@camstack/system 1.2.180 → 1.2.182

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_system_deps = require("./manifest-system-deps-BVIr3MYJ.js");
+const require_manifest_system_deps = require("./manifest-system-deps-BbP419V1.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -317,7 +317,7 @@ async function runWorkerDeviceRestoreWithRetry(addon, context, addonId, sourceNo
 			};
 		}));
 		await restoreFn.call(addon, savedDevices);
-		log?.info?.(`[worker-restore] "${addonId}": restored ${savedDevices.length} device(s)`);
+		log?.info?.(`[worker-restore] "${addonId}": restore pass complete for ${savedDevices.length} persisted device(s)`);
 	} catch (err) {
 		log?.warn?.(`[worker-restore] "${addonId}": restoreDevices threw: ${(0, _camstack_types_addon.errMsg)(err)}`);
 	}

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { A as createUdsLoggerWithControl, Ft as RUNNER_RSS_BUDGET_ENV, Jt as startRunnerHeapWatch, Qt as emitHeapDiagnosticReport, a as createUdsAddonContext, bt as resolveAddonClass, it as setWorkerNativeCapsChangeListener, j as LocalChildClient, n as installManifestPythonDeps, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestSystemDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-system-deps-Ci-jhrxY.mjs";
+import { A as createUdsLoggerWithControl, Ft as RUNNER_RSS_BUDGET_ENV, Jt as startRunnerHeapWatch, Qt as emitHeapDiagnosticReport, a as createUdsAddonContext, bt as resolveAddonClass, it as setWorkerNativeCapsChangeListener, j as LocalChildClient, n as installManifestPythonDeps, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestSystemDeps, tt as getWorkerNativeCapProvider, yt as installManifestNativeDeps } from "./manifest-system-deps-Bdezdcd5.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";
@@ -314,7 +314,7 @@ async function runWorkerDeviceRestoreWithRetry(addon, context, addonId, sourceNo
 			};
 		}));
 		await restoreFn.call(addon, savedDevices);
-		log?.info?.(`[worker-restore] "${addonId}": restored ${savedDevices.length} device(s)`);
+		log?.info?.(`[worker-restore] "${addonId}": restore pass complete for ${savedDevices.length} persisted device(s)`);
 	} catch (err) {
 		log?.warn?.(`[worker-restore] "${addonId}": restoreDevices threw: ${errMsg(err)}`);
 	}

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-TEwQZL3g.js");
+const require_dist = require("../../dist-D8VIyu_0.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { E as addonPagesCapability, Ft as BaseAddon, Pt as errMsg, sn as EventCategory } from "../../dist-DqNTelT4.mjs";
+import { E as addonPagesCapability, Ft as BaseAddon, Pt as errMsg, sn as EventCategory } from "../../dist-CVPtxkvV.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-TEwQZL3g.js");
+const require_dist = require("../../dist-D8VIyu_0.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, O as addonWidgetsCapability, Pt as errMsg, sn as EventCategory } from "../../dist-DqNTelT4.mjs";
+import { Ft as BaseAddon, O as addonWidgetsCapability, Pt as errMsg, sn as EventCategory } from "../../dist-CVPtxkvV.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-TEwQZL3g.js");
+const require_dist = require("../../dist-D8VIyu_0.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, Jt as createEvent, Pt as errMsg, k as alertsCapability, n as AlertSchema, sn as EventCategory } from "../../dist-DqNTelT4.mjs";
+import { Ft as BaseAddon, Jt as createEvent, Pt as errMsg, k as alertsCapability, n as AlertSchema, sn as EventCategory } from "../../dist-CVPtxkvV.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-TEwQZL3g.js");
+const require_dist = require("../../dist-D8VIyu_0.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, j as backupCapability, sn as EventCategory } from "../../dist-DqNTelT4.mjs";
+import { Ft as BaseAddon, j as backupCapability, sn as EventCategory } from "../../dist-CVPtxkvV.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-TEwQZL3g.js");
+const require_dist = require("../../dist-D8VIyu_0.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, ct as logDestinationCapability } from "../../dist-DqNTelT4.mjs";
+import { Ft as BaseAddon, ct as logDestinationCapability } from "../../dist-CVPtxkvV.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-TEwQZL3g.js");
+const require_dist = require("../../dist-D8VIyu_0.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as BaseAddon, I as coreBlockAddonId, L as coreBlockIdFromAddonId, Pt as errMsg, R as coreBlocksCapability, c as CORE_BLOCK_ADDON_PREFIX, d as DeclaredDevices, l as CoreBlockSchema, s as CORE_BLOCKS_ADDON_ID } from "../../dist-DqNTelT4.mjs";
+import { Ft as BaseAddon, I as coreBlockAddonId, L as coreBlockIdFromAddonId, Pt as errMsg, R as coreBlocksCapability, c as CORE_BLOCK_ADDON_PREFIX, d as DeclaredDevices, l as CoreBlockSchema, s as CORE_BLOCKS_ADDON_ID } from "../../dist-CVPtxkvV.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-TEwQZL3g.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DauPtbFR.js");
+const require_dist = require("../../dist-D8VIyu_0.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-wakiINPT.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -1896,7 +1896,10 @@ async function discoverDevices(pctx, input) {
 		stableId: d.stableId,
 		type: d.type,
 		suggestedName: d.suggestedName,
-		prefilledConfig: d.prefilledConfig
+		prefilledConfig: d.prefilledConfig,
+		...d.alreadyOnboarded === true ? { alreadyOnboarded: true } : {},
+		...d.onboardedDeviceId !== void 0 ? { onboardedDeviceId: d.onboardedDeviceId } : {},
+		...d.onboardedName !== void 0 ? { onboardedName: d.onboardedName } : {}
 	}));
 }
 async function adoptDevice(pctx, input) {
@@ -3280,8 +3283,6 @@ var DeviceEventPropagator = class {
 		return chain;
 	}
 };
-//#endregion
-//#region src/builtins/device-manager/migrate-device.ts
 /** A refusal that names a switch the camera does not offer, rather than one it
 *  could not be asked about. The cap documents rejecting the former; anything
 *  else is treated as the camera being out of reach, which is the safe reading:
@@ -3293,10 +3294,31 @@ function classify(err) {
 		detail
 	};
 }
+/**
+* One switch write under the bound. The race, not the write, is what fails on
+* timeout — the underlying promise is marked handled so a late rejection from
+* a camera that eventually answers "no" cannot surface as an unhandled
+* rejection after the migration already reported `unreachable`.
+*/
+async function setSwitchBounded(deps, deviceId, switchId, enabled) {
+	const budget = deps.switchTimeoutMs ?? 15e3;
+	const write = deps.setSwitch(deviceId, switchId, enabled);
+	write.catch(() => {});
+	let timer;
+	try {
+		await Promise.race([write, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error(`switch write did not answer within ${budget}ms — reported unreachable; if it lands late, a duplicate write of the same value is a no-op`));
+			}, budget);
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
 async function applyAll(deps, deviceId, enabled) {
 	const out = [];
 	for (const switchId of require_dist.CAMERA_SWITCH_ORDER) try {
-		await deps.setSwitch(deviceId, switchId, enabled);
+		await setSwitchBounded(deps, deviceId, switchId, enabled);
 		out.push({
 			deviceId,
 			switchId,
@@ -3344,7 +3366,6 @@ async function migrateDevice$1(deps, input) {
 		});
 	}
 	const up = await applyAll(deps, sourceId, true);
-	await deps.respawnRunners([sourceId, targetId]);
 	deps.log("camera migrated", {
 		sourceId,
 		targetId,
@@ -3360,6 +3381,52 @@ async function migrateDevice$1(deps, input) {
 	};
 }
 //#endregion
+//#region src/builtins/device-manager/migrate-reload.ts
+async function reloadMigratedDevices(pctx, targets) {
+	const ctx = pctx.host.ctx;
+	for (const target of targets) {
+		pctx.metaStore.idToAddonId.set(target.deviceId, target.addonId);
+		pctx.host.remoteNativeCaps.delete(target.deviceId);
+		pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(target.deviceId);
+	}
+	const fallbackAddons = /* @__PURE__ */ new Map();
+	await Promise.all(targets.map(async (target) => {
+		try {
+			const reloaded = await (await pctx.host.requireDeviceProvider(target.addonId)).reloadDevice({ stableId: target.stableId });
+			ctx.logger.info("migration: device reloaded in place — no other device disturbed", {
+				tags: { deviceId: target.deviceId },
+				meta: {
+					addonId: target.addonId,
+					stableId: target.stableId,
+					reloadedAs: reloaded.deviceId
+				}
+			});
+		} catch (err) {
+			ctx.logger.error("migration: in-place reload FAILED — falling back to a provider restart", {
+				tags: { deviceId: target.deviceId },
+				meta: {
+					addonId: target.addonId,
+					stableId: target.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			fallbackAddons.set(target.addonId, target.deviceId);
+		}
+	}));
+	if (fallbackAddons.size === 0) return;
+	await Promise.all([...fallbackAddons.entries()].map(async ([addonId, migratedDeviceId]) => {
+		const owned = [...pctx.metaStore.idToAddonId.entries()].filter(([, a]) => a === addonId).length;
+		ctx.logger.info("migration: restarting a whole provider to flush the id maps", {
+			tags: { deviceId: migratedDeviceId },
+			meta: {
+				addonId,
+				devicesTakenDown: owned
+			}
+		});
+		await ctx.api.addons.restartAddon.mutate({ addonId });
+	}));
+}
+//#endregion
 //#region src/builtins/device-manager/migrate-hardware-state.ts
 /**
 * The per-device state half of a migration (`deviceManager.migrateDevice`).
@@ -3540,72 +3607,121 @@ async function allocateDeviceId(pctx, input) {
 * The temp id comes from `allocateNextDeviceId`, the monotonic counter, so the
 * value a crash could park a row on was never used and will never be reused.
 * `swapIds` therefore runs INSIDE the same lock the id was allocated under.
+*
+* Retry-safe since 2026-09-04 (`migrate-guard.ts`): a concurrent call touching
+* either device is REFUSED before it can queue on the lock, and a repeat of a
+* completed swap — matched against the `addonId`/`stableId` fingerprint the
+* swap left on the rows — is a no-op returning the original report. A client
+* retry ran a second full cycle on 2026-09-01 and swapped two cameras back;
+* neither path can re-run a swap any more.
 */
 async function migrateDevice(pctx, input) {
 	const { sourceId, targetId } = input;
 	const ctx = pctx.host.ctx;
-	return await pctx.metaStore.withMetaWriteLock(async () => {
-		for (const id of [sourceId, targetId]) if (await pctx.metaStore.rows.get(id) === null) throw new Error(`[device-manager] migrateDevice: device ${id} does not exist`);
-		const tempId = await pctx.metaStore.allocateNextDeviceId();
-		return await migrateDevice$1({
-			setSwitch: async (deviceId, switchId, enabled) => {
-				await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
-					deviceId,
-					switchId,
-					enabled
-				});
-			},
-			swapIds: async (a, b) => {
-				await pctx.metaStore.rows.swapIds(a, b, tempId);
-			},
-			swapHardwareState: async (a, b) => {
-				const swapped = await swapHardwareState(pctx.settings, a, b);
-				pctx.host.seedMirror(a, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtSource));
-				pctx.host.seedMirror(b, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtTarget));
-				ctx.logger.info("migration: hardware-scoped device state swapped", {
-					tags: { deviceId: a },
+	pctx.migrationGuard.begin(sourceId, targetId);
+	try {
+		const outcome = await pctx.metaStore.withMetaWriteLock(async () => {
+			const sourceRow = await pctx.metaStore.rows.get(sourceId);
+			if (sourceRow === null) throw new Error(`[device-manager] migrateDevice: device ${sourceId} does not exist`);
+			const targetRow = await pctx.metaStore.rows.get(targetId);
+			if (targetRow === null) throw new Error(`[device-manager] migrateDevice: device ${targetId} does not exist`);
+			const replay = pctx.migrationGuard.matchReplay(sourceId, targetId, {
+				addonId: sourceRow.meta.addonId,
+				stableId: sourceRow.meta.stableId
+			}, {
+				addonId: targetRow.meta.addonId,
+				stableId: targetRow.meta.stableId
+			});
+			if (replay !== null) {
+				ctx.logger.info("migrateDevice: this swap already completed — replaying the original report, NOTHING re-run", {
+					tags: { deviceId: sourceId },
 					meta: {
-						sourceId: a,
-						targetId: b,
-						hardwareKeysToSource: swapped.hardwareKeysToSource,
-						hardwareKeysToTarget: swapped.hardwareKeysToTarget,
-						roleKeysKeptAtSource: swapped.roleKeysKeptAtSource,
-						roleKeysKeptAtTarget: swapped.roleKeysKeptAtTarget
+						sourceId,
+						targetId
 					}
 				});
-			},
-			forgetStreamState: async (deviceId) => {
-				await ctx.api.streamBroker.forgetDeviceHardware.mutate({ deviceId });
-			},
-			respawnRunners: async (deviceIds) => {
-				const owners = /* @__PURE__ */ new Set();
-				for (const deviceId of deviceIds) {
-					const addonId = pctx.metaStore.idToAddonId.get(deviceId);
-					if (addonId !== void 0) owners.add(addonId);
-				}
-				for (const addonId of owners) {
-					const owned = [...pctx.metaStore.idToAddonId.entries()].filter(([, a]) => a === addonId).length;
-					ctx.logger.info("migration: restarting a whole provider to flush the id maps", {
-						tags: { deviceId: sourceId },
+				return {
+					result: replay,
+					reloadTargets: null
+				};
+			}
+			const tempId = await pctx.metaStore.allocateNextDeviceId();
+			const result = await migrateDevice$1({
+				setSwitch: async (deviceId, switchId, enabled) => {
+					if (switchId === "stream-broker") {
+						const moved = await writeDisabledFlagUnderLock(pctx, deviceId, !enabled);
+						emitDisabledEvents(pctx, deviceId, !enabled, moved);
+						return;
+					}
+					await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
+						deviceId,
+						switchId,
+						enabled
+					});
+				},
+				swapIds: async (a, b) => {
+					await pctx.metaStore.rows.swapIds(a, b, tempId);
+				},
+				swapHardwareState: async (a, b) => {
+					const swapped = await swapHardwareState(pctx.settings, a, b);
+					pctx.host.seedMirror(a, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtSource));
+					pctx.host.seedMirror(b, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtTarget));
+					ctx.logger.info("migration: hardware-scoped device state swapped", {
+						tags: { deviceId: a },
 						meta: {
-							addonId,
-							devicesTakenDown: owned
+							sourceId: a,
+							targetId: b,
+							hardwareKeysToSource: swapped.hardwareKeysToSource,
+							hardwareKeysToTarget: swapped.hardwareKeysToTarget,
+							roleKeysKeptAtSource: swapped.roleKeysKeptAtSource,
+							roleKeysKeptAtTarget: swapped.roleKeysKeptAtTarget
 						}
 					});
-					await ctx.api.addons.restartAddon.mutate({ addonId });
+				},
+				forgetStreamState: async (deviceId) => {
+					await ctx.api.streamBroker.forgetDeviceHardware.mutate({ deviceId });
+				},
+				log: (message, meta) => {
+					ctx.logger.info(message, {
+						tags: { deviceId: sourceId },
+						meta
+					});
 				}
-			},
-			log: (message, meta) => {
-				ctx.logger.info(message, {
-					tags: { deviceId: sourceId },
-					meta
-				});
-			}
-		}, {
-			sourceId,
-			targetId
+			}, {
+				sourceId,
+				targetId
+			});
+			pctx.migrationGuard.recordCompleted({
+				sourceId,
+				targetId,
+				identityAtSource: {
+					addonId: targetRow.meta.addonId,
+					stableId: targetRow.meta.stableId
+				},
+				identityAtTarget: {
+					addonId: sourceRow.meta.addonId,
+					stableId: sourceRow.meta.stableId
+				},
+				result
+			});
+			return {
+				result,
+				reloadTargets: [{
+					deviceId: sourceId,
+					addonId: targetRow.meta.addonId,
+					stableId: targetRow.meta.stableId
+				}, {
+					deviceId: targetId,
+					addonId: sourceRow.meta.addonId,
+					stableId: sourceRow.meta.stableId
+				}]
+			};
 		});
-	});
+		if (outcome.reloadTargets !== null) await reloadMigratedDevices(pctx, outcome.reloadTargets);
+		return outcome.result;
+	} finally {
+		pctx.migrationGuard.end(sourceId, targetId);
+	}
 }
 async function registerDevice(pctx, input) {
 	const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
@@ -4292,35 +4408,23 @@ async function setMetadata(pctx, input) {
 	});
 }
 /**
-* Soft-disable the device. Persisted on the meta row;
-* lifecycle gating is the driver's responsibility (BaseDevice
-* exposes `this.disabled` for the driver to consult at the top
-* of its lifecycle methods).
-*
-* TWO events leave here, and they are not the same message:
-*
-*  - `device.meta-changed` fires on EVERY call. It is the meta-surface echo
-*    every UI redraws on, and idempotence is not interesting to it.
-*  - `device.disabled` / `device.enabled` fire ONLY when the flag actually
-*    MOVES. They are the lifecycle announcement — the operator asked to be
-*    told when a camera is switched off, and a write that re-states a flag the
-*    device already had is not that. Telemetry semantics (D8) are fine here: a
-*    dropped announcement costs a notification, never durable state, and the
-*    meta row is the authority either way (D62 — this switch stores nothing of
-*    its own).
+* Read + patch the `disabled` flag. The caller HOLDS the meta write lock —
+* this is split out of {@link setDisabled} so `migrateDevice`, which holds the
+* lock for its whole run, can write the same authority without re-acquiring
+* it (the self-deadlock documented at its `setSwitch`).
 */
-async function setDisabled(pctx, input) {
-	const { deviceId, disabled } = input;
-	const moved = await pctx.metaStore.withMetaWriteLock(async () => {
-		const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-		if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
-		const { meta: m } = persisted;
-		await pctx.metaStore.rows.patch(deviceId, { disabled });
-		return {
-			changed: (m.disabled ?? false) !== disabled,
-			integrationId: m.integrationId ?? ""
-		};
-	});
+async function writeDisabledFlagUnderLock(pctx, deviceId, disabled) {
+	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+	if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
+	const { meta: m } = persisted;
+	await pctx.metaStore.rows.patch(deviceId, { disabled });
+	return {
+		changed: (m.disabled ?? false) !== disabled,
+		integrationId: m.integrationId ?? ""
+	};
+}
+/** The two announcements — meta echo always, lifecycle only on a transition. */
+function emitDisabledEvents(pctx, deviceId, disabled, moved) {
 	pctx.host.ctx.eventBus.emit({
 		id: (0, node_crypto.randomUUID)(),
 		timestamp: /* @__PURE__ */ new Date(),
@@ -4350,6 +4454,10 @@ async function setDisabled(pctx, input) {
 		}
 	});
 }
+async function setDisabled(pctx, input) {
+	const { deviceId, disabled } = input;
+	emitDisabledEvents(pctx, deviceId, disabled, await pctx.metaStore.withMetaWriteLock(() => writeDisabledFlagUnderLock(pctx, deviceId, disabled)));
+}
 async function loadRuntimeState(pctx, input) {
 	const { deviceId } = input;
 	if (!await pctx.metaStore.resolvePersistedById(deviceId)) return {};
@@ -5964,6 +6072,43 @@ function resolveNativeCapOwnerSync(pctx, capName, deviceId) {
 	};
 	return resolveRemoteNativeCapFromRegistry(pctx.bindingsDeps, capName, deviceId);
 }
+function sameIdentity(a, b) {
+	return a.addonId === b.addonId && a.stableId === b.stableId;
+}
+/** One guard per device-manager instance. `now` is injectable for the specs. */
+function createMigrationGuard(now = Date.now) {
+	const inFlight = /* @__PURE__ */ new Set();
+	const completed = /* @__PURE__ */ new Map();
+	const pairKey = (sourceId, targetId) => `${sourceId}->${targetId}`;
+	return {
+		begin(sourceId, targetId) {
+			for (const id of [sourceId, targetId]) if (inFlight.has(id)) throw new Error(`[device-manager] migrateDevice: a migration involving device ${id} is already in flight — this call was refused, not queued. The running migration's report stands; re-read the device rows before retrying.`);
+			inFlight.add(sourceId);
+			inFlight.add(targetId);
+		},
+		end(sourceId, targetId) {
+			inFlight.delete(sourceId);
+			inFlight.delete(targetId);
+		},
+		recordCompleted(record) {
+			completed.set(pairKey(record.sourceId, record.targetId), {
+				...record,
+				completedAt: now()
+			});
+		},
+		matchReplay(sourceId, targetId, atSource, atTarget) {
+			const key = pairKey(sourceId, targetId);
+			const record = completed.get(key);
+			if (record === void 0) return null;
+			if (now() - record.completedAt > 9e5) {
+				completed.delete(key);
+				return null;
+			}
+			if (!sameIdentity(record.identityAtSource, atSource) || !sameIdentity(record.identityAtTarget, atTarget)) return null;
+			return record.result;
+		}
+	};
+}
 //#endregion
 //#region src/builtins/device-manager/device-manager.addon.ts
 var DeviceManagerAddon = class extends require_dist.BaseAddon {
@@ -6204,6 +6349,7 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			settings,
 			registry,
 			bindingsDeps: this.bindingsDeps,
+			migrationGuard: createMigrationGuard(),
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
 			get provider() {