camstack 1.2.35 → 1.2.37

package/dist/{launcher-IU5FZCJX.js → launcher-6VDFMPM6.js}

@@ -23631,9 +23631,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-Ctfhlrtl.js
-var require_dist_Ctfhlrtl = __commonJS({
-  "../system/dist/dist-Ctfhlrtl.js"(exports) {
+// ../system/dist/dist-C1Aea3c6.js
+var require_dist_C1Aea3c6 = __commonJS({
+  "../system/dist/dist-C1Aea3c6.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -25933,7 +25933,7 @@ var require_dist_Ctfhlrtl = __commonJS({
       postBufferSec: zod.z.number().min(0).optional()
     });
     ({
-      preBufferSec: 10,
+      preBufferSec: 15,
       postBufferSec: 30
     }).postBufferSec * 1e3;
     var RecordingRetentionSchema = zod.z.object({
@@ -32442,128 +32442,103 @@ var require_dist_Ctfhlrtl = __commonJS({
     var AUDIO_MACRO_LABELS = [
       {
         id: "speech",
-        name: "Speech",
-        icon: "\u{1F5E3}\uFE0F"
+        name: "Speech"
       },
       {
         id: "scream",
-        name: "Scream / Shout",
-        icon: "\u{1F631}"
+        name: "Scream / Shout"
       },
       {
         id: "crying",
-        name: "Crying / Baby",
-        icon: "\u{1F622}"
+        name: "Crying / Baby"
       },
       {
         id: "laughter",
-        name: "Laughter",
-        icon: "\u{1F602}"
+        name: "Laughter"
       },
       {
         id: "music",
-        name: "Music",
-        icon: "\u{1F3B5}"
+        name: "Music"
       },
       {
         id: "dog",
-        name: "Dog",
-        icon: "\u{1F415}"
+        name: "Dog"
       },
       {
         id: "cat",
-        name: "Cat",
-        icon: "\u{1F408}"
+        name: "Cat"
       },
       {
         id: "bird",
-        name: "Bird",
-        icon: "\u{1F426}"
+        name: "Bird"
       },
       {
         id: "animal",
-        name: "Animal (other)",
-        icon: "\u{1F43E}"
+        name: "Animal (other)"
       },
       {
         id: "alarm",
-        name: "Alarm / Siren",
-        icon: "\u{1F6A8}"
+        name: "Alarm / Siren"
       },
       {
         id: "doorbell",
-        name: "Doorbell / Knock",
-        icon: "\u{1F514}"
+        name: "Doorbell / Knock"
       },
       {
         id: "glass_breaking",
-        name: "Glass Breaking",
-        icon: "\u{1F4A5}"
+        name: "Glass Breaking"
       },
       {
         id: "gunshot",
-        name: "Gunshot / Explosion",
-        icon: "\u{1F4A3}"
+        name: "Gunshot / Explosion"
       },
       {
         id: "vehicle",
-        name: "Vehicle",
-        icon: "\u{1F697}"
+        name: "Vehicle"
       },
       {
         id: "siren",
-        name: "Emergency Siren",
-        icon: "\u{1F691}"
+        name: "Emergency Siren"
       },
       {
         id: "fire",
-        name: "Fire / Smoke",
-        icon: "\u{1F525}"
+        name: "Fire / Smoke"
       },
       {
         id: "water",
-        name: "Water",
-        icon: "\u{1F4A7}"
+        name: "Water"
       },
       {
         id: "wind",
-        name: "Wind / Weather",
-        icon: "\u{1F32C}\uFE0F"
+        name: "Wind / Weather"
       },
       {
         id: "door",
-        name: "Door",
-        icon: "\u{1F6AA}"
+        name: "Door"
       },
       {
         id: "footsteps",
-        name: "Footsteps",
-        icon: "\u{1F463}"
+        name: "Footsteps"
       },
       {
         id: "crowd",
-        name: "Crowd / Chatter",
-        icon: "\u{1F465}"
+        name: "Crowd / Chatter"
       },
       {
         id: "telephone",
-        name: "Telephone",
-        icon: "\u{1F4DE}"
+        name: "Telephone"
       },
       {
         id: "engine",
-        name: "Engine / Motor",
-        icon: "\u2699\uFE0F"
+        name: "Engine / Motor"
       },
       {
         id: "tools",
-        name: "Tools / Construction",
-        icon: "\u{1F528}"
+        name: "Tools / Construction"
       },
       {
         id: "silence",
-        name: "Silence",
-        icon: "\u{1F92B}"
+        name: "Silence"
       }
     ];
     var YAMNET_TO_MACRO = {
@@ -34677,6 +34652,35 @@ var require_dist_Ctfhlrtl = __commonJS({
       */
       hasFace: zod.z.boolean().optional(),
       /**
+      * This track has a face row IN THE GALLERY: a crop **and** an embedding — a
+      * face an operator could ASSIGN to an identity.
+      *
+      * The STRICT twin of {@link hasFace}, and the pair only earns its keep
+      * because the two disagree. `hasFace` is stamped at the TOP of the face
+      * branch, before every gate, and means no more than "a face detector produced
+      * a face detail". This one is stamped at the single moment the gallery row
+      * LANDS — after `FaceRecognizer.onTrackEnd` successfully persists it, i.e.
+      * past the embedding-magnitude verdict, the `minFacePx` detection gate, the
+      * candidate gate, the imageless-track drop (no crop was ever captured) and
+      * the crop-store drop. Everything between the detector and that insert can
+      * legitimately refuse the face, so a flag written any earlier promises the
+      * operator something to assign and delivers nothing.
+      *
+      * **Independent of recognition.** A face collected but never auto-matched is
+      * still assignable — it is in fact the face an operator most wants to reach —
+      * so this is NOT gated on `recognizedIdentityId`. Recognition lands in
+      * `subLabel`; this says only that the raw material exists.
+      *
+      * **Set once, never cleared.** A track that produced a gallery row produced
+      * one; deleting the row later is the gallery's business, not this flag's.
+      *
+      * **Absent ≠ false**, the same rule as {@link hasFace}: every row written
+      * before the column omits it, and so does every server that predates the
+      * field. A consumer must test `=== true` and render nothing otherwise —
+      * never infer "no assignable face".
+      */
+      hasEmbeddedFace: zod.z.boolean().optional(),
+      /**
       * This subject CONTAINS a folded rider — a person the rider-pairing step
       * ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
       * so the passage is tracked once and as a VEHICLE.
@@ -36437,6 +36441,32 @@ var require_dist_Ctfhlrtl = __commonJS({
       /** FRAME-space bbox (already mapped back from crop space). */
       bbox: NativeCropBboxSchema.optional(),
       embedding: zod.z.string().optional(),
+      /**
+      * L2 magnitude of the RAW pre-normalization embedding. Additive and optional
+      * so an older runner that does not send it degrades to "unmeasurable", which
+      * the consuming gate treats as accept — never as reject.
+      */
+      embeddingMagnitude: zod.z.number().optional(),
+      /**
+      * Model that produced `embedding` — the SAME contract `labelModelId` has for
+      * `label`, and for the same reason: the producing node is the only side that
+      * knows which model actually ran, and re-deriving it downstream is exactly
+      * the inference this model exists to forbid.
+      *
+      * Additive and optional, so a runner that predates it degrades to
+      * "unmeasurable" rather than to a wrong answer — the consumer falls back to
+      * its previous assumption instead of refusing.
+      *
+      * Its absence was not cosmetic. `FaceRecognizer` needs the probe's model id
+      * to use `face-matcher`'s same-model gate (`sample.modelId !== probe.modelId`);
+      * with nothing on the wire it took the id from the GALLERY, so the gate
+      * compared the gallery against itself and could never fire. That turned the
+      * one guard protecting the face feature space into a tautology, and it is
+      * why swapping `face-embedding`'s model would NOT have stranded the enrolled
+      * gallery as the catalog comment predicts — it would have scored the new
+      * model's vectors against the old model's samples in one cosine space.
+      */
+      embeddingModelId: zod.z.string().optional(),
       label: zod.z.string().optional(),
       /**
       * The tier `label` occupies, copied VERBATIM from the producing step's
@@ -37270,6 +37300,12 @@ var require_dist_Ctfhlrtl = __commonJS({
       /** Unix timestamp (ms) when this snapshot was composed server-side. */
       fetchedAt: zod.z.number()
     });
+    var InferenceDeviceExclusionReasonSchema = zod.z.enum([
+      "disabled",
+      "unavailable",
+      "cannot-host-camera-root",
+      "accelerator-preferred"
+    ]);
     var NodeInferenceDeviceSchema = zod.z.object({
       /** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
       key: zod.z.string(),
@@ -37300,7 +37336,17 @@ var require_dist_Ctfhlrtl = __commonJS({
       * available per format; this is the stored selection that becomes the
       * default for EVERY camera landing on this accelerator.
       */
-      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional()
+      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional(),
+      /**
+      * `null` when the device IS a camera-root candidate on this node; otherwise
+      * the reason the dispatcher drops it. Computed by the SAME
+      * `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+      * never disagree with the election — deriving it in the UI from
+      * `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+      * the node's model catalog) and `accelerator-preferred` (needs the node-wide
+      * "an accelerator is serving" predicate).
+      */
+      exclusion: InferenceDeviceExclusionReasonSchema.nullable()
     });
     var NodeInferenceDevicesSchema = zod.z.object({
       nodeId: zod.z.string(),
@@ -38098,6 +38144,7 @@ var require_dist_Ctfhlrtl = __commonJS({
             isBattery: zod.z.boolean(),
             reason: zod.z.enum([
               "disabled",
+              "offline",
               "sleeping",
               "unreachable",
               "waking"
@@ -38188,9 +38235,17 @@ var require_dist_Ctfhlrtl = __commonJS({
           sleeping: zod.z.boolean(),
           /** Current device state rendered over the cached frame. State images
           *  remain authoritative even when their photographic background is
-          *  old; null means the link must carry a current camera frame. */
+          *  old; null means the link must carry a current camera frame.
+          *
+          *  **This is the ONLY source a surface may derive an inactive tile
+          *  from.** A client that reads a device's `online`/`disabled` flags and
+          *  draws its own verdict will disagree with the pixels it is painting
+          *  — the frame comes from here, and so must the sentence over it
+          *  (D190). Pair with `ageMs` for the age of the photograph behind the
+          *  state. */
           stateReason: zod.z.enum([
             "disabled",
+            "offline",
             "sleeping",
             "unreachable",
             "waking"
@@ -42300,7 +42355,35 @@ var require_dist_Ctfhlrtl = __commonJS({
       */
       priority: zod.z.number()
     });
-    var GetConnectionEndpointsResultSchema = zod.z.object({ endpoints: zod.z.array(ConnectionEndpointSchema).readonly() });
+    var LocalPortSourceEnum = zod.z.enum([
+      "server-config",
+      "server-env",
+      "caller-hint",
+      "default"
+    ]);
+    var AdvertisedLocalPortSchema = zod.z.object({
+      port: zod.z.number().int().min(1).max(65535),
+      source: LocalPortSourceEnum
+    });
+    var GetConnectionEndpointsResultSchema = zod.z.object({
+      endpoints: zod.z.array(ConnectionEndpointSchema).readonly(),
+      /**
+      * The port the hub built the LAN/loopback URLs with, and where that number
+      * came from.
+      *
+      * Returned rather than merely applied, because "the URL is right" and "the
+      * client can KNOW the URL is right" are different properties. A client that
+      * only sees a corrected URL cannot distinguish a hub that fixed the port from
+      * a hub that echoed the port the client sent, so it cannot decide whether to
+      * race the candidate or discard it. With `source` it can: anything but
+      * `caller-hint` is the hub's own socket.
+      *
+      * Absent on hubs predating this field — a client that finds it missing is
+      * talking to an echoing hub and must degrade exactly as it does for
+      * `caller-hint`.
+      */
+      localPort: AdvertisedLocalPortSchema
+    });
     var NotificationEndpointSchema = zod.z.object({
       /** The operator's explicit choice, or null for AUTO. */
       baseUrl: zod.z.string().nullable(),
@@ -42342,10 +42425,35 @@ var require_dist_Ctfhlrtl = __commonJS({
         * Honours `getAllowedAddresses()` when set — addresses outside
         * the allowlist are dropped (the public tunnel + loopback are
         * always included as escape hatches).
+        *
+        * **The port is the hub's, not the caller's** (D62 — a function's fact
+        * belongs to whoever already owns it). This method used to take a `port`
+        * and echo it onto every LAN and loopback URL it advertised, which made
+        * every client a second authority on a socket only the hub binds. A viewer
+        * configured with a port-less public URL (`https://camstack.example.top`)
+        * infers 443 from the scheme, asks with 443, and was handed
+        * `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+        * cannot ever answer, and losing its race reads in the log exactly like
+        * "the LAN was tried and it was slower" — so an operator sitting on his own
+        * WiFi stayed on the public tunnel for weeks, with the LAN candidate born
+        * dead on every single connect.
+        *
+        * The hub now resolves its own listen port and reports it as `localPort`,
+        * with the SOURCE of the number, so a client can tell a fact from an echo.
+        *
+        * Out of scope on purpose: a LAN URL that is not the hub's own socket (a
+        * reverse proxy in front of it on another port) is not this method's to
+        * invent either — pin it with `setNotificationEndpoint` / a configured
+        * origin, which is an operator statement rather than a guess.
         */
         getConnectionEndpoints: method(zod.z.object({
-          /** Local hub HTTP port to use in base URLs. */
-          port: zod.z.number().int().min(1).max(65535),
+          /**
+          * LEGACY HINT — do not send from new code. Kept optional so clients
+          * written against the echoing contract keep working; the hub uses it
+          * only when it cannot read its own port, and says so via
+          * `localPort.source === 'caller-hint'`.
+          */
+          port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
           *  candidate. Default `true`. */
           includeLoopback: zod.z.boolean().optional(),
@@ -55173,7 +55281,6 @@ var require_dist_Ctfhlrtl = __commonJS({
       hitPercent: 60,
       samplingSeconds: 10
     };
-    new Map(AUDIO_MACRO_LABELS.flatMap((macro2) => macro2.icon === void 0 ? [] : [[macro2.id, macro2.icon]]));
     NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
     var TimelapseTemplateSchema = zod.z.object({
       title: zod.z.string().max(500).optional(),
@@ -55284,6 +55391,39 @@ var require_dist_Ctfhlrtl = __commonJS({
       createdAt: zod.z.number(),
       updatedAt: zod.z.number()
     });
+    Object.freeze(Object.fromEntries([{
+      stepId: "face-embedding",
+      label: "Face recognition model",
+      defaultModelId: "arcface-r100",
+      indexName: "the enrolled face gallery",
+      options: [
+        {
+          id: "arcface-r100",
+          label: "ArcFace (ResNet34)"
+        },
+        {
+          id: "auraface-r100",
+          label: "AuraFace R100"
+        },
+        {
+          id: "inception-resnet-v1",
+          label: "Inception ResNet V1"
+        }
+      ]
+    }, {
+      stepId: "clip-embedding",
+      label: "Semantic search model",
+      defaultModelId: "mobileclip-s1",
+      indexName: "the object semantic-search index",
+      options: [{
+        id: "mobileclip-s1",
+        label: "MobileCLIP S1"
+      }, {
+        id: "mobileclip-s2",
+        label: "MobileCLIP S2"
+      }]
+    }].map((s) => [s.stepId, s.defaultModelId])));
+    zod.z.string().min(1);
     zod.z.object({
       /**
       * Fraction of the box's own size added on EACH side before cutting.
@@ -55304,10 +55444,17 @@ var require_dist_Ctfhlrtl = __commonJS({
       */
       square: zod.z.boolean()
     });
-    ({
+    var DEFAULT_DETAIL_CROP_CONVENTION = {
       paddingRatio: 0.15,
       square: false
-    }).paddingRatio;
+    };
+    Object.freeze({
+      x: 0,
+      y: 0,
+      w: 1,
+      h: 1
+    });
+    DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio;
     var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
     zod.z.object({
       /**
@@ -56108,7 +56255,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -56921,7 +57068,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -57015,7 +57162,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -57912,6 +58059,230 @@ var require_core_blocks = __commonJS({
   }
 });
 
+// ../system/dist/retired-settings-keys-B52KsNz8.js
+var require_retired_settings_keys_B52KsNz8 = __commonJS({
+  "../system/dist/retired-settings-keys-B52KsNz8.js"(exports) {
+    "use strict";
+    var require_dist10 = require_dist_C1Aea3c6();
+    function settingsStoreIsAuthoritativeHere(env) {
+      const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
+      return raw === "" || raw === "hub";
+    }
+    var RETIRED_SETTINGS_KEYS = [{
+      namespace: "detection-pipeline",
+      collection: "addon-settings",
+      row: "root",
+      keys: ["pipelineSteps", "pipelineEngine"],
+      perNodeKeys: [
+        "engineRuntime",
+        "engineBackend",
+        "engineDevice",
+        "probedBestEngine"
+      ],
+      reason: "global step/engine seed and the per-node engine cascade \u2014 both removed; the live per-camera dispatch path never read either"
+    }];
+    var RETIRED_SETTINGS_ROWS = [
+      {
+        collection: "addon-settings",
+        row: "device-manager.deviceMeta",
+        owner: "device-manager",
+        evidence: { collection: "device-manager:devices" },
+        reason: "the fleet is one row per device in `device-manager:devices` since the flatten; this blob was 467 KB read and JSON.parsed on hub-main per projection"
+      },
+      {
+        collection: "addon-settings",
+        row: "device-manager.deviceMetadata",
+        owner: "device-manager",
+        evidence: { collection: "device-manager:devices" },
+        reason: "hardware-identity metadata is the `metadata` column of the device row; the separate blob existed only because a blob write is whole-value"
+      },
+      {
+        collection: "addon-settings",
+        row: "device-manager.deviceIndex",
+        owner: "device-manager",
+        evidence: { collection: "device-manager:devices" },
+        reason: "derivable: `addonId`/`stableId` are indexed columns, and index membership is the `registered` column"
+      }
+    ];
+    function retiredKeyStoreOf(backend) {
+      return {
+        async read(spec) {
+          return require_dist10.asJsonObject(await backend.get({
+            namespace: spec.namespace,
+            collection: spec.collection,
+            key: spec.row
+          }));
+        },
+        async write(spec, value) {
+          await backend.set({
+            namespace: spec.namespace,
+            collection: spec.collection,
+            key: spec.row,
+            value
+          });
+        }
+      };
+    }
+    function planNestedRetiredKeyPurge(blob, spec) {
+      const nestedKeys = spec.mapValueKeys ?? [];
+      if (nestedKeys.length === 0) return [];
+      const found = [];
+      for (const [mapKey, value] of Object.entries(blob)) {
+        const inner = require_dist10.asJsonObject(value);
+        if (inner === null) continue;
+        for (const retired of nestedKeys) if (retired in inner) found.push(`${mapKey}.${retired}`);
+      }
+      return found;
+    }
+    function planRetiredKeyPurge(blob, spec) {
+      const exact = new Set(spec.keys);
+      const found = [];
+      for (const key of Object.keys(blob)) {
+        if (exact.has(key)) {
+          found.push(key);
+          continue;
+        }
+        for (const perNode of spec.perNodeKeys) if (key === perNode || key.startsWith(`${perNode}@`)) {
+          found.push(key);
+          break;
+        }
+      }
+      return found;
+    }
+    async function purgeRetiredSettingsKeys(store, logger, specs = RETIRED_SETTINGS_KEYS, env = process.env) {
+      if (!settingsStoreIsAuthoritativeHere(env)) return [];
+      const results = [];
+      for (const spec of specs) {
+        let blob;
+        try {
+          blob = await store.read(spec);
+        } catch (err) {
+          logger.warn("retired settings keys \u2014 read failed, row left untouched", { meta: {
+            addon: spec.namespace,
+            collection: spec.collection,
+            row: spec.row,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+          continue;
+        }
+        if (blob === null) continue;
+        const doomed = planRetiredKeyPurge(blob, spec);
+        const doomedNested = planNestedRetiredKeyPurge(blob, spec);
+        if (doomed.length === 0 && doomedNested.length === 0) continue;
+        const doomedSet = new Set(doomed);
+        const nestedByMapKey = /* @__PURE__ */ new Map();
+        for (const path of doomedNested) {
+          const cut = path.indexOf(".");
+          const mapKey = path.slice(0, cut);
+          const inner = path.slice(cut + 1);
+          const bucket = nestedByMapKey.get(mapKey) ?? /* @__PURE__ */ new Set();
+          bucket.add(inner);
+          nestedByMapKey.set(mapKey, bucket);
+        }
+        const next = Object.fromEntries(Object.entries(blob).filter(([key]) => !doomedSet.has(key)).map(([key, value]) => {
+          const retired = nestedByMapKey.get(key);
+          if (retired === void 0) return [key, value];
+          const inner = require_dist10.asJsonObject(value);
+          if (inner === null) return [key, value];
+          return [key, Object.fromEntries(Object.entries(inner).filter(([k]) => !retired.has(k)))];
+        }));
+        await store.write(spec, next);
+        const result = {
+          addon: spec.namespace,
+          collection: spec.collection,
+          row: spec.row,
+          keys: doomed,
+          nested: doomedNested
+        };
+        results.push(result);
+        logger.info(`purged ${doomed.length + doomedNested.length} retired settings keys`, { meta: {
+          ...result,
+          reason: spec.reason
+        } });
+      }
+      return results;
+    }
+    async function purgeRetiredSettingsRows(store, logger, specs = RETIRED_SETTINGS_ROWS, env = process.env) {
+      if (!settingsStoreIsAuthoritativeHere(env)) return [];
+      const results = [];
+      const evidence = /* @__PURE__ */ new Map();
+      for (const spec of specs) {
+        let present;
+        try {
+          present = await store.hasRow(spec);
+        } catch (err) {
+          logger.warn("retired settings row \u2014 read failed, row left untouched", { meta: {
+            addon: spec.owner,
+            collection: spec.collection,
+            row: spec.row,
+            error: errText(err)
+          } });
+          continue;
+        }
+        if (!present) continue;
+        const successor = spec.evidence.collection;
+        let count = evidence.get(successor);
+        if (count === void 0) {
+          try {
+            count = await store.countRows(successor);
+          } catch (err) {
+            logger.warn("retired settings row \u2014 successor unreadable, row left untouched", { meta: {
+              addon: spec.owner,
+              row: spec.row,
+              successor,
+              error: errText(err)
+            } });
+            count = 0;
+          }
+          evidence.set(successor, count);
+        }
+        if (count === 0) {
+          logger.warn("retired settings row kept \u2014 its successor is empty, migration has not run", { meta: {
+            addon: spec.owner,
+            collection: spec.collection,
+            row: spec.row,
+            successor
+          } });
+          continue;
+        }
+        await store.deleteRow(spec);
+        const result = {
+          owner: spec.owner,
+          collection: spec.collection,
+          row: spec.row
+        };
+        results.push(result);
+        logger.info("purged a retired settings row", { meta: {
+          ...result,
+          reason: spec.reason
+        } });
+      }
+      return results;
+    }
+    function errText(err) {
+      return err instanceof Error ? err.message : String(err);
+    }
+    Object.defineProperty(exports, "purgeRetiredSettingsKeys", {
+      enumerable: true,
+      get: function() {
+        return purgeRetiredSettingsKeys;
+      }
+    });
+    Object.defineProperty(exports, "purgeRetiredSettingsRows", {
+      enumerable: true,
+      get: function() {
+        return purgeRetiredSettingsRows;
+      }
+    });
+    Object.defineProperty(exports, "retiredKeyStoreOf", {
+      enumerable: true,
+      get: function() {
+        return retiredKeyStoreOf;
+      }
+    });
+  }
+});
+
 // ../types/dist/canonical-hash-DNV8S5ET.js
 var require_canonical_hash_DNV8S5ET = __commonJS({
   "../types/dist/canonical-hash-DNV8S5ET.js"(exports) {
@@ -59735,7 +60106,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
+    var require_retired_settings_keys = require_retired_settings_keys_B52KsNz8();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -60023,6 +60395,311 @@ var require_device_manager_addon = __commonJS({
         }
       }
     };
+    function tagContribution(contribution, capName, addonId, kind) {
+      const source = kind === "settings" ? "settings" : "live";
+      return {
+        ...contribution.tabs ? { tabs: [...contribution.tabs] } : {},
+        sections: contribution.sections.map((section) => ({
+          ...section,
+          fields: section.fields.map((field) => tagField(field, capName, addonId, source, kind))
+        }))
+      };
+    }
+    function isFieldRecord(value) {
+      return value !== null && typeof value === "object" && !Array.isArray(value);
+    }
+    function toWireShape(input) {
+      const out = { sections: input.sections.map((s) => ({
+        id: s.id,
+        title: s.title,
+        ...s.description !== void 0 ? { description: s.description } : {},
+        ...s.style !== void 0 ? { style: s.style } : {},
+        ...s.defaultCollapsed !== void 0 ? { defaultCollapsed: s.defaultCollapsed } : {},
+        ...s.columns !== void 0 ? { columns: s.columns } : {},
+        ...s.tab !== void 0 ? { tab: s.tab } : {},
+        ...s.location !== void 0 ? { location: s.location } : {},
+        ...s.order !== void 0 ? { order: s.order } : {},
+        fields: [...s.fields]
+      })) };
+      if (input.tabs) out.tabs = [...input.tabs];
+      return out;
+    }
+    function tagField(field, capName, addonId, source, kind) {
+      if (!isFieldRecord(field)) return field;
+      const f = field;
+      const structuralTypes = /* @__PURE__ */ new Set([
+        "separator",
+        "info",
+        "button"
+      ]);
+      if (typeof f.type === "string" && structuralTypes.has(f.type)) return field;
+      const tagged = {
+        ...f,
+        source
+      };
+      if (kind === "live" || f.readonlyField === true) tagged.readonlyField = true;
+      else {
+        tagged.writerCapName = capName;
+        tagged.writerAddonId = addonId;
+      }
+      if (f.type === "group") {
+        const children = Array.isArray(f.fields) ? f.fields : [];
+        if (children.length > 0) tagged.fields = children.map((child) => tagField(child, capName, addonId, source, kind));
+      } else if (f.type === "sub-tabs") {
+        const rawTabs = Array.isArray(f.tabs) ? f.tabs : [];
+        if (rawTabs.length > 0) tagged.tabs = rawTabs.map((tab) => {
+          if (!isFieldRecord(tab)) return tab;
+          const tabChildren = Array.isArray(tab.fields) ? tab.fields : [];
+          return {
+            ...tab,
+            fields: tabChildren.map((child) => tagField(child, capName, addonId, source, kind))
+          };
+        });
+      }
+      return tagged;
+    }
+    function mergeAggregates(parts) {
+      const tabDecls = /* @__PURE__ */ new Map();
+      const sections = [];
+      const seenSectionIds = /* @__PURE__ */ new Set();
+      for (const part of parts) {
+        if (part.tabs) {
+          for (const t of part.tabs) if (!tabDecls.has(t.id)) tabDecls.set(t.id, t);
+        }
+        for (const s of part.sections) {
+          if (s.id !== void 0) {
+            if (seenSectionIds.has(s.id)) continue;
+            seenSectionIds.add(s.id);
+          }
+          sections.push(s);
+        }
+      }
+      for (const s of sections) {
+        const tabId = s.tab ?? "general";
+        if (tabDecls.has(tabId)) continue;
+        const known = require_dist10.WELL_KNOWN_TAB_MAP[tabId];
+        if (known) tabDecls.set(tabId, {
+          id: known.id,
+          label: known.label,
+          icon: known.icon,
+          order: known.order
+        });
+        else tabDecls.set(tabId, {
+          id: tabId,
+          label: tabId,
+          icon: "wrench",
+          order: 100
+        });
+      }
+      sections.sort((a, b) => {
+        const tabA = a.tab ?? "general";
+        const tabB = b.tab ?? "general";
+        if (tabA !== tabB) {
+          const orderA = tabDecls.get(tabA)?.order ?? 100;
+          const orderB = tabDecls.get(tabB)?.order ?? 100;
+          if (orderA !== orderB) return orderA - orderB;
+          return tabA.localeCompare(tabB);
+        }
+        return (a.order ?? 0) - (b.order ?? 0);
+      });
+      const sortedTabs = [...tabDecls.values()].toSorted((a, b) => (a.order ?? 100) - (b.order ?? 100));
+      const out = { sections };
+      if (sortedTabs.length > 0) out.tabs = sortedTabs;
+      return out;
+    }
+    function wireRemoteNativeCapSync(ctx, remoteNativeCaps) {
+      const localNodeId = ctx.kernel.localNodeId ?? "hub";
+      ctx.eventBus.subscribe({ category: require_dist10.EventCategory.DeviceBindingsChanged }, (event) => {
+        const { deviceId, capName, reason, addonId, nodeId } = event.data;
+        if (nodeId === localNodeId) return;
+        if (reason === "native-registered") {
+          let perDevice = remoteNativeCaps.get(deviceId);
+          if (!perDevice) {
+            perDevice = /* @__PURE__ */ new Map();
+            remoteNativeCaps.set(deviceId, perDevice);
+          }
+          perDevice.set(capName, {
+            addonId,
+            nodeId
+          });
+        } else if (reason === "native-unregistered") {
+          const perDevice = remoteNativeCaps.get(deviceId);
+          if (!perDevice) return;
+          perDevice.delete(capName);
+          if (perDevice.size === 0) remoteNativeCaps.delete(deviceId);
+        }
+      });
+      const cluster = ctx.kernel.cluster;
+      if (cluster) cluster.broker.localBus.on("$node.disconnected", (payload) => {
+        const gone = payload.node.id;
+        const emptyDevices = [];
+        for (const [deviceId, perDevice] of remoteNativeCaps) {
+          const toDelete = [];
+          for (const [capName, entry] of perDevice) if (entry.nodeId === gone) toDelete.push(capName);
+          for (const capName of toDelete) perDevice.delete(capName);
+          if (perDevice.size === 0) emptyDevices.push(deviceId);
+        }
+        for (const deviceId of emptyDevices) remoteNativeCaps.delete(deviceId);
+      });
+    }
+    async function readBindingsStore(deps) {
+      return { deviceBindings: (await deps.ctx.settings.readAddonStore()).deviceBindings ?? {} };
+    }
+    async function writeBindingsStore(deps, next) {
+      await deps.ctx.settings.writeAddonStore({ deviceBindings: next.deviceBindings });
+    }
+    function resolveWrapperNodeId(_wrapperAddonId) {
+      return "hub";
+    }
+    function toRoutableProviderNodeId(nodeId) {
+      const slash = nodeId.indexOf("/");
+      return slash === -1 ? nodeId : nodeId.slice(0, slash);
+    }
+    function resolveRemoteNativeCapFromRegistry(deps, capName, deviceId) {
+      const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+      if (!clusterCaps) return null;
+      for (const entry of clusterCaps) if (entry.capName === capName && entry.deviceId === deviceId && entry.addonId) return {
+        addonId: entry.addonId,
+        nodeId: entry.nodeId
+      };
+      return null;
+    }
+    function resolveDeviceType(deps, row, deviceId) {
+      const persisted = row?.meta.type;
+      if (typeof persisted === "string" && persisted.length > 0) return persisted;
+      const live = deps.ctx.kernel?.deviceRegistry?.getById(deviceId)?.type;
+      return typeof live === "string" && live.length > 0 ? live : void 0;
+    }
+    async function resolveDevicePresence(deps, row, deviceId) {
+      if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
+      if (row !== null) return "present";
+      return await deps.rows.count() > 0 ? "absent" : "unknown";
+    }
+    function capAppliesToDeviceType(def, deviceType) {
+      if (deviceType === void 0) return true;
+      const declared = def?.deviceTypes;
+      if (!declared || declared.length === 0) return true;
+      return declared.some((t) => t === deviceType);
+    }
+    async function getBindings(deps, input) {
+      const storeKey = String(input.deviceId);
+      const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+      const row = await deps.rows.get(input.deviceId);
+      const deviceType = resolveDeviceType(deps, row, input.deviceId);
+      const presence = await resolveDevicePresence(deps, row, input.deviceId);
+      const entries = [];
+      const seenCaps = /* @__PURE__ */ new Set();
+      const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
+      for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
+        const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
+        const remoteNative = resolveRemote(capName);
+        const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
+        const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
+        if (wrapperAddonId === null && !nativeAddonId) {
+          seenCaps.add(capName);
+          continue;
+        }
+        entries.push({
+          capName,
+          kind: wrapperAddonId ? "wrapped" : "native",
+          providerAddonId: wrapperAddonId ?? nativeAddonId,
+          providerNodeId: wrapperAddonId ? resolveWrapperNodeId(wrapperAddonId) : toRoutableProviderNodeId(nativeNodeId),
+          nativeAddonId
+        });
+        seenCaps.add(capName);
+      }
+      if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device \u2014 returning none", { tags: { deviceId: input.deviceId } });
+      else if (deps.capabilityRegistry) {
+        const skippedForType = [];
+        for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
+          if (seenCaps.has(capName)) continue;
+          if (!capAppliesToDeviceType(deps.capabilityRegistry.getDefinition(capName), deviceType)) {
+            skippedForType.push(capName);
+            continue;
+          }
+          const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
+          if (!defaultWrapperAddonId) continue;
+          const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
+          const remoteNative = resolveRemote(capName);
+          const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
+          entries.push({
+            capName,
+            kind: "wrapped",
+            providerAddonId: defaultWrapperAddonId,
+            providerNodeId: resolveWrapperNodeId(defaultWrapperAddonId),
+            nativeAddonId
+          });
+          seenCaps.add(capName);
+        }
+        if (skippedForType.length > 0) deps.ctx.logger.debug("getBindings: default wrappers skipped \u2014 deviceTypes mismatch", {
+          tags: { deviceId: input.deviceId },
+          meta: {
+            deviceType,
+            skipped: skippedForType
+          }
+        });
+      }
+      if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
+        if (seenCaps.has(capName)) continue;
+        const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
+        entries.push({
+          capName,
+          kind: "native",
+          providerAddonId: nativeAddonId,
+          providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
+          nativeAddonId
+        });
+        seenCaps.add(capName);
+      }
+      const pushFed = deps.remoteNativeCaps.get(input.deviceId);
+      if (pushFed) for (const [capName, info] of pushFed) {
+        if (seenCaps.has(capName)) continue;
+        entries.push({
+          capName,
+          kind: "native",
+          providerAddonId: info.addonId,
+          providerNodeId: toRoutableProviderNodeId(info.nodeId),
+          nativeAddonId: info.addonId
+        });
+        seenCaps.add(capName);
+      }
+      const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+      if (clusterCaps) for (const entry of clusterCaps) {
+        if (entry.deviceId !== input.deviceId) continue;
+        if (seenCaps.has(entry.capName)) continue;
+        if (!entry.addonId) continue;
+        const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
+        if (entry.nodeId === localNodeId) continue;
+        entries.push({
+          capName: entry.capName,
+          kind: "native",
+          providerAddonId: entry.addonId,
+          providerNodeId: toRoutableProviderNodeId(entry.nodeId),
+          nativeAddonId: entry.addonId
+        });
+        seenCaps.add(entry.capName);
+      }
+      return {
+        deviceId: input.deviceId,
+        entries
+      };
+    }
+    async function getAllBindings(deps) {
+      const ids = /* @__PURE__ */ new Set();
+      for (const row of await deps.rows.listAll()) ids.add(row.meta.id);
+      const registered = deps.ctx.kernel?.deviceRegistry?.getAll() ?? [];
+      for (const device of registered) ids.add(device.id);
+      if (ids.size === 0) {
+        deps.ctx.logger.warn("getAllBindings found no devices \u2014 warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
+        return [];
+      }
+      const out = [];
+      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await getBindings(deps, { deviceId }));
+      return out;
+    }
+    async function lookupPersistedStableId(deps, deviceId) {
+      return (await deps.rows.get(deviceId))?.meta.stableId;
+    }
     var MODE_LABELS = {
       auto: "Auto",
       day: "Day",
@@ -60345,118 +61022,6 @@ var require_device_manager_addon = __commonJS({
       if (reducer.kind !== "settings") throw new Error(`device-config: builderId "${builderId}" is not a settings-based derived-form`);
       return reducer.parsePatch(patch);
     }
-    function tagContribution(contribution, capName, addonId, kind) {
-      const source = kind === "settings" ? "settings" : "live";
-      return {
-        ...contribution.tabs ? { tabs: [...contribution.tabs] } : {},
-        sections: contribution.sections.map((section) => ({
-          ...section,
-          fields: section.fields.map((field) => tagField(field, capName, addonId, source, kind))
-        }))
-      };
-    }
-    function isFieldRecord(value) {
-      return value !== null && typeof value === "object" && !Array.isArray(value);
-    }
-    function toWireShape(input) {
-      const out = { sections: input.sections.map((s) => ({
-        id: s.id,
-        title: s.title,
-        ...s.description !== void 0 ? { description: s.description } : {},
-        ...s.style !== void 0 ? { style: s.style } : {},
-        ...s.defaultCollapsed !== void 0 ? { defaultCollapsed: s.defaultCollapsed } : {},
-        ...s.columns !== void 0 ? { columns: s.columns } : {},
-        ...s.tab !== void 0 ? { tab: s.tab } : {},
-        ...s.location !== void 0 ? { location: s.location } : {},
-        ...s.order !== void 0 ? { order: s.order } : {},
-        fields: [...s.fields]
-      })) };
-      if (input.tabs) out.tabs = [...input.tabs];
-      return out;
-    }
-    function tagField(field, capName, addonId, source, kind) {
-      if (!isFieldRecord(field)) return field;
-      const f = field;
-      const structuralTypes = /* @__PURE__ */ new Set([
-        "separator",
-        "info",
-        "button"
-      ]);
-      if (typeof f.type === "string" && structuralTypes.has(f.type)) return field;
-      const tagged = {
-        ...f,
-        source
-      };
-      if (kind === "live" || f.readonlyField === true) tagged.readonlyField = true;
-      else {
-        tagged.writerCapName = capName;
-        tagged.writerAddonId = addonId;
-      }
-      if (f.type === "group") {
-        const children = Array.isArray(f.fields) ? f.fields : [];
-        if (children.length > 0) tagged.fields = children.map((child) => tagField(child, capName, addonId, source, kind));
-      } else if (f.type === "sub-tabs") {
-        const rawTabs = Array.isArray(f.tabs) ? f.tabs : [];
-        if (rawTabs.length > 0) tagged.tabs = rawTabs.map((tab) => {
-          if (!isFieldRecord(tab)) return tab;
-          const tabChildren = Array.isArray(tab.fields) ? tab.fields : [];
-          return {
-            ...tab,
-            fields: tabChildren.map((child) => tagField(child, capName, addonId, source, kind))
-          };
-        });
-      }
-      return tagged;
-    }
-    function mergeAggregates(parts) {
-      const tabDecls = /* @__PURE__ */ new Map();
-      const sections = [];
-      const seenSectionIds = /* @__PURE__ */ new Set();
-      for (const part of parts) {
-        if (part.tabs) {
-          for (const t of part.tabs) if (!tabDecls.has(t.id)) tabDecls.set(t.id, t);
-        }
-        for (const s of part.sections) {
-          if (s.id !== void 0) {
-            if (seenSectionIds.has(s.id)) continue;
-            seenSectionIds.add(s.id);
-          }
-          sections.push(s);
-        }
-      }
-      for (const s of sections) {
-        const tabId = s.tab ?? "general";
-        if (tabDecls.has(tabId)) continue;
-        const known = require_dist10.WELL_KNOWN_TAB_MAP[tabId];
-        if (known) tabDecls.set(tabId, {
-          id: known.id,
-          label: known.label,
-          icon: known.icon,
-          order: known.order
-        });
-        else tabDecls.set(tabId, {
-          id: tabId,
-          label: tabId,
-          icon: "wrench",
-          order: 100
-        });
-      }
-      sections.sort((a, b) => {
-        const tabA = a.tab ?? "general";
-        const tabB = b.tab ?? "general";
-        if (tabA !== tabB) {
-          const orderA = tabDecls.get(tabA)?.order ?? 100;
-          const orderB = tabDecls.get(tabB)?.order ?? 100;
-          if (orderA !== orderB) return orderA - orderB;
-          return tabA.localeCompare(tabB);
-        }
-        return (a.order ?? 0) - (b.order ?? 0);
-      });
-      const sortedTabs = [...tabDecls.values()].toSorted((a, b) => (a.order ?? 100) - (b.order ?? 100));
-      const out = { sections };
-      if (sortedTabs.length > 0) out.tabs = sortedTabs;
-      return out;
-    }
     function isTransientMoleculerError(err) {
       if (err !== null && typeof err === "object") {
         const e = err;
@@ -60548,22 +61113,15 @@ var require_device_manager_addon = __commonJS({
     }
     async function listPersistedByAddon(pctx, input) {
       const { addonId } = input;
-      const { index, meta } = await pctx.metaStore.readAll();
-      const stableIds = index[addonId] ?? [];
-      const byStableId = /* @__PURE__ */ new Map();
-      for (const m of Object.values(meta)) if (m.addonId === addonId) byStableId.set(m.stableId, m);
-      return stableIds.map((stableId) => {
-        const m = byStableId.get(stableId);
-        return {
-          id: m.id,
-          stableId,
-          type: m.type,
-          name: m.name,
-          location: m.location ?? null,
-          disabled: m.disabled ?? false,
-          parentDeviceId: m.parentDeviceId
-        };
-      });
+      return (await pctx.metaStore.rows.listByAddon(addonId)).map(({ meta: m }) => ({
+        id: m.id,
+        stableId: m.stableId,
+        type: m.type,
+        name: m.name,
+        location: m.location ?? null,
+        disabled: m.disabled ?? false,
+        parentDeviceId: m.parentDeviceId
+      }));
     }
     async function listAll(pctx, input) {
       const ownerFilter = Reflect.get(input, "addonId");
@@ -60573,7 +61131,9 @@ var require_device_manager_addon = __commonJS({
       const camerasOnly = input.isCamera === true;
       const results = [];
       const seen = /* @__PURE__ */ new Set();
-      const { meta, metadata: metadataMap, index } = await pctx.metaStore.readAll();
+      const fleet = addonId ? await pctx.metaStore.rows.listByAddon(addonId) : await pctx.metaStore.rows.listAll();
+      const rowById = /* @__PURE__ */ new Map();
+      for (const row of fleet) rowById.set(row.meta.id, row);
       if (pctx.registry) {
         const liveEntries = addonId ? pctx.registry.getAllForAddon(addonId).map((device) => ({
           addonId,
@@ -60581,7 +61141,8 @@ var require_device_manager_addon = __commonJS({
         })) : pctx.registry.getAllWithAddonId();
         for (const { addonId: aid, device } of liveEntries) {
           const key = String(device.id);
-          const info = toDeviceInfo(aid, device, metadataMap[key] ?? null, meta[key] ?? null);
+          const row = rowById.get(device.id);
+          const info = toDeviceInfo(aid, device, row?.metadata ?? null, row?.meta ?? null);
           seen.add(key);
           if (camerasOnly && !info.isCamera) continue;
           results.push(slim ? {
@@ -60591,38 +61152,36 @@ var require_device_manager_addon = __commonJS({
           } : info);
         }
       }
-      const metaByAddonStable = /* @__PURE__ */ new Map();
-      for (const m of Object.values(meta)) metaByAddonStable.set(`${m.addonId}\0${m.stableId}`, m);
-      const targetAddons = addonId ? [addonId] : Object.keys(index);
-      for (const aid of targetAddons) for (const stableId of index[aid] ?? []) {
-        const m = metaByAddonStable.get(`${aid}\0${stableId}`);
-        const key = String(m.id);
-        if (seen.has(key)) continue;
+      for (const row of fleet) {
+        const m = row.meta;
+        const aid = m.addonId;
+        const stableId = m.stableId;
+        if (seen.has(String(m.id))) continue;
         const persistedType = m.type;
         if (camerasOnly && persistedType !== require_dist10.DeviceType.Camera) continue;
         const persistedConfig = slim ? {} : await pctx.settings.readDeviceStore(m.id);
-        const metadata = slim ? null : metadataMap[key] ?? null;
+        const metadata = slim ? null : row.metadata;
         results.push({
           id: m.id,
           stableId,
           addonId: aid,
           type: persistedType,
-          name: m?.name ?? stableId,
-          location: m?.location ?? null,
-          disabled: m?.disabled ?? false,
-          parentDeviceId: m?.parentDeviceId ?? null,
-          role: toDeviceRole(m?.role),
+          name: m.name,
+          location: m.location ?? null,
+          disabled: m.disabled ?? false,
+          parentDeviceId: m.parentDeviceId ?? null,
+          role: toDeviceRole(m.role),
           online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
           probed: pctx.host.resolveDeviceProbed(m.id),
-          features: persistedFeatures(m?.features),
+          features: persistedFeatures(m.features),
           isCamera: persistedType === require_dist10.DeviceType.Camera,
           config: persistedConfig ?? {},
           metadata,
-          ...m?.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
-          ...m?.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
-          ...m?.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
-          ...m?.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
-          ...m?.display !== void 0 ? { display: m.display } : {},
+          ...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
+          ...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
+          ...m.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
+          ...m.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
+          ...m.display !== void 0 ? { display: m.display } : {},
           ...(() => {
             if (slim) return {};
             const si = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
@@ -60637,19 +61196,15 @@ var require_device_manager_addon = __commonJS({
       if (pctx.registry) {
         const found = resolveDeviceById(pctx.registry, deviceId);
         if (found) {
-          const key2 = String(found.device.id);
-          const [map, metaMap] = await Promise.all([pctx.metaStore.readMetadataMap(), pctx.metaStore.readMeta()]);
-          const metadata2 = map[key2] ?? null;
-          const metaRow = metaMap[key2] ?? null;
-          return toDeviceInfo(found.addonId, found.device, metadata2, metaRow);
+          const row2 = await pctx.metaStore.getRow(found.device.id);
+          return toDeviceInfo(found.addonId, found.device, row2?.metadata ?? null, row2?.meta ?? null);
         }
       }
-      const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-      if (!persisted) return null;
-      const { addonId: aid, stableId, meta: m } = persisted;
+      const row = await pctx.metaStore.getRow(deviceId);
+      if (row === null) return null;
+      const { meta: m, metadata } = row;
+      const { addonId: aid, stableId } = m;
       const persistedConfig = await pctx.settings.readDeviceStore(m.id);
-      const key = String(deviceId);
-      const metadata = (await pctx.metaStore.readMetadataMap())[key] ?? null;
       const sourceInfoGetDevice = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
       return {
         id: deviceId,
@@ -60688,26 +61243,25 @@ var require_device_manager_addon = __commonJS({
       }
       const results = [];
       const seen = /* @__PURE__ */ new Set();
-      const { index, meta, metadata: metadataMap } = await pctx.metaStore.readAll();
+      const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
+      const rowById = /* @__PURE__ */ new Map();
+      for (const row of childRows) rowById.set(row.meta.id, row);
       if (pctx.registry) {
         const liveChildren = pctx.registry.getChildren(parentDeviceId);
         for (const device of liveChildren) {
           const key = String(device.id);
-          const metadata = metadataMap[key] ?? null;
-          const metaRow = meta[key] ?? null;
-          results.push(toDeviceInfo(ownerAddonId, device, metadata, metaRow));
+          const row = rowById.get(device.id);
+          results.push(toDeviceInfo(ownerAddonId, device, row?.metadata ?? null, row?.meta ?? null));
           seen.add(key);
         }
       }
-      const ownerMetaByStableId = /* @__PURE__ */ new Map();
-      for (const m of Object.values(meta)) if (m.addonId === ownerAddonId) ownerMetaByStableId.set(m.stableId, m);
-      const persistedChildren = (index[ownerAddonId] ?? []).filter((sid) => ownerMetaByStableId.get(sid)?.parentDeviceId === parentDeviceId);
-      for (const childStableId of persistedChildren) {
-        const m = ownerMetaByStableId.get(childStableId);
+      for (const row of childRows) {
+        const m = row.meta;
+        const childStableId = m.stableId;
         const key = String(m.id);
         if (seen.has(key)) continue;
         const persistedConfig = await pctx.settings.readDeviceStore(m.id);
-        const metadata = metadataMap[key] ?? null;
+        const metadata = row.metadata;
         const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
         results.push({
           id: m.id,
@@ -60851,16 +61405,10 @@ var require_device_manager_addon = __commonJS({
     }
     async function removeByIntegration(pctx, input) {
       const { integrationId } = input;
-      const meta = await pctx.metaStore.readMeta();
-      const parentKeys = Object.keys(meta).filter((key) => {
-        const m = meta[key];
-        return m !== void 0 && m.integrationId === integrationId && m.parentDeviceId === null;
-      });
+      const parents = (await pctx.metaStore.rows.listByIntegration(integrationId)).filter((row) => row.meta.parentDeviceId === null);
       let removed = 0;
-      for (const _key of parentKeys) {
-        const m = meta[_key];
-        if (!m) continue;
-        await pctx.provider.remove({ deviceId: m.id });
+      for (const parent of parents) {
+        await pctx.provider.remove({ deviceId: parent.meta.id });
         removed++;
       }
       return { removed };
@@ -61249,204 +61797,6 @@ var require_device_manager_addon = __commonJS({
         driverPatch
       };
     }
-    function wireRemoteNativeCapSync(ctx, remoteNativeCaps) {
-      const localNodeId = ctx.kernel.localNodeId ?? "hub";
-      ctx.eventBus.subscribe({ category: require_dist10.EventCategory.DeviceBindingsChanged }, (event) => {
-        const { deviceId, capName, reason, addonId, nodeId } = event.data;
-        if (nodeId === localNodeId) return;
-        if (reason === "native-registered") {
-          let perDevice = remoteNativeCaps.get(deviceId);
-          if (!perDevice) {
-            perDevice = /* @__PURE__ */ new Map();
-            remoteNativeCaps.set(deviceId, perDevice);
-          }
-          perDevice.set(capName, {
-            addonId,
-            nodeId
-          });
-        } else if (reason === "native-unregistered") {
-          const perDevice = remoteNativeCaps.get(deviceId);
-          if (!perDevice) return;
-          perDevice.delete(capName);
-          if (perDevice.size === 0) remoteNativeCaps.delete(deviceId);
-        }
-      });
-      const cluster = ctx.kernel.cluster;
-      if (cluster) cluster.broker.localBus.on("$node.disconnected", (payload) => {
-        const gone = payload.node.id;
-        const emptyDevices = [];
-        for (const [deviceId, perDevice] of remoteNativeCaps) {
-          const toDelete = [];
-          for (const [capName, entry] of perDevice) if (entry.nodeId === gone) toDelete.push(capName);
-          for (const capName of toDelete) perDevice.delete(capName);
-          if (perDevice.size === 0) emptyDevices.push(deviceId);
-        }
-        for (const deviceId of emptyDevices) remoteNativeCaps.delete(deviceId);
-      });
-    }
-    async function readBindingsStore(deps) {
-      return { deviceBindings: (await deps.ctx.settings.readAddonStore()).deviceBindings ?? {} };
-    }
-    async function writeBindingsStore(deps, next) {
-      await deps.ctx.settings.writeAddonStore({ deviceBindings: next.deviceBindings });
-    }
-    function resolveWrapperNodeId(_wrapperAddonId) {
-      return "hub";
-    }
-    function toRoutableProviderNodeId(nodeId) {
-      const slash = nodeId.indexOf("/");
-      return slash === -1 ? nodeId : nodeId.slice(0, slash);
-    }
-    function resolveRemoteNativeCapFromRegistry(deps, capName, deviceId) {
-      const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
-      if (!clusterCaps) return null;
-      for (const entry of clusterCaps) if (entry.capName === capName && entry.deviceId === deviceId && entry.addonId) return {
-        addonId: entry.addonId,
-        nodeId: entry.nodeId
-      };
-      return null;
-    }
-    function resolveDeviceType(deps, rawStore, deviceId) {
-      const persisted = rawStore.deviceMeta?.[String(deviceId)]?.type;
-      if (typeof persisted === "string" && persisted.length > 0) return persisted;
-      const live = deps.ctx.kernel?.deviceRegistry?.getById(deviceId)?.type;
-      return typeof live === "string" && live.length > 0 ? live : void 0;
-    }
-    function resolveDevicePresence(deps, rawStore, deviceId) {
-      if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
-      const meta = rawStore.deviceMeta;
-      if (meta && Object.keys(meta).length > 0) return meta[String(deviceId)] === void 0 ? "absent" : "present";
-      return "unknown";
-    }
-    function capAppliesToDeviceType(def, deviceType) {
-      if (deviceType === void 0) return true;
-      const declared = def?.deviceTypes;
-      if (!declared || declared.length === 0) return true;
-      return declared.some((t) => t === deviceType);
-    }
-    async function getBindings(deps, input) {
-      const storeKey = String(input.deviceId);
-      const rawStore = await deps.ctx.settings.readAddonStore();
-      const perDevice = (rawStore.deviceBindings ?? {})[storeKey] ?? {};
-      const deviceType = resolveDeviceType(deps, rawStore, input.deviceId);
-      const presence = resolveDevicePresence(deps, rawStore, input.deviceId);
-      const entries = [];
-      const seenCaps = /* @__PURE__ */ new Set();
-      const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
-      for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
-        const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
-        const remoteNative = resolveRemote(capName);
-        const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
-        const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
-        if (wrapperAddonId === null && !nativeAddonId) {
-          seenCaps.add(capName);
-          continue;
-        }
-        entries.push({
-          capName,
-          kind: wrapperAddonId ? "wrapped" : "native",
-          providerAddonId: wrapperAddonId ?? nativeAddonId,
-          providerNodeId: wrapperAddonId ? resolveWrapperNodeId(wrapperAddonId) : toRoutableProviderNodeId(nativeNodeId),
-          nativeAddonId
-        });
-        seenCaps.add(capName);
-      }
-      if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device \u2014 returning none", { tags: { deviceId: input.deviceId } });
-      else if (deps.capabilityRegistry) {
-        const skippedForType = [];
-        for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
-          if (seenCaps.has(capName)) continue;
-          if (!capAppliesToDeviceType(deps.capabilityRegistry.getDefinition(capName), deviceType)) {
-            skippedForType.push(capName);
-            continue;
-          }
-          const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
-          if (!defaultWrapperAddonId) continue;
-          const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
-          const remoteNative = resolveRemote(capName);
-          const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
-          entries.push({
-            capName,
-            kind: "wrapped",
-            providerAddonId: defaultWrapperAddonId,
-            providerNodeId: resolveWrapperNodeId(defaultWrapperAddonId),
-            nativeAddonId
-          });
-          seenCaps.add(capName);
-        }
-        if (skippedForType.length > 0) deps.ctx.logger.debug("getBindings: default wrappers skipped \u2014 deviceTypes mismatch", {
-          tags: { deviceId: input.deviceId },
-          meta: {
-            deviceType,
-            skipped: skippedForType
-          }
-        });
-      }
-      if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
-        if (seenCaps.has(capName)) continue;
-        const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
-        entries.push({
-          capName,
-          kind: "native",
-          providerAddonId: nativeAddonId,
-          providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
-          nativeAddonId
-        });
-        seenCaps.add(capName);
-      }
-      const pushFed = deps.remoteNativeCaps.get(input.deviceId);
-      if (pushFed) for (const [capName, info] of pushFed) {
-        if (seenCaps.has(capName)) continue;
-        entries.push({
-          capName,
-          kind: "native",
-          providerAddonId: info.addonId,
-          providerNodeId: toRoutableProviderNodeId(info.nodeId),
-          nativeAddonId: info.addonId
-        });
-        seenCaps.add(capName);
-      }
-      const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
-      if (clusterCaps) for (const entry of clusterCaps) {
-        if (entry.deviceId !== input.deviceId) continue;
-        if (seenCaps.has(entry.capName)) continue;
-        if (!entry.addonId) continue;
-        const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
-        if (entry.nodeId === localNodeId) continue;
-        entries.push({
-          capName: entry.capName,
-          kind: "native",
-          providerAddonId: entry.addonId,
-          providerNodeId: toRoutableProviderNodeId(entry.nodeId),
-          nativeAddonId: entry.addonId
-        });
-        seenCaps.add(entry.capName);
-      }
-      return {
-        deviceId: input.deviceId,
-        entries
-      };
-    }
-    async function getAllBindings(deps) {
-      const store = await deps.ctx.settings.readAddonStore();
-      const ids = /* @__PURE__ */ new Set();
-      for (const key of Object.keys(store.deviceMeta ?? {})) {
-        const id = Number(key);
-        if (Number.isInteger(id)) ids.add(id);
-      }
-      const registered = deps.ctx.kernel?.deviceRegistry?.getAll() ?? [];
-      for (const device of registered) ids.add(device.id);
-      if (ids.size === 0) {
-        deps.ctx.logger.warn("getAllBindings found no devices \u2014 warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
-        return [];
-      }
-      const out = [];
-      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await getBindings(deps, { deviceId }));
-      return out;
-    }
-    async function lookupPersistedStableId(deps, deviceId) {
-      return ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.stableId;
-    }
     async function getDeviceAggregate(deps, deviceId, kind) {
       const registry = deps.capabilityRegistry;
       if (!registry) {
@@ -62003,7 +62353,7 @@ var require_device_manager_addon = __commonJS({
         if (wireable) caps.push(wireable);
       }
       if (input.includeSynthesizable === true) {
-        const deviceType = ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.type;
+        const deviceType = (await deps.bindingsDeps.rows.get(deviceId))?.meta.type;
         if (deviceType !== void 0) for (const def of require_dist10.ALL_CAPABILITY_DEFINITIONS) {
           if (seen.has(def.name)) continue;
           if (def.scope !== "device" || def.kind === "wrapper") continue;
@@ -62091,20 +62441,10 @@ var require_device_manager_addon = __commonJS({
         return chain;
       }
     };
-    async function stampIntegrationId(metaStore, settings, ctx, deviceId, integrationId) {
+    async function stampIntegrationId(metaStore, ctx, deviceId, integrationId) {
       await metaStore.withMetaWriteLock(async () => {
-        const persisted = await metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] stampIntegrationId: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await metaStore.readMeta();
-        await settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            integrationId
-          }
-        } });
+        if (!await metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] stampIntegrationId: unknown device id=${deviceId}`);
+        await metaStore.rows.patch(deviceId, { integrationId });
       });
       ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62124,70 +62464,54 @@ var require_device_manager_addon = __commonJS({
     async function allocateDeviceId(pctx, input) {
       const { addonId, stableId } = input;
       return await pctx.metaStore.withMetaWriteLock(async () => {
-        const meta = await pctx.metaStore.readMeta();
-        const existing = Object.values(meta).find((m) => m.addonId === addonId && m.stableId === stableId);
-        if (existing) return { id: existing.id };
+        const existing = await pctx.metaStore.rows.findByStableId(addonId, stableId);
+        if (existing) return { id: existing.meta.id };
         const id = await pctx.metaStore.allocateNextDeviceId();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...meta,
-          [String(id)]: {
-            addonId,
-            stableId,
-            type: "generic",
-            name: stableId,
-            location: null,
-            disabled: false,
-            parentDeviceId: null,
-            id
-          }
-        } });
+        await pctx.metaStore.rows.upsert({
+          addonId,
+          stableId,
+          type: "generic",
+          name: stableId,
+          location: null,
+          disabled: false,
+          parentDeviceId: null,
+          id
+        }, {
+          registered: false,
+          metadata: null
+        });
         return { id };
       });
     }
     async function registerDevice(pctx, input) {
       const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
-      const key = String(id);
       const featuresArr = Array.isArray(features) ? [...features] : [];
       const { isFirstRegistration, exportFingerprint, fingerprintChanged } = await pctx.metaStore.withMetaWriteLock(async () => {
-        const index = await pctx.metaStore.readIndex();
-        const existing = index[addonId] ?? [];
-        const wasInIndex = existing.includes(stableId);
-        if (!wasInIndex) await pctx.settings.writeAddonStore({ deviceIndex: {
-          ...index,
-          [addonId]: [...existing, stableId]
-        } });
-        const meta = await pctx.metaStore.readMeta();
-        const existingMeta = meta[key];
+        const existingRow = await pctx.metaStore.rows.get(id);
+        const existingMeta = existingRow?.meta;
+        const wasRegistered = existingRow?.registered ?? false;
         const wasUserNamed = existingMeta?.userNamed ?? (existingMeta !== void 0 && existingMeta.name !== stableId);
         const resolvedName = wasUserNamed && existingMeta !== void 0 ? existingMeta.name : name;
-        const isFirst = !existingMeta || !wasInIndex;
+        const isFirst = !existingMeta || !wasRegistered;
         const fingerprint = (0, _camstack_types_node.canonicalDeviceFingerprint)({
           deviceId: id,
           deviceType: type,
           features: featuresArr
         });
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...meta,
-          [key]: {
-            addonId,
-            stableId,
-            type,
-            name: resolvedName,
-            userNamed: wasUserNamed,
-            location: existingMeta?.location ?? null,
-            disabled: existingMeta?.disabled ?? false,
-            ...existingMeta?.integrationId !== void 0 ? { integrationId: existingMeta.integrationId } : {},
-            ...existingMeta?.linkDeviceId !== void 0 ? { linkDeviceId: existingMeta.linkDeviceId } : {},
-            ...existingMeta?.primaryChildEntityId !== void 0 ? { primaryChildEntityId: existingMeta.primaryChildEntityId } : {},
-            ...existingMeta?.childLayout !== void 0 ? { childLayout: existingMeta.childLayout } : {},
-            ...existingMeta?.role !== void 0 ? { role: existingMeta.role } : {},
-            ...existingMeta?.display !== void 0 ? { display: existingMeta.display } : {},
-            parentDeviceId,
-            id,
-            features: featuresArr,
-            exportFingerprint: fingerprint
-          }
-        } });
+        await pctx.metaStore.rows.upsertRegistration({
+          deviceId: id,
+          addonId,
+          stableId,
+          type,
+          name: resolvedName,
+          userNamed: wasUserNamed,
+          location: existingMeta?.location ?? null,
+          disabled: existingMeta?.disabled ?? false,
+          parentDeviceId: parentDeviceId ?? null,
+          registered: true,
+          features: featuresArr,
+          exportFingerprint: fingerprint
+        });
         return {
           isFirstRegistration: isFirst,
           exportFingerprint: fingerprint,
@@ -62247,26 +62571,9 @@ var require_device_manager_addon = __commonJS({
       const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
       if (!persisted) return;
       const { addonId, stableId, meta: persistedMeta } = persisted;
-      const key = String(deviceId);
       const deviceName = persistedMeta.name;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const index = await pctx.metaStore.readIndex();
-        const remaining = (index[addonId] ?? []).filter((sid) => sid !== stableId);
-        const updatedIndex = remaining.length > 0 ? {
-          ...index,
-          [addonId]: remaining
-        } : (() => {
-          const { [addonId]: _removed, ...rest } = index;
-          return rest;
-        })();
-        await pctx.settings.writeAddonStore({ deviceIndex: updatedIndex });
-        const { [key]: _removedMeta, ...restMeta } = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: restMeta });
-        const map = await pctx.metaStore.readMetadataMap();
-        if (key in map) {
-          const { [key]: _removedMetadata, ...restMap } = map;
-          await pctx.settings.writeAddonStore({ deviceMetadata: restMap });
-        }
+        await pctx.metaStore.rows.remove(deviceId);
       });
       await pctx.settings.clearDeviceStore(deviceId);
       await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -62310,11 +62617,10 @@ var require_device_manager_addon = __commonJS({
     }
     async function loadMeta(pctx, input) {
       const { deviceId } = input;
-      const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-      if (!persisted) return null;
-      const { addonId, stableId, meta: m } = persisted;
-      const key = String(deviceId);
-      const metadata = (await pctx.metaStore.readMetadataMap())[key] ?? null;
+      const row = await pctx.metaStore.getRow(deviceId);
+      if (row === null) return null;
+      const { meta: m, metadata } = row;
+      const { addonId, stableId } = m;
       return {
         id: m.id,
         stableId,
@@ -62337,32 +62643,26 @@ var require_device_manager_addon = __commonJS({
         const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
         if (!persisted) throw new Error(`[device-manager] setName: unknown device id=${deviceId}`);
         const { meta: m } = persisted;
-        const key = String(deviceId);
         const oldName = m.name;
-        const allMeta = await pctx.metaStore.readMeta();
-        const nextMeta = {
-          ...allMeta,
-          [key]: {
-            ...m,
-            name,
-            userNamed: true
+        await pctx.metaStore.rows.patch(deviceId, {
+          name,
+          userNamed: true
+        });
+        if (oldName.length > 0 && oldName !== name) {
+          const candidates = /* @__PURE__ */ new Map();
+          for (const row of await pctx.metaStore.rows.listByParent(deviceId)) candidates.set(row.meta.id, row.meta);
+          for (const row of await pctx.metaStore.rows.listAll()) if (row.meta.linkDeviceId === deviceId) candidates.set(row.meta.id, row.meta);
+          candidates.delete(deviceId);
+          for (const childMeta of candidates.values()) {
+            if (childMeta.name !== oldName && !childMeta.name.startsWith(`${oldName} `)) continue;
+            const childName = childMeta.name === oldName ? name : `${name}${childMeta.name.slice(oldName.length)}`;
+            await pctx.metaStore.rows.patch(childMeta.id, { name: childName });
+            cascaded.push({
+              id: childMeta.id,
+              name: childName
+            });
           }
-        };
-        if (oldName.length > 0 && oldName !== name) for (const [childKey, childMeta] of Object.entries(allMeta)) {
-          if (childKey === key) continue;
-          if (!(childMeta.parentDeviceId === deviceId || childMeta.linkDeviceId === deviceId)) continue;
-          if (childMeta.name !== oldName && !childMeta.name.startsWith(`${oldName} `)) continue;
-          const childName = childMeta.name === oldName ? name : `${name}${childMeta.name.slice(oldName.length)}`;
-          nextMeta[childKey] = {
-            ...childMeta,
-            name: childName
-          };
-          cascaded.push({
-            id: Number(childKey),
-            name: childName
-          });
         }
-        await pctx.settings.writeAddonStore({ deviceMeta: nextMeta });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62396,18 +62696,8 @@ var require_device_manager_addon = __commonJS({
     async function setLocation(pctx, input) {
       const { deviceId, location } = input;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setLocation: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            location
-          }
-        } });
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setLocation: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, { location });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62427,18 +62717,8 @@ var require_device_manager_addon = __commonJS({
     async function setType(pctx, input) {
       const { deviceId, type } = input;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setType: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            type
-          }
-        } });
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setType: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, { type });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62461,18 +62741,8 @@ var require_device_manager_addon = __commonJS({
     async function setLinkDeviceId(pctx, input) {
       const { deviceId, linkDeviceId } = input;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setLinkDeviceId: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            linkDeviceId
-          }
-        } });
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setLinkDeviceId: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, { linkDeviceId });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62492,18 +62762,8 @@ var require_device_manager_addon = __commonJS({
     async function setPrimaryChildEntityId(pctx, input) {
       const { deviceId, primaryChildEntityId } = input;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setPrimaryChildEntityId: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            primaryChildEntityId
-          }
-        } });
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setPrimaryChildEntityId: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, { primaryChildEntityId });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62523,18 +62783,8 @@ var require_device_manager_addon = __commonJS({
     async function setChildLayout(pctx, input) {
       const { deviceId, childLayout } = input;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setChildLayout: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            childLayout
-          }
-        } });
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setChildLayout: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, { childLayout });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62554,18 +62804,8 @@ var require_device_manager_addon = __commonJS({
     async function setRole(pctx, input) {
       const { deviceId, role } = input;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setRole: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            role
-          }
-        } });
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setRole: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, { role });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62596,19 +62836,8 @@ var require_device_manager_addon = __commonJS({
       const { deviceId, display } = input;
       const normalized = display === null ? null : normalizeDisplayOverride(display);
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setDisplay: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        const nextRow = normalized === null ? (({ display: _drop, ...rest }) => rest)(m) : {
-          ...m,
-          display: normalized
-        };
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: nextRow
-        } });
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setDisplay: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, { display: normalized });
       });
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
@@ -62638,24 +62867,15 @@ var require_device_manager_addon = __commonJS({
     async function applyInitialMeta(pctx, input) {
       const { deviceId, name, location, type, integrationId, linkDeviceId, role } = input;
       await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] applyInitialMeta: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        const merged = {
-          ...m,
+        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] applyInitialMeta: unknown device id=${deviceId}`);
+        await pctx.metaStore.rows.patch(deviceId, {
           ...name !== void 0 ? { name } : {},
           ...location !== void 0 ? { location } : {},
           ...type !== void 0 ? { type } : {},
           ...integrationId !== void 0 ? { integrationId } : {},
           ...linkDeviceId !== void 0 ? { linkDeviceId } : {},
           ...role !== void 0 ? { role } : {}
-        };
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: merged
-        } });
+        });
       });
       const emitMetaChanged = (field, value) => {
         pctx.host.ctx.eventBus.emit({
@@ -62683,10 +62903,9 @@ var require_device_manager_addon = __commonJS({
     async function setMetadata(pctx, input) {
       const { deviceId, patch } = input;
       const result = await pctx.metaStore.withMetaWriteLock(async () => {
-        if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] setMetadata: unknown device id=${deviceId}`);
-        const key = String(deviceId);
-        const map = await pctx.metaStore.readMetadataMap();
-        const next = { ...map[key] ?? {} };
+        const row = await pctx.metaStore.rows.get(deviceId);
+        if (row === null) throw new Error(`[device-manager] setMetadata: unknown device id=${deviceId}`);
+        const next = { ...row.metadata ?? {} };
         let changed = false;
         for (const [k, v] of Object.entries(patch)) if (v === null) {
           if (k in next) {
@@ -62699,10 +62918,7 @@ var require_device_manager_addon = __commonJS({
         }
         if (!changed) return { changed: false };
         const hasFields = Object.keys(next).length > 0;
-        const updatedMap = { ...map };
-        if (hasFields) updatedMap[key] = next;
-        else delete updatedMap[key];
-        await pctx.settings.writeAddonStore({ deviceMetadata: updatedMap });
+        await pctx.metaStore.rows.patch(deviceId, { metadata: hasFields ? next : null });
         return {
           changed: true,
           finalMeta: hasFields ? next : null
@@ -62730,15 +62946,7 @@ var require_device_manager_addon = __commonJS({
         const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
         if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
         const { meta: m } = persisted;
-        const key = String(deviceId);
-        const allMeta = await pctx.metaStore.readMeta();
-        await pctx.settings.writeAddonStore({ deviceMeta: {
-          ...allMeta,
-          [key]: {
-            ...m,
-            disabled
-          }
-        } });
+        await pctx.metaStore.rows.patch(deviceId, { disabled });
         return {
           changed: (m.disabled ?? false) !== disabled,
           integrationId: m.integrationId ?? ""
@@ -62781,9 +62989,7 @@ var require_device_manager_addon = __commonJS({
       return data;
     }
     async function listLocations(pctx) {
-      const store = await pctx.settings.readAddonStore();
-      const meta = store.deviceMeta ?? {};
-      const locations = store.locations ?? [];
+      const locations = (await pctx.metaStore.readStore()).locations ?? [];
       const seen = /* @__PURE__ */ new Map();
       const consider = (raw) => {
         if (typeof raw !== "string") return;
@@ -62793,38 +62999,34 @@ var require_device_manager_addon = __commonJS({
         if (!seen.has(key)) seen.set(key, trimmed);
       };
       for (const label of locations) consider(label);
-      for (const m of Object.values(meta)) consider(m.location);
+      for (const row of await pctx.metaStore.rows.listAll()) consider(row.meta.location);
       return [...seen.values()].toSorted((a, b) => a.localeCompare(b, void 0, { sensitivity: "base" }));
     }
     async function addLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) throw new Error("[device-manager] addLocation: name must be non-empty");
-      const current = (await pctx.settings.readAddonStore()).locations ?? [];
+      const current = (await pctx.metaStore.readStore()).locations ?? [];
       if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
       await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
     }
     async function removeLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) return;
-      const store = await pctx.settings.readAddonStore();
-      const current = store.locations ?? [];
+      const current = (await pctx.metaStore.readStore()).locations ?? [];
       const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
       if (remaining.length !== current.length) await pctx.settings.writeAddonStore({ locations: remaining });
       if (input.cascade !== true) return;
-      const meta = store.deviceMeta ?? {};
-      const updates = { ...meta };
-      const cleared = [];
-      for (const [key, m] of Object.entries(meta)) {
-        if (typeof m.location !== "string") continue;
-        if (m.location.trim().toLowerCase() !== trimmed.toLowerCase()) continue;
-        updates[key] = {
-          ...m,
-          location: null
-        };
-        cleared.push(m.id);
-      }
-      if (cleared.length === 0) return;
-      await pctx.settings.writeAddonStore({ deviceMeta: updates });
+      const cleared = await pctx.metaStore.withMetaWriteLock(async () => {
+        const out = [];
+        for (const row of await pctx.metaStore.rows.listAll()) {
+          const location = row.meta.location;
+          if (typeof location !== "string") continue;
+          if (location.trim().toLowerCase() !== trimmed.toLowerCase()) continue;
+          await pctx.metaStore.rows.patch(row.meta.id, { location: null });
+          out.push(row.meta.id);
+        }
+        return out;
+      });
       for (const deviceId of cleared) pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
         timestamp: /* @__PURE__ */ new Date(),
@@ -62840,41 +63042,48 @@ var require_device_manager_addon = __commonJS({
         }
       });
     }
+    function decodeAddonStore(raw) {
+      const nextDeviceId = raw["nextDeviceId"];
+      const locations = raw["locations"];
+      const roleDisplayDefaults = raw["roleDisplayDefaults"];
+      return {
+        ...typeof nextDeviceId === "number" && Number.isFinite(nextDeviceId) ? { nextDeviceId } : {},
+        ...Array.isArray(locations) ? { locations: locations.filter((l) => typeof l === "string") } : {},
+        ...isRoleDisplayDefaults(roleDisplayDefaults) ? { roleDisplayDefaults } : {}
+      };
+    }
+    function isRoleDisplayDefaults(value) {
+      return value !== null && typeof value === "object" && !Array.isArray(value);
+    }
     var DeviceMetaStore = class {
       settings;
       registry;
+      rows;
       /** Synchronous ownership cache, keyed by NUMERIC deviceId → owning addonId.
-      *  The persisted meta store is authoritative but reads are async; hub-side
+      *  The persisted row store is authoritative but reads are async; hub-side
       *  callers (e.g. `CapabilityRegistry.getNativeProvider` fallback) need
       *  ownership without awaiting. Kept in sync with every register/remove and
       *  warmed from persistence on boot. */
       idToAddonId = /* @__PURE__ */ new Map();
-      /** Serialises every read-modify-write of the deviceMeta / deviceIndex blob
-      *  through one promise chain (see `withMetaWriteLock`). Per-instance state —
-      *  identical to the former `onInitialize` closure variable. */
+      /** Serialises every read-modify-write of a device row through one promise
+      *  chain (see `withMetaWriteLock`). Per-instance state. */
       metaWriteChain = Promise.resolve();
-      constructor(settings, registry) {
+      constructor(settings, registry, rows) {
         this.settings = settings;
         this.registry = registry;
+        this.rows = rows;
       }
       /** The read currently in flight, or null. Never a settled value — see
       *  {@link readStore}. */
       inFlightRead = null;
       /**
-      * The whole persisted addon store.
+      * The addon's own settings row set — `nextDeviceId`, `roleDisplayDefaults`,
+      * `locations`. NOT the fleet: no device has lived here since the flatten.
       *
       * **Concurrent callers join the read already in flight.** This is not a
       * cache and nothing survives settlement: a caller that awaited the running
       * promise could not have observed anything older than its result, so the
-      * only thing that changes is cost. What that cost was, measured on the
-      * 2026-08-19 boot: `readAddonStore` lands in `SqliteSettingsBackend
-      * .getAllAddon`, which reads and `JSON.parse`s this addon's rows —
-      * 625 KB on the live hub (`deviceMeta` 467 KB + `deviceMetadata` 87 KB +
-      * `deviceIndex` 70 KB) — synchronously, on the hub's event loop. A V8
-      * profile of that boot had hub-main's JS thread 99.9% busy with 64% of it
-      * inside `getAllAddon`, ~89% of that entered here, and every runner's first
-      * store read queued behind it (the notification centre's six parallel reads
-      * all resolved together at t+44.7 s).
+      * only thing that changes is cost.
       *
       * A rejection is NOT latched: the slot is cleared before the promise
       * settles either way, so a failed read costs the joiners that one failure
@@ -62885,7 +63094,7 @@ var require_device_manager_addon = __commonJS({
         if (existing !== null) return existing;
         const read = (async () => {
           try {
-            return await this.settings.readAddonStore();
+            return decodeAddonStore(await this.settings.readAddonStore());
           } finally {
             this.inFlightRead = null;
           }
@@ -62893,41 +63102,6 @@ var require_device_manager_addon = __commonJS({
         this.inFlightRead = read;
         return read;
       };
-      /**
-      * The three fleet projections from ONE read.
-      *
-      * `listAll` asked for `deviceMeta`, then `deviceMetadata`, then
-      * `deviceIndex` — three SEQUENTIAL awaits, which {@link readStore}'s
-      * in-flight join cannot collapse because each starts after the previous one
-      * settled. Three full 625 KB parses per call, on a call made once per device
-      * lifecycle event during a 974-device boot: 23% of hub-main's CPU.
-      *
-      * It is also ONE snapshot. Three separate reads could straddle a write and
-      * hand back an index that names a device the meta map no longer has.
-      */
-      readAll = async () => {
-        const store = await this.readStore();
-        return {
-          index: store.deviceIndex ?? {},
-          meta: store.deviceMeta ?? {},
-          metadata: store.deviceMetadata ?? {}
-        };
-      };
-      readIndex = async () => {
-        return (await this.readStore()).deviceIndex ?? {};
-      };
-      readMeta = async () => {
-        return (await this.readStore()).deviceMeta ?? {};
-      };
-      /** Hardware-identity metadata map. Lives in a sibling key on the
-      *  device-manager addon store so its writers (`setMetadata`) never
-      *  collide with the lifecycle writers on `deviceMeta`
-      *  (`registerDevice` / `setName` / `setLocation` / `setDisabled`).
-      *  Single-writer per row eliminates the "writer X clobbers writer
-      *  Y's field" bug class — `setMetadata` is the only producer. */
-      readMetadataMap = async () => {
-        return (await this.readStore()).deviceMetadata ?? {};
-      };
       withMetaWriteLock = async (fn) => {
         const previous = this.metaWriteChain;
         let release = () => {
@@ -62944,31 +63118,36 @@ var require_device_manager_addon = __commonJS({
           release();
         }
       };
+      /** The whole persisted row for one device, or `null`. */
+      getRow = async (deviceId) => this.rows.get(deviceId);
       /**
       * Resolve a numeric deviceId to the owning `(addonId, stableId)` pair.
-      * Scans persisted meta — live IDevice lookup (hub registry) is handled
+      * Reads the device's own row — live IDevice lookup (hub registry) is handled
       * separately per call site so callers can decide whether to route to
       * an in-process driver or to the cross-process `device-ops` bridge.
       * Returns null when no device with that id is known to the hub.
       */
       resolvePersistedById = async (deviceId) => {
-        const m = (await this.readMeta())[String(deviceId)];
-        if (!m) return null;
+        const row = await this.rows.get(deviceId);
+        if (row === null) return null;
         return {
-          addonId: m.addonId,
-          stableId: m.stableId,
-          meta: m
+          addonId: row.meta.addonId,
+          stableId: row.meta.stableId,
+          meta: row.meta
         };
       };
+      /** The device's hardware-identity metadata blob, or `null`. */
+      readMetadata = async (deviceId) => {
+        return (await this.rows.get(deviceId))?.metadata ?? null;
+      };
       /** Direct children of a device: the union of the live registry's children
-      *  and the persisted-meta scan (`parentDeviceId === parentId`), deduplicated
+      *  and the persisted rows whose `parentDeviceId` is `parentId`, deduplicated
       *  and excluding self. Shared by the `remove` cascade and the `resetToSource`
       *  resync purge (#19). */
       directChildIds = async (parentId) => {
         const ids = /* @__PURE__ */ new Set();
         if (this.registry) for (const c of this.registry.getChildren(parentId)) ids.add(c.id);
-        const meta = await this.readMeta();
-        for (const m of Object.values(meta)) if (m.parentDeviceId === parentId) ids.add(m.id);
+        for (const row of await this.rows.listByParent(parentId)) ids.add(row.meta.id);
         ids.delete(parentId);
         return [...ids];
       };
@@ -62978,6 +63157,476 @@ var require_device_manager_addon = __commonJS({
         return current;
       };
     };
+    var DEVICE_ROWS_COLLECTION = "device-manager:devices";
+    var DEVICE_ROWS_FLEET_LIMIT = 2e4;
+    var DEVICE_ROWS_COLUMNS = [
+      {
+        name: "id",
+        type: "TEXT",
+        primaryKey: true,
+        notNull: true
+      },
+      {
+        name: "deviceId",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "addonId",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "stableId",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "type",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "name",
+        type: "TEXT",
+        notNull: true
+      },
+      {
+        name: "userNamed",
+        type: "BOOLEAN"
+      },
+      {
+        name: "location",
+        type: "TEXT"
+      },
+      {
+        name: "disabled",
+        type: "BOOLEAN",
+        notNull: true,
+        defaultValue: false
+      },
+      {
+        name: "parentDeviceId",
+        type: "INTEGER"
+      },
+      {
+        name: "registered",
+        type: "BOOLEAN",
+        notNull: true,
+        defaultValue: false
+      },
+      {
+        name: "features",
+        type: "JSON"
+      },
+      {
+        name: "exportFingerprint",
+        type: "TEXT"
+      },
+      {
+        name: "integrationId",
+        type: "TEXT"
+      },
+      {
+        name: "linkDeviceId",
+        type: "INTEGER"
+      },
+      {
+        name: "primaryChildEntityId",
+        type: "TEXT"
+      },
+      {
+        name: "childLayout",
+        type: "JSON"
+      },
+      {
+        name: "role",
+        type: "TEXT"
+      },
+      {
+        name: "display",
+        type: "JSON"
+      },
+      {
+        name: "metadata",
+        type: "JSON"
+      }
+    ];
+    var DEVICE_ROWS_INDEXES = [
+      {
+        name: "idx_dm_devices_addon_stable",
+        columns: ["addonId", "stableId"]
+      },
+      {
+        name: "idx_dm_devices_parent",
+        columns: ["parentDeviceId"]
+      },
+      {
+        name: "idx_dm_devices_integration",
+        columns: ["integrationId"]
+      }
+    ];
+    function deviceRowBackendOf(client) {
+      return {
+        declareCollection: async (input) => {
+          await client.declareCollection.mutate(input);
+        },
+        get: (input) => client.get.query(input),
+        set: async (input) => {
+          await client.set.mutate(input);
+        },
+        query: (input) => client.query.query(input),
+        updateWhere: (input) => client.updateWhere.mutate(input),
+        delete: async (input) => {
+          await client.delete.mutate(input);
+        },
+        count: (input) => client.count.query(input)
+      };
+    }
+    function isPlainObject3(value) {
+      return value !== null && typeof value === "object" && !Array.isArray(value);
+    }
+    function readString(value) {
+      return typeof value === "string" ? value : void 0;
+    }
+    function readNumber(value) {
+      return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+    }
+    function readBoolean(value) {
+      if (typeof value === "boolean") return value;
+      if (value === 1) return true;
+      if (value === 0) return false;
+    }
+    function readStringArray(value) {
+      if (!Array.isArray(value)) return void 0;
+      const out = [];
+      for (const entry of value) if (typeof entry === "string") out.push(entry);
+      return out;
+    }
+    function decodeDeviceRow(data) {
+      const deviceId = readNumber(data["deviceId"]);
+      const addonId = readString(data["addonId"]);
+      const stableId = readString(data["stableId"]);
+      const type = readString(data["type"]);
+      const name = readString(data["name"]);
+      if (deviceId === void 0 || addonId === void 0 || stableId === void 0 || type === void 0 || name === void 0) return null;
+      const location = readString(data["location"]);
+      const parentDeviceId = readNumber(data["parentDeviceId"]);
+      const userNamed = readBoolean(data["userNamed"]);
+      const features = readStringArray(data["features"]);
+      const exportFingerprint = readString(data["exportFingerprint"]);
+      const integrationId = readString(data["integrationId"]);
+      const linkDeviceId = readNumber(data["linkDeviceId"]);
+      const primaryChildEntityId = readString(data["primaryChildEntityId"]);
+      const role = readString(data["role"]);
+      const rawChildLayout = data["childLayout"];
+      const rawDisplay = data["display"];
+      const rawMetadata = data["metadata"];
+      return {
+        meta: {
+          id: deviceId,
+          addonId,
+          stableId,
+          type,
+          name,
+          location: location ?? null,
+          disabled: readBoolean(data["disabled"]) ?? false,
+          parentDeviceId: parentDeviceId ?? null,
+          ...userNamed !== void 0 ? { userNamed } : {},
+          ...features !== void 0 ? { features } : {},
+          ...exportFingerprint !== void 0 ? { exportFingerprint } : {},
+          ...integrationId !== void 0 ? { integrationId } : {},
+          ...linkDeviceId !== void 0 ? { linkDeviceId } : {},
+          ...primaryChildEntityId !== void 0 ? { primaryChildEntityId } : {},
+          ...isChildLayout(rawChildLayout) ? { childLayout: rawChildLayout } : {},
+          ...role !== void 0 ? { role } : {},
+          ...isPlainObject3(rawDisplay) ? { display: toDisplayOverride(rawDisplay) } : {}
+        },
+        metadata: isPlainObject3(rawMetadata) ? rawMetadata : null,
+        registered: readBoolean(data["registered"]) ?? false
+      };
+    }
+    function isChildLayout(value) {
+      return Array.isArray(value);
+    }
+    function toDisplayOverride(value) {
+      return value;
+    }
+    function encodeDeviceRow(meta, extra = {}) {
+      const row = {
+        id: String(meta.id),
+        deviceId: meta.id,
+        addonId: meta.addonId,
+        stableId: meta.stableId,
+        type: meta.type,
+        name: meta.name,
+        userNamed: meta.userNamed ?? null,
+        location: meta.location,
+        disabled: meta.disabled,
+        parentDeviceId: meta.parentDeviceId,
+        registered: extra.registered ?? false,
+        features: meta.features === void 0 ? null : [...meta.features],
+        exportFingerprint: meta.exportFingerprint ?? null,
+        integrationId: meta.integrationId ?? null,
+        linkDeviceId: meta.linkDeviceId ?? null,
+        primaryChildEntityId: meta.primaryChildEntityId ?? null,
+        childLayout: meta.childLayout ?? null,
+        role: meta.role ?? null,
+        display: meta.display ?? null
+      };
+      if (extra.metadata !== void 0) row["metadata"] = extra.metadata;
+      return row;
+    }
+    function encodeDeviceRowPatch(patch) {
+      const row = {};
+      for (const [key, value] of Object.entries(patch)) {
+        if (value === void 0) continue;
+        row[key] = value;
+      }
+      return row;
+    }
+    var DeviceRowStore = class {
+      backend;
+      logger;
+      declared = null;
+      constructor(backend, logger) {
+        this.backend = backend;
+        this.logger = logger;
+      }
+      /**
+      * Lazy, idempotent `declareCollection`, memoised on the PROMISE so N
+      * concurrent first-callers issue one declaration rather than N. A rejection
+      * is not latched — the slot is cleared so the next caller retries instead of
+      * inheriting a dead collection forever.
+      */
+      async declare() {
+        const existing = this.declared;
+        if (existing !== null) return existing;
+        const run = (async () => {
+          try {
+            await this.backend.declareCollection({
+              collection: DEVICE_ROWS_COLLECTION,
+              columns: DEVICE_ROWS_COLUMNS,
+              indexes: DEVICE_ROWS_INDEXES
+            });
+          } catch (err) {
+            this.declared = null;
+            throw err;
+          }
+        })();
+        this.declared = run;
+        return run;
+      }
+      /** One device, by numeric id. `null` when the fleet does not know it. */
+      async get(deviceId) {
+        await this.declare();
+        const raw = await this.backend.get({
+          collection: DEVICE_ROWS_COLLECTION,
+          key: String(deviceId)
+        });
+        if (!isPlainObject3(raw)) return null;
+        const decoded = decodeDeviceRow(raw);
+        if (decoded === null) {
+          this.logger.warn("device row skipped \u2014 identity fields missing", { tags: { deviceId } });
+          return null;
+        }
+        return decoded;
+      }
+      /** Every device, ordered by numeric id. */
+      async listAll() {
+        return this.list({
+          orderBy: {
+            field: "deviceId",
+            direction: "asc"
+          },
+          limit: DEVICE_ROWS_FLEET_LIMIT
+        });
+      }
+      /**
+      * The device an addon knows as `stableId`, or `null`.
+      *
+      * `(addonId, stableId)` is the addon-facing identity — unique by
+      * construction, since `allocateDeviceId` is the only thing that mints a row
+      * and it returns the existing id for a pair it already knows. A second row
+      * for the pair would be a corruption, so this takes the LOWEST id and says
+      * so rather than picking arbitrarily.
+      */
+      async findByStableId(addonId, stableId) {
+        const rows = await this.list({
+          where: {
+            addonId,
+            stableId
+          },
+          orderBy: {
+            field: "deviceId",
+            direction: "asc"
+          },
+          limit: 2
+        });
+        const first = rows[0];
+        if (first === void 0) return null;
+        if (rows.length > 1) this.logger.warn("duplicate device rows for one (addonId, stableId) \u2014 using the lowest id", {
+          tags: { deviceId: first.meta.id },
+          meta: {
+            addonId,
+            stableId,
+            ids: rows.map((r) => r.meta.id)
+          }
+        });
+        return first;
+      }
+      /** Every device owned by one addon, ordered by numeric id. */
+      async listByAddon(addonId) {
+        return this.list({
+          where: { addonId },
+          orderBy: {
+            field: "deviceId",
+            direction: "asc"
+          },
+          limit: DEVICE_ROWS_FLEET_LIMIT
+        });
+      }
+      /** Every device an integration owns, ordered by numeric id. */
+      async listByIntegration(integrationId) {
+        return this.list({
+          where: { integrationId },
+          orderBy: {
+            field: "deviceId",
+            direction: "asc"
+          },
+          limit: DEVICE_ROWS_FLEET_LIMIT
+        });
+      }
+      /** Direct children of one device, ordered by numeric id. */
+      async listByParent(parentDeviceId) {
+        return this.list({
+          where: { parentDeviceId },
+          orderBy: {
+            field: "deviceId",
+            direction: "asc"
+          },
+          limit: DEVICE_ROWS_FLEET_LIMIT
+        });
+      }
+      /** How many devices the fleet holds. Used to tell "empty store" from "gone device". */
+      async count() {
+        await this.declare();
+        return this.backend.count({ collection: DEVICE_ROWS_COLLECTION });
+      }
+      async list(filter) {
+        await this.declare();
+        const records = await this.backend.query({
+          collection: DEVICE_ROWS_COLLECTION,
+          filter
+        });
+        const out = [];
+        for (const record of records) {
+          const decoded = decodeDeviceRow(record.data);
+          if (decoded === null) {
+            this.logger.warn("device row skipped \u2014 identity fields missing", { meta: { rowId: record.id } });
+            continue;
+          }
+          out.push(decoded);
+        }
+        return out;
+      }
+      /** Insert or replace the whole identity row. */
+      async upsert(meta, extra = {}) {
+        await this.declare();
+        await this.backend.set({
+          collection: DEVICE_ROWS_COLLECTION,
+          key: String(meta.id),
+          value: encodeDeviceRow(meta, extra)
+        });
+      }
+      /**
+      * Write the named columns of an EXISTING row and nothing else.
+      *
+      * An UPDATE, deliberately not an upsert: a partial upsert would try to INSERT
+      * a row carrying only the patched columns, and SQLite rejects that on the
+      * `NOT NULL` identity columns before the primary-key conflict can turn it
+      * into an update. Every caller resolves the row under the write lock and
+      * throws when it is gone, so matching zero rows means a device was removed
+      * between the resolve and the write — the patch is lost, and a lost write
+      * that says nothing reads as a write that happened.
+      */
+      async patch(deviceId, patch) {
+        const columns = encodeDeviceRowPatch(patch);
+        if (Object.keys(columns).length === 0) return;
+        await this.declare();
+        const { updated } = await this.backend.updateWhere({
+          collection: DEVICE_ROWS_COLLECTION,
+          filter: { where: { id: String(deviceId) } },
+          data: columns
+        });
+        if (updated === 0) this.logger.warn("device row patch matched no row \u2014 the device was removed under it", {
+          tags: { deviceId },
+          meta: { columns: Object.keys(columns) }
+        });
+      }
+      /**
+      * Insert-or-update the registration columns. See {@link DeviceRegistrationRow}
+      * for why this is a separate, fully-specified statement rather than a patch.
+      */
+      async upsertRegistration(row) {
+        await this.declare();
+        await this.backend.set({
+          collection: DEVICE_ROWS_COLLECTION,
+          key: String(row.deviceId),
+          value: {
+            deviceId: row.deviceId,
+            addonId: row.addonId,
+            stableId: row.stableId,
+            type: row.type,
+            name: row.name,
+            userNamed: row.userNamed,
+            location: row.location,
+            disabled: row.disabled,
+            parentDeviceId: row.parentDeviceId,
+            registered: row.registered,
+            features: [...row.features],
+            exportFingerprint: row.exportFingerprint
+          }
+        });
+      }
+      /** Drop the device's row. Idempotent. */
+      async remove(deviceId) {
+        await this.declare();
+        await this.backend.delete({
+          collection: DEVICE_ROWS_COLLECTION,
+          key: String(deviceId)
+        });
+      }
+      /**
+      * The retirement door for the three blobs this collection replaced.
+      *
+      * The purge is gated on THIS collection being non-empty, and the count has to
+      * be taken after `declare()` — which is why the owning addon runs it and the
+      * settings engine cannot: at the engine's own boot no addon has declared
+      * anything, so every successor would read as unreadable, forever.
+      */
+      retiredRowStore() {
+        return {
+          hasRow: async (spec) => {
+            const raw = await this.backend.get({
+              collection: spec.collection,
+              key: spec.row
+            });
+            return raw !== void 0 && raw !== null;
+          },
+          deleteRow: async (spec) => {
+            await this.backend.delete({
+              collection: spec.collection,
+              key: spec.row
+            });
+          },
+          countRows: async (collection) => {
+            await this.declare();
+            return this.backend.count({ collection });
+          }
+        };
+      }
+    };
     function persistableBlob(blob, policyFor) {
       const out = {};
       for (const [capName, slice] of Object.entries(blob)) {
@@ -63456,12 +64105,21 @@ var require_device_manager_addon = __commonJS({
           }
         }))).filter((id) => id !== null);
       }
+      /**
+      * Row access for `device-manager:devices`. Built once in `onInitialize`
+      * (which is also where the collection is declared) — every consumer reaches
+      * it through {@link bindingsDeps} or the `ProviderContext`.
+      */
+      deviceRows = null;
       /** Build the dependency context the extracted binding resolvers consume. */
       get bindingsDeps() {
+        const rows = this.deviceRows;
+        if (rows === null) throw new Error("[device-manager] device row store not initialized");
         return {
           ctx: this.ctx,
           capabilityRegistry: this.capabilityRegistry,
-          remoteNativeCaps: this.remoteNativeCaps
+          remoteNativeCaps: this.remoteNativeCaps,
+          rows
         };
       }
       async getBindings(input) {
@@ -63517,17 +64175,23 @@ var require_device_manager_addon = __commonJS({
           if (!ops) throw new Error(`[device-manager] device-ops native provider not found for '${deviceId}'`);
           return ops;
         };
-        const metaStore = new DeviceMetaStore(settings, registry);
+        const settingsStoreApi = this.ctx.api?.settingsStore;
+        if (!settingsStoreApi) throw new Error("[device-manager] settings-store API not available \u2014 refusing to serve a fleet it cannot persist");
+        const deviceRows = new DeviceRowStore(deviceRowBackendOf(settingsStoreApi), this.ctx.logger.child("rows"));
+        await deviceRows.declare();
+        this.deviceRows = deviceRows;
+        try {
+          await require_retired_settings_keys.purgeRetiredSettingsRows(deviceRows.retiredRowStore(), this.ctx.logger.child("RetiredRows"));
+        } catch (err) {
+          this.ctx.logger.warn("retired-row purge failed", { meta: { error: require_dist10.errMsg(err) } });
+        }
+        const metaStore = new DeviceMetaStore(settings, registry, deviceRows);
         this.stateMirrorImpl = new DeviceStateMirror(this.ctx);
         const stateMirror = this.stateMirrorImpl;
-        const readMeta = metaStore.readMeta;
         const resolvePersistedById = metaStore.resolvePersistedById;
         const idToAddonId = metaStore.idToAddonId;
-        {
-          const meta = await readMeta();
-          for (const m of Object.values(meta)) idToAddonId.set(m.id, m.addonId);
-        }
-        const stampIntegrationId$1 = (deviceId, integrationId) => stampIntegrationId(metaStore, settings, this.ctx, deviceId, integrationId);
+        for (const row of await deviceRows.listAll()) idToAddonId.set(row.meta.id, row.meta.addonId);
+        const stampIntegrationId$1 = (deviceId, integrationId) => stampIntegrationId(metaStore, this.ctx, deviceId, integrationId);
         const pctx = {
           host: this.providerHost,
           metaStore,
@@ -63770,7 +64434,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -63907,7 +64571,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -64097,7 +64761,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -71781,7 +72445,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -72346,7 +73010,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -73288,7 +73952,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -74404,7 +75068,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
+    var require_retired_settings_keys = require_retired_settings_keys_B52KsNz8();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -74413,123 +75078,47 @@ var require_sqlite_settings_addon = __commonJS({
     var SQLITE_PAGE_CACHE_KIB = -65536;
     var SQLITE_MMAP_SIZE_BYTES = 268435456;
     var SQLITE_JOURNAL_SIZE_LIMIT_BYTES = 67108864;
-    function settingsStoreIsAuthoritativeHere(env) {
-      const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
-      return raw === "" || raw === "hub";
-    }
-    var RETIRED_SETTINGS_KEYS = [{
-      namespace: "detection-pipeline",
-      collection: "addon-settings",
-      row: "root",
-      keys: ["pipelineSteps", "pipelineEngine"],
-      perNodeKeys: [
-        "engineRuntime",
-        "engineBackend",
-        "engineDevice",
-        "probedBestEngine"
-      ],
-      reason: "global step/engine seed and the per-node engine cascade \u2014 both removed; the live per-camera dispatch path never read either"
+    var RETIRED_COLLECTIONS = [{
+      collection: "devices",
+      owner: "integration-registry",
+      reason: "the device half of the integration-registry is deleted; the fleet is `device-manager:devices` and always was (0 rows here against 974 live devices)"
     }, {
-      namespace: "device-manager",
-      collection: "addon-settings",
-      row: "deviceMeta",
-      keys: [],
-      perNodeKeys: [],
-      mapValueKeys: ["deviceLinks"],
-      reason: "cross-device field wiring, deleted 2026-08-08 \u2014 0 links across 302 devices a month after the UI shipped. There is no reader left: the resolver, the overlay, the cycle guard, the fifth binding kind and the tab are gone"
+      collection: "device_settings_kv",
+      owner: "integration-registry",
+      reason: "per-device settings of a device table that never had a row; the live per-camera store is the device-manager row plus `addon-device-settings`"
     }];
-    function retiredKeyStoreOf(backend) {
-      return {
-        async read(spec) {
-          return require_dist10.asJsonObject(await backend.get({
-            namespace: spec.namespace,
-            collection: spec.collection,
-            key: spec.row
-          }));
-        },
-        async write(spec, value) {
-          await backend.set({
-            namespace: spec.namespace,
-            collection: spec.collection,
-            key: spec.row,
-            value
-          });
-        }
-      };
-    }
-    function planNestedRetiredKeyPurge(blob, spec) {
-      const nestedKeys = spec.mapValueKeys ?? [];
-      if (nestedKeys.length === 0) return [];
-      const found = [];
-      for (const [mapKey, value] of Object.entries(blob)) {
-        const inner = require_dist10.asJsonObject(value);
-        if (inner === null) continue;
-        for (const retired of nestedKeys) if (retired in inner) found.push(`${mapKey}.${retired}`);
-      }
-      return found;
-    }
-    function planRetiredKeyPurge(blob, spec) {
-      const exact = new Set(spec.keys);
-      const found = [];
-      for (const key of Object.keys(blob)) {
-        if (exact.has(key)) {
-          found.push(key);
-          continue;
-        }
-        for (const perNode of spec.perNodeKeys) if (key === perNode || key.startsWith(`${perNode}@`)) {
-          found.push(key);
-          break;
-        }
-      }
-      return found;
+    function retiredCollectionStoreOf(backend) {
+      return { async drop(collection) {
+        return backend.dropRetiredTable(collection);
+      } };
     }
-    async function purgeRetiredSettingsKeys(store, logger, specs = RETIRED_SETTINGS_KEYS, env = process.env) {
-      if (!settingsStoreIsAuthoritativeHere(env)) return [];
+    async function purgeRetiredCollections(store, logger, specs = RETIRED_COLLECTIONS) {
       const results = [];
       for (const spec of specs) {
-        let blob;
+        let dropped;
         try {
-          blob = await store.read(spec);
+          dropped = await store.drop(spec.collection);
         } catch (err) {
-          logger.warn("retired settings keys \u2014 read failed, row left untouched", { meta: {
-            addon: spec.namespace,
+          logger.warn("retired collection \u2014 drop failed, table left in place", { meta: {
+            addon: spec.owner,
             collection: spec.collection,
-            row: spec.row,
             error: err instanceof Error ? err.message : String(err)
           } });
           continue;
         }
-        if (blob === null) continue;
-        const doomed = planRetiredKeyPurge(blob, spec);
-        const doomedNested = planNestedRetiredKeyPurge(blob, spec);
-        if (doomed.length === 0 && doomedNested.length === 0) continue;
-        const doomedSet = new Set(doomed);
-        const nestedByMapKey = /* @__PURE__ */ new Map();
-        for (const path of doomedNested) {
-          const cut = path.indexOf(".");
-          const mapKey = path.slice(0, cut);
-          const inner = path.slice(cut + 1);
-          const bucket = nestedByMapKey.get(mapKey) ?? /* @__PURE__ */ new Set();
-          bucket.add(inner);
-          nestedByMapKey.set(mapKey, bucket);
-        }
-        const next = Object.fromEntries(Object.entries(blob).filter(([key]) => !doomedSet.has(key)).map(([key, value]) => {
-          const retired = nestedByMapKey.get(key);
-          if (retired === void 0) return [key, value];
-          const inner = require_dist10.asJsonObject(value);
-          if (inner === null) return [key, value];
-          return [key, Object.fromEntries(Object.entries(inner).filter(([k]) => !retired.has(k)))];
-        }));
-        await store.write(spec, next);
+        if (dropped === null) continue;
         const result = {
-          addon: spec.namespace,
           collection: spec.collection,
-          row: spec.row,
-          keys: doomed,
-          nested: doomedNested
+          owner: spec.owner,
+          rows: dropped.rows
         };
         results.push(result);
-        logger.info(`purged ${doomed.length + doomedNested.length} retired settings keys`, { meta: {
+        const line = "dropped a retired collection";
+        if (dropped.rows > 0) logger.warn(`${line} \u2014 it still held rows`, { meta: {
+          ...result,
+          reason: spec.reason
+        } });
+        else logger.info(line, { meta: {
           ...result,
           reason: spec.reason
         } });
@@ -74623,6 +75212,9 @@ var require_sqlite_settings_addon = __commonJS({
     function isImposedBound(source) {
       return source !== "caller";
     }
+    function isCountRow(raw) {
+      return raw !== null && typeof raw === "object" && typeof Reflect.get(raw, "n") === "number";
+    }
     function parseRowData(raw) {
       return require_dist10.asJsonObject(require_dist10.parseJsonUnknown(raw)) ?? {};
     }
@@ -75307,6 +75899,31 @@ var require_sqlite_settings_addon = __commonJS({
         }
         this.structuredTables.set(table, fingerprint);
       }
+      /**
+      * Drop a table nothing declares any more, reporting what went with it.
+      *
+      * The DDL lives here because the engine owns the handle AND the two memos
+      * that outlive a table: `structuredTables` (schema fingerprint) and
+      * `declaredCollections` (the column set `compileFilter` resolves against).
+      * Dropping behind their backs would leave a ghost — a later declaration of
+      * the same name would be memoised as "already materialised" against a table
+      * that no longer exists.
+      *
+      * WHICH tables are retired, and the logging, are policy: they live in
+      * `retired-collections.ts`. This method knows only how to drop one.
+      *
+      * Answers `null` when the table is not there — the steady state after the
+      * first boot that ran the purge, and the case on a fresh install.
+      */
+      dropRetiredTable(table) {
+        if (this.getDb().prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?`).get(table) === void 0) return null;
+        const counted = this.getDb().prepare(`SELECT COUNT(*) AS n FROM "${table}"`).get();
+        const rows = isCountRow(counted) ? counted.n : 0;
+        this.getDb().exec(`DROP TABLE "${table}"`);
+        this.structuredTables.delete(table);
+        this.declaredCollections.delete(table);
+        return { rows };
+      }
       async tableInsert(table, row) {
         const keys = Object.keys(row);
         const cols = keys.map((k) => `"${k}"`).join(", ");
@@ -75817,10 +76434,11 @@ var require_sqlite_settings_addon = __commonJS({
         this.backend = new SqliteSettingsBackend(dbPath, { ...require_dist10.RUNTIME_DEFAULTS }, this.ctx.logger.child("Query"));
         await this.backend.initialize();
         try {
-          await purgeRetiredSettingsKeys(retiredKeyStoreOf(this.backend), this.ctx.logger.child("RetiredKeys"));
+          await require_retired_settings_keys.purgeRetiredSettingsKeys(require_retired_settings_keys.retiredKeyStoreOf(this.backend), this.ctx.logger.child("RetiredKeys"));
         } catch (err) {
           this.ctx.logger.warn("Retired-key purge failed", { meta: { error: require_dist10.errMsg(err) } });
         }
+        await purgeRetiredCollections(retiredCollectionStoreOf(this.backend), this.ctx.logger.child("RetiredCollections"));
         const vectorIndex = this.createVectorIndex(this.backend);
         await vectorIndex.loadIndexRegistry();
         this.vectorIndex = vectorIndex;
@@ -75995,7 +76613,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -77874,7 +78492,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -95935,7 +96553,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -107405,9 +108023,9 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-GejnH--L.js
-var require_manifest_python_deps_GejnH_L = __commonJS({
-  "../system/dist/manifest-python-deps-GejnH--L.js"(exports) {
+// ../system/dist/manifest-python-deps-MA_BZGBz.js
+var require_manifest_python_deps_MA_BZGBz = __commonJS({
+  "../system/dist/manifest-python-deps-MA_BZGBz.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -111384,6 +112002,8 @@ var require_manifest_python_deps_GejnH_L = __commonJS({
       };
       goneHandler = () => {
       };
+      /** Source of {@link RegisteredChild.incarnation}; one bump per accepted connection. */
+      nextIncarnation = 1;
       eventHandler = null;
       logHandler = null;
       readinessHandler = null;
@@ -111658,14 +112278,20 @@ var require_manifest_python_deps_GejnH_L = __commonJS({
       listChildren() {
         return [...this.children.values()].map((e) => ({
           childId: e.childId,
-          caps: e.caps
+          caps: e.caps,
+          incarnation: e.incarnation
         }));
       }
       /** Register the (single) child-registered handler. Only one handler is active at a time. */
       onChildRegistered(handler) {
         this.registeredHandler = handler;
       }
-      /** Register the (single) child-gone handler. Only one handler is active at a time. */
+      /**
+      * Register the (single) child-gone handler. Only one handler is active at a
+      * time. The handler receives the {@link RegisteredChild.incarnation} of the
+      * connection that closed — carry it into whatever teardown it triggers, so a
+      * dead generation cannot tear down its successor's work.
+      */
       onChildGone(handler) {
         this.goneHandler = handler;
       }
@@ -111750,6 +112376,7 @@ var require_manifest_python_deps_GejnH_L = __commonJS({
       }
       onConnection(channel) {
         let childId = null;
+        const incarnation = this.nextIncarnation++;
         channel.onEvent((body) => {
           const msg = body;
           if (msg.kind === "event") {
@@ -111778,16 +112405,24 @@ var require_manifest_python_deps_GejnH_L = __commonJS({
             if (childId !== null && childId !== msg.childId) throw new Error(`child attempted to change identity from "${childId}" to "${msg.childId}"`);
             childId = msg.childId;
             const eventPatterns = msg.eventPatterns ?? null;
+            const superseded = this.children.get(msg.childId);
+            if (superseded !== void 0 && superseded.channel !== channel) this.logger?.info("local child superseded by a new connection", {
+              childId: msg.childId,
+              supersededIncarnation: superseded.incarnation,
+              incarnation
+            });
             this.children.set(msg.childId, {
               childId: msg.childId,
               channel,
               caps: msg.caps,
-              eventPatterns
+              eventPatterns,
+              incarnation
             });
             this.logPatternSet(msg.childId, eventPatterns);
             this.registeredHandler({
               childId: msg.childId,
-              caps: msg.caps
+              caps: msg.caps,
+              incarnation
             });
             return { ok: true };
           }
@@ -111822,11 +112457,21 @@ var require_manifest_python_deps_GejnH_L = __commonJS({
           throw new Error(`unknown child request kind: ${msg.kind}`);
         });
         channel.onClose(() => {
-          if (childId !== null && this.children.delete(childId)) {
-            this.childEventStats.delete(childId);
-            this.loggedPatternSet.delete(childId);
-            this.goneHandler(childId);
+          if (childId === null) return;
+          const entry = this.children.get(childId);
+          if (entry === void 0) return;
+          if (entry.channel !== channel) {
+            this.logger?.info("ignoring close of a superseded local child connection", {
+              childId,
+              incarnation,
+              liveIncarnation: entry.incarnation
+            });
+            return;
           }
+          this.children.delete(childId);
+          this.childEventStats.delete(childId);
+          this.loggedPatternSet.delete(childId);
+          this.goneHandler(childId, incarnation);
         });
       }
     };
@@ -118184,7 +118829,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ctfhlrtl();
+    var require_dist10 = require_dist_C1Aea3c6();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -118209,7 +118854,7 @@ var require_dist3 = __commonJS({
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DUHPHa_Y();
-    var require_manifest_python_deps = require_manifest_python_deps_GejnH_L();
+    var require_manifest_python_deps = require_manifest_python_deps_MA_BZGBz();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -120105,13 +120750,9 @@ var require_dist3 = __commonJS({
       return {};
     }
     var integrationCounter = 0;
-    var deviceCounter = 0;
     function nextIntegrationId() {
       return `int_${String(++integrationCounter).padStart(4, "0")}`;
     }
-    function nextDeviceId() {
-      return `dev_${String(++deviceCounter).padStart(4, "0")}`;
-    }
     var INTEGRATIONS_COLUMNS = [
       {
         name: "id",
@@ -120178,99 +120819,8 @@ var require_dist3 = __commonJS({
         defaultValue: "string"
       }
     ];
-    var DEVICES_COLUMNS = [
-      {
-        name: "id",
-        type: "TEXT",
-        primaryKey: true
-      },
-      {
-        name: "integration_id",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "stable_id",
-        type: "TEXT",
-        notNull: true,
-        unique: true
-      },
-      {
-        name: "type",
-        type: "TEXT",
-        notNull: true,
-        defaultValue: "camera"
-      },
-      {
-        name: "name",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "enabled",
-        type: "INTEGER",
-        notNull: true,
-        defaultValue: 1
-      },
-      {
-        name: "info",
-        type: "JSON",
-        notNull: true,
-        defaultValue: "{}"
-      },
-      {
-        name: "created_at",
-        type: "INTEGER",
-        notNull: true
-      },
-      {
-        name: "updated_at",
-        type: "INTEGER",
-        notNull: true
-      }
-    ];
-    var DEVICES_INDEXES = [
-      {
-        name: "idx_devices_integration",
-        columns: ["integration_id"]
-      },
-      {
-        name: "idx_devices_stable",
-        columns: ["stable_id"],
-        unique: true
-      },
-      {
-        name: "idx_devices_type",
-        columns: ["type"]
-      }
-    ];
-    var DEVICE_SETTINGS_COLUMNS = [
-      {
-        name: "device_id",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "key",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "value",
-        type: "TEXT",
-        notNull: true
-      },
-      {
-        name: "value_type",
-        type: "TEXT",
-        notNull: true,
-        defaultValue: "string"
-      }
-    ];
     var INTEGRATIONS = "integrations";
     var INTEGRATION_SETTINGS = "integration_settings";
-    var DEVICES = "devices";
-    var DEVICE_SETTINGS = "device_settings_kv";
     var IntegrationRegistry = class IntegrationRegistry2 {
       store;
       constructor(backend) {
@@ -120286,15 +120836,6 @@ var require_dist3 = __commonJS({
           collection: INTEGRATION_SETTINGS,
           columns: INTEGRATION_SETTINGS_COLUMNS
         });
-        await this.store.declareCollection({
-          collection: DEVICES,
-          columns: DEVICES_COLUMNS,
-          indexes: DEVICES_INDEXES
-        });
-        await this.store.declareCollection({
-          collection: DEVICE_SETTINGS,
-          columns: DEVICE_SETTINGS_COLUMNS
-        });
         const ints = await this.store.query({
           collection: INTEGRATIONS,
           filter: {
@@ -120309,20 +120850,6 @@ var require_dist3 = __commonJS({
           const num = parseInt(ints[0].id.replace("int_", ""), 10);
           if (!isNaN(num)) integrationCounter = num;
         }
-        const devs = await this.store.query({
-          collection: DEVICES,
-          filter: {
-            orderBy: {
-              field: "id",
-              direction: "desc"
-            },
-            limit: 1
-          }
-        });
-        if (devs[0]) {
-          const num = parseInt(devs[0].id.replace("dev_", ""), 10);
-          if (!isNaN(num)) deviceCounter = num;
-        }
       }
       async createIntegration(input) {
         const id = nextIntegrationId();
@@ -120406,15 +120933,6 @@ var require_dist3 = __commonJS({
       async deleteIntegration(id) {
         const integration = await this.getIntegration(id);
         if (integration !== null && IntegrationRegistry2.isFixed(integration)) throw new Error(`integration "${id}" is fixed \u2014 it belongs to the addon that declared it and cannot be deleted`);
-        const devices = await this.listDevices(id);
-        for (const d of devices) await this.store.deleteWhere({
-          collection: DEVICE_SETTINGS,
-          filter: { where: { device_id: d.id } }
-        });
-        await this.store.deleteWhere({
-          collection: DEVICES,
-          filter: { where: { integration_id: id } }
-        });
         await this.store.deleteWhere({
           collection: INTEGRATION_SETTINGS,
           filter: { where: { integration_id: id } }
@@ -120459,139 +120977,6 @@ var require_dist3 = __commonJS({
       async setIntegrationSettings(integrationId, settings) {
         for (const [key, value] of Object.entries(settings)) await this.setIntegrationSetting(integrationId, key, value);
       }
-      async createDevice(input) {
-        const id = nextDeviceId();
-        const now = Math.floor(Date.now() / 1e3);
-        await this.store.insert({
-          collection: DEVICES,
-          record: {
-            id,
-            data: {
-              integration_id: input.integrationId,
-              stable_id: input.stableId,
-              type: input.type,
-              name: input.name,
-              enabled: input.enabled !== false ? 1 : 0,
-              info: input.info ?? {},
-              created_at: now,
-              updated_at: now
-            }
-          }
-        });
-        if (input.settings) await this.setDeviceSettings(id, input.settings);
-        return {
-          id,
-          integrationId: input.integrationId,
-          stableId: input.stableId,
-          type: input.type,
-          name: input.name,
-          enabled: input.enabled !== false,
-          info: input.info ?? {},
-          createdAt: now,
-          updatedAt: now
-        };
-      }
-      async getDevice(id) {
-        const rows = await this.store.query({
-          collection: DEVICES,
-          filter: {
-            where: { id },
-            limit: 1
-          }
-        });
-        return rows[0] ? this.mapDevice(rows[0].data) : null;
-      }
-      async getDeviceByStableId(stableId) {
-        const rows = await this.store.query({
-          collection: DEVICES,
-          filter: {
-            where: { stable_id: stableId },
-            limit: 1
-          }
-        });
-        return rows[0] ? this.mapDevice(rows[0].data) : null;
-      }
-      async listDevices(integrationId) {
-        return (await this.store.query({
-          collection: DEVICES,
-          filter: {
-            ...integrationId ? { where: { integration_id: integrationId } } : {},
-            orderBy: {
-              field: "created_at",
-              direction: "asc"
-            }
-          }
-        })).map((r) => this.mapDevice(r.data));
-      }
-      async listCameras() {
-        return (await this.store.query({
-          collection: DEVICES,
-          filter: {
-            where: { type: "camera" },
-            orderBy: {
-              field: "created_at",
-              direction: "asc"
-            }
-          }
-        })).map((r) => this.mapDevice(r.data));
-      }
-      async updateDevice(id, updates) {
-        const updateRow = { updated_at: Math.floor(Date.now() / 1e3) };
-        if (updates.name !== void 0) updateRow["name"] = updates.name;
-        if (updates.enabled !== void 0) updateRow["enabled"] = updates.enabled ? 1 : 0;
-        if (updates.info !== void 0) updateRow["info"] = updates.info;
-        await this.store.updateWhere({
-          collection: DEVICES,
-          filter: { where: { id } },
-          data: updateRow
-        });
-        return this.getDevice(id);
-      }
-      async deleteDevice(id) {
-        await this.store.deleteWhere({
-          collection: DEVICE_SETTINGS,
-          filter: { where: { device_id: id } }
-        });
-        await this.store.deleteWhere({
-          collection: DEVICES,
-          filter: { where: { id } }
-        });
-        return true;
-      }
-      async getDeviceSettings(deviceId) {
-        const result = {};
-        const rows = await this.store.query({
-          collection: DEVICE_SETTINGS,
-          filter: { where: { device_id: deviceId } }
-        });
-        for (const row of rows) result[String(row.data["key"])] = deserializeSetting(row.data["value"], String(row.data["value_type"]));
-        return result;
-      }
-      async setDeviceSetting(deviceId, key, value) {
-        const s = serializeSetting(value);
-        await this.store.deleteWhere({
-          collection: DEVICE_SETTINGS,
-          filter: { where: {
-            device_id: deviceId,
-            key
-          } }
-        });
-        await this.store.insert({
-          collection: DEVICE_SETTINGS,
-          record: {
-            id: `${deviceId}:${key}`,
-            data: {
-              device_id: deviceId,
-              key,
-              value: s.value,
-              value_type: s.valueType
-            }
-          }
-        });
-      }
-      async setDeviceSettings(deviceId, settings) {
-        for (const [key, value] of Object.entries(settings)) await this.setDeviceSetting(deviceId, key, value);
-      }
       mapIntegration(row) {
         return {
           id: String(row["id"]),
@@ -120603,19 +120988,6 @@ var require_dist3 = __commonJS({
           updatedAt: Number(row["updated_at"])
         };
       }
-      mapDevice(row) {
-        return {
-          id: String(row["id"]),
-          integrationId: String(row["integration_id"]),
-          stableId: String(row["stable_id"]),
-          type: String(row["type"]),
-          name: String(row["name"]),
-          enabled: row["enabled"] === 1,
-          info: readInfo(row["info"]),
-          createdAt: Number(row["created_at"]),
-          updatedAt: Number(row["updated_at"])
-        };
-      }
     };
     var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
     var NATIVE_SCAN_DEPTH = 4;
@@ -123109,6 +123481,7 @@ var require_dist3 = __commonJS({
         const state = {
           definition,
           providers: /* @__PURE__ */ new Map(),
+          providerOwners: /* @__PURE__ */ new Map(),
           activeAddonId: null,
           router: null,
           disabledProviders: /* @__PURE__ */ new Set()
@@ -123166,8 +123539,15 @@ var require_dist3 = __commonJS({
       * Double-register of the same pair is always a programmer error —
       * two legitimately different addons implementing the same cap keep
       * using different `addonId`s and the user picks one via `configReader`.
-      */
-      registerProvider(capabilityName, addonId, provider) {
+      *
+      * `owner` (optional) stamps the registration with the incarnation that made
+      * it — see {@link ProviderOwnerToken}. Once stamped, only an unregister
+      * presenting the SAME token can delete it. Registration paths whose key is
+      * reused across process generations (the UDS child manifest, the D3
+      * `registerNode` handshake) MUST pass one; ownerless registrations keep the
+      * historical unconditional behaviour.
+      */
+      registerProvider(capabilityName, addonId, provider, owner) {
         let state = this.capabilities.get(capabilityName);
         if (!state) {
           const colonIdx = capabilityName.indexOf(":");
@@ -123199,6 +123579,7 @@ var require_dist3 = __commonJS({
           if (missing.length > 0) throw new Error(`CapabilityRegistry: provider "${addonId}" for capability "${capabilityName}" declares exposesDeviceSettings: true but is missing DeviceSettingsContribution method(s): ${missing.join(", ")}. Implement them on the provider (or drop the flag from the cap def).`);
         }
         state.providers.set(addonId, provider);
+        if (owner !== void 0) state.providerOwners.set(addonId, owner);
         if (state.definition.mode === "singleton") {
           const userChoice = this.configReader?.(capabilityName);
           const preferred = state.definition.preferredProvider;
@@ -123229,7 +123610,8 @@ var require_dist3 = __commonJS({
           tags: { addonId },
           meta: {
             capability: capabilityName,
-            mode: state.definition.mode
+            mode: state.definition.mode,
+            ...owner === void 0 ? {} : { owner }
           }
         });
         this.emitEvent("capability:provider-registered", {
@@ -123276,11 +123658,70 @@ var require_dist3 = __commonJS({
         const declarers = this.manifestDeclarers.get(capabilityName);
         return declarers ? [...declarers] : [];
       }
-      /** Unregister a provider. For singleton: clears active. For collection: removes from list. */
-      unregisterProvider(capabilityName, addonId) {
+      /**
+      * The owner token a registration declared, or `null` when the pair is not
+      * registered or was registered without one.
+      */
+      getProviderOwner(capabilityName, addonId) {
+        return this.capabilities.get(capabilityName)?.providerOwners.get(addonId) ?? null;
+      }
+      /**
+      * Hand an EXISTING registration to a new owner, without touching the provider
+      * instance, the active-singleton selection or any event.
+      *
+      * The takeover case: a replacement runner handshakes with an UNCHANGED cap
+      * set, so the manifest diff correctly leaves the registration alone — but the
+      * registration is still stamped with the dead generation's token, and nothing
+      * the LIVE generation can present would ever match it. Re-stamping keeps the
+      * capability cleanable when the successor eventually dies.
+      *
+      * Returns `false` when the pair is not registered (nothing to hand over) —
+      * the caller decides whether that is a register-instead or a diagnosis.
+      */
+      reassignProviderOwner(capabilityName, addonId, owner) {
+        const state = this.capabilities.get(capabilityName);
+        if (!state || !state.providers.has(addonId)) return false;
+        const previous = state.providerOwners.get(addonId);
+        if (previous === owner) return true;
+        state.providerOwners.set(addonId, owner);
+        this.logger.info("Capability registration ownership reassigned", {
+          tags: { addonId },
+          meta: {
+            capability: capabilityName,
+            owner,
+            previousOwner: previous ?? null
+          }
+        });
+        return true;
+      }
+      /**
+      * Unregister a provider. For singleton: clears active. For collection:
+      * removes from list.
+      *
+      * `owner` is the caller's PROOF that it owns the registration it is deleting.
+      * When the registration declared an owner (see {@link ProviderOwnerToken})
+      * and the caller presents a different one — or none at all — this is a
+      * logged no-op: the caller belongs to a generation that no longer holds the
+      * key. This is what stops a dead runner's teardown from erasing its
+      * successor's live registration ([D188](../../../../docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md)).
+      */
+      unregisterProvider(capabilityName, addonId, owner) {
         const state = this.capabilities.get(capabilityName);
         if (!state) return;
+        const registeredOwner = state.providerOwners.get(addonId);
+        if (registeredOwner !== void 0 && registeredOwner !== owner) {
+          this.logger.info("Unregister ignored \u2014 registration is owned by another incarnation", {
+            tags: { addonId },
+            meta: {
+              capability: capabilityName,
+              registeredOwner,
+              presentedOwner: owner ?? null
+            }
+          });
+          return;
+        }
         state.providers.delete(addonId);
+        state.providerOwners.delete(addonId);
         if (state.definition.mode === "singleton" && state.activeAddonId === addonId) {
           const userChoice = this.configReader?.(capabilityName);
           const preferred = state.definition.preferredProvider;
@@ -198254,6 +198695,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     function safeSegment(name2) {
       return name2.replace(/[^a-zA-Z0-9._-]/g, "_");
     }
+    var EXACT_SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
     var StagingArea = class {
       stagingDir;
       deps;
@@ -198271,8 +198713,12 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         if (input.signal.aborted) throw new Error("staging aborted after fetch");
         await this.deps.extract(tgz, destDir);
         const raw = JSON.parse(node_fs.readFileSync(node_path.join(destDir, "package.json"), "utf-8"));
-        if (raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${String(raw.version)}`);
-        return { stagedPath: destDir };
+        if (typeof raw.version !== "string" || raw.version.length === 0) throw new Error(`staging validation failed: ${input.name} staged a package.json with no version`);
+        if (EXACT_SEMVER.test(input.version) && raw.version !== input.version) throw new Error(`staging validation failed: ${input.name} expected version ${input.version}, got ${raw.version}`);
+        return {
+          stagedPath: destDir,
+          resolvedVersion: raw.version
+        };
       }
       cleanup(jobId) {
         node_fs.rmSync(node_path.join(this.stagingDir, jobId), {
@@ -238430,7 +238876,7 @@ var require_dist9 = __commonJS({
       postBufferSec: zod.z.number().min(0).optional()
     });
     var DEFAULT_EVENTS_BAND_BUFFER_SEC = {
-      preBufferSec: 10,
+      preBufferSec: 15,
       postBufferSec: 30
     };
     var VISIT_MERGE_GAP_MS = DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec * 1e3;
@@ -239044,12 +239490,17 @@ var require_dist9 = __commonJS({
       "tflite",
       "pt"
     ];
+    var FAMILY_LABEL = {
+      yolo26: "YOLO26",
+      yolov9: "YOLOv9"
+    };
     function familyLabel(family) {
-      return family.toUpperCase();
+      return FAMILY_LABEL[family] ?? family.toUpperCase();
     }
+    var RESOLUTION_IN_NAME = /\s*@\s*\d+\s*(?:[x×]\s*\d+)?/gi;
     function tierLabel(family, baseName) {
       const fl = familyLabel(family);
-      const stripped = baseName.replace(new RegExp(`^${fl}\\s+`, "i"), "").trim();
+      const stripped = baseName.replace(new RegExp(`^${fl}\\s+`, "i"), "").replace(RESOLUTION_IN_NAME, "").trim();
       return stripped.length > 0 ? stripped : baseName;
     }
     function variantLabel(precision, optimization) {
@@ -239066,9 +239517,11 @@ var require_dist9 = __commonJS({
       return sizes.length > 0 ? Math.min(...sizes) : 0;
     }
     var TIER_ORDER = [
+      "t",
       "n",
       "s",
       "m",
+      "c",
       "l",
       "x"
     ];
@@ -239105,7 +239558,7 @@ var require_dist9 = __commonJS({
             if (a.optimization !== b.optimization) return a.optimization === "fast" ? 1 : -1;
             return PRECISION_ORDER.indexOf(a.precision) - PRECISION_ORDER.indexOf(b.precision);
           });
-          const base = options.find((o) => o.precision === "fp32" && o.optimization === "standard" && o.resolution === void 0) ?? options[0];
+          const base = options.find((o) => o.precision === "fp32" && o.optimization === "standard") ?? options[0];
           if (base === void 0) continue;
           const baseEntry = entries2.find((e) => e.id === base.modelId);
           tierList.push({
@@ -239135,15 +239588,9 @@ var require_dist9 = __commonJS({
     function resolveVariantModelId(models, selection) {
       const precision = selection.precision ?? "fp32";
       const optimization = selection.optimization ?? "standard";
-      for (const m of models) {
-        if (m.group === void 0) continue;
-        if (m.group.family !== selection.family || m.group.tier !== selection.tier) continue;
-        if ((m.group.precision ?? "fp32") !== precision) continue;
-        if ((m.group.optimization ?? "standard") !== optimization) continue;
-        if (m.group.resolution !== selection.resolution) continue;
-        return m.id;
-      }
-      return null;
+      const candidates = models.filter((m) => m.group !== void 0 && m.group.family === selection.family && m.group.tier === selection.tier && (m.group.precision ?? "fp32") === precision && (m.group.optimization ?? "standard") === optimization);
+      if (selection.resolution !== void 0) return candidates.find((m) => m.group?.resolution === selection.resolution)?.id ?? null;
+      return candidates.toSorted((a, b) => (b.group?.resolution ?? Infinity) - (a.group?.resolution ?? Infinity))[0]?.id ?? null;
     }
     function describeModelVariant(models, modelId) {
       const entry = models.find((m) => m.id === modelId);
@@ -240550,11 +240997,15 @@ export default function block(ctx: AddonContext) {
   ): Promise<void> {
     const resolved: Record<string, unknown> = {}
     for (const [k, v] of Object.entries(args)) resolved[k] = substitute(v, vars)
-    const client = (ctx.api as unknown as Record<string, Record<string, { mutate: (i: unknown) => Promise<unknown> }>>)[capToRouterKey(cap)]
-    if (client === undefined || client[method] === undefined) {
+    const client: unknown = Reflect.get(ctx.api, capToRouterKey(cap))
+    const proc: unknown =
+      typeof client === 'object' && client !== null ? Reflect.get(client, method) : undefined
+    const mutate: unknown =
+      typeof proc === 'object' && proc !== null ? Reflect.get(proc, 'mutate') : undefined
+    if (typeof mutate !== 'function') {
       throw new Error('no such device method: ' + cap + '.' + method)
     }
-    await client[method]!.mutate({ ...resolved, deviceId })
+    await mutate({ ...resolved, deviceId })
   }
 
   async function evaluateConditions(): Promise<boolean> {
@@ -246401,128 +246852,103 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var AUDIO_MACRO_LABELS = [
       {
         id: "speech",
-        name: "Speech",
-        icon: "\u{1F5E3}\uFE0F"
+        name: "Speech"
       },
       {
         id: "scream",
-        name: "Scream / Shout",
-        icon: "\u{1F631}"
+        name: "Scream / Shout"
       },
       {
         id: "crying",
-        name: "Crying / Baby",
-        icon: "\u{1F622}"
+        name: "Crying / Baby"
       },
       {
         id: "laughter",
-        name: "Laughter",
-        icon: "\u{1F602}"
+        name: "Laughter"
       },
       {
         id: "music",
-        name: "Music",
-        icon: "\u{1F3B5}"
+        name: "Music"
       },
       {
         id: "dog",
-        name: "Dog",
-        icon: "\u{1F415}"
+        name: "Dog"
       },
       {
         id: "cat",
-        name: "Cat",
-        icon: "\u{1F408}"
+        name: "Cat"
       },
       {
         id: "bird",
-        name: "Bird",
-        icon: "\u{1F426}"
+        name: "Bird"
       },
       {
         id: "animal",
-        name: "Animal (other)",
-        icon: "\u{1F43E}"
+        name: "Animal (other)"
       },
       {
         id: "alarm",
-        name: "Alarm / Siren",
-        icon: "\u{1F6A8}"
+        name: "Alarm / Siren"
       },
       {
         id: "doorbell",
-        name: "Doorbell / Knock",
-        icon: "\u{1F514}"
+        name: "Doorbell / Knock"
       },
       {
         id: "glass_breaking",
-        name: "Glass Breaking",
-        icon: "\u{1F4A5}"
+        name: "Glass Breaking"
       },
       {
         id: "gunshot",
-        name: "Gunshot / Explosion",
-        icon: "\u{1F4A3}"
+        name: "Gunshot / Explosion"
       },
       {
         id: "vehicle",
-        name: "Vehicle",
-        icon: "\u{1F697}"
+        name: "Vehicle"
       },
       {
         id: "siren",
-        name: "Emergency Siren",
-        icon: "\u{1F691}"
+        name: "Emergency Siren"
       },
       {
         id: "fire",
-        name: "Fire / Smoke",
-        icon: "\u{1F525}"
+        name: "Fire / Smoke"
       },
       {
         id: "water",
-        name: "Water",
-        icon: "\u{1F4A7}"
+        name: "Water"
       },
       {
         id: "wind",
-        name: "Wind / Weather",
-        icon: "\u{1F32C}\uFE0F"
+        name: "Wind / Weather"
       },
       {
         id: "door",
-        name: "Door",
-        icon: "\u{1F6AA}"
+        name: "Door"
       },
       {
         id: "footsteps",
-        name: "Footsteps",
-        icon: "\u{1F463}"
+        name: "Footsteps"
       },
       {
         id: "crowd",
-        name: "Crowd / Chatter",
-        icon: "\u{1F465}"
+        name: "Crowd / Chatter"
       },
       {
         id: "telephone",
-        name: "Telephone",
-        icon: "\u{1F4DE}"
+        name: "Telephone"
       },
       {
         id: "engine",
-        name: "Engine / Motor",
-        icon: "\u2699\uFE0F"
+        name: "Engine / Motor"
       },
       {
         id: "tools",
-        name: "Tools / Construction",
-        icon: "\u{1F528}"
+        name: "Tools / Construction"
       },
       {
         id: "silence",
-        name: "Silence",
-        icon: "\u{1F92B}"
+        name: "Silence"
       }
     ];
     var YAMNET_TO_MACRO = {
@@ -249110,6 +249536,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       hasFace: zod.z.boolean().optional(),
       /**
+      * This track has a face row IN THE GALLERY: a crop **and** an embedding — a
+      * face an operator could ASSIGN to an identity.
+      *
+      * The STRICT twin of {@link hasFace}, and the pair only earns its keep
+      * because the two disagree. `hasFace` is stamped at the TOP of the face
+      * branch, before every gate, and means no more than "a face detector produced
+      * a face detail". This one is stamped at the single moment the gallery row
+      * LANDS — after `FaceRecognizer.onTrackEnd` successfully persists it, i.e.
+      * past the embedding-magnitude verdict, the `minFacePx` detection gate, the
+      * candidate gate, the imageless-track drop (no crop was ever captured) and
+      * the crop-store drop. Everything between the detector and that insert can
+      * legitimately refuse the face, so a flag written any earlier promises the
+      * operator something to assign and delivers nothing.
+      *
+      * **Independent of recognition.** A face collected but never auto-matched is
+      * still assignable — it is in fact the face an operator most wants to reach —
+      * so this is NOT gated on `recognizedIdentityId`. Recognition lands in
+      * `subLabel`; this says only that the raw material exists.
+      *
+      * **Set once, never cleared.** A track that produced a gallery row produced
+      * one; deleting the row later is the gallery's business, not this flag's.
+      *
+      * **Absent ≠ false**, the same rule as {@link hasFace}: every row written
+      * before the column omits it, and so does every server that predates the
+      * field. A consumer must test `=== true` and render nothing otherwise —
+      * never infer "no assignable face".
+      */
+      hasEmbeddedFace: zod.z.boolean().optional(),
+      /**
       * This subject CONTAINS a folded rider — a person the rider-pairing step
       * ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
       * so the passage is tracked once and as a VEHICLE.
@@ -250870,6 +251325,32 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** FRAME-space bbox (already mapped back from crop space). */
       bbox: NativeCropBboxSchema.optional(),
       embedding: zod.z.string().optional(),
+      /**
+      * L2 magnitude of the RAW pre-normalization embedding. Additive and optional
+      * so an older runner that does not send it degrades to "unmeasurable", which
+      * the consuming gate treats as accept — never as reject.
+      */
+      embeddingMagnitude: zod.z.number().optional(),
+      /**
+      * Model that produced `embedding` — the SAME contract `labelModelId` has for
+      * `label`, and for the same reason: the producing node is the only side that
+      * knows which model actually ran, and re-deriving it downstream is exactly
+      * the inference this model exists to forbid.
+      *
+      * Additive and optional, so a runner that predates it degrades to
+      * "unmeasurable" rather than to a wrong answer — the consumer falls back to
+      * its previous assumption instead of refusing.
+      *
+      * Its absence was not cosmetic. `FaceRecognizer` needs the probe's model id
+      * to use `face-matcher`'s same-model gate (`sample.modelId !== probe.modelId`);
+      * with nothing on the wire it took the id from the GALLERY, so the gate
+      * compared the gallery against itself and could never fire. That turned the
+      * one guard protecting the face feature space into a tautology, and it is
+      * why swapping `face-embedding`'s model would NOT have stranded the enrolled
+      * gallery as the catalog comment predicts — it would have scored the new
+      * model's vectors against the old model's samples in one cosine space.
+      */
+      embeddingModelId: zod.z.string().optional(),
       label: zod.z.string().optional(),
       /**
       * The tier `label` occupies, copied VERBATIM from the producing step's
@@ -251846,6 +252327,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Unix timestamp (ms) when this snapshot was composed server-side. */
       fetchedAt: zod.z.number()
     });
+    var INFERENCE_DEVICE_EXCLUSION_REASONS = [
+      "disabled",
+      "unavailable",
+      "cannot-host-camera-root",
+      "accelerator-preferred"
+    ];
+    var InferenceDeviceExclusionReasonSchema = zod.z.enum(INFERENCE_DEVICE_EXCLUSION_REASONS);
     var NodeInferenceDeviceSchema = zod.z.object({
       /** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
       key: zod.z.string(),
@@ -251876,7 +252364,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * available per format; this is the stored selection that becomes the
       * default for EVERY camera landing on this accelerator.
       */
-      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional()
+      steps: zod.z.record(zod.z.string(), DeviceStepConfigSchema).optional(),
+      /**
+      * `null` when the device IS a camera-root candidate on this node; otherwise
+      * the reason the dispatcher drops it. Computed by the SAME
+      * `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+      * never disagree with the election — deriving it in the UI from
+      * `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+      * the node's model catalog) and `accelerator-preferred` (needs the node-wide
+      * "an accelerator is serving" predicate).
+      */
+      exclusion: InferenceDeviceExclusionReasonSchema.nullable()
     });
     var NodeInferenceDevicesSchema = zod.z.object({
       nodeId: zod.z.string(),
@@ -252694,6 +253192,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
             isBattery: zod.z.boolean(),
             reason: zod.z.enum([
               "disabled",
+              "offline",
               "sleeping",
               "unreachable",
               "waking"
@@ -252784,9 +253283,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sleeping: zod.z.boolean(),
           /** Current device state rendered over the cached frame. State images
           *  remain authoritative even when their photographic background is
-          *  old; null means the link must carry a current camera frame. */
+          *  old; null means the link must carry a current camera frame.
+          *
+          *  **This is the ONLY source a surface may derive an inactive tile
+          *  from.** A client that reads a device's `online`/`disabled` flags and
+          *  draws its own verdict will disagree with the pixels it is painting
+          *  — the frame comes from here, and so must the sentence over it
+          *  (D190). Pair with `ageMs` for the age of the photograph behind the
+          *  state. */
           stateReason: zod.z.enum([
             "disabled",
+            "offline",
             "sleeping",
             "unreachable",
             "waking"
@@ -256899,7 +257406,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       priority: zod.z.number()
     });
-    var GetConnectionEndpointsResultSchema = zod.z.object({ endpoints: zod.z.array(ConnectionEndpointSchema).readonly() });
+    var LocalPortSourceEnum = zod.z.enum([
+      "server-config",
+      "server-env",
+      "caller-hint",
+      "default"
+    ]);
+    var AdvertisedLocalPortSchema = zod.z.object({
+      port: zod.z.number().int().min(1).max(65535),
+      source: LocalPortSourceEnum
+    });
+    var GetConnectionEndpointsResultSchema = zod.z.object({
+      endpoints: zod.z.array(ConnectionEndpointSchema).readonly(),
+      /**
+      * The port the hub built the LAN/loopback URLs with, and where that number
+      * came from.
+      *
+      * Returned rather than merely applied, because "the URL is right" and "the
+      * client can KNOW the URL is right" are different properties. A client that
+      * only sees a corrected URL cannot distinguish a hub that fixed the port from
+      * a hub that echoed the port the client sent, so it cannot decide whether to
+      * race the candidate or discard it. With `source` it can: anything but
+      * `caller-hint` is the hub's own socket.
+      *
+      * Absent on hubs predating this field — a client that finds it missing is
+      * talking to an echoing hub and must degrade exactly as it does for
+      * `caller-hint`.
+      */
+      localPort: AdvertisedLocalPortSchema
+    });
     var NotificationEndpointSchema = zod.z.object({
       /** The operator's explicit choice, or null for AUTO. */
       baseUrl: zod.z.string().nullable(),
@@ -256941,10 +257476,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * Honours `getAllowedAddresses()` when set — addresses outside
         * the allowlist are dropped (the public tunnel + loopback are
         * always included as escape hatches).
+        *
+        * **The port is the hub's, not the caller's** (D62 — a function's fact
+        * belongs to whoever already owns it). This method used to take a `port`
+        * and echo it onto every LAN and loopback URL it advertised, which made
+        * every client a second authority on a socket only the hub binds. A viewer
+        * configured with a port-less public URL (`https://camstack.example.top`)
+        * infers 443 from the scheme, asks with 443, and was handed
+        * `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+        * cannot ever answer, and losing its race reads in the log exactly like
+        * "the LAN was tried and it was slower" — so an operator sitting on his own
+        * WiFi stayed on the public tunnel for weeks, with the LAN candidate born
+        * dead on every single connect.
+        *
+        * The hub now resolves its own listen port and reports it as `localPort`,
+        * with the SOURCE of the number, so a client can tell a fact from an echo.
+        *
+        * Out of scope on purpose: a LAN URL that is not the hub's own socket (a
+        * reverse proxy in front of it on another port) is not this method's to
+        * invent either — pin it with `setNotificationEndpoint` / a configured
+        * origin, which is an operator statement rather than a guess.
         */
         getConnectionEndpoints: require_sleep.method(zod.z.object({
-          /** Local hub HTTP port to use in base URLs. */
-          port: zod.z.number().int().min(1).max(65535),
+          /**
+          * LEGACY HINT — do not send from new code. Kept optional so clients
+          * written against the echoing contract keep working; the hub uses it
+          * only when it cannot read its own port, and says so via
+          * `localPort.source === 'caller-hint'`.
+          */
+          port: zod.z.number().int().min(1).max(65535).optional(),
           /** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
           *  candidate. Default `true`. */
           includeLoopback: zod.z.boolean().optional(),
@@ -263188,10 +263748,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       } };
     }
     var LAST_FETCHED_FIELD = "lastFetchedAt";
+    var RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = 6e4;
+    var OPERATOR_WRITTEN_STALE_MS = 10 * 6e4;
     function createRuntimeStateBridge(params) {
       const { runtimeState, cap, ownDeviceId, refresh, staleMs, empty, logger } = params;
       const missCooldownMs = params.refreshMissCooldownMs ?? 6e4;
+      const staleRead = params.staleRead ?? "await-refresh";
       let missCooldownUntil = 0;
+      let refreshInFlight = null;
       const readFetchedAt = () => {
         const value = runtimeState.getCapState(cap.name)?.[LAST_FETCHED_FIELD];
         return typeof value === "number" ? value : 0;
@@ -263206,14 +263770,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           }
         });
       };
-      const ensureFresh = async () => {
-        const slice = runtimeState.getCapState(cap.name);
-        const fetchedAt = readFetchedAt();
-        if (slice && Date.now() - fetchedAt <= staleMs) {
-          missCooldownUntil = 0;
-          return;
-        }
-        if (Date.now() < missCooldownUntil) return;
+      const runRefresh = async (fetchedAt) => {
         try {
           await refresh();
         } catch (err) {
@@ -263229,6 +263786,34 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         }
         openMissCooldown(void 0);
       };
+      const startRefresh = (fetchedAt) => {
+        const existing = refreshInFlight;
+        if (existing !== null) return existing;
+        const started = runRefresh(fetchedAt).catch(() => void 0).finally(() => {
+          refreshInFlight = null;
+        });
+        refreshInFlight = started;
+        return started;
+      };
+      const ensureFresh = async () => {
+        const slice = runtimeState.getCapState(cap.name);
+        const fetchedAt = readFetchedAt();
+        if (slice && Date.now() - fetchedAt <= staleMs) {
+          missCooldownUntil = 0;
+          return;
+        }
+        if (Date.now() < missCooldownUntil) return;
+        if (staleRead === "serve-and-revalidate") {
+          if (refreshInFlight !== null) return;
+          if (slice && fetchedAt > 0) {
+            startRefresh(fetchedAt);
+            return;
+          }
+          await startRefresh(fetchedAt);
+          return;
+        }
+        await runRefresh(fetchedAt);
+      };
       const projectStatus = () => {
         const slice = runtimeState.getCapState(cap.name);
         if (!slice) return empty();
@@ -273776,6 +274361,9 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     function normalizeAudioLabel(value) {
       return value.startsWith(AUDIO_KIND_PREFIX) ? value.slice(6) : value;
     }
+    function audioKindId(macroId) {
+      return macroId.startsWith(AUDIO_KIND_PREFIX) ? macroId : `${AUDIO_KIND_PREFIX}${macroId}`;
+    }
     var NC_AUDIO_DB_MIN = -96;
     var NC_AUDIO_DB_MAX = 0;
     var NC_AUDIO_DB_STEP = 3;
@@ -273823,8 +274411,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         samplingSeconds: clampInt(patch.samplingSeconds ?? base.samplingSeconds, 1, 300)
       };
     }
-    var UNKNOWN_LABEL_ICON = "\u{1F508}";
-    var ICON_BY_ID = new Map(AUDIO_MACRO_LABELS.flatMap((macro2) => macro2.icon === void 0 ? [] : [[macro2.id, macro2.icon]]));
     function audioLabelChoices(taxonomy, selected) {
       const fromHub = taxonomy?.audioKinds ?? [];
       const choices = fromHub.length > 0 ? fromHub.map((entry) => {
@@ -273832,13 +274418,13 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         return {
           value: id,
           label: entry.label,
-          icon: ICON_BY_ID.get(id) ?? UNKNOWN_LABEL_ICON,
+          iconId: audioKindId(id),
           unknown: false
         };
       }) : AUDIO_MACRO_LABELS.map((macro2) => ({
         value: macro2.id,
         label: macro2.name,
-        icon: macro2.icon ?? UNKNOWN_LABEL_ICON,
+        iconId: audioKindId(macro2.id),
         unknown: false
       }));
       const known = new Set(choices.map((choice) => choice.value));
@@ -273850,7 +274436,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         choices.push({
           value: id,
           label: id,
-          icon: UNKNOWN_LABEL_ICON,
+          iconId: audioKindId(id),
           unknown: true
         });
       }
@@ -274574,6 +275160,74 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       if (map !== void 0) return map[String(deviceId)] ?? 0;
       return rule.lastGeneratedAt ?? 0;
     }
+    var CLUSTER_MODEL_SCOPED_STEPS = [{
+      stepId: "face-embedding",
+      label: "Face recognition model",
+      defaultModelId: "arcface-r100",
+      indexName: "the enrolled face gallery",
+      options: [
+        {
+          id: "arcface-r100",
+          label: "ArcFace (ResNet34)"
+        },
+        {
+          id: "auraface-r100",
+          label: "AuraFace R100"
+        },
+        {
+          id: "inception-resnet-v1",
+          label: "Inception ResNet V1"
+        }
+      ]
+    }, {
+      stepId: "clip-embedding",
+      label: "Semantic search model",
+      defaultModelId: "mobileclip-s1",
+      indexName: "the object semantic-search index",
+      options: [{
+        id: "mobileclip-s1",
+        label: "MobileCLIP S1"
+      }, {
+        id: "mobileclip-s2",
+        label: "MobileCLIP S2"
+      }]
+    }];
+    var CLUSTER_MODEL_SECTION_ID = "cluster-step-models";
+    function clusterModelSettingKey(stepId) {
+      return `clusterModel:${stepId}`;
+    }
+    function isClusterScopedStep(stepId) {
+      return CLUSTER_MODEL_SCOPED_STEPS.some((s) => s.stepId === stepId);
+    }
+    var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
+    var ChosenModelIdSchema = zod.z.string().min(1);
+    function readClusterStepModels(config) {
+      const out = {};
+      for (const step2 of CLUSTER_MODEL_SCOPED_STEPS) {
+        const parsed = ChosenModelIdSchema.safeParse(config[clusterModelSettingKey(step2.stepId)]);
+        out[step2.stepId] = parsed.success ? parsed.data : step2.defaultModelId;
+      }
+      return out;
+    }
+    function isHydratedField$2(entry) {
+      return typeof entry === "object" && entry !== null && "key" in entry;
+    }
+    function pickClusterStepModels(view) {
+      if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
+      const flat = {};
+      const wanted = new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
+      for (const section of view.sections) for (const entry of section.fields) {
+        if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+        if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+      }
+      return readClusterStepModels(flat);
+    }
+    function resolveClusterStepModelId(stepId, models) {
+      const step2 = CLUSTER_MODEL_SCOPED_STEPS.find((s) => s.stepId === stepId);
+      if (step2 === void 0) return null;
+      const chosen = models[stepId];
+      return chosen !== void 0 && chosen !== "" ? chosen : step2.defaultModelId;
+    }
     var DETAIL_CROP_SECTION_ID = "detail-crop";
     var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
     var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
@@ -274621,6 +275275,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       }
       return readDetailCropConvention(flat);
     }
+    var FULL_IMAGE_BBOX = Object.freeze({
+      x: 0,
+      y: 0,
+      w: 1,
+      h: 1
+    });
     var DETAIL_CROP_PADDING_FIELD = {
       min: 0,
       max: 1,
@@ -276356,6 +277016,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.CAP_NAMES_WITH_STATUS = CAP_NAMES_WITH_STATUS;
     exports.CAP_NODE_PIN_CONTEXT_KEY = require_sleep.CAP_NODE_PIN_CONTEXT_KEY;
     exports.CAP_PROVIDER_KIND_MAP = CAP_PROVIDER_KIND_MAP;
+    exports.CLUSTER_MODEL_SCOPED_STEPS = CLUSTER_MODEL_SCOPED_STEPS;
+    exports.CLUSTER_MODEL_SECTION_ID = CLUSTER_MODEL_SECTION_ID;
     exports.COCO_80_LABELS = COCO_80_LABELS;
     exports.COCO_TO_MACRO = COCO_TO_MACRO;
     exports.CONNECTION_TEST_TIMEOUT_MS = CONNECTION_TEST_TIMEOUT_MS;
@@ -276443,6 +277105,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DECLARED_INTEGRATION_FIXED_KEY = DECLARED_INTEGRATION_FIXED_KEY;
     exports.DEFAULT_ADDON_PLACEMENT = DEFAULT_ADDON_PLACEMENT;
     exports.DEFAULT_AUDIO_ANALYZER_CONFIG = DEFAULT_AUDIO_ANALYZER_CONFIG;
+    exports.DEFAULT_CLUSTER_STEP_MODELS = DEFAULT_CLUSTER_STEP_MODELS;
     exports.DEFAULT_DECODER_HWACCEL_CONFIG = DEFAULT_DECODER_HWACCEL_CONFIG;
     exports.DEFAULT_DETAIL_CROP_CONVENTION = DEFAULT_DETAIL_CROP_CONVENTION;
     exports.DEFAULT_EVENTS_BAND_BUFFER_SEC = DEFAULT_EVENTS_BAND_BUFFER_SEC;
@@ -276561,6 +277224,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ExpressionLiteralBindingSchema = ExpressionLiteralBindingSchema;
     exports.ExpressionParseError = ExpressionParseError;
     exports.ExpressionSourceSchema = ExpressionSourceSchema;
+    exports.FULL_IMAGE_BBOX = FULL_IMAGE_BBOX;
     exports.FanControlStatusSchema = FanControlStatusSchema;
     exports.FanDirectionSchema = FanDirectionSchema;
     exports.FeatureManifestSchema = FeatureManifestSchema;
@@ -276587,6 +277251,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.HumidifierStatusSchema = HumidifierStatusSchema;
     exports.HumiditySensorStatusSchema = HumiditySensorStatusSchema;
     exports.HvacModeSchema = HvacModeSchema;
+    exports.INFERENCE_DEVICE_EXCLUSION_REASONS = INFERENCE_DEVICE_EXCLUSION_REASONS;
     exports.ImageContractSchema = ImageContractSchema;
     exports.ImageContractStateSchema = ImageContractStateSchema;
     exports.ImageRotateSchema = ImageRotateSchema;
@@ -276594,6 +277259,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ImageSettingsPatchSchema = ImageSettingsPatchSchema;
     exports.ImageSettingsStatusSchema = ImageSettingsStatusSchema;
     exports.ImageStatusSchema = ImageStatusSchema;
+    exports.InferenceDeviceExclusionReasonSchema = InferenceDeviceExclusionReasonSchema;
     exports.IngestOwnerSchema = IngestOwnerSchema;
     exports.InstalledPackageSchema = InstalledPackageSchema;
     exports.IntegrationLiteSchema = IntegrationLiteSchema;
@@ -276806,6 +277472,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.NotificationSchema = NotificationSchema;
     exports.NotifierStatusSchema = NotifierStatusSchema;
     exports.NumericSensorStatusSchema = NumericSensorStatusSchema;
+    exports.OPERATOR_WRITTEN_STALE_MS = OPERATOR_WRITTEN_STALE_MS;
     exports.OPS_LOG_DEFAULT_LIMIT = OPS_LOG_DEFAULT_LIMIT;
     exports.OPS_LOG_RING_DEFAULT_MAX = OPS_LOG_RING_DEFAULT_MAX;
     exports.OauthIntegrationDescriptorSchema = OauthIntegrationDescriptorSchema;
@@ -276888,6 +277555,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
     exports.RUNTIME_DEFAULTS = RUNTIME_DEFAULTS;
     exports.RUNTIME_STATE_POLICY = RUNTIME_STATE_POLICY;
+    exports.RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS;
     exports.RUNTIME_TO_FORMAT = RUNTIME_TO_FORMAT;
     exports.RawStateResultSchema = require_sleep.RawStateResultSchema;
     exports.ReadGopBytesResultSchema = ReadGopBytesResultSchema;
@@ -277180,6 +277848,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.audioAnalyzerCapability = audioAnalyzerCapability;
     exports.audioCodecCapability = audioCodecCapability;
     exports.audioIsFailClosed = audioIsFailClosed;
+    exports.audioKindId = audioKindId;
     exports.audioLabelChoices = audioLabelChoices;
     exports.audioMetricsCapability = audioMetricsCapability;
     exports.audioModeOf = audioModeOf;
@@ -277218,6 +277887,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.classifyStream = classifyStream;
     exports.classifyStreams = classifyStreams;
     exports.climateControlCapability = climateControlCapability;
+    exports.clusterModelSettingKey = clusterModelSettingKey;
     exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
     exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
     exports.colorCapability = colorCapability;
@@ -277336,6 +278006,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.isAudioRule = isAudioRule;
     exports.isBaseConditionKey = isBaseConditionKey;
     exports.isBatteryPresenceFault = isBatteryPresenceFault;
+    exports.isClusterScopedStep = isClusterScopedStep;
     exports.isCollectionArrayMethod = isCollectionArrayMethod;
     exports.isDeployableToAgent = isDeployableToAgent;
     exports.isDetectionMacroClass = isDetectionMacroClass;
@@ -277419,6 +278090,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.patchAudio = patchAudio;
     exports.petFeederCapability = petFeederCapability;
     exports.pickAccessoryControl = pickAccessoryControl;
+    exports.pickClusterStepModels = pickClusterStepModels;
     exports.pickDetailCropConvention = pickDetailCropConvention;
     exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
     exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
@@ -277442,6 +278114,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ptzAutotrackCapability = ptzAutotrackCapability;
     exports.ptzCapability = ptzCapability;
     exports.pythonScriptForBackend = pythonScriptForBackend;
+    exports.readClusterStepModels = readClusterStepModels;
     exports.readDetailCropConvention = readDetailCropConvention;
     exports.readDeviceStateFrom = readDeviceStateFrom;
     exports.readNativeLeaseOverride = readNativeLeaseOverride;
@@ -277459,6 +278132,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.resolveAddonPlacement = resolveAddonPlacement;
     exports.resolveAddonRuntime = resolveAddonRuntime;
     exports.resolveCapMount = require_sleep.resolveCapMount;
+    exports.resolveClusterStepModelId = resolveClusterStepModelId;
     exports.resolveDetectionRuntime = resolveDetectionRuntime;
     exports.resolveDeviceControlKind = resolveDeviceControlKind;
     exports.resolveDeviceProfile = resolveDeviceProfile;
@@ -277768,22 +278442,20 @@ var require_update_availability_emitter = __commonJS({
         this.persistIfDirty();
         if (!latestChanged)
           return;
-        this.emitList(target);
+        this.emitList(target, scope);
       }
       /** Publish a partial candidate set without treating omissions as up-to-date. */
       publishCandidates(candidates) {
-        let latestChanged = false;
-        const targets = /* @__PURE__ */ new Set();
+        const changed = /* @__PURE__ */ new Map();
         for (const candidate of candidates) {
-          targets.add(candidate.target);
-          if (this.note(candidate))
-            latestChanged = true;
+          if (!this.note(candidate))
+            continue;
+          const scope = scopeOf(candidate);
+          changed.set(`${candidate.target}:${scope}`, { target: candidate.target, scope });
         }
         this.persistIfDirty();
-        if (!latestChanged)
-          return;
-        for (const target of targets)
-          this.emitList(target);
+        for (const { target, scope } of changed.values())
+          this.emitList(target, scope);
       }
       note(candidate) {
         const key = this.key(candidate);
@@ -277809,20 +278481,20 @@ var require_update_availability_emitter = __commonJS({
           held: Object.fromEntries(this.held)
         });
       }
-      emitList(target) {
-        const list = [...this.held.values()].filter((candidate) => candidate.target === target);
+      /** Announce ONE scope's full list. `scope` is the node id, `hub` for the hub. */
+      emitList(target, scope) {
+        const list = [...this.held.values()].filter((candidate) => candidate.target === target && scopeOf(candidate) === scope);
         if (list.length === 0)
           return;
         const packages = list.map((candidate) => ({
           packageName: candidate.packageName,
           currentVersion: candidate.currentVersion,
           latestVersion: candidate.latestVersion,
-          ...candidate.nodeId !== void 0 ? { nodeId: candidate.nodeId } : {}
+          nodeId: scope
         }));
-        const nodeIds = unique(packages.map((pkg) => pkg.nodeId).filter((id) => id !== void 0));
         const head = list[0];
         this.eventBus.emit({
-          id: `update.available:${target}:${packages.map((pkg) => `${pkg.nodeId ?? "hub"}:${pkg.packageName}@${pkg.latestVersion}`).toSorted().join(",")}`,
+          id: `update.available:${target}:${scope}:${packages.map((pkg) => `${pkg.packageName}@${pkg.latestVersion}`).toSorted().join(",")}`,
           timestamp: /* @__PURE__ */ new Date(),
           source: this.source,
           category: types_1.EventCategory.UpdateAvailable,
@@ -277832,24 +278504,24 @@ var require_update_availability_emitter = __commonJS({
             currentVersion: head.currentVersion,
             latestVersion: head.latestVersion,
             packages,
-            ...head.nodeId !== void 0 ? { nodeId: head.nodeId } : {},
-            ...nodeIds.length > 0 ? { nodeIds } : {}
+            nodeId: scope,
+            nodeIds: [scope]
           }
         });
       }
       key(candidate) {
-        return `${candidate.target}:${candidate.nodeId ?? "hub"}:${candidate.packageName}`;
+        return `${candidate.target}:${scopeOf(candidate)}:${candidate.packageName}`;
       }
     };
     exports.UpdateAvailabilityEmitter = UpdateAvailabilityEmitter;
+    function scopeOf(candidate) {
+      return candidate.nodeId ?? "hub";
+    }
     function stampNode(candidate, nodeId) {
       if (nodeId === void 0 || candidate.nodeId !== void 0)
         return candidate;
       return { ...candidate, nodeId };
     }
-    function unique(values) {
-      return [...new Set(values)];
-    }
   }
 });
 
@@ -279204,7 +279876,13 @@ var require_server_root = __commonJS({
                 fromVersion: runningVersion
               }
             });
-            this.restartServerFn(`${RESTART_REASON_PREFIX}: ${this.spec.packageName}@${target}`);
+            this.restartServerFn(`${RESTART_REASON_PREFIX}: ${this.spec.packageName}@${target}`, {
+              packageName: this.spec.packageName,
+              ...runningVersion !== null ? {
+                fromVersion: runningVersion
+              } : {},
+              toVersion: target
+            });
             return {
               accepted: true,
               targetVersion: target,
@@ -279489,6 +280167,47 @@ var require_server_root = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/updates/restart-marker.js
+var require_restart_marker = __commonJS({
+  "../../server/backend/dist/core/updates/restart-marker.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.buildRestartMarker = buildRestartMarker;
+    exports.isServerUpdateReason = isServerUpdateReason;
+    exports.versionFromReason = versionFromReason;
+    var SERVER_UPDATE_PREFIX = "server-update:";
+    var ROOT_PACKAGE_NAME = "@camstack/server";
+    function buildRestartMarker(input) {
+      const { requestedBy, update, requestedAt } = input;
+      const toVersion = update?.toVersion ?? versionFromReason(requestedBy);
+      const isUpdate = update !== void 0 || isServerUpdateReason(requestedBy) && toVersion !== void 0;
+      if (!isUpdate) {
+        return {
+          kind: "manual",
+          requestedAt,
+          ...requestedBy !== void 0 ? { requestedBy } : {}
+        };
+      }
+      return {
+        kind: "framework-update",
+        requestedAt,
+        ...requestedBy !== void 0 ? { requestedBy } : {},
+        packageName: update?.packageName ?? ROOT_PACKAGE_NAME,
+        ...update?.fromVersion !== void 0 ? { fromVersion: update.fromVersion } : {},
+        ...toVersion !== void 0 ? { toVersion } : {}
+      };
+    }
+    function isServerUpdateReason(requestedBy) {
+      return requestedBy !== void 0 && requestedBy.startsWith(SERVER_UPDATE_PREFIX);
+    }
+    function versionFromReason(requestedBy) {
+      if (requestedBy === void 0)
+        return void 0;
+      return /@([^@\s]+)$/.exec(requestedBy)?.[1];
+    }
+  }
+});
+
 // ../../server/backend/dist/agent/agent-update-service.js
 var require_agent_update_service = __commonJS({
   "../../server/backend/dist/agent/agent-update-service.js"(exports) {
@@ -279546,6 +280265,7 @@ var require_agent_update_service = __commonJS({
     var update_availability_emitter_js_1 = require_update_availability_emitter();
     var update_availability_store_js_1 = require_update_availability_store();
     var index_js_1 = require_server_root();
+    var restart_marker_js_1 = require_restart_marker();
     exports.AGENT_RUNTIME_ADDON_ID = "agent-runtime";
     exports.AGENT_RESTART_GRACE_MS = 2e3;
     function isRunningInContainer(existsSyncFn) {
@@ -279609,8 +280329,8 @@ var require_agent_update_service = __commonJS({
             seedDir: "CAMSTACK_SEED_SERVER_DIR"
           },
           logger: options.logger,
-          restartServer: (requestedBy) => {
-            writeAgentRestartMarker(options.dataDir, requestedBy);
+          restartServer: (requestedBy, update) => {
+            writeAgentRestartMarker(options.dataDir, requestedBy, update);
             restartAgent(requestedBy);
           },
           dataDir: options.dataDir,
@@ -279688,18 +280408,13 @@ var require_agent_update_service = __commonJS({
       }
     };
     exports.AgentUpdateService = AgentUpdateService;
-    function writeAgentRestartMarker(dataDir, requestedBy) {
-      const toVersion = /@([^@\s]+)$/.exec(requestedBy)?.[1];
+    function writeAgentRestartMarker(dataDir, requestedBy, update) {
       try {
-        (0, system_1.writePendingRestart)(dataDir, {
-          kind: requestedBy.startsWith("server-update:") ? "framework-update" : "manual",
+        (0, system_1.writePendingRestart)(dataDir, (0, restart_marker_js_1.buildRestartMarker)({
           requestedAt: Date.now(),
           requestedBy,
-          ...requestedBy.startsWith("server-update:") ? {
-            packageName: "@camstack/server",
-            ...toVersion !== void 0 ? { toVersion } : {}
-          } : {}
-        });
+          ...update !== void 0 ? { update } : {}
+        }));
       } catch {
       }
     }
@@ -388570,6 +389285,7 @@ var require_addon_package_service = __commonJS({
     var types_1 = require_dist9();
     var update_availability_emitter_js_1 = require_update_availability_emitter();
     var update_check_scheduler_js_1 = require_update_check_scheduler();
+    var restart_marker_js_1 = require_restart_marker();
     var package_dir_utils_js_1 = require_package_dir_utils();
     var execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
     exports.SYSTEM_PACKAGE = "@camstack/system";
@@ -389497,26 +390213,24 @@ var require_addon_package_service = __commonJS({
       /**
        * Gracefully restart the server process.
        *
-       * Writes a `manual` restart marker so the post-boot service can
-       * emit `system.restart-completed` on the next boot (powers the
-       * admin-UI "Server restarted" toast). Emits `system.restarting`
+       * Writes the restart marker so the post-boot service can emit
+       * `system.restart-completed` on the next boot (powers the admin-UI
+       * "Server restarted" toast AND the operator's "Server aggiornato"
+       * notification). `update` is passed by `RootUpdateService` for an
+       * update-driven restart and is the ONLY source of the version being left
+       * behind — see `updates/restart-marker.ts`. Emits `system.restarting`
        * with the same payload so subscribers can show a reconnect overlay
        * immediately. Then delegates to `scheduleSelfRestart` which picks
        * the right exit path (Electron `app.relaunch` vs supervisor-driven
        * `process.exit`).
        */
-      restartServer(requestedBy) {
+      restartServer(requestedBy, update) {
         this.logger.info("Server restart requested -- initiating graceful shutdown");
-        const toVersion = toVersionFromRestartReason(requestedBy);
-        const payload = {
-          kind: isServerUpdateRequest(requestedBy) ? "framework-update" : "manual",
+        const payload = (0, restart_marker_js_1.buildRestartMarker)({
           requestedAt: Date.now(),
           ...requestedBy !== void 0 ? { requestedBy } : {},
-          ...isServerUpdateRequest(requestedBy) ? {
-            packageName: "@camstack/server",
-            ...toVersion !== void 0 ? { toVersion } : {}
-          } : {}
-        };
+          ...update !== void 0 ? { update } : {}
+        });
         try {
           (0, system_1.writePendingRestart)(this.resolveDataDir(), payload);
         } catch (err) {
@@ -390007,22 +390721,23 @@ var require_addon_package_service = __commonJS({
        * re-announces them on the next good poll.
        */
       publishAddonAvailability(updates, failures, nodeId) {
+        const scope = nodeId ?? this.resolveNodeId();
         const candidates = updates.map((update) => ({
           target: "addon",
           packageName: update.name,
           currentVersion: update.currentVersion,
           latestVersion: update.latestVersion,
-          ...nodeId !== void 0 ? { nodeId } : {}
+          nodeId: scope
         }));
         if (failures > 0) {
           this.logger.warn("Addon update check incomplete \u2014 availability published as partial", {
-            tags: { nodeId: nodeId ?? "hub" },
+            tags: { nodeId: scope },
             meta: { failures, published: candidates.length }
           });
           this.updateAvailability.publishCandidates(candidates);
           return;
         }
-        this.updateAvailability.publishSnapshot("addon", candidates, nodeId);
+        this.updateAvailability.publishSnapshot("addon", candidates, scope);
       }
       /** Fetch npm search results for camstack addon packages (cached 5 min) */
       async fetchSearchFromNpm() {
@@ -390172,15 +390887,6 @@ var require_addon_package_service = __commonJS({
       }
     };
     exports.AddonPackageService = AddonPackageService;
-    function isServerUpdateRequest(requestedBy) {
-      return requestedBy !== void 0 && requestedBy.startsWith("server-update:");
-    }
-    function toVersionFromRestartReason(requestedBy) {
-      if (requestedBy === void 0)
-        return void 0;
-      const match = /@([^@\s]+)$/.exec(requestedBy);
-      return match?.[1];
-    }
     async function extractTgzStripped(tgz, destDir) {
       fs.mkdirSync(destDir, { recursive: true });
       const tmpFile = path.join(os.tmpdir(), `camstack-tgz-${(0, node_crypto_1.randomUUID)()}.tgz`);
@@ -401689,14 +402395,6 @@ var require_integration_visibility = __commonJS({
     function createFilteredIntegrationRegistry(deps) {
       const { raw, logger } = deps;
       const isInstalled = (addonId) => deps.isAddonInstalled((0, types_1.bareAddonId)(addonId));
-      let activeIntegrationIds = null;
-      const ensureActiveIds = async () => {
-        if (activeIntegrationIds)
-          return activeIntegrationIds;
-        const all = await raw.listIntegrations();
-        activeIntegrationIds = new Set(all.filter((i) => isInstalled(i.addonId)).map((i) => i.id));
-        return activeIntegrationIds;
-      };
       const logHidden = (integration, phase) => {
         logger.warn("integration hidden \u2014 its addon is not installed, so this read answers null even though the row exists", {
           tags: { integrationId: integration.id, addonId: integration.addonId },
@@ -401742,39 +402440,7 @@ var require_integration_visibility = __commonJS({
         // Integration settings: passthrough (already gated by getIntegration)
         getIntegrationSettings: (id) => raw.getIntegrationSettings(id),
         setIntegrationSetting: (id, key, value) => raw.setIntegrationSetting(id, key, value),
-        setIntegrationSettings: (id, settings) => raw.setIntegrationSettings(id, settings),
-        // Devices: filter out devices belonging to hidden integrations
-        createDevice: (input) => raw.createDevice(input),
-        getDevice: async (id) => {
-          const d = await raw.getDevice(id);
-          if (!d)
-            return null;
-          const ids = await ensureActiveIds();
-          return ids.has(d.integrationId) ? d : null;
-        },
-        getDeviceByStableId: async (stableId) => {
-          const d = await raw.getDeviceByStableId(stableId);
-          if (!d)
-            return null;
-          const ids = await ensureActiveIds();
-          return ids.has(d.integrationId) ? d : null;
-        },
-        listDevices: async (integrationId) => {
-          const devices = await raw.listDevices(integrationId);
-          const ids = await ensureActiveIds();
-          return devices.filter((d) => ids.has(d.integrationId));
-        },
-        listCameras: async () => {
-          const cameras = await raw.listCameras();
-          const ids = await ensureActiveIds();
-          return cameras.filter((d) => ids.has(d.integrationId));
-        },
-        updateDevice: (id, updates) => raw.updateDevice(id, updates),
-        deleteDevice: (id) => raw.deleteDevice(id),
-        // Device settings: passthrough
-        getDeviceSettings: (id) => raw.getDeviceSettings(id),
-        setDeviceSetting: (id, key, value) => raw.setDeviceSetting(id, key, value),
-        setDeviceSettings: (id, settings) => raw.setDeviceSettings(id, settings)
+        setIntegrationSettings: (id, settings) => raw.setIntegrationSettings(id, settings)
       };
     }
   }
@@ -406355,6 +407021,7 @@ var require_moleculer_service = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.MoleculerService = void 0;
+    exports.childOwnerToken = childOwnerToken;
     exports.buildChildUdsManifest = buildChildUdsManifest;
     var node_crypto_1 = __require("crypto");
     var system_1 = require_dist3();
@@ -406381,6 +407048,21 @@ var require_moleculer_service = __commonJS({
        * `$hub.registerNode`. Populated by `onRegisterNode` in `hubDeps`.
        */
       nodeRegistry = new system_1.HubNodeRegistry();
+      /**
+       * nodeId → the owner token of the INCARNATION whose manifest currently backs
+       * that node's capability registrations.
+       *
+       * A node id is not unique over time: `resolveRunnerId` is deterministic, so a
+       * runner replaced by an addon update reconnects as the same `hub/<runner>`
+       * node. Without an incarnation the predecessor's teardown and the successor's
+       * registration are the same `(cap, addonId)` key, and the teardown wins by
+       * arriving last — `recording`, `storage-evictable` and `recording-export`
+       * were unregistered from a healthy process for 7 hours on 2026-08-20.
+       * Populated only for transports that can observe an incarnation (UDS
+       * children); remote nodes stay ownerless and behave exactly as before.
+       * See `docs/decisions/adr-0188-an-unregister-carries-proof-of-ownership.md`.
+       */
+      nodeOwners = /* @__PURE__ */ new Map();
       /**
        * Fixed-period agent-readiness snapshot sweep (D8 reconcile) — repairs
        * agent-origin readiness deltas lost while the agent stayed connected.
@@ -406702,14 +407384,18 @@ var require_moleculer_service = __commonJS({
             const hubNodeId = this.brokerSafe.nodeID;
             const childNodeId = `${hubNodeId}/${child.childId}`;
             const params = buildChildUdsManifest(childNodeId, child.childId, child.caps);
-            this.onRegisterNode(params);
-            logger.info("UDS child registered \u2014 manifest applied", { meta: { nodeId: childNodeId } });
+            this.onRegisterNode(params, childOwnerToken(childNodeId, child.incarnation));
+            logger.info("UDS child registered \u2014 manifest applied", {
+              meta: { nodeId: childNodeId, incarnation: child.incarnation }
+            });
           });
-          registry.onChildGone((childId) => {
+          registry.onChildGone((childId, incarnation) => {
             const hubNodeId = this.brokerSafe.nodeID;
             const childNodeId = `${hubNodeId}/${childId}`;
-            logger.info("UDS child gone \u2014 removing from registry", { meta: { childId } });
-            this.removeNodeFromRegistry(childNodeId);
+            logger.info("UDS child gone \u2014 removing from registry", {
+              meta: { childId, incarnation }
+            });
+            this.removeNodeFromRegistry(childNodeId, childOwnerToken(childNodeId, incarnation));
           });
           registry.onChildLog((childId, entry) => {
             this.logging.writeFromWorker((0, system_1.udsChildLogToWorkerEntry)(childId, entry));
@@ -406893,10 +407579,15 @@ var require_moleculer_service = __commonJS({
        * CapabilityRegistry update is a diff (atomic replace) rather than an
        * unconditional re-register — see `applyNodeManifest` for the rationale.
        */
-      onRegisterNode(params) {
+      onRegisterNode(params, owner) {
         const previousManifest = this.nodeRegistry.getNodeManifest(params.nodeId);
+        const previousOwner = this.nodeOwners.get(params.nodeId);
         this.nodeRegistry.registerNode(params);
-        this.applyNodeManifest(params, previousManifest);
+        if (owner === void 0)
+          this.nodeOwners.delete(params.nodeId);
+        else
+          this.nodeOwners.set(params.nodeId, owner);
+        this.applyNodeManifest(params, previousManifest, owner, previousOwner);
         const { nodeId } = params;
         if (nodeId !== "hub" && !nodeId.includes("/") && this.onAgentRegisteredCb) {
           this.onAgentRegisteredCb(nodeId);
@@ -406924,7 +407615,7 @@ var require_moleculer_service = __commonJS({
        * already; this method handles only `params.addons` (system caps).
        * Native-cap wiring into device-manager is done in a later task.
        */
-      applyNodeManifest(params, previousManifest) {
+      applyNodeManifest(params, previousManifest, owner, previousOwner) {
         const { nodeId, addons } = params;
         const hubNodeId = this.brokerSafe.nodeID;
         const isLocalChild = nodeId.startsWith(hubNodeId + "/");
@@ -406955,9 +407646,16 @@ var require_moleculer_service = __commonJS({
         for (const [key, { addonId, capName }] of previous) {
           if (desired.has(key))
             continue;
-          registry.unregisterProvider(capName, registryKeyFor(addonId));
+          registry.unregisterProvider(capName, registryKeyFor(addonId), previousOwner);
           this.nodeCallFns.delete(`${nodeId}::${capName}`);
         }
+        if (owner !== void 0 && previousOwner !== void 0 && owner !== previousOwner) {
+          for (const [key, { addonId, capName }] of desired) {
+            if (!previous.has(key))
+              continue;
+            registry.reassignProviderOwner(capName, registryKeyFor(addonId), owner);
+          }
+        }
         for (const [key, { addonId, capName, capDef }] of desired) {
           if (previous.has(key))
             continue;
@@ -406982,7 +407680,7 @@ var require_moleculer_service = __commonJS({
           for (const methodName of Object.keys((0, system_1.expandCapMethods)(capDef))) {
             proxy[methodName] = (methodParams) => callFn(methodName, methodParams);
           }
-          registry.registerProvider(capName, registryKey, proxy);
+          registry.registerProvider(capName, registryKey, proxy, owner);
           if (capDef.mode === "singleton" && isLocalChild) {
             const activeKey = registry.getSingletonAddonId(capName);
             if (activeKey === null || activeKey.includes("@")) {
@@ -407015,7 +407713,14 @@ var require_moleculer_service = __commonJS({
        * Unregisters every cap the node's last manifest declared and emits
        * synthetic readiness-down events for each.
        */
-      removeNodeFromRegistry(nodeId) {
+      removeNodeFromRegistry(nodeId, owner) {
+        const currentOwner = this.nodeOwners.get(nodeId);
+        if (currentOwner !== void 0 && currentOwner !== owner) {
+          this.logger.info("Node teardown ignored \u2014 node id reclaimed by a newer incarnation", {
+            meta: { nodeId, currentOwner, presentedOwner: owner ?? null }
+          });
+          return;
+        }
         const manifest = this.nodeRegistry.getNodeManifest(nodeId);
         if (!manifest)
           return;
@@ -407029,7 +407734,7 @@ var require_moleculer_service = __commonJS({
           const registryKey = isLocalChild ? addonId : `${addonId}@${nodeId}`;
           if (registry) {
             for (const capName of capabilities) {
-              registry.unregisterProvider(capName, registryKey);
+              registry.unregisterProvider(capName, registryKey, owner);
             }
           }
           for (const capName of capabilities) {
@@ -407050,6 +407755,7 @@ var require_moleculer_service = __commonJS({
             }
           }
         }
+        this.nodeOwners.delete(nodeId);
         this.nodeRegistry.removeNode(nodeId);
       }
       findCallFn(nodeId, capabilityName) {
@@ -407213,6 +407919,9 @@ var require_moleculer_service = __commonJS({
       }
     };
     exports.MoleculerService = MoleculerService;
+    function childOwnerToken(childNodeId, incarnation) {
+      return `${childNodeId}#${incarnation}`;
+    }
     function buildChildUdsManifest(nodeId, childId, caps) {
       const capsByAddon = /* @__PURE__ */ new Map();
       for (const cap of caps) {
@@ -408573,7 +409282,7 @@ var require_manual_boot = __commonJS({
       const replEngineService = new repl_engine_service_1.ReplEngineService(addonRegistryService, eventBusService, loggingService);
       const serverUpdateService = new server_update_service_1.ServerUpdateService({
         logger: loggingService.createLogger("ServerUpdate"),
-        restartServer: (requestedBy) => addonPackageService.restartServer(requestedBy),
+        restartServer: (requestedBy, update) => addonPackageService.restartServer(requestedBy, update),
         eventBus: eventBusService,
         updateAvailabilityStore: new update_availability_store_js_1.FileUpdateAvailabilityStore(availabilityDataDir, "server-update", loggingService.createLogger("UpdateAvailability"))
       });