@camstack/system 1.2.23 → 1.2.25

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-CqDPWqEE.js");
+const require_manifest_python_deps = require("./manifest-python-deps-COgal7Jy.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-57PA4rHm.mjs";
+import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-julrfvyf.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as fs from "node:fs";

package/dist/index.js

@@ -2,7 +2,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
 const require_dist = require("./dist-CS0pdC8l.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
-const require_manifest_python_deps = require("./manifest-python-deps-CqDPWqEE.js");
+const require_manifest_python_deps = require("./manifest-python-deps-COgal7Jy.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
 import { B as logLevelAtMost, Dt as readinessKey, Et as parseJsonUnknown$1, F as isVoidInput, I as kebabToCamel, L as lifecycleJobSchema, M as isArrayOutputSchema, N as isCollectionArrayMethod, Ot as resolveCapMount, P as isObjectInput, Tt as parseJsonObject, V as looseSchema, W as objectInputDeclaresAddonId, _t as asString$1, c as RUNTIME_DEFAULTS, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, jt as EventCategory$1, k as extractNestedAddonId, kt as scopeKey, m as addonSettingsCapability, ot as DATAPLANE_SECRET_HEADER$1, pt as ReadinessTimeoutError, q as procedureAuthKey, s as METHOD_ACCESS_MAP, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, xt as expandCapMethods, yt as emitDownForOwnedCaps } from "./dist-CIek6F9X.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-57PA4rHm.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-julrfvyf.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";

package/dist/kernel/moleculer/settings-read-guard.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Read-modify-write guard for the addon settings stores.
+ *
+ * ## The data loss this prevents
+ *
+ * Every settings mutation is `read current → merge patch → write back`. The
+ * read used to answer `{}` for BOTH "this addon has no settings yet" and "the
+ * read failed", so a failed read merged the patch onto nothing and the write
+ * persisted a blob containing ONLY the patch. Everything else in it was gone.
+ *
+ * It happened on 2026-07-31. The UDS transport stalled, `settings write failed
+ * (addon-settings/root) — transport error ... UDS request timed out after
+ * 60000ms` appeared in the log, and the recording configuration for all three
+ * recording cameras came back as `{"enabled": false, "bands": []}`. Two and a
+ * half hours of footage were never written, and nothing looked broken: an
+ * emptied config is indistinguishable from an operator switching recording off.
+ *
+ * The rule this module enforces: **a read that FAILED is not an empty value.**
+ * A miss still merges onto `{}` — that is a real empty. A failure refuses the
+ * write and says so, leaving the stored blob untouched so the next successful
+ * write starts from the truth.
+ */
+/**
+ * Outcome of a settings read. `missing` and `failed` are deliberately distinct
+ * — collapsing them is the bug.
+ */
+export type SettingsRead = {
+    readonly kind: 'value';
+    readonly value: Record<string, unknown>;
+} | {
+    readonly kind: 'missing';
+} | {
+    readonly kind: 'failed';
+    readonly error: string;
+};
+export interface ReadModifyWriteInput {
+    readonly read: () => Promise<SettingsRead>;
+    readonly write: (next: Record<string, unknown>) => Promise<void>;
+    readonly patch: Record<string, unknown>;
+    /** Called instead of writing when the read failed — always log this. */
+    readonly onRefused: (error: string) => void;
+}
+/**
+ * Merge `patch` over the current value and write it — unless the read failed,
+ * in which case write NOTHING.
+ *
+ * Returns whether the write was attempted, so a caller can surface the refusal.
+ */
+export declare function readModifyWrite(input: ReadModifyWriteInput): Promise<boolean>;

package/dist/kernel/transport/local-child-registry.d.ts

@@ -95,6 +95,18 @@ export interface LocalChildRegistryOptions {
      * everything). The kernel has no cap registry, so the wiring side injects it.
      */
     readonly isAggregatedCollectionMethod?: (capName: string, method: string) => boolean;
+    /**
+     * Per-cap-method bound for UDS cap calls, in ms — read from the cap
+     * definition's declared `timeoutMs`. The SAME resolver the remote plane uses
+     * (`CapRouteResolver.capTimeoutMs`), so the two planes agree by construction
+     * instead of by coincidence.
+     *
+     * Without this the channel default (60 s) would apply to everything, and a
+     * legitimately long method — `applyServerUpdate` declares 16 min because it
+     * awaits a full npm install — would be cut off mid-run. Omitted ⇒ the
+     * channel default for every cap call.
+     */
+    readonly capTimeoutMs?: (capName: string, method: string) => number | undefined;
 }
 /**
  * Parent-side authority for local addon-runners reachable over a
@@ -118,6 +130,8 @@ export declare class LocalChildRegistry {
     private readonly ownNodeId?;
     /** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
     private readonly isAggregatedCollectionMethod?;
+    /** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
+    private readonly capTimeoutMs?;
     /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
     private readonly egressRoutedCaps;
     /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -227,6 +241,12 @@ export declare class LocalChildRegistry {
      */
     isChildKnown(childId: string): boolean;
     childProvides(childId: string, capName: string, deviceId?: number): boolean;
+    /**
+     * Per-request options for a cap call: the cap method's declared `timeoutMs`
+     * when one exists, else `undefined` so the channel applies its default.
+     * Mirrors `CapRouteResolver.callTimeout` for the remote plane.
+     */
+    private capRequestOpts;
     /** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
     callCapOnChild(childId: string, input: CapCallInput): Promise<unknown>;
     /** Forward a cap method call to the owning child over UDS; rejects if none. */

package/dist/kernel/transport/local-transport.d.ts

@@ -19,9 +19,19 @@ export type Frame = {
 };
 export type RequestHandler = (body: unknown) => Promise<unknown>;
 export type EventHandler = (body: unknown) => void;
+/** Per-request options a {@link LocalChannel} implementation may honour. */
+export interface LocalRequestOptions {
+    /**
+     * Bound on this request in ms; `0` or negative disables it. Omitted ⇒ the
+     * implementation's default. Cap calls pass the cap method's declared
+     * `timeoutMs` so a legitimately long method (`applyServerUpdate`, 16 min) is
+     * not cut short.
+     */
+    readonly timeoutMs?: number;
+}
 /** A bidirectional request/response + one-way event channel over one socket. */
 export interface LocalChannel {
-    request(body: unknown): Promise<unknown>;
+    request(body: unknown, opts?: LocalRequestOptions): Promise<unknown>;
     emit(body: unknown): void;
     onRequest(handler: RequestHandler): void;
     onEvent(handler: EventHandler): void;

package/dist/kernel/transport/socket-channel.d.ts

@@ -1,5 +1,21 @@
 import { Socket } from 'node:net';
 import { LocalChannel, RequestHandler, EventHandler } from './local-transport.js';
+/**
+ * Default bound on one UDS request, when the caller names none.
+ *
+ * Chosen to match `REMOTE_CALL_TIMEOUT_MS` in `cap-route-resolver.ts`: the SAME
+ * cap method already dies at 60 s when it resolves to a remote node, so
+ * applying the same bound locally makes the two planes consistent rather than
+ * newly restrictive. Callers with a legitimately longer method (the cap
+ * layer's declared `timeoutMs`, e.g. `applyServerUpdate` at 16 min) pass it
+ * explicitly.
+ */
+export declare const DEFAULT_UDS_REQUEST_TIMEOUT_MS = 60000;
+/** Per-request options for {@link SocketChannel.request}. */
+export interface SocketRequestOptions {
+    /** Bound in ms; `0` or negative disables the timer entirely. */
+    readonly timeoutMs?: number;
+}
 export declare class SocketChannel implements LocalChannel {
     private readonly socket;
     private nextId;
@@ -11,7 +27,18 @@ export declare class SocketChannel implements LocalChannel {
     private closed;
     private closeFired;
     constructor(socket: Socket);
-    request(body: unknown): Promise<unknown>;
+    /**
+     * Send a request and wait for the peer's response.
+     *
+     * Bounded. Without a timer this settles on exactly two events — a matching
+     * `res` frame, or the socket's `close` (which drains `pending`) — so a peer
+     * that receives the request and then neither answers nor closes leaves the
+     * caller pending forever. That is a wedged handler, or a half-open socket
+     * after a child died without a clean teardown, and it is how camera 615 spent
+     * 30+ minutes with every inference permit held by a call that was never
+     * coming back.
+     */
+    request(body: unknown, opts?: SocketRequestOptions): Promise<unknown>;
     emit(body: unknown): void;
     /** Replace the request handler. Only one handler is active at a time. */
     onRequest(handler: RequestHandler): void;

package/dist/{manifest-python-deps-CqDPWqEE.js → manifest-python-deps-COgal7Jy.js}

@@ -1188,6 +1188,27 @@ function addSettingsActions(addon, actions) {
 	}
 }
 //#endregion
+//#region src/kernel/moleculer/settings-read-guard.ts
+/**
+* Merge `patch` over the current value and write it — unless the read failed,
+* in which case write NOTHING.
+*
+* Returns whether the write was attempted, so a caller can surface the refusal.
+*/
+async function readModifyWrite(input) {
+	const current = await input.read();
+	if (current.kind === "failed") {
+		input.onRefused(current.error);
+		return false;
+	}
+	const base = current.kind === "value" ? current.value : {};
+	await input.write({
+		...base,
+		...input.patch
+	});
+	return true;
+}
+//#endregion
 //#region src/kernel/moleculer/device-cap-proxy.ts
 /**
 * Max number of accessory children spawned concurrently during a single
@@ -3526,8 +3547,6 @@ function localEndpointPath(nodeId) {
 	if (process.platform === "win32") return `\\\\.\\pipe\\camstack-${safe}`;
 	return (0, node_path.join)((0, node_os.tmpdir)(), `camstack-${safe}.sock`);
 }
-//#endregion
-//#region src/kernel/transport/socket-channel.ts
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -3546,13 +3565,34 @@ var SocketChannel = class {
 		socket.on("close", () => this.handleClose());
 		socket.on("error", () => {});
 	}
-	request(body) {
+	/**
+	* Send a request and wait for the peer's response.
+	*
+	* Bounded. Without a timer this settles on exactly two events — a matching
+	* `res` frame, or the socket's `close` (which drains `pending`) — so a peer
+	* that receives the request and then neither answers nor closes leaves the
+	* caller pending forever. That is a wedged handler, or a half-open socket
+	* after a child died without a clean teardown, and it is how camera 615 spent
+	* 30+ minutes with every inference permit held by a call that was never
+	* coming back.
+	*/
+	request(body, opts) {
 		if (this.closed) return Promise.reject(/* @__PURE__ */ new Error("channel closed"));
 		const id = this.nextId++;
+		const timeoutMs = opts?.timeoutMs ?? 6e4;
 		return new Promise((resolve, reject) => {
+			let timer = null;
+			if (timeoutMs > 0) {
+				timer = setTimeout(() => {
+					this.pending.delete(id);
+					reject(/* @__PURE__ */ new Error(`UDS request timed out after ${timeoutMs}ms`));
+				}, timeoutMs);
+				timer.unref?.();
+			}
 			this.pending.set(id, {
 				resolve,
-				reject
+				reject,
+				timer
 			});
 			this.send({
 				k: "req",
@@ -3616,6 +3656,7 @@ var SocketChannel = class {
 			const p = this.pending.get(frame.id);
 			if (!p) return;
 			this.pending.delete(frame.id);
+			if (p.timer !== null) clearTimeout(p.timer);
 			if (frame.ok) p.resolve(frame.body);
 			else p.reject(new Error(frame.err));
 			return;
@@ -3626,7 +3667,10 @@ var SocketChannel = class {
 		if (this.closeFired) return;
 		this.closeFired = true;
 		this.closed = true;
-		for (const [, p] of this.pending) p.reject(/* @__PURE__ */ new Error("channel closed"));
+		for (const [, p] of this.pending) {
+			if (p.timer !== null) clearTimeout(p.timer);
+			p.reject(/* @__PURE__ */ new Error("channel closed"));
+		}
 		this.pending.clear();
 		this.closeHandler();
 	}
@@ -4305,6 +4349,8 @@ var LocalChildRegistry = class {
 	ownNodeId;
 	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
 	isAggregatedCollectionMethod;
+	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
+	capTimeoutMs;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
 	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -4334,6 +4380,7 @@ var LocalChildRegistry = class {
 			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
 			this.ownNodeId = opts.ownNodeId;
 			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
+			this.capTimeoutMs = opts.capTimeoutMs;
 		} else {
 			this.server = serverOrOptions;
 			this.onUnownedCall = onUnownedCallArg;
@@ -4496,11 +4543,20 @@ var LocalChildRegistry = class {
 		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
 		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
 	}
+	/**
+	* Per-request options for a cap call: the cap method's declared `timeoutMs`
+	* when one exists, else `undefined` so the channel applies its default.
+	* Mirrors `CapRouteResolver.callTimeout` for the remote plane.
+	*/
+	capRequestOpts(input) {
+		const declared = this.capTimeoutMs?.(input.capName, input.method);
+		return typeof declared === "number" ? { timeoutMs: declared } : void 0;
+	}
 	/** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
 	async callCapOnChild(childId, input) {
 		const entry = this.children.get(childId);
 		if (!entry) throw new Error(`no local child "${childId}" for cap "${input.capName}"`);
-		return entry.channel.request(this.toCapCall(input));
+		return entry.channel.request(this.toCapCall(input), this.capRequestOpts(input));
 	}
 	/** Forward a cap method call to the owning child over UDS; rejects if none. */
 	async callCap(input) {
@@ -4510,7 +4566,7 @@ var LocalChildRegistry = class {
 			const where = input.deviceId === void 0 ? "" : ` for device ${input.deviceId}`;
 			throw new Error(`no local child provides cap "${input.capName}"${where}`);
 		}
-		return entry.channel.request(this.toCapCall(input));
+		return entry.channel.request(this.toCapCall(input), this.capRequestOpts(input));
 	}
 	/**
 	* Forward an ADDON-LEVEL call (routes / custom-action) to a SPECIFIC child
@@ -7136,8 +7192,18 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		bindingCache.clear();
 	});
 	const settingsApi = Reflect.get(api, "settingsStore");
-	const readBlob = async (coll, key, namespace) => {
-		if (!settingsApi) return {};
+	/**
+	* Read a settings blob, distinguishing a MISS from a FAILURE.
+	*
+	* Collapsing the two is a data-loss bug, not a style choice: every mutation
+	* is read-modify-write, so a failed read that answers "empty" makes the write
+	* persist the patch ALONE and destroy every field the patch does not mention.
+	* That is what emptied the recording configuration on 2026-07-31 when the UDS
+	* transport stalled — `{"enabled": false, "bands": []}`, two and a half hours
+	* of footage never written, and nothing that looked like a fault.
+	*/
+	const readBlobResult = async (coll, key, namespace) => {
+		if (!settingsApi) return { kind: "missing" };
 		try {
 			const v = await settingsApi.get.query(namespace !== void 0 ? {
 				namespace,
@@ -7147,11 +7213,40 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 				collection: coll,
 				key
 			});
-			return v && typeof v === "object" ? v : {};
-		} catch {
-			return {};
+			return v && typeof v === "object" ? {
+				kind: "value",
+				value: v
+			} : { kind: "missing" };
+		} catch (err) {
+			return {
+				kind: "failed",
+				error: (0, _camstack_types_addon.errMsg)(err)
+			};
 		}
 	};
+	/**
+	* Soft read for CONSUMERS: a failure reads as empty so a boot path degrades
+	* to defaults instead of throwing. Safe here precisely because the result is
+	* never written back — {@link readBlobResult} is what the write paths use.
+	*/
+	const readBlob = async (coll, key, namespace) => {
+		const r = await readBlobResult(coll, key, namespace);
+		return r.kind === "value" ? r.value : {};
+	};
+	/** Read-modify-write that REFUSES to write when the read failed. */
+	const mergeBlob = async (coll, key, patch, namespace) => {
+		await readModifyWrite({
+			read: () => readBlobResult(coll, key, namespace),
+			write: (next) => writeBlob(coll, key, next, namespace),
+			patch,
+			onRefused: (error) => {
+				scopedLogger.error(`settings merge REFUSED (${coll}/${key}) — read failed, refusing to overwrite with a partial blob`, { meta: {
+					error,
+					patchKeys: Object.keys(patch)
+				} });
+			}
+		});
+	};
 	const writeBlob = async (coll, key, value, namespace) => {
 		if (!settingsApi) return;
 		try {
@@ -7190,10 +7285,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async writeAddonStore(patch) {
 			return serializeRmw("addon-settings", "root", async () => {
-				await writeBlob("addon-settings", "root", {
-					...await readBlob("addon-settings", "root", addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-settings", "root", patch, addonId);
 			});
 		},
 		async readDeviceStore(deviceId) {
@@ -7202,10 +7294,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		async writeDeviceStore(deviceId, patch) {
 			const key = String(deviceId);
 			return serializeRmw("addon-devices", key, async () => {
-				await writeBlob("addon-devices", key, {
-					...await readBlob("addon-devices", key, addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-devices", key, patch, addonId);
 			});
 		},
 		async clearDeviceStore(deviceId) {
@@ -7225,10 +7314,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async setSection(section, patch) {
 			return serializeRmw("sections", section, async () => {
-				await writeBlob("sections", section, {
-					...await readBlob("sections", section),
-					...patch
-				});
+				await mergeBlob("sections", section, patch);
 			});
 		}
 	};

package/dist/{manifest-python-deps-57PA4rHm.mjs → manifest-python-deps-julrfvyf.mjs}

@@ -1186,6 +1186,27 @@ function addSettingsActions(addon, actions) {
 	}
 }
 //#endregion
+//#region src/kernel/moleculer/settings-read-guard.ts
+/**
+* Merge `patch` over the current value and write it — unless the read failed,
+* in which case write NOTHING.
+*
+* Returns whether the write was attempted, so a caller can surface the refusal.
+*/
+async function readModifyWrite(input) {
+	const current = await input.read();
+	if (current.kind === "failed") {
+		input.onRefused(current.error);
+		return false;
+	}
+	const base = current.kind === "value" ? current.value : {};
+	await input.write({
+		...base,
+		...input.patch
+	});
+	return true;
+}
+//#endregion
 //#region src/kernel/moleculer/device-cap-proxy.ts
 /**
 * Max number of accessory children spawned concurrently during a single
@@ -3524,8 +3545,6 @@ function localEndpointPath(nodeId) {
 	if (process.platform === "win32") return `\\\\.\\pipe\\camstack-${safe}`;
 	return join(tmpdir(), `camstack-${safe}.sock`);
 }
-//#endregion
-//#region src/kernel/transport/socket-channel.ts
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -3544,13 +3563,34 @@ var SocketChannel = class {
 		socket.on("close", () => this.handleClose());
 		socket.on("error", () => {});
 	}
-	request(body) {
+	/**
+	* Send a request and wait for the peer's response.
+	*
+	* Bounded. Without a timer this settles on exactly two events — a matching
+	* `res` frame, or the socket's `close` (which drains `pending`) — so a peer
+	* that receives the request and then neither answers nor closes leaves the
+	* caller pending forever. That is a wedged handler, or a half-open socket
+	* after a child died without a clean teardown, and it is how camera 615 spent
+	* 30+ minutes with every inference permit held by a call that was never
+	* coming back.
+	*/
+	request(body, opts) {
 		if (this.closed) return Promise.reject(/* @__PURE__ */ new Error("channel closed"));
 		const id = this.nextId++;
+		const timeoutMs = opts?.timeoutMs ?? 6e4;
 		return new Promise((resolve, reject) => {
+			let timer = null;
+			if (timeoutMs > 0) {
+				timer = setTimeout(() => {
+					this.pending.delete(id);
+					reject(/* @__PURE__ */ new Error(`UDS request timed out after ${timeoutMs}ms`));
+				}, timeoutMs);
+				timer.unref?.();
+			}
 			this.pending.set(id, {
 				resolve,
-				reject
+				reject,
+				timer
 			});
 			this.send({
 				k: "req",
@@ -3614,6 +3654,7 @@ var SocketChannel = class {
 			const p = this.pending.get(frame.id);
 			if (!p) return;
 			this.pending.delete(frame.id);
+			if (p.timer !== null) clearTimeout(p.timer);
 			if (frame.ok) p.resolve(frame.body);
 			else p.reject(new Error(frame.err));
 			return;
@@ -3624,7 +3665,10 @@ var SocketChannel = class {
 		if (this.closeFired) return;
 		this.closeFired = true;
 		this.closed = true;
-		for (const [, p] of this.pending) p.reject(/* @__PURE__ */ new Error("channel closed"));
+		for (const [, p] of this.pending) {
+			if (p.timer !== null) clearTimeout(p.timer);
+			p.reject(/* @__PURE__ */ new Error("channel closed"));
+		}
 		this.pending.clear();
 		this.closeHandler();
 	}
@@ -4303,6 +4347,8 @@ var LocalChildRegistry = class {
 	ownNodeId;
 	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
 	isAggregatedCollectionMethod;
+	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
+	capTimeoutMs;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
 	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -4332,6 +4378,7 @@ var LocalChildRegistry = class {
 			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
 			this.ownNodeId = opts.ownNodeId;
 			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
+			this.capTimeoutMs = opts.capTimeoutMs;
 		} else {
 			this.server = serverOrOptions;
 			this.onUnownedCall = onUnownedCallArg;
@@ -4494,11 +4541,20 @@ var LocalChildRegistry = class {
 		if (deviceId !== void 0 && entry.caps.some((cap) => cap.capName === capName && cap.deviceId === deviceId)) return true;
 		return entry.caps.some((cap) => cap.capName === capName && cap.deviceId === void 0);
 	}
+	/**
+	* Per-request options for a cap call: the cap method's declared `timeoutMs`
+	* when one exists, else `undefined` so the channel applies its default.
+	* Mirrors `CapRouteResolver.callTimeout` for the remote plane.
+	*/
+	capRequestOpts(input) {
+		const declared = this.capTimeoutMs?.(input.capName, input.method);
+		return typeof declared === "number" ? { timeoutMs: declared } : void 0;
+	}
 	/** Forward a cap method call to a SPECIFIC child by id over UDS; rejects if that child is absent. */
 	async callCapOnChild(childId, input) {
 		const entry = this.children.get(childId);
 		if (!entry) throw new Error(`no local child "${childId}" for cap "${input.capName}"`);
-		return entry.channel.request(this.toCapCall(input));
+		return entry.channel.request(this.toCapCall(input), this.capRequestOpts(input));
 	}
 	/** Forward a cap method call to the owning child over UDS; rejects if none. */
 	async callCap(input) {
@@ -4508,7 +4564,7 @@ var LocalChildRegistry = class {
 			const where = input.deviceId === void 0 ? "" : ` for device ${input.deviceId}`;
 			throw new Error(`no local child provides cap "${input.capName}"${where}`);
 		}
-		return entry.channel.request(this.toCapCall(input));
+		return entry.channel.request(this.toCapCall(input), this.capRequestOpts(input));
 	}
 	/**
 	* Forward an ADDON-LEVEL call (routes / custom-action) to a SPECIFIC child
@@ -7134,8 +7190,18 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		bindingCache.clear();
 	});
 	const settingsApi = Reflect.get(api, "settingsStore");
-	const readBlob = async (coll, key, namespace) => {
-		if (!settingsApi) return {};
+	/**
+	* Read a settings blob, distinguishing a MISS from a FAILURE.
+	*
+	* Collapsing the two is a data-loss bug, not a style choice: every mutation
+	* is read-modify-write, so a failed read that answers "empty" makes the write
+	* persist the patch ALONE and destroy every field the patch does not mention.
+	* That is what emptied the recording configuration on 2026-07-31 when the UDS
+	* transport stalled — `{"enabled": false, "bands": []}`, two and a half hours
+	* of footage never written, and nothing that looked like a fault.
+	*/
+	const readBlobResult = async (coll, key, namespace) => {
+		if (!settingsApi) return { kind: "missing" };
 		try {
 			const v = await settingsApi.get.query(namespace !== void 0 ? {
 				namespace,
@@ -7145,11 +7211,40 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 				collection: coll,
 				key
 			});
-			return v && typeof v === "object" ? v : {};
-		} catch {
-			return {};
+			return v && typeof v === "object" ? {
+				kind: "value",
+				value: v
+			} : { kind: "missing" };
+		} catch (err) {
+			return {
+				kind: "failed",
+				error: errMsg(err)
+			};
 		}
 	};
+	/**
+	* Soft read for CONSUMERS: a failure reads as empty so a boot path degrades
+	* to defaults instead of throwing. Safe here precisely because the result is
+	* never written back — {@link readBlobResult} is what the write paths use.
+	*/
+	const readBlob = async (coll, key, namespace) => {
+		const r = await readBlobResult(coll, key, namespace);
+		return r.kind === "value" ? r.value : {};
+	};
+	/** Read-modify-write that REFUSES to write when the read failed. */
+	const mergeBlob = async (coll, key, patch, namespace) => {
+		await readModifyWrite({
+			read: () => readBlobResult(coll, key, namespace),
+			write: (next) => writeBlob(coll, key, next, namespace),
+			patch,
+			onRefused: (error) => {
+				scopedLogger.error(`settings merge REFUSED (${coll}/${key}) — read failed, refusing to overwrite with a partial blob`, { meta: {
+					error,
+					patchKeys: Object.keys(patch)
+				} });
+			}
+		});
+	};
 	const writeBlob = async (coll, key, value, namespace) => {
 		if (!settingsApi) return;
 		try {
@@ -7188,10 +7283,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async writeAddonStore(patch) {
 			return serializeRmw("addon-settings", "root", async () => {
-				await writeBlob("addon-settings", "root", {
-					...await readBlob("addon-settings", "root", addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-settings", "root", patch, addonId);
 			});
 		},
 		async readDeviceStore(deviceId) {
@@ -7200,10 +7292,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		async writeDeviceStore(deviceId, patch) {
 			const key = String(deviceId);
 			return serializeRmw("addon-devices", key, async () => {
-				await writeBlob("addon-devices", key, {
-					...await readBlob("addon-devices", key, addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-devices", key, patch, addonId);
 			});
 		},
 		async clearDeviceStore(deviceId) {
@@ -7223,10 +7312,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async setSection(section, patch) {
 			return serializeRmw("sections", section, async () => {
-				await writeBlob("sections", section, {
-					...await readBlob("sections", section),
-					...patch
-				});
+				await mergeBlob("sections", section, patch);
 			});
 		}
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.23",
+  "version": "1.2.25",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",