@camstack/system 1.2.157 → 1.2.160

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-DVODn-qc.js");
+const require_manifest_system_deps = require("./manifest-system-deps-oJMkWSX-.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -420,7 +420,7 @@ async function loadAddonModule(addonId, addonDir) {
 	if (!node_fs.existsSync(entryPath)) throw new Error(`Entry point not found: ${entryPath}`);
 	const modUnknown = await import(entryPath);
 	const mod = isRecord(modUnknown) ? modUnknown : {};
-	const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
+	const AddonClass = require_manifest_system_deps.resolveAddonClass(mod);
 	if (!AddonClass) throw new Error(`No addon class exported from ${entryPath}`);
 	return {
 		declaration,
@@ -554,13 +554,13 @@ async function main() {
 	*/
 	const customActionRegistry = new require_custom_action_registry.CustomActionRegistry();
 	let shuttingDown = false;
-	const udsChildClient = new require_manifest_python_deps.LocalChildClient({
+	const udsChildClient = new require_manifest_system_deps.LocalChildClient({
 		nodeId: parentNodeId,
 		childId: runnerId,
-		caps: buildChildCapDescriptors(runnerManifest, require_manifest_python_deps.getWorkerNativeCapSnapshot()),
+		caps: buildChildCapDescriptors(runnerManifest, require_manifest_system_deps.getWorkerNativeCapSnapshot()),
 		dispatch: createChildCapDispatch({
 			getSingletonProvider: (capName, addonId) => resolveSingletonProvider(capName, addonId),
-			getDeviceProvider: (capName, deviceId) => require_manifest_python_deps.getWorkerNativeCapProvider(capName, deviceId) ?? null,
+			getDeviceProvider: (capName, deviceId) => require_manifest_system_deps.getWorkerNativeCapProvider(capName, deviceId) ?? null,
 			isCollectionListMethod: (capName, method) => (0, _camstack_types_addon.isCollectionArrayMethodName)(capName, method)
 		})
 	});
@@ -570,7 +570,7 @@ async function main() {
 		getAddonInstance: (addonId) => loadedAddonInstances.get(addonId) ?? null,
 		getDataPlanes: (addonId) => addonDataPlanes.get(addonId) ?? []
 	}));
-	const { logger: runnerLog, control: runnerLogControl } = require_manifest_python_deps.createUdsLoggerWithControl(udsChildClient, runnerId, nodeId, "addon-runner");
+	const { logger: runnerLog, control: runnerLogControl } = require_manifest_system_deps.createUdsLoggerWithControl(udsChildClient, runnerId, nodeId, "addon-runner");
 	udsChildClient.onSetLogLevel((level) => {
 		runnerLogControl.setLevel(level);
 		runnerLog.info(`Log level changed to "${level}" via UDS`);
@@ -585,13 +585,13 @@ async function main() {
 	if (storageProvider) runnerLog.info(`"${nodeId}" storage provider rooted at ${dataDir}`);
 	else runnerLog.warn(`"${nodeId}" failed to load FilesystemStorageProvider`, { meta: { error: (0, _camstack_types_addon.errMsg)(storageProviderError) } });
 	const refreshChildCaps = (reason) => {
-		const freshDescriptors = buildChildCapDescriptors(runnerManifest, require_manifest_python_deps.getWorkerNativeCapSnapshot());
+		const freshDescriptors = buildChildCapDescriptors(runnerManifest, require_manifest_system_deps.getWorkerNativeCapSnapshot());
 		udsChildClient.updateCaps(freshDescriptors).catch((err) => {
 			runnerLog.warn(`UDS updateCaps failed (${reason})`, { meta: { error: err instanceof Error ? err.message : String(err) } });
 		});
 	};
 	let capRefreshTimer;
-	require_manifest_python_deps.setWorkerNativeCapsChangeListener(() => {
+	require_manifest_system_deps.setWorkerNativeCapsChangeListener(() => {
 		if (capRefreshTimer !== void 0) return;
 		capRefreshTimer = setTimeout(() => {
 			capRefreshTimer = void 0;
@@ -603,7 +603,7 @@ async function main() {
 	const deviceRestorePromises = [];
 	for (const { spec, declaration, AddonClass } of loadedModules) try {
 		const addon = new AddonClass();
-		const context = await require_manifest_python_deps.createUdsAddonContext(udsChildClient, nodeId, declaration, dataDir, {
+		const context = await require_manifest_system_deps.createUdsAddonContext(udsChildClient, nodeId, declaration, dataDir, {
 			...storageProvider ? { storageProvider } : {},
 			dataPlaneSink: { set: (addonId, endpoints) => {
 				addonDataPlanes.set(addonId, endpoints);
@@ -611,12 +611,13 @@ async function main() {
 		});
 		try {
 			const pkgRaw = JSON.parse(node_fs.readFileSync(node_path.join(spec.addonDir, "package.json"), "utf-8"));
-			await require_manifest_python_deps.installManifestNativeDeps(spec.addonDir, pkgRaw, context.logger);
+			await require_manifest_system_deps.installManifestNativeDeps(spec.addonDir, pkgRaw, context.logger);
 		} catch (nativeErr) {
 			console.error(`[addon-runner] native deps install failed for "${spec.addonId}": ${(0, _camstack_types_addon.errMsg)(nativeErr)}`);
 			process.exit(1);
 		}
-		await require_manifest_python_deps.installManifestPythonDeps(declaration, spec.addonDir, context.deps, context.logger);
+		await require_manifest_system_deps.installManifestPythonDeps(declaration, spec.addonDir, context.deps, context.logger);
+		await require_manifest_system_deps.installManifestSystemDeps(declaration, context.logger);
 		const registeredProviders = /* @__PURE__ */ new Map();
 		const initWatchdog = startInitWatchdog({
 			addonId: spec.addonId,
@@ -651,7 +652,7 @@ async function main() {
 				return fn(input, caller);
 			});
 		}
-		require_manifest_python_deps.validateProviderRegistrations(spec.addonId, declaration, registeredProviders, context.logger);
+		require_manifest_system_deps.validateProviderRegistrations(spec.addonId, declaration, registeredProviders, context.logger);
 		const capNames = [...registeredProviders.keys()];
 		context.logger.info(`"${spec.addonId}" caps: ${capNames.length > 0 ? capNames.join(", ") : "(none)"}`);
 		runnerManifest.push({
@@ -688,10 +689,10 @@ async function main() {
 	fireHubReachableOnce();
 	runnerLog.info(`"${nodeId}" started — ${loaded.length} addon(s) ready (UDS connected)`);
 	process.stdout.write(`READY:${nodeId}\n`);
-	const stopHeapWatch = require_manifest_python_deps.startRunnerHeapWatch({
+	const stopHeapWatch = require_manifest_system_deps.startRunnerHeapWatch({
 		heapProfile: process.env["CAMSTACK_RUNNER_HEAP_PROFILE"],
 		reclaimSwitch: process.env["CAMSTACK_RUNNER_HEAP_RECLAIM"],
-		rssBudgetMb: process.env[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV],
+		rssBudgetMb: process.env[require_manifest_system_deps.RUNNER_RSS_BUDGET_ENV],
 		label: nodeId,
 		sink: {
 			info: (line) => {
@@ -703,7 +704,7 @@ async function main() {
 		}
 	});
 	process.on("SIGUSR2", () => {
-		require_manifest_python_deps.emitHeapDiagnosticReport({
+		require_manifest_system_deps.emitHeapDiagnosticReport({
 			label: nodeId,
 			addons: loaded.map((e) => e.addonId),
 			sink: {
@@ -720,7 +721,7 @@ async function main() {
 	const shutdown = async () => {
 		shuttingDown = true;
 		stopHeapWatch?.();
-		require_manifest_python_deps.setWorkerNativeCapsChangeListener(null);
+		require_manifest_system_deps.setWorkerNativeCapsChangeListener(null);
 		if (capRefreshTimer !== void 0) {
 			clearTimeout(capRefreshTimer);
 			capRefreshTimer = void 0;

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { F as createUdsLoggerWithControl, I as LocalChildClient, It as RUNNER_RSS_BUDGET_ENV, Yt as startRunnerHeapWatch, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, en as emitHeapDiagnosticReport, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps, xt as resolveAddonClass } from "./manifest-python-deps-CD14Pv0-.mjs";
+import { Ct as resolveAddonClass, N as createUdsLoggerWithControl, P as LocalChildClient, Rt as RUNNER_RSS_BUDGET_ENV, St as installManifestNativeDeps, Zt as startRunnerHeapWatch, a as createUdsAddonContext, at as getWorkerNativeCapSnapshot, it as getWorkerNativeCapProvider, lt as validateProviderRegistrations, n as installManifestPythonDeps, nn as emitHeapDiagnosticReport, st as setWorkerNativeCapsChangeListener, t as installManifestSystemDeps } from "./manifest-system-deps-DnoPpLGp.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";
@@ -614,6 +614,7 @@ async function main() {
 			process.exit(1);
 		}
 		await installManifestPythonDeps(declaration, spec.addonDir, context.deps, context.logger);
+		await installManifestSystemDeps(declaration, context.logger);
 		const registeredProviders = /* @__PURE__ */ new Map();
 		const initWatchdog = startInitWatchdog({
 			addonId: spec.addonId,

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ot as errMsg, S as addonPagesCapability, kt as BaseAddon, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, in as EventCategory, jt as errMsg, w as addonPagesCapability } from "../../dist-DKs---Vx.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ot as errMsg, kt as BaseAddon, tn as EventCategory, w as addonWidgetsCapability } from "../../dist-LvKus-mT.mjs";
+import { E as addonWidgetsCapability, Mt as BaseAddon, in as EventCategory, jt as errMsg } from "../../dist-DKs---Vx.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as createEvent, Ot as errMsg, T as alertsCapability, kt as BaseAddon, n as AlertSchema, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { D as alertsCapability, Gt as createEvent, Mt as BaseAddon, in as EventCategory, jt as errMsg, n as AlertSchema } from "../../dist-DKs---Vx.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.d.ts

@@ -120,13 +120,16 @@ export declare class BackupOrchestratorAddon extends BaseAddon<Record<string, ne
      */
     private scheduleRestore;
     /**
-     * Resolve a target destination set: caller-provided list wins;
-     * otherwise fall back to every destination flagged as enabled in
-     * its policy row (`triggerSupported !== false` after the policy
-     * join). The old "global enabledDestinations override" was retired
-     * along with the orchestrator settings panel — per-destination
-     * `enabled` toggles in the destinations table are now the only
-     * routing knob.
+     * Resolve a target destination set — see {@link selectBackupTargets} for the
+     * rule. Caller-provided list wins over the per-destination policy flag;
+     * NEITHER wins over `StorageLocation.enabled`, which is the operator's
+     * switch on the storage screen and the only one that means "this disk takes
+     * no writes" (D62).
+     *
+     * Reads locations + policies directly rather than going through
+     * `listDestinations()`: that method also reads every destination's
+     * `manifests.json` to hydrate `lastSuccess`, which target resolution has no
+     * use for and which cost one round-trip per destination on every trigger.
      */
     private resolveTargets;
     private startScheduleTimer;

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");
@@ -4777,6 +4777,28 @@ function mapRowToSchedule(row) {
 	};
 }
 //#endregion
+//#region src/builtins/backup-orchestrator/write-targets.ts
+/**
+* Pick the destinations an archive may be fanned out to.
+*
+* An explicit `requested` list selects from the candidates by id and bypasses
+* the policy flag (that is today's behaviour and it is right: naming a
+* destination IS the opt-in). A requested id that is not a `backups` location
+* at all is simply absent from the candidates and drops out here, exactly as
+* before.
+*
+* The location flag is applied LAST and to both paths, so there is one place
+* where "disabled" is honoured rather than one per caller.
+*/
+function selectBackupTargets(input) {
+	const requested = input.requested;
+	const pool = requested && requested.length > 0 ? input.candidates.filter((c) => requested.includes(c.id)) : input.candidates.filter((c) => c.policyEnabled);
+	return {
+		targets: pool.filter((c) => c.locationEnabled),
+		skippedDisabled: pool.filter((c) => !c.locationEnabled).map((c) => c.id)
+	};
+}
+//#endregion
 //#region src/builtins/backup-orchestrator/backup-orchestrator.addon.ts
 /**
 * `backup-orchestrator` builtin — singleton owner of the `backup` cap.
@@ -5002,7 +5024,7 @@ var BackupOrchestratorAddon = class extends require_dist.BaseAddon {
 			subId,
 			displayName,
 			kind: kindFromProviderId(loc.providerId),
-			triggerSupported: effective.enabled,
+			triggerSupported: effective.enabled && loc.enabled !== false,
 			restoreSupported: true,
 			enabled: effective.enabled,
 			retentionCount: effective.retentionCount,
@@ -5367,18 +5389,34 @@ var BackupOrchestratorAddon = class extends require_dist.BaseAddon {
 		});
 	}
 	/**
-	* Resolve a target destination set: caller-provided list wins;
-	* otherwise fall back to every destination flagged as enabled in
-	* its policy row (`triggerSupported !== false` after the policy
-	* join). The old "global enabledDestinations override" was retired
-	* along with the orchestrator settings panel — per-destination
-	* `enabled` toggles in the destinations table are now the only
-	* routing knob.
+	* Resolve a target destination set — see {@link selectBackupTargets} for the
+	* rule. Caller-provided list wins over the per-destination policy flag;
+	* NEITHER wins over `StorageLocation.enabled`, which is the operator's
+	* switch on the storage screen and the only one that means "this disk takes
+	* no writes" (D62).
+	*
+	* Reads locations + policies directly rather than going through
+	* `listDestinations()`: that method also reads every destination's
+	* `manifests.json` to hydrate `lastSuccess`, which target resolution has no
+	* use for and which cost one round-trip per destination on every trigger.
 	*/
 	async resolveTargets(requested) {
-		const all = await this.listDestinations();
-		if (requested && requested.length > 0) return all.filter((d) => requested.includes(d.id));
-		return all.filter((d) => d.triggerSupported !== false);
+		const locations = await this.fetchBackupLocations();
+		const policies = await this.loadPoliciesIndexed(locations.map((l) => l.id));
+		const selection = selectBackupTargets({
+			candidates: locations.map((l) => ({
+				id: l.id,
+				locationEnabled: l.enabled !== false,
+				policyEnabled: (policies.get(l.id) ?? this.fallbackPolicy(l.id)).enabled
+			})),
+			...requested && requested.length > 0 ? { requested: [...requested] } : {}
+		});
+		if (selection.skippedDisabled.length > 0) this.ctx.logger.warn("backup: destination skipped — its storage location is disabled by the operator", { meta: {
+			destinationIds: [...selection.skippedDisabled],
+			requestedExplicitly: requested !== void 0 && requested.length > 0
+		} });
+		if (selection.targets.length === 0 && selection.skippedDisabled.length > 0) throw new Error(`every selected backup destination is disabled (${selection.skippedDisabled.join(", ")}) — enable its storage location on the Storage screen, or choose another destination. Refusing to write an archive to a location the operator turned off.`);
+		return selection.targets.map((t) => ({ id: t.id }));
 	}
 	startScheduleTimer() {
 		if (this.scheduleTimer) return;

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { D as backupCapability, kt as BaseAddon, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, in as EventCategory, k as backupCapability } from "../../dist-DKs---Vx.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";
@@ -4762,6 +4762,28 @@ function mapRowToSchedule(row) {
 	};
 }
 //#endregion
+//#region src/builtins/backup-orchestrator/write-targets.ts
+/**
+* Pick the destinations an archive may be fanned out to.
+*
+* An explicit `requested` list selects from the candidates by id and bypasses
+* the policy flag (that is today's behaviour and it is right: naming a
+* destination IS the opt-in). A requested id that is not a `backups` location
+* at all is simply absent from the candidates and drops out here, exactly as
+* before.
+*
+* The location flag is applied LAST and to both paths, so there is one place
+* where "disabled" is honoured rather than one per caller.
+*/
+function selectBackupTargets(input) {
+	const requested = input.requested;
+	const pool = requested && requested.length > 0 ? input.candidates.filter((c) => requested.includes(c.id)) : input.candidates.filter((c) => c.policyEnabled);
+	return {
+		targets: pool.filter((c) => c.locationEnabled),
+		skippedDisabled: pool.filter((c) => !c.locationEnabled).map((c) => c.id)
+	};
+}
+//#endregion
 //#region src/builtins/backup-orchestrator/backup-orchestrator.addon.ts
 /**
 * `backup-orchestrator` builtin — singleton owner of the `backup` cap.
@@ -4987,7 +5009,7 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			subId,
 			displayName,
 			kind: kindFromProviderId(loc.providerId),
-			triggerSupported: effective.enabled,
+			triggerSupported: effective.enabled && loc.enabled !== false,
 			restoreSupported: true,
 			enabled: effective.enabled,
 			retentionCount: effective.retentionCount,
@@ -5352,18 +5374,34 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 		});
 	}
 	/**
-	* Resolve a target destination set: caller-provided list wins;
-	* otherwise fall back to every destination flagged as enabled in
-	* its policy row (`triggerSupported !== false` after the policy
-	* join). The old "global enabledDestinations override" was retired
-	* along with the orchestrator settings panel — per-destination
-	* `enabled` toggles in the destinations table are now the only
-	* routing knob.
+	* Resolve a target destination set — see {@link selectBackupTargets} for the
+	* rule. Caller-provided list wins over the per-destination policy flag;
+	* NEITHER wins over `StorageLocation.enabled`, which is the operator's
+	* switch on the storage screen and the only one that means "this disk takes
+	* no writes" (D62).
+	*
+	* Reads locations + policies directly rather than going through
+	* `listDestinations()`: that method also reads every destination's
+	* `manifests.json` to hydrate `lastSuccess`, which target resolution has no
+	* use for and which cost one round-trip per destination on every trigger.
 	*/
 	async resolveTargets(requested) {
-		const all = await this.listDestinations();
-		if (requested && requested.length > 0) return all.filter((d) => requested.includes(d.id));
-		return all.filter((d) => d.triggerSupported !== false);
+		const locations = await this.fetchBackupLocations();
+		const policies = await this.loadPoliciesIndexed(locations.map((l) => l.id));
+		const selection = selectBackupTargets({
+			candidates: locations.map((l) => ({
+				id: l.id,
+				locationEnabled: l.enabled !== false,
+				policyEnabled: (policies.get(l.id) ?? this.fallbackPolicy(l.id)).enabled
+			})),
+			...requested && requested.length > 0 ? { requested: [...requested] } : {}
+		});
+		if (selection.skippedDisabled.length > 0) this.ctx.logger.warn("backup: destination skipped — its storage location is disabled by the operator", { meta: {
+			destinationIds: [...selection.skippedDisabled],
+			requestedExplicitly: requested !== void 0 && requested.length > 0
+		} });
+		if (selection.targets.length === 0 && selection.skippedDisabled.length > 0) throw new Error(`every selected backup destination is disabled (${selection.skippedDisabled.join(", ")}) — enable its storage location on the Storage screen, or choose another destination. Refusing to write an archive to a location the operator turned off.`);
+		return selection.targets.map((t) => ({ id: t.id }));
 	}
 	startScheduleTimer() {
 		if (this.scheduleTimer) return;

package/dist/builtins/backup-orchestrator/write-targets.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Which `backups` locations tonight's archive may land on.
+ *
+ * ## Why this is its own module
+ *
+ * The orchestrator had **two** enabled switches for one function: the
+ * operator-visible `StorageLocation.enabled` on the storage screen, and
+ * `backup_destination_policies.enabled`, seeded `true` for every newly-seen
+ * location. Only the second one was consulted, so a location the storage
+ * screen showed as disabled still received the archive — the exact shape D62
+ * exists to forbid ("a second switch that disagrees with the first is worse
+ * than no switch").
+ *
+ * The location flag is now the OUTER gate for every path, and the policy flag
+ * keeps its narrower meaning: *this destination takes part in the unattended
+ * fan-out*. An explicit request (an operator pressing Back up now with a
+ * destination selected, or a schedule naming `locationIds`) still overrides
+ * the policy flag — it never overrides the location flag, because that one is
+ * the operator saying "do not write here" about the disk itself.
+ *
+ * Kept pure and separate so the decision can be read in one screen and the
+ * addon is left with fetch → decide → log → upload.
+ */
+/** One `backups` location, reduced to the two flags that decide a write. */
+export interface BackupTargetCandidate {
+    readonly id: string;
+    /**
+     * `StorageLocation.enabled`. ABSENT MEANS ACTIVE — the caller maps
+     * `enabled !== false`, so a legacy location persisted before the flag
+     * existed stays a destination.
+     */
+    readonly locationEnabled: boolean;
+    /** `backup_destination_policies.enabled` — the unattended-fan-out opt-in. */
+    readonly policyEnabled: boolean;
+}
+export interface BackupTargetSelection {
+    /** Destinations the archive may be written to. */
+    readonly targets: readonly BackupTargetCandidate[];
+    /**
+     * Ids dropped because the OPERATOR disabled the storage location. Returned
+     * rather than silently filtered: a fan-out that drops a destination must say
+     * so, and the caller decides between "log and continue" and "refuse".
+     */
+    readonly skippedDisabled: readonly string[];
+}
+export interface BackupTargetSelectionInput {
+    readonly candidates: readonly BackupTargetCandidate[];
+    /** Explicitly named destinations (cap input, or a schedule's `locationIds`). */
+    readonly requested?: readonly string[];
+}
+/**
+ * Pick the destinations an archive may be fanned out to.
+ *
+ * An explicit `requested` list selects from the candidates by id and bypasses
+ * the policy flag (that is today's behaviour and it is right: naming a
+ * destination IS the opt-in). A requested id that is not a `backups` location
+ * at all is simply absent from the candidates and drops out here, exactly as
+ * before.
+ *
+ * The location flag is applied LAST and to both paths, so there is one place
+ * where "disabled" is honoured rather than one per caller.
+ */
+export declare function selectBackupTargets(input: BackupTargetSelectionInput): BackupTargetSelection;

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-DKs---Vx.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { M as coreBlockIdFromAddonId, N as coreBlocksCapability, Ot as errMsg, c as CoreBlockSchema, j as coreBlockAddonId, kt as BaseAddon, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, u as DeclaredDevices } from "../../dist-LvKus-mT.mjs";
+import { F as coreBlockIdFromAddonId, I as coreBlocksCapability, Mt as BaseAddon, P as coreBlockAddonId, c as CoreBlockSchema, jt as errMsg, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, u as DeclaredDevices } from "../../dist-DKs---Vx.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-bindings-store.d.ts

@@ -1,6 +1,7 @@
 import { AddonContext, CapabilityDefinition, DeviceBindingEntry, ICapabilityRegistry } from '@camstack/types';
 import { DeviceBindingsStore } from './device-meta-types.js';
 import { DeviceRow, DeviceRowStore } from './device-row-store.js';
+import { WriteLock } from './write-lock.js';
 /** Push-fed remote native-cap cache shape (numeric deviceId → capName → owner). */
 export type RemoteNativeCaps = Map<number, Map<string, {
     addonId: string;
@@ -18,6 +19,27 @@ export interface BindingsDeps {
     /** Row access for `device-manager:devices` — the device ledger the type and
      *  presence gates below consult. */
     readonly rows: DeviceRowStore;
+    /**
+     * Ordering for every read-modify-write of this addon's `addon-settings` key
+     * range — `deviceBindings` above all, but also `locations`, `nextDeviceId`
+     * and `roleDisplayDefaults`.
+     *
+     * `deviceBindings` is ONE fleet-wide blob keyed by device, so a writer that
+     * only means to touch camera 615 rewrites every camera's row. Nothing
+     * ordered those writers, and the window between the read and the write is a
+     * settings-door round trip — an RPC to the isolated `sqlite-settings` child,
+     * measured at 2.9 s on the live hub mid-drain (D181). Two toggles on
+     * DIFFERENT cameras therefore lost each other, and the value that went
+     * missing was `{ wrapperAddonId: null }`: the marker that keeps a
+     * `defaultActive` wrapper from re-binding. The operator's OFF came back ON
+     * (D62).
+     *
+     * **Writers only.** No read path takes this lock: `getBindings`,
+     * `getBindingsBatch` and `getAllBindings` must never queue behind a write,
+     * and putting a read under it would make a 1 019-device sweep wait on
+     * whatever toggle happens to be in flight.
+     */
+    readonly withAddonStoreWriteLock: WriteLock;
 }
 /**
  * Wire the push-fed cross-process native-cap cache (`remoteNativeCaps`).
@@ -107,8 +129,15 @@ export type DevicePresence = 'present' | 'absent' | 'unknown';
  * same reason `getAllBindings` warns instead of reporting zero devices. That is
  * the only reason this is async: the `COUNT(*)` runs solely on the miss path,
  * where the alternative is to call a device gone because the store is empty.
+ *
+ * `ledgerNonEmpty` is passed IN rather than defaulted, deliberately. A default
+ * that issued its own `rows.count()` would be a per-device read hiding behind
+ * an optional argument — the exact shape this file just removed from the
+ * activations blob — and nothing would fail when a future caller took it.
  */
-export declare function resolveDevicePresence(deps: BindingsDeps, row: DeviceRow | null, deviceId: number): Promise<DevicePresence>;
+export declare function resolveDevicePresence(deps: BindingsDeps, row: DeviceRow | null, deviceId: number, ledgerNonEmpty: LedgerNonEmpty): Promise<DevicePresence>;
+/** "Does the ledger hold any row at all?", asked at most once per pass. */
+export type LedgerNonEmpty = () => Promise<boolean>;
 /**
  * Does a capability apply to a device of type `deviceType`?
  *
@@ -138,15 +167,23 @@ export declare function getBindings(deps: BindingsDeps, input: {
  * `getAllBindings` (511 ms / 679 KB of mostly-unwanted rows).
  *
  * Sequential on purpose, like `getAllBindings`: `resolveBindingsForDevice`'s
- * remaining per-device work (the bindings-store read, the routing rules) runs
- * on this process's own event loop, so concurrency buys nothing there and a
- * fan-out of `Promise.all` over hundreds of ids only makes the queue less fair
- * to everything else on it. The one part that DOES amortise across the whole
- * set — the device row lookup — is fetched ONCE, ahead of the loop
- * ({@link DeviceRowStore.getMany}), rather than once per iteration: measured
- * on the live hub 2026-08-25, `get device-manager:devices` ran 1 656
- * calls/min steady-state, one row per call, which is exactly what looping
- * `getBindings`'s own `rows.get(deviceId)` here produced.
+ * remaining per-device work is the routing rules, which run on this process's
+ * own event loop, so concurrency buys nothing there and a fan-out of
+ * `Promise.all` over hundreds of ids only makes the queue less fair to
+ * everything else on it. Both parts that DO amortise across the whole set are
+ * fetched ONCE, ahead of the loop, and in parallel with each other:
+ *
+ *  - the device rows ({@link DeviceRowStore.getMany}) rather than once per
+ *    iteration — measured on the live hub 2026-08-25, `get
+ *    device-manager:devices` ran 1 656 calls/min steady-state, one row per
+ *    call, which is exactly what looping `getBindings`'s own
+ *    `rows.get(deviceId)` here produced;
+ *  - the wrapper-activation blob, which the per-device resolver used to read
+ *    itself — a second settings-door round trip per id, on the call that
+ *    exists precisely so a caller needing many devices does not pay per
+ *    device. Measured on the live hub 2026-08-30, mid-drain:
+ *    `getBindingsBatch` of 1 id = 5.78 s, of 8 ids = 17.16 s — a slope of
+ *    1.63 s PER ADDITIONAL DEVICE, on a call that ships 4.5 KB a row.
  */
 export declare function getBindingsBatch(deps: BindingsDeps, input: {
     deviceIds: readonly number[];
@@ -164,6 +201,15 @@ export declare function getBindingsBatch(deps: BindingsDeps, input: {
  * clients invalidate via the existing
  * `capability.binding-changed` event rather than re-fetching this
  * payload periodically.
+ *
+ * **"Single round-trip" was a claim, not a fact, until 2026-08-30.** The
+ * per-device resolver read the wrapper-activation blob itself, so this call
+ * issued one settings-door RPC per device — 1 020 of them on the live
+ * 1 019-device hub, at ~2.9 s each while the storage drain ran. It did not
+ * return in 240 s, and `SystemMirror.init` gives it 15 s, so the admin UI
+ * could not boot at all. Now the whole pass costs exactly TWO reads (the fleet
+ * listing and the blob), issued in parallel, and nothing in the loop awaits a
+ * store.
  */
 export declare function getAllBindings(deps: BindingsDeps): Promise<Array<{
     deviceId: number;

package/dist/builtins/device-manager/device-manager.addon.d.ts

@@ -83,6 +83,17 @@ export declare class DeviceManagerAddon extends BaseAddon {
      * it through {@link bindingsDeps} or the `ProviderContext`.
      */
     private deviceRows;
+    /**
+     * The ONE lock ordering every read-modify-write of this addon's
+     * `addon-settings` key range (`deviceBindings`, `locations`, `nextDeviceId`,
+     * `roleDisplayDefaults`).
+     *
+     * It lives on the addon rather than on `DeviceMetaStore` because the writers
+     * do not all go through that class — `setWrapperActive` and `removeDevice`'s
+     * bindings purge reach the store through `BindingsDeps` — and two locks over
+     * one key range is the same defect one level up. Handed to both.
+     */
+    private readonly addonStoreWriteLock;
     /** Build the dependency context the extracted binding resolvers consume. */
     private get bindingsDeps();
     getBindings(input: {