@camstack/system 1.2.58 → 1.2.60

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, dt as BaseAddon, m as addonPagesCapability, ut as errMsg } from "../../dist-UrXyJ9Zm.mjs";
+import { ft as errMsg, m as addonPagesCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, dt as BaseAddon, g as addonWidgetsCapability, ut as errMsg } from "../../dist-UrXyJ9Zm.mjs";
+import { ft as errMsg, g as addonWidgetsCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, _ as alertsCapability, dt as BaseAddon, n as AlertSchema, ut as errMsg, wt as createEvent } from "../../dist-UrXyJ9Zm.mjs";
+import { Et as createEvent, _ as alertsCapability, ft as errMsg, n as AlertSchema, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, b as backupCapability, dt as BaseAddon } from "../../dist-UrXyJ9Zm.mjs";
+import { b as backupCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import Kt from "node:fs";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { U as logDestinationCapability, dt as BaseAddon } from "../../dist-UrXyJ9Zm.mjs";
+import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-C5XpOjbI.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { S as coreBlocksCapability, dt as BaseAddon, o as CoreBlockSchema } from "../../dist-UrXyJ9Zm.mjs";
+import { C as coreBlocksCapability, o as CoreBlockSchema, pt as BaseAddon } from "../../dist-C5XpOjbI.mjs";
 import { randomUUID } from "node:crypto";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -1644,7 +1644,7 @@ async function getBindings(deps, input) {
 			entries.push({
 				capName,
 				kind: "linked",
-				providerAddonId: deps.ctx.id,
+				providerAddonId: require_dist.bareAddonId(deps.ctx.id),
 				providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
 				nativeAddonId: ""
 			});

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as setByPath, A as enumerateItemArrayFields, D as deviceStatusCapability, E as deviceStateCapability, F as getByPath, It as sleep, Lt as EventCategory, M as evaluateLinkExpression, T as deviceManagerCapability, Y as parseStreamParamsFormPatch, _t as DeviceType, a as CAP_NAMES_WITH_STATUS, at as toExpressionValue, bt as WELL_KNOWN_TAB_MAP, dt as BaseAddon, gt as DeviceRole, ht as DeviceFeature, j as enumerateSchemaFields, kt as isDeviceConfigCap, q as normalizeUnit, s as DeviceStatusSchema, st as validateExpressionSource, t as ALL_CAPABILITY_DEFINITIONS, u as STREAM_PROFILE_META, ut as errMsg, v as applyTransform, x as buildStreamParamsConfigSchema } from "../../dist-UrXyJ9Zm.mjs";
+import { D as deviceStateCapability, E as deviceManagerCapability, I as getByPath, M as enumerateSchemaFields, N as evaluateLinkExpression, O as deviceStatusCapability, Rt as sleep, S as buildStreamParamsConfigSchema, St as WELL_KNOWN_TAB_MAP, Y as normalizeUnit, Z as parseStreamParamsFormPatch, _t as DeviceFeature, a as CAP_NAMES_WITH_STATUS, ft as errMsg, j as enumerateItemArrayFields, jt as isDeviceConfigCap, lt as validateExpressionSource, pt as BaseAddon, s as DeviceStatusSchema, st as toExpressionValue, t as ALL_CAPABILITY_DEFINITIONS, tt as setByPath, u as STREAM_PROFILE_META, v as applyTransform, vt as DeviceRole, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
@@ -1639,7 +1639,7 @@ async function getBindings(deps, input) {
 			entries.push({
 				capName,
 				kind: "linked",
-				providerAddonId: deps.ctx.id,
+				providerAddonId: bareAddonId(deps.ctx.id),
 				providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
 				nativeAddonId: ""
 			});

package/dist/builtins/doorbell/binding-mirror.d.ts

@@ -31,6 +31,31 @@
  * evidence the wrapper was bound. The cost of erring open is a spurious
  * ring on a camera the operator unbound but left configured, for at most
  * two reload cycles. The cost of erring closed is the press.
+ *
+ * ─────────────────────────────────────────────────────────────────────
+ * 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
+ * matters more than the fix. `refreshBindingMirror` matched the binding with
+ * `entry.providerAddonId === this.ctx.id`. The two addon-context factories do
+ * not spell `ctx.id` the same way: a forked addon gets `virtual-doorbell`, a
+ * hub-main BUILTIN gets `addon:virtual-doorbell`. Every entry on the wire
+ * carries the bare form. So for this builtin the comparison was false for
+ * every entry, forever — not a blip. Corroboration only defends against a
+ * TRANSIENT bad read; two systematically-wrong reads agree with each other,
+ * and the mirror latched `unbound` with no way back except an operator
+ * opening the settings page. A real press on camera 615 was dropped.
+ *
+ * Two things follow, and both are now load-bearing here:
+ *
+ *   1. The comparison goes through `isSameAddonId` ({@link entriesBindWrapper}),
+ *      never a raw `===`.
+ *   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
+ *      input. Before a negative is believed — and again on the ring path
+ *      before a press is destroyed — the DURABLE authority is consulted
+ *      directly ({@link readDurableWrapperBinding} over the `device-manager`
+ *      addon store's `deviceBindings` map). That read carries a discriminator
+ *      the derived view genuinely cannot offer: a store answering from an
+ *      empty snapshot (D44) has no `deviceBindings` key at all, while a
+ *      genuine unbind leaves the key present and merely omits the row.
  */
 /**
  * `bound` — a read saw the wrapper's activation.
@@ -48,3 +73,43 @@ export declare function nextBindingState(previous: DoorbellBindingState | undefi
 export declare function allowsRing(state: DoorbellBindingState | undefined): boolean;
 /** True only when a read has positively confirmed the binding. */
 export declare function hasConfirmedBinding(state: DoorbellBindingState | undefined): boolean;
+/** The fields of a `DeviceBindingEntry` this module reasons about. */
+export interface BindingEntryView {
+    readonly capName: string;
+    readonly kind: string;
+    readonly providerAddonId: string;
+}
+/**
+ * Does this list of binding entries name `ownAddonId` as the ACTIVE WRAPPER
+ * of `capName`?
+ *
+ * `isSameAddonId` is the whole point: `ownAddonId` is an `AddonContext.id`,
+ * which is prefixed (`addon:…`) in hub-main and bare in a forked runner,
+ * while `providerAddonId` is always bare. A raw `===` here is the D72 bug.
+ */
+export declare function entriesBindWrapper(entries: ReadonlyArray<BindingEntryView>, capName: string, ownAddonId: string): boolean;
+/**
+ * Render binding entries for a log line. A systematic wrong answer and a
+ * one-off blip produce the same VERDICT; only the entries themselves tell
+ * them apart, so a negative read never gets to report just its conclusion.
+ */
+export declare function summariseEntries(entries: ReadonlyArray<BindingEntryView>): string[];
+/**
+ * `bound` / `unbound` — the durable store answered, and this is its answer.
+ * `unreadable` — the store could not be read, or answered from an empty
+ * snapshot (D44). It carries NO information and must never destroy work.
+ */
+export type DurableBindingVerdict = 'bound' | 'unbound' | 'unreadable';
+/**
+ * Read the DURABLE authority — the `device-manager` addon store's
+ * `deviceBindings` map — for "is `ownAddonId` the active wrapper of
+ * `capName` on `deviceId`".
+ *
+ * This is the input the derived `getBindings` view is not: it is the row the
+ * operator's toggle actually writes, with no registry resolution, no
+ * `defaultActive` auto-binding and no cross-node cap folding in between. It
+ * also grades its own trustworthiness, which `getBindings` cannot: the
+ * absence of the `deviceBindings` KEY is the signature of a store answering
+ * from an empty snapshot, whereas a genuine unbind leaves the key present.
+ */
+export declare function readDurableWrapperBinding(record: unknown, deviceId: number, capName: string, ownAddonId: string): DurableBindingVerdict;

package/dist/builtins/doorbell/virtual-doorbell.addon.d.ts

@@ -67,23 +67,68 @@ export declare class VirtualDoorbellAddon extends BaseAddon<VirtualDoorbellAddon
      * byte-shaped like a native firmware ring so every downstream consumer
      * (UI toast, notifier rules, exporters) is agnostic to the origin.
      *
-     * The binding gate here is a pure in-memory read. It performs NO I/O and
-     * cannot fail: the whole point of the mirror is that the ring path can no
-     * longer be talked out of ringing by a store that answered badly.
+     * The binding gate here is a pure in-memory read on the path that RINGS:
+     * an open mirror performs NO I/O and cannot fail. The mirror can only
+     * DESTROY a press through the one branch below, and that branch is not
+     * allowed to be the last word — see `ringsDespiteUnboundMirror`.
      */
     private fireDoorbell;
     /**
-     * Fold one bindings read for `cameraId` into the mirror. Runs on the
-     * assignment-reload cadence, never while firing.
+     * The addon id as the REGISTRY and the bindings store spell it.
      *
-     * A read that THROWS carries no information and leaves the mirror exactly
-     * as it was — the previous verdict keeps standing. A read that succeeds
-     * but omits our activation only ARMS a revocation; `nextBindingState`
-     * requires a second consecutive negative before the camera goes silent,
-     * because a genuine unbind and a store answering from an empty snapshot
-     * (D44) are indistinguishable in a single response.
+     * `ctx.id` does NOT: hub-main prefixes it (`addon:virtual-doorbell`) while
+     * a forked runner does not, and this builtin runs in hub-main. Comparing
+     * the raw `ctx.id` to a `providerAddonId` was false for every entry for
+     * twelve hours on 2026-08-07 (D72).
+     */
+    private get ownAddonId();
+    /**
+     * One read of the DERIVED binding view. `null` when the read could not be
+     * answered at all — which carries no information and must leave the mirror
+     * untouched.
+     */
+    private readDerivedBinding;
+    /**
+     * One read of the DURABLE authority: the `device-manager` addon store's
+     * `deviceBindings` map, straight from the settings DB.
+     *
+     * This is deliberately NOT `getBindings`. The derived view folds the store
+     * together with the capability registry, `defaultActive` auto-binding and
+     * the cluster native-cap feeds — any of which can make it disagree with
+     * what the operator actually persisted, and one of which (an addon-id
+     * spelling mismatch) made it disagree *systematically* while looking
+     * exactly like a genuine unbind. The raw row cannot: it is what the
+     * bindings toggle wrote, and it grades its own trustworthiness (D44).
+     */
+    private readDurableAuthority;
+    /**
+     * Reconcile `cameraId`'s mirror against the authority. Runs on the
+     * assignment-reload cadence, never while firing — and it runs on EVERY
+     * cycle regardless of the current verdict, so a camera sitting in
+     * `unbound` returns to `bound` on its own the moment the authority says
+     * so. There is no latch here that an operator has to clear.
+     *
+     * A positive derived read is believed immediately. A NEGATIVE one never
+     * is: the durable authority is asked, and it outranks the derived view in
+     * the direction that destroys work. Only when the authority agrees does
+     * the negative get folded, and even then `nextBindingState` still wants a
+     * second consecutive one (D49).
      */
     private refreshBindingMirror;
+    /**
+     * The mirror says `unbound` and a real press just arrived. Decide, with
+     * ONE read of the durable authority, whether to destroy it.
+     *
+     * D49 forbade I/O on the ring path because the read it would have made was
+     * the same fallible derived read that caused the problem. This read is
+     * different in both directions: it is the authority rather than a view of
+     * it, and it is paid ONLY on the branch that would otherwise drop a press —
+     * a ring is rare, one query is cheap, and a dropped ring has no retry, no
+     * reconcile and nothing downstream that notices.
+     *
+     * Returns `true` when the ring must proceed.
+     */
+    private ringsDespiteUnboundMirror;
     /**
      * Record a binding we observed FIRST-HAND. Both callers are cap methods
      * the router only reaches by resolving this wrapper for this device —

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over
@@ -221,6 +221,65 @@ var DoorbellTriggerEngine = class {
 //#endregion
 //#region src/builtins/doorbell/binding-mirror.ts
 /**
+* The virtual-doorbell wrapper's in-memory mirror of ONE durable fact per
+* camera: is this wrapper still the active `doorbell` binding for it?
+*
+* WHY A MIRROR AND NOT A READ. A doorbell press is a one-shot event: there
+* is no retry, no reconcile, nothing downstream that can notice it went
+* missing. The wrapper used to re-derive the binding on the ring path via
+* `deviceManager.getBindings` and treat ANY answer that omitted its own
+* activation as "the operator unbound this". On 2026-08-04/05 camera 615
+* rang zero times out of three real presses: the binding was persisted (a
+* same-day backup taken before the presses proves it, and the same process
+* later returned it correctly to a tRPC query), but the store answered
+* transiently without it — `getBindings` reads the device-manager addon
+* store, which is exactly the surface that can silently answer `{}` (D44,
+* `addon-registry.service.ts`). Three presses, three drops, at `debug`.
+*
+* WHY CORROBORATION AND NOT A BETTER DISCRIMINATOR. There isn't one. A
+* genuinely unbound pure-wrapper cap and a store answering from an empty
+* snapshot produce the SAME `getBindings` response — no `doorbell` entry,
+* with the camera's native entries (snapshot, motion, …) still present in
+* both cases because those come from the capability registry, not the
+* store. The response cannot be graded. What CAN be graded is repetition: a
+* real unbind is permanent and every later read agrees, a store blip does
+* not survive the next read. So a negative read ARMS the revocation and a
+* second consecutive negative applies it.
+*
+* ERRING. `undefined` (never read) and `unbind-pending` both ring. Reaching
+* the ring path at all means the camera has a configured trigger source,
+* and a source can only be configured through this wrapper's own
+* binding-gated settings surface — so a configured source is itself
+* evidence the wrapper was bound. The cost of erring open is a spurious
+* ring on a camera the operator unbound but left configured, for at most
+* two reload cycles. The cost of erring closed is the press.
+*
+* ─────────────────────────────────────────────────────────────────────
+* 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
+* matters more than the fix. `refreshBindingMirror` matched the binding with
+* `entry.providerAddonId === this.ctx.id`. The two addon-context factories do
+* not spell `ctx.id` the same way: a forked addon gets `virtual-doorbell`, a
+* hub-main BUILTIN gets `addon:virtual-doorbell`. Every entry on the wire
+* carries the bare form. So for this builtin the comparison was false for
+* every entry, forever — not a blip. Corroboration only defends against a
+* TRANSIENT bad read; two systematically-wrong reads agree with each other,
+* and the mirror latched `unbound` with no way back except an operator
+* opening the settings page. A real press on camera 615 was dropped.
+*
+* Two things follow, and both are now load-bearing here:
+*
+*   1. The comparison goes through `isSameAddonId` ({@link entriesBindWrapper}),
+*      never a raw `===`.
+*   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
+*      input. Before a negative is believed — and again on the ring path
+*      before a press is destroyed — the DURABLE authority is consulted
+*      directly ({@link readDurableWrapperBinding} over the `device-manager`
+*      addon store's `deviceBindings` map). That read carries a discriminator
+*      the derived view genuinely cannot offer: a store answering from an
+*      empty snapshot (D44) has no `deviceBindings` key at all, while a
+*      genuine unbind leaves the key present and merely omits the row.
+*/
+/**
 * Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
 * never reach this function — an unanswerable store carries no information
 * and must leave the mirror exactly as it was.
@@ -237,6 +296,52 @@ function allowsRing(state) {
 function hasConfirmedBinding(state) {
 	return state === "bound";
 }
+/**
+* Does this list of binding entries name `ownAddonId` as the ACTIVE WRAPPER
+* of `capName`?
+*
+* `isSameAddonId` is the whole point: `ownAddonId` is an `AddonContext.id`,
+* which is prefixed (`addon:…`) in hub-main and bare in a forked runner,
+* while `providerAddonId` is always bare. A raw `===` here is the D72 bug.
+*/
+function entriesBindWrapper(entries, capName, ownAddonId) {
+	return entries.some((entry) => entry.capName === capName && entry.kind === "wrapped" && require_dist.isSameAddonId(entry.providerAddonId, ownAddonId));
+}
+/**
+* Render binding entries for a log line. A systematic wrong answer and a
+* one-off blip produce the same VERDICT; only the entries themselves tell
+* them apart, so a negative read never gets to report just its conclusion.
+*/
+function summariseEntries(entries) {
+	return entries.map((entry) => `${entry.capName}:${entry.kind}:${entry.providerAddonId}`);
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Read the DURABLE authority — the `device-manager` addon store's
+* `deviceBindings` map — for "is `ownAddonId` the active wrapper of
+* `capName` on `deviceId`".
+*
+* This is the input the derived `getBindings` view is not: it is the row the
+* operator's toggle actually writes, with no registry resolution, no
+* `defaultActive` auto-binding and no cross-node cap folding in between. It
+* also grades its own trustworthiness, which `getBindings` cannot: the
+* absence of the `deviceBindings` KEY is the signature of a store answering
+* from an empty snapshot, whereas a genuine unbind leaves the key present.
+*/
+function readDurableWrapperBinding(record, deviceId, capName, ownAddonId) {
+	if (!isRecord$2(record)) return "unreadable";
+	const deviceBindings = record["deviceBindings"];
+	if (!isRecord$2(deviceBindings)) return "unreadable";
+	const perDevice = deviceBindings[String(deviceId)];
+	if (!isRecord$2(perDevice)) return "unbound";
+	const activation = perDevice[capName];
+	if (!isRecord$2(activation)) return "unbound";
+	const wrapperAddonId = activation["wrapperAddonId"];
+	if (typeof wrapperAddonId !== "string") return "unbound";
+	return require_dist.isSameAddonId(wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+}
 //#endregion
 //#region src/builtins/doorbell/doorbell-settings.ts
 /**
@@ -330,6 +435,13 @@ function applyDoorbellSourcesPatch(current, patchValue) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
+/**
+* The addon whose store IS the durable authority on wrapper activations.
+* `deviceBindings[<deviceId>][<capName>].wrapperAddonId` is the row the
+* operator's bindings toggle writes; `deviceManager.getBindings` is a VIEW
+* derived from it plus the capability registry.
+*/
+var DEVICE_MANAGER_ADDON_ID = "device-manager";
 /** Structural narrowing helper for untrusted bus payloads. */
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -469,19 +581,14 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* byte-shaped like a native firmware ring so every downstream consumer
 	* (UI toast, notifier rules, exporters) is agnostic to the origin.
 	*
-	* The binding gate here is a pure in-memory read. It performs NO I/O and
-	* cannot fail: the whole point of the mirror is that the ring path can no
-	* longer be talked out of ringing by a store that answered badly.
+	* The binding gate here is a pure in-memory read on the path that RINGS:
+	* an open mirror performs NO I/O and cannot fail. The mirror can only
+	* DESTROY a press through the one branch below, and that branch is not
+	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
 	*/
 	async fireDoorbell(cameraId, timestamp) {
 		const binding = this.bindingMirror.get(cameraId);
-		if (!allowsRing(binding)) {
-			this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
-				tags: { deviceId: cameraId },
-				meta: { bindingState: binding }
-			});
-			return;
-		}
+		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
 			tags: { deviceId: cameraId },
 			meta: { bindingState: binding ?? "never-read" }
@@ -520,20 +627,28 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		});
 	}
 	/**
-	* Fold one bindings read for `cameraId` into the mirror. Runs on the
-	* assignment-reload cadence, never while firing.
+	* The addon id as the REGISTRY and the bindings store spell it.
 	*
-	* A read that THROWS carries no information and leaves the mirror exactly
-	* as it was — the previous verdict keeps standing. A read that succeeds
-	* but omits our activation only ARMS a revocation; `nextBindingState`
-	* requires a second consecutive negative before the camera goes silent,
-	* because a genuine unbind and a store answering from an empty snapshot
-	* (D44) are indistinguishable in a single response.
+	* `ctx.id` does NOT: hub-main prefixes it (`addon:virtual-doorbell`) while
+	* a forked runner does not, and this builtin runs in hub-main. Comparing
+	* the raw `ctx.id` to a `providerAddonId` was false for every entry for
+	* twelve hours on 2026-08-07 (D72).
 	*/
-	async refreshBindingMirror(cameraId) {
-		let entries;
+	get ownAddonId() {
+		return require_dist.bareAddonId(this.ctx.id);
+	}
+	/**
+	* One read of the DERIVED binding view. `null` when the read could not be
+	* answered at all — which carries no information and must leave the mirror
+	* untouched.
+	*/
+	async readDerivedBinding(cameraId) {
 		try {
-			entries = (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries;
+			const bindings = await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId });
+			return {
+				bound: entriesBindWrapper(bindings.entries, require_dist.doorbellCapability.name, this.ownAddonId),
+				entries: bindings.entries
+			};
 		} catch (err) {
 			this.ctx.logger.warn("virtual-doorbell: binding check failed — keeping the last known verdict, NOT treating this as an unbind", {
 				tags: { deviceId: cameraId },
@@ -542,19 +657,126 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 					bindingState: this.bindingMirror.get(cameraId)
 				}
 			});
+			return null;
+		}
+	}
+	/**
+	* One read of the DURABLE authority: the `device-manager` addon store's
+	* `deviceBindings` map, straight from the settings DB.
+	*
+	* This is deliberately NOT `getBindings`. The derived view folds the store
+	* together with the capability registry, `defaultActive` auto-binding and
+	* the cluster native-cap feeds — any of which can make it disagree with
+	* what the operator actually persisted, and one of which (an addon-id
+	* spelling mismatch) made it disagree *systematically* while looking
+	* exactly like a genuine unbind. The raw row cannot: it is what the
+	* bindings toggle wrote, and it grades its own trustworthiness (D44).
+	*/
+	async readDurableAuthority(cameraId) {
+		try {
+			return readDurableWrapperBinding(await this.ctx.api.addonSettingsRaw.getGlobal.query({ addonId: DEVICE_MANAGER_ADDON_ID }), cameraId, require_dist.doorbellCapability.name, this.ownAddonId);
+		} catch (err) {
+			this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing", {
+				tags: { deviceId: cameraId },
+				meta: { error: require_dist.errMsg(err) }
+			});
+			return "unreadable";
+		}
+	}
+	/**
+	* Reconcile `cameraId`'s mirror against the authority. Runs on the
+	* assignment-reload cadence, never while firing — and it runs on EVERY
+	* cycle regardless of the current verdict, so a camera sitting in
+	* `unbound` returns to `bound` on its own the moment the authority says
+	* so. There is no latch here that an operator has to clear.
+	*
+	* A positive derived read is believed immediately. A NEGATIVE one never
+	* is: the durable authority is asked, and it outranks the derived view in
+	* the direction that destroys work. Only when the authority agrees does
+	* the negative get folded, and even then `nextBindingState` still wants a
+	* second consecutive one (D49).
+	*/
+	async refreshBindingMirror(cameraId) {
+		const derived = await this.readDerivedBinding(cameraId);
+		if (derived === null) return;
+		if (derived.bound) {
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
+			return;
+		}
+		const authority = await this.readDurableAuthority(cameraId);
+		const entries = summariseEntries(derived.entries);
+		if (authority === "bound") {
+			this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store", {
+				tags: { deviceId: cameraId },
+				meta: {
+					ownAddonId: this.ownAddonId,
+					entries
+				}
+			});
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
 			return;
 		}
-		const boundNow = entries.some((entry) => entry.capName === require_dist.doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
 		const previous = this.bindingMirror.get(cameraId);
-		const next = nextBindingState(previous, boundNow);
+		const next = nextBindingState(previous, false);
 		this.bindingMirror.set(cameraId, next);
-		if (next !== previous && next !== "bound") this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+		this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
 			tags: { deviceId: cameraId },
 			meta: {
 				from: previous ?? "never-read",
-				to: next
+				to: next,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries
+			}
+		});
+	}
+	/**
+	* The mirror says `unbound` and a real press just arrived. Decide, with
+	* ONE read of the durable authority, whether to destroy it.
+	*
+	* D49 forbade I/O on the ring path because the read it would have made was
+	* the same fallible derived read that caused the problem. This read is
+	* different in both directions: it is the authority rather than a view of
+	* it, and it is paid ONLY on the branch that would otherwise drop a press —
+	* a ring is rare, one query is cheap, and a dropped ring has no retry, no
+	* reconcile and nothing downstream that notices.
+	*
+	* Returns `true` when the ring must proceed.
+	*/
+	async ringsDespiteUnboundMirror(cameraId, binding) {
+		const authority = await this.readDurableAuthority(cameraId);
+		if (authority === "bound") {
+			this.bindingMirror.set(cameraId, "bound");
+			this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		if (authority === "unreadable") {
+			this.ctx.logger.warn("virtual-doorbell: ringing on an unbound mirror — the durable bindings store could not answer, and an unanswerable store never destroys a one-shot press", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		const derived = await this.readDerivedBinding(cameraId);
+		this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+			tags: { deviceId: cameraId },
+			meta: {
+				bindingState: binding,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
 			}
 		});
+		return false;
 	}
 	/**
 	* Record a binding we observed FIRST-HAND. Both callers are cap methods