@camstack/addon-provider-reolink 1.2.57 → 1.2.59

package/dist/addon.js

@@ -26,7 +26,7 @@ let fs_promises = require("fs/promises");
 fs_promises = require_chunk.__toESM(fs_promises, 1);
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
-//#region ../types/dist/event-category-CIa_iT6b.mjs
+//#region ../types/dist/event-category-BZL-fdNj.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -463,7 +463,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["MetricsNodeResourcesSnapshot"] = "metrics.node-resources-snapshot";
 	/**
 	* Periodic per-node process-tree snapshot (camstack-related pids
-	* with ghost / managed / root classification). Emitted ~0.2 Hz by
+	* with root / managed / system classification). Emitted ~0.2 Hz by
 	* the metrics-provider addon. Drives the Cluster → Processes tab
 	* without polling `metricsProvider.listNodeProcesses`.
 	*/
@@ -11705,6 +11705,19 @@ var SettingsRecordSchema = object({
 	data: record(string(), unknown())
 });
 /**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = object({
+	id: string().optional(),
+	data: record(string(), unknown())
+});
+/**
 * Column declaration for a structured (SQL-backed) collection.
 *
 * Logical types — the backend translates each to the matching SQLite
@@ -11761,6 +11774,10 @@ method(object({
 	collection: string(),
 	record: SettingsRecordSchema
 }), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), { kind: "mutation" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
@@ -11869,6 +11886,13 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	namespace: string().optional(),
 	collection: string(),
@@ -13820,6 +13844,68 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 	limit: number().optional(),
 	tags: record(string(), string()).optional()
 }), array(LogEntrySchema).readonly());
+var LoadContributionSchema = object({
+	role: _enum([
+		"decode",
+		"transcode",
+		"recording",
+		"streaming",
+		"detection"
+	]),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
+	* camera (a shared pool), NOT that the contributor forgot to look it up: a
+	* contributor that cannot name its camera must not emit the entry at all,
+	* because an unnamed per-camera entry is indistinguishable from a shared one
+	* and would quietly turn one camera's cost into everybody's.
+	*/
+	deviceId: number().int().positive().nullable(),
+	attribution: _enum([
+		"measured",
+		"accounted",
+		"unattributable"
+	]),
+	/**
+	* What ONE entry is, in the contributor's own words — `615/high`,
+	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+	* family and inventing a common one would lose the only information that
+	* makes two entries for the same camera distinguishable.
+	*/
+	unit: string(),
+	/**
+	* The OS process this cost lives in, when there is one. Present so a
+	* consumer can (a) tell two generations of the same unit apart across a
+	* restart, and (b) subtract claimed processes from the node's process
+	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
+	* process of its own.
+	*/
+	pid: number().int().positive().optional(),
+	/**
+	* When this generation started. The pid's incarnation marker: a consumer
+	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+	* window when this changes, because the counter restarted from zero in a new
+	* process.
+	*/
+	startedAtMs: number().optional(),
+	/**
+	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
+	* system, read from the child's own `/proc/<pid>/stat` at the moment the
+	* contribution is asked for.
+	*
+	* Cumulative and not a rate on purpose: a rate needs a window, a window
+	* needs a sampler, and a new per-node sampler is the defect half of
+	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
+	* by whoever already keeps a history; a rate cannot be un-averaged.
+	*
+	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
+	* an entry with no process.
+	*/
+	cpuSeconds: number().optional(),
+	/** Resident bytes of this unit's process, same source and same rules. */
+	rssBytes: number().optional()
+});
+method(_void(), array(LoadContributionSchema).readonly());
 /**
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
@@ -14023,8 +14109,7 @@ var NodeProcessSchema = object({
 	classification: _enum([
 		"root",
 		"managed",
-		"system",
-		"ghost"
+		"system"
 	]),
 	/** `$process` addon binding when `managed`, else null. */
 	addonId: string().nullable(),
@@ -14032,22 +14117,39 @@ var NodeProcessSchema = object({
 	nodeId: string().nullable(),
 	/** Truncated command line. */
 	command: string(),
+	/**
+	* `ps pcpu` — CPU averaged over the process's WHOLE LIFETIME, not a rate.
+	* On a runner up for days it barely moves. Fine as a column, useless as a
+	* series: use `cpuMainPercent + cpuGcPercent` for anything time-varying.
+	*/
 	cpuPercent: number(),
 	memoryRssBytes: number(),
+	/**
+	* Instantaneous CPU% of the process's own threads over the last
+	* process-snapshot window, from a `/proc/<pid>/task/*` tick delta.
+	*
+	* `null` = UNKNOWN, never zero: no previous sample yet (first tick after
+	* boot), the pid was recycled, or this node is not Linux.
+	*/
+	cpuMainPercent: number().nullable(),
+	/**
+	* Instantaneous CPU% of V8's `V8Worker` platform pool over the same window.
+	*
+	* This is the number that rewrote the 2026-08-27 diagnosis — hub-main 73%,
+	* `stream-broker` 61% (`docs/architecture/load-ledger.md`). A CPU chart that
+	* does not separate it from `cpuMainPercent` shows "busy" where the truth is
+	* "allocating too much".
+	*
+	* Concurrent GC is the dominant tenant of that pool but not the only one
+	* (background compilation runs there too), so it is reported as
+	* "GC / V8 helpers" rather than as pure collection time. `null` has the same
+	* meaning as on `cpuMainPercent`.
+	*/
+	cpuGcPercent: number().nullable(),
+	/** Threads seen in the tick scan. `null` under the same conditions. */
+	threadCount: number().nullable(),
 	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-	uptimeSec: number(),
-	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-	orphaned: boolean()
-});
-var KillProcessInputSchema = object({
-	pid: number(),
-	/** Force = SIGKILL. Default is SIGTERM. */
-	force: boolean().optional()
-});
-var KillProcessResultSchema = object({
-	success: boolean(),
-	reason: string().optional(),
-	signal: _enum(["SIGTERM", "SIGKILL"]).optional()
+	uptimeSec: number()
 });
 var DumpHeapSnapshotInputSchema = object({ 
 /** The addon whose runner should dump a heap snapshot. */
@@ -14060,6 +14162,104 @@ var DumpHeapSnapshotResultSchema = object({
 	pid: number().optional(),
 	reason: string().optional()
 });
+/**
+* One point of one function's series.
+*
+* The unsuffixed fields are the bucket's **MAXIMUM**, and that choice is the
+* point of the whole surface. The two obvious reductions both lie: a mean per
+* bucket smears a spike away, and taking every Nth sample skips it outright.
+* Either would give us a tool built to find peaks that does not show peaks.
+* `...Min` carries the other end, `samples` says how many raw snapshots folded
+* into the bucket, and a mean stays derivable where it is wanted.
+*
+* An UNREDUCED point is a one-sample bucket: `samples === 1` and each `...Min`
+* equals its unsuffixed twin. Reduced and unreduced are the same shape, so a
+* caller cannot tell which it received — which is what "one reader" means.
+*/
+var LoadPointSchema = object({
+	/** Bucket START, or the snapshot's own timestamp when unreduced. */
+	atMs: number(),
+	/** Raw snapshots in this bucket. Never 0 — AN EMPTY BUCKET IS ABSENT. */
+	samples: number().int(),
+	/**
+	* `null` = UNKNOWN and it PROPAGATES: a bucket is null unless every process
+	* of every snapshot in it reported a thread split. A partial sum is a
+	* smaller number that looks exactly as real as a complete one.
+	*/
+	cpuMainPercent: number().nullable(),
+	cpuMainPercentMin: number().nullable(),
+	cpuGcPercent: number().nullable(),
+	cpuGcPercentMin: number().nullable(),
+	/** Lifetime-average CPU%, summed. Always known — and never a rate. */
+	cpuLifetimePercent: number(),
+	cpuLifetimePercentMin: number(),
+	memoryRssBytes: number(),
+	memoryRssBytesMin: number(),
+	processCount: number().int(),
+	processCountMin: number().int()
+});
+/** One function's series. `key` is an addonId, `__root__` or `__unattributed__`. */
+var LoadFunctionSeriesSchema = object({
+	key: string(),
+	kind: _enum([
+		"addon",
+		"root",
+		"unattributed"
+	]),
+	/** Oldest-first. A missing interval is MISSING — never zero-filled. */
+	points: array(LoadPointSchema).readonly()
+});
+var NodeLoadSeriesSchema = object({
+	nodeId: string(),
+	/** One entry per function seen in the window, heaviest-first. */
+	series: array(LoadFunctionSeriesSchema).readonly(),
+	/**
+	* Width of one returned bucket, in ms. Equals the sampling cadence when no
+	* reduction was needed — so a caller can always say what one point covers
+	* without having to know whether it was reduced.
+	*/
+	bucketMs: number(),
+	/** Raw snapshots that went into this answer, across both tiers. */
+	retainedSamples: number(),
+	/** Oldest snapshot represented, or `null` when nothing is retained. */
+	oldestAtMs: number().nullable(),
+	/** The fixed sampling cadence in force on the cluster, in ms. */
+	cadenceMs: number(),
+	/**
+	* Did the DURABLE tier contribute? `false` means the answer is the hot ring
+	* alone — an agent (which holds no table), or a store that refused.
+	* Reported because "the last hour" and "the last six hours" are different
+	* questions and an operator must not have to guess which was answered.
+	*/
+	durable: boolean()
+});
+var GetLoadSeriesInputSchema = object({
+	/**
+	* The node whose series is wanted.
+	*
+	* NOT named `nodeId`: the generated cap router strips a top-level
+	* `nodeId` from every method input and uses it to ROUTE the call to
+	* that node's provider (`generated-cap-routers.ts`). A series target
+	* called `nodeId` would silently become a routing pin and never reach
+	* the provider. The hub holds every node it hears from, so the
+	* ordinary call is unpinned — answered by the hub, for any node.
+	*/
+	forNodeId: string(),
+	/**
+	* EXCLUSIVE lower bound. A caller passes the newest `atMs` it already
+	* holds and receives only what it is missing, so seeding a live chart
+	* from this method cannot double a point already drawn.
+	*/
+	sinceMs: number().optional(),
+	/**
+	* Most points the caller wants PER FUNCTION. The window is reduced to fit,
+	* preserving min and max per bucket.
+	*
+	* Absent means NO reduction — legitimate for a short window and a trap for a
+	* long one, which is why a chart passes its own pixel width.
+	*/
+	maxPoints: number().int().positive().optional()
+});
 var SystemMetricsSchema = object({
 	cpuPercent: number(),
 	memoryPercent: number(),
@@ -14070,10 +14270,7 @@ var SystemMetricsSchema = object({
 	gpuPercent: number().optional(),
 	gpuMemoryPercent: number().optional()
 });
-method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(KillProcessInputSchema, KillProcessResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
+method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema), method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -29792,6 +29989,15 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
+/**
+* One contribution, plus WHO reported it.
+*
+* The addon and node are added by the hub as it enumerates providers, never by
+* the contributor: an addon reporting its own identity could report somebody
+* else's, and the whole point of this surface is that no claim is made by
+* anyone but its owner.
+*/
+var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: string() });
 var GetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
 	/**
@@ -29850,7 +30056,7 @@ method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), met
 }), method(_void(), SiteLocationStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+}), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(_void(), array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -33041,6 +33247,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.insertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.isEmpty": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -34355,6 +34567,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loadContribution.list": {
+		capName: "load-contribution",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
@@ -34655,17 +34873,17 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.getProcessStats": {
+	"metricsProvider.getLoadSeries": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.killProcess": {
+	"metricsProvider.getProcessStats": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
 	"metricsProvider.listAddonInstances": {
 		capName: "metrics-provider",
@@ -36677,6 +36895,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.insertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.isEmpty": {
 		capName: "settings-store",
 		capScope: "system",
@@ -37289,6 +37513,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoadContributions": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getLoggingSettings": {
 		capName: "system",
 		capScope: "system",
@@ -235991,10 +236221,12 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* descriptors served by the `stream-catalog` cap (broker PULLS via
 	* `registerStreamCatalogProvider`).
 	*
-	* Returns `[]` (logging at debug, matching the prior early-returns) on
-	* the battery-sleep gate, `ensureApi` failure, or
-	* `buildVideoStreamOptions` failure — the broker simply sees no
-	* descriptors for the device until the next reconcile.
+	* Returns `[]` only when there is genuinely nothing to say: the
+	* battery-sleep gate (logged at debug), or a camera that connected and
+	* reported zero streams. An `ensureApi` / `buildVideoStreamOptions` failure
+	* THROWS — `[]` and an error are not the same fact, and the broker needs
+	* the difference to keep the device's existing entry and to schedule its
+	* per-device backoff instead of treating the camera as stream-less.
 	*
 	* This method only BUILDS descriptors — it never opens an upstream
 	* session or touches the broker.
@@ -236122,10 +236354,22 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			channel: ownChannel,
 			onNvr: true
 		} : void 0;
+		const readStreamOptions = async (current) => withTimeout(buildOptions ? current.buildVideoStreamOptions(buildOptions) : current.buildVideoStreamOptions(), 1e4, "buildVideoStreamOptions");
 		try {
-			streamOptions = await withTimeout(buildOptions ? api.buildVideoStreamOptions(buildOptions) : api.buildVideoStreamOptions(), 1e4, "buildVideoStreamOptions");
+			streamOptions = await readStreamOptions(api);
 		} catch (err) {
-			throw new Error(`buildStreamCatalog: buildVideoStreamOptions failed for device ${this.id}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			if (isChild) throw new Error(`buildStreamCatalog: buildVideoStreamOptions failed for device ${this.id}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			this.ctx.logger.warn("buildStreamCatalog: stream options read failed — dropping the Baichuan session and retrying once", {
+				tags: { deviceId: this.id },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			await this.dropBaichuanSession("stream-catalog-retry");
+			try {
+				streamOptions = await readStreamOptions(await withTimeout(this.ensureApi(), 1e4, "ensureApi"));
+			} catch (retryErr) {
+				throw new Error(`buildStreamCatalog: buildVideoStreamOptions failed for device ${this.id} (after one re-auth retry): ${retryErr instanceof Error ? retryErr.message : String(retryErr)}`, { cause: retryErr });
+			}
+			this.ctx.logger.info("buildStreamCatalog: stream options read recovered after re-auth", { tags: { deviceId: this.id } });
 		}
 		const channelCount = this.channelCount();
 		const desired = /* @__PURE__ */ new Map();
@@ -239007,6 +239251,30 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* `awake` push (or a snapshot demand from the operator) will
 	* lazily call `ensureApi()` and re-establish the client.
 	*/
+	/**
+	* Close and forget the cached control-channel client so the NEXT
+	* `ensureApi()` performs a fresh login.
+	*
+	* The one thing `scheduleReconnect` cannot express: an EXPIRED session on a
+	* socket that is still open. No `close`/`error` ever fires, so the reconnect
+	* ladder is never armed, and `ensureApi`'s `if (this.api) return this.api`
+	* keeps handing back a client whose every request answers `responseCode
+	* 400`. Callers that see an application-level rejection they believe is a
+	* dead session call this and retry ONCE — they must never loop on it.
+	*
+	* Same teardown the `disconnectAll` / debug-options paths use: `close()`
+	* best-effort, then null the field. Active RFC 4571 servers are untouched —
+	* each owns a dedicated socket and survives a control-channel reset (see
+	* `scheduleReconnect`).
+	*/
+	async dropBaichuanSession(reason) {
+		const current = this.api;
+		this.api = null;
+		if (!current) return;
+		try {
+			await current.close({ reason });
+		} catch {}
+	}
 	scheduleReconnect(reason) {
 		if (this.reconnectTimer) return;
 		if (this.isBattery) {

package/dist/addon.mjs

@@ -21,7 +21,7 @@ import netImpl from "net";
 import { fileURLToPath } from "url";
 import { mkdir } from "fs/promises";
 import os from "node:os";
-//#region ../types/dist/event-category-CIa_iT6b.mjs
+//#region ../types/dist/event-category-BZL-fdNj.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -458,7 +458,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["MetricsNodeResourcesSnapshot"] = "metrics.node-resources-snapshot";
 	/**
 	* Periodic per-node process-tree snapshot (camstack-related pids
-	* with ghost / managed / root classification). Emitted ~0.2 Hz by
+	* with root / managed / system classification). Emitted ~0.2 Hz by
 	* the metrics-provider addon. Drives the Cluster → Processes tab
 	* without polling `metricsProvider.listNodeProcesses`.
 	*/
@@ -11700,6 +11700,19 @@ var SettingsRecordSchema = object({
 	data: record(string(), unknown())
 });
 /**
+* One record of a BULK insert — {@link SettingsRecordSchema} with the id made
+* optional.
+*
+* A separate schema rather than loosening the shared one: every other method
+* on this cap addresses a row BY its id, and making that field optional
+* everywhere would turn a forgotten key into a silently generated one on
+* `update` and `delete` as well.
+*/
+var BulkRecordSchema = object({
+	id: string().optional(),
+	data: record(string(), unknown())
+});
+/**
 * Column declaration for a structured (SQL-backed) collection.
 *
 * Logical types — the backend translates each to the matching SQLite
@@ -11756,6 +11769,10 @@ method(object({
 	collection: string(),
 	record: SettingsRecordSchema
 }), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), { kind: "mutation" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
@@ -11864,6 +11881,13 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	records: array(BulkRecordSchema).readonly()
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	namespace: string().optional(),
 	collection: string(),
@@ -13815,6 +13839,68 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 	limit: number().optional(),
 	tags: record(string(), string()).optional()
 }), array(LogEntrySchema).readonly());
+var LoadContributionSchema = object({
+	role: _enum([
+		"decode",
+		"transcode",
+		"recording",
+		"streaming",
+		"detection"
+	]),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. `null` means this cost genuinely belongs to no single
+	* camera (a shared pool), NOT that the contributor forgot to look it up: a
+	* contributor that cannot name its camera must not emit the entry at all,
+	* because an unnamed per-camera entry is indistinguishable from a shared one
+	* and would quietly turn one camera's cost into everybody's.
+	*/
+	deviceId: number().int().positive().nullable(),
+	attribution: _enum([
+		"measured",
+		"accounted",
+		"unattributable"
+	]),
+	/**
+	* What ONE entry is, in the contributor's own words — `615/high`,
+	* `617/native`, `cuda:0 shared pool`. Free text because the unit differs per
+	* family and inventing a common one would lose the only information that
+	* makes two entries for the same camera distinguishable.
+	*/
+	unit: string(),
+	/**
+	* The OS process this cost lives in, when there is one. Present so a
+	* consumer can (a) tell two generations of the same unit apart across a
+	* restart, and (b) subtract claimed processes from the node's process
+	* snapshot to see what NOBODY claimed. Absent for an entry that owns no
+	* process of its own.
+	*/
+	pid: number().int().positive().optional(),
+	/**
+	* When this generation started. The pid's incarnation marker: a consumer
+	* differencing {@link LoadContributionSchema.shape.cpuSeconds} must drop the
+	* window when this changes, because the counter restarted from zero in a new
+	* process.
+	*/
+	startedAtMs: number().optional(),
+	/**
+	* CUMULATIVE CPU seconds this unit has consumed since it started — user +
+	* system, read from the child's own `/proc/<pid>/stat` at the moment the
+	* contribution is asked for.
+	*
+	* Cumulative and not a rate on purpose: a rate needs a window, a window
+	* needs a sampler, and a new per-node sampler is the defect half of
+	* `docs/architecture/load-ledger.md` documents. A counter can be differenced
+	* by whoever already keeps a history; a rate cannot be un-averaged.
+	*
+	* Absent — never zero — on a node with no `/proc`, on a read failure, and on
+	* an entry with no process.
+	*/
+	cpuSeconds: number().optional(),
+	/** Resident bytes of this unit's process, same source and same rules. */
+	rssBytes: number().optional()
+});
+method(_void(), array(LoadContributionSchema).readonly());
 /**
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
@@ -14018,8 +14104,7 @@ var NodeProcessSchema = object({
 	classification: _enum([
 		"root",
 		"managed",
-		"system",
-		"ghost"
+		"system"
 	]),
 	/** `$process` addon binding when `managed`, else null. */
 	addonId: string().nullable(),
@@ -14027,22 +14112,39 @@ var NodeProcessSchema = object({
 	nodeId: string().nullable(),
 	/** Truncated command line. */
 	command: string(),
+	/**
+	* `ps pcpu` — CPU averaged over the process's WHOLE LIFETIME, not a rate.
+	* On a runner up for days it barely moves. Fine as a column, useless as a
+	* series: use `cpuMainPercent + cpuGcPercent` for anything time-varying.
+	*/
 	cpuPercent: number(),
 	memoryRssBytes: number(),
+	/**
+	* Instantaneous CPU% of the process's own threads over the last
+	* process-snapshot window, from a `/proc/<pid>/task/*` tick delta.
+	*
+	* `null` = UNKNOWN, never zero: no previous sample yet (first tick after
+	* boot), the pid was recycled, or this node is not Linux.
+	*/
+	cpuMainPercent: number().nullable(),
+	/**
+	* Instantaneous CPU% of V8's `V8Worker` platform pool over the same window.
+	*
+	* This is the number that rewrote the 2026-08-27 diagnosis — hub-main 73%,
+	* `stream-broker` 61% (`docs/architecture/load-ledger.md`). A CPU chart that
+	* does not separate it from `cpuMainPercent` shows "busy" where the truth is
+	* "allocating too much".
+	*
+	* Concurrent GC is the dominant tenant of that pool but not the only one
+	* (background compilation runs there too), so it is reported as
+	* "GC / V8 helpers" rather than as pure collection time. `null` has the same
+	* meaning as on `cpuMainPercent`.
+	*/
+	cpuGcPercent: number().nullable(),
+	/** Threads seen in the tick scan. `null` under the same conditions. */
+	threadCount: number().nullable(),
 	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-	uptimeSec: number(),
-	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-	orphaned: boolean()
-});
-var KillProcessInputSchema = object({
-	pid: number(),
-	/** Force = SIGKILL. Default is SIGTERM. */
-	force: boolean().optional()
-});
-var KillProcessResultSchema = object({
-	success: boolean(),
-	reason: string().optional(),
-	signal: _enum(["SIGTERM", "SIGKILL"]).optional()
+	uptimeSec: number()
 });
 var DumpHeapSnapshotInputSchema = object({ 
 /** The addon whose runner should dump a heap snapshot. */
@@ -14055,6 +14157,104 @@ var DumpHeapSnapshotResultSchema = object({
 	pid: number().optional(),
 	reason: string().optional()
 });
+/**
+* One point of one function's series.
+*
+* The unsuffixed fields are the bucket's **MAXIMUM**, and that choice is the
+* point of the whole surface. The two obvious reductions both lie: a mean per
+* bucket smears a spike away, and taking every Nth sample skips it outright.
+* Either would give us a tool built to find peaks that does not show peaks.
+* `...Min` carries the other end, `samples` says how many raw snapshots folded
+* into the bucket, and a mean stays derivable where it is wanted.
+*
+* An UNREDUCED point is a one-sample bucket: `samples === 1` and each `...Min`
+* equals its unsuffixed twin. Reduced and unreduced are the same shape, so a
+* caller cannot tell which it received — which is what "one reader" means.
+*/
+var LoadPointSchema = object({
+	/** Bucket START, or the snapshot's own timestamp when unreduced. */
+	atMs: number(),
+	/** Raw snapshots in this bucket. Never 0 — AN EMPTY BUCKET IS ABSENT. */
+	samples: number().int(),
+	/**
+	* `null` = UNKNOWN and it PROPAGATES: a bucket is null unless every process
+	* of every snapshot in it reported a thread split. A partial sum is a
+	* smaller number that looks exactly as real as a complete one.
+	*/
+	cpuMainPercent: number().nullable(),
+	cpuMainPercentMin: number().nullable(),
+	cpuGcPercent: number().nullable(),
+	cpuGcPercentMin: number().nullable(),
+	/** Lifetime-average CPU%, summed. Always known — and never a rate. */
+	cpuLifetimePercent: number(),
+	cpuLifetimePercentMin: number(),
+	memoryRssBytes: number(),
+	memoryRssBytesMin: number(),
+	processCount: number().int(),
+	processCountMin: number().int()
+});
+/** One function's series. `key` is an addonId, `__root__` or `__unattributed__`. */
+var LoadFunctionSeriesSchema = object({
+	key: string(),
+	kind: _enum([
+		"addon",
+		"root",
+		"unattributed"
+	]),
+	/** Oldest-first. A missing interval is MISSING — never zero-filled. */
+	points: array(LoadPointSchema).readonly()
+});
+var NodeLoadSeriesSchema = object({
+	nodeId: string(),
+	/** One entry per function seen in the window, heaviest-first. */
+	series: array(LoadFunctionSeriesSchema).readonly(),
+	/**
+	* Width of one returned bucket, in ms. Equals the sampling cadence when no
+	* reduction was needed — so a caller can always say what one point covers
+	* without having to know whether it was reduced.
+	*/
+	bucketMs: number(),
+	/** Raw snapshots that went into this answer, across both tiers. */
+	retainedSamples: number(),
+	/** Oldest snapshot represented, or `null` when nothing is retained. */
+	oldestAtMs: number().nullable(),
+	/** The fixed sampling cadence in force on the cluster, in ms. */
+	cadenceMs: number(),
+	/**
+	* Did the DURABLE tier contribute? `false` means the answer is the hot ring
+	* alone — an agent (which holds no table), or a store that refused.
+	* Reported because "the last hour" and "the last six hours" are different
+	* questions and an operator must not have to guess which was answered.
+	*/
+	durable: boolean()
+});
+var GetLoadSeriesInputSchema = object({
+	/**
+	* The node whose series is wanted.
+	*
+	* NOT named `nodeId`: the generated cap router strips a top-level
+	* `nodeId` from every method input and uses it to ROUTE the call to
+	* that node's provider (`generated-cap-routers.ts`). A series target
+	* called `nodeId` would silently become a routing pin and never reach
+	* the provider. The hub holds every node it hears from, so the
+	* ordinary call is unpinned — answered by the hub, for any node.
+	*/
+	forNodeId: string(),
+	/**
+	* EXCLUSIVE lower bound. A caller passes the newest `atMs` it already
+	* holds and receives only what it is missing, so seeding a live chart
+	* from this method cannot double a point already drawn.
+	*/
+	sinceMs: number().optional(),
+	/**
+	* Most points the caller wants PER FUNCTION. The window is reduced to fit,
+	* preserving min and max per bucket.
+	*
+	* Absent means NO reduction — legitimate for a short window and a trap for a
+	* long one, which is why a chart passes its own pixel width.
+	*/
+	maxPoints: number().int().positive().optional()
+});
 var SystemMetricsSchema = object({
 	cpuPercent: number(),
 	memoryPercent: number(),
@@ -14065,10 +14265,7 @@ var SystemMetricsSchema = object({
 	gpuPercent: number().optional(),
 	gpuMemoryPercent: number().optional()
 });
-method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(KillProcessInputSchema, KillProcessResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
+method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema), method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -29787,6 +29984,15 @@ var LoggingSettingsPatchSchema = object({
 * authority over the whole hierarchy and answers for every layer, so the
 * layer selector needs a name the transport does not already own.
 */
+/**
+* One contribution, plus WHO reported it.
+*
+* The addon and node are added by the hub as it enumerates providers, never by
+* the contributor: an addon reporting its own identity could report somebody
+* else's, and the whole point of this surface is that no claim is made by
+* anyone but its owner.
+*/
+var ReportedLoadContributionSchema = LoadContributionSchema.extend({ addonId: string() });
 var GetLoggingSettingsInputSchema = object({
 	scopeNodeId: string().optional(),
 	/**
@@ -29845,7 +30051,7 @@ method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), met
 }), method(_void(), SiteLocationStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+}), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(_void(), array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -33036,6 +33242,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dataStoreProvider.insertMany": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.isEmpty": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -34350,6 +34562,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"loadContribution.list": {
+		capName: "load-contribution",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.downloadCa": {
 		capName: "local-network",
 		capScope: "system",
@@ -34650,17 +34868,17 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.getProcessStats": {
+	"metricsProvider.getLoadSeries": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"metricsProvider.killProcess": {
+	"metricsProvider.getProcessStats": {
 		capName: "metrics-provider",
 		capScope: "system",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
 	"metricsProvider.listAddonInstances": {
 		capName: "metrics-provider",
@@ -36672,6 +36890,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.insertMany": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"settingsStore.isEmpty": {
 		capName: "settings-store",
 		capScope: "system",
@@ -37284,6 +37508,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoadContributions": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getLoggingSettings": {
 		capName: "system",
 		capScope: "system",
@@ -235971,10 +236201,12 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* descriptors served by the `stream-catalog` cap (broker PULLS via
 	* `registerStreamCatalogProvider`).
 	*
-	* Returns `[]` (logging at debug, matching the prior early-returns) on
-	* the battery-sleep gate, `ensureApi` failure, or
-	* `buildVideoStreamOptions` failure — the broker simply sees no
-	* descriptors for the device until the next reconcile.
+	* Returns `[]` only when there is genuinely nothing to say: the
+	* battery-sleep gate (logged at debug), or a camera that connected and
+	* reported zero streams. An `ensureApi` / `buildVideoStreamOptions` failure
+	* THROWS — `[]` and an error are not the same fact, and the broker needs
+	* the difference to keep the device's existing entry and to schedule its
+	* per-device backoff instead of treating the camera as stream-less.
 	*
 	* This method only BUILDS descriptors — it never opens an upstream
 	* session or touches the broker.
@@ -236102,10 +236334,22 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			channel: ownChannel,
 			onNvr: true
 		} : void 0;
+		const readStreamOptions = async (current) => withTimeout(buildOptions ? current.buildVideoStreamOptions(buildOptions) : current.buildVideoStreamOptions(), 1e4, "buildVideoStreamOptions");
 		try {
-			streamOptions = await withTimeout(buildOptions ? api.buildVideoStreamOptions(buildOptions) : api.buildVideoStreamOptions(), 1e4, "buildVideoStreamOptions");
+			streamOptions = await readStreamOptions(api);
 		} catch (err) {
-			throw new Error(`buildStreamCatalog: buildVideoStreamOptions failed for device ${this.id}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			if (isChild) throw new Error(`buildStreamCatalog: buildVideoStreamOptions failed for device ${this.id}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+			this.ctx.logger.warn("buildStreamCatalog: stream options read failed — dropping the Baichuan session and retrying once", {
+				tags: { deviceId: this.id },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+			await this.dropBaichuanSession("stream-catalog-retry");
+			try {
+				streamOptions = await readStreamOptions(await withTimeout(this.ensureApi(), 1e4, "ensureApi"));
+			} catch (retryErr) {
+				throw new Error(`buildStreamCatalog: buildVideoStreamOptions failed for device ${this.id} (after one re-auth retry): ${retryErr instanceof Error ? retryErr.message : String(retryErr)}`, { cause: retryErr });
+			}
+			this.ctx.logger.info("buildStreamCatalog: stream options read recovered after re-auth", { tags: { deviceId: this.id } });
 		}
 		const channelCount = this.channelCount();
 		const desired = /* @__PURE__ */ new Map();
@@ -238987,6 +239231,30 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* `awake` push (or a snapshot demand from the operator) will
 	* lazily call `ensureApi()` and re-establish the client.
 	*/
+	/**
+	* Close and forget the cached control-channel client so the NEXT
+	* `ensureApi()` performs a fresh login.
+	*
+	* The one thing `scheduleReconnect` cannot express: an EXPIRED session on a
+	* socket that is still open. No `close`/`error` ever fires, so the reconnect
+	* ladder is never armed, and `ensureApi`'s `if (this.api) return this.api`
+	* keeps handing back a client whose every request answers `responseCode
+	* 400`. Callers that see an application-level rejection they believe is a
+	* dead session call this and retry ONCE — they must never loop on it.
+	*
+	* Same teardown the `disconnectAll` / debug-options paths use: `close()`
+	* best-effort, then null the field. Active RFC 4571 servers are untouched —
+	* each owns a dedicated socket and survives a control-channel reset (see
+	* `scheduleReconnect`).
+	*/
+	async dropBaichuanSession(reason) {
+		const current = this.api;
+		this.api = null;
+		if (!current) return;
+		try {
+			await current.close({ reason });
+		} catch {}
+	}
 	scheduleReconnect(reason) {
 		if (this.reconnectTimer) return;
 		if (this.isBattery) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-reolink",
-  "version": "1.2.57",
+  "version": "1.2.59",
   "description": "Reolink camera device provider addon for CamStack — native Baichuan protocol",
   "keywords": [
     "camstack",
@@ -44,7 +44,8 @@
         "mode": "standalone",
         "execution": {
           "placement": "hub-only",
-          "heapProfile": "heavy"
+          "heapProfile": "heavy",
+          "rssBudgetMb": 1024
         },
         "capabilities": [
           {