@camstack/system 1.2.57 → 1.2.59

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over
@@ -221,6 +221,65 @@ var DoorbellTriggerEngine = class {
 //#endregion
 //#region src/builtins/doorbell/binding-mirror.ts
 /**
+* The virtual-doorbell wrapper's in-memory mirror of ONE durable fact per
+* camera: is this wrapper still the active `doorbell` binding for it?
+*
+* WHY A MIRROR AND NOT A READ. A doorbell press is a one-shot event: there
+* is no retry, no reconcile, nothing downstream that can notice it went
+* missing. The wrapper used to re-derive the binding on the ring path via
+* `deviceManager.getBindings` and treat ANY answer that omitted its own
+* activation as "the operator unbound this". On 2026-08-04/05 camera 615
+* rang zero times out of three real presses: the binding was persisted (a
+* same-day backup taken before the presses proves it, and the same process
+* later returned it correctly to a tRPC query), but the store answered
+* transiently without it — `getBindings` reads the device-manager addon
+* store, which is exactly the surface that can silently answer `{}` (D44,
+* `addon-registry.service.ts`). Three presses, three drops, at `debug`.
+*
+* WHY CORROBORATION AND NOT A BETTER DISCRIMINATOR. There isn't one. A
+* genuinely unbound pure-wrapper cap and a store answering from an empty
+* snapshot produce the SAME `getBindings` response — no `doorbell` entry,
+* with the camera's native entries (snapshot, motion, …) still present in
+* both cases because those come from the capability registry, not the
+* store. The response cannot be graded. What CAN be graded is repetition: a
+* real unbind is permanent and every later read agrees, a store blip does
+* not survive the next read. So a negative read ARMS the revocation and a
+* second consecutive negative applies it.
+*
+* ERRING. `undefined` (never read) and `unbind-pending` both ring. Reaching
+* the ring path at all means the camera has a configured trigger source,
+* and a source can only be configured through this wrapper's own
+* binding-gated settings surface — so a configured source is itself
+* evidence the wrapper was bound. The cost of erring open is a spurious
+* ring on a camera the operator unbound but left configured, for at most
+* two reload cycles. The cost of erring closed is the press.
+*
+* ─────────────────────────────────────────────────────────────────────
+* 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
+* matters more than the fix. `refreshBindingMirror` matched the binding with
+* `entry.providerAddonId === this.ctx.id`. The two addon-context factories do
+* not spell `ctx.id` the same way: a forked addon gets `virtual-doorbell`, a
+* hub-main BUILTIN gets `addon:virtual-doorbell`. Every entry on the wire
+* carries the bare form. So for this builtin the comparison was false for
+* every entry, forever — not a blip. Corroboration only defends against a
+* TRANSIENT bad read; two systematically-wrong reads agree with each other,
+* and the mirror latched `unbound` with no way back except an operator
+* opening the settings page. A real press on camera 615 was dropped.
+*
+* Two things follow, and both are now load-bearing here:
+*
+*   1. The comparison goes through `isSameAddonId` ({@link entriesBindWrapper}),
+*      never a raw `===`.
+*   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
+*      input. Before a negative is believed — and again on the ring path
+*      before a press is destroyed — the DURABLE authority is consulted
+*      directly ({@link readDurableWrapperBinding} over the `device-manager`
+*      addon store's `deviceBindings` map). That read carries a discriminator
+*      the derived view genuinely cannot offer: a store answering from an
+*      empty snapshot (D44) has no `deviceBindings` key at all, while a
+*      genuine unbind leaves the key present and merely omits the row.
+*/
+/**
 * Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
 * never reach this function — an unanswerable store carries no information
 * and must leave the mirror exactly as it was.
@@ -237,6 +296,52 @@ function allowsRing(state) {
 function hasConfirmedBinding(state) {
 	return state === "bound";
 }
+/**
+* Does this list of binding entries name `ownAddonId` as the ACTIVE WRAPPER
+* of `capName`?
+*
+* `isSameAddonId` is the whole point: `ownAddonId` is an `AddonContext.id`,
+* which is prefixed (`addon:…`) in hub-main and bare in a forked runner,
+* while `providerAddonId` is always bare. A raw `===` here is the D72 bug.
+*/
+function entriesBindWrapper(entries, capName, ownAddonId) {
+	return entries.some((entry) => entry.capName === capName && entry.kind === "wrapped" && require_dist.isSameAddonId(entry.providerAddonId, ownAddonId));
+}
+/**
+* Render binding entries for a log line. A systematic wrong answer and a
+* one-off blip produce the same VERDICT; only the entries themselves tell
+* them apart, so a negative read never gets to report just its conclusion.
+*/
+function summariseEntries(entries) {
+	return entries.map((entry) => `${entry.capName}:${entry.kind}:${entry.providerAddonId}`);
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Read the DURABLE authority — the `device-manager` addon store's
+* `deviceBindings` map — for "is `ownAddonId` the active wrapper of
+* `capName` on `deviceId`".
+*
+* This is the input the derived `getBindings` view is not: it is the row the
+* operator's toggle actually writes, with no registry resolution, no
+* `defaultActive` auto-binding and no cross-node cap folding in between. It
+* also grades its own trustworthiness, which `getBindings` cannot: the
+* absence of the `deviceBindings` KEY is the signature of a store answering
+* from an empty snapshot, whereas a genuine unbind leaves the key present.
+*/
+function readDurableWrapperBinding(record, deviceId, capName, ownAddonId) {
+	if (!isRecord$2(record)) return "unreadable";
+	const deviceBindings = record["deviceBindings"];
+	if (!isRecord$2(deviceBindings)) return "unreadable";
+	const perDevice = deviceBindings[String(deviceId)];
+	if (!isRecord$2(perDevice)) return "unbound";
+	const activation = perDevice[capName];
+	if (!isRecord$2(activation)) return "unbound";
+	const wrapperAddonId = activation["wrapperAddonId"];
+	if (typeof wrapperAddonId !== "string") return "unbound";
+	return require_dist.isSameAddonId(wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+}
 //#endregion
 //#region src/builtins/doorbell/doorbell-settings.ts
 /**
@@ -330,6 +435,13 @@ function applyDoorbellSourcesPatch(current, patchValue) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
+/**
+* The addon whose store IS the durable authority on wrapper activations.
+* `deviceBindings[<deviceId>][<capName>].wrapperAddonId` is the row the
+* operator's bindings toggle writes; `deviceManager.getBindings` is a VIEW
+* derived from it plus the capability registry.
+*/
+var DEVICE_MANAGER_ADDON_ID = "device-manager";
 /** Structural narrowing helper for untrusted bus payloads. */
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -469,19 +581,14 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* byte-shaped like a native firmware ring so every downstream consumer
 	* (UI toast, notifier rules, exporters) is agnostic to the origin.
 	*
-	* The binding gate here is a pure in-memory read. It performs NO I/O and
-	* cannot fail: the whole point of the mirror is that the ring path can no
-	* longer be talked out of ringing by a store that answered badly.
+	* The binding gate here is a pure in-memory read on the path that RINGS:
+	* an open mirror performs NO I/O and cannot fail. The mirror can only
+	* DESTROY a press through the one branch below, and that branch is not
+	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
 	*/
 	async fireDoorbell(cameraId, timestamp) {
 		const binding = this.bindingMirror.get(cameraId);
-		if (!allowsRing(binding)) {
-			this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
-				tags: { deviceId: cameraId },
-				meta: { bindingState: binding }
-			});
-			return;
-		}
+		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
 			tags: { deviceId: cameraId },
 			meta: { bindingState: binding ?? "never-read" }
@@ -520,20 +627,28 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		});
 	}
 	/**
-	* Fold one bindings read for `cameraId` into the mirror. Runs on the
-	* assignment-reload cadence, never while firing.
+	* The addon id as the REGISTRY and the bindings store spell it.
 	*
-	* A read that THROWS carries no information and leaves the mirror exactly
-	* as it was — the previous verdict keeps standing. A read that succeeds
-	* but omits our activation only ARMS a revocation; `nextBindingState`
-	* requires a second consecutive negative before the camera goes silent,
-	* because a genuine unbind and a store answering from an empty snapshot
-	* (D44) are indistinguishable in a single response.
+	* `ctx.id` does NOT: hub-main prefixes it (`addon:virtual-doorbell`) while
+	* a forked runner does not, and this builtin runs in hub-main. Comparing
+	* the raw `ctx.id` to a `providerAddonId` was false for every entry for
+	* twelve hours on 2026-08-07 (D72).
 	*/
-	async refreshBindingMirror(cameraId) {
-		let entries;
+	get ownAddonId() {
+		return require_dist.bareAddonId(this.ctx.id);
+	}
+	/**
+	* One read of the DERIVED binding view. `null` when the read could not be
+	* answered at all — which carries no information and must leave the mirror
+	* untouched.
+	*/
+	async readDerivedBinding(cameraId) {
 		try {
-			entries = (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries;
+			const bindings = await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId });
+			return {
+				bound: entriesBindWrapper(bindings.entries, require_dist.doorbellCapability.name, this.ownAddonId),
+				entries: bindings.entries
+			};
 		} catch (err) {
 			this.ctx.logger.warn("virtual-doorbell: binding check failed — keeping the last known verdict, NOT treating this as an unbind", {
 				tags: { deviceId: cameraId },
@@ -542,19 +657,126 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 					bindingState: this.bindingMirror.get(cameraId)
 				}
 			});
+			return null;
+		}
+	}
+	/**
+	* One read of the DURABLE authority: the `device-manager` addon store's
+	* `deviceBindings` map, straight from the settings DB.
+	*
+	* This is deliberately NOT `getBindings`. The derived view folds the store
+	* together with the capability registry, `defaultActive` auto-binding and
+	* the cluster native-cap feeds — any of which can make it disagree with
+	* what the operator actually persisted, and one of which (an addon-id
+	* spelling mismatch) made it disagree *systematically* while looking
+	* exactly like a genuine unbind. The raw row cannot: it is what the
+	* bindings toggle wrote, and it grades its own trustworthiness (D44).
+	*/
+	async readDurableAuthority(cameraId) {
+		try {
+			return readDurableWrapperBinding(await this.ctx.api.addonSettingsRaw.getGlobal.query({ addonId: DEVICE_MANAGER_ADDON_ID }), cameraId, require_dist.doorbellCapability.name, this.ownAddonId);
+		} catch (err) {
+			this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing", {
+				tags: { deviceId: cameraId },
+				meta: { error: require_dist.errMsg(err) }
+			});
+			return "unreadable";
+		}
+	}
+	/**
+	* Reconcile `cameraId`'s mirror against the authority. Runs on the
+	* assignment-reload cadence, never while firing — and it runs on EVERY
+	* cycle regardless of the current verdict, so a camera sitting in
+	* `unbound` returns to `bound` on its own the moment the authority says
+	* so. There is no latch here that an operator has to clear.
+	*
+	* A positive derived read is believed immediately. A NEGATIVE one never
+	* is: the durable authority is asked, and it outranks the derived view in
+	* the direction that destroys work. Only when the authority agrees does
+	* the negative get folded, and even then `nextBindingState` still wants a
+	* second consecutive one (D49).
+	*/
+	async refreshBindingMirror(cameraId) {
+		const derived = await this.readDerivedBinding(cameraId);
+		if (derived === null) return;
+		if (derived.bound) {
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
+			return;
+		}
+		const authority = await this.readDurableAuthority(cameraId);
+		const entries = summariseEntries(derived.entries);
+		if (authority === "bound") {
+			this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store", {
+				tags: { deviceId: cameraId },
+				meta: {
+					ownAddonId: this.ownAddonId,
+					entries
+				}
+			});
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
 			return;
 		}
-		const boundNow = entries.some((entry) => entry.capName === require_dist.doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
 		const previous = this.bindingMirror.get(cameraId);
-		const next = nextBindingState(previous, boundNow);
+		const next = nextBindingState(previous, false);
 		this.bindingMirror.set(cameraId, next);
-		if (next !== previous && next !== "bound") this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+		this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
 			tags: { deviceId: cameraId },
 			meta: {
 				from: previous ?? "never-read",
-				to: next
+				to: next,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries
+			}
+		});
+	}
+	/**
+	* The mirror says `unbound` and a real press just arrived. Decide, with
+	* ONE read of the durable authority, whether to destroy it.
+	*
+	* D49 forbade I/O on the ring path because the read it would have made was
+	* the same fallible derived read that caused the problem. This read is
+	* different in both directions: it is the authority rather than a view of
+	* it, and it is paid ONLY on the branch that would otherwise drop a press —
+	* a ring is rare, one query is cheap, and a dropped ring has no retry, no
+	* reconcile and nothing downstream that notices.
+	*
+	* Returns `true` when the ring must proceed.
+	*/
+	async ringsDespiteUnboundMirror(cameraId, binding) {
+		const authority = await this.readDurableAuthority(cameraId);
+		if (authority === "bound") {
+			this.bindingMirror.set(cameraId, "bound");
+			this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		if (authority === "unreadable") {
+			this.ctx.logger.warn("virtual-doorbell: ringing on an unbound mirror — the durable bindings store could not answer, and an unanswerable store never destroys a one-shot press", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		const derived = await this.readDerivedBinding(cameraId);
+		this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+			tags: { deviceId: cameraId },
+			meta: {
+				bindingState: binding,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
 			}
 		});
+		return false;
 	}
 	/**
 	* Record a binding we observed FIRST-HAND. Both callers are cap methods

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, O as doorbellCapability, _t as DeviceType, dt as BaseAddon, ut as errMsg, wt as createEvent } from "../../dist-DhL_zGRT.mjs";
+import { B as isSameAddonId, Et as createEvent, ft as errMsg, k as doorbellCapability, pt as BaseAddon, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over
@@ -216,6 +216,65 @@ var DoorbellTriggerEngine = class {
 //#endregion
 //#region src/builtins/doorbell/binding-mirror.ts
 /**
+* The virtual-doorbell wrapper's in-memory mirror of ONE durable fact per
+* camera: is this wrapper still the active `doorbell` binding for it?
+*
+* WHY A MIRROR AND NOT A READ. A doorbell press is a one-shot event: there
+* is no retry, no reconcile, nothing downstream that can notice it went
+* missing. The wrapper used to re-derive the binding on the ring path via
+* `deviceManager.getBindings` and treat ANY answer that omitted its own
+* activation as "the operator unbound this". On 2026-08-04/05 camera 615
+* rang zero times out of three real presses: the binding was persisted (a
+* same-day backup taken before the presses proves it, and the same process
+* later returned it correctly to a tRPC query), but the store answered
+* transiently without it — `getBindings` reads the device-manager addon
+* store, which is exactly the surface that can silently answer `{}` (D44,
+* `addon-registry.service.ts`). Three presses, three drops, at `debug`.
+*
+* WHY CORROBORATION AND NOT A BETTER DISCRIMINATOR. There isn't one. A
+* genuinely unbound pure-wrapper cap and a store answering from an empty
+* snapshot produce the SAME `getBindings` response — no `doorbell` entry,
+* with the camera's native entries (snapshot, motion, …) still present in
+* both cases because those come from the capability registry, not the
+* store. The response cannot be graded. What CAN be graded is repetition: a
+* real unbind is permanent and every later read agrees, a store blip does
+* not survive the next read. So a negative read ARMS the revocation and a
+* second consecutive negative applies it.
+*
+* ERRING. `undefined` (never read) and `unbind-pending` both ring. Reaching
+* the ring path at all means the camera has a configured trigger source,
+* and a source can only be configured through this wrapper's own
+* binding-gated settings surface — so a configured source is itself
+* evidence the wrapper was bound. The cost of erring open is a spurious
+* ring on a camera the operator unbound but left configured, for at most
+* two reload cycles. The cost of erring closed is the press.
+*
+* ─────────────────────────────────────────────────────────────────────
+* 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
+* matters more than the fix. `refreshBindingMirror` matched the binding with
+* `entry.providerAddonId === this.ctx.id`. The two addon-context factories do
+* not spell `ctx.id` the same way: a forked addon gets `virtual-doorbell`, a
+* hub-main BUILTIN gets `addon:virtual-doorbell`. Every entry on the wire
+* carries the bare form. So for this builtin the comparison was false for
+* every entry, forever — not a blip. Corroboration only defends against a
+* TRANSIENT bad read; two systematically-wrong reads agree with each other,
+* and the mirror latched `unbound` with no way back except an operator
+* opening the settings page. A real press on camera 615 was dropped.
+*
+* Two things follow, and both are now load-bearing here:
+*
+*   1. The comparison goes through `isSameAddonId` ({@link entriesBindWrapper}),
+*      never a raw `===`.
+*   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
+*      input. Before a negative is believed — and again on the ring path
+*      before a press is destroyed — the DURABLE authority is consulted
+*      directly ({@link readDurableWrapperBinding} over the `device-manager`
+*      addon store's `deviceBindings` map). That read carries a discriminator
+*      the derived view genuinely cannot offer: a store answering from an
+*      empty snapshot (D44) has no `deviceBindings` key at all, while a
+*      genuine unbind leaves the key present and merely omits the row.
+*/
+/**
 * Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
 * never reach this function — an unanswerable store carries no information
 * and must leave the mirror exactly as it was.
@@ -232,6 +291,52 @@ function allowsRing(state) {
 function hasConfirmedBinding(state) {
 	return state === "bound";
 }
+/**
+* Does this list of binding entries name `ownAddonId` as the ACTIVE WRAPPER
+* of `capName`?
+*
+* `isSameAddonId` is the whole point: `ownAddonId` is an `AddonContext.id`,
+* which is prefixed (`addon:…`) in hub-main and bare in a forked runner,
+* while `providerAddonId` is always bare. A raw `===` here is the D72 bug.
+*/
+function entriesBindWrapper(entries, capName, ownAddonId) {
+	return entries.some((entry) => entry.capName === capName && entry.kind === "wrapped" && isSameAddonId(entry.providerAddonId, ownAddonId));
+}
+/**
+* Render binding entries for a log line. A systematic wrong answer and a
+* one-off blip produce the same VERDICT; only the entries themselves tell
+* them apart, so a negative read never gets to report just its conclusion.
+*/
+function summariseEntries(entries) {
+	return entries.map((entry) => `${entry.capName}:${entry.kind}:${entry.providerAddonId}`);
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Read the DURABLE authority — the `device-manager` addon store's
+* `deviceBindings` map — for "is `ownAddonId` the active wrapper of
+* `capName` on `deviceId`".
+*
+* This is the input the derived `getBindings` view is not: it is the row the
+* operator's toggle actually writes, with no registry resolution, no
+* `defaultActive` auto-binding and no cross-node cap folding in between. It
+* also grades its own trustworthiness, which `getBindings` cannot: the
+* absence of the `deviceBindings` KEY is the signature of a store answering
+* from an empty snapshot, whereas a genuine unbind leaves the key present.
+*/
+function readDurableWrapperBinding(record, deviceId, capName, ownAddonId) {
+	if (!isRecord$2(record)) return "unreadable";
+	const deviceBindings = record["deviceBindings"];
+	if (!isRecord$2(deviceBindings)) return "unreadable";
+	const perDevice = deviceBindings[String(deviceId)];
+	if (!isRecord$2(perDevice)) return "unbound";
+	const activation = perDevice[capName];
+	if (!isRecord$2(activation)) return "unbound";
+	const wrapperAddonId = activation["wrapperAddonId"];
+	if (typeof wrapperAddonId !== "string") return "unbound";
+	return isSameAddonId(wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+}
 //#endregion
 //#region src/builtins/doorbell/doorbell-settings.ts
 /**
@@ -325,6 +430,13 @@ function applyDoorbellSourcesPatch(current, patchValue) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
+/**
+* The addon whose store IS the durable authority on wrapper activations.
+* `deviceBindings[<deviceId>][<capName>].wrapperAddonId` is the row the
+* operator's bindings toggle writes; `deviceManager.getBindings` is a VIEW
+* derived from it plus the capability registry.
+*/
+var DEVICE_MANAGER_ADDON_ID = "device-manager";
 /** Structural narrowing helper for untrusted bus payloads. */
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -464,19 +576,14 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* byte-shaped like a native firmware ring so every downstream consumer
 	* (UI toast, notifier rules, exporters) is agnostic to the origin.
 	*
-	* The binding gate here is a pure in-memory read. It performs NO I/O and
-	* cannot fail: the whole point of the mirror is that the ring path can no
-	* longer be talked out of ringing by a store that answered badly.
+	* The binding gate here is a pure in-memory read on the path that RINGS:
+	* an open mirror performs NO I/O and cannot fail. The mirror can only
+	* DESTROY a press through the one branch below, and that branch is not
+	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
 	*/
 	async fireDoorbell(cameraId, timestamp) {
 		const binding = this.bindingMirror.get(cameraId);
-		if (!allowsRing(binding)) {
-			this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
-				tags: { deviceId: cameraId },
-				meta: { bindingState: binding }
-			});
-			return;
-		}
+		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
 			tags: { deviceId: cameraId },
 			meta: { bindingState: binding ?? "never-read" }
@@ -515,20 +622,28 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 		});
 	}
 	/**
-	* Fold one bindings read for `cameraId` into the mirror. Runs on the
-	* assignment-reload cadence, never while firing.
+	* The addon id as the REGISTRY and the bindings store spell it.
 	*
-	* A read that THROWS carries no information and leaves the mirror exactly
-	* as it was — the previous verdict keeps standing. A read that succeeds
-	* but omits our activation only ARMS a revocation; `nextBindingState`
-	* requires a second consecutive negative before the camera goes silent,
-	* because a genuine unbind and a store answering from an empty snapshot
-	* (D44) are indistinguishable in a single response.
+	* `ctx.id` does NOT: hub-main prefixes it (`addon:virtual-doorbell`) while
+	* a forked runner does not, and this builtin runs in hub-main. Comparing
+	* the raw `ctx.id` to a `providerAddonId` was false for every entry for
+	* twelve hours on 2026-08-07 (D72).
 	*/
-	async refreshBindingMirror(cameraId) {
-		let entries;
+	get ownAddonId() {
+		return bareAddonId(this.ctx.id);
+	}
+	/**
+	* One read of the DERIVED binding view. `null` when the read could not be
+	* answered at all — which carries no information and must leave the mirror
+	* untouched.
+	*/
+	async readDerivedBinding(cameraId) {
 		try {
-			entries = (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries;
+			const bindings = await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId });
+			return {
+				bound: entriesBindWrapper(bindings.entries, doorbellCapability.name, this.ownAddonId),
+				entries: bindings.entries
+			};
 		} catch (err) {
 			this.ctx.logger.warn("virtual-doorbell: binding check failed — keeping the last known verdict, NOT treating this as an unbind", {
 				tags: { deviceId: cameraId },
@@ -537,19 +652,126 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 					bindingState: this.bindingMirror.get(cameraId)
 				}
 			});
+			return null;
+		}
+	}
+	/**
+	* One read of the DURABLE authority: the `device-manager` addon store's
+	* `deviceBindings` map, straight from the settings DB.
+	*
+	* This is deliberately NOT `getBindings`. The derived view folds the store
+	* together with the capability registry, `defaultActive` auto-binding and
+	* the cluster native-cap feeds — any of which can make it disagree with
+	* what the operator actually persisted, and one of which (an addon-id
+	* spelling mismatch) made it disagree *systematically* while looking
+	* exactly like a genuine unbind. The raw row cannot: it is what the
+	* bindings toggle wrote, and it grades its own trustworthiness (D44).
+	*/
+	async readDurableAuthority(cameraId) {
+		try {
+			return readDurableWrapperBinding(await this.ctx.api.addonSettingsRaw.getGlobal.query({ addonId: DEVICE_MANAGER_ADDON_ID }), cameraId, doorbellCapability.name, this.ownAddonId);
+		} catch (err) {
+			this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing", {
+				tags: { deviceId: cameraId },
+				meta: { error: errMsg(err) }
+			});
+			return "unreadable";
+		}
+	}
+	/**
+	* Reconcile `cameraId`'s mirror against the authority. Runs on the
+	* assignment-reload cadence, never while firing — and it runs on EVERY
+	* cycle regardless of the current verdict, so a camera sitting in
+	* `unbound` returns to `bound` on its own the moment the authority says
+	* so. There is no latch here that an operator has to clear.
+	*
+	* A positive derived read is believed immediately. A NEGATIVE one never
+	* is: the durable authority is asked, and it outranks the derived view in
+	* the direction that destroys work. Only when the authority agrees does
+	* the negative get folded, and even then `nextBindingState` still wants a
+	* second consecutive one (D49).
+	*/
+	async refreshBindingMirror(cameraId) {
+		const derived = await this.readDerivedBinding(cameraId);
+		if (derived === null) return;
+		if (derived.bound) {
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
+			return;
+		}
+		const authority = await this.readDurableAuthority(cameraId);
+		const entries = summariseEntries(derived.entries);
+		if (authority === "bound") {
+			this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store", {
+				tags: { deviceId: cameraId },
+				meta: {
+					ownAddonId: this.ownAddonId,
+					entries
+				}
+			});
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
 			return;
 		}
-		const boundNow = entries.some((entry) => entry.capName === doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
 		const previous = this.bindingMirror.get(cameraId);
-		const next = nextBindingState(previous, boundNow);
+		const next = nextBindingState(previous, false);
 		this.bindingMirror.set(cameraId, next);
-		if (next !== previous && next !== "bound") this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+		this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
 			tags: { deviceId: cameraId },
 			meta: {
 				from: previous ?? "never-read",
-				to: next
+				to: next,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries
+			}
+		});
+	}
+	/**
+	* The mirror says `unbound` and a real press just arrived. Decide, with
+	* ONE read of the durable authority, whether to destroy it.
+	*
+	* D49 forbade I/O on the ring path because the read it would have made was
+	* the same fallible derived read that caused the problem. This read is
+	* different in both directions: it is the authority rather than a view of
+	* it, and it is paid ONLY on the branch that would otherwise drop a press —
+	* a ring is rare, one query is cheap, and a dropped ring has no retry, no
+	* reconcile and nothing downstream that notices.
+	*
+	* Returns `true` when the ring must proceed.
+	*/
+	async ringsDespiteUnboundMirror(cameraId, binding) {
+		const authority = await this.readDurableAuthority(cameraId);
+		if (authority === "bound") {
+			this.bindingMirror.set(cameraId, "bound");
+			this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		if (authority === "unreadable") {
+			this.ctx.logger.warn("virtual-doorbell: ringing on an unbound mirror — the durable bindings store could not answer, and an unanswerable store never destroys a one-shot press", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		const derived = await this.readDerivedBinding(cameraId);
+		this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+			tags: { deviceId: cameraId },
+			meta: {
+				bindingState: binding,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
 			}
 		});
+		return false;
 	}
 	/**
 	* Record a binding we observed FIRST-HAND. Both callers are cap methods