camstack 1.2.28 → 1.2.30

package/dist/{launcher-XHGXNFNV.js → launcher-3IBPG6ZS.js}

@@ -23631,9 +23631,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-tMrPAfpF.js
-var require_dist_tMrPAfpF = __commonJS({
-  "../system/dist/dist-tMrPAfpF.js"(exports) {
+// ../system/dist/dist-CB2eCKJb.js
+var require_dist_CB2eCKJb = __commonJS({
+  "../system/dist/dist-CB2eCKJb.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -23650,6 +23650,7 @@ var require_dist_tMrPAfpF = __commonJS({
       EventCategory2["AddonInstalled"] = "addon.installed";
       EventCategory2["AddonUninstalled"] = "addon.uninstalled";
       EventCategory2["AddonCrashed"] = "addon.crashed";
+      EventCategory2["AddonRunnerFailed"] = "addon.runner-failed";
       EventCategory2["AddonError"] = "addon.error";
       EventCategory2["AddonPageReady"] = "addon.page-ready";
       EventCategory2["AddonWidgetReady"] = "addon.widget-ready";
@@ -25931,6 +25932,10 @@ var require_dist_tMrPAfpF = __commonJS({
       preBufferSec: zod.z.number().min(0).optional(),
       postBufferSec: zod.z.number().min(0).optional()
     });
+    ({
+      preBufferSec: 10,
+      postBufferSec: 30
+    }).postBufferSec * 1e3;
     var RecordingRetentionSchema = zod.z.object({
       maxAgeDays: zod.z.number().min(0).optional(),
       maxSizeGb: zod.z.number().min(0).optional()
@@ -25947,6 +25952,12 @@ var require_dist_tMrPAfpF = __commonJS({
       /** DERIVED summary of `bands`, stamped by the recorder on every save.
       *  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
       mode: RecordingStorageModeSchema.optional(),
+      /**
+      * Which assigned broker slots to record. Absent / empty = {@link
+      * DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
+      * camera's currently assigned slots — never `mid` unless the operator
+      * picks it, and never a slot the broker has not assigned.
+      */
       profiles: zod.z.array(CamProfileSchema).optional(),
       segmentSeconds: zod.z.number().int().positive().optional(),
       /**
@@ -26009,7 +26020,11 @@ var require_dist_tMrPAfpF = __commonJS({
       profiles: zod.z.array(zod.z.string()).optional(),
       /** Copy throttle in MB/s (default 40) — the drain is a background chore,
       *  never allowed to starve live writers. */
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Move only segments whose startMs is >= this. Absent = the whole source
+      *  pile. Used when a full drain is too expensive and the operator only
+      *  wants the recent window on the new disk. */
+      sinceMs: zod.z.number().int().optional()
     });
     var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
     var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
@@ -33092,6 +33107,7 @@ var require_dist_tMrPAfpF = __commonJS({
       "node-offline",
       "node-inference-unavailable",
       "detection-blind",
+      "addon-crash-loop",
       "addon-update-available",
       "server-update-available",
       "alarm-triggered",
@@ -33099,6 +33115,9 @@ var require_dist_tMrPAfpF = __commonJS({
       "alarm-disarmed",
       "alarm-arming",
       "alarm-arm-refused",
+      "addon-updated",
+      "server-updated",
+      "export-completed",
       "camera-online",
       "camera-offline",
       "camera-disabled",
@@ -34512,7 +34531,9 @@ var require_dist_tMrPAfpF = __commonJS({
       *  `'staging'`. */
       markForTrain: zod.z.boolean().optional(),
       /** Operator marked this track for diagnostic attention. */
-      debug: zod.z.boolean().optional()
+      debug: zod.z.boolean().optional(),
+      /** Operator favourited this track. Pins it against pruning. */
+      favourited: zod.z.boolean().optional()
     };
     var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
     var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
@@ -34520,6 +34541,7 @@ var require_dist_tMrPAfpF = __commonJS({
       trackId: zod.z.string(),
       markForTrain: zod.z.boolean(),
       debug: zod.z.boolean(),
+      favourited: zod.z.boolean(),
       /** The lifecycle state the boolean was derived from. Required here (unlike on
       *  a track row) because this shape is only ever produced by the write body,
       *  which always knows it — and a surface that has just written needs to render
@@ -35042,6 +35064,11 @@ var require_dist_tMrPAfpF = __commonJS({
       /** Per-track CLIP search vectors removed (best-effort). */
       embeddings: zod.z.number().int()
     });
+    var DiskReconcileCountsSchema = zod.z.object({
+      mediaDropped: zod.z.number().int(),
+      tracks: zod.z.number().int(),
+      events: zod.z.number().int()
+    });
     var EventStoreDeviceFootprintSchema = zod.z.object({
       deviceId: zod.z.number(),
       /** Persisted event rows (motion + object + audio) for the camera. */
@@ -35298,6 +35325,17 @@ var require_dist_tMrPAfpF = __commonJS({
           auth: "admin"
         }),
         /**
+        * Disk-wins reconcile for one camera. Drops media index rows whose blobs
+        * are gone, then cascades tracks (including favourited and staging) that
+        * have no remaining files. Enrolled identity/vehicle/scene media is never
+        * probed. Trackless motion/audio events with no remaining file are dropped,
+        * including snapshot-less rows.
+        */
+        reconcileFromDisk: method(zod.z.object({ deviceId: zod.z.number() }), DiskReconcileCountsSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /**
         * Delete whole tracks (object events) by id for the given device,
         * cascading their media in lockstep. Returns the number of tracks
         * actually deleted plus the ids that could not be removed.
@@ -35316,7 +35354,7 @@ var require_dist_tMrPAfpF = __commonJS({
           auth: "admin"
         }),
         /**
-        * Set the per-track operator flags (`markForTrain`, `debug`) on ONE track.
+        * Set the per-track operator flags (`markForTrain`, `debug`, `favourited`) on ONE track.
         * The patch is PARTIAL — an omitted key is left untouched — because the
         * three surfaces that write it (admin Events grid, viewer track detail,
         * viewer cluster detail) each own one toggle and must not clobber the other.
@@ -37161,6 +37199,24 @@ var require_dist_tMrPAfpF = __commonJS({
       /** Wall-clock ms spent on the stage before it was abandoned. */
       elapsedMs: zod.z.number()
     });
+    var DiskReconcileJobSchema = zod.z.object({
+      state: zod.z.enum([
+        "idle",
+        "running",
+        "done",
+        "error"
+      ]),
+      total: zod.z.number().int().nonnegative(),
+      completed: zod.z.number().int().nonnegative(),
+      currentDeviceId: zod.z.number().int().nullable(),
+      failed: zod.z.array(zod.z.number().int()).readonly(),
+      mediaDropped: zod.z.number().int().nonnegative(),
+      tracks: zod.z.number().int().nonnegative(),
+      events: zod.z.number().int().nonnegative(),
+      startedAtMs: zod.z.number().int().nullable(),
+      finishedAtMs: zod.z.number().int().nullable(),
+      error: zod.z.string().nullable()
+    });
     var CameraStatusSchema = zod.z.object({
       deviceId: zod.z.number(),
       assignment: CameraAssignmentStatusSchema,
@@ -37685,6 +37741,18 @@ var require_dist_tMrPAfpF = __commonJS({
         * rail without issuing N parallel browser round-trips.
         */
         getCameraStatuses: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.array(CameraStatusSchema).readonly()),
+        /**
+        * Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
+        * the addon process and returns immediately with the job snapshot — the
+        * work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
+        * Admin-only. Idempotent while a job is already running.
+        */
+        reconcileFromDisk: method(zod.z.void(), DiskReconcileJobSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** Snapshot of the in-flight or last disk-wins fleet reconcile. */
+        getReconcileFromDiskStatus: method(zod.z.void(), DiskReconcileJobSchema, { auth: "admin" }),
         /** List every template the operator has saved. */
         listTemplates: method(zod.z.void(), zod.z.array(PipelineTemplateSchema).readonly()),
         /** Create a new named preset from a given CameraPipelineConfig. */
@@ -38823,8 +38891,65 @@ var require_dist_tMrPAfpF = __commonJS({
         startMs: zod.z.number(),
         endMs: zod.z.number()
       }),
-      /** Thumbnail URL (lazy; e.g. analytics `getEventMedia`). Never inlined. */
-      thumbnail: zod.z.string().optional()
+      /**
+      * Distinct object classes attached to this visit (`person`, `car`, …),
+      * dominant first, capped at {@link MAX_CLIP_LABELS}. The ribbon renders these
+      * instead of the bare kind — "Object" tells the operator nothing a colour bar
+      * did not. Absent (never empty) when the visit attached no classified object
+      * event, so a motion/audio-only visit keeps its kind label.
+      */
+      labels: zod.z.array(zod.z.string()).max(3).optional(),
+      /**
+      * Lazy thumbnail URL, never inlined.
+      *
+      * Recording-derived clips (events-mode keep-window, and the prepared
+      * continuous event+fragment visit) MUST use the snapshot of the **main
+      * event of the interval** — `getEventMedia({ eventId, kind: 'snapshot' })`
+      * of the event that owns `kind` (object > motion > audio). Do not extract
+      * a keyframe from the recorded segments. Other providers (onboard, HKSV)
+      * mint their own stills.
+      *
+      * **VOUCHED, never fabricated.** A provider emits this only for an event it
+      * has CONFIRMED owns at least one media row (its own, or its owning track's).
+      * Absent is meaningful — "this visit has no event still" — never "we did not
+      * look". Stamping it from a URL template made 35% of one camera's clips point
+      * at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+      * A read that FAILS drops the claim; it never invents it.
+      */
+      thumbnail: zod.z.string().optional(),
+      /**
+      * An instant INSIDE this visit's footage, hole-safe, where a recorded still
+      * can be decoded. Present whenever the visit came from recorded availability;
+      * absent on a per-event padded window (there is no footage to promise).
+      *
+      * This is not a thumbnail and not a second byte path: it is the argument to
+      * the recorder's existing still route. The surface — never the provider —
+      * decides whether to use it. It is the midpoint of the visit's LONGEST
+      * contiguous range, not of the visit: a visit spans its holes by
+      * construction, so a naive midpoint lands in dead air.
+      */
+      stillAtMs: zod.z.number().optional(),
+      /**
+      * Analytics event ids that overlap this visit — a BOUNDED sample, newest
+      * first within kind (object → motion → audio), capped at
+      * {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+      *
+      * Bounded because it is not a payload the surface pages through: one visit on
+      * device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+      * camera-day. Read {@link eventCount} for the true total.
+      */
+      eventIds: zod.z.array(zod.z.string()).optional(),
+      /** How many analytics events actually overlap this visit. Differs from
+      *  `eventIds.length` exactly when the sample was capped — so a truncated
+      *  list is never mistaken for a quiet visit. */
+      eventCount: zod.z.number().int().nonnegative().optional(),
+      /** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
+      *  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
+      *  bar keeps showing them via `recording.getAvailability`. */
+      holes: zod.z.array(zod.z.object({
+        startMs: zod.z.number(),
+        endMs: zod.z.number()
+      })).optional()
     });
     var ClipPlaybackSchema = zod.z.object({
       /** HLS master URL through the hub data-plane (Range + token in path). */
@@ -39372,7 +39497,14 @@ var require_dist_tMrPAfpF = __commonJS({
     });
     var AutoUpdateSettingsSchema = zod.z.object({
       channel: ChannelSchema,
-      intervalSeconds: zod.z.number()
+      intervalSeconds: zod.z.number(),
+      /**
+      * Cadence of the "an update exists" POLLER, in seconds. Independent of
+      * `channel`: the poller runs while auto-apply is `off`, because being told
+      * about a publish and installing it are different decisions. Clamped
+      * server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+      */
+      updateCheckIntervalSeconds: zod.z.number()
     });
     var AddonAutoUpdateSchema = ChannelWithInheritSchema;
     var RestartAddonResultSchema = zod.z.unknown();
@@ -39623,7 +39755,9 @@ var require_dist_tMrPAfpF = __commonJS({
         getAutoUpdateSettings: method(zod.z.void(), AutoUpdateSettingsSchema, { auth: "admin" }),
         setAutoUpdateSettings: method(zod.z.object({
           channel: ChannelSchema,
-          intervalSeconds: zod.z.number().min(300).max(86400).optional()
+          intervalSeconds: zod.z.number().min(300).max(86400).optional(),
+          /** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+          updateCheckIntervalSeconds: zod.z.number().min(900).max(604800).optional()
         }), zod.z.unknown(), {
           kind: "mutation",
           auth: "admin"
@@ -44905,7 +45039,9 @@ var require_dist_tMrPAfpF = __commonJS({
       includeAudio: zod.z.boolean(),
       maxLifeMs: zod.z.number().int().positive(),
       deleteAfterDownload: zod.z.boolean(),
-      title: zod.z.string().max(200).optional()
+      title: zod.z.string().max(200).optional(),
+      /** Notification-output target ids to ping when this export becomes ready. */
+      notifyTargetIds: zod.z.array(zod.z.string().min(1)).max(20).optional()
     }).superRefine((v, ctx) => {
       if (v.speed !== void 0 && v.timelapse !== void 0) ctx.addIssue({
         code: zod.z.ZodIssueCode.custom,
@@ -44959,14 +45095,23 @@ var require_dist_tMrPAfpF = __commonJS({
       scope: "system",
       mode: "singleton",
       methods: {
-        /** Queue a render of `[fromMs,toMs)` for `deviceId`/`profile`. Fails fast
-        *  when no footage covers the range. Returns the queued record. */
+        /** Queue a render of `[fromMs,toMs)` for `deviceId`/`profiles` (legacy
+        *  singular `profile` still accepted). Fails fast when no footage covers
+        *  the range. One job per profile; returns the first queued record. */
         createExport: method(zod.z.object({
           deviceId: zod.z.number(),
-          profile: zod.z.string(),
+          /** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
+          profile: zod.z.string().optional(),
+          profiles: zod.z.array(zod.z.string()).min(1).optional(),
           fromMs: zod.z.number(),
           toMs: zod.z.number(),
           options: ExportOptionsSchema
+        }).superRefine((v, ctx) => {
+          if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
+            code: zod.z.ZodIssueCode.custom,
+            message: "pass profiles[] (min 1) or legacy profile",
+            path: ["profiles"]
+          });
         }), ExportRecordSchema, {
           kind: "mutation",
           auth: "protected"
@@ -50603,6 +50748,12 @@ var require_dist_tMrPAfpF = __commonJS({
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.reconcileFromDisk": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "create"
+      },
       "pipelineAnalytics.refreshStorageLocationsForMigration": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -51005,6 +51156,12 @@ var require_dist_tMrPAfpF = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineOrchestrator.getReconcileFromDiskStatus": {
+        capName: "pipeline-orchestrator",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "pipelineOrchestrator.listAgentSettings": {
         capName: "pipeline-orchestrator",
         capScope: "system",
@@ -51029,6 +51186,12 @@ var require_dist_tMrPAfpF = __commonJS({
         addonId: null,
         access: "create"
       },
+      "pipelineOrchestrator.reconcileFromDisk": {
+        capName: "pipeline-orchestrator",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "pipelineOrchestrator.removeAgentSettings": {
         capName: "pipeline-orchestrator",
         capScope: "system",
@@ -54020,6 +54183,11 @@ var require_dist_tMrPAfpF = __commonJS({
         form: "single",
         optional: true
       }],
+      "pipelineAnalytics.reconcileFromDisk": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.restageRetrainTrack": [{
         name: "deviceId",
         form: "single",
@@ -55207,6 +55375,8 @@ var require_dist_tMrPAfpF = __commonJS({
     function isSameAddonId(a, b) {
       return bareAddonId(a) === bareAddonId(b);
     }
+    var MB = 1024 * 1024;
+    1024 * MB, 3072 * MB;
     function decodeVectorBase64(encoded) {
       const buffer = Buffer.from(encoded, "base64");
       if (buffer.byteLength % 4 !== 0) throw new Error(`decodeVectorBase64: ${buffer.byteLength} bytes is not a whole number of Float32 values`);
@@ -55913,7 +56083,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -56726,7 +56896,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -56820,7 +56990,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -59540,7 +59710,7 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -63528,7 +63698,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -63665,7 +63835,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -63855,7 +64025,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -71539,7 +71709,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -72104,7 +72274,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -73046,7 +73216,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -74162,7 +74332,7 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -75730,7 +75900,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -77609,7 +77779,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -95670,7 +95840,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -96658,9 +96828,9 @@ var require_file_data_plane_DUHPHa_Y = __commonJS({
   }
 });
 
-// ../types/dist/event-category-D3gG7oil.js
-var require_event_category_D3gG7oil = __commonJS({
-  "../types/dist/event-category-D3gG7oil.js"(exports) {
+// ../types/dist/event-category-CRPORAAz.js
+var require_event_category_CRPORAAz = __commonJS({
+  "../types/dist/event-category-CRPORAAz.js"(exports) {
     "use strict";
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
       EventCategory2["SystemBoot"] = "system.boot";
@@ -96676,6 +96846,7 @@ var require_event_category_D3gG7oil = __commonJS({
       EventCategory2["AddonInstalled"] = "addon.installed";
       EventCategory2["AddonUninstalled"] = "addon.uninstalled";
       EventCategory2["AddonCrashed"] = "addon.crashed";
+      EventCategory2["AddonRunnerFailed"] = "addon.runner-failed";
       EventCategory2["AddonError"] = "addon.error";
       EventCategory2["AddonPageReady"] = "addon.page-ready";
       EventCategory2["AddonWidgetReady"] = "addon.widget-ready";
@@ -96823,11 +96994,11 @@ var require_event_category_D3gG7oil = __commonJS({
   }
 });
 
-// ../types/dist/sleep-EYtyUX0L.js
-var require_sleep_EYtyUX0L = __commonJS({
-  "../types/dist/sleep-EYtyUX0L.js"(exports) {
+// ../types/dist/sleep-CMRLJj2e.js
+var require_sleep_CMRLJj2e = __commonJS({
+  "../types/dist/sleep-CMRLJj2e.js"(exports) {
     "use strict";
-    var require_event_category = require_event_category_D3gG7oil();
+    var require_event_category = require_event_category_CRPORAAz();
     var zod = require_zod();
     var WELL_KNOWN_TABS = [
       {
@@ -99298,6 +99469,7 @@ var require_sleep_EYtyUX0L = __commonJS({
           pruneEventsBefore: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pruneEventsBefore", "mutation", input),
           pruneTracksBefore: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "pruneTracksBefore", "mutation", input),
           wipeAllAnalytics: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "wipeAllAnalytics", "mutation", input),
+          reconcileFromDisk: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "reconcileFromDisk", "mutation", input),
           deleteTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteTracks", "mutation", input),
           setTrackFlags: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "setTrackFlags", "mutation", input),
           getEventStoreFootprint: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventStoreFootprint", "query", input),
@@ -99600,10 +99772,7 @@ var require_sleep_EYtyUX0L = __commonJS({
           getDeviceLiveContribution: (input) => dispatchSystem("recording", "getDeviceLiveContribution", "query", input),
           applyDeviceSettingsPatch: (input) => dispatchSystem("recording", "applyDeviceSettingsPatch", "mutation", input)
         },
-        recordingExport: {
-          createExport: (input) => dispatchSystem("recordingExport", "createExport", "mutation", input),
-          listExports: (input) => dispatchSystem("recordingExport", "listExports", "query", input)
-        },
+        recordingExport: { listExports: (input) => dispatchSystem("recordingExport", "listExports", "query", input) },
         streamBroker: {
           publishCameraStream: (input) => dispatchSystem("streamBroker", "publishCameraStream", "mutation", input),
           retractCameraStream: (input) => dispatchSystem("streamBroker", "retractCameraStream", "mutation", input),
@@ -100266,8 +100435,8 @@ var require_addon = __commonJS({
   "../types/dist/addon.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_D3gG7oil();
-    var require_sleep = require_sleep_EYtyUX0L();
+    var require_event_category = require_event_category_CRPORAAz();
+    var require_sleep = require_sleep_CMRLJj2e();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -107141,9 +107310,9 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-BtVjvfvj.js
-var require_manifest_python_deps_BtVjvfvj = __commonJS({
-  "../system/dist/manifest-python-deps-BtVjvfvj.js"(exports) {
+// ../system/dist/manifest-python-deps-GejnH--L.js
+var require_manifest_python_deps_GejnH_L = __commonJS({
+  "../system/dist/manifest-python-deps-GejnH--L.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -107159,9 +107328,139 @@ var require_manifest_python_deps_BtVjvfvj = __commonJS({
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
     var node_http = __require("http");
+    var node_v8 = __require("v8");
+    node_v8 = require_chunk.__toESM(node_v8);
+    var node_vm = __require("vm");
+    node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
     var _trpc_client = require_dist2();
     var node_net = __require("net");
+    var HEAP_WATCH_INTERVAL_MS = 6e4;
+    var HEAP_WATCH_WARN_RATIO = 0.8;
+    var HEAP_WATCH_ESCALATE_RATIO = 0.7;
+    var HEAP_WATCH_DEESCALATE_RATIO = 0.6;
+    function nextMode(current, usedRatio, escalateRatio = HEAP_WATCH_ESCALATE_RATIO, deescalateRatio = HEAP_WATCH_DEESCALATE_RATIO) {
+      if (current === "escalated") return usedRatio < deescalateRatio ? "steady" : "escalated";
+      return usedRatio >= escalateRatio ? "escalated" : "steady";
+    }
+    var HEAP_RECLAIM_TRIGGER_MB = 1024;
+    var HEAP_RECLAIM_MIN_INTERVAL_MS = 12e4;
+    var MB = (bytes) => Math.round(bytes / 1048576);
+    function buildHeapSample(mem, heapLimitBytes, warnRatio = HEAP_WATCH_WARN_RATIO) {
+      const usedRatio = heapLimitBytes > 0 ? mem.heapUsed / heapLimitBytes : 0;
+      return {
+        rssMb: MB(mem.rss),
+        heapUsedMb: MB(mem.heapUsed),
+        heapTotalMb: MB(mem.heapTotal),
+        heapLimitMb: MB(heapLimitBytes),
+        externalMb: MB(mem.external),
+        arrayBuffersMb: MB(mem.arrayBuffers),
+        usedRatio: Math.round(usedRatio * 100) / 100,
+        nearLimit: usedRatio >= warnRatio
+      };
+    }
+    var consoleSink = {
+      info: (line) => console.log(line),
+      warn: (line) => console.warn(line)
+    };
+    function strandedMb(s) {
+      return s.rssMb - s.heapUsedMb - s.externalMb;
+    }
+    function shouldReclaim(s, triggerMb = HEAP_RECLAIM_TRIGGER_MB) {
+      return strandedMb(s) > triggerMb;
+    }
+    function isGcFunction(value) {
+      return typeof value === "function";
+    }
+    function createV8Reclaimer() {
+      try {
+        node_v8.setFlagsFromString("--expose-gc");
+        const gc = node_vm.runInNewContext("gc");
+        node_v8.setFlagsFromString("--no-expose-gc");
+        if (!isGcFunction(gc)) return void 0;
+        return () => gc({
+          execution: "sync",
+          flavor: "last-resort"
+        });
+      } catch {
+        return;
+      }
+    }
+    function format2(label, s) {
+      return `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+    }
+    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions) {
+      const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
+      const now = reclaimOptions?.now ?? (() => Date.now());
+      const triggerMb = reclaimOptions?.triggerMb ?? 1024;
+      const minIntervalMs = reclaimOptions?.minIntervalMs ?? 12e4;
+      const fastIntervalMs = reclaimOptions?.fastIntervalMs ?? 2e3;
+      const escalateRatio = reclaimOptions?.escalateRatio ?? 0.7;
+      const deescalateRatio = reclaimOptions?.deescalateRatio ?? 0.6;
+      let lastReclaimAt = Number.NEGATIVE_INFINITY;
+      const read = () => {
+        const limit = reclaimOptions?.heapLimitBytes ?? node_v8.getHeapStatistics().heap_size_limit;
+        return buildHeapSample(readMemory(), limit);
+      };
+      const maybeReclaim = (sample) => {
+        if (reclaimOptions === void 0) return;
+        if (!shouldReclaim(sample, triggerMb)) return;
+        if (now() - lastReclaimAt < minIntervalMs) return;
+        lastReclaimAt = now();
+        const startedAt = now();
+        try {
+          reclaimOptions.reclaim();
+        } catch (error) {
+          sink.warn(`[mem] reclaim failed \u2014 ${error instanceof Error ? error.message : String(error)}`);
+          return;
+        }
+        const after = read();
+        sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB\u2192${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB\u2192${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
+      };
+      let mode = "steady";
+      let lastLoggedAt = Number.NEGATIVE_INFINITY;
+      const probeIntervalMs = Math.min(fastIntervalMs, intervalMs);
+      const tick = () => {
+        try {
+          const sample = read();
+          const previous = mode;
+          mode = nextMode(previous, sample.usedRatio, escalateRatio, deescalateRatio);
+          const at = now();
+          const due = at - lastLoggedAt >= intervalMs;
+          if (mode === "escalated" || due) {
+            lastLoggedAt = at;
+            const line = format2(label, sample);
+            if (sample.nearLimit) sink.warn(`${line} \u2014 APPROACHING HEAP LIMIT`);
+            else if (mode === "escalated") sink.warn(`${line} \u2014 heap elevated, sampling every ${probeIntervalMs}ms`);
+            else sink.info(line);
+          }
+          if (previous === "escalated" && mode === "steady") sink.info(`[mem] ${label} heap back to routine \u2014 logging every ${intervalMs}ms`);
+          maybeReclaim(sample);
+        } catch {
+        }
+      };
+      const timer = setInterval(tick, probeIntervalMs);
+      timer.unref?.();
+      tick();
+      let stopped = false;
+      return () => {
+        if (stopped) return;
+        stopped = true;
+        clearInterval(timer);
+      };
+    }
+    var RUNNER_HEAP_WATCH_INTERVAL_MS = 3e5;
+    function startRunnerHeapWatch(options) {
+      if (options.heapProfile !== "heavy") return void 0;
+      const intervalMs = options.intervalMs ?? 3e5;
+      if (options.reclaimSwitch === "off") return startHeapWatch(options.label, options.sink, intervalMs);
+      let reclaimOptions = options.reclaimOptions;
+      if (reclaimOptions === void 0) {
+        const reclaimer = createV8Reclaimer();
+        reclaimOptions = reclaimer === void 0 ? void 0 : { reclaim: reclaimer };
+      }
+      return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions);
+    }
     function trimSlashes(s) {
       return s.replace(/^\/+/, "").replace(/\/+$/, "");
     }
@@ -113520,6 +113819,30 @@ var require_manifest_python_deps_BtVjvfvj = __commonJS({
         return FrameDecoder;
       }
     });
+    Object.defineProperty(exports, "HEAP_RECLAIM_MIN_INTERVAL_MS", {
+      enumerable: true,
+      get: function() {
+        return HEAP_RECLAIM_MIN_INTERVAL_MS;
+      }
+    });
+    Object.defineProperty(exports, "HEAP_RECLAIM_TRIGGER_MB", {
+      enumerable: true,
+      get: function() {
+        return HEAP_RECLAIM_TRIGGER_MB;
+      }
+    });
+    Object.defineProperty(exports, "HEAP_WATCH_INTERVAL_MS", {
+      enumerable: true,
+      get: function() {
+        return HEAP_WATCH_INTERVAL_MS;
+      }
+    });
+    Object.defineProperty(exports, "HEAP_WATCH_WARN_RATIO", {
+      enumerable: true,
+      get: function() {
+        return HEAP_WATCH_WARN_RATIO;
+      }
+    });
     Object.defineProperty(exports, "HUB_CAP_FWD_ACTION", {
       enumerable: true,
       get: function() {
@@ -113550,6 +113873,12 @@ var require_manifest_python_deps_BtVjvfvj = __commonJS({
         return NATIVE_PROVIDER_SERVICE_INFIX;
       }
     });
+    Object.defineProperty(exports, "RUNNER_HEAP_WATCH_INTERVAL_MS", {
+      enumerable: true,
+      get: function() {
+        return RUNNER_HEAP_WATCH_INTERVAL_MS;
+      }
+    });
     Object.defineProperty(exports, "SocketChannel", {
       enumerable: true,
       get: function() {
@@ -113598,6 +113927,12 @@ var require_manifest_python_deps_BtVjvfvj = __commonJS({
         return brokerTransportLink;
       }
     });
+    Object.defineProperty(exports, "buildHeapSample", {
+      enumerable: true,
+      get: function() {
+        return buildHeapSample;
+      }
+    });
     Object.defineProperty(exports, "buildLinkChain", {
       enumerable: true,
       get: function() {
@@ -113742,6 +114077,12 @@ var require_manifest_python_deps_BtVjvfvj = __commonJS({
         return createUdsLoggerWithControl;
       }
     });
+    Object.defineProperty(exports, "createV8Reclaimer", {
+      enumerable: true,
+      get: function() {
+        return createV8Reclaimer;
+      }
+    });
     Object.defineProperty(exports, "deserializeTypedArrays", {
       enumerable: true,
       get: function() {
@@ -113904,6 +114245,30 @@ var require_manifest_python_deps_BtVjvfvj = __commonJS({
         return setWorkerNativeCapsChangeListener;
       }
     });
+    Object.defineProperty(exports, "shouldReclaim", {
+      enumerable: true,
+      get: function() {
+        return shouldReclaim;
+      }
+    });
+    Object.defineProperty(exports, "startHeapWatch", {
+      enumerable: true,
+      get: function() {
+        return startHeapWatch;
+      }
+    });
+    Object.defineProperty(exports, "startRunnerHeapWatch", {
+      enumerable: true,
+      get: function() {
+        return startRunnerHeapWatch;
+      }
+    });
+    Object.defineProperty(exports, "strandedMb", {
+      enumerable: true,
+      get: function() {
+        return strandedMb;
+      }
+    });
     Object.defineProperty(exports, "subscribePassthrough", {
       enumerable: true,
       get: function() {
@@ -117724,7 +118089,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_tMrPAfpF();
+    var require_dist10 = require_dist_CB2eCKJb();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -117749,7 +118114,7 @@ var require_dist3 = __commonJS({
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DUHPHa_Y();
-    var require_manifest_python_deps = require_manifest_python_deps_BtVjvfvj();
+    var require_manifest_python_deps = require_manifest_python_deps_GejnH_L();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -117767,8 +118132,6 @@ var require_dist3 = __commonJS({
     var node_fs$1 = require_chunk.__toESM(node_fs, 1);
     node_fs = require_chunk.__toESM(node_fs);
     var node_http = __require("http");
-    var node_v8 = __require("v8");
-    node_v8 = require_chunk.__toESM(node_v8);
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
     var _camstack_types_addon = require_addon();
@@ -118102,120 +118465,6 @@ var require_dist3 = __commonJS({
       if (replayBody !== void 0) upstream.end(replayBody);
       else clientReq.pipe(upstream);
     }
-    var HEAP_WATCH_INTERVAL_MS = 6e4;
-    var HEAP_WATCH_WARN_RATIO = 0.8;
-    var HEAP_WATCH_ESCALATE_RATIO = 0.7;
-    var HEAP_WATCH_DEESCALATE_RATIO = 0.6;
-    function nextMode(current, usedRatio, escalateRatio = HEAP_WATCH_ESCALATE_RATIO, deescalateRatio = HEAP_WATCH_DEESCALATE_RATIO) {
-      if (current === "escalated") return usedRatio < deescalateRatio ? "steady" : "escalated";
-      return usedRatio >= escalateRatio ? "escalated" : "steady";
-    }
-    var HEAP_RECLAIM_TRIGGER_MB = 1536;
-    var HEAP_RECLAIM_MIN_INTERVAL_MS = 6e5;
-    var MB = (bytes) => Math.round(bytes / 1048576);
-    function buildHeapSample(mem, heapLimitBytes, warnRatio = HEAP_WATCH_WARN_RATIO) {
-      const usedRatio = heapLimitBytes > 0 ? mem.heapUsed / heapLimitBytes : 0;
-      return {
-        rssMb: MB(mem.rss),
-        heapUsedMb: MB(mem.heapUsed),
-        heapTotalMb: MB(mem.heapTotal),
-        heapLimitMb: MB(heapLimitBytes),
-        externalMb: MB(mem.external),
-        arrayBuffersMb: MB(mem.arrayBuffers),
-        usedRatio: Math.round(usedRatio * 100) / 100,
-        nearLimit: usedRatio >= warnRatio
-      };
-    }
-    var consoleSink = {
-      info: (line) => console.log(line),
-      warn: (line) => console.warn(line)
-    };
-    function strandedMb(s) {
-      return s.rssMb - s.heapUsedMb - s.externalMb;
-    }
-    function shouldReclaim(s, triggerMb = HEAP_RECLAIM_TRIGGER_MB) {
-      return strandedMb(s) > triggerMb;
-    }
-    function isGcFunction(value) {
-      return typeof value === "function";
-    }
-    function createV8Reclaimer() {
-      try {
-        node_v8.setFlagsFromString("--expose-gc");
-        const gc = node_vm.runInNewContext("gc");
-        node_v8.setFlagsFromString("--no-expose-gc");
-        if (!isGcFunction(gc)) return void 0;
-        return () => gc({
-          execution: "sync",
-          flavor: "last-resort"
-        });
-      } catch {
-        return;
-      }
-    }
-    function format$1(label, s) {
-      return `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
-    }
-    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions) {
-      const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
-      const now = reclaimOptions?.now ?? (() => Date.now());
-      const triggerMb = reclaimOptions?.triggerMb ?? 1536;
-      const minIntervalMs = reclaimOptions?.minIntervalMs ?? 6e5;
-      const fastIntervalMs = reclaimOptions?.fastIntervalMs ?? 2e3;
-      const escalateRatio = reclaimOptions?.escalateRatio ?? 0.7;
-      const deescalateRatio = reclaimOptions?.deescalateRatio ?? 0.6;
-      let lastReclaimAt = Number.NEGATIVE_INFINITY;
-      const read = () => {
-        const limit = reclaimOptions?.heapLimitBytes ?? node_v8.getHeapStatistics().heap_size_limit;
-        return buildHeapSample(readMemory(), limit);
-      };
-      const maybeReclaim = (sample) => {
-        if (reclaimOptions === void 0) return;
-        if (!shouldReclaim(sample, triggerMb)) return;
-        if (now() - lastReclaimAt < minIntervalMs) return;
-        lastReclaimAt = now();
-        const startedAt = now();
-        try {
-          reclaimOptions.reclaim();
-        } catch (error) {
-          sink.warn(`[mem] reclaim failed \u2014 ${error instanceof Error ? error.message : String(error)}`);
-          return;
-        }
-        const after = read();
-        sink.info(`[mem] reclaim ${label} stranded=${strandedMb(sample)}MB rss=${sample.rssMb}MB\u2192${after.rssMb}MB freed=${sample.rssMb - after.rssMb}MB arrayBuffers=${sample.arrayBuffersMb}MB\u2192${after.arrayBuffersMb}MB took=${now() - startedAt}ms`);
-      };
-      let mode = "steady";
-      let lastLoggedAt = Number.NEGATIVE_INFINITY;
-      const probeIntervalMs = Math.min(fastIntervalMs, intervalMs);
-      const tick = () => {
-        try {
-          const sample = read();
-          const previous = mode;
-          mode = nextMode(previous, sample.usedRatio, escalateRatio, deescalateRatio);
-          const at2 = now();
-          const due = at2 - lastLoggedAt >= intervalMs;
-          if (mode === "escalated" || due) {
-            lastLoggedAt = at2;
-            const line = format$1(label, sample);
-            if (sample.nearLimit) sink.warn(`${line} \u2014 APPROACHING HEAP LIMIT`);
-            else if (mode === "escalated") sink.warn(`${line} \u2014 heap elevated, sampling every ${probeIntervalMs}ms`);
-            else sink.info(line);
-          }
-          if (previous === "escalated" && mode === "steady") sink.info(`[mem] ${label} heap back to routine \u2014 logging every ${intervalMs}ms`);
-          maybeReclaim(sample);
-        } catch {
-        }
-      };
-      const timer = setInterval(tick, probeIntervalMs);
-      timer.unref?.();
-      tick();
-      let stopped = false;
-      return () => {
-        if (stopped) return;
-        stopped = true;
-        clearInterval(timer);
-      };
-    }
     var VALID_TRANSITIONS = {
       stopped: ["starting", "disabled"],
       starting: [
@@ -118447,17 +118696,27 @@ var require_dist3 = __commonJS({
       return bare;
     }
     var PRUNE_TARGET_RATIO = 0.9;
+    var DEFAULT_MAX_TOTAL_LOG_ENTRIES = 5e4;
     var PartitionedLogBuffer = class {
       buffers = /* @__PURE__ */ new Map();
+      /**
+      * Bucket key → the write ordinal of its last `push`. A monotonic counter, not
+      * a clock: eviction order must follow the order writes actually happened, and
+      * a wall clock that steps backwards would pick the wrong victim.
+      */
+      lastWriteSeq = /* @__PURE__ */ new Map();
+      writeSeq = 0;
       perAddonCapacity;
       maxTotalEntries;
       pruneLevel;
+      maxBuckets;
       /** Running total, so `push` does not walk every bucket to decide. */
       totalEntries = 0;
       constructor(perAddonCapacity = 5e3, options = {}) {
         this.perAddonCapacity = options.perAddonCapacity ?? perAddonCapacity;
-        this.maxTotalEntries = options.maxTotalEntries ?? null;
+        this.maxTotalEntries = options.maxTotalEntries === void 0 ? DEFAULT_MAX_TOTAL_LOG_ENTRIES : options.maxTotalEntries;
         this.pruneLevel = options.pruneLevel ?? "debug";
+        this.maxBuckets = options.maxBuckets === void 0 ? 128 : options.maxBuckets;
       }
       /**
       * Apply new limits at runtime. Shrinking takes effect as entries are pushed
@@ -118470,6 +118729,7 @@ var require_dist3 = __commonJS({
         if (options.perAddonCapacity !== void 0 && options.perAddonCapacity > 0) this.perAddonCapacity = options.perAddonCapacity;
         if (options.maxTotalEntries !== void 0) this.maxTotalEntries = options.maxTotalEntries;
         if (options.pruneLevel !== void 0) this.pruneLevel = options.pruneLevel;
+        if (options.maxBuckets !== void 0) this.maxBuckets = options.maxBuckets;
       }
       bufferFor(key) {
         let buf = this.buffers.get(key);
@@ -118480,34 +118740,82 @@ var require_dist3 = __commonJS({
         return buf;
       }
       push(entry) {
-        const buf = this.bufferFor(addonBucketKey(entry.tags?.addonId));
+        const key = addonBucketKey(entry.tags?.addonId);
+        const buf = this.bufferFor(key);
         const before = buf.size();
         buf.push(entry);
         this.totalEntries += buf.size() - before;
-        if (this.maxTotalEntries !== null && this.totalEntries > this.maxTotalEntries) this.enforceTotalCap(this.maxTotalEntries);
+        this.lastWriteSeq.set(key, ++this.writeSeq);
+        if (this.maxBuckets !== null && this.buffers.size > this.maxBuckets) this.evictBuckets(this.buffers.size - this.maxBuckets, key);
+        if (this.maxTotalEntries !== null && this.totalEntries > this.maxTotalEntries) this.enforceTotalCap(this.maxTotalEntries, key);
       }
       /**
-      * Bring the total down to `PRUNE_TARGET_RATIO × cap` by discarding prunable
-      * entries, largest bucket first. Stops early when nothing prunable is left —
-      * see the class docblock on why that is the correct outcome rather than a
-      * failure to enforce.
-      */
-      enforceTotalCap(cap) {
+      * Bring the total down to `PRUNE_TARGET_RATIO × cap`.
+      *
+      * Two passes, in this order and no other: first discard prunable entries,
+      * largest bucket first, which is free of information cost. Only if that
+      * cannot reach the target does the second pass drop WHOLE buckets,
+      * least-recently-written first — the bound has to hold even when every
+      * retained entry is above `pruneLevel`, and a bucket nobody has written to is
+      * the cheapest thing in the structure to lose.
+      */
+      enforceTotalCap(cap, protectedKey) {
         const target = Math.max(1, Math.floor(cap * PRUNE_TARGET_RATIO));
         let deficit = this.totalEntries - target;
         if (deficit <= 0) return;
-        const bySizeDesc = [...this.buffers.values()].sort((a, b) => b.size() - a.size());
-        for (const buf of bySizeDesc) {
+        const bySizeDesc = [...this.buffers.entries()].toSorted((a, b) => b[1].size() - a[1].size());
+        for (const [key, buf] of bySizeDesc) {
           if (deficit <= 0) break;
           const removed = buf.pruneOldestAtOrBelow(this.pruneLevel, deficit);
           this.totalEntries -= removed;
           deficit -= removed;
+          if (buf.size() === 0) this.dropBucket(key);
         }
+        if (deficit > 0) this.evictBucketsUntil(target, protectedKey);
+      }
+      /**
+      * Drop whole buckets, least-recently-WRITTEN first, until the total is at or
+      * below `target`. Never touches `protectedKey` (the bucket being written to
+      * right now) and always leaves at least one bucket standing.
+      */
+      evictBucketsUntil(target, protectedKey) {
+        for (const key of this.evictionOrder(protectedKey)) {
+          if (this.totalEntries <= target || this.buffers.size <= 1) return;
+          this.dropBucket(key);
+        }
+      }
+      /** Drop exactly `count` buckets, least-recently-written first. */
+      evictBuckets(count, protectedKey) {
+        let remaining = count;
+        for (const key of this.evictionOrder(protectedKey)) {
+          if (remaining <= 0 || this.buffers.size <= 1) return;
+          this.dropBucket(key);
+          remaining -= 1;
+        }
+      }
+      /** Bucket keys ordered least-recently-written first, excluding `protectedKey`.
+      *  A bucket with no recorded write sorts first — it can only be a leftover. */
+      evictionOrder(protectedKey) {
+        return [...this.buffers.keys()].filter((key) => key !== protectedKey).toSorted((a, b) => (this.lastWriteSeq.get(a) ?? 0) - (this.lastWriteSeq.get(b) ?? 0));
+      }
+      /** Remove a bucket and everything that indexes it. An empty ring left behind
+      *  is the leak this class shipped with — the map only ever grew. */
+      dropBucket(key) {
+        const buf = this.buffers.get(key);
+        if (buf === void 0) return;
+        this.totalEntries -= buf.size();
+        this.buffers.delete(key);
+        this.lastWriteSeq.delete(key);
       }
       /** Entries retained across every bucket. */
       size() {
         return this.totalEntries;
       }
+      /** Buckets currently retained. Observability for the aggregate bound — an
+      *  addon roster that only ever grows is what this class had to stop doing. */
+      bucketCount() {
+        return this.buffers.size;
+      }
       /** Every retained entry across all buckets, newest-first (mirrors
       *  {@link LogRingBuffer.getAll}). Used to replay history to a destination. */
       getAll() {
@@ -118535,13 +118843,25 @@ var require_dist3 = __commonJS({
         if (pinned !== null) {
           const removed2 = this.buffers.get(pinned)?.clear(filter) ?? 0;
           this.totalEntries -= removed2;
+          this.dropIfEmpty(pinned);
           return removed2;
         }
         let removed = 0;
-        for (const buf of this.buffers.values()) removed += buf.clear(filter);
+        for (const [key, buf] of [...this.buffers.entries()]) {
+          removed += buf.clear(filter);
+          this.dropIfEmpty(key);
+        }
         this.totalEntries -= removed;
         return removed;
       }
+      /** An emptied bucket is removed rather than left as an empty ring: the map
+      *  used to grow with every addon id that ever logged and never shrink. */
+      dropIfEmpty(key) {
+        if (this.buffers.get(key)?.size() === 0) {
+          this.buffers.delete(key);
+          this.lastWriteSeq.delete(key);
+        }
+      }
       /** The bucket key a filter pins to via `tags.addonId`, or null when the
       *  filter doesn't constrain the addon (→ scan all buckets). */
       pinnedAddonKey(filter) {
@@ -118637,11 +118957,13 @@ var require_dist3 = __commonJS({
       * `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
       * evicts only its own lines, so quiet addons keep their sparse history.
       *
-      * `options.maxTotalEntries` adds a soft ceiling across all buckets, because the
-      * per-bucket bound scales with addon count. When it is exceeded, only entries at
-      * or below `options.pruneLevel` (default `debug`) are discarded — `warn` and
-      * `error` are never evicted to satisfy it. Both default to the previous
-      * behaviour: no total cap. See {@link PartitionedLogBuffer}.
+      * `options.maxTotalEntries` ceilings the total across all buckets, because the
+      * per-bucket bound scales with addon count, and `options.maxBuckets` ceilings the
+      * bucket count itself. When the total is exceeded, entries at or below
+      * `options.pruneLevel` (default `debug`) are discarded first — a live addon's
+      * `warn`/`error` are never evicted to satisfy it — and only if that cannot reach
+      * the target are whole least-recently-written buckets dropped. Both bounds are ON
+      * by default; pass an explicit `null` to opt out. See {@link PartitionedLogBuffer}.
       */
       constructor(perAddonCapacity = 5e3, options = {}) {
         this.ringBuffer = new PartitionedLogBuffer(perAddonCapacity, options);
@@ -197242,22 +197564,33 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         });
       });
     }
+    var EMPTY_HEAP_DECLARATION = {
+      profile: void 0,
+      maxOldSpaceMb: void 0
+    };
     var heapProfileCache = /* @__PURE__ */ new Map();
-    function readAddonHeapProfile(spec) {
+    function readAddonHeapDeclaration(spec) {
       const cacheKey = `${spec.addonDir}::${spec.addonId}`;
       const cached = heapProfileCache.get(cacheKey);
-      if (cached !== void 0 || heapProfileCache.has(cacheKey)) return cached;
-      let profile;
+      if (cached !== void 0) return cached;
+      let declaration = EMPTY_HEAP_DECLARATION;
       for (const manifestPath of [node_path.join(spec.addonDir, "package.json"), node_path.join(node_path.dirname(spec.addonDir), "package.json")]) try {
         const raw = node_fs.readFileSync(manifestPath, "utf8");
         const parsed = JSON.parse(raw);
-        profile = extractHeapProfile(parsed, spec.addonId);
-        if (profile !== void 0) break;
+        const profile = extractHeapProfile(parsed, spec.addonId);
+        const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
+        if (profile !== void 0 || maxOldSpaceMb !== void 0) {
+          declaration = {
+            profile,
+            maxOldSpaceMb
+          };
+          break;
+        }
         if (manifestHasAddon(parsed, spec.addonId)) break;
       } catch {
       }
-      heapProfileCache.set(cacheKey, profile);
-      return profile;
+      heapProfileCache.set(cacheKey, declaration);
+      return declaration;
     }
     function invalidateHeapProfiles(addons) {
       for (const spec of addons) heapProfileCache.delete(`${spec.addonDir}::${spec.addonId}`);
@@ -197269,6 +197602,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.heapProfile;
       return value === "heavy" || value === "light" ? value : void 0;
     }
+    function extractMaxOldSpaceMb(parsed, addonId) {
+      const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.maxOldSpaceMb;
+      return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
+    }
     function readManifestAddons(parsed) {
       if (typeof parsed !== "object" || parsed === null) return [];
       const camstack = parsed.camstack;
@@ -197277,15 +197614,25 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       return Array.isArray(addons) ? addons : [];
     }
     function isHeavyRunner(addons) {
-      return addons.some((a) => readAddonHeapProfile(a) === "heavy");
+      return addons.some((a) => readAddonHeapDeclaration(a).profile === "heavy");
+    }
+    var HEAVY_MAX_OLD_MB_DEFAULT = 1024;
+    function runnerMaxOldSpaceMb(addons, heavy) {
+      const envDefault = heavy ? positiveIntEnv("CAMSTACK_RUNNER_HEAVY_MAX_OLD_MB", HEAVY_MAX_OLD_MB_DEFAULT) : positiveIntEnv("CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB", 0);
+      const declared = addons.map((a) => readAddonHeapDeclaration(a).maxOldSpaceMb).filter((mb) => mb !== void 0);
+      if (declared.length === 0) return envDefault;
+      if (declared.includes(0)) return 0;
+      return Math.max(...declared);
     }
     function runnerHeapFlags(addons) {
       if (process.env["CAMSTACK_RUNNER_HEAP_TUNING"] === "off") return [];
-      if (isHeavyRunner(addons)) return [];
-      const semiMb = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB", 2);
-      const oldMb = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_MAX_OLD_MB", 0);
+      const heavy = isHeavyRunner(addons);
       const flags = [];
-      if (semiMb > 0) flags.push(`--max-semi-space-size=${semiMb}`);
+      if (!heavy) {
+        const semiMb = positiveIntEnv("CAMSTACK_RUNNER_LIGHT_SEMI_SPACE_MB", 2);
+        if (semiMb > 0) flags.push(`--max-semi-space-size=${semiMb}`);
+      }
+      const oldMb = runnerMaxOldSpaceMb(addons, heavy);
       if (oldMb > 0) flags.push(`--max-old-space-size=${oldMb}`);
       return flags;
     }
@@ -197332,19 +197679,21 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       function spawnRunner(runnerId, addons, env) {
         const nodeId = buildNodeId(runnerId);
         const runnerPath = node_path.resolve(__dirname, "addon-runner.js");
+        const heavy = isHeavyRunner(addons);
         const childEnv = {
           ...process.env,
           CAMSTACK_RUNNER_ID: runnerId,
           CAMSTACK_RUNNER_ADDONS: JSON.stringify(addons),
           CAMSTACK_PARENT_NODE_ID: parentNodeId,
           CAMSTACK_DATA_DIR: dataDir,
+          CAMSTACK_RUNNER_HEAP_PROFILE: heavy ? "heavy" : "light",
           CAMSTACK_LOG_LEVEL: process.env["CAMSTACK_LOG_LEVEL"] ?? "info",
           ...parentTcpPort !== void 0 ? { CAMSTACK_PARENT_TCP_PORT: String(parentTcpPort) } : {},
           ...parentUdsPath !== void 0 ? { CAMSTACK_PARENT_UDS_PATH: parentUdsPath } : {},
           ...env
         };
         const heapFlags = runnerHeapFlags(addons);
-        capturedBroker?.logger.info(`[${runnerId}] heap profile: ${isHeavyRunner(addons) ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
+        capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}]`);
         const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
           env: childEnv,
           stdio: [
@@ -197388,6 +197737,15 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
             capturedBroker?.logger.error(`[${runnerId}] Crash circuit-breaker tripped \u2014 ${decision.crashesInWindow} crashes in ${CRASH_WINDOW_MS}ms. Not respawning.`);
             processes.set(runnerId, entry);
             if (capturedBroker) forceMoleculerDisconnect(capturedBroker, entry.nodeId);
+            emitRunnerEvent(require_dist10.EventCategory.AddonRunnerFailed, runnerId, {
+              runnerId,
+              nodeId: parentNodeId,
+              addonIds: entry.runnerAddons.map((addon) => addon.addonId),
+              crashesInWindow: decision.crashesInWindow,
+              windowMs: CRASH_WINDOW_MS,
+              ...code !== null ? { exitCode: code } : {},
+              ...signal !== null ? { signal } : {}
+            });
             for (const addon of entry.runnerAddons) emitRunnerEvent(require_dist10.EventCategory.AddonCrashed, addon.addonId, {
               addonId: addon.addonId,
               error: `Crash circuit-breaker tripped after ${decision.crashesInWindow} crashes in ${CRASH_WINDOW_MS}ms`
@@ -198109,10 +198467,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.HEALTH_MONITOR_GRACE_PERIOD_MS = HEALTH_MONITOR_GRACE_PERIOD_MS;
     exports.HEALTH_MONITOR_RETRY_INTERVALS_MS = HEALTH_MONITOR_RETRY_INTERVALS_MS;
     exports.HEALTH_MONITOR_TICK_MS = HEALTH_MONITOR_TICK_MS;
-    exports.HEAP_RECLAIM_MIN_INTERVAL_MS = HEAP_RECLAIM_MIN_INTERVAL_MS;
-    exports.HEAP_RECLAIM_TRIGGER_MB = HEAP_RECLAIM_TRIGGER_MB;
-    exports.HEAP_WATCH_INTERVAL_MS = HEAP_WATCH_INTERVAL_MS;
-    exports.HEAP_WATCH_WARN_RATIO = HEAP_WATCH_WARN_RATIO;
+    exports.HEAP_RECLAIM_MIN_INTERVAL_MS = require_manifest_python_deps.HEAP_RECLAIM_MIN_INTERVAL_MS;
+    exports.HEAP_RECLAIM_TRIGGER_MB = require_manifest_python_deps.HEAP_RECLAIM_TRIGGER_MB;
+    exports.HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.HEAP_WATCH_INTERVAL_MS;
+    exports.HEAP_WATCH_WARN_RATIO = require_manifest_python_deps.HEAP_WATCH_WARN_RATIO;
     exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
     exports.HUB_CAP_FWD_SERVICE = require_manifest_python_deps.HUB_CAP_FWD_SERVICE;
     exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAddon$1;
@@ -198151,6 +198509,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.PythonEnvManager = PythonEnvManager;
     exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
     exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
+    exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
     exports.RUNTIME_DEFAULTS = require_dist10.RUNTIME_DEFAULTS;
     exports.ReadinessRegistry = require_dist10.ReadinessRegistry;
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
@@ -198189,7 +198548,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
     });
     exports.buildCapRouters = buildCapRouters;
-    exports.buildHeapSample = buildHeapSample;
+    exports.buildHeapSample = require_manifest_python_deps.buildHeapSample;
     exports.buildLinkChain = require_manifest_python_deps.buildLinkChain;
     exports.buildNativeCapProxy = require_manifest_python_deps.buildNativeCapProxy;
     exports.buildNodeManifest = buildNodeManifest;
@@ -198234,7 +198593,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.createUdsEventBus = require_manifest_python_deps.createUdsEventBus;
     exports.createUdsLogger = require_manifest_python_deps.createUdsLogger;
     exports.createUdsLoggerWithControl = require_manifest_python_deps.createUdsLoggerWithControl;
-    exports.createV8Reclaimer = createV8Reclaimer;
+    exports.createV8Reclaimer = require_manifest_python_deps.createV8Reclaimer;
     exports.deleteModelFromDisk = require_file_data_plane.deleteModelFromDisk;
     exports.deriveAgentListenPort = deriveAgentListenPort;
     exports.describeProviderKindDrift = describeProviderKindDrift;
@@ -198360,9 +198719,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays;
     exports.setHubConnected = require_manifest_python_deps.setHubConnected;
     exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
-    exports.shouldReclaim = shouldReclaim;
-    exports.startHeapWatch = startHeapWatch;
-    exports.strandedMb = strandedMb;
+    exports.shouldReclaim = require_manifest_python_deps.shouldReclaim;
+    exports.startHeapWatch = require_manifest_python_deps.startHeapWatch;
+    exports.startRunnerHeapWatch = require_manifest_python_deps.startRunnerHeapWatch;
+    exports.strandedMb = require_manifest_python_deps.strandedMb;
     exports.stripCamstackDeps = stripCamstackDeps;
     exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
     exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
@@ -237035,7 +237395,7 @@ var require_enums = __commonJS({
   "../types/dist/enums.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_D3gG7oil();
+    var require_event_category = require_event_category_CRPORAAz();
     var EventSourceType = /* @__PURE__ */ (function(EventSourceType2) {
       EventSourceType2["Addon"] = "addon";
       EventSourceType2["Core"] = "core";
@@ -237055,8 +237415,8 @@ var require_dist9 = __commonJS({
   "../types/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-    var require_event_category = require_event_category_D3gG7oil();
-    var require_sleep = require_sleep_EYtyUX0L();
+    var require_event_category = require_event_category_CRPORAAz();
+    var require_sleep = require_sleep_CMRLJj2e();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -237978,6 +238338,7 @@ var require_dist9 = __commonJS({
       preBufferSec: 10,
       postBufferSec: 30
     };
+    var VISIT_MERGE_GAP_MS = DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec * 1e3;
     var RecordingRetentionSchema = zod.z.object({
       maxAgeDays: zod.z.number().min(0).optional(),
       maxSizeGb: zod.z.number().min(0).optional()
@@ -238039,6 +238400,12 @@ var require_dist9 = __commonJS({
       /** DERIVED summary of `bands`, stamped by the recorder on every save.
       *  Authoring it has no effect — see {@link RecordingStorageModeSchema}. */
       mode: RecordingStorageModeSchema.optional(),
+      /**
+      * Which assigned broker slots to record. Absent / empty = {@link
+      * DEFAULT_RECORDING_PROFILES} (`high`+`low`) intersected with the
+      * camera's currently assigned slots — never `mid` unless the operator
+      * picks it, and never a slot the broker has not assigned.
+      */
       profiles: zod.z.array(require_sleep.CamProfileSchema).optional(),
       segmentSeconds: zod.z.number().int().positive().optional(),
       /**
@@ -238061,6 +238428,15 @@ var require_dist9 = __commonJS({
       if (config.bands.some((band) => band.mode === "continuous")) return "continuous";
       return "events";
     }
+    var DEFAULT_RECORDING_PROFILES = ["high", "low"];
+    function resolveRecordingProfiles(assigned, override) {
+      if (override !== void 0 && override.length > 0) {
+        const selected = assigned.filter((profile) => override.includes(profile));
+        return selected.length > 0 ? selected : [...assigned];
+      }
+      const preferred = assigned.filter((profile) => DEFAULT_RECORDING_PROFILES.includes(profile));
+      return preferred.length > 0 ? preferred : [...assigned];
+    }
     var RelocateJobStateSchema = zod.z.enum([
       "queued",
       "running",
@@ -238106,7 +238482,11 @@ var require_dist9 = __commonJS({
       profiles: zod.z.array(zod.z.string()).optional(),
       /** Copy throttle in MB/s (default 40) — the drain is a background chore,
       *  never allowed to starve live writers. */
-      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+      throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+      /** Move only segments whose startMs is >= this. Absent = the whole source
+      *  pile. Used when a full drain is too expensive and the operator only
+      *  wants the recent window on the new disk. */
+      sinceMs: zod.z.number().int().optional()
     });
     var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
     var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
@@ -246609,6 +246989,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "node-offline",
       "node-inference-unavailable",
       "detection-blind",
+      "addon-crash-loop",
       "addon-update-available",
       "server-update-available",
       "alarm-triggered",
@@ -246616,6 +246997,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "alarm-disarmed",
       "alarm-arming",
       "alarm-arm-refused",
+      "addon-updated",
+      "server-updated",
+      "export-completed",
       "camera-online",
       "camera-offline",
       "camera-disabled",
@@ -247445,6 +247829,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
             value: "detection-blind",
             label: "Camera detecting nothing"
           },
+          {
+            value: "addon-crash-loop",
+            label: "Addon stopped after repeated crashes"
+          },
           {
             value: "addon-update-available",
             label: "Addon update available"
@@ -247453,6 +247841,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
             value: "server-update-available",
             label: "Server update available"
           },
+          {
+            value: "addon-updated",
+            label: "Addons updated"
+          },
+          {
+            value: "server-updated",
+            label: "Server updated"
+          },
+          {
+            value: "export-completed",
+            label: "Export completed"
+          },
           {
             value: "alarm-arming",
             label: "Alarm arming (exit delay)"
@@ -248469,7 +248869,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       *  `'staging'`. */
       markForTrain: zod.z.boolean().optional(),
       /** Operator marked this track for diagnostic attention. */
-      debug: zod.z.boolean().optional()
+      debug: zod.z.boolean().optional(),
+      /** Operator favourited this track. Pins it against pruning. */
+      favourited: zod.z.boolean().optional()
     };
     var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
     var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
@@ -248477,6 +248879,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       trackId: zod.z.string(),
       markForTrain: zod.z.boolean(),
       debug: zod.z.boolean(),
+      favourited: zod.z.boolean(),
       /** The lifecycle state the boolean was derived from. Required here (unlike on
       *  a track row) because this shape is only ever produced by the write body,
       *  which always knows it — and a surface that has just written needs to render
@@ -248999,6 +249402,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Per-track CLIP search vectors removed (best-effort). */
       embeddings: zod.z.number().int()
     });
+    var DiskReconcileCountsSchema = zod.z.object({
+      mediaDropped: zod.z.number().int(),
+      tracks: zod.z.number().int(),
+      events: zod.z.number().int()
+    });
     var EventStoreDeviceFootprintSchema = zod.z.object({
       deviceId: zod.z.number(),
       /** Persisted event rows (motion + object + audio) for the camera. */
@@ -249255,6 +249663,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           auth: "admin"
         }),
         /**
+        * Disk-wins reconcile for one camera. Drops media index rows whose blobs
+        * are gone, then cascades tracks (including favourited and staging) that
+        * have no remaining files. Enrolled identity/vehicle/scene media is never
+        * probed. Trackless motion/audio events with no remaining file are dropped,
+        * including snapshot-less rows.
+        */
+        reconcileFromDisk: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), DiskReconcileCountsSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /**
         * Delete whole tracks (object events) by id for the given device,
         * cascading their media in lockstep. Returns the number of tracks
         * actually deleted plus the ids that could not be removed.
@@ -249273,7 +249692,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           auth: "admin"
         }),
         /**
-        * Set the per-track operator flags (`markForTrain`, `debug`) on ONE track.
+        * Set the per-track operator flags (`markForTrain`, `debug`, `favourited`) on ONE track.
         * The patch is PARTIAL — an omitted key is left untouched — because the
         * three surfaces that write it (admin Events grid, viewer track detail,
         * viewer cluster detail) each own one toggle and must not clobber the other.
@@ -251261,6 +251680,24 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Wall-clock ms spent on the stage before it was abandoned. */
       elapsedMs: zod.z.number()
     });
+    var DiskReconcileJobSchema = zod.z.object({
+      state: zod.z.enum([
+        "idle",
+        "running",
+        "done",
+        "error"
+      ]),
+      total: zod.z.number().int().nonnegative(),
+      completed: zod.z.number().int().nonnegative(),
+      currentDeviceId: zod.z.number().int().nullable(),
+      failed: zod.z.array(zod.z.number().int()).readonly(),
+      mediaDropped: zod.z.number().int().nonnegative(),
+      tracks: zod.z.number().int().nonnegative(),
+      events: zod.z.number().int().nonnegative(),
+      startedAtMs: zod.z.number().int().nullable(),
+      finishedAtMs: zod.z.number().int().nullable(),
+      error: zod.z.string().nullable()
+    });
     var CameraStatusSchema = zod.z.object({
       deviceId: zod.z.number(),
       assignment: CameraAssignmentStatusSchema,
@@ -251785,6 +252222,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * rail without issuing N parallel browser round-trips.
         */
         getCameraStatuses: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.array(CameraStatusSchema).readonly()),
+        /**
+        * Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
+        * the addon process and returns immediately with the job snapshot — the
+        * work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
+        * Admin-only. Idempotent while a job is already running.
+        */
+        reconcileFromDisk: require_sleep.method(zod.z.void(), DiskReconcileJobSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /** Snapshot of the in-flight or last disk-wins fleet reconcile. */
+        getReconcileFromDiskStatus: require_sleep.method(zod.z.void(), DiskReconcileJobSchema, { auth: "admin" }),
         /** List every template the operator has saved. */
         listTemplates: require_sleep.method(zod.z.void(), zod.z.array(PipelineTemplateSchema).readonly()),
         /** Create a new named preset from a given CameraPipelineConfig. */
@@ -252927,6 +253376,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         stats: require_sleep.method(VectorStatsInputSchema, VectorStatsResultSchema)
       }
     };
+    var MAX_CLIP_EVENT_IDS = 24;
+    var MAX_CLIP_LABELS = 3;
     var ClipSchema = zod.z.object({
       /** Opaque, provider-namespaced id. The default provider encodes the time
       *  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -252943,8 +253394,65 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         startMs: zod.z.number(),
         endMs: zod.z.number()
       }),
-      /** Thumbnail URL (lazy; e.g. analytics `getEventMedia`). Never inlined. */
-      thumbnail: zod.z.string().optional()
+      /**
+      * Distinct object classes attached to this visit (`person`, `car`, …),
+      * dominant first, capped at {@link MAX_CLIP_LABELS}. The ribbon renders these
+      * instead of the bare kind — "Object" tells the operator nothing a colour bar
+      * did not. Absent (never empty) when the visit attached no classified object
+      * event, so a motion/audio-only visit keeps its kind label.
+      */
+      labels: zod.z.array(zod.z.string()).max(3).optional(),
+      /**
+      * Lazy thumbnail URL, never inlined.
+      *
+      * Recording-derived clips (events-mode keep-window, and the prepared
+      * continuous event+fragment visit) MUST use the snapshot of the **main
+      * event of the interval** — `getEventMedia({ eventId, kind: 'snapshot' })`
+      * of the event that owns `kind` (object > motion > audio). Do not extract
+      * a keyframe from the recorded segments. Other providers (onboard, HKSV)
+      * mint their own stills.
+      *
+      * **VOUCHED, never fabricated.** A provider emits this only for an event it
+      * has CONFIRMED owns at least one media row (its own, or its owning track's).
+      * Absent is meaningful — "this visit has no event still" — never "we did not
+      * look". Stamping it from a URL template made 35% of one camera's clips point
+      * at a 404 (device 3836, 2026-08-17: 64 of 179 clips dead, 63 of them motion).
+      * A read that FAILS drops the claim; it never invents it.
+      */
+      thumbnail: zod.z.string().optional(),
+      /**
+      * An instant INSIDE this visit's footage, hole-safe, where a recorded still
+      * can be decoded. Present whenever the visit came from recorded availability;
+      * absent on a per-event padded window (there is no footage to promise).
+      *
+      * This is not a thumbnail and not a second byte path: it is the argument to
+      * the recorder's existing still route. The surface — never the provider —
+      * decides whether to use it. It is the midpoint of the visit's LONGEST
+      * contiguous range, not of the visit: a visit spans its holes by
+      * construction, so a naive midpoint lands in dead air.
+      */
+      stillAtMs: zod.z.number().optional(),
+      /**
+      * Analytics event ids that overlap this visit — a BOUNDED sample, newest
+      * first within kind (object → motion → audio), capped at
+      * {@link MAX_CLIP_EVENT_IDS}. Empty on footage-only clips.
+      *
+      * Bounded because it is not a payload the surface pages through: one visit on
+      * device 615 carried 2 345 ids, and `eventIds` was 99% of a 153 KB
+      * camera-day. Read {@link eventCount} for the true total.
+      */
+      eventIds: zod.z.array(zod.z.string()).optional(),
+      /** How many analytics events actually overlap this visit. Differs from
+      *  `eventIds.length` exactly when the sample was capped — so a truncated
+      *  list is never mistaken for a quiet visit. */
+      eventCount: zod.z.number().int().nonnegative().optional(),
+      /** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
+      *  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
+      *  bar keeps showing them via `recording.getAvailability`. */
+      holes: zod.z.array(zod.z.object({
+        startMs: zod.z.number(),
+        endMs: zod.z.number()
+      })).optional()
     });
     var ClipPlaybackSchema = zod.z.object({
       /** HLS master URL through the hub data-plane (Range + token in path). */
@@ -253492,7 +254000,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     });
     var AutoUpdateSettingsSchema = zod.z.object({
       channel: ChannelSchema,
-      intervalSeconds: zod.z.number()
+      intervalSeconds: zod.z.number(),
+      /**
+      * Cadence of the "an update exists" POLLER, in seconds. Independent of
+      * `channel`: the poller runs while auto-apply is `off`, because being told
+      * about a publish and installing it are different decisions. Clamped
+      * server-side to 900 s … 604800 s; defaults to 21600 s (6 h).
+      */
+      updateCheckIntervalSeconds: zod.z.number()
     });
     var AddonAutoUpdateSchema = ChannelWithInheritSchema;
     var RestartAddonResultSchema = zod.z.unknown();
@@ -253743,7 +254258,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         getAutoUpdateSettings: require_sleep.method(zod.z.void(), AutoUpdateSettingsSchema, { auth: "admin" }),
         setAutoUpdateSettings: require_sleep.method(zod.z.object({
           channel: ChannelSchema,
-          intervalSeconds: zod.z.number().min(300).max(86400).optional()
+          intervalSeconds: zod.z.number().min(300).max(86400).optional(),
+          /** Availability-poll cadence; see AutoUpdateSettingsSchema. */
+          updateCheckIntervalSeconds: zod.z.number().min(900).max(604800).optional()
         }), zod.z.unknown(), {
           kind: "mutation",
           auth: "admin"
@@ -259033,7 +259550,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       includeAudio: zod.z.boolean(),
       maxLifeMs: zod.z.number().int().positive(),
       deleteAfterDownload: zod.z.boolean(),
-      title: zod.z.string().max(200).optional()
+      title: zod.z.string().max(200).optional(),
+      /** Notification-output target ids to ping when this export becomes ready. */
+      notifyTargetIds: zod.z.array(zod.z.string().min(1)).max(20).optional()
     }).superRefine((v, ctx) => {
       if (v.speed !== void 0 && v.timelapse !== void 0) ctx.addIssue({
         code: zod.z.ZodIssueCode.custom,
@@ -259083,20 +259602,30 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       name: zod.z.string(),
       bytes: zod.z.number().int().nonnegative()
     });
+    var CreateExportInputSchema = zod.z.object({
+      deviceId: zod.z.number(),
+      /** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
+      profile: zod.z.string().optional(),
+      profiles: zod.z.array(zod.z.string()).min(1).optional(),
+      fromMs: zod.z.number(),
+      toMs: zod.z.number(),
+      options: ExportOptionsSchema
+    }).superRefine((v, ctx) => {
+      if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
+        code: zod.z.ZodIssueCode.custom,
+        message: "pass profiles[] (min 1) or legacy profile",
+        path: ["profiles"]
+      });
+    });
     var recordingExportCapability = {
       name: "recording-export",
       scope: "system",
       mode: "singleton",
       methods: {
-        /** Queue a render of `[fromMs,toMs)` for `deviceId`/`profile`. Fails fast
-        *  when no footage covers the range. Returns the queued record. */
-        createExport: require_sleep.method(zod.z.object({
-          deviceId: zod.z.number(),
-          profile: zod.z.string(),
-          fromMs: zod.z.number(),
-          toMs: zod.z.number(),
-          options: ExportOptionsSchema
-        }), ExportRecordSchema, {
+        /** Queue a render of `[fromMs,toMs)` for `deviceId`/`profiles` (legacy
+        *  singular `profile` still accepted). Fails fast when no footage covers
+        *  the range. One job per profile; returns the first queued record. */
+        createExport: require_sleep.method(CreateExportInputSchema, ExportRecordSchema, {
           kind: "mutation",
           auth: "protected"
         }),
@@ -262006,15 +262535,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           labels: ["probe not implemented"]
         };
       }
-      /**
-      * Top-level devices restored at once in {@link onRestoreDevices}.
-      *
-      * Four covers the fleets this ships to without turning a boot into a burst a
-      * camera NVR answers with a refusal. A provider whose upstream is a single
-      * session with a serial command channel (a Baichuan hub, an NVR that
-      * serialises ISAPI) should lower it; nothing needs to raise it.
-      */
-      restoreConcurrency = 4;
       async restoreDevices(savedDevices) {
         await this.onRestoreDevices(savedDevices);
         if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
@@ -262069,14 +262589,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
             });
           }
         };
-        let nextTopLevel = 0;
-        await Promise.all(Array.from({ length: Math.min(Math.max(1, this.restoreConcurrency), topLevel.length) }, async () => {
-          for (; ; ) {
-            const saved = topLevel[nextTopLevel++];
-            if (saved === void 0) return;
-            await restoreOne(saved);
-          }
-        }));
+        await Promise.all(topLevel.map((saved) => restoreOne(saved)));
         const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
         for (const saved of childRows) {
           const Class = this.deviceClasses[saved.type];
@@ -267639,6 +268152,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.reconcileFromDisk": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "create"
+      },
       "pipelineAnalytics.refreshStorageLocationsForMigration": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -268041,6 +268560,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineOrchestrator.getReconcileFromDiskStatus": {
+        capName: "pipeline-orchestrator",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "pipelineOrchestrator.listAgentSettings": {
         capName: "pipeline-orchestrator",
         capScope: "system",
@@ -268065,6 +268590,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "pipelineOrchestrator.reconcileFromDisk": {
+        capName: "pipeline-orchestrator",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "pipelineOrchestrator.removeAgentSettings": {
         capName: "pipeline-orchestrator",
         capScope: "system",
@@ -271308,6 +271839,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: true
       }],
+      "pipelineAnalytics.reconcileFromDisk": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.restageRetrainTrack": [{
         name: "deviceId",
         form: "single",
@@ -272926,6 +273462,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           getNodeInferenceDevices: (input) => dispatch("pipelineOrchestrator", "getNodeInferenceDevices", "query", input),
           resetNodePipelineDefaults: (input) => dispatch("pipelineOrchestrator", "resetNodePipelineDefaults", "mutation", input),
           getCameraStatuses: (input) => dispatch("pipelineOrchestrator", "getCameraStatuses", "query", input),
+          reconcileFromDisk: (input) => dispatch("pipelineOrchestrator", "reconcileFromDisk", "mutation", input),
+          getReconcileFromDiskStatus: (input) => dispatch("pipelineOrchestrator", "getReconcileFromDiskStatus", "query", input),
           listTemplates: (input) => dispatch("pipelineOrchestrator", "listTemplates", "query", input),
           saveTemplate: (input) => dispatch("pipelineOrchestrator", "saveTemplate", "mutation", input),
           updateTemplate: (input) => dispatch("pipelineOrchestrator", "updateTemplate", "mutation", input),
@@ -272974,6 +273512,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           startStorageRebalance: (input) => dispatch("recording", "startStorageRebalance", "mutation", input)
         },
         recordingExport: {
+          createExport: (input) => dispatch("recordingExport", "createExport", "mutation", input),
           getExport: (input) => dispatch("recordingExport", "getExport", "query", input),
           cancelExport: (input) => dispatch("recordingExport", "cancelExport", "mutation", input),
           deleteExport: (input) => dispatch("recordingExport", "deleteExport", "mutation", input),
@@ -273542,6 +274081,27 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       }
       return schedule.invert === true ? !inside : inside;
     }
+    var NC_SYSTEM_EVENT_FILTER_KEYS = [
+      "deviceIds",
+      "deviceTypes",
+      "nodeIds",
+      "packageNames"
+    ];
+    function systemEventFilterApplies(kind, filter) {
+      switch (filter) {
+        case "deviceIds":
+          return kind.startsWith("device-") || kind.startsWith("stream-") || kind === "detection-blind" || kind === "alarm-triggered" || kind === "export-completed";
+        case "deviceTypes":
+          return kind.startsWith("device-") || kind === "detection-blind";
+        case "nodeIds":
+          return kind.startsWith("node-") || kind === "addon-crash-loop" || kind === "addon-update-available" || kind === "addon-updated" || kind === "server-update-available" || kind === "server-updated";
+        case "packageNames":
+          return kind.endsWith("update-available") || kind === "addon-updated" || kind === "server-updated";
+      }
+    }
+    function systemEventFilterAppliesToAnyKind(kinds, filter) {
+      return kinds.some((kind) => systemEventFilterApplies(kind, filter));
+    }
     var TimelapseTemplateSchema = zod.z.object({
       title: zod.z.string().max(500).optional(),
       body: zod.z.string().max(2e3).optional()
@@ -274592,6 +275152,278 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         return rawUrl;
       }
     }
+    var MB = 1024 * 1024;
+    var DEFAULT_POOL_MEMORY_POLICY = {
+      sampleIntervalMs: 6e4,
+      baselineSettleSamples: 5,
+      baselineSampleCount: 3,
+      restartMultiple: 4,
+      floorBytes: 1024 * MB,
+      ceilingBytes: 3072 * MB,
+      cooldownMs: 30 * 6e4,
+      maxRestartsPerWindow: 6,
+      restartWindowMs: 1440 * 6e4
+    };
+    function resolvePoolMemoryPolicy(env) {
+      const num = (key, fallback, min) => {
+        const raw = env[key];
+        if (raw === void 0) return fallback;
+        const parsed = Number(raw);
+        return Number.isFinite(parsed) && parsed >= min ? parsed : fallback;
+      };
+      const d = DEFAULT_POOL_MEMORY_POLICY;
+      return {
+        sampleIntervalMs: num("CAMSTACK_POOL_MEM_INTERVAL_MS", d.sampleIntervalMs, 5e3),
+        baselineSettleSamples: d.baselineSettleSamples,
+        baselineSampleCount: d.baselineSampleCount,
+        restartMultiple: num("CAMSTACK_POOL_MEM_MULTIPLE", d.restartMultiple, 1.5),
+        floorBytes: num("CAMSTACK_POOL_MEM_FLOOR_MB", d.floorBytes / MB, 128) * MB,
+        ceilingBytes: num("CAMSTACK_POOL_MEM_CEILING_MB", d.ceilingBytes / MB, 256) * MB,
+        cooldownMs: num("CAMSTACK_POOL_MEM_COOLDOWN_MS", d.cooldownMs, 6e4),
+        maxRestartsPerWindow: num("CAMSTACK_POOL_MEM_MAX_RESTARTS", d.maxRestartsPerWindow, 1),
+        restartWindowMs: num("CAMSTACK_POOL_MEM_RESTART_WINDOW_MS", d.restartWindowMs, 6e4)
+      };
+    }
+    function parseProcStatus(text) {
+      const kb = (label) => {
+        const match = text.match(new RegExp(`^${label}:\\s+(\\d+)\\s*kB`, "m"));
+        return match ? Number(match[1]) * 1024 : null;
+      };
+      const rssBytes = kb("VmRSS");
+      if (rssBytes === null) return null;
+      const threadsMatch = text.match(/^Threads:\s+(\d+)/m);
+      return {
+        rssBytes,
+        vmBytes: kb("VmSize") ?? 0,
+        hwmBytes: kb("VmHWM") ?? 0,
+        swapBytes: kb("VmSwap") ?? 0,
+        threads: threadsMatch ? Number(threadsMatch[1]) : 0
+      };
+    }
+    function initialPoolMemoryState() {
+      return {
+        settleSeen: 0,
+        baselineWindow: [],
+        baselineBytes: null,
+        restartsAt: [],
+        lastRestartAt: null
+      };
+    }
+    function median(values) {
+      const sorted = [...values].sort((a, b) => a - b);
+      return sorted[Math.floor(sorted.length / 2)];
+    }
+    function advanceBaseline(state, rssBytes, policy) {
+      if (state.baselineBytes !== null) return state;
+      if (state.settleSeen < policy.baselineSettleSamples) return {
+        ...state,
+        settleSeen: state.settleSeen + 1
+      };
+      const window2 = [...state.baselineWindow, rssBytes];
+      if (window2.length < policy.baselineSampleCount) return {
+        ...state,
+        baselineWindow: window2
+      };
+      return {
+        ...state,
+        baselineWindow: window2,
+        baselineBytes: median(window2)
+      };
+    }
+    function poolMemoryThreshold(baselineBytes, policy) {
+      if (baselineBytes === null) return policy.ceilingBytes;
+      return Math.min(policy.ceilingBytes, Math.max(policy.floorBytes, policy.restartMultiple * baselineBytes));
+    }
+    function pruneRestarts(restartsAt, nowMs, policy) {
+      return restartsAt.filter((t) => nowMs - t < policy.restartWindowMs);
+    }
+    function evaluatePoolMemory(state, rssBytes, nowMs, policy) {
+      const next = advanceBaseline(state, rssBytes, policy);
+      const thresholdBytes = poolMemoryThreshold(next.baselineBytes, policy);
+      if (rssBytes <= thresholdBytes) return {
+        state: next,
+        action: next.baselineBytes === null ? "baseline-pending" : "ok",
+        baselineBytes: next.baselineBytes,
+        thresholdBytes
+      };
+      const inWindow = pruneRestarts(next.restartsAt, nowMs, policy);
+      const pruned = {
+        ...next,
+        restartsAt: inWindow
+      };
+      if (inWindow.length >= policy.maxRestartsPerWindow) return {
+        state: pruned,
+        action: "exhausted",
+        baselineBytes: next.baselineBytes,
+        thresholdBytes
+      };
+      if (pruned.lastRestartAt !== null && nowMs - pruned.lastRestartAt < policy.cooldownMs) return {
+        state: pruned,
+        action: "cooldown",
+        baselineBytes: next.baselineBytes,
+        thresholdBytes
+      };
+      return {
+        state: pruned,
+        action: "restart",
+        baselineBytes: next.baselineBytes,
+        thresholdBytes
+      };
+    }
+    function commitWatchdogRestart(state, nowMs) {
+      return {
+        ...initialPoolMemoryState(),
+        restartsAt: [...state.restartsAt, nowMs],
+        lastRestartAt: nowMs
+      };
+    }
+    function resetPoolBaseline(state) {
+      return {
+        ...initialPoolMemoryState(),
+        restartsAt: state.restartsAt,
+        lastRestartAt: state.lastRestartAt
+      };
+    }
+    function pickRestartCandidate(candidates) {
+      if (candidates.length === 0) return null;
+      let worst = candidates[0];
+      for (const c of candidates) if (c.rssBytes / c.thresholdBytes > worst.rssBytes / worst.thresholdBytes) worst = c;
+      return worst.key;
+    }
+    var PoolMemoryWatchdog = class {
+      pools = /* @__PURE__ */ new Map();
+      timer = null;
+      sweeping = false;
+      stopped = false;
+      opts;
+      now;
+      setTimer;
+      clearTimer;
+      constructor(opts) {
+        this.opts = opts;
+        this.now = opts.now ?? (() => Date.now());
+        this.setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+        this.clearTimer = opts.clearTimer ?? ((t) => clearTimeout(t));
+      }
+      start() {
+        if (this.timer || this.stopped) return;
+        this.arm();
+      }
+      stop() {
+        this.stopped = true;
+        if (this.timer) {
+          this.clearTimer(this.timer);
+          this.timer = null;
+        }
+      }
+      arm() {
+        const timer = this.setTimer(() => {
+          this.sweep().finally(() => {
+            if (!this.stopped) this.arm();
+          });
+        }, this.opts.policy.sampleIntervalMs);
+        if (typeof timer.unref === "function") timer.unref();
+        this.timer = timer;
+      }
+      /** One sweep: sample → log every pool → restart at most one. Public so the
+      *  loop is testable without fake global timers. */
+      async sweep() {
+        if (this.sweeping) return;
+        this.sweeping = true;
+        try {
+          await this.doSweep();
+        } catch (err) {
+          this.opts.log.warn("pool memory sweep failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+        } finally {
+          this.sweeping = false;
+        }
+      }
+      async doSweep() {
+        const nowMs = this.now();
+        const samples = await this.opts.sample();
+        const candidates = [];
+        const verdictByKey = /* @__PURE__ */ new Map();
+        for (const t of samples) {
+          const tracked2 = this.pools.get(t.key);
+          let state = tracked2?.state ?? initialPoolMemoryState();
+          if (tracked2 && tracked2.pids.length > 0 && !samePids(tracked2.pids, t.pids)) {
+            this.opts.log.warn("pool process changed outside the watchdog \u2014 re-baselining", { meta: {
+              poolKey: t.key,
+              previousPids: tracked2.pids,
+              pids: t.pids
+            } });
+            state = resetPoolBaseline(state);
+          }
+          const verdict2 = evaluatePoolMemory(state, t.rssBytes, nowMs, this.opts.policy);
+          this.pools.set(t.key, {
+            state: verdict2.state,
+            pids: t.pids
+          });
+          verdictByKey.set(t.key, verdict2);
+          this.opts.log.info("pool memory", { meta: {
+            poolKey: t.key,
+            pids: t.pids,
+            rssMb: Math.round(t.rssBytes / MB),
+            baselineMb: verdict2.baselineBytes === null ? null : Math.round(verdict2.baselineBytes / MB),
+            thresholdMb: Math.round(verdict2.thresholdBytes / MB),
+            action: verdict2.action,
+            ...t.meta
+          } });
+          if (verdict2.action === "restart") candidates.push({
+            key: t.key,
+            rssBytes: t.rssBytes,
+            thresholdBytes: verdict2.thresholdBytes
+          });
+          else if (verdict2.action === "cooldown") this.opts.log.warn("pool over memory threshold but inside restart cooldown", { meta: {
+            poolKey: t.key,
+            rssMb: Math.round(t.rssBytes / MB),
+            thresholdMb: Math.round(verdict2.thresholdBytes / MB),
+            cooldownMs: this.opts.policy.cooldownMs
+          } });
+          else if (verdict2.action === "exhausted") this.opts.log.error("pool memory watchdog gave up \u2014 restart budget exhausted, pool leaks faster than restarts can pay for; needs a heap profile (py-spy / tracemalloc)", { meta: {
+            poolKey: t.key,
+            rssMb: Math.round(t.rssBytes / MB),
+            thresholdMb: Math.round(verdict2.thresholdBytes / MB),
+            maxRestartsPerWindow: this.opts.policy.maxRestartsPerWindow,
+            restartWindowMs: this.opts.policy.restartWindowMs
+          } });
+        }
+        for (const key of [...this.pools.keys()]) if (!samples.some((t) => t.key === key)) this.pools.delete(key);
+        const pickedKey = pickRestartCandidate(candidates);
+        if (pickedKey === null) return;
+        const picked = candidates.find((c) => c.key === pickedKey);
+        const verdict = verdictByKey.get(pickedKey);
+        const tracked = this.pools.get(pickedKey);
+        const restartsInWindow = tracked.state.restartsAt.length + 1;
+        this.opts.log.warn("pool memory watchdog restarting pool \u2014 RSS over threshold", { meta: {
+          poolKey: pickedKey,
+          pids: tracked.pids,
+          rssMb: Math.round(picked.rssBytes / MB),
+          thresholdMb: Math.round(picked.thresholdBytes / MB),
+          baselineMb: verdict.baselineBytes === null ? null : Math.round(verdict.baselineBytes / MB),
+          restartsInWindow,
+          deferredCandidates: candidates.filter((c) => c.key !== pickedKey).map((c) => c.key)
+        } });
+        try {
+          await this.opts.restart(pickedKey);
+          this.pools.set(pickedKey, {
+            state: commitWatchdogRestart(tracked.state, this.now()),
+            pids: []
+          });
+        } catch (err) {
+          this.opts.log.error("pool memory watchdog restart failed", { meta: {
+            poolKey: pickedKey,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+        }
+      }
+    };
+    function samePids(a, b) {
+      if (a.length !== b.length) return false;
+      const sortedA = [...a].sort((x, y) => x - y);
+      const sortedB = [...b].sort((x, y) => x - y);
+      return sortedA.every((v, i) => v === sortedB[i]);
+    }
     function rectsToCells(rects, gridWidth, gridHeight) {
       const total = gridWidth * gridHeight;
       if (total <= 0 || rects.length === 0) return Array.from({ length: Math.max(0, total) }).fill(false);
@@ -275266,6 +276098,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
     exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
     exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
+    exports.DEFAULT_POOL_MEMORY_POLICY = DEFAULT_POOL_MEMORY_POLICY;
+    exports.DEFAULT_RECORDING_PROFILES = DEFAULT_RECORDING_PROFILES;
     exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
     exports.DEFAULT_RUNTIME_STATE_DURABILITY = require_sleep.DEFAULT_RUNTIME_STATE_DURABILITY;
     exports.DEFAULT_SCRUB_THUMBNAIL_PRESET = DEFAULT_SCRUB_THUMBNAIL_PRESET;
@@ -275316,6 +276150,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DiscoveredChildStatusSchema = DiscoveredChildStatusSchema;
     exports.DiscoveredDeviceSchema = DiscoveredDeviceSchema;
     exports.DiscoveredTargetSchema = DiscoveredTargetSchema;
+    exports.DiskReconcileJobSchema = DiskReconcileJobSchema;
     exports.DisposerChain = require_sleep.DisposerChain;
     exports.DoorbellPressEventSchema = DoorbellPressEventSchema;
     exports.DoorbellStatusSchema = DoorbellStatusSchema;
@@ -275455,6 +276290,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.LoginMethodContributionSchema = LoginMethodContributionSchema;
     exports.LoginStageEnum = LoginStageEnum;
     exports.MACRO_LABELS = MACRO_LABELS;
+    exports.MAX_CLIP_EVENT_IDS = MAX_CLIP_EVENT_IDS;
+    exports.MAX_CLIP_LABELS = MAX_CLIP_LABELS;
     exports.MAX_CONDITION_DEPTH = MAX_CONDITION_DEPTH;
     exports.MAX_CONDITION_LEAVES = MAX_CONDITION_LEAVES;
     exports.MAX_EXPRESSION_AST_NODES = MAX_EXPRESSION_AST_NODES;
@@ -275546,6 +276383,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.NC_HISTORY_LIMIT_MAX = NC_HISTORY_LIMIT_MAX;
     exports.NC_MAX_PER_TRACK_IMMEDIATE = NC_MAX_PER_TRACK_IMMEDIATE;
     exports.NC_SNOOZE_MAX_MINUTES = NC_SNOOZE_MAX_MINUTES;
+    exports.NC_SYSTEM_EVENT_FILTER_KEYS = NC_SYSTEM_EVENT_FILTER_KEYS;
     exports.NC_TAXONOMY = NC_TAXONOMY;
     exports.NativeCropBboxSchema = NativeCropBboxSchema;
     exports.NativeCropRefSchema = NativeCropRefSchema;
@@ -275659,6 +276497,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.PipelineValidationResultSchema = PipelineValidationResultSchema;
     exports.PlaceholderReasonSchema = PlaceholderReasonSchema;
     exports.PolygonPointSchema = PolygonPointSchema;
+    exports.PoolMemoryWatchdog = PoolMemoryWatchdog;
     exports.PowerMeterStatusSchema = PowerMeterStatusSchema;
     exports.PresenceStatusSchema = PresenceStatusSchema;
     exports.PressureSensorStatusSchema = PressureSensorStatusSchema;
@@ -275913,6 +276752,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.UpdateUserInputSchema = UpdateUserInputSchema;
     exports.UserRecordSchema = UserRecordSchema;
     exports.UserSummarySchema = UserSummarySchema;
+    exports.VISIT_MERGE_GAP_MS = VISIT_MERGE_GAP_MS;
     exports.VacuumControlStatusSchema = VacuumControlStatusSchema;
     exports.VacuumStateSchema = VacuumStateSchema;
     exports.ValveStateSchema = ValveStateSchema;
@@ -276025,6 +276865,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
     exports.colorCapability = colorCapability;
     exports.colorForKind = colorForKind;
+    exports.commitWatchdogRestart = commitWatchdogRestart;
     exports.compileExpression = compileExpression;
     exports.compileExpressionSafe = compileExpressionSafe;
     exports.composeSwitchedOff = composeSwitchedOff;
@@ -276094,6 +276935,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.errMsg = require_err_msg.errMsg;
     exports.evaluateAst = evaluateAst;
     exports.evaluateExpressionSource = evaluateExpressionSource;
+    exports.evaluatePoolMemory = evaluatePoolMemory;
     exports.evaluateZoneRules = evaluateZoneRules;
     exports.event = require_sleep.event;
     exports.eventEmitterCapability = eventEmitterCapability;
@@ -276123,6 +276965,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.hydrateSchema = require_sleep.hydrateSchema;
     exports.imageCapability = imageCapability;
     exports.imageSettingsCapability = imageSettingsCapability;
+    exports.initialPoolMemoryState = initialPoolMemoryState;
     exports.integrationsCapability = integrationsCapability;
     exports.intercomCapability = intercomCapability;
     exports.invocationFromEncodeProfile = require_canonical_hash.invocationFromEncodeProfile;
@@ -276205,6 +277048,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.parseJsonArray = require_sleep.parseJsonArray;
     exports.parseJsonObject = require_sleep.parseJsonObject;
     exports.parseJsonUnknown = require_sleep.parseJsonUnknown;
+    exports.parseProcStatus = parseProcStatus;
     exports.parseProfileBrokerId = require_sleep.parseProfileBrokerId;
     exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
     exports.patchAudio = patchAudio;
@@ -276213,6 +277057,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.pickDetailCropConvention = pickDetailCropConvention;
     exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
     exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
+    exports.pickRestartCandidate = pickRestartCandidate;
     exports.pickVideoEncoder = require_canonical_hash.pickVideoEncoder;
     exports.pickerForCondition = pickerForCondition;
     exports.pipelineAnalyticsCapability = pipelineAnalyticsCapability;
@@ -276221,6 +277066,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.pipelineRunnerCapability = pipelineRunnerCapability;
     exports.plateGalleryCapability = plateGalleryCapability;
     exports.platformProbeCapability = platformProbeCapability;
+    exports.poolMemoryThreshold = poolMemoryThreshold;
     exports.powerMeterCapability = powerMeterCapability;
     exports.prepareNotification = prepareNotification;
     exports.presenceCapability = presenceCapability;
@@ -276242,6 +277088,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.recordingExportCapability = recordingExportCapability;
     exports.rectsToCells = rectsToCells;
     exports.requiresPython = requiresPython;
+    exports.resetPoolBaseline = resetPoolBaseline;
     exports.resolveAddonExecution = resolveAddonExecution;
     exports.resolveAddonGroup = resolveAddonGroup;
     exports.resolveAddonPlacement = resolveAddonPlacement;
@@ -276255,6 +277102,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.resolveHydratedFieldValue = require_sleep.resolveHydratedFieldValue;
     exports.resolveModelFormat = resolveModelFormat;
     exports.resolveMutate = resolveMutate;
+    exports.resolvePoolMemoryPolicy = resolvePoolMemoryPolicy;
+    exports.resolveRecordingProfiles = resolveRecordingProfiles;
     exports.resolveRunnerId = resolveRunnerId;
     exports.resolveScrubThumbnailGeometry = resolveScrubThumbnailGeometry;
     exports.resolveVariantModelId = resolveVariantModelId;
@@ -276299,6 +277148,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.switchedOffIds = switchedOffIds;
     exports.synthesizeSourceInfo = synthesizeSourceInfo;
     exports.systemCapability = systemCapability;
+    exports.systemEventFilterApplies = systemEventFilterApplies;
+    exports.systemEventFilterAppliesToAnyKind = systemEventFilterAppliesToAnyKind;
     exports.tamperCapability = tamperCapability;
     exports.taskLogEntrySchema = taskLogEntrySchema;
     exports.taskPhaseSchema = taskPhaseSchema;
@@ -276454,6 +277305,314 @@ var require_agent_config = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/server-update/system-ensure-prebuilds.js
+var require_system_ensure_prebuilds = __commonJS({
+  "../../server/backend/dist/core/server-update/system-ensure-prebuilds.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.buildSystemEnsureNativePrebuilds = buildSystemEnsureNativePrebuilds;
+    var system_1 = require_dist3();
+    function buildSystemEnsureNativePrebuilds(logger) {
+      return async (closureDir) => {
+        await (0, system_1.ensureNativePrebuilds)(closureDir, { logger });
+      };
+    }
+  }
+});
+
+// ../../server/backend/dist/core/server-update/system-exec-npm.js
+var require_system_exec_npm = __commonJS({
+  "../../server/backend/dist/core/server-update/system-exec-npm.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.buildSystemExecNpm = buildSystemExecNpm;
+    var system_1 = require_dist3();
+    function buildSystemExecNpm(options, runNpmFn = system_1.runNpm) {
+      return async (args, opts) => {
+        const { stdout } = await runNpmFn(args, {
+          cacheDir: options.cacheDir,
+          registry: options.registry,
+          logger: options.logger,
+          ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
+          timeout: opts.timeoutMs
+        });
+        return { stdout };
+      };
+    }
+  }
+});
+
+// ../../server/backend/dist/core/update-availability-emitter.js
+var require_update_availability_emitter = __commonJS({
+  "../../server/backend/dist/core/update-availability-emitter.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.UpdateAvailabilityEmitter = void 0;
+    var types_1 = require_dist9();
+    var UpdateAvailabilityEmitter = class {
+      eventBus;
+      source;
+      store;
+      latestByKey = /* @__PURE__ */ new Map();
+      held = /* @__PURE__ */ new Map();
+      /** Set when in-memory state diverged from what the store last saw. */
+      dirty = false;
+      constructor(eventBus, source, store) {
+        this.eventBus = eventBus;
+        this.source = source;
+        this.store = store;
+        const persisted = store?.load() ?? null;
+        if (persisted === null)
+          return;
+        for (const [key, version] of Object.entries(persisted.latestByKey)) {
+          this.latestByKey.set(key, version);
+        }
+        for (const [key, candidate] of Object.entries(persisted.held)) {
+          this.held.set(key, candidate);
+        }
+      }
+      publishSnapshot(target, candidates, nodeId) {
+        const scope = nodeId ?? "hub";
+        const present = /* @__PURE__ */ new Set();
+        let latestChanged = false;
+        for (const candidate of candidates) {
+          if (candidate.target !== target)
+            continue;
+          const stamped = stampNode(candidate, nodeId);
+          const key = this.key(stamped);
+          present.add(key);
+          if (this.note(stamped))
+            latestChanged = true;
+        }
+        for (const key of [...this.held.keys()]) {
+          if (!key.startsWith(`${target}:${scope}:`))
+            continue;
+          if (present.has(key))
+            continue;
+          this.held.delete(key);
+          this.latestByKey.delete(key);
+          this.dirty = true;
+        }
+        this.persistIfDirty();
+        if (!latestChanged)
+          return;
+        this.emitList(target);
+      }
+      /** Publish a partial candidate set without treating omissions as up-to-date. */
+      publishCandidates(candidates) {
+        let latestChanged = false;
+        const targets = /* @__PURE__ */ new Set();
+        for (const candidate of candidates) {
+          targets.add(candidate.target);
+          if (this.note(candidate))
+            latestChanged = true;
+        }
+        this.persistIfDirty();
+        if (!latestChanged)
+          return;
+        for (const target of targets)
+          this.emitList(target);
+      }
+      note(candidate) {
+        const key = this.key(candidate);
+        const previous = this.latestByKey.get(key);
+        const previousHeld = this.held.get(key);
+        if (previousHeld === void 0 || previousHeld.currentVersion !== candidate.currentVersion || previousHeld.latestVersion !== candidate.latestVersion || previousHeld.nodeId !== candidate.nodeId) {
+          this.dirty = true;
+        }
+        this.held.set(key, candidate);
+        this.latestByKey.set(key, candidate.latestVersion);
+        return previous !== candidate.latestVersion;
+      }
+      /**
+       * Flush to the durable store. Called BEFORE the emit so a crash between the
+       * two costs a duplicate announcement, never a silent one.
+       */
+      persistIfDirty() {
+        if (!this.dirty)
+          return;
+        this.dirty = false;
+        this.store?.save({
+          latestByKey: Object.fromEntries(this.latestByKey),
+          held: Object.fromEntries(this.held)
+        });
+      }
+      emitList(target) {
+        const list = [...this.held.values()].filter((candidate) => candidate.target === target);
+        if (list.length === 0)
+          return;
+        const packages = list.map((candidate) => ({
+          packageName: candidate.packageName,
+          currentVersion: candidate.currentVersion,
+          latestVersion: candidate.latestVersion,
+          ...candidate.nodeId !== void 0 ? { nodeId: candidate.nodeId } : {}
+        }));
+        const nodeIds = unique(packages.map((pkg) => pkg.nodeId).filter((id) => id !== void 0));
+        const head = list[0];
+        this.eventBus.emit({
+          id: `update.available:${target}:${packages.map((pkg) => `${pkg.nodeId ?? "hub"}:${pkg.packageName}@${pkg.latestVersion}`).toSorted().join(",")}`,
+          timestamp: /* @__PURE__ */ new Date(),
+          source: this.source,
+          category: types_1.EventCategory.UpdateAvailable,
+          data: {
+            target,
+            packageName: head.packageName,
+            currentVersion: head.currentVersion,
+            latestVersion: head.latestVersion,
+            packages,
+            ...head.nodeId !== void 0 ? { nodeId: head.nodeId } : {},
+            ...nodeIds.length > 0 ? { nodeIds } : {}
+          }
+        });
+      }
+      key(candidate) {
+        return `${candidate.target}:${candidate.nodeId ?? "hub"}:${candidate.packageName}`;
+      }
+    };
+    exports.UpdateAvailabilityEmitter = UpdateAvailabilityEmitter;
+    function stampNode(candidate, nodeId) {
+      if (nodeId === void 0 || candidate.nodeId !== void 0)
+        return candidate;
+      return { ...candidate, nodeId };
+    }
+    function unique(values) {
+      return [...new Set(values)];
+    }
+  }
+});
+
+// ../../server/backend/dist/core/update-availability-store.js
+var require_update_availability_store = __commonJS({
+  "../../server/backend/dist/core/update-availability-store.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.FileUpdateAvailabilityStore = exports.UPDATE_AVAILABILITY_DIR = void 0;
+    var fs = __importStar(__require("fs"));
+    var path = __importStar(__require("path"));
+    var types_1 = require_dist9();
+    exports.UPDATE_AVAILABILITY_DIR = "update-availability";
+    var FileUpdateAvailabilityStore = class {
+      scopeId;
+      logger;
+      filePath;
+      constructor(dataDir, scopeId, logger) {
+        this.scopeId = scopeId;
+        this.logger = logger;
+        this.filePath = path.join(dataDir, exports.UPDATE_AVAILABILITY_DIR, `${scopeId}.json`);
+      }
+      load() {
+        try {
+          if (!fs.existsSync(this.filePath))
+            return null;
+          const parsed = JSON.parse(fs.readFileSync(this.filePath, "utf-8"));
+          return parseState(parsed);
+        } catch (error) {
+          this.logger.warn("Update-availability state unreadable; starting from empty", {
+            meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) }
+          });
+          return null;
+        }
+      }
+      save(state) {
+        try {
+          fs.mkdirSync(path.dirname(this.filePath), { recursive: true });
+          const tmp = `${this.filePath}.tmp`;
+          fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+          fs.renameSync(tmp, this.filePath);
+        } catch (error) {
+          this.logger.warn("Failed to persist update-availability state", {
+            meta: { scopeId: this.scopeId, path: this.filePath, error: (0, types_1.errMsg)(error) }
+          });
+        }
+      }
+    };
+    exports.FileUpdateAvailabilityStore = FileUpdateAvailabilityStore;
+    function parseState(raw) {
+      if (raw === null || typeof raw !== "object")
+        return null;
+      const latestRaw = Reflect.get(raw, "latestByKey");
+      const heldRaw = Reflect.get(raw, "held");
+      if (latestRaw === null || typeof latestRaw !== "object")
+        return null;
+      if (heldRaw === null || typeof heldRaw !== "object")
+        return null;
+      const latestByKey = {};
+      for (const [key, value] of Object.entries(latestRaw)) {
+        if (typeof value === "string")
+          latestByKey[key] = value;
+      }
+      const held = {};
+      for (const [key, value] of Object.entries(heldRaw)) {
+        const candidate = parseCandidate(value);
+        if (candidate !== null)
+          held[key] = candidate;
+      }
+      return { latestByKey, held };
+    }
+    function parseCandidate(raw) {
+      if (raw === null || typeof raw !== "object")
+        return null;
+      const target = Reflect.get(raw, "target");
+      const packageName = Reflect.get(raw, "packageName");
+      const currentVersion = Reflect.get(raw, "currentVersion");
+      const latestVersion = Reflect.get(raw, "latestVersion");
+      const nodeId = Reflect.get(raw, "nodeId");
+      if (target !== "addon" && target !== "server")
+        return null;
+      if (typeof packageName !== "string")
+        return null;
+      if (typeof currentVersion !== "string")
+        return null;
+      if (typeof latestVersion !== "string")
+        return null;
+      return {
+        target,
+        packageName,
+        currentVersion,
+        latestVersion,
+        ...typeof nodeId === "string" ? { nodeId } : {}
+      };
+    }
+  }
+});
+
 // ../../server/backend/dist/server-root/index.js
 var require_server_root = __commonJS({
   "../../server/backend/dist/server-root/index.js"(exports, module) {
@@ -277958,43 +279117,6 @@ var require_server_root = __commonJS({
   }
 });
 
-// ../../server/backend/dist/core/server-update/system-exec-npm.js
-var require_system_exec_npm = __commonJS({
-  "../../server/backend/dist/core/server-update/system-exec-npm.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.buildSystemExecNpm = buildSystemExecNpm;
-    var system_1 = require_dist3();
-    function buildSystemExecNpm(options, runNpmFn = system_1.runNpm) {
-      return async (args, opts) => {
-        const { stdout } = await runNpmFn(args, {
-          cacheDir: options.cacheDir,
-          registry: options.registry,
-          logger: options.logger,
-          ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
-          timeout: opts.timeoutMs
-        });
-        return { stdout };
-      };
-    }
-  }
-});
-
-// ../../server/backend/dist/core/server-update/system-ensure-prebuilds.js
-var require_system_ensure_prebuilds = __commonJS({
-  "../../server/backend/dist/core/server-update/system-ensure-prebuilds.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.buildSystemEnsureNativePrebuilds = buildSystemEnsureNativePrebuilds;
-    var system_1 = require_dist3();
-    function buildSystemEnsureNativePrebuilds(logger) {
-      return async (closureDir) => {
-        await (0, system_1.ensureNativePrebuilds)(closureDir, { logger });
-      };
-    }
-  }
-});
-
 // ../../server/backend/dist/agent/agent-update-service.js
 var require_agent_update_service = __commonJS({
   "../../server/backend/dist/agent/agent-update-service.js"(exports) {
@@ -278042,11 +279164,16 @@ var require_agent_update_service = __commonJS({
     exports.resolveAgentPackageJsonPath = resolveAgentPackageJsonPath;
     exports.scheduleAgentRestart = scheduleAgentRestart;
     exports.agentRuntimeManifestEntry = agentRuntimeManifestEntry;
+    var node_crypto_1 = __require("crypto");
     var fs = __importStar(__require("fs"));
     var path = __importStar(__require("path"));
-    var index_js_1 = require_server_root();
-    var system_exec_npm_js_1 = require_system_exec_npm();
+    var system_1 = require_dist3();
+    var types_1 = require_dist9();
     var system_ensure_prebuilds_js_1 = require_system_ensure_prebuilds();
+    var system_exec_npm_js_1 = require_system_exec_npm();
+    var update_availability_emitter_js_1 = require_update_availability_emitter();
+    var update_availability_store_js_1 = require_update_availability_store();
+    var index_js_1 = require_server_root();
     exports.AGENT_RUNTIME_ADDON_ID = "agent-runtime";
     exports.AGENT_RESTART_GRACE_MS = 2e3;
     function isRunningInContainer(existsSyncFn) {
@@ -278091,7 +279218,14 @@ var require_agent_update_service = __commonJS({
       grace.unref();
     }
     var AgentUpdateService = class extends index_js_1.RootUpdateService {
+      updateAvailability;
+      eventBus;
+      nodeId;
+      agentDataDir;
+      /** The base class keeps `logger` private; hold our own for the store. */
+      agentLogger;
       constructor(options) {
+        const restartAgent = options.restartAgent ?? ((requestedBy) => scheduleAgentRestart(options.logger, requestedBy, options.dataDir));
         super({
           spec: index_js_1.HUB_ROOT_SPEC,
           // The agent's on-disk root IS `@camstack/server` (booted via
@@ -278103,7 +279237,10 @@ var require_agent_update_service = __commonJS({
             seedDir: "CAMSTACK_SEED_SERVER_DIR"
           },
           logger: options.logger,
-          restartServer: options.restartAgent ?? ((requestedBy) => scheduleAgentRestart(options.logger, requestedBy, options.dataDir)),
+          restartServer: (requestedBy) => {
+            writeAgentRestartMarker(options.dataDir, requestedBy);
+            restartAgent(requestedBy);
+          },
           dataDir: options.dataDir,
           runningPackageJsonPath: options.runningPackageJsonPath ?? resolveAgentPackageJsonPath(__dirname),
           workspaceProbeDir: __dirname,
@@ -278121,9 +279258,79 @@ var require_agent_update_service = __commonJS({
           env: options.env,
           now: options.now
         });
+        this.nodeId = options.nodeId ?? process.env["CAMSTACK_NODE_ID"] ?? "agent";
+        this.agentDataDir = options.dataDir;
+        this.agentLogger = options.logger;
+        this.eventBus = options.eventBus ?? null;
+        this.updateAvailability = options.eventBus !== void 0 ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, { type: "core", id: "agent-update-service" }, options.updateAvailabilityStore) : null;
+      }
+      /**
+       * Bind the agent's real event bus once the mesh is up. The dedup state is
+       * persisted under the agent's data dir from here on — an agent restarts on
+       * every root update, which is exactly when its availability list is longest.
+       */
+      bindAvailability(eventBus, nodeId) {
+        this.eventBus = eventBus;
+        this.nodeId = nodeId;
+        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(eventBus, { type: "core", id: "agent-update-service" }, new update_availability_store_js_1.FileUpdateAvailabilityStore(this.agentDataDir, "agent-update", this.agentLogger));
+      }
+      async checkServerUpdate() {
+        const result = await super.checkServerUpdate();
+        if (result.error !== null)
+          return result;
+        this.updateAvailability?.publishSnapshot("server", result.updateAvailable && result.runningVersion !== null && result.latestVersion !== null ? [
+          {
+            target: "server",
+            packageName: result.packageName,
+            currentVersion: result.runningVersion,
+            latestVersion: result.latestVersion,
+            nodeId: this.nodeId
+          }
+        ] : [], this.nodeId);
+        return result;
+      }
+      /** Consume `.restart-pending` and emit `system.restart-completed` if present. */
+      emitRestartCompletedIfPending() {
+        const bus = this.eventBus;
+        if (bus === null)
+          return;
+        const marker = (0, system_1.readPendingRestart)(this.agentDataDir);
+        if (marker === null)
+          return;
+        const payload = {
+          kind: marker.kind,
+          requestedAt: marker.requestedAt,
+          nodeId: this.nodeId,
+          ...marker.packageName !== void 0 ? { packageName: marker.packageName } : {},
+          ...marker.fromVersion !== void 0 ? { fromVersion: marker.fromVersion } : {},
+          ...marker.toVersion !== void 0 ? { toVersion: marker.toVersion } : {},
+          ...marker.requestedBy !== void 0 ? { requestedBy: marker.requestedBy } : {}
+        };
+        bus.emit({
+          id: (0, node_crypto_1.randomUUID)(),
+          timestamp: /* @__PURE__ */ new Date(),
+          source: { type: "core", id: "agent-update-service" },
+          category: types_1.EventCategory.SystemRestartCompleted,
+          data: payload
+        });
       }
     };
     exports.AgentUpdateService = AgentUpdateService;
+    function writeAgentRestartMarker(dataDir, requestedBy) {
+      const toVersion = /@([^@\s]+)$/.exec(requestedBy)?.[1];
+      try {
+        (0, system_1.writePendingRestart)(dataDir, {
+          kind: requestedBy.startsWith("server-update:") ? "framework-update" : "manual",
+          requestedAt: Date.now(),
+          requestedBy,
+          ...requestedBy.startsWith("server-update:") ? {
+            packageName: "@camstack/server",
+            ...toVersion !== void 0 ? { toVersion } : {}
+          } : {}
+        });
+      } catch {
+      }
+    }
     function agentRuntimeManifestEntry() {
       return { addonId: exports.AGENT_RUNTIME_ADDON_ID, capabilities: ["server-management"] };
     }
@@ -370765,6 +371972,7 @@ var require_main2 = __commonJS({
         agentBootConfirmed = true;
         try {
           agentUpdateService.confirmBootHealthy();
+          agentUpdateService.emitRestartCompletedIfPending();
         } catch (err) {
           consoleLogger.warn(`agent root boot confirmation failed: ${err instanceof Error ? err.message : String(err)}`);
         }
@@ -370944,9 +372152,10 @@ var require_main2 = __commonJS({
           return;
         reconcileHubUrlFromRegistry();
       });
+      const agentBrokerEventBus = (0, system_1.getBrokerEventBus)(broker);
+      agentUpdateService.bindAvailability(agentBrokerEventBus, broker.nodeID);
       let udsEventBridgeDispose = null;
       if (agentUdsRegistry !== void 0) {
-        const agentBrokerEventBus = (0, system_1.getBrokerEventBus)(broker);
         udsEventBridgeDispose = (0, system_1.createUdsEventBridge)({
           registry: agentUdsRegistry,
           parentBus: agentBrokerEventBus,
@@ -386589,61 +387798,126 @@ var require_ws3 = __commonJS({
   }
 });
 
-// ../../server/backend/dist/core/update-availability-emitter.js
-var require_update_availability_emitter = __commonJS({
-  "../../server/backend/dist/core/update-availability-emitter.js"(exports) {
+// ../../server/backend/dist/core/updates/update-check-scheduler.js
+var require_update_check_scheduler = __commonJS({
+  "../../server/backend/dist/core/updates/update-check-scheduler.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.UpdateAvailabilityEmitter = void 0;
+    exports.UpdateCheckScheduler = exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS = exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS = exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS = void 0;
+    exports.clampUpdateCheckInterval = clampUpdateCheckInterval;
     var types_1 = require_dist9();
-    var UpdateAvailabilityEmitter = class {
-      eventBus;
-      source;
-      signatures = /* @__PURE__ */ new Map();
-      constructor(eventBus, source) {
-        this.eventBus = eventBus;
-        this.source = source;
+    exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS = 6 * 60 * 60;
+    exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS = 15 * 60;
+    exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS = 7 * 24 * 60 * 60;
+    var DEFAULT_INITIAL_DELAY_MS = 9e4;
+    function clampUpdateCheckInterval(seconds) {
+      if (!Number.isFinite(seconds))
+        return exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS;
+      const whole = Math.floor(seconds);
+      if (whole < exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS)
+        return exports.MIN_UPDATE_CHECK_INTERVAL_SECONDS;
+      if (whole > exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS)
+        return exports.MAX_UPDATE_CHECK_INTERVAL_SECONDS;
+      return whole;
+    }
+    var UpdateCheckScheduler = class {
+      logger;
+      targets;
+      getIntervalSeconds;
+      initialDelayMs;
+      timer = null;
+      bootTimer = null;
+      intervalSeconds = exports.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS;
+      sweeping = false;
+      constructor(options) {
+        this.logger = options.logger;
+        this.targets = options.targets;
+        this.getIntervalSeconds = options.getIntervalSeconds;
+        this.initialDelayMs = options.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;
       }
-      publishSnapshot(target, candidates, nodeId) {
-        const scope = nodeId ?? "hub";
-        const present = /* @__PURE__ */ new Set();
-        for (const candidate of candidates) {
-          if (candidate.target !== target)
-            continue;
-          const key = this.key(candidate);
-          present.add(key);
-          this.publish(candidate);
+      /** Interval currently armed, after clamping. Exposed for assertions + logs. */
+      currentIntervalSeconds() {
+        return this.intervalSeconds;
+      }
+      /** Arm the poller. Safe to call twice — the previous timers are replaced. */
+      start() {
+        this.arm();
+        if (this.bootTimer !== null)
+          clearTimeout(this.bootTimer);
+        this.bootTimer = setTimeout(() => {
+          this.bootTimer = null;
+          void this.runSweep();
+        }, this.initialDelayMs);
+        this.bootTimer.unref?.();
+      }
+      /** Re-read the interval from settings and re-arm if it moved. */
+      reschedule() {
+        const next = clampUpdateCheckInterval(this.getIntervalSeconds());
+        if (this.timer !== null && next === this.intervalSeconds)
+          return;
+        this.arm();
+      }
+      stop() {
+        if (this.timer !== null)
+          clearInterval(this.timer);
+        if (this.bootTimer !== null)
+          clearTimeout(this.bootTimer);
+        this.timer = null;
+        this.bootTimer = null;
+      }
+      /**
+       * One full sweep. Never throws and never runs concurrently with itself — an
+       * overlapping tick (slow registry, long agent fan-out) is dropped WITH a log
+       * rather than doubling the npm traffic.
+       */
+      async runSweep() {
+        if (this.sweeping) {
+          this.logger.warn("Update check skipped \u2014 previous sweep still running");
+          return;
         }
-        for (const key of this.signatures.keys()) {
-          if (key.startsWith(`${target}:${scope}:`) && !present.has(key)) {
-            this.signatures.delete(key);
+        this.sweeping = true;
+        try {
+          const nodes = this.targets.listNodes();
+          await this.attempt("hub addon packages", "hub", () => this.targets.checkHubAddons());
+          await this.attempt("framework packages", "hub", () => this.targets.checkFrameworkPackages());
+          for (const node of nodes) {
+            if (!node.isOnline) {
+              this.logger.warn("Update check skipped \u2014 node offline", { tags: { nodeId: node.id } });
+              continue;
+            }
+            await this.attempt("node server package", node.id, () => this.targets.checkNodeServerUpdate(node.id, node.isHub));
+            if (node.isHub)
+              continue;
+            await this.attempt("agent addon packages", node.id, () => this.targets.checkAgentAddons(node.id));
           }
+        } finally {
+          this.sweeping = false;
         }
       }
-      /** Publish a partial candidate set without treating omissions as up-to-date. */
-      publishCandidates(candidates) {
-        for (const candidate of candidates)
-          this.publish(candidate);
-      }
-      publish(candidate) {
-        const key = this.key(candidate);
-        const signature = `${candidate.currentVersion}->${candidate.latestVersion}`;
-        if (this.signatures.get(key) === signature)
-          return;
-        this.signatures.set(key, signature);
-        this.eventBus.emit({
-          id: `update.available:${key}:${signature}`,
-          timestamp: /* @__PURE__ */ new Date(),
-          source: this.source,
-          category: types_1.EventCategory.UpdateAvailable,
-          data: candidate
+      arm() {
+        if (this.timer !== null)
+          clearInterval(this.timer);
+        this.intervalSeconds = clampUpdateCheckInterval(this.getIntervalSeconds());
+        this.logger.info("Update check scheduled", {
+          meta: { intervalSeconds: this.intervalSeconds }
         });
+        this.timer = setInterval(() => {
+          void this.runSweep();
+        }, this.intervalSeconds * 1e3);
+        this.timer.unref?.();
       }
-      key(candidate) {
-        return `${candidate.target}:${candidate.nodeId ?? "hub"}:${candidate.packageName}`;
+      async attempt(what, nodeId, run) {
+        try {
+          await run();
+        } catch (error) {
+          this.logger.warn(`Update check failed \u2014 ${what}`, {
+            tags: { nodeId },
+            meta: { error: (0, types_1.errMsg)(error) }
+          });
+        }
       }
     };
-    exports.UpdateAvailabilityEmitter = UpdateAvailabilityEmitter;
+    exports.UpdateCheckScheduler = UpdateCheckScheduler;
   }
 });
 
@@ -386922,8 +388196,9 @@ var require_addon_package_service = __commonJS({
     var node_util_1 = __require("util");
     var system_1 = require_dist3();
     var types_1 = require_dist9();
-    var package_dir_utils_js_1 = require_package_dir_utils();
     var update_availability_emitter_js_1 = require_update_availability_emitter();
+    var update_check_scheduler_js_1 = require_update_check_scheduler();
+    var package_dir_utils_js_1 = require_package_dir_utils();
     var execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
     exports.SYSTEM_PACKAGE = "@camstack/system";
     exports.AUTO_UPDATE_EXCLUDED_PACKAGES = /* @__PURE__ */ new Set([
@@ -387016,10 +388291,20 @@ var require_addon_package_service = __commonJS({
       updateAvailability;
       // -- Auto-update state ----------------------------------------------------
       autoUpdateConfig = {
-        global: { channel: "off", intervalSeconds: 21600 },
+        global: {
+          channel: "off",
+          intervalSeconds: 21600,
+          updateCheckIntervalSeconds: update_check_scheduler_js_1.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS
+        },
         overrides: {}
       };
       autoUpdateTimer = null;
+      /**
+       * Re-arm hook for the availability poller, wired at boot (manual-boot). Kept
+       * as a callback rather than a service reference so this module never imports
+       * the scheduler's dependencies back.
+       */
+      updateCheckRescheduler = null;
       // -- Timing constants -----------------------------------------------------
       // Short TTL — operators expect to see freshly-published versions
       // within minutes of `npm publish`, not hours. The Addons page kicks
@@ -387033,7 +388318,7 @@ var require_addon_package_service = __commonJS({
       // 10 minutes
       static NPM_REGISTRY = "https://registry.npmjs.org";
       static REGISTRY_TIMEOUT_MS = 1e4;
-      constructor(loggingService, eventBusService, configService, addonRegistry, notificationService, toastService) {
+      constructor(loggingService, eventBusService, configService, addonRegistry, notificationService, toastService, updateAvailabilityStore) {
         this.loggingService = loggingService;
         this.eventBusService = eventBusService;
         this.configService = configService;
@@ -387041,10 +388326,7 @@ var require_addon_package_service = __commonJS({
         this.notificationService = notificationService;
         this.toastService = toastService;
         this.logger = this.loggingService.createLogger("AddonPackageService");
-        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(this.eventBusService, {
-          type: "core",
-          id: "addon-package-service"
-        });
+        this.updateAvailability = new update_availability_emitter_js_1.UpdateAvailabilityEmitter(this.eventBusService, { type: "core", id: "addon-package-service" }, updateAvailabilityStore);
         try {
           const addonsDir = this.resolveAddonsDir();
           const workspacePackagesDir = (0, system_1.detectWorkspacePackagesDir)(__dirname);
@@ -387409,8 +388691,8 @@ var require_addon_package_service = __commonJS({
         }
         this.logger.info("Checking for package updates...");
         const updates = [];
-        const addonUpdates = await this.checkAddonPackageUpdates();
-        updates.push(...addonUpdates);
+        const sweep = await this.checkAddonPackageUpdates();
+        updates.push(...sweep.updates);
         this.logger.info("Found package updates", {
           meta: {
             count: updates.length,
@@ -387425,12 +388707,7 @@ var require_addon_package_service = __commonJS({
           updates,
           expiresAt: now + _AddonPackageService.UPDATE_CACHE_TTL_MS
         };
-        this.updateAvailability.publishSnapshot("addon", updates.map((update) => ({
-          target: "addon",
-          packageName: update.name,
-          currentVersion: update.currentVersion,
-          latestVersion: update.latestVersion
-        })));
+        this.publishAddonAvailability(updates, sweep.failures);
         return updates;
       }
       /** Clear the cached update check results */
@@ -387454,12 +388731,22 @@ var require_addon_package_service = __commonJS({
             seen.set(pkg.name, pkg.version);
         }
         const updates = [];
+        let failures = 0;
         await Promise.all([...seen].map(async ([name, version]) => {
           if (!this.isAllowedPackage(name))
             return;
           if (exports.AUTO_UPDATE_EXCLUDED_PACKAGES.has(name))
             return;
-          const latestVersion = await this.fetchLatestVersion(name);
+          const lookup = await this.lookupLatestVersion(name);
+          if (!lookup.ok) {
+            failures += 1;
+            this.logger.warn("Registry lookup failed for installed package", {
+              tags: { nodeId: nodeId ?? "hub" },
+              meta: { name, error: lookup.error }
+            });
+            return;
+          }
+          const latestVersion = lookup.latestVersion;
           if (latestVersion === null || !isVersionNewer(latestVersion, version))
             return;
           const category = this.categorize(name);
@@ -387471,13 +388758,7 @@ var require_addon_package_service = __commonJS({
             requiresRestart: category === "core"
           });
         }));
-        this.updateAvailability.publishSnapshot("addon", updates.map((update) => ({
-          target: "addon",
-          packageName: update.name,
-          currentVersion: update.currentVersion,
-          latestVersion: update.latestVersion,
-          ...nodeId !== void 0 ? { nodeId } : {}
-        })), nodeId);
+        this.publishAddonAvailability(updates, failures, nodeId);
         return updates;
       }
       /**
@@ -387854,10 +389135,15 @@ var require_addon_package_service = __commonJS({
        */
       restartServer(requestedBy) {
         this.logger.info("Server restart requested -- initiating graceful shutdown");
+        const toVersion = toVersionFromRestartReason(requestedBy);
         const payload = {
-          kind: "manual",
+          kind: isServerUpdateRequest(requestedBy) ? "framework-update" : "manual",
           requestedAt: Date.now(),
-          ...requestedBy !== void 0 ? { requestedBy } : {}
+          ...requestedBy !== void 0 ? { requestedBy } : {},
+          ...isServerUpdateRequest(requestedBy) ? {
+            packageName: "@camstack/server",
+            ...toVersion !== void 0 ? { toVersion } : {}
+          } : {}
         };
         try {
           (0, system_1.writePendingRestart)(this.resolveDataDir(), payload);
@@ -387899,6 +389185,7 @@ var require_addon_package_service = __commonJS({
           const hubPkgDir = (0, package_dir_utils_js_1.resolveHubClosurePackageDir)(packageName);
           const buildId = hubPkgDir !== null ? (0, package_dir_utils_js_1.computeDistBuildId)(path.join(hubPkgDir, "dist")) : null;
           let latestVersion = null;
+          let lookupFailed = false;
           try {
             const args = [
               "view",
@@ -387910,21 +389197,65 @@ var require_addon_package_service = __commonJS({
             const trimmed = stdout.trim();
             latestVersion = trimmed.length > 0 ? trimmed : null;
           } catch (err) {
+            lookupFailed = true;
             this.logger.debug("listFrameworkPackages: npm view failed", {
               meta: { packageName, error: (0, types_1.errMsg)(err) }
             });
           }
-          const hasUpdate = latestVersion !== null && currentVersion !== "unknown" && latestVersion !== currentVersion;
+          const hasUpdate = latestVersion !== null && currentVersion !== "unknown" && isVersionNewer(latestVersion, currentVersion);
           return {
             packageName,
             currentVersion,
             latestVersion,
             hasUpdate,
             buildId,
+            lookupFailed,
             ...description !== void 0 ? { description } : {}
           };
         }));
-        return rows;
+        this.publishFrameworkAvailability(rows);
+        return rows.map(({ lookupFailed: _lookupFailed, ...row }) => row);
+      }
+      /**
+       * Announce framework updates. This surface SHOWED `@camstack/system` had an
+       * update and emitted nothing, so the operator was never told — it was the
+       * only discovery path with no publish at all.
+       *
+       * Two rules it must not break:
+       *  - **Strictly newer only.** `hasUpdate` is `latest !== current`, which is
+       *    true for a hub running a `-dev.<timestamp>` build AHEAD of the npm tag.
+       *    Announcing that would be telling the operator to downgrade.
+       *  - **A failed lookup publishes nothing.** Not even an empty snapshot: an
+       *    empty snapshot means "up to date" and would clear the dedup state, so
+       *    the next successful poll would re-announce everything.
+       */
+      publishFrameworkAvailability(rows) {
+        const failed = rows.filter((row) => row.lookupFailed);
+        if (failed.length > 0) {
+          this.logger.warn("Framework update check incomplete \u2014 availability not published", {
+            meta: { packages: failed.map((row) => row.packageName) }
+          });
+          return;
+        }
+        const candidates = [];
+        for (const row of rows) {
+          if (row.latestVersion === null || row.currentVersion === "unknown")
+            continue;
+          if (!isVersionNewer(row.latestVersion, row.currentVersion))
+            continue;
+          candidates.push({
+            target: "server",
+            packageName: row.packageName,
+            currentVersion: row.currentVersion,
+            latestVersion: row.latestVersion,
+            nodeId: this.resolveNodeId()
+          });
+        }
+        this.updateAvailability.publishSnapshot("server", candidates, this.resolveNodeId());
+      }
+      /** Node id stamped on availability events emitted by THIS process. */
+      resolveNodeId() {
+        return process.env["CAMSTACK_NODE_ID"] ?? "hub";
       }
       // =========================================================================
       // Reload
@@ -387956,21 +389287,37 @@ var require_addon_package_service = __commonJS({
       // =========================================================================
       // Auto-update settings
       // =========================================================================
+      /**
+       * Register the availability poller's re-arm hook. Called once at boot so a
+       * `setAutoUpdateSettings` write takes effect without a restart.
+       */
+      setUpdateCheckRescheduler(reschedule) {
+        this.updateCheckRescheduler = reschedule;
+      }
       /** Get global auto-update settings */
       getAutoUpdateSettings() {
         return { ...this.autoUpdateConfig.global };
       }
       /** Set global auto-update settings and restart the timer */
-      async setAutoUpdateSettings(channel, intervalSeconds) {
+      async setAutoUpdateSettings(channel, intervalSeconds, updateCheckIntervalSeconds) {
+        const previousCheckInterval = this.autoUpdateConfig.global.updateCheckIntervalSeconds;
+        const nextCheckInterval = updateCheckIntervalSeconds === void 0 ? previousCheckInterval : (0, update_check_scheduler_js_1.clampUpdateCheckInterval)(updateCheckIntervalSeconds);
         this.autoUpdateConfig = {
           ...this.autoUpdateConfig,
           global: {
             channel,
-            intervalSeconds: intervalSeconds ?? this.autoUpdateConfig.global.intervalSeconds
+            intervalSeconds: intervalSeconds ?? this.autoUpdateConfig.global.intervalSeconds,
+            updateCheckIntervalSeconds: nextCheckInterval
           }
         };
         this.saveAutoUpdateConfig();
         this.scheduleAutoUpdate();
+        if (updateCheckIntervalSeconds === void 0)
+          return;
+        this.logger.info("Update-check interval changed", {
+          meta: { from: previousCheckInterval, to: nextCheckInterval }
+        });
+        this.updateCheckRescheduler?.();
       }
       /** Get per-addon auto-update override */
       getAddonAutoUpdate(addonId) {
@@ -388101,10 +389448,12 @@ var require_addon_package_service = __commonJS({
               const global2 = asRecord(raw["global"]);
               const channel = asString(global2["channel"]);
               const validChannel = channel === "latest" || channel === "beta" ? channel : "off";
+              const rawCheckInterval = global2["updateCheckIntervalSeconds"];
               return {
                 global: {
                   channel: validChannel,
-                  intervalSeconds: typeof global2["intervalSeconds"] === "number" ? global2["intervalSeconds"] : 3600
+                  intervalSeconds: typeof global2["intervalSeconds"] === "number" ? global2["intervalSeconds"] : 3600,
+                  updateCheckIntervalSeconds: typeof rawCheckInterval === "number" ? (0, update_check_scheduler_js_1.clampUpdateCheckInterval)(rawCheckInterval) : update_check_scheduler_js_1.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS
                 },
                 overrides: Object.fromEntries(Object.entries(asRecord(raw["overrides"])).map(([k, v]) => {
                   const s = asString(v);
@@ -388119,7 +389468,14 @@ var require_addon_package_service = __commonJS({
             meta: { error: (0, types_1.errMsg)(err) }
           });
         }
-        return { global: { channel: "off", intervalSeconds: 21600 }, overrides: {} };
+        return {
+          global: {
+            channel: "off",
+            intervalSeconds: 21600,
+            updateCheckIntervalSeconds: update_check_scheduler_js_1.DEFAULT_UPDATE_CHECK_INTERVAL_SECONDS
+          },
+          overrides: {}
+        };
       }
       /** Save auto-update config to disk */
       saveAutoUpdateConfig() {
@@ -388144,12 +389500,17 @@ var require_addon_package_service = __commonJS({
       /**
        * Check addon packages for updates by reading installed versions from
        * data/addons/{name}/package.json and comparing against npm registry.
+       *
+       * Reports `failures` alongside the diff: a registry lookup that could not be
+       * MADE is not evidence that a package is up to date, and the availability
+       * publish branches on it.
        */
       async checkAddonPackageUpdates() {
         const addonsDir = this.resolveAddonsDir();
         const updates = [];
+        let failures = 0;
         if (!fs.existsSync(addonsDir))
-          return updates;
+          return { updates, failures };
         const pkgJsonPaths = [];
         const topDirs = fs.readdirSync(addonsDir, { withFileTypes: true }).filter((d) => d.isDirectory());
         for (const dir of topDirs) {
@@ -388186,7 +389547,16 @@ var require_addon_package_service = __commonJS({
               if (source === "workspace")
                 continue;
             }
-            const latestVersion = await this.fetchLatestVersion(name);
+            const lookup = await this.lookupLatestVersion(name);
+            if (!lookup.ok) {
+              failures += 1;
+              this.logger.warn("Registry lookup failed for installed addon package", {
+                tags: { nodeId: this.resolveNodeId() },
+                meta: { name, error: lookup.error }
+              });
+              continue;
+            }
+            const latestVersion = lookup.latestVersion;
             if (!latestVersion)
               continue;
             if (isVersionNewer(latestVersion, version)) {
@@ -388199,13 +389569,14 @@ var require_addon_package_service = __commonJS({
               });
             }
           } catch (error) {
+            failures += 1;
             const msg = (0, types_1.errMsg)(error);
-            this.logger.debug("Failed to check updates for addon", {
+            this.logger.warn("Failed to check updates for addon", {
               meta: { pkgJsonPath, error: msg }
             });
           }
         }
-        return updates;
+        return { updates, failures };
       }
       // =========================================================================
       // Private: npm registry helpers
@@ -388216,7 +389587,7 @@ var require_addon_package_service = __commonJS({
        * Honours `CAMSTACK_NPM_REGISTRY` so update checks resolve against
        * the same registry the installer/pack paths use. Without this, a
        * per-node `listUpdates` (which diffs an agent's roster via
-       * `checkUpdatesForInstalled` → `fetchLatestVersion`) would bypass a
+       * `checkUpdatesForInstalled` → `lookupLatestVersion`) would bypass a
        * private registry — including the e2e harness's verdaccio — and
        * silently report "no update" for packages that only exist there.
        * Trailing slashes are stripped so the `${base}/${name}` join is clean.
@@ -388226,28 +389597,60 @@ var require_addon_package_service = __commonJS({
         const base = override && override.length > 0 ? override : _AddonPackageService.NPM_REGISTRY;
         return base.replace(/\/+$/, "");
       }
-      /** Fetch the latest published version of a package from the npm registry */
-      async fetchLatestVersion(packageName) {
+      /**
+       * Ask the registry for a package's latest version, distinguishing "there is
+       * no such package" (a definitive answer) from "I could not ask" (a failure).
+       * The difference decides whether an availability SNAPSHOT may be published —
+       * see {@link RegistryLookup}.
+       */
+      async lookupLatestVersion(packageName) {
         try {
           const encodedName = packageName.replace("/", "%2F");
           const url = `${this.resolveRegistryBase()}/${encodedName}/latest`;
           const response = await fetch(url, {
             signal: AbortSignal.timeout(_AddonPackageService.REGISTRY_TIMEOUT_MS)
           });
+          if (response.status === 404)
+            return { ok: true, latestVersion: null };
           if (!response.ok) {
             this.logger.debug("Registry returned non-ok status", {
               meta: { packageName, status: response.status }
             });
-            return null;
+            return { ok: false, error: `registry status ${response.status}` };
           }
           const data = await fetchJsonObject(response);
           const version = asString(data["version"]);
-          return version || null;
+          return { ok: true, latestVersion: version || null };
         } catch (error) {
-          const msg = (0, types_1.errMsg)(error);
-          this.logger.debug("Failed to fetch latest version", { meta: { packageName, error: msg } });
-          return null;
+          return { ok: false, error: (0, types_1.errMsg)(error) };
+        }
+      }
+      /**
+       * Announce the addon-update set for one scope (hub or a node).
+       *
+       * `failures > 0` means at least one registry lookup could not be made, so
+       * the set is INCOMPLETE — publish it as candidates (additive) rather than a
+       * snapshot (authoritative). A snapshot built from a partial sweep silently
+       * marks the unreachable packages "up to date", clears their dedup state and
+       * re-announces them on the next good poll.
+       */
+      publishAddonAvailability(updates, failures, nodeId) {
+        const candidates = updates.map((update) => ({
+          target: "addon",
+          packageName: update.name,
+          currentVersion: update.currentVersion,
+          latestVersion: update.latestVersion,
+          ...nodeId !== void 0 ? { nodeId } : {}
+        }));
+        if (failures > 0) {
+          this.logger.warn("Addon update check incomplete \u2014 availability published as partial", {
+            tags: { nodeId: nodeId ?? "hub" },
+            meta: { failures, published: candidates.length }
+          });
+          this.updateAvailability.publishCandidates(candidates);
+          return;
         }
+        this.updateAvailability.publishSnapshot("addon", candidates, nodeId);
       }
       /** Fetch npm search results for camstack addon packages (cached 5 min) */
       async fetchSearchFromNpm() {
@@ -388397,6 +389800,15 @@ var require_addon_package_service = __commonJS({
       }
     };
     exports.AddonPackageService = AddonPackageService;
+    function isServerUpdateRequest(requestedBy) {
+      return requestedBy !== void 0 && requestedBy.startsWith("server-update:");
+    }
+    function toVersionFromRestartReason(requestedBy) {
+      if (requestedBy === void 0)
+        return void 0;
+      const match = /@([^@\s]+)$/.exec(requestedBy);
+      return match?.[1];
+    }
     async function extractTgzStripped(tgz, destDir) {
       fs.mkdirSync(destDir, { recursive: true });
       const tmpFile = path.join(os.tmpdir(), `camstack-tgz-${(0, node_crypto_1.randomUUID)()}.tgz`);
@@ -396513,6 +397925,30 @@ var require_integration_id_backfill = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/updates/agent-installed-packages.js
+var require_agent_installed_packages = __commonJS({
+  "../../server/backend/dist/core/updates/agent-installed-packages.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.AGENT_STATUS_TIMEOUT_MS = void 0;
+    exports.fetchAgentInstalledPackages = fetchAgentInstalledPackages;
+    var addon_package_service_js_1 = require_addon_package_service();
+    exports.AGENT_STATUS_TIMEOUT_MS = 5e3;
+    async function fetchAgentInstalledPackages(broker, nodeId) {
+      const status = await broker.call("$agent.status", {}, { nodeID: nodeId, timeout: exports.AGENT_STATUS_TIMEOUT_MS });
+      const out = [];
+      for (const addon of status.addons ?? []) {
+        if (typeof addon.packageName !== "string" || typeof addon.version !== "string")
+          continue;
+        if ((0, addon_package_service_js_1.isFrameworkPackage)(addon.packageName))
+          continue;
+        out.push({ name: addon.packageName, version: addon.version });
+      }
+      return out;
+    }
+  }
+});
+
 // ../../server/backend/dist/api/core/collection-preference.js
 var require_collection_preference = __commonJS({
   "../../server/backend/dist/api/core/collection-preference.js"(exports) {
@@ -396888,6 +398324,7 @@ var require_post_boot_service = __commonJS({
         const payload = {
           kind: marker.kind,
           requestedAt: marker.requestedAt,
+          nodeId: process.env["CAMSTACK_NODE_ID"] ?? "hub",
           ...marker.packageName !== void 0 ? { packageName: marker.packageName } : {},
           ...marker.fromVersion !== void 0 ? { fromVersion: marker.fromVersion } : {},
           ...marker.toVersion !== void 0 ? { toVersion: marker.toVersion } : {},
@@ -396971,6 +398408,7 @@ var require_cap_providers = __commonJS({
     var integration_id_backfill_1 = require_integration_id_backfill();
     var addon_package_service_js_1 = require_addon_package_service();
     var lifecycle_runner_singleton_js_1 = require_lifecycle_runner_singleton();
+    var agent_installed_packages_js_1 = require_agent_installed_packages();
     var collection_preference_js_1 = require_collection_preference();
     var site_location_js_1 = require_site_location();
     function getRetention(registry) {
@@ -397854,18 +399292,6 @@ var require_cap_providers = __commonJS({
     function isHubNode(nodeId) {
       return nodeId === "hub" || nodeId.startsWith("hub/");
     }
-    async function fetchAgentInstalledPackages(broker, nodeId) {
-      const status = await broker.call("$agent.status", {}, { nodeID: nodeId, timeout: 5e3 });
-      const out = [];
-      for (const a of status.addons ?? []) {
-        if (typeof a.packageName !== "string" || typeof a.version !== "string")
-          continue;
-        if ((0, addon_package_service_js_1.isFrameworkPackage)(a.packageName))
-          continue;
-        out.push({ name: a.packageName, version: a.version });
-      }
-      return out;
-    }
     function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
       const broker = moleculer.broker;
       const frameworkAllowSet = /* @__PURE__ */ new Set([addon_package_service_js_1.SYSTEM_PACKAGE]);
@@ -397906,7 +399332,7 @@ var require_cap_providers = __commonJS({
         },
         listUpdates: async (input) => {
           const nodeId = input.nodeId;
-          const updates = nodeId === void 0 || isHubNode(nodeId) ? await ps.checkUpdates() : await ps.checkUpdatesForInstalled(await fetchAgentInstalledPackages(broker, nodeId), nodeId);
+          const updates = nodeId === void 0 || isHubNode(nodeId) ? await ps.checkUpdates() : await ps.checkUpdatesForInstalled(await (0, agent_installed_packages_js_1.fetchAgentInstalledPackages)(broker, nodeId), nodeId);
           return updates.map((u) => ({ ...u, isSystem: frameworkAllowSet.has(u.name) }));
         },
         updatePackage: async (input) => {
@@ -397935,7 +399361,7 @@ var require_cap_providers = __commonJS({
           const nodeId = input.nodeId;
           if (nodeId === void 0 || isHubNode(nodeId))
             return ps.checkUpdates(true);
-          const installed = await fetchAgentInstalledPackages(broker, nodeId);
+          const installed = await (0, agent_installed_packages_js_1.fetchAgentInstalledPackages)(broker, nodeId);
           return ps.checkUpdatesForInstalled(installed, nodeId);
         },
         restartServer: async () => ps.restartServer(ctx.user?.username ?? ctx.user?.id),
@@ -397996,7 +399422,7 @@ var require_cap_providers = __commonJS({
           return { success: true };
         },
         getAutoUpdateSettings: async () => ps.getAutoUpdateSettings(),
-        setAutoUpdateSettings: async (input) => ps.setAutoUpdateSettings(input.channel, input.intervalSeconds),
+        setAutoUpdateSettings: async (input) => ps.setAutoUpdateSettings(input.channel, input.intervalSeconds, input.updateCheckIntervalSeconds),
         getAddonAutoUpdate: async (input) => ps.getAddonAutoUpdate(input.addonId),
         setAddonAutoUpdate: async (input) => ps.setAddonAutoUpdate(input.addonId, input.channel),
         applyAutoUpdateToAll: async (input) => {
@@ -398243,6 +399669,12 @@ var require_event_bus_proxy_router = __commonJS({
     }
     function createEventBusProxyRouter(eventBus) {
       return (0, trpc_middleware_js_1.trpcRouter)({
+        // ADMIN-ONLY. `emit` injects a fully-attributed SystemEvent onto the hub's
+        // real EventBus — including a spoofable `source` (a fake `device`/`addon`
+        // origin). Forked addons that legitimately emit reach this over the
+        // trusted core-cap/UDS mesh, whose context is `createMeshTrpcContext`
+        // (`isAdmin: true`), so gating it here withholds the surface from
+        // non-admin HTTP/WS principals without blinding a worker.
         emit: trpc_middleware_js_1.adminProcedure.input(SystemEventInputSchema).output(zod_1.z.object({ ok: zod_1.z.literal(true) })).mutation(({ input }) => {
           eventBus.emit({
             id: input.id,
@@ -404158,7 +405590,7 @@ var require_logging_service = __commonJS({
       deviceNames = /* @__PURE__ */ new Map();
       constructor(configService) {
         const perAddonCapacity = configService.get("eventBus.perAddonLogBufferSize") ?? 5e3;
-        const maxTotalEntries = configService.get("eventBus.maxTotalLogBufferSize") ?? null;
+        const maxTotalEntries = configService.get("eventBus.maxTotalLogBufferSize");
         const pruneLevel = configService.get("eventBus.logBufferPruneLevel") ?? "debug";
         super(perAddonCapacity, { maxTotalEntries, pruneLevel });
         this.setDeviceNameLookup((id) => this.deviceNames.get(id) ?? null);
@@ -405500,11 +406932,12 @@ var require_server_update_service = __commonJS({
     exports.ServerUpdateService = void 0;
     var path = __importStar(__require("path"));
     var index_js_1 = require_server_root();
-    var system_exec_npm_js_1 = require_system_exec_npm();
-    var system_ensure_prebuilds_js_1 = require_system_ensure_prebuilds();
     var update_availability_emitter_js_1 = require_update_availability_emitter();
+    var system_ensure_prebuilds_js_1 = require_system_ensure_prebuilds();
+    var system_exec_npm_js_1 = require_system_exec_npm();
     var ServerUpdateService = class extends index_js_1.RootUpdateService {
       updateAvailability;
+      nodeId;
       constructor(options) {
         const dataDir = path.resolve(options.dataDir ?? options.env?.["CAMSTACK_DATA"] ?? process.env["CAMSTACK_DATA"] ?? "camstack-data");
         super({
@@ -405535,23 +406968,23 @@ var require_server_update_service = __commonJS({
           env: options.env,
           now: options.now
         });
-        this.updateAvailability = options.eventBus !== void 0 ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, {
-          type: "core",
-          id: "server-update-service"
-        }) : null;
+        this.updateAvailability = options.eventBus !== void 0 ? new update_availability_emitter_js_1.UpdateAvailabilityEmitter(options.eventBus, { type: "core", id: "server-update-service" }, options.updateAvailabilityStore) : null;
+        this.nodeId = options.nodeId ?? "hub";
       }
       async checkServerUpdate() {
         const result = await super.checkServerUpdate();
         if (result.error !== null)
           return result;
+        const nodeId = this.nodeId;
         this.updateAvailability?.publishSnapshot("server", result.updateAvailable && result.runningVersion !== null && result.latestVersion !== null ? [
           {
             target: "server",
             packageName: result.packageName,
             currentVersion: result.runningVersion,
-            latestVersion: result.latestVersion
+            latestVersion: result.latestVersion,
+            ...nodeId !== void 0 ? { nodeId } : {}
           }
-        ] : []);
+        ] : [], nodeId);
         return result;
       }
     };
@@ -405572,6 +407005,82 @@ var require_storage_service = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/streaming/ttl-cache.js
+var require_ttl_cache = __commonJS({
+  "../../server/backend/dist/core/streaming/ttl-cache.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.TtlCache = void 0;
+    var TtlCache = class {
+      entries = /* @__PURE__ */ new Map();
+      ttlMs;
+      maxEntries;
+      now;
+      constructor(options) {
+        this.ttlMs = options.ttlMs;
+        this.maxEntries = options.maxEntries;
+        this.now = options.now ?? (() => Date.now());
+      }
+      /** The live value, or undefined when absent or expired. An expired entry is
+       *  DELETED here, not merely reported missing. */
+      get(key) {
+        const slot = this.entries.get(key);
+        if (slot === void 0)
+          return void 0;
+        const at = this.now();
+        if (at - slot.storedAt >= this.ttlMs) {
+          this.entries.delete(key);
+          return void 0;
+        }
+        slot.lastAccessAt = at;
+        return slot.value;
+      }
+      /**
+       * Store a value, then bring the map back inside both bounds.
+       *
+       * The sweep runs on WRITE and not on a timer on purpose: a timer would have
+       * to be owned, unref'd and stopped by every holder of a cache, and a cache
+       * that is never written to is a cache that is not growing.
+       */
+      set(key, value) {
+        const at = this.now();
+        this.entries.set(key, { value, storedAt: at, lastAccessAt: at });
+        this.sweepExpired(at);
+        this.enforceMaxEntries(key);
+      }
+      delete(key) {
+        this.entries.delete(key);
+      }
+      clear() {
+        this.entries.clear();
+      }
+      /** Entries currently retained. The number that used to only go up. */
+      size() {
+        return this.entries.size;
+      }
+      sweepExpired(at) {
+        for (const [key, slot] of this.entries) {
+          if (at - slot.storedAt >= this.ttlMs)
+            this.entries.delete(key);
+        }
+      }
+      /** Evict least-recently-USED first. `protectedKey` is the entry just written —
+       *  evicting it would make `set` a no-op. */
+      enforceMaxEntries(protectedKey) {
+        if (this.entries.size <= this.maxEntries)
+          return;
+        const coldestFirst = [...this.entries.entries()].filter(([key]) => key !== protectedKey).toSorted((a, b) => a[1].lastAccessAt - b[1].lastAccessAt);
+        for (const [key] of coldestFirst) {
+          if (this.entries.size <= this.maxEntries)
+            return;
+          this.entries.delete(key);
+        }
+      }
+    };
+    exports.TtlCache = TtlCache;
+  }
+});
+
 // ../../server/backend/dist/core/streaming/stream-probe.service.js
 var require_stream_probe_service = __commonJS({
   "../../server/backend/dist/core/streaming/stream-probe.service.js"(exports) {
@@ -405580,16 +407089,28 @@ var require_stream_probe_service = __commonJS({
     exports.StreamProbeService = void 0;
     var child_process_1 = __require("child_process");
     var util_1 = __require("util");
+    var ttl_cache_1 = require_ttl_cache();
     var types_1 = require_dist9();
     var execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
     var CACHE_TTL_MS = 36e5;
     var PROBE_TIMEOUT_MS = 5e3;
+    var CACHE_MAX_ENTRIES = 512;
     var CODEC_ALIASES = {
       hevc: "h265"
     };
     var StreamProbeService = class {
       logger;
-      cache = /* @__PURE__ */ new Map();
+      /**
+       * Probe results, bounded by BOTH a swept TTL and an entry ceiling.
+       *
+       * It used to be a plain `Map` whose age was consulted only when the same URL
+       * was probed again — so an entry nobody asked about a second time was never
+       * found expired and never removed. See {@link TtlCache}.
+       */
+      cache = new ttl_cache_1.TtlCache({
+        ttlMs: CACHE_TTL_MS,
+        maxEntries: CACHE_MAX_ENTRIES
+      });
       constructor(loggingService) {
         this.logger = loggingService.createLogger("StreamProbeService");
       }
@@ -405601,12 +407122,11 @@ var require_stream_probe_service = __commonJS({
         const force = options?.force ?? false;
         if (!force) {
           const cached = this.cache.get(url);
-          if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) {
-            return cached.metadata;
-          }
+          if (cached)
+            return cached;
         }
         const metadata = await this.runProbe(url);
-        this.cache.set(url, { metadata, timestamp: Date.now() });
+        this.cache.set(url, metadata);
         return metadata;
       }
       /**
@@ -406458,6 +407978,9 @@ var require_manual_boot = __commonJS({
     var storage_service_1 = require_storage_service();
     var stream_probe_service_1 = require_stream_probe_service();
     var topology_emitter_service_1 = require_topology_emitter_service();
+    var update_availability_store_js_1 = require_update_availability_store();
+    var agent_installed_packages_js_1 = require_agent_installed_packages();
+    var update_check_scheduler_js_1 = require_update_check_scheduler();
     var ServiceContainer = class {
       services = /* @__PURE__ */ new Map();
       register(ctor, instance) {
@@ -406503,7 +408026,8 @@ var require_manual_boot = __commonJS({
       agentRegistryService.setAddonRegistry(addonRegistryService);
       agentRegistryService.setClusterNodeHistoryStore(new cluster_node_history_store_1.ClusterNodeHistoryStore(() => capabilityService.getRegistry()?.getSingleton("settings-store") ?? null, loggingService.createLogger("cluster-node-history")));
       const addonWidgetsService = new addon_widgets_service_1.AddonWidgetsService(loggingService, capabilityService, addonRegistryService);
-      const addonPackageService = new addon_package_service_1.AddonPackageService(loggingService, eventBusService, configService, addonRegistryService, notificationWrapper, toastWrapper);
+      const availabilityDataDir = path.resolve(process.env["CAMSTACK_DATA"] ?? "camstack-data");
+      const addonPackageService = new addon_package_service_1.AddonPackageService(loggingService, eventBusService, configService, addonRegistryService, notificationWrapper, toastWrapper, new update_availability_store_js_1.FileUpdateAvailabilityStore(availabilityDataDir, "addon-packages", loggingService.createLogger("UpdateAvailability")));
       const backfillLogger = loggingService.createLogger("agent-backfill");
       agentRegistryService.setAddonBackfill({
         pack: async (name, version) => {
@@ -406556,10 +408080,40 @@ var require_manual_boot = __commonJS({
       const serverUpdateService = new server_update_service_1.ServerUpdateService({
         logger: loggingService.createLogger("ServerUpdate"),
         restartServer: (requestedBy) => addonPackageService.restartServer(requestedBy),
-        eventBus: eventBusService
+        eventBus: eventBusService,
+        updateAvailabilityStore: new update_availability_store_js_1.FileUpdateAvailabilityStore(availabilityDataDir, "server-update", loggingService.createLogger("UpdateAvailability"))
       });
       const topologyEmitterService = new topology_emitter_service_1.TopologyEmitterService(eventBusService, agentRegistryService, addonRegistryService, (0, cap_providers_1.createNodeRootPackageLookup)(moleculerService, serverUpdateService));
       const postBootService = new post_boot_service_1.PostBootService(addonRegistryService, eventBusService, loggingService);
+      const updateCheckLogger = loggingService.createLogger("UpdateCheck");
+      const updateCheckScheduler = new update_check_scheduler_js_1.UpdateCheckScheduler({
+        logger: updateCheckLogger,
+        getIntervalSeconds: () => addonPackageService.getAutoUpdateSettings().updateCheckIntervalSeconds,
+        targets: {
+          listNodes: () => agentRegistryService.listNodeLiveness(),
+          checkHubAddons: () => addonPackageService.checkUpdates(true),
+          checkFrameworkPackages: () => addonPackageService.listFrameworkPackages(),
+          checkAgentAddons: async (nodeId) => {
+            const broker = moleculerService.broker;
+            const installed = await (0, agent_installed_packages_js_1.fetchAgentInstalledPackages)(broker, nodeId);
+            return addonPackageService.checkUpdatesForInstalled(installed, nodeId);
+          },
+          checkNodeServerUpdate: async (nodeId, isHub) => {
+            if (isHub)
+              return serverUpdateService.checkServerUpdate();
+            const proxy = moleculerService.createCapabilityProxy("server-management", nodeId);
+            if (proxy === null) {
+              updateCheckLogger.warn("Update check skipped \u2014 server-management unreachable", {
+                tags: { nodeId }
+              });
+              return void 0;
+            }
+            return proxy["checkServerUpdate"]?.({});
+          }
+        }
+      });
+      addonPackageService.setUpdateCheckRescheduler(() => updateCheckScheduler.reschedule());
+      updateCheckScheduler.start();
       const container = new ServiceContainer();
       container.register(config_service_1.ConfigService, configService);
       container.register(logging_service_1.LoggingService, loggingService);
@@ -406584,6 +408138,7 @@ var require_manual_boot = __commonJS({
       container.register(server_update_service_1.ServerUpdateService, serverUpdateService);
       container.register(topology_emitter_service_1.TopologyEmitterService, topologyEmitterService);
       container.register(post_boot_service_1.PostBootService, postBootService);
+      container.register(update_check_scheduler_js_1.UpdateCheckScheduler, updateCheckScheduler);
       const fastify = (0, fastify_1.default)(fastifyOpts);
       let closed = false;
       let shutdownHooksRegistered = false;
@@ -406594,6 +408149,11 @@ var require_manual_boot = __commonJS({
         const logErr = (label, err) => {
           console.error(`[manual-boot] ${label} destroy failed:`, err);
         };
+        try {
+          updateCheckScheduler.stop();
+        } catch (err) {
+          logErr("UpdateCheckScheduler", err);
+        }
         try {
           topologyEmitterService.onModuleDestroy();
         } catch (err) {