@camstack/system 1.2.55 → 1.2.56

package/dist/builtins/doorbell/binding-mirror.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The virtual-doorbell wrapper's in-memory mirror of ONE durable fact per
+ * camera: is this wrapper still the active `doorbell` binding for it?
+ *
+ * WHY A MIRROR AND NOT A READ. A doorbell press is a one-shot event: there
+ * is no retry, no reconcile, nothing downstream that can notice it went
+ * missing. The wrapper used to re-derive the binding on the ring path via
+ * `deviceManager.getBindings` and treat ANY answer that omitted its own
+ * activation as "the operator unbound this". On 2026-08-04/05 camera 615
+ * rang zero times out of three real presses: the binding was persisted (a
+ * same-day backup taken before the presses proves it, and the same process
+ * later returned it correctly to a tRPC query), but the store answered
+ * transiently without it — `getBindings` reads the device-manager addon
+ * store, which is exactly the surface that can silently answer `{}` (D44,
+ * `addon-registry.service.ts`). Three presses, three drops, at `debug`.
+ *
+ * WHY CORROBORATION AND NOT A BETTER DISCRIMINATOR. There isn't one. A
+ * genuinely unbound pure-wrapper cap and a store answering from an empty
+ * snapshot produce the SAME `getBindings` response — no `doorbell` entry,
+ * with the camera's native entries (snapshot, motion, …) still present in
+ * both cases because those come from the capability registry, not the
+ * store. The response cannot be graded. What CAN be graded is repetition: a
+ * real unbind is permanent and every later read agrees, a store blip does
+ * not survive the next read. So a negative read ARMS the revocation and a
+ * second consecutive negative applies it.
+ *
+ * ERRING. `undefined` (never read) and `unbind-pending` both ring. Reaching
+ * the ring path at all means the camera has a configured trigger source,
+ * and a source can only be configured through this wrapper's own
+ * binding-gated settings surface — so a configured source is itself
+ * evidence the wrapper was bound. The cost of erring open is a spurious
+ * ring on a camera the operator unbound but left configured, for at most
+ * two reload cycles. The cost of erring closed is the press.
+ */
+/**
+ * `bound` — a read saw the wrapper's activation.
+ * `unbind-pending` — one read did not; NOT yet believed, still rings.
+ * `unbound` — two consecutive reads did not; believed, silences the camera.
+ */
+export type DoorbellBindingState = 'bound' | 'unbind-pending' | 'unbound';
+/**
+ * Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
+ * never reach this function — an unanswerable store carries no information
+ * and must leave the mirror exactly as it was.
+ */
+export declare function nextBindingState(previous: DoorbellBindingState | undefined, boundNow: boolean): DoorbellBindingState;
+/** May a ring proceed? Only a corroborated unbind stops one. */
+export declare function allowsRing(state: DoorbellBindingState | undefined): boolean;
+/** True only when a read has positively confirmed the binding. */
+export declare function hasConfirmedBinding(state: DoorbellBindingState | undefined): boolean;

package/dist/builtins/doorbell/trigger-engine.d.ts

@@ -19,6 +19,19 @@
  * reconnect is not a doorbell press.
  */
 export declare const SOURCE_CAP_ACTIVE_FIELD: Readonly<Record<string, string>>;
+/**
+ * The same caps → the slice field carrying the ms-epoch timestamp of the
+ * last transition. Every source cap MUST appear here (guarded by a spec):
+ * without a transition timestamp the engine cannot tell a genuine press
+ * from a boot-time hydration when the FIRST slice it ever sees is already
+ * active, and errs towards silence — swallowing the press.
+ *
+ * These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+ * provider derives them from `state.last_changed`, so they survive our own
+ * restarts and correctly read as "hours ago" for a state that has been
+ * active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+ */
+export declare const SOURCE_CAP_CHANGED_AT_FIELD: Readonly<Record<string, string>>;
 /** Cap names whose presence in a device's bindings qualify it as a source. */
 export declare const SOURCE_CAPS: readonly string[];
 /**
@@ -41,6 +54,45 @@ export declare const SOURCE_CAPS: readonly string[];
 export declare const SOURCE_DEVICE_TYPES: readonly string[];
 /** True when a cap is a recognised binary/switch doorbell source. */
 export declare function isSourceCap(capName: string): boolean;
+/**
+ * Why a slice produced no ring. Every value names a DROPPED evaluation, so
+ * the addon can log the ones that may have cost a real press instead of
+ * returning an empty array that reads as "nothing happened".
+ */
+export type DoorbellIgnoreReason = 
+/** Not a recognised binary/switch source cap. */
+'unknown-cap'
+/** Recognised cap, but its active field is missing or not a boolean. */
+ | 'non-boolean-value'
+/** First sighting, INACTIVE — nothing can have been lost. */
+ | 'baseline-seeded-inactive'
+/** First sighting, ALREADY ACTIVE, and we could not prove it is a fresh
+ *  transition. A genuine press MAY have been swallowed here. */
+ | 'baseline-seeded-stale-active'
+/** Re-emission carrying the same binary value. */
+ | 'no-change'
+/** The falling edge — switch-off / contact-close never rings. */
+ | 'falling-edge'
+/** A real rise, but no camera is wired to this source. */
+ | 'no-assignment';
+/**
+ * The outcome of feeding one slice. `fired` is what rings; `debounced` and
+ * `ignored` exist so that no suppression is invisible.
+ */
+export interface DoorbellTriggerResult {
+    /** Cameras to ring now. */
+    readonly fired: readonly number[];
+    /** Cameras that WOULD have rung but are inside their debounce window. */
+    readonly debounced: readonly number[];
+    /** Set when the slice carried no ring at all; null once a rise was matched. */
+    readonly ignored: DoorbellIgnoreReason | null;
+}
+/**
+ * How recent a source's own transition timestamp must be for a FIRST
+ * sighting that is already active to count as a genuine press rather than a
+ * hydration of long-standing state.
+ */
+export declare const DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 30000;
 /**
  * One camera's virtual-doorbell wiring: a source device that rings it. A
  * camera with several sources produces several assignments (one per source).
@@ -57,9 +109,25 @@ export declare const DEFAULT_DEBOUNCE_MS = 2000;
  *
  * Tracks the last observed binary value per (sourceDevice, cap) so a
  * `DeviceStateChanged` re-emission (the slice's `lastChangedAt` moves while
- * the binary value does not) never double-fires, and the FIRST observation
- * after boot only seeds the baseline — a state hydration at startup must not
- * ring anybody's doorbell.
+ * the binary value does not) never double-fires.
+ *
+ * FIRST SIGHTINGS. Seeding the baseline and never firing was wrong for the
+ * one case that matters: a momentary source (a button wired to a Home
+ * Assistant switch) is NOT re-pushed in its resting `off` state after a hub
+ * restart, so after every restart — several a day — the first slice the
+ * engine ever sees for it is the PRESS ITSELF, already active. That press
+ * was eaten whole; a real one on 2026-08-05 left no trace anywhere.
+ *
+ * The discriminator is the source's own transition timestamp. A first
+ * sighting that is already active rings only when its transition can be
+ * proved to have happened AFTER this engine started watching AND within
+ * `firstSightingFreshnessMs`. Both halves earn their keep: freshness alone
+ * would ring on a boot hydration of a state that flipped seconds before the
+ * restart, and "after we started" alone would ring, on a long-lived
+ * process, for a source adopted today whose state flipped yesterday. An
+ * undateable first sighting (no timestamp, or a zero sentinel) does NOT
+ * ring — the ambiguous case errs towards silence, but reports
+ * `baseline-seeded-stale-active` so the caller can say so out loud.
  */
 export declare class DoorbellTriggerEngine {
     private assignments;
@@ -69,9 +137,13 @@ export declare class DoorbellTriggerEngine {
     private readonly lastFiredAt;
     private readonly debounceMs;
     private readonly now;
+    private readonly firstSightingFreshnessMs;
+    /** When this engine started watching — the floor for a first-sighting rise. */
+    private readonly startedAt;
     constructor(options?: {
         readonly debounceMs?: number;
         readonly now?: () => number;
+        readonly firstSightingFreshnessMs?: number;
     });
     /** Replace the full assignment set (rebuilt whenever settings change). */
     setAssignments(assignments: readonly DoorbellAssignment[]): void;
@@ -79,11 +151,16 @@ export declare class DoorbellTriggerEngine {
     /** True when any assignment references `deviceId` as its source. */
     hasSource(deviceId: number): boolean;
     /**
-     * Feed one `DeviceStateChanged` slice. Returns the camera ids whose
-     * doorbell should ring (already debounced). Only a false→true rise on a
-     * recognised source cap fires; baseline-only sightings, re-emissions, and
-     * the falling edge return an empty array.
+     * Feed one `DeviceStateChanged` slice. Reports which cameras should ring,
+     * which were suppressed by the debounce window, and — when nothing was
+     * matched at all — WHY. Only a rise to active on a recognised source cap
+     * can ring; re-emissions and the falling edge never do.
+     */
+    onStateSlice(deviceId: number, capName: string, slice: Record<string, unknown>): DoorbellTriggerResult;
+    /**
+     * Can this slice PROVE its active state is a transition we would have
+     * witnessed had we been listening — i.e. recent, and after we started?
      */
-    onStateSlice(deviceId: number, capName: string, slice: Record<string, unknown>): number[];
+    private roseAfterWeStartedWatching;
     private matchAndDebounce;
 }

package/dist/builtins/doorbell/virtual-doorbell.addon.d.ts

@@ -2,6 +2,13 @@ import { ProviderRegistration, BaseAddon } from '@camstack/types';
 interface VirtualDoorbellAddonConfig {
     /** Per-camera debounce window (ms) against sensor chatter. */
     readonly debounceMs: number;
+    /**
+     * Reload the camera→source assignment map (and the binding mirror) at
+     * most this often — lazily, on trigger traffic. Covers devices/settings
+     * appearing after boot without a settings save, and is the cadence on
+     * which an unbind gets corroborated.
+     */
+    readonly assignmentsTtlMs: number;
 }
 /**
  * VirtualDoorbellAddon — WRAPPER over the `doorbell` capability.
@@ -27,28 +34,63 @@ interface VirtualDoorbellAddonConfig {
  *      bumps the camera's `doorbell` runtime-state counters via the
  *      standard `deviceState.setCapSlice` plumbing.
  *
- * Fires ONLY for cameras where the wrapper is BOUND (checked against
- * `deviceManager.getBindings`) and at least one source device is configured.
+ * Fires ONLY for cameras with at least one configured source device that
+ * this wrapper is BOUND to. The binding is NOT re-derived on the ring path:
+ * it is mirrored in memory (`binding-mirror.ts`) and refreshed on the
+ * assignment-reload cadence, because a fallible read must never be able to
+ * destroy a one-shot press.
  */
 export declare class VirtualDoorbellAddon extends BaseAddon<VirtualDoorbellAddonConfig> {
-    private readonly engine;
+    private engine;
     /** Monotonic guard: assignments are reloaded lazily on trigger traffic. */
     private assignmentsLoadedAt;
     private assignmentsLoading;
+    /**
+     * Per-camera mirror of "is this wrapper still the active doorbell
+     * binding". Written ONLY off the ring path; read on it. See
+     * `binding-mirror.ts` for why a single negative read is not believed.
+     */
+    private readonly bindingMirror;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
     private handleStateChanged;
     /**
-     * Ring the camera's virtual doorbell: verify the wrapper is BOUND to
-     * the camera, bump the `doorbell` runtime-state counters through the
-     * canonical `deviceState.setCapSlice` write, and emit the typed
-     * `DoorbellOnPressed` event with the CAMERA as source — byte-shaped
-     * like a native firmware ring so every downstream consumer (UI
-     * toast, notifier rules, exporters) is agnostic to the origin.
+     * Say out loud every case where a rise did NOT become a ring. Silence
+     * reads as "never happened": three real presses on camera 615 produced
+     * zero operator-visible lines because the drop logged at `debug`.
+     */
+    private logSuppressions;
+    /**
+     * Ring the camera's virtual doorbell: bump the `doorbell` runtime-state
+     * counters through the canonical `deviceState.setCapSlice` write, and
+     * emit the typed `DoorbellOnPressed` event with the CAMERA as source —
+     * byte-shaped like a native firmware ring so every downstream consumer
+     * (UI toast, notifier rules, exporters) is agnostic to the origin.
+     *
+     * The binding gate here is a pure in-memory read. It performs NO I/O and
+     * cannot fail: the whole point of the mirror is that the ring path can no
+     * longer be talked out of ringing by a store that answered badly.
      */
     private fireDoorbell;
-    /** True when THIS wrapper is the active `doorbell` binding for the camera. */
-    private isWrapperBound;
+    /**
+     * Fold one bindings read for `cameraId` into the mirror. Runs on the
+     * assignment-reload cadence, never while firing.
+     *
+     * A read that THROWS carries no information and leaves the mirror exactly
+     * as it was — the previous verdict keeps standing. A read that succeeds
+     * but omits our activation only ARMS a revocation; `nextBindingState`
+     * requires a second consecutive negative before the camera goes silent,
+     * because a genuine unbind and a store answering from an empty snapshot
+     * (D44) are indistinguishable in a single response.
+     */
+    private refreshBindingMirror;
+    /**
+     * Record a binding we observed FIRST-HAND. Both callers are cap methods
+     * the router only reaches by resolving this wrapper for this device —
+     * which it can only do through the binding — so a call is direct evidence
+     * and outranks anything the store says.
+     */
+    private confirmBindingFromCapCall;
     /**
      * Lazily (re)build the camera→source assignment set from every
      * camera's device store. TTL-bounded so devices/settings appearing

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -37,6 +37,30 @@ var SOURCE_CAP_ACTIVE_FIELD = {
 	vibration: "detected",
 	tamper: "tampered"
 };
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the engine cannot tell a genuine press
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the press.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
 /** Cap names whose presence in a device's bindings qualify it as a source. */
 var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
 /**
@@ -73,14 +97,46 @@ function sliceActiveValue(capName, slice) {
 	const raw = slice[field];
 	return typeof raw === "boolean" ? raw : null;
 }
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+function ignoredResult(reason) {
+	return {
+		fired: [],
+		debounced: [],
+		ignored: reason
+	};
+}
 /**
 * Stateful (but side-effect-free towards the outside) trigger engine.
 *
 * Tracks the last observed binary value per (sourceDevice, cap) so a
 * `DeviceStateChanged` re-emission (the slice's `lastChangedAt` moves while
-* the binary value does not) never double-fires, and the FIRST observation
-* after boot only seeds the baseline — a state hydration at startup must not
-* ring anybody's doorbell.
+* the binary value does not) never double-fires.
+*
+* FIRST SIGHTINGS. Seeding the baseline and never firing was wrong for the
+* one case that matters: a momentary source (a button wired to a Home
+* Assistant switch) is NOT re-pushed in its resting `off` state after a hub
+* restart, so after every restart — several a day — the first slice the
+* engine ever sees for it is the PRESS ITSELF, already active. That press
+* was eaten whole; a real one on 2026-08-05 left no trace anywhere.
+*
+* The discriminator is the source's own transition timestamp. A first
+* sighting that is already active rings only when its transition can be
+* proved to have happened AFTER this engine started watching AND within
+* `firstSightingFreshnessMs`. Both halves earn their keep: freshness alone
+* would ring on a boot hydration of a state that flipped seconds before the
+* restart, and "after we started" alone would ring, on a long-lived
+* process, for a source adopted today whose state flipped yesterday. An
+* undateable first sighting (no timestamp, or a zero sentinel) does NOT
+* ring — the ambiguous case errs towards silence, but reports
+* `baseline-seeded-stale-active` so the caller can say so out loud.
 */
 var DoorbellTriggerEngine = class {
 	assignments = [];
@@ -90,9 +146,14 @@ var DoorbellTriggerEngine = class {
 	lastFiredAt = /* @__PURE__ */ new Map();
 	debounceMs;
 	now;
+	firstSightingFreshnessMs;
+	/** When this engine started watching — the floor for a first-sighting rise. */
+	startedAt;
 	constructor(options) {
 		this.debounceMs = options?.debounceMs ?? 2e3;
 		this.now = options?.now ?? Date.now;
+		this.firstSightingFreshnessMs = options?.firstSightingFreshnessMs ?? 3e4;
+		this.startedAt = this.now();
 	}
 	/** Replace the full assignment set (rebuilt whenever settings change). */
 	setAssignments(assignments) {
@@ -106,35 +167,77 @@ var DoorbellTriggerEngine = class {
 		return this.assignments.some((a) => a.sourceDeviceId === deviceId);
 	}
 	/**
-	* Feed one `DeviceStateChanged` slice. Returns the camera ids whose
-	* doorbell should ring (already debounced). Only a false→true rise on a
-	* recognised source cap fires; baseline-only sightings, re-emissions, and
-	* the falling edge return an empty array.
+	* Feed one `DeviceStateChanged` slice. Reports which cameras should ring,
+	* which were suppressed by the debounce window, and — when nothing was
+	* matched at all — WHY. Only a rise to active on a recognised source cap
+	* can ring; re-emissions and the falling edge never do.
 	*/
 	onStateSlice(deviceId, capName, slice) {
 		const value = sliceActiveValue(capName, slice);
-		if (value === null) return [];
+		if (value === null) return ignoredResult(isSourceCap(capName) ? "non-boolean-value" : "unknown-cap");
 		const key = `${deviceId}:${capName}`;
 		const prior = this.lastValues.get(key);
 		this.lastValues.set(key, value);
-		if (prior === void 0 || prior === value) return [];
-		if (!value) return [];
-		return this.matchAndDebounce((a) => a.sourceDeviceId === deviceId);
+		if (prior === void 0) {
+			if (!value) return ignoredResult("baseline-seeded-inactive");
+			if (!this.roseAfterWeStartedWatching(capName, slice)) return ignoredResult("baseline-seeded-stale-active");
+			return this.matchAndDebounce(deviceId);
+		}
+		if (prior === value) return ignoredResult("no-change");
+		if (!value) return ignoredResult("falling-edge");
+		return this.matchAndDebounce(deviceId);
 	}
-	matchAndDebounce(predicate) {
+	/**
+	* Can this slice PROVE its active state is a transition we would have
+	* witnessed had we been listening — i.e. recent, and after we started?
+	*/
+	roseAfterWeStartedWatching(capName, slice) {
+		const changedAt = sliceChangedAt(capName, slice);
+		if (changedAt === null) return false;
+		return changedAt >= Math.max(this.startedAt, this.now() - this.firstSightingFreshnessMs);
+	}
+	matchAndDebounce(sourceDeviceId) {
 		const now = this.now();
 		const fired = [];
+		const debounced = [];
 		for (const assignment of this.assignments) {
-			if (!predicate(assignment)) continue;
+			if (assignment.sourceDeviceId !== sourceDeviceId) continue;
 			const last = this.lastFiredAt.get(assignment.cameraId);
-			if (last !== void 0 && now - last < this.debounceMs) continue;
+			if (last !== void 0 && now - last < this.debounceMs) {
+				debounced.push(assignment.cameraId);
+				continue;
+			}
 			this.lastFiredAt.set(assignment.cameraId, now);
 			fired.push(assignment.cameraId);
 		}
-		return fired;
+		if (fired.length === 0 && debounced.length === 0) return ignoredResult("no-assignment");
+		return {
+			fired,
+			debounced,
+			ignored: null
+		};
 	}
 };
 //#endregion
+//#region src/builtins/doorbell/binding-mirror.ts
+/**
+* Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
+* never reach this function — an unanswerable store carries no information
+* and must leave the mirror exactly as it was.
+*/
+function nextBindingState(previous, boundNow) {
+	if (boundNow) return "bound";
+	return previous === "unbind-pending" || previous === "unbound" ? "unbound" : "unbind-pending";
+}
+/** May a ring proceed? Only a corroborated unbind stops one. */
+function allowsRing(state) {
+	return state !== "unbound";
+}
+/** True only when a read has positively confirmed the binding. */
+function hasConfirmedBinding(state) {
+	return state === "bound";
+}
+//#endregion
 //#region src/builtins/doorbell/doorbell-settings.ts
 /**
 * Pure per-camera settings parsing/normalization for the virtual-doorbell
@@ -227,10 +330,6 @@ function applyDoorbellSourcesPatch(current, patchValue) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
-/** Reload the camera→source assignment map at most this often (lazily,
-*  on trigger traffic). Covers devices/settings appearing after boot
-*  without a settings save. */
-var ASSIGNMENTS_TTL_MS = 6e4;
 /** Structural narrowing helper for untrusted bus payloads. */
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -286,19 +385,32 @@ function parseDoorbellSlice(slice) {
 *      bumps the camera's `doorbell` runtime-state counters via the
 *      standard `deviceState.setCapSlice` plumbing.
 *
-* Fires ONLY for cameras where the wrapper is BOUND (checked against
-* `deviceManager.getBindings`) and at least one source device is configured.
+* Fires ONLY for cameras with at least one configured source device that
+* this wrapper is BOUND to. The binding is NOT re-derived on the ring path:
+* it is mirrored in memory (`binding-mirror.ts`) and refreshed on the
+* assignment-reload cadence, because a fallible read must never be able to
+* destroy a one-shot press.
 */
 var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	engine;
 	/** Monotonic guard: assignments are reloaded lazily on trigger traffic. */
 	assignmentsLoadedAt = 0;
 	assignmentsLoading = null;
+	/**
+	* Per-camera mirror of "is this wrapper still the active doorbell
+	* binding". Written ONLY off the ring path; read on it. See
+	* `binding-mirror.ts` for why a single negative read is not believed.
+	*/
+	bindingMirror = /* @__PURE__ */ new Map();
 	constructor() {
-		super({ debounceMs: 2e3 });
+		super({
+			debounceMs: 2e3,
+			assignmentsTtlMs: 6e4
+		});
 		this.engine = new DoorbellTriggerEngine({ debounceMs: 2e3 });
 	}
 	async onInitialize() {
+		this.engine = new DoorbellTriggerEngine({ debounceMs: this.config.debounceMs });
 		this.ctx.logger.info("Virtual doorbell wrapper initialized");
 		this.subscribe({ category: require_dist.EventCategory.DeviceStateChanged }, (event) => {
 			const data = parseDeviceStateChanged(event.data);
@@ -318,22 +430,62 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	async handleStateChanged(data) {
 		if (!isSourceCap(data.capName)) return;
 		await this.ensureAssignments();
-		const cameraIds = this.engine.onStateSlice(data.deviceId, data.capName, data.slice);
-		for (const cameraId of cameraIds) await this.fireDoorbell(cameraId, Date.now());
+		const result = this.engine.onStateSlice(data.deviceId, data.capName, data.slice);
+		this.logSuppressions(data, result);
+		for (const cameraId of result.fired) await this.fireDoorbell(cameraId, Date.now());
+	}
+	/**
+	* Say out loud every case where a rise did NOT become a ring. Silence
+	* reads as "never happened": three real presses on camera 615 produced
+	* zero operator-visible lines because the drop logged at `debug`.
+	*/
+	logSuppressions(data, result) {
+		for (const cameraId of result.debounced) this.ctx.logger.info("virtual-doorbell: rise suppressed by the debounce window", {
+			tags: { deviceId: cameraId },
+			meta: {
+				sourceDeviceId: data.deviceId,
+				capName: data.capName
+			}
+		});
+		if (result.ignored === "baseline-seeded-stale-active") {
+			const message = "virtual-doorbell: first slice seen for this source is already ACTIVE but its transition could not be dated — seeded as baseline, a press may have been swallowed";
+			const options = {
+				tags: { deviceId: data.deviceId },
+				meta: { capName: data.capName }
+			};
+			if (this.engine.hasSource(data.deviceId)) this.ctx.logger.warn(message, options);
+			else this.ctx.logger.debug(message, options);
+			return;
+		}
+		if (result.ignored === "no-assignment") this.ctx.logger.debug("virtual-doorbell: rise on a source no camera is wired to", {
+			tags: { deviceId: data.deviceId },
+			meta: { capName: data.capName }
+		});
 	}
 	/**
-	* Ring the camera's virtual doorbell: verify the wrapper is BOUND to
-	* the camera, bump the `doorbell` runtime-state counters through the
-	* canonical `deviceState.setCapSlice` write, and emit the typed
-	* `DoorbellOnPressed` event with the CAMERA as source — byte-shaped
-	* like a native firmware ring so every downstream consumer (UI
-	* toast, notifier rules, exporters) is agnostic to the origin.
+	* Ring the camera's virtual doorbell: bump the `doorbell` runtime-state
+	* counters through the canonical `deviceState.setCapSlice` write, and
+	* emit the typed `DoorbellOnPressed` event with the CAMERA as source —
+	* byte-shaped like a native firmware ring so every downstream consumer
+	* (UI toast, notifier rules, exporters) is agnostic to the origin.
+	*
+	* The binding gate here is a pure in-memory read. It performs NO I/O and
+	* cannot fail: the whole point of the mirror is that the ring path can no
+	* longer be talked out of ringing by a store that answered badly.
 	*/
 	async fireDoorbell(cameraId, timestamp) {
-		if (!await this.isWrapperBound(cameraId)) {
-			this.ctx.logger.debug("virtual-doorbell: trigger matched but wrapper not bound — skipping", { tags: { deviceId: cameraId } });
+		const binding = this.bindingMirror.get(cameraId);
+		if (!allowsRing(binding)) {
+			this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+				tags: { deviceId: cameraId },
+				meta: { bindingState: binding }
+			});
 			return;
 		}
+		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
+			tags: { deviceId: cameraId },
+			meta: { bindingState: binding ?? "never-read" }
+		});
 		try {
 			const next = {
 				lastPressedAt: timestamp,
@@ -367,17 +519,51 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 			meta: { timestamp }
 		});
 	}
-	/** True when THIS wrapper is the active `doorbell` binding for the camera. */
-	async isWrapperBound(cameraId) {
+	/**
+	* Fold one bindings read for `cameraId` into the mirror. Runs on the
+	* assignment-reload cadence, never while firing.
+	*
+	* A read that THROWS carries no information and leaves the mirror exactly
+	* as it was — the previous verdict keeps standing. A read that succeeds
+	* but omits our activation only ARMS a revocation; `nextBindingState`
+	* requires a second consecutive negative before the camera goes silent,
+	* because a genuine unbind and a store answering from an empty snapshot
+	* (D44) are indistinguishable in a single response.
+	*/
+	async refreshBindingMirror(cameraId) {
+		let entries;
 		try {
-			return (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries.some((entry) => entry.capName === require_dist.doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
+			entries = (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries;
 		} catch (err) {
-			this.ctx.logger.debug("virtual-doorbell: getBindings failed — treating as unbound", {
+			this.ctx.logger.warn("virtual-doorbell: binding check failed — keeping the last known verdict, NOT treating this as an unbind", {
 				tags: { deviceId: cameraId },
-				meta: { error: require_dist.errMsg(err) }
+				meta: {
+					error: require_dist.errMsg(err),
+					bindingState: this.bindingMirror.get(cameraId)
+				}
 			});
-			return false;
+			return;
 		}
+		const boundNow = entries.some((entry) => entry.capName === require_dist.doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
+		const previous = this.bindingMirror.get(cameraId);
+		const next = nextBindingState(previous, boundNow);
+		this.bindingMirror.set(cameraId, next);
+		if (next !== previous && next !== "bound") this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+			tags: { deviceId: cameraId },
+			meta: {
+				from: previous ?? "never-read",
+				to: next
+			}
+		});
+	}
+	/**
+	* Record a binding we observed FIRST-HAND. Both callers are cap methods
+	* the router only reaches by resolving this wrapper for this device —
+	* which it can only do through the binding — so a call is direct evidence
+	* and outranks anything the store says.
+	*/
+	confirmBindingFromCapCall(deviceId) {
+		this.bindingMirror.set(deviceId, nextBindingState(this.bindingMirror.get(deviceId), true));
 	}
 	/**
 	* Lazily (re)build the camera→source assignment set from every
@@ -386,7 +572,8 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* eagerly by `applyDeviceSettingsPatch`.
 	*/
 	async ensureAssignments() {
-		if (Date.now() - this.assignmentsLoadedAt < ASSIGNMENTS_TTL_MS) return;
+		const now = Date.now();
+		if (this.assignmentsLoadedAt > 0 && now - this.assignmentsLoadedAt < this.config.assignmentsTtlMs) return;
 		if (this.assignmentsLoading) return this.assignmentsLoading;
 		this.assignmentsLoading = this.loadAssignments().then(() => {
 			this.assignmentsLoadedAt = Date.now();
@@ -398,17 +585,29 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		return this.assignmentsLoading;
 	}
 	async loadAssignments() {
+		if (!this.ctx.settings) {
+			this.ctx.logger.warn("virtual-doorbell: no settings store — every camera reads ZERO trigger sources, no doorbell can ring");
+			return;
+		}
 		const cameras = (await this.ctx.api.deviceManager.listAll.query({})).filter((d) => d.type === require_dist.DeviceType.Camera);
 		const assignments = [];
+		const configuredCameras = [];
 		for (const camera of cameras) {
 			const sources = await this.readDeviceSources(camera.id);
+			if (sources.length > 0) configuredCameras.push(camera.id);
 			for (const source of sources) assignments.push({
 				cameraId: camera.id,
 				sourceDeviceId: source.deviceId
 			});
 		}
+		for (const cameraId of configuredCameras) await this.refreshBindingMirror(cameraId);
+		const hadAssignments = this.engine.getAssignments().length > 0;
 		this.engine.setAssignments(assignments);
-		this.ctx.logger.debug("virtual-doorbell: assignments loaded", { meta: { count: assignments.length } });
+		if (hadAssignments && assignments.length === 0) this.ctx.logger.warn("virtual-doorbell: assignment reload went from configured to EMPTY — every camera just lost its trigger sources");
+		this.ctx.logger.debug("virtual-doorbell: assignments loaded", { meta: {
+			count: assignments.length,
+			configuredCameras: configuredCameras.length
+		} });
 	}
 	invalidateAssignments() {
 		this.assignmentsLoadedAt = 0;
@@ -425,7 +624,7 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 				capName: require_dist.doorbellCapability.name
 			}));
 		} catch (err) {
-			this.ctx.logger.debug("virtual-doorbell: getCapSlice failed during getStatus", {
+			this.ctx.logger.warn("virtual-doorbell: getCapSlice failed during getStatus", {
 				tags: { deviceId },
 				meta: { error: require_dist.errMsg(err) }
 			});
@@ -477,6 +676,7 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	async buildDeviceSettingsContribution(deviceId) {
 		const device = await this.lookupDevice(deviceId);
 		if (device && device.type !== require_dist.DeviceType.Camera) return null;
+		this.confirmBindingFromCapCall(deviceId);
 		const sources = await this.readDeviceSources(deviceId);
 		return { sections: [{
 			id: "virtual-doorbell",
@@ -499,6 +699,7 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	}
 	async saveDeviceSettingsPatch(deviceId, patch) {
 		if (!this.ctx.settings) throw new Error("[virtual-doorbell] settings store unavailable — cannot persist per-device settings");
+		this.confirmBindingFromCapCall(deviceId);
 		if ("doorbellSources" in patch) {
 			const next = applyDoorbellSourcesPatch(await this.ctx.settings.readDeviceStore(deviceId), patch[KEY_SOURCES]);
 			await this.ctx.settings.writeDeviceStore(deviceId, next);

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -32,6 +32,30 @@ var SOURCE_CAP_ACTIVE_FIELD = {
 	vibration: "detected",
 	tamper: "tampered"
 };
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the engine cannot tell a genuine press
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the press.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
 /** Cap names whose presence in a device's bindings qualify it as a source. */
 var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
 /**
@@ -68,14 +92,46 @@ function sliceActiveValue(capName, slice) {
 	const raw = slice[field];
 	return typeof raw === "boolean" ? raw : null;
 }
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+function ignoredResult(reason) {
+	return {
+		fired: [],
+		debounced: [],
+		ignored: reason
+	};
+}
 /**
 * Stateful (but side-effect-free towards the outside) trigger engine.
 *
 * Tracks the last observed binary value per (sourceDevice, cap) so a
 * `DeviceStateChanged` re-emission (the slice's `lastChangedAt` moves while
-* the binary value does not) never double-fires, and the FIRST observation
-* after boot only seeds the baseline — a state hydration at startup must not
-* ring anybody's doorbell.
+* the binary value does not) never double-fires.
+*
+* FIRST SIGHTINGS. Seeding the baseline and never firing was wrong for the
+* one case that matters: a momentary source (a button wired to a Home
+* Assistant switch) is NOT re-pushed in its resting `off` state after a hub
+* restart, so after every restart — several a day — the first slice the
+* engine ever sees for it is the PRESS ITSELF, already active. That press
+* was eaten whole; a real one on 2026-08-05 left no trace anywhere.
+*
+* The discriminator is the source's own transition timestamp. A first
+* sighting that is already active rings only when its transition can be
+* proved to have happened AFTER this engine started watching AND within
+* `firstSightingFreshnessMs`. Both halves earn their keep: freshness alone
+* would ring on a boot hydration of a state that flipped seconds before the
+* restart, and "after we started" alone would ring, on a long-lived
+* process, for a source adopted today whose state flipped yesterday. An
+* undateable first sighting (no timestamp, or a zero sentinel) does NOT
+* ring — the ambiguous case errs towards silence, but reports
+* `baseline-seeded-stale-active` so the caller can say so out loud.
 */
 var DoorbellTriggerEngine = class {
 	assignments = [];
@@ -85,9 +141,14 @@ var DoorbellTriggerEngine = class {
 	lastFiredAt = /* @__PURE__ */ new Map();
 	debounceMs;
 	now;
+	firstSightingFreshnessMs;
+	/** When this engine started watching — the floor for a first-sighting rise. */
+	startedAt;
 	constructor(options) {
 		this.debounceMs = options?.debounceMs ?? 2e3;
 		this.now = options?.now ?? Date.now;
+		this.firstSightingFreshnessMs = options?.firstSightingFreshnessMs ?? 3e4;
+		this.startedAt = this.now();
 	}
 	/** Replace the full assignment set (rebuilt whenever settings change). */
 	setAssignments(assignments) {
@@ -101,35 +162,77 @@ var DoorbellTriggerEngine = class {
 		return this.assignments.some((a) => a.sourceDeviceId === deviceId);
 	}
 	/**
-	* Feed one `DeviceStateChanged` slice. Returns the camera ids whose
-	* doorbell should ring (already debounced). Only a false→true rise on a
-	* recognised source cap fires; baseline-only sightings, re-emissions, and
-	* the falling edge return an empty array.
+	* Feed one `DeviceStateChanged` slice. Reports which cameras should ring,
+	* which were suppressed by the debounce window, and — when nothing was
+	* matched at all — WHY. Only a rise to active on a recognised source cap
+	* can ring; re-emissions and the falling edge never do.
 	*/
 	onStateSlice(deviceId, capName, slice) {
 		const value = sliceActiveValue(capName, slice);
-		if (value === null) return [];
+		if (value === null) return ignoredResult(isSourceCap(capName) ? "non-boolean-value" : "unknown-cap");
 		const key = `${deviceId}:${capName}`;
 		const prior = this.lastValues.get(key);
 		this.lastValues.set(key, value);
-		if (prior === void 0 || prior === value) return [];
-		if (!value) return [];
-		return this.matchAndDebounce((a) => a.sourceDeviceId === deviceId);
+		if (prior === void 0) {
+			if (!value) return ignoredResult("baseline-seeded-inactive");
+			if (!this.roseAfterWeStartedWatching(capName, slice)) return ignoredResult("baseline-seeded-stale-active");
+			return this.matchAndDebounce(deviceId);
+		}
+		if (prior === value) return ignoredResult("no-change");
+		if (!value) return ignoredResult("falling-edge");
+		return this.matchAndDebounce(deviceId);
 	}
-	matchAndDebounce(predicate) {
+	/**
+	* Can this slice PROVE its active state is a transition we would have
+	* witnessed had we been listening — i.e. recent, and after we started?
+	*/
+	roseAfterWeStartedWatching(capName, slice) {
+		const changedAt = sliceChangedAt(capName, slice);
+		if (changedAt === null) return false;
+		return changedAt >= Math.max(this.startedAt, this.now() - this.firstSightingFreshnessMs);
+	}
+	matchAndDebounce(sourceDeviceId) {
 		const now = this.now();
 		const fired = [];
+		const debounced = [];
 		for (const assignment of this.assignments) {
-			if (!predicate(assignment)) continue;
+			if (assignment.sourceDeviceId !== sourceDeviceId) continue;
 			const last = this.lastFiredAt.get(assignment.cameraId);
-			if (last !== void 0 && now - last < this.debounceMs) continue;
+			if (last !== void 0 && now - last < this.debounceMs) {
+				debounced.push(assignment.cameraId);
+				continue;
+			}
 			this.lastFiredAt.set(assignment.cameraId, now);
 			fired.push(assignment.cameraId);
 		}
-		return fired;
+		if (fired.length === 0 && debounced.length === 0) return ignoredResult("no-assignment");
+		return {
+			fired,
+			debounced,
+			ignored: null
+		};
 	}
 };
 //#endregion
+//#region src/builtins/doorbell/binding-mirror.ts
+/**
+* Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
+* never reach this function — an unanswerable store carries no information
+* and must leave the mirror exactly as it was.
+*/
+function nextBindingState(previous, boundNow) {
+	if (boundNow) return "bound";
+	return previous === "unbind-pending" || previous === "unbound" ? "unbound" : "unbind-pending";
+}
+/** May a ring proceed? Only a corroborated unbind stops one. */
+function allowsRing(state) {
+	return state !== "unbound";
+}
+/** True only when a read has positively confirmed the binding. */
+function hasConfirmedBinding(state) {
+	return state === "bound";
+}
+//#endregion
 //#region src/builtins/doorbell/doorbell-settings.ts
 /**
 * Pure per-camera settings parsing/normalization for the virtual-doorbell
@@ -222,10 +325,6 @@ function applyDoorbellSourcesPatch(current, patchValue) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
-/** Reload the camera→source assignment map at most this often (lazily,
-*  on trigger traffic). Covers devices/settings appearing after boot
-*  without a settings save. */
-var ASSIGNMENTS_TTL_MS = 6e4;
 /** Structural narrowing helper for untrusted bus payloads. */
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -281,19 +380,32 @@ function parseDoorbellSlice(slice) {
 *      bumps the camera's `doorbell` runtime-state counters via the
 *      standard `deviceState.setCapSlice` plumbing.
 *
-* Fires ONLY for cameras where the wrapper is BOUND (checked against
-* `deviceManager.getBindings`) and at least one source device is configured.
+* Fires ONLY for cameras with at least one configured source device that
+* this wrapper is BOUND to. The binding is NOT re-derived on the ring path:
+* it is mirrored in memory (`binding-mirror.ts`) and refreshed on the
+* assignment-reload cadence, because a fallible read must never be able to
+* destroy a one-shot press.
 */
 var VirtualDoorbellAddon = class extends BaseAddon {
 	engine;
 	/** Monotonic guard: assignments are reloaded lazily on trigger traffic. */
 	assignmentsLoadedAt = 0;
 	assignmentsLoading = null;
+	/**
+	* Per-camera mirror of "is this wrapper still the active doorbell
+	* binding". Written ONLY off the ring path; read on it. See
+	* `binding-mirror.ts` for why a single negative read is not believed.
+	*/
+	bindingMirror = /* @__PURE__ */ new Map();
 	constructor() {
-		super({ debounceMs: 2e3 });
+		super({
+			debounceMs: 2e3,
+			assignmentsTtlMs: 6e4
+		});
 		this.engine = new DoorbellTriggerEngine({ debounceMs: 2e3 });
 	}
 	async onInitialize() {
+		this.engine = new DoorbellTriggerEngine({ debounceMs: this.config.debounceMs });
 		this.ctx.logger.info("Virtual doorbell wrapper initialized");
 		this.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
 			const data = parseDeviceStateChanged(event.data);
@@ -313,22 +425,62 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	async handleStateChanged(data) {
 		if (!isSourceCap(data.capName)) return;
 		await this.ensureAssignments();
-		const cameraIds = this.engine.onStateSlice(data.deviceId, data.capName, data.slice);
-		for (const cameraId of cameraIds) await this.fireDoorbell(cameraId, Date.now());
+		const result = this.engine.onStateSlice(data.deviceId, data.capName, data.slice);
+		this.logSuppressions(data, result);
+		for (const cameraId of result.fired) await this.fireDoorbell(cameraId, Date.now());
+	}
+	/**
+	* Say out loud every case where a rise did NOT become a ring. Silence
+	* reads as "never happened": three real presses on camera 615 produced
+	* zero operator-visible lines because the drop logged at `debug`.
+	*/
+	logSuppressions(data, result) {
+		for (const cameraId of result.debounced) this.ctx.logger.info("virtual-doorbell: rise suppressed by the debounce window", {
+			tags: { deviceId: cameraId },
+			meta: {
+				sourceDeviceId: data.deviceId,
+				capName: data.capName
+			}
+		});
+		if (result.ignored === "baseline-seeded-stale-active") {
+			const message = "virtual-doorbell: first slice seen for this source is already ACTIVE but its transition could not be dated — seeded as baseline, a press may have been swallowed";
+			const options = {
+				tags: { deviceId: data.deviceId },
+				meta: { capName: data.capName }
+			};
+			if (this.engine.hasSource(data.deviceId)) this.ctx.logger.warn(message, options);
+			else this.ctx.logger.debug(message, options);
+			return;
+		}
+		if (result.ignored === "no-assignment") this.ctx.logger.debug("virtual-doorbell: rise on a source no camera is wired to", {
+			tags: { deviceId: data.deviceId },
+			meta: { capName: data.capName }
+		});
 	}
 	/**
-	* Ring the camera's virtual doorbell: verify the wrapper is BOUND to
-	* the camera, bump the `doorbell` runtime-state counters through the
-	* canonical `deviceState.setCapSlice` write, and emit the typed
-	* `DoorbellOnPressed` event with the CAMERA as source — byte-shaped
-	* like a native firmware ring so every downstream consumer (UI
-	* toast, notifier rules, exporters) is agnostic to the origin.
+	* Ring the camera's virtual doorbell: bump the `doorbell` runtime-state
+	* counters through the canonical `deviceState.setCapSlice` write, and
+	* emit the typed `DoorbellOnPressed` event with the CAMERA as source —
+	* byte-shaped like a native firmware ring so every downstream consumer
+	* (UI toast, notifier rules, exporters) is agnostic to the origin.
+	*
+	* The binding gate here is a pure in-memory read. It performs NO I/O and
+	* cannot fail: the whole point of the mirror is that the ring path can no
+	* longer be talked out of ringing by a store that answered badly.
 	*/
 	async fireDoorbell(cameraId, timestamp) {
-		if (!await this.isWrapperBound(cameraId)) {
-			this.ctx.logger.debug("virtual-doorbell: trigger matched but wrapper not bound — skipping", { tags: { deviceId: cameraId } });
+		const binding = this.bindingMirror.get(cameraId);
+		if (!allowsRing(binding)) {
+			this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+				tags: { deviceId: cameraId },
+				meta: { bindingState: binding }
+			});
 			return;
 		}
+		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
+			tags: { deviceId: cameraId },
+			meta: { bindingState: binding ?? "never-read" }
+		});
 		try {
 			const next = {
 				lastPressedAt: timestamp,
@@ -362,17 +514,51 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 			meta: { timestamp }
 		});
 	}
-	/** True when THIS wrapper is the active `doorbell` binding for the camera. */
-	async isWrapperBound(cameraId) {
+	/**
+	* Fold one bindings read for `cameraId` into the mirror. Runs on the
+	* assignment-reload cadence, never while firing.
+	*
+	* A read that THROWS carries no information and leaves the mirror exactly
+	* as it was — the previous verdict keeps standing. A read that succeeds
+	* but omits our activation only ARMS a revocation; `nextBindingState`
+	* requires a second consecutive negative before the camera goes silent,
+	* because a genuine unbind and a store answering from an empty snapshot
+	* (D44) are indistinguishable in a single response.
+	*/
+	async refreshBindingMirror(cameraId) {
+		let entries;
 		try {
-			return (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries.some((entry) => entry.capName === doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
+			entries = (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries;
 		} catch (err) {
-			this.ctx.logger.debug("virtual-doorbell: getBindings failed — treating as unbound", {
+			this.ctx.logger.warn("virtual-doorbell: binding check failed — keeping the last known verdict, NOT treating this as an unbind", {
 				tags: { deviceId: cameraId },
-				meta: { error: errMsg(err) }
+				meta: {
+					error: errMsg(err),
+					bindingState: this.bindingMirror.get(cameraId)
+				}
 			});
-			return false;
+			return;
 		}
+		const boundNow = entries.some((entry) => entry.capName === doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
+		const previous = this.bindingMirror.get(cameraId);
+		const next = nextBindingState(previous, boundNow);
+		this.bindingMirror.set(cameraId, next);
+		if (next !== previous && next !== "bound") this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+			tags: { deviceId: cameraId },
+			meta: {
+				from: previous ?? "never-read",
+				to: next
+			}
+		});
+	}
+	/**
+	* Record a binding we observed FIRST-HAND. Both callers are cap methods
+	* the router only reaches by resolving this wrapper for this device —
+	* which it can only do through the binding — so a call is direct evidence
+	* and outranks anything the store says.
+	*/
+	confirmBindingFromCapCall(deviceId) {
+		this.bindingMirror.set(deviceId, nextBindingState(this.bindingMirror.get(deviceId), true));
 	}
 	/**
 	* Lazily (re)build the camera→source assignment set from every
@@ -381,7 +567,8 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* eagerly by `applyDeviceSettingsPatch`.
 	*/
 	async ensureAssignments() {
-		if (Date.now() - this.assignmentsLoadedAt < ASSIGNMENTS_TTL_MS) return;
+		const now = Date.now();
+		if (this.assignmentsLoadedAt > 0 && now - this.assignmentsLoadedAt < this.config.assignmentsTtlMs) return;
 		if (this.assignmentsLoading) return this.assignmentsLoading;
 		this.assignmentsLoading = this.loadAssignments().then(() => {
 			this.assignmentsLoadedAt = Date.now();
@@ -393,17 +580,29 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 		return this.assignmentsLoading;
 	}
 	async loadAssignments() {
+		if (!this.ctx.settings) {
+			this.ctx.logger.warn("virtual-doorbell: no settings store — every camera reads ZERO trigger sources, no doorbell can ring");
+			return;
+		}
 		const cameras = (await this.ctx.api.deviceManager.listAll.query({})).filter((d) => d.type === DeviceType.Camera);
 		const assignments = [];
+		const configuredCameras = [];
 		for (const camera of cameras) {
 			const sources = await this.readDeviceSources(camera.id);
+			if (sources.length > 0) configuredCameras.push(camera.id);
 			for (const source of sources) assignments.push({
 				cameraId: camera.id,
 				sourceDeviceId: source.deviceId
 			});
 		}
+		for (const cameraId of configuredCameras) await this.refreshBindingMirror(cameraId);
+		const hadAssignments = this.engine.getAssignments().length > 0;
 		this.engine.setAssignments(assignments);
-		this.ctx.logger.debug("virtual-doorbell: assignments loaded", { meta: { count: assignments.length } });
+		if (hadAssignments && assignments.length === 0) this.ctx.logger.warn("virtual-doorbell: assignment reload went from configured to EMPTY — every camera just lost its trigger sources");
+		this.ctx.logger.debug("virtual-doorbell: assignments loaded", { meta: {
+			count: assignments.length,
+			configuredCameras: configuredCameras.length
+		} });
 	}
 	invalidateAssignments() {
 		this.assignmentsLoadedAt = 0;
@@ -420,7 +619,7 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 				capName: doorbellCapability.name
 			}));
 		} catch (err) {
-			this.ctx.logger.debug("virtual-doorbell: getCapSlice failed during getStatus", {
+			this.ctx.logger.warn("virtual-doorbell: getCapSlice failed during getStatus", {
 				tags: { deviceId },
 				meta: { error: errMsg(err) }
 			});
@@ -472,6 +671,7 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	async buildDeviceSettingsContribution(deviceId) {
 		const device = await this.lookupDevice(deviceId);
 		if (device && device.type !== DeviceType.Camera) return null;
+		this.confirmBindingFromCapCall(deviceId);
 		const sources = await this.readDeviceSources(deviceId);
 		return { sections: [{
 			id: "virtual-doorbell",
@@ -494,6 +694,7 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	}
 	async saveDeviceSettingsPatch(deviceId, patch) {
 		if (!this.ctx.settings) throw new Error("[virtual-doorbell] settings store unavailable — cannot persist per-device settings");
+		this.confirmBindingFromCapCall(deviceId);
 		if ("doorbellSources" in patch) {
 			const next = applyDoorbellSourcesPatch(await this.ctx.settings.readDeviceStore(deviceId), patch[KEY_SOURCES]);
 			await this.ctx.settings.writeDeviceStore(deviceId, next);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.55",
+  "version": "1.2.56",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",