@camstack/addon-pipeline-orchestrator 1.2.51 → 1.2.53

package/dist/index.js

@@ -13863,11 +13863,33 @@ var NotificationFormatSchema = _enum([
 * Named by INTENT, never by glyph. "check" would tie the vocabulary to one
 * renderer's icon set; "acknowledge" survives an adapter that draws it
 * differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
 */
 var NotificationActionIconSchema = _enum([
 	"acknowledge",
 	"dismiss",
 	"silence",
+	"snooze",
 	"view",
 	"play",
 	"open",
@@ -13875,9 +13897,13 @@ var NotificationActionIconSchema = _enum([
 	"lock",
 	"unlock",
 	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
 	"disarm",
 	"light",
-	"alert"
+	"alert",
+	"camera"
 ]);
 /** A single tap-through action button. */
 var NotificationActionSchema = object({
@@ -13893,7 +13919,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14061,6 +14103,24 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	targetId: string(),
 	enabled: boolean()
 }), _void(), { kind: "mutation" });
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
 var COCO_TO_MACRO = {
 	mapping: {
 		person: "person",
@@ -14858,6 +14918,8 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-triggered",
 	"alarm-armed",
 	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -14894,6 +14956,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -15270,15 +15335,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -15514,6 +15579,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -15613,6 +15702,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -15631,6 +15721,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15782,7 +15873,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15807,6 +15911,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -18059,7 +18167,14 @@ var zonesCapability = {
 	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
 	* (e.g. zone groupings) can sit alongside the polygon list.
 	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() })
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -18229,6 +18344,22 @@ var detectionFpsField = {
 	default: 10,
 	step: 1
 };
+/**
+* The occupancy re-check interval. DEFAULT 300 s (2026-08-13 — was 30 s).
+*
+* The recheck is now on by default (a parked car is invisible to occupancy
+* rules until the stationary registry has been rebuilt by motion, which after a
+* restart may be never on a quiet camera). Each cycle re-subscribes a detection
+* session — an RTSP re-dial — so the switch is only affordable at a WIDE
+* interval: 300 s is ~12 re-dials an hour per camera, against 120 at the old
+* 30 s. A parked car is therefore counted within 5 minutes of a restart.
+*
+* Why not wider: `max` is 300 and raising it is TRAIN-BOUND, not addon-bound —
+* the host validates `attachCamera` against ITS copy of this schema, so a
+* runner asked for 600 would be rejected by the hub until a `@camstack/server`
+* carrying the wider bound is installed everywhere. 300 is the widest value
+* that ships with an addon deploy.
+*/
 var occupancyRecheckSecField = {
 	min: 0,
 	max: 300,
@@ -18430,15 +18561,21 @@ var RunnerCameraConfigSchema = object({
 	*/
 	onboardMotionDrivesAnalyzer: boolean().default(true),
 	/**
-	* Master toggle for the occupancy re-check. When `false` (DEFAULT) the runner
-	* never arms the periodic recheck timer, regardless of `occupancyRecheckSec` —
-	* this is off by default because the recheck re-subscribes a detection session
-	* every N seconds while `watching`, a major source of pull-decoder re-dial
-	* churn (each cycle creates+tears a session → RTSP re-dial → latency). The
+	* Master toggle for the occupancy re-check. When `false` the runner never arms
+	* the periodic recheck timer, regardless of `occupancyRecheckSec`; the
 	* `occupancyRecheckSec` / `occupancyRecheckFrames` sliders only take effect
 	* (and only render) when this is enabled.
-	*/
-	occupancyRecheckEnabled: boolean().default(false),
+	*
+	* DEFAULT `true` since 2026-08-13 (was `false`). It was off because the
+	* recheck re-subscribes a detection session every N seconds while `watching`
+	* — each cycle creates+tears a session ⇒ an RTSP re-dial ⇒ latency, a major
+	* pull-decoder churn source. What that bought was a blind spot: a STATIONARY
+	* object is counted only while the stationary registry holds it, and the
+	* registry rebuilds from motion, so after a restart a parked car was invisible
+	* to every occupancy rule until something moved in front of it. The churn is
+	* now paid on the interval instead — see `occupancyRecheckSecField`.
+	*/
+	occupancyRecheckEnabled: boolean().default(true),
 	occupancyRecheckSec: number().min(occupancyRecheckSecField.min).max(occupancyRecheckSecField.max).default(occupancyRecheckSecField.default),
 	occupancyRecheckFrames: number().min(occupancyRecheckFramesField.min).max(occupancyRecheckFramesField.max).default(occupancyRecheckFramesField.default),
 	/**
@@ -18571,8 +18708,8 @@ var RunnerCameraDeviceUIFields = [
 		type: "boolean",
 		style: "checkbox",
 		label: "Occupancy re-check",
-		description: "Periodically re-sample a few frames during the watching phase to confirm the scene is truly empty (catches stationary objects motion-gating would miss). Off by default — it adds decoder re-dial churn.",
-		default: false
+		description: "Periodically re-sample a few frames during the watching phase, so objects that are simply parked are still counted (motion gating alone loses them after a restart). On by default at a wide interval; turn it off on cameras where the extra decoder re-dial is expensive.",
+		default: true
 	},
 	{
 		key: "occupancyRecheckSec",
@@ -26413,7 +26550,14 @@ var zoneRulesCapability = {
 		motion: array(ZoneRuleSchema).readonly(),
 		detection: array(ZoneRuleSchema).readonly(),
 		package: array(ZoneRuleSchema).readonly()
-	})
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
 };
 /**
 * Accessory device helpers — shared across drivers.
@@ -32094,6 +32238,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -32913,7 +33058,55 @@ var OrchestratorDiagnosticsSchema = object({
 	cameraConfigCount: number().int().min(0),
 	activeDetectionCount: number().int().min(0)
 });
-var pipelineOrchestratorActions = defineCustomActions({ dumpState: customAction(_void(), OrchestratorDiagnosticsSchema) });
+/**
+* The node-stress long-term-statistics read surface.
+*
+* A custom action rather than a cap method, matching how the orchestrator
+* already serves `dumpState`: this is a hub-local read over a table the hub
+* owns, and it ships with one `camstack deploy` instead of a release train.
+* The MEAN is derived here and returned alongside the addable `sum`/`samples`
+* — a chart wants the first, a re-bucketing caller wants the second, and a
+* stored mean is a field that can disagree with both.
+*/
+var NodeStressStatsInputSchema = object({
+	/** `node-score` | `node-queue-pressure` | `node-drop-ratio` | `node-fps-deficit`. */
+	series: string().optional(),
+	/** A node id. Omit for every node. */
+	subject: string().optional(),
+	/** Inclusive bucket-start bounds, ms. */
+	from: number().int().optional(),
+	to: number().int().optional(),
+	limit: number().int().positive().max(5e3).optional()
+});
+var NodeStressStatsRowSchema = object({
+	subject: string(),
+	series: string(),
+	scope: string(),
+	bucketStart: number(),
+	samples: number(),
+	sum: number(),
+	mean: number(),
+	min: number(),
+	max: number()
+});
+var NodeStressStatsOutputSchema = object({
+	rows: array(NodeStressStatsRowSchema).readonly(),
+	/** Buckets still accumulating — "is it running" answerable at once, rather
+	*  than after five minutes of indistinguishable silence. */
+	open: array(NodeStressStatsRowSchema).readonly(),
+	/** The durable failover history the anti-flap guards read, newest first.
+	*  Exposed for the same reason the heartbeat exists: "nothing moved" has to
+	*  be distinguishable from "nothing is watching". */
+	moves: array(object({
+		deviceId: number(),
+		fromNodeId: string(),
+		at: number()
+	})).readonly()
+});
+var pipelineOrchestratorActions = defineCustomActions({
+	dumpState: customAction(_void(), OrchestratorDiagnosticsSchema),
+	nodeStressStats: customAction(NodeStressStatsInputSchema, NodeStressStatsOutputSchema, { auth: "admin" })
+});
 /**
 * Sentinel returned by `buildDetectionConfig` when the profile-slot READ
 * itself failed transiently (e.g. `listAllProfileSlots` discovery timeout
@@ -35499,7 +35692,7 @@ function resolveDetectionSettings(input) {
 	const userOnboardMotionDrivesAnalyzer = raw["onboardMotionDrivesAnalyzer"];
 	const onboardMotionDrivesAnalyzer = typeof userOnboardMotionDrivesAnalyzer === "boolean" ? userOnboardMotionDrivesAnalyzer : true;
 	const userOccupancyRecheckEnabled = raw["occupancyRecheckEnabled"];
-	const occupancyRecheckEnabled = typeof userOccupancyRecheckEnabled === "boolean" ? userOccupancyRecheckEnabled : false;
+	const occupancyRecheckEnabled = typeof userOccupancyRecheckEnabled === "boolean" ? userOccupancyRecheckEnabled : true;
 	const occupancyRecheckSec = mustNumber(flat, deviceId, "occupancyRecheckSec");
 	const occupancyRecheckFrames = mustNumber(flat, deviceId, "occupancyRecheckFrames");
 	return {
@@ -35633,12 +35826,341 @@ function buildRunnerConfig(base, overrides) {
 	};
 }
 //#endregion
-//#region src/device-features-mirror.ts
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
+		try {
+			await this.store.delete.mutate({
+				collection: this.spec.collection,
+				key
+			});
+		} catch (err) {
+			this.logger.debug("durable delete failed", { meta: {
+				collection: this.spec.collection,
+				key,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
+	*
+	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
+	* fallible read is work destroyed on an error (D49/D130) — that is why this
+	* is a method a feature opts into rather than a policy the primitive runs.
+	* Best-effort per row: a failed delete keeps the key (retried next prune)
+	* rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
+				});
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
+			}
+		}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
+var DEVICE_FEATURES_SPEC = {
+	collection: "pipeline-orchestrator:device-features",
+	columns: [
+		{
+			name: "deviceId",
+			type: "TEXT",
+			primaryKey: true,
+			notNull: true
+		},
+		(
+		/** The feature name list, verbatim. */
+		{
+			name: "features",
+			type: "JSON",
+			notNull: true
+		}),
+		{
+			name: "updatedAt",
+			type: "INTEGER",
+			notNull: true
+		}
+	],
+	writeMode: "write-behind",
+	keyOf: (row) => String(row.deviceId),
+	toValue: (row) => ({
+		features: [...row.features],
+		updatedAt: row.updatedAt
+	}),
+	fromRecord: (key, data) => {
+		const deviceId = Number(key);
+		const raw = data["features"];
+		if (!Number.isFinite(deviceId) || !Array.isArray(raw)) return null;
+		const features = raw.filter((f) => typeof f === "string");
+		if (features.length === 0) return null;
+		const updatedAt = Number(data["updatedAt"]);
+		return {
+			deviceId,
+			features,
+			updatedAt: Number.isFinite(updatedAt) ? updatedAt : 0,
+			restored: true
+		};
+	},
+	deviceIdOf: (row) => row.deviceId
+};
 var DeviceFeaturesMirror = class {
+	/** Process-local fallback, used only when no store was supplied. */
+	local = /* @__PURE__ */ new Map();
+	durable;
 	logger;
-	lastKnown = /* @__PURE__ */ new Map();
-	constructor(logger) {
-		this.logger = logger;
+	now;
+	constructor(deps) {
+		this.logger = deps.logger;
+		this.now = deps.now ?? (() => Date.now());
+		this.durable = deps.store === void 0 ? null : new DurableLedger({
+			spec: DEVICE_FEATURES_SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, DEVICE_FEATURES_SPEC);
+	}
+	/**
+	* Seed the mirror from the last session. Call once at boot, after `declare`
+	* and BEFORE the first `resolve` — the whole value of the row is that it is
+	* already there when the first read fails.
+	*/
+	async hydrate() {
+		if (this.durable === null) return 0;
+		const rows = await this.durable.load();
+		this.logger.info("device-features mirror restored", { meta: { devices: rows.length } });
+		return rows.length;
+	}
+	held(deviceId) {
+		return this.durable === null ? this.local.get(deviceId) : this.durable.get(String(deviceId));
+	}
+	remember(deviceId, features) {
+		const row = {
+			deviceId,
+			features: [...features],
+			updatedAt: this.now(),
+			restored: false
+		};
+		if (this.durable === null) {
+			this.local.set(deviceId, row);
+			return;
+		}
+		const held = this.durable.get(String(deviceId));
+		if (held !== void 0 && !held.restored && sameFeatures(held.features, features)) return;
+		this.durable.put(row);
+	}
+	drop(deviceId) {
+		if (this.durable === null) {
+			this.local.delete(deviceId);
+			return;
+		}
+		this.durable.forget(String(deviceId));
 	}
 	/**
 	* Resolve a device's features, preferring a fresh read but never letting a
@@ -35647,15 +36169,19 @@ var DeviceFeaturesMirror = class {
 	async resolve(deviceId, read) {
 		const first = await read();
 		if (first !== null && first.length > 0) {
-			this.lastKnown.set(deviceId, [...first]);
+			this.remember(deviceId, first);
 			return first;
 		}
-		const mirrored = this.lastKnown.get(deviceId);
+		const heldRow = this.held(deviceId);
+		const mirrored = heldRow?.features;
 		if (first === null) {
 			if (mirrored !== void 0) {
 				this.logger.warn("device features unavailable — serving last-known mirror", {
 					tags: { deviceId },
-					meta: { mirrored: mirrored.length }
+					meta: {
+						mirrored: mirrored.length,
+						restored: heldRow?.restored === true
+					}
 				});
 				return mirrored;
 			}
@@ -35669,7 +36195,7 @@ var DeviceFeaturesMirror = class {
 				tags: { deviceId },
 				meta: { features: second.length }
 			});
-			this.lastKnown.set(deviceId, [...second]);
+			this.remember(deviceId, second);
 			return second;
 		}
 		if (second === null) {
@@ -35680,14 +36206,20 @@ var DeviceFeaturesMirror = class {
 			tags: { deviceId },
 			meta: { previously: mirrored.length }
 		});
-		this.lastKnown.delete(deviceId);
+		this.drop(deviceId);
 		return [];
 	}
 	/** Drop a device's mirror — call when the device is removed. */
 	forget(deviceId) {
-		this.lastKnown.delete(deviceId);
+		this.drop(deviceId);
 	}
 };
+/** Order-insensitive feature-set equality — the read's order is not a fact. */
+function sameFeatures(a, b) {
+	if (a.length !== b.length) return false;
+	const held = new Set(a);
+	return b.every((f) => held.has(f));
+}
 //#endregion
 //#region src/watchdog-camera.ts
 /**
@@ -35754,7 +36286,20 @@ var DetectionWiringController = class {
 	featuresMirror;
 	constructor(deps) {
 		this.deps = deps;
-		this.featuresMirror = new DeviceFeaturesMirror(deps.logger);
+		this.featuresMirror = new DeviceFeaturesMirror({
+			logger: deps.logger,
+			...deps.featuresStore !== void 0 ? { store: deps.featuresStore } : {}
+		});
+	}
+	/**
+	* Declare + seed the device-features mirror. Call once at boot, BEFORE the
+	* first detection start — the restored row is worth nothing after the read
+	* that would have needed it.
+	*/
+	async hydrateFeaturesMirror() {
+		if (this.deps.featuresStore === void 0) return;
+		await DeviceFeaturesMirror.declare(this.deps.featuresStore);
+		await this.featuresMirror.hydrate();
 	}
 	/** `activeDetections.get(deviceId)`. */
 	getActiveDetectionConfig(deviceId) {
@@ -36965,7 +37510,6 @@ var NodeStressController = class NodeStressController {
 	static HEARTBEAT_MS = 60 * 6e4;
 	samples = /* @__PURE__ */ new Map();
 	memories = /* @__PURE__ */ new Map();
-	history = [];
 	/** When the last heartbeat went out. `null` ⇒ the next sweep emits one. */
 	lastHeartbeatAt = null;
 	timer = null;
@@ -37009,6 +37553,18 @@ var NodeStressController = class NodeStressController {
 	forgetDevice(deviceId) {
 		this.samples.delete(deviceId);
 	}
+	/**
+	* Recover the move history from disk BEFORE the first sweep can act.
+	*
+	* Best-effort by construction (the ledger keeps whatever it already has on a
+	* read failure), and the count is logged out loud: a restart that recovers 0
+	* moves while the operator remembers three is the line that says the budget
+	* has been reset.
+	*/
+	async hydrate() {
+		const recovered = await this.deps.moves.load();
+		this.deps.logger.info("node-stress move history recovered", { meta: { moves: recovered } });
+	}
 	start() {
 		if (this.timer) return;
 		this.timer = setInterval(() => {
@@ -37024,12 +37580,24 @@ var NodeStressController = class NodeStressController {
 		}
 		this.samples.clear();
 		this.memories.clear();
-		this.history = [];
 	}
 	/** The last computed state per node — empty before the first sweep. */
 	statesView() {
 		return new Map([...this.memories].map(([nodeId, m]) => [nodeId, m.state]));
 	}
+	/** The durable move history, newest first — the guards' own evidence, so an
+	*  operator asking "why did nothing move" can read the budget. */
+	historyView() {
+		return this.deps.moves.entries().toSorted((a, b) => b.at - a.at);
+	}
+	/**
+	* The per-node stress signals as of `now`, for the LTS aggregator and for
+	* diagnostics. Computed from the same live samples the sweep uses, so a
+	* chart can never disagree with a verdict.
+	*/
+	signalsView(now) {
+		return new Map(this.buildInputs(now).map((input) => [input.nodeId, input.signals]));
+	}
 	/** Group live samples by node and reduce each group. Exposed for tests. */
 	buildInputs(now) {
 		const byNode = /* @__PURE__ */ new Map();
@@ -37060,6 +37628,7 @@ var NodeStressController = class NodeStressController {
 		const verdicts = evaluateNodeStress(this.memories, this.buildInputs(now), now, this.thresholds());
 		for (const v of verdicts) {
 			this.memories.set(v.nodeId, v.memory);
+			this.deps.lts?.noteSignals(v.nodeId, v.signals, now);
 			if (v.changed) this.logTransition(v);
 		}
 		this.maybeHeartbeat(mode, verdicts, now);
@@ -37118,11 +37687,12 @@ var NodeStressController = class NodeStressController {
 	async actOn(verdicts, now) {
 		if (this.moveInFlight) return;
 		if (!verdicts.some((v) => v.state === "saturated")) return;
-		this.history = this.history.filter((h) => now - h.at < NodeStressController.HISTORY_TTL_MS);
+		this.deps.moves.pruneOlderThan(now - NodeStressController.HISTORY_TTL_MS);
+		const history = this.deps.moves.entries().filter((h) => now - h.at < NodeStressController.HISTORY_TTL_MS);
 		const plan = planStressFailover({
 			verdicts,
 			candidates: await this.collectCandidates(now),
-			history: this.history,
+			history,
 			nodeCaps: await this.deps.settingsStore.buildNodeCaps(),
 			attachedByNode: this.attachedByNode()
 		}, now, this.guards());
@@ -37146,7 +37716,7 @@ var NodeStressController = class NodeStressController {
 			await this.deps.detach(plan.fromNodeId, plan.deviceId);
 			await this.deps.attach(plan.toNodeId, config);
 			this.deps.ledger.recordAssignment(plan.deviceId, plan.toNodeId, "rebalance", false);
-			this.history.push({
+			this.deps.moves.record({
 				deviceId: plan.deviceId,
 				fromNodeId: plan.fromNodeId,
 				at: now
@@ -37218,6 +37788,513 @@ var NodeStressController = class NodeStressController {
 	}
 };
 //#endregion
+//#region src/durable/lts-aggregator.ts
+/** Wall-clock bucket width. Five minutes, matching HA's statistics tier. */
+var LTS_BUCKET_MS = 5 * 6e4;
+/** How often the row cap is enforced. Rarely: it is a bound, not a deadline. */
+var CAP_SWEEP_INTERVAL_MS = 6 * 36e5;
+var LTS_COLUMNS = [
+	(
+	/** `<subject>|<series>|<scope>|<bucketStart>` — deterministic, so a bucket
+	*  flushed twice replaces itself rather than doubling. */
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	}),
+	(
+	/** The camera id, or the node id. One column, because every query is
+	*  "this thing over time" and the thing is one or the other. */
+	{
+		name: "subject",
+		type: "TEXT",
+		notNull: true
+	}),
+	(
+	/** Numeric mirror of `subject` for camera rows, so a per-camera question is
+	*  answered by an integer index — every log line and every query about a
+	*  device in this repo is keyed by the numeric id. `NULL` for node rows. */
+	{
+		name: "deviceId",
+		type: "INTEGER"
+	}),
+	{
+		name: "series",
+		type: "TEXT",
+		notNull: true
+	},
+	(
+	/** Sub-scope within a series: a zoneId for occupancy, `''` otherwise. */
+	{
+		name: "scope",
+		type: "TEXT",
+		notNull: true
+	}),
+	(
+	/** Bucket start, wall-clock aligned to {@link LTS_BUCKET_MS}. */
+	{
+		name: "bucketStart",
+		type: "INTEGER",
+		notNull: true
+	}),
+	{
+		name: "samples",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "sum",
+		type: "REAL",
+		notNull: true
+	},
+	{
+		name: "min",
+		type: "REAL",
+		notNull: true
+	},
+	{
+		name: "max",
+		type: "REAL",
+		notNull: true
+	}
+];
+var LTS_INDEXES = [{
+	name: "idx_lts_series_bucket",
+	columns: ["series", "bucketStart"]
+}, {
+	name: "idx_lts_device",
+	columns: ["deviceId"]
+}];
+function ltsBucketStart(at, bucketMs = LTS_BUCKET_MS) {
+	return Math.floor(at / bucketMs) * bucketMs;
+}
+var LtsAggregator = class {
+	open = /* @__PURE__ */ new Map();
+	/** Every (subject, series, scope) that has produced a row in this process —
+	*  the groups the cap sweep has any reason to look at. */
+	groups = /* @__PURE__ */ new Set();
+	lastCapSweepAt = 0;
+	collection;
+	store;
+	logger;
+	nowFn;
+	bucketMs;
+	maxRows;
+	constructor(deps) {
+		this.collection = deps.collection;
+		this.store = deps.store;
+		this.logger = deps.logger;
+		this.nowFn = deps.now ?? (() => Date.now());
+		this.bucketMs = deps.bucketMs ?? 3e5;
+		this.maxRows = deps.maxRowsPerSeries ?? 105120;
+	}
+	static declare(store, collection) {
+		return store.declareCollection.mutate({
+			collection,
+			columns: [...LTS_COLUMNS],
+			indexes: [...LTS_INDEXES]
+		});
+	}
+	/**
+	* Record one observation. Synchronous, allocation-free after the first
+	* sample of a bucket, and it cannot throw — it sits on paths that are
+	* already producing the value for another reason and must not learn a new
+	* failure mode.
+	*
+	* A non-finite value is DROPPED rather than folded in: one `NaN` would make
+	* `sum`, `min` and `max` all `NaN` for the whole bucket, turning a skewed
+	* row into a meaningless one.
+	*/
+	note(input) {
+		if (!Number.isFinite(input.value)) return;
+		const at = input.at ?? this.nowFn();
+		const scope = input.scope ?? "";
+		const bucketStart = ltsBucketStart(at, this.bucketMs);
+		const key = rowId(input.subject, input.series, scope, bucketStart);
+		const held = this.open.get(key);
+		if (held === void 0) {
+			this.open.set(key, {
+				subject: input.subject,
+				...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
+				series: input.series,
+				scope,
+				bucketStart,
+				samples: 1,
+				sum: input.value,
+				min: input.value,
+				max: input.value
+			});
+			return;
+		}
+		held.samples += 1;
+		held.sum += input.value;
+		if (input.value < held.min) held.min = input.value;
+		if (input.value > held.max) held.max = input.value;
+	}
+	/** Buckets currently accumulating — diagnostics, and what a flush would write. */
+	openBuckets() {
+		return [...this.open.values()].map(toRow);
+	}
+	/**
+	* Write every bucket that has CLOSED (its window ended at or before `now`)
+	* and drop it from RAM. Returns the number of rows written.
+	*
+	* The current bucket is deliberately left alone: writing it early would mean
+	* rewriting it on the next tick, which turns one row into up to sixty and
+	* offers every one of them to the checkpoint lottery (D96).
+	*/
+	async flushDue(now = this.nowFn()) {
+		const currentBucket = ltsBucketStart(now, this.bucketMs);
+		const due = [...this.open.values()].filter((b) => b.bucketStart < currentBucket);
+		if (due.length === 0) {
+			await this.maybeSweepCap(now);
+			return 0;
+		}
+		let written = 0;
+		for (const bucket of due) {
+			const key = rowId(bucket.subject, bucket.series, bucket.scope, bucket.bucketStart);
+			try {
+				await this.store.set.mutate({
+					collection: this.collection,
+					key,
+					value: {
+						subject: bucket.subject,
+						...bucket.deviceId !== void 0 ? { deviceId: bucket.deviceId } : {},
+						series: bucket.series,
+						scope: bucket.scope,
+						bucketStart: bucket.bucketStart,
+						samples: bucket.samples,
+						sum: bucket.sum,
+						min: bucket.min,
+						max: bucket.max
+					}
+				});
+				written += 1;
+				this.groups.add(groupKey(bucket.subject, bucket.series, bucket.scope));
+			} catch (err) {
+				this.logger.warn("lts bucket write failed — this interval will be missing", {
+					...bucket.deviceId !== void 0 ? { tags: { deviceId: bucket.deviceId } } : {},
+					meta: {
+						collection: this.collection,
+						series: bucket.series,
+						subject: bucket.subject,
+						bucketStart: bucket.bucketStart,
+						error: String(err)
+					}
+				});
+			}
+			this.open.delete(key);
+		}
+		await this.maybeSweepCap(now);
+		return written;
+	}
+	/** Read closed buckets back. The read surface every chart will use. */
+	async read(query = {}) {
+		const where = {};
+		if (query.series !== void 0) where["series"] = query.series;
+		if (query.subject !== void 0) where["subject"] = query.subject;
+		if (query.scope !== void 0) where["scope"] = query.scope;
+		const records = await this.store.query.query({
+			collection: this.collection,
+			filter: {
+				...Object.keys(where).length > 0 ? { where } : {},
+				...query.from !== void 0 || query.to !== void 0 ? { whereBetween: { bucketStart: [query.from ?? 0, query.to ?? Number.MAX_SAFE_INTEGER] } } : {},
+				orderBy: {
+					field: "bucketStart",
+					direction: "asc"
+				},
+				limit: query.limit ?? 5e3
+			}
+		});
+		const rows = [];
+		for (const record of records) {
+			const row = recordToRow(record.data);
+			if (row !== null) rows.push(row);
+		}
+		return rows;
+	}
+	/**
+	* Enforce the per-(subject, series, scope) row cap, at most once every six
+	* hours. Only groups this process has written to are examined: a group with
+	* no new rows cannot have crossed a cap it was under.
+	*/
+	async maybeSweepCap(now) {
+		if (now - this.lastCapSweepAt < CAP_SWEEP_INTERVAL_MS) return;
+		this.lastCapSweepAt = now;
+		for (const group of this.groups) {
+			const [subject, series, scope] = group.split("\0");
+			if (subject === void 0 || series === void 0 || scope === void 0) continue;
+			const where = {
+				subject,
+				series,
+				scope
+			};
+			try {
+				const excess = await this.store.count.query({
+					collection: this.collection,
+					filter: { where }
+				}) - this.maxRows;
+				if (excess <= 0) continue;
+				const cutoff = (await this.store.query.query({
+					collection: this.collection,
+					filter: {
+						where,
+						orderBy: {
+							field: "bucketStart",
+							direction: "asc"
+						},
+						limit: excess
+					}
+				})).at(-1)?.data["bucketStart"];
+				if (typeof cutoff !== "number") continue;
+				const { deleted } = await this.store.deleteWhere.mutate({
+					collection: this.collection,
+					filter: {
+						where,
+						whereBetween: { bucketStart: [0, cutoff] }
+					}
+				});
+				this.logger.info("lts row cap enforced", { meta: {
+					collection: this.collection,
+					series,
+					subject,
+					deleted,
+					cap: this.maxRows
+				} });
+			} catch (err) {
+				this.logger.warn("lts row cap sweep failed — the series keeps growing this cycle", { meta: {
+					collection: this.collection,
+					series,
+					subject,
+					error: String(err)
+				} });
+			}
+		}
+	}
+};
+function groupKey(subject, series, scope) {
+	return `${subject}${series}${scope}`;
+}
+function rowId(subject, series, scope, bucketStart) {
+	return `${subject}|${series}|${scope}|${bucketStart}`;
+}
+function toRow(bucket) {
+	return {
+		subject: bucket.subject,
+		...bucket.deviceId !== void 0 ? { deviceId: bucket.deviceId } : {},
+		series: bucket.series,
+		scope: bucket.scope,
+		bucketStart: bucket.bucketStart,
+		samples: bucket.samples,
+		sum: bucket.sum,
+		min: bucket.min,
+		max: bucket.max
+	};
+}
+/** Structural validation on read. A malformed row is skipped, never charted. */
+function recordToRow(data) {
+	const subject = data["subject"];
+	const series = data["series"];
+	const scope = data["scope"];
+	if (typeof subject !== "string" || typeof series !== "string") return null;
+	const bucketStart = Number(data["bucketStart"]);
+	const samples = Number(data["samples"]);
+	const sum = Number(data["sum"]);
+	const min = Number(data["min"]);
+	const max = Number(data["max"]);
+	if (![
+		bucketStart,
+		samples,
+		sum,
+		min,
+		max
+	].every((n) => Number.isFinite(n))) return null;
+	const rawDeviceId = data["deviceId"];
+	const deviceId = typeof rawDeviceId === "number" && Number.isFinite(rawDeviceId) ? rawDeviceId : void 0;
+	return {
+		subject,
+		...deviceId !== void 0 ? { deviceId } : {},
+		series,
+		scope: typeof scope === "string" ? scope : "",
+		bucketStart,
+		samples,
+		sum,
+		min,
+		max
+	};
+}
+//#endregion
+//#region src/node-stress-lts.ts
+/**
+* @durable class=ledger owner=pipeline-orchestrator
+*   write="one row per (node, series, 5-min bucket), written ONCE when the bucket closes; a node reporting no samples writes nothing"
+*   retention="row CAP per (subject, series, scope) — 105,120 rows ≈ one year of 5-minute buckets. Not an age sweep: an LTS row summarises an interval and has no owner to be orphaned from."
+*/
+var NODE_STRESS_LTS_COLLECTION = "pipeline-orchestrator:stats-5m";
+var NodeStressLts = class {
+	lts;
+	constructor(deps) {
+		this.lts = new LtsAggregator({
+			collection: NODE_STRESS_LTS_COLLECTION,
+			store: deps.store,
+			logger: deps.logger,
+			...deps.now !== void 0 ? { now: deps.now } : {}
+		});
+	}
+	static declare(store) {
+		return LtsAggregator.declare(store, NODE_STRESS_LTS_COLLECTION);
+	}
+	/** Fold one sweep's verdict for one node into the open buckets. */
+	noteSignals(nodeId, signals, at) {
+		this.lts.note({
+			subject: nodeId,
+			series: "node-score",
+			value: signals.score,
+			at
+		});
+		this.lts.note({
+			subject: nodeId,
+			series: "node-queue-pressure",
+			value: signals.queuePressure,
+			at
+		});
+		this.lts.note({
+			subject: nodeId,
+			series: "node-drop-ratio",
+			value: signals.dropRatio,
+			at
+		});
+		this.lts.note({
+			subject: nodeId,
+			series: "node-fps-deficit",
+			value: signals.fpsDeficit,
+			at
+		});
+	}
+	flushDue(now) {
+		return this.lts.flushDue(now);
+	}
+	read(query) {
+		return this.lts.read(query);
+	}
+	openBuckets() {
+		return this.lts.openBuckets();
+	}
+};
+//#endregion
+//#region src/node-stress-move-ledger.ts
+/**
+* @durable class=ledger owner=pipeline-orchestrator
+*   write="one row per APPLIED failover move (never per attempt); write-behind"
+*   retention="pruned by the sweep once older than the longest guard window (2 h) — a move no guard can read is growth with no reader"
+*/
+var NODE_STRESS_MOVES_COLLECTION = "pipeline-orchestrator:node-stress-moves";
+var NODE_STRESS_MOVES_COLUMNS = [
+	(
+	/** `<deviceId>:<at>` — one camera can be moved more than once, and each move
+	*  spends its own slice of the budget. */
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	}),
+	(
+	/** Indexed: every question about a move is asked per-camera. */
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	}),
+	(
+	/** The node the camera LEFT — the return ban is about coming back here. */
+	{
+		name: "fromNodeId",
+		type: "TEXT",
+		notNull: true
+	}),
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var NODE_STRESS_MOVES_INDEXES = [{
+	name: "idx_node_stress_moves_device",
+	columns: ["deviceId"]
+}];
+function moveId(entry) {
+	return `${entry.deviceId}:${entry.at}`;
+}
+var NODE_STRESS_MOVES_SPEC = {
+	collection: NODE_STRESS_MOVES_COLLECTION,
+	columns: NODE_STRESS_MOVES_COLUMNS,
+	indexes: NODE_STRESS_MOVES_INDEXES,
+	writeMode: "write-behind",
+	keyOf: (row) => row.id,
+	toValue: (row) => ({
+		deviceId: row.deviceId,
+		fromNodeId: row.fromNodeId,
+		at: row.at
+	}),
+	fromRecord: (id, data) => {
+		const deviceId = Number(data["deviceId"]);
+		const at = Number(data["at"]);
+		const fromNodeId = data["fromNodeId"];
+		if (!Number.isFinite(deviceId) || !Number.isFinite(at)) return null;
+		if (typeof fromNodeId !== "string" || fromNodeId.length === 0) return null;
+		return {
+			id,
+			deviceId,
+			fromNodeId,
+			at
+		};
+	},
+	deviceIdOf: (row) => row.deviceId,
+	loadLimit: 1e4
+};
+var NodeStressMoveLedger = class {
+	ledger;
+	constructor(deps) {
+		this.ledger = new DurableLedger({
+			spec: NODE_STRESS_MOVES_SPEC,
+			store: deps.store,
+			logger: deps.logger
+		});
+	}
+	static declare(store) {
+		return DurableLedger.declare(store, NODE_STRESS_MOVES_SPEC);
+	}
+	/** Boot reseed. Returns the row count so the caller can say out loud how much
+	*  budget it recovered — "moves recovered: 0" after a restart is the line that
+	*  explains a burst of relocations. */
+	async load() {
+		return (await this.ledger.load()).length;
+	}
+	/** The history the guards read. Pure RAM — a guard must never wait on I/O. */
+	entries() {
+		return this.ledger.snapshot().map(({ deviceId, fromNodeId, at }) => ({
+			deviceId,
+			fromNodeId,
+			at
+		}));
+	}
+	/** Record one APPLIED move. Mirror first; the durable write follows and its
+	*  failure is logged, never thrown at a relocation that already happened. */
+	record(entry) {
+		this.ledger.put({
+			...entry,
+			id: moveId(entry)
+		});
+	}
+	/** Drop moves older than `cutoff` — no guard can read them. Returns the count. */
+	pruneOlderThan(cutoff) {
+		const keep = new Set(this.ledger.snapshot().filter((row) => row.at >= cutoff).map((row) => row.id));
+		return this.ledger.pruneExcept(keep);
+	}
+};
+//#endregion
 //#region src/dispatch-reconcile.ts
 function runnerAttachmentKey(nodeId, deviceId) {
 	return `${nodeId}:${deviceId}`;
@@ -42354,8 +43431,18 @@ async function buildOrchestratorControllers(deps) {
 		readGlobalSettings: () => globalSettings,
 		getInitTimestamp: () => deps.initTimestamp
 	});
+	const nodeStressMoves = new NodeStressMoveLedger({
+		store: deps.ctx().api.settingsStore,
+		logger: deps.ctx().logger.child("node-stress")
+	});
+	const nodeStressLts = new NodeStressLts({
+		store: deps.ctx().api.settingsStore,
+		logger: deps.ctx().logger.child("node-stress-lts")
+	});
 	const nodeStress = new NodeStressController({
 		ledger,
+		moves: nodeStressMoves,
+		lts: nodeStressLts,
 		topology,
 		settingsStore,
 		logger: deps.ctx().logger,
@@ -42364,6 +43451,17 @@ async function buildOrchestratorControllers(deps) {
 		readPipelinePin: (deviceId) => deps.readPipelinePin(deviceId),
 		readGlobalSettings: () => globalSettings
 	});
+	await NodeStressMoveLedger.declare(deps.ctx().api.settingsStore).then(() => nodeStress.hydrate()).catch((err) => {
+		deps.ctx().logger.warn("node-stress move history unavailable — this boot starts cold", { meta: { error: errMsg(err) } });
+	});
+	await NodeStressLts.declare(deps.ctx().api.settingsStore).catch((err) => {
+		deps.ctx().logger.warn("node-stress statistics unavailable — no baseline this boot", { meta: { error: errMsg(err) } });
+	});
+	const nodeStressLtsTimer = setInterval(() => {
+		nodeStressLts.flushDue().catch((err) => {
+			deps.ctx().logger.warn("node-stress statistics flush failed", { meta: { error: errMsg(err) } });
+		});
+	}, 6e4);
 	nodeStress.start();
 	const inferenceRotation = new RoundRobinInferenceDeviceRotation();
 	/**
@@ -42707,6 +43805,7 @@ async function buildOrchestratorControllers(deps) {
 	reconcile.scheduleReconcile();
 	const detectionWiring = new DetectionWiringController({
 		ctx: () => deps.ctx(),
+		featuresStore: deps.ctx().api.settingsStore,
 		ledger,
 		placement,
 		audio,
@@ -42731,10 +43830,15 @@ async function buildOrchestratorControllers(deps) {
 		deviceHasOnboardMotionCap: (deviceId) => deps.deviceHasOnboardMotionCap(deviceId),
 		deviceSettingsSchema: () => deps.deviceSettingsSchema()
 	});
+	await detectionWiring.hydrateFeaturesMirror().catch((err) => {
+		deps.ctx().logger.warn("device-features mirror not restored — this boot starts cold", { meta: { error: errMsg(err) } });
+	});
 	return {
 		ledger,
 		topology,
 		loadService,
+		nodeStressLts,
+		nodeStressLtsTimer,
 		audio,
 		settingsStore,
 		loadShed,
@@ -43287,6 +44391,18 @@ function deriveRuntimeSettings(config) {
 }
 //#endregion
 //#region src/index.ts
+/**
+* The FULL action catalog, under the name the HUB HARVESTS.
+*
+* The hub's forked-addon harvest imports this entry module and reads the
+* `customActions` NAMED export (`loadForkedCustomActionCatalog`) — returning a
+* catalog from `onInitialize` is not enough. Without this line the bridge
+* answers *"no addon 'pipeline-orchestrator' registers custom actions"* for
+* every action here, which is what `dumpState` had been doing, silently, since
+* it was written: an admin diagnostic that 404s is worse than no diagnostic,
+* because nobody discovers it is missing until they need it.
+*/
+var customActions = pipelineOrchestratorActions;
 var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddon {
 	/** This node's Moleculer nodeId (from this.ctx.kernel.localNodeId). */
 	localNodeId = "hub";
@@ -43504,6 +44620,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	pendingRetryTimer = null;
 	/** Periodic auto-rebalance sweep timer (drift correction under hysteresis). */
 	autoRebalanceTimer = null;
+	/** Node-stress five-minute statistics + its flush timer (see
+	*  `node-stress-lts.ts`). `observe` mode's first durable output. */
+	nodeStressLts = null;
+	nodeStressLtsTimer = null;
 	initTimestamp = 0;
 	/** Storage migration maintenance lease. It only gates dispatch; it does not
 	* change any camera wrapper or persistent pipeline configuration. */
@@ -43597,6 +44717,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.unsubOrchestratorSubscriptions = controllers.unsubOrchestratorSubscriptions;
 		this.pendingRetryTimer = controllers.pendingRetryTimer;
 		this.autoRebalanceTimer = controllers.autoRebalanceTimer;
+		this.nodeStressLts = controllers.nodeStressLts;
+		this.nodeStressLtsTimer = controllers.nodeStressLtsTimer;
 		return {
 			providers: [
 				{
@@ -43625,7 +44747,23 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				}
 			],
 			customActions: pipelineOrchestratorActions,
-			actionHandlers: { dumpState: async () => this.dumpDiagnostics() }
+			actionHandlers: {
+				dumpState: async () => this.dumpDiagnostics(),
+				nodeStressStats: async (input) => {
+					const lts = this.nodeStressLts;
+					const moves = this.nodeStress?.historyView() ?? [];
+					if (!lts) return {
+						rows: [],
+						open: [],
+						moves: [...moves]
+					};
+					return {
+						rows: (await lts.read(input)).map(withStatsMean),
+						open: lts.openBuckets().map(withStatsMean),
+						moves: [...moves]
+					};
+				}
+			}
 		};
 	}
 	/**
@@ -43660,6 +44798,11 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			clearInterval(this.autoRebalanceTimer);
 			this.autoRebalanceTimer = null;
 		}
+		if (this.nodeStressLtsTimer !== null) {
+			clearInterval(this.nodeStressLtsTimer);
+			this.nodeStressLtsTimer = null;
+		}
+		this.nodeStressLts = null;
 		this.unsubOrchestratorSubscriptions?.();
 		this.unsubOrchestratorSubscriptions = null;
 		this.reconcile?.dispose();
@@ -44613,8 +45756,16 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		return this.isSessionCamera(deviceId) && !this.session.hasActiveSession(deviceId);
 	}
 };
+/** The derived mean for one statistics row — see `node-stress-lts.ts`. */
+function withStatsMean(row) {
+	return {
+		...row,
+		mean: row.samples > 0 ? row.sum / row.samples : 0
+	};
+}
 //#endregion
 exports.balance = balance;
 exports.computeCapacityScore = computeCapacityScore;
+exports.customActions = customActions;
 exports.default = PipelineOrchestratorAddon;
 exports.pipelineOrchestratorActions = pipelineOrchestratorActions;