@camstack/system 1.2.195 → 1.2.197

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Qnc3kuba.js");
+const require_dist = require("../../dist-BNaW68aZ.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { D as addonPagesCapability, Ft as errMsg, It as BaseAddon, cn as EventCategory } from "../../dist-Cr3ChLtE.mjs";
+import { D as addonPagesCapability, Ft as errMsg, It as BaseAddon, cn as EventCategory } from "../../dist-DWnHJI2T.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Qnc3kuba.js");
+const require_dist = require("../../dist-BNaW68aZ.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as errMsg, It as BaseAddon, cn as EventCategory, k as addonWidgetsCapability } from "../../dist-Cr3ChLtE.mjs";
+import { Ft as errMsg, It as BaseAddon, cn as EventCategory, k as addonWidgetsCapability } from "../../dist-DWnHJI2T.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Qnc3kuba.js");
+const require_dist = require("../../dist-BNaW68aZ.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { A as alertsCapability, Ft as errMsg, It as BaseAddon, Yt as createEvent, cn as EventCategory, n as AlertSchema } from "../../dist-Cr3ChLtE.mjs";
+import { A as alertsCapability, Ft as errMsg, It as BaseAddon, Yt as createEvent, cn as EventCategory, n as AlertSchema } from "../../dist-DWnHJI2T.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Qnc3kuba.js");
+const require_dist = require("../../dist-BNaW68aZ.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { It as BaseAddon, M as backupCapability, cn as EventCategory } from "../../dist-Cr3ChLtE.mjs";
+import { It as BaseAddon, M as backupCapability, cn as EventCategory } from "../../dist-DWnHJI2T.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Qnc3kuba.js");
+const require_dist = require("../../dist-BNaW68aZ.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { It as BaseAddon, lt as logDestinationCapability } from "../../dist-Cr3ChLtE.mjs";
+import { It as BaseAddon, lt as logDestinationCapability } from "../../dist-DWnHJI2T.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Qnc3kuba.js");
+const require_dist = require("../../dist-BNaW68aZ.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { Ft as errMsg, It as BaseAddon, L as coreBlockAddonId, R as coreBlockIdFromAddonId, c as CORE_BLOCK_ADDON_PREFIX, d as DeclaredDevices, l as CoreBlockSchema, s as CORE_BLOCKS_ADDON_ID, z as coreBlocksCapability } from "../../dist-Cr3ChLtE.mjs";
+import { Ft as errMsg, It as BaseAddon, L as coreBlockAddonId, R as coreBlockIdFromAddonId, c as CORE_BLOCK_ADDON_PREFIX, d as DeclaredDevices, l as CoreBlockSchema, s as CORE_BLOCKS_ADDON_ID, z as coreBlocksCapability } from "../../dist-DWnHJI2T.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Qnc3kuba.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-C_h6HXZi.js");
+const require_dist = require("../../dist-BNaW68aZ.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-FwgzdSHJ.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -1367,6 +1367,17 @@ function resolveDeviceById(registry, deviceId) {
 	};
 }
 //#endregion
+//#region src/builtins/device-manager/device-online-fallback.ts
+/**
+* The value to hand `resolveDeviceOnline` as its fallback. The mirrored
+* `device-status` slice, when one exists, still wins over this.
+*/
+function persistedOnlineFallback(input) {
+	if (!input.registryPresent) return false;
+	if (input.parentDeviceId !== null) return true;
+	return Object.keys(input.config ?? {}).length > 0;
+}
+//#endregion
 //#region src/builtins/device-manager/device-queries.ts
 /**
 * The ORIGINATING addon id off a cap-channel call's `args`, or `undefined`.
@@ -1384,15 +1395,35 @@ function extractCallerAddonId(input) {
 }
 async function listPersistedByAddon(pctx, input) {
 	const { addonId } = input;
-	return (await pctx.metaStore.rows.listByAddon(addonId)).map(({ meta: m }) => ({
-		id: m.id,
-		stableId: m.stableId,
-		type: m.type,
-		name: m.name,
-		location: m.location ?? null,
-		disabled: m.disabled ?? false,
-		parentDeviceId: m.parentDeviceId
-	}));
+	const rows = await pctx.metaStore.rows.listByAddon(addonId);
+	const saved = [];
+	for (const row of rows) {
+		const m = row.meta;
+		if (!row.registered) {
+			const reserved = await pctx.settings.readDeviceStore(m.id);
+			if (Object.keys(reserved ?? {}).length === 0) {
+				pctx.host.ctx.logger.warn("Skipping an unregistered device reservation with no configuration — not a device, not restored", {
+					tags: { deviceId: m.id },
+					meta: {
+						addonId,
+						stableId: m.stableId,
+						type: m.type
+					}
+				});
+				continue;
+			}
+		}
+		saved.push({
+			id: m.id,
+			stableId: m.stableId,
+			type: m.type,
+			name: m.name,
+			location: m.location ?? null,
+			disabled: m.disabled ?? false,
+			parentDeviceId: m.parentDeviceId
+		});
+	}
+	return saved;
 }
 /**
 * Every requested device's persisted config, in as few store round trips as the
@@ -1476,7 +1507,11 @@ async function listAll(pctx, input) {
 			disabled: m.disabled ?? false,
 			parentDeviceId: m.parentDeviceId ?? null,
 			role: toDeviceRole(m.role),
-			online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
+			online: pctx.host.resolveDeviceOnline(m.id, persistedOnlineFallback({
+				registryPresent: pctx.registry !== null,
+				parentDeviceId: m.parentDeviceId ?? null,
+				config: persistedConfig
+			})),
 			probed: pctx.host.resolveDeviceProbed(m.id),
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(persistedType),
@@ -1521,7 +1556,11 @@ async function getDevice(pctx, input) {
 		disabled: m.disabled ?? false,
 		parentDeviceId: m.parentDeviceId,
 		role: toDeviceRole(m.role),
-		online: pctx.host.resolveDeviceOnline(deviceId, true),
+		online: pctx.host.resolveDeviceOnline(deviceId, persistedOnlineFallback({
+			registryPresent: true,
+			parentDeviceId: m.parentDeviceId ?? null,
+			config: persistedConfig
+		})),
 		probed: pctx.host.resolveDeviceProbed(deviceId),
 		features: persistedFeatures(m.features),
 		isCamera: persistedIsCamera(m.type),
@@ -1905,7 +1944,7 @@ async function discoverDevices(pctx, input) {
 async function adoptDevice(pctx, input) {
 	const dp = await pctx.host.requireDeviceProvider(input.addonId);
 	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device adoption`);
-	const summary = await dp.adoptDiscoveredDevice({ candidate: input.candidate });
+	const summary = await pctx.removalFence.runUnfenced(() => dp.adoptDiscoveredDevice({ candidate: input.candidate }));
 	if (input.integrationId !== void 0) try {
 		await pctx.stampIntegrationId(summary.id, input.integrationId);
 	} catch (err) {
@@ -1927,10 +1966,10 @@ async function getCreationSchema(pctx, input) {
 async function createDevice(pctx, input) {
 	const dp = await pctx.host.requireDeviceProvider(input.addonId);
 	if (!await dp.supportsManualCreation({})) throw new Error(`Addon "${input.addonId}" does not support manual device creation`);
-	const summary = await dp.createDevice({
+	const summary = await pctx.removalFence.runUnfenced(() => dp.createDevice({
 		type: input.type,
 		config: input.config
-	});
+	}));
 	if (input.integrationId !== void 0) try {
 		await pctx.stampIntegrationId(summary.id, input.integrationId);
 	} catch (err) {
@@ -3792,6 +3831,17 @@ async function allocateDeviceId(pctx, input) {
 	return await pctx.metaStore.withMetaWriteLock(async () => {
 		const existing = await pctx.metaStore.rows.findByStableId(addonId, stableId);
 		if (existing) return { id: existing.meta.id };
+		const fenced = pctx.removalFence.isPairFenced(addonId, stableId);
+		if (fenced) {
+			pctx.host.ctx.logger.warn("allocateDeviceId refused — this device was just removed, NOT re-created", {
+				tags: { deviceId: fenced.deviceId },
+				meta: {
+					addonId,
+					stableId
+				}
+			});
+			throw new Error(`[device-manager] allocateDeviceId: device ${fenced.deviceId} (${addonId}/${stableId}) was removed — refusing to re-create it`);
+		}
 		const id = await pctx.metaStore.allocateNextDeviceId();
 		await pctx.metaStore.rows.upsert({
 			addonId,
@@ -3939,6 +3989,16 @@ async function migrateDevice(pctx, input) {
 async function registerDevice(pctx, input) {
 	const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
 	const featuresArr = Array.isArray(features) ? [...features] : [];
+	if (pctx.removalFence.isIdFenced(id) ?? pctx.removalFence.isPairFenced(addonId, stableId)) {
+		pctx.host.ctx.logger.warn("registerDevice refused — this device was removed, NOT resurrected", {
+			tags: { deviceId: id },
+			meta: {
+				addonId,
+				stableId
+			}
+		});
+		throw new Error(`[device-manager] registerDevice: device ${id} (${addonId}/${stableId}) was removed — refusing to resurrect it`);
+	}
 	const { isFirstRegistration, exportFingerprint, fingerprintChanged, inheritedLocation, inheritedDescendantIds, inheritFailed } = await pctx.metaStore.withMetaWriteLock(async () => {
 		const existingRow = await pctx.metaStore.rows.get(id);
 		const existingMeta = existingRow?.meta;
@@ -4079,6 +4139,11 @@ async function removeDevice(pctx, input) {
 	const deviceName = persistedMeta.name;
 	await pctx.metaStore.withMetaWriteLock(async () => {
 		await pctx.metaStore.rows.remove(deviceId);
+		pctx.removalFence.record({
+			deviceId,
+			addonId,
+			stableId
+		});
 	});
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -6444,6 +6509,56 @@ function createMigrationGuard(now = Date.now) {
 		}
 	};
 }
+function pairKey(addonId, stableId) {
+	return `${addonId}${stableId}`;
+}
+function createRemovalFence(options = {}) {
+	const ttlMs = options.ttlMs ?? 3e5;
+	const now = options.now ?? (() => Date.now());
+	const byId = /* @__PURE__ */ new Map();
+	const byPair = /* @__PURE__ */ new Map();
+	let suspensions = 0;
+	const fresh = (entry) => {
+		if (entry === void 0) return null;
+		if (suspensions > 0) return null;
+		if (now() - entry.removedAt >= ttlMs) {
+			byId.delete(entry.deviceId);
+			byPair.delete(pairKey(entry.addonId, entry.stableId));
+			return null;
+		}
+		return entry;
+	};
+	return {
+		record(entry) {
+			const full = {
+				...entry,
+				removedAt: now()
+			};
+			byId.set(full.deviceId, full);
+			byPair.set(pairKey(full.addonId, full.stableId), full);
+		},
+		isIdFenced(deviceId) {
+			return fresh(byId.get(deviceId));
+		},
+		isPairFenced(addonId, stableId) {
+			return fresh(byPair.get(pairKey(addonId, stableId)));
+		},
+		lift(addonId, stableId) {
+			const entry = byPair.get(pairKey(addonId, stableId));
+			if (entry === void 0) return;
+			byPair.delete(pairKey(addonId, stableId));
+			byId.delete(entry.deviceId);
+		},
+		async runUnfenced(fn) {
+			suspensions += 1;
+			try {
+				return await fn();
+			} finally {
+				suspensions -= 1;
+			}
+		}
+	};
+}
 //#endregion
 //#region src/builtins/device-manager/device-manager.addon.ts
 var DeviceManagerAddon = class extends require_dist.BaseAddon {
@@ -6686,6 +6801,7 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			registry,
 			bindingsDeps: this.bindingsDeps,
 			migrationGuard: createMigrationGuard(),
+			removalFence: createRemovalFence(),
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
 			get provider() {

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { Bt as DeviceFeature, F as buildStreamParamsConfigSchema, Ft as errMsg, G as deviceStatusCapability, Gt as WELL_KNOWN_TAB_MAP, Ht as DeviceType, It as BaseAddon, J as enumerateItemArrayFields, St as runtimeStatePolicyFor, U as deviceManagerCapability, Vt as DeviceRole, W as deviceStateCapability, Y as enumerateSchemaFields, a as CAMERA_SWITCH_ORDER, bt as resolveContainerPrimaryChild, cn as EventCategory, en as isDeviceConfigCap, f as DeviceStatusSchema, ht as parseStreamParamsFormPatch, o as CAP_NAMES_WITH_STATUS, pt as normalizeUnit, sn as sleep, t as ALL_CAPABILITY_DEFINITIONS, x as STREAM_PROFILE_META } from "../../dist-Cr3ChLtE.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-BG6g74f1.mjs";
+import { Bt as DeviceFeature, F as buildStreamParamsConfigSchema, Ft as errMsg, G as deviceStatusCapability, Gt as WELL_KNOWN_TAB_MAP, Ht as DeviceType, It as BaseAddon, J as enumerateItemArrayFields, St as runtimeStatePolicyFor, U as deviceManagerCapability, Vt as DeviceRole, W as deviceStateCapability, Y as enumerateSchemaFields, a as CAMERA_SWITCH_ORDER, bt as resolveContainerPrimaryChild, cn as EventCategory, en as isDeviceConfigCap, f as DeviceStatusSchema, ht as parseStreamParamsFormPatch, o as CAP_NAMES_WITH_STATUS, pt as normalizeUnit, sn as sleep, t as ALL_CAPABILITY_DEFINITIONS, x as STREAM_PROFILE_META } from "../../dist-DWnHJI2T.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-cjLVvYV0.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -1362,6 +1362,17 @@ function resolveDeviceById(registry, deviceId) {
 	};
 }
 //#endregion
+//#region src/builtins/device-manager/device-online-fallback.ts
+/**
+* The value to hand `resolveDeviceOnline` as its fallback. The mirrored
+* `device-status` slice, when one exists, still wins over this.
+*/
+function persistedOnlineFallback(input) {
+	if (!input.registryPresent) return false;
+	if (input.parentDeviceId !== null) return true;
+	return Object.keys(input.config ?? {}).length > 0;
+}
+//#endregion
 //#region src/builtins/device-manager/device-queries.ts
 /**
 * The ORIGINATING addon id off a cap-channel call's `args`, or `undefined`.
@@ -1379,15 +1390,35 @@ function extractCallerAddonId(input) {
 }
 async function listPersistedByAddon(pctx, input) {
 	const { addonId } = input;
-	return (await pctx.metaStore.rows.listByAddon(addonId)).map(({ meta: m }) => ({
-		id: m.id,
-		stableId: m.stableId,
-		type: m.type,
-		name: m.name,
-		location: m.location ?? null,
-		disabled: m.disabled ?? false,
-		parentDeviceId: m.parentDeviceId
-	}));
+	const rows = await pctx.metaStore.rows.listByAddon(addonId);
+	const saved = [];
+	for (const row of rows) {
+		const m = row.meta;
+		if (!row.registered) {
+			const reserved = await pctx.settings.readDeviceStore(m.id);
+			if (Object.keys(reserved ?? {}).length === 0) {
+				pctx.host.ctx.logger.warn("Skipping an unregistered device reservation with no configuration — not a device, not restored", {
+					tags: { deviceId: m.id },
+					meta: {
+						addonId,
+						stableId: m.stableId,
+						type: m.type
+					}
+				});
+				continue;
+			}
+		}
+		saved.push({
+			id: m.id,
+			stableId: m.stableId,
+			type: m.type,
+			name: m.name,
+			location: m.location ?? null,
+			disabled: m.disabled ?? false,
+			parentDeviceId: m.parentDeviceId
+		});
+	}
+	return saved;
 }
 /**
 * Every requested device's persisted config, in as few store round trips as the
@@ -1471,7 +1502,11 @@ async function listAll(pctx, input) {
 			disabled: m.disabled ?? false,
 			parentDeviceId: m.parentDeviceId ?? null,
 			role: toDeviceRole(m.role),
-			online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
+			online: pctx.host.resolveDeviceOnline(m.id, persistedOnlineFallback({
+				registryPresent: pctx.registry !== null,
+				parentDeviceId: m.parentDeviceId ?? null,
+				config: persistedConfig
+			})),
 			probed: pctx.host.resolveDeviceProbed(m.id),
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(persistedType),
@@ -1516,7 +1551,11 @@ async function getDevice(pctx, input) {
 		disabled: m.disabled ?? false,
 		parentDeviceId: m.parentDeviceId,
 		role: toDeviceRole(m.role),
-		online: pctx.host.resolveDeviceOnline(deviceId, true),
+		online: pctx.host.resolveDeviceOnline(deviceId, persistedOnlineFallback({
+			registryPresent: true,
+			parentDeviceId: m.parentDeviceId ?? null,
+			config: persistedConfig
+		})),
 		probed: pctx.host.resolveDeviceProbed(deviceId),
 		features: persistedFeatures(m.features),
 		isCamera: persistedIsCamera(m.type),
@@ -1900,7 +1939,7 @@ async function discoverDevices(pctx, input) {
 async function adoptDevice(pctx, input) {
 	const dp = await pctx.host.requireDeviceProvider(input.addonId);
 	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device adoption`);
-	const summary = await dp.adoptDiscoveredDevice({ candidate: input.candidate });
+	const summary = await pctx.removalFence.runUnfenced(() => dp.adoptDiscoveredDevice({ candidate: input.candidate }));
 	if (input.integrationId !== void 0) try {
 		await pctx.stampIntegrationId(summary.id, input.integrationId);
 	} catch (err) {
@@ -1922,10 +1961,10 @@ async function getCreationSchema(pctx, input) {
 async function createDevice(pctx, input) {
 	const dp = await pctx.host.requireDeviceProvider(input.addonId);
 	if (!await dp.supportsManualCreation({})) throw new Error(`Addon "${input.addonId}" does not support manual device creation`);
-	const summary = await dp.createDevice({
+	const summary = await pctx.removalFence.runUnfenced(() => dp.createDevice({
 		type: input.type,
 		config: input.config
-	});
+	}));
 	if (input.integrationId !== void 0) try {
 		await pctx.stampIntegrationId(summary.id, input.integrationId);
 	} catch (err) {
@@ -3787,6 +3826,17 @@ async function allocateDeviceId(pctx, input) {
 	return await pctx.metaStore.withMetaWriteLock(async () => {
 		const existing = await pctx.metaStore.rows.findByStableId(addonId, stableId);
 		if (existing) return { id: existing.meta.id };
+		const fenced = pctx.removalFence.isPairFenced(addonId, stableId);
+		if (fenced) {
+			pctx.host.ctx.logger.warn("allocateDeviceId refused — this device was just removed, NOT re-created", {
+				tags: { deviceId: fenced.deviceId },
+				meta: {
+					addonId,
+					stableId
+				}
+			});
+			throw new Error(`[device-manager] allocateDeviceId: device ${fenced.deviceId} (${addonId}/${stableId}) was removed — refusing to re-create it`);
+		}
 		const id = await pctx.metaStore.allocateNextDeviceId();
 		await pctx.metaStore.rows.upsert({
 			addonId,
@@ -3934,6 +3984,16 @@ async function migrateDevice(pctx, input) {
 async function registerDevice(pctx, input) {
 	const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
 	const featuresArr = Array.isArray(features) ? [...features] : [];
+	if (pctx.removalFence.isIdFenced(id) ?? pctx.removalFence.isPairFenced(addonId, stableId)) {
+		pctx.host.ctx.logger.warn("registerDevice refused — this device was removed, NOT resurrected", {
+			tags: { deviceId: id },
+			meta: {
+				addonId,
+				stableId
+			}
+		});
+		throw new Error(`[device-manager] registerDevice: device ${id} (${addonId}/${stableId}) was removed — refusing to resurrect it`);
+	}
 	const { isFirstRegistration, exportFingerprint, fingerprintChanged, inheritedLocation, inheritedDescendantIds, inheritFailed } = await pctx.metaStore.withMetaWriteLock(async () => {
 		const existingRow = await pctx.metaStore.rows.get(id);
 		const existingMeta = existingRow?.meta;
@@ -4074,6 +4134,11 @@ async function removeDevice(pctx, input) {
 	const deviceName = persistedMeta.name;
 	await pctx.metaStore.withMetaWriteLock(async () => {
 		await pctx.metaStore.rows.remove(deviceId);
+		pctx.removalFence.record({
+			deviceId,
+			addonId,
+			stableId
+		});
 	});
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -6439,6 +6504,56 @@ function createMigrationGuard(now = Date.now) {
 		}
 	};
 }
+function pairKey(addonId, stableId) {
+	return `${addonId}${stableId}`;
+}
+function createRemovalFence(options = {}) {
+	const ttlMs = options.ttlMs ?? 3e5;
+	const now = options.now ?? (() => Date.now());
+	const byId = /* @__PURE__ */ new Map();
+	const byPair = /* @__PURE__ */ new Map();
+	let suspensions = 0;
+	const fresh = (entry) => {
+		if (entry === void 0) return null;
+		if (suspensions > 0) return null;
+		if (now() - entry.removedAt >= ttlMs) {
+			byId.delete(entry.deviceId);
+			byPair.delete(pairKey(entry.addonId, entry.stableId));
+			return null;
+		}
+		return entry;
+	};
+	return {
+		record(entry) {
+			const full = {
+				...entry,
+				removedAt: now()
+			};
+			byId.set(full.deviceId, full);
+			byPair.set(pairKey(full.addonId, full.stableId), full);
+		},
+		isIdFenced(deviceId) {
+			return fresh(byId.get(deviceId));
+		},
+		isPairFenced(addonId, stableId) {
+			return fresh(byPair.get(pairKey(addonId, stableId)));
+		},
+		lift(addonId, stableId) {
+			const entry = byPair.get(pairKey(addonId, stableId));
+			if (entry === void 0) return;
+			byPair.delete(pairKey(addonId, stableId));
+			byId.delete(entry.deviceId);
+		},
+		async runUnfenced(fn) {
+			suspensions += 1;
+			try {
+				return await fn();
+			} finally {
+				suspensions -= 1;
+			}
+		}
+	};
+}
 //#endregion
 //#region src/builtins/device-manager/device-manager.addon.ts
 var DeviceManagerAddon = class extends BaseAddon {
@@ -6681,6 +6796,7 @@ var DeviceManagerAddon = class extends BaseAddon {
 			registry,
 			bindingsDeps: this.bindingsDeps,
 			migrationGuard: createMigrationGuard(),
+			removalFence: createRemovalFence(),
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
 			get provider() {

package/dist/builtins/device-manager/device-online-fallback.d.ts

@@ -0,0 +1,35 @@
+/**
+ * What "online" means for a device the hub can only see on disk.
+ *
+ * The authority for a device's liveness is the addon that owns it (D224): it
+ * publishes `device-status` through `markOnline`, the hub mirrors that slice,
+ * and every persisted-row projection reads the mirror. The FALLBACK — what the
+ * hub answers before any slice has arrived — used to be "a persisted row
+ * implies a successful registration, so: online". That assumption is false for
+ * exactly one shape of row, and it is the shape a bad removal leaves behind: a
+ * top-level device with NO configuration, which its provider can never restore
+ * (its config schema rejects an empty blob), so no owner will ever publish a
+ * slice contradicting the guess.
+ *
+ * Device 614 was reported `online: true` for a full day that way, while its
+ * provider logged `Failed to restore device` eight times. A device without
+ * configuration cannot be online — the row is a leftover, not a camera. See
+ * D376.
+ *
+ * Children are left on the legacy fallback deliberately: an accessory child
+ * (siren, floodlight, PIR) legitimately carries an empty config blob and gets
+ * its liveness from the parent's worker.
+ */
+export interface PersistedOnlineFallbackInput {
+    /** Is a hub-side device registry present at all? `false` is the "offline view". */
+    readonly registryPresent: boolean;
+    /** `null` for a top-level device. */
+    readonly parentDeviceId: number | null;
+    /** The device's persisted config blob, as read from its device store. */
+    readonly config: Record<string, unknown> | undefined;
+}
+/**
+ * The value to hand `resolveDeviceOnline` as its fallback. The mirrored
+ * `device-status` slice, when one exists, still wins over this.
+ */
+export declare function persistedOnlineFallback(input: PersistedOnlineFallbackInput): boolean;

package/dist/builtins/device-manager/device-provider-context.d.ts

@@ -3,6 +3,7 @@ import { AdoptionJobEngine } from './adoption-job-engine.js';
 import { BindingsDeps } from './device-bindings-store.js';
 import { DeviceManagerSettings, DeviceMetaStore } from './device-meta-store.js';
 import { MigrationGuard } from './migrate-guard.js';
+import { RemovalFence } from './removal-fence.js';
 type IDeviceProviderCap = InferProvider<typeof deviceProviderCapability>;
 /**
  * The addon-instance surface the extracted provider functions need. Exposed by
@@ -51,6 +52,11 @@ export interface ProviderContext {
     /** In-flight refusal + completed-swap replay for `migrateDevice` — the
      *  reason a retried migration can no longer undo the one that ran. */
     readonly migrationGuard: MigrationGuard;
+    /** Keeps a removed device removed: refuses the `registerDevice` /
+     *  `allocateDeviceId` that a still-live device object issues as its runner
+     *  tears down, which is how a deleted camera came back as a config-less
+     *  shell (D376). */
+    readonly removalFence: RemovalFence;
     /** Resolve the per-device `device-ops` native provider (throws when absent). */
     requireDeviceOps(deviceId: number): IDeviceOpsProvider;
     /** Stamp an integration id onto a device's meta row + emit DeviceMetaChanged. */