camstack 1.2.48 → 1.2.50

package/dist/{launcher-MNOEQWRN.js → launcher-5GF42UWL.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-D3lqzV40.js
-var require_dist_D3lqzV40 = __commonJS({
-  "../system/dist/dist-D3lqzV40.js"(exports) {
+// ../system/dist/dist-BVU5JADq.js
+var require_dist_BVU5JADq = __commonJS({
+  "../system/dist/dist-BVU5JADq.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -25904,6 +25904,46 @@ var require_dist_D3lqzV40 = __commonJS({
     function logLevelAtMost(level, threshold) {
       return LOG_LEVEL_RANK[level] <= LOG_LEVEL_RANK[threshold];
     }
+    var LogChannelLevelSchema = zod.z.enum([
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogChannelDescriptorSchema = zod.z.object({
+      /**
+      * Dotted `area.thing`, unique across the workspace. `area` is conventionally
+      * the addon's short name so an operator reading a channel list can tell who
+      * owns it without a second lookup.
+      */
+      name: zod.z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+      /** One sentence: what the operator will SEE after arming it. */
+      description: zod.z.string().min(1),
+      /** The level its lines are emitted at. Never below `info`. */
+      defaultLevel: LogChannelLevelSchema,
+      /**
+      * Whether this channel can be narrowed to a camera.
+      *
+      * `true` is a PROMISE with two halves, and both must hold: the gate is
+      * consulted with the numeric device id, AND every line the channel admits
+      * carries `tags: { deviceId }` with that same numeric id. The second half is
+      * what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+      * keeps `deviceId` out of the stream labels for cardinality, so the tag in
+      * the body is the only way to filter.
+      *
+      * A channel whose lines carry the device only in `meta` (or not at all) is
+      * declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+      * the operator narrows to one camera, sees nothing, and concludes the code
+      * path was never taken.
+      */
+      perDevice: zod.z.boolean()
+    });
+    var LogChannelWindowSchema = zod.z.object({
+      channel: zod.z.string().min(1),
+      /** Epoch ms the window closes at. */
+      armedUntilMs: zod.z.number(),
+      /** `null` = every camera. A non-empty list narrows to those numeric ids. */
+      deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+    });
     var OpsLogDomainSchema = zod.z.enum(["recording", "events"]);
     var OpsLogOpSchema = zod.z.enum([
       "prune",
@@ -29461,6 +29501,21 @@ var require_dist_D3lqzV40 = __commonJS({
       whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional(),
       whereNot: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
     });
+    var AggregateFieldSchema = zod.z.object({
+      /** Result key. */
+      as: zod.z.string().min(1),
+      /** Column to aggregate. Must be a real column of a declared collection. */
+      field: zod.z.string().min(1),
+      op: zod.z.enum([
+        "sum",
+        "min",
+        "max"
+      ])
+    });
+    var AggregateResultSchema = zod.z.object({
+      count: zod.z.number().int(),
+      values: zod.z.record(zod.z.string(), zod.z.number().nullable())
+    });
     var SettingsRecordSchema = zod.z.object({
       id: zod.z.string(),
       data: zod.z.record(zod.z.string(), zod.z.unknown())
@@ -29588,6 +29643,32 @@ var require_dist_D3lqzV40 = __commonJS({
           collection: zod.z.string(),
           filter: QueryFilterSchema.optional()
         }), zod.z.number()),
+        /**
+        * `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
+        * statement, over the rows `filter` selects.
+        *
+        * Exists because "how much is there" was being answered by materialising
+        * "what is there". The recorder's storage-pressure sweep asked its in-RAM
+        * footage index for bytes/count/oldest/newest across a set of storage
+        * locations twice a minute, and the only way to answer that from a map is
+        * to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
+        * minute on the main thread, which is also why the whole archive had to
+        * stay resident to be visited. The question is a sum; nothing needs to be
+        * materialised to answer it.
+        *
+        * **The engine REFUSES a field it cannot serve**, exactly as
+        * `query.columns` does and unlike a PREDICATE, which is skipped when
+        * unresolvable. A dropped predicate over-matches and the caller sees extra
+        * rows; a dropped aggregate returns a NUMBER that is wrong and looks
+        * exactly like a real one. That asymmetry is what this repo has already
+        * paid for once in `count`.
+        */
+        aggregate: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          fields: zod.z.array(AggregateFieldSchema).readonly(),
+          filter: QueryFilterSchema.optional()
+        }), AggregateResultSchema),
         /** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
         histogram: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -29746,6 +29827,15 @@ var require_dist_D3lqzV40 = __commonJS({
           collection: zod.z.string(),
           filter: QueryFilterSchema.optional()
         }), zod.z.number(), { auth: "admin" }),
+        /** `COUNT(*)` plus one SUM/MIN/MAX per field, in one statement. Mirror of
+        *  `settings-store.aggregate` — see it for why an unresolvable field is
+        *  refused rather than dropped. */
+        aggregate: method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          fields: zod.z.array(AggregateFieldSchema).readonly(),
+          filter: QueryFilterSchema.optional()
+        }), AggregateResultSchema, { auth: "admin" }),
         /** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
         histogram: method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -30857,6 +30947,39 @@ var require_dist_D3lqzV40 = __commonJS({
         /** List children of a parent device (by parent numeric id). */
         getChildren: method(zod.z.object({ parentDeviceId: zod.z.number() }), zod.z.array(DeviceInfoSchema)),
         /**
+        * `getChildren` for a NAMED SET of parents, in one call.
+        *
+        * The accessory reconcile in `device-cap-proxy.ts` asks this question once
+        * per registered device — every `BaseDevice` inherits a
+        * `getAccessoryChildren()` that returns `[]`, so even a leaf accessory
+        * pays a round-trip to learn it has nothing to prune. Measured on the live
+        * hub 2026-08-27 over a 120-second boot window, fleet of 1 017 devices:
+        * `DeviceRowStore.list < DeviceRowStore.listByParent < getChildren` at
+        * **1 024 calls** returning **919 rows in total** — 1 024 RPCs and 1 024
+        * indexed scans to move less than one row each. `listByParentMany`
+        * collapses the scans; this collapses the RPCs.
+        *
+        * Keyed by parent id as a STRING — a JSON object cannot key by number
+        * (same reason as `getDeviceStatusAggregateBatch`). The per-parent value
+        * is exactly what `getChildren` returns for that parent.
+        *
+        * A parent with no children — or one the fleet does not know — is ABSENT
+        * from the record, never an invented empty row: the same contract as
+        * `DeviceRowStore.getMany`/`listByParentMany`. An EMPTY `parentDeviceIds`
+        * reads nothing at all rather than degrading to "every device".
+        *
+        * `parentDeviceIds` is capped at {@link DEVICE_CHILDREN_BATCH_MAX} — see
+        * that constant for why. A caller with more parents than that sends more
+        * than one call; it never sends one pathological one.
+        *
+        * Version skew: this is a NEW method, not a new field on `getChildren`, so
+        * a hub that predates it answers NOT_FOUND rather than silently stripping
+        * an unknown input key and answering a DIFFERENT question. The kernel-side
+        * loader degrades to per-parent `getChildren` on that error — see
+        * `children-batch-loader.ts`.
+        */
+        getChildrenBatch: method(zod.z.object({ parentDeviceIds: zod.z.array(zod.z.number()).max(256) }), zod.z.record(zod.z.string(), zod.z.array(DeviceInfoSchema))),
+        /**
         * Resolve the devices LINKED to a camera — the single policy authority
         * both consumers call (viewer devices panel + pipeline-analytics event
         * kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
@@ -31901,6 +32024,38 @@ var require_dist_D3lqzV40 = __commonJS({
         })
       }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var LogLevelSchema = zod.z.enum([
       "debug",
       "info",
@@ -47226,6 +47381,14 @@ var require_dist_D3lqzV40 = __commonJS({
       scope: LoggingScopeKindSchema,
       /** The node this layer speaks for; `null` on the cluster layer. */
       nodeId: zod.z.string().nullable(),
+      /**
+      * The declared channel this layer speaks for; `null` on every layer but
+      * `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+      * by design — the convention this repo settled on is one orchestrator-wide
+      * setting, never per node (D52) — so a component layer that carried a node
+      * would invite a per-node copy of a value that has no per-node meaning.
+      */
+      component: zod.z.string().nullable(),
       /** Explicitly set here, or `null` when this layer inherits. */
       level: LogLevelSchema$1.nullable()
     });
@@ -47251,6 +47414,38 @@ var require_dist_D3lqzV40 = __commonJS({
       /** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
       reportEveryMs: zod.z.number().int().positive().optional()
     });
+    var LogChannelWindowStateSchema = zod.z.object({
+      channel: zod.z.string(),
+      armed: zod.z.boolean(),
+      /** Epoch ms the window closes at. 0 when disarmed. */
+      armedUntilMs: zod.z.number(),
+      /** Ms left before it expires on its own. 0 when disarmed. */
+      remainingMs: zod.z.number(),
+      /**
+      * The cameras it is narrowed to, or `null` for every camera.
+      *
+      * A channel declared `perDevice: false` can only ever report `null` here:
+      * its lines do not carry `tags: { deviceId }`, so narrowing them would
+      * produce a filter that silently matches nothing. The server REFUSES such a
+      * patch rather than quietly widening it — ignoring the request would teach
+      * the operator that per-camera filtering works on that channel when it does
+      * not.
+      */
+      deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+    });
+    var LogChannelWindowPatchSchema = zod.z.object({
+      channel: zod.z.string().min(1),
+      armMs: zod.z.number().int().min(0),
+      /**
+      * Narrow to these numeric device ids. Absent or `null` = every camera.
+      *
+      * Numeric because the repo's own rule makes it possible: every log line
+      * about a device carries `tags: { deviceId }` with the numeric id. That rule
+      * was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+      * diagnosed by hand, and this is the first thing that collects on it.
+      */
+      deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable().optional()
+    });
     var LoggingSettingsPatchSchema = zod.z.object({
       /**
       * Absent leaves the level untouched. `null` CLEARS the explicit value at the
@@ -47261,19 +47456,50 @@ var require_dist_D3lqzV40 = __commonJS({
       * Only the diagnostics NAMED here change. An armed window that is not listed
       * keeps running — a patch is never a full replacement.
       */
-      diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional()
+      diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional(),
+      /**
+      * Only the channels NAMED here change. An armed channel that is not listed
+      * keeps running — same rule as `diagnostics`, because a patch that silently
+      * disarmed the channels it did not mention would make the Levels page and
+      * the Diagnostics page fight over the same value.
+      */
+      channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
+    });
+    var GetLoggingSettingsInputSchema = zod.z.object({
+      scopeNodeId: zod.z.string().optional(),
+      /**
+      * The declared CHANNEL this document is addressed at, when the caller wants
+      * the `component` layer. Absent = the node/cluster hierarchy only.
+      *
+      * Naming it separately rather than overloading `scopeNodeId` keeps the two
+      * axes from collapsing: a component level is cluster-wide, a node level is
+      * not, and one selector for both would make "which of these two did I just
+      * set" unanswerable — the exact ambiguity `explicit` exists to remove.
+      */
+      scopeComponent: zod.z.string().optional()
     });
-    var GetLoggingSettingsInputSchema = zod.z.object({ scopeNodeId: zod.z.string().optional() });
     var SetLoggingSettingsInputSchema = zod.z.object({
       scopeNodeId: zod.z.string().optional(),
+      scopeComponent: zod.z.string().optional(),
       patch: LoggingSettingsPatchSchema
     });
     var LoggingSettingsStateSchema = zod.z.object({
       /** The layer this document was read at. `null` = the cluster layer. */
       scopeNodeId: zod.z.string().nullable(),
+      /** The channel this document was read at. `null` = no component layer. */
+      scopeComponent: zod.z.string().nullable(),
       effective: LoggingEffectiveSchema,
       explicit: LoggingExplicitSchema,
       activeWindows: zod.z.array(DiagnosticWindowSchema).readonly(),
+      /**
+      * Every channel the cluster's addons DECLARE, gathered from the
+      * `log-channels` providers. Not stored anywhere: assembled per read, so a
+      * channel added by a redeployed addon appears without anybody editing a
+      * list, and a channel whose addon is gone stops being offered.
+      */
+      channels: zod.z.array(LogChannelDescriptorSchema).readonly(),
+      /** The channels ARMED right now, each with its deadline. */
+      activeChannels: zod.z.array(LogChannelWindowStateSchema).readonly(),
       persisted: zod.z.boolean()
     });
     var systemCapability = {
@@ -48752,6 +48978,7 @@ var require_dist_D3lqzV40 = __commonJS({
       llmRuntimeCapability,
       localNetworkCapability,
       lockControlCapability,
+      logChannelsCapability,
       logDestinationCapability,
       loginMethodCapability,
       mediaPlayerCapability,
@@ -49718,6 +49945,12 @@ var require_dist_D3lqzV40 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "dataStoreProvider.aggregate": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "dataStoreProvider.count": {
         capName: "data-store-provider",
         capScope: "system",
@@ -50132,6 +50365,12 @@ var require_dist_D3lqzV40 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "deviceManager.getChildrenBatch": {
+        capName: "device-manager",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "deviceManager.getConfigSchema": {
         capName: "device-manager",
         capScope: "system",
@@ -51182,6 +51421,18 @@ var require_dist_D3lqzV40 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "logChannels.apply": {
+        capName: "log-channels",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "logChannels.list": {
+        capName: "log-channels",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "logDestination.query": {
         capName: "log-destination",
         capScope: "system",
@@ -53336,6 +53587,12 @@ var require_dist_D3lqzV40 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "settingsStore.aggregate": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "settingsStore.count": {
         capName: "settings-store",
         capScope: "system",
@@ -54915,6 +55172,11 @@ var require_dist_D3lqzV40 = __commonJS({
         form: "single",
         optional: false
       }],
+      "deviceManager.getChildrenBatch": [{
+        name: "parentDeviceIds",
+        form: "array",
+        optional: false
+      }],
       "deviceManager.getConfigSchema": [{
         name: "deviceId",
         form: "single",
@@ -57730,7 +57992,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -58549,7 +58811,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -58643,7 +58905,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -59540,11 +59802,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-OtUQtEbq.js
-var require_retired_settings_keys_OtUQtEbq = __commonJS({
-  "../system/dist/retired-settings-keys-OtUQtEbq.js"(exports) {
+// ../system/dist/retired-settings-keys-_PLI9w0k.js
+var require_retired_settings_keys_PLI9w0k = __commonJS({
+  "../system/dist/retired-settings-keys-_PLI9w0k.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -61587,8 +61849,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
-    var require_retired_settings_keys = require_retired_settings_keys_OtUQtEbq();
+    var require_dist10 = require_dist_BVU5JADq();
+    var require_retired_settings_keys = require_retired_settings_keys_PLI9w0k();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -62750,30 +63012,16 @@ var require_device_manager_addon = __commonJS({
         ...sourceInfoGetDevice !== void 0 ? { sourceInfo: sourceInfoGetDevice } : {}
       };
     }
-    async function getChildren(pctx, input) {
-      const { parentDeviceId } = input;
-      let ownerAddonId = null;
-      if (pctx.registry) {
-        if (pctx.registry.getById(parentDeviceId)) ownerAddonId = pctx.registry.getAddonId(parentDeviceId);
-      }
-      if (!ownerAddonId) {
-        const persisted = await pctx.metaStore.resolvePersistedById(parentDeviceId);
-        if (!persisted) return [];
-        ownerAddonId = persisted.addonId;
-      }
+    async function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren) {
       const results = [];
       const seen = /* @__PURE__ */ new Set();
-      const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
       const rowById = /* @__PURE__ */ new Map();
       for (const row of childRows) rowById.set(row.meta.id, row);
-      if (pctx.registry) {
-        const liveChildren = pctx.registry.getChildren(parentDeviceId);
-        for (const device of liveChildren) {
-          const key = String(device.id);
-          const row = rowById.get(device.id);
-          results.push(toDeviceInfo(ownerAddonId, device, row?.metadata ?? null, row?.meta ?? null));
-          seen.add(key);
-        }
+      for (const device of liveChildren) {
+        const key = String(device.id);
+        const row = rowById.get(device.id);
+        results.push(toDeviceInfo(ownerAddonId, device, row?.metadata ?? null, row?.meta ?? null));
+        seen.add(key);
       }
       for (const row of childRows) {
         const m = row.meta;
@@ -62809,6 +63057,58 @@ var require_device_manager_addon = __commonJS({
       }
       return results;
     }
+    function liveOwnerOf(pctx, parentDeviceId) {
+      if (!pctx.registry) return null;
+      if (!pctx.registry.getById(parentDeviceId)) return null;
+      return pctx.registry.getAddonId(parentDeviceId);
+    }
+    async function getChildren(pctx, input) {
+      const { parentDeviceId } = input;
+      let ownerAddonId = liveOwnerOf(pctx, parentDeviceId);
+      if (!ownerAddonId) {
+        const persisted = await pctx.metaStore.resolvePersistedById(parentDeviceId);
+        if (!persisted) return [];
+        ownerAddonId = persisted.addonId;
+      }
+      const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
+      const liveChildren = pctx.registry?.getChildren(parentDeviceId) ?? [];
+      return [...await projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren)];
+    }
+    async function getChildrenBatch(pctx, input) {
+      const parentIds = [...new Set(input.parentDeviceIds)];
+      const out = {};
+      if (parentIds.length === 0) return out;
+      const owners = /* @__PURE__ */ new Map();
+      const unownedIds = [];
+      for (const parentId of parentIds) {
+        const live = liveOwnerOf(pctx, parentId);
+        if (live !== null) owners.set(parentId, live);
+        else unownedIds.push(parentId);
+      }
+      if (unownedIds.length > 0) {
+        const rows = await pctx.metaStore.rows.getMany(unownedIds);
+        for (const [parentId, row] of rows) owners.set(parentId, row.meta.addonId);
+      }
+      const requested = new Set(parentIds);
+      const rowsByParent = await pctx.metaStore.rows.listByParentMany([...owners.keys()]);
+      const liveByParent = /* @__PURE__ */ new Map();
+      for (const device of pctx.registry?.getAll() ?? []) {
+        const parentId = device.parentDeviceId;
+        if (parentId === null || parentId === void 0) continue;
+        if (!requested.has(parentId)) continue;
+        const bucket = liveByParent.get(parentId);
+        if (bucket === void 0) liveByParent.set(parentId, [device]);
+        else bucket.push(device);
+      }
+      for (const [parentId, ownerAddonId] of owners) {
+        const childRows = rowsByParent.get(parentId) ?? [];
+        const liveChildren = liveByParent.get(parentId) ?? [];
+        if (childRows.length === 0 && liveChildren.length === 0) continue;
+        const projected = await projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren);
+        if (projected.length > 0) out[String(parentId)] = [...projected];
+      }
+      return out;
+    }
     async function getStreamSources(pctx, input) {
       const { deviceId } = input;
       if (pctx.registry) {
@@ -64255,16 +64555,17 @@ var require_device_manager_addon = __commonJS({
     async function collectDescendants(metaStore, rootId) {
       const out = [];
       const visited = /* @__PURE__ */ new Set([rootId]);
-      const queue = [rootId];
-      while (queue.length > 0) {
-        const parentId = queue.shift();
-        if (parentId === void 0) break;
-        for (const row of await metaStore.rows.listByParent(parentId)) {
+      let frontier = [rootId];
+      while (frontier.length > 0) {
+        const byParent = await metaStore.rows.listByParentMany(frontier);
+        const next = [];
+        for (const parentId of frontier) for (const row of byParent.get(parentId) ?? []) {
           if (visited.has(row.meta.id)) continue;
           visited.add(row.meta.id);
           out.push(row.meta);
-          queue.push(row.meta.id);
+          next.push(row.meta.id);
         }
+        frontier = next;
       }
       return out;
     }
@@ -65323,6 +65624,46 @@ var require_device_manager_addon = __commonJS({
           limit: DEVICE_ROWS_FLEET_LIMIT
         });
       }
+      /**
+      * Direct children of MANY devices, in ONE query.
+      *
+      * `listByParent` called once per parent is the same shape `get` was before
+      * {@link getMany}: an indexed lookup this store makes cheap, repeated until
+      * it isn't. Measured on the live hub 2026-08-27, 120-second boot window:
+      * `DeviceRowStore.list < DeviceRowStore.listByParent < getChildren` at
+      * **1 024 calls** — one per device — for 919 rows in total. The BFS in
+      * `device-meta-actions.ts#collectDescendants` walked a container tree the
+      * same way, one query per node.
+      *
+      * `whereIn` on the indexed `parentDeviceId` column collapses a level of that
+      * walk into a single statement. Contract, verbatim from {@link getMany}: an
+      * EMPTY `parentDeviceIds` reads nothing at all rather than degrading to
+      * "everything", and a parent with no children — or one the fleet does not
+      * know — is simply ABSENT from the map, never an invented empty row.
+      */
+      async listByParentMany(parentDeviceIds) {
+        const out = /* @__PURE__ */ new Map();
+        const unique = [...new Set(parentDeviceIds)];
+        if (unique.length === 0) return out;
+        const rows = await this.list({
+          whereIn: { parentDeviceId: unique },
+          orderBy: {
+            field: "deviceId",
+            direction: "asc"
+          },
+          limit: DEVICE_ROWS_FLEET_LIMIT
+        });
+        const byParent = /* @__PURE__ */ new Map();
+        for (const row of rows) {
+          const parent = row.meta.parentDeviceId;
+          if (parent === null || parent === void 0) continue;
+          const bucket = byParent.get(parent);
+          if (bucket === void 0) byParent.set(parent, [row]);
+          else bucket.push(row);
+        }
+        for (const [parent, bucket] of byParent) out.set(parent, bucket);
+        return out;
+      }
       /** How many devices the fleet holds. Used to tell "empty store" from "gone device". */
       async count() {
         await this.declare();
@@ -66056,6 +66397,7 @@ var require_device_manager_addon = __commonJS({
           listAll: (input) => listAll(pctx, input),
           getDevice: (input) => getDevice(pctx, input),
           getChildren: (input) => getChildren(pctx, input),
+          getChildrenBatch: (input) => getChildrenBatch(pctx, input),
           getLinkedDevices: (input) => getLinkedDevices(pctx, input),
           getLinkedDevicesBatch: (input) => getLinkedDevicesBatch(pctx, input),
           getDeviceSettingsContribution: (input) => buildLinkedDevicesContribution(pctx, input.deviceId),
@@ -66257,7 +66599,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -66394,7 +66736,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -66584,7 +66926,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -74268,7 +74610,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -74833,7 +75175,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     var node_os = __require("os");
@@ -75775,7 +76117,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -76891,8 +77233,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
-    var require_retired_settings_keys = require_retired_settings_keys_OtUQtEbq();
+    var require_dist10 = require_dist_BVU5JADq();
+    var require_retired_settings_keys = require_retired_settings_keys_PLI9w0k();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -77733,6 +78075,46 @@ var require_sqlite_settings_addon = __commonJS({
           params
         }, () => this.getDb().prepare(sql).get(...params))?.cnt ?? 0;
       }
+      /**
+      * `COUNT(*)` and one SUM/MIN/MAX per requested field, in ONE statement.
+      *
+      * Result slots are aliased POSITIONALLY (`a0`, `a1`, …) and mapped back by
+      * index: `as` is caller text and must never reach SQL as an identifier, and
+      * the column name is validated through {@link fieldExprFor} exactly like a
+      * projection — an unresolvable field THROWS rather than being dropped, because
+      * a missing aggregate comes back as a number that looks real.
+      *
+      * `select` mode on the filter, so this agrees with `query` and `count` about
+      * which rows it is talking about.
+      */
+      async aggregate({ namespace, collection, fields, filter }) {
+        const scoped = this.scopedName(namespace, collection);
+        const decl = this.requireDeclared(scoped);
+        const shape = this.shapeOf(decl);
+        const selects = ['COUNT(*) AS "n"'];
+        fields.forEach((f, i) => {
+          const col = fieldExprFor(f.field, shape);
+          if (col === null) throw new UnsafeFilterError(`aggregate cannot read "${f.field}" on "${scoped}" \u2014 it is not a column of this collection, and answering without it would return a number that looks real`);
+          selects.push(`${f.op.toUpperCase()}(${col}) AS "a${i}"`);
+        });
+        const { whereSql, params } = compileFilter$1(filter, shape, "select", (v) => this.serializeColumnValue(v));
+        const sql = `SELECT ${selects.join(", ")} FROM "${scoped}"${whereSql}`;
+        const row = this.measured({
+          op: "aggregate",
+          collection: scoped,
+          sql,
+          params
+        }, () => this.getDb().prepare(sql).get(...params));
+        const values = {};
+        fields.forEach((f, i) => {
+          const raw = row?.[`a${i}`];
+          values[f.as] = typeof raw === "number" && Number.isFinite(raw) ? raw : null;
+        });
+        return {
+          count: row?.["n"] ?? 0,
+          values
+        };
+      }
       async histogram({ namespace, collection, field, bucketSize, origin, filter }) {
         const scoped = this.scopedName(namespace, collection);
         const decl = this.requireDeclared(scoped);
@@ -79086,7 +79468,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -79655,6 +80037,7 @@ var require_storage_orchestrator_addon = __commonJS({
         deleteWhere: async (input) => (await engine()).deleteWhere(input),
         updateWhere: async (input) => (await engine()).updateWhere(input),
         count: async (input) => (await engine()).count(input),
+        aggregate: async (input) => (await engine()).aggregate(input),
         histogram: async (input) => (await engine()).histogram(input),
         isEmpty: async (input) => (await engine()).isEmpty(input),
         declareCollection: async (input) => (await engine()).declareCollection(input)
@@ -80965,7 +81348,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -99026,7 +99409,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -104814,6 +105197,7 @@ var require_addon = __commonJS({
         "listProfiles",
         "listRuntimeNodes"
       ],
+      "log-channels": ["list"],
       "log-destination": ["query"],
       "login-method": ["getLoginMethods"],
       "mqtt-broker": ["listBrokers"],
@@ -111401,11 +111785,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-B_mCU6gz.js
-var require_manifest_python_deps_B_mCU6gz = __commonJS({
-  "../system/dist/manifest-python-deps-B_mCU6gz.js"(exports) {
+// ../system/dist/manifest-python-deps-CktMcXzS.js
+var require_manifest_python_deps_CktMcXzS = __commonJS({
+  "../system/dist/manifest-python-deps-CktMcXzS.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
+    require_dist_BVU5JADq();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -111496,6 +111881,34 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
     function shouldReclaim(s, triggerMb = HEAP_RECLAIM_TRIGGER_MB) {
       return strandedMb(s) > triggerMb;
     }
+    function share(partMb, rssMb) {
+      return rssMb > 0 ? Math.round(partMb / rssMb * 100) : 0;
+    }
+    function describeRss(s, budgetMb) {
+      const nativeResidueMb = Math.max(0, strandedMb(s));
+      const shape = s.heapUsedMb >= s.externalMb && s.heapUsedMb >= nativeResidueMb ? "v8-heap" : s.externalMb >= nativeResidueMb ? "external" : "native-residue";
+      return {
+        rssMb: s.rssMb,
+        budgetMb,
+        overMb: Math.max(0, s.rssMb - budgetMb),
+        heapUsedMb: s.heapUsedMb,
+        externalMb: s.externalMb,
+        nativeResidueMb,
+        arrayBuffersMb: s.arrayBuffersMb,
+        shape
+      };
+    }
+    var SHAPE_ADVICE = {
+      "v8-heap": "live JS retainers \u2014 bounded by --max-old-space-size; the fix is the retained set",
+      external: "Buffers / native external \u2014 NO V8 flag bounds this, and the old-space ceiling never will",
+      "native-residue": "freed native memory the allocator has not returned \u2014 MALLOC_ARENA_MAX/VIPS_CONCURRENCY are already applied, so this lever is spent"
+    };
+    var RSS_BUDGET_RELEASE_RATIO = 0.9;
+    var RSS_BUDGET_REANNOUNCE_MIN_MS = 9e5;
+    function nextRssBudgetState(current, rssMb, budgetMb, releaseRatio = RSS_BUDGET_RELEASE_RATIO) {
+      if (current === "over") return rssMb < budgetMb * releaseRatio ? "within" : "over";
+      return rssMb > budgetMb ? "over" : "within";
+    }
     function isGcFunction(value) {
       return typeof value === "function";
     }
@@ -111513,12 +111926,15 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
         return;
       }
     }
-    function format2(label, s, loop) {
-      const line = `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB`;
+    function formatOverBudget(label, b, source) {
+      return `[mem] ${label} OVER RSS BUDGET rss=${b.rssMb}MB budget=${b.budgetMb}MB over=+${b.overMb}MB shape=${b.shape} heapUsed=${b.heapUsedMb}MB(${share(b.heapUsedMb, b.rssMb)}%) external=${b.externalMb}MB(${share(b.externalMb, b.rssMb)}%) nativeResidue=${b.nativeResidueMb}MB(${share(b.nativeResidueMb, b.rssMb)}%) arrayBuffers=${b.arrayBuffersMb}MB budgetFrom="${source}" \u2014 ${SHAPE_ADVICE[b.shape]}`;
+    }
+    function format2(label, s, loop, budgetMb) {
+      const line = `[mem] ${label} rss=${s.rssMb}MB heapUsed=${s.heapUsedMb}MB heapTotal=${s.heapTotalMb}MB heapLimit=${s.heapLimitMb}MB used=${Math.round(s.usedRatio * 100)}% external=${s.externalMb}MB arrayBuffers=${s.arrayBuffersMb}MB` + (budgetMb === void 0 ? "" : ` rssBudget=${budgetMb}MB`);
       if (loop === void 0) return line;
       return `${line} loopP50=${loop.p50Ms}ms loopP99=${loop.p99Ms}ms loopMax=${loop.maxMs}ms`;
     }
-    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv, announceCeilingOrigin = true) {
+    function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEAP_WATCH_INTERVAL_MS, reclaimOptions, loopDelay = createLoopDelayMeter(), execArgv = process.execArgv, announceCeilingOrigin = true, rssBudget) {
       const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
       const now = reclaimOptions?.now ?? (() => Date.now());
       const triggerMb = reclaimOptions?.triggerMb ?? 1024;
@@ -111560,6 +111976,29 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
       };
       let mode = "steady";
       let lastLoggedAt = Number.NEGATIVE_INFINITY;
+      const budgetMb = rssBudget?.budgetMb !== void 0 && rssBudget.budgetMb > 0 ? rssBudget.budgetMb : void 0;
+      const budgetSource = rssBudget?.source ?? "unspecified";
+      const releaseRatio = rssBudget?.releaseRatio ?? 0.9;
+      const reannounceMinMs = rssBudget?.reannounceMinMs ?? 9e5;
+      let budgetState = "within";
+      let lastBudgetWarnAt = Number.NEGATIVE_INFINITY;
+      let overBudgetAnnounced = false;
+      const checkRssBudget = (sample, at) => {
+        if (budgetMb === void 0) return;
+        const previous = budgetState;
+        budgetState = nextRssBudgetState(previous, sample.rssMb, budgetMb, releaseRatio);
+        if (budgetState === previous) return;
+        if (budgetState === "over") {
+          if (at - lastBudgetWarnAt < reannounceMinMs) return;
+          lastBudgetWarnAt = at;
+          overBudgetAnnounced = true;
+          sink.warn(formatOverBudget(label, describeRss(sample, budgetMb), budgetSource));
+          return;
+        }
+        if (!overBudgetAnnounced) return;
+        overBudgetAnnounced = false;
+        sink.info(`[mem] ${label} back within its RSS budget \u2014 rss=${sample.rssMb}MB budget=${budgetMb}MB`);
+      };
       const probeIntervalMs = Math.min(fastIntervalMs, intervalMs);
       const tick = () => {
         try {
@@ -111570,12 +112009,13 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
           const due = at - lastLoggedAt >= intervalMs;
           if (mode === "escalated" || due) {
             lastLoggedAt = at;
-            const line = format2(label, sample, loopDelay?.read());
+            const line = format2(label, sample, loopDelay?.read(), budgetMb);
             if (sample.nearLimit) sink.warn(`${line} \u2014 APPROACHING HEAP LIMIT`);
             else if (mode === "escalated") sink.warn(`${line} \u2014 heap elevated, sampling every ${probeIntervalMs}ms`);
             else sink.info(line);
           }
           if (previous === "escalated" && mode === "steady") sink.info(`[mem] ${label} heap back to routine \u2014 logging every ${intervalMs}ms`);
+          checkRssBudget(sample, at);
           maybeReclaim(sample);
         } catch {
         }
@@ -111583,6 +112023,7 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
       const timer = setInterval(tick, probeIntervalMs);
       timer.unref?.();
       tick();
+      if (rssBudget !== void 0 && budgetMb === void 0) sink.info(`[mem] ${label} is NOT WATCHED against an RSS budget \u2014 no budget declared (${budgetSource}). rss growth outside the V8 heap raises nothing here: --max-old-space-size bounds old space only, and stranded subtracts external by construction. Declare execution.rssBudgetMb once this process has a measured working set.`);
       if (announceCeilingOrigin && heapCeilingOrigin(execArgv) === "v8-default") sink.info(`[mem] ${label} heap ceiling is V8's DEFAULT (${read().heapLimitMb}MB) \u2014 no --max-old-space-size on argv. Nothing here CHOSE that number; it is derived from host RAM and moves with it.`);
       let stopped = false;
       return () => {
@@ -111593,16 +112034,40 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
       };
     }
     var RUNNER_HEAP_WATCH_INTERVAL_MS = 3e5;
+    function parseRssBudgetMb(raw) {
+      if (raw === void 0) return void 0;
+      const parsed = Number(raw);
+      if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
+      return Math.floor(parsed);
+    }
+    var RUNNER_RSS_BUDGET_ENV = "CAMSTACK_RUNNER_RSS_BUDGET_MB";
+    var HUB_RSS_BUDGET_ENV = "CAMSTACK_HUB_RSS_BUDGET_MB";
+    var HUB_MAIN_RSS_BUDGET_MB = 4096;
+    function hubMainRssBudget(env = process.env) {
+      const override = env[HUB_RSS_BUDGET_ENV];
+      if (override !== void 0) return {
+        budgetMb: parseRssBudgetMb(override),
+        source: HUB_RSS_BUDGET_ENV
+      };
+      return {
+        budgetMb: HUB_MAIN_RSS_BUDGET_MB,
+        source: "HUB_MAIN_RSS_BUDGET_MB (kernel/heap-watch)"
+      };
+    }
     function startRunnerHeapWatch(options) {
       if (options.heapProfile !== "heavy") return void 0;
       const intervalMs = options.intervalMs ?? 3e5;
-      if (options.reclaimSwitch === "off") return startHeapWatch(options.label, options.sink, intervalMs, void 0, void 0, void 0, false);
+      const rssBudget = {
+        budgetMb: parseRssBudgetMb(options.rssBudgetMb),
+        source: `manifest execution.rssBudgetMb (via ${RUNNER_RSS_BUDGET_ENV})`
+      };
+      if (options.reclaimSwitch === "off") return startHeapWatch(options.label, options.sink, intervalMs, void 0, void 0, void 0, false, rssBudget);
       let reclaimOptions = options.reclaimOptions;
       if (reclaimOptions === void 0) {
         const reclaimer = createV8Reclaimer();
         reclaimOptions = reclaimer === void 0 ? void 0 : { reclaim: reclaimer };
       }
-      return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, true);
+      return startHeapWatch(options.label, options.sink, intervalMs, reclaimOptions, void 0, void 0, true, rssBudget);
     }
     function trimSlashes(s) {
       return s.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -112479,6 +112944,105 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
       });
       return true;
     }
+    function parseChildRows(value) {
+      if (!Array.isArray(value)) return null;
+      const rows = [];
+      for (const entry of value) {
+        if (typeof entry !== "object" || entry === null) return null;
+        const id = Reflect.get(entry, "id");
+        const stableId = Reflect.get(entry, "stableId");
+        const name = Reflect.get(entry, "name");
+        const linkDeviceId = Reflect.get(entry, "linkDeviceId");
+        if (typeof id !== "number" || typeof stableId !== "string" || typeof name !== "string") return null;
+        rows.push({
+          id,
+          stableId,
+          name,
+          ...typeof linkDeviceId === "number" || linkDeviceId === null ? { linkDeviceId } : {}
+        });
+      }
+      return rows;
+    }
+    function parseChildrenByParent(value) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+      const out = /* @__PURE__ */ new Map();
+      for (const [key, entry] of Object.entries(value)) {
+        const parentDeviceId = Number(key);
+        if (!Number.isInteger(parentDeviceId)) return null;
+        const rows = parseChildRows(entry);
+        if (rows === null) return null;
+        out.set(parentDeviceId, rows);
+      }
+      return out;
+    }
+    function looksLikeUnknownMethod(err) {
+      const lowered = (err instanceof Error ? err.message : String(err)).toLowerCase();
+      return lowered.includes("not_found") || lowered.includes("no procedure") || lowered.includes("unknown method") || lowered.includes("no such method") || lowered.includes("not available");
+    }
+    function createChildrenBatchLoader(opts) {
+      const maxBatch = Math.max(1, opts.maxBatch ?? 256);
+      let pending = [];
+      let flushScheduled = false;
+      let flushing = false;
+      let batchUnsupported = false;
+      const answerOneByOne = async (waiters) => {
+        await Promise.all(waiters.map(async (waiter) => {
+          try {
+            waiter.resolve(await opts.fetchOne(waiter.parentDeviceId));
+          } catch (err) {
+            waiter.reject(err);
+          }
+        }));
+      };
+      const runBatch = async (waiters) => {
+        const parentDeviceIds = [...new Set(waiters.map((w) => w.parentDeviceId))];
+        try {
+          const byParent = await opts.fetchBatch(parentDeviceIds);
+          for (const waiter of waiters) waiter.resolve(byParent.get(waiter.parentDeviceId) ?? []);
+        } catch (err) {
+          const unknown = looksLikeUnknownMethod(err);
+          if (unknown) batchUnsupported = true;
+          opts.logger.warn(unknown ? "device-manager.getChildrenBatch is not available on this hub \u2014 falling back to per-parent getChildren for the process lifetime" : "device-manager.getChildrenBatch failed \u2014 answering this batch per parent", { meta: {
+            parents: parentDeviceIds.length,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+          await answerOneByOne(waiters);
+        }
+      };
+      const flush = async () => {
+        flushing = true;
+        try {
+          while (pending.length > 0) {
+            const batch = pending.slice(0, maxBatch);
+            pending = pending.slice(maxBatch);
+            if (batchUnsupported) await answerOneByOne(batch);
+            else await runBatch(batch);
+          }
+        } finally {
+          flushing = false;
+        }
+      };
+      const scheduleFlush = () => {
+        if (flushScheduled || flushing) return;
+        flushScheduled = true;
+        setTimeout(() => {
+          flushScheduled = false;
+          flush().catch((err) => {
+            opts.logger.warn("children batch flush threw", { meta: { error: err instanceof Error ? err.message : String(err) } });
+          });
+        }, 0);
+      };
+      return { load(parentDeviceId) {
+        return new Promise((resolve, reject) => {
+          pending.push({
+            parentDeviceId,
+            resolve,
+            reject
+          });
+          scheduleFlush();
+        });
+      } };
+    }
     var ACCESSORY_SPAWN_CONCURRENCY = 12;
     async function runBounded(items, limit, worker2) {
       const effectiveLimit = Math.max(1, Math.min(limit, items.length));
@@ -112686,6 +113250,19 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
         api
       });
       let selfApi;
+      const childrenLoader = createChildrenBatchLoader({
+        logger: opts.logger,
+        fetchBatch: async (parentDeviceIds) => {
+          const parsed = parseChildrenByParent(await callDeviceManager(api, "getChildrenBatch", { parentDeviceIds }));
+          if (parsed === null) throw new Error("getChildrenBatch returned a shape this kernel cannot read");
+          return parsed;
+        },
+        fetchOne: async (parentDeviceId) => {
+          const parsed = parseChildRows(await callDeviceManager(api, "getChildren", { parentDeviceId }));
+          if (parsed === null) throw new Error("getChildren returned a shape this kernel cannot read");
+          return parsed;
+        }
+      });
       const deviceRebuildFactories = /* @__PURE__ */ new Map();
       const buildContext = (stableId, id, parentDeviceId = null, initialRuntimeState = {}, persistedConfig = {}, deviceMeta = null) => {
         let runtimeStateRef = null;
@@ -113097,7 +113674,7 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
               return;
             }
             try {
-              const currentChildren = await callDeviceManager(api, "getChildren", { parentDeviceId: device.id });
+              const currentChildren = await childrenLoader.load(device.id);
               for (const child of currentChildren) {
                 if (child.linkDeviceId !== device.id) continue;
                 if (expected.has(child.stableId)) continue;
@@ -118046,6 +118623,18 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
         return HUB_CAP_FWD_SERVICE;
       }
     });
+    Object.defineProperty(exports, "HUB_MAIN_RSS_BUDGET_MB", {
+      enumerable: true,
+      get: function() {
+        return HUB_MAIN_RSS_BUDGET_MB;
+      }
+    });
+    Object.defineProperty(exports, "HUB_RSS_BUDGET_ENV", {
+      enumerable: true,
+      get: function() {
+        return HUB_RSS_BUDGET_ENV;
+      }
+    });
     Object.defineProperty(exports, "LocalChildClient", {
       enumerable: true,
       get: function() {
@@ -118064,12 +118653,30 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
         return NATIVE_PROVIDER_SERVICE_INFIX;
       }
     });
+    Object.defineProperty(exports, "RSS_BUDGET_REANNOUNCE_MIN_MS", {
+      enumerable: true,
+      get: function() {
+        return RSS_BUDGET_REANNOUNCE_MIN_MS;
+      }
+    });
+    Object.defineProperty(exports, "RSS_BUDGET_RELEASE_RATIO", {
+      enumerable: true,
+      get: function() {
+        return RSS_BUDGET_RELEASE_RATIO;
+      }
+    });
     Object.defineProperty(exports, "RUNNER_HEAP_WATCH_INTERVAL_MS", {
       enumerable: true,
       get: function() {
         return RUNNER_HEAP_WATCH_INTERVAL_MS;
       }
     });
+    Object.defineProperty(exports, "RUNNER_RSS_BUDGET_ENV", {
+      enumerable: true,
+      get: function() {
+        return RUNNER_RSS_BUDGET_ENV;
+      }
+    });
     Object.defineProperty(exports, "SocketChannel", {
       enumerable: true,
       get: function() {
@@ -118274,6 +118881,12 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
         return createV8Reclaimer;
       }
     });
+    Object.defineProperty(exports, "describeRss", {
+      enumerable: true,
+      get: function() {
+        return describeRss;
+      }
+    });
     Object.defineProperty(exports, "deserializeTypedArrays", {
       enumerable: true,
       get: function() {
@@ -118334,6 +118947,12 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
         return getWorkerNativeCapSnapshot;
       }
     });
+    Object.defineProperty(exports, "hubMainRssBudget", {
+      enumerable: true,
+      get: function() {
+        return hubMainRssBudget;
+      }
+    });
     Object.defineProperty(exports, "installManifestNativeDeps", {
       enumerable: true,
       get: function() {
@@ -118370,12 +118989,24 @@ var require_manifest_python_deps_B_mCU6gz = __commonJS({
         return mountNativeCapService;
       }
     });
+    Object.defineProperty(exports, "nextRssBudgetState", {
+      enumerable: true,
+      get: function() {
+        return nextRssBudgetState;
+      }
+    });
     Object.defineProperty(exports, "parseCapAction", {
       enumerable: true,
       get: function() {
         return parseCapAction;
       }
     });
+    Object.defineProperty(exports, "parseRssBudgetMb", {
+      enumerable: true,
+      get: function() {
+        return parseRssBudgetMb;
+      }
+    });
     Object.defineProperty(exports, "registerEventBusService", {
       enumerable: true,
       get: function() {
@@ -122274,7 +122905,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_D3lqzV40();
+    var require_dist10 = require_dist_BVU5JADq();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -122300,7 +122931,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_u8QCJCFE();
-    var require_manifest_python_deps = require_manifest_python_deps_B_mCU6gz();
+    var require_manifest_python_deps = require_manifest_python_deps_CktMcXzS();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -201766,7 +202397,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     }
     var EMPTY_HEAP_DECLARATION = {
       profile: void 0,
-      maxOldSpaceMb: void 0
+      maxOldSpaceMb: void 0,
+      rssBudgetMb: void 0
     };
     var heapProfileCache = /* @__PURE__ */ new Map();
     function readAddonHeapDeclaration(spec) {
@@ -201779,10 +202411,12 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         const parsed = JSON.parse(raw);
         const profile = extractHeapProfile(parsed, spec.addonId);
         const maxOldSpaceMb = extractMaxOldSpaceMb(parsed, spec.addonId);
-        if (profile !== void 0 || maxOldSpaceMb !== void 0) {
+        const rssBudgetMb = extractRssBudgetMb(parsed, spec.addonId);
+        if (profile !== void 0 || maxOldSpaceMb !== void 0 || rssBudgetMb !== void 0) {
           declaration = {
             profile,
-            maxOldSpaceMb
+            maxOldSpaceMb,
+            rssBudgetMb
           };
           break;
         }
@@ -201806,6 +202440,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.maxOldSpaceMb;
       return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : void 0;
     }
+    function extractRssBudgetMb(parsed, addonId) {
+      const value = readManifestAddons(parsed).find((a) => a.id === addonId)?.execution?.rssBudgetMb;
+      return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+    }
     function readManifestAddons(parsed) {
       if (typeof parsed !== "object" || parsed === null) return [];
       const camstack = parsed.camstack;
@@ -201824,6 +202462,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       if (declared.includes(0)) return 0;
       return Math.max(...declared);
     }
+    function runnerRssBudgetMb(addons) {
+      const declared = addons.map((a) => readAddonHeapDeclaration(a).rssBudgetMb).filter((mb) => mb !== void 0);
+      return declared.length === 0 ? void 0 : Math.max(...declared);
+    }
     function runnerHeapFlags(addons) {
       if (process.env["CAMSTACK_RUNNER_HEAP_TUNING"] === "off") return [];
       const heavy = isHeavyRunner(addons);
@@ -201880,6 +202522,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         const nodeId = buildNodeId(runnerId);
         const runnerPath = node_path.resolve(__dirname, "addon-runner.js");
         const heavy = isHeavyRunner(addons);
+        const rssBudgetMb = runnerRssBudgetMb(addons);
         const childEnv = {
           ...process.env,
           CAMSTACK_RUNNER_ID: runnerId,
@@ -201893,6 +202536,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           ...applyRunnerNativeAllocator(process.env),
           ...env
         };
+        if (rssBudgetMb === void 0) delete childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV];
+        else childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV] = String(rssBudgetMb);
         const heapFlags = runnerHeapFlags(addons);
         capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
         const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
@@ -202683,6 +203328,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.HEAP_WATCH_WARN_RATIO = require_manifest_python_deps.HEAP_WATCH_WARN_RATIO;
     exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
     exports.HUB_CAP_FWD_SERVICE = require_manifest_python_deps.HUB_CAP_FWD_SERVICE;
+    exports.HUB_MAIN_RSS_BUDGET_MB = require_manifest_python_deps.HUB_MAIN_RSS_BUDGET_MB;
+    exports.HUB_RSS_BUDGET_ENV = require_manifest_python_deps.HUB_RSS_BUDGET_ENV;
     exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAddon$1;
     exports.HubForwarderDestination = require_builtins_hub_forwarder_index.HubForwarderDestination$1;
     exports.HubLogForwarder = HubLogForwarder;
@@ -202722,7 +203369,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.PythonEnvManager = PythonEnvManager;
     exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
     exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
+    exports.RSS_BUDGET_REANNOUNCE_MIN_MS = require_manifest_python_deps.RSS_BUDGET_REANNOUNCE_MIN_MS;
+    exports.RSS_BUDGET_RELEASE_RATIO = require_manifest_python_deps.RSS_BUDGET_RELEASE_RATIO;
     exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
+    exports.RUNNER_RSS_BUDGET_ENV = require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV;
     exports.RUNTIME_DEFAULTS = require_dist10.RUNTIME_DEFAULTS;
     exports.ReadinessRegistry = require_dist10.ReadinessRegistry;
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
@@ -202819,6 +203469,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.deleteModelFromDisk = require_file_data_plane.deleteModelFromDisk;
     exports.deriveAgentListenPort = deriveAgentListenPort;
     exports.describeProviderKindDrift = describeProviderKindDrift;
+    exports.describeRss = require_manifest_python_deps.describeRss;
     exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
     Object.defineProperty(exports, "downloadBinary", {
       enumerable: true,
@@ -202895,6 +203546,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.getWorkerDeviceRegistry = require_manifest_python_deps.getWorkerDeviceRegistry;
     exports.hasDotNode = hasDotNode;
     exports.hashClusterSecret = hashClusterSecret;
+    exports.hubMainRssBudget = require_manifest_python_deps.hubMainRssBudget;
     exports.installManifestNativeDeps = require_manifest_python_deps.installManifestNativeDeps;
     exports.installManifestPythonDeps = require_manifest_python_deps.installManifestPythonDeps;
     exports.installPackageFromNpm = installPackageFromNpm;
@@ -202923,8 +203575,10 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
     exports.localProviderLink = require_manifest_python_deps.localProviderLink;
     exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
+    exports.nextRssBudgetState = require_manifest_python_deps.nextRssBudgetState;
     exports.parseCapAction = require_manifest_python_deps.parseCapAction;
     exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
+    exports.parseRssBudgetMb = require_manifest_python_deps.parseRssBudgetMb;
     exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
     exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
     exports.proxyToUpstream = proxyToUpstream;
@@ -203840,6 +204494,253 @@ var require_dist4 = __commonJS({
     function logLevelAtMost(level, threshold) {
       return LOG_LEVEL_RANK[level] <= LOG_LEVEL_RANK[threshold];
     }
+    var LogChannelLevelSchema = zod.z.enum([
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogChannelDescriptorSchema = zod.z.object({
+      /**
+      * Dotted `area.thing`, unique across the workspace. `area` is conventionally
+      * the addon's short name so an operator reading a channel list can tell who
+      * owns it without a second lookup.
+      */
+      name: zod.z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+      /** One sentence: what the operator will SEE after arming it. */
+      description: zod.z.string().min(1),
+      /** The level its lines are emitted at. Never below `info`. */
+      defaultLevel: LogChannelLevelSchema,
+      /**
+      * Whether this channel can be narrowed to a camera.
+      *
+      * `true` is a PROMISE with two halves, and both must hold: the gate is
+      * consulted with the numeric device id, AND every line the channel admits
+      * carries `tags: { deviceId }` with that same numeric id. The second half is
+      * what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+      * keeps `deviceId` out of the stream labels for cardinality, so the tag in
+      * the body is the only way to filter.
+      *
+      * A channel whose lines carry the device only in `meta` (or not at all) is
+      * declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+      * the operator narrows to one camera, sees nothing, and concludes the code
+      * path was never taken.
+      */
+      perDevice: zod.z.boolean()
+    });
+    var LogChannelWindowSchema = zod.z.object({
+      channel: zod.z.string().min(1),
+      /** Epoch ms the window closes at. */
+      armedUntilMs: zod.z.number(),
+      /** `null` = every camera. A non-empty list narrows to those numeric ids. */
+      deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+    });
+    var LogChannelGate = class {
+      descriptor;
+      /**
+      * HOT PATH GUARD. A plain data FIELD, and it must stay one.
+      *
+      * `log-channel.spec.ts` asserts the property descriptor has no getter and
+      * booby-traps the device set, so turning this into an accessor — or reading
+      * anything before it — fails the spec instead of taxing every line the
+      * process emits.
+      */
+      on = false;
+      /** `null` while armed for every camera. Never read while `on` is false. */
+      devices = null;
+      level;
+      closesAtMs = 0;
+      constructor(descriptor) {
+        this.descriptor = descriptor;
+        this.level = descriptor.defaultLevel;
+      }
+      /** Epoch ms this channel disarms itself at. 0 when disarmed. */
+      get armedUntilMs() {
+        return this.on ? this.closesAtMs : 0;
+      }
+      /**
+      * Does this channel want a line about `deviceId`?
+      *
+      * Call it only behind `gate.on &&`. On its own it is still correct — the
+      * guard is repeated inside — but the point of the prefix is that a disarmed
+      * channel must not pay the call at all.
+      */
+      wants(deviceId) {
+        if (!this.on) return false;
+        return this.devices === null || this.devices.has(deviceId);
+      }
+      /**
+      * Emit one line on this channel, at the channel's declared level.
+      *
+      * The channel name is added as `tags.logChannel` so LogQL can select the
+      * channel without matching on the message text, and whatever `tags` the
+      * caller passed — `deviceId` above all — is preserved.
+      */
+      log(logger, message, extras) {
+        if (!this.on) return;
+        const tags = {
+          ...extras.tags,
+          logChannel: this.descriptor.name
+        };
+        const line = {
+          ...extras,
+          tags
+        };
+        if (this.level === "error") logger.error(message, line);
+        else if (this.level === "warn") logger.warn(message, line);
+        else logger.info(message, line);
+      }
+      /**
+      * Arm (or RE-arm, restarting) this channel. Off the hot path only.
+      *
+      * An empty `deviceIds` list is treated as "every camera" rather than "no
+      * camera": a window that matches nothing is indistinguishable from a
+      * disarmed one, and the operator who asked for it would wait for lines that
+      * can never come.
+      */
+      arm(window2) {
+        const ids = window2.deviceIds;
+        this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
+        this.closesAtMs = window2.armedUntilMs;
+        this.on = true;
+      }
+      /** Disarm. Off the hot path only. */
+      disarm() {
+        this.on = false;
+        this.devices = null;
+        this.closesAtMs = 0;
+      }
+    };
+    var LogChannelRegistry = class {
+      gates = /* @__PURE__ */ new Map();
+      /**
+      * Declare a channel and get its gate.
+      *
+      * A duplicate name throws. Two declarations of one name is a programming
+      * error, not a merge: the operator would arm one and the other would stay
+      * dark, which is the dead-knob shape (D62) with an extra step.
+      */
+      declare(descriptor) {
+        const parsed = LogChannelDescriptorSchema.parse(descriptor);
+        if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process \u2014 two declarations of one name is a programming error, not a merge`);
+        const gate = new LogChannelGate(parsed);
+        this.gates.set(parsed.name, gate);
+        return gate;
+      }
+      /** The declarations, sorted by name so a list is stable to read and diff. */
+      list() {
+        return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
+      }
+      /** The gate for a declared channel, or `undefined`. */
+      gate(name) {
+        return this.gates.get(name);
+      }
+      /**
+      * Apply the FULL set of armed windows. Off the hot path.
+      *
+      * Full, not incremental, and that is the whole design: the document is the
+      * authority, so a channel the document does not name is disarmed here. An
+      * incremental apply would let a disarm get lost in transit and leave a
+      * channel running that nobody can see is running.
+      *
+      * A window already past its deadline is ignored rather than armed — a
+      * restore that re-armed an expired window would make a forgotten diagnostic
+      * immortal across restarts.
+      *
+      * Returns the names it could not place, so the caller can log them: a
+      * channel named in the document that this process does not declare is
+      * either a typo or an addon that has not booted yet, and both deserve a
+      * line rather than silence.
+      */
+      apply(windows, nowMs) {
+        const wanted = /* @__PURE__ */ new Map();
+        const unknown = [];
+        for (const window2 of windows) {
+          if (window2.armedUntilMs <= nowMs) continue;
+          if (!this.gates.has(window2.channel)) {
+            unknown.push(window2.channel);
+            continue;
+          }
+          wanted.set(window2.channel, window2);
+        }
+        for (const [name, gate] of this.gates) {
+          const window2 = wanted.get(name);
+          if (window2 === void 0) gate.disarm();
+          else gate.arm(window2);
+        }
+        return unknown;
+      }
+      /**
+      * Disarm whatever has run out. Called on a timer, NEVER from a log path — a
+      * diagnostic that adds a `Date.now()` to the path it is measuring measures
+      * itself.
+      *
+      * Returns the names it closed, so the caller can write the one line that
+      * says a window ended and stops "it went quiet" from reading as "the branch
+      * was not taken".
+      */
+      tick(nowMs) {
+        const closed = [];
+        for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
+          gate.disarm();
+          closed.push(name);
+        }
+        return closed;
+      }
+      /** The channels armed right now, as the document would describe them. */
+      armed() {
+        const out = [];
+        for (const [name, gate] of this.gates) if (gate.on) out.push({
+          channel: name,
+          armedUntilMs: gate.armedUntilMs,
+          deviceIds: null
+        });
+        return out;
+      }
+    };
+    var instance = null;
+    function getLogChannelRegistry() {
+      instance ??= new LogChannelRegistry();
+      return instance;
+    }
+    function declareLogChannel(descriptor) {
+      return getLogChannelRegistry().declare(descriptor);
+    }
+    function __resetLogChannelRegistryForTests() {
+      instance = null;
+    }
+    var LOG_CHANNEL_TICK_MS = 5e3;
+    function createLogChannelsProvider(logger, options = {}) {
+      const registry = getLogChannelRegistry();
+      const now = options.now ?? Date.now;
+      const tickMs = options.tickMs ?? 5e3;
+      const timer = setInterval(() => {
+        const closed = registry.tick(now());
+        for (const name of closed) logger.info("log channel window closed", {
+          tags: { logChannel: name },
+          meta: { channel: name }
+        });
+      }, tickMs);
+      timer.unref?.();
+      return {
+        list: () => registry.list(),
+        apply: (input) => {
+          const unknown = registry.apply(input.windows, now());
+          const armed = registry.armed();
+          logger.info("log channels applied", { meta: {
+            armed: armed.map((window2) => window2.channel),
+            unknown,
+            declared: registry.list().length
+          } });
+          return {
+            armed: armed.length,
+            unknown
+          };
+        },
+        stop: () => {
+          clearInterval(timer);
+        }
+      };
+    }
     var OpsLogDomainSchema = zod.z.enum(["recording", "events"]);
     var OpsLogOpSchema = zod.z.enum([
       "prune",
@@ -208416,6 +209317,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       whereBetween: zod.z.record(zod.z.string(), zod.z.tuple([zod.z.unknown(), zod.z.unknown()])).optional(),
       whereNot: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
     });
+    var AggregateFieldSchema = zod.z.object({
+      /** Result key. */
+      as: zod.z.string().min(1),
+      /** Column to aggregate. Must be a real column of a declared collection. */
+      field: zod.z.string().min(1),
+      op: zod.z.enum([
+        "sum",
+        "min",
+        "max"
+      ])
+    });
+    var AggregateResultSchema = zod.z.object({
+      count: zod.z.number().int(),
+      values: zod.z.record(zod.z.string(), zod.z.number().nullable())
+    });
     var SettingsRecordSchema = zod.z.object({
       id: zod.z.string(),
       data: zod.z.record(zod.z.string(), zod.z.unknown())
@@ -208543,6 +209459,32 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           collection: zod.z.string(),
           filter: QueryFilterSchema.optional()
         }), zod.z.number()),
+        /**
+        * `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
+        * statement, over the rows `filter` selects.
+        *
+        * Exists because "how much is there" was being answered by materialising
+        * "what is there". The recorder's storage-pressure sweep asked its in-RAM
+        * footage index for bytes/count/oldest/newest across a set of storage
+        * locations twice a minute, and the only way to answer that from a map is
+        * to visit every row — 7.1 M of them on the live hub, ~15 M row visits a
+        * minute on the main thread, which is also why the whole archive had to
+        * stay resident to be visited. The question is a sum; nothing needs to be
+        * materialised to answer it.
+        *
+        * **The engine REFUSES a field it cannot serve**, exactly as
+        * `query.columns` does and unlike a PREDICATE, which is skipped when
+        * unresolvable. A dropped predicate over-matches and the caller sees extra
+        * rows; a dropped aggregate returns a NUMBER that is wrong and looks
+        * exactly like a real one. That asymmetry is what this repo has already
+        * paid for once in `count`.
+        */
+        aggregate: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          fields: zod.z.array(AggregateFieldSchema).readonly(),
+          filter: QueryFilterSchema.optional()
+        }), AggregateResultSchema),
         /** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
         histogram: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -208701,6 +209643,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           collection: zod.z.string(),
           filter: QueryFilterSchema.optional()
         }), zod.z.number(), { auth: "admin" }),
+        /** `COUNT(*)` plus one SUM/MIN/MAX per field, in one statement. Mirror of
+        *  `settings-store.aggregate` — see it for why an unresolvable field is
+        *  refused rather than dropped. */
+        aggregate: require_sleep.method(zod.z.object({
+          namespace: zod.z.string().optional(),
+          collection: zod.z.string(),
+          fields: zod.z.array(AggregateFieldSchema).readonly(),
+          filter: QueryFilterSchema.optional()
+        }), AggregateResultSchema, { auth: "admin" }),
         /** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
         histogram: require_sleep.method(zod.z.object({
           namespace: zod.z.string().optional(),
@@ -209415,6 +210366,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         })
       }
     };
+    var DEVICE_CHILDREN_BATCH_MAX = 256;
     var ChildLayoutEntrySchema = zod.z.object({
       childKey: zod.z.string(),
       section: zod.z.string(),
@@ -209896,6 +210848,39 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         /** List children of a parent device (by parent numeric id). */
         getChildren: require_sleep.method(zod.z.object({ parentDeviceId: zod.z.number() }), zod.z.array(DeviceInfoSchema)),
         /**
+        * `getChildren` for a NAMED SET of parents, in one call.
+        *
+        * The accessory reconcile in `device-cap-proxy.ts` asks this question once
+        * per registered device — every `BaseDevice` inherits a
+        * `getAccessoryChildren()` that returns `[]`, so even a leaf accessory
+        * pays a round-trip to learn it has nothing to prune. Measured on the live
+        * hub 2026-08-27 over a 120-second boot window, fleet of 1 017 devices:
+        * `DeviceRowStore.list < DeviceRowStore.listByParent < getChildren` at
+        * **1 024 calls** returning **919 rows in total** — 1 024 RPCs and 1 024
+        * indexed scans to move less than one row each. `listByParentMany`
+        * collapses the scans; this collapses the RPCs.
+        *
+        * Keyed by parent id as a STRING — a JSON object cannot key by number
+        * (same reason as `getDeviceStatusAggregateBatch`). The per-parent value
+        * is exactly what `getChildren` returns for that parent.
+        *
+        * A parent with no children — or one the fleet does not know — is ABSENT
+        * from the record, never an invented empty row: the same contract as
+        * `DeviceRowStore.getMany`/`listByParentMany`. An EMPTY `parentDeviceIds`
+        * reads nothing at all rather than degrading to "every device".
+        *
+        * `parentDeviceIds` is capped at {@link DEVICE_CHILDREN_BATCH_MAX} — see
+        * that constant for why. A caller with more parents than that sends more
+        * than one call; it never sends one pathological one.
+        *
+        * Version skew: this is a NEW method, not a new field on `getChildren`, so
+        * a hub that predates it answers NOT_FOUND rather than silently stripping
+        * an unknown input key and answering a DIFFERENT question. The kernel-side
+        * loader degrades to per-parent `getChildren` on that error — see
+        * `children-batch-loader.ts`.
+        */
+        getChildrenBatch: require_sleep.method(zod.z.object({ parentDeviceIds: zod.z.array(zod.z.number()).max(256) }), zod.z.record(zod.z.string(), zod.z.array(DeviceInfoSchema))),
+        /**
         * Resolve the devices LINKED to a camera — the single policy authority
         * both consumers call (viewer devices panel + pipeline-analytics event
         * kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
@@ -210947,6 +211932,38 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         })
       }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var LogLevelSchema = zod.z.enum([
       "debug",
       "info",
@@ -227266,6 +228283,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       scope: LoggingScopeKindSchema,
       /** The node this layer speaks for; `null` on the cluster layer. */
       nodeId: zod.z.string().nullable(),
+      /**
+      * The declared channel this layer speaks for; `null` on every layer but
+      * `component`. Never folded into `nodeId`: a component level is CLUSTER-WIDE
+      * by design — the convention this repo settled on is one orchestrator-wide
+      * setting, never per node (D52) — so a component layer that carried a node
+      * would invite a per-node copy of a value that has no per-node meaning.
+      */
+      component: zod.z.string().nullable(),
       /** Explicitly set here, or `null` when this layer inherits. */
       level: LogLevelSchema$1.nullable()
     });
@@ -227291,6 +228316,38 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
       reportEveryMs: zod.z.number().int().positive().optional()
     });
+    var LogChannelWindowStateSchema = zod.z.object({
+      channel: zod.z.string(),
+      armed: zod.z.boolean(),
+      /** Epoch ms the window closes at. 0 when disarmed. */
+      armedUntilMs: zod.z.number(),
+      /** Ms left before it expires on its own. 0 when disarmed. */
+      remainingMs: zod.z.number(),
+      /**
+      * The cameras it is narrowed to, or `null` for every camera.
+      *
+      * A channel declared `perDevice: false` can only ever report `null` here:
+      * its lines do not carry `tags: { deviceId }`, so narrowing them would
+      * produce a filter that silently matches nothing. The server REFUSES such a
+      * patch rather than quietly widening it — ignoring the request would teach
+      * the operator that per-camera filtering works on that channel when it does
+      * not.
+      */
+      deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+    });
+    var LogChannelWindowPatchSchema = zod.z.object({
+      channel: zod.z.string().min(1),
+      armMs: zod.z.number().int().min(0),
+      /**
+      * Narrow to these numeric device ids. Absent or `null` = every camera.
+      *
+      * Numeric because the repo's own rule makes it possible: every log line
+      * about a device carries `tags: { deviceId }` with the numeric id. That rule
+      * was paid for with a 22% thumbnail gap and a 3-hour media blackout both
+      * diagnosed by hand, and this is the first thing that collects on it.
+      */
+      deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable().optional()
+    });
     var LoggingSettingsPatchSchema = zod.z.object({
       /**
       * Absent leaves the level untouched. `null` CLEARS the explicit value at the
@@ -227301,19 +228358,50 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * Only the diagnostics NAMED here change. An armed window that is not listed
       * keeps running — a patch is never a full replacement.
       */
-      diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional()
+      diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional(),
+      /**
+      * Only the channels NAMED here change. An armed channel that is not listed
+      * keeps running — same rule as `diagnostics`, because a patch that silently
+      * disarmed the channels it did not mention would make the Levels page and
+      * the Diagnostics page fight over the same value.
+      */
+      channels: zod.z.array(LogChannelWindowPatchSchema).readonly().optional()
+    });
+    var GetLoggingSettingsInputSchema = zod.z.object({
+      scopeNodeId: zod.z.string().optional(),
+      /**
+      * The declared CHANNEL this document is addressed at, when the caller wants
+      * the `component` layer. Absent = the node/cluster hierarchy only.
+      *
+      * Naming it separately rather than overloading `scopeNodeId` keeps the two
+      * axes from collapsing: a component level is cluster-wide, a node level is
+      * not, and one selector for both would make "which of these two did I just
+      * set" unanswerable — the exact ambiguity `explicit` exists to remove.
+      */
+      scopeComponent: zod.z.string().optional()
     });
-    var GetLoggingSettingsInputSchema = zod.z.object({ scopeNodeId: zod.z.string().optional() });
     var SetLoggingSettingsInputSchema = zod.z.object({
       scopeNodeId: zod.z.string().optional(),
+      scopeComponent: zod.z.string().optional(),
       patch: LoggingSettingsPatchSchema
     });
     var LoggingSettingsStateSchema = zod.z.object({
       /** The layer this document was read at. `null` = the cluster layer. */
       scopeNodeId: zod.z.string().nullable(),
+      /** The channel this document was read at. `null` = no component layer. */
+      scopeComponent: zod.z.string().nullable(),
       effective: LoggingEffectiveSchema,
       explicit: LoggingExplicitSchema,
       activeWindows: zod.z.array(DiagnosticWindowSchema).readonly(),
+      /**
+      * Every channel the cluster's addons DECLARE, gathered from the
+      * `log-channels` providers. Not stored anywhere: assembled per read, so a
+      * channel added by a redeployed addon appears without anybody editing a
+      * list, and a channel whose addon is gone stops being offered.
+      */
+      channels: zod.z.array(LogChannelDescriptorSchema).readonly(),
+      /** The channels ARMED right now, each with its deadline. */
+      activeChannels: zod.z.array(LogChannelWindowStateSchema).readonly(),
       persisted: zod.z.boolean()
     });
     var systemCapability = {
@@ -230945,6 +232033,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       llmRuntime: "llm-runtime",
       localNetwork: "local-network",
       lockControl: "lock-control",
+      logChannels: "log-channels",
       logDestination: "log-destination",
       loginMethod: "login-method",
       mediaPlayer: "media-player",
@@ -231315,6 +232404,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         key: "lockControl",
         name: "lock-control"
       },
+      {
+        key: "logChannels",
+        name: "log-channels"
+      },
       {
         key: "logDestination",
         name: "log-destination"
@@ -231694,6 +232787,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       llmRuntimeCapability,
       localNetworkCapability,
       lockControlCapability,
+      logChannelsCapability,
       logDestinationCapability,
       loginMethodCapability,
       mediaPlayerCapability,
@@ -232660,6 +233754,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "dataStoreProvider.aggregate": {
+        capName: "data-store-provider",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "dataStoreProvider.count": {
         capName: "data-store-provider",
         capScope: "system",
@@ -233074,6 +234174,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "deviceManager.getChildrenBatch": {
+        capName: "device-manager",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "deviceManager.getConfigSchema": {
         capName: "device-manager",
         capScope: "system",
@@ -234124,6 +235230,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "logChannels.apply": {
+        capName: "log-channels",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "logChannels.list": {
+        capName: "log-channels",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "logDestination.query": {
         capName: "log-destination",
         capScope: "system",
@@ -236278,6 +237396,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "settingsStore.aggregate": {
+        capName: "settings-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "settingsStore.count": {
         capName: "settings-store",
         capScope: "system",
@@ -237626,6 +238750,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "llm-runtime",
       "local-network",
       "lock-control",
+      "log-channels",
       "log-destination",
       "login-method",
       "media-player",
@@ -237782,6 +238907,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "llm",
       "llm-runtime",
       "local-network",
+      "log-channels",
       "log-destination",
       "login-method",
       "mesh-network",
@@ -238109,6 +239235,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "deviceManager.getChildrenBatch": [{
+        name: "parentDeviceIds",
+        form: "array",
+        optional: false
+      }],
       "deviceManager.getConfigSchema": [{
         name: "deviceId",
         form: "single",
@@ -239583,6 +240714,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "deviceManager.getBindings",
       "deviceManager.getBindingsBatch",
       "deviceManager.getChildren",
+      "deviceManager.getChildrenBatch",
       "deviceManager.getConfigSchema",
       "deviceManager.getDevice",
       "deviceManager.getDeviceAggregate",
@@ -240275,6 +241407,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           listPersistedByAddon: (input) => dispatch("deviceManager", "listPersistedByAddon", "query", input),
           listAll: (input) => dispatch("deviceManager", "listAll", "query", input),
           getChildren: (input) => dispatch("deviceManager", "getChildren", "query", input),
+          getChildrenBatch: (input) => dispatch("deviceManager", "getChildrenBatch", "query", input),
           getLinkedDevicesBatch: (input) => dispatch("deviceManager", "getLinkedDevicesBatch", "query", input),
           removeByIntegration: (input) => dispatch("deviceManager", "removeByIntegration", "mutation", input),
           getBindingsBatch: (input) => dispatch("deviceManager", "getBindingsBatch", "query", input),
@@ -240589,6 +241722,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           deleteWhere: (input) => dispatch("settingsStore", "deleteWhere", "mutation", input),
           updateWhere: (input) => dispatch("settingsStore", "updateWhere", "mutation", input),
           count: (input) => dispatch("settingsStore", "count", "query", input),
+          aggregate: (input) => dispatch("settingsStore", "aggregate", "query", input),
           histogram: (input) => dispatch("settingsStore", "histogram", "query", input),
           isEmpty: (input) => dispatch("settingsStore", "isEmpty", "query", input),
           declareCollection: (input) => dispatch("settingsStore", "declareCollection", "mutation", input)
@@ -243598,6 +244732,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DETECTION_PIPELINE_CAP_NAME = DETECTION_PIPELINE_CAP_NAME;
     exports.DEVICE_BACKEND_TO_FORMAT = DEVICE_BACKEND_TO_FORMAT;
     exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
+    exports.DEVICE_CHILDREN_BATCH_MAX = DEVICE_CHILDREN_BATCH_MAX;
     exports.DEVICE_PROFILES = DEVICE_PROFILES;
     exports.DEVICE_SCOPED_CAPS = require_sleep.DEVICE_SCOPED_CAPS;
     exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_sleep.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
@@ -243748,6 +244883,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.IntercomStatusSchema = IntercomStatusSchema;
     exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
     exports.KeyEventSchema = KeyEventSchema;
+    exports.LOG_CHANNEL_TICK_MS = LOG_CHANNEL_TICK_MS;
     exports.LOG_LEVEL_RANK = LOG_LEVEL_RANK;
     exports.LabelAttributionSchema = LabelAttributionSchema;
     exports.LabelDefinitionSchema = LabelDefinitionSchema;
@@ -243783,6 +244919,14 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.LocationStatSchema = LocationStatSchema;
     exports.LockControlStatusSchema = LockControlStatusSchema;
     exports.LockStateSchema = LockStateSchema;
+    exports.LogChannelApplyResultSchema = LogChannelApplyResultSchema;
+    exports.LogChannelDescriptorSchema = LogChannelDescriptorSchema;
+    exports.LogChannelGate = LogChannelGate;
+    exports.LogChannelLevelSchema = LogChannelLevelSchema;
+    exports.LogChannelRegistry = LogChannelRegistry;
+    exports.LogChannelWindowPatchSchema = LogChannelWindowPatchSchema;
+    exports.LogChannelWindowSchema = LogChannelWindowSchema;
+    exports.LogChannelWindowStateSchema = LogChannelWindowStateSchema;
     exports.LogEntrySchema = LogEntrySchema;
     exports.LogLevelSchema = LogLevelSchema;
     exports.LogStreamEntrySchema = LogStreamEntrySchema;
@@ -244333,6 +245477,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.ZoneRulesArraySchema = ZoneRulesArraySchema;
     exports.ZoneSchema = ZoneSchema;
     exports.ZoneScopeBreakdownSchema = ZoneScopeBreakdownSchema;
+    exports.__resetLogChannelRegistryForTests = __resetLogChannelRegistryForTests;
     exports.accessoriesCapability = accessoriesCapability;
     exports.accessoryStableId = accessoryStableId;
     exports.addonPagesCapability = addonPagesCapability;
@@ -244429,6 +245574,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.createExpressionScope = createExpressionScope;
     exports.createHwAccelCache = createHwAccelCache;
     exports.createLazyTrpcSource = require_sleep.createLazyTrpcSource;
+    exports.createLogChannelsProvider = createLogChannelsProvider;
     exports.createMirrorSource = require_sleep.createMirrorSource;
     exports.createRuntimeStateBridge = createRuntimeStateBridge;
     exports.createSliceHandle = require_sleep.createSliceHandle;
@@ -244438,6 +245584,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.dataStoreProviderCapability = dataStoreProviderCapability;
     exports.dayNightCapability = dayNightCapability;
     exports.declarationOwnerNodeId = declarationOwnerNodeId;
+    exports.declareLogChannel = declareLogChannel;
     exports.decodeVectorBase64 = decodeVectorBase64;
     exports.decoderCapability = decoderCapability;
     exports.defaultDeliveryForSection = defaultDeliveryForSection;
@@ -244500,6 +245647,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.getAudioMacroClassIds = getAudioMacroClassIds;
     exports.getByPath = getByPath;
     exports.getCapsByProviderKind = getCapsByProviderKind;
+    exports.getLogChannelRegistry = getLogChannelRegistry;
     exports.getTaxonomyEntry = getTaxonomyEntry;
     exports.hasMotionTrigger = hasMotionTrigger;
     exports.hfModelUrl = hfModelUrl;
@@ -244553,6 +245701,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.locationSimilarity = locationSimilarity;
     exports.lockControlCapability = lockControlCapability;
     exports.logBannerArgs = require_canonical_hash.logBannerArgs;
+    exports.logChannelsCapability = logChannelsCapability;
     exports.logDestinationCapability = logDestinationCapability;
     exports.logLevelAtMost = logLevelAtMost;
     exports.loginMethodCapability = loginMethodCapability;
@@ -401844,17 +402993,55 @@ var require_logging_settings = __commonJS({
   "../../server/backend/dist/api/core/logging-settings.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.LoggingSettingsService = exports.HUB_NODE_ID = exports.LOGGING_SETTINGS_KEY = void 0;
+    exports.LoggingSettingsService = exports.MAX_CHANNEL_WINDOW_MS = exports.EMPTY_LOG_CHANNEL_PLANE = exports.HUB_NODE_ID = exports.LOGGING_SETTINGS_KEY = void 0;
+    exports.buildLogChannelPlane = buildLogChannelPlane;
     exports.toLoggingSettingsRecord = toLoggingSettingsRecord;
     exports.resolveLevel = resolveLevel;
     exports.describeLayers = describeLayers;
     exports.mergeLevel = mergeLevel;
+    exports.validateChannelPatch = validateChannelPatch;
+    exports.mergeChannelWindows = mergeChannelWindows;
+    exports.liveChannelWindows = liveChannelWindows;
+    exports.describeChannelWindows = describeChannelWindows;
     var types_1 = require_dist4();
     var system_1 = require_dist3();
     exports.LOGGING_SETTINGS_KEY = "logging-settings";
     var SYSTEM_SETTINGS_COLLECTION = "system-settings";
     exports.HUB_NODE_ID = "hub";
     var LOG_LEVELS = ["debug", "info", "warn", "error"];
+    exports.EMPTY_LOG_CHANNEL_PLANE = {
+      declarations: async () => [],
+      apply: async () => {
+      }
+    };
+    function buildLogChannelPlane(source, onProviderError) {
+      return {
+        declarations: async () => {
+          const seen = /* @__PURE__ */ new Map();
+          for (const [addonId, provider] of source.entries()) {
+            try {
+              for (const descriptor of await provider.list()) {
+                if (!seen.has(descriptor.name))
+                  seen.set(descriptor.name, descriptor);
+              }
+            } catch (err) {
+              onProviderError?.(addonId, "list", (0, types_1.errMsg)(err));
+            }
+          }
+          return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name));
+        },
+        apply: async (windows) => {
+          for (const [addonId, provider] of source.entries()) {
+            try {
+              await provider.apply({ windows });
+            } catch (err) {
+              onProviderError?.(addonId, "apply", (0, types_1.errMsg)(err));
+            }
+          }
+        }
+      };
+    }
+    exports.MAX_CHANNEL_WINDOW_MS = 30 * 6e4;
     var LoggingSettingsService = class {
       store;
       gate;
@@ -401862,6 +403049,7 @@ var require_logging_settings = __commonJS({
       localNodeId;
       logger;
       now;
+      channels;
       constructor(deps) {
         this.store = deps.store;
         this.gate = deps.gate;
@@ -401869,6 +403057,7 @@ var require_logging_settings = __commonJS({
         this.localNodeId = deps.localNodeId ?? exports.HUB_NODE_ID;
         this.logger = deps.logger;
         this.now = deps.now ?? Date.now;
+        this.channels = deps.channels ?? exports.EMPTY_LOG_CHANNEL_PLANE;
       }
       /**
        * The document as it stands, resolved for `nodeId` (absent = the cluster).
@@ -401877,9 +403066,9 @@ var require_logging_settings = __commonJS({
        * and, crucially, does not touch the mirror. What the operator sees is
        * honestly labelled as un-persisted; what the hub does is unchanged.
        */
-      async get(scopeNodeId) {
+      async get(scopeNodeId, scopeComponent) {
         const record = await this.read();
-        return this.describe(record, scopeNodeId ?? null);
+        return this.describe(record, scopeNodeId ?? null, scopeComponent ?? null);
       }
       /**
        * Apply a patch. Fields absent from it are untouched.
@@ -401889,28 +403078,47 @@ var require_logging_settings = __commonJS({
        * must still give the operator a live measurement, and must say so rather
        * than reporting a durable arm that is not durable.
        */
-      async set(patch, scopeNodeId) {
+      async set(patch, scopeNodeId, scopeComponent) {
         await this.applyDiagnostics(patch);
         const scope = scopeNodeId ?? null;
+        const component = scopeComponent ?? null;
         const stored = await this.read();
         const levelChanged = patch.level !== void 0;
-        let persistedLevel = true;
+        const channelsChanged = patch.channels !== void 0;
+        let persisted = true;
+        let next = stored ?? {};
         if (levelChanged) {
-          const next = mergeLevel(stored ?? {}, scope, patch.level ?? null, this.now());
-          persistedLevel = await this.write(next);
+          next = mergeLevel(next, scope, component, patch.level ?? null, this.now());
+        }
+        if (channelsChanged) {
+          const declared = await this.channels.declarations();
+          const rejected = validateChannelPatch(patch.channels ?? [], declared);
+          if (rejected.length > 0) {
+            this.logger?.warn("log channel patch refused - nothing was armed or disarmed", {
+              meta: { reasons: rejected }
+            });
+            throw new Error(`log channel patch refused: ${rejected.join("; ")}`);
+          }
+          next = mergeChannelWindows(next, patch.channels ?? [], this.now());
+        }
+        if (levelChanged || channelsChanged) {
+          persisted = await this.write(next);
           this.refreshMirror(next);
+          await this.pushChannels(next);
           this.logger?.info("logging settings written", {
             meta: {
-              scope: scope === null ? "cluster" : "node",
+              scope: component !== null ? "component" : scope === null ? "cluster" : "node",
               nodeId: scope,
-              level: patch.level ?? null,
-              persisted: persistedLevel
+              component,
+              level: levelChanged ? patch.level ?? null : void 0,
+              channels: (patch.channels ?? []).map((c) => `${c.channel}:${c.armMs}`),
+              persisted
             }
           });
-          const state = await this.describe(next, scope);
-          return { ...state, persisted: state.persisted && persistedLevel };
+          const state = await this.describe(next, scope, component);
+          return { ...state, persisted: state.persisted && persisted };
         }
-        return this.describe(stored, scope);
+        return this.describe(stored, scope, component);
       }
       /**
        * Re-establish the mirror and re-arm any diagnostic window that outlived the
@@ -401923,8 +403131,10 @@ var require_logging_settings = __commonJS({
        */
       async restore() {
         const record = await this.read();
-        if (record !== null)
+        if (record !== null) {
           this.refreshMirror(record);
+          await this.pushChannels(record);
+        }
         await this.requestCensus.restore();
       }
       // ── internals ─────────────────────────────────────────────────────
@@ -401942,16 +403152,55 @@ var require_logging_settings = __commonJS({
           });
         }
       }
-      async describe(record, scopeNodeId) {
-        const resolved = resolveLevel(record ?? {}, scopeNodeId);
+      /**
+       * Push the live windows to every declared gate.
+       *
+       * A failure here is logged and swallowed: the document is written and the
+       * operator is told what it says, and a runner that could not be reached
+       * simply keeps the mirror it has. Throwing would turn one unreachable addon
+       * into a failed write for the whole cluster.
+       */
+      async pushChannels(record) {
+        try {
+          await this.channels.apply(liveChannelWindows(record, this.now()));
+        } catch (err) {
+          this.logger?.warn("log channel windows written but NOT pushed to every gate", {
+            meta: { error: (0, types_1.errMsg)(err) }
+          });
+        }
+      }
+      async describe(record, scopeNodeId, scopeComponent) {
+        const resolved = resolveLevel(record ?? {}, scopeNodeId, scopeComponent);
         return {
           scopeNodeId,
+          scopeComponent,
           effective: { level: resolved.level, levelSource: resolved.source },
-          explicit: { layers: describeLayers(record ?? {}, scopeNodeId) },
+          explicit: { layers: describeLayers(record ?? {}, scopeNodeId, scopeComponent) },
           activeWindows: await this.describeWindows(),
+          channels: await this.declaredChannels(),
+          activeChannels: describeChannelWindows(record ?? {}, this.now()),
           persisted: record !== null
         };
       }
+      /**
+       * The declarations, assembled per read.
+       *
+       * Not cached and not stored: a channel added by a redeployed addon has to
+       * appear without anybody editing a list, and a channel whose addon is gone
+       * has to stop being offered. A read that throws yields the EMPTY list and
+       * says so — "unknown" is the truth about a set of addons nobody reached, and
+       * it changes no armed window (D49/D224).
+       */
+      async declaredChannels() {
+        try {
+          return await this.channels.declarations();
+        } catch (err) {
+          this.logger?.warn("log channel declarations unreadable - reporting none", {
+            meta: { error: (0, types_1.errMsg)(err) }
+          });
+          return [];
+        }
+      }
       /**
        * The armed windows, with their deadline.
        *
@@ -402015,14 +403264,21 @@ var require_logging_settings = __commonJS({
         return {};
       const clusterLevel = asLogLevel(Reflect.get(value, "clusterLevel"));
       const nodeLevels = asNodeLevels(Reflect.get(value, "nodeLevels"));
+      const componentLevels = asNodeLevels(Reflect.get(value, "componentLevels"));
+      const channelWindows = asChannelWindows(Reflect.get(value, "channelWindows"));
       const updatedAt = Reflect.get(value, "updatedAt");
       return {
         ...clusterLevel !== null ? { clusterLevel } : {},
         ...nodeLevels !== null ? { nodeLevels } : {},
+        ...componentLevels !== null ? { componentLevels } : {},
+        ...channelWindows !== null ? { channelWindows } : {},
         ...typeof updatedAt === "number" && Number.isFinite(updatedAt) ? { updatedAt } : {}
       };
     }
-    function resolveLevel(record, nodeId) {
+    function resolveLevel(record, nodeId, component = null) {
+      const componentLevel = component === null ? void 0 : record.componentLevels?.[component];
+      if (componentLevel !== void 0)
+        return { level: componentLevel, source: "component" };
       const nodeLevel = nodeId === null ? void 0 : record.nodeLevels?.[nodeId];
       if (nodeLevel !== void 0)
         return { level: nodeLevel, source: "node" };
@@ -402030,17 +403286,37 @@ var require_logging_settings = __commonJS({
         return { level: record.clusterLevel, source: "cluster" };
       return { level: system_1.DEFAULT_LOG_LEVEL, source: "default" };
     }
-    function describeLayers(record, nodeId) {
-      const cluster = {
-        scope: "cluster",
-        nodeId: null,
-        level: record.clusterLevel ?? null
-      };
-      if (nodeId === null)
-        return [cluster];
-      return [cluster, { scope: "node", nodeId, level: record.nodeLevels?.[nodeId] ?? null }];
+    function describeLayers(record, nodeId, component = null) {
+      const layers = [
+        { scope: "cluster", nodeId: null, component: null, level: record.clusterLevel ?? null }
+      ];
+      if (nodeId !== null) {
+        layers.push({
+          scope: "node",
+          nodeId,
+          component: null,
+          level: record.nodeLevels?.[nodeId] ?? null
+        });
+      }
+      if (component !== null) {
+        layers.push({
+          scope: "component",
+          nodeId: null,
+          component,
+          level: record.componentLevels?.[component] ?? null
+        });
+      }
+      return layers;
     }
-    function mergeLevel(record, nodeId, next, updatedAt) {
+    function mergeLevel(record, nodeId, component, next, updatedAt) {
+      if (component !== null) {
+        const { [component]: _clearedComponent, ...otherComponents } = record.componentLevels ?? {};
+        const componentLevels = {
+          ...otherComponents,
+          ...next !== null ? { [component]: next } : {}
+        };
+        return { ...record, componentLevels, updatedAt };
+      }
       if (nodeId === null) {
         const { clusterLevel: _dropped, ...rest } = record;
         return { ...rest, ...next !== null ? { clusterLevel: next } : {}, updatedAt };
@@ -402056,6 +403332,81 @@ var require_logging_settings = __commonJS({
         updatedAt
       };
     }
+    function validateChannelPatch(patches, declared) {
+      const byName = new Map(declared.map((d) => [d.name, d]));
+      const reasons = [];
+      for (const patch of patches) {
+        const descriptor = byName.get(patch.channel);
+        if (descriptor === void 0) {
+          const known = [...byName.keys()].sort().slice(0, 8).join(", ");
+          reasons.push(`"${patch.channel}" is not declared by any addon on this cluster` + (known.length > 0 ? ` (declared: ${known})` : ""));
+          continue;
+        }
+        const ids = patch.deviceIds;
+        if (ids !== void 0 && ids !== null && ids.length > 0 && !descriptor.perDevice) {
+          reasons.push(`"${patch.channel}" is declared perDevice: false \u2014 its lines carry no tags.deviceId, so narrowing it to a camera would match nothing`);
+        }
+      }
+      return reasons;
+    }
+    function mergeChannelWindows(record, patches, nowMs) {
+      const windows = { ...record.channelWindows };
+      for (const patch of patches) {
+        if (patch.armMs <= 0) {
+          delete windows[patch.channel];
+          continue;
+        }
+        const ids = patch.deviceIds;
+        windows[patch.channel] = {
+          armedUntilMs: nowMs + Math.min(patch.armMs, exports.MAX_CHANNEL_WINDOW_MS),
+          deviceIds: ids === void 0 || ids === null || ids.length === 0 ? null : [...ids]
+        };
+      }
+      return { ...record, channelWindows: windows, updatedAt: nowMs };
+    }
+    function liveChannelWindows(record, nowMs) {
+      const out = [];
+      for (const [channel, window2] of Object.entries(record.channelWindows ?? {})) {
+        if (window2.armedUntilMs <= nowMs)
+          continue;
+        out.push({ channel, armedUntilMs: window2.armedUntilMs, deviceIds: window2.deviceIds });
+      }
+      return out.sort((a, b) => a.channel.localeCompare(b.channel));
+    }
+    function describeChannelWindows(record, nowMs) {
+      const out = [];
+      for (const [channel, window2] of Object.entries(record.channelWindows ?? {})) {
+        const armed = window2.armedUntilMs > nowMs;
+        out.push({
+          channel,
+          armed,
+          armedUntilMs: armed ? window2.armedUntilMs : 0,
+          remainingMs: armed ? window2.armedUntilMs - nowMs : 0,
+          deviceIds: armed ? window2.deviceIds : null
+        });
+      }
+      return out.sort((a, b) => a.channel.localeCompare(b.channel));
+    }
+    function asChannelWindows(value) {
+      if (typeof value !== "object" || value === null)
+        return null;
+      const out = {};
+      for (const [key, raw] of Object.entries(value)) {
+        if (typeof raw !== "object" || raw === null)
+          continue;
+        const armedUntilMs = Reflect.get(raw, "armedUntilMs");
+        if (typeof armedUntilMs !== "number" || !Number.isFinite(armedUntilMs))
+          continue;
+        out[key] = { armedUntilMs, deviceIds: asDeviceIds(Reflect.get(raw, "deviceIds")) };
+      }
+      return out;
+    }
+    function asDeviceIds(value) {
+      if (!Array.isArray(value))
+        return null;
+      const ids = value.filter((id) => typeof id === "number" && Number.isInteger(id));
+      return ids.length > 0 ? ids : null;
+    }
     function asLogLevel(value) {
       return typeof value === "string" && isLogLevel(value) ? value : null;
     }
@@ -402692,10 +404043,14 @@ var require_cap_providers = __commonJS({
         store,
         ...logger !== void 0 ? { logger } : {}
       });
+      const channels = (0, logging_settings_js_1.buildLogChannelPlane)({ entries: () => registry?.getCollectionEntries("log-channels") ?? [] }, (addonId, phase, error) => {
+        logger?.warn("log-channels provider unreachable", { meta: { addonId, phase, error } });
+      });
       const loggingSettings = new logging_settings_js_1.LoggingSettingsService({
         store,
         gate: (0, system_1.getLoggingGate)(),
         requestCensus,
+        channels,
         ...logger !== void 0 ? { logger } : {}
       });
       return {
@@ -402729,8 +404084,8 @@ var require_cap_providers = __commonJS({
         setSiteLocation: async (input) => siteLocation.set(input),
         detectSiteLocation: async () => siteLocation.detect(),
         getRequestCensus: async () => requestCensus.status(),
-        getLoggingSettings: async (input) => loggingSettings.get(input.scopeNodeId),
-        setLoggingSettings: async (input) => loggingSettings.set(input.patch, input.scopeNodeId)
+        getLoggingSettings: async (input) => loggingSettings.get(input.scopeNodeId, input.scopeComponent),
+        setLoggingSettings: async (input) => loggingSettings.set(input.patch, input.scopeNodeId, input.scopeComponent)
       };
     }
     function buildSiteLocationService(registry, logger) {
@@ -405277,6 +406632,7 @@ var require_device_config_secret_redaction = __commonJS({
     exports.NON_ADMIN_CONFIG_REDACTED_METHODS = exports.REDACTED_SECRET = void 0;
     exports.isSecretConfigKey = isSecretConfigKey;
     exports.redactDeviceInfoSecrets = redactDeviceInfoSecrets;
+    exports.redactDeviceInfoRecordSecrets = redactDeviceInfoRecordSecrets;
     exports.redactSettingsSections = redactSettingsSections;
     exports.redactSettingsAggregate = redactSettingsAggregate;
     exports.redactConfigEntries = redactConfigEntries;
@@ -405314,6 +406670,14 @@ var require_device_config_secret_redaction = __commonJS({
         return data;
       return { ...data, config: redactRecord(config) };
     }
+    function redactDeviceInfoRecordSecrets(data) {
+      if (!isRecord(data))
+        return data;
+      const out = {};
+      for (const [key, value] of Object.entries(data))
+        out[key] = redactDeviceInfoSecrets(value);
+      return out;
+    }
     function redactField(field) {
       if (!isRecord(field))
         return field;
@@ -405372,6 +406736,7 @@ var require_device_config_secret_redaction = __commonJS({
       ["deviceManager.getDevice", redactDeviceInfoSecrets],
       ["deviceManager.listAll", redactDeviceInfoSecrets],
       ["deviceManager.getChildren", redactDeviceInfoSecrets],
+      ["deviceManager.getChildrenBatch", redactDeviceInfoRecordSecrets],
       ["deviceManager.getDeviceSettingsAggregate", redactSettingsSections],
       ["deviceManager.getSettingsSchema", redactSettingsSections],
       ["deviceManager.getDeviceAggregate", redactSettingsAggregate],
@@ -408962,6 +410327,234 @@ var require_addon_settings_provider = __commonJS({
   }
 });
 
+// ../../server/backend/dist/core/addon/single-flight-refresh.js
+var require_single_flight_refresh = __commonJS({
+  "../../server/backend/dist/core/addon/single-flight-refresh.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.createSingleFlightRefresh = createSingleFlightRefresh;
+    function widenScope(a, b) {
+      if (a === null || b === null)
+        return null;
+      const out = new Set(a);
+      for (const id of b)
+        out.add(id);
+      return out;
+    }
+    function createSingleFlightRefresh(run) {
+      let inFlight = null;
+      let pendingScope;
+      let pendingPromise = null;
+      let releasePending = () => {
+      };
+      const start = (scope) => {
+        const active = (async () => {
+          try {
+            await run(scope);
+          } finally {
+            inFlight = null;
+            if (pendingScope !== void 0) {
+              const next = pendingScope;
+              pendingScope = void 0;
+              const release = releasePending;
+              releasePending = () => {
+              };
+              pendingPromise = null;
+              void start(next).finally(release);
+            }
+          }
+        })();
+        inFlight = active;
+        return active;
+      };
+      return {
+        request: async (scope) => {
+          if (scope !== null && scope.size === 0)
+            return;
+          if (inFlight === null) {
+            await start(scope);
+            return;
+          }
+          pendingScope = pendingScope === void 0 ? scope : widenScope(pendingScope, scope);
+          if (pendingPromise === null) {
+            pendingPromise = new Promise((resolve) => {
+              releasePending = resolve;
+            });
+          }
+          const wait = pendingPromise;
+          if (wait !== null)
+            await wait;
+        }
+      };
+    }
+  }
+});
+
+// ../../server/backend/dist/core/addon/device-meta-mirror.js
+var require_device_meta_mirror = __commonJS({
+  "../../server/backend/dist/core/addon/device-meta-mirror.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DeviceMetaMirror = exports.MIRROR_IRRELEVANT_META_FIELDS = void 0;
+    exports.classifyDeviceEvent = classifyDeviceEvent;
+    var types_1 = require_dist4();
+    var single_flight_refresh_js_1 = require_single_flight_refresh();
+    exports.MIRROR_IRRELEVANT_META_FIELDS = /* @__PURE__ */ new Set([
+      "name",
+      "disabled",
+      "metadata",
+      "display",
+      "role",
+      "integrationId",
+      "linkDeviceId",
+      "primaryChildEntityId",
+      "childLayout"
+    ]);
+    function classifyDeviceEvent(data) {
+      if (data === null || typeof data !== "object")
+        return { kind: "fleet" };
+      const field = Reflect.get(data, "field");
+      if (typeof field === "string" && exports.MIRROR_IRRELEVANT_META_FIELDS.has(field)) {
+        return { kind: "none" };
+      }
+      const deviceId = Reflect.get(data, "deviceId");
+      if (typeof deviceId !== "number" || !Number.isFinite(deviceId))
+        return { kind: "fleet" };
+      return { kind: "device", deviceId };
+    }
+    var MAX_ANCESTOR_HOPS = 8;
+    var DeviceMetaMirror = class {
+      read;
+      live;
+      logger;
+      parents = /* @__PURE__ */ new Map();
+      meta = /* @__PURE__ */ new Map();
+      gate;
+      constructor(read, live, logger) {
+        this.read = read;
+        this.live = live;
+        this.logger = logger;
+        this.gate = (0, single_flight_refresh_js_1.createSingleFlightRefresh)((scope) => this.refresh(scope));
+      }
+      /** Ask for a refresh covering exactly what the event changed. */
+      onDeviceEvent(data) {
+        const scope = classifyDeviceEvent(data);
+        if (scope.kind === "none")
+          return;
+        void this.gate.request(scope.kind === "fleet" ? null : /* @__PURE__ */ new Set([scope.deviceId]));
+      }
+      /** Warm (or re-warm) the whole fleet — the boot sweep, and the D8 reconcile
+       *  that repairs anything a dropped event would have left behind. */
+      async refreshAll() {
+        await this.gate.request(null);
+      }
+      /** Parent of a device: mirror first (covers forked devices), then the live
+       *  hub registry (covers a hub-local device before the first warm). */
+      parentOf(deviceId) {
+        const mirrored = this.parents.get(deviceId);
+        if (mirrored !== void 0)
+          return mirrored;
+        return this.live.parentDeviceId(deviceId);
+      }
+      /** Persisted `DeviceType` string, or null when unknown. */
+      typeOf(deviceId) {
+        const mirrored = this.meta.get(deviceId);
+        if (mirrored !== void 0)
+          return mirrored.type;
+        return this.live.type(deviceId);
+      }
+      /** Persisted operator `location` label, or null when unset/unknown. */
+      locationOf(deviceId) {
+        const mirrored = this.meta.get(deviceId);
+        if (mirrored !== void 0)
+          return mirrored.location;
+        return this.live.location(deviceId);
+      }
+      /** The whole mirrored fleet — fuels fleet-wide selector expansion. */
+      list() {
+        const out = [];
+        for (const [id, m] of this.meta) {
+          out.push({
+            id,
+            type: m.type,
+            location: m.location,
+            parentDeviceId: this.parents.get(id) ?? null
+          });
+        }
+        return out;
+      }
+      /** Ancestor chain (parent, grandparent, …), bounded. Empty for a top-level
+       *  device or one the hub has never heard of. */
+      ancestorsOf(deviceId) {
+        const out = [];
+        let current = deviceId;
+        for (let hop = 0; hop < MAX_ANCESTOR_HOPS; hop++) {
+          const parent = this.parentOf(current);
+          if (parent === null || parent === current)
+            break;
+          out.push(parent);
+          current = parent;
+        }
+        return out;
+      }
+      async refresh(scope) {
+        try {
+          const ids = scope === null ? null : [...scope];
+          const rows = await this.read(ids);
+          if (!Array.isArray(rows))
+            return;
+          const nextParents = /* @__PURE__ */ new Map();
+          const nextMeta = /* @__PURE__ */ new Map();
+          for (const row of rows) {
+            if (row === null || typeof row !== "object")
+              continue;
+            const id = Reflect.get(row, "id");
+            if (typeof id !== "number")
+              continue;
+            const parent = Reflect.get(row, "parentDeviceId");
+            if (typeof parent === "number")
+              nextParents.set(id, parent);
+            const type = Reflect.get(row, "type");
+            const location = Reflect.get(row, "location");
+            nextMeta.set(id, {
+              type: typeof type === "string" ? type : "",
+              location: typeof location === "string" ? location : null
+            });
+          }
+          if (ids === null) {
+            this.parents.clear();
+            for (const [k, v] of nextParents)
+              this.parents.set(k, v);
+            this.meta.clear();
+            for (const [k, v] of nextMeta)
+              this.meta.set(k, v);
+            return;
+          }
+          for (const id of ids) {
+            const m = nextMeta.get(id);
+            if (m === void 0) {
+              this.parents.delete(id);
+              this.meta.delete(id);
+              continue;
+            }
+            this.meta.set(id, m);
+            const parent = nextParents.get(id);
+            if (parent === void 0)
+              this.parents.delete(id);
+            else
+              this.parents.set(id, parent);
+          }
+        } catch (err) {
+          this.logger.debug("device-meta mirror refresh failed \u2014 keeping previous", {
+            meta: { error: (0, types_1.errMsg)(err), scope: scope === null ? "fleet" : scope.size }
+          });
+        }
+      }
+    };
+    exports.DeviceMetaMirror = DeviceMetaMirror;
+  }
+});
+
 // ../../server/backend/dist/core/addon/integration-visibility.js
 var require_integration_visibility = __commonJS({
   "../../server/backend/dist/core/addon/integration-visibility.js"(exports) {
@@ -409221,58 +410814,6 @@ var require_runner_spawn_fanout = __commonJS({
   }
 });
 
-// ../../server/backend/dist/core/addon/single-flight-refresh.js
-var require_single_flight_refresh = __commonJS({
-  "../../server/backend/dist/core/addon/single-flight-refresh.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.createSingleFlightRefresh = createSingleFlightRefresh;
-    function createSingleFlightRefresh(run) {
-      let inFlight = null;
-      let pending = false;
-      let pendingPromise = null;
-      let releasePending = () => {
-      };
-      const start = () => {
-        const active = (async () => {
-          try {
-            await run();
-          } finally {
-            inFlight = null;
-            if (pending) {
-              pending = false;
-              const release = releasePending;
-              releasePending = () => {
-              };
-              pendingPromise = null;
-              void start().finally(release);
-            }
-          }
-        })();
-        inFlight = active;
-        return active;
-      };
-      return {
-        request: async () => {
-          if (inFlight === null) {
-            await start();
-            return;
-          }
-          if (!pending) {
-            pending = true;
-            pendingPromise = new Promise((resolve) => {
-              releasePending = resolve;
-            });
-          }
-          const wait = pendingPromise;
-          if (wait !== null)
-            await wait;
-        }
-      };
-    }
-  }
-});
-
 // ../../server/backend/dist/core/addon/addon-registry.service.js
 var require_addon_registry_service = __commonJS({
   "../../server/backend/dist/core/addon/addon-registry.service.js"(exports) {
@@ -409329,13 +410870,13 @@ var require_addon_registry_service = __commonJS({
     var addon_call_gateway_js_1 = require_addon_call_gateway();
     var addon_row_manifest_1 = require_addon_row_manifest();
     var addon_settings_provider_js_1 = require_addon_settings_provider();
+    var device_meta_mirror_js_1 = require_device_meta_mirror();
     var integration_visibility_js_1 = require_integration_visibility();
     var package_dir_utils_1 = require_package_dir_utils();
     var prune_misplaced_addons_js_1 = require_prune_misplaced_addons();
     var require_cache_js_1 = require_require_cache();
     var runner_convergence_1 = require_runner_convergence();
     var runner_spawn_fanout_js_1 = require_runner_spawn_fanout();
-    var single_flight_refresh_js_1 = require_single_flight_refresh();
     function shouldEvictMissingOnDisk(entry, id, onDiskIds) {
       return entry.source === "installed" && entry.packageName !== "@camstack/system" && !onDiskIds.has(id);
     }
@@ -409542,6 +411083,14 @@ var require_addon_registry_service = __commonJS({
         this.streamProbe = streamProbe;
         this.logger = this.loggingService.createLogger("AddonRegistry");
         this.addonLoader = new system_1.AddonLoader(this.loggingService.createLogger("AddonLoader"));
+        this.deviceMirror = new device_meta_mirror_js_1.DeviceMetaMirror(async (deviceIds) => this.getBrokerApi().deviceManager.listAll.query({
+          projection: "slim",
+          ...deviceIds === null ? {} : { deviceIds: [...deviceIds] }
+        }), {
+          parentDeviceId: (deviceId) => this.deviceRegistry.getById(deviceId)?.parentDeviceId ?? null,
+          type: (deviceId) => this.deviceRegistry.getById(deviceId)?.type ?? null,
+          location: (deviceId) => this.deviceRegistry.getById(deviceId)?.location ?? null
+        }, this.logger);
         this.healthMonitor = new system_1.AddonHealthMonitor({
           eventBus: this.eventBusService,
           logger: this.loggingService.createLogger("AddonHealthMonitor"),
@@ -410103,56 +411652,22 @@ var require_addon_registry_service = __commonJS({
       // fleet — forked devices included. This is a hub-process, SYNCHRONOUSLY
       // readable mirror of that parentage, refreshed OFF the request path on every
       // device-meta lifecycle event — never a per-call DB query.
-      deviceParentMirror = /* @__PURE__ */ new Map();
-      /**
-       * Hub-process mirror of each device's persisted `type` + `location`, warmed
-       * from the same `listAll({projection:'slim'})` sweep as the parent mirror.
-       * Backs the v3 scope-model `types` / `locations` selectors: the enforcement
-       * matcher resolves a selector against a device's type/location synchronously,
-       * off the request path (D49). Empty for a device the hub has never heard of.
-       */
-      deviceMetaMirror = /* @__PURE__ */ new Map();
-      /** Parent of a device: the persisted mirror first (covers forked devices),
-       *  falling back to the live hub registry (covers a hub-local device before the
-       *  first mirror warm). null when top-level or unknown. */
-      parentOfDevice(deviceId) {
-        const mirrored = this.deviceParentMirror.get(deviceId);
-        if (mirrored !== void 0)
-          return mirrored;
-        return this.deviceRegistry.getById(deviceId)?.parentDeviceId ?? null;
-      }
+      //
+      // The mirror itself, and the rule that decides how much of the fleet one
+      // event may re-read, live in `device-meta-mirror.ts` — with the 4 904-call /
+      // 4 987 368-row boot census that made the rule necessary.
+      deviceMirror;
       /** Persisted `DeviceType` string of a device, or null when unknown. Mirror
        *  first (covers forked devices), then the live hub registry. */
-      getPersistedType = (deviceId) => {
-        const mirrored = this.deviceMetaMirror.get(deviceId);
-        if (mirrored !== void 0)
-          return mirrored.type;
-        return this.deviceRegistry.getById(deviceId)?.type ?? null;
-      };
+      getPersistedType = (deviceId) => this.deviceMirror.typeOf(deviceId);
       /** Persisted operator `location` label of a device, or null when unset/unknown. */
-      getPersistedLocation = (deviceId) => {
-        const mirrored = this.deviceMetaMirror.get(deviceId);
-        if (mirrored !== void 0)
-          return mirrored.location;
-        return this.deviceRegistry.getById(deviceId)?.location ?? null;
-      };
+      getPersistedLocation = (deviceId) => this.deviceMirror.locationOf(deviceId);
       /**
        * The whole persisted fleet, slim — id + type + location + parentDeviceId.
        * Fuels the FLEET-wide selector expansion (response projection + `auth.me`
        * counts). Read synchronously off the mirror, never a per-call DB query.
        */
-      getPersistedDeviceList = () => {
-        const out = [];
-        for (const [id, m] of this.deviceMetaMirror) {
-          out.push({
-            id,
-            type: m.type,
-            location: m.location,
-            parentDeviceId: this.deviceParentMirror.get(id) ?? null
-          });
-        }
-        return out;
-      };
+      getPersistedDeviceList = () => this.deviceMirror.list();
       /**
        * Ancestor chain (parent, grandparent, …) of a device, bounded to 8 hops
        * (defence-in-depth against a corrupt registry cycle). Synchronous — it is
@@ -410160,80 +411675,31 @@ var require_addon_registry_service = __commonJS({
        * a FORKED camera covers its accessory children. Empty for a top-level device
        * or one the hub has never heard of.
        */
-      getPersistedAncestors = (deviceId) => {
-        const out = [];
-        let current = deviceId;
-        for (let hop = 0; hop < 8; hop++) {
-          const parent = this.parentOfDevice(current);
-          if (parent == null || parent === current)
-            break;
-          out.push(parent);
-          current = parent;
-        }
-        return out;
-      };
-      /** One full-fleet rebuild in flight, at most one queued behind it. Every
-       *  event below asks for the SAME total rebuild, so running it once per event
-       *  was ~1 000 rebuilds of a 974-row mirror on a boot — each one a 625 KB read
-       *  and parse on hub-main's event loop. No timer: the first event still
-       *  refreshes immediately, because this mirror backs scope enforcement.
-       *  See `single-flight-refresh.ts`. */
-      deviceMirrorGate = (0, single_flight_refresh_js_1.createSingleFlightRefresh)(() => this.refreshDeviceParentMirror());
-      /** Subscribe the mirror to every device-meta lifecycle event, and warm it once
-       *  the addon set (device-manager included) is up. */
+      getPersistedAncestors = (deviceId) => this.deviceMirror.ancestorsOf(deviceId);
+      /**
+       * Subscribe the mirror to every device-meta lifecycle event, and warm it once
+       * the addon set (device-manager included) is up.
+       *
+       * The device events ask for a SCOPED refresh — the one device they name, or
+       * nothing at all when they name a field the mirror does not hold.
+       * `SystemAddonsReady` is the only fleet-wide read, and it is also the D8
+       * reconcile: whatever a dropped event would have left stale, the warm
+       * repairs.
+       */
       wireDeviceParentMirror() {
-        const refresh = () => {
-          void this.deviceMirrorGate.request();
-        };
         for (const category of [
           types_1.EventCategory.DeviceMetaChanged,
           types_1.EventCategory.DeviceRegistered,
           types_1.EventCategory.DeviceUnregistered,
-          types_1.EventCategory.DeviceProvisioned,
-          types_1.EventCategory.SystemAddonsReady
+          types_1.EventCategory.DeviceProvisioned
         ]) {
-          this.eventBusService.subscribe({ category }, refresh);
-        }
-      }
-      /** Rebuild the parent mirror from the device-manager's persisted fleet
-       *  (`listAll`, slim projection — no config blob). Off the request path; a
-       *  failed read KEEPS the previous mirror (D49 — a read that fails changes
-       *  nothing, and must never look like an unbind that destroys inheritance). */
-      async refreshDeviceParentMirror() {
-        try {
-          const api = this.getBrokerApi();
-          const rows = await api.deviceManager.listAll.query({ projection: "slim" });
-          if (!Array.isArray(rows))
-            return;
-          const nextParents = /* @__PURE__ */ new Map();
-          const nextMeta = /* @__PURE__ */ new Map();
-          for (const row of rows) {
-            if (row === null || typeof row !== "object")
-              continue;
-            const id = Reflect.get(row, "id");
-            if (typeof id !== "number")
-              continue;
-            const parent = Reflect.get(row, "parentDeviceId");
-            if (typeof parent === "number")
-              nextParents.set(id, parent);
-            const type = Reflect.get(row, "type");
-            const location = Reflect.get(row, "location");
-            nextMeta.set(id, {
-              type: typeof type === "string" ? type : "",
-              location: typeof location === "string" ? location : null
-            });
-          }
-          this.deviceParentMirror.clear();
-          for (const [k, v] of nextParents)
-            this.deviceParentMirror.set(k, v);
-          this.deviceMetaMirror.clear();
-          for (const [k, v] of nextMeta)
-            this.deviceMetaMirror.set(k, v);
-        } catch (err) {
-          this.logger.debug("device-parent mirror refresh failed \u2014 keeping previous", {
-            meta: { error: (0, types_1.errMsg)(err) }
+          this.eventBusService.subscribe({ category }, (event) => {
+            this.deviceMirror.onDeviceEvent(event.data);
           });
         }
+        this.eventBusService.subscribe({ category: types_1.EventCategory.SystemAddonsReady }, () => {
+          void this.deviceMirror.refreshAll();
+        });
       }
       /** Load persisted collection disabled-lists from settings-store into the registry */
       loadCollectionPreferences() {
@@ -416301,7 +417767,7 @@ var require_main4 = __commonJS({
     async function bootstrap() {
       const heapReclaimer = (0, system_1.createV8Reclaimer)();
       const heapReclaim = heapReclaimer === void 0 ? void 0 : { reclaim: heapReclaimer };
-      (0, system_1.startHeapWatch)("hub-main", void 0, void 0, heapReclaim);
+      (0, system_1.startHeapWatch)("hub-main", void 0, void 0, heapReclaim, void 0, void 0, true, (0, system_1.hubMainRssBudget)());
       cleanupOrphanProcesses();
       let spaIndexHtml = null;
       const configPath = process.env.CONFIG_PATH ?? path.join(process.env.CAMSTACK_DATA ?? path.join(process.cwd(), "camstack-data"), "config.yaml");