@camstack/types 1.2.126 → 1.2.128

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BaEgqJNv.js");
-const require_sleep = require("./sleep-CWWLTM6W.js");
+const require_sleep = require("./sleep-C3AniWy-.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -2252,6 +2252,21 @@ var RelocateJobSchema = zod.z.object({
 	bytesMoved: zod.z.number().int(),
 	/** Total files discovered up front; null while (or when) unknown. */
 	filesTotal: zod.z.number().int().nullable(),
+	/**
+	* Rows this run CORRECTED while moving them — a durable mutation the move
+	* made that nobody asked for, so it is reported where the operator reads the
+	* job rather than only in a log line.
+	*
+	* A footage segment records its byte count in its own NAME, and the durable
+	* hour row derives its aggregates from those names. A file that does not
+	* match its name therefore makes the ledger's sums — and with them quota and
+	* pressure eviction — wrong by the difference, and only a rename can fix it.
+	* On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+	*
+	* Absent on lanes where the question has no meaning: a media blob's size is
+	* in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+	*/
+	rowsReconciled: zod.z.number().int().nonnegative().optional(),
 	startedAt: zod.z.number(),
 	finishedAt: zod.z.number().nullable(),
 	error: zod.z.string().nullable()
@@ -2320,14 +2335,42 @@ var RelocateMediaInputSchema = zod.z.object({
 	/** Omitted = `move`, the pre-existing behaviour. */
 	mode: MediaRelocateModeSchema.optional()
 });
-/** How many rows still carry NO `locationId` — the population a repoint would
-*  silently re-aim at a disk that does not hold their bytes. Zero is the only
-*  value that permits a non-blocking `eventMedia` cutover. */
-var UnstampedEventMediaCountSchema = zod.z.object({
-	media: zod.z.number().int().nonnegative(),
-	retrainFrames: zod.z.number().int().nonnegative(),
-	total: zod.z.number().int().nonnegative()
+/**
+* The unstamped population of ONE collection — split, because the gate and the
+* operator ask two different questions and only one of them has to be cheap.
+*
+* `present` is the GATE: "is there at least one row that would be orphaned by a
+* repoint". It is a single indexed seek to the first matching row, so it stays
+* answerable on a saturated disk and answers in O(log n) precisely in the state
+* that matters — after a seal, when the population is empty.
+*
+* `rows` is the NUMBER, for the refusal message and the operator's sense of
+* scale. It is a second, indexed `COUNT(*)`, and `null` means **not
+* measurable** — never zero. `{ present: true, rows: null }` is a legitimate
+* and useful answer: "there are some, and this read could not say how many"
+* still refuses the cutover, which is the whole job.
+*/
+var UnstampedRowsSchema = zod.z.object({
+	present: zod.z.boolean(),
+	rows: zod.z.number().int().nonnegative().nullable()
 });
+/**
+* How many rows still carry NO `locationId` — the population a repoint would
+* silently re-aim at a disk that does not hold their bytes.
+*
+* **`null` = the count could not be taken**, and it is NOT permission to cut
+* over. The gate opens on a measured absence and on nothing else; an unread
+* collection and an empty one are different facts, and this repo has already
+* paid for conflating them (`RelocateResidueSchema`, D295).
+*/
+var UnstampedEventMediaCountSchema = zod.z.object({
+	media: UnstampedRowsSchema,
+	retrainFrames: UnstampedRowsSchema,
+	/** True when EITHER collection holds one. The refusal reads this. */
+	anyPresent: zod.z.boolean(),
+	/** Sum across both, or `null` when either lane could not be counted. */
+	total: zod.z.number().int().nonnegative().nullable()
+}).nullable();
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -2438,6 +2481,10 @@ var StorageMigrationMoveProgressSchema = zod.z.object({
 	/** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
 	filesTotal: zod.z.number().int().nonnegative().nullable(),
 	bytesMoved: zod.z.number().int().nonnegative(),
+	/** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+	*  a lane that cannot reconcile. A migration that silently rewrote durable
+	*  rows would be the same failure as one that silently skipped them. */
+	rowsReconciled: zod.z.number().int().nonnegative().optional(),
 	/** The MOVER's start, not the migration's: a drain restarted after an addon
 	*  crash gets a new mover, and a rate computed from the migration's start
 	*  would silently average in the time nothing was running. */
@@ -10516,6 +10563,15 @@ var deviceManagerCapability = {
 		* calls are sync. Bindings change rarely (only on wrapper toggle or
 		* device add/remove) — clients invalidate via the
 		* `capability.binding-changed` event.
+		*
+		* "A single round-trip" describes the CLIENT's side and used not to
+		* describe the server's: until 2026-08-30 the resolver read the persisted
+		* wrapper activations once per device, so answering this cost one
+		* settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+		* it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+		* The server side is now two reads for the whole fleet. Anything PERIODIC
+		* still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+		* a warm seed.
 		*/
 		getAllBindings: require_sleep.method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
 		/**
@@ -10948,6 +11004,135 @@ var embeddingEncoderCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/failure-contribution.cap.ts
+/**
+* `failure-contribution` — the capability an addon reports its OWN losses
+* through, per camera, with the denominator attached. It stores nothing.
+*
+* ## The twin of `load-contribution`, and why it is a twin and not a field
+*
+* `load-contribution` answers *what did this camera COST*. This answers *what
+* did this camera LOSE*. The reporting discipline is identical and deliberately
+* copied: the contributor reports what it already knows, hub-main adds only
+* `addonId`, nothing needs global knowledge, and there is no central list for
+* somebody to forget to edit.
+*
+* They are not merged, because their invariants are opposites:
+*
+*  - a `load-contribution` measurement is **absent, never zero** — a zero would
+*    claim a camera cost nothing, which is a measurement nobody made;
+*  - a `failure-contribution` zero is the **most valuable value on the
+*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
+*    and it is exactly what an absent entry cannot say.
+*
+* Putting a loss counter on a cost entry would also break the reconciliation
+* that gives `load-contribution` its point: contributions are subtracted from
+* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
+* has no process.
+*
+* ## Why not a log line, since the counters already exist
+*
+* Several of these paths already counted themselves — `CaptureScheduler`'s
+* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
+* ends in a log line, and a log line is the thing the operator asked to stop
+* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
+* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
+* media blackout were both diagnosed. The counters stay; this is where they can
+* be READ.
+*
+* ## The rate is served with its denominator or not at all
+*
+* Every entry carries `attempts` and `succeeded`. A miss count alone is
+* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
+* than yesterday" and was **flat across twelve hours** once divided by the
+* successes on the same path. A surface that publishes only the numerator
+* reproduces that mistake on every read.
+*
+* ## Shape
+*
+* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
+* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
+* generated hooks, while `addons.listCapabilityProviders` still enumerates it
+* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
+* a forked runner's entries reach hub-main over transport that already exists.
+* No new UDS message, no second registry (D3). The operator reads the assembled
+* result through `system.getFailureContributions`.
+*/
+var FailureReasonCountSchema = zod.z.object({
+	/**
+	* Why the attempt did not land, in the contributor's own vocabulary —
+	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+	* strings that already appear in this repo's logs and, where one exists, the
+	* same string the per-track `previewMissReason` records (D276): a second
+	* vocabulary for the same loss would make the row and the counter
+	* un-joinable.
+	*/
+	reason: zod.z.string(),
+	count: zod.z.number().int().nonnegative()
+});
+var FailureContributionSchema = zod.z.object({
+	/**
+	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+	* `unit` free: the families are owned by different addons and a shared enum
+	* is a central list that rots invisibly.
+	*/
+	family: zod.z.string(),
+	/**
+	* The NUMERIC device id — the same value every log line carries as
+	* `tags.deviceId`. Never nullable and never absent: a contributor that
+	* cannot name the camera must not emit the entry, because a fleet total
+	* cannot answer the only question anybody asks of this surface.
+	*/
+	deviceId: zod.z.number().int().positive(),
+	/**
+	* A second dimension inside the family: the model / step id for an inference
+	* timeout, so "which camera AND which model" is one read. Absent when the
+	* family has a single variant.
+	*/
+	variant: zod.z.string().optional(),
+	/**
+	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
+	* differencing two reads must drop the interval when it changes, because the
+	* counter restarted from zero in a respawned runner. Same discipline as
+	* `LoadContribution.startedAtMs`.
+	*/
+	sinceMs: zod.z.number(),
+	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+	atMs: zod.z.number(),
+	/**
+	* THE DENOMINATOR — every attempt on this path for this camera in the
+	* window. A failure count published without it is the mistake this schema
+	* exists to make impossible.
+	*/
+	attempts: zod.z.number().int().nonnegative(),
+	/** Attempts that landed. `attempts - succeeded` is the loss. */
+	succeeded: zod.z.number().int().nonnegative(),
+	/** The loss, partitioned. Sums to `attempts - succeeded`. */
+	reasons: zod.z.array(FailureReasonCountSchema).readonly()
+});
+var failureContributionCapability = {
+	name: "failure-contribution",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* This addon's per-camera failure counters, read live from bounded in-RAM
+	* state it already keeps. Inert: no persistence, no sampling, no timer.
+	*
+	* READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+	* consumer that wants a rate differences two reads. A draining read would
+	* make two operators with the page open each destroy half of the other's
+	* numbers, and `load-contribution` already settled the same question the
+	* same way for `cpuSeconds`.
+	*/
+list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly()) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+//#endregion
 //#region src/capabilities/filesystem-browse.cap.ts
 /**
 * filesystem-browse — per-node capability for browsing the node's local
@@ -11588,246 +11773,6 @@ var llmCapability = {
 	}
 };
 //#endregion
-//#region src/capabilities/log-channels.cap.ts
-/**
-* `log-channels` — the capability an addon DECLARES its diagnostic channels
-* through. It stores nothing.
-*
-* ## Why a capability at all, and why this shape
-*
-* Which channels exist is knowledge only the addon has: `stream-broker` knows
-* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
-* maintained by hand rots at the first addition and rots INVISIBLY — nothing
-* fails, an operator just never sees the channel somebody added. So the list
-* is assembled from declarations at runtime.
-*
-* The shape is copied from `log-destination.cap.ts`, which already does
-* exactly this job: `mode: 'collection'`, `internal: true`,
-* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
-* `addons.listCapabilityProviders` still enumerates it, and the hub's
-* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
-* runner's declarations reach hub-main over the transport that already exists.
-* No new UDS message, no second registry.
-*
-* ## What it deliberately does NOT own
-*
-* The VALUES — which channel is armed, for which cameras, until when — live in
-* ONE place: the logging settings document on the `system` cap
-* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
-* value is the defect the plan behind this work exists to remove, and
-* `setRequestCensus` was retired (D245) rather than allowed to be a second
-* one. {@link logChannelsCapability} therefore has no getter for a level, no
-* setter for a window and no persistence of any kind.
-*
-* ## Why `apply` is here even so
-*
-* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
-* seam has to carry the value from the authority to the mirror, and a channel
-* that cannot be reached is precisely the dead knob this whole slice exists to
-* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
-* `apply` is that seam and nothing more: it writes an in-memory mirror, it
-* persists nothing, it is never the source of a value, and it is called only
-* with a set the hub actually read (D49 — a read that fails does not call it
-* at all, so no channel is silently disarmed by a bad read).
-*/
-/** What `apply` reports back — enough to log, not enough to be a second state. */
-var LogChannelApplyResultSchema = zod.z.object({
-	/** How many declared channels are armed in this process after the call. */
-	armed: zod.z.number().int().min(0),
-	/**
-	* Names the document armed that this process does not declare. Reported
-	* rather than swallowed: a name here is either a typo or an addon that has
-	* not booted, and both deserve a line instead of silence.
-	*/
-	unknown: zod.z.array(zod.z.string()).readonly()
-});
-var logChannelsCapability = {
-	name: "log-channels",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		/** The channels this addon declares. Inert: no value, no state. */
-		list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
-		/**
-		* Refresh this process's mirror from the document's FULL set of armed
-		* windows.
-		*
-		* Full and not incremental on purpose: the document is the authority, so a
-		* channel it does not name is disarmed here. An incremental apply would
-		* let a disarm get lost in transit and leave a channel running that
-		* nobody can see is running.
-		*/
-		apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-	},
-	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
-	mount: { kind: "skip" }
-};
-//#endregion
-//#region src/capabilities/log-destination.cap.ts
-var LogLevelSchema = zod.z.enum([
-	"debug",
-	"info",
-	"warn",
-	"error"
-]);
-var LogEntrySchema = zod.z.object({
-	timestamp: zod.z.date(),
-	level: LogLevelSchema,
-	scope: zod.z.array(zod.z.string()),
-	message: zod.z.string(),
-	meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-});
-var logDestinationCapability = {
-	name: "log-destination",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-		query: require_sleep.method(zod.z.object({
-			scope: zod.z.array(zod.z.string()).optional(),
-			level: LogLevelSchema.optional(),
-			since: zod.z.date().optional(),
-			until: zod.z.date().optional(),
-			limit: zod.z.number().optional(),
-			tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-		}), zod.z.array(LogEntrySchema).readonly())
-	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-	mount: { kind: "skip" }
-};
-//#endregion
-//#region src/capabilities/failure-contribution.cap.ts
-/**
-* `failure-contribution` — the capability an addon reports its OWN losses
-* through, per camera, with the denominator attached. It stores nothing.
-*
-* ## The twin of `load-contribution`, and why it is a twin and not a field
-*
-* `load-contribution` answers *what did this camera COST*. This answers *what
-* did this camera LOSE*. The reporting discipline is identical and deliberately
-* copied: the contributor reports what it already knows, hub-main adds only
-* `addonId`, nothing needs global knowledge, and there is no central list for
-* somebody to forget to edit.
-*
-* They are not merged, because their invariants are opposites:
-*
-*  - a `load-contribution` measurement is **absent, never zero** — a zero would
-*    claim a camera cost nothing, which is a measurement nobody made;
-*  - a `failure-contribution` zero is the **most valuable value on the
-*    surface** — `attempts: 400, succeeded: 400` is the proof a fix landed,
-*    and it is exactly what an absent entry cannot say.
-*
-* Putting a loss counter on a cost entry would also break the reconciliation
-* that gives `load-contribution` its point: contributions are subtracted from
-* `metrics.node-processes-snapshot` to find processes nobody claims. A failure
-* has no process.
-*
-* ## Why not a log line, since the counters already exist
-*
-* Several of these paths already counted themselves — `CaptureScheduler`'s
-* per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
-* ends in a log line, and a log line is the thing the operator asked to stop
-* needing: *"possiamo armare questi errori intanto? Così al prossimo giro
-* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
-* hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
-* media blackout were both diagnosed. The counters stay; this is where they can
-* be READ.
-*
-* ## The rate is served with its denominator or not at all
-*
-* Every entry carries `attempts` and `succeeded`. A miss count alone is
-* unreadable: on 2026-08-28 the enrichment-crop miss count read as "35x worse
-* than yesterday" and was **flat across twelve hours** once divided by the
-* successes on the same path. A surface that publishes only the numerator
-* reproduces that mistake on every read.
-*
-* ## Shape
-*
-* Copied from `load-contribution.cap.ts` (`mode: 'collection'`,
-* `internal: true`, `mount: { kind: 'skip' }`): no tRPC route of its own and no
-* generated hooks, while `addons.listCapabilityProviders` still enumerates it
-* and the hub's `CapabilityRegistry` still holds an RPC proxy per provider — so
-* a forked runner's entries reach hub-main over transport that already exists.
-* No new UDS message, no second registry (D3). The operator reads the assembled
-* result through `system.getFailureContributions`.
-*/
-var FailureReasonCountSchema = zod.z.object({
-	/**
-	* Why the attempt did not land, in the contributor's own vocabulary —
-	* `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-	* strings that already appear in this repo's logs and, where one exists, the
-	* same string the per-track `previewMissReason` records (D276): a second
-	* vocabulary for the same loss would make the row and the counter
-	* un-joinable.
-	*/
-	reason: zod.z.string(),
-	count: zod.z.number().int().nonnegative()
-});
-var FailureContributionSchema = zod.z.object({
-	/**
-	* The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-	* `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-	* `unit` free: the families are owned by different addons and a shared enum
-	* is a central list that rots invisibly.
-	*/
-	family: zod.z.string(),
-	/**
-	* The NUMERIC device id — the same value every log line carries as
-	* `tags.deviceId`. Never nullable and never absent: a contributor that
-	* cannot name the camera must not emit the entry, because a fleet total
-	* cannot answer the only question anybody asks of this surface.
-	*/
-	deviceId: zod.z.number().int().positive(),
-	/**
-	* A second dimension inside the family: the model / step id for an inference
-	* timeout, so "which camera AND which model" is one read. Absent when the
-	* family has a single variant.
-	*/
-	variant: zod.z.string().optional(),
-	/**
-	* Epoch ms this counter started — the INCARNATION MARKER. A consumer
-	* differencing two reads must drop the interval when it changes, because the
-	* counter restarted from zero in a respawned runner. Same discipline as
-	* `LoadContribution.startedAtMs`.
-	*/
-	sinceMs: zod.z.number(),
-	/** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-	atMs: zod.z.number(),
-	/**
-	* THE DENOMINATOR — every attempt on this path for this camera in the
-	* window. A failure count published without it is the mistake this schema
-	* exists to make impossible.
-	*/
-	attempts: zod.z.number().int().nonnegative(),
-	/** Attempts that landed. `attempts - succeeded` is the loss. */
-	succeeded: zod.z.number().int().nonnegative(),
-	/** The loss, partitioned. Sums to `attempts - succeeded`. */
-	reasons: zod.z.array(FailureReasonCountSchema).readonly()
-});
-var failureContributionCapability = {
-	name: "failure-contribution",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { 
-	/**
-	* This addon's per-camera failure counters, read live from bounded in-RAM
-	* state it already keeps. Inert: no persistence, no sampling, no timer.
-	*
-	* READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-	* consumer that wants a rate differences two reads. A draining read would
-	* make two operators with the page open each destroy half of the other's
-	* numbers, and `load-contribution` already settled the same question the
-	* same way for `cpuSeconds`.
-	*/
-list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly()) },
-	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
-	mount: { kind: "skip" }
-};
-//#endregion
 //#region src/capabilities/load-contribution.cap.ts
 /**
 * `load-contribution` — the capability an addon reports its OWN cost through,
@@ -11988,6 +11933,117 @@ list: require_sleep.method(zod.z.void(), zod.z.array(LoadContributionSchema).rea
 	mount: { kind: "skip" }
 };
 //#endregion
+//#region src/capabilities/log-channels.cap.ts
+/**
+* `log-channels` — the capability an addon DECLARES its diagnostic channels
+* through. It stores nothing.
+*
+* ## Why a capability at all, and why this shape
+*
+* Which channels exist is knowledge only the addon has: `stream-broker` knows
+* webrtc/ICE/RTP, `provider-reolink` knows baichuan/handshake. A central list
+* maintained by hand rots at the first addition and rots INVISIBLY — nothing
+* fails, an operator just never sees the channel somebody added. So the list
+* is assembled from declarations at runtime.
+*
+* The shape is copied from `log-destination.cap.ts`, which already does
+* exactly this job: `mode: 'collection'`, `internal: true`,
+* `mount: { kind: 'skip' }` — no tRPC route, no generated hooks — while
+* `addons.listCapabilityProviders` still enumerates it, and the hub's
+* `CapabilityRegistry` still holds an RPC proxy per provider so a forked
+* runner's declarations reach hub-main over the transport that already exists.
+* No new UDS message, no second registry.
+*
+* ## What it deliberately does NOT own
+*
+* The VALUES — which channel is armed, for which cameras, until when — live in
+* ONE place: the logging settings document on the `system` cap
+* (`getLoggingSettings` / `setLoggingSettings`). Two authorities over the same
+* value is the defect the plan behind this work exists to remove, and
+* `setRequestCensus` was retired (D245) rather than allowed to be a second
+* one. {@link logChannelsCapability} therefore has no getter for a level, no
+* setter for a window and no persistence of any kind.
+*
+* ## Why `apply` is here even so
+*
+* The gate lives in the addon's PROCESS; the document lives in hub-main. Some
+* seam has to carry the value from the authority to the mirror, and a channel
+* that cannot be reached is precisely the dead knob this whole slice exists to
+* make impossible (D62 — `audioThresholdDbfs`, the HA entities with no source).
+* `apply` is that seam and nothing more: it writes an in-memory mirror, it
+* persists nothing, it is never the source of a value, and it is called only
+* with a set the hub actually read (D49 — a read that fails does not call it
+* at all, so no channel is silently disarmed by a bad read).
+*/
+/** What `apply` reports back — enough to log, not enough to be a second state. */
+var LogChannelApplyResultSchema = zod.z.object({
+	/** How many declared channels are armed in this process after the call. */
+	armed: zod.z.number().int().min(0),
+	/**
+	* Names the document armed that this process does not declare. Reported
+	* rather than swallowed: a name here is either a typo or an addon that has
+	* not booted, and both deserve a line instead of silence.
+	*/
+	unknown: zod.z.array(zod.z.string()).readonly()
+});
+var logChannelsCapability = {
+	name: "log-channels",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** The channels this addon declares. Inert: no value, no state. */
+		list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+		/**
+		* Refresh this process's mirror from the document's FULL set of armed
+		* windows.
+		*
+		* Full and not incremental on purpose: the document is the authority, so a
+		* channel it does not name is disarmed here. An incremental apply would
+		* let a disarm get lost in transit and leave a channel running that
+		* nobody can see is running.
+		*/
+		apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+//#endregion
+//#region src/capabilities/log-destination.cap.ts
+var LogLevelSchema = zod.z.enum([
+	"debug",
+	"info",
+	"warn",
+	"error"
+]);
+var LogEntrySchema = zod.z.object({
+	timestamp: zod.z.date(),
+	level: LogLevelSchema,
+	scope: zod.z.array(zod.z.string()),
+	message: zod.z.string(),
+	meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+});
+var logDestinationCapability = {
+	name: "log-destination",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+		query: require_sleep.method(zod.z.object({
+			scope: zod.z.array(zod.z.string()).optional(),
+			level: LogLevelSchema.optional(),
+			since: zod.z.date().optional(),
+			until: zod.z.date().optional(),
+			limit: zod.z.number().optional(),
+			tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+		}), zod.z.array(LogEntrySchema).readonly())
+	},
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
+};
+//#endregion
 //#region src/capabilities/login-method.cap.ts
 /**
 * `login-method` — collection cap through which auth addons contribute
@@ -18192,14 +18248,65 @@ var MediaFileKindEnum = zod.z.enum([
 	"keyFrameSmall",
 	"thumbnailSmall"
 ]);
-var MediaFileSchema = zod.z.object({
+/**
+* One media row's IDENTITY and shape, with no representation of its bytes.
+*
+* This is the half of a media row that is cheap: it comes out of the index
+* without opening a blob, and it is everything a client needs to decide what
+* to render before it renders anything. Both wire shapes below are this plus
+* an address; the STORE's own read-back shape ({@link MediaFileBytes}) is this
+* plus the bytes.
+*/
+var MediaFileRefSchema = zod.z.object({
 	key: zod.z.string(),
 	kind: MediaFileKindEnum,
-	base64: zod.z.string(),
 	sizeBytes: zod.z.number(),
 	timestamp: zod.z.number()
 });
 /**
+* One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
+* ARE — never the bytes themselves.
+*
+* ## Why `url` and not `base64`
+*
+* Measured on the live hub 2026-08-30: `getTrackMedia {trackId, deviceId}`
+* with no `kinds` returned 6 rows / **3 597 219 B**, of which `keyFrame` alone
+* was **2 824 077 B** — one full-resolution frame, base64, so +33 % on the
+* wire. Forty events is ~144 MB. Every byte of it was read off disk,
+* base64-encoded, held whole in a unary tRPC envelope, and materialised in
+* hub-main's heap on the way past — for an `<img>` that would have cached it.
+*
+* `url` points at the `event-media` data plane
+* (`/addon/<addonId>/event-media/<storedKey>`), which serves the same blob
+* with an ETag and `Cache-Control: immutable`, honours conditional GETs, can
+* render a `?variant=thumb`, and streams. The hub gate in front of it requires
+* a bearer or the session cookie (`access: 'authenticated'`), so the bytes are
+* no less protected than they were inside a `view`-level cap response — see
+* `data-plane-access.ts` for the rule and the one gap it does not close
+* (per-device scoping).
+*
+* The URL is built from the row's **stored** key, which is not always its
+* published `kind`: a track's face/plate crop is stored as `crop` under
+* `('face'|'plate', '<prefix>-<trackId>')` and published as
+* `faceCrop`/`plateCrop`. `MediaStore.getByKey` knows only the stored key.
+*
+* ## `base64` is TRANSITIONAL and is going away
+*
+* It is still populated for one reason: the deployed viewer's track-detail
+* HERO tile reads it (`use-track-media-entry.ts` → `parseMediaFiles`, which
+* REQUIRES the field), and a row without it parses as a FAILED read — the red
+* triangle — not as absence. Removing the field before that viewer ships is an
+* outage, not a cleanup. Once the viewer takes its hero bytes from `url`,
+* delete this line and the `withBytes` pass-through in
+* `analytics-query-facade.ts`; nothing else reads it.
+*/
+var MediaFileSchema = MediaFileRefSchema.extend({
+	/** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+	url: zod.z.string(),
+	/** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+	base64: zod.z.string()
+});
+/**
 * One media row WITHOUT its bytes.
 *
 * A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
@@ -18209,7 +18316,9 @@ var MediaFileSchema = zod.z.object({
 * blocks the whole view.
 *
 * `sizeBytes` is carried because it is what lets a client decide between the
-* stored blob and a `?variant=thumb` rendering without fetching either.
+* stored blob and a `?variant=thumb` rendering without fetching either, and
+* `url` because a client that had to build the plane path itself is a second
+* copy of a route — the embed, the viewer and the admin UI each grew one.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 /**
@@ -19008,6 +19117,17 @@ var pipelineAnalyticsCapability = {
 		* happens to stamp it. This count is what the migration planner's
 		* non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
 		* it to zero.
+		*
+		* TWO indexed statements per collection, not a walk. It used to page the
+		* whole collection at 200 rows per RPC ordered by an unindexed column, so
+		* on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+		* time it was called, and the migration it gates could never start. The
+		* cheap question (`present`: is there at least one) is asked first and
+		* separately from the expensive one (`rows`), because only the first has
+		* to be answerable for the gate to do its job.
+		*
+		* **`null` is "not measurable", never zero** — at either level. An
+		* unreadable collection must not read as a sealed one.
 		*/
 		countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
 		/**
@@ -19331,6 +19451,26 @@ var pipelineAnalyticsCapability = {
 			deviceId: zod.z.number()
 		}), zod.z.array(MediaFileInfoSchema).readonly()),
 		/**
+		* What media an EVENT has, without any of it — the twin `getEventMedia`
+		* never had.
+		*
+		* `listTrackMedia` above got this treatment because a track's media is
+		* 5-8 MB. An event's is worse per row, not better: an old-style event owns
+		* a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+		* modal — the one surface that legitimately shows the big kinds — unions
+		* both listings to build its filmstrip. It then renders every tile from
+		* the `event-media` plane by key and throws the bytes away. Measured on
+		* the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+		* ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+		*
+		* Same `deviceId` authorization subject as `getEventMedia`, and the same
+		* rows — this is a projection of that method, never a different question.
+		*/
+		listEventMedia: require_sleep.method(zod.z.object({
+			eventId: zod.z.string(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileInfoSchema).readonly()),
+		/**
 		* Search object events by text query using CLIP cosine similarity.
 		* Encodes `text` via the `embedding-encoder` cap, queries the
 		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -26156,10 +26296,24 @@ var FaceClusterSchema = zod.z.object({
 	size: zod.z.number().int(),
 	cohesion: zod.z.number()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema$1 = zod.z.object({
 	key: zod.z.string(),
 	kind: zod.z.string(),
-	base64: zod.z.string(),
+	url: zod.z.string(),
 	sizeBytes: zod.z.number(),
 	timestamp: zod.z.number()
 });
@@ -29657,10 +29811,24 @@ var PlateInfoSchema = zod.z.object({
 	*/
 	cropUrl: zod.z.string().optional()
 });
+/**
+* One gallery media row: what the crop is, how big it is, and WHERE its bytes
+* are — never the bytes.
+*
+* `base64` was deleted here rather than deprecated. `MediaFile.base64` (the
+* track/event contract) is still populated because a deployed viewer requires
+* the field to parse a row at all; this method has no such reader. Its ONE
+* caller is the admin UI's detail modal, which was building
+* `data:image/jpeg;base64,…` from a row whose `key` sat right beside it, in a
+* dialog already rendering its key FRAME from the `event-media` plane.
+*
+* `url` is `/addon/<addonId>/event-media/<encoded key>`. The plane resolves a
+* media key directly, so this needed no new plane and no new access decision.
+*/
 var MediaFileLiteSchema = zod.z.object({
 	key: zod.z.string(),
 	kind: zod.z.string(),
-	base64: zod.z.string(),
+	url: zod.z.string(),
 	sizeBytes: zod.z.number(),
 	timestamp: zod.z.number()
 });
@@ -41449,6 +41617,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listGroups": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45335,6 +45509,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.listGroups": [{
 		name: "deviceIds",
 		form: "array",
@@ -51712,6 +51891,7 @@ exports.MaskRectShapeSchema = MaskRectShapeSchema;
 exports.MaskShapeKindSchema = MaskShapeKindSchema;
 exports.MaskShapeSchema = MaskShapeSchema;
 exports.MediaFileInfoSchema = MediaFileInfoSchema;
+exports.MediaFileRefSchema = MediaFileRefSchema;
 exports.MediaFileSchema = MediaFileSchema;
 exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
 exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
@@ -52190,6 +52370,7 @@ exports.UNIT_TABLE = UNIT_TABLE;
 exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
 exports.UnitConversionError = UnitConversionError;
 exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
+exports.UnstampedRowsSchema = UnstampedRowsSchema;
 exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
 exports.UpdateStatusSchema = UpdateStatusSchema;
 exports.UpdateUserInputSchema = UpdateUserInputSchema;