@camstack/addon-provider-reolink 1.2.83 → 1.2.85

package/dist/addon.js

@@ -13361,7 +13361,26 @@ var DiscoveryCandidateSchema = object({
 	* identity ahead of adoption. Rendering metadata (unit, precision)
 	* flows live through the cap STATUS SLICE after adoption.
 	*/
-	sourceInfo: SourceInfoSchema.optional()
+	sourceInfo: SourceInfoSchema.optional(),
+	/**
+	* Set when this candidate is a device the provider ALREADY owns.
+	*
+	* A scan cannot generally produce the identity a device was onboarded under
+	* (Reolink keys on `mac-<mac>`, learned at adopt time), so a stableId
+	* comparison never matches and an owned device looks addable. Re-adopting one
+	* overwrites its config with scan-derived values — that is how a Home Hub's
+	* Baichuan port was overwritten with its ONVIF port, taking the hub and its
+	* three child cameras offline for four hours.
+	*
+	* A provider that can recognise its own devices says so here. Absent means
+	* "not recognised", which is not the same as "known to be new" — a provider
+	* that cannot tell simply never sets it.
+	*/
+	alreadyOnboarded: boolean().optional(),
+	/** Numeric id of the device this candidate was matched to. Set with `alreadyOnboarded`. */
+	onboardedDeviceId: number().optional(),
+	/** Operator-facing name of the matched device, so the UI can say WHICH one it is. */
+	onboardedName: string().optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -34043,6 +34062,22 @@ var BaseDeviceProvider = class extends BaseAddon {
 	* failed — logged at ERROR with `tags.deviceId` and surfaced via
 	* `getStatus().error`.
 	*/
+	/**
+	* Repair a row's PERSISTED config blob immediately before it is restored.
+	* Default: no-op — most providers have nothing to heal.
+	*
+	* This exists because a restored device self-hydrates from the DB: `create()`
+	* passes `{}` and `BaseDevice` parses the stored blob against the device
+	* schema. A blob that lost a REQUIRED field therefore fails restore forever,
+	* and no later pass revisits it — a hub-adopted Reolink camera whose blob had
+	* been emptied failed all four bounded attempts against fields
+	* (`host`, `password`) it inherits from its parent and never dials itself.
+	*
+	* Implementations get every saved row, so a child can read its parent's blob.
+	* A heal that throws is treated like any other restore failure: retried under
+	* the bound, then reported — never swallowed.
+	*/
+	async healSavedConfig(_saved, _allSaved) {}
 	async onRestoreDevices(savedDevices) {
 		const restored = /* @__PURE__ */ new Set();
 		const failures = [];
@@ -34051,6 +34086,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 			const Class = this.deviceClasses[saved.type];
 			if (!Class) throw new Error(`no device class registered for type "${saved.type}"`);
 			if (saved.parentDeviceId !== null && !restored.has(saved.parentDeviceId)) throw new Error(`parent device ${saved.parentDeviceId} not restored`);
+			await this.healSavedConfig(saved, savedDevices);
 			await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
 			restored.add(saved.id);
 		};
@@ -242593,6 +242629,43 @@ function computeHealthCheckBackoffMs(consecutive) {
 	return 15 * 6e4;
 }
 //#endregion
+//#region src/hub-channel-reconcile.ts
+/**
+* Match adopted children to the hub's own channel list by IDENTITY, then report the
+* ones whose persisted `channel` is missing or wrong.
+*
+* A child's stableId is `${hubStableId}-${childNativeId}`, and `childNativeId` is built
+* from the camera's UID — so identity survives a channel move, while `channel` does not.
+* The hub is the authority on which slot a UID currently occupies.
+*
+* Why this exists: `loadAdoptedChildrenByChannel` keys the adopted set on the persisted
+* `channel` alone. A child that lost it is absent from that map, so the discovery panel
+* renders it `alreadyAdopted: false` — one click away from being adopted a SECOND time —
+* and `routeSimpleEvent` silently drops every push for its slot. Observed live on
+* 2026-09-04 with an Argus MagiCam that was actually on channel 3.
+*
+* Pure: no I/O. A discovered entry with no channel, or with no adopted child, is skipped —
+* this repairs what exists, it never adopts.
+*/
+function planChannelReconciliation(hubStableId, discovered, children) {
+	const byStableId = /* @__PURE__ */ new Map();
+	for (const child of children) byStableId.set(child.stableId, child);
+	const repairs = [];
+	for (const entry of discovered) {
+		if (typeof entry.rtspChannel !== "number") continue;
+		const child = byStableId.get(`${hubStableId}-${entry.childNativeId}`);
+		if (child === void 0) continue;
+		if (child.channel === entry.rtspChannel) continue;
+		repairs.push({
+			deviceId: child.deviceId,
+			stableId: child.stableId,
+			from: child.channel ?? null,
+			to: entry.rtspChannel
+		});
+	}
+	return repairs;
+}
+//#endregion
 //#region src/simple-event-dispatch-trace.ts
 /**
 * Gate for hub-side simpleEvent traces.
@@ -243089,6 +243162,7 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 			lastFetchedAt: Date.now()
 		};
 		this.runtimeState.setCapState(deviceDiscoveryCapability.name, slice);
+		if (lastError === null) await this.reconcileChildChannels(discovered);
 		if (lastError === null) {
 			this.knownUnadoptedChannels.clear();
 			for (const d of discovered) {
@@ -243261,6 +243335,64 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 	* the channel index. Returns a `channel → kernel deviceId` map.
 	* Used to gate the `alreadyAdopted` flag in the discovery list.
 	*/
+	/**
+	* Re-derive each adopted child's `channel` from the hub's own channel list, matching by
+	* IDENTITY (stableId carries the camera UID) rather than by the channel itself.
+	*
+	* `loadAdoptedChildrenByChannel` keys the adopted set on the persisted `channel` alone,
+	* so a child that lost it is invisible: the discovery panel renders it available (one
+	* click from a second adoption of the same camera) and `routeSimpleEvent` drops every
+	* push for its slot. A channel move produces the same damage under a wrong number.
+	*
+	* Writes through the live device so its in-memory config and the DB stay in step.
+	* A child that is not live is skipped — it is repaired on its next successful restore.
+	*/
+	async reconcileChildChannels(discovered) {
+		const children = await this.ctx.devices.getChildren(this.id);
+		const adopted = children.map((child) => {
+			const channel = child instanceof ReolinkCamera ? child.config.values.channel : void 0;
+			return {
+				deviceId: child.id,
+				stableId: child.stableId,
+				...typeof channel === "number" ? { channel } : {}
+			};
+		});
+		const repairs = planChannelReconciliation(this.stableId, discovered.map((d) => ({
+			childNativeId: d.childNativeId,
+			...typeof d.metadata.rtspChannel === "number" ? { rtspChannel: d.metadata.rtspChannel } : {}
+		})), adopted);
+		if (repairs.length === 0) return;
+		for (const repair of repairs) {
+			const child = children.find((c) => c.id === repair.deviceId);
+			if (!(child instanceof ReolinkCamera)) continue;
+			try {
+				await child.config.setAll({ channel: repair.to });
+				this.channelToDeviceId.set(repair.to, repair.deviceId);
+				this.ctx.logger.warn("Reolink Hub: repaired a child channel from the hub channel list", {
+					tags: {
+						deviceId: repair.deviceId,
+						stableId: repair.stableId
+					},
+					meta: {
+						from: repair.from,
+						to: repair.to
+					}
+				});
+			} catch (err) {
+				this.ctx.logger.warn("Reolink Hub: child channel repair failed", {
+					tags: {
+						deviceId: repair.deviceId,
+						stableId: repair.stableId
+					},
+					meta: {
+						from: repair.from,
+						to: repair.to,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			}
+		}
+	}
 	async loadAdoptedChildrenByChannel() {
 		const result = /* @__PURE__ */ new Map();
 		const children = await this.ctx.devices.getChildren(this.id);
@@ -243725,6 +243857,53 @@ function buildCreationFormSchema() {
 	] };
 }
 //#endregion
+//#region src/child-config-heal.ts
+/** Connection fields a hub-adopted child inherits from its parent at adoption time. */
+var INHERITED_CONNECTION_KEYS = [
+	"host",
+	"port",
+	"username",
+	"password",
+	"transport"
+];
+/** A stored value counts as present only when it is a usable string/number. */
+function isPresent(value) {
+	if (typeof value === "string") return value !== "";
+	return typeof value === "number";
+}
+/**
+* Work out what a hub-adopted child's persisted blob is missing from the connection
+* fields it inherited from its parent when it was adopted.
+*
+* `ReolinkCamera` with a parent uses `parent.api` and never dials its own login — but
+* `reolinkCameraSchema` still requires `host` and `password` as strings, so a blob that
+* lost them fails to parse and the camera cannot be restored at all. Observed live on
+* 2026-09-04: an Argus MagiCam under a Home Hub carried `{}` and burned all four bounded
+* restore attempts on `host`/`password` — fields it would never have used.
+*
+* Only ABSENT fields are filled. A child that deliberately differs from its parent (a
+* per-child credential, a non-default port) keeps what it has.
+*/
+function planChildConfigHeal(childConfig, parentConfig) {
+	const patch = {};
+	const missingKeys = [];
+	for (const key of INHERITED_CONNECTION_KEYS) {
+		if (isPresent(childConfig[key])) continue;
+		if (!isPresent(parentConfig[key])) continue;
+		patch[key] = parentConfig[key];
+		missingKeys.push(key);
+	}
+	return {
+		patch,
+		missingKeys
+	};
+}
+/** Find the saved row a child names as its parent. */
+function findParentRow(child, allSaved) {
+	if (child.parentDeviceId === null) return void 0;
+	return allSaved.find((row) => row.id === child.parentDeviceId);
+}
+//#endregion
 //#region src/reolink-discovery-map.ts
 /**
 * Flatten a host (IP / hostname) into a flat row-key slug — shared by `generateStableId` and the
@@ -243734,21 +243913,44 @@ function slugifyReolinkHost(host) {
 	return host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 /**
+* Decide whether a discovered host is a device this provider already owns.
+*
+* Matching is by UID first (stable across a DHCP lease change) and by host second. A UID match
+* wins even when the host differs, because the address is the thing that moves.
+*/
+function findOnboardedMatch(discovered, onboarded) {
+	if (discovered.uid !== void 0 && discovered.uid !== "") {
+		const byUid = onboarded.find((o) => o.uid === discovered.uid);
+		if (byUid !== void 0) return byUid;
+	}
+	return onboarded.find((o) => o.host !== void 0 && o.host === discovered.host);
+}
+/**
 * Map discovered Reolink hosts to adoption {@link DiscoveryCandidate}s, de-duplicated by host (the
 * same camera can answer on more than one discovery method — UDP broadcast, ONVIF, HTTP scan). The
 * first responder for a host wins. Pure: no I/O.
 *
+* **The scan never supplies `port`.** `port` in the Reolink config schema is the BAICHUAN port
+* (default 9000). Discovery reports `httpPort`, the HTTP/ONVIF listener — on a Reolink Home Hub
+* that is 8000, while Baichuan lives on `mediaPort` 9000. Writing the discovered value into `port`
+* pointed every Baichuan login at the ONVIF listener, which accepts the TCP connection and then
+* closes it: `Baichuan socket closed`, 316 times in 12 hours, taking the hub and all three of its
+* child cameras offline. The default is correct; a non-default Baichuan port is an operator edit,
+* never a scan result.
+*
 * The authoritative stableId is `mac-<mac>` (learned during autodetect at adopt time), which discovery
-* can't produce — so a re-scan of a MAC-keyed camera may still show as addable. The `host-` key still
-* lets host-added cameras be detected as onboarded on re-scan.
+* can't produce — so candidates carry `alreadyOnboarded` rather than relying on a stableId match,
+* which never fires for a MAC-keyed device. Re-adding an owned device is how the port got clobbered
+* in the first place, so a scan says so instead of offering it again.
 */
-function mapReolinkDiscoveryToCandidates(devices, credentials) {
+function mapReolinkDiscoveryToCandidates(devices, credentials, onboarded = []) {
 	const username = credentials.username?.trim() ?? "";
 	const password = credentials.password ?? "";
 	const byHost = /* @__PURE__ */ new Map();
 	for (const d of devices) if (!byHost.has(d.host)) byHost.set(d.host, d);
 	return [...byHost.values()].map((d) => {
 		const displayName = d.name ?? d.model ?? d.host;
+		const match = findOnboardedMatch(d, onboarded);
 		return {
 			stableId: `host-${slugifyReolinkHost(d.host)}`,
 			type: DeviceType.Camera,
@@ -243757,11 +243959,15 @@ function mapReolinkDiscoveryToCandidates(devices, credentials) {
 				name: displayName,
 				host: d.host,
 				transport: "auto",
-				...d.httpPort !== void 0 ? { port: d.httpPort } : {},
 				...d.uid ? { uid: d.uid } : {},
 				...username ? { username } : {},
 				...password ? { password } : {}
-			}
+			},
+			...match !== void 0 ? {
+				alreadyOnboarded: true,
+				onboardedDeviceId: match.deviceId,
+				onboardedName: match.name
+			} : {}
 		};
 	});
 }
@@ -244410,6 +244616,61 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		super({});
 	}
 	/**
+	* Reduce this addon's live devices to the identities a network scan can produce, so
+	* {@link mapReolinkDiscoveryToCandidates} can recognise a device it already owns.
+	*
+	* Hubs are included: the incident this exists for was a Home Hub re-offered by a scan and
+	* re-added, which overwrote its Baichuan port with the ONVIF port the scan reported.
+	*/
+	/**
+	* Re-inherit the parent's connection fields into a hub-adopted child whose persisted
+	* blob lost them, so the child can be restored at all.
+	*
+	* `adoptDiscoveredChild` copies `host`/`port`/`username`/`password`/`transport` down
+	* from the Hub at adoption. Nothing re-applied them afterwards, so a child whose blob
+	* was emptied failed `reolinkCameraSchema` on every restore — on fields a child never
+	* dials, because a child with a parent uses `parent.api`. Only ABSENT fields are
+	* filled; a child that deliberately differs keeps what it has.
+	*/
+	async healSavedConfig(saved, allSaved) {
+		const parent = findParentRow(saved, allSaved);
+		if (parent === void 0) return;
+		const { patch, missingKeys } = planChildConfigHeal(saved.config, parent.config);
+		if (missingKeys.length === 0) return;
+		await this.ctx.kernel.devices?.persistInitialConfig(saved.stableId, {
+			...saved.config,
+			...patch
+		});
+		this.ctx.logger.warn("Reolink child config healed from its parent before restore", {
+			tags: {
+				deviceId: saved.id,
+				stableId: saved.stableId
+			},
+			meta: {
+				parentDeviceId: parent.id,
+				restoredKeys: [...missingKeys]
+			}
+		});
+	}
+	listOnboardedForDiscovery() {
+		const all = this.ctx.kernel.deviceRegistry?.getAll() ?? [];
+		const onboarded = [];
+		for (const d of all) {
+			if (!(d instanceof ReolinkCamera) && !(d instanceof ReolinkHub)) continue;
+			const values = d.config.values;
+			const host = typeof values.host === "string" && values.host !== "" ? values.host : void 0;
+			const uid = typeof values.uid === "string" && values.uid !== "" ? values.uid : void 0;
+			if (host === void 0 && uid === void 0) continue;
+			onboarded.push({
+				deviceId: d.id,
+				name: d.name,
+				...host !== void 0 ? { host } : {},
+				...uid !== void 0 ? { uid } : {}
+			});
+		}
+		return onboarded;
+	}
+	/**
 	* Enumerate this addon's live `ReolinkCamera` instances from the
 	* global device registry. Used by the email-push server to resolve
 	* recipients + route inbound motion. Returns `[]` when the registry
@@ -244692,10 +244953,17 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			networkCidr: networkCidr || "local",
 			enableOnvif
 		} });
-		return mapReolinkDiscoveryToCandidates(devices, {
+		const onboarded = this.listOnboardedForDiscovery();
+		const candidates = mapReolinkDiscoveryToCandidates(devices, {
 			username,
 			password
-		});
+		}, onboarded);
+		const owned = candidates.filter((c) => c.alreadyOnboarded === true).length;
+		if (owned > 0) this.ctx.logger.info("Reolink discovery: candidates already owned by this provider", { meta: {
+			owned,
+			total: candidates.length
+		} });
+		return candidates;
 	}
 	async adoptDiscoveredDevice(input) {
 		return this.createDevice({

package/dist/addon.mjs

@@ -13356,7 +13356,26 @@ var DiscoveryCandidateSchema = object({
 	* identity ahead of adoption. Rendering metadata (unit, precision)
 	* flows live through the cap STATUS SLICE after adoption.
 	*/
-	sourceInfo: SourceInfoSchema.optional()
+	sourceInfo: SourceInfoSchema.optional(),
+	/**
+	* Set when this candidate is a device the provider ALREADY owns.
+	*
+	* A scan cannot generally produce the identity a device was onboarded under
+	* (Reolink keys on `mac-<mac>`, learned at adopt time), so a stableId
+	* comparison never matches and an owned device looks addable. Re-adopting one
+	* overwrites its config with scan-derived values — that is how a Home Hub's
+	* Baichuan port was overwritten with its ONVIF port, taking the hub and its
+	* three child cameras offline for four hours.
+	*
+	* A provider that can recognise its own devices says so here. Absent means
+	* "not recognised", which is not the same as "known to be new" — a provider
+	* that cannot tell simply never sets it.
+	*/
+	alreadyOnboarded: boolean().optional(),
+	/** Numeric id of the device this candidate was matched to. Set with `alreadyOnboarded`. */
+	onboardedDeviceId: number().optional(),
+	/** Operator-facing name of the matched device, so the UI can say WHICH one it is. */
+	onboardedName: string().optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -34038,6 +34057,22 @@ var BaseDeviceProvider = class extends BaseAddon {
 	* failed — logged at ERROR with `tags.deviceId` and surfaced via
 	* `getStatus().error`.
 	*/
+	/**
+	* Repair a row's PERSISTED config blob immediately before it is restored.
+	* Default: no-op — most providers have nothing to heal.
+	*
+	* This exists because a restored device self-hydrates from the DB: `create()`
+	* passes `{}` and `BaseDevice` parses the stored blob against the device
+	* schema. A blob that lost a REQUIRED field therefore fails restore forever,
+	* and no later pass revisits it — a hub-adopted Reolink camera whose blob had
+	* been emptied failed all four bounded attempts against fields
+	* (`host`, `password`) it inherits from its parent and never dials itself.
+	*
+	* Implementations get every saved row, so a child can read its parent's blob.
+	* A heal that throws is treated like any other restore failure: retried under
+	* the bound, then reported — never swallowed.
+	*/
+	async healSavedConfig(_saved, _allSaved) {}
 	async onRestoreDevices(savedDevices) {
 		const restored = /* @__PURE__ */ new Set();
 		const failures = [];
@@ -34046,6 +34081,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 			const Class = this.deviceClasses[saved.type];
 			if (!Class) throw new Error(`no device class registered for type "${saved.type}"`);
 			if (saved.parentDeviceId !== null && !restored.has(saved.parentDeviceId)) throw new Error(`parent device ${saved.parentDeviceId} not restored`);
+			await this.healSavedConfig(saved, savedDevices);
 			await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
 			restored.add(saved.id);
 		};
@@ -242573,6 +242609,43 @@ function computeHealthCheckBackoffMs(consecutive) {
 	return 15 * 6e4;
 }
 //#endregion
+//#region src/hub-channel-reconcile.ts
+/**
+* Match adopted children to the hub's own channel list by IDENTITY, then report the
+* ones whose persisted `channel` is missing or wrong.
+*
+* A child's stableId is `${hubStableId}-${childNativeId}`, and `childNativeId` is built
+* from the camera's UID — so identity survives a channel move, while `channel` does not.
+* The hub is the authority on which slot a UID currently occupies.
+*
+* Why this exists: `loadAdoptedChildrenByChannel` keys the adopted set on the persisted
+* `channel` alone. A child that lost it is absent from that map, so the discovery panel
+* renders it `alreadyAdopted: false` — one click away from being adopted a SECOND time —
+* and `routeSimpleEvent` silently drops every push for its slot. Observed live on
+* 2026-09-04 with an Argus MagiCam that was actually on channel 3.
+*
+* Pure: no I/O. A discovered entry with no channel, or with no adopted child, is skipped —
+* this repairs what exists, it never adopts.
+*/
+function planChannelReconciliation(hubStableId, discovered, children) {
+	const byStableId = /* @__PURE__ */ new Map();
+	for (const child of children) byStableId.set(child.stableId, child);
+	const repairs = [];
+	for (const entry of discovered) {
+		if (typeof entry.rtspChannel !== "number") continue;
+		const child = byStableId.get(`${hubStableId}-${entry.childNativeId}`);
+		if (child === void 0) continue;
+		if (child.channel === entry.rtspChannel) continue;
+		repairs.push({
+			deviceId: child.deviceId,
+			stableId: child.stableId,
+			from: child.channel ?? null,
+			to: entry.rtspChannel
+		});
+	}
+	return repairs;
+}
+//#endregion
 //#region src/simple-event-dispatch-trace.ts
 /**
 * Gate for hub-side simpleEvent traces.
@@ -243069,6 +243142,7 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 			lastFetchedAt: Date.now()
 		};
 		this.runtimeState.setCapState(deviceDiscoveryCapability.name, slice);
+		if (lastError === null) await this.reconcileChildChannels(discovered);
 		if (lastError === null) {
 			this.knownUnadoptedChannels.clear();
 			for (const d of discovered) {
@@ -243241,6 +243315,64 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 	* the channel index. Returns a `channel → kernel deviceId` map.
 	* Used to gate the `alreadyAdopted` flag in the discovery list.
 	*/
+	/**
+	* Re-derive each adopted child's `channel` from the hub's own channel list, matching by
+	* IDENTITY (stableId carries the camera UID) rather than by the channel itself.
+	*
+	* `loadAdoptedChildrenByChannel` keys the adopted set on the persisted `channel` alone,
+	* so a child that lost it is invisible: the discovery panel renders it available (one
+	* click from a second adoption of the same camera) and `routeSimpleEvent` drops every
+	* push for its slot. A channel move produces the same damage under a wrong number.
+	*
+	* Writes through the live device so its in-memory config and the DB stay in step.
+	* A child that is not live is skipped — it is repaired on its next successful restore.
+	*/
+	async reconcileChildChannels(discovered) {
+		const children = await this.ctx.devices.getChildren(this.id);
+		const adopted = children.map((child) => {
+			const channel = child instanceof ReolinkCamera ? child.config.values.channel : void 0;
+			return {
+				deviceId: child.id,
+				stableId: child.stableId,
+				...typeof channel === "number" ? { channel } : {}
+			};
+		});
+		const repairs = planChannelReconciliation(this.stableId, discovered.map((d) => ({
+			childNativeId: d.childNativeId,
+			...typeof d.metadata.rtspChannel === "number" ? { rtspChannel: d.metadata.rtspChannel } : {}
+		})), adopted);
+		if (repairs.length === 0) return;
+		for (const repair of repairs) {
+			const child = children.find((c) => c.id === repair.deviceId);
+			if (!(child instanceof ReolinkCamera)) continue;
+			try {
+				await child.config.setAll({ channel: repair.to });
+				this.channelToDeviceId.set(repair.to, repair.deviceId);
+				this.ctx.logger.warn("Reolink Hub: repaired a child channel from the hub channel list", {
+					tags: {
+						deviceId: repair.deviceId,
+						stableId: repair.stableId
+					},
+					meta: {
+						from: repair.from,
+						to: repair.to
+					}
+				});
+			} catch (err) {
+				this.ctx.logger.warn("Reolink Hub: child channel repair failed", {
+					tags: {
+						deviceId: repair.deviceId,
+						stableId: repair.stableId
+					},
+					meta: {
+						from: repair.from,
+						to: repair.to,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			}
+		}
+	}
 	async loadAdoptedChildrenByChannel() {
 		const result = /* @__PURE__ */ new Map();
 		const children = await this.ctx.devices.getChildren(this.id);
@@ -243705,6 +243837,53 @@ function buildCreationFormSchema() {
 	] };
 }
 //#endregion
+//#region src/child-config-heal.ts
+/** Connection fields a hub-adopted child inherits from its parent at adoption time. */
+var INHERITED_CONNECTION_KEYS = [
+	"host",
+	"port",
+	"username",
+	"password",
+	"transport"
+];
+/** A stored value counts as present only when it is a usable string/number. */
+function isPresent(value) {
+	if (typeof value === "string") return value !== "";
+	return typeof value === "number";
+}
+/**
+* Work out what a hub-adopted child's persisted blob is missing from the connection
+* fields it inherited from its parent when it was adopted.
+*
+* `ReolinkCamera` with a parent uses `parent.api` and never dials its own login — but
+* `reolinkCameraSchema` still requires `host` and `password` as strings, so a blob that
+* lost them fails to parse and the camera cannot be restored at all. Observed live on
+* 2026-09-04: an Argus MagiCam under a Home Hub carried `{}` and burned all four bounded
+* restore attempts on `host`/`password` — fields it would never have used.
+*
+* Only ABSENT fields are filled. A child that deliberately differs from its parent (a
+* per-child credential, a non-default port) keeps what it has.
+*/
+function planChildConfigHeal(childConfig, parentConfig) {
+	const patch = {};
+	const missingKeys = [];
+	for (const key of INHERITED_CONNECTION_KEYS) {
+		if (isPresent(childConfig[key])) continue;
+		if (!isPresent(parentConfig[key])) continue;
+		patch[key] = parentConfig[key];
+		missingKeys.push(key);
+	}
+	return {
+		patch,
+		missingKeys
+	};
+}
+/** Find the saved row a child names as its parent. */
+function findParentRow(child, allSaved) {
+	if (child.parentDeviceId === null) return void 0;
+	return allSaved.find((row) => row.id === child.parentDeviceId);
+}
+//#endregion
 //#region src/reolink-discovery-map.ts
 /**
 * Flatten a host (IP / hostname) into a flat row-key slug — shared by `generateStableId` and the
@@ -243714,21 +243893,44 @@ function slugifyReolinkHost(host) {
 	return host.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 /**
+* Decide whether a discovered host is a device this provider already owns.
+*
+* Matching is by UID first (stable across a DHCP lease change) and by host second. A UID match
+* wins even when the host differs, because the address is the thing that moves.
+*/
+function findOnboardedMatch(discovered, onboarded) {
+	if (discovered.uid !== void 0 && discovered.uid !== "") {
+		const byUid = onboarded.find((o) => o.uid === discovered.uid);
+		if (byUid !== void 0) return byUid;
+	}
+	return onboarded.find((o) => o.host !== void 0 && o.host === discovered.host);
+}
+/**
 * Map discovered Reolink hosts to adoption {@link DiscoveryCandidate}s, de-duplicated by host (the
 * same camera can answer on more than one discovery method — UDP broadcast, ONVIF, HTTP scan). The
 * first responder for a host wins. Pure: no I/O.
 *
+* **The scan never supplies `port`.** `port` in the Reolink config schema is the BAICHUAN port
+* (default 9000). Discovery reports `httpPort`, the HTTP/ONVIF listener — on a Reolink Home Hub
+* that is 8000, while Baichuan lives on `mediaPort` 9000. Writing the discovered value into `port`
+* pointed every Baichuan login at the ONVIF listener, which accepts the TCP connection and then
+* closes it: `Baichuan socket closed`, 316 times in 12 hours, taking the hub and all three of its
+* child cameras offline. The default is correct; a non-default Baichuan port is an operator edit,
+* never a scan result.
+*
 * The authoritative stableId is `mac-<mac>` (learned during autodetect at adopt time), which discovery
-* can't produce — so a re-scan of a MAC-keyed camera may still show as addable. The `host-` key still
-* lets host-added cameras be detected as onboarded on re-scan.
+* can't produce — so candidates carry `alreadyOnboarded` rather than relying on a stableId match,
+* which never fires for a MAC-keyed device. Re-adding an owned device is how the port got clobbered
+* in the first place, so a scan says so instead of offering it again.
 */
-function mapReolinkDiscoveryToCandidates(devices, credentials) {
+function mapReolinkDiscoveryToCandidates(devices, credentials, onboarded = []) {
 	const username = credentials.username?.trim() ?? "";
 	const password = credentials.password ?? "";
 	const byHost = /* @__PURE__ */ new Map();
 	for (const d of devices) if (!byHost.has(d.host)) byHost.set(d.host, d);
 	return [...byHost.values()].map((d) => {
 		const displayName = d.name ?? d.model ?? d.host;
+		const match = findOnboardedMatch(d, onboarded);
 		return {
 			stableId: `host-${slugifyReolinkHost(d.host)}`,
 			type: DeviceType.Camera,
@@ -243737,11 +243939,15 @@ function mapReolinkDiscoveryToCandidates(devices, credentials) {
 				name: displayName,
 				host: d.host,
 				transport: "auto",
-				...d.httpPort !== void 0 ? { port: d.httpPort } : {},
 				...d.uid ? { uid: d.uid } : {},
 				...username ? { username } : {},
 				...password ? { password } : {}
-			}
+			},
+			...match !== void 0 ? {
+				alreadyOnboarded: true,
+				onboardedDeviceId: match.deviceId,
+				onboardedName: match.name
+			} : {}
 		};
 	});
 }
@@ -244390,6 +244596,61 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		super({});
 	}
 	/**
+	* Reduce this addon's live devices to the identities a network scan can produce, so
+	* {@link mapReolinkDiscoveryToCandidates} can recognise a device it already owns.
+	*
+	* Hubs are included: the incident this exists for was a Home Hub re-offered by a scan and
+	* re-added, which overwrote its Baichuan port with the ONVIF port the scan reported.
+	*/
+	/**
+	* Re-inherit the parent's connection fields into a hub-adopted child whose persisted
+	* blob lost them, so the child can be restored at all.
+	*
+	* `adoptDiscoveredChild` copies `host`/`port`/`username`/`password`/`transport` down
+	* from the Hub at adoption. Nothing re-applied them afterwards, so a child whose blob
+	* was emptied failed `reolinkCameraSchema` on every restore — on fields a child never
+	* dials, because a child with a parent uses `parent.api`. Only ABSENT fields are
+	* filled; a child that deliberately differs keeps what it has.
+	*/
+	async healSavedConfig(saved, allSaved) {
+		const parent = findParentRow(saved, allSaved);
+		if (parent === void 0) return;
+		const { patch, missingKeys } = planChildConfigHeal(saved.config, parent.config);
+		if (missingKeys.length === 0) return;
+		await this.ctx.kernel.devices?.persistInitialConfig(saved.stableId, {
+			...saved.config,
+			...patch
+		});
+		this.ctx.logger.warn("Reolink child config healed from its parent before restore", {
+			tags: {
+				deviceId: saved.id,
+				stableId: saved.stableId
+			},
+			meta: {
+				parentDeviceId: parent.id,
+				restoredKeys: [...missingKeys]
+			}
+		});
+	}
+	listOnboardedForDiscovery() {
+		const all = this.ctx.kernel.deviceRegistry?.getAll() ?? [];
+		const onboarded = [];
+		for (const d of all) {
+			if (!(d instanceof ReolinkCamera) && !(d instanceof ReolinkHub)) continue;
+			const values = d.config.values;
+			const host = typeof values.host === "string" && values.host !== "" ? values.host : void 0;
+			const uid = typeof values.uid === "string" && values.uid !== "" ? values.uid : void 0;
+			if (host === void 0 && uid === void 0) continue;
+			onboarded.push({
+				deviceId: d.id,
+				name: d.name,
+				...host !== void 0 ? { host } : {},
+				...uid !== void 0 ? { uid } : {}
+			});
+		}
+		return onboarded;
+	}
+	/**
 	* Enumerate this addon's live `ReolinkCamera` instances from the
 	* global device registry. Used by the email-push server to resolve
 	* recipients + route inbound motion. Returns `[]` when the registry
@@ -244672,10 +244933,17 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			networkCidr: networkCidr || "local",
 			enableOnvif
 		} });
-		return mapReolinkDiscoveryToCandidates(devices, {
+		const onboarded = this.listOnboardedForDiscovery();
+		const candidates = mapReolinkDiscoveryToCandidates(devices, {
 			username,
 			password
-		});
+		}, onboarded);
+		const owned = candidates.filter((c) => c.alreadyOnboarded === true).length;
+		if (owned > 0) this.ctx.logger.info("Reolink discovery: candidates already owned by this provider", { meta: {
+			owned,
+			total: candidates.length
+		} });
+		return candidates;
 	}
 	async adoptDiscoveredDevice(input) {
 		return this.createDevice({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-reolink",
-  "version": "1.2.83",
+  "version": "1.2.85",
   "description": "Reolink camera device provider addon for CamStack — native Baichuan protocol",
   "keywords": [
     "camstack",