@camstack/system 1.2.157 → 1.2.160

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as buildStreamParamsConfigSchema, Ft as DeviceType, H as enumerateItemArrayFields, L as deviceManagerCapability, Nt as DeviceFeature, Ot as errMsg, Pt as DeviceRole, R as deviceStateCapability, Rt as WELL_KNOWN_TAB_MAP, U as enumerateSchemaFields, _ as STREAM_PROFILE_META, a as CAP_NAMES_WITH_STATUS, d as DeviceStatusSchema, en as sleep, ht as runtimeStatePolicyFor, kt as BaseAddon, lt as parseStreamParamsFormPatch, qt as isDeviceConfigCap, st as normalizeUnit, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory, z as deviceStatusCapability } from "../../dist-LvKus-mT.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CV4QVdXj.mjs";
+import { B as deviceManagerCapability, G as enumerateItemArrayFields, H as deviceStatusCapability, It as DeviceFeature, K as enumerateSchemaFields, Lt as DeviceRole, M as buildStreamParamsConfigSchema, Mt as BaseAddon, Rt as DeviceType, V as deviceStateCapability, Vt as WELL_KNOWN_TAB_MAP, Xt as isDeviceConfigCap, a as CAP_NAMES_WITH_STATUS, d as DeviceStatusSchema, ft as parseStreamParamsFormPatch, in as EventCategory, jt as errMsg, rn as sleep, t as ALL_CAPABILITY_DEFINITIONS, ut as normalizeUnit, vt as runtimeStatePolicyFor, y as STREAM_PROFILE_META } from "../../dist-DKs---Vx.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-C3eONTvV.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -564,11 +564,31 @@ function resolveDeviceType(deps, row, deviceId) {
 * same reason `getAllBindings` warns instead of reporting zero devices. That is
 * the only reason this is async: the `COUNT(*)` runs solely on the miss path,
 * where the alternative is to call a device gone because the store is empty.
+*
+* `ledgerNonEmpty` is passed IN rather than defaulted, deliberately. A default
+* that issued its own `rows.count()` would be a per-device read hiding behind
+* an optional argument — the exact shape this file just removed from the
+* activations blob — and nothing would fail when a future caller took it.
 */
-async function resolveDevicePresence(deps, row, deviceId) {
+async function resolveDevicePresence(deps, row, deviceId, ledgerNonEmpty) {
 	if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
 	if (row !== null) return "present";
-	return await deps.rows.count() > 0 ? "absent" : "unknown";
+	return await ledgerNonEmpty() ? "absent" : "unknown";
+}
+/**
+* `deps.rows.count()`, collapsed to at most one call per pass.
+*
+* The count answers a FLEET question ("has device restore run at all?"), not a
+* per-device one, and it is reached only when a device misses both the live
+* registry and the ledger. A fleet sweep over a store that is genuinely empty
+* hits that path once per device.
+*/
+function onceLedgerNonEmpty(deps) {
+	let pending = null;
+	return () => {
+		if (pending === null) pending = deps.rows.count().then((n) => n > 0);
+		return pending;
+	};
 }
 /**
 * Does a capability apply to a device of type `deviceType`?
@@ -589,8 +609,11 @@ function capAppliesToDeviceType(def, deviceType) {
 	return declared.some((t) => t === deviceType);
 }
 async function getBindings(deps, input) {
-	const row = await deps.rows.get(input.deviceId);
-	return resolveBindingsForDevice(deps, input.deviceId, row);
+	const [row, store] = await Promise.all([deps.rows.get(input.deviceId), readBindingsStore(deps)]);
+	return resolveBindingsForDevice(deps, input.deviceId, row, {
+		store,
+		ledgerNonEmpty: onceLedgerNonEmpty(deps)
+	});
 }
 /**
 * The `getBindings` resolver, taking the device's row as a PARAMETER instead
@@ -605,12 +628,22 @@ async function getBindings(deps, input) {
 * iteration shape measured on the live hub 2026-08-25: `get
 * device-manager:devices` at 1 656 calls/min steady-state and 17 687 during
 * boot, one row per call.
+*
+* The {@link BindingsPass} is the SECOND half of that same split, and it is
+* the one that was missing. This function used to issue its own
+* `readBindingsStore(deps)` — one settings-door round trip per device, for a
+* blob that is identical for every device in the pass. `getAllBindings` on the
+* live 1 019-device hub therefore cost 1 020 round trips; it never answered
+* inside `SystemMirror.init`'s 15 s budget, and the admin UI refused to boot.
+* Now every entry point resolves the pass once and hands it down — so this
+* function performs NO store reads of its own, and every device in a sweep
+* sees the same version of the activations.
 */
-async function resolveBindingsForDevice(deps, deviceId, row) {
+async function resolveBindingsForDevice(deps, deviceId, row, pass) {
 	const storeKey = String(deviceId);
-	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+	const perDevice = pass.store.deviceBindings[storeKey] ?? {};
 	const deviceType = resolveDeviceType(deps, row, deviceId);
-	const presence = await resolveDevicePresence(deps, row, deviceId);
+	const presence = await resolveDevicePresence(deps, row, deviceId, pass.ledgerNonEmpty);
 	const entries = [];
 	const seenCaps = /* @__PURE__ */ new Set();
 	const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
@@ -718,21 +751,33 @@ async function resolveBindingsForDevice(deps, deviceId, row) {
 * `getAllBindings` (511 ms / 679 KB of mostly-unwanted rows).
 *
 * Sequential on purpose, like `getAllBindings`: `resolveBindingsForDevice`'s
-* remaining per-device work (the bindings-store read, the routing rules) runs
-* on this process's own event loop, so concurrency buys nothing there and a
-* fan-out of `Promise.all` over hundreds of ids only makes the queue less fair
-* to everything else on it. The one part that DOES amortise across the whole
-* set — the device row lookup — is fetched ONCE, ahead of the loop
-* ({@link DeviceRowStore.getMany}), rather than once per iteration: measured
-* on the live hub 2026-08-25, `get device-manager:devices` ran 1 656
-* calls/min steady-state, one row per call, which is exactly what looping
-* `getBindings`'s own `rows.get(deviceId)` here produced.
+* remaining per-device work is the routing rules, which run on this process's
+* own event loop, so concurrency buys nothing there and a fan-out of
+* `Promise.all` over hundreds of ids only makes the queue less fair to
+* everything else on it. Both parts that DO amortise across the whole set are
+* fetched ONCE, ahead of the loop, and in parallel with each other:
+*
+*  - the device rows ({@link DeviceRowStore.getMany}) rather than once per
+*    iteration — measured on the live hub 2026-08-25, `get
+*    device-manager:devices` ran 1 656 calls/min steady-state, one row per
+*    call, which is exactly what looping `getBindings`'s own
+*    `rows.get(deviceId)` here produced;
+*  - the wrapper-activation blob, which the per-device resolver used to read
+*    itself — a second settings-door round trip per id, on the call that
+*    exists precisely so a caller needing many devices does not pay per
+*    device. Measured on the live hub 2026-08-30, mid-drain:
+*    `getBindingsBatch` of 1 id = 5.78 s, of 8 ids = 17.16 s — a slope of
+*    1.63 s PER ADDITIONAL DEVICE, on a call that ships 4.5 KB a row.
 */
 async function getBindingsBatch(deps, input) {
 	const ids = [...new Set(input.deviceIds)];
-	const rows = await deps.rows.getMany(ids);
+	const [rows, store] = await Promise.all([deps.rows.getMany(ids), readBindingsStore(deps)]);
+	const pass = {
+		store,
+		ledgerNonEmpty: onceLedgerNonEmpty(deps)
+	};
 	const out = [];
-	for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null));
+	for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null, pass));
 	return out;
 }
 /**
@@ -745,9 +790,18 @@ async function getBindingsBatch(deps, input) {
 * clients invalidate via the existing
 * `capability.binding-changed` event rather than re-fetching this
 * payload periodically.
+*
+* **"Single round-trip" was a claim, not a fact, until 2026-08-30.** The
+* per-device resolver read the wrapper-activation blob itself, so this call
+* issued one settings-door RPC per device — 1 020 of them on the live
+* 1 019-device hub, at ~2.9 s each while the storage drain ran. It did not
+* return in 240 s, and `SystemMirror.init` gives it 15 s, so the admin UI
+* could not boot at all. Now the whole pass costs exactly TWO reads (the fleet
+* listing and the blob), issued in parallel, and nothing in the loop awaits a
+* store.
 */
 async function getAllBindings(deps) {
-	const fleet = await deps.rows.listAll();
+	const [fleet, store] = await Promise.all([deps.rows.listAll(), readBindingsStore(deps)]);
 	const rowById = /* @__PURE__ */ new Map();
 	const ids = /* @__PURE__ */ new Set();
 	for (const row of fleet) {
@@ -760,8 +814,12 @@ async function getAllBindings(deps) {
 		deps.ctx.logger.warn("getAllBindings found no devices — warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
 		return [];
 	}
+	const pass = {
+		store,
+		ledgerNonEmpty: onceLedgerNonEmpty(deps)
+	};
 	const out = [];
-	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null));
+	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null, pass));
 	return out;
 }
 /**
@@ -1461,15 +1519,39 @@ async function getDevice(pctx, input) {
 	};
 }
 /**
-* The children of ONE parent, projected from rows and live devices the caller
-* has ALREADY read.
+* The child ids whose config comes from the SETTINGS STORE — the rows the live
+* registry does not answer for.
+*
+* The one place the "persisted fills in what the registry does not hold" rule
+* is spelled, so the pre-read and the projection cannot disagree about which
+* children need a store value. On the live hub 2026-08-30 this is every child
+* there is: all 896 belong to forked provider addons, so hub-main's registry
+* holds none of them.
+*/
+function persistedChildIds(childRows, liveChildren) {
+	const live = /* @__PURE__ */ new Set();
+	for (const device of liveChildren) live.add(device.id);
+	return childRows.filter((row) => !live.has(row.meta.id)).map((row) => row.meta.id);
+}
+/**
+* The children of ONE parent, projected from rows, live devices AND configs the
+* caller has ALREADY read.
 *
 * Extracted so `getChildren` and `getChildrenBatch` share one projection: the
 * batch differs only in HOW the rows were fetched (one `listByParentMany`
 * instead of N `listByParent`), never in what a parent's answer looks like.
-* Byte-for-byte the body `getChildren` had.
+*
+* **Not async, and that is the contract.** This function used to `await
+* pctx.settings.readDeviceStore(m.id)` inside its own loop — one settings-door
+* round trip per persisted child, sequentially, on hub-main's event loop. The
+* caller above (`getChildrenBatch`, coalescing every accessory reconcile in
+* flight) had already removed the ledger N+1 and left this one: 896 door reads
+* per boot reconcile and per device page, at ~2.9 s each mid-drain. `configs`
+* arrives resolved through `readDeviceConfigs` — one round trip for the whole
+* pass — and a signature with no `Promise` in it means a future read cannot be
+* put back here without the type saying so.
 */
-async function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren) {
+function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs) {
 	const results = [];
 	const seen = /* @__PURE__ */ new Set();
 	const rowById = /* @__PURE__ */ new Map();
@@ -1485,9 +1567,9 @@ async function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, li
 		const childStableId = m.stableId;
 		const key = String(m.id);
 		if (seen.has(key)) continue;
-		const persistedConfig = await pctx.settings.readDeviceStore(m.id);
+		const persistedConfig = configs.get(m.id) ?? {};
 		const metadata = row.metadata;
-		const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
+		const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig, childStableId, ownerAddonId);
 		results.push({
 			id: m.id,
 			stableId: childStableId,
@@ -1502,7 +1584,7 @@ async function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, li
 			probed: pctx.host.resolveDeviceProbed(m.id),
 			features: persistedFeatures(m.features),
 			isCamera: false,
-			config: persistedConfig ?? {},
+			config: persistedConfig,
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -1536,18 +1618,23 @@ async function getChildren(pctx, input) {
 	}
 	const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
 	const liveChildren = pctx.registry?.getChildren(parentDeviceId) ?? [];
-	return [...await projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren)];
+	const configs = await readDeviceConfigs(pctx, persistedChildIds(childRows, liveChildren));
+	return [...projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs)];
 }
 /**
-* `getChildren` for a set of parents — TWO store reads for the whole set, not
-* two per parent.
+* `getChildren` for a set of parents — THREE store reads for the whole set, not
+* three per parent (and not one per child).
 *
 * The single-parent path costs one `resolvePersistedById` (a primary-key read)
 * plus one `listByParent` (an indexed scan) EACH. Asked once per device at
 * boot that was 1 024 of each, measured on the live hub 2026-08-27 — see the
 * cap method's note. Here the ownership lookup for every parent the live
 * registry does not hold is ONE `getMany`, and the children of every parent
-* are ONE `listByParentMany`.
+* are ONE `listByParentMany`. The third read is the settings door, and it is
+* one for the whole batch: `readDeviceConfigs` over every persisted child of
+* every parent. That one was the leftover — the ledger N+1 was removed and a
+* door round trip PER CHILD stayed behind it (896 on the live hub 2026-08-30,
+* all of them forked-owned and therefore all persisted).
 *
 * The live half is indexed once too: `registry.getChildren` is
 * `getAll().filter(…)`, so calling it per parent would trade an RPC N+1 for an
@@ -1585,11 +1672,14 @@ async function getChildrenBatch(pctx, input) {
 		if (bucket === void 0) liveByParent.set(parentId, [device]);
 		else bucket.push(device);
 	}
+	const configIds = [];
+	for (const parentId of owners.keys()) configIds.push(...persistedChildIds(rowsByParent.get(parentId) ?? [], liveByParent.get(parentId) ?? []));
+	const configs = await readDeviceConfigs(pctx, configIds);
 	for (const [parentId, ownerAddonId] of owners) {
 		const childRows = rowsByParent.get(parentId) ?? [];
 		const liveChildren = liveByParent.get(parentId) ?? [];
 		if (childRows.length === 0 && liveChildren.length === 0) continue;
-		const projected = await projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren);
+		const projected = projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren, configs);
 		if (projected.length > 0) out[String(parentId)] = [...projected];
 	}
 	return out;
@@ -2951,18 +3041,20 @@ async function listBindableCapsForDeviceType(deps, input) {
 }
 async function setWrapperActive(deps, input) {
 	const storeKey = String(input.deviceId);
-	const store = await readBindingsStore(deps.bindingsDeps);
-	const perDevice = { ...store.deviceBindings[storeKey] };
-	if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
-	else perDevice[input.capName] = { wrapperAddonId: null };
-	const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
-		...store.deviceBindings,
-		[storeKey]: perDevice
-	} : (() => {
-		const { [storeKey]: _drop, ...rest } = store.deviceBindings;
-		return rest;
-	})();
-	await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+	await deps.bindingsDeps.withAddonStoreWriteLock(async () => {
+		const store = await readBindingsStore(deps.bindingsDeps);
+		const perDevice = { ...store.deviceBindings[storeKey] };
+		if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
+		else perDevice[input.capName] = { wrapperAddonId: null };
+		const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
+			...store.deviceBindings,
+			[storeKey]: perDevice
+		} : (() => {
+			const { [storeKey]: _drop, ...rest } = store.deviceBindings;
+			return rest;
+		})();
+		await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+	});
 	deps.ctx.eventBus.emit({
 		id: randomUUID(),
 		timestamp: /* @__PURE__ */ new Date(),
@@ -3329,12 +3421,13 @@ async function removeDevice(pctx, input) {
 	});
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
-	const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
 	const bindingKey = String(deviceId);
-	if (bindingsStore.deviceBindings[bindingKey]) {
+	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+		const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
+		if (!bindingsStore.deviceBindings[bindingKey]) return;
 		const { [bindingKey]: _removedBindings, ...restBindings } = bindingsStore.deviceBindings;
 		await writeBindingsStore(pctx.bindingsDeps, { deviceBindings: restBindings });
-	}
+	});
 	pctx.host.remoteNativeCaps.delete(deviceId);
 	pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(deviceId);
 	pctx.metaStore.idToAddonId.delete(deviceId);
@@ -3796,16 +3889,24 @@ async function getRoleDisplayDefaults(pctx, _input) {
 /**
 * Replace the per-role display defaults whole-record (full replace). Override
 * units are normalized (`normalizeUnit`) at write so the render path always
-* looks up canonical spellings. Single-writer top-level key — no lock, no RMW,
-* no interaction with the device write lock. Not per-device, so no event
-* is emitted; the UI invalidates its own query on mutate.
+* looks up canonical spellings. Not per-device, so no event is emitted; the UI
+* invalidates its own query on mutate.
+*
+* This key is not itself read-modify-written, but `writeAddonStore` IS — the
+* door loads this addon's whole key range, merges the patch and re-inserts the
+* range (`settings-door-view.ts`). An unordered write of ANY key on that range
+* can therefore carry a stale copy of every other key, so it takes the same
+* lock as `deviceBindings` and `locations`. The old comment here claimed "no
+* lock, no RMW", which described the top-level key and not the write.
 */
 async function setRoleDisplayDefaults(pctx, input) {
 	const normalized = Object.fromEntries(Object.entries(input.defaults).map(([role, def]) => [role, def.unit !== void 0 ? {
 		...def,
 		unit: normalizeUnit(def.unit) ?? def.unit
 	} : def]));
-	await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+		await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+	});
 }
 /**
 * Batched meta pre-seed. Applies every provided field to the
@@ -4003,9 +4104,11 @@ async function listLocations(pctx) {
 async function addLocation(pctx, input) {
 	const trimmed = input.name.trim();
 	if (trimmed.length === 0) throw new Error("[device-manager] addLocation: name must be non-empty");
-	const current = (await pctx.metaStore.readStore()).locations ?? [];
-	if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
-	await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+		const current = (await pctx.metaStore.readStore()).locations ?? [];
+		if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
+		await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+	});
 }
 /**
 * Remove a label from the curated registry. Match is
@@ -4019,9 +4122,12 @@ async function addLocation(pctx, input) {
 async function removeLocation(pctx, input) {
 	const trimmed = input.name.trim();
 	if (trimmed.length === 0) return;
-	const current = (await pctx.metaStore.readStore()).locations ?? [];
-	const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
-	if (remaining.length !== current.length) await pctx.settings.writeAddonStore({ locations: remaining });
+	await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+		const current = (await pctx.metaStore.readStore()).locations ?? [];
+		const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
+		if (remaining.length === current.length) return;
+		await pctx.settings.writeAddonStore({ locations: remaining });
+	});
 	if (input.cascade !== true) return;
 	const cleared = await pctx.metaStore.withMetaWriteLock(async () => {
 		const out = [];
@@ -4072,24 +4178,41 @@ function isRoleDisplayDefaults(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
+//#region src/builtins/device-manager/write-lock.ts
+function createWriteLock() {
+	let chain = Promise.resolve();
+	return async (fn) => {
+		const previous = chain;
+		let release = () => {};
+		chain = new Promise((resolve) => {
+			release = resolve;
+		});
+		try {
+			await previous.catch(() => {});
+			return await fn();
+		} finally {
+			release();
+		}
+	};
+}
+//#endregion
 //#region src/builtins/device-manager/device-meta-store.ts
 var DeviceMetaStore = class {
 	settings;
 	registry;
 	rows;
+	withAddonStoreWriteLock;
 	/** Synchronous ownership cache, keyed by NUMERIC deviceId → owning addonId.
 	*  The persisted row store is authoritative but reads are async; hub-side
 	*  callers (e.g. `CapabilityRegistry.getNativeProvider` fallback) need
 	*  ownership without awaiting. Kept in sync with every register/remove and
 	*  warmed from persistence on boot. */
 	idToAddonId = /* @__PURE__ */ new Map();
-	/** Serialises every read-modify-write of a device row through one promise
-	*  chain (see `withMetaWriteLock`). Per-instance state. */
-	metaWriteChain = Promise.resolve();
-	constructor(settings, registry, rows) {
+	constructor(settings, registry, rows, withAddonStoreWriteLock = createWriteLock()) {
 		this.settings = settings;
 		this.registry = registry;
 		this.rows = rows;
+		this.withAddonStoreWriteLock = withAddonStoreWriteLock;
 	}
 	/** The read currently in flight, or null. Never a settled value — see
 	*  {@link readStore}. */
@@ -4120,20 +4243,7 @@ var DeviceMetaStore = class {
 		this.inFlightRead = read;
 		return read;
 	};
-	withMetaWriteLock = async (fn) => {
-		const previous = this.metaWriteChain;
-		let release = () => {};
-		const next = new Promise((resolve) => {
-			release = resolve;
-		});
-		this.metaWriteChain = next;
-		try {
-			await previous.catch(() => {});
-			return await fn();
-		} finally {
-			release();
-		}
-	};
+	withMetaWriteLock = createWriteLock();
 	/** The whole persisted row for one device, or `null`. */
 	getRow = async (deviceId) => this.rows.get(deviceId);
 	/**
@@ -4167,11 +4277,24 @@ var DeviceMetaStore = class {
 		ids.delete(parentId);
 		return [...ids];
 	};
-	allocateNextDeviceId = async () => {
+	/**
+	* Mint the next numeric device id.
+	*
+	* A read-modify-write of `nextDeviceId`, and it must hold the addon-store
+	* lock for the whole of it. Serialising the WRITES is not enough and never
+	* was: two callers that both read `N` both write `N + 1` and both return
+	* `N`, so two devices receive the same id. (`writeAddonStore` is itself
+	* read-modify-write over the addon's whole key range, so an unlocked bump
+	* can also be reverted wholesale by a concurrent `setWrapperActive`.)
+	*
+	* Callers hold {@link withMetaWriteLock} — this is the one nesting, and it
+	* only ever goes meta ⊃ addon-store.
+	*/
+	allocateNextDeviceId = async () => this.withAddonStoreWriteLock(async () => {
 		const current = (await this.readStore()).nextDeviceId ?? 1;
 		await this.settings.writeAddonStore({ nextDeviceId: current + 1 });
 		return current;
-	};
+	});
 };
 //#endregion
 //#region src/builtins/device-manager/fleet-read-census.ts
@@ -5554,6 +5677,17 @@ var DeviceManagerAddon = class extends BaseAddon {
 	* it through {@link bindingsDeps} or the `ProviderContext`.
 	*/
 	deviceRows = null;
+	/**
+	* The ONE lock ordering every read-modify-write of this addon's
+	* `addon-settings` key range (`deviceBindings`, `locations`, `nextDeviceId`,
+	* `roleDisplayDefaults`).
+	*
+	* It lives on the addon rather than on `DeviceMetaStore` because the writers
+	* do not all go through that class — `setWrapperActive` and `removeDevice`'s
+	* bindings purge reach the store through `BindingsDeps` — and two locks over
+	* one key range is the same defect one level up. Handed to both.
+	*/
+	addonStoreWriteLock = createWriteLock();
 	/** Build the dependency context the extracted binding resolvers consume. */
 	get bindingsDeps() {
 		const rows = this.deviceRows;
@@ -5562,7 +5696,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
 			remoteNativeCaps: this.remoteNativeCaps,
-			rows
+			rows,
+			withAddonStoreWriteLock: this.addonStoreWriteLock
 		};
 	}
 	async getBindings(input) {
@@ -5631,7 +5766,7 @@ var DeviceManagerAddon = class extends BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("retired-row purge failed", { meta: { error: errMsg(err) } });
 		}
-		const metaStore = new DeviceMetaStore(settings, registry, deviceRows);
+		const metaStore = new DeviceMetaStore(settings, registry, deviceRows, this.addonStoreWriteLock);
 		this.stateMirrorImpl = new DeviceStateMirror(this.ctx);
 		const stateMirror = this.stateMirrorImpl;
 		const resolvePersistedById = metaStore.resolvePersistedById;

package/dist/builtins/device-manager/device-meta-actions.d.ts

@@ -132,9 +132,15 @@ export declare function getRoleDisplayDefaults(pctx: ProviderContext, _input: Pa
 /**
  * Replace the per-role display defaults whole-record (full replace). Override
  * units are normalized (`normalizeUnit`) at write so the render path always
- * looks up canonical spellings. Single-writer top-level key — no lock, no RMW,
- * no interaction with the device write lock. Not per-device, so no event
- * is emitted; the UI invalidates its own query on mutate.
+ * looks up canonical spellings. Not per-device, so no event is emitted; the UI
+ * invalidates its own query on mutate.
+ *
+ * This key is not itself read-modify-written, but `writeAddonStore` IS — the
+ * door loads this addon's whole key range, merges the patch and re-inserts the
+ * range (`settings-door-view.ts`). An unordered write of ANY key on that range
+ * can therefore carry a stale copy of every other key, so it takes the same
+ * lock as `deviceBindings` and `locations`. The old comment here claimed "no
+ * lock, no RMW", which described the top-level key and not the write.
  */
 export declare function setRoleDisplayDefaults(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['setRoleDisplayDefaults']>[0]): ReturnType<IDeviceManagerProvider['setRoleDisplayDefaults']>;
 /**

package/dist/builtins/device-manager/device-meta-store.d.ts

@@ -1,6 +1,7 @@
 import { AddonContext, IDeviceRegistry } from '@camstack/types';
 import { AddonStore, PersistedDeviceMeta } from './device-meta-types.js';
 import { DeviceRow, DeviceRowStore } from './device-row-store.js';
+import { WriteLock } from './write-lock.js';
 /** The settings surface the meta store uses (`ctx.settings`, narrowed non-null). */
 export type DeviceManagerSettings = NonNullable<AddonContext['settings']>;
 export declare class DeviceMetaStore {
@@ -9,20 +10,33 @@ export declare class DeviceMetaStore {
     readonly registry: IDeviceRegistry | null;
     /** Row access for `device-manager:devices`. */
     readonly rows: DeviceRowStore;
+    /**
+     * The addon's OWN settings row set lock, shared with every other writer of
+     * it (`setWrapperActive`, `removeDevice`'s bindings purge, `addLocation`,
+     * `removeLocation`, `setRoleDisplayDefaults`) — see
+     * {@link BindingsDeps.addonStoreLock}. Owned by the addon, not by this
+     * class, because those writers do not all go through it.
+     */
+    readonly withAddonStoreWriteLock: WriteLock;
     /** Synchronous ownership cache, keyed by NUMERIC deviceId → owning addonId.
      *  The persisted row store is authoritative but reads are async; hub-side
      *  callers (e.g. `CapabilityRegistry.getNativeProvider` fallback) need
      *  ownership without awaiting. Kept in sync with every register/remove and
      *  warmed from persistence on boot. */
     readonly idToAddonId: Map<number, string>;
-    /** Serialises every read-modify-write of a device row through one promise
-     *  chain (see `withMetaWriteLock`). Per-instance state. */
-    private metaWriteChain;
     constructor(settings: DeviceManagerSettings, 
     /** Hub-process device registry (null when this node owns no registry). */
     registry: IDeviceRegistry | null, 
     /** Row access for `device-manager:devices`. */
-    rows: DeviceRowStore);
+    rows: DeviceRowStore, 
+    /**
+     * The addon's OWN settings row set lock, shared with every other writer of
+     * it (`setWrapperActive`, `removeDevice`'s bindings purge, `addLocation`,
+     * `removeLocation`, `setRoleDisplayDefaults`) — see
+     * {@link BindingsDeps.addonStoreLock}. Owned by the addon, not by this
+     * class, because those writers do not all go through it.
+     */
+    withAddonStoreWriteLock?: WriteLock);
     /** The read currently in flight, or null. Never a settled value — see
      *  {@link readStore}. */
     private inFlightRead;
@@ -40,7 +54,7 @@ export declare class DeviceMetaStore {
      * and the next caller reaches the store again.
      */
     readStore: () => Promise<AddonStore>;
-    withMetaWriteLock: <T>(fn: () => Promise<T>) => Promise<T>;
+    withMetaWriteLock: WriteLock;
     /** The whole persisted row for one device, or `null`. */
     getRow: (deviceId: number) => Promise<DeviceRow | null>;
     /**
@@ -62,5 +76,18 @@ export declare class DeviceMetaStore {
      *  and excluding self. Shared by the `remove` cascade and the `resetToSource`
      *  resync purge (#19). */
     directChildIds: (parentId: number) => Promise<readonly number[]>;
+    /**
+     * Mint the next numeric device id.
+     *
+     * A read-modify-write of `nextDeviceId`, and it must hold the addon-store
+     * lock for the whole of it. Serialising the WRITES is not enough and never
+     * was: two callers that both read `N` both write `N + 1` and both return
+     * `N`, so two devices receive the same id. (`writeAddonStore` is itself
+     * read-modify-write over the addon's whole key range, so an unlocked bump
+     * can also be reverted wholesale by a concurrent `setWrapperActive`.)
+     *
+     * Callers hold {@link withMetaWriteLock} — this is the one nesting, and it
+     * only ever goes meta ⊃ addon-store.
+     */
     allocateNextDeviceId: () => Promise<number>;
 }

package/dist/builtins/device-manager/device-queries.d.ts

@@ -6,15 +6,19 @@ export declare function listAll(pctx: ProviderContext, input: Parameters<IDevice
 export declare function getDevice(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['getDevice']>[0]): ReturnType<IDeviceManagerProvider['getDevice']>;
 export declare function getChildren(pctx: ProviderContext, input: Parameters<IDeviceManagerProvider['getChildren']>[0]): ReturnType<IDeviceManagerProvider['getChildren']>;
 /**
- * `getChildren` for a set of parents — TWO store reads for the whole set, not
- * two per parent.
+ * `getChildren` for a set of parents — THREE store reads for the whole set, not
+ * three per parent (and not one per child).
  *
  * The single-parent path costs one `resolvePersistedById` (a primary-key read)
  * plus one `listByParent` (an indexed scan) EACH. Asked once per device at
  * boot that was 1 024 of each, measured on the live hub 2026-08-27 — see the
  * cap method's note. Here the ownership lookup for every parent the live
  * registry does not hold is ONE `getMany`, and the children of every parent
- * are ONE `listByParentMany`.
+ * are ONE `listByParentMany`. The third read is the settings door, and it is
+ * one for the whole batch: `readDeviceConfigs` over every persisted child of
+ * every parent. That one was the leftover — the ledger N+1 was removed and a
+ * door round trip PER CHILD stayed behind it (896 on the live hub 2026-08-30,
+ * all of them forked-owned and therefore all persisted).
  *
  * The live half is indexed once too: `registry.getChildren` is
  * `getAll().filter(…)`, so calling it per parent would trade an RPC N+1 for an

package/dist/builtins/device-manager/write-lock.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The promise-chain mutex the device-manager orders its read-modify-writes
+ * with.
+ *
+ * One owner at a time, FIFO, no timers and no timeout: a waiter is parked on
+ * the previous holder's completion, so nothing is delayed that was not already
+ * waiting for a store round trip. A rejected holder still releases the chain —
+ * a failed write must not wedge every writer behind it.
+ *
+ * Extracted from `DeviceMetaStore.withMetaWriteLock`, which was the only
+ * instance until the addon's OWN settings row set needed the same ordering.
+ * Two subtly different copies of a mutex is not a thing this file wants to
+ * exist.
+ */
+/** Run `fn` with exclusive ownership of one lock. */
+export type WriteLock = <T>(fn: () => Promise<T>) => Promise<T>;
+export declare function createWriteLock(): WriteLock;

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over