camstack 1.2.58 → 1.2.60

package/dist/{launcher-AL5IQ6H2.js → launcher-CL4LHR6D.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-CxgTulEG.js
-var require_dist_CxgTulEG = __commonJS({
-  "../system/dist/dist-CxgTulEG.js"(exports) {
+// ../system/dist/dist-BPlfW-CG.js
+var require_dist_BPlfW_CG = __commonJS({
+  "../system/dist/dist-BPlfW-CG.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -32718,6 +32718,38 @@ var require_dist_CxgTulEG = __commonJS({
       /** Wall-clock uptime (seconds). Parsed from `ps etime`. */
       uptimeSec: zod.z.number()
     });
+    var ContainerMemoryPointSchema = zod.z.object({
+      /** Which hierarchy answered, so a reading is never ambiguous. */
+      source: zod.z.enum(["cgroup-v2", "cgroup-v1"]),
+      /** `memory.current` (v2) / `memory.usage_in_bytes` (v1). Always known. */
+      currentBytes: zod.z.number(),
+      /** The cgroup's ceiling. `null` = NO LIMIT — never a sentinel, never zero. */
+      limitBytes: zod.z.number().nullable(),
+      /** Anonymous pages: the closest thing to "what the processes allocated". */
+      anonBytes: zod.z.number().nullable(),
+      /** Page cache. Charged to the cgroup, owned by no process. */
+      fileBytes: zod.z.number().nullable(),
+      /**
+      * Shared memory — and the field that explained the largest single surprise.
+      * The i915 driver backs GPU buffers with shmem, so an inference pool or a
+      * hardware-decode session holding DRM objects is charged HERE and appears
+      * nowhere in a `ps` scan.
+      */
+      shmemBytes: zod.z.number().nullable(),
+      /** Kernel slab charged to this cgroup. `null` on v1, which never publishes it. */
+      slabBytes: zod.z.number().nullable(),
+      /**
+      * Shrinkable i915 GEM object bytes, from debugfs.
+      *
+      * **Host-wide across every DRM client, NOT cgroup-scoped.** It is not a
+      * component of `currentBytes` and must not be subtracted from it; it says
+      * what put the shmem there, where `shmemBytes` only says how much.
+      *
+      * `null` wherever debugfs is not mounted — which is inside every camstack
+      * container today — and on any node with no Intel GPU.
+      */
+      gpuShmemBytes: zod.z.number().nullable()
+    }).extend({ atMs: zod.z.number() });
     var DumpHeapSnapshotInputSchema = zod.z.object({
       /** The addon whose runner should dump a heap snapshot. */
       addonId: zod.z.string()
@@ -32767,6 +32799,21 @@ var require_dist_CxgTulEG = __commonJS({
       /** One entry per function seen in the window, heaviest-first. */
       series: zod.z.array(LoadFunctionSeriesSchema).readonly(),
       /**
+      * The CONTAINER's memory over the same window, oldest-first.
+      *
+      * Sits next to `series` rather than in a method of its own because the whole
+      * question is a subtraction: the per-process rows in `series` sum to one
+      * number and this one is another, and an operator who has to issue two calls
+      * to compare them will compare two different instants. Same reader, same
+      * `sinceMs`, same `bucketMs`, same timestamps.
+      *
+      * **EMPTY means ABSENT, never zero.** A node with no cgroup — a developer
+      * Mac, a bare-metal host, a container with the hierarchy hidden — reports no
+      * points at all. A zero here would be indistinguishable from a healthy
+      * container and is precisely the lie this field exists to avoid.
+      */
+      containerMemory: zod.z.array(ContainerMemoryPointSchema).readonly(),
+      /**
       * Width of one returned bucket, in ms. Equals the sampling cadence when no
       * reduction was needed — so a caller can always say what one point covers
       * without having to know whether it was reduced.
@@ -43598,6 +43645,33 @@ var require_dist_CxgTulEG = __commonJS({
       deviceNative: true,
       mode: "singleton",
       deviceTypes: [DeviceType.Camera],
+      /**
+      * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+      *
+      * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+      * cap has no configuration surface at all: all six methods open, feed and
+      * close one live audio session against one `deviceId`. That is the same
+      * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+      * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+      * `admin` because they change what the device IS.
+      *
+      * `protected` does not mean ungated: `protectedProcedure` runs the
+      * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+      * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+      * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+      * only) still cannot talk, and a grant on camera 5 cannot talk through
+      * camera 7.
+      *
+      * Every method was `auth: 'admin'` from the initial commit, which made the
+      * cap unreachable by every non-admin principal — `adminProcedure` throws
+      * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+      * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+      * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+      * `camera-operator` scope preset has promised "PTZ control, intercom,
+      * snapshots" since that same commit; the promise could not be kept. Recorded
+      * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+      * preset promises a cap no row of that preset can reach.
+      */
       methods: {
         /**
         * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -43610,7 +43684,7 @@ var require_dist_CxgTulEG = __commonJS({
           sdpOffer: zod.z.string()
         }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         handleAnswer: method(zod.z.object({
           deviceId: zod.z.number(),
@@ -43618,7 +43692,7 @@ var require_dist_CxgTulEG = __commonJS({
           sdpAnswer: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close explicitly. Server also auto-closes on 30s idle. */
         stopSession: method(zod.z.object({
@@ -43626,7 +43700,7 @@ var require_dist_CxgTulEG = __commonJS({
           sessionId: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -43639,7 +43713,7 @@ var require_dist_CxgTulEG = __commonJS({
         */
         startTalkSession: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Push one chunk of talk-back audio onto the active talk session.
@@ -43674,12 +43748,12 @@ var require_dist_CxgTulEG = __commonJS({
           sequenceNumber: zod.z.number().int()
         }), zod.z.object({ accepted: zod.z.boolean() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close the raw-PCM talk session. Idempotent. */
         endTalkSession: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         })
       },
       events: { onStatusChanged: { data: zod.z.object({
@@ -58639,7 +58713,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59458,7 +59532,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59552,7 +59626,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60449,11 +60523,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-BbjWjol0.js
-var require_retired_settings_keys_BbjWjol0 = __commonJS({
-  "../system/dist/retired-settings-keys-BbjWjol0.js"(exports) {
+// ../system/dist/retired-settings-keys-DBY6ebwV.js
+var require_retired_settings_keys_DBY6ebwV = __commonJS({
+  "../system/dist/retired-settings-keys-DBY6ebwV.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62667,8 +62741,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
-    var require_retired_settings_keys = require_retired_settings_keys_BbjWjol0();
+    var require_dist10 = require_dist_BPlfW_CG();
+    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67417,7 +67491,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67554,7 +67628,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67744,7 +67818,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75557,7 +75631,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76122,14 +76196,859 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
-    var node_os = __require("os");
-    node_os = require_chunk.__toESM(node_os);
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
+    var node_os = __require("os");
+    node_os = require_chunk.__toESM(node_os);
+    var nodeCgroupFileReader = { read(path) {
+      try {
+        return (0, node_fs.readFileSync)(path, "utf8");
+      } catch {
+        return null;
+      }
+    } };
+    var CGROUP_MOUNT_ROOT = "/sys/fs/cgroup";
+    var I915_GEM_OBJECTS_PATH = "/sys/kernel/debug/dri/0/i915_gem_objects";
+    var V1_UNLIMITED_SENTINEL = 9223372036854772e3;
+    function parseCgroupSelf(text) {
+      let v1 = null;
+      for (const rawLine of text.split("\n")) {
+        const line = rawLine.trim();
+        if (line.length === 0) continue;
+        const first = line.indexOf(":");
+        if (first < 0) continue;
+        const second = line.indexOf(":", first + 1);
+        if (second < 0) continue;
+        const controllers = line.slice(first + 1, second);
+        const path = line.slice(second + 1);
+        if (path.length === 0) continue;
+        const normalized = path.startsWith("/") ? path : `/${path}`;
+        if (controllers.length === 0) return {
+          version: "v2",
+          path: normalized
+        };
+        if (v1 === null && controllers.split(",").includes("memory")) v1 = {
+          version: "v1",
+          path: normalized
+        };
+      }
+      return v1;
+    }
+    function parseCgroupStat(text) {
+      const out = /* @__PURE__ */ new Map();
+      for (const rawLine of text.split("\n")) {
+        const line = rawLine.trim();
+        if (line.length === 0) continue;
+        const space = line.indexOf(" ");
+        if (space <= 0) continue;
+        const key = line.slice(0, space);
+        const value = Number(line.slice(space + 1).trim());
+        if (!Number.isFinite(value)) continue;
+        out.set(key, value);
+      }
+      return out;
+    }
+    function parseCgroupScalar(text) {
+      const trimmed = text.trim();
+      if (trimmed.length === 0) return null;
+      if (trimmed === "max") return null;
+      const value = Number(trimmed);
+      if (!Number.isFinite(value) || value < 0) return null;
+      if (value >= V1_UNLIMITED_SENTINEL) return null;
+      return value;
+    }
+    function parseI915GemObjects(text) {
+      const match = text.match(/^\s*\d+\s+shrinkable\b[^,\n]*,\s*(\d+)\s+bytes/m);
+      if (match === null) return null;
+      const bytes = Number(match[1]);
+      return Number.isFinite(bytes) ? bytes : null;
+    }
+    function resolveCgroupMemoryLayout(fs) {
+      const selfText = fs.read("/proc/self/cgroup");
+      if (selfText === null) return null;
+      const entry = parseCgroupSelf(selfText);
+      if (entry === null) return null;
+      const suffix = entry.path === "/" ? "" : entry.path;
+      const candidates = entry.version === "v2" ? [`${CGROUP_MOUNT_ROOT}${suffix}`, CGROUP_MOUNT_ROOT] : [`${CGROUP_MOUNT_ROOT}/memory${suffix}`, `${CGROUP_MOUNT_ROOT}/memory`];
+      const usageFile = entry.version === "v2" ? "memory.current" : "memory.usage_in_bytes";
+      const limitFile = entry.version === "v2" ? "memory.max" : "memory.limit_in_bytes";
+      for (const directory of candidates) {
+        if (fs.read(`${directory}/${usageFile}`) === null) continue;
+        return {
+          source: entry.version === "v2" ? "cgroup-v2" : "cgroup-v1",
+          directory,
+          currentPath: `${directory}/${usageFile}`,
+          limitPath: `${directory}/${limitFile}`,
+          statPath: `${directory}/memory.stat`
+        };
+      }
+      return null;
+    }
+    function statValue(stat, key) {
+      const value = stat.get(key);
+      return value === void 0 ? null : value;
+    }
+    function resolveSlab(stat) {
+      const direct = statValue(stat, "slab");
+      if (direct !== null) return direct;
+      const reclaimable = stat.get("slab_reclaimable");
+      const unreclaimable = stat.get("slab_unreclaimable");
+      if (reclaimable === void 0 || unreclaimable === void 0) return null;
+      return reclaimable + unreclaimable;
+    }
+    function buildContainerMemorySnapshot(input) {
+      const currentBytes = parseCgroupScalar(input.currentText);
+      if (currentBytes === null) return null;
+      const stat = input.statText === null ? /* @__PURE__ */ new Map() : parseCgroupStat(input.statText);
+      const isV2 = input.source === "cgroup-v2";
+      return {
+        source: input.source,
+        currentBytes,
+        limitBytes: input.limitText === null ? null : parseCgroupScalar(input.limitText),
+        anonBytes: statValue(stat, isV2 ? "anon" : "rss"),
+        fileBytes: statValue(stat, isV2 ? "file" : "cache"),
+        shmemBytes: statValue(stat, "shmem"),
+        slabBytes: isV2 ? resolveSlab(stat) : null,
+        gpuShmemBytes: input.gpuShmemBytes
+      };
+    }
+    var ContainerMemoryProbe = class {
+      logger;
+      fs;
+      wantGpu;
+      resolved = false;
+      layout = null;
+      gpuProbed = false;
+      gpuReadable = false;
+      /** `null` until the first sample — so the FIRST outcome is a transition too. */
+      lastReadOk = null;
+      constructor(deps) {
+        this.logger = deps.logger;
+        this.fs = deps.fs ?? nodeCgroupFileReader;
+        this.wantGpu = deps.readGpu ?? true;
+      }
+      /** Did this node resolve a cgroup at all? Absent is a reportable fact. */
+      get available() {
+        return this.layout !== null;
+      }
+      /**
+      * One reading, or `null` when this node has no cgroup or the cgroup stopped
+      * answering. `null` is ABSENT — the caller contributes no point, and no
+      * point is what a chart must show, never a zero.
+      */
+      sample() {
+        const layout = this.resolveOnce();
+        if (layout === null) return null;
+        const currentText = this.fs.read(layout.currentPath);
+        if (currentText === null) {
+          this.noteRead(false, `unreadable: ${layout.currentPath}`);
+          return null;
+        }
+        const snapshot = buildContainerMemorySnapshot({
+          source: layout.source,
+          currentText,
+          limitText: this.fs.read(layout.limitPath),
+          statText: this.fs.read(layout.statPath),
+          gpuShmemBytes: this.readGpuShmem()
+        });
+        if (snapshot === null) {
+          this.noteRead(false, `unparseable: ${layout.currentPath}`);
+          return null;
+        }
+        this.noteRead(true, null);
+        return snapshot;
+      }
+      /** Resolve on first use and never again — a cgroup does not move under a pid. */
+      resolveOnce() {
+        if (this.resolved) return this.layout;
+        this.resolved = true;
+        try {
+          this.layout = resolveCgroupMemoryLayout(this.fs);
+        } catch (err) {
+          this.layout = null;
+          this.logger.warn("cgroup memory resolution failed \u2014 container memory will be ABSENT", { meta: { error: require_dist10.errMsg(err) } });
+          return null;
+        }
+        if (this.layout === null) {
+          this.logger.info("no cgroup on this node \u2014 container memory is ABSENT, not zero, for every sample", { meta: {
+            platform: process.platform,
+            probed: "/proc/self/cgroup"
+          } });
+          return null;
+        }
+        this.logger.info("container memory resolved from the cgroup", { meta: {
+          source: this.layout.source,
+          directory: this.layout.directory
+        } });
+        return this.layout;
+      }
+      /**
+      * The GPU number, probed once.
+      *
+      * It is host-wide and lives in debugfs, so it is absent far more often than
+      * it is present — inside every camstack container today. One `open` decides
+      * it for the life of the process; after that an unreadable file costs
+      * nothing at all, not even a syscall.
+      */
+      readGpuShmem() {
+        if (!this.wantGpu) return null;
+        if (!this.gpuProbed) {
+          this.gpuProbed = true;
+          const text2 = this.fs.read(I915_GEM_OBJECTS_PATH);
+          this.gpuReadable = text2 !== null && parseI915GemObjects(text2) !== null;
+          this.logger.info(this.gpuReadable ? "i915 GEM accounting is readable \u2014 GPU-backed shmem will be reported" : "i915 GEM accounting is NOT readable \u2014 gpuShmemBytes stays UNKNOWN (this is normal: debugfs is not mounted in the container, and a node with no Intel GPU has no such file)", { meta: { path: I915_GEM_OBJECTS_PATH } });
+          if (!this.gpuReadable) return null;
+          return text2 === null ? null : parseI915GemObjects(text2);
+        }
+        if (!this.gpuReadable) return null;
+        const text = this.fs.read(I915_GEM_OBJECTS_PATH);
+        return text === null ? null : parseI915GemObjects(text);
+      }
+      /** Log a read outcome only when it CHANGES. Never once per tick. */
+      noteRead(ok, reason) {
+        if (this.lastReadOk === ok) return;
+        const first = this.lastReadOk === null;
+        this.lastReadOk = ok;
+        if (!ok) {
+          this.logger.warn("cgroup memory stopped answering \u2014 container memory is ABSENT until it returns", { meta: { reason: reason ?? "unknown" } });
+          return;
+        }
+        if (!first) this.logger.info("cgroup memory is answering again");
+      }
+    };
+    var LoadPartition = class {
+      capacity;
+      slots;
+      head = 0;
+      count = 0;
+      rows = 0;
+      /** Newest retained sample's timestamp — the monotonic gate for `push`. */
+      newestAtMs = null;
+      constructor(capacity) {
+        this.capacity = capacity;
+        this.slots = Array.from({ length: capacity });
+      }
+      /**
+      * Accept a sample.
+      *
+      * A sample at or before the newest one already held is REFUSED. The bus drops
+      * a node's own broadcast echo, but a cross-node redelivery or a replayed
+      * subscription must not be able to double a point — and idempotence here is
+      * what lets every reader above treat the series as a set.
+      *
+      * `accepted` is reported separately from `rowDelta` on purpose: a full ring
+      * that evicts a sample of the same size has a delta of zero and is not a
+      * refusal, and conflating the two would silently stop advancing the write
+      * ordinal on a steady-state cluster.
+      */
+      push(sample) {
+        if (this.newestAtMs !== null && sample.atMs <= this.newestAtMs) return {
+          accepted: false,
+          rowDelta: 0
+        };
+        const evicted = this.count === this.capacity ? this.slots[this.head]?.processes.length ?? 0 : 0;
+        this.slots[this.head] = sample;
+        this.head = (this.head + 1) % this.capacity;
+        if (this.count < this.capacity) this.count++;
+        this.newestAtMs = sample.atMs;
+        const rowDelta = sample.processes.length - evicted;
+        this.rows += rowDelta;
+        return {
+          accepted: true,
+          rowDelta
+        };
+      }
+      /** Drop the oldest sample. Returns the rows reclaimed (0 when empty). */
+      dropOldest() {
+        if (this.count === 0) return 0;
+        const index = (this.head - this.count + this.capacity) % this.capacity;
+        const victim = this.slots[index];
+        this.slots[index] = void 0;
+        this.count--;
+        const reclaimed = victim?.processes.length ?? 0;
+        this.rows -= reclaimed;
+        if (this.count === 0) this.newestAtMs = null;
+        return reclaimed;
+      }
+      /** Oldest-first, optionally only what is strictly newer than `sinceMs`. */
+      list(sinceMs) {
+        const out = [];
+        for (let i = 0; i < this.count; i++) {
+          const index = (this.head - this.count + i + this.capacity) % this.capacity;
+          const sample = this.slots[index];
+          if (sample === void 0) continue;
+          if (sinceMs !== void 0 && sample.atMs <= sinceMs) continue;
+          out.push(sample);
+        }
+        return out;
+      }
+      size() {
+        return this.count;
+      }
+      rowCount() {
+        return this.rows;
+      }
+      oldestAtMs() {
+        if (this.count === 0) return null;
+        const index = (this.head - this.count + this.capacity) % this.capacity;
+        return this.slots[index]?.atMs ?? null;
+      }
+      lastWriteAtMs() {
+        return this.newestAtMs;
+      }
+    };
+    var NodeLoadRing = class {
+      partitions = /* @__PURE__ */ new Map();
+      /**
+      * Node id → write ordinal of its last accepted sample. A monotonic counter,
+      * not a clock: partition eviction must follow the order writes actually
+      * happened, and node clocks disagree.
+      */
+      lastWriteSeq = /* @__PURE__ */ new Map();
+      writeSeq = 0;
+      totalRows = 0;
+      samplesPerNode;
+      maxTotalProcessRows;
+      maxNodes;
+      idleEvictionMs;
+      now;
+      constructor(options = {}) {
+        this.samplesPerNode = options.samplesPerNode ?? 180;
+        this.maxTotalProcessRows = options.maxTotalProcessRows ?? 32e3;
+        this.maxNodes = options.maxNodes ?? 16;
+        this.idleEvictionMs = options.idleEvictionMs ?? 36e5;
+        this.now = options.now ?? Date.now;
+      }
+      /**
+      * Retain one snapshot. `processes` is stored by reference — the payload is
+      * already an immutable arrival off the bus, and copying it would double the
+      * measured cost for nothing.
+      *
+      * Returns whether the sample was ACCEPTED — that is, whether it was new
+      * rather than a replay of a timestamp this node has already delivered.
+      *
+      * The return value is not diagnostics. It is the idempotence gate the
+      * DURABLE tier rides on (`load-series-store.ts`): only an accepted sample is
+      * appended to the table, which is what lets that table carry an `INTEGER`
+      * rowid key instead of a composite unique index over two million rows. The
+      * gate is one monotonic comparison in memory; the index it replaces was
+      * measured at ~40 bytes per row.
+      */
+      record(nodeId, atMs, processes) {
+        if (nodeId.length === 0) return false;
+        this.sweepIdle();
+        let partition = this.partitions.get(nodeId);
+        if (partition === void 0) {
+          partition = new LoadPartition(this.samplesPerNode);
+          this.partitions.set(nodeId, partition);
+        }
+        const outcome = partition.push({
+          atMs,
+          processes
+        });
+        if (!outcome.accepted) {
+          if (partition.size() === 0) this.partitions.delete(nodeId);
+          return false;
+        }
+        this.totalRows += outcome.rowDelta;
+        this.lastWriteSeq.set(nodeId, ++this.writeSeq);
+        if (this.partitions.size > this.maxNodes) this.evictPartitions(this.partitions.size - this.maxNodes, nodeId);
+        this.enforceRowBudget();
+        return true;
+      }
+      /**
+      * Read one node's retained series, oldest-first.
+      *
+      * `sinceMs` is EXCLUSIVE: a caller passes the newest timestamp it already
+      * holds and gets back only what it is missing. That is the whole contract
+      * that lets the admin UI seed from here and then continue live without
+      * doubling a point it already drew.
+      *
+      * A node nobody has recorded answers with an empty series, not an error —
+      * unknown is the truth about a node that has not reported.
+      */
+      read(nodeId, sinceMs) {
+        this.sweepIdle();
+        const partition = this.partitions.get(nodeId);
+        if (partition === void 0) return {
+          nodeId,
+          samples: [],
+          retainedSamples: 0,
+          oldestAtMs: null,
+          capacity: this.samplesPerNode
+        };
+        return {
+          nodeId,
+          samples: partition.list(sinceMs),
+          retainedSamples: partition.size(),
+          oldestAtMs: partition.oldestAtMs(),
+          capacity: this.samplesPerNode
+        };
+      }
+      /** Node ids with a live partition. Observability for the fleet bound. */
+      nodeIds() {
+        return [...this.partitions.keys()];
+      }
+      /** Process rows retained across every partition — the number that IS memory. */
+      rowCount() {
+        return this.totalRows;
+      }
+      /** Samples retained across every partition. */
+      sampleCount() {
+        let total = 0;
+        for (const partition of this.partitions.values()) total += partition.size();
+        return total;
+      }
+      /**
+      * Drop partitions whose newest sample is older than the retention window.
+      *
+      * Lazy, on write and on read — never a timer. A timer would be a new
+      * periodic cost in a subsystem whose entire premise is that it adds none,
+      * and a ring that nobody writes to and nobody reads is not growing either.
+      */
+      sweepIdle() {
+        const cutoff = this.now() - this.idleEvictionMs;
+        for (const [nodeId, partition] of [...this.partitions.entries()]) {
+          const lastWrite = partition.lastWriteAtMs();
+          if (lastWrite !== null && lastWrite > cutoff) continue;
+          this.dropPartition(nodeId);
+        }
+      }
+      /**
+      * Bring the fleet back under the row budget by dropping the OLDEST sample of
+      * the HEAVIEST partition, repeatedly.
+      *
+      * Terminates: every iteration removes one sample from a non-empty partition,
+      * and the population of samples is finite and strictly decreasing.
+      */
+      enforceRowBudget() {
+        while (this.totalRows > this.maxTotalProcessRows) {
+          const victim = this.heaviestPartition();
+          if (victim === null) return;
+          const [nodeId, partition] = victim;
+          this.totalRows -= partition.dropOldest();
+          if (partition.size() === 0) this.dropPartition(nodeId);
+        }
+      }
+      heaviestPartition() {
+        let best = null;
+        for (const entry of this.partitions.entries()) {
+          if (entry[1].size() === 0) continue;
+          if (best === null || entry[1].rowCount() > best[1].rowCount()) best = entry;
+        }
+        return best;
+      }
+      /** Drop `count` whole partitions, least-recently-written first. */
+      evictPartitions(count, protectedNodeId) {
+        const order = [...this.partitions.keys()].filter((nodeId) => nodeId !== protectedNodeId).toSorted((a, b) => (this.lastWriteSeq.get(a) ?? 0) - (this.lastWriteSeq.get(b) ?? 0));
+        let remaining = count;
+        for (const nodeId of order) {
+          if (remaining <= 0) return;
+          this.dropPartition(nodeId);
+          remaining -= 1;
+        }
+      }
+      /** Remove a partition and everything that indexes it. */
+      dropPartition(nodeId) {
+        const partition = this.partitions.get(nodeId);
+        if (partition === void 0) return;
+        this.totalRows -= partition.rowCount();
+        this.partitions.delete(nodeId);
+        this.lastWriteSeq.delete(nodeId);
+      }
+    };
+    var CONTAINER_MEMORY_COLLECTION = "metrics:node-memory-samples";
+    var CONTAINER_MEMORY_MAX_TOTAL_ROWS = 2880;
+    var CONTAINER_MEMORY_MAX_ROWS = 5e4;
+    var CONTAINER_MEMORY_COLUMNS = [
+      {
+        name: "id",
+        type: "INTEGER",
+        primaryKey: true,
+        notNull: true
+      },
+      {
+        name: "nodeId",
+        type: "TEXT",
+        notNull: true
+      },
+      /** Shared with the process rows of the same tick — that is the whole point. */
+      {
+        name: "atMs",
+        type: "INTEGER",
+        notNull: true
+      },
+      {
+        name: "source",
+        type: "TEXT",
+        notNull: true
+      },
+      /**
+      * Whole MiB, like `rssMib` on the process row and for the same reason: a
+      * byte-exact residency on a value in the tens of gigabytes is precision no
+      * chart can draw, and it costs bytes on every row forever.
+      */
+      {
+        name: "currentMib",
+        type: "INTEGER",
+        notNull: true
+      },
+      /** `NULL` = NO LIMIT. Never a sentinel. */
+      {
+        name: "limitMib",
+        type: "INTEGER"
+      },
+      /** `NULL` = UNKNOWN on all four. Never zero. */
+      {
+        name: "anonMib",
+        type: "INTEGER"
+      },
+      {
+        name: "fileMib",
+        type: "INTEGER"
+      },
+      {
+        name: "shmemMib",
+        type: "INTEGER"
+      },
+      {
+        name: "slabMib",
+        type: "INTEGER"
+      },
+      /** Host-wide i915 GEM bytes. `NULL` wherever debugfs is not mounted. */
+      {
+        name: "gpuShmemMib",
+        type: "INTEGER"
+      }
+    ];
+    var CONTAINER_MEMORY_INDEXES = [
+      /** The one index, and it serves both the read and the prune — see the
+      *  process table's `idx_load_samples_node_at` for the full reasoning. */
+      {
+        name: "idx_node_memory_node_at",
+        columns: ["nodeId", "atMs"]
+      }
+    ];
+    var BYTES_PER_MIB$1 = 1048576;
+    function toMib(value) {
+      return value === null ? null : Math.round(value / BYTES_PER_MIB$1);
+    }
+    function fromMib(value) {
+      return value === null ? null : value * BYTES_PER_MIB$1;
+    }
+    function snapshotToRow(nodeId, atMs, snapshot) {
+      return {
+        nodeId,
+        atMs,
+        source: snapshot.source,
+        currentMib: Math.round(snapshot.currentBytes / BYTES_PER_MIB$1),
+        limitMib: toMib(snapshot.limitBytes),
+        anonMib: toMib(snapshot.anonBytes),
+        fileMib: toMib(snapshot.fileBytes),
+        shmemMib: toMib(snapshot.shmemBytes),
+        slabMib: toMib(snapshot.slabBytes),
+        gpuShmemMib: toMib(snapshot.gpuShmemBytes)
+      };
+    }
+    function rowToPoint(row) {
+      if (row.source !== "cgroup-v2" && row.source !== "cgroup-v1") return null;
+      return {
+        atMs: row.atMs,
+        source: row.source,
+        currentBytes: row.currentMib * BYTES_PER_MIB$1,
+        limitBytes: fromMib(row.limitMib),
+        anonBytes: fromMib(row.anonMib),
+        fileBytes: fromMib(row.fileMib),
+        shmemBytes: fromMib(row.shmemMib),
+        slabBytes: fromMib(row.slabMib),
+        gpuShmemBytes: fromMib(row.gpuShmemMib)
+      };
+    }
+    function recordToMemoryRow(data) {
+      const nodeId = data["nodeId"];
+      const source = data["source"];
+      if (typeof nodeId !== "string" || typeof source !== "string") return null;
+      const atMs = Number(data["atMs"]);
+      const currentMib = Number(data["currentMib"]);
+      if (!Number.isFinite(atMs) || !Number.isFinite(currentMib)) return null;
+      const optional = (raw) => {
+        if (raw === null || raw === void 0) return null;
+        const n = Number(raw);
+        return Number.isFinite(n) ? n : null;
+      };
+      return {
+        nodeId,
+        atMs,
+        source,
+        currentMib,
+        limitMib: optional(data["limitMib"]),
+        anonMib: optional(data["anonMib"]),
+        fileMib: optional(data["fileMib"]),
+        shmemMib: optional(data["shmemMib"]),
+        slabMib: optional(data["slabMib"]),
+        gpuShmemMib: optional(data["gpuShmemMib"])
+      };
+    }
+    var ContainerMemoryRing = class {
+      ring;
+      constructor(options = {}) {
+        this.ring = new NodeLoadRing({
+          samplesPerNode: options.samplesPerNode ?? 180,
+          maxTotalProcessRows: CONTAINER_MEMORY_MAX_TOTAL_ROWS,
+          ...options.now !== void 0 ? { now: options.now } : {}
+        });
+      }
+      /** Retain one reading. `false` = a timestamp this node already delivered. */
+      record(nodeId, atMs, snapshot) {
+        return this.ring.record(nodeId, atMs, [snapshot]);
+      }
+      /**
+      * Read one node's retained readings, oldest-first. `sinceMs` is EXCLUSIVE,
+      * matching every other reader in this subsystem.
+      *
+      * A node nobody has recorded answers EMPTY — which is what "this node has no
+      * cgroup" looks like, and it must stay distinguishable from a zero.
+      */
+      read(nodeId, sinceMs) {
+        const series = this.ring.read(nodeId, sinceMs);
+        const out = [];
+        for (const sample of series.samples) {
+          const snapshot = sample.processes[0];
+          if (snapshot === void 0) continue;
+          out.push({
+            ...snapshot,
+            atMs: sample.atMs
+          });
+        }
+        return out;
+      }
+    };
+    function reduceContainerMemory(points, bucketMs, origin) {
+      if (bucketMs <= 0 || points.length === 0) return points;
+      const buckets = /* @__PURE__ */ new Map();
+      for (const point of points) {
+        const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
+        const held = buckets.get(start);
+        if (held === void 0 || point.currentBytes > held.currentBytes) buckets.set(start, {
+          ...point,
+          atMs: start
+        });
+      }
+      return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+    }
+    function mergeContainerMemory(cold, hot) {
+      const byAt = /* @__PURE__ */ new Map();
+      for (const point of cold) byAt.set(point.atMs, point);
+      for (const point of hot) byAt.set(point.atMs, point);
+      return [...byAt.values()].toSorted((a, b) => a.atMs - b.atMs);
+    }
+    var ContainerMemoryStore = class {
+      declared = false;
+      store;
+      logger;
+      nowFn;
+      prunePageRows;
+      constructor(deps) {
+        this.store = deps.store;
+        this.logger = deps.logger;
+        this.nowFn = deps.now ?? (() => Date.now());
+        this.prunePageRows = deps.prunePageRows ?? 2e4;
+      }
+      /** Idempotently declare the collection. `false` when the store refused. */
+      async declare() {
+        if (this.declared) return true;
+        try {
+          await this.store.declareCollection.mutate({
+            collection: CONTAINER_MEMORY_COLLECTION,
+            columns: [...CONTAINER_MEMORY_COLUMNS],
+            indexes: CONTAINER_MEMORY_INDEXES.map((i) => ({
+              name: i.name,
+              columns: [...i.columns]
+            }))
+          });
+          this.declared = true;
+          return true;
+        } catch (err) {
+          this.logger.warn("container memory declareCollection failed \u2014 nothing will be retained on disk", { meta: {
+            collection: CONTAINER_MEMORY_COLLECTION,
+            error: require_dist10.errMsg(err)
+          } });
+          return false;
+        }
+      }
+      /** Append ONE reading. */
+      async append(nodeId, atMs, snapshot) {
+        if (!await this.declare()) return 0;
+        const record = { ...snapshotToRow(nodeId, atMs, snapshot) };
+        try {
+          const { inserted } = await this.store.insertMany.mutate({
+            collection: CONTAINER_MEMORY_COLLECTION,
+            records: [{ data: record }]
+          });
+          return inserted;
+        } catch (err) {
+          this.logger.warn("container memory reading not retained \u2014 this interval will be missing", { meta: {
+            nodeId,
+            atMs,
+            error: require_dist10.errMsg(err)
+          } });
+          return 0;
+        }
+      }
+      /** Read one node's cold readings, oldest-first. `sinceMs` is EXCLUSIVE. */
+      async read(nodeId, sinceMs, limitRows) {
+        if (!await this.declare()) return [];
+        try {
+          const records = await this.store.query.query({
+            collection: CONTAINER_MEMORY_COLLECTION,
+            filter: {
+              where: { nodeId },
+              whereBetween: { atMs: [sinceMs + 1, Number.MAX_SAFE_INTEGER] },
+              orderBy: {
+                field: "atMs",
+                direction: "asc"
+              },
+              limit: limitRows
+            }
+          });
+          const points = [];
+          for (const record of records) {
+            const row = recordToMemoryRow(record.data);
+            if (row === null) continue;
+            const point = rowToPoint(row);
+            if (point !== null) points.push(point);
+          }
+          return points;
+        } catch (err) {
+          this.logger.warn("container memory cold read failed \u2014 answering from the hot window only", { meta: {
+            nodeId,
+            sinceMs,
+            error: require_dist10.errMsg(err)
+          } });
+          return [];
+        }
+      }
+      /**
+      * Enforce BOTH bounds, oldest-first, through a bounded page each.
+      *
+      * Not rate-limited here: it is driven by the process store's own prune
+      * cadence, so it runs at most once a minute by construction and a second
+      * timer would be a second thing to get wrong.
+      */
+      async prune(nodeIds, retention) {
+        if (!await this.declare()) return null;
+        const ageCutoff = this.nowFn() - retention.retentionHours * 36e5;
+        let deletedByAge = 0;
+        let rowsExamined = 0;
+        for (const nodeId of nodeIds) {
+          const outcome = await this.deleteOldestPage(nodeId, ageCutoff, this.prunePageRows);
+          deletedByAge += outcome.deleted;
+          rowsExamined += outcome.examined;
+        }
+        const total = await this.count();
+        const excess = total === null ? 0 : total - CONTAINER_MEMORY_MAX_ROWS;
+        let deletedByCap = 0;
+        if (excess > 0) {
+          let remaining = Math.min(excess, this.prunePageRows);
+          for (const nodeId of nodeIds) {
+            if (remaining <= 0) break;
+            const outcome = await this.deleteOldestPage(nodeId, null, remaining);
+            deletedByCap += outcome.deleted;
+            remaining -= outcome.deleted;
+            rowsExamined += outcome.examined;
+          }
+          this.logger.warn("container memory ROW CAP bit \u2014 evicting the oldest readings", { meta: {
+            collection: CONTAINER_MEMORY_COLLECTION,
+            rows: total,
+            cap: CONTAINER_MEMORY_MAX_ROWS,
+            over: excess,
+            deleted: deletedByCap,
+            hint: "lower the retention or the sampling cadence \u2014 the cap is the guarantee, not the intention"
+          } });
+        }
+        return {
+          deletedByAge,
+          deletedByCap,
+          rowsExamined,
+          capBit: excess > 0
+        };
+      }
+      /** Total rows, or `null` when the store could not answer. */
+      async count() {
+        if (!await this.declare()) return null;
+        try {
+          return await this.store.count.query({ collection: CONTAINER_MEMORY_COLLECTION });
+        } catch (err) {
+          this.logger.warn("container memory count failed \u2014 the row cap is not enforced this pass", { meta: { error: require_dist10.errMsg(err) } });
+          return null;
+        }
+      }
+      /**
+      * Delete this node's oldest rows, at most one page's worth.
+      *
+      * `cutoff === null` means "the oldest rows, whatever their age" — the
+      * row-cap path, which is bounded by `limitRows` instead. Either way the page
+      * is READ FIRST, ordered by the one index, and its last `atMs` becomes the
+      * effective cutoff for a single bounded delete. An unbounded `deleteWhere`
+      * would be one statement and one stalling transaction the first time a
+      * retention is lowered.
+      */
+      async deleteOldestPage(nodeId, cutoff, limitRows) {
+        if (limitRows <= 0) return {
+          deleted: 0,
+          examined: 0
+        };
+        try {
+          const page = await this.store.query.query({
+            collection: CONTAINER_MEMORY_COLLECTION,
+            filter: {
+              where: { nodeId },
+              ...cutoff === null ? {} : { whereBetween: { atMs: [0, cutoff] } },
+              orderBy: {
+                field: "atMs",
+                direction: "asc"
+              },
+              limit: Math.min(limitRows, this.prunePageRows)
+            },
+            columns: ["atMs"]
+          });
+          if (page.length === 0) return {
+            deleted: 0,
+            examined: 0
+          };
+          const effectiveCutoff = Number(page.at(-1)?.data["atMs"]);
+          if (!Number.isFinite(effectiveCutoff)) return {
+            deleted: 0,
+            examined: page.length
+          };
+          const { deleted } = await this.store.deleteWhere.mutate({
+            collection: CONTAINER_MEMORY_COLLECTION,
+            filter: {
+              where: { nodeId },
+              whereBetween: { atMs: [0, effectiveCutoff] }
+            }
+          });
+          return {
+            deleted,
+            examined: page.length
+          };
+        } catch (err) {
+          this.logger.warn("container memory prune failed \u2014 the table keeps growing this pass", { meta: {
+            nodeId,
+            cutoff,
+            error: require_dist10.errMsg(err)
+          } });
+          return {
+            deleted: 0,
+            examined: 0
+          };
+        }
+      }
+    };
     var IS_DARWIN = node_os.platform() === "darwin";
     var IS_LINUX = node_os.platform() === "linux";
     var NativeMetricsProvider = class {
@@ -76594,247 +77513,6 @@ var require_native_metrics_addon = __commonJS({
         });
       });
     }
-    var LoadPartition = class {
-      capacity;
-      slots;
-      head = 0;
-      count = 0;
-      rows = 0;
-      /** Newest retained sample's timestamp — the monotonic gate for `push`. */
-      newestAtMs = null;
-      constructor(capacity) {
-        this.capacity = capacity;
-        this.slots = Array.from({ length: capacity });
-      }
-      /**
-      * Accept a sample.
-      *
-      * A sample at or before the newest one already held is REFUSED. The bus drops
-      * a node's own broadcast echo, but a cross-node redelivery or a replayed
-      * subscription must not be able to double a point — and idempotence here is
-      * what lets every reader above treat the series as a set.
-      *
-      * `accepted` is reported separately from `rowDelta` on purpose: a full ring
-      * that evicts a sample of the same size has a delta of zero and is not a
-      * refusal, and conflating the two would silently stop advancing the write
-      * ordinal on a steady-state cluster.
-      */
-      push(sample) {
-        if (this.newestAtMs !== null && sample.atMs <= this.newestAtMs) return {
-          accepted: false,
-          rowDelta: 0
-        };
-        const evicted = this.count === this.capacity ? this.slots[this.head]?.processes.length ?? 0 : 0;
-        this.slots[this.head] = sample;
-        this.head = (this.head + 1) % this.capacity;
-        if (this.count < this.capacity) this.count++;
-        this.newestAtMs = sample.atMs;
-        const rowDelta = sample.processes.length - evicted;
-        this.rows += rowDelta;
-        return {
-          accepted: true,
-          rowDelta
-        };
-      }
-      /** Drop the oldest sample. Returns the rows reclaimed (0 when empty). */
-      dropOldest() {
-        if (this.count === 0) return 0;
-        const index = (this.head - this.count + this.capacity) % this.capacity;
-        const victim = this.slots[index];
-        this.slots[index] = void 0;
-        this.count--;
-        const reclaimed = victim?.processes.length ?? 0;
-        this.rows -= reclaimed;
-        if (this.count === 0) this.newestAtMs = null;
-        return reclaimed;
-      }
-      /** Oldest-first, optionally only what is strictly newer than `sinceMs`. */
-      list(sinceMs) {
-        const out = [];
-        for (let i = 0; i < this.count; i++) {
-          const index = (this.head - this.count + i + this.capacity) % this.capacity;
-          const sample = this.slots[index];
-          if (sample === void 0) continue;
-          if (sinceMs !== void 0 && sample.atMs <= sinceMs) continue;
-          out.push(sample);
-        }
-        return out;
-      }
-      size() {
-        return this.count;
-      }
-      rowCount() {
-        return this.rows;
-      }
-      oldestAtMs() {
-        if (this.count === 0) return null;
-        const index = (this.head - this.count + this.capacity) % this.capacity;
-        return this.slots[index]?.atMs ?? null;
-      }
-      lastWriteAtMs() {
-        return this.newestAtMs;
-      }
-    };
-    var NodeLoadRing = class {
-      partitions = /* @__PURE__ */ new Map();
-      /**
-      * Node id → write ordinal of its last accepted sample. A monotonic counter,
-      * not a clock: partition eviction must follow the order writes actually
-      * happened, and node clocks disagree.
-      */
-      lastWriteSeq = /* @__PURE__ */ new Map();
-      writeSeq = 0;
-      totalRows = 0;
-      samplesPerNode;
-      maxTotalProcessRows;
-      maxNodes;
-      idleEvictionMs;
-      now;
-      constructor(options = {}) {
-        this.samplesPerNode = options.samplesPerNode ?? 180;
-        this.maxTotalProcessRows = options.maxTotalProcessRows ?? 32e3;
-        this.maxNodes = options.maxNodes ?? 16;
-        this.idleEvictionMs = options.idleEvictionMs ?? 36e5;
-        this.now = options.now ?? Date.now;
-      }
-      /**
-      * Retain one snapshot. `processes` is stored by reference — the payload is
-      * already an immutable arrival off the bus, and copying it would double the
-      * measured cost for nothing.
-      *
-      * Returns whether the sample was ACCEPTED — that is, whether it was new
-      * rather than a replay of a timestamp this node has already delivered.
-      *
-      * The return value is not diagnostics. It is the idempotence gate the
-      * DURABLE tier rides on (`load-series-store.ts`): only an accepted sample is
-      * appended to the table, which is what lets that table carry an `INTEGER`
-      * rowid key instead of a composite unique index over two million rows. The
-      * gate is one monotonic comparison in memory; the index it replaces was
-      * measured at ~40 bytes per row.
-      */
-      record(nodeId, atMs, processes) {
-        if (nodeId.length === 0) return false;
-        this.sweepIdle();
-        let partition = this.partitions.get(nodeId);
-        if (partition === void 0) {
-          partition = new LoadPartition(this.samplesPerNode);
-          this.partitions.set(nodeId, partition);
-        }
-        const outcome = partition.push({
-          atMs,
-          processes
-        });
-        if (!outcome.accepted) {
-          if (partition.size() === 0) this.partitions.delete(nodeId);
-          return false;
-        }
-        this.totalRows += outcome.rowDelta;
-        this.lastWriteSeq.set(nodeId, ++this.writeSeq);
-        if (this.partitions.size > this.maxNodes) this.evictPartitions(this.partitions.size - this.maxNodes, nodeId);
-        this.enforceRowBudget();
-        return true;
-      }
-      /**
-      * Read one node's retained series, oldest-first.
-      *
-      * `sinceMs` is EXCLUSIVE: a caller passes the newest timestamp it already
-      * holds and gets back only what it is missing. That is the whole contract
-      * that lets the admin UI seed from here and then continue live without
-      * doubling a point it already drew.
-      *
-      * A node nobody has recorded answers with an empty series, not an error —
-      * unknown is the truth about a node that has not reported.
-      */
-      read(nodeId, sinceMs) {
-        this.sweepIdle();
-        const partition = this.partitions.get(nodeId);
-        if (partition === void 0) return {
-          nodeId,
-          samples: [],
-          retainedSamples: 0,
-          oldestAtMs: null,
-          capacity: this.samplesPerNode
-        };
-        return {
-          nodeId,
-          samples: partition.list(sinceMs),
-          retainedSamples: partition.size(),
-          oldestAtMs: partition.oldestAtMs(),
-          capacity: this.samplesPerNode
-        };
-      }
-      /** Node ids with a live partition. Observability for the fleet bound. */
-      nodeIds() {
-        return [...this.partitions.keys()];
-      }
-      /** Process rows retained across every partition — the number that IS memory. */
-      rowCount() {
-        return this.totalRows;
-      }
-      /** Samples retained across every partition. */
-      sampleCount() {
-        let total = 0;
-        for (const partition of this.partitions.values()) total += partition.size();
-        return total;
-      }
-      /**
-      * Drop partitions whose newest sample is older than the retention window.
-      *
-      * Lazy, on write and on read — never a timer. A timer would be a new
-      * periodic cost in a subsystem whose entire premise is that it adds none,
-      * and a ring that nobody writes to and nobody reads is not growing either.
-      */
-      sweepIdle() {
-        const cutoff = this.now() - this.idleEvictionMs;
-        for (const [nodeId, partition] of [...this.partitions.entries()]) {
-          const lastWrite = partition.lastWriteAtMs();
-          if (lastWrite !== null && lastWrite > cutoff) continue;
-          this.dropPartition(nodeId);
-        }
-      }
-      /**
-      * Bring the fleet back under the row budget by dropping the OLDEST sample of
-      * the HEAVIEST partition, repeatedly.
-      *
-      * Terminates: every iteration removes one sample from a non-empty partition,
-      * and the population of samples is finite and strictly decreasing.
-      */
-      enforceRowBudget() {
-        while (this.totalRows > this.maxTotalProcessRows) {
-          const victim = this.heaviestPartition();
-          if (victim === null) return;
-          const [nodeId, partition] = victim;
-          this.totalRows -= partition.dropOldest();
-          if (partition.size() === 0) this.dropPartition(nodeId);
-        }
-      }
-      heaviestPartition() {
-        let best = null;
-        for (const entry of this.partitions.entries()) {
-          if (entry[1].size() === 0) continue;
-          if (best === null || entry[1].rowCount() > best[1].rowCount()) best = entry;
-        }
-        return best;
-      }
-      /** Drop `count` whole partitions, least-recently-written first. */
-      evictPartitions(count, protectedNodeId) {
-        const order = [...this.partitions.keys()].filter((nodeId) => nodeId !== protectedNodeId).toSorted((a, b) => (this.lastWriteSeq.get(a) ?? 0) - (this.lastWriteSeq.get(b) ?? 0));
-        let remaining = count;
-        for (const nodeId of order) {
-          if (remaining <= 0) return;
-          this.dropPartition(nodeId);
-          remaining -= 1;
-        }
-      }
-      /** Remove a partition and everything that indexes it. */
-      dropPartition(nodeId) {
-        const partition = this.partitions.get(nodeId);
-        if (partition === void 0) return;
-        this.totalRows -= partition.rowCount();
-        this.partitions.delete(nodeId);
-        this.lastWriteSeq.delete(nodeId);
-      }
-    };
     var LOAD_SERIES_COLLECTION = "metrics:node-load-samples";
     var DEFAULT_MAX_ROWS = 5e5;
     var LOAD_SERIES_COLUMNS = [
@@ -77545,6 +78223,20 @@ var require_native_metrics_addon = __commonJS({
       * per sample, to reach that very same table.
       */
       loadStore = null;
+      /**
+      * The container's OWN memory, sampled on the process-snapshot tick.
+      *
+      * It rides that tick rather than a timer of its own so a memory reading and
+      * the process rows it must be compared against carry the SAME timestamp —
+      * the whole question is a subtraction, and two clocks make it an estimate.
+      * Constructed in `onInitialize`, where the logger exists; it resolves the
+      * cgroup once and latches.
+      */
+      memoryProbe = null;
+      /** Hot tier for the container reading. Bounds in `container-memory-series.ts`. */
+      memoryRing = new ContainerMemoryRing();
+      /** Cold tier, HUB only — same reasoning as `loadStore`. */
+      memoryStore = null;
       /** The resolved knobs. Re-resolved on every settings write. */
       loadConfig = {
         cadenceSec: 10,
@@ -77617,13 +78309,20 @@ var require_native_metrics_addon = __commonJS({
           dumpHeapSnapshot: (params) => this.dumpHeapSnapshot(params)
         };
         this.applyLoadSeriesConfig();
-        if (this.isHub) this.loadStore = new LoadSeriesStore({
-          store: this.ctx.api.settingsStore,
-          logger: this.ctx.logger.child("LoadSeries")
-        });
+        if (this.isHub) {
+          this.loadStore = new LoadSeriesStore({
+            store: this.ctx.api.settingsStore,
+            logger: this.ctx.logger.child("LoadSeries")
+          });
+          this.memoryStore = new ContainerMemoryStore({
+            store: this.ctx.api.settingsStore,
+            logger: this.ctx.logger.child("ContainerMemory")
+          });
+        }
+        this.memoryProbe = new ContainerMemoryProbe({ logger: this.ctx.logger.child("ContainerMemory") });
         this.snapshotTimer = setInterval(() => this.emitResourcesSnapshot(), METRICS_SNAPSHOT_INTERVAL_MS);
         this.startProcessSnapshotTimer();
-        this.ctx.addDisposer(this.ctx.eventBus.subscribe({ category: require_dist10.EventCategory.MetricsNodeProcessesSnapshot }, (event) => this.retainSnapshot(event.data.nodeId, event.data.timestamp, event.data.processes)));
+        this.ctx.addDisposer(this.ctx.eventBus.subscribe({ category: require_dist10.EventCategory.MetricsNodeProcessesSnapshot }, (event) => this.retainSnapshot(event.data.nodeId, event.data.timestamp, event.data.processes, event.data.containerMemory)));
         return [{
           capability: require_dist10.metricsProviderCapability,
           provider: composed
@@ -77641,19 +78340,31 @@ var require_native_metrics_addon = __commonJS({
       * The durable append is fire-and-forget: a storage stall must cost a gap in
       * the cold window, never a blocked event-bus handler. Every failure logs.
       */
-      retainSnapshot(nodeId, atMs, processes) {
+      retainSnapshot(nodeId, atMs, processes, containerMemory) {
         const retained = processes.map((p) => NativeMetricsAddon2.toRetained(p));
         if (!this.loadRing.record(nodeId, atMs, retained)) return;
         this.observedRowsByNode.set(nodeId, retained.length);
+        if (containerMemory !== null) this.memoryRing.record(nodeId, atMs, containerMemory);
         const store = this.loadStore;
         if (store === null) return;
-        store.append(nodeId, atMs, retained).then(() => store.prune([...this.observedRowsByNode.keys()], this.loadConfig)).catch((err) => {
+        store.append(nodeId, atMs, retained).then(() => store.prune([...this.observedRowsByNode.keys()], this.loadConfig)).then(async (outcome) => {
+          if (outcome === null) return;
+          await this.memoryStore?.prune([...this.observedRowsByNode.keys()], this.loadConfig);
+        }).catch((err) => {
           this.ctx.logger.warn("durable load series write failed", { meta: {
             nodeId,
             atMs,
             error: err instanceof Error ? err.message : String(err)
           } });
         });
+        if (containerMemory === null) return;
+        this.memoryStore?.append(nodeId, atMs, containerMemory).catch((err) => {
+          this.ctx.logger.warn("durable container memory write failed", { meta: {
+            nodeId,
+            atMs,
+            error: err instanceof Error ? err.message : String(err)
+          } });
+        });
       }
       /**
       * The ONE reader, over both tiers.
@@ -77682,6 +78393,14 @@ var require_native_metrics_addon = __commonJS({
         return {
           nodeId: params.forNodeId,
           series: merged.series,
+          containerMemory: await this.readContainerMemory({
+            forNodeId: params.forNodeId,
+            sinceMs,
+            ...params.sinceMs !== void 0 ? { exclusiveSinceMs: params.sinceMs } : {},
+            bucketMs: merged.bucketMs,
+            cadenceMs,
+            origin: merged.oldestAtMs
+          }),
           bucketMs: merged.bucketMs,
           retainedSamples: merged.retainedSamples,
           oldestAtMs: merged.oldestAtMs,
@@ -77690,6 +78409,24 @@ var require_native_metrics_addon = __commonJS({
         };
       }
       /**
+      * The container's memory over the same window, on the same x-axis.
+      *
+      * Both tiers, merged and deduped on `atMs` like the process series, then
+      * reduced against the SAME `bucketMs` and the SAME origin — otherwise the
+      * two series in one answer would sit on two different axes and the
+      * subtraction they exist for would be an eyeball.
+      *
+      * An EMPTY answer means the node has no cgroup, or nothing has been retained
+      * for it yet. It never means zero.
+      */
+      async readContainerMemory(params) {
+        const hot = this.memoryRing.read(params.forNodeId, params.exclusiveSinceMs);
+        const store = this.memoryStore;
+        const merged = mergeContainerMemory(store === null ? [] : await store.read(params.forNodeId, params.sinceMs, CONTAINER_MEMORY_MAX_ROWS), hot);
+        if (params.bucketMs <= params.cadenceMs) return merged;
+        return reduceContainerMemory(merged, params.bucketMs, params.origin ?? 0);
+      }
+      /**
       * Re-resolve the knobs and restate the fixed cadence.
       *
       * A REFUSED value (out of 5-60 s, or out of 1-72 h) leaves the previous
@@ -77806,6 +78543,7 @@ var require_native_metrics_addon = __commonJS({
         const timestamp = Date.now();
         try {
           const processes = await this.listNodeProcesses();
+          const containerMemory = this.memoryProbe?.sample() ?? null;
           eventBus.emit(require_dist10.createEvent(require_dist10.EventCategory.MetricsNodeProcessesSnapshot, {
             type: "node",
             id: nodeId,
@@ -77813,7 +78551,8 @@ var require_native_metrics_addon = __commonJS({
           }, {
             nodeId,
             processes,
-            timestamp
+            timestamp,
+            containerMemory
           }));
         } catch (err) {
           this.ctx.logger.warn("process snapshot skipped \u2014 this interval will be missing", { meta: {
@@ -78079,14 +78818,14 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
-    var node_os = __require("os");
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
+    var node_os = __require("os");
     function isWithinAllowedRoots(candidate, allowedRoots) {
       const norm = (0, node_path.resolve)(candidate);
       return allowedRoots.some((root) => {
@@ -79195,8 +79934,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
-    var require_retired_settings_keys = require_retired_settings_keys_BbjWjol0();
+    var require_dist10 = require_dist_BPlfW_CG();
+    var require_retired_settings_keys = require_retired_settings_keys_DBY6ebwV();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -81475,7 +82214,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -83356,7 +84095,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -101417,7 +102156,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -102447,9 +103186,9 @@ var require_file_data_plane_DO8KbxCe = __commonJS({
   }
 });
 
-// ../system/dist/tls-u8QCJCFE.js
-var require_tls_u8QCJCFE = __commonJS({
-  "../system/dist/tls-u8QCJCFE.js"(exports) {
+// ../system/dist/tls-BxQlomxd.js
+var require_tls_BxQlomxd = __commonJS({
+  "../system/dist/tls-BxQlomxd.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
     var node_crypto = __require("crypto");
@@ -102457,9 +103196,9 @@ var require_tls_u8QCJCFE = __commonJS({
     var node_path = __require("path");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
+    var node_fs = __require("fs");
     var node_os = __require("os");
     node_os = require_chunk.__toESM(node_os);
-    var node_fs = __require("fs");
     var node_http = __require("http");
     var node_net = __require("net");
     var DEFAULT_HTTP_PORT = 4480;
@@ -113905,12 +114644,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-CcDe4S2Z.js
-var require_manifest_python_deps_CcDe4S2Z = __commonJS({
-  "../system/dist/manifest-python-deps-CcDe4S2Z.js"(exports) {
+// ../system/dist/manifest-python-deps-COeSr7el.js
+var require_manifest_python_deps_COeSr7el = __commonJS({
+  "../system/dist/manifest-python-deps-COeSr7el.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_CxgTulEG();
+    require_dist_BPlfW_CG();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -113919,10 +114658,10 @@ var require_manifest_python_deps_CcDe4S2Z = __commonJS({
     node_path = require_chunk.__toESM(node_path);
     var node_child_process = __require("child_process");
     var node_util = __require("util");
-    var node_os = __require("os");
-    node_os = require_chunk.__toESM(node_os);
     var node_fs = __require("fs");
     node_fs = require_chunk.__toESM(node_fs);
+    var node_os = __require("os");
+    node_os = require_chunk.__toESM(node_os);
     var node_http = __require("http");
     var node_v8 = __require("v8");
     node_v8 = require_chunk.__toESM(node_v8);
@@ -125356,7 +126095,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CxgTulEG();
+    var require_dist10 = require_dist_BPlfW_CG();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -125381,8 +126120,8 @@ var require_dist3 = __commonJS({
     require_system_config();
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
-    var require_tls$1 = require_tls_u8QCJCFE();
-    var require_manifest_python_deps = require_manifest_python_deps_CcDe4S2Z();
+    var require_tls$1 = require_tls_BxQlomxd();
+    var require_manifest_python_deps = require_manifest_python_deps_COeSr7el();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -125394,11 +126133,11 @@ var require_dist3 = __commonJS({
     var node_child_process = __require("child_process");
     var node_util = __require("util");
     node_util = require_chunk.__toESM(node_util);
-    var node_os = __require("os");
-    node_os = require_chunk.__toESM(node_os);
     var node_fs = __require("fs");
     var node_fs$1 = require_chunk.__toESM(node_fs, 1);
     node_fs = require_chunk.__toESM(node_fs);
+    var node_os = __require("os");
+    node_os = require_chunk.__toESM(node_os);
     var node_http = __require("http");
     var node_vm = __require("vm");
     node_vm = require_chunk.__toESM(node_vm);
@@ -215080,6 +215819,38 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** Wall-clock uptime (seconds). Parsed from `ps etime`. */
       uptimeSec: zod.z.number()
     });
+    var ContainerMemoryPointSchema = zod.z.object({
+      /** Which hierarchy answered, so a reading is never ambiguous. */
+      source: zod.z.enum(["cgroup-v2", "cgroup-v1"]),
+      /** `memory.current` (v2) / `memory.usage_in_bytes` (v1). Always known. */
+      currentBytes: zod.z.number(),
+      /** The cgroup's ceiling. `null` = NO LIMIT — never a sentinel, never zero. */
+      limitBytes: zod.z.number().nullable(),
+      /** Anonymous pages: the closest thing to "what the processes allocated". */
+      anonBytes: zod.z.number().nullable(),
+      /** Page cache. Charged to the cgroup, owned by no process. */
+      fileBytes: zod.z.number().nullable(),
+      /**
+      * Shared memory — and the field that explained the largest single surprise.
+      * The i915 driver backs GPU buffers with shmem, so an inference pool or a
+      * hardware-decode session holding DRM objects is charged HERE and appears
+      * nowhere in a `ps` scan.
+      */
+      shmemBytes: zod.z.number().nullable(),
+      /** Kernel slab charged to this cgroup. `null` on v1, which never publishes it. */
+      slabBytes: zod.z.number().nullable(),
+      /**
+      * Shrinkable i915 GEM object bytes, from debugfs.
+      *
+      * **Host-wide across every DRM client, NOT cgroup-scoped.** It is not a
+      * component of `currentBytes` and must not be subtracted from it; it says
+      * what put the shmem there, where `shmemBytes` only says how much.
+      *
+      * `null` wherever debugfs is not mounted — which is inside every camstack
+      * container today — and on any node with no Intel GPU.
+      */
+      gpuShmemBytes: zod.z.number().nullable()
+    }).extend({ atMs: zod.z.number() });
     var DumpHeapSnapshotInputSchema = zod.z.object({
       /** The addon whose runner should dump a heap snapshot. */
       addonId: zod.z.string()
@@ -215129,6 +215900,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** One entry per function seen in the window, heaviest-first. */
       series: zod.z.array(LoadFunctionSeriesSchema).readonly(),
       /**
+      * The CONTAINER's memory over the same window, oldest-first.
+      *
+      * Sits next to `series` rather than in a method of its own because the whole
+      * question is a subtraction: the per-process rows in `series` sum to one
+      * number and this one is another, and an operator who has to issue two calls
+      * to compare them will compare two different instants. Same reader, same
+      * `sinceMs`, same `bucketMs`, same timestamps.
+      *
+      * **EMPTY means ABSENT, never zero.** A node with no cgroup — a developer
+      * Mac, a bare-metal host, a container with the hierarchy hidden — reports no
+      * points at all. A zero here would be indistinguishable from a healthy
+      * container and is precisely the lie this field exists to avoid.
+      */
+      containerMemory: zod.z.array(ContainerMemoryPointSchema).readonly(),
+      /**
       * Width of one returned bucket, in ms. Equals the sampling cadence when no
       * reduction was needed — so a caller can always say what one point covers
       * without having to know whether it was reduced.
@@ -226930,6 +227716,33 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       deviceNative: true,
       mode: "singleton",
       deviceTypes: [require_sleep.DeviceType.Camera],
+      /**
+      * **Auth tier: `protected` on every method — deliberate, and load-bearing.**
+      *
+      * Talking through a camera is an OPERATE action, not a CONFIGURE one. This
+      * cap has no configuration surface at all: all six methods open, feed and
+      * close one live audio session against one `deviceId`. That is the same
+      * authority as `ptz.move` or `snapshot.getSnapshot`, both `protected` — and
+      * the opposite of `ptz.savePreset` / `snapshot.invalidateCache`, which are
+      * `admin` because they change what the device IS.
+      *
+      * `protected` does not mean ungated: `protectedProcedure` runs the
+      * `METHOD_ACCESS_MAP` scope check, and every method here is `scope: 'device'`
+      * with `access: 'create'` and a `deviceId` in its input. So a caller needs a
+      * grant that covers THAT camera at `create` — a `camera-viewer` (`view`
+      * only) still cannot talk, and a grant on camera 5 cannot talk through
+      * camera 7.
+      *
+      * Every method was `auth: 'admin'` from the initial commit, which made the
+      * cap unreachable by every non-admin principal — `adminProcedure` throws
+      * `FORBIDDEN: Admin required` BEFORE the scope check runs, so the scope
+      * machinery generated for this cap (`METHOD_ACCESS_MAP`,
+      * `DEVICE_SCOPED_CAPS`, `METHOD_DEVICE_SELECTORS`) was complete and dead. The
+      * `camera-operator` scope preset has promised "PTZ control, intercom,
+      * snapshots" since that same commit; the promise could not be kept. Recorded
+      * as D289; `scripts/check-scope-preset-promises.ts` now fails the build if a
+      * preset promises a cap no row of that preset can reach.
+      */
       methods: {
         /**
         * Open a server-side WebRTC audio-only session. Returns an SDP
@@ -226942,7 +227755,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sdpOffer: zod.z.string()
         }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         handleAnswer: require_sleep.method(zod.z.object({
           deviceId: zod.z.number(),
@@ -226950,7 +227763,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sdpAnswer: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close explicitly. Server also auto-closes on 30s idle. */
         stopSession: require_sleep.method(zod.z.object({
@@ -226958,7 +227771,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sessionId: zod.z.string()
         }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Open a raw-PCM talk session (no WebRTC SDP plumbing). Used by
@@ -226971,7 +227784,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         */
         startTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ sessionId: zod.z.string() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /**
         * Push one chunk of talk-back audio onto the active talk session.
@@ -227006,12 +227819,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           sequenceNumber: zod.z.number().int()
         }), zod.z.object({ accepted: zod.z.boolean() }), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         }),
         /** Close the raw-PCM talk session. Idempotent. */
         endTalkSession: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
           kind: "mutation",
-          auth: "admin"
+          auth: "protected"
         })
       },
       events: { onStatusChanged: { data: zod.z.object({
@@ -244269,7 +245082,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       {
         id: "camera-operator",
         label: "Camera operator",
-        description: "Everything `camera-viewer` does plus PTZ control, intercom, snapshots and recording start/stop. Cannot delete devices or recordings.",
+        description: "Everything `camera-viewer` does plus live control of every granted camera \u2014 PTZ movement, intercom talk-back and on-demand snapshots. Cannot delete devices, and grants nothing on system-scope caps (recording control, users, addons).",
         rows: [{
           type: "category",
           target: "device",
@@ -400869,6 +401682,7 @@ var require_scope_access = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.DEVICE_ENUMERATION_METHODS = void 0;
+    exports.referencedDeviceIds = referencedDeviceIds;
     exports.checkScopeAccess = checkScopeAccess;
     var system_1 = require_dist3();
     var types_1 = require_dist4();
@@ -412794,6 +413608,25 @@ var require_trpc_router = __commonJS({
   }
 });
 
+// ../../server/backend/dist/api/trpc/trpc-error-device-tags.js
+var require_trpc_error_device_tags = __commonJS({
+  "../../server/backend/dist/api/trpc/trpc-error-device-tags.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.trpcErrorDeviceTags = trpcErrorDeviceTags;
+    var scope_access_js_1 = require_scope_access();
+    function trpcErrorDeviceTags(path, input) {
+      if (path === void 0)
+        return {};
+      const ids = (0, scope_access_js_1.referencedDeviceIds)(path, input);
+      const first = ids[0];
+      if (first === void 0)
+        return {};
+      return ids.length > 1 ? { deviceId: first, deviceCount: ids.length } : { deviceId: first };
+    }
+  }
+});
+
 // ../../server/backend/dist/api/trpc/ws-request-census.js
 var require_ws_request_census = __commonJS({
   "../../server/backend/dist/api/trpc/ws-request-census.js"(exports) {
@@ -420876,6 +421709,7 @@ var require_main4 = __commonJS({
     var trpc_context_1 = require_trpc_context();
     var trpc_router_1 = require_trpc_router();
     var trpc_error_principal_1 = require_trpc_error_principal();
+    var trpc_error_device_tags_1 = require_trpc_error_device_tags();
     var ws_request_census_1 = require_ws_request_census();
     var addon_route_jwt_gate_js_1 = require_addon_route_jwt_gate();
     var session_cookie_js_1 = require_session_cookie();
@@ -421174,9 +422008,13 @@ var require_main4 = __commonJS({
               (0, http_request_census_hook_1.recordTrpcHttpRequest)(httpRequestCensus, req, trpcCtx.user);
               return trpcCtx;
             },
-            onError: ({ path: trpcPath, error, ctx }) => {
+            onError: ({ path: trpcPath, error, ctx, input }) => {
               const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC");
               trpcLogger.warn("tRPC error", {
+                // WHICH camera. A refusal on a device-scoped path that names no
+                // deviceId cannot answer "one camera or all of them?" — the
+                // question always asked first (2026-08-29, `intercom.startSession`).
+                tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
                 meta: {
                   code: error.code,
                   path: trpcPath ?? "?",
@@ -421575,9 +422413,12 @@ var require_main4 = __commonJS({
             (0, ws_request_census_1.identifyWsCensusSession)(opts.res, (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user));
             return wsCtx;
           },
-          onError: ({ path: trpcPath, error, ctx }) => {
+          onError: ({ path: trpcPath, error, ctx, input }) => {
             const trpcLogger = app.get(logging_service_1.LoggingService).createLogger("tRPC:ws");
             trpcLogger.warn("tRPC error", {
+              // The socket the viewer uses — this is the transport that logged the
+              // four `intercom.startSession` refusals with no camera on them.
+              tags: (0, trpc_error_device_tags_1.trpcErrorDeviceTags)(trpcPath, input),
               meta: {
                 code: error.code,
                 path: trpcPath ?? "?",