@camstack/system 1.2.438 → 1.2.440

package/dist/addon-runner.mjs

@@ -21,7 +21,7 @@ import { once } from "node:events";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { pathToFileURL } from "node:url";
 //#region src/kernel/addon-class-resolver.ts
-function isRecord$3(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -45,14 +45,14 @@ function isRecord$3(value) {
 function isAddonConstructor(fn) {
 	if (typeof fn !== "function") return false;
 	const proto = fn.prototype;
-	if (!isRecord$3(proto)) return false;
+	if (!isRecord$5(proto)) return false;
 	return typeof proto["initialize"] === "function";
 }
 function resolveAddonClass(mod) {
 	let candidate = mod["default"];
-	if (isRecord$3(candidate) && "default" in candidate) candidate = candidate["default"];
+	if (isRecord$5(candidate) && "default" in candidate) candidate = candidate["default"];
 	if (isAddonConstructor(candidate)) return candidate;
-	if (isRecord$3(candidate)) {
+	if (isRecord$5(candidate)) {
 		const fn = Object.values(candidate).find(isAddonConstructor);
 		if (fn) return fn;
 	}
@@ -5158,27 +5158,6 @@ function createUdsLoggerWithControl(client, addonId, nodeId, scope, tags = {}) {
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/settings-read-guard.ts
-/**
-* Merge `patch` over the current value and write it — unless the read failed,
-* in which case write NOTHING.
-*
-* Returns whether the write was attempted, so a caller can surface the refusal.
-*/
-async function readModifyWrite(input) {
-	const current = await input.read();
-	if (current.kind === "failed") {
-		input.onRefused(current.error);
-		return false;
-	}
-	const base = current.kind === "value" ? current.value : {};
-	await input.write({
-		...base,
-		...input.patch
-	});
-	return true;
-}
-//#endregion
 //#region src/kernel/capability-handle.ts
 var CapabilityUnavailableError = class extends Error {
 	capName;
@@ -5391,7 +5370,7 @@ var RuntimeStateLoadError = class extends Error {
 		this.name = "RuntimeStateLoadError";
 	}
 };
-function isRecord$2(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorMessage(err) {
@@ -5422,7 +5401,7 @@ async function loadRuntimeStateOrRefuse(load, logger, target) {
 	} catch (err) {
 		return refuse(errorMessage(err), err);
 	}
-	if (!isRecord$2(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
+	if (!isRecord$4(answer)) return refuse(`answered ${answer === null ? "null" : typeof answer}`);
 	return answer;
 }
 //#endregion
@@ -9339,6 +9318,727 @@ function createRemoteProviderProxy(broker, serviceName, capName, nodeId, methods
 	return dispatcher;
 }
 //#endregion
+//#region src/builtins/sqlite-storage/prefix-range.ts
+var MAX_ASCII = 127;
+/**
+* @returns the range for `prefix`, or `null` when the caller must fall back to
+*   a `LIKE` scan (empty prefix — which is the whole table and has no upper
+*   bound — or any byte outside ASCII).
+*/
+function prefixRange(prefix) {
+	if (prefix.length === 0) return null;
+	for (let i = 0; i < prefix.length; i++) {
+		const code = prefix.charCodeAt(i);
+		if (code === 0 || code > MAX_ASCII) return null;
+	}
+	const last = prefix.charCodeAt(prefix.length - 1);
+	if (last >= MAX_ASCII) return null;
+	return {
+		lo: prefix,
+		hi: prefix.slice(0, -1) + String.fromCharCode(last + 1)
+	};
+}
+//#endregion
+//#region src/kernel/prefix-walk.ts
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unwrapStoredValue(parsed) {
+	if (!isRecord$3(parsed) || !("value" in parsed)) return parsed;
+	return parsed.value;
+}
+/**
+* Rows one page of a prefix read asks for.
+*
+* Below `SETTINGS_QUERY_DEFAULT_ROW_CAP` (2 000, `query-bounds.ts`) on purpose:
+* this read now names its own bound, so the engine's defensive cap is never the
+* thing that decides how much of the answer the caller gets.
+*/
+var PREFIX_PAGE_ROWS = 1e3;
+/**
+* Pages one prefix read may take before it refuses.
+*
+* 512 pages is 512 000 rows — three orders of magnitude past the largest live
+* scope (`addon-device-settings` for one addon over a ~1 019-device fleet) and
+* still a bound, because a walk with no bound is the defect this file was
+* fixing, not one to reintroduce.
+*/
+var PREFIX_PAGE_BUDGET = 512;
+/**
+* Every row under `prefix`, or a throw — never the first 2 000 of them.
+*
+* **The defect.** This issued ONE `query` with no `limit`, and
+* `queryDeclared` resolves an absent limit to `SETTINGS_QUERY_DEFAULT_ROW_CAP`
+* and cuts the result there. On the live hub that fired 138 times in two hours
+* (`settings-store query truncated by a defensive row cap`, collection
+* `addon-device-settings`, `rowCap: 2000`, `requestedLimit: null`): a
+* ~1 019-device fleet with more than two stored keys per device puts one
+* addon's `<addonId>:` range past the cap. The engine warned; the door did not
+* notice, and handed its caller a short map that is **shape-identical to a
+* complete one**. Every device whose rows sort past the cap reads as "has no
+* stored settings", which is exactly what a device with none looks like.
+*
+* **The fix is a keyset walk, not a bigger limit.** The cursor is the last id
+* of the previous page, INCLUSIVE — so the page boundary re-reads exactly one
+* row (ids are unique, so a full page always advances) and no row can fall
+* between two pages the way an `OFFSET` walk drops rows under a concurrent
+* write (D295 rule 1). Re-reading is free here: the accumulator is keyed by
+* suffix, so the duplicate overwrites itself with its own value.
+*
+* `ORDER BY id` is not decoration — the cursor is only meaningful if the
+* engine returns the range in the order the cursor advances through. It is the
+* primary key, so the ordering is the range scan's own.
+*
+* @throws when the prefix cannot be expressed as a range and the collection is
+*   larger than one page, or when the walk exceeds {@link PREFIX_PAGE_BUDGET}.
+*   A throw is the point: a caller that cannot be answered completely must not
+*   be handed something that looks like a complete answer.
+*/
+async function loadPrefixed(door, collection, prefix, decode = unwrapStoredValue) {
+	const range = prefixRange(prefix);
+	const result = {};
+	let cursor = range?.lo ?? null;
+	for (let page = 0;; page++) {
+		if (page >= PREFIX_PAGE_BUDGET) throw new Error(`settings door: reading "${prefix}" from "${collection}" exceeded ${PREFIX_PAGE_BUDGET} pages of ${PREFIX_PAGE_ROWS} rows. Refusing to return the part that was read — a partial scope read is indistinguishable from an empty one.`);
+		const rows = await door.query({
+			collection,
+			filter: {
+				...range !== null && cursor !== null ? { whereBetween: { id: [cursor, range.hi] } } : {},
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: PREFIX_PAGE_ROWS
+			}
+		});
+		for (const row of rows) {
+			if (range !== null && (row.id < range.lo || row.id >= range.hi)) continue;
+			if (!row.id.startsWith(prefix)) continue;
+			result[row.id.slice(prefix.length)] = decode(row.data);
+		}
+		if (rows.length < PREFIX_PAGE_ROWS) return result;
+		const last = rows[rows.length - 1];
+		if (last === void 0) return result;
+		if (range === null) throw new Error(`settings door: prefix "${prefix}" on "${collection}" cannot be expressed as an id range, and the unfiltered read filled a page — the answer would be partial. Use an ASCII, non-empty prefix.`);
+		if (last.id === cursor) throw new Error(`settings door: reading "${prefix}" from "${collection}" made no progress at id "${last.id}" — ids under a prefix must be unique.`);
+		cursor = last.id;
+	}
+}
+//#endregion
+//#region src/kernel/addon-settings-store.ts
+/** The collection every addon's settings share. Named nowhere else (with sections' own module). */
+var ADDON_SETTINGS_COLLECTION = "addon-settings";
+function createAddonSettingsStore(door, addonId) {
+	const prefix = `${addonId}.`;
+	const message = (err) => err instanceof Error ? err.message : String(err);
+	return {
+		async read() {
+			try {
+				const value = await loadPrefixed(door, ADDON_SETTINGS_COLLECTION, prefix);
+				return Object.keys(value).length === 0 ? { kind: "absent" } : {
+					kind: "present",
+					value
+				};
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					error: message(err)
+				};
+			}
+		},
+		async readKey(key) {
+			try {
+				const row = await door.get({
+					collection: ADDON_SETTINGS_COLLECTION,
+					key: `${prefix}${key}`
+				});
+				return row === void 0 || row === null ? { kind: "absent" } : {
+					kind: "present",
+					value: unwrapStoredValue(row)
+				};
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					error: message(err)
+				};
+			}
+		},
+		async merge(patch) {
+			const records = [];
+			const removed = [];
+			for (const [key, value] of Object.entries(patch)) if (value === void 0) removed.push(`${prefix}${key}`);
+			else records.push({
+				id: `${prefix}${key}`,
+				data: {
+					addonId,
+					key,
+					value
+				}
+			});
+			if (records.length === 0 && removed.length === 0) return;
+			if (prefixRange(prefix) === null) throw new Error(`addon settings: "${addonId}" cannot be expressed as an id range`);
+			await door.transact({ ops: [...removed.length > 0 ? [{
+				op: "deleteWhere",
+				collection: ADDON_SETTINGS_COLLECTION,
+				filter: { whereIn: { id: removed } }
+			}] : [], ...records.length > 0 ? [{
+				op: "upsertMany",
+				collection: ADDON_SETTINGS_COLLECTION,
+				conflict: ["id"],
+				records
+			}] : []] });
+		}
+	};
+}
+//#endregion
+//#region src/kernel/system-settings-policy.ts
+/**
+* Which `system-settings` keys the STORE may answer, and which the kernel
+* loads from the door into memory at boot — D675.
+*
+* ## The store never answers for a bootstrap section
+*
+* `system-settings` may still hold `auth.jwtSecret`, `auth.adminUsername` and
+* `auth.adminPassword` — written there by `local-auth` (and by older builds)
+* next to `auth.tokenExpiry`. Since D797 none of the three is a setting at
+* all (the signing key is the keychain's, the first-boot admin is fixed), and
+* the stale rows must still never answer: merging them back in would let a
+* stale DB copy stand in for a credential. The one-off ops script deletes them.
+*
+* So a bootstrap-owned section is answered from env + config.yaml ONLY, and
+* the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:
+* the values the operator edits on System → Authentication (`auth.tokenExpiry`,
+* `auth.accessTokenExpiry`, `auth.trustedProxies`). Widening this list is a security decision, not a
+* convenience.
+*/
+/** Top-level sections whose authority is env + config.yaml (`bootstrapSchema`). */
+var BOOTSTRAP_OWNED_SECTIONS = new Set([
+	"mode",
+	"server",
+	"auth",
+	"hub",
+	"agent",
+	"tls",
+	"bootstrap",
+	"keychain"
+]);
+/** The only keys under a bootstrap-owned section the store may answer. */
+var STORE_READABLE_BOOTSTRAP_KEYS = new Set([
+	"auth.tokenExpiry",
+	"auth.accessTokenExpiry",
+	"auth.trustedProxies",
+	"auth.trustedNetworks",
+	"server.name"
+]);
+/** May the settings store answer `key`, or is it env + config.yaml only? */
+function storeMayAnswer(key) {
+	const dot = key.indexOf(".");
+	const section = dot === -1 ? key : key.slice(0, dot);
+	if (!BOOTSTRAP_OWNED_SECTIONS.has(section)) return true;
+	return STORE_READABLE_BOOTSTRAP_KEYS.has(key);
+}
+//#endregion
+//#region src/kernel/device-settings-store.ts
+/** The collection every addon's per-device settings share. Named nowhere else. */
+var DEVICE_SETTINGS_COLLECTION = "addon-device-settings";
+function scopeOf(addonId, deviceId) {
+	return `${addonId}:${String(deviceId)}.`;
+}
+function assertDeviceId(deviceId) {
+	if (!Number.isInteger(deviceId) || deviceId <= 0) throw new Error(`device settings: "${String(deviceId)}" is not a device id`);
+}
+function deviceIdOfSuffix(suffix) {
+	const dot = suffix.indexOf(".");
+	if (dot <= 0) return null;
+	const id = Number(suffix.slice(0, dot));
+	return Number.isInteger(id) && id > 0 ? id : null;
+}
+/** Every field row of one device scope, or a throw. */
+async function readScope(door, addonId, deviceId) {
+	return loadPrefixed(door, DEVICE_SETTINGS_COLLECTION, scopeOf(addonId, deviceId));
+}
+function createDeviceSettingsStore(door, addonId) {
+	return {
+		async read(deviceId) {
+			try {
+				assertDeviceId(deviceId);
+				const value = await readScope(door, addonId, deviceId);
+				return Object.keys(value).length === 0 ? { kind: "absent" } : {
+					kind: "present",
+					value
+				};
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+		},
+		async readBatch(deviceIds) {
+			const out = /* @__PURE__ */ new Map();
+			if (deviceIds.length === 0) return out;
+			for (const id of deviceIds) out.set(id, {});
+			const wanted = new Set(deviceIds);
+			const all = await loadPrefixed(door, DEVICE_SETTINGS_COLLECTION, `${addonId}:`);
+			for (const [suffix, value] of Object.entries(all)) {
+				const id = deviceIdOfSuffix(suffix);
+				if (id === null || !wanted.has(id)) continue;
+				const blob = out.get(id);
+				if (blob !== void 0) blob[suffix.slice(suffix.indexOf(".") + 1)] = value;
+			}
+			return out;
+		},
+		async listIds() {
+			const all = await loadPrefixed(door, DEVICE_SETTINGS_COLLECTION, `${addonId}:`, () => null);
+			const ids = /* @__PURE__ */ new Set();
+			for (const suffix of Object.keys(all)) {
+				const id = deviceIdOfSuffix(suffix);
+				if (id !== null) ids.add(id);
+			}
+			return [...ids].toSorted((a, b) => a - b);
+		},
+		async merge(deviceId, patch) {
+			assertDeviceId(deviceId);
+			const scope = scopeOf(addonId, deviceId);
+			const records = [];
+			const removed = [];
+			for (const [key, value] of Object.entries(patch)) if (value === void 0) removed.push(`${scope}${key}`);
+			else records.push({
+				id: `${scope}${key}`,
+				data: {
+					addonId,
+					deviceId: String(deviceId),
+					key,
+					value
+				}
+			});
+			if (records.length === 0 && removed.length === 0) return;
+			await door.transact({ ops: [...removed.length > 0 ? [{
+				op: "deleteWhere",
+				collection: DEVICE_SETTINGS_COLLECTION,
+				filter: { whereIn: { id: removed } }
+			}] : [], ...records.length > 0 ? [{
+				op: "upsertMany",
+				collection: DEVICE_SETTINGS_COLLECTION,
+				conflict: ["id"],
+				records
+			}] : []] });
+		},
+		async clear(deviceId) {
+			assertDeviceId(deviceId);
+			const range = prefixRange(scopeOf(addonId, deviceId));
+			if (range === null) throw new Error(`device settings: no id range for addon "${addonId}"`);
+			await door.deleteWhere({
+				collection: DEVICE_SETTINGS_COLLECTION,
+				filter: { whereBetween: { id: [range.lo, range.hi] } }
+			});
+		}
+	};
+}
+/** The `Record` form of a read: `{}` for a store that answered with no row, a THROW for one that did not. */
+async function readDeviceOrThrow(store, deviceId) {
+	const read = await store.read(deviceId);
+	switch (read.kind) {
+		case "present": return { ...read.value };
+		case "absent": return {};
+		case "unreadable": throw new Error(`device settings of ${String(deviceId)} could not be read: ${read.error}`);
+	}
+}
+//#endregion
+//#region src/kernel/settings-door-view.ts
+/**
+* Every `system-settings` row under `prefix`, keyed by the suffix — or a throw.
+*
+* `system-settings` stores the value ITSELF (`setSystem` / `door.set` write
+* `JSON.stringify(value)`), mostly scalars. The engine's `query` hands a KV row
+* back parsed only when its text is an object or an array; a scalar comes back
+* as `{ value: <its JSON text> }` — `"12h"` arrives as `{ value: '"12h"' }`.
+* That is not a value anyone stored, and guessing it back would misread a
+* stored object that happens to be `{ value: … }`. So the range read only
+* ENUMERATES the keys (same keyset walk and refusal as every prefix read
+* here), and each value is taken from `get`, which parses the row exactly
+* (D675). These reads are small and rare: a section's handful of keys when a
+* form opens, and the capability preferences once at boot.
+*/
+async function loadSystemSettingsPrefix(door, prefix, mayRead = () => true) {
+	const listed = await loadPrefixed(door, "system-settings", prefix, () => null);
+	const result = {};
+	for (const suffix of Object.keys(listed).filter(mayRead)) {
+		const value = await door.get({
+			collection: "system-settings",
+			key: `${prefix}${suffix}`
+		});
+		if (value !== void 0) result[suffix] = value;
+	}
+	return result;
+}
+//#endregion
+//#region src/kernel/sections-store.ts
+function createSectionsStore(door) {
+	return {
+		read: (section) => loadSystemSettingsPrefix(door, `${section}.`, (key) => storeMayAnswer(`${section}.${key}`)),
+		write: async (section, patch) => {
+			for (const [key, value] of Object.entries(patch)) await door.set({
+				collection: "system-settings",
+				key: `${section}.${key}`,
+				value
+			});
+		}
+	};
+}
+//#endregion
+//#region src/kernel/moleculer/runner-addon-settings.ts
+/** @param client the hub's `settingsStore` client; `undefined` makes every call THROW. */
+function createRunnerAddonSettings(client, addonId, before = async () => {}) {
+	if (client === void 0) {
+		const refuse = async () => {
+			throw new Error(`settings of "${addonId}": settings store not wired`);
+		};
+		return {
+			readAddonStore: refuse,
+			readAddonStoreResult: async () => ({
+				kind: "failed",
+				error: "settings store not wired"
+			}),
+			readAddonStoreKeyResult: async () => ({
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: "settings store not wired"
+			}),
+			writeAddonStore: refuse,
+			getSection: refuse,
+			setSection: refuse
+		};
+	}
+	const door = {
+		query: async (input) => {
+			await before();
+			return client.query.query(input);
+		},
+		get: async (input) => {
+			await before();
+			return client.get.query(input);
+		},
+		set: async (input) => {
+			await before();
+			return client.set.mutate(input);
+		},
+		transact: async (input) => {
+			await before();
+			return client.transact.mutate(input);
+		}
+	};
+	const store = createAddonSettingsStore(door, addonId);
+	const sections = createSectionsStore(door);
+	return {
+		readAddonStore: async () => {
+			const read = await store.read();
+			switch (read.kind) {
+				case "present": return { ...read.value };
+				case "absent": return {};
+				case "unreadable": throw new Error(`settings of "${addonId}" could not be read: ${read.error}`);
+			}
+		},
+		readAddonStoreResult: async () => {
+			const read = await store.read();
+			switch (read.kind) {
+				case "present": return {
+					kind: "value",
+					value: { ...read.value }
+				};
+				case "absent": return { kind: "missing" };
+				case "unreadable": return {
+					kind: "failed",
+					error: read.error
+				};
+			}
+		},
+		readAddonStoreKeyResult: async (key) => {
+			const read = await store.readKey(key);
+			return read.kind === "unreadable" ? {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: read.error
+			} : read;
+		},
+		writeAddonStore: (patch) => store.merge(patch),
+		getSection: (section) => sections.read(section),
+		setSection: (section, patch) => sections.write(section, patch)
+	};
+}
+//#endregion
+//#region src/builtins/sqlite-storage/retired-settings-keys.ts
+/**
+* The dead keys, per row.
+*
+* ## Addressing these rows
+*
+* Every namespace below is a FORKED addon, whose `ctx.settings` comes from
+* `addon-context-factory` and writes `<addonId>:addon-settings` row `root`. The
+* scoped table is therefore the right target — unlike the hub builtin whose
+* mis-addressed spec is dissected at {@link RetiredRowSpec}. Confirmed per
+* namespace against `packages/<pkg>/package.json`'s manifest `id`.
+*
+* ## `keys` vs `perNodeKeys` is a data-loss decision, not a style choice
+*
+* `perNodeKeys` matches `<key>` AND `<key>@<nodeId>`. That is right for a key
+* whose per-node copies are all dead (the engine cascade, the decoder
+* `backend`). It is WRONG for `probedBestHwaccel` / `probedBestAudioBackend`,
+* where the bare key is unreachable residue but every `@<nodeId>` copy is the
+* node's live probe result — those go under `keys`, which is exact-match.
+*
+* `detection-pipeline` / `addon-settings` / `root` — every key in this row is
+* dead; the row itself is kept because the addon writes a live key into it
+* (`videoPipelineSteps`). `pipelineTemplates` is no longer read or written
+* (templates were removed, D759) and is deliberately NOT listed here: stored
+* template rows are left exactly as they are.
+*
+*  - `pipelineSteps` / `pipelineEngine`: the persisted GLOBAL step + engine
+*    seed. Removed with `getGlobalSteps` becoming pure — dispatch builds steps
+*    from the orchestrator's `agentSettings` plus per-camera overrides, and
+*    never consulted the seed. See `addon-pipeline/src/detection-pipeline/provider.ts`.
+*  - `engineRuntime` / `engineBackend` / `engineDevice` / `probedBestEngine`:
+*    the per-node engine CASCADE, removed with the operator-facing engine
+*    election. Each node now runs a device-array of inference pools balanced
+*    per session, and the node-default pool derives live from the node's own
+*    hardware (`resolveAutoEngine`). See
+*    `addon-pipeline/src/detection-pipeline/engine-store-keys.ts`.
+*/
+var RETIRED_SETTINGS_KEYS = [
+	{
+		namespace: "detection-pipeline",
+		collection: "addon-settings",
+		row: "root",
+		keys: ["pipelineSteps", "pipelineEngine"],
+		perNodeKeys: [
+			"engineRuntime",
+			"engineBackend",
+			"engineDevice",
+			"probedBestEngine"
+		],
+		reason: "global step/engine seed and the per-node engine cascade — both removed; the live per-camera dispatch path never read either"
+	},
+	{
+		namespace: "pipeline-orchestrator",
+		collection: "addon-settings",
+		row: "root",
+		keys: [
+			"enabledNodes",
+			"enabledDecoderNodes",
+			"enabledAudioNodes",
+			"remoteSourcingNodes",
+			"nativeLeaseTtlMs"
+		],
+		perNodeKeys: ["backend"],
+		reason: "the pre-singleton \"enabled nodes\" role model (node capability now lives per node in agent-settings and is derived by NodeTopology.refresh, never read from this row), `nativeLeaseTtlMs` superseded by `nativeLeaseActivityMs`, and the decoder `backend` selector whose resolver returns DEFAULT_DECODER_BACKEND unconditionally (decoder-backend.ts)"
+	},
+	{
+		namespace: "stream-broker",
+		collection: "addon-settings",
+		row: "root",
+		keys: [
+			"maxDecodeFps",
+			"initialReconnectDelayMs",
+			"maxReconnectDelayMs"
+		],
+		perNodeKeys: [],
+		reason: "three form knobs deleted 2026-08-28 (D272): nothing capped decode fps, and the reconnect ladder has always run on the INITIAL/MAX_RECONNECT_DELAY_MS constants"
+	},
+	{
+		namespace: "embedding-encoder",
+		collection: "addon-settings",
+		row: "root",
+		keys: ["runtime", "backend"],
+		perNodeKeys: [],
+		reason: "two selects deleted 2026-08-28 (D272); their only reference was a withTags log field, and the CUDA/CoreML options named acceleration that has never existed — embedding inference is always ONNX in the embedded Python"
+	},
+	{
+		namespace: "audio-analyzer",
+		collection: "addon-settings",
+		row: "root",
+		keys: ["selectedAudioModel", "probedBestAudioBackend"],
+		perNodeKeys: [],
+		reason: "`selectedAudioModel` deleted 2026-08-28 (D272) — createAudioPipeline takes a backend and no model id, so it never reached inference; the BARE `probedBestAudioBackend` is pre-perNode residue that projectStore already drops (no bare fallback), so no node can ever read it"
+	},
+	{
+		namespace: "decoder-nodeav",
+		collection: "addon-settings",
+		row: "root",
+		keys: ["probedBestHwaccel"],
+		perNodeKeys: [],
+		reason: "bare pre-perNode residue — the live probe result is `probedBestHwaccel@<nodeId>` and `projectStore` deliberately drops the bare key, so nothing can read it"
+	},
+	{
+		namespace: "pipeline-analytics",
+		collection: "addon-settings",
+		row: "root",
+		keys: ["mediaAttachPolicy"],
+		perNodeKeys: [],
+		reason: "deleted 2026-08-28 (D272) — absent from MediaSettingsSchema, so the value was never even resolved, let alone read"
+	}
+];
+//#endregion
+//#region src/kernel/legacy-blob-guard.ts
+/** Root keys retired long before D870: they never count as "settings still to migrate". */
+var OWN_RETIRED_ROOT_KEYS = new Set([
+	"recordingConfigs",
+	"recordingExports",
+	"recordingOpsLog",
+	"probeSnapshots",
+	"rtspTokens",
+	"profileMap"
+]);
+/** Is `key` of `addonId` a root key that was retired (and must not be migrated)? */
+function isRetiredRootKey(addonId, key) {
+	if (OWN_RETIRED_ROOT_KEYS.has(key)) return true;
+	return RETIRED_SETTINGS_KEYS.some((spec) => spec.namespace === addonId && (spec.keys.includes(key) || spec.perNodeKeys.some((k) => key === k || key.startsWith(`${k}@`))));
+}
+var UnmigratedSettingsError = class extends Error {
+	constructor(addonId, what) {
+		super(`addon "${addonId}" refuses to start: ${what} - the settings it had are still in the per-addon tables and the standard store holds none. Run scripts/hub/migrate-device-store.ts --copy --apply (D870) before starting it.`);
+		this.name = "UnmigratedSettingsError";
+	}
+};
+async function countOf(client, input) {
+	const n = await client.count.query(input);
+	if (typeof n !== "number") throw new Error("settings store answered a non-number to a count");
+	return n;
+}
+var LEGACY_PAGE = 500;
+var LEGACY_PAGE_BUDGET = 200;
+var ID_TAIL = "";
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Does the addon's per-device blob table hold a row the copy would actually
+* migrate - a positive numeric id with a non-empty record? An addon whose rows
+* the copy skips anyway must not be refused for them.
+*/
+async function hasMigratableDeviceRow(client, addonId) {
+	let cursor = "";
+	for (let page = 0; page < LEGACY_PAGE_BUDGET; page++) {
+		const rows = await client.query.query({
+			namespace: addonId,
+			collection: "addon-devices",
+			filter: {
+				whereBetween: { id: [cursor, ID_TAIL] },
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: LEGACY_PAGE
+			}
+		});
+		if (!Array.isArray(rows)) throw new Error("settings store answered a non-list to a query");
+		let lastId = cursor;
+		for (const row of rows) {
+			if (!isRecord$2(row) || typeof row["id"] !== "string") continue;
+			lastId = row["id"];
+			const id = Number(row["id"]);
+			const data = row["data"];
+			if (Number.isInteger(id) && id > 0 && isRecord$2(data) && Object.keys(data).length > 0) return true;
+		}
+		if (rows.length < LEGACY_PAGE || lastId === cursor) return false;
+		cursor = lastId;
+	}
+	throw new Error(`addon "${addonId}": more legacy blob pages than the guard will read`);
+}
+/**
+* THROWS when the addon has blob settings and the standard store has none of
+* its own. A store that cannot be asked also throws: it is not "no blobs".
+*/
+async function assertLegacyBlobsMigrated(client, addonId, logger) {
+	const legacyDevices = await hasMigratableDeviceRow(client, addonId);
+	const root = await client.get.query({
+		namespace: addonId,
+		collection: "addon-settings",
+		key: "root"
+	});
+	const legacySettings = isRecord$2(root) && Object.keys(root).some((key) => !isRetiredRootKey(addonId, key));
+	if (!legacyDevices && !legacySettings) return;
+	const rangeOf = (prefix) => {
+		const range = prefixRange(prefix);
+		if (range === null) throw new Error(`no id range for addon "${addonId}"`);
+		return { whereBetween: { id: [range.lo, range.hi] } };
+	};
+	const newDevices = await countOf(client, {
+		collection: "addon-device-settings",
+		filter: rangeOf(`${addonId}:`)
+	});
+	const newSettings = await countOf(client, {
+		collection: "addon-settings",
+		filter: rangeOf(`${addonId}.`)
+	});
+	const problems = [];
+	if (legacyDevices && newDevices === 0) problems.push("per-device blobs");
+	if (legacySettings && newSettings === 0) problems.push("an addon settings blob");
+	if (problems.length === 0) return;
+	const error = new UnmigratedSettingsError(addonId, problems.join(" and "));
+	logger.error(error.message, { meta: {
+		addonId,
+		newDevices,
+		newSettings
+	} });
+	throw error;
+}
+//#endregion
+//#region src/kernel/moleculer/runner-device-settings.ts
+/**
+* The forked runner's `ctx.settings` device methods (D870).
+*
+* A runner does not hold the settings door; it holds a tRPC client of the hub's
+* `settings-store` cap. This file adapts that client to the door slice the
+* per-device store needs and hands back the five view methods — the SAME module
+* hub-main's view uses, so a device's settings are one set of rows whichever
+* process asks. Before D870 the runner kept its own `<addonId>:addon-devices`
+* blob per device; a hub-side write to the rows was invisible to it.
+*/
+/** The door slice the per-device store needs, over a tRPC client. */
+function doorOverClient(client, before = async () => {}) {
+	return {
+		query: async (input) => {
+			await before();
+			return client.query.query(input);
+		},
+		transact: async (input) => {
+			await before();
+			return client.transact.mutate(input);
+		},
+		deleteWhere: async (input) => {
+			await before();
+			return client.deleteWhere.mutate(input);
+		}
+	};
+}
+/**
+* @param client the hub's `settingsStore` client, or `undefined` when the
+*   runner has none — every call then THROWS: a store that could not be asked
+*   is not an empty one.
+*/
+function createRunnerDeviceSettings(client, addonId, before = async () => {}) {
+	if (client === void 0) {
+		const refuse = () => {
+			throw new Error(`device settings of "${addonId}": settings store not wired`);
+		};
+		return {
+			readDeviceStore: async () => refuse(),
+			readDeviceStoreBatch: async () => refuse(),
+			listDeviceStoreIds: async () => refuse(),
+			writeDeviceStore: async () => refuse(),
+			clearDeviceStore: async () => refuse()
+		};
+	}
+	const store = createDeviceSettingsStore(doorOverClient(client, before), addonId);
+	return {
+		readDeviceStore: (deviceId) => readDeviceOrThrow(store, deviceId),
+		readDeviceStoreBatch: (ids) => store.readBatch(ids),
+		listDeviceStoreIds: () => store.listIds(),
+		writeDeviceStore: (deviceId, patch) => store.merge(deviceId, patch),
+		clearDeviceStore: (deviceId) => store.clear(deviceId)
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/addon-context-factory.ts
 /** This runtime's node id, regardless of mode (broker.nodeID or the UDS child nodeId). */
 function runtimeNodeId(runtime) {
@@ -9583,20 +10283,6 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		}
 		return r.kind === "value" ? r.value : {};
 	};
-	/** Read-modify-write that REFUSES to write when the read failed. */
-	const mergeBlob = async (coll, key, patch, namespace) => {
-		await readModifyWrite({
-			read: () => readBlobResult(coll, key, namespace),
-			write: (next) => writeBlob(coll, key, next, namespace),
-			patch,
-			onRefused: (error) => {
-				scopedLogger.error(`settings merge REFUSED (${coll}/${key}) — read failed, refusing to overwrite with a partial blob`, { meta: {
-					error,
-					patchKeys: Object.keys(patch)
-				} });
-			}
-		});
-	};
 	const writeBlob = async (coll, key, value, namespace) => {
 		if (!settingsApi) return;
 		try {
@@ -9619,38 +10305,24 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 			} });
 		}
 	};
-	const rmwChains = /* @__PURE__ */ new Map();
-	const serializeRmw = (coll, key, op) => {
-		const chainKey = `${coll}/${key}`;
-		const next = (rmwChains.get(chainKey) ?? Promise.resolve()).catch(() => void 0).then(op);
-		rmwChains.set(chainKey, next);
-		next.finally(() => {
-			if (rmwChains.get(chainKey) === next) rmwChains.delete(chainKey);
-		}).catch(() => void 0);
-		return next;
+	const deviceSettingsClient = Reflect.get(api, "settingsStore");
+	let blobsChecked = null;
+	const bootGuard = () => {
+		const client = deviceSettingsClient;
+		if (client === void 0) return Promise.resolve();
+		blobsChecked ??= assertLegacyBlobsMigrated({
+			get: { query: (input) => client.get.query(input) },
+			query: { query: (input) => client.query.query(input) },
+			count: { query: (input) => client.count.query(input) }
+		}, addonId, scopedLogger).catch((err) => {
+			blobsChecked = null;
+			throw err;
+		});
+		return blobsChecked;
 	};
 	const settingsView = {
-		async readAddonStore() {
-			return readBlob("addon-settings", "root", addonId);
-		},
-		readAddonStoreResult: () => readBlobResult("addon-settings", "root", addonId),
-		async writeAddonStore(patch) {
-			return serializeRmw("addon-settings", "root", async () => {
-				await mergeBlob("addon-settings", "root", patch, addonId);
-			});
-		},
-		async readDeviceStore(deviceId) {
-			return readBlob("addon-devices", String(deviceId), addonId);
-		},
-		async writeDeviceStore(deviceId, patch) {
-			const key = String(deviceId);
-			return serializeRmw("addon-devices", key, async () => {
-				await mergeBlob("addon-devices", key, patch, addonId);
-			});
-		},
-		async clearDeviceStore(deviceId) {
-			await writeBlob("addon-devices", String(deviceId), {}, addonId);
-		},
+		...createRunnerAddonSettings(deviceSettingsClient, addonId, bootGuard),
+		...createRunnerDeviceSettings(deviceSettingsClient, addonId, bootGuard),
 		async readDeviceRuntimeState(deviceId) {
 			return readBlob("device-runtime-state", String(deviceId));
 		},
@@ -9659,14 +10331,6 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async clearDeviceRuntimeState(deviceId) {
 			await writeBlob("device-runtime-state", String(deviceId), {});
-		},
-		async getSection(section) {
-			return readBlob("sections", section);
-		},
-		async setSection(section, patch) {
-			return serializeRmw("sections", section, async () => {
-				await mergeBlob("sections", section, patch);
-			});
 		}
 	};
 	const readinessRegistry = () => runtime.mode === "broker" ? getOrInitReadinessRegistry(runtime.broker, scopedEventBus, scopedLogger) : getOrInitReadinessRegistryForClient(runtime.client, scopedEventBus, scopedLogger, nodeId);