deps.api();
+		if (api) try {
+			return (await api.deviceManager.listAll.query({
+				isCamera: true,
+				projection: "slim"
+			})).map((camera) => camera.id);
+		} catch (err) {
+			lastError = err;
+		}
+		if (Date.now() >= deadline) {
+			deps.logger.warn("zones mirror boot hydration SKIPPED — camera list never became readable; mirror-only consumers keep whatever the last write left", { meta: { error: lastError === null ? "ctx.api unavailable" : errMsg(lastError) } });
+			return null;
+		}
+		await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+	}
+}
+//#endregion
 //#region src/zone-rules-provider.ts
 /**
 * `zone-rules-provider.ts` — implements `zoneRulesCapability` for the
@@ -41647,6 +42781,20 @@ async function migrateStepGating(deps) {
 * before persisting — partial / corrupt writes are rejected outright
 * since rules drive runtime filtering and a bad payload would silently
 * widen the operator's intended scope.
+*
+* ── THE MIRROR IS HYDRATED AT BOOT, NOT ONLY ON MUTATION ──────────
+*
+* Same root cause as the `zones` slice (see `zones-provider.ts`): the
+* mirror used to be written only by `persist`, so a camera nobody had
+* mutated since its runtime-state row was last written had NO
+* `zone-rules` slice, and every mirror-only consumer — motion-wasm's
+* zone gate, the detection-pipeline zone gate, the admin rules editor
+* — read "no rules" until an operator happened to save one. Zones and
+* rules gate together, so hydrating one without the other still leaves
+* both runner-side gates inert. {@link ZoneRulesProvider.hydrateMirror}
+* is what the boot sweep (`zone-mirror-hydration.ts`) calls; it is an
+* RPC read, never an event replay (D8), and a stage that could not be
+* read leaves the mirror untouched (D49).
 */
 /**
 * Every zone-rule stage, in the declared enum order. The unified device-state
@@ -41690,6 +42838,11 @@ var ZoneRulesProvider = class {
 	* write on one stage can never drop the other. Built lazily + memoised.
 	*/
 	stateByDevice = /* @__PURE__ */ new Map();
+	/** Per-device fingerprint of the slice this process last successfully wrote.
+	*  Absent ⇒ never mirrored here, so the next hydration writes. */
+	mirroredFingerprint = /* @__PURE__ */ new Map();
+	/** Devices already reported as unmirrorable — one warn per episode. */
+	reportedMirrorFailure = /* @__PURE__ */ new Set();
 	constructor(ctx) {
 		this.ctx = ctx;
 	}
@@ -41732,10 +42885,52 @@ var ZoneRulesProvider = class {
 		if (!parsed.success) throw new Error(`zone-rules.setRules: invalid rule payload — ${parsed.error.issues.map((i) => i.message).join("; ")}`);
 		await this.persist(deviceId, stage, parsed.data);
 	}
+	/**
+	* Reconcile ONE device's `zone-rules` mirror against the durable block.
+	* Called by the boot sweep for every camera. Never throws.
+	*
+	* A stage whose read FAILED aborts the whole hydration: the mirror is a
+	* single slice carrying every stage, so writing a partially-read block would
+	* publish "this stage has no rules" off a store blip — and an empty
+	* `motion`/`detection` array is what makes a gate stop gating.
+	*/
+	async hydrateMirror(deviceId) {
+		const perDevice = this.stageCache(deviceId);
+		for (const stage of ALL_STAGES) {
+			const read = await this.readRules(deviceId, stage);
+			if (!read.ok) return "unreadable";
+			perDevice.set(stage, read.rules);
+		}
+		const slice = await this.buildSliceValue(deviceId, perDevice);
+		const fingerprint = JSON.stringify(slice);
+		if (this.mirroredFingerprint.get(deviceId) === fingerprint) return "unchanged";
+		try {
+			await (await this.ctx.fetchDevice(deviceId)).deviceState.setCapSlice({
+				capName: ZONE_RULES_CAP_NAME,
+				slice
+			});
+		} catch (err) {
+			if (!this.reportedMirrorFailure.has(deviceId)) {
+				this.reportedMirrorFailure.add(deviceId);
+				this.ctx.logger.warn("zone-rules mirror write failed — mirror-only zone gates see NO rules for this camera until it lands", {
+					tags: { deviceId },
+					meta: { error: err instanceof Error ? err.message : String(err) }
+				});
+			}
+			return "write-failed";
+		}
+		const first = !this.mirroredFingerprint.has(deviceId);
+		this.mirroredFingerprint.set(deviceId, fingerprint);
+		this.reportedMirrorFailure.delete(deviceId);
+		if (first) this.ctx.logger.info("zone-rules mirror hydrated from the durable block", { tags: { deviceId } });
+		return "written";
+	}
 	/** Drop a device's cache entries. Called when the device is removed. */
 	forgetDevice(deviceId) {
 		this.cache.delete(deviceId);
 		this.stateByDevice.delete(deviceId);
+		this.mirroredFingerprint.delete(deviceId);
+		this.reportedMirrorFailure.delete(deviceId);
 	}
 	/** Cap-surface read: a failure folds to the empty list, as it always has. */
 	async loadRules(deviceId, stage) {
@@ -41750,11 +42945,7 @@ var ZoneRulesProvider = class {
 	* momentary store blip into a permanent one.
 	*/
 	async readRules(deviceId, stage) {
-		let perDevice = this.cache.get(deviceId);
-		if (!perDevice) {
-			perDevice = /* @__PURE__ */ new Map();
-			this.cache.set(deviceId, perDevice);
-		}
+		const perDevice = this.stageCache(deviceId);
 		const cached = perDevice.get(stage);
 		if (cached) return {
 			ok: true,
@@ -41795,11 +42986,7 @@ var ZoneRulesProvider = class {
 		};
 	}
 	async persist(deviceId, stage, rules) {
-		let perDevice = this.cache.get(deviceId);
-		if (!perDevice) {
-			perDevice = /* @__PURE__ */ new Map();
-			this.cache.set(deviceId, perDevice);
-		}
+		const perDevice = this.stageCache(deviceId);
 		perDevice.set(stage, rules);
 		await this.rulesState(deviceId).update((prev) => ({
 			...prev,
@@ -41811,6 +42998,8 @@ var ZoneRulesProvider = class {
 				capName: ZONE_RULES_CAP_NAME,
 				slice: sliceValue
 			});
+			this.mirroredFingerprint.set(deviceId, JSON.stringify(sliceValue));
+			this.reportedMirrorFailure.delete(deviceId);
 		} catch (err) {
 			this.ctx.logger.debug("zone-rules slice mirror failed", {
 				tags: { deviceId },
@@ -41829,6 +43018,15 @@ var ZoneRulesProvider = class {
 	* also warms the cache). Iterates {@link ALL_STAGES} so it stays exhaustive
 	* over the cap's stage discriminator without a per-stage branch.
 	*/
+	/** The per-stage cache map for a device, created on first use. */
+	stageCache(deviceId) {
+		let perDevice = this.cache.get(deviceId);
+		if (!perDevice) {
+			perDevice = /* @__PURE__ */ new Map();
+			this.cache.set(deviceId, perDevice);
+		}
+		return perDevice;
+	}
 	async buildSliceValue(deviceId, perDevice) {
 		const slice = {
 			motion: [],
@@ -41846,11 +43044,38 @@ var ZoneRulesProvider = class {
 *
 * Per-camera CRUD over polygon detection zones. Persists to the
 * orchestrator's per-device settings store under the `zones` key and
-* mirrors every change into the device-state `zones` slice via
+* mirrors the catalogue into the device-state `zones` slice via
 * `api.deviceState.setCapSlice`. Downstream consumers (motion-wasm,
 * pipeline-executor, analytics, admin UI) read the live state with
 * the canonical `dev.state.zones.onChanged` channel.
 *
+* ── THIS PROVIDER OWNS THE MIRROR FOR ITS WHOLE LIFETIME ──────────
+*
+* The mirror used to be written in exactly ONE place: `persist`, i.e.
+* only when an operator mutates a zone. Nothing seeded it at startup,
+* so a camera whose runtime-state row had never been written (or had
+* been reset) had no `zones` slice at all, and every mirror-only
+* consumer concluded "this camera has no zones" — forever, because no
+* mutation was coming. Live cost (camera 617 'Parcheggio',
+* 2026-08-12): `zones.listZones {617}` returned 'Parcheggio papà'
+* while `deviceState.getCapSlice {617,'zones'}` returned `null`;
+* occupancy dropped all three parked cars into `unzoned`, its zone
+* rule could never fire, and the admin Zones tab — which reads the
+* same mirror — showed "No zones yet".
+*
+* So the mirror is reconciled against the durable catalogue on the
+* READ path too ({@link ZonesProvider.hydrateMirror}), and the boot
+* sweep in `zone-mirror-hydration.ts` walks every camera once at
+* startup. That is deliberately an RPC read, never an event replay:
+* events are lossy telemetry and a slice change that was dropped is
+* never re-sent (D8).
+*
+* Two rules the hydration path must keep (D49):
+*   - a durable read that FAILED changes nothing — it must never be
+*     mirrored, and must not be cached as "this camera has no zones";
+*   - hydration is a reconcile, not a mutation: `onZonesChanged` is
+*     NOT fired, so nothing downstream re-dispatches on a boot read.
+*
 * Onboard / firmware-reported zones are out of scope for now — every
 * zone is operator-drawn. The provider keeps the surface symmetric:
 * `addZone` rejects id collisions, `updateZone` requires an existing
@@ -41859,6 +43084,11 @@ var ZoneRulesProvider = class {
 var ZONES_STORE_KEY = "zones";
 var ZONES_CAP_NAME = "zones";
 var ZonesArraySchema = array(ZoneSchema);
+/** Identity of a mirrored catalogue — cheap enough to compare on every read,
+*  and it changes whenever anything an operator can see changes. */
+function fingerprintZones(zones) {
+	return JSON.stringify(zones);
+}
 var ZonesProvider = class {
 	ctx;
 	/** Per-device cache. Hydrated lazily on first read for a device. */
@@ -41869,6 +43099,16 @@ var ZonesProvider = class {
 	* be dropped on persist. Built lazily + memoised per device.
 	*/
 	stateByDevice = /* @__PURE__ */ new Map();
+	/**
+	* Per-device fingerprint of the catalogue this process last successfully
+	* wrote to the mirror. Absent ⇒ this process has never mirrored the device,
+	* so the next read hydrates; a write that FAILED leaves it absent, which is
+	* what makes the retry happen on the next read rather than never.
+	*/
+	mirroredFingerprint = /* @__PURE__ */ new Map();
+	/** Devices already reported as unmirrorable — keeps the warn to one per
+	*  episode instead of one per read. */
+	reportedMirrorFailure = /* @__PURE__ */ new Set();
 	constructor(ctx) {
 		this.ctx = ctx;
 	}
@@ -41894,55 +43134,141 @@ var ZonesProvider = class {
 		}
 		return handle;
 	}
+	/**
+	* The device's catalogue — and, on the way past, the one place a mirror-only
+	* consumer's boot blindness is cured: every authoritative read reconciles the
+	* device-state slice against what it just read.
+	*/
 	async listZones({ deviceId }) {
-		return this.loadZones(deviceId);
+		const read = await this.readCatalogue(deviceId);
+		if (read.ok) await this.ensureMirror(deviceId, read.zones);
+		return read.zones;
 	}
 	async addZone({ deviceId, zone }) {
-		const existing = await this.loadZones(deviceId);
+		const existing = await this.readForMutation(deviceId);
 		if (existing.some((entry) => entry.id === zone.id)) throw new Error(`zones.addZone: id ${zone.id} already exists`);
 		await this.persist(deviceId, [...existing, zone]);
 	}
 	async updateZone({ deviceId, zone }) {
-		const existing = await this.loadZones(deviceId);
+		const existing = await this.readForMutation(deviceId);
 		if (!existing.some((entry) => entry.id === zone.id)) throw new Error(`zones.updateZone: id ${zone.id} not found`);
 		const next = existing.map((entry) => entry.id === zone.id ? zone : entry);
 		await this.persist(deviceId, next);
 	}
 	async removeZone({ deviceId, zoneId }) {
-		const existing = await this.loadZones(deviceId);
+		const existing = await this.readForMutation(deviceId);
 		if (!existing.some((entry) => entry.id === zoneId)) return;
 		await this.persist(deviceId, existing.filter((entry) => entry.id !== zoneId));
 	}
 	/**
+	* Reconcile ONE device's mirror against the durable catalogue. The boot
+	* sweep (`zone-mirror-hydration.ts`) calls this for every camera so a
+	* mirror-only consumer never starts blind; `listZones` calls it too, so a
+	* camera adopted after boot is covered by its first read.
+	*
+	* Never throws — a hydration that cannot happen is reported, and reported
+	* once (see {@link ZoneMirrorHydration}).
+	*/
+	async hydrateMirror(deviceId) {
+		const read = await this.readCatalogue(deviceId);
+		if (!read.ok) return "unreadable";
+		return this.ensureMirror(deviceId, read.zones);
+	}
+	/**
 	* Drop a device's cache entry. Called when the device is removed so
 	* the next attach starts from a fresh disk read.
 	*/
 	forgetDevice(deviceId) {
 		this.cache.delete(deviceId);
 		this.stateByDevice.delete(deviceId);
+		this.mirroredFingerprint.delete(deviceId);
+		this.reportedMirrorFailure.delete(deviceId);
+	}
+	/**
+	* The catalogue for a mutation. A mutation is read-modify-write over the
+	* WHOLE array, so proceeding from a failed read would persist the operator's
+	* zones away — refuse instead.
+	*/
+	async readForMutation(deviceId) {
+		const read = await this.readCatalogue(deviceId);
+		if (!read.ok) throw new Error(`zones: catalogue unreadable for device ${deviceId} — refusing to write`);
+		return read.zones;
 	}
-	async loadZones(deviceId) {
+	/**
+	* Read the durable catalogue, cached per device. A FAILED read is neither
+	* cached nor reported as `[]` — the caller decides what an unknown answer
+	* means for it.
+	*/
+	async readCatalogue(deviceId) {
 		const cached = this.cache.get(deviceId);
-		if (cached) return cached;
-		let zones = [];
+		if (cached) return {
+			ok: true,
+			zones: cached
+		};
+		let zones;
 		try {
 			zones = await this.zonesState(deviceId).get();
 		} catch (err) {
-			this.ctx.logger.warn("zones store read failed — using empty list", {
+			this.ctx.logger.warn("zones store read failed — catalogue UNKNOWN for this device", {
 				tags: { deviceId },
 				meta: { error: err instanceof Error ? err.message : String(err) }
 			});
+			return {
+				ok: false,
+				zones: []
+			};
 		}
 		this.cache.set(deviceId, zones);
-		return zones;
+		return {
+			ok: true,
+			zones
+		};
 	}
-	async persist(deviceId, zones) {
-		this.cache.set(deviceId, zones);
-		await this.zonesState(deviceId).set(zones);
+	/**
+	* Make the device-state mirror agree with `zones`. Idempotent per process
+	* via the fingerprint; the hub itself also no-ops an identical
+	* `setCapSlice`, so this is belt-and-braces against needless RPCs, not
+	* against needless writes.
+	*/
+	async ensureMirror(deviceId, zones) {
+		const fingerprint = fingerprintZones(zones);
+		if (this.mirroredFingerprint.get(deviceId) === fingerprint) return "unchanged";
+		try {
+			await this.writeMirror(deviceId, zones);
+		} catch (err) {
+			if (!this.reportedMirrorFailure.has(deviceId)) {
+				this.reportedMirrorFailure.add(deviceId);
+				this.ctx.logger.warn("zones mirror write failed — mirror-only consumers see NO zones for this camera until it lands", {
+					tags: { deviceId },
+					meta: {
+						zones: zones.length,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			}
+			return "write-failed";
+		}
+		const first = !this.mirroredFingerprint.has(deviceId);
+		this.mirroredFingerprint.set(deviceId, fingerprint);
+		this.reportedMirrorFailure.delete(deviceId);
+		if (first) this.ctx.logger.info("zones mirror hydrated from the durable catalogue", {
+			tags: { deviceId },
+			meta: { zones: zones.length }
+		});
+		return "written";
+	}
+	async writeMirror(deviceId, zones) {
 		await (await this.ctx.fetchDevice(deviceId)).deviceState.setCapSlice({
 			capName: ZONES_CAP_NAME,
 			slice: { zones }
 		});
+	}
+	async persist(deviceId, zones) {
+		this.cache.set(deviceId, zones);
+		await this.zonesState(deviceId).set(zones);
+		await this.writeMirror(deviceId, zones);
+		this.mirroredFingerprint.set(deviceId, fingerprintZones(zones));
+		this.reportedMirrorFailure.delete(deviceId);
 		this.ctx.onZonesChanged?.(deviceId, zones);
 	}
 };
@@ -42037,8 +43363,18 @@ async function buildOrchestratorControllers(deps) {
 		readGlobalSettings: () => globalSettings,
 		getInitTimestamp: () => deps.initTimestamp
 	});
+	const nodeStressMoves = new NodeStressMoveLedger({
+		store: deps.ctx().api.settingsStore,
+		logger: deps.ctx().logger.child("node-stress")
+	});
+	const nodeStressLts = new NodeStressLts({
+		store: deps.ctx().api.settingsStore,
+		logger: deps.ctx().logger.child("node-stress-lts")
+	});
 	const nodeStress = new NodeStressController({
 		ledger,
+		moves: nodeStressMoves,
+		lts: nodeStressLts,
 		topology,
 		settingsStore,
 		logger: deps.ctx().logger,
@@ -42047,6 +43383,17 @@ async function buildOrchestratorControllers(deps) {
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
 		readGlobalSettings: () => globalSettings
 	});
+	await NodeStressMoveLedger.declare(deps.ctx().api.settingsStore).then(() => nodeStress.hydrate()).catch((err) => {
+		deps.ctx().logger.warn("node-stress move history unavailable — this boot starts cold", { meta: { error: errMsg(err) } });
+	});
+	await NodeStressLts.declare(deps.ctx().api.settingsStore).catch((err) => {
+		deps.ctx().logger.warn("node-stress statistics unavailable — no baseline this boot", { meta: { error: errMsg(err) } });
+	});
+	const nodeStressLtsTimer = setInterval(() => {
+		nodeStressLts.flushDue().catch((err) => {
+			deps.ctx().logger.warn("node-stress statistics flush failed", { meta: { error: errMsg(err) } });
+		});
+	}, 6e4);
 	nodeStress.start();
 	const inferenceRotation = new RoundRobinInferenceDeviceRotation();
 	/**
@@ -42355,6 +43702,19 @@ async function buildOrchestratorControllers(deps) {
 			});
 		}
 	});
+	hydrateZoneMirrorsAtBoot({
+		api: () => deps.ctx().api ?? null,
+		hydrators: [{
+			mirror: "zones",
+			hydrate: (deviceId) => zonesProvider.hydrateMirror(deviceId)
+		}, {
+			mirror: "zone-rules",
+			hydrate: (deviceId) => zoneRulesProvider.hydrateMirror(deviceId)
+		}],
+		logger: deps.ctx().logger.child("zones")
+	}).catch((err) => {
+		deps.ctxIfReady()?.logger.warn("zones mirror boot hydration failed", { meta: { error: errMsg(err) } });
+	});
 	const unsubOrchestratorSubscriptions = wireOrchestratorSubscriptions({
 		eventBus: deps.ctx().eventBus,
 		logger: deps.ctx().logger,
@@ -42377,6 +43737,7 @@ async function buildOrchestratorControllers(deps) {
 	reconcile.scheduleReconcile();
 	const detectionWiring = new DetectionWiringController({
 		ctx: () => deps.ctx(),
+		featuresStore: deps.ctx().api.settingsStore,
 		ledger,
 		placement,
 		audio,
@@ -42401,10 +43762,15 @@ async function buildOrchestratorControllers(deps) {
 		deviceHasOnboardMotionCap: (deviceId) => deps.deviceHasOnboardMotionCap(deviceId),
 		deviceSettingsSchema: () => deps.deviceSettingsSchema()
 	});
+	await detectionWiring.hydrateFeaturesMirror().catch((err) => {
+		deps.ctx().logger.warn("device-features mirror not restored — this boot starts cold", { meta: { error: errMsg(err) } });
+	});
 	return {
 		ledger,
 		topology,
 		loadService,
+		nodeStressLts,
+		nodeStressLtsTimer,
 		audio,
 		settingsStore,
 		loadShed,
@@ -42658,25 +44024,37 @@ function buildGlobalSettingsSections(options) {
 			id: NATIVE_LEASE_SECTION_ID,
 			title: "Native frame lease",
 			tab: "pipeline",
-			description: "How long each decode worker keeps a full-resolution copy of a delivered frame in RAM so a LATE native crop (post-analysis snapshot, face/plate detail) can still be cut from real pixels instead of the ≤640 detection frame. Cost is real: a retained 4K frame is ~24.9 MB on the default pinned-RGB24 path (~12.4 MB as YUV420P), a 1080p frame ~6.2 MB / ~3.1 MB. Worst case for ONE busy camera ≈ frameBytes × delivered fps × TTL seconds, capped by the budget below. Takes effect on the NEXT decode session for a camera, not on sessions already running.",
+			description: "How a decode worker keeps native pixels available for a LATE crop (post-analysis snapshot, face/plate detail) instead of falling back to the ≤640 detection frame. Two things are kept and they cost very differently: a HELD FRAME is a full native raster (~24.9 MB at 4K on the default pinned-RGB24 path, ~6.2 MB at 1080p) and lives only until its own detection result arrives; a TILE is one subject cut from that frame at native resolution and JPEG-encoded (~60-120 KB at 4K), and lives for tens of seconds. A frame on which nothing was detected produces no tiles and costs nothing. Takes effect on the NEXT decode session for a camera, not on sessions already running.",
 			fields: [
 				{
-					key: NATIVE_LEASE_TTL_KEY,
+					key: NATIVE_LEASE_HOLD_KEY,
 					type: "slider",
-					label: "Lease TTL",
-					description: "How long a retained native frame stays claimable before it counts as a miss. It must cover the whole late-crop horizon — detection inference, the cross-process hop to hub post-analysis, tracking, and the tRPC crop round-trip back. Below ~500 ms the busiest cameras outrun it and their crops silently fall back to the downscaled detection frame; every extra second multiplies resident RAM by roughly (frame bytes × delivered fps). 1200 ms is the shipped value.",
-					min: NATIVE_LEASE_TTL_FIELD.min,
-					max: NATIVE_LEASE_TTL_FIELD.max,
-					step: NATIVE_LEASE_TTL_FIELD.step,
-					default: NATIVE_LEASE_TTL_FIELD.default,
+					label: "Frames held at once",
+					description: "How many delivered frames a worker keeps alive while waiting for their detection results. A frame is freed as soon as its own result comes back and its subject tiles have been cut, so the steady state is inference latency × delivered fps — 1 to 4 frames in practice. This number is only the bound above which the OLDEST held frame is dropped, which is what stops a runner that has stopped answering from pinning RAM. Raising it does not improve crop hit rate; it buys tolerance for a slow runner, and holdOverflow on the metrics line is what tells you that you need it.",
+					min: NATIVE_LEASE_HOLD_FIELD.min,
+					max: NATIVE_LEASE_HOLD_FIELD.max,
+					step: NATIVE_LEASE_HOLD_FIELD.step,
+					default: NATIVE_LEASE_HOLD_FIELD.default,
 					showValue: true,
-					unit: "ms"
+					unit: "frames"
+				},
+				{
+					key: NATIVE_LEASE_TILE_BUDGET_KEY,
+					type: "slider",
+					label: "Subject tile RAM",
+					description: "RAM per decode worker for the compressed SUBJECT TILES — the native-resolution crops taken at the moment a frame's detections are known, and kept long after the frame itself is gone. This is what serves a crop that arrives seconds late, which measurement says is the ordinary case (2 to 10 seconds on this cluster). At ~60-120 KB a tile, 64 MB is many hundreds of subjects. 0 turns tiles OFF and restores the old behaviour, where a late crop had nothing to fall back to but the ≤640 detection frame.",
+					min: NATIVE_LEASE_TILE_BUDGET_FIELD.min,
+					max: NATIVE_LEASE_TILE_BUDGET_FIELD.max,
+					step: NATIVE_LEASE_TILE_BUDGET_FIELD.step,
+					default: NATIVE_LEASE_TILE_BUDGET_FIELD.default,
+					showValue: true,
+					unit: "MB"
 				},
 				{
 					key: NATIVE_LEASE_BUDGET_KEY,
 					type: "slider",
 					label: "Lease RAM ceiling",
-					description: "Hard RAM ceiling for retained frames, PER decode worker (one worker per camera per plane). This is a safety ceiling, not the working size — the TTL above is what normally reclaims frames, and at 1024 MB the ceiling is never the binding constraint on a single camera. Lower it on a small host to bound the worst case. 0 DISABLES the lease entirely and falls the worker back to the tiny GPU surface ring, which misses roughly 85% of late crops — that is the behaviour the lease exists to replace, so 0 is a diagnostic setting, not a tuning one.",
+					description: "Hard RAM ceiling for held frames, PER decode worker (one worker per camera per plane). This is a safety ceiling, not the working size — the hold count above is what reclaims frames now, and the ceiling is the number above which something is wrong. Lower it on a small host to bound the worst case. 0 DISABLES the lease entirely and falls the worker back to the tiny GPU surface ring, which misses roughly 85% of late crops — that is the behaviour the lease exists to replace, so 0 is a diagnostic setting, not a tuning one.",
 					min: NATIVE_LEASE_BUDGET_FIELD.min,
 					max: NATIVE_LEASE_BUDGET_FIELD.max,
 					step: NATIVE_LEASE_BUDGET_FIELD.step,
@@ -42945,6 +44323,18 @@ function deriveRuntimeSettings(config) {
 }
 //#endregion
 //#region src/index.ts
+/**
+* The FULL action catalog, under the name the HUB HARVESTS.
+*
+* The hub's forked-addon harvest imports this entry module and reads the
+* `customActions` NAMED export (`loadForkedCustomActionCatalog`) — returning a
+* catalog from `onInitialize` is not enough. Without this line the bridge
+* answers *"no addon 'pipeline-orchestrator' registers custom actions"* for
+* every action here, which is what `dumpState` had been doing, silently, since
+* it was written: an admin diagnostic that 404s is worse than no diagnostic,
+* because nobody discovers it is missing until they need it.
+*/
+var customActions = pipelineOrchestratorActions;
 var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddon {
 	/** This node's Moleculer nodeId (from this.ctx.kernel.localNodeId). */
 	localNodeId = "hub";
@@ -43162,6 +44552,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	pendingRetryTimer = null;
 	/** Periodic auto-rebalance sweep timer (drift correction under hysteresis). */
 	autoRebalanceTimer = null;
+	/** Node-stress five-minute statistics + its flush timer (see
+	*  `node-stress-lts.ts`). `observe` mode's first durable output. */
+	nodeStressLts = null;
+	nodeStressLtsTimer = null;
 	initTimestamp = 0;
 	/** Storage migration maintenance lease. It only gates dispatch; it does not
 	* change any camera wrapper or persistent pipeline configuration. */
@@ -43255,6 +44649,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.unsubOrchestratorSubscriptions = controllers.unsubOrchestratorSubscriptions;
 		this.pendingRetryTimer = controllers.pendingRetryTimer;
 		this.autoRebalanceTimer = controllers.autoRebalanceTimer;
+		this.nodeStressLts = controllers.nodeStressLts;
+		this.nodeStressLtsTimer = controllers.nodeStressLtsTimer;
 		return {
 			providers: [
 				{
@@ -43283,7 +44679,23 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				}
 			],
 			customActions: pipelineOrchestratorActions,
-			actionHandlers: { dumpState: async () => this.dumpDiagnostics() }
+			actionHandlers: {
+				dumpState: async () => this.dumpDiagnostics(),
+				nodeStressStats: async (input) => {
+					const lts = this.nodeStressLts;
+					const moves = this.nodeStress?.historyView() ?? [];
+					if (!lts) return {
+						rows: [],
+						open: [],
+						moves: [...moves]
+					};
+					return {
+						rows: (await lts.read(input)).map(withStatsMean),
+						open: lts.openBuckets().map(withStatsMean),
+						moves: [...moves]
+					};
+				}
+			}
 		};
 	}
 	/**
@@ -43318,6 +44730,11 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			clearInterval(this.autoRebalanceTimer);
 			this.autoRebalanceTimer = null;
 		}
+		if (this.nodeStressLtsTimer !== null) {
+			clearInterval(this.nodeStressLtsTimer);
+			this.nodeStressLtsTimer = null;
+		}
+		this.nodeStressLts = null;
 		this.unsubOrchestratorSubscriptions?.();
 		this.unsubOrchestratorSubscriptions = null;
 		this.reconcile?.dispose();
@@ -44271,8 +45688,16 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		return this.isSessionCamera(deviceId) && !this.session.hasActiveSession(deviceId);
 	}
 };
+/** The derived mean for one statistics row — see `node-stress-lts.ts`. */
+function withStatsMean(row) {
+	return {
+		...row,
+		mean: row.samples > 0 ? row.sum / row.samples : 0
+	};
+}
 //#endregion
 exports.balance = balance;
 exports.computeCapacityScore = computeCapacityScore;
+exports.customActions = customActions;
 exports.default = PipelineOrchestratorAddon;
 exports.pipelineOrchestratorActions = pipelineOrchestratorActions;