@camstack/system 1.2.107 → 1.2.108

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,5 @@
 import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-_oC_QkQA.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Bsjf7HQ-.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -289,6 +290,442 @@ var AdoptionJobEngine = class {
 	}
 };
 //#endregion
+//#region src/builtins/device-manager/device-aggregation-merge.ts
+/**
+* Pure aggregator-merge + field-tagging helpers for the device-manager
+* device-details aggregator. Extracted verbatim from
+* `device-manager.addon.ts`. These functions are stateless: they take
+* contributions in and return new wire-shape objects, attaching writer
+* provenance to editable fields. No addon-instance dependency.
+*
+* `mergeAggregates` is re-exported from the addon module to preserve the
+* existing public export surface the test-suite imports.
+*/
+/**
+* Walk the sections/fields of a contribution and inject `writerCapName` +
+* `writerAddonId` + `source` on each editable field. Readonly fields and
+* structural fields (separator/info/button) pass through untouched. The
+* aggregator is the single place that knows provenance — provider schemas
+* stay clean, UI-bound metadata is attached once at the boundary.
+*/
+function tagContribution(contribution, capName, addonId, kind) {
+	const source = kind === "settings" ? "settings" : "live";
+	return {
+		...contribution.tabs ? { tabs: [...contribution.tabs] } : {},
+		sections: contribution.sections.map((section) => ({
+			...section,
+			fields: section.fields.map((field) => tagField(field, capName, addonId, source, kind))
+		}))
+	};
+}
+function isFieldRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Convert a strict `ConfigUISchemaWithValues` (readonly arrays, typed
+* field union) into the cap wire shape `ContributionShape` (mutable
+* arrays, opaque field records). Required because the cap method z.infer
+* uses mutable arrays — readonly arrays are not assignable to mutable
+* even when structurally identical, so a structural copy bridges the gap
+* without disabling the type checker.
+*/
+function toWireShape(input) {
+	const out = { sections: input.sections.map((s) => ({
+		id: s.id,
+		title: s.title,
+		...s.description !== void 0 ? { description: s.description } : {},
+		...s.style !== void 0 ? { style: s.style } : {},
+		...s.defaultCollapsed !== void 0 ? { defaultCollapsed: s.defaultCollapsed } : {},
+		...s.columns !== void 0 ? { columns: s.columns } : {},
+		...s.tab !== void 0 ? { tab: s.tab } : {},
+		...s.location !== void 0 ? { location: s.location } : {},
+		...s.order !== void 0 ? { order: s.order } : {},
+		fields: [...s.fields]
+	})) };
+	if (input.tabs) out.tabs = [...input.tabs];
+	return out;
+}
+function tagField(field, capName, addonId, source, kind) {
+	if (!isFieldRecord(field)) return field;
+	const f = field;
+	const structuralTypes = new Set([
+		"separator",
+		"info",
+		"button"
+	]);
+	if (typeof f.type === "string" && structuralTypes.has(f.type)) return field;
+	const tagged = {
+		...f,
+		source
+	};
+	if (kind === "live" || f.readonlyField === true) tagged.readonlyField = true;
+	else {
+		tagged.writerCapName = capName;
+		tagged.writerAddonId = addonId;
+	}
+	if (f.type === "group") {
+		const children = Array.isArray(f.fields) ? f.fields : [];
+		if (children.length > 0) tagged.fields = children.map((child) => tagField(child, capName, addonId, source, kind));
+	} else if (f.type === "sub-tabs") {
+		const rawTabs = Array.isArray(f.tabs) ? f.tabs : [];
+		if (rawTabs.length > 0) tagged.tabs = rawTabs.map((tab) => {
+			if (!isFieldRecord(tab)) return tab;
+			const tabChildren = Array.isArray(tab.fields) ? tab.fields : [];
+			return {
+				...tab,
+				fields: tabChildren.map((child) => tagField(child, capName, addonId, source, kind))
+			};
+		});
+	}
+	return tagged;
+}
+function mergeAggregates(parts) {
+	const tabDecls = /* @__PURE__ */ new Map();
+	const sections = [];
+	const seenSectionIds = /* @__PURE__ */ new Set();
+	for (const part of parts) {
+		if (part.tabs) {
+			for (const t of part.tabs) if (!tabDecls.has(t.id)) tabDecls.set(t.id, t);
+		}
+		for (const s of part.sections) {
+			if (s.id !== void 0) {
+				if (seenSectionIds.has(s.id)) continue;
+				seenSectionIds.add(s.id);
+			}
+			sections.push(s);
+		}
+	}
+	for (const s of sections) {
+		const tabId = s.tab ?? "general";
+		if (tabDecls.has(tabId)) continue;
+		const known = WELL_KNOWN_TAB_MAP[tabId];
+		if (known) tabDecls.set(tabId, {
+			id: known.id,
+			label: known.label,
+			icon: known.icon,
+			order: known.order
+		});
+		else tabDecls.set(tabId, {
+			id: tabId,
+			label: tabId,
+			icon: "wrench",
+			order: 100
+		});
+	}
+	sections.sort((a, b) => {
+		const tabA = a.tab ?? "general";
+		const tabB = b.tab ?? "general";
+		if (tabA !== tabB) {
+			const orderA = tabDecls.get(tabA)?.order ?? 100;
+			const orderB = tabDecls.get(tabB)?.order ?? 100;
+			if (orderA !== orderB) return orderA - orderB;
+			return tabA.localeCompare(tabB);
+		}
+		return (a.order ?? 0) - (b.order ?? 0);
+	});
+	const sortedTabs = [...tabDecls.values()].toSorted((a, b) => (a.order ?? 100) - (b.order ?? 100));
+	const out = { sections };
+	if (sortedTabs.length > 0) out.tabs = sortedTabs;
+	return out;
+}
+//#endregion
+//#region src/builtins/device-manager/device-bindings-store.ts
+/**
+* Wire the push-fed cross-process native-cap cache (`remoteNativeCaps`).
+* Workers emit `DeviceBindingsChanged` on `ctx.registerNativeCap` / device
+* removal; we mirror those into `remoteNativeCaps` so `getBindings` returns the
+* full cluster view. Events from the local node are ignored: hub-local natives
+* live in `capabilityRegistry` and are folded in directly by getBindings.
+*
+* Push events are accurate in the steady state but can be lost during the
+* Moleculer transport handshake window (hub restart, crash-respawn,
+* restartAddon). The reliable replacement for lost events is the D3 re-handshake
+* (`listClusterNativeCaps()`), which `resolveNativeCapOwnerSync` /
+* `getBindings` step 4 fall through to on a push miss. The `$node.disconnected`
+* handler purges a gone node's entries; the worker re-handshakes (and re-emits
+* `native-registered`) on its next boot.
+*/
+function wireRemoteNativeCapSync(ctx, remoteNativeCaps) {
+	const localNodeId = ctx.kernel.localNodeId ?? "hub";
+	ctx.eventBus.subscribe({ category: EventCategory.DeviceBindingsChanged }, (event) => {
+		const { deviceId, capName, reason, addonId, nodeId } = event.data;
+		if (nodeId === localNodeId) return;
+		if (reason === "native-registered") {
+			let perDevice = remoteNativeCaps.get(deviceId);
+			if (!perDevice) {
+				perDevice = /* @__PURE__ */ new Map();
+				remoteNativeCaps.set(deviceId, perDevice);
+			}
+			perDevice.set(capName, {
+				addonId,
+				nodeId
+			});
+		} else if (reason === "native-unregistered") {
+			const perDevice = remoteNativeCaps.get(deviceId);
+			if (!perDevice) return;
+			perDevice.delete(capName);
+			if (perDevice.size === 0) remoteNativeCaps.delete(deviceId);
+		}
+	});
+	const cluster = ctx.kernel.cluster;
+	if (cluster) cluster.broker.localBus.on("$node.disconnected", (payload) => {
+		const gone = payload.node.id;
+		const emptyDevices = [];
+		for (const [deviceId, perDevice] of remoteNativeCaps) {
+			const toDelete = [];
+			for (const [capName, entry] of perDevice) if (entry.nodeId === gone) toDelete.push(capName);
+			for (const capName of toDelete) perDevice.delete(capName);
+			if (perDevice.size === 0) emptyDevices.push(deviceId);
+		}
+		for (const deviceId of emptyDevices) remoteNativeCaps.delete(deviceId);
+	});
+}
+async function readBindingsStore(deps) {
+	return { deviceBindings: (await deps.ctx.settings.readAddonStore()).deviceBindings ?? {} };
+}
+async function writeBindingsStore(deps, next) {
+	await deps.ctx.settings.writeAddonStore({ deviceBindings: next.deviceBindings });
+}
+function resolveWrapperNodeId(_wrapperAddonId) {
+	return "hub";
+}
+/**
+* Reduce a provider node id to the routable form `DeviceProxy` can pin.
+*
+* Every addon runs in its own `addon-runner` with the composite node id
+* `${parentNodeId}/${runnerId}` (see `addon-runner.ts`) — e.g.
+* `hub/provider-reolink` or `dev-agent-0/provider-reolink`. That composite is
+* an IDENTITY, not a routable target: the `CapRouteResolver` reaches a child
+* only THROUGH its parent (the hub resolves a hub-local-uds child by
+* cap+device; an agent forwards to its own child). `DeviceProxy` pins
+* `entry.providerNodeId` on every cap call, so a binding entry must expose the
+* parent node id — otherwise the explicit pin classifies as `remote-moleculer`
+* to an unknown node → `no-provider`, which surfaces as
+* "this camera doesn't expose …" for client-proxy-driven widget caps
+* (motion-zones, privacy-mask). Wrappers already report the parent via
+* `resolveWrapperNodeId`; this aligns natives with the same contract.
+*
+* A flat node id (a genuine standalone node with no `/`) is returned
+* unchanged.
+*/
+function toRoutableProviderNodeId(nodeId) {
+	const slash = nodeId.indexOf("/");
+	return slash === -1 ? nodeId : nodeId.slice(0, slash);
+}
+/**
+* Resolve a remote native cap entry for a given `(capName, deviceId)` by
+* consulting the handshake-fed `HubNodeRegistry` via
+* `ctx.kernel.listClusterNativeCaps()`. Called when the push-based
+* `remoteNativeCaps` cache misses — covers the Moleculer transport
+* handshake window where `DeviceBindingsChanged` events were lost but the
+* D3 re-handshake (post device restore) has already populated the registry.
+*
+* Returns `null` when the entry is genuinely not present in the cluster
+* view (cap not registered on any worker for that device).
+*/
+function resolveRemoteNativeCapFromRegistry(deps, capName, deviceId) {
+	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+	if (!clusterCaps) return null;
+	for (const entry of clusterCaps) if (entry.capName === capName && entry.deviceId === deviceId && entry.addonId) return {
+		addonId: entry.addonId,
+		nodeId: entry.nodeId
+	};
+	return null;
+}
+/**
+* Resolve the device's declared TYPE (`'camera'`, `'event-emitter'`, …), or
+* `undefined` when it cannot be established.
+*
+* The PERSISTED row is the authority: `ctx.kernel.deviceRegistry` is hub-only
+* and has been observed empty in the very process that answers `getBindings`
+* correctly (see the note on `getAllBindings`). The registry is consulted only
+* as a secondary source, for a device constructed but not yet persisted.
+*
+* `undefined` is a first-class answer and callers must treat it as "no
+* filtering" — an absent row must never be the reason a device loses bindings.
+*/
+function resolveDeviceType(deps, row, deviceId) {
+	const persisted = row?.meta.type;
+	if (typeof persisted === "string" && persisted.length > 0) return persisted;
+	const live = deps.ctx.kernel?.deviceRegistry?.getById(deviceId)?.type;
+	return typeof live === "string" && live.length > 0 ? live : void 0;
+}
+/**
+* Is this device still part of the fleet?
+*
+* The device-manager's own stores are the authority in-process — no RPC. Two
+* sources, in the same order `resolveDeviceType` uses them: the live registry
+* first (a device constructed but not yet persisted is present), then the
+* PERSISTED meta, which is the index `getBindings` already reads and is present
+* wherever this provider runs.
+*
+* `'absent'` is only ever returned against a NON-EMPTY ledger. An empty one
+* means device restore has not run, not that the fleet was deleted (D49) — the
+* same reason `getAllBindings` warns instead of reporting zero devices. That is
+* the only reason this is async: the `COUNT(*)` runs solely on the miss path,
+* where the alternative is to call a device gone because the store is empty.
+*/
+async function resolveDevicePresence(deps, row, deviceId) {
+	if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
+	if (row !== null) return "present";
+	return await deps.rows.count() > 0 ? "absent" : "unknown";
+}
+/**
+* Does a capability apply to a device of type `deviceType`?
+*
+* The cap's `deviceTypes` is the ONLY declaration consulted (D4: behavioural
+* cap metadata lives in the `*.cap.ts`, never in a manifest). Two deliberate
+* fail-open cases:
+*
+*   - a cap that declares no `deviceTypes` (or an empty list) applies to every
+*     device — the pre-existing, back-compatible semantics;
+*   - an UNKNOWN `deviceType` never filters, so a missing/failed meta lookup
+*     changes nothing (D49: a read that fails must not destroy work).
+*/
+function capAppliesToDeviceType(def, deviceType) {
+	if (deviceType === void 0) return true;
+	const declared = def?.deviceTypes;
+	if (!declared || declared.length === 0) return true;
+	return declared.some((t) => t === deviceType);
+}
+async function getBindings(deps, input) {
+	const storeKey = String(input.deviceId);
+	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+	const row = await deps.rows.get(input.deviceId);
+	const deviceType = resolveDeviceType(deps, row, input.deviceId);
+	const presence = await resolveDevicePresence(deps, row, input.deviceId);
+	const entries = [];
+	const seenCaps = /* @__PURE__ */ new Set();
+	const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
+	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
+		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
+		const remoteNative = resolveRemote(capName);
+		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
+		const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
+		if (wrapperAddonId === null && !nativeAddonId) {
+			seenCaps.add(capName);
+			continue;
+		}
+		entries.push({
+			capName,
+			kind: wrapperAddonId ? "wrapped" : "native",
+			providerAddonId: wrapperAddonId ?? nativeAddonId,
+			providerNodeId: wrapperAddonId ? resolveWrapperNodeId(wrapperAddonId) : toRoutableProviderNodeId(nativeNodeId),
+			nativeAddonId
+		});
+		seenCaps.add(capName);
+	}
+	if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device — returning none", { tags: { deviceId: input.deviceId } });
+	else if (deps.capabilityRegistry) {
+		const skippedForType = [];
+		for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
+			if (seenCaps.has(capName)) continue;
+			if (!capAppliesToDeviceType(deps.capabilityRegistry.getDefinition(capName), deviceType)) {
+				skippedForType.push(capName);
+				continue;
+			}
+			const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
+			if (!defaultWrapperAddonId) continue;
+			const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
+			const remoteNative = resolveRemote(capName);
+			const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
+			entries.push({
+				capName,
+				kind: "wrapped",
+				providerAddonId: defaultWrapperAddonId,
+				providerNodeId: resolveWrapperNodeId(defaultWrapperAddonId),
+				nativeAddonId
+			});
+			seenCaps.add(capName);
+		}
+		if (skippedForType.length > 0) deps.ctx.logger.debug("getBindings: default wrappers skipped — deviceTypes mismatch", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				deviceType,
+				skipped: skippedForType
+			}
+		});
+	}
+	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
+		if (seenCaps.has(capName)) continue;
+		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
+		entries.push({
+			capName,
+			kind: "native",
+			providerAddonId: nativeAddonId,
+			providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
+			nativeAddonId
+		});
+		seenCaps.add(capName);
+	}
+	const pushFed = deps.remoteNativeCaps.get(input.deviceId);
+	if (pushFed) for (const [capName, info] of pushFed) {
+		if (seenCaps.has(capName)) continue;
+		entries.push({
+			capName,
+			kind: "native",
+			providerAddonId: info.addonId,
+			providerNodeId: toRoutableProviderNodeId(info.nodeId),
+			nativeAddonId: info.addonId
+		});
+		seenCaps.add(capName);
+	}
+	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+	if (clusterCaps) for (const entry of clusterCaps) {
+		if (entry.deviceId !== input.deviceId) continue;
+		if (seenCaps.has(entry.capName)) continue;
+		if (!entry.addonId) continue;
+		const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
+		if (entry.nodeId === localNodeId) continue;
+		entries.push({
+			capName: entry.capName,
+			kind: "native",
+			providerAddonId: entry.addonId,
+			providerNodeId: toRoutableProviderNodeId(entry.nodeId),
+			nativeAddonId: entry.addonId
+		});
+		seenCaps.add(entry.capName);
+	}
+	return {
+		deviceId: input.deviceId,
+		entries
+	};
+}
+/**
+* Whole-fleet binding dump. Iterates every device known to the
+* deviceRegistry and reuses the per-device `getBindings` resolver
+* for each — same routing rules, single round-trip. Used by
+* `SystemManager.init()` for warm-boot.
+*
+* Bindings change rarely (wrapper toggle, device add/remove) so
+* clients invalidate via the existing
+* `capability.binding-changed` event rather than re-fetching this
+* payload periodically.
+*/
+async function getAllBindings(deps) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const row of await deps.rows.listAll()) ids.add(row.meta.id);
+	const registered = deps.ctx.kernel?.deviceRegistry?.getAll() ?? [];
+	for (const device of registered) ids.add(device.id);
+	if (ids.size === 0) {
+		deps.ctx.logger.warn("getAllBindings found no devices — warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
+		return [];
+	}
+	const out = [];
+	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await getBindings(deps, { deviceId }));
+	return out;
+}
+/**
+* Resolve a numeric deviceId to a stableId via persisted meta.
+* Used only by the device-identity section of the device-details
+* aggregator (see `buildBaseDeviceSection`) to surface the stableId as
+* a readonly display field. All runtime/registry lookups are keyed by
+* numeric deviceId; this helper is display-only.
+*/
+async function lookupPersistedStableId(deps, deviceId) {
+	return (await deps.rows.get(deviceId))?.meta.stableId;
+}
+//#endregion
 //#region src/builtins/device-manager/day-night-config-schema.ts
 var MODE_LABELS = {
 	auto: "Auto",
@@ -678,145 +1115,6 @@ function parseDerivedFormSettingsPatch(builderId, patch) {
 	return reducer.parsePatch(patch);
 }
 //#endregion
-//#region src/builtins/device-manager/device-aggregation-merge.ts
-/**
-* Pure aggregator-merge + field-tagging helpers for the device-manager
-* device-details aggregator. Extracted verbatim from
-* `device-manager.addon.ts`. These functions are stateless: they take
-* contributions in and return new wire-shape objects, attaching writer
-* provenance to editable fields. No addon-instance dependency.
-*
-* `mergeAggregates` is re-exported from the addon module to preserve the
-* existing public export surface the test-suite imports.
-*/
-/**
-* Walk the sections/fields of a contribution and inject `writerCapName` +
-* `writerAddonId` + `source` on each editable field. Readonly fields and
-* structural fields (separator/info/button) pass through untouched. The
-* aggregator is the single place that knows provenance — provider schemas
-* stay clean, UI-bound metadata is attached once at the boundary.
-*/
-function tagContribution(contribution, capName, addonId, kind) {
-	const source = kind === "settings" ? "settings" : "live";
-	return {
-		...contribution.tabs ? { tabs: [...contribution.tabs] } : {},
-		sections: contribution.sections.map((section) => ({
-			...section,
-			fields: section.fields.map((field) => tagField(field, capName, addonId, source, kind))
-		}))
-	};
-}
-function isFieldRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/**
-* Convert a strict `ConfigUISchemaWithValues` (readonly arrays, typed
-* field union) into the cap wire shape `ContributionShape` (mutable
-* arrays, opaque field records). Required because the cap method z.infer
-* uses mutable arrays — readonly arrays are not assignable to mutable
-* even when structurally identical, so a structural copy bridges the gap
-* without disabling the type checker.
-*/
-function toWireShape(input) {
-	const out = { sections: input.sections.map((s) => ({
-		id: s.id,
-		title: s.title,
-		...s.description !== void 0 ? { description: s.description } : {},
-		...s.style !== void 0 ? { style: s.style } : {},
-		...s.defaultCollapsed !== void 0 ? { defaultCollapsed: s.defaultCollapsed } : {},
-		...s.columns !== void 0 ? { columns: s.columns } : {},
-		...s.tab !== void 0 ? { tab: s.tab } : {},
-		...s.location !== void 0 ? { location: s.location } : {},
-		...s.order !== void 0 ? { order: s.order } : {},
-		fields: [...s.fields]
-	})) };
-	if (input.tabs) out.tabs = [...input.tabs];
-	return out;
-}
-function tagField(field, capName, addonId, source, kind) {
-	if (!isFieldRecord(field)) return field;
-	const f = field;
-	const structuralTypes = new Set([
-		"separator",
-		"info",
-		"button"
-	]);
-	if (typeof f.type === "string" && structuralTypes.has(f.type)) return field;
-	const tagged = {
-		...f,
-		source
-	};
-	if (kind === "live" || f.readonlyField === true) tagged.readonlyField = true;
-	else {
-		tagged.writerCapName = capName;
-		tagged.writerAddonId = addonId;
-	}
-	if (f.type === "group") {
-		const children = Array.isArray(f.fields) ? f.fields : [];
-		if (children.length > 0) tagged.fields = children.map((child) => tagField(child, capName, addonId, source, kind));
-	} else if (f.type === "sub-tabs") {
-		const rawTabs = Array.isArray(f.tabs) ? f.tabs : [];
-		if (rawTabs.length > 0) tagged.tabs = rawTabs.map((tab) => {
-			if (!isFieldRecord(tab)) return tab;
-			const tabChildren = Array.isArray(tab.fields) ? tab.fields : [];
-			return {
-				...tab,
-				fields: tabChildren.map((child) => tagField(child, capName, addonId, source, kind))
-			};
-		});
-	}
-	return tagged;
-}
-function mergeAggregates(parts) {
-	const tabDecls = /* @__PURE__ */ new Map();
-	const sections = [];
-	const seenSectionIds = /* @__PURE__ */ new Set();
-	for (const part of parts) {
-		if (part.tabs) {
-			for (const t of part.tabs) if (!tabDecls.has(t.id)) tabDecls.set(t.id, t);
-		}
-		for (const s of part.sections) {
-			if (s.id !== void 0) {
-				if (seenSectionIds.has(s.id)) continue;
-				seenSectionIds.add(s.id);
-			}
-			sections.push(s);
-		}
-	}
-	for (const s of sections) {
-		const tabId = s.tab ?? "general";
-		if (tabDecls.has(tabId)) continue;
-		const known = WELL_KNOWN_TAB_MAP[tabId];
-		if (known) tabDecls.set(tabId, {
-			id: known.id,
-			label: known.label,
-			icon: known.icon,
-			order: known.order
-		});
-		else tabDecls.set(tabId, {
-			id: tabId,
-			label: tabId,
-			icon: "wrench",
-			order: 100
-		});
-	}
-	sections.sort((a, b) => {
-		const tabA = a.tab ?? "general";
-		const tabB = b.tab ?? "general";
-		if (tabA !== tabB) {
-			const orderA = tabDecls.get(tabA)?.order ?? 100;
-			const orderB = tabDecls.get(tabB)?.order ?? 100;
-			if (orderA !== orderB) return orderA - orderB;
-			return tabA.localeCompare(tabB);
-		}
-		return (a.order ?? 0) - (b.order ?? 0);
-	});
-	const sortedTabs = [...tabDecls.values()].toSorted((a, b) => (a.order ?? 100) - (b.order ?? 100));
-	const out = { sections };
-	if (sortedTabs.length > 0) out.tabs = sortedTabs;
-	return out;
-}
-//#endregion
 //#region src/builtins/device-manager/device-projection.ts
 /**
 * Return true when `err` is a transient Moleculer error that is worth
@@ -948,22 +1246,15 @@ function resolveDeviceById(registry, deviceId) {
 //#region src/builtins/device-manager/device-queries.ts
 async function listPersistedByAddon(pctx, input) {
 	const { addonId } = input;
-	const { index, meta } = await pctx.metaStore.readAll();
-	const stableIds = index[addonId] ?? [];
-	const byStableId = /* @__PURE__ */ new Map();
-	for (const m of Object.values(meta)) if (m.addonId === addonId) byStableId.set(m.stableId, m);
-	return stableIds.map((stableId) => {
-		const m = byStableId.get(stableId);
-		return {
-			id: m.id,
-			stableId,
-			type: m.type,
-			name: m.name,
-			location: m.location ?? null,
-			disabled: m.disabled ?? false,
-			parentDeviceId: m.parentDeviceId
-		};
-	});
+	return (await pctx.metaStore.rows.listByAddon(addonId)).map(({ meta: m }) => ({
+		id: m.id,
+		stableId: m.stableId,
+		type: m.type,
+		name: m.name,
+		location: m.location ?? null,
+		disabled: m.disabled ?? false,
+		parentDeviceId: m.parentDeviceId
+	}));
 }
 async function listAll(pctx, input) {
 	const ownerFilter = Reflect.get(input, "addonId");
@@ -973,7 +1264,9 @@ async function listAll(pctx, input) {
 	const camerasOnly = input.isCamera === true;
 	const results = [];
 	const seen = /* @__PURE__ */ new Set();
-	const { meta, metadata: metadataMap, index } = await pctx.metaStore.readAll();
+	const fleet = addonId ? await pctx.metaStore.rows.listByAddon(addonId) : await pctx.metaStore.rows.listAll();
+	const rowById = /* @__PURE__ */ new Map();
+	for (const row of fleet) rowById.set(row.meta.id, row);
 	if (pctx.registry) {
 		const liveEntries = addonId ? pctx.registry.getAllForAddon(addonId).map((device) => ({
 			addonId,
@@ -981,7 +1274,8 @@ async function listAll(pctx, input) {
 		})) : pctx.registry.getAllWithAddonId();
 		for (const { addonId: aid, device } of liveEntries) {
 			const key = String(device.id);
-			const info = toDeviceInfo(aid, device, metadataMap[key] ?? null, meta[key] ?? null);
+			const row = rowById.get(device.id);
+			const info = toDeviceInfo(aid, device, row?.metadata ?? null, row?.meta ?? null);
 			seen.add(key);
 			if (camerasOnly && !info.isCamera) continue;
 			results.push(slim ? {
@@ -991,38 +1285,36 @@ async function listAll(pctx, input) {
 			} : info);
 		}
 	}
-	const metaByAddonStable = /* @__PURE__ */ new Map();
-	for (const m of Object.values(meta)) metaByAddonStable.set(`${m.addonId}${m.stableId}`, m);
-	const targetAddons = addonId ? [addonId] : Object.keys(index);
-	for (const aid of targetAddons) for (const stableId of index[aid] ?? []) {
-		const m = metaByAddonStable.get(`${aid}${stableId}`);
-		const key = String(m.id);
-		if (seen.has(key)) continue;
+	for (const row of fleet) {
+		const m = row.meta;
+		const aid = m.addonId;
+		const stableId = m.stableId;
+		if (seen.has(String(m.id))) continue;
 		const persistedType = m.type;
 		if (camerasOnly && persistedType !== DeviceType.Camera) continue;
 		const persistedConfig = slim ? {} : await pctx.settings.readDeviceStore(m.id);
-		const metadata = slim ? null : metadataMap[key] ?? null;
+		const metadata = slim ? null : row.metadata;
 		results.push({
 			id: m.id,
 			stableId,
 			addonId: aid,
 			type: persistedType,
-			name: m?.name ?? stableId,
-			location: m?.location ?? null,
-			disabled: m?.disabled ?? false,
-			parentDeviceId: m?.parentDeviceId ?? null,
-			role: toDeviceRole(m?.role),
+			name: m.name,
+			location: m.location ?? null,
+			disabled: m.disabled ?? false,
+			parentDeviceId: m.parentDeviceId ?? null,
+			role: toDeviceRole(m.role),
 			online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
 			probed: pctx.host.resolveDeviceProbed(m.id),
-			features: persistedFeatures(m?.features),
+			features: persistedFeatures(m.features),
 			isCamera: persistedType === DeviceType.Camera,
 			config: persistedConfig ?? {},
 			metadata,
-			...m?.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
-			...m?.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
-			...m?.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
-			...m?.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
-			...m?.display !== void 0 ? { display: m.display } : {},
+			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
+			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
+			...m.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
+			...m.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
+			...m.display !== void 0 ? { display: m.display } : {},
 			...(() => {
 				if (slim) return {};
 				const si = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
@@ -1037,19 +1329,15 @@ async function getDevice(pctx, input) {
 	if (pctx.registry) {
 		const found = resolveDeviceById(pctx.registry, deviceId);
 		if (found) {
-			const key = String(found.device.id);
-			const [map, metaMap] = await Promise.all([pctx.metaStore.readMetadataMap(), pctx.metaStore.readMeta()]);
-			const metadata = map[key] ?? null;
-			const metaRow = metaMap[key] ?? null;
-			return toDeviceInfo(found.addonId, found.device, metadata, metaRow);
+			const row = await pctx.metaStore.getRow(found.device.id);
+			return toDeviceInfo(found.addonId, found.device, row?.metadata ?? null, row?.meta ?? null);
 		}
 	}
-	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-	if (!persisted) return null;
-	const { addonId: aid, stableId, meta: m } = persisted;
+	const row = await pctx.metaStore.getRow(deviceId);
+	if (row === null) return null;
+	const { meta: m, metadata } = row;
+	const { addonId: aid, stableId } = m;
 	const persistedConfig = await pctx.settings.readDeviceStore(m.id);
-	const key = String(deviceId);
-	const metadata = (await pctx.metaStore.readMetadataMap())[key] ?? null;
 	const sourceInfoGetDevice = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
 	return {
 		id: deviceId,
@@ -1088,26 +1376,25 @@ async function getChildren(pctx, input) {
 	}
 	const results = [];
 	const seen = /* @__PURE__ */ new Set();
-	const { index, meta, metadata: metadataMap } = await pctx.metaStore.readAll();
+	const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
+	const rowById = /* @__PURE__ */ new Map();
+	for (const row of childRows) rowById.set(row.meta.id, row);
 	if (pctx.registry) {
 		const liveChildren = pctx.registry.getChildren(parentDeviceId);
 		for (const device of liveChildren) {
 			const key = String(device.id);
-			const metadata = metadataMap[key] ?? null;
-			const metaRow = meta[key] ?? null;
-			results.push(toDeviceInfo(ownerAddonId, device, metadata, metaRow));
+			const row = rowById.get(device.id);
+			results.push(toDeviceInfo(ownerAddonId, device, row?.metadata ?? null, row?.meta ?? null));
 			seen.add(key);
 		}
 	}
-	const ownerMetaByStableId = /* @__PURE__ */ new Map();
-	for (const m of Object.values(meta)) if (m.addonId === ownerAddonId) ownerMetaByStableId.set(m.stableId, m);
-	const persistedChildren = (index[ownerAddonId] ?? []).filter((sid) => ownerMetaByStableId.get(sid)?.parentDeviceId === parentDeviceId);
-	for (const childStableId of persistedChildren) {
-		const m = ownerMetaByStableId.get(childStableId);
+	for (const row of childRows) {
+		const m = row.meta;
+		const childStableId = m.stableId;
 		const key = String(m.id);
 		if (seen.has(key)) continue;
 		const persistedConfig = await pctx.settings.readDeviceStore(m.id);
-		const metadata = metadataMap[key] ?? null;
+		const metadata = row.metadata;
 		const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
 		results.push({
 			id: m.id,
@@ -1259,16 +1546,10 @@ async function remove(pctx, input) {
 */
 async function removeByIntegration(pctx, input) {
 	const { integrationId } = input;
-	const meta = await pctx.metaStore.readMeta();
-	const parentKeys = Object.keys(meta).filter((key) => {
-		const m = meta[key];
-		return m !== void 0 && m.integrationId === integrationId && m.parentDeviceId === null;
-	});
+	const parents = (await pctx.metaStore.rows.listByIntegration(integrationId)).filter((row) => row.meta.parentDeviceId === null);
 	let removed = 0;
-	for (const _key of parentKeys) {
-		const m = meta[_key];
-		if (!m) continue;
-		await pctx.provider.remove({ deviceId: m.id });
+	for (const parent of parents) {
+		await pctx.provider.remove({ deviceId: parent.meta.id });
 		removed++;
 	}
 	return { removed };
@@ -1692,316 +1973,16 @@ function splitDeviceStoreKeys(patch) {
 		}
 		if (Object.keys(slice).length > 0) storeGroups.push({
 			section,
-			patch: slice
-		});
-	}
-	const driverPatch = {};
-	for (const [key, value] of Object.entries(patch)) if (!claimed.has(key)) driverPatch[key] = value;
-	return {
-		storeGroups,
-		driverPatch
-	};
-}
-//#endregion
-//#region src/builtins/device-manager/device-bindings-store.ts
-/**
-* Wire the push-fed cross-process native-cap cache (`remoteNativeCaps`).
-* Workers emit `DeviceBindingsChanged` on `ctx.registerNativeCap` / device
-* removal; we mirror those into `remoteNativeCaps` so `getBindings` returns the
-* full cluster view. Events from the local node are ignored: hub-local natives
-* live in `capabilityRegistry` and are folded in directly by getBindings.
-*
-* Push events are accurate in the steady state but can be lost during the
-* Moleculer transport handshake window (hub restart, crash-respawn,
-* restartAddon). The reliable replacement for lost events is the D3 re-handshake
-* (`listClusterNativeCaps()`), which `resolveNativeCapOwnerSync` /
-* `getBindings` step 4 fall through to on a push miss. The `$node.disconnected`
-* handler purges a gone node's entries; the worker re-handshakes (and re-emits
-* `native-registered`) on its next boot.
-*/
-function wireRemoteNativeCapSync(ctx, remoteNativeCaps) {
-	const localNodeId = ctx.kernel.localNodeId ?? "hub";
-	ctx.eventBus.subscribe({ category: EventCategory.DeviceBindingsChanged }, (event) => {
-		const { deviceId, capName, reason, addonId, nodeId } = event.data;
-		if (nodeId === localNodeId) return;
-		if (reason === "native-registered") {
-			let perDevice = remoteNativeCaps.get(deviceId);
-			if (!perDevice) {
-				perDevice = /* @__PURE__ */ new Map();
-				remoteNativeCaps.set(deviceId, perDevice);
-			}
-			perDevice.set(capName, {
-				addonId,
-				nodeId
-			});
-		} else if (reason === "native-unregistered") {
-			const perDevice = remoteNativeCaps.get(deviceId);
-			if (!perDevice) return;
-			perDevice.delete(capName);
-			if (perDevice.size === 0) remoteNativeCaps.delete(deviceId);
-		}
-	});
-	const cluster = ctx.kernel.cluster;
-	if (cluster) cluster.broker.localBus.on("$node.disconnected", (payload) => {
-		const gone = payload.node.id;
-		const emptyDevices = [];
-		for (const [deviceId, perDevice] of remoteNativeCaps) {
-			const toDelete = [];
-			for (const [capName, entry] of perDevice) if (entry.nodeId === gone) toDelete.push(capName);
-			for (const capName of toDelete) perDevice.delete(capName);
-			if (perDevice.size === 0) emptyDevices.push(deviceId);
-		}
-		for (const deviceId of emptyDevices) remoteNativeCaps.delete(deviceId);
-	});
-}
-async function readBindingsStore(deps) {
-	return { deviceBindings: (await deps.ctx.settings.readAddonStore()).deviceBindings ?? {} };
-}
-async function writeBindingsStore(deps, next) {
-	await deps.ctx.settings.writeAddonStore({ deviceBindings: next.deviceBindings });
-}
-function resolveWrapperNodeId(_wrapperAddonId) {
-	return "hub";
-}
-/**
-* Reduce a provider node id to the routable form `DeviceProxy` can pin.
-*
-* Every addon runs in its own `addon-runner` with the composite node id
-* `${parentNodeId}/${runnerId}` (see `addon-runner.ts`) — e.g.
-* `hub/provider-reolink` or `dev-agent-0/provider-reolink`. That composite is
-* an IDENTITY, not a routable target: the `CapRouteResolver` reaches a child
-* only THROUGH its parent (the hub resolves a hub-local-uds child by
-* cap+device; an agent forwards to its own child). `DeviceProxy` pins
-* `entry.providerNodeId` on every cap call, so a binding entry must expose the
-* parent node id — otherwise the explicit pin classifies as `remote-moleculer`
-* to an unknown node → `no-provider`, which surfaces as
-* "this camera doesn't expose …" for client-proxy-driven widget caps
-* (motion-zones, privacy-mask). Wrappers already report the parent via
-* `resolveWrapperNodeId`; this aligns natives with the same contract.
-*
-* A flat node id (a genuine standalone node with no `/`) is returned
-* unchanged.
-*/
-function toRoutableProviderNodeId(nodeId) {
-	const slash = nodeId.indexOf("/");
-	return slash === -1 ? nodeId : nodeId.slice(0, slash);
-}
-/**
-* Resolve a remote native cap entry for a given `(capName, deviceId)` by
-* consulting the handshake-fed `HubNodeRegistry` via
-* `ctx.kernel.listClusterNativeCaps()`. Called when the push-based
-* `remoteNativeCaps` cache misses — covers the Moleculer transport
-* handshake window where `DeviceBindingsChanged` events were lost but the
-* D3 re-handshake (post device restore) has already populated the registry.
-*
-* Returns `null` when the entry is genuinely not present in the cluster
-* view (cap not registered on any worker for that device).
-*/
-function resolveRemoteNativeCapFromRegistry(deps, capName, deviceId) {
-	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
-	if (!clusterCaps) return null;
-	for (const entry of clusterCaps) if (entry.capName === capName && entry.deviceId === deviceId && entry.addonId) return {
-		addonId: entry.addonId,
-		nodeId: entry.nodeId
-	};
-	return null;
-}
-/**
-* Resolve the device's declared TYPE (`'camera'`, `'event-emitter'`, …), or
-* `undefined` when it cannot be established.
-*
-* The PERSISTED meta is the authority: `ctx.kernel.deviceRegistry` is hub-only
-* and has been observed empty in the very process that answers `getBindings`
-* correctly (see the note on `getAllBindings`). The registry is consulted only
-* as a secondary source, for a device constructed but not yet persisted.
-*
-* `undefined` is a first-class answer and callers must treat it as "no
-* filtering" — an absent row must never be the reason a device loses bindings.
-*/
-function resolveDeviceType(deps, rawStore, deviceId) {
-	const persisted = rawStore.deviceMeta?.[String(deviceId)]?.type;
-	if (typeof persisted === "string" && persisted.length > 0) return persisted;
-	const live = deps.ctx.kernel?.deviceRegistry?.getById(deviceId)?.type;
-	return typeof live === "string" && live.length > 0 ? live : void 0;
-}
-/**
-* Is this device still part of the fleet?
-*
-* The device-manager's own stores are the authority in-process — no RPC. Two
-* sources, in the same order `resolveDeviceType` uses them: the live registry
-* first (a device constructed but not yet persisted is present), then the
-* PERSISTED meta, which is the index `getBindings` already reads and is present
-* wherever this provider runs.
-*
-* `'absent'` is only ever returned against a NON-EMPTY meta store. An empty one
-* means device restore has not run, not that the fleet was deleted (D49) — the
-* same reason `getAllBindings` warns instead of reporting zero devices.
-*/
-function resolveDevicePresence(deps, rawStore, deviceId) {
-	if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
-	const meta = rawStore.deviceMeta;
-	if (meta && Object.keys(meta).length > 0) return meta[String(deviceId)] === void 0 ? "absent" : "present";
-	return "unknown";
-}
-/**
-* Does a capability apply to a device of type `deviceType`?
-*
-* The cap's `deviceTypes` is the ONLY declaration consulted (D4: behavioural
-* cap metadata lives in the `*.cap.ts`, never in a manifest). Two deliberate
-* fail-open cases:
-*
-*   - a cap that declares no `deviceTypes` (or an empty list) applies to every
-*     device — the pre-existing, back-compatible semantics;
-*   - an UNKNOWN `deviceType` never filters, so a missing/failed meta lookup
-*     changes nothing (D49: a read that fails must not destroy work).
-*/
-function capAppliesToDeviceType(def, deviceType) {
-	if (deviceType === void 0) return true;
-	const declared = def?.deviceTypes;
-	if (!declared || declared.length === 0) return true;
-	return declared.some((t) => t === deviceType);
-}
-async function getBindings(deps, input) {
-	const storeKey = String(input.deviceId);
-	const rawStore = await deps.ctx.settings.readAddonStore();
-	const perDevice = (rawStore.deviceBindings ?? {})[storeKey] ?? {};
-	const deviceType = resolveDeviceType(deps, rawStore, input.deviceId);
-	const presence = resolveDevicePresence(deps, rawStore, input.deviceId);
-	const entries = [];
-	const seenCaps = /* @__PURE__ */ new Set();
-	const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
-	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
-		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
-		const remoteNative = resolveRemote(capName);
-		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
-		const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
-		if (wrapperAddonId === null && !nativeAddonId) {
-			seenCaps.add(capName);
-			continue;
-		}
-		entries.push({
-			capName,
-			kind: wrapperAddonId ? "wrapped" : "native",
-			providerAddonId: wrapperAddonId ?? nativeAddonId,
-			providerNodeId: wrapperAddonId ? resolveWrapperNodeId(wrapperAddonId) : toRoutableProviderNodeId(nativeNodeId),
-			nativeAddonId
-		});
-		seenCaps.add(capName);
-	}
-	if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device — returning none", { tags: { deviceId: input.deviceId } });
-	else if (deps.capabilityRegistry) {
-		const skippedForType = [];
-		for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
-			if (seenCaps.has(capName)) continue;
-			if (!capAppliesToDeviceType(deps.capabilityRegistry.getDefinition(capName), deviceType)) {
-				skippedForType.push(capName);
-				continue;
-			}
-			const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
-			if (!defaultWrapperAddonId) continue;
-			const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
-			const remoteNative = resolveRemote(capName);
-			const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
-			entries.push({
-				capName,
-				kind: "wrapped",
-				providerAddonId: defaultWrapperAddonId,
-				providerNodeId: resolveWrapperNodeId(defaultWrapperAddonId),
-				nativeAddonId
-			});
-			seenCaps.add(capName);
-		}
-		if (skippedForType.length > 0) deps.ctx.logger.debug("getBindings: default wrappers skipped — deviceTypes mismatch", {
-			tags: { deviceId: input.deviceId },
-			meta: {
-				deviceType,
-				skipped: skippedForType
-			}
-		});
-	}
-	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
-		if (seenCaps.has(capName)) continue;
-		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
-		entries.push({
-			capName,
-			kind: "native",
-			providerAddonId: nativeAddonId,
-			providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
-			nativeAddonId
-		});
-		seenCaps.add(capName);
-	}
-	const pushFed = deps.remoteNativeCaps.get(input.deviceId);
-	if (pushFed) for (const [capName, info] of pushFed) {
-		if (seenCaps.has(capName)) continue;
-		entries.push({
-			capName,
-			kind: "native",
-			providerAddonId: info.addonId,
-			providerNodeId: toRoutableProviderNodeId(info.nodeId),
-			nativeAddonId: info.addonId
-		});
-		seenCaps.add(capName);
-	}
-	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
-	if (clusterCaps) for (const entry of clusterCaps) {
-		if (entry.deviceId !== input.deviceId) continue;
-		if (seenCaps.has(entry.capName)) continue;
-		if (!entry.addonId) continue;
-		const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
-		if (entry.nodeId === localNodeId) continue;
-		entries.push({
-			capName: entry.capName,
-			kind: "native",
-			providerAddonId: entry.addonId,
-			providerNodeId: toRoutableProviderNodeId(entry.nodeId),
-			nativeAddonId: entry.addonId
+			patch: slice
 		});
-		seenCaps.add(entry.capName);
 	}
+	const driverPatch = {};
+	for (const [key, value] of Object.entries(patch)) if (!claimed.has(key)) driverPatch[key] = value;
 	return {
-		deviceId: input.deviceId,
-		entries
+		storeGroups,
+		driverPatch
 	};
 }
-/**
-* Whole-fleet binding dump. Iterates every device known to the
-* deviceRegistry and reuses the per-device `getBindings` resolver
-* for each — same routing rules, single round-trip. Used by
-* `SystemManager.init()` for warm-boot.
-*
-* Bindings change rarely (wrapper toggle, device add/remove) so
-* clients invalidate via the existing
-* `capability.binding-changed` event rather than re-fetching this
-* payload periodically.
-*/
-async function getAllBindings(deps) {
-	const store = await deps.ctx.settings.readAddonStore();
-	const ids = /* @__PURE__ */ new Set();
-	for (const key of Object.keys(store.deviceMeta ?? {})) {
-		const id = Number(key);
-		if (Number.isInteger(id)) ids.add(id);
-	}
-	const registered = deps.ctx.kernel?.deviceRegistry?.getAll() ?? [];
-	for (const device of registered) ids.add(device.id);
-	if (ids.size === 0) {
-		deps.ctx.logger.warn("getAllBindings found no devices — warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
-		return [];
-	}
-	const out = [];
-	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await getBindings(deps, { deviceId }));
-	return out;
-}
-/**
-* Resolve a numeric deviceId to a stableId via persisted meta.
-* Used only by the device-identity section of the device-details
-* aggregator (see `buildBaseDeviceSection`) to surface the stableId as
-* a readonly display field. All runtime/registry lookups are keyed by
-* numeric deviceId; this helper is display-only.
-*/
-async function lookupPersistedStableId(deps, deviceId) {
-	return ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.stableId;
-}
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
@@ -2790,7 +2771,7 @@ async function getWireableFields(deps, input) {
 		if (wireable) caps.push(wireable);
 	}
 	if (input.includeSynthesizable === true) {
-		const deviceType = ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.type;
+		const deviceType = (await deps.bindingsDeps.rows.get(deviceId))?.meta.type;
 		if (deviceType !== void 0) for (const def of ALL_CAPABILITY_DEFINITIONS) {
 			if (seen.has(def.name)) continue;
 			if (def.scope !== "device" || def.kind === "wrapper") continue;
@@ -2944,20 +2925,10 @@ var DeviceEventPropagator = class {
 * because `ProviderContext.stampIntegrationId` delegates HERE — passing the
 * context would be a capture cycle.
 */
-async function stampIntegrationId(metaStore, settings, ctx, deviceId, integrationId) {
+async function stampIntegrationId(metaStore, ctx, deviceId, integrationId) {
 	await metaStore.withMetaWriteLock(async () => {
-		const persisted = await metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] stampIntegrationId: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await metaStore.readMeta();
-		await settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				integrationId
-			}
-		} });
+		if (!await metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] stampIntegrationId: unknown device id=${deviceId}`);
+		await metaStore.rows.patch(deviceId, { integrationId });
 	});
 	ctx.eventBus.emit({
 		id: randomUUID(),
@@ -2977,70 +2948,54 @@ async function stampIntegrationId(metaStore, settings, ctx, deviceId, integratio
 async function allocateDeviceId(pctx, input) {
 	const { addonId, stableId } = input;
 	return await pctx.metaStore.withMetaWriteLock(async () => {
-		const meta = await pctx.metaStore.readMeta();
-		const existing = Object.values(meta).find((m) => m.addonId === addonId && m.stableId === stableId);
-		if (existing) return { id: existing.id };
+		const existing = await pctx.metaStore.rows.findByStableId(addonId, stableId);
+		if (existing) return { id: existing.meta.id };
 		const id = await pctx.metaStore.allocateNextDeviceId();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...meta,
-			[String(id)]: {
-				addonId,
-				stableId,
-				type: "generic",
-				name: stableId,
-				location: null,
-				disabled: false,
-				parentDeviceId: null,
-				id
-			}
-		} });
+		await pctx.metaStore.rows.upsert({
+			addonId,
+			stableId,
+			type: "generic",
+			name: stableId,
+			location: null,
+			disabled: false,
+			parentDeviceId: null,
+			id
+		}, {
+			registered: false,
+			metadata: null
+		});
 		return { id };
 	});
 }
 async function registerDevice(pctx, input) {
 	const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
-	const key = String(id);
 	const featuresArr = Array.isArray(features) ? [...features] : [];
 	const { isFirstRegistration, exportFingerprint, fingerprintChanged } = await pctx.metaStore.withMetaWriteLock(async () => {
-		const index = await pctx.metaStore.readIndex();
-		const existing = index[addonId] ?? [];
-		const wasInIndex = existing.includes(stableId);
-		if (!wasInIndex) await pctx.settings.writeAddonStore({ deviceIndex: {
-			...index,
-			[addonId]: [...existing, stableId]
-		} });
-		const meta = await pctx.metaStore.readMeta();
-		const existingMeta = meta[key];
+		const existingRow = await pctx.metaStore.rows.get(id);
+		const existingMeta = existingRow?.meta;
+		const wasRegistered = existingRow?.registered ?? false;
 		const wasUserNamed = existingMeta?.userNamed ?? (existingMeta !== void 0 && existingMeta.name !== stableId);
 		const resolvedName = wasUserNamed && existingMeta !== void 0 ? existingMeta.name : name;
-		const isFirst = !existingMeta || !wasInIndex;
+		const isFirst = !existingMeta || !wasRegistered;
 		const fingerprint = canonicalDeviceFingerprint({
 			deviceId: id,
 			deviceType: type,
 			features: featuresArr
 		});
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...meta,
-			[key]: {
-				addonId,
-				stableId,
-				type,
-				name: resolvedName,
-				userNamed: wasUserNamed,
-				location: existingMeta?.location ?? null,
-				disabled: existingMeta?.disabled ?? false,
-				...existingMeta?.integrationId !== void 0 ? { integrationId: existingMeta.integrationId } : {},
-				...existingMeta?.linkDeviceId !== void 0 ? { linkDeviceId: existingMeta.linkDeviceId } : {},
-				...existingMeta?.primaryChildEntityId !== void 0 ? { primaryChildEntityId: existingMeta.primaryChildEntityId } : {},
-				...existingMeta?.childLayout !== void 0 ? { childLayout: existingMeta.childLayout } : {},
-				...existingMeta?.role !== void 0 ? { role: existingMeta.role } : {},
-				...existingMeta?.display !== void 0 ? { display: existingMeta.display } : {},
-				parentDeviceId,
-				id,
-				features: featuresArr,
-				exportFingerprint: fingerprint
-			}
-		} });
+		await pctx.metaStore.rows.upsertRegistration({
+			deviceId: id,
+			addonId,
+			stableId,
+			type,
+			name: resolvedName,
+			userNamed: wasUserNamed,
+			location: existingMeta?.location ?? null,
+			disabled: existingMeta?.disabled ?? false,
+			parentDeviceId: parentDeviceId ?? null,
+			registered: true,
+			features: featuresArr,
+			exportFingerprint: fingerprint
+		});
 		return {
 			isFirstRegistration: isFirst,
 			exportFingerprint: fingerprint,
@@ -3100,26 +3055,9 @@ async function removeDevice(pctx, input) {
 	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
 	if (!persisted) return;
 	const { addonId, stableId, meta: persistedMeta } = persisted;
-	const key = String(deviceId);
 	const deviceName = persistedMeta.name;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const index = await pctx.metaStore.readIndex();
-		const remaining = (index[addonId] ?? []).filter((sid) => sid !== stableId);
-		const updatedIndex = remaining.length > 0 ? {
-			...index,
-			[addonId]: remaining
-		} : (() => {
-			const { [addonId]: _removed, ...rest } = index;
-			return rest;
-		})();
-		await pctx.settings.writeAddonStore({ deviceIndex: updatedIndex });
-		const { [key]: _removedMeta, ...restMeta } = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: restMeta });
-		const map = await pctx.metaStore.readMetadataMap();
-		if (key in map) {
-			const { [key]: _removedMetadata, ...restMap } = map;
-			await pctx.settings.writeAddonStore({ deviceMetadata: restMap });
-		}
+		await pctx.metaStore.rows.remove(deviceId);
 	});
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -3175,11 +3113,10 @@ async function loadConfig(pctx, input) {
 */
 async function loadMeta(pctx, input) {
 	const { deviceId } = input;
-	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-	if (!persisted) return null;
-	const { addonId, stableId, meta: m } = persisted;
-	const key = String(deviceId);
-	const metadata = (await pctx.metaStore.readMetadataMap())[key] ?? null;
+	const row = await pctx.metaStore.getRow(deviceId);
+	if (row === null) return null;
+	const { meta: m, metadata } = row;
+	const { addonId, stableId } = m;
 	return {
 		id: m.id,
 		stableId,
@@ -3209,32 +3146,26 @@ async function setName(pctx, input) {
 		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
 		if (!persisted) throw new Error(`[device-manager] setName: unknown device id=${deviceId}`);
 		const { meta: m } = persisted;
-		const key = String(deviceId);
 		const oldName = m.name;
-		const allMeta = await pctx.metaStore.readMeta();
-		const nextMeta = {
-			...allMeta,
-			[key]: {
-				...m,
-				name,
-				userNamed: true
+		await pctx.metaStore.rows.patch(deviceId, {
+			name,
+			userNamed: true
+		});
+		if (oldName.length > 0 && oldName !== name) {
+			const candidates = /* @__PURE__ */ new Map();
+			for (const row of await pctx.metaStore.rows.listByParent(deviceId)) candidates.set(row.meta.id, row.meta);
+			for (const row of await pctx.metaStore.rows.listAll()) if (row.meta.linkDeviceId === deviceId) candidates.set(row.meta.id, row.meta);
+			candidates.delete(deviceId);
+			for (const childMeta of candidates.values()) {
+				if (childMeta.name !== oldName && !childMeta.name.startsWith(`${oldName} `)) continue;
+				const childName = childMeta.name === oldName ? name : `${name}${childMeta.name.slice(oldName.length)}`;
+				await pctx.metaStore.rows.patch(childMeta.id, { name: childName });
+				cascaded.push({
+					id: childMeta.id,
+					name: childName
+				});
 			}
-		};
-		if (oldName.length > 0 && oldName !== name) for (const [childKey, childMeta] of Object.entries(allMeta)) {
-			if (childKey === key) continue;
-			if (!(childMeta.parentDeviceId === deviceId || childMeta.linkDeviceId === deviceId)) continue;
-			if (childMeta.name !== oldName && !childMeta.name.startsWith(`${oldName} `)) continue;
-			const childName = childMeta.name === oldName ? name : `${name}${childMeta.name.slice(oldName.length)}`;
-			nextMeta[childKey] = {
-				...childMeta,
-				name: childName
-			};
-			cascaded.push({
-				id: Number(childKey),
-				name: childName
-			});
 		}
-		await pctx.settings.writeAddonStore({ deviceMeta: nextMeta });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3274,18 +3205,8 @@ async function setName(pctx, input) {
 async function setLocation(pctx, input) {
 	const { deviceId, location } = input;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setLocation: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				location
-			}
-		} });
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setLocation: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, { location });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3312,18 +3233,8 @@ async function setLocation(pctx, input) {
 async function setType(pctx, input) {
 	const { deviceId, type } = input;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setType: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				type
-			}
-		} });
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setType: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, { type });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3358,18 +3269,8 @@ async function setIntegrationId(pctx, input) {
 async function setLinkDeviceId(pctx, input) {
 	const { deviceId, linkDeviceId } = input;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setLinkDeviceId: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				linkDeviceId
-			}
-		} });
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setLinkDeviceId: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, { linkDeviceId });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3396,18 +3297,8 @@ async function setLinkDeviceId(pctx, input) {
 async function setPrimaryChildEntityId(pctx, input) {
 	const { deviceId, primaryChildEntityId } = input;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setPrimaryChildEntityId: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				primaryChildEntityId
-			}
-		} });
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setPrimaryChildEntityId: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, { primaryChildEntityId });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3433,18 +3324,8 @@ async function setPrimaryChildEntityId(pctx, input) {
 async function setChildLayout(pctx, input) {
 	const { deviceId, childLayout } = input;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setChildLayout: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				childLayout
-			}
-		} });
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setChildLayout: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, { childLayout });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3470,18 +3351,8 @@ async function setChildLayout(pctx, input) {
 async function setRole(pctx, input) {
 	const { deviceId, role } = input;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setRole: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				role
-			}
-		} });
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setRole: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, { role });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3526,19 +3397,8 @@ async function setDisplay(pctx, input) {
 	const { deviceId, display } = input;
 	const normalized = display === null ? null : normalizeDisplayOverride(display);
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setDisplay: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		const nextRow = normalized === null ? (({ display: _drop, ...rest }) => rest)(m) : {
-			...m,
-			display: normalized
-		};
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: nextRow
-		} });
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setDisplay: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, { display: normalized });
 	});
 	pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
@@ -3566,7 +3426,7 @@ async function getRoleDisplayDefaults(pctx, _input) {
 * Replace the per-role display defaults whole-record (full replace). Override
 * units are normalized (`normalizeUnit`) at write so the render path always
 * looks up canonical spellings. Single-writer top-level key — no lock, no RMW,
-* no interaction with the `deviceMeta` write lock. Not per-device, so no event
+* no interaction with the device write lock. Not per-device, so no event
 * is emitted; the UI invalidates its own query on mutate.
 */
 async function setRoleDisplayDefaults(pctx, input) {
@@ -3579,7 +3439,7 @@ async function setRoleDisplayDefaults(pctx, input) {
 /**
 * Batched meta pre-seed. Applies every provided field to the
 * device's meta row in ONE read-modify-write under a single
-* `withMetaWriteLock` acquisition (one `deviceMeta` blob write),
+* `withMetaWriteLock` acquisition (one row write),
 * then emits one `DeviceMetaChanged` event per field that was
 * supplied — preserving the exact semantics of the individual
 * setters (`setName` / `setLocation` / `setType` /
@@ -3595,24 +3455,15 @@ async function setRoleDisplayDefaults(pctx, input) {
 async function applyInitialMeta(pctx, input) {
 	const { deviceId, name, location, type, integrationId, linkDeviceId, role } = input;
 	await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] applyInitialMeta: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		const merged = {
-			...m,
+		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] applyInitialMeta: unknown device id=${deviceId}`);
+		await pctx.metaStore.rows.patch(deviceId, {
 			...name !== void 0 ? { name } : {},
 			...location !== void 0 ? { location } : {},
 			...type !== void 0 ? { type } : {},
 			...integrationId !== void 0 ? { integrationId } : {},
 			...linkDeviceId !== void 0 ? { linkDeviceId } : {},
 			...role !== void 0 ? { role } : {}
-		};
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: merged
-		} });
+		});
 	});
 	const emitMetaChanged = (field, value) => {
 		pctx.host.ctx.eventBus.emit({
@@ -3648,10 +3499,9 @@ async function applyInitialMeta(pctx, input) {
 async function setMetadata(pctx, input) {
 	const { deviceId, patch } = input;
 	const result = await pctx.metaStore.withMetaWriteLock(async () => {
-		if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setMetadata: unknown device id=${deviceId}`);
-		const key = String(deviceId);
-		const map = await pctx.metaStore.readMetadataMap();
-		const next = { ...map[key] ?? {} };
+		const row = await pctx.metaStore.rows.get(deviceId);
+		if (row === null) throw new Error(`[device-manager] setMetadata: unknown device id=${deviceId}`);
+		const next = { ...row.metadata ?? {} };
 		let changed = false;
 		for (const [k, v] of Object.entries(patch)) if (v === null) {
 			if (k in next) {
@@ -3664,10 +3514,7 @@ async function setMetadata(pctx, input) {
 		}
 		if (!changed) return { changed: false };
 		const hasFields = Object.keys(next).length > 0;
-		const updatedMap = { ...map };
-		if (hasFields) updatedMap[key] = next;
-		else delete updatedMap[key];
-		await pctx.settings.writeAddonStore({ deviceMetadata: updatedMap });
+		await pctx.metaStore.rows.patch(deviceId, { metadata: hasFields ? next : null });
 		return {
 			changed: true,
 			finalMeta: hasFields ? next : null
@@ -3713,15 +3560,7 @@ async function setDisabled(pctx, input) {
 		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
 		if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
 		const { meta: m } = persisted;
-		const key = String(deviceId);
-		const allMeta = await pctx.metaStore.readMeta();
-		await pctx.settings.writeAddonStore({ deviceMeta: {
-			...allMeta,
-			[key]: {
-				...m,
-				disabled
-			}
-		} });
+		await pctx.metaStore.rows.patch(deviceId, { disabled });
 		return {
 			changed: (m.disabled ?? false) !== disabled,
 			integrationId: m.integrationId ?? ""
@@ -3771,9 +3610,7 @@ async function loadRuntimeState(pctx, input) {
 * location autocomplete.
 */
 async function listLocations(pctx) {
-	const store = await pctx.settings.readAddonStore();
-	const meta = store.deviceMeta ?? {};
-	const locations = store.locations ?? [];
+	const locations = (await pctx.metaStore.readStore()).locations ?? [];
 	const seen = /* @__PURE__ */ new Map();
 	const consider = (raw) => {
 		if (typeof raw !== "string") return;
@@ -3783,7 +3620,7 @@ async function listLocations(pctx) {
 		if (!seen.has(key)) seen.set(key, trimmed);
 	};
 	for (const label of locations) consider(label);
-	for (const m of Object.values(meta)) consider(m.location);
+	for (const row of await pctx.metaStore.rows.listAll()) consider(row.meta.location);
 	return [...seen.values()].toSorted((a, b) => a.localeCompare(b, void 0, { sensitivity: "base" }));
 }
 /**
@@ -3795,7 +3632,7 @@ async function listLocations(pctx) {
 async function addLocation(pctx, input) {
 	const trimmed = input.name.trim();
 	if (trimmed.length === 0) throw new Error("[device-manager] addLocation: name must be non-empty");
-	const current = (await pctx.settings.readAddonStore()).locations ?? [];
+	const current = (await pctx.metaStore.readStore()).locations ?? [];
 	if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
 	await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
 }
@@ -3811,25 +3648,21 @@ async function addLocation(pctx, input) {
 async function removeLocation(pctx, input) {
 	const trimmed = input.name.trim();
 	if (trimmed.length === 0) return;
-	const store = await pctx.settings.readAddonStore();
-	const current = store.locations ?? [];
+	const current = (await pctx.metaStore.readStore()).locations ?? [];
 	const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
 	if (remaining.length !== current.length) await pctx.settings.writeAddonStore({ locations: remaining });
 	if (input.cascade !== true) return;
-	const meta = store.deviceMeta ?? {};
-	const updates = { ...meta };
-	const cleared = [];
-	for (const [key, m] of Object.entries(meta)) {
-		if (typeof m.location !== "string") continue;
-		if (m.location.trim().toLowerCase() !== trimmed.toLowerCase()) continue;
-		updates[key] = {
-			...m,
-			location: null
-		};
-		cleared.push(m.id);
-	}
-	if (cleared.length === 0) return;
-	await pctx.settings.writeAddonStore({ deviceMeta: updates });
+	const cleared = await pctx.metaStore.withMetaWriteLock(async () => {
+		const out = [];
+		for (const row of await pctx.metaStore.rows.listAll()) {
+			const location = row.meta.location;
+			if (typeof location !== "string") continue;
+			if (location.trim().toLowerCase() !== trimmed.toLowerCase()) continue;
+			await pctx.metaStore.rows.patch(row.meta.id, { location: null });
+			out.push(row.meta.id);
+		}
+		return out;
+	});
 	for (const deviceId of cleared) pctx.host.ctx.eventBus.emit({
 		id: randomUUID(),
 		timestamp: /* @__PURE__ */ new Date(),
@@ -3846,42 +3679,58 @@ async function removeLocation(pctx, input) {
 	});
 }
 //#endregion
+//#region src/builtins/device-manager/device-meta-types.ts
+/**
+* Decode the raw `ctx.settings.readAddonStore()` record into {@link AddonStore}.
+*
+* A field of the wrong shape reads as ABSENT rather than being trusted through
+* a cast: the store is JSON on disk and a hand-edit or a partial restore must
+* cost the caller its default, never a downstream `TypeError`.
+*/
+function decodeAddonStore(raw) {
+	const nextDeviceId = raw["nextDeviceId"];
+	const locations = raw["locations"];
+	const roleDisplayDefaults = raw["roleDisplayDefaults"];
+	return {
+		...typeof nextDeviceId === "number" && Number.isFinite(nextDeviceId) ? { nextDeviceId } : {},
+		...Array.isArray(locations) ? { locations: locations.filter((l) => typeof l === "string") } : {},
+		...isRoleDisplayDefaults(roleDisplayDefaults) ? { roleDisplayDefaults } : {}
+	};
+}
+function isRoleDisplayDefaults(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//#endregion
 //#region src/builtins/device-manager/device-meta-store.ts
 var DeviceMetaStore = class {
 	settings;
 	registry;
+	rows;
 	/** Synchronous ownership cache, keyed by NUMERIC deviceId → owning addonId.
-	*  The persisted meta store is authoritative but reads are async; hub-side
+	*  The persisted row store is authoritative but reads are async; hub-side
 	*  callers (e.g. `CapabilityRegistry.getNativeProvider` fallback) need
 	*  ownership without awaiting. Kept in sync with every register/remove and
 	*  warmed from persistence on boot. */
 	idToAddonId = /* @__PURE__ */ new Map();
-	/** Serialises every read-modify-write of the deviceMeta / deviceIndex blob
-	*  through one promise chain (see `withMetaWriteLock`). Per-instance state —
-	*  identical to the former `onInitialize` closure variable. */
+	/** Serialises every read-modify-write of a device row through one promise
+	*  chain (see `withMetaWriteLock`). Per-instance state. */
 	metaWriteChain = Promise.resolve();
-	constructor(settings, registry) {
+	constructor(settings, registry, rows) {
 		this.settings = settings;
 		this.registry = registry;
+		this.rows = rows;
 	}
 	/** The read currently in flight, or null. Never a settled value — see
 	*  {@link readStore}. */
 	inFlightRead = null;
 	/**
-	* The whole persisted addon store.
+	* The addon's own settings row set — `nextDeviceId`, `roleDisplayDefaults`,
+	* `locations`. NOT the fleet: no device has lived here since the flatten.
 	*
 	* **Concurrent callers join the read already in flight.** This is not a
 	* cache and nothing survives settlement: a caller that awaited the running
 	* promise could not have observed anything older than its result, so the
-	* only thing that changes is cost. What that cost was, measured on the
-	* 2026-08-19 boot: `readAddonStore` lands in `SqliteSettingsBackend
-	* .getAllAddon`, which reads and `JSON.parse`s this addon's rows —
-	* 625 KB on the live hub (`deviceMeta` 467 KB + `deviceMetadata` 87 KB +
-	* `deviceIndex` 70 KB) — synchronously, on the hub's event loop. A V8
-	* profile of that boot had hub-main's JS thread 99.9% busy with 64% of it
-	* inside `getAllAddon`, ~89% of that entered here, and every runner's first
-	* store read queued behind it (the notification centre's six parallel reads
-	* all resolved together at t+44.7 s).
+	* only thing that changes is cost.
 	*
 	* A rejection is NOT latched: the slot is cleared before the promise
 	* settles either way, so a failed read costs the joiners that one failure
@@ -3892,7 +3741,7 @@ var DeviceMetaStore = class {
 		if (existing !== null) return existing;
 		const read = (async () => {
 			try {
-				return await this.settings.readAddonStore();
+				return decodeAddonStore(await this.settings.readAddonStore());
 			} finally {
 				this.inFlightRead = null;
 			}
@@ -3900,41 +3749,6 @@ var DeviceMetaStore = class {
 		this.inFlightRead = read;
 		return read;
 	};
-	/**
-	* The three fleet projections from ONE read.
-	*
-	* `listAll` asked for `deviceMeta`, then `deviceMetadata`, then
-	* `deviceIndex` — three SEQUENTIAL awaits, which {@link readStore}'s
-	* in-flight join cannot collapse because each starts after the previous one
-	* settled. Three full 625 KB parses per call, on a call made once per device
-	* lifecycle event during a 974-device boot: 23% of hub-main's CPU.
-	*
-	* It is also ONE snapshot. Three separate reads could straddle a write and
-	* hand back an index that names a device the meta map no longer has.
-	*/
-	readAll = async () => {
-		const store = await this.readStore();
-		return {
-			index: store.deviceIndex ?? {},
-			meta: store.deviceMeta ?? {},
-			metadata: store.deviceMetadata ?? {}
-		};
-	};
-	readIndex = async () => {
-		return (await this.readStore()).deviceIndex ?? {};
-	};
-	readMeta = async () => {
-		return (await this.readStore()).deviceMeta ?? {};
-	};
-	/** Hardware-identity metadata map. Lives in a sibling key on the
-	*  device-manager addon store so its writers (`setMetadata`) never
-	*  collide with the lifecycle writers on `deviceMeta`
-	*  (`registerDevice` / `setName` / `setLocation` / `setDisabled`).
-	*  Single-writer per row eliminates the "writer X clobbers writer
-	*  Y's field" bug class — `setMetadata` is the only producer. */
-	readMetadataMap = async () => {
-		return (await this.readStore()).deviceMetadata ?? {};
-	};
 	withMetaWriteLock = async (fn) => {
 		const previous = this.metaWriteChain;
 		let release = () => {};
@@ -3949,31 +3763,36 @@ var DeviceMetaStore = class {
 			release();
 		}
 	};
+	/** The whole persisted row for one device, or `null`. */
+	getRow = async (deviceId) => this.rows.get(deviceId);
 	/**
 	* Resolve a numeric deviceId to the owning `(addonId, stableId)` pair.
-	* Scans persisted meta — live IDevice lookup (hub registry) is handled
+	* Reads the device's own row — live IDevice lookup (hub registry) is handled
 	* separately per call site so callers can decide whether to route to
 	* an in-process driver or to the cross-process `device-ops` bridge.
 	* Returns null when no device with that id is known to the hub.
 	*/
 	resolvePersistedById = async (deviceId) => {
-		const m = (await this.readMeta())[String(deviceId)];
-		if (!m) return null;
+		const row = await this.rows.get(deviceId);
+		if (row === null) return null;
 		return {
-			addonId: m.addonId,
-			stableId: m.stableId,
-			meta: m
+			addonId: row.meta.addonId,
+			stableId: row.meta.stableId,
+			meta: row.meta
 		};
 	};
+	/** The device's hardware-identity metadata blob, or `null`. */
+	readMetadata = async (deviceId) => {
+		return (await this.rows.get(deviceId))?.metadata ?? null;
+	};
 	/** Direct children of a device: the union of the live registry's children
-	*  and the persisted-meta scan (`parentDeviceId === parentId`), deduplicated
+	*  and the persisted rows whose `parentDeviceId` is `parentId`, deduplicated
 	*  and excluding self. Shared by the `remove` cascade and the `resetToSource`
 	*  resync purge (#19). */
 	directChildIds = async (parentId) => {
 		const ids = /* @__PURE__ */ new Set();
 		if (this.registry) for (const c of this.registry.getChildren(parentId)) ids.add(c.id);
-		const meta = await this.readMeta();
-		for (const m of Object.values(meta)) if (m.parentDeviceId === parentId) ids.add(m.id);
+		for (const row of await this.rows.listByParent(parentId)) ids.add(row.meta.id);
 		ids.delete(parentId);
 		return [...ids];
 	};
@@ -3984,6 +3803,525 @@ var DeviceMetaStore = class {
 	};
 };
 //#endregion
+//#region src/builtins/device-manager/device-row-store.ts
+/**
+* @durable class=registry owner=device-manager
+*   write="one row per device, written by `allocateDeviceId` (identity placeholder),
+*     `registerDevice` (full reconcile) and every meta setter (single-column patch);
+*     `setMetadata` patches the `metadata` column of the same row"
+*   retention="none — a row goes only when the operator removes the device
+*     (`removeDevice`), or when an integration is deleted and cascades. Bounded by the
+*     fleet an operator configures (974 rows on the reference hub)."
+*/
+var DEVICE_ROWS_COLLECTION = "device-manager:devices";
+/**
+* Fleet reads pass this explicitly.
+*
+* `settings-store.query` applies a DEFAULT row cap of 2 000 when the caller
+* names no `limit` (`query-bounds.ts`), and truncation there is silent to the
+* caller — it warns in the engine's log and returns a short list that looks
+* complete. The reference hub is already at 974 devices; half the default cap
+* is not a margin worth betting the fleet listing on. 20 000 is the engine's
+* hard ceiling, so this asks for everything the engine will ever serve in one
+* call and any future need to page is a loud failure rather than a quiet one.
+*/
+var DEVICE_ROWS_FLEET_LIMIT = 2e4;
+var DEVICE_ROWS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "addonId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "stableId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "type",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "userNamed",
+		type: "BOOLEAN"
+	},
+	{
+		name: "location",
+		type: "TEXT"
+	},
+	{
+		name: "disabled",
+		type: "BOOLEAN",
+		notNull: true,
+		defaultValue: false
+	},
+	{
+		name: "parentDeviceId",
+		type: "INTEGER"
+	},
+	{
+		name: "registered",
+		type: "BOOLEAN",
+		notNull: true,
+		defaultValue: false
+	},
+	{
+		name: "features",
+		type: "JSON"
+	},
+	{
+		name: "exportFingerprint",
+		type: "TEXT"
+	},
+	{
+		name: "integrationId",
+		type: "TEXT"
+	},
+	{
+		name: "linkDeviceId",
+		type: "INTEGER"
+	},
+	{
+		name: "primaryChildEntityId",
+		type: "TEXT"
+	},
+	{
+		name: "childLayout",
+		type: "JSON"
+	},
+	{
+		name: "role",
+		type: "TEXT"
+	},
+	{
+		name: "display",
+		type: "JSON"
+	},
+	{
+		name: "metadata",
+		type: "JSON"
+	}
+];
+var DEVICE_ROWS_INDEXES = [
+	{
+		name: "idx_dm_devices_addon_stable",
+		columns: ["addonId", "stableId"]
+	},
+	{
+		name: "idx_dm_devices_parent",
+		columns: ["parentDeviceId"]
+	},
+	{
+		name: "idx_dm_devices_integration",
+		columns: ["integrationId"]
+	}
+];
+/** Adapt `ctx.api.settingsStore` (tRPC namespace) to {@link DeviceRowBackend}. */
+function deviceRowBackendOf(client) {
+	return {
+		declareCollection: async (input) => {
+			await client.declareCollection.mutate(input);
+		},
+		get: (input) => client.get.query(input),
+		set: async (input) => {
+			await client.set.mutate(input);
+		},
+		query: (input) => client.query.query(input),
+		updateWhere: (input) => client.updateWhere.mutate(input),
+		delete: async (input) => {
+			await client.delete.mutate(input);
+		},
+		count: (input) => client.count.query(input)
+	};
+}
+function isPlainObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function readNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function readBoolean(value) {
+	if (typeof value === "boolean") return value;
+	if (value === 1) return true;
+	if (value === 0) return false;
+}
+function readStringArray(value) {
+	if (!Array.isArray(value)) return void 0;
+	const out = [];
+	for (const entry of value) if (typeof entry === "string") out.push(entry);
+	return out;
+}
+/**
+* Decode one stored row.
+*
+* Returns `null` for a row missing an identity field the rest of the system
+* treats as an invariant (`deviceId` / `addonId` / `stableId` / `type` /
+* `name`). A row like that cannot be projected into a `DeviceInfo` and taking
+* the whole fleet read down for it would be worse — the caller logs the skip.
+*/
+function decodeDeviceRow(data) {
+	const deviceId = readNumber(data["deviceId"]);
+	const addonId = readString(data["addonId"]);
+	const stableId = readString(data["stableId"]);
+	const type = readString(data["type"]);
+	const name = readString(data["name"]);
+	if (deviceId === void 0 || addonId === void 0 || stableId === void 0 || type === void 0 || name === void 0) return null;
+	const location = readString(data["location"]);
+	const parentDeviceId = readNumber(data["parentDeviceId"]);
+	const userNamed = readBoolean(data["userNamed"]);
+	const features = readStringArray(data["features"]);
+	const exportFingerprint = readString(data["exportFingerprint"]);
+	const integrationId = readString(data["integrationId"]);
+	const linkDeviceId = readNumber(data["linkDeviceId"]);
+	const primaryChildEntityId = readString(data["primaryChildEntityId"]);
+	const role = readString(data["role"]);
+	const rawChildLayout = data["childLayout"];
+	const rawDisplay = data["display"];
+	const rawMetadata = data["metadata"];
+	return {
+		meta: {
+			id: deviceId,
+			addonId,
+			stableId,
+			type,
+			name,
+			location: location ?? null,
+			disabled: readBoolean(data["disabled"]) ?? false,
+			parentDeviceId: parentDeviceId ?? null,
+			...userNamed !== void 0 ? { userNamed } : {},
+			...features !== void 0 ? { features } : {},
+			...exportFingerprint !== void 0 ? { exportFingerprint } : {},
+			...integrationId !== void 0 ? { integrationId } : {},
+			...linkDeviceId !== void 0 ? { linkDeviceId } : {},
+			...primaryChildEntityId !== void 0 ? { primaryChildEntityId } : {},
+			...isChildLayout(rawChildLayout) ? { childLayout: rawChildLayout } : {},
+			...role !== void 0 ? { role } : {},
+			...isPlainObject(rawDisplay) ? { display: toDisplayOverride(rawDisplay) } : {}
+		},
+		metadata: isPlainObject(rawMetadata) ? rawMetadata : null,
+		registered: readBoolean(data["registered"]) ?? false
+	};
+}
+/**
+* `ChildLayout` is a JSON column: what comes back is whatever was written.
+* The projection hands it to the UI untouched, so the only thing worth
+* checking is that it is still the array shape the writer put in.
+*/
+function isChildLayout(value) {
+	return Array.isArray(value);
+}
+/**
+* `DeviceDisplayOverride` is likewise stored verbatim in a JSON column. It is
+* an all-optional record, so any object round-trips; the write path
+* (`normalizeDisplayOverride`) is what gives it shape.
+*/
+function toDisplayOverride(value) {
+	return value;
+}
+/** Full-row value for an upsert: identity + every field of the meta record. */
+function encodeDeviceRow(meta, extra = {}) {
+	const row = {
+		id: String(meta.id),
+		deviceId: meta.id,
+		addonId: meta.addonId,
+		stableId: meta.stableId,
+		type: meta.type,
+		name: meta.name,
+		userNamed: meta.userNamed ?? null,
+		location: meta.location,
+		disabled: meta.disabled,
+		parentDeviceId: meta.parentDeviceId,
+		registered: extra.registered ?? false,
+		features: meta.features === void 0 ? null : [...meta.features],
+		exportFingerprint: meta.exportFingerprint ?? null,
+		integrationId: meta.integrationId ?? null,
+		linkDeviceId: meta.linkDeviceId ?? null,
+		primaryChildEntityId: meta.primaryChildEntityId ?? null,
+		childLayout: meta.childLayout ?? null,
+		role: meta.role ?? null,
+		display: meta.display ?? null
+	};
+	if (extra.metadata !== void 0) row["metadata"] = extra.metadata;
+	return row;
+}
+/** Column map for a partial write — only the keys the caller actually named. */
+function encodeDeviceRowPatch(patch) {
+	const row = {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (value === void 0) continue;
+		row[key] = value;
+	}
+	return row;
+}
+/**
+* Row access for the device fleet. Every method is a single statement against
+* `device-manager:devices` — there is no in-memory copy of the fleet here and
+* no cache: a per-device question is a primary-key lookup, a fleet question is
+* one indexed scan.
+*/
+var DeviceRowStore = class {
+	backend;
+	logger;
+	declared = null;
+	constructor(backend, logger) {
+		this.backend = backend;
+		this.logger = logger;
+	}
+	/**
+	* Lazy, idempotent `declareCollection`, memoised on the PROMISE so N
+	* concurrent first-callers issue one declaration rather than N. A rejection
+	* is not latched — the slot is cleared so the next caller retries instead of
+	* inheriting a dead collection forever.
+	*/
+	async declare() {
+		const existing = this.declared;
+		if (existing !== null) return existing;
+		const run = (async () => {
+			try {
+				await this.backend.declareCollection({
+					collection: DEVICE_ROWS_COLLECTION,
+					columns: DEVICE_ROWS_COLUMNS,
+					indexes: DEVICE_ROWS_INDEXES
+				});
+			} catch (err) {
+				this.declared = null;
+				throw err;
+			}
+		})();
+		this.declared = run;
+		return run;
+	}
+	/** One device, by numeric id. `null` when the fleet does not know it. */
+	async get(deviceId) {
+		await this.declare();
+		const raw = await this.backend.get({
+			collection: DEVICE_ROWS_COLLECTION,
+			key: String(deviceId)
+		});
+		if (!isPlainObject(raw)) return null;
+		const decoded = decodeDeviceRow(raw);
+		if (decoded === null) {
+			this.logger.warn("device row skipped — identity fields missing", { tags: { deviceId } });
+			return null;
+		}
+		return decoded;
+	}
+	/** Every device, ordered by numeric id. */
+	async listAll() {
+		return this.list({
+			orderBy: {
+				field: "deviceId",
+				direction: "asc"
+			},
+			limit: DEVICE_ROWS_FLEET_LIMIT
+		});
+	}
+	/**
+	* The device an addon knows as `stableId`, or `null`.
+	*
+	* `(addonId, stableId)` is the addon-facing identity — unique by
+	* construction, since `allocateDeviceId` is the only thing that mints a row
+	* and it returns the existing id for a pair it already knows. A second row
+	* for the pair would be a corruption, so this takes the LOWEST id and says
+	* so rather than picking arbitrarily.
+	*/
+	async findByStableId(addonId, stableId) {
+		const rows = await this.list({
+			where: {
+				addonId,
+				stableId
+			},
+			orderBy: {
+				field: "deviceId",
+				direction: "asc"
+			},
+			limit: 2
+		});
+		const first = rows[0];
+		if (first === void 0) return null;
+		if (rows.length > 1) this.logger.warn("duplicate device rows for one (addonId, stableId) — using the lowest id", {
+			tags: { deviceId: first.meta.id },
+			meta: {
+				addonId,
+				stableId,
+				ids: rows.map((r) => r.meta.id)
+			}
+		});
+		return first;
+	}
+	/** Every device owned by one addon, ordered by numeric id. */
+	async listByAddon(addonId) {
+		return this.list({
+			where: { addonId },
+			orderBy: {
+				field: "deviceId",
+				direction: "asc"
+			},
+			limit: DEVICE_ROWS_FLEET_LIMIT
+		});
+	}
+	/** Every device an integration owns, ordered by numeric id. */
+	async listByIntegration(integrationId) {
+		return this.list({
+			where: { integrationId },
+			orderBy: {
+				field: "deviceId",
+				direction: "asc"
+			},
+			limit: DEVICE_ROWS_FLEET_LIMIT
+		});
+	}
+	/** Direct children of one device, ordered by numeric id. */
+	async listByParent(parentDeviceId) {
+		return this.list({
+			where: { parentDeviceId },
+			orderBy: {
+				field: "deviceId",
+				direction: "asc"
+			},
+			limit: DEVICE_ROWS_FLEET_LIMIT
+		});
+	}
+	/** How many devices the fleet holds. Used to tell "empty store" from "gone device". */
+	async count() {
+		await this.declare();
+		return this.backend.count({ collection: DEVICE_ROWS_COLLECTION });
+	}
+	async list(filter) {
+		await this.declare();
+		const records = await this.backend.query({
+			collection: DEVICE_ROWS_COLLECTION,
+			filter
+		});
+		const out = [];
+		for (const record of records) {
+			const decoded = decodeDeviceRow(record.data);
+			if (decoded === null) {
+				this.logger.warn("device row skipped — identity fields missing", { meta: { rowId: record.id } });
+				continue;
+			}
+			out.push(decoded);
+		}
+		return out;
+	}
+	/** Insert or replace the whole identity row. */
+	async upsert(meta, extra = {}) {
+		await this.declare();
+		await this.backend.set({
+			collection: DEVICE_ROWS_COLLECTION,
+			key: String(meta.id),
+			value: encodeDeviceRow(meta, extra)
+		});
+	}
+	/**
+	* Write the named columns of an EXISTING row and nothing else.
+	*
+	* An UPDATE, deliberately not an upsert: a partial upsert would try to INSERT
+	* a row carrying only the patched columns, and SQLite rejects that on the
+	* `NOT NULL` identity columns before the primary-key conflict can turn it
+	* into an update. Every caller resolves the row under the write lock and
+	* throws when it is gone, so matching zero rows means a device was removed
+	* between the resolve and the write — the patch is lost, and a lost write
+	* that says nothing reads as a write that happened.
+	*/
+	async patch(deviceId, patch) {
+		const columns = encodeDeviceRowPatch(patch);
+		if (Object.keys(columns).length === 0) return;
+		await this.declare();
+		const { updated } = await this.backend.updateWhere({
+			collection: DEVICE_ROWS_COLLECTION,
+			filter: { where: { id: String(deviceId) } },
+			data: columns
+		});
+		if (updated === 0) this.logger.warn("device row patch matched no row — the device was removed under it", {
+			tags: { deviceId },
+			meta: { columns: Object.keys(columns) }
+		});
+	}
+	/**
+	* Insert-or-update the registration columns. See {@link DeviceRegistrationRow}
+	* for why this is a separate, fully-specified statement rather than a patch.
+	*/
+	async upsertRegistration(row) {
+		await this.declare();
+		await this.backend.set({
+			collection: DEVICE_ROWS_COLLECTION,
+			key: String(row.deviceId),
+			value: {
+				deviceId: row.deviceId,
+				addonId: row.addonId,
+				stableId: row.stableId,
+				type: row.type,
+				name: row.name,
+				userNamed: row.userNamed,
+				location: row.location,
+				disabled: row.disabled,
+				parentDeviceId: row.parentDeviceId,
+				registered: row.registered,
+				features: [...row.features],
+				exportFingerprint: row.exportFingerprint
+			}
+		});
+	}
+	/** Drop the device's row. Idempotent. */
+	async remove(deviceId) {
+		await this.declare();
+		await this.backend.delete({
+			collection: DEVICE_ROWS_COLLECTION,
+			key: String(deviceId)
+		});
+	}
+	/**
+	* The retirement door for the three blobs this collection replaced.
+	*
+	* The purge is gated on THIS collection being non-empty, and the count has to
+	* be taken after `declare()` — which is why the owning addon runs it and the
+	* settings engine cannot: at the engine's own boot no addon has declared
+	* anything, so every successor would read as unreadable, forever.
+	*/
+	retiredRowStore() {
+		return {
+			hasRow: async (spec) => {
+				const raw = await this.backend.get({
+					collection: spec.collection,
+					key: spec.row
+				});
+				return raw !== void 0 && raw !== null;
+			},
+			deleteRow: async (spec) => {
+				await this.backend.delete({
+					collection: spec.collection,
+					key: spec.row
+				});
+			},
+			countRows: async (collection) => {
+				await this.declare();
+				return this.backend.count({ collection });
+			}
+		};
+	}
+};
+//#endregion
 //#region src/builtins/device-manager/runtime-state-persist-gate.ts
 /**
 * The subset of `blob` that is allowed on disk: slices whose capability
@@ -4548,12 +4886,21 @@ var DeviceManagerAddon = class extends BaseAddon {
 			}
 		}))).filter((id) => id !== null);
 	}
+	/**
+	* Row access for `device-manager:devices`. Built once in `onInitialize`
+	* (which is also where the collection is declared) — every consumer reaches
+	* it through {@link bindingsDeps} or the `ProviderContext`.
+	*/
+	deviceRows = null;
 	/** Build the dependency context the extracted binding resolvers consume. */
 	get bindingsDeps() {
+		const rows = this.deviceRows;
+		if (rows === null) throw new Error("[device-manager] device row store not initialized");
 		return {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
-			remoteNativeCaps: this.remoteNativeCaps
+			remoteNativeCaps: this.remoteNativeCaps,
+			rows
 		};
 	}
 	async getBindings(input) {
@@ -4609,17 +4956,23 @@ var DeviceManagerAddon = class extends BaseAddon {
 			if (!ops) throw new Error(`[device-manager] device-ops native provider not found for '${deviceId}'`);
 			return ops;
 		};
-		const metaStore = new DeviceMetaStore(settings, registry);
+		const settingsStoreApi = this.ctx.api?.settingsStore;
+		if (!settingsStoreApi) throw new Error("[device-manager] settings-store API not available — refusing to serve a fleet it cannot persist");
+		const deviceRows = new DeviceRowStore(deviceRowBackendOf(settingsStoreApi), this.ctx.logger.child("rows"));
+		await deviceRows.declare();
+		this.deviceRows = deviceRows;
+		try {
+			await purgeRetiredSettingsRows(deviceRows.retiredRowStore(), this.ctx.logger.child("RetiredRows"));
+		} catch (err) {
+			this.ctx.logger.warn("retired-row purge failed", { meta: { error: errMsg(err) } });
+		}
+		const metaStore = new DeviceMetaStore(settings, registry, deviceRows);
 		this.stateMirrorImpl = new DeviceStateMirror(this.ctx);
 		const stateMirror = this.stateMirrorImpl;
-		const readMeta = metaStore.readMeta;
 		const resolvePersistedById = metaStore.resolvePersistedById;
 		const idToAddonId = metaStore.idToAddonId;
-		{
-			const meta = await readMeta();
-			for (const m of Object.values(meta)) idToAddonId.set(m.id, m.addonId);
-		}
-		const stampIntegrationId$1 = (deviceId, integrationId) => stampIntegrationId(metaStore, settings, this.ctx, deviceId, integrationId);
+		for (const row of await deviceRows.listAll()) idToAddonId.set(row.meta.id, row.meta.addonId);
+		const stampIntegrationId$1 = (deviceId, integrationId) => stampIntegrationId(metaStore, this.ctx, deviceId, integrationId);
 		const pctx = {
 			host: this.providerHost,
 			metaStore,