@camstack/system 1.2.455 → 1.2.457

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Bi as expandCapMethods, Cr as supportedRuntimes, Dn as lifecycleJobSchema, Ei as asString$1, Hn as objectInputDeclaresRequiredDeviceId, K as METHOD_ACCESS_MAP, Kr as errMsg$1, Li as defineRecordKinds, Mn as looseSchema, Ni as createEvent$1, Qr as DEVICE_STATUS_METHOD, Ri as emitDownForOwnedCaps, Sn as kebabToCamel$1, Ti as asNumber, Vn as objectInputDeclaresAddonId, W as LOG_LEVEL_RANK, Xr as DATAPLANE_SECRET_HEADER$1, Yr as CALLER_STAMPED_CAPABILITIES$1, Zr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _ as CatalogFileSchema, _a as userError, _n as isCollectionArrayMethod, ar as resolveMethodAuth, bn as isObjectInput, ca as resolveCapMount, cr as scopesAllowAddon, d as CATALOG_LANGS, fi as RUNTIME_DEFAULTS, fn as interpolate, ft as addonSettingsCapability, gn as isArrayOutputSchema, hr as splitTranslationRef, jn as logLevelAtMost, lr as scopesAllowDeviceCap, mi as ReadinessTimeoutError, n as AGENT_MDNS_TXT_KEYS, na as parseJsonUnknown, oa as readinessKey, on as extractNestedAddonId, pi as ReadinessRegistry, qn as procedureAuthKey, r as ALL_CAPABILITY_DEFINITIONS, t as AGENT_MDNS_SERVICE_TYPE, ta as parseJsonObject, ua as scopeKey, va as withoutCallerStamp, wi as asJsonObject$1, xn as isVoidInput, ya as EventCategory$1 } from "./dist-BpSENkRJ.mjs";
+import { An as isVoidInput, Bn as logLevelAtMost, Ci as ReadinessTimeoutError, Da as withoutCallerStamp, Ea as userError, Fi as asString$1, Hi as createEvent$1, In as lifecycleJobSchema, J as METHOD_ACCESS_MAP, K as LOG_LEVEL_RANK, Ki as defineRecordKinds, Mr as supportedRuntimes, Ni as asJsonObject$1, Oa as EventCategory$1, Pi as asNumber, Si as ReadinessRegistry, Tn as isCollectionArrayMethod, Vn as looseSchema, Xn as objectInputDeclaresAddonId, Yi as expandCapMethods, Zn as objectInputDeclaresRequiredDeviceId, _a as resolveCapMount, _r as scopesAllowAddon, ai as DATAPLANE_SECRET_HEADER$1, bn as interpolate, bt as addonSettingsCapability, d as CATALOG_LANGS, da as parseJsonUnknown, ha as readinessKey, ii as CALLER_STAMPED_CAPABILITIES$1, jn as kebabToCamel$1, kn as isObjectInput, mn as extractNestedAddonId, mr as resolveMethodAuth, n as AGENT_MDNS_TXT_KEYS, nr as procedureAuthKey, oi as DEVICE_SETTINGS_CONTRIBUTION_METHODS, qi as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, si as DEVICE_STATUS_METHOD, t as AGENT_MDNS_SERVICE_TYPE, ti as errMsg$1, ua as parseJsonObject, v as CatalogFileSchema, vr as scopesAllowDeviceCap, wn as isArrayOutputSchema, wr as splitTranslationRef, xi as RUNTIME_DEFAULTS, ya as scopeKey } from "./dist-Dhux90yB.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-uFbTyY_o.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-BB6nHAL5.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -20,27 +20,28 @@ import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
 import "./builtins/liveness-monitor/index.mjs";
-import { LocalAuthAddon, S as ApiKeyManager, _ as AuthAuditLog, a as attachUserManagementInternal, b as SettingsReadUnavailableError, c as ScopedTokenManager, d as onSessionsRevoked, f as DeviceCredentialManager, g as AdminTokenManager, h as ADMIN_TOKEN_PREFIX, i as USER_MANAGEMENT_INTERNAL, l as LoginSessionManager, m as ADMIN_TOKEN_MAX_LIFETIME_MS, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as PREVIOUS_LEAF_GRACE_MS, r as UserManager, s as DeviceCaStore, t as FIRST_BOOT_ADMIN_PASSWORD, u as REFRESH_TOKEN_PREFIX, v as AuthManager, x as isSettingsReadUnavailable, y as parseTokenExpiry } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, _ as SettingsReadUnavailableError, a as attachUserManagementInternal, c as DeviceCaStore, d as onSessionsRevoked, f as DeviceCredentialManager, g as parseTokenExpiry, h as AuthManager, i as USER_MANAGEMENT_INTERNAL, l as LoginSessionManager, m as AuthAuditLog, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as PREVIOUS_LEAF_GRACE_MS, r as UserManager, s as preferencesLimitReasonOf, t as FIRST_BOOT_ADMIN_PASSWORD, u as REFRESH_TOKEN_PREFIX, v as isSettingsReadUnavailable, y as ApiKeyManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
+import { a as lineContainsText, i as levelRank, n as compileLogFilter, o as lineMatches, r as filterIsEmpty, s as originNodeOf, t as bareAddonOf } from "./log-read-filter-D7Ev3zm-.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { l as SqliteSettingsBackend } from "./wal-maintenance-TyuOEVy1.mjs";
+import { l as SqliteSettingsBackend } from "./wal-maintenance-BMiX6UIa.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DOlYt1t1.mjs";
-import { $ as generateMeshKeyPair, A as isConstrainedCa, C as MAX_LEAF_VALIDITY_DAYS, D as PERMITTED_DNS_SUFFIXES, F as AGENT_HTTPS_NAMES_COLLECTION, G as describeMeshLeaf, H as MESH_NODE_CERTIFICATES_COLUMNS, I as AGENT_HTTPS_NAMES_COLUMNS, J as caFingerprint, K as getProcessMeshCertificateRegistry, L as AgentHttpsNames, M as permitsIdentity, N as permitsName, O as PERMITTED_IP_RANGES, P as readNameConstraints, Q as generateMeshCa, R as getProcessAgentHttpsNames, S as LEAF_RENEWAL_WINDOW_DAYS, T as evaluateExistingCert, U as MeshCertificateRegistry, V as MESH_NODE_CERTIFICATES_COLLECTION, W as RENEWAL_ABANDONED, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, a as collectAgentNames, b as systemHostFacts, c as installAgentHttps, d as issueAgentHttpsLeaf, et as isValidAgentNodeId, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isLocalOnlyHostname, k as buildNameConstraintSet, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafFromCsr, o as createAgentHttpsRequest, p as pemDigest, q as setProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as loadMeshCa, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as issueMeshLeafForNode, u as isPrivateAddress, w as SERVER_AUTH_OID, x as CA_VALIDITY_DAYS, y as collectCertIdentity, z as setProcessAgentHttpsNames } from "./agent-https-CLWrOO3o.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-cxKcZRMi.mjs";
+import { $ as generateMeshCa, A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as AGENT_HTTPS_NAMES_COLLECTION, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, Q as exportMeshPrivateKeyPem, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, U as MESH_NODE_CERTIFICATES_COLUMNS, W as MeshCertificateRegistry, X as caFingerprintCompact, Y as caFingerprint, Z as createMeshCsrPem, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, et as generateMeshKeyPair, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, it as loadMeshCa, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, nt as issueMeshLeafForNode, o as createAgentHttpsRequest, p as pemDigest, q as getProcessMeshCertificateRegistry, r as agentHttpsPaths, rt as issueMeshLeafFromCsr, s as describeHttpsLeaf, t as AgentHttpsInstallError, tt as isValidAgentNodeId, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-CK9Z4sSR.mjs";
 import { $ as parseCidrList, A as setProcessMeshPeerTransportLookup, B as requireProcessMeshCa, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as AGENT_UI_UNLOCK_VERSION, H as AGENT_UI_UNLOCK_TTL_MS, I as MeshCrl, J as mintAgentUiUnlockTicket, K as UnlockTicketJtiStore, L as processMeshCrl, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as normalizeIp, R as MeshCaKeeper, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as AGENT_UI_UNLOCK_TYP, V as AGENT_DASHBOARD_ORIGINS_FIELD, W as AGENT_UI_UNLOCK_USE, X as verifyAgentUiUnlockTicket, Y as parseAgentDashboardOrigins, Z as createCidrMatcher, _ as signPairingProof, a as hubHostFromMeshAddress, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, d as PAIRING_PROTOCOL, et as readCidrSetting, f as PAIRING_TTL_MS, g as keyFingerprintShort, h as describeCsr, i as AgentPairing, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, m as computePairingSas, n as HubPairing, o as PAIRING_CODE_DIGITS, p as computePairingCommitment, q as isAllowedAgentDashboardReturnTo, r as PairingHttpError, s as PAIRING_MAX_CODE_ATTEMPTS, u as PAIRING_PIN_DIGITS, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as getProcessMeshCaState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-stpC3Zy-.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-DlgkFJVY.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-B8olZqqd.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-YFSJRtKy.mjs";
+import { c as backupOrchestratorRecordKinds, f as BackupDecryptError, g as generateBackupKeyPair, l as backupRecordStoresOf, m as BackupKeyMismatchError, p as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, v as readBackupEncryptionHeader } from "./restore-archive-DyOaPeAr.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -4436,6 +4437,16 @@ var ScopedLogger = class ScopedLogger {
 		};
 	}
 };
+//#endregion
+//#region src/logging/log-manager.ts
+/**
+* A short id for one process lifetime: the first half of every entry `id`.
+* Base-36 epoch ms plus a random suffix, so two boots of the same process in
+* the same millisecond still mint different ids.
+*/
+function newBootId() {
+	return `${Date.now().toString(36)}${Math.floor(Math.random() * 36 ** 4).toString(36).padStart(4, "0")}`;
+}
 var LogManager = class {
 	ringBuffer;
 	/**
@@ -4472,6 +4483,14 @@ var LogManager = class {
 	*/
 	gate = getLoggingGate();
 	/**
+	* Entry identity (D898): `<bootId>.<seq>`, stamped once, here, on every line
+	* this process accepts — so the in-memory tail, the live subscription and
+	* the rotated file carry the SAME id and a page read from disk dedupes
+	* exactly against the lines pushed live.
+	*/
+	bootId = newBootId();
+	seq = 0;
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*
@@ -4504,7 +4523,10 @@ var LogManager = class {
 	}
 	createLogger(scope) {
 		return new ScopedLogger(scope, (entry) => {
-			const enriched = redactLogEntry(this.enrichDeviceName(entry));
+			const enriched = {
+				...redactLogEntry(this.enrichDeviceName(entry)),
+				id: `${this.bootId}.${String(++this.seq)}`
+			};
 			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
 			if (this.gate.allowsDestination(enriched)) for (const entry of this.destinations) {
 				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
@@ -16046,6 +16068,67 @@ function createChildrenBatchLoader(opts) {
 	} };
 }
 //#endregion
+//#region src/kernel/moleculer/accessory-prune-gate.ts
+function isSpecList(answer) {
+	return Array.isArray(answer);
+}
+function classifyAccessoryRead(answer, ctx) {
+	if (isSpecList(answer)) {
+		if (!ctx.online) return {
+			kind: "unknown",
+			reason: "parent offline",
+			children: answer
+		};
+		if (ctx.probedAt === 0) return {
+			kind: "unknown",
+			reason: "probe not yet completed",
+			children: answer
+		};
+		return {
+			kind: "successful",
+			children: answer
+		};
+	}
+	if (answer.kind === "unknown") return {
+		kind: "unknown",
+		reason: answer.reason,
+		children: answer.known ?? []
+	};
+	return {
+		kind: "successful",
+		children: answer.children
+	};
+}
+/** One per parent registration; in-memory on purpose (a restart starts over — the safe direction). */
+var AccessoryShrinkGate = class {
+	/** childId → the probe (`lastProbedAt`) of the first successful read that lacked it. */
+	#firstMissing = /* @__PURE__ */ new Map();
+	/**
+	* `missing` = the managed children a SUCCESSFUL read no longer lists. Never
+	* call this for an unknown read.
+	*/
+	decide(missing, probedAt) {
+		const missingSet = new Set(missing);
+		for (const id of [...this.#firstMissing.keys()]) if (!missingSet.has(id)) this.#firstMissing.delete(id);
+		const prune = [];
+		const deferred = [];
+		for (const id of missing) {
+			const first = this.#firstMissing.get(id);
+			if (first !== void 0 && probedAt > first) {
+				prune.push(id);
+				this.#firstMissing.delete(id);
+				continue;
+			}
+			if (first === void 0) this.#firstMissing.set(id, probedAt);
+			deferred.push(id);
+		}
+		return {
+			prune,
+			deferred
+		};
+	}
+};
+//#endregion
 //#region src/kernel/moleculer/runtime-state-load.ts
 /** A device build refused because its runtime state could not be loaded. */
 var RuntimeStateLoadError = class extends Error {
@@ -16768,6 +16851,7 @@ function createBrokerDeviceManagerApi(opts) {
 				throw err;
 			}
 			const lifecycleHost = device;
+			const shrinkGate = new AccessoryShrinkGate();
 			const runReconcile = async () => {
 				try {
 					await callDeviceManager(api, "registerDevice", {
@@ -16791,7 +16875,12 @@ function createBrokerDeviceManagerApi(opts) {
 					});
 				}
 				if (typeof lifecycleHost.getAccessoryChildren !== "function") return;
-				const specs = lifecycleHost.getAccessoryChildren();
+				const probedAt = device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0;
+				const read = classifyAccessoryRead(lifecycleHost.getAccessoryChildren(), {
+					online: device.online,
+					probedAt
+				});
+				const specs = read.children;
 				const expected = new Set(specs.map((s) => `${device.stableId}-${s.stableIdSuffix}`));
 				await runBounded(specs, ACCESSORY_SPAWN_CONCURRENCY, async (spec) => {
 					try {
@@ -16809,24 +16898,42 @@ function createBrokerDeviceManagerApi(opts) {
 						});
 					}
 				});
-				if ((device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0) === 0 && specs.length === 0) {
-					opts.logger.debug("Accessory orphan reconciliation skipped — probe not yet completed", { tags: {
-						parentDeviceId: device.id,
-						parentStableId: device.stableId
-					} });
+				if (read.kind === "unknown") {
+					opts.logger.info("Accessory orphan reconciliation skipped — child list unknown", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							reason: read.reason,
+							probedAt
+						}
+					});
 					return;
 				}
 				try {
-					const currentChildren = await childrenLoader.load(device.id);
-					for (const child of currentChildren) {
-						if (child.linkDeviceId !== device.id) continue;
-						if (expected.has(child.stableId)) continue;
+					const missing = (await childrenLoader.load(device.id)).filter((child) => child.linkDeviceId === device.id && !expected.has(child.stableId));
+					const decision = shrinkGate.decide(missing.map((child) => child.id), probedAt);
+					if (decision.deferred.length > 0) opts.logger.info("Accessory children missing from a complete read — kept until a later probe agrees", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							childDeviceIds: [...decision.deferred],
+							probedAt
+						}
+					});
+					const confirmed = new Set(decision.prune);
+					for (const child of missing) {
+						if (!confirmed.has(child.id)) continue;
 						const live = registry.getById(child.id);
 						try {
 							if (live) await deviceApi.remove(child.id);
 							else await callDeviceManager(api, "removeDevice", { deviceId: child.id });
 							opts.logger.info("Removed orphan accessory child no longer in parent specs", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId
 								},
@@ -16839,6 +16946,7 @@ function createBrokerDeviceManagerApi(opts) {
 						} catch (err) {
 							opts.logger.warn("Failed to remove orphan accessory child", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId,
 									childDeviceId: child.id
@@ -21298,7 +21406,7 @@ var LEVEL_ORDER = {
 	warn: 2,
 	error: 3
 };
-function levelRank(level) {
+function levelRank$1(level) {
 	return LEVEL_ORDER[level] ?? 0;
 }
 function createUdsLoggerWithState(client, addonId, nodeId, levelState, scope, tags = {}) {
@@ -21310,7 +21418,7 @@ function createUdsLoggerWithState(client, addonId, nodeId, levelState, scope, ta
 		...tags
 	};
 	function log(level, message, extras) {
-		if (levelRank(level) < levelRank(levelState.current)) return;
+		if (levelRank$1(level) < levelRank$1(levelState.current)) return;
 		const mergedTags = extras?.tags ? {
 			...baseTags,
 			...extras.tags
@@ -27006,6 +27114,10 @@ var en_default = {
 	"device.credentials-unavailable": "Device credentials not available",
 	"device.credential-not-found": "Device credential not found: {id}",
 	"storage.no-provider": "No storage provider configured",
+	"preferences.forbidden": "This credential cannot reach account preferences",
+	"preferences.unavailable": "Account preferences are not available",
+	"preferences.value-too-large": "This preference value is too large",
+	"preferences.too-many-namespaces": "Too many preference namespaces for this account",
 	"recording.export-unknown": "Unknown export \"{id}\"",
 	"recording.export-invalid-range": "Invalid time range {fromMs}..{toMs}",
 	"recording.export-no-profiles": "The export needs at least one stream profile",
@@ -27253,6 +27365,10 @@ var it_default = {
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",
 	"device.credential-not-found": "Credenziale del dispositivo non trovata: {id}",
 	"storage.no-provider": "Nessun provider di archiviazione configurato",
+	"preferences.forbidden": "Questa credenziale non può accedere alle preferenze dell’account",
+	"preferences.unavailable": "Le preferenze dell’account non sono disponibili",
+	"preferences.value-too-large": "Il valore di questa preferenza è troppo grande",
+	"preferences.too-many-namespaces": "Troppi gruppi di preferenze per questo account",
 	"recording.export-unknown": "Esportazione \"{id}\" sconosciuta",
 	"recording.export-invalid-range": "Intervallo di tempo non valido {fromMs}..{toMs}",
 	"recording.export-no-profiles": "L'esportazione richiede almeno un profilo di flusso",
@@ -27570,4 +27686,4 @@ function resetCatalogRegistryForTests() {
 }
 //#endregion
 var readAllRows = import_read_all_rows.readAllRows;
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_NODE_HISTORY_COLLECTION, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRefusedError, AddonRouteRegistry, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_NODE_HISTORY_COLLECTION, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ClusterNodeHistoryBodySchema, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceHistoryAddon, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, INTEGRATIONS_LEGACY, INTEGRATION_SETTINGS_LEGACY, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PERMITTED_DNS_SUFFIXES, PERMITTED_IP_RANGES, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORAGE_DRAIN_STATE_LEGACY, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UNMIGRATED_SETTINGS_CODE, UNMIGRATED_SETTINGS_REMEDY, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UnmigratedSettingsError, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, asBrokerLike, assertLegacyBlobsMigrated, attachUserManagementInternal, attributeStall, backupOrchestratorRecordKinds, backupRecordStoresOf, bareAddonOf, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNameConstraintSet, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, caReplacementMarkerFile, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, chainsToPublicRoot, checkUploadedCa, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterAgentRecordKinds, clusterEventTopic, clusterNodeHistoryRecordKind, collectAgentNames, collectCertIdentity, collectModelFiles, compileLogFilter, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, filterIsEmpty, findAddonRefusal, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, integrationRegistryRecordKinds, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isConstrainedCa, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, levelRank, lineContainsText, lineMatches, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localCaCommonName, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, originNodeOf, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, permitsIdentity, permitsName, pinnedHttpsCaFingerprint, preferencesLimitReasonOf, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readAllRows, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readNameConstraints, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, replaceUnconstrainedLocalCa, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, retirePreviousLocalCa, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storageOrchestratorRecordKinds, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, useStoredUploadedCertificate, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/config-schema.d.ts

@@ -117,6 +117,11 @@ export type AppConfig = BootstrapConfig & {
 		* means "evict anything", which defeats the point.
 		*/
 		logBufferPruneLevel?: "debug" | "info" | "warn" | "error";
+		/**
+		* Entries the hub keeps in memory once `winston-logging` holds the history
+		* (D898). Default 2000; the files serve everything older.
+		*/
+		logTailSize?: number;
 	};
 	retention: {
 		detectionEventsDays: number;

package/dist/kernel/moleculer/accessory-prune-gate.d.ts

@@ -0,0 +1,55 @@
+/**
+* When may the kernel DELETE a parent's accessory children? (D49, 2026-10-21)
+*
+* Deleting an accessory is destructive: its id, bindings and history go with
+* it, and a re-spawn gets a NEW id. Dreame without credentials answered
+* `getAccessoryChildren()` with only the core child and the kernel pruned 97
+* accessories. The contract:
+*
+* 1. A prune is only ever the result of a SUCCESSFUL read — the provider
+*    positively says "connected, and this is the complete list". Missing
+*    credentials, a disconnected parent, a failed or partial read, a boot
+*    before the first successful connect: all UNKNOWN, and unknown prunes
+*    nothing (nor does it confirm or cancel an earlier shrink).
+*    - `{ kind: 'complete', children }` is a successful read.
+*    - `{ kind: 'unknown', reason, known? }` is unknown; `known` children are
+*      still spawned (spawning is idempotent and destroys nothing).
+*    - a bare array (the legacy answer) is successful only while the parent
+*      reports itself `online` AND its feature probe has completed.
+* 2. A SHRINK needs a second agreeing successful read on a LATER probe
+*    (`feature-probe.lastProbedAt` advanced). The first read that lacks a
+*    child only records it; the child is pruned when a successful read of a
+*    later probe still lacks it. A successful read that lists it again
+*    forgets the record.
+*/
+import type { AccessoryChildrenAnswer, AccessoryChildSpec } from "@camstack/types";
+export type AccessoryReadVerdict = {
+	readonly kind: "successful";
+	readonly children: readonly AccessoryChildSpec[];
+} | {
+	readonly kind: "unknown";
+	readonly reason: string;
+	/** What may still be SPAWNED (spawning is idempotent and never destroys). */
+	readonly children: readonly AccessoryChildSpec[];
+};
+export interface AccessoryReadContext {
+	readonly online: boolean;
+	/** `feature-probe.lastProbedAt`; 0 = the probe never completed. */
+	readonly probedAt: number;
+}
+export declare function classifyAccessoryRead(answer: AccessoryChildrenAnswer, ctx: AccessoryReadContext): AccessoryReadVerdict;
+export interface ShrinkDecision {
+	/** Confirmed by a successful read of a later probe: delete these. */
+	readonly prune: readonly number[];
+	/** Missing for the first time (or again on the same probe): kept, recorded. */
+	readonly deferred: readonly number[];
+}
+/** One per parent registration; in-memory on purpose (a restart starts over — the safe direction). */
+export declare class AccessoryShrinkGate {
+	#private;
+	/**
+	* `missing` = the managed children a SUCCESSFUL read no longer lists. Never
+	* call this for an unknown read.
+	*/
+	decide(missing: readonly number[], probedAt: number): ShrinkDecision;
+}