@camstack/system 1.2.133 → 1.2.135

package/dist/builtins/sqlite-storage/query-profiler.d.ts

@@ -35,6 +35,23 @@ import { IScopedLogger } from '@camstack/types';
  * statement that really does take seconds. Both are needed; neither is
  * sufficient.
  *
+ * ## Why the SQL shape, and why the plan
+ *
+ * `(op, collection)` names a TABLE, not a call site. On 2026-08-25 the busiest
+ * line of a 90 s operator stall was `query pipeline-analytics:tracks — 1005
+ * calls, max 1615 ms` and eleven different reads in one addon are spelled
+ * exactly that way; the aggregate accused all of them and cleared none. So the
+ * shape of the prepared statement (`statement-shape.ts`) is part of the
+ * aggregate KEY, and the report prints it.
+ *
+ * A shape says WHICH query. It does not say why it is slow — "1.6 s for 501
+ * rows" is a full scan and "1.6 s for 501 rows" is also a cold disk, and those
+ * are the same line. `EXPLAIN QUERY PLAN` is the only thing that separates
+ * them, and it is attached to the slow-call WARN because that is where the
+ * question is asked. It is asked ONCE PER SHAPE PER WINDOW: a scan that fires
+ * the WARN fires it repeatedly, and a plan re-printed forty times is how the
+ * one line that mattered stops being read.
+ *
  * ## Cost
  *
  * Two `Date.now()` calls and one `Map` lookup per statement. At the measured
@@ -64,17 +81,37 @@ export interface SqliteOpSample {
     readonly deviceId?: number;
     /** See {@link SqliteOpLabel.owner}. */
     readonly owner?: string;
+    /** See {@link SqliteOpLabel.sql}. */
+    readonly sql?: string;
+    /** See {@link SqliteOpLabel.params}. */
+    readonly params?: readonly unknown[];
 }
-/** One `(op, collection, owner)` triple's totals over a report window. */
+/** One `(op, collection, owner, shape)` tuple's totals over a report window. */
 export interface SqliteOpStat {
     readonly op: string;
     readonly collection: string;
     readonly owner?: string;
+    /** `statement-shape.ts` fingerprint; absent for a fixed-shape statement the
+     *  engine did not hand to the profiler. */
+    readonly shape?: string;
     readonly calls: number;
     readonly totalMs: number;
     readonly maxMs: number;
     readonly rows: number;
 }
+/**
+ * Runs `EXPLAIN QUERY PLAN` for a statement on the connection that executed it.
+ *
+ * Injected rather than reached for: the profiler must not own a database
+ * handle, and the plan is only trustworthy from the SAME connection — a second
+ * handle can differ in `sqlite_stat1` visibility and in temp-schema state, and
+ * a plan taken from a connection that is not the one that stalled describes a
+ * query nobody ran.
+ *
+ * Returns one string per plan row (SQLite's `detail` column). Must not throw —
+ * an unexplainable statement yields `[]`.
+ */
+export type SqlExplainer = (sql: string, params: readonly unknown[]) => readonly string[];
 /**
  * Duration at which one statement is worth a WARN on its own, in ms.
  *
@@ -104,6 +141,8 @@ export interface SqliteOpProfilerOptions {
     readonly reportIntervalMs?: number;
     readonly reportFloorMs?: number;
     readonly topN?: number;
+    /** Absent ⇒ slow-call WARNs carry no plan. See {@link SqlExplainer}. */
+    readonly explain?: SqlExplainer;
 }
 /** Identity of a measured call, without the numbers `measure` supplies itself. */
 export interface SqliteOpLabel {
@@ -117,6 +156,27 @@ export interface SqliteOpLabel {
      * exactly where the 67 660-call storm of 2026-08-25 stopped.
      */
     readonly owner?: string;
+    /**
+     * The statement the engine prepared, verbatim.
+     *
+     * Supplied only by the ops that BUILD their SQL from a filter — those are the
+     * ones whose cost varies by call site. A fixed-shape statement (`get`, `set`)
+     * is already fully described by `(op, collection)`.
+     *
+     * Used for two things and nothing else: the shape that becomes part of the
+     * aggregate key, and the `EXPLAIN QUERY PLAN` on a slow call. Never logged
+     * raw — see `statement-shape.ts` for what is dropped.
+     */
+    readonly sql?: string;
+    /**
+     * The values bound to {@link sql}.
+     *
+     * Needed because `EXPLAIN QUERY PLAN` on a statement with unbound parameters
+     * is not the plan that ran: SQLite's planner reads bound values for `LIKE`
+     * prefixes and for index-selection on `IN`. Never logged, in whole or in
+     * part — they carry device ids, keys and user data.
+     */
+    readonly params?: readonly unknown[];
 }
 export declare class SqliteOpProfiler {
     private readonly logger;
@@ -125,7 +185,11 @@ export declare class SqliteOpProfiler {
     private readonly reportIntervalMs;
     private readonly reportFloorMs;
     private readonly topN;
+    private readonly explain;
     private readonly stats;
+    /** Shapes already explained in this window — see the class doc on why the
+     *  plan is printed once and not on every WARN. Cleared by `drain`. */
+    private readonly explainedShapes;
     private windowStartedAt;
     private timer;
     constructor(options: SqliteOpProfilerOptions);
@@ -139,6 +203,15 @@ export declare class SqliteOpProfiler {
      */
     measure<T>(label: SqliteOpLabel, run: () => T): T;
     record(sample: SqliteOpSample): void;
+    /**
+     * `EXPLAIN QUERY PLAN` for a statement that just held the loop, or nothing.
+     *
+     * Nothing when: no explainer was injected, the op carries no SQL, or this
+     * shape has already been explained in this window. The explainer is
+     * contracted not to throw and is guarded anyway — a profiler that can turn a
+     * slow query into a crash is worse than one that cannot explain it.
+     */
+    private planFor;
     /** Totals for the window, busiest first, and reset. */
     drain(): readonly SqliteOpStat[];
     /** Emit one aggregate line for the window, unless the engine was idle. */

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -45,6 +45,22 @@ export interface DroppedTable {
 export declare function scopeOwnerOf(filter: QueryFilter | undefined): {
     owner?: string;
 };
+/**
+ * Stable identity of a declared schema — every property that changes the DDL
+ * or the set of columns a filter can name.
+ *
+ * Deliberately covers `indexes` too: an added index is as invisible to a
+ * name-only memo as an added column, and `CREATE INDEX IF NOT EXISTS` is
+ * cheap enough that re-running it costs nothing.
+ */
+/**
+ * A `query` asked to read a column the collection cannot serve. Distinct type
+ * so a caller can map it to a 400 — it is always a programming error in the
+ * caller, never a condition of the data.
+ */
+export declare class UnprojectableColumnError extends Error {
+    constructor(message: string);
+}
 /**
  * SQLite implementation of ISettingsBackend.
  *
@@ -130,7 +146,7 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
     getEngineInfo(): Promise<DataStoreEngineInfo>;
     get({ namespace, collection, key }: SettingsGetInput): Promise<unknown>;
     set({ namespace, collection, key, value }: SettingsSetInput): Promise<void>;
-    query<T extends object = Record<string, unknown>>({ namespace, collection, filter, }: SettingsQueryInput): Promise<readonly SettingsRecord<T>[]>;
+    query<T extends object = Record<string, unknown>>({ namespace, collection, filter, columns, }: SettingsQueryInput): Promise<readonly SettingsRecord<T>[]>;
     insert<T extends object = Record<string, unknown>>({ namespace, collection, record, }: SettingsInsertInput<T>): Promise<void>;
     update({ namespace, collection, id, data }: SettingsUpdateInput): Promise<void>;
     delete({ namespace, collection, key }: SettingsDeleteInput): Promise<void>;
@@ -151,6 +167,28 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * uncapped `tableUpdate` would have done.
      */
     updateWhere({ namespace, collection, filter, data, }: SettingsUpdateWhereInput): Promise<SettingsUpdateWhereResult>;
+    /**
+     * How many rows match — about the SAME rows {@link query} would return.
+     *
+     * That agreement is the entire contract, and until now it did not hold. This
+     * was the FOURTH hand-rolled copy of the filter logic (after `query`, the
+     * bulk mutations and `histogram`) and it compiled only `where`:
+     * `whereBetween`, `whereIn` and `whereNot` were dropped silently, so the
+     * count was not slow, it was WRONG, and always wrong in the same direction —
+     * too big, because every dropped predicate is a predicate that would have
+     * excluded rows.
+     *
+     * Two live callers decided on it. `TrackStore.countStaging({ deviceId,
+     * olderThanMs })` sends the cutoff as `whereBetween: { lastSeen: [0, …] }`
+     * and got the device's whole staging history instead. The notification-centre
+     * artefact gallery pages on `total` from this method while listing through
+     * `query`, and its filter is almost entirely `whereIn`/`whereBetween`
+     * (visibility, kind, device, time window, expiry) — so `total` counted rows
+     * the page could never show, including other users'.
+     *
+     * `select` mode, deliberately: `count` must be forgiving in exactly the way
+     * `query` is, or the two disagree again for a new reason.
+     */
     count({ namespace, collection, filter }: SettingsCountInput): Promise<number>;
     histogram({ namespace, collection, field, bucketSize, origin, filter, }: SettingsHistogramInput): Promise<readonly HistogramBucket[]>;
     isEmpty({ namespace, collection }: SettingsIsEmptyInput): Promise<boolean>;
@@ -221,6 +259,24 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * Returns null if the backend has not been initialized yet.
      */
     getDatabase(): Database.Database | null;
+    /**
+     * `EXPLAIN QUERY PLAN` for a statement, as one string per plan row.
+     *
+     * Answers the question the timing alone cannot: "1.6 s for 501 rows" is a
+     * full scan and is also a cold disk, and only the plan tells them apart. It
+     * runs on the SAME connection as the statement, because that is the only
+     * connection whose `sqlite_stat1` visibility and temp schema match.
+     *
+     * `EXPLAIN QUERY PLAN` prepares and plans; it does not execute the statement,
+     * so it costs no page reads of its own. It is still called only from the
+     * slow-call path, once per shape per window.
+     *
+     * Never throws. A plan that cannot be taken (a statement the engine will no
+     * longer prepare, a closed handle mid-shutdown) is a missing ANSWER, not a
+     * failure worth turning a slow query into a crash — the profiler falls back
+     * to the line it would have printed anyway.
+     */
+    private explainQueryPlan;
     /**
      * Run one synchronous statement under the profiler.
      *
@@ -265,6 +321,16 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * storage report turns it off without a rebuild.
      */
     private scheduleMapGrowthCheck;
+    /**
+     * One-shot `ANALYZE`, long after boot, only if the database has none.
+     *
+     * `analyze-stats.ts` has the measurement that justifies it: without
+     * `sqlite_stat1` the planner walked 150 133 media rows to return six, and one
+     * `ANALYZE` took that same query from 727 ms to 3.2 ms. It is scheduled
+     * rather than run inline because it is a 14 s synchronous statement on the
+     * one thread the cluster reads configuration through.
+     */
+    private scheduleIndexAnalysis;
     private scheduleStorageReport;
     private logStorageReport;
     private readPragmaNumber;

package/dist/builtins/sqlite-storage/statement-shape.d.ts

@@ -0,0 +1,64 @@
+/**
+ * A stable, low-cardinality name for the SHAPE of a SQL statement.
+ *
+ * ## Why the profiler needs this
+ *
+ * `SqliteOpProfiler` aggregated on `(op, collection)`, and that pair is not an
+ * identity — it is a table. On 2026-08-25 the busiest line of a 90 s operator
+ * stall read `query pipeline-analytics:tracks — 1005 calls, 2694 ms,
+ * max 1615 ms, 17981 rows`, and there was no way to tell from it WHICH of the
+ * eleven distinct reads that addon issues against that one table had spent the
+ * second and a half. Every one of them was equally accused; the aggregate could
+ * not clear a single one.
+ *
+ * The shape is the missing half. It is derived from the statement the engine
+ * actually prepared, so it cannot drift from the code the way a hand-passed
+ * label would, and it collapses to exactly one string per call site — which is
+ * what makes it safe as part of an aggregate key.
+ *
+ * ## What is thrown away, and why
+ *
+ * - **The projection.** `queryDeclared` always selects every column, so the
+ *   `SELECT` list is the table's schema restated — pure noise, and the single
+ *   longest part of the statement.
+ * - **The table name.** It is already the `collection` field of the report.
+ * - **The width of an `IN` list.** `IN (?, ?, … ×500)` and `IN (?)` are the
+ *   same call site; keeping the literal placeholders would make every page of
+ *   a chunked read its own aggregate row. The COUNT is kept (`IN (?×500)`)
+ *   because it is the difference between "reads one row" and "reads five
+ *   hundred", which is the whole question being asked.
+ *
+ * Bound values are never included. They are not needed to name a call site, and
+ * a statement's parameters routinely carry device ids, keys and user data — a
+ * profiler line is not a place to put them.
+ */
+/**
+ * Longest fingerprint kept, in characters.
+ *
+ * A shape is a log field printed five to a line; past this it stops being
+ * readable and starts pushing the numbers off the end. Every real statement in
+ * this engine fits well inside it — the cap exists for the pathological
+ * `whereIn` with forty distinct fields, not for the normal case.
+ */
+export declare const SQL_SHAPE_MAX_LENGTH = 220;
+/** Appended when a shape is cut at {@link SQL_SHAPE_MAX_LENGTH}. */
+export declare const SQL_SHAPE_ELLIPSIS = "\u2026";
+/**
+ * How many distinct raw statements the memo holds before it is dropped.
+ *
+ * The engine prepares its SQL fresh on every call, so without a memo this runs
+ * a handful of regexes per statement at a few hundred statements a second.
+ * With one, it runs them once per call site. The bound exists because the raw
+ * key is unbounded in principle (an `IN` list of a new width mints a new
+ * entry): at the cap the memo is cleared rather than grown, which costs one
+ * re-derivation per shape and cannot leak.
+ */
+export declare const SQL_SHAPE_MEMO_MAX_ENTRIES = 512;
+/**
+ * Name the shape of `sql`, whose table is `collection`.
+ *
+ * Memoised on the raw statement — see {@link SQL_SHAPE_MEMO_MAX_ENTRIES}.
+ */
+export declare function sqlShape(sql: string, collection: string): string;
+/** Test seam: forget every memoised shape. */
+export declare function resetSqlShapeMemo(): void;

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-BUEU7B1V.mjs";
+import { dt as storageCapability, ft as storageMigrationCapability, g as StorageMigrationJobSchema, h as StorageLocationTypeSchema, lt as settingsStoreCapability, yt as BaseAddon, zt as parseJsonObject } from "../../dist-Bh25kEUH.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { It as hydrateSchema, vt as errMsg, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DqcaE-k1.js");
+const require_dist = require("../../dist-D-R0SuP-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BUEU7B1V.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-BUEU7B1V.mjs → dist-Bh25kEUH.mjs}

@@ -3704,24 +3704,6 @@ var RecordingRetentionSchema = z.object({
 	maxSizeGb: z.number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = z.enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -3729,7 +3711,11 @@ var ScrubThumbnailPresetSchema = z.enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -3752,14 +3738,7 @@ var RecordingConfigSchema = z.object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: z.array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -8060,11 +8039,26 @@ var settingsStoreCapability = {
 			key: z.string(),
 			value: z.unknown()
 		}), z.void(), { kind: "mutation" }),
-		/** Get all entries matching an optional filter. */
+		/**
+		* Rows matching a filter.
+		*
+		* `columns` is a SQL-level projection: the engine SELECTs only those
+		* columns (plus the primary key) instead of the whole row. It is the only
+		* way to stop paying disk for a column that is discarded — a heavy JSON
+		* column dominates the row, and dropping it in JS after the read pays every
+		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
+		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+		* plan.
+		*
+		* The engine REFUSES a column it cannot serve rather than omitting it —
+		* see `SettingsQueryInput.columns` for why a projection may not be
+		* forgiving the way a predicate is.
+		*/
 		query: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			columns: z.array(z.string()).readonly().optional()
 		}), z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(z.object({
@@ -8229,7 +8223,17 @@ var dataStoreProviderCapability = {
 		query: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			/**
+			* SQL-level column projection — MUST mirror `settings-store.query`.
+			*
+			* This is the second schema the same call passes through, and Zod
+			* objects STRIP what they do not declare: a field present on the door
+			* and absent here does not error, it silently disappears one hop before
+			* the engine, and the caller concludes the projection does nothing.
+			* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+			*/
+			columns: z.array(z.string()).readonly().optional()
 		}), z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(z.object({
@@ -22863,7 +22867,27 @@ var faceGalleryCapability = {
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		listIdentities: method(z.void(), z.array(IdentitySchema).readonly()),
+		listIdentities: method(z.object({ 
+		/**
+		* Inline {@link IdentitySchema.coverBase64} on every row.
+		*
+		* Default `false`, the same inversion `listRecentFaces` and
+		* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+		* why the burden belongs on the caller that WANTS the bytes). Measured
+		* on the live hub the same day: four identities cost 40,979 B with the
+		* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+		* four times and the viewer holds at `staleTime: 30_000`.
+		*
+		* Nothing loses its avatar: `coverMediaKey` is already on every row and
+		* the `event-media` plane serves that key `immutable` with an ETag.
+		*
+		* **This is an INPUT field, so it does not reach the addon until the
+		* next train** — the hub router validates cap inputs against its own
+		* compiled Zod and strips a key it does not know. Until then the
+		* provider sees `undefined`, which resolves to `false`: the cheap shape
+		* is what ships, and the opt-in becomes reachable when the train lands.
+		*/
+includeCrops: z.boolean().optional() }).optional(), z.array(IdentitySchema).readonly()),
 		createIdentity: method(z.object({ name: z.string().min(1) }), IdentitySchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -26225,7 +26249,13 @@ var plateGalleryCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listVehicles: method(z.void(), z.array(VehicleSchema).readonly()),
+		listVehicles: method(z.object({ 
+		/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+		*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+		*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+		*  INPUT field: stripped by the hub router until the train ships, which
+		*  resolves to `false` and is exactly the intended default. */
+includeCrops: z.boolean().optional() }).optional(), z.array(VehicleSchema).readonly()),
 		createVehicle: method(z.object({ name: z.string().min(1) }), VehicleSchema, {
 			kind: "mutation",
 			auth: "admin"

package/dist/{dist-DqcaE-k1.js → dist-D-R0SuP-.js}

@@ -3704,24 +3704,6 @@ var RecordingRetentionSchema = zod.z.object({
 	maxSizeGb: zod.z.number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = zod.z.enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -3729,7 +3711,11 @@ var ScrubThumbnailPresetSchema = zod.z.enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -3752,14 +3738,7 @@ var RecordingConfigSchema = zod.z.object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: zod.z.array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -8060,11 +8039,26 @@ var settingsStoreCapability = {
 			key: zod.z.string(),
 			value: zod.z.unknown()
 		}), zod.z.void(), { kind: "mutation" }),
-		/** Get all entries matching an optional filter. */
+		/**
+		* Rows matching a filter.
+		*
+		* `columns` is a SQL-level projection: the engine SELECTs only those
+		* columns (plus the primary key) instead of the whole row. It is the only
+		* way to stop paying disk for a column that is discarded — a heavy JSON
+		* column dominates the row, and dropping it in JS after the read pays every
+		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
+		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+		* plan.
+		*
+		* The engine REFUSES a column it cannot serve rather than omitting it —
+		* see `SettingsQueryInput.columns` for why a projection may not be
+		* forgiving the way a predicate is.
+		*/
 		query: method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			columns: zod.z.array(zod.z.string()).readonly().optional()
 		}), zod.z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(zod.z.object({
@@ -8229,7 +8223,17 @@ var dataStoreProviderCapability = {
 		query: method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			/**
+			* SQL-level column projection — MUST mirror `settings-store.query`.
+			*
+			* This is the second schema the same call passes through, and Zod
+			* objects STRIP what they do not declare: a field present on the door
+			* and absent here does not error, it silently disappears one hop before
+			* the engine, and the caller concludes the projection does nothing.
+			* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+			*/
+			columns: zod.z.array(zod.z.string()).readonly().optional()
 		}), zod.z.array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(zod.z.object({
@@ -22863,7 +22867,27 @@ var faceGalleryCapability = {
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		listIdentities: method(zod.z.void(), zod.z.array(IdentitySchema).readonly()),
+		listIdentities: method(zod.z.object({ 
+		/**
+		* Inline {@link IdentitySchema.coverBase64} on every row.
+		*
+		* Default `false`, the same inversion `listRecentFaces` and
+		* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+		* why the burden belongs on the caller that WANTS the bytes). Measured
+		* on the live hub the same day: four identities cost 40,979 B with the
+		* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+		* four times and the viewer holds at `staleTime: 30_000`.
+		*
+		* Nothing loses its avatar: `coverMediaKey` is already on every row and
+		* the `event-media` plane serves that key `immutable` with an ETag.
+		*
+		* **This is an INPUT field, so it does not reach the addon until the
+		* next train** — the hub router validates cap inputs against its own
+		* compiled Zod and strips a key it does not know. Until then the
+		* provider sees `undefined`, which resolves to `false`: the cheap shape
+		* is what ships, and the opt-in becomes reachable when the train lands.
+		*/
+includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(IdentitySchema).readonly()),
 		createIdentity: method(zod.z.object({ name: zod.z.string().min(1) }), IdentitySchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -26225,7 +26249,13 @@ var plateGalleryCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listVehicles: method(zod.z.void(), zod.z.array(VehicleSchema).readonly()),
+		listVehicles: method(zod.z.object({ 
+		/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+		*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+		*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+		*  INPUT field: stripped by the hub router until the train ships, which
+		*  resolves to `false` and is exactly the intended default. */
+includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(VehicleSchema).readonly()),
 		createVehicle: method(zod.z.object({ name: zod.z.string().min(1) }), VehicleSchema, {
 			kind: "mutation",
 			auth: "admin"