@camstack/system 1.2.389 → 1.2.391

package/dist/builtins/device-manager/mirror-row-writer.d.ts

@@ -1,196 +1,222 @@
-import { IScopedLogger } from '@camstack/types';
-import { DeviceManagerSettings } from './device-meta-store.js';
-import { MigrationRefusedError } from './migration-refused.js';
-import { RuntimeStatePolicyLookup } from './runtime-state-persist-gate.js';
+/**
+* The ROW WRITER of the hub runtime-state mirror (`DeviceStateMirror`): every
+* write of a device's `__device-state:<id>` row goes through here — the
+* debounced writer, a claim's write-through, the migration drain, the shutdown
+* flush.
+*
+* Every row write of a device goes through ONE queue per device
+* (`serialiseWrite`), so two writes are never in flight at once and each
+* carries the memory of the moment it RUNS (`persistableFor`, supplied by the
+* mirror). What is believed to be on disk (`lastPersisted`) is the baseline of
+* the effective-change gate. A migration HOLDS the writer off two rows while it
+* swaps them (`holdDiskWrites`).
+*
+* Extracted from `device-state-mirror.ts` (D663 final review I-2) — the mirror
+* owns memory and the merge; this owns what reaches the row, and when.
+*
+* ── Never write a row this process has not READ (D677) ────────────────────
+* A row write REPLACES the whole row. So every write path — debounced,
+* write-through, drain, shutdown flush — first makes sure the device's row was
+* read into memory (`readRowFirst`, the mirror's single-flight `fill` seed:
+* memory wins per cap, the row fills the gaps). A read that fails writes
+* NOTHING and is logged once per episode with `tags.deviceId`. A write that
+* would still drop a cap the stored row holds is logged at warn, by name: the
+* boot race that did exactly that was silent since at least 09-18 (159 shrinks, 15
+* cameras, 65 of 82 hub restarts).
+*/
+import type { IScopedLogger } from "@camstack/types";
+import type { DeviceManagerSettings } from "./device-meta-store.js";
+import { MigrationRefusedError } from "./migration-refused.js";
+import { type RuntimeStatePolicyLookup } from "./runtime-state-persist-gate.js";
 /** A device's row as it may reach disk: cap name → persistable slice (plus `$owned`). */
 export type PersistableRow = Record<string, Record<string, unknown>>;
 /** Which path wrote (or tried to write) a row — named on every line it logs. */
-export type RowWritePath = 'debounced' | 'shutdown-flush' | 'drain' | 'claim' | 'release';
+export type RowWritePath = "debounced" | "shutdown-flush" | "drain" | "claim" | "release";
 /**
- * A write-through refused because the device's row could not be read first
- * (D677). Nothing was written; the caller rolls its memory change back.
- */
+* A write-through refused because the device's row could not be read first
+* (D677). Nothing was written; the caller rolls its memory change back.
+*/
 export declare class RuntimeStateRowUnreadError extends Error {
-    readonly deviceId: number;
-    constructor(deviceId: number);
+	readonly deviceId: number;
+	constructor(deviceId: number);
 }
 /**
- * The drain before a migration could not vouch for a device's row. Nothing has
- * moved yet, so it is a {@link MigrationRefusedError}: the migration refuses
- * and restores both cameras' switches.
- */
+* The drain before a migration could not vouch for a device's row. Nothing has
+* moved yet, so it is a {@link MigrationRefusedError}: the migration refuses
+* and restores both cameras' switches.
+*/
 export declare class RuntimeStateDrainError extends MigrationRefusedError {
-    readonly deviceId: number;
-    constructor(deviceId: number, reason: string, options?: ErrorOptions);
+	readonly deviceId: number;
+	constructor(deviceId: number, reason: string, options?: ErrorOptions);
 }
 /** A migration's hold on the debounced writer (`holdDiskWrites`). */
 export interface MirrorWriteHold {
-    /** Let the writer back onto the rows; re-arms it so the row converges to memory. */
-    readonly release: () => void;
+	/** Let the writer back onto the rows; re-arms it so the row converges to memory. */
+	readonly release: () => void;
 }
 /** What the writer needs from the mirror that owns it. */
 export interface MirrorRowWriterDeps {
-    readonly logger: IScopedLogger;
-    /** Per-cap durability + volatile-field policy (D4). */
-    readonly policyFor: RuntimeStatePolicyLookup;
-    /** The device's row as memory holds it NOW — taken when a write RUNS. */
-    readonly persistableFor: (deviceId: number) => PersistableRow;
-    /** The device's row was read into memory in this process (D677). */
-    readonly isRowRead: (deviceId: number) => boolean;
-    /**
-     * Read the row into memory — single-flight, `fill` (memory wins per cap).
-     * Rejects when the row cannot be read; memory is then unchanged.
-     */
-    readonly readRowFirst: (deviceId: number, settings: DeviceManagerSettings) => Promise<void>;
+	readonly logger: IScopedLogger;
+	/** Per-cap durability + volatile-field policy (D4). */
+	readonly policyFor: RuntimeStatePolicyLookup;
+	/** The device's row as memory holds it NOW — taken when a write RUNS. */
+	readonly persistableFor: (deviceId: number) => PersistableRow;
+	/** The device's row was read into memory in this process (D677). */
+	readonly isRowRead: (deviceId: number) => boolean;
+	/**
+	* Read the row into memory — single-flight, `fill` (memory wins per cap).
+	* Rejects when the row cannot be read; memory is then unchanged.
+	*/
+	readonly readRowFirst: (deviceId: number, settings: DeviceManagerSettings) => Promise<void>;
 }
 export declare class MirrorRowWriter {
-    private readonly deps;
-    static readonly RUNTIME_STATE_DEBOUNCE_MS = 1000;
-    /** Ceiling of the re-arm backoff while a device's row cannot be read (D677, D3). */
-    static readonly UNREAD_REARM_MAX_MS = 60000;
-    /** The re-arm delay after `refusals` consecutive unread refusals: 1 s, 2 s, 4 s … capped at 60 s. */
-    static unreadRearmDelayMs(refusals: number): number;
-    /**
-     * Per-device disk-write debouncer for runtime-state. `setCapSlice`
-     * updates the in-memory mirror synchronously and emits the change
-     * event immediately, but the disk write is coalesced.
-     */
-    private readonly runtimeStateDebounce;
-    /**
-     * Devices whose debounced writer is HELD off the row — a migration is
-     * swapping it (`holdDiskWrites`). A change while held stays in memory only.
-     */
-    private readonly writesHeld;
-    /** Held devices a durable change was scheduled for — what `release` re-arms. */
-    private readonly heldDirty;
-    /**
-     * What is believed to be ON DISK for each device — the persistable projection
-     * of the last blob actually written (or read at seed time). The
-     * effective-change gate compares against THIS, not against the previous
-     * mirror state: two clock-only ticks in a row must not add up to a write just
-     * because each was compared with its immediate predecessor.
-     */
-    private readonly lastPersisted;
-    /**
-     * Per-device count of writes the effective-change gate skipped since the last
-     * real one. Reported on the next write that DOES happen, so the log says how
-     * much churn the gate absorbed instead of saying nothing at all — a branch
-     * that drops work silently reads as "never happened".
-     */
-    private readonly skippedSinceWrite;
-    /** Devices whose unreadable-row refusal is already logged — once per episode. */
-    private readonly rowUnreadLogged;
-    constructor(deps: MirrorRowWriterDeps);
-    /** What is believed to be on the device's row; undefined before any read or write. */
-    persisted(deviceId: number): PersistableRow | undefined;
-    /** Record what the row now holds — a write that landed, or a row just read. */
-    markPersisted(deviceId: number, row: PersistableRow): void;
-    /** A migration holds the writer off this device's row right now. */
-    isHeld(deviceId: number): boolean;
-    /**
-     * Chain a row write behind whatever is in flight for the device. Returns the
-     * write's own promise (it may reject, to its caller); the queue tail never
-     * rejects and clears itself once it is the last one out.
-     */
-    serialiseWrite<T>(deviceId: number, task: () => Promise<T>): Promise<T>;
-    private slotFor;
-    /** Arm the writer for a durable change, or remember it for `release` while a migration holds the device. */
-    armOrHold(deviceId: number, settings: DeviceManagerSettings): void;
-    /**
-     * Debounced disk writer, behind two gates.
-     *
-     * GATE — DURABILITY: a change to a `durability: 'session'` cap never even
-     * arms the timer. That is where the fleet's write rate goes: `audio-metrics`
-     * and `zone-analytics` are ~90 % of the offered 12–19 writes/s, they change
-     * genuinely every second, and their restored value is worthless.
-     *
-     * GATE — EFFECTIVE CHANGE (at flush): the persistable blob is compared with
-     * what is believed to be on disk, ignoring the clock fields each cap declared
-     * volatile. `battery` wrote its blob 526 times in 25 minutes without one
-     * percentage moving; this is the gate that turns those into one write.
-     *
-     * The blob is read from the live mirror at flush time, so the disk picture is
-     * always the latest state — no risk of writing a stale snapshot.
-     */
-    schedule(deviceId: number, settings: DeviceManagerSettings, changedCap: string): void;
-    /** Arm the debounce timer; at fire, queue a write of the live blob unless disk already has it. */
-    private armDiskWrite;
-    /**
-     * Forget a removed device: cancel its armed write, await one in flight, and
-     * drop its baseline and counters — nothing writes its row after this.
-     */
-    forget(deviceId: number): Promise<void>;
-    /**
-     * The row is in memory, or is read now (D677). False when the read failed:
-     * the caller writes nothing. Logged once per episode, tagged; the episode
-     * ends at the next successful read.
-     */
-    private rowReadOrRefuse;
-    /**
-     * The ONE call of `writeDeviceRuntimeState`. A blob that lacks a cap the
-     * stored row holds is written (memory is the authority once the row was
-     * read) but never silently: the dropped caps are named at warn (D677).
-     * `$owned` is excluded — a release that empties it is the claim path's own
-     * logged business.
-     */
-    private writeRow;
-    /**
-     * A claim's write-through (D663): queued behind the device's writes, the row
-     * read first, the blob taken when it runs. Rejects with
-     * {@link RuntimeStateRowUnreadError} when the row cannot be read, or with the
-     * write's own error; resolves to what landed.
-     */
-    writeThroughRow(deviceId: number, settings: DeviceManagerSettings, path: RowWritePath): Promise<PersistableRow>;
-    /**
-     * The debounced write itself: the row read first (D677), then the blob as
-     * memory holds it NOW, behind the effective-change gate. Never rejects. An
-     * unreadable row writes nothing; the debounced path re-arms with a backoff
-     * (1 s doubling to 60 s — never a 1 Hz loop, D3), and the armed timer is
-     * what a migration drain sees as owed, so a row that has become readable
-     * drains normally. The shutdown flush does not re-arm.
-     */
-    private writeLiveBlob;
-    /** Re-arm an unread refusal with its backoff, or remember it for `release` while held. */
-    private rearmAfterUnread;
-    /**
-     * Hold the debounced writer off these devices' rows while a migration swaps
-     * them (D663 re-review N-6). Resolves once each device is DRAINED: a write
-     * still in its debounce window is written now (it is this hardware's latest
-     * state, and the swap then carries it to the right number), and a write
-     * already in flight has landed. Until `release`, nothing the writer does
-     * reaches these rows — a blob read before the swap and written after it would
-     * put the other box's state back under the number, and make it the baseline.
-     *
-     * Only what the writer already had pending is written — never memory
-     * wholesale, which for a row nobody read would overwrite it with a partial
-     * picture. `release` re-arms the writer for a device changed while held:
-     * after the migration's `replace` reseed memory equals the row and nothing
-     * is written; after a failed swap the row converges to memory.
-     *
-     * The migration must not proceed over a row that is not what memory says it
-     * is. So a drain write that FAILS, and equally a write that was in flight and
-     * FAILED (ruling I-2 — awaiting it is not the same as it landing), release
-     * the hold, log the device and reject with a {@link RuntimeStateDrainError};
-     * the owed write is re-armed on release.
-     *
-     * One hold per device at a time: `writesHeld` is a set, not a refcount, so a
-     * second overlapping hold would be released by the first. Safe because the
-     * only caller is `migrateDevice`, serialised by `migrationGuard` and the meta
-     * write lock; a new caller needs a refcount first.
-     */
-    holdDiskWrites(deviceIds: readonly number[], settings: DeviceManagerSettings): Promise<MirrorWriteHold>;
-    /** Cancel the timer, await the write in flight, then write (queued) what is not yet on disk. */
-    private drainDiskWrite;
-    /** A drain that cannot vouch for the row: still owed (re-armed on release), logged, refused. */
-    private refuseDrain;
-    /**
-     * True when `blob` differs from what is believed to be on disk only in fields
-     * the owning caps declared volatile. Counts the skip so the next real write
-     * can report how much churn was absorbed.
-     */
-    private isAlreadyPersisted;
-    /** Flush every pending debounced disk write (graceful shutdown). Clears the
-     *  debounce slots after awaiting in-flight + scheduled writes so shutdown is
-     *  lossless. */
-    flushPendingWrites(settings: DeviceManagerSettings | undefined): Promise<void>;
+	private readonly deps;
+	static readonly RUNTIME_STATE_DEBOUNCE_MS = 1e3;
+	/** Ceiling of the re-arm backoff while a device's row cannot be read (D677, D3). */
+	static readonly UNREAD_REARM_MAX_MS = 6e4;
+	/** The re-arm delay after `refusals` consecutive unread refusals: 1 s, 2 s, 4 s … capped at 60 s. */
+	static unreadRearmDelayMs(refusals: number): number;
+	/**
+	* Per-device disk-write debouncer for runtime-state. `setCapSlice`
+	* updates the in-memory mirror synchronously and emits the change
+	* event immediately, but the disk write is coalesced.
+	*/
+	private readonly runtimeStateDebounce;
+	/**
+	* Devices whose debounced writer is HELD off the row — a migration is
+	* swapping it (`holdDiskWrites`). A change while held stays in memory only.
+	*/
+	private readonly writesHeld;
+	/** Held devices a durable change was scheduled for — what `release` re-arms. */
+	private readonly heldDirty;
+	/**
+	* What is believed to be ON DISK for each device — the persistable projection
+	* of the last blob actually written (or read at seed time). The
+	* effective-change gate compares against THIS, not against the previous
+	* mirror state: two clock-only ticks in a row must not add up to a write just
+	* because each was compared with its immediate predecessor.
+	*/
+	private readonly lastPersisted;
+	/**
+	* Per-device count of writes the effective-change gate skipped since the last
+	* real one. Reported on the next write that DOES happen, so the log says how
+	* much churn the gate absorbed instead of saying nothing at all — a branch
+	* that drops work silently reads as "never happened".
+	*/
+	private readonly skippedSinceWrite;
+	/** Devices whose unreadable-row refusal is already logged — once per episode. */
+	private readonly rowUnreadLogged;
+	constructor(deps: MirrorRowWriterDeps);
+	/** What is believed to be on the device's row; undefined before any read or write. */
+	persisted(deviceId: number): PersistableRow | undefined;
+	/** Record what the row now holds — a write that landed, or a row just read. */
+	markPersisted(deviceId: number, row: PersistableRow): void;
+	/** A migration holds the writer off this device's row right now. */
+	isHeld(deviceId: number): boolean;
+	/**
+	* Chain a row write behind whatever is in flight for the device. Returns the
+	* write's own promise (it may reject, to its caller); the queue tail never
+	* rejects and clears itself once it is the last one out.
+	*/
+	serialiseWrite<T>(deviceId: number, task: () => Promise<T>): Promise<T>;
+	private slotFor;
+	/** Arm the writer for a durable change, or remember it for `release` while a migration holds the device. */
+	armOrHold(deviceId: number, settings: DeviceManagerSettings): void;
+	/**
+	* Debounced disk writer, behind two gates.
+	*
+	* GATE — DURABILITY: a change to a `durability: 'session'` cap never even
+	* arms the timer. That is where the fleet's write rate goes: `audio-metrics`
+	* and `zone-analytics` are ~90 % of the offered 12–19 writes/s, they change
+	* genuinely every second, and their restored value is worthless.
+	*
+	* GATE — EFFECTIVE CHANGE (at flush): the persistable blob is compared with
+	* what is believed to be on disk, ignoring the clock fields each cap declared
+	* volatile. `battery` wrote its blob 526 times in 25 minutes without one
+	* percentage moving; this is the gate that turns those into one write.
+	*
+	* The blob is read from the live mirror at flush time, so the disk picture is
+	* always the latest state — no risk of writing a stale snapshot.
+	*/
+	schedule(deviceId: number, settings: DeviceManagerSettings, changedCap: string): void;
+	/** Arm the debounce timer; at fire, queue a write of the live blob unless disk already has it. */
+	private armDiskWrite;
+	/**
+	* Forget a removed device: cancel its armed write, await one in flight, and
+	* drop its baseline and counters — nothing writes its row after this.
+	*/
+	forget(deviceId: number): Promise<void>;
+	/**
+	* The row is in memory, or is read now (D677). False when the read failed:
+	* the caller writes nothing. Logged once per episode, tagged; the episode
+	* ends at the next successful read.
+	*/
+	private rowReadOrRefuse;
+	/**
+	* The ONE call of `writeDeviceRuntimeState`. A blob that lacks a cap the
+	* stored row holds is written (memory is the authority once the row was
+	* read) but never silently: the dropped caps are named at warn (D677).
+	* `$owned` is excluded — a release that empties it is the claim path's own
+	* logged business.
+	*/
+	private writeRow;
+	/**
+	* A claim's write-through (D663): queued behind the device's writes, the row
+	* read first, the blob taken when it runs. Rejects with
+	* {@link RuntimeStateRowUnreadError} when the row cannot be read, or with the
+	* write's own error; resolves to what landed.
+	*/
+	writeThroughRow(deviceId: number, settings: DeviceManagerSettings, path: RowWritePath): Promise<PersistableRow>;
+	/**
+	* The debounced write itself: the row read first (D677), then the blob as
+	* memory holds it NOW, behind the effective-change gate. Never rejects. An
+	* unreadable row writes nothing; the debounced path re-arms with a backoff
+	* (1 s doubling to 60 s — never a 1 Hz loop, D3), and the armed timer is
+	* what a migration drain sees as owed, so a row that has become readable
+	* drains normally. The shutdown flush does not re-arm.
+	*/
+	private writeLiveBlob;
+	/** Re-arm an unread refusal with its backoff, or remember it for `release` while held. */
+	private rearmAfterUnread;
+	/**
+	* Hold the debounced writer off these devices' rows while a migration swaps
+	* them (D663 re-review N-6). Resolves once each device is DRAINED: a write
+	* still in its debounce window is written now (it is this hardware's latest
+	* state, and the swap then carries it to the right number), and a write
+	* already in flight has landed. Until `release`, nothing the writer does
+	* reaches these rows — a blob read before the swap and written after it would
+	* put the other box's state back under the number, and make it the baseline.
+	*
+	* Only what the writer already had pending is written — never memory
+	* wholesale, which for a row nobody read would overwrite it with a partial
+	* picture. `release` re-arms the writer for a device changed while held:
+	* after the migration's `replace` reseed memory equals the row and nothing
+	* is written; after a failed swap the row converges to memory.
+	*
+	* The migration must not proceed over a row that is not what memory says it
+	* is. So a drain write that FAILS, and equally a write that was in flight and
+	* FAILED (ruling I-2 — awaiting it is not the same as it landing), release
+	* the hold, log the device and reject with a {@link RuntimeStateDrainError};
+	* the owed write is re-armed on release.
+	*
+	* One hold per device at a time: `writesHeld` is a set, not a refcount, so a
+	* second overlapping hold would be released by the first. Safe because the
+	* only caller is `migrateDevice`, serialised by `migrationGuard` and the meta
+	* write lock; a new caller needs a refcount first.
+	*/
+	holdDiskWrites(deviceIds: readonly number[], settings: DeviceManagerSettings): Promise<MirrorWriteHold>;
+	/** Cancel the timer, await the write in flight, then write (queued) what is not yet on disk. */
+	private drainDiskWrite;
+	/** A drain that cannot vouch for the row: still owed (re-armed on release), logged, refused. */
+	private refuseDrain;
+	/**
+	* True when `blob` differs from what is believed to be on disk only in fields
+	* the owning caps declared volatile. Counts the skip so the next real write
+	* can report how much churn was absorbed.
+	*/
+	private isAlreadyPersisted;
+	/** Flush every pending debounced disk write (graceful shutdown). Clears the
+	*  debounce slots after awaiting in-flight + scheduled writes so shutdown is
+	*  lossless. */
+	flushPendingWrites(settings: DeviceManagerSettings | undefined): Promise<void>;
 }

package/dist/builtins/device-manager/recording-onboard-config-schema.d.ts

@@ -1,41 +1,65 @@
-import { ConfigUISchema, RecordingOnboardOptions, RecordingOnboardStatus } from '@camstack/types';
+/**
+* `recording-onboard` — server-side `ConfigUISchema` builder + form-patch
+* parser. Sibling of `day-night-config-schema.ts`, registered against the
+* `recording-onboard` builderId in `device-config-contribution.ts`.
+*
+* Field keys use the `recordingOnboard_<prop>` prefix so a flat form
+* patch can be re-parsed by {@link parseRecordingOnboardFormPatch}.
+*
+* Two deliberate choices:
+*
+*   - **The schedule is ONE field**, an `editable-array` of windows,
+*     not a field per trigger per day. The device-manager save path has
+*     a single-field entry point (`updateDeviceField`), so a patch may
+*     legitimately carry one key; a schedule spread over many keys could
+*     not be reassembled from such a patch, and reassembling it from a
+*     stale mirror is exactly the second-authority failure D62 forbids.
+*     One key means the value that arrives is always complete.
+*
+*   - **Every field is rendered on every camera**, and one this camera
+*     cannot write is rendered DISABLED with its reason in the
+*     description. Not hidden: a control that vanishes is
+*     indistinguishable from a feature CamStack never built, and
+*     disabled must not look like broken.
+*/
+import type { ConfigUISchema, RecordingOnboardOptions, RecordingOnboardStatus } from "@camstack/types";
 export declare const RECORDING_ONBOARD_KEYS: {
-    readonly storageBanner: "recordingOnboard_storageBanner";
-    readonly volumes: "recordingOnboard_volumes";
-    readonly tracks: "recordingOnboard_tracks";
-    readonly enabled: "recordingOnboard_enabled";
-    readonly overwriteWhenFull: "recordingOnboard_overwriteWhenFull";
-    readonly preRecordSec: "recordingOnboard_preRecordSec";
-    readonly postRecordSec: "recordingOnboard_postRecordSec";
-    readonly segmentMinutes: "recordingOnboard_segmentMinutes";
-    readonly windows: "recordingOnboard_windows";
+	readonly storageBanner: string;
+	readonly volumes: string;
+	readonly tracks: string;
+	readonly enabled: string;
+	readonly overwriteWhenFull: string;
+	readonly preRecordSec: string;
+	readonly postRecordSec: string;
+	readonly segmentMinutes: string;
+	readonly windows: string;
 };
 /** Row keys inside the windows `editable-array`. Local, not prefixed. */
 export declare const WINDOW_ROW_KEYS: {
-    readonly trigger: "trigger";
-    readonly day: "day";
-    readonly startMinute: "startMinute";
-    readonly endMinute: "endMinute";
+	readonly trigger: "trigger";
+	readonly day: "day";
+	readonly startMinute: "startMinute";
+	readonly endMinute: "endMinute";
 };
 /**
- * Build the `recording-onboard` `ConfigUISchema`.
- *
- * Never returns null. The storage read works on every camera in the
- * fleet, so the section always has something true to say — and a camera
- * CamStack has not reached yet says exactly that, rather than
- * disappearing (D315: not-yet-known must not look like not-installed).
- */
+* Build the `recording-onboard` `ConfigUISchema`.
+*
+* Never returns null. The storage read works on every camera in the
+* fleet, so the section always has something true to say — and a camera
+* CamStack has not reached yet says exactly that, rather than
+* disappearing (D315: not-yet-known must not look like not-installed).
+*/
 export declare function buildRecordingOnboardConfigSchema(options: RecordingOnboardOptions, status: RecordingOnboardStatus | null): ConfigUISchema | null;
 /**
- * Re-parse a flat `ConfigFormBuilder` patch into a
- * `RecordingOnboardPatch`-shaped object.
- *
- * Returns only the keys the patch actually carried. The windows key is
- * all-or-nothing on purpose: the field is a single editable array, so
- * its presence means the operator submitted the COMPLETE window set. A
- * row that cannot be read is DROPPED and the remaining set is still
- * submitted — the provider then refuses or applies a set the operator
- * can see in the form, rather than the form and the camera silently
- * disagreeing about a row neither shows.
- */
+* Re-parse a flat `ConfigFormBuilder` patch into a
+* `RecordingOnboardPatch`-shaped object.
+*
+* Returns only the keys the patch actually carried. The windows key is
+* all-or-nothing on purpose: the field is a single editable array, so
+* its presence means the operator submitted the COMPLETE window set. A
+* row that cannot be read is DROPPED and the remaining set is still
+* submitted — the provider then refuses or applies a set the operator
+* can see in the form, rather than the form and the camera silently
+* disagreeing about a row neither shows.
+*/
 export declare function parseRecordingOnboardFormPatch(patch: Record<string, unknown>): Record<string, unknown>;

package/dist/builtins/device-manager/removal-fence.d.ts

@@ -1,58 +1,58 @@
 /**
- * A removed device stays removed.
- *
- * `removeDevice` deletes the row and clears the device's config store, but
- * NOTHING stopped a write that was already on its way from putting the row
- * back: `registerDevice` upserts unconditionally (`upsertRegistration` doubles
- * as the INSERT), and `allocateDeviceId` mints a fresh row for any
- * `(addonId, stableId)` it cannot find. A live device object whose runner had
- * not finished tearing down — a probe retry, a reconcile, an accessory
- * re-register — therefore resurrected the row it had just lost, with its
- * construction-time name and type intact and its config GONE, because the
- * config was cleared by the removal and `registerDevice` does not write config.
- *
- * That is exactly the shell device 614 ("Videocamera studio") was left in on
- * 2026-09-05: row present, `config: {}`, `disabled: false`, `online: true`,
- * failing its provider's Zod schema on `host`/`password` at every boot for a
- * day. See D376.
- *
- * The fence is deliberately IN-MEMORY and short-lived. The race it closes is
- * a teardown that is seconds wide, in the one process that owns the rows; a
- * durable tombstone would be a second authority on "does this device exist"
- * and this repo has been burned by those. A deliberate re-add of the same
- * hardware (`createDevice` / `adoptDevice`) lifts the fence for that pair
- * explicitly, so an operator is never told "no" for their own action.
- */
+* A removed device stays removed.
+*
+* `removeDevice` deletes the row and clears the device's config store, but
+* NOTHING stopped a write that was already on its way from putting the row
+* back: `registerDevice` upserts unconditionally (`upsertRegistration` doubles
+* as the INSERT), and `allocateDeviceId` mints a fresh row for any
+* `(addonId, stableId)` it cannot find. A live device object whose runner had
+* not finished tearing down — a probe retry, a reconcile, an accessory
+* re-register — therefore resurrected the row it had just lost, with its
+* construction-time name and type intact and its config GONE, because the
+* config was cleared by the removal and `registerDevice` does not write config.
+*
+* That is exactly the shell device 614 ("Videocamera studio") was left in on
+* 2026-09-05: row present, `config: {}`, `disabled: false`, `online: true`,
+* failing its provider's Zod schema on `host`/`password` at every boot for a
+* day. See D376.
+*
+* The fence is deliberately IN-MEMORY and short-lived. The race it closes is
+* a teardown that is seconds wide, in the one process that owns the rows; a
+* durable tombstone would be a second authority on "does this device exist"
+* and this repo has been burned by those. A deliberate re-add of the same
+* hardware (`createDevice` / `adoptDevice`) lifts the fence for that pair
+* explicitly, so an operator is never told "no" for their own action.
+*/
 /** How long a removed identity refuses to be re-created. */
 export declare const REMOVAL_FENCE_TTL_MS: number;
 export interface RemovalFenceEntry {
-    readonly deviceId: number;
-    readonly addonId: string;
-    readonly stableId: string;
-    readonly removedAt: number;
+	readonly deviceId: number;
+	readonly addonId: string;
+	readonly stableId: string;
+	readonly removedAt: number;
 }
 export interface RemovalFence {
-    /** Record a completed removal. */
-    record(entry: Omit<RemovalFenceEntry, 'removedAt'>): void;
-    /** Is this numeric id fenced? */
-    isIdFenced(deviceId: number): RemovalFenceEntry | null;
-    /** Is this addon-facing identity fenced? */
-    isPairFenced(addonId: string, stableId: string): RemovalFenceEntry | null;
-    /** Lift the fence for one identity — an operator re-adding the device. */
-    lift(addonId: string, stableId: string): void;
-    /**
-     * Run an operator-initiated create/adopt with the fence down.
-     *
-     * `createDevice` / `adoptDevice` do not know the stableId in advance — the
-     * provider derives it from the hardware — so re-adding a camera that was
-     * just deleted cannot lift a single pair. It suspends the whole fence for
-     * the duration of the operator's own action instead, which is the one case
-     * where "this identity was removed" must not win.
-     */
-    runUnfenced<T>(fn: () => Promise<T>): Promise<T>;
+	/** Record a completed removal. */
+	record(entry: Omit<RemovalFenceEntry, "removedAt">): void;
+	/** Is this numeric id fenced? */
+	isIdFenced(deviceId: number): RemovalFenceEntry | null;
+	/** Is this addon-facing identity fenced? */
+	isPairFenced(addonId: string, stableId: string): RemovalFenceEntry | null;
+	/** Lift the fence for one identity — an operator re-adding the device. */
+	lift(addonId: string, stableId: string): void;
+	/**
+	* Run an operator-initiated create/adopt with the fence down.
+	*
+	* `createDevice` / `adoptDevice` do not know the stableId in advance — the
+	* provider derives it from the hardware — so re-adding a camera that was
+	* just deleted cannot lift a single pair. It suspends the whole fence for
+	* the duration of the operator's own action instead, which is the one case
+	* where "this identity was removed" must not win.
+	*/
+	runUnfenced<T>(fn: () => Promise<T>): Promise<T>;
 }
 export interface RemovalFenceOptions {
-    readonly ttlMs?: number;
-    readonly now?: () => number;
+	readonly ttlMs?: number;
+	readonly now?: () => number;
 }
 export declare function createRemovalFence(options?: RemovalFenceOptions): RemovalFence;