@camstack/system 1.2.79 → 1.2.81

package/dist/builtins/snapshot/snapshot-coalescing.d.ts

@@ -42,8 +42,13 @@ export declare const SWR_COLD_WAIT_MS = 10000;
  * Max simultaneous ffmpeg keyframe grabs — the WRAPPER path, the common case for
  * cameras with no vendor snapshot URL. A 20-cam grid mount spawns at most this
  * many ffmpeg processes; the rest serve cached frames (SWR) or queue.
+ *
+ * Raised 3 → 6 on 2026-08-12 (operator): a 17-camera cold start serialised
+ * into 6 waves and the client-side "image displayed" clustering matched the
+ * pool exactly (p90 10.8 s). Measured client-side after the raise — if the
+ * hub shows decode pressure, this is the first knob to lower.
  */
-export declare const MAX_CONCURRENT_GRABS = 3;
+export declare const MAX_CONCURRENT_GRABS = 6;
 /**
  * Max simultaneous cheap native snapshot fetches (vendor HTTP/ONVIF). Higher than
  * the ffmpeg bound because a native fetch is a lightweight HTTP round-trip, not a

package/dist/builtins/snapshot/snapshot-courtesy.d.ts

@@ -0,0 +1,36 @@
+/** Why a camera cannot produce a frame right now. */
+export type CourtesyReason = 'disabled' | 'offline' | 'sleeping';
+/** Default tile size when the caller asks for no particular width. */
+export declare const COURTESY_DEFAULT_WIDTH = 640;
+/** The word the frame carries. Deliberately the operator's vocabulary. */
+export declare function courtesyLabel(reason: CourtesyReason): string;
+/**
+ * Background per reason. A disabled camera is a DELIBERATE state and must not
+ * read as an alarm, so it is neutral grey; offline is a fault and is warmer.
+ */
+export declare function courtesyBackground(reason: CourtesyReason): string;
+/** XML escaping for text placed inside an SVG `<text>` node. */
+export declare function escapeCourtesyText(value: string): string;
+export interface CourtesyFrameSpec {
+    readonly deviceName: string;
+    readonly reason: CourtesyReason;
+    readonly width: number;
+    readonly height: number;
+}
+/**
+ * The SVG the frame is rasterized from: the state large and centred, the
+ * camera's name under it, smaller and dimmer.
+ *
+ * Sizes derive from the width so a 240 px grid tile and a 1920 px full-bleed
+ * frame read the same, with a floor so a thumbnail stays legible.
+ */
+export declare function buildCourtesySvg(spec: CourtesyFrameSpec): string;
+/** Cache key — a courtesy frame is a pure function of these four. */
+export declare function courtesyCacheKey(spec: CourtesyFrameSpec): string;
+/**
+ * Render the frame.
+ *
+ * Rejects on failure — the caller decides what to do, exactly as `resizeJpeg`
+ * does, so a broken courtesy path is never mistaken for a broken camera.
+ */
+export declare function renderCourtesyJpeg(spec: CourtesyFrameSpec): Promise<Buffer>;

package/dist/builtins/snapshot/snapshot-resize.d.ts

@@ -7,24 +7,56 @@
  * ffmpeg filter chain to hook into. Resizing the finished bytes gives both the
  * same behaviour with one implementation.
  *
- * The cost is one ffmpeg run per (device, stream, width) per cache window — not
- * one per request. A camera whose card is on screen pays it once every
- * `snapshotMaxAgeS`.
+ * ── Why sharp and not ffmpeg (2026-08-11) ─────────────────────────────────
+ * This used to `spawn('ffmpeg')` per resize. The snapshot wrapper is a system
+ * builtin, so it loads in the hub's ROOT process: sampled on the live hub,
+ * ~1.6 of those children were running at any instant, every one of them
+ * parented by the root PID.
  *
- * `ffmpeg` is already this addon's dependency (the keyframe grab shells out to
- * it), so this adds no new one.
+ * Be precise about what that cost the root process, because it is easy to
+ * overstate. The transcode itself ran in the CHILD and was charged to ffmpeg
+ * (16 % + 13 % of a core in that same sample), not to the parent. What the
+ * parent paid was the fork, the exec, the JPEG written into one pipe and read
+ * back out of the other, and the base64 — real event-loop work, on the loop
+ * that also serves the tRPC API, but NOT the 52 ms below.
+ *
+ * Benchmarked in that container, 2560×1440 → 640 wide, wall-clock per resize:
+ *
+ *     ffmpeg   52.0 ms   (fork + exec + pipe round-trip + teardown)
+ *     sharp     4.8 ms   (in-process libvips, on its own threadpool)
+ *
+ * So this removes ~29 % of a core of container CPU and the per-resize process
+ * churn from the root process. It was NOT verified to be the cause of that
+ * process sitting at 90 % — nobody has profiled it.
+ *
+ * `sharp` is not a new dependency: it is already a host-external
+ * (`HOST_EXTERNAL_SPECIFIERS`), already resolved from the framework closure at
+ * runtime, and already used by the terminal frame renderer. The build preset
+ * keeps it out of the bundle, so this import costs nothing at pack time.
+ *
+ * The cost is still one resize per (device, stream, width) per cache window —
+ * not one per request. What changed is what a resize COSTS.
  */
 /** Runs the resize. Injected so the caller is testable without a real ffmpeg. */
 export type JpegResizer = (bytes: Buffer, width: number) => Promise<Buffer>;
 export declare const RESIZE_TIMEOUT_MS = 10000;
 /**
- * Scale to `width`, preserving aspect ratio (`-2` keeps the height even, which
- * mjpeg requires).
+ * Scale to `width`, preserving aspect ratio.
+ *
+ * Rejects on failure or timeout. It NEVER falls back to the original silently —
+ * a caller that quietly served the 4K frame when the resize failed would
+ * reproduce exactly the bug this whole module exists to fix, and nobody would
+ * see it. The caller decides, and logs.
  *
- * Rejects on a non-zero exit or a timeout. It NEVER falls back to the original
- * silently — a caller that quietly served the 4K frame when the resize failed
- * would reproduce exactly the bug this whole change exists to fix, and nobody
- * would see it. The caller decides, and logs.
+ * It DOES upscale a source narrower than `width`, and that is deliberate. A
+ * `withoutEnlargement: true` was tried first — it is the obvious saving, since
+ * upscaling pays encode cost for a blurrier, larger image. But the caller
+ * stamps the response ETag from the width it asked for, and its resize-FAILURE
+ * path already returns `width: undefined` specifically so a response can never
+ * "claim a width the bytes do not have". Silently returning 320 px bytes for a
+ * `w=640` request breaks that invariant on the SUCCESS path, where nobody is
+ * looking. Honest output width beats a few saved pixels; revisit only together
+ * with the ETag.
  */
 export declare function resizeJpeg(bytes: Buffer, width: number, timeoutMs?: number): Promise<Buffer>;
 /**

package/dist/builtins/snapshot/snapshot.addon.d.ts

@@ -34,6 +34,15 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
     /** Card-sized derivatives of the frames above, keyed by width and validated
      *  against the source frame's timestamp. */
     private readonly variants;
+    /**
+     * Rendered courtesy frames, by (reason, size, device name).
+     *
+     * A courtesy frame is a pure function of those three, so it is rendered once
+     * and reused for as long as the process lives — a disabled camera must not
+     * cost an ffmpeg run per poll. Unbounded on purpose: the key space is
+     * (3 reasons × this node's own cameras), not user input.
+     */
+    private readonly courtesyFrames;
     /**
      * De-dupes concurrent captures per `${deviceId}:${streamId}` and holds a
      * settled SUCCESS for COALESCE_MS so a grid-mount burst (and a row of refresh
@@ -72,17 +81,6 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      *  secret that rolled on every boot would invalidate every link a client is
      *  currently holding, which is a fleet-wide blank grid after each restart. */
     private linkSecret;
-    /**
-     * Who is being looked at, inferred from data-plane traffic. The keep-warm
-     * loop's entire bound — see `snapshot-keep-warm.ts`.
-     */
-    private readonly subscriptions;
-    /** Chained warm-tick timer (never `setInterval` — see `scheduleWarmTick`). */
-    private warmTimer;
-    /** Set while a warm tick is running so ticks can never stack. */
-    private warmTickRunning;
-    /** Flipped on shutdown so an in-flight tick does not reschedule itself. */
-    private stopped;
     /**
      * How a full frame becomes a card-sized one. Defaults to the real ffmpeg
      * resize; injectable so the wrapper's own logic is testable without spawning a
@@ -190,40 +188,6 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      * which is the exact staleness this change exists to remove.
      */
     private peekFreshFrame;
-    /**
-     * Schedule the next warm tick. A CHAINED timer, not `setInterval`: the next
-     * tick is armed only after the previous one settles, so a fleet that is slower
-     * than the interval degrades to "as fast as it can" instead of stacking ticks
-     * on top of each other and exhausting the ffmpeg pool.
-     *
-     * `unref` so the loop never holds the process open.
-     */
-    private scheduleWarmTick;
-    /**
-     * Refresh the cache for every camera somebody is currently looking at.
-     *
-     * Deliberately NOT a blind poll of the whole fleet: with nobody watching this
-     * walks an empty list and costs nothing, which is the entire difference
-     * between this and a background poller.
-     *
-     * Battery cameras need no special case here and must not get one. A warm tick
-     * is a plain non-forced `getSnapshot`, so it meets the two gates that already
-     * exist — the 3600 s battery max-age (which makes the tick a cache hit) and
-     * the sleeping-battery gate (which refuses to capture without `force`). A
-     * second battery check here would be a rule that disagrees with the authority
-     * that already owns it.
-     */
-    private runWarmTick;
-    /**
-     * Warm one (device, stream): refresh the frame, then pre-derive the widths
-     * that were actually requested.
-     *
-     * Deriving the variants matters as much as the capture. Warming only the full
-     * frame would leave every grid tile still paying an ffmpeg resize on the
-     * request path — the cache would be fresh and the tile would still be slow.
-     */
-    private warmOne;
-    private warmOneUnbounded;
     /**
      * The frame at a card-sized width, derived once per (device, stream, width)
      * per capture.
@@ -253,6 +217,16 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      * and no cache propagates.
      */
     private resolveOutcome;
+    /**
+     * Reconcile backstop for a stale hit: is the frame we are about to serve the
+     * property of a device that no longer exists?
+     *
+     * Asked ONLY past `staleTtlMs`, which is already the "something is wrong"
+     * threshold — so the common path costs nothing. A `true` answer evicts and
+     * the caller returns null; anything else leaves the existing
+     * keep-the-UI-from-going-blank contract untouched.
+     */
+    private staleHitBelongsToRemovedDevice;
     /**
      * Run the capture ladder ONCE for a device: native provider first, then the
      * stream-broker ffmpeg fallback. Never rejects — resolves a {@link
@@ -325,6 +299,25 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      */
     private runGrabWithResumeRetry;
     private invalidateCache;
+    /** Forget every cached artefact of one device: frames, derived variants and
+     *  any settled single-flight result that would answer the next request. */
+    private dropDeviceCaches;
+    /**
+     * The device is GONE — drop its cached frames and say so.
+     *
+     * Distinct from `invalidateCache` (a refresh, expected and silent): this is
+     * the terminal case, and a deleted camera that keeps answering with its last
+     * JPEG looks to an operator exactly like a camera that was never deleted.
+     */
+    private evictRemovedDevice;
+    /**
+     * Does device-manager still know this id?
+     *
+     * `null` means the question could not be answered — a transport hiccup is
+     * not a deletion (D49), and the caller keeps serving what it has. Only an
+     * explicit "no such device" evicts.
+     */
+    private deviceStillExists;
     /**
      * Sleep state from the device-state MIRROR, not from a cap round-trip.
      *
@@ -378,6 +371,20 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
     private getStatus;
     private readDeviceSettings;
     private buildDeviceSettingsContribution;
+    /**
+     * The frame a camera that CANNOT capture answers with.
+     *
+     * Returns null only if rendering itself fails — the caller then falls through
+     * to its previous behaviour, so a broken courtesy path degrades to the old
+     * 404 rather than masking a real capture failure as a placeholder.
+     *
+     * Rendered at the full tile size; the existing resize ladder derives the
+     * card-sized variants from it exactly as it does for a real frame, so no
+     * downstream consumer needs to know this frame is synthetic.
+     */
+    private courtesyFrame;
+    /** A courtesy frame shaped as the cap's response, or null when unrenderable. */
+    private courtesyImage;
     /**
      * Single-trip device lookup against device-manager. Returns the
      * fields the wrapper actually consults — name (logging) + battery

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-cINpngi1.js");
+const require_dist = require("../../dist-CA2mim74.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { gt as BaseAddon, ut as storageProviderCapability, z as filesystemBrowseCapability } from "../../dist-CIIFhXqm.mjs";
+import { gt as BaseAddon, ut as storageProviderCapability, z as filesystemBrowseCapability } from "../../dist-DZOZtn-0.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-cINpngi1.js");
+const require_dist = require("../../dist-CA2mim74.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { A as decodeVectorBase64, Et as asJsonObject, Lt as parseJsonUnknown, f as RUNTIME_DEFAULTS, gt as BaseAddon, ht as errMsg, k as dataStoreProviderCapability, mt as vectorStoreCapability, pt as vectorDimFromBase64, w as bareAddonId } from "../../dist-CIIFhXqm.mjs";
+import { A as decodeVectorBase64, Et as asJsonObject, Lt as parseJsonUnknown, f as RUNTIME_DEFAULTS, gt as BaseAddon, ht as errMsg, k as dataStoreProviderCapability, mt as vectorStoreCapability, pt as vectorDimFromBase64, w as bareAddonId } from "../../dist-DZOZtn-0.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-cINpngi1.js");
+const require_dist = require("../../dist-CA2mim74.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { It as parseJsonObject, ct as storageCapability, g as StorageMigrationJobSchema, gt as BaseAddon, h as StorageLocationTypeSchema, lt as storageMigrationCapability, ot as settingsStoreCapability } from "../../dist-CIIFhXqm.mjs";
+import { It as parseJsonObject, ct as storageCapability, g as StorageMigrationJobSchema, gt as BaseAddon, h as StorageLocationTypeSchema, lt as storageMigrationCapability, ot as settingsStoreCapability } from "../../dist-DZOZtn-0.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-cINpngi1.js");
+const require_dist = require("../../dist-CA2mim74.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Nt as hydrateSchema, gt as BaseAddon, ht as errMsg } from "../../dist-CIIFhXqm.mjs";
+import { Nt as hydrateSchema, gt as BaseAddon, ht as errMsg } from "../../dist-DZOZtn-0.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-cINpngi1.js");
+const require_dist = require("../../dist-CA2mim74.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { J as logDestinationCapability, gt as BaseAddon } from "../../dist-CIIFhXqm.mjs";
+import { J as logDestinationCapability, gt as BaseAddon } from "../../dist-DZOZtn-0.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-cINpngi1.js → dist-CA2mim74.js}

@@ -17500,24 +17500,28 @@ var snapshotCapability = {
 		*
 		* `getSnapshotOverview` is cache-only by contract: it answers from whatever
 		* the wrapper happens to hold and never captures. Under D93 the client
-		* versions its image URL on that answer, and an image REQUEST is what enrols
-		* a camera in the keep-warm loop. Both of those are satisfiable by the
-		* client's own image cache — `expo-image` is URL-keyed and never revalidates
-		* — so a URL painted in a previous session comes off disk with no network,
-		* no enrolment, and nothing warming. Measured on the live hub: reopening
-		* after two minutes idle painted 15 of 16 tiles at **168 s old** with zero
-		* HTTP requests, and the fleet only recovered because a later poll happened
-		* to observe a different identity.
+		* versions its image URL on that answer, and an image REQUEST was the only
+		* demand signal. Both of those are satisfiable by the client's own image
+		* cache — `expo-image` is URL-keyed and never revalidates — so a URL painted
+		* in a previous session comes off disk with no network, no demand, and no
+		* capture. Measured on the live hub: reopening after two minutes idle
+		* painted 15 of 16 tiles at **168 s old** with zero HTTP requests, and the
+		* fleet only recovered because a later poll happened to observe a different
+		* identity.
 		*
 		* ## The two properties that fix it
 		*
 		* **It is an RPC, so no client cache can answer it.** The demand signal
-		* always reaches the wrapper. This method therefore MAY create keep-warm
-		* subscriptions, where `getSnapshotOverview` must never (D93) — the
-		* distinction is not "one is newer" but that the overview poll is app-wide
-		* (a creating overview would warm every camera on the install) while this is
-		* called by a rendered surface naming the tiles it is actually painting, at
-		* the width it is painting them.
+		* always reaches the wrapper. This method therefore CAPTURES, where
+		* `getSnapshotOverview` must never (D93) — the distinction is not "one is
+		* newer" but that the overview poll is app-wide (a capturing overview would
+		* dial every camera on the install) while this is called by a rendered
+		* surface naming the tiles it is actually painting, at the width it is
+		* painting them.
+		*
+		* Since 2026-08-11 this is the ONLY thing that refreshes a snapshot: the
+		* server-side keep-warm loop was removed (operator directive — on-demand,
+		* always), so a camera nobody is looking at costs nothing at all.
 		*
 		* **It waits, briefly and boundedly, for the capture it triggered.** The
 		* returned `capturedAt` is the frame the link will serve, not the frame the
@@ -27344,9 +27348,10 @@ var DeclaredDevices = class {
 		}
 		const integrationId = spec.integrationId ?? await this.ensureIntegration(spec.integrationName);
 		const index = await this.readIndex();
+		const live = await this.readLiveByStableId();
 		const outcomes = [];
 		for (const declaration of spec.devices) {
-			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			const outcome = await this.applyDeclaration(declaration, integrationId, index, live);
 			if (outcome !== null) outcomes.push(outcome);
 		}
 		return {
@@ -27392,6 +27397,26 @@ var DeclaredDevices = class {
 		return new Map(rows.map((row) => [row.stableId, row]));
 	}
 	/**
+	* Devices this kernel already has CONSTRUCTED, by stableId.
+	*
+	* Distinct from {@link readIndex}, and the distinction is the bug: the index
+	* is persisted rows, this is live objects. A row without an object must be
+	* adopted; an object must be left exactly as it is.
+	*
+	* Failure is non-fatal and deliberately so — an empty map degrades to the
+	* previous behaviour (attempt the adopt) rather than skipping a device that
+	* genuinely needs bringing up.
+	*/
+	async readLiveByStableId() {
+		try {
+			const devices = await this.ports.devices.getAll();
+			return new Map(devices.map((device) => [device.stableId, device]));
+		} catch (err) {
+			this.ports.logger.warn("could not read live devices — falling back to adopt-by-row", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
 	* One declaration: adopt what exists, create what does not.
 	*
 	* The create branch is the destructive one — it seeds `initialMeta`, and
@@ -27400,8 +27425,15 @@ var DeclaredDevices = class {
 	* the declared name over the operator's rename. D49: that branch needs a
 	* second read to agree.
 	*/
-	async applyDeclaration(declaration, integrationId, index) {
+	async applyDeclaration(declaration, integrationId, index, live) {
 		try {
+			const alreadyLive = live.get(declaration.stableId);
+			if (alreadyLive !== void 0) return {
+				stableId: declaration.stableId,
+				deviceId: alreadyLive.id,
+				device: alreadyLive,
+				created: false
+			};
 			let existing = index.get(declaration.stableId);
 			if (existing === void 0) {
 				existing = (await this.readIndex()).get(declaration.stableId);

package/dist/{dist-CIIFhXqm.mjs → dist-DZOZtn-0.mjs}

@@ -17500,24 +17500,28 @@ var snapshotCapability = {
 		*
 		* `getSnapshotOverview` is cache-only by contract: it answers from whatever
 		* the wrapper happens to hold and never captures. Under D93 the client
-		* versions its image URL on that answer, and an image REQUEST is what enrols
-		* a camera in the keep-warm loop. Both of those are satisfiable by the
-		* client's own image cache — `expo-image` is URL-keyed and never revalidates
-		* — so a URL painted in a previous session comes off disk with no network,
-		* no enrolment, and nothing warming. Measured on the live hub: reopening
-		* after two minutes idle painted 15 of 16 tiles at **168 s old** with zero
-		* HTTP requests, and the fleet only recovered because a later poll happened
-		* to observe a different identity.
+		* versions its image URL on that answer, and an image REQUEST was the only
+		* demand signal. Both of those are satisfiable by the client's own image
+		* cache — `expo-image` is URL-keyed and never revalidates — so a URL painted
+		* in a previous session comes off disk with no network, no demand, and no
+		* capture. Measured on the live hub: reopening after two minutes idle
+		* painted 15 of 16 tiles at **168 s old** with zero HTTP requests, and the
+		* fleet only recovered because a later poll happened to observe a different
+		* identity.
 		*
 		* ## The two properties that fix it
 		*
 		* **It is an RPC, so no client cache can answer it.** The demand signal
-		* always reaches the wrapper. This method therefore MAY create keep-warm
-		* subscriptions, where `getSnapshotOverview` must never (D93) — the
-		* distinction is not "one is newer" but that the overview poll is app-wide
-		* (a creating overview would warm every camera on the install) while this is
-		* called by a rendered surface naming the tiles it is actually painting, at
-		* the width it is painting them.
+		* always reaches the wrapper. This method therefore CAPTURES, where
+		* `getSnapshotOverview` must never (D93) — the distinction is not "one is
+		* newer" but that the overview poll is app-wide (a capturing overview would
+		* dial every camera on the install) while this is called by a rendered
+		* surface naming the tiles it is actually painting, at the width it is
+		* painting them.
+		*
+		* Since 2026-08-11 this is the ONLY thing that refreshes a snapshot: the
+		* server-side keep-warm loop was removed (operator directive — on-demand,
+		* always), so a camera nobody is looking at costs nothing at all.
 		*
 		* **It waits, briefly and boundedly, for the capture it triggered.** The
 		* returned `capturedAt` is the frame the link will serve, not the frame the
@@ -27344,9 +27348,10 @@ var DeclaredDevices = class {
 		}
 		const integrationId = spec.integrationId ?? await this.ensureIntegration(spec.integrationName);
 		const index = await this.readIndex();
+		const live = await this.readLiveByStableId();
 		const outcomes = [];
 		for (const declaration of spec.devices) {
-			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			const outcome = await this.applyDeclaration(declaration, integrationId, index, live);
 			if (outcome !== null) outcomes.push(outcome);
 		}
 		return {
@@ -27392,6 +27397,26 @@ var DeclaredDevices = class {
 		return new Map(rows.map((row) => [row.stableId, row]));
 	}
 	/**
+	* Devices this kernel already has CONSTRUCTED, by stableId.
+	*
+	* Distinct from {@link readIndex}, and the distinction is the bug: the index
+	* is persisted rows, this is live objects. A row without an object must be
+	* adopted; an object must be left exactly as it is.
+	*
+	* Failure is non-fatal and deliberately so — an empty map degrades to the
+	* previous behaviour (attempt the adopt) rather than skipping a device that
+	* genuinely needs bringing up.
+	*/
+	async readLiveByStableId() {
+		try {
+			const devices = await this.ports.devices.getAll();
+			return new Map(devices.map((device) => [device.stableId, device]));
+		} catch (err) {
+			this.ports.logger.warn("could not read live devices — falling back to adopt-by-row", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
 	* One declaration: adopt what exists, create what does not.
 	*
 	* The create branch is the destructive one — it seeds `initialMeta`, and
@@ -27400,8 +27425,15 @@ var DeclaredDevices = class {
 	* the declared name over the operator's rename. D49: that branch needs a
 	* second read to agree.
 	*/
-	async applyDeclaration(declaration, integrationId, index) {
+	async applyDeclaration(declaration, integrationId, index, live) {
 		try {
+			const alreadyLive = live.get(declaration.stableId);
+			if (alreadyLive !== void 0) return {
+				stableId: declaration.stableId,
+				deviceId: alreadyLive.id,
+				device: alreadyLive,
+				created: false
+			};
 			let existing = index.get(declaration.stableId);
 			if (existing === void 0) {
 				existing = (await this.readIndex()).get(declaration.stableId);

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-cINpngi1.js");
+const require_dist = require("./dist-CA2mim74.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as objectInputDeclaresAddonId, At as emitDownForOwnedCaps, B as isArrayOutputSchema, Bt as scopeKey, Ct as ReadinessRegistry, Dt as asNumber, Et as asJsonObject$1, G as kebabToCamel, H as isObjectInput, Ht as EventCategory$1, It as parseJsonObject, K as lifecycleJobSchema, Lt as parseJsonUnknown$1, Mt as expandCapMethods, Ot as asString$1, R as extractNestedAddonId, Rt as readinessKey, V as isCollectionArrayMethod, W as isVoidInput, X as looseSchema, Y as logLevelAtMost, _t as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, ht as errMsg$1, it as scopesAllowDeviceCap, kt as createEvent, nt as procedureAuthKey, rt as scopesAllowAddon, t as ALL_CAPABILITY_DEFINITIONS, vt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, wt as ReadinessTimeoutError, y as addonSettingsCapability, yt as DEVICE_STATUS_METHOD, zt as resolveCapMount } from "./dist-CIIFhXqm.mjs";
+import { $ as objectInputDeclaresAddonId, At as emitDownForOwnedCaps, B as isArrayOutputSchema, Bt as scopeKey, Ct as ReadinessRegistry, Dt as asNumber, Et as asJsonObject$1, G as kebabToCamel, H as isObjectInput, Ht as EventCategory$1, It as parseJsonObject, K as lifecycleJobSchema, Lt as parseJsonUnknown$1, Mt as expandCapMethods, Ot as asString$1, R as extractNestedAddonId, Rt as readinessKey, V as isCollectionArrayMethod, W as isVoidInput, X as looseSchema, Y as logLevelAtMost, _t as DATAPLANE_SECRET_HEADER$1, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, ht as errMsg$1, it as scopesAllowDeviceCap, kt as createEvent, nt as procedureAuthKey, rt as scopesAllowAddon, t as ALL_CAPABILITY_DEFINITIONS, vt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, wt as ReadinessTimeoutError, y as addonSettingsCapability, yt as DEVICE_STATUS_METHOD, zt as resolveCapMount } from "./dist-DZOZtn-0.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.79",
+  "version": "1.2.81",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",