camstack 1.2.63 → 1.2.66

package/dist/{launcher-RA6HGFNQ.js → launcher-EJVL74UN.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-CDgIzo82.js
-var require_dist_CDgIzo82 = __commonJS({
-  "../system/dist/dist-CDgIzo82.js"(exports) {
+// ../system/dist/dist-CcvXUhHK.js
+var require_dist_CcvXUhHK = __commonJS({
+  "../system/dist/dist-CcvXUhHK.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -25997,6 +25997,40 @@ var require_dist_CDgIzo82 = __commonJS({
       /** Unix ms when the group was composed server-side. */
       fetchedAt: zod.z.number()
     });
+    var REDACTED_SECRET = "__camstack_redacted__";
+    function collectSecretConfigKeys(schema) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+      return keys;
+    }
+    function isRecord$2(value) {
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+    function sectionsOf(schema) {
+      if (!isRecord$2(schema)) return [];
+      const sections = schema["sections"];
+      return Array.isArray(sections) ? sections : [];
+    }
+    function fieldsOf(node) {
+      if (!isRecord$2(node)) return [];
+      const fields = node["fields"];
+      return Array.isArray(fields) ? fields : [];
+    }
+    function walkField(field, out) {
+      if (!isRecord$2(field)) return;
+      const type = field["type"];
+      const key = field["key"];
+      if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+      if (type === "group") {
+        for (const child of fieldsOf(field)) walkField(child, out);
+        return;
+      }
+      if (type === "sub-tabs") {
+        const tabs = field["tabs"];
+        if (!Array.isArray(tabs)) return;
+        for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+      }
+    }
     var STREAM_QUALITY_LABELS = {
       high: "High",
       mid: "Mid",
@@ -26225,6 +26259,21 @@ var require_dist_CDgIzo82 = __commonJS({
       bytesMoved: zod.z.number().int(),
       /** Total files discovered up front; null while (or when) unknown. */
       filesTotal: zod.z.number().int().nullable(),
+      /**
+      * Rows this run CORRECTED while moving them — a durable mutation the move
+      * made that nobody asked for, so it is reported where the operator reads the
+      * job rather than only in a log line.
+      *
+      * A footage segment records its byte count in its own NAME, and the durable
+      * hour row derives its aggregates from those names. A file that does not
+      * match its name therefore makes the ledger's sums — and with them quota and
+      * pressure eviction — wrong by the difference, and only a rename can fix it.
+      * On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+      *
+      * Absent on lanes where the question has no meaning: a media blob's size is
+      * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+      */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -26267,11 +26316,18 @@ var require_dist_CDgIzo82 = __commonJS({
       /** Omitted = `move`, the pre-existing behaviour. */
       mode: MediaRelocateModeSchema.optional()
     });
-    var UnstampedEventMediaCountSchema = zod.z.object({
-      media: zod.z.number().int().nonnegative(),
-      retrainFrames: zod.z.number().int().nonnegative(),
-      total: zod.z.number().int().nonnegative()
+    var UnstampedRowsSchema = zod.z.object({
+      present: zod.z.boolean(),
+      rows: zod.z.number().int().nonnegative().nullable()
     });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: UnstampedRowsSchema,
+      retrainFrames: UnstampedRowsSchema,
+      /** True when EITHER collection holds one. The refusal reads this. */
+      anyPresent: zod.z.boolean(),
+      /** Sum across both, or `null` when either lane could not be counted. */
+      total: zod.z.number().int().nonnegative().nullable()
+    }).nullable();
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
@@ -26313,13 +26369,33 @@ var require_dist_CDgIzo82 = __commonJS({
       "recorder",
       "analytics"
     ]);
+    var StorageMigrationMoveProgressSchema = zod.z.object({
+      filesMoved: zod.z.number().int().nonnegative(),
+      /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
+      filesTotal: zod.z.number().int().nonnegative().nullable(),
+      bytesMoved: zod.z.number().int().nonnegative(),
+      /** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+      *  a lane that cannot reconcile. A migration that silently rewrote durable
+      *  rows would be the same failure as one that silently skipped them. */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
+      /** The MOVER's start, not the migration's: a drain restarted after an addon
+      *  crash gets a new mover, and a rate computed from the migration's start
+      *  would silently average in the time nothing was running. */
+      startedAt: zod.z.number(),
+      /** When the coordinator last read these numbers. Paired with `startedAt` it
+      *  is the only honest rate: both clocks are the hub's, so a UI never has to
+      *  subtract its own. */
+      observedAt: zod.z.number()
+    });
     var StorageMigrationMoveSchema = zod.z.object({
       storageClass: StorageMigrationClassSchema,
       fromLocationId: zod.z.string(),
       toLocationId: zod.z.string(),
       moverJobId: zod.z.string().nullable(),
       state: RelocateJobStateSchema.nullable(),
-      error: zod.z.string().nullable()
+      error: zod.z.string().nullable(),
+      /** Last observed mover counters; `null` until the mover has been polled once. */
+      progress: StorageMigrationMoveProgressSchema.nullable()
     });
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
@@ -26365,6 +26441,52 @@ var require_dist_CDgIzo82 = __commonJS({
       })),
       findings: zod.z.array(StorageMigrationFindingSchema)
     });
+    var StorageMigrationLaneSchema = zod.z.enum(["footage", "media"]);
+    var StorageMigrationMoverSchema = zod.z.object({
+      lane: StorageMigrationLaneSchema,
+      job: RelocateJobSchema,
+      /** The coordinator job that armed this mover, or `null` for a mover armed
+      *  directly against the owning addon. */
+      migrationJobId: zod.z.string().nullable(),
+      /** When the hub read these counters. Stamped here so a rate is `bytesMoved`
+      *  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
+      *  a browser subtracting its own `Date.now()` from a server `startedAt` is a
+      *  rate made of two different clocks. */
+      observedAt: zod.z.number()
+    });
+    var StorageMigrationResidueSchema = zod.z.object({
+      storageClass: StorageMigrationClassSchema,
+      /** The location still holding the data. `'*'` for the media lane, whose rows
+      *  move from wherever they are rather than from one named source. */
+      fromLocationId: zod.z.string(),
+      /** Where a drain would move it — the class's CURRENT default. */
+      toLocationId: zod.z.string(),
+      /** Segments (footage lane) or rows (media lane) still on the source. */
+      items: zod.z.number().int().nonnegative().nullable(),
+      /** Bytes on the source; `null` when the lane counts rows rather than bytes. */
+      bytes: zod.z.number().int().nonnegative().nullable()
+    });
+    var StorageMigrationDrainInputSchema = zod.z.object({
+      /** The classes to drain. Each must appear in `storageMigration.residue`, so
+      *  a class whose source is already empty is refused rather than started. */
+      classes: zod.z.array(StorageMigrationClassSchema).min(1),
+      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+    });
+    var RelocateResidueInputSchema = zod.z.object({
+      fromLocationId: zod.z.string().min(1),
+      /** Narrow to one logical class; omit for every profile on the location. */
+      footageClass: RelocateFootageClassSchema.optional()
+    });
+    var RelocateResidueSchema = zod.z.object({
+      segments: zod.z.number().int().nonnegative(),
+      bytes: zod.z.number().int().nonnegative()
+    }).nullable();
+    var RelocatableMediaCountSchema = zod.z.object({ rows: zod.z.number().int().nonnegative() }).nullable();
+    var RelocatableMediaCountInputSchema = zod.z.object({
+      toLocationId: zod.z.string().min(1),
+      /** Omitted = `move`. */
+      mode: MediaRelocateModeSchema.optional()
+    });
     var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
     var StorageLocationSchema = zod.z.object({
       id: zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
@@ -26408,6 +26530,8 @@ var require_dist_CDgIzo82 = __commonJS({
       updatedAt: zod.z.number()
     });
     var StorageLocationRefSchema = zod.z.union([StorageLocationTypeSchema, zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
+    var StorageAccessSchema = zod.z.enum(["local-path", "cap-mediated"]);
+    var STORAGE_ACCESS_FALLBACK = "local-path";
     var StorageLocationDeclarationSchema = zod.z.object({
       /**
       * Global location identifier, e.g. `recordings` or `recordingsLow`.
@@ -26427,6 +26551,19 @@ var require_dist_CDgIzo82 = __commonJS({
       */
       cardinality: zod.z.enum(["single", "multi"]),
       /**
+      * HOW the declaring service reaches the bytes — and therefore WHICH
+      * providers may back a location of this kind. See {@link StorageAccessSchema}
+      * and {@link STORAGE_ACCESS_FALLBACK}.
+      *
+      * Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+      * can only over-restrict (refuse a remote provider for a kind that might
+      * have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+      * permissive direction and is therefore never inferred — a repo guard
+      * (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+      * reached by omission.
+      */
+      access: StorageAccessSchema.optional(),
+      /**
       * When set, the default instance for this location inherits its resolved
       * root from the named location's default instance. Useful for derivative
       * slots (e.g. `recordingsLow` → `recordings`) so operators only need to
@@ -31396,6 +31533,15 @@ var require_dist_CDgIzo82 = __commonJS({
         * calls are sync. Bindings change rarely (only on wrapper toggle or
         * device add/remove) — clients invalidate via the
         * `capability.binding-changed` event.
+        *
+        * "A single round-trip" describes the CLIENT's side and used not to
+        * describe the server's: until 2026-08-30 the resolver read the persisted
+        * wrapper activations once per device, so answering this cost one
+        * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+        * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+        * The server side is now two reads for the whole fleet. Anything PERIODIC
+        * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+        * a warm seed.
         */
         getAllBindings: method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
         /**
@@ -36385,8 +36531,10 @@ var require_dist_CDgIzo82 = __commonJS({
       lastSeen: zod.z.number(),
       /** Frame-rate position history (subject to maxPositionHistory cap). */
       positions: zod.z.array(TrackPositionSchema).readonly(),
-      /** Periodic snapshots at snapshotIntervalMs cadence (subject to
-      *  saveThumbnails policy). */
+      /** Periodic snapshots at snapshotIntervalMs cadence — DEBUG media, produced
+      *  only while `MediaSettings.debugMediaEnabled` is on for the camera (D299;
+      *  the retired `saveThumbnails` used to gate this and the rolling
+      *  `lastFrame` together). Empty is the healthy default, not a capture gap. */
       snapshots: zod.z.array(TrackSnapshotSchema).readonly(),
       /** Deduplicated zones the track has entered at least once. Zone IDS. */
       zonesVisited: zod.z.array(zod.z.string()).readonly(),
@@ -37367,8 +37515,34 @@ var require_dist_CDgIzo82 = __commonJS({
         * happens to stamp it. This count is what the migration planner's
         * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
         * it to zero.
+        *
+        * TWO indexed statements per collection, not a walk. It used to page the
+        * whole collection at 200 rows per RPC ordered by an unindexed column, so
+        * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+        * time it was called, and the migration it gates could never start. The
+        * cheap question (`present`: is there at least one) is asked first and
+        * separately from the expensive one (`rows`), because only the first has
+        * to be answerable for the gate to do its job.
+        *
+        * **`null` is "not measurable", never zero** — at either level. An
+        * unreadable collection must not read as a sealed one.
         */
         countUnstampedEventMedia: method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
+        /**
+        * How many rows a pass would STILL act on against `toLocationId`.
+        *
+        * One derivation, two consumers: it is the media lane's denominator (the
+        * **M** the footage lane gets from the ledger census — D295) and it is the
+        * residue behind "drain remaining". Deriving them separately is how "N of M"
+        * ends up comparing two different populations.
+        *
+        * `null` means the count could not be taken; it is never zero-filled,
+        * because a zero here reads as "nothing left to move".
+        */
+        countRelocatableMedia: method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -39909,6 +40083,35 @@ var require_dist_CDgIzo82 = __commonJS({
         cancel: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
           auth: "admin"
+        }),
+        /**
+        * Every mover running RIGHT NOW, in both lanes, with its counters.
+        *
+        * `status` covers a migration's own moves — the coordinator folds their
+        * progress onto the durable job record it is already polling. This covers
+        * the other case, and it is not hypothetical: a drain armed straight against
+        * `recording.relocateFootage` (the only path that existed before
+        * {@link drain}) has no job to fold into and would otherwise be invisible.
+        */
+        movers: method(zod.z.object({}), zod.z.array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }),
+        /**
+        * What each class's SOURCE still holds, from the archive — never from the
+        * resident index (D295). Only classes with something left (or something
+        * unknown) are listed, so an empty list means there is nothing to drain and
+        * the UI has no honest button to offer.
+        */
+        residue: method(zod.z.object({}), zod.z.array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }),
+        /**
+        * Run the drain half alone, on a class whose default has ALREADY moved.
+        *
+        * It never repoints anything, which is what lets `start` keep refusing a
+        * destination that is already the default: the two verbs cannot be confused
+        * for one another, and no operator can re-repoint a migrated class through
+        * this door.
+        */
+        drain: method(StorageMigrationDrainInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+          kind: "mutation",
+          auth: "admin"
         })
       }
     };
@@ -40418,7 +40621,20 @@ var require_dist_CDgIzo82 = __commonJS({
       */
       scanned: zod.z.number(),
       /** True when the backend could not consider every row that passed the filter. */
-      truncated: zod.z.boolean()
+      truncated: zod.z.boolean(),
+      /**
+      * The `topK` the backend actually ran with.
+      *
+      * Every backend has a ceiling — sqlite-vec's is 4,096 — and a caller asking
+      * past it used to learn nothing but a boolean, from a WARN in the provider's
+      * own log rather than in its answer. That is how an audit asking for 20,000
+      * consumed 4,096 and reported `examined: 4096` as if it had walked the index,
+      * for weeks. `truncated` says THAT the answer was short; this says BY HOW
+      * MUCH, in the return value, where the caller cannot fail to see it.
+      *
+      * Equals the requested `topK` whenever nothing was lowered.
+      */
+      effectiveTopK: zod.z.number().int().positive()
     });
     var VectorDeleteInputSchema = zod.z.object({
       index: zod.z.string(),
@@ -40437,6 +40653,35 @@ var require_dist_CDgIzo82 = __commonJS({
       id: zod.z.string(),
       metadata: VectorMetadataSchema
     })) });
+    var VectorFetchInputSchema = zod.z.object({
+      index: zod.z.string(),
+      ids: zod.z.array(zod.z.string())
+    });
+    var VectorFetchResultSchema = zod.z.object({ items: zod.z.array(zod.z.object({
+      id: zod.z.string(),
+      /** base64 Float32LE — the same wire form `upsert` accepts. */
+      vector: zod.z.string(),
+      metadata: VectorMetadataSchema
+    })) });
+    var VectorScanInputSchema = zod.z.object({
+      index: zod.z.string(),
+      /** Opaque resume point. `0` starts at the top; pass back `nextCursor`. */
+      cursor: zod.z.number().int().nonnegative().default(0),
+      limit: zod.z.number().int().positive()
+    });
+    var VectorScanResultSchema = zod.z.object({
+      items: zod.z.array(zod.z.object({
+        id: zod.z.string(),
+        metadata: VectorMetadataSchema
+      })),
+      /**
+      * Where the next page starts, or `null` when the walk reached the end.
+      *
+      * `null` is the ONLY end-of-index signal. A caller must not infer the end
+      * from a short page: a backend is free to return fewer rows than asked.
+      */
+      nextCursor: zod.z.number().int().nonnegative().nullable()
+    });
     var VectorStatsInputSchema = zod.z.object({ index: zod.z.string() });
     var VectorStatsResultSchema = zod.z.object({
       /** Provider id, so an operator can tell brute force from an ANN index. */
@@ -40467,6 +40712,10 @@ var require_dist_CDgIzo82 = __commonJS({
         query: method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
         /** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
         getByIds: method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+        /** Metadata AND vectors, by named id — see {@link VectorFetchInputSchema}. */
+        fetchByIds: method(VectorFetchInputSchema, VectorFetchResultSchema, { auth: "admin" }),
+        /** One page of the whole index, unranked — see {@link VectorScanInputSchema}. */
+        scan: method(VectorScanInputSchema, VectorScanResultSchema, { auth: "admin" }),
         deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
           kind: "mutation",
           auth: "admin"
@@ -46928,6 +47177,20 @@ var require_dist_CDgIzo82 = __commonJS({
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * What a location STILL holds, asked of the durable hour ledger.
+        *
+        * The number behind "drain remaining": segments and bytes that would still
+        * have to move off `fromLocationId`. It is a ledger aggregate — the archive
+        * — because the resident index is not the archive (D295), and a drain sized
+        * off the index is exactly what reported `done` over 80.3 GB on 2026-08-29.
+        * `null` means the archive could not be asked (no ledger on this node, or
+        * the aggregate failed) and is never conflated with an empty source.
+        */
+        getRelocateResidue: method(RelocateResidueInputSchema, RelocateResidueSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Cancel a running or queued relocate job. A queued job never runs. */
         cancelRelocateJob: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
@@ -52932,6 +53195,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countRelocatableMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.countUnstampedEventMedia": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -54096,6 +54365,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "recording.getRelocateResidue": {
+        capName: "recording",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "recording.getStorageMigrationMoveStatus": {
         capName: "recording",
         capScope: "system",
@@ -54642,12 +54917,30 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "storageMigration.drain": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "storageMigration.movers": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.plan": {
         capName: "storage-migration",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "storageMigration.residue": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.start": {
         capName: "storage-migration",
         capScope: "system",
@@ -55482,6 +55775,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "delete"
       },
+      "vectorStore.fetchByIds": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.getByIds": {
         capName: "vector-store",
         capScope: "system",
@@ -55494,6 +55793,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "vectorStore.scan": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.stats": {
         capName: "vector-store",
         capScope: "system",
@@ -58249,6 +58554,12 @@ var require_dist_CDgIzo82 = __commonJS({
         return METHOD_ACCESS_MAP;
       }
     });
+    Object.defineProperty(exports, "REDACTED_SECRET", {
+      enumerable: true,
+      get: function() {
+        return REDACTED_SECRET;
+      }
+    });
     Object.defineProperty(exports, "RUNTIME_DEFAULTS", {
       enumerable: true,
       get: function() {
@@ -58279,6 +58590,12 @@ var require_dist_CDgIzo82 = __commonJS({
         return SOURCE_DEVICE_TYPES;
       }
     });
+    Object.defineProperty(exports, "STORAGE_ACCESS_FALLBACK", {
+      enumerable: true,
+      get: function() {
+        return STORAGE_ACCESS_FALLBACK;
+      }
+    });
     Object.defineProperty(exports, "STREAM_PROFILE_META", {
       enumerable: true,
       get: function() {
@@ -58387,6 +58704,12 @@ var require_dist_CDgIzo82 = __commonJS({
         return buildStreamParamsConfigSchema;
       }
     });
+    Object.defineProperty(exports, "collectSecretConfigKeys", {
+      enumerable: true,
+      get: function() {
+        return collectSecretConfigKeys;
+      }
+    });
     Object.defineProperty(exports, "coreBlockAddonId", {
       enumerable: true,
       get: function() {
@@ -58789,7 +59112,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59608,7 +59931,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59702,7 +60025,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60599,11 +60922,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-BfAzWvPC.js
-var require_retired_settings_keys_BfAzWvPC = __commonJS({
-  "../system/dist/retired-settings-keys-BfAzWvPC.js"(exports) {
+// ../system/dist/retired-settings-keys-DXZ2xe7C.js
+var require_retired_settings_keys_DXZ2xe7C = __commonJS({
+  "../system/dist/retired-settings-keys-DXZ2xe7C.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62817,8 +63140,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
-    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
+    var require_dist10 = require_dist_CcvXUhHK();
+    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -63281,10 +63604,17 @@ var require_device_manager_addon = __commonJS({
       const live = deps.ctx.kernel?.deviceRegistry?.getById(deviceId)?.type;
       return typeof live === "string" && live.length > 0 ? live : void 0;
     }
-    async function resolveDevicePresence(deps, row, deviceId) {
+    async function resolveDevicePresence(deps, row, deviceId, ledgerNonEmpty) {
       if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
       if (row !== null) return "present";
-      return await deps.rows.count() > 0 ? "absent" : "unknown";
+      return await ledgerNonEmpty() ? "absent" : "unknown";
+    }
+    function onceLedgerNonEmpty(deps) {
+      let pending = null;
+      return () => {
+        if (pending === null) pending = deps.rows.count().then((n) => n > 0);
+        return pending;
+      };
     }
     function capAppliesToDeviceType(def, deviceType) {
       if (deviceType === void 0) return true;
@@ -63293,14 +63623,17 @@ var require_device_manager_addon = __commonJS({
       return declared.some((t) => t === deviceType);
     }
     async function getBindings(deps, input) {
-      const row = await deps.rows.get(input.deviceId);
-      return resolveBindingsForDevice(deps, input.deviceId, row);
+      const [row, store] = await Promise.all([deps.rows.get(input.deviceId), readBindingsStore(deps)]);
+      return resolveBindingsForDevice(deps, input.deviceId, row, {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      });
     }
-    async function resolveBindingsForDevice(deps, deviceId, row) {
+    async function resolveBindingsForDevice(deps, deviceId, row, pass) {
       const storeKey = String(deviceId);
-      const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+      const perDevice = pass.store.deviceBindings[storeKey] ?? {};
       const deviceType = resolveDeviceType(deps, row, deviceId);
-      const presence = await resolveDevicePresence(deps, row, deviceId);
+      const presence = await resolveDevicePresence(deps, row, deviceId, pass.ledgerNonEmpty);
       const entries = [];
       const seenCaps = /* @__PURE__ */ new Set();
       const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
@@ -63400,13 +63733,17 @@ var require_device_manager_addon = __commonJS({
     }
     async function getBindingsBatch(deps, input) {
       const ids = [...new Set(input.deviceIds)];
-      const rows = await deps.rows.getMany(ids);
+      const [rows, store] = await Promise.all([deps.rows.getMany(ids), readBindingsStore(deps)]);
+      const pass = {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      };
       const out = [];
-      for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null));
+      for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null, pass));
       return out;
     }
     async function getAllBindings(deps) {
-      const fleet = await deps.rows.listAll();
+      const [fleet, store] = await Promise.all([deps.rows.listAll(), readBindingsStore(deps)]);
       const rowById = /* @__PURE__ */ new Map();
       const ids = /* @__PURE__ */ new Set();
       for (const row of fleet) {
@@ -63419,8 +63756,12 @@ var require_device_manager_addon = __commonJS({
         deps.ctx.logger.warn("getAllBindings found no devices \u2014 warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
         return [];
       }
+      const pass = {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      };
       const out = [];
-      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null));
+      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null, pass));
       return out;
     }
     async function lookupPersistedStableId(deps, deviceId) {
@@ -63980,7 +64321,12 @@ var require_device_manager_addon = __commonJS({
         ...sourceInfoGetDevice !== void 0 ? { sourceInfo: sourceInfoGetDevice } : {}
       };
     }
-    async function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren) {
+    function persistedChildIds(childRows, liveChildren) {
+      const live = /* @__PURE__ */ new Set();
+      for (const device of liveChildren) live.add(device.id);
+      return childRows.filter((row) => !live.has(row.meta.id)).map((row) => row.meta.id);
+    }
+    function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs) {
       const results = [];
       const seen = /* @__PURE__ */ new Set();
       const rowById = /* @__PURE__ */ new Map();
@@ -63996,9 +64342,9 @@ var require_device_manager_addon = __commonJS({
         const childStableId = m.stableId;
         const key = String(m.id);
         if (seen.has(key)) continue;
-        const persistedConfig = await pctx.settings.readDeviceStore(m.id);
+        const persistedConfig = configs.get(m.id) ?? {};
         const metadata = row.metadata;
-        const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
+        const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig, childStableId, ownerAddonId);
         results.push({
           id: m.id,
           stableId: childStableId,
@@ -64013,7 +64359,7 @@ var require_device_manager_addon = __commonJS({
           probed: pctx.host.resolveDeviceProbed(m.id),
           features: persistedFeatures(m.features),
           isCamera: false,
-          config: persistedConfig ?? {},
+          config: persistedConfig,
           metadata,
           ...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
           ...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -64040,7 +64386,8 @@ var require_device_manager_addon = __commonJS({
       }
       const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
       const liveChildren = pctx.registry?.getChildren(parentDeviceId) ?? [];
-      return [...await projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren)];
+      const configs = await readDeviceConfigs(pctx, persistedChildIds(childRows, liveChildren));
+      return [...projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs)];
     }
     async function getChildrenBatch(pctx, input) {
       const parentIds = [...new Set(input.parentDeviceIds)];
@@ -64068,11 +64415,14 @@ var require_device_manager_addon = __commonJS({
         if (bucket === void 0) liveByParent.set(parentId, [device]);
         else bucket.push(device);
       }
+      const configIds = [];
+      for (const parentId of owners.keys()) configIds.push(...persistedChildIds(rowsByParent.get(parentId) ?? [], liveByParent.get(parentId) ?? []));
+      const configs = await readDeviceConfigs(pctx, configIds);
       for (const [parentId, ownerAddonId] of owners) {
         const childRows = rowsByParent.get(parentId) ?? [];
         const liveChildren = liveByParent.get(parentId) ?? [];
         if (childRows.length === 0 && liveChildren.length === 0) continue;
-        const projected = await projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren);
+        const projected = projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren, configs);
         if (projected.length > 0) out[String(parentId)] = [...projected];
       }
       return out;
@@ -65114,18 +65464,20 @@ var require_device_manager_addon = __commonJS({
     }
     async function setWrapperActive(deps, input) {
       const storeKey = String(input.deviceId);
-      const store = await readBindingsStore(deps.bindingsDeps);
-      const perDevice = { ...store.deviceBindings[storeKey] };
-      if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
-      else perDevice[input.capName] = { wrapperAddonId: null };
-      const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
-        ...store.deviceBindings,
-        [storeKey]: perDevice
-      } : (() => {
-        const { [storeKey]: _drop, ...rest } = store.deviceBindings;
-        return rest;
-      })();
-      await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+      await deps.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const store = await readBindingsStore(deps.bindingsDeps);
+        const perDevice = { ...store.deviceBindings[storeKey] };
+        if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
+        else perDevice[input.capName] = { wrapperAddonId: null };
+        const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
+          ...store.deviceBindings,
+          [storeKey]: perDevice
+        } : (() => {
+          const { [storeKey]: _drop, ...rest } = store.deviceBindings;
+          return rest;
+        })();
+        await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+      });
       deps.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
         timestamp: /* @__PURE__ */ new Date(),
@@ -65404,12 +65756,13 @@ var require_device_manager_addon = __commonJS({
       });
       await pctx.settings.clearDeviceStore(deviceId);
       await pctx.settings.clearDeviceRuntimeState(deviceId);
-      const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
       const bindingKey = String(deviceId);
-      if (bindingsStore.deviceBindings[bindingKey]) {
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
+        if (!bindingsStore.deviceBindings[bindingKey]) return;
         const { [bindingKey]: _removedBindings, ...restBindings } = bindingsStore.deviceBindings;
         await writeBindingsStore(pctx.bindingsDeps, { deviceBindings: restBindings });
-      }
+      });
       pctx.host.remoteNativeCaps.delete(deviceId);
       pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(deviceId);
       pctx.metaStore.idToAddonId.delete(deviceId);
@@ -65751,7 +66104,9 @@ var require_device_manager_addon = __commonJS({
         ...def,
         unit: require_dist10.normalizeUnit(def.unit) ?? def.unit
       } : def]));
-      await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+      });
     }
     async function applyInitialMeta(pctx, input) {
       const { deviceId, name, location, type, integrationId, linkDeviceId, role } = input;
@@ -65894,16 +66249,21 @@ var require_device_manager_addon = __commonJS({
     async function addLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) throw new Error("[device-manager] addLocation: name must be non-empty");
-      const current = (await pctx.metaStore.readStore()).locations ?? [];
-      if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
-      await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const current = (await pctx.metaStore.readStore()).locations ?? [];
+        if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
+        await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+      });
     }
     async function removeLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) return;
-      const current = (await pctx.metaStore.readStore()).locations ?? [];
-      const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
-      if (remaining.length !== current.length) await pctx.settings.writeAddonStore({ locations: remaining });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const current = (await pctx.metaStore.readStore()).locations ?? [];
+        const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
+        if (remaining.length === current.length) return;
+        await pctx.settings.writeAddonStore({ locations: remaining });
+      });
       if (input.cascade !== true) return;
       const cleared = await pctx.metaStore.withMetaWriteLock(async () => {
         const out = [];
@@ -65944,23 +66304,40 @@ var require_device_manager_addon = __commonJS({
     function isRoleDisplayDefaults(value) {
       return value !== null && typeof value === "object" && !Array.isArray(value);
     }
+    function createWriteLock() {
+      let chain = Promise.resolve();
+      return async (fn) => {
+        const previous = chain;
+        let release = () => {
+        };
+        chain = new Promise((resolve) => {
+          release = resolve;
+        });
+        try {
+          await previous.catch(() => {
+          });
+          return await fn();
+        } finally {
+          release();
+        }
+      };
+    }
     var DeviceMetaStore = class {
       settings;
       registry;
       rows;
+      withAddonStoreWriteLock;
       /** Synchronous ownership cache, keyed by NUMERIC deviceId → owning addonId.
       *  The persisted row store is authoritative but reads are async; hub-side
       *  callers (e.g. `CapabilityRegistry.getNativeProvider` fallback) need
       *  ownership without awaiting. Kept in sync with every register/remove and
       *  warmed from persistence on boot. */
       idToAddonId = /* @__PURE__ */ new Map();
-      /** Serialises every read-modify-write of a device row through one promise
-      *  chain (see `withMetaWriteLock`). Per-instance state. */
-      metaWriteChain = Promise.resolve();
-      constructor(settings, registry, rows) {
+      constructor(settings, registry, rows, withAddonStoreWriteLock = createWriteLock()) {
         this.settings = settings;
         this.registry = registry;
         this.rows = rows;
+        this.withAddonStoreWriteLock = withAddonStoreWriteLock;
       }
       /** The read currently in flight, or null. Never a settled value — see
       *  {@link readStore}. */
@@ -65991,22 +66368,7 @@ var require_device_manager_addon = __commonJS({
         this.inFlightRead = read;
         return read;
       };
-      withMetaWriteLock = async (fn) => {
-        const previous = this.metaWriteChain;
-        let release = () => {
-        };
-        const next = new Promise((resolve) => {
-          release = resolve;
-        });
-        this.metaWriteChain = next;
-        try {
-          await previous.catch(() => {
-          });
-          return await fn();
-        } finally {
-          release();
-        }
-      };
+      withMetaWriteLock = createWriteLock();
       /** The whole persisted row for one device, or `null`. */
       getRow = async (deviceId) => this.rows.get(deviceId);
       /**
@@ -66040,11 +66402,24 @@ var require_device_manager_addon = __commonJS({
         ids.delete(parentId);
         return [...ids];
       };
-      allocateNextDeviceId = async () => {
+      /**
+      * Mint the next numeric device id.
+      *
+      * A read-modify-write of `nextDeviceId`, and it must hold the addon-store
+      * lock for the whole of it. Serialising the WRITES is not enough and never
+      * was: two callers that both read `N` both write `N + 1` and both return
+      * `N`, so two devices receive the same id. (`writeAddonStore` is itself
+      * read-modify-write over the addon's whole key range, so an unlocked bump
+      * can also be reverted wholesale by a concurrent `setWrapperActive`.)
+      *
+      * Callers hold {@link withMetaWriteLock} — this is the one nesting, and it
+      * only ever goes meta ⊃ addon-store.
+      */
+      allocateNextDeviceId = async () => this.withAddonStoreWriteLock(async () => {
         const current = (await this.readStore()).nextDeviceId ?? 1;
         await this.settings.writeAddonStore({ nextDeviceId: current + 1 });
         return current;
-      };
+      });
     };
     var CENSUS_STACK_FRAMES = 3;
     function siteFromStack(stack) {
@@ -67238,6 +67613,17 @@ var require_device_manager_addon = __commonJS({
       * it through {@link bindingsDeps} or the `ProviderContext`.
       */
       deviceRows = null;
+      /**
+      * The ONE lock ordering every read-modify-write of this addon's
+      * `addon-settings` key range (`deviceBindings`, `locations`, `nextDeviceId`,
+      * `roleDisplayDefaults`).
+      *
+      * It lives on the addon rather than on `DeviceMetaStore` because the writers
+      * do not all go through that class — `setWrapperActive` and `removeDevice`'s
+      * bindings purge reach the store through `BindingsDeps` — and two locks over
+      * one key range is the same defect one level up. Handed to both.
+      */
+      addonStoreWriteLock = createWriteLock();
       /** Build the dependency context the extracted binding resolvers consume. */
       get bindingsDeps() {
         const rows = this.deviceRows;
@@ -67246,7 +67632,8 @@ var require_device_manager_addon = __commonJS({
           ctx: this.ctx,
           capabilityRegistry: this.capabilityRegistry,
           remoteNativeCaps: this.remoteNativeCaps,
-          rows
+          rows,
+          withAddonStoreWriteLock: this.addonStoreWriteLock
         };
       }
       async getBindings(input) {
@@ -67315,7 +67702,7 @@ var require_device_manager_addon = __commonJS({
         } catch (err) {
           this.ctx.logger.warn("retired-row purge failed", { meta: { error: require_dist10.errMsg(err) } });
         }
-        const metaStore = new DeviceMetaStore(settings, registry, deviceRows);
+        const metaStore = new DeviceMetaStore(settings, registry, deviceRows, this.addonStoreWriteLock);
         this.stateMirrorImpl = new DeviceStateMirror(this.ctx);
         const stateMirror = this.stateMirrorImpl;
         const resolvePersistedById = metaStore.resolvePersistedById;
@@ -67567,7 +67954,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67704,7 +68091,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67894,7 +68281,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75707,7 +76094,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76272,7 +76659,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -78894,7 +79281,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -80010,8 +80397,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
-    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
+    var require_dist10 = require_dist_CcvXUhHK();
+    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -80342,11 +80729,16 @@ var require_sqlite_settings_addon = __commonJS({
       const resolve = (field) => {
         const expr = fieldExprFor(field, shape);
         if (expr === null && mode === "mutate") throw new UnsafeFilterError(`filter refers to "${field}", which this collection cannot express \u2014 refusing to run a bulk mutation with a dropped predicate`);
+        if (expr === null && mode === "measure") throw new UnsafeFilterError(`filter refers to "${field}", which this collection cannot express \u2014 refusing to answer with a number counted over a different question`);
         return expr;
       };
       for (const [field, value] of Object.entries(filter?.where ?? {})) {
         const expr = resolve(field);
         if (expr === null) continue;
+        if (value === null) {
+          clauses.push(`${expr} IS NULL`);
+          continue;
+        }
         clauses.push(`${expr} = ?`);
         params.push(serialize2(value));
       }
@@ -80369,6 +80761,10 @@ var require_sqlite_settings_addon = __commonJS({
       for (const [field, value] of Object.entries(filter?.whereNot ?? {})) {
         const expr = resolve(field);
         if (expr === null) continue;
+        if (value === null) {
+          clauses.push(`${expr} IS NOT NULL`);
+          continue;
+        }
         clauses.push(`(${expr} IS NULL OR ${expr} != ?)`);
         params.push(serialize2(value));
       }
@@ -80881,13 +81277,17 @@ var require_sqlite_settings_addon = __commonJS({
       * (visibility, kind, device, time window, expiry) — so `total` counted rows
       * the page could never show, including other users'.
       *
-      * `select` mode, deliberately: `count` must be forgiving in exactly the way
-      * `query` is, or the two disagree again for a new reason.
+      * `measure` mode. `count` compiles the same predicates `query` does — the
+      * two must never disagree about WHICH rows they are talking about — but it
+      * refuses a predicate it cannot express rather than skipping it. `query`
+      * hands back rows and a caller can see the filter did not bite; a count
+      * hands back a number, and the whole collection and the intended subset are
+      * the same shape.
       */
       async count({ namespace, collection, filter }) {
         const scoped = this.scopedName(namespace, collection);
         const decl = this.requireDeclared(scoped);
-        const { whereSql, params } = compileFilter$1(filter, this.shapeOf(decl), "select", (v) => this.serializeColumnValue(v));
+        const { whereSql, params } = compileFilter$1(filter, this.shapeOf(decl), "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT COUNT(*) AS cnt FROM "${scoped}"${whereSql}`;
         return this.measured({
           op: "count",
@@ -80905,8 +81305,10 @@ var require_sqlite_settings_addon = __commonJS({
       * projection — an unresolvable field THROWS rather than being dropped, because
       * a missing aggregate comes back as a number that looks real.
       *
-      * `select` mode on the filter, so this agrees with `query` and `count` about
-      * which rows it is talking about.
+      * `measure` mode on the filter, so this agrees with `query` and `count`
+      * about which rows it is talking about — and, since 2026-08-30, refuses an
+      * unresolvable PREDICATE for the same reason it already refused an
+      * unresolvable FIELD. Both come back as a number that looks real.
       */
       async aggregate({ namespace, collection, fields, filter }) {
         const scoped = this.scopedName(namespace, collection);
@@ -80918,7 +81320,7 @@ var require_sqlite_settings_addon = __commonJS({
           if (col === null) throw new UnsafeFilterError(`aggregate cannot read "${f.field}" on "${scoped}" \u2014 it is not a column of this collection, and answering without it would return a number that looks real`);
           selects.push(`${f.op.toUpperCase()}(${col}) AS "a${i}"`);
         });
-        const { whereSql, params } = compileFilter$1(filter, shape, "select", (v) => this.serializeColumnValue(v));
+        const { whereSql, params } = compileFilter$1(filter, shape, "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT ${selects.join(", ")} FROM "${scoped}"${whereSql}`;
         const row = this.measured({
           op: "aggregate",
@@ -80942,7 +81344,7 @@ var require_sqlite_settings_addon = __commonJS({
         const shape = this.shapeOf(decl);
         const col = fieldExprFor(field, shape);
         if (col === null) return [];
-        const { whereSql: where, params } = compileFilter$1(filter, shape, "select", (v) => this.serializeColumnValue(v));
+        const { whereSql: where, params } = compileFilter$1(filter, shape, "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT ${`CAST((${col} - ?) / ? AS INTEGER)`} AS bucket, COUNT(*) AS count FROM "${scoped}"${where} GROUP BY bucket ORDER BY bucket`;
         return this.measured({
           op: "histogram",
@@ -81223,8 +81625,10 @@ var require_sqlite_settings_addon = __commonJS({
       * connection whose `sqlite_stat1` visibility and temp schema match.
       *
       * `EXPLAIN QUERY PLAN` prepares and plans; it does not execute the statement,
-      * so it costs no page reads of its own. It is still called only from the
-      * slow-call path, once per shape per window.
+      * so it costs no page reads of its own. In production it is called only from
+      * the slow-call path, once per shape per window; it is public so a guard can
+      * assert that a declared index is the one the planner actually picks — "we
+      * added an index" and "the query uses it" are different claims.
       *
       * Never throws. A plan that cannot be taken (a statement the engine will no
       * longer prepare, a closed handle mid-shutdown) is a missing ANSWER, not a
@@ -81773,7 +82177,88 @@ var require_sqlite_settings_addon = __commonJS({
         return {
           matches,
           scanned: rows.length,
-          truncated: k < params.topK && rows.length >= k
+          truncated: k < params.topK && rows.length >= k,
+          effectiveTopK: k
+        };
+      }
+      /**
+      * Ids read back WITH their vectors.
+      *
+      * `vec0` returns a vector column as the packed Float32 blob it stores, which
+      * is byte-for-byte what `upsert` was given — so the round trip is a base64
+      * encode and nothing else. No re-normalisation, no float re-ordering: a
+      * gallery loaded through here ranks identically to one loaded from the JSON
+      * column it replaced.
+      */
+      async fetchByIds(index, ids) {
+        this.specOf(index);
+        if (ids.length === 0) return [];
+        const placeholders = ids.map(() => "?").join(",");
+        const rows = this.measured({
+          op: "vectorFetch",
+          collection: tableFor(index)
+        }, () => this.db.prepare(`SELECT id, embedding, deviceId, timestamp, className, modelId, extra
+           FROM ${tableFor(index)} WHERE id IN (${placeholders})`).all(...ids));
+        const out = [];
+        for (const raw of rows) {
+          if (typeof raw !== "object" || raw === null) continue;
+          const row = raw;
+          const id = asText(row["id"]);
+          if (id === null) continue;
+          const blob = row["embedding"];
+          if (!Buffer.isBuffer(blob)) {
+            this.logger.warn("sqlite-vec: row has no readable vector \u2014 skipped", { meta: {
+              index,
+              id
+            } });
+            continue;
+          }
+          out.push({
+            id,
+            vector: blob.toString("base64"),
+            metadata: rebuild(row)
+          });
+        }
+        return out;
+      }
+      /**
+      * One page of the whole index, unranked.
+      *
+      * `LIMIT ? OFFSET ?` over the `vec0` table with NO `MATCH` clause: a plain
+      * scan, so the extension's KNN `k` ceiling ({@link VEC_KNN_MAX_K}) does not
+      * apply and no distance is computed at all. Ordered by `id` so a cursor means
+      * the same thing across calls — `rowid` order is not stable under the
+      * DELETE-then-INSERT upsert this class performs.
+      *
+      * The cursor is an OFFSET, so rows deleted behind the walk shift the window.
+      * That is acceptable and deliberate for the one caller: a reconcile that
+      * misses a row this pass sees it next pass, and the alternative — a keyset
+      * cursor on a virtual table whose ordering the extension owns — buys nothing
+      * for a walk that is idempotent by construction.
+      */
+      async scan(index, cursor, limit) {
+        this.specOf(index);
+        const offset = Math.max(0, Math.floor(cursor));
+        const take = Math.max(1, Math.floor(limit));
+        const rows = this.measured({
+          op: "vectorScan",
+          collection: tableFor(index)
+        }, () => this.db.prepare(`SELECT id, deviceId, timestamp, className, modelId, extra
+           FROM ${tableFor(index)} ORDER BY id LIMIT ? OFFSET ?`).all(BigInt(take), BigInt(offset)));
+        const items = [];
+        for (const raw of rows) {
+          if (typeof raw !== "object" || raw === null) continue;
+          const row = raw;
+          const id = asText(row["id"]);
+          if (id === null) continue;
+          items.push({
+            id,
+            metadata: rebuild(row)
+          });
+        }
+        return {
+          items,
+          nextCursor: rows.length < take ? null : offset + rows.length
         };
       }
       async getByIds(index, ids) {
@@ -82111,6 +82596,8 @@ var require_sqlite_settings_addon = __commonJS({
             ...input.filter !== void 0 ? { filter: input.filter } : {}
           }),
           getByIds: async (input) => ({ items: await vectorIndex.getByIds(input.index, input.ids) }),
+          fetchByIds: async (input) => ({ items: await vectorIndex.fetchByIds(input.index, input.ids) }),
+          scan: async (input) => vectorIndex.scan(input.index, input.cursor, input.limit),
           deleteByIds: async (input) => ({ deleted: await vectorIndex.deleteByIds(input.index, input.ids) }),
           deleteByFilter: async (input) => ({ deleted: await vectorIndex.deleteByFilter(input.index, input.filter) }),
           stats: async (input) => vectorIndex.stats(input.index)
@@ -82290,7 +82777,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82496,6 +82983,10 @@ var require_storage_orchestrator_addon = __commonJS({
       "recorder",
       "pipeline"
     ];
+    function describeUnstamped(lane) {
+      if (!lane.present) return "0";
+      return lane.rows === null ? "an unknown number of" : lane.rows.toString();
+    }
     var StorageMigrationCoordinator = class {
       deps;
       active = null;
@@ -82526,7 +83017,8 @@ var require_storage_orchestrator_addon = __commonJS({
             toLocationId: target.id,
             moverJobId: null,
             state: null,
-            error: null
+            error: null,
+            progress: null
           });
           if (BLOCKING_ONLY_CLASSES.includes(storageClass)) findings.push({
             code: "blockingOnly",
@@ -82538,12 +83030,21 @@ var require_storage_orchestrator_addon = __commonJS({
         if (moves.length === 0) throw new Error("select at least one storage class");
         if (moves.some((move) => move.storageClass === "eventMedia")) {
           const unstamped = await this.deps.participants.analytics.countUnstamped();
-          if (unstamped.total > 0) {
-            if (mode === "nonBlocking") throw new Error(`${unstamped.total.toString()} event-media row(s) still carry no locationId (${unstamped.media.toString()} media, ${unstamped.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+          if (unstamped === null) {
+            if (mode === "nonBlocking") throw new Error("could not determine whether any event-media row still carries no locationId. A non-blocking cutover repoints the default and would silently orphan every such row, so an unmeasured collection is refused exactly like a non-empty one. Retry, or run the blocking mode, which stamps rows as it moves them.");
+            findings.push({
+              code: "unstampedEventMediaRows",
+              storageClass: "eventMedia",
+              message: "the count of event-media rows carrying no locationId could not be taken \u2014 treat it as unknown, not as zero. This blocking migration stamps them as it moves them, so it is safe regardless; a non-blocking one would be refused."
+            });
+          } else if (unstamped.anyPresent) {
+            const scale = unstamped.total === null ? "an unknown number of" : unstamped.total.toString();
+            const perLane = `${describeUnstamped(unstamped.media)} media, ${describeUnstamped(unstamped.retrainFrames)} retrain frames`;
+            if (mode === "nonBlocking") throw new Error(`${scale} event-media row(s) still carry no locationId (${perLane}). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
             findings.push({
               code: "unstampedEventMediaRows",
               storageClass: "eventMedia",
-              message: `${unstamped.total.toString()} event-media row(s) carry no locationId. This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
+              message: `${scale} event-media row(s) carry no locationId (${perLane}). This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
             });
           }
         }
@@ -82624,7 +83125,8 @@ var require_storage_orchestrator_addon = __commonJS({
               ...move,
               moverJobId: null,
               state: null,
-              error: null
+              error: null,
+              progress: null
             })),
             pauseLeaseId: null,
             pausedParticipants: [],
@@ -82658,6 +83160,178 @@ var require_storage_orchestrator_addon = __commonJS({
         await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
         return true;
       }
+      /**
+      * Every mover running right now, in both lanes — including the ones no
+      * migration armed.
+      *
+      * `status` already carries a migration's own progress (the coordinator folds
+      * it onto each move from the poll it is already doing). This exists for the
+      * other half: `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+      * are operator-callable, and until {@link drain} existed that was the only way
+      * to run a drain at all. Such a mover has no job to fold into, so without this
+      * read a five-hour operation is invisible in the UI.
+      *
+      * `migrationJobId` is best-effort by construction: the coordinator keeps ONE
+      * durable job, so a mover armed by an older, since-overwritten migration
+      * reports `null`. That is the honest answer — nothing here can still claim it.
+      */
+      async movers() {
+        const job = await this.status();
+        const owned = /* @__PURE__ */ new Map();
+        for (const move of job?.moves ?? []) if (move.moverJobId !== null) owned.set(move.moverJobId, job?.jobId ?? "");
+        const [footage, media] = await Promise.all([this.deps.participants.recorder.listMovers(), this.deps.participants.analytics.listMovers()]);
+        const observedAt = this.deps.now();
+        const label = (lane, jobs) => jobs.map((mover) => ({
+          lane,
+          job: mover,
+          migrationJobId: owned.get(mover.jobId) ?? null,
+          observedAt
+        }));
+        return [...label("footage", footage), ...label("media", media)];
+      }
+      /**
+      * What every class's source STILL holds — the census behind a "drain
+      * remaining" action.
+      *
+      * A class appears here only when something is (or might be) left on a
+      * location that is not its default. An empty result therefore means exactly
+      * "there is nothing to drain", which is what lets the UI offer the action
+      * only when it is true, and what lets {@link drain} refuse rather than start
+      * a job that would move nothing and report `done` — the failure mode D295
+      * exists to end.
+      *
+      * `items: null` is "the archive could not be asked" and is still listed. A
+      * residue nobody could measure is the case an operator most needs to see;
+      * dropping it because the read failed would be the quiet success again.
+      */
+      async residue() {
+        const out = [];
+        for (const storageClass of STORAGE_CLASSES) {
+          if (!MOVER_CLASSES.includes(storageClass)) continue;
+          const target = this.deps.locations.getDefaultLocation(storageClass);
+          if (!target) continue;
+          if (laneOf(storageClass) === "media") {
+            const count = await unanswerable(this.deps.participants.analytics.residue({
+              toLocationId: target.id,
+              mode: storageClass === "galleryMedia" ? "gallery" : "move"
+            }));
+            if (count !== null && count.rows === 0) continue;
+            out.push({
+              storageClass,
+              fromLocationId: "*",
+              toLocationId: target.id,
+              items: count?.rows ?? null,
+              bytes: null
+            });
+            continue;
+          }
+          for (const source of this.deps.locations.listLocations({ type: storageClass })) {
+            if (source.id === target.id) continue;
+            const census = await unanswerable(this.deps.participants.recorder.residue({
+              fromLocationId: source.id,
+              footageClass: storageClass === "recordingsLow" ? "recordingsLow" : "recordings"
+            }));
+            if (census !== null && census.segments === 0) continue;
+            out.push({
+              storageClass,
+              fromLocationId: source.id,
+              toLocationId: target.id,
+              items: census?.segments ?? null,
+              bytes: census?.bytes ?? null
+            });
+          }
+        }
+        return out;
+      }
+      /**
+      * Run the DRAIN half alone, against classes whose default has already moved.
+      *
+      * ## Why this is a second verb rather than a looser `start`
+      *
+      * `start` refuses a destination that is already the class's default
+      * (`"recordingsLow:ssd" is already the "recordingsLow" default`). That refusal
+      * is correct and it is load-bearing: there is genuinely nothing left to
+      * repoint, and an operator must never be able to re-repoint a migrated class
+      * by accident. Making `start` idempotent — "an already-repointed class
+      * proceeds straight to draining" — would delete that protection AND make the
+      * verb mean two different things depending on state, so the confirmation an
+      * operator reads ("pauses the writers…") would be a lie half the time.
+      *
+      * `drain` instead cannot repoint AT ALL: it never touches
+      * `setDefaultLocations`, and its job starts in `draining` with `repointed`
+      * already true, so the `repointing` / `refreshing` / `resuming` blocks of
+      * {@link run} are behind it and unreachable. The two verbs are disjoint, and
+      * `start`'s refusal keeps meaning exactly what it meant.
+      *
+      * ## Why it re-derives the work instead of resuming the old job
+      *
+      * The finished job is the audit of what happened; re-opening it destroys
+      * that. And a drain is needed in cases where no migration job ever existed
+      * (a mover armed by hand, footage stranded on a location an operator added
+      * and then un-defaulted). One job = one operation, and the work list comes
+      * from {@link residue} — the archive — not from what a previous job believed.
+      */
+      async drain(input) {
+        if (this.startReserved) throw new Error("storage migration is already active");
+        this.startReserved = true;
+        try {
+          const existing = await this.status();
+          if (existing && isTerminal(existing) && existing.pausedParticipants.length > 0) {
+            await this.releaseAfterTerminal(existing);
+            await this.persist(existing);
+            if (existing.pausedParticipants.length > 0) throw new Error(`storage migration ${existing.jobId} still holds maintenance leases`);
+          }
+          if (existing && !isTerminal(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
+          for (const storageClass of input.classes) {
+            if (MOVER_CLASSES.includes(storageClass)) continue;
+            throw new Error(`No mover owns "${storageClass}" \u2014 there is nothing that can drain it. Move it by hand.`);
+          }
+          const residue = await this.residue();
+          const moves = [];
+          const destinations = {};
+          for (const storageClass of input.classes) {
+            const remaining = residue.filter((entry) => entry.storageClass === storageClass);
+            if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its default location \u2014 there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
+            for (const entry of remaining) {
+              if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED \u2014 a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen, or make an enabled location the "${storageClass}" default first.`);
+              moves.push({
+                storageClass,
+                fromLocationId: entry.fromLocationId,
+                toLocationId: entry.toLocationId,
+                moverJobId: null,
+                state: null,
+                error: null,
+                progress: null
+              });
+              destinations[storageClass] = entry.toLocationId;
+            }
+          }
+          const now = this.deps.now();
+          const job = {
+            jobId: this.deps.newId(),
+            phase: "draining",
+            mode: "nonBlocking",
+            destinations,
+            throttleMbps: input.throttleMbps ?? 40,
+            moves,
+            pauseLeaseId: null,
+            pausedParticipants: [],
+            repointed: true,
+            cancelRequested: false,
+            startedAt: now,
+            updatedAt: now,
+            finishedAt: null,
+            error: null
+          };
+          await this.persist(job);
+          this.active = job;
+          this.runPromise = this.run(job);
+          this.runPromise;
+          return job.jobId;
+        } finally {
+          this.startReserved = false;
+        }
+      }
       /** Boot recovery resumes a durable unfinished state. A missing in-memory
       * child mover is recreated from the same copy-if-absent input. */
       async recover() {
@@ -82867,6 +83541,14 @@ var require_storage_orchestrator_addon = __commonJS({
             }
             move.state = status.state;
             move.error = status.error;
+            move.progress = {
+              filesMoved: status.filesMoved,
+              filesTotal: status.filesTotal,
+              bytesMoved: status.bytesMoved,
+              ...status.rowsReconciled === void 0 ? {} : { rowsReconciled: status.rowsReconciled },
+              startedAt: status.startedAt,
+              observedAt: this.deps.now()
+            };
             if (status.state === "failed") throw new Error(move.error ?? `${move.storageClass} move failed`);
             if (status.state === "cancelled") {
               job.cancelRequested = true;
@@ -82886,9 +83568,10 @@ var require_storage_orchestrator_addon = __commonJS({
       *
       * The gate is the RE-COUNT, not the seal job's terminal state: a seal that
       * failed some rows still finishes, and "finished" is not "there are none
-      * left". A non-zero count here fails the job while nothing has been paused
+      * left". A remaining row here fails the job while nothing has been paused
       * and nothing has been repointed, which is the cheapest possible place to
-      * discover it.
+      * discover it. So does a re-count that could not be TAKEN: the gate opens on
+      * a measured absence, and only on that.
       *
       * The seal's own mover job id is deliberately NOT durable. It is idempotent
       * and cheap, so a coordinator restart mid-seal simply re-runs the whole
@@ -82898,7 +83581,8 @@ var require_storage_orchestrator_addon = __commonJS({
       async sealEventMedia(job) {
         const move = job.moves.find((candidate) => candidate.storageClass === "eventMedia");
         if (move === void 0) return;
-        if ((await this.deps.participants.analytics.countUnstamped()).total > 0) {
+        const before = await this.deps.participants.analytics.countUnstamped();
+        if (before === null || before.anyPresent) {
           const started = await this.deps.participants.analytics.startDrain({
             toLocationId: move.fromLocationId,
             mode: "seal"
@@ -82907,7 +83591,8 @@ var require_storage_orchestrator_addon = __commonJS({
           if (job.cancelRequested) return;
         }
         const after = await this.deps.participants.analytics.countUnstamped();
-        if (after.total > 0) throw new Error(`event-media seal left ${after.total.toString()} row(s) without a locationId (${after.media.toString()} media, ${after.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
+        if (after === null) throw new Error("event-media seal ran, but whether any row still carries no locationId could not be measured afterwards. Unknown is not zero; nothing has been paused or repointed.");
+        if (after.anyPresent) throw new Error(`event-media seal left ${after.total === null ? "an unknown number of" : after.total.toString()} row(s) without a locationId (${describeUnstamped(after.media)} media, ${describeUnstamped(after.retrainFrames)} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
       }
       async waitForSeal(job, moverJobId) {
         const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -82986,6 +83671,13 @@ var require_storage_orchestrator_addon = __commonJS({
         await this.deps.state.set(job);
       }
     };
+    async function unanswerable(read) {
+      try {
+        return await read;
+      } catch {
+        return null;
+      }
+    }
     function requireLease(job) {
       if (job.pauseLeaseId === null) throw new Error("storage migration has no maintenance lease");
       return job.pauseLeaseId;
@@ -83006,6 +83698,9 @@ var require_storage_orchestrator_addon = __commonJS({
         const existing = map.get(declaration.id);
         if (existing !== void 0) {
           if (existing.cardinality !== declaration.cardinality) throw new Error(`Storage location cardinality conflict for id "${declaration.id}": "${existing.cardinality}" (first declarer) vs "${declaration.cardinality}" (later declarer). All addons declaring the same storage location id must agree on cardinality.`);
+          const existingAccess = existing.access ?? "local-path";
+          const declaredAccess = declaration.access ?? "local-path";
+          if (existingAccess !== declaredAccess) throw new Error(`Storage location access conflict for id "${declaration.id}": "${existingAccess}" (first declarer) vs "${declaredAccess}" (later declarer). All addons declaring the same storage location id must agree on access \u2014 a later declaration must never widen what an earlier one restricted.`);
           continue;
         }
         map.set(declaration.id, declaration);
@@ -83021,11 +83716,23 @@ var require_storage_orchestrator_addon = __commonJS({
         cardinalityOf(id) {
           return map.get(id)?.cardinality ?? null;
         },
+        accessOf(id) {
+          const declaration = map.get(id);
+          if (declaration === void 0) return null;
+          return declaration.access ?? "local-path";
+        },
         list() {
           return frozen;
         }
       };
     }
+    function resolveRefusalFor(location, locality) {
+      if (locality !== false) return null;
+      return `storage.resolve is a request for a path this node can open with node:fs, and location "${location.id}" is served by the remote provider "${location.providerId}" (nodeLocal: false) \u2014 the path it would return exists on the remote host, not here. Read and write this location through the storage cap (read/write, or beginUpload/writeChunk/finalizeUpload) instead.`;
+    }
+    function canProbeOccupancyLocally(locality) {
+      return locality === true;
+    }
     function resolveEngine(getEngines) {
       const engines = getEngines();
       if (engines.length === 0) throw new Error("settings-store: no data-store-provider engine is registered \u2014 the data door has nothing behind it");
@@ -83053,6 +83760,47 @@ var require_storage_orchestrator_addon = __commonJS({
         declareCollection: async (input) => (await engine()).declareCollection(input)
       };
     }
+    var EMPTY_SECRET_KEYS = /* @__PURE__ */ new Set();
+    function secretKeysOfProviderInfo(info) {
+      return require_dist10.collectSecretConfigKeys(info.configSchema);
+    }
+    function redactLocationConfig(config, secretKeys) {
+      if (secretKeys.size === 0) return config;
+      let touched = false;
+      const out = {};
+      for (const [key, value] of Object.entries(config)) {
+        if (secretKeys.has(key) && value !== void 0 && value !== null && value !== "") {
+          out[key] = require_dist10.REDACTED_SECRET;
+          touched = true;
+          continue;
+        }
+        out[key] = value;
+      }
+      return touched ? out : config;
+    }
+    function redactLocation(location, secretKeys) {
+      const config = redactLocationConfig(location.config, secretKeys);
+      if (config === location.config) return location;
+      return {
+        ...location,
+        config
+      };
+    }
+    function restoreRedactedSecrets(incoming, stored, secretKeys) {
+      if (secretKeys.size === 0) return incoming;
+      let touched = false;
+      const out = {};
+      for (const [key, value] of Object.entries(incoming)) {
+        if (value !== "__camstack_redacted__" || !secretKeys.has(key)) {
+          out[key] = value;
+          continue;
+        }
+        touched = true;
+        const previous = stored?.[key];
+        if (previous !== void 0) out[key] = previous;
+      }
+      return touched ? out : incoming;
+    }
     async function collectProviderInfos(providers, onError) {
       const out = [];
       for (const [index, p] of providers.entries()) try {
@@ -83193,6 +83941,34 @@ var require_storage_orchestrator_addon = __commonJS({
           backfilled: backfill.length,
           total: this.locations.size
         } });
+        this.reportDisabledDefaults();
+      }
+      /**
+      * Shout about a persisted row that is BOTH the type default and disabled.
+      *
+      * `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
+      * default) and neither can `setDefaultLocations` — but hydrate writes rows
+      * straight into the map without either, so a hand-edited store, a partial
+      * migration or a row written by another build can. It matters because every
+      * bare-type ref resolves through {@link getDefaultLocation}: on such a row
+      * `storage.write({ location: 'eventMedia' })` and the migration coordinator's
+      * drain destination both point at a disk the operator turned off. That is the
+      * one thing this model must never do silently.
+      *
+      * Reported, never repaired: flipping an operator's flag back on at boot would
+      * be the system overruling the switch instead of obeying it. The coordinator
+      * refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
+      * path is deliberately left working, because narrowing a READ is a worse bug
+      * than the one this line reports.
+      */
+      reportDisabledDefaults() {
+        for (const loc of this.locations.values()) {
+          if (!loc.isDefault || loc.enabled !== false) continue;
+          this.logger.error("storage-orchestrator: the type DEFAULT is disabled \u2014 every bare-type ref for this type resolves to a location the operator turned off. Enable it, or make another location the default.", { meta: {
+            id: loc.id,
+            type: loc.type
+          } });
+        }
       }
       /**
       * Inject the declaration-driven cardinality source. Called once by the
@@ -83264,6 +84040,7 @@ var require_storage_orchestrator_addon = __commonJS({
           loaded: this.locations.size,
           isSystemUpgraded: upgraded
         } });
+        this.reportDisabledDefaults();
       }
       /**
       * Boot backfill (SP1): stamp `nodeId` on every persisted node-local
@@ -83374,6 +84151,66 @@ var require_storage_orchestrator_addon = __commonJS({
       * implicitly-demoted siblings are persisted before the in-memory map
       * mutation returns. Persistence errors propagate to the caller.
       */
+      /**
+      * Refuse a `(location kind, provider)` pair the kind cannot use.
+      *
+      * The rule, in one line: a `'local-path'` kind requires a provider whose
+      * `getProviderInfo().nodeLocal` is `true`.
+      *
+      * `nodeLocal` is the honest name for "this provider's `resolve` returns a
+      * path on the filesystem of the node that resolved it". The
+      * `storage-provider` cap's own discriminated union already forces every
+      * provider to declare it, and all four remote providers declare `false`, so
+      * no new cap surface is needed to ask the question.
+      *
+      * Three-valued on purpose. Only a POSITIVE `false` refuses:
+      *  - `true`      → node-local, always fine.
+      *  - `false`     → the provider is known and known to be remote. REFUSE.
+      *  - `undefined` → the provider has not registered yet (early boot, an addon
+      *    still loading). That is "unknown", not "remote", and a read that could
+      *    not be made must never destroy work (D49) — the system seed runs
+      *    through this path before any provider registers. Allowed, and logged,
+      *    so the allowance is never silent.
+      *
+      * The DECLARATION side is read the same way. A kind the registry does not
+      * know is `local-path` (fail-closed: an unknown kind is not a permissive
+      * one), but NO REGISTRY AT ALL is a different statement — nothing has been
+      * loaded, so nothing can be concluded about any kind. The addon injects the
+      * registry inside `onInitialize`, before the `storage` cap is mounted, so
+      * there is no window in which an operator upsert sees this branch; a service
+      * constructed without one is the in-memory/early-boot path.
+      */
+      refuseIncompatibleProvider(input) {
+        const registry = this.registry;
+        if (registry === null) {
+          this.logger.debug("storage-orchestrator: no location declarations loaded \u2014 access constraint not evaluated", { meta: {
+            id: input.id,
+            type: input.type,
+            providerId: input.providerId
+          } });
+          return;
+        }
+        const access = registry.accessOf(input.type) ?? "local-path";
+        if (access !== "local-path") return;
+        const nodeLocal = this.nodeLocalResolver?.(input.providerId);
+        if (nodeLocal === true) return;
+        if (nodeLocal === void 0) {
+          this.logger.debug("storage-orchestrator: provider not yet classified \u2014 allowing a local-path upsert", { meta: {
+            id: input.id,
+            type: input.type,
+            providerId: input.providerId,
+            access
+          } });
+          return;
+        }
+        this.logger.warn("storage-orchestrator: REFUSED a remote provider for a local-path kind", { meta: {
+          id: input.id,
+          type: input.type,
+          providerId: input.providerId,
+          access
+        } });
+        throw new Error(`Storage kind "${input.type}" is declared access "local-path": the service that owns it reads and writes its bytes with node:fs on the path "storage.resolve" returns, so it can only be backed by a node-local provider. Provider "${input.providerId}" is remote (nodeLocal: false) and its resolved paths do not exist on this node. Refusing location "${input.id}".`);
+      }
       upsertLocation(input) {
         const now = Date.now();
         const existing = this.locations.get(input.id);
@@ -83383,6 +84220,7 @@ var require_storage_orchestrator_addon = __commonJS({
             if (already) throw new Error(`Storage type "${input.type}" is single \u2014 only one location allowed (existing: "${already.id}"). Edit it instead of adding a new one.`);
           }
         }
+        this.refuseIncompatibleProvider(input);
         if (this.nodeLocalResolver?.(input.providerId) === true && !input.nodeId) input = {
           ...input,
           nodeId: "hub"
@@ -83853,6 +84691,19 @@ var require_storage_orchestrator_addon = __commonJS({
       */
       nodeLocalByProvider = /* @__PURE__ */ new Map();
       /**
+      * Cached `providerId → secret config keys`, derived from each provider's own
+      * `configSchema` in the SAME refresh as `nodeLocalByProvider` — one
+      * `getProviderInfo()` round trip answers both questions.
+      *
+      * An absent providerId yields an EMPTY set, which redacts nothing. That is
+      * the one direction this cache can be wrong in, so it is worth saying why it
+      * is acceptable: the entry is populated at the same moment the provider
+      * becomes resolvable at all, so a location whose provider is unknown here
+      * cannot be dispatched to either — there is no window in which a credential
+      * is readable through a provider the orchestrator can otherwise use.
+      */
+      secretKeysByProvider = /* @__PURE__ */ new Map();
+      /**
       * Disposers run on `onShutdown` — currently the eventBus subscription
       * for `capability:provider-registered` events used by the lazy seed
       * fallback. Stored separately from the `BaseAddon` disposer chain so
@@ -83887,13 +84738,24 @@ var require_storage_orchestrator_addon = __commonJS({
           listLocations: async ({ type }) => {
             const rows = type !== void 0 ? service.listLocations({ type }) : service.listLocations();
             return Promise.all(rows.map(async (loc) => ({
-              ...loc,
+              ...this.redacted(loc),
               capacity: await this.localCapacityOf(loc)
             })));
           },
-          getDefaultLocation: async ({ type }) => service.getDefaultLocation(type),
+          getDefaultLocation: async ({ type }) => {
+            const loc = service.getDefaultLocation(type);
+            return loc === null ? null : this.redacted(loc);
+          },
           listLocationDeclarations: async () => service.listDeclarations(),
-          upsertLocation: async (input) => service.upsertLocation(input),
+          upsertLocation: async (input) => {
+            const stored = service.getLocationById(input.id);
+            const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId));
+            const saved = service.upsertLocation(config === input.config ? input : {
+              ...input,
+              config
+            });
+            return this.redacted(saved);
+          },
           deleteLocation: async ({ id, force }) => {
             await service.deleteLocation(id, { force: force === true });
           },
@@ -83938,6 +84800,7 @@ var require_storage_orchestrator_addon = __commonJS({
           },
           resolve: async ({ location, relativePath }) => {
             const loc = service.resolveRef(location);
+            this.refuseRemoteResolve(loc);
             return (await service.getProviderFor(loc)).resolve({
               location: loc,
               relativePath
@@ -84060,6 +84923,8 @@ var require_storage_orchestrator_addon = __commonJS({
               startMove: (input) => this.ctx.api.recording.startStorageMigrationMove.mutate(input),
               startDrain: (input) => this.ctx.api.recording.relocateFootage.mutate(input),
               getMove: (jobId) => this.ctx.api.recording.getStorageMigrationMoveStatus.query({ jobId }),
+              listMovers: () => this.ctx.api.recording.listRelocateJobs.query({}),
+              residue: (input) => this.ctx.api.recording.getRelocateResidue.query(input),
               cancelMove: async (jobId) => (await this.ctx.api.recording.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
                 await this.ctx.api.recording.refreshStorageLocationsForMigration.mutate({ leaseId });
@@ -84076,6 +84941,8 @@ var require_storage_orchestrator_addon = __commonJS({
               startDrain: (input) => this.ctx.api.pipelineAnalytics.relocateMedia.mutate(input),
               countUnstamped: () => this.ctx.api.pipelineAnalytics.countUnstampedEventMedia.query({}),
               getMove: (jobId) => this.ctx.api.pipelineAnalytics.getStorageMigrationMoveStatus.query({ jobId }),
+              listMovers: () => this.ctx.api.pipelineAnalytics.listRelocateMediaJobs.query({}),
+              residue: (input) => this.ctx.api.pipelineAnalytics.countRelocatableMedia.query(input),
               cancelMove: async (jobId) => (await this.ctx.api.pipelineAnalytics.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
                 await this.ctx.api.pipelineAnalytics.refreshStorageLocationsForMigration.mutate({ leaseId });
@@ -84091,7 +84958,10 @@ var require_storage_orchestrator_addon = __commonJS({
           plan: (input) => migration.plan(input),
           start: async (input) => ({ jobId: await migration.start(input) }),
           status: ({ jobId }) => migration.status(jobId),
-          cancel: async ({ jobId }) => ({ cancelled: await migration.cancel(jobId) })
+          cancel: async ({ jobId }) => ({ cancelled: await migration.cancel(jobId) }),
+          movers: () => migration.movers(),
+          residue: () => migration.residue(),
+          drain: async (input) => ({ jobId: await migration.drain(input) })
         };
         await this.seedFromDeclarations();
         const eventBus = this.ctx.eventBus;
@@ -84236,6 +85106,34 @@ var require_storage_orchestrator_addon = __commonJS({
         }
         return out;
       }
+      /** Declared secret config keys for a provider; empty when unknown. */
+      secretKeysFor(providerId) {
+        return this.secretKeysByProvider.get(providerId) ?? EMPTY_SECRET_KEYS;
+      }
+      /** A location with its provider's declared secrets replaced by the sentinel. */
+      redacted(location) {
+        return redactLocation(location, this.secretKeysFor(location.providerId));
+      }
+      /**
+      * Is this location backed by a provider that serves a genuine local
+      * filesystem? `true` / `false` / `undefined` — see
+      * `StorageOrchestratorService.refuseIncompatibleProvider` for why the
+      * unknown case is kept distinct rather than folded into either answer.
+      */
+      providerIsNodeLocal(location) {
+        return this.nodeLocalByProvider.get(location.providerId);
+      }
+      /** See the call site in the `resolve` dispatch, and `access-guards.ts`. */
+      refuseRemoteResolve(location) {
+        const refusal = resolveRefusalFor(location, this.providerIsNodeLocal(location));
+        if (refusal === null) return;
+        this.ctx.logger.warn("storage-orchestrator: REFUSED resolve() on a remote-backed location", { meta: {
+          id: location.id,
+          type: location.type,
+          providerId: location.providerId
+        } });
+        throw new Error(refusal);
+      }
       /** statfs capacity of a location's basePath, walking up to the nearest
       *  existing ancestor. Null for remote-node locations or unstattable paths. */
       async localCapacityOf(loc) {
@@ -84323,6 +85221,13 @@ var require_storage_orchestrator_addon = __commonJS({
       * errno — `EACCES`, `EIO`, a stale NFS handle — is `unknown` and refuses.
       */
       async locationOccupancy(location) {
+        if (!canProbeOccupancyLocally(this.providerIsNodeLocal(location))) {
+          this.ctx.logger.debug("storage-orchestrator: occupancy unknown \u2014 location is not backed by a local filesystem", { meta: {
+            id: location.id,
+            providerId: location.providerId
+          } });
+          return "unknown";
+        }
         if ((location.nodeId === void 0 || location.nodeId === "" ? HUB_NODE_ID : location.nodeId) !== (this.service?.getLocalNodeId() ?? HUB_NODE_ID)) return "unknown";
         const basePath = this.locationBasePath(location.id);
         if (basePath === null) return "unknown";
@@ -84405,7 +85310,10 @@ var require_storage_orchestrator_addon = __commonJS({
             error: err instanceof Error ? err.message : String(err)
           } });
         });
-        for (const info of infos) this.nodeLocalByProvider.set(info.providerId, info.nodeLocal);
+        for (const info of infos) {
+          this.nodeLocalByProvider.set(info.providerId, info.nodeLocal);
+          this.secretKeysByProvider.set(info.providerId, secretKeysOfProviderInfo(info));
+        }
       }
     };
     exports.SqliteLocationStore = SqliteLocationStore;
@@ -84444,7 +85352,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -102505,7 +103413,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -104448,9 +105356,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CJrvRDlD.js
-var require_sleep_CJrvRDlD = __commonJS({
-  "../types/dist/sleep-CJrvRDlD.js"(exports) {
+// ../types/dist/sleep-CWWLTM6W.js
+var require_sleep_CWWLTM6W = __commonJS({
+  "../types/dist/sleep-CWWLTM6W.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -107151,6 +108059,7 @@ var require_sleep_CJrvRDlD = __commonJS({
           cancelStorageMigrationMove: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelStorageMigrationMove", "mutation", input),
           relocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "relocateMedia", "mutation", input),
           countUnstampedEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "countUnstampedEventMedia", "query", input),
+          countRelocatableMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "countRelocatableMedia", "query", input),
           listRelocateMediaJobs: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRelocateMediaJobs", "query", input),
           cancelRelocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelRelocateMedia", "mutation", input),
           listOpsLog: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listOpsLog", "query", input),
@@ -108115,7 +109024,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CJrvRDlD();
+    var require_sleep = require_sleep_CWWLTM6W();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -108335,7 +109244,10 @@ var require_addon = __commonJS({
         "createApiKey": { "isAdmin": false },
         "createUser": { "isAdmin": false }
       },
-      "vector-store": { "declareIndex": { "metric": "cosine" } },
+      "vector-store": {
+        "declareIndex": { "metric": "cosine" },
+        "scan": { "cursor": 0 }
+      },
       "zones": {
         "addZone": { "zone": { "__nested__": {
           "kind": "polygon",
@@ -114994,12 +115906,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-DVODn-qc.js
-var require_manifest_python_deps_DVODn_qc = __commonJS({
-  "../system/dist/manifest-python-deps-DVODn-qc.js"(exports) {
+// ../system/dist/manifest-system-deps-oJMkWSX-.js
+var require_manifest_system_deps_oJMkWSX = __commonJS({
+  "../system/dist/manifest-system-deps-oJMkWSX-.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_CDgIzo82();
+    require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -115702,14 +116614,14 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         dispose
       };
     }
-    var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
+    var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
     var DEFAULT_REGISTRY = "https://registry.npmjs.org";
     function bootstrappedCliPath(cacheDir) {
       return node_path.join(cacheDir, "package", "bin", "npm-cli.js");
     }
     async function defaultProbeSystemNpm() {
       try {
-        await execFileAsync$1("npm", ["--version"], { timeout: 15e3 });
+        await execFileAsync$2("npm", ["--version"], { timeout: 15e3 });
         return true;
       } catch {
         return false;
@@ -115727,7 +116639,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       await node_fs.promises.writeFile(destTgz, bytes);
     }
     async function defaultExtractTarball(tgzPath, destDir) {
-      await execFileAsync$1("tar", [
+      await execFileAsync$2("tar", [
         "-xzf",
         tgzPath,
         "-C",
@@ -115755,7 +116667,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         registry: options.registry,
         logger: options.logger
       });
-      return execFileAsync$1(invocation.command, [...invocation.argsPrefix, ...args], {
+      return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
         ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
         timeout: options.timeout ?? 3e5
       });
@@ -115813,7 +116725,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       const namedAddon = Object.values(mod).find(isAddonConstructor);
       if (namedAddon) return namedAddon;
     }
-    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
     function defaultNpmCacheDir() {
       return node_path.join(node_os.tmpdir(), "camstack-npm-bootstrap");
     }
@@ -116041,7 +116953,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
             return;
           }
           logger.warn("@electron/rebuild not available \u2014 falling back to npx", { meta: { addonDir } });
-          await execFileAsync("npx", [
+          await execFileAsync$1("npx", [
             "--yes",
             "electron-rebuild",
             "-m",
@@ -117244,11 +118156,11 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
               });
             }
           };
-          const PROBE_TIMEOUT_MS = 3e4;
+          const PROBE_TIMEOUT_MS2 = 3e4;
           const runProbe = async () => {
             if (typeof lifecycleHost.onProbe !== "function") return;
             try {
-              await Promise.race([lifecycleHost.onProbe(), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`onProbe timeout after ${PROBE_TIMEOUT_MS}ms`)), PROBE_TIMEOUT_MS))]);
+              await Promise.race([lifecycleHost.onProbe(), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`onProbe timeout after ${PROBE_TIMEOUT_MS2}ms`)), PROBE_TIMEOUT_MS2))]);
             } catch (err) {
               opts.logger.warn("device.onProbe() threw or timed out \u2014 continuing with stale flags (slice subscription will reconcile if probe lands later)", {
                 tags: {
@@ -119107,6 +120019,174 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         createClient: (nodeId) => new UdsLocalTransportClient(localEndpointPath(nodeId))
       };
     }
+    var DEFAULT_RETENTION_SECONDS = 300;
+    var DEFAULT_MAX_TRIPLES = 4e3;
+    var PARENT_ROUTED_PROVIDER_ADDON_ID = "(unresolved: parent-routed)";
+    var CapUsageRegistry = class {
+      retentionSeconds;
+      maxTriples;
+      map = /* @__PURE__ */ new Map();
+      triples = 0;
+      droppedTriples = 0;
+      constructor(opts) {
+        this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? DEFAULT_RETENTION_SECONDS);
+        this.maxTriples = Math.max(1, opts?.maxTriples ?? DEFAULT_MAX_TRIPLES);
+      }
+      /**
+      * Record one observed cap call.
+      *
+      * On the hot path: this runs once per cross-process cap call on hub-main's
+      * event loop, which is the cluster's only queue (D181). Three Map lookups, an
+      * integer increment, and — only when the wall clock has moved on — a bounded
+      * clear. No allocation once a triple exists, and it NEVER throws into the
+      * call it observes.
+      */
+      recordCall(rec) {
+        try {
+          if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
+          if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
+          const window2 = this.windowFor(rec);
+          if (window2 === null) return;
+          const sec = Math.floor(rec.atMs / 1e3);
+          if (window2.lastCallAtMs !== 0) {
+            const lastSec = Math.floor(window2.lastCallAtMs / 1e3);
+            const advanced = Math.min(sec - lastSec, this.retentionSeconds);
+            for (let k = 1; k <= advanced; k++) window2.buckets[(lastSec + k) % this.retentionSeconds] = 0;
+          }
+          const idx = sec % this.retentionSeconds;
+          window2.buckets[idx] = (window2.buckets[idx] ?? 0) + 1;
+          if (rec.atMs > window2.lastCallAtMs) window2.lastCallAtMs = rec.atMs;
+        } catch {
+        }
+      }
+      getGraph(opts) {
+        const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
+        const minMs = opts.nowMs - windowSeconds * 1e3;
+        const nowSec = Math.floor(opts.nowMs / 1e3);
+        const out = [];
+        for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window2] of byCap) {
+          if (window2.lastCallAtMs < minMs) continue;
+          const count = this.sumWindow(window2, nowSec, windowSeconds);
+          if (count === 0) continue;
+          const callsPerMin = count / windowSeconds * 60;
+          out.push({
+            callerAddonId: caller,
+            providerAddonId: provider,
+            capName,
+            callsPerMin,
+            lastCallAtMs: window2.lastCallAtMs
+          });
+        }
+        return out;
+      }
+      /** See {@link CapUsageStats}. Cheap — three counters, no scan. */
+      getStats() {
+        return {
+          triples: this.triples,
+          maxTriples: this.maxTriples,
+          droppedTriples: this.droppedTriples
+        };
+      }
+      /** Test / diagnostic helper — drops all recorded calls. */
+      clear() {
+        this.map.clear();
+        this.triples = 0;
+        this.droppedTriples = 0;
+      }
+      /**
+      * Sum the buckets covering `(nowSec - windowSeconds, nowSec]`.
+      *
+      * The scan starts at `lastSec`, never at `nowSec`. `recordCall` clears the
+      * buckets the ring has advanced OVER, which by definition stops at the last
+      * write: the buckets for the seconds since then still hold whatever the
+      * previous pass left in them, and reading `nowSec` down would count it. A
+      * triple that went quiet for a couple of minutes and then made one call would
+      * report the burst it made five minutes earlier.
+      *
+      * No lower bound is needed beyond the window itself: every bucket at or below
+      * `lastSec - retention` was cleared by the advance that reached `lastSec`, so
+      * it reads zero anyway. The loop is bounded by `windowSeconds ≤ retention`.
+      */
+      sumWindow(window2, nowSec, windowSeconds) {
+        const lastSec = Math.floor(window2.lastCallAtMs / 1e3);
+        const from = Math.min(nowSec, lastSec);
+        const floorSec = nowSec - windowSeconds;
+        let count = 0;
+        for (let s = from; s > floorSec; s--) count += window2.buckets[s % this.retentionSeconds] ?? 0;
+        return count;
+      }
+      /**
+      * The ring for this triple, creating it if the ceiling allows. `null` means
+      * the observation is dropped — counted, never silent (see
+      * {@link CapUsageStats.droppedTriples}).
+      */
+      windowFor(rec) {
+        let byProvider = this.map.get(rec.callerAddonId);
+        if (!byProvider) {
+          byProvider = /* @__PURE__ */ new Map();
+          this.map.set(rec.callerAddonId, byProvider);
+        }
+        let byCap = byProvider.get(rec.providerAddonId);
+        if (!byCap) {
+          byCap = /* @__PURE__ */ new Map();
+          byProvider.set(rec.providerAddonId, byCap);
+        }
+        const existing = byCap.get(rec.capName);
+        if (existing) return existing;
+        if (this.triples >= this.maxTriples) {
+          this.reclaimExpired(rec.atMs);
+          if (this.triples >= this.maxTriples) {
+            this.droppedTriples++;
+            return null;
+          }
+          byProvider = this.map.get(rec.callerAddonId);
+          if (!byProvider) {
+            byProvider = /* @__PURE__ */ new Map();
+            this.map.set(rec.callerAddonId, byProvider);
+          }
+          byCap = byProvider.get(rec.providerAddonId);
+          if (!byCap) {
+            byCap = /* @__PURE__ */ new Map();
+            byProvider.set(rec.providerAddonId, byCap);
+          }
+        }
+        const created = {
+          buckets: new Uint32Array(this.retentionSeconds),
+          lastCallAtMs: 0
+        };
+        byCap.set(rec.capName, created);
+        this.triples++;
+        return created;
+      }
+      /**
+      * Drop every triple whose whole ring has aged out — its last call is older
+      * than the retention window, so it can contribute to no query. O(triples),
+      * and only reachable when the ceiling is full, so it is amortised away by the
+      * admissions it enables.
+      */
+      reclaimExpired(nowMs) {
+        const cutoff = nowMs - this.retentionSeconds * 1e3;
+        for (const [caller, byProvider] of this.map) {
+          for (const [provider, byCap] of byProvider) {
+            for (const [capName, window2] of byCap) {
+              if (window2.lastCallAtMs >= cutoff) continue;
+              byCap.delete(capName);
+              this.triples--;
+            }
+            if (byCap.size === 0) byProvider.delete(provider);
+          }
+          if (byProvider.size === 0) this.map.delete(caller);
+        }
+      }
+    };
+    var singleton = null;
+    function getCapUsageRegistry() {
+      if (!singleton) singleton = new CapUsageRegistry();
+      return singleton;
+    }
+    function __resetCapUsageRegistryForTests() {
+      singleton = null;
+    }
     function createSharedBusState(retainRecent = false) {
       return {
         handlers: /* @__PURE__ */ new Map(),
@@ -119653,6 +120733,8 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       isAddonPinnedCall;
       /** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
       capTimeoutMs;
+      /** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+      capUsageObserver;
       /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
       egressRoutedCaps = /* @__PURE__ */ new Set();
       /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -119684,6 +120766,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
           this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
           this.isAddonPinnedCall = opts.isAddonPinnedCall;
           this.capTimeoutMs = opts.capTimeoutMs;
+          this.capUsageObserver = opts.capUsageObserver;
         } else {
           this.server = serverOrOptions;
           this.onUnownedCall = onUnownedCallArg;
@@ -119850,6 +120933,30 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         }
         return candidates[0];
       }
+      /**
+      * Publish one cap-usage observation, if a sink is wired.
+      *
+      * Cost discipline — this is on the hot path (D181: hub-main's event loop is
+      * the cluster's only queue): no sink means one undefined check; with a sink
+      * it is one object literal and one `Date.now()`, and the sink itself is O(1).
+      * Wrapped so a broken observer can never fail the call it observes — the
+      * registry swallows too, and BOTH matter: this catch also covers a sink that
+      * is not the registry.
+      */
+      recordCapUsage(callerChildId, providerChildId, capName, methodName) {
+        const sink = this.capUsageObserver;
+        if (sink === void 0 || callerChildId === null) return;
+        try {
+          sink({
+            callerAddonId: callerChildId,
+            providerAddonId: providerChildId ?? "(unresolved: parent-routed)",
+            capName,
+            methodName,
+            atMs: Date.now()
+          });
+        } catch {
+        }
+      }
       /** First child whose cap manifest contains a descriptor matching `predicate`. */
       findChildId(predicate) {
         for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
@@ -120119,7 +121226,9 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
             const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
             const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
             const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
-            if ((!(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+            const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
+            this.recordCapUsage(childId, target, out.capName, out.method);
+            if (target !== null) {
               if (!this.egressRoutedCaps.has(out.capName)) {
                 this.egressRoutedCaps.add(out.capName);
                 this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -120976,77 +122085,6 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       }
       return links;
     }
-    var CapUsageRegistry = class {
-      retentionSeconds;
-      map = /* @__PURE__ */ new Map();
-      constructor(opts) {
-        this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? 300);
-      }
-      recordCall(rec) {
-        try {
-          if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
-          if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
-          let byProvider = this.map.get(rec.callerAddonId);
-          if (!byProvider) {
-            byProvider = /* @__PURE__ */ new Map();
-            this.map.set(rec.callerAddonId, byProvider);
-          }
-          let byCap = byProvider.get(rec.providerAddonId);
-          if (!byCap) {
-            byCap = /* @__PURE__ */ new Map();
-            byProvider.set(rec.providerAddonId, byCap);
-          }
-          let window2 = byCap.get(rec.capName);
-          if (!window2) {
-            window2 = {
-              buckets: Array.from({ length: this.retentionSeconds }, () => 0),
-              lastCallAtMs: 0
-            };
-            byCap.set(rec.capName, window2);
-          }
-          const bucketIdx = Math.floor(rec.atMs / 1e3) % this.retentionSeconds;
-          window2.buckets[bucketIdx] = (window2.buckets[bucketIdx] ?? 0) + 1;
-          if (rec.atMs > window2.lastCallAtMs) window2.lastCallAtMs = rec.atMs;
-        } catch {
-        }
-      }
-      getGraph(opts) {
-        const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
-        const minMs = opts.nowMs - windowSeconds * 1e3;
-        const out = [];
-        for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window2] of byCap) {
-          if (window2.lastCallAtMs < minMs) continue;
-          const nowBucket = Math.floor(opts.nowMs / 1e3);
-          let count = 0;
-          for (let i = 0; i < windowSeconds; i++) {
-            const b = (nowBucket - i + this.retentionSeconds * 1e6) % this.retentionSeconds;
-            count += window2.buckets[b] ?? 0;
-          }
-          if (count === 0) continue;
-          const callsPerMin = count / windowSeconds * 60;
-          out.push({
-            callerAddonId: caller,
-            providerAddonId: provider,
-            capName,
-            callsPerMin,
-            lastCallAtMs: window2.lastCallAtMs
-          });
-        }
-        return out;
-      }
-      /** Test / diagnostic helper — drops all recorded calls. */
-      clear() {
-        this.map.clear();
-      }
-    };
-    var singleton = null;
-    function getCapUsageRegistry() {
-      if (!singleton) singleton = new CapUsageRegistry();
-      return singleton;
-    }
-    function __resetCapUsageRegistryForTests() {
-      singleton = null;
-    }
     function safeExistsSync(path) {
       try {
         return node_fs.existsSync(path);
@@ -122158,6 +123196,156 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       }
       await deps.installPythonRequirements(reqAbs);
     }
+    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    var INSTALL_TIMEOUT_MS = 300 * 1e3;
+    var PROBE_TIMEOUT_MS = 1e4;
+    async function installManifestSystemDeps(declaration, logger, options = {}) {
+      const deps = declaration.systemDependencies;
+      if (!deps || deps.length === 0) return;
+      const hasBinary = options.hasBinary ?? defaultHasBinary;
+      const detectManager = options.detectManager ?? defaultDetectManager;
+      const run = options.run ?? defaultRun;
+      const platform = options.platform ?? process.platform;
+      for (const dep of deps) try {
+        await satisfyOne(dep, declaration.id, {
+          hasBinary,
+          detectManager,
+          run,
+          platform
+        }, logger);
+      } catch (err) {
+        logger.warn("system dependency step failed", { meta: {
+          addonId: declaration.id,
+          binary: dep.binary,
+          error: err instanceof Error ? err.message : String(err)
+        } });
+      }
+    }
+    async function satisfyOne(dep, addonId, rt, logger) {
+      if (await rt.hasBinary(dep.binary)) {
+        logger.debug("system dependency already present", { meta: {
+          addonId,
+          binary: dep.binary
+        } });
+        return;
+      }
+      const manager = await rt.detectManager();
+      if (manager === null) {
+        logger.warn("system dependency missing and no supported package manager on this host", { meta: {
+          addonId,
+          binary: dep.binary,
+          platform: rt.platform,
+          ...dep.reason !== void 0 ? { reason: dep.reason } : {}
+        } });
+        return;
+      }
+      const packageName = dep.packages[manager];
+      if (packageName === void 0 || packageName.length === 0) {
+        logger.warn("system dependency missing and the addon declares no package for this manager", { meta: {
+          addonId,
+          binary: dep.binary,
+          manager,
+          ...dep.reason !== void 0 ? { reason: dep.reason } : {}
+        } });
+        return;
+      }
+      const plan = planFor(manager, packageName);
+      logger.info("installing system dependency", { meta: {
+        addonId,
+        binary: dep.binary,
+        manager,
+        package: packageName
+      } });
+      try {
+        for (const [command, args] of plan.steps) await rt.run(command, args);
+      } catch (err) {
+        logger.warn("system dependency install failed \u2014 the addon loads, its capability must refuse", { meta: {
+          addonId,
+          binary: dep.binary,
+          manager,
+          package: packageName,
+          error: err instanceof Error ? err.message : String(err),
+          ...dep.reason !== void 0 ? { reason: dep.reason } : {}
+        } });
+        return;
+      }
+      if (!await rt.hasBinary(dep.binary)) {
+        logger.warn("system dependency installed but the binary still does not resolve", { meta: {
+          addonId,
+          binary: dep.binary,
+          manager,
+          package: packageName
+        } });
+        return;
+      }
+      logger.info("system dependency installed", { meta: {
+        addonId,
+        binary: dep.binary,
+        manager,
+        package: packageName
+      } });
+    }
+    function planFor(manager, packageName) {
+      switch (manager) {
+        case "apt":
+          return {
+            manager,
+            steps: [["apt-get", ["update"]], ["apt-get", [
+              "install",
+              "-y",
+              "--no-install-recommends",
+              packageName
+            ]]]
+          };
+        case "apk":
+          return {
+            manager,
+            steps: [["apk", [
+              "add",
+              "--no-cache",
+              packageName
+            ]]]
+          };
+        case "dnf":
+          return {
+            manager,
+            steps: [["dnf", [
+              "install",
+              "-y",
+              packageName
+            ]]]
+          };
+        case "brew":
+          return {
+            manager,
+            steps: [["brew", ["install", packageName]]]
+          };
+      }
+    }
+    async function defaultHasBinary(binary) {
+      try {
+        await execFileAsync("command", ["-v", binary], {
+          timeout: PROBE_TIMEOUT_MS,
+          shell: process.platform === "win32" ? false : "/bin/sh"
+        });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    async function defaultDetectManager() {
+      const candidates = node_os.platform() === "darwin" ? ["brew"] : [
+        "apt",
+        "apk",
+        "dnf",
+        "brew"
+      ];
+      for (const candidate of candidates) if (await defaultHasBinary(candidate === "apt" ? "apt-get" : candidate)) return candidate;
+      return null;
+    }
+    async function defaultRun(command, args) {
+      await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+    }
     Object.defineProperty(exports, "AGENT_CAP_FWD_ACTION", {
       enumerable: true,
       get: function() {
@@ -122332,6 +123520,12 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         return NATIVE_PROVIDER_SERVICE_INFIX;
       }
     });
+    Object.defineProperty(exports, "PARENT_ROUTED_PROVIDER_ADDON_ID", {
+      enumerable: true,
+      get: function() {
+        return PARENT_ROUTED_PROVIDER_ADDON_ID;
+      }
+    });
     Object.defineProperty(exports, "RSS_BUDGET_REANNOUNCE_MIN_MS", {
       enumerable: true,
       get: function() {
@@ -122752,6 +123946,12 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         return installManifestPythonDeps;
       }
     });
+    Object.defineProperty(exports, "installManifestSystemDeps", {
+      enumerable: true,
+      get: function() {
+        return installManifestSystemDeps;
+      }
+    });
     Object.defineProperty(exports, "ipcParentLink", {
       enumerable: true,
       get: function() {
@@ -126740,7 +127940,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -126766,7 +127966,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_python_deps = require_manifest_python_deps_DVODn_qc();
+    var require_manifest_system_deps = require_manifest_system_deps_oJMkWSX();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -129235,7 +130435,7 @@ var require_dist3 = __commonJS({
         if (!node_fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
         const modUnknown = await importAddonModuleFresh(entryPath);
         const mod = isRecord$2(modUnknown) ? modUnknown : {};
-        const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
+        const AddonClass = require_manifest_system_deps.resolveAddonClass(mod);
         if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
         this.addons.set(declaration.id, {
           declaration,
@@ -129251,7 +130451,7 @@ var require_dist3 = __commonJS({
       async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
         const modUnknown = await importAddonModuleFresh(modulePath);
         const mod = isRecord$2(modUnknown) ? modUnknown : {};
-        const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
+        const AddonClass = require_manifest_system_deps.resolveAddonClass(mod);
         if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
         this.addons.set(addonId, {
           module: mod,
@@ -130154,7 +131354,7 @@ var require_dist3 = __commonJS({
         await node_fs.promises.writeFile(node_path.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
         await copyDirRecursive(distDir, node_path.join(targetDir, "dist"));
         await copyExtraFileDirs(pkgData, sourceDir, targetDir);
-        require_manifest_python_deps.copyBundledNativeModules(sourceDir, targetDir, this.logger);
+        require_manifest_system_deps.copyBundledNativeModules(sourceDir, targetDir, this.logger);
         await node_fs.promises.writeFile(node_path.join(targetDir, ".install-source"), "local");
         const localPkgVersion = require_dist10.asString(pkgData.version, "0.0.0");
         this.manifest.upsert(packageName, {
@@ -130163,7 +131363,7 @@ var require_dist3 = __commonJS({
         });
         const strippedDeps = stripBundledDeps(pkgData);
         if (strippedDeps["dependencies"] && typeof strippedDeps["dependencies"] === "object" && Object.keys(strippedDeps["dependencies"]).length > 0) try {
-          await require_manifest_python_deps.runNpm([
+          await require_manifest_system_deps.runNpm([
             "install",
             "--omit=dev",
             "--ignore-scripts=false"
@@ -130172,7 +131372,7 @@ var require_dist3 = __commonJS({
           this.logger.warn(`${packageName} \u2014 npm install failed (continuing)`, { meta: { error: require_dist10.errMsg(err) } });
         }
         try {
-          await require_manifest_python_deps.installManifestNativeDeps(targetDir, pkgData, this.logger, this.registry, this.npmCacheDir);
+          await require_manifest_system_deps.installManifestNativeDeps(targetDir, pkgData, this.logger, this.registry, this.npmCacheDir);
         } catch (err) {
           this.logger.warn(`${packageName} \u2014 native deps install failed (continuing)`, { meta: { error: require_dist10.errMsg(err) } });
         }
@@ -130208,7 +131408,7 @@ var require_dist3 = __commonJS({
               tmpDir
             ];
             if (this.registry) args.push("--registry", this.registry);
-            const { stdout } = await require_manifest_python_deps.runNpm(args, this.npmRunOptions(tmpDir, 12e4));
+            const { stdout } = await require_manifest_system_deps.runNpm(args, this.npmRunOptions(tmpDir, 12e4));
             const tgzFiles = node_fs.readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
             if (tgzFiles.length === 0) throw new Error(`npm pack produced no tgz. stdout: ${stdout.trim()}`);
             return node_path.join(tmpDir, tgzFiles[0]);
@@ -130412,7 +131612,7 @@ var require_dist3 = __commonJS({
           dependencies: depNames
         } });
         try {
-          await require_manifest_python_deps.runNpm([
+          await require_manifest_system_deps.runNpm([
             "install",
             "--omit=dev",
             "--omit=peer",
@@ -130472,7 +131672,7 @@ var require_dist3 = __commonJS({
           return;
         }
         try {
-          await require_manifest_python_deps.installManifestNativeDeps(pkgDir, pkgView.raw, this.logger, this.registry, this.npmCacheDir);
+          await require_manifest_system_deps.installManifestNativeDeps(pkgDir, pkgView.raw, this.logger, this.registry, this.npmCacheDir);
         } catch (nativeErr) {
           this.logger.error(`${packageName} \u2014 native dependency install FAILED; install ABORTED (a swapped-in copy would fail every load at the binding)`, { meta: {
             pkgDir,
@@ -131016,7 +132216,7 @@ var require_dist3 = __commonJS({
         if (!(!node_fs.existsSync(distDir) || this.isDistIncomplete(pkgData, sourceDir))) return;
         this.logger.info(`${packageName} \u2014 building (dist/ missing or incomplete)`);
         try {
-          await require_manifest_python_deps.runNpm(["run", "build"], this.npmRunOptions(sourceDir, 18e4));
+          await require_manifest_system_deps.runNpm(["run", "build"], this.npmRunOptions(sourceDir, 18e4));
         } catch (err) {
           const msg = require_dist10.errMsg(err);
           this.logger.warn(`${packageName} auto-build failed`, { meta: { error: msg } });
@@ -205618,7 +206818,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     function createCoreCapService(options) {
       const actions = {};
       for (const { actionName, invoke } of options.actions) actions[actionName] = { handler: async (ctx) => {
-        const raw = require_manifest_python_deps.deserializeTypedArrays(ctx.params);
+        const raw = require_manifest_system_deps.deserializeTypedArrays(ctx.params);
         return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw, readOrigin(ctx));
       } };
       return {
@@ -206399,7 +207599,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
       function emitRunnerEvent(category, sourceId, data) {
         if (!capturedBroker) return;
-        require_manifest_python_deps.getBrokerEventBus(capturedBroker).emit(require_dist10.createEvent(category, {
+        require_manifest_system_deps.getBrokerEventBus(capturedBroker).emit(require_dist10.createEvent(category, {
           type: "core",
           id: sourceId,
           nodeId: parentNodeId
@@ -206423,8 +207623,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           ...applyRunnerNativeAllocator(process.env),
           ...env
         };
-        if (rssBudgetMb === void 0) delete childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV];
-        else childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV] = String(rssBudgetMb);
+        if (rssBudgetMb === void 0) delete childEnv[require_manifest_system_deps.RUNNER_RSS_BUDGET_ENV];
+        else childEnv[require_manifest_system_deps.RUNNER_RSS_BUDGET_ENV] = String(rssBudgetMb);
         const heapFlags = runnerHeapFlags(addons);
         capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
         const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
@@ -207157,12 +208357,12 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return finalJob;
       }
     };
-    exports.AGENT_CAP_FWD_ACTION = require_manifest_python_deps.AGENT_CAP_FWD_ACTION;
-    exports.AGENT_CAP_FWD_SERVICE = require_manifest_python_deps.AGENT_CAP_FWD_SERVICE;
+    exports.AGENT_CAP_FWD_ACTION = require_manifest_system_deps.AGENT_CAP_FWD_ACTION;
+    exports.AGENT_CAP_FWD_SERVICE = require_manifest_system_deps.AGENT_CAP_FWD_SERVICE;
     exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
     exports.ALL_CAPABILITY_DEFINITIONS = require_dist10.ALL_CAPABILITY_DEFINITIONS;
     exports.AddonApiFactory = AddonApiFactory;
-    exports.AddonDepsManager = require_manifest_python_deps.AddonDepsManager;
+    exports.AddonDepsManager = require_manifest_system_deps.AddonDepsManager;
     exports.AddonEngineManager = AddonEngineManager;
     exports.AddonHealthMonitor = AddonHealthMonitor;
     exports.AddonInstaller = AddonInstaller;
@@ -207177,19 +208377,19 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
     exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
     exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
-    exports.CapRouteError = require_manifest_python_deps.CapRouteError;
-    exports.CapRouteResolver = require_manifest_python_deps.CapRouteResolver;
-    exports.CapUsageRegistry = require_manifest_python_deps.CapUsageRegistry;
-    exports.CapabilityHandle = require_manifest_python_deps.CapabilityHandle;
+    exports.CapRouteError = require_manifest_system_deps.CapRouteError;
+    exports.CapRouteResolver = require_manifest_system_deps.CapRouteResolver;
+    exports.CapUsageRegistry = require_manifest_system_deps.CapUsageRegistry;
+    exports.CapabilityHandle = require_manifest_system_deps.CapabilityHandle;
     exports.CapabilityRegistry = CapabilityRegistry;
-    exports.CapabilityUnavailableError = require_manifest_python_deps.CapabilityUnavailableError;
+    exports.CapabilityUnavailableError = require_manifest_system_deps.CapabilityUnavailableError;
     exports.ConfigManager = ConfigManager;
     exports.ConfigStore = require_builtins_sqlite_storage_index.ConfigStore$1;
     exports.ConsoleDestination = require_builtins_console_logging_index.ConsoleDestination$1;
     exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLoggingAddon$1;
     exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
     exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
-    exports.DECISIVE_HEAP_SPACES = require_manifest_python_deps.DECISIVE_HEAP_SPACES;
+    exports.DECISIVE_HEAP_SPACES = require_manifest_system_deps.DECISIVE_HEAP_SPACES;
     exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
     exports.DEFAULT_LAN_HTTP_PORT = require_tls$1.DEFAULT_LAN_HTTP_PORT;
     exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
@@ -207197,33 +208397,33 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.DEVICE_STATUS_METHOD = require_dist10.DEVICE_STATUS_METHOD;
     exports.DataPlaneRegistry = DataPlaneRegistry;
     exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
-    exports.DeviceRegistry = require_manifest_python_deps.DeviceRegistry;
+    exports.DeviceRegistry = require_manifest_system_deps.DeviceRegistry;
     exports.DeviceStore = require_builtins_sqlite_storage_index.DeviceStore$1;
-    exports.EMPTY_SOCKET_DIRECTION = require_manifest_python_deps.EMPTY_SOCKET_DIRECTION;
-    exports.EMPTY_SOCKET_PLANE_BASELINE = require_manifest_python_deps.EMPTY_SOCKET_PLANE_BASELINE;
-    exports.EVENT_PLANE_TOP_N = require_manifest_python_deps.EVENT_PLANE_TOP_N;
-    exports.EVENT_TOPIC_PREFIX = require_manifest_python_deps.EVENT_TOPIC_PREFIX;
+    exports.EMPTY_SOCKET_DIRECTION = require_manifest_system_deps.EMPTY_SOCKET_DIRECTION;
+    exports.EMPTY_SOCKET_PLANE_BASELINE = require_manifest_system_deps.EMPTY_SOCKET_PLANE_BASELINE;
+    exports.EVENT_PLANE_TOP_N = require_manifest_system_deps.EVENT_PLANE_TOP_N;
+    exports.EVENT_TOPIC_PREFIX = require_manifest_system_deps.EVENT_TOPIC_PREFIX;
     exports.EngineManagerResolver = EngineManagerResolver;
     exports.EventBus = EventBus;
     exports.FeatureManager = FeatureManager;
     exports.FilesystemStorageAddon = require_builtins_sqlite_storage_filesystem_storage_addon.FilesystemStorageAddon;
     exports.FilesystemStorageProvider = require_builtins_sqlite_storage_filesystem_storage_addon.FilesystemStorageProvider;
-    exports.FrameDecoder = require_manifest_python_deps.FrameDecoder;
+    exports.FrameDecoder = require_manifest_system_deps.FrameDecoder;
     exports.FsStorageBackend = FsStorageBackend;
     exports.HEALTH_MONITOR_GRACE_PERIOD_MS = HEALTH_MONITOR_GRACE_PERIOD_MS;
     exports.HEALTH_MONITOR_RETRY_INTERVALS_MS = HEALTH_MONITOR_RETRY_INTERVALS_MS;
     exports.HEALTH_MONITOR_TICK_MS = HEALTH_MONITOR_TICK_MS;
-    exports.HEAP_RECLAIM_MIN_INTERVAL_MS = require_manifest_python_deps.HEAP_RECLAIM_MIN_INTERVAL_MS;
-    exports.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS = require_manifest_python_deps.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS;
-    exports.HEAP_RECLAIM_TRIGGER_MB = require_manifest_python_deps.HEAP_RECLAIM_TRIGGER_MB;
-    exports.HEAP_SPACE_REPORT_MIN_MB = require_manifest_python_deps.HEAP_SPACE_REPORT_MIN_MB;
-    exports.HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.HEAP_WATCH_INTERVAL_MS;
-    exports.HEAP_WATCH_WARN_RATIO = require_manifest_python_deps.HEAP_WATCH_WARN_RATIO;
-    exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
-    exports.HUB_CAP_FWD_SERVICE = require_manifest_python_deps.HUB_CAP_FWD_SERVICE;
-    exports.HUB_MAIN_HEAP_WATCH_LABEL = require_manifest_python_deps.HUB_MAIN_HEAP_WATCH_LABEL;
-    exports.HUB_MAIN_RSS_BUDGET_MB = require_manifest_python_deps.HUB_MAIN_RSS_BUDGET_MB;
-    exports.HUB_RSS_BUDGET_ENV = require_manifest_python_deps.HUB_RSS_BUDGET_ENV;
+    exports.HEAP_RECLAIM_MIN_INTERVAL_MS = require_manifest_system_deps.HEAP_RECLAIM_MIN_INTERVAL_MS;
+    exports.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS = require_manifest_system_deps.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS;
+    exports.HEAP_RECLAIM_TRIGGER_MB = require_manifest_system_deps.HEAP_RECLAIM_TRIGGER_MB;
+    exports.HEAP_SPACE_REPORT_MIN_MB = require_manifest_system_deps.HEAP_SPACE_REPORT_MIN_MB;
+    exports.HEAP_WATCH_INTERVAL_MS = require_manifest_system_deps.HEAP_WATCH_INTERVAL_MS;
+    exports.HEAP_WATCH_WARN_RATIO = require_manifest_system_deps.HEAP_WATCH_WARN_RATIO;
+    exports.HUB_CAP_FWD_ACTION = require_manifest_system_deps.HUB_CAP_FWD_ACTION;
+    exports.HUB_CAP_FWD_SERVICE = require_manifest_system_deps.HUB_CAP_FWD_SERVICE;
+    exports.HUB_MAIN_HEAP_WATCH_LABEL = require_manifest_system_deps.HUB_MAIN_HEAP_WATCH_LABEL;
+    exports.HUB_MAIN_RSS_BUDGET_MB = require_manifest_system_deps.HUB_MAIN_RSS_BUDGET_MB;
+    exports.HUB_RSS_BUDGET_ENV = require_manifest_system_deps.HUB_RSS_BUDGET_ENV;
     exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAddon$1;
     exports.HubForwarderDestination = require_builtins_hub_forwarder_index.HubForwarderDestination$1;
     exports.HubLogForwarder = HubLogForwarder;
@@ -207236,8 +208436,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.LifecycleStateMachine = LifecycleStateMachine;
     exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
     exports.LocalAuthAddon = require_builtins_local_auth_local_auth_addon.LocalAuthAddon;
-    exports.LocalChildClient = require_manifest_python_deps.LocalChildClient;
-    exports.LocalChildRegistry = require_manifest_python_deps.LocalChildRegistry;
+    exports.LocalChildClient = require_manifest_system_deps.LocalChildClient;
+    exports.LocalChildRegistry = require_manifest_system_deps.LocalChildRegistry;
     exports.LogManager = LogManager;
     exports.LogRingBuffer = LogRingBuffer;
     exports.LoggingGate = LoggingGate;
@@ -207246,12 +208446,13 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.MAX_LEAF_VALIDITY_DAYS = require_tls$1.MAX_LEAF_VALIDITY_DAYS;
     exports.METHOD_ACCESS_MAP = require_dist10.METHOD_ACCESS_MAP;
     exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
-    exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
+    exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_system_deps.NATIVE_PROVIDER_SERVICE_INFIX;
     exports.NATIVE_SCAN_DEPTH = NATIVE_SCAN_DEPTH;
     exports.NativeMetricsAddon = require_builtins_native_metrics_native_metrics_addon.default;
     exports.NativeMetricsProvider = require_builtins_native_metrics_native_metrics_addon.NativeMetricsProvider;
     exports.NetworkQualityTracker = NetworkQualityTracker;
     exports.NotificationService = NotificationService;
+    exports.PARENT_ROUTED_PROVIDER_ADDON_ID = require_manifest_system_deps.PARENT_ROUTED_PROVIDER_ADDON_ID;
     Object.defineProperty(exports, "PYTHON_VERSION", {
       enumerable: true,
       get: function() {
@@ -207263,21 +208464,21 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.PythonEnvManager = PythonEnvManager;
     exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
     exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
-    exports.RSS_BUDGET_REANNOUNCE_MIN_MS = require_manifest_python_deps.RSS_BUDGET_REANNOUNCE_MIN_MS;
-    exports.RSS_BUDGET_RELEASE_RATIO = require_manifest_python_deps.RSS_BUDGET_RELEASE_RATIO;
-    exports.RUNNER_HEAP_SNAPSHOT_ENV = require_manifest_python_deps.RUNNER_HEAP_SNAPSHOT_ENV;
-    exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
-    exports.RUNNER_RSS_BUDGET_ENV = require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV;
+    exports.RSS_BUDGET_REANNOUNCE_MIN_MS = require_manifest_system_deps.RSS_BUDGET_REANNOUNCE_MIN_MS;
+    exports.RSS_BUDGET_RELEASE_RATIO = require_manifest_system_deps.RSS_BUDGET_RELEASE_RATIO;
+    exports.RUNNER_HEAP_SNAPSHOT_ENV = require_manifest_system_deps.RUNNER_HEAP_SNAPSHOT_ENV;
+    exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_system_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
+    exports.RUNNER_RSS_BUDGET_ENV = require_manifest_system_deps.RUNNER_RSS_BUDGET_ENV;
     exports.RUNTIME_DEFAULTS = require_dist10.RUNTIME_DEFAULTS;
     exports.ReadinessRegistry = require_dist10.ReadinessRegistry;
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
     exports.SERVER_AUTH_OID = require_tls$1.SERVER_AUTH_OID;
-    exports.SOCKET_PLANE_TOP_N = require_manifest_python_deps.SOCKET_PLANE_TOP_N;
+    exports.SOCKET_PLANE_TOP_N = require_manifest_system_deps.SOCKET_PLANE_TOP_N;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
-    exports.SocketChannel = require_manifest_python_deps.SocketChannel;
+    exports.SocketChannel = require_manifest_system_deps.SocketChannel;
     exports.SqliteSettingsAddon = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsAddon;
     exports.SqliteSettingsBackend = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsBackend;
     exports.StagingArea = StagingArea;
@@ -207289,23 +208490,23 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.SystemEventBus = SystemEventBus;
     exports.TRADITIONAL_NATIVE_PACKAGES = TRADITIONAL_NATIVE_PACKAGES;
     exports.ToastService = ToastService;
-    exports.UDS_NO_ROUTE_PREFIX = require_manifest_python_deps.UDS_NO_ROUTE_PREFIX;
-    exports.UdsLocalTransportClient = require_manifest_python_deps.UdsLocalTransportClient;
-    exports.UdsLocalTransportServer = require_manifest_python_deps.UdsLocalTransportServer;
+    exports.UDS_NO_ROUTE_PREFIX = require_manifest_system_deps.UDS_NO_ROUTE_PREFIX;
+    exports.UdsLocalTransportClient = require_manifest_system_deps.UdsLocalTransportClient;
+    exports.UdsLocalTransportServer = require_manifest_system_deps.UdsLocalTransportServer;
     exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
     exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
     exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
-    exports.ZERO_LOOP_DELAY = require_manifest_python_deps.ZERO_LOOP_DELAY;
-    exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
+    exports.ZERO_LOOP_DELAY = require_manifest_system_deps.ZERO_LOOP_DELAY;
+    exports.__resetCapUsageRegistryForTests = require_manifest_system_deps.__resetCapUsageRegistryForTests;
     exports.__resetLoggingGateForTests = __resetLoggingGateForTests;
-    exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
+    exports.adaptBrokerToCluster = require_manifest_system_deps.adaptBrokerToCluster;
     exports.addonSettingsCapability = require_dist10.addonSettingsCapability;
     exports.allFamiliesListenHost = require_tls$1.allFamiliesListenHost;
     exports.applyLanHttp = require_tls$1.applyLanHttp;
     exports.bindPendingLanHttp = require_tls$1.bindPendingLanHttp;
     exports.bootstrapSchema = bootstrapSchema;
-    exports.brokerCallForCap = require_manifest_python_deps.brokerCallForCap;
-    exports.brokerTransportLink = require_manifest_python_deps.brokerTransportLink;
+    exports.brokerCallForCap = require_manifest_system_deps.brokerCallForCap;
+    exports.brokerTransportLink = require_manifest_system_deps.brokerTransportLink;
     Object.defineProperty(exports, "buildBinaryPath", {
       enumerable: true,
       get: function() {
@@ -207313,70 +208514,70 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
     });
     exports.buildCapRouters = buildCapRouters;
-    exports.buildHeapSample = require_manifest_python_deps.buildHeapSample;
-    exports.buildLinkChain = require_manifest_python_deps.buildLinkChain;
-    exports.buildNativeCapProxy = require_manifest_python_deps.buildNativeCapProxy;
+    exports.buildHeapSample = require_manifest_system_deps.buildHeapSample;
+    exports.buildLinkChain = require_manifest_system_deps.buildLinkChain;
+    exports.buildNativeCapProxy = require_manifest_system_deps.buildNativeCapProxy;
     exports.buildNodeManifest = buildNodeManifest;
     exports.buildStorageLocationRegistry = require_builtins_storage_orchestrator_storage_orchestrator_addon.buildStorageLocationRegistry;
-    exports.buildUdsNativeCapProxy = require_manifest_python_deps.buildUdsNativeCapProxy;
+    exports.buildUdsNativeCapProxy = require_manifest_system_deps.buildUdsNativeCapProxy;
     exports.builderMountedCapNames = builderMountedCapNames;
     exports.callRegisterNodeWithRetry = callRegisterNodeWithRetry;
-    exports.callWithServiceDiscovery = require_manifest_python_deps.callWithServiceDiscovery;
+    exports.callWithServiceDiscovery = require_manifest_system_deps.callWithServiceDiscovery;
     exports.canServeDataPlane = canServeDataPlane;
-    exports.capActionName = require_manifest_python_deps.capActionName;
-    exports.capActionSuffix = require_manifest_python_deps.capActionSuffix;
-    exports.capBareAction = require_manifest_python_deps.capBareAction;
-    exports.capServiceName = require_manifest_python_deps.capServiceName;
+    exports.capActionName = require_manifest_system_deps.capActionName;
+    exports.capActionSuffix = require_manifest_system_deps.capActionSuffix;
+    exports.capBareAction = require_manifest_system_deps.capBareAction;
+    exports.capServiceName = require_manifest_system_deps.capServiceName;
     exports.classifyAddonDir = classifyAddonDir;
-    exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
+    exports.classifyCapRoute = require_manifest_system_deps.classifyCapRoute;
     exports.clearPendingRestart = clearPendingRestart;
     exports.closeLanHttp = require_tls$1.closeLanHttp;
-    exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
+    exports.clusterEventTopic = require_manifest_system_deps.clusterEventTopic;
     exports.clusterSecretMatches = clusterSecretMatches;
     exports.collectCertIdentity = require_tls$1.collectCertIdentity;
     exports.collectModelFiles = require_file_data_plane.collectModelFiles;
     exports.contentTypeFor = require_file_data_plane.contentTypeFor;
     exports.copyDirRecursive = copyDirRecursive;
     exports.copyExtraFileDirs = copyExtraFileDirs;
-    exports.createAddonContext = require_manifest_python_deps.createAddonContext;
-    exports.createAddonDataPlaneFacility = require_manifest_python_deps.createAddonDataPlaneFacility;
-    exports.createAddonService = require_manifest_python_deps.createAddonService;
+    exports.createAddonContext = require_manifest_system_deps.createAddonContext;
+    exports.createAddonDataPlaneFacility = require_manifest_system_deps.createAddonDataPlaneFacility;
+    exports.createAddonService = require_manifest_system_deps.createAddonService;
     exports.createAuthenticatedFileServer = require_file_data_plane.createAuthenticatedFileServer;
     exports.createBroker = createBroker2;
-    exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBrokerDeviceManagerApi;
+    exports.createBrokerDeviceManagerApi = require_manifest_system_deps.createBrokerDeviceManagerApi;
     exports.createCoreCapService = createCoreCapService;
-    exports.createDeferredHeapWatchSink = require_manifest_python_deps.createDeferredHeapWatchSink;
+    exports.createDeferredHeapWatchSink = require_manifest_system_deps.createDeferredHeapWatchSink;
     exports.createDoorSettingsView = createDoorSettingsView;
-    exports.createEventPlaneMeter = require_manifest_python_deps.createEventPlaneMeter;
-    exports.createEventPlaneReader = require_manifest_python_deps.createEventPlaneReader;
+    exports.createEventPlaneMeter = require_manifest_system_deps.createEventPlaneMeter;
+    exports.createEventPlaneReader = require_manifest_system_deps.createEventPlaneReader;
     exports.createFileDataPlaneHandler = require_file_data_plane.createFileDataPlaneHandler;
-    exports.createHubCapForwardService = require_manifest_python_deps.createHubCapForwardService;
+    exports.createHubCapForwardService = require_manifest_system_deps.createHubCapForwardService;
     exports.createHubService = createHubService;
-    exports.createKernelHwAccel = require_manifest_python_deps.createKernelHwAccel;
-    exports.createLocalTransport = require_manifest_python_deps.createLocalTransport;
-    exports.createLoopDelayMeter = require_manifest_python_deps.createLoopDelayMeter;
-    exports.createParentUnownedCallHandler = require_manifest_python_deps.createParentUnownedCallHandler;
+    exports.createKernelHwAccel = require_manifest_system_deps.createKernelHwAccel;
+    exports.createLocalTransport = require_manifest_system_deps.createLocalTransport;
+    exports.createLoopDelayMeter = require_manifest_system_deps.createLoopDelayMeter;
+    exports.createParentUnownedCallHandler = require_manifest_system_deps.createParentUnownedCallHandler;
     exports.createProcessService = createProcessService;
     exports.createReadinessService = createReadinessService;
     exports.createReadinessServiceForRegistry = createReadinessServiceForRegistry;
     exports.createScopedProcessManager = createScopedProcessManager;
-    exports.createSocketDirectionCounters = require_manifest_python_deps.createSocketDirectionCounters;
-    exports.createSocketPlaneMeter = require_manifest_python_deps.createSocketPlaneMeter;
-    exports.createSocketPlaneReader = require_manifest_python_deps.createSocketPlaneReader;
+    exports.createSocketDirectionCounters = require_manifest_system_deps.createSocketDirectionCounters;
+    exports.createSocketPlaneMeter = require_manifest_system_deps.createSocketPlaneMeter;
+    exports.createSocketPlaneReader = require_manifest_system_deps.createSocketPlaneReader;
     exports.createStreamProbeBrokerService = createStreamProbeBrokerService;
-    exports.createUdsAddonContext = require_manifest_python_deps.createUdsAddonContext;
-    exports.createUdsEventBridge = require_manifest_python_deps.createUdsEventBridge;
-    exports.createUdsEventBus = require_manifest_python_deps.createUdsEventBus;
-    exports.createUdsLogger = require_manifest_python_deps.createUdsLogger;
-    exports.createUdsLoggerWithControl = require_manifest_python_deps.createUdsLoggerWithControl;
-    exports.createV8Reclaimer = require_manifest_python_deps.createV8Reclaimer;
+    exports.createUdsAddonContext = require_manifest_system_deps.createUdsAddonContext;
+    exports.createUdsEventBridge = require_manifest_system_deps.createUdsEventBridge;
+    exports.createUdsEventBus = require_manifest_system_deps.createUdsEventBus;
+    exports.createUdsLogger = require_manifest_system_deps.createUdsLogger;
+    exports.createUdsLoggerWithControl = require_manifest_system_deps.createUdsLoggerWithControl;
+    exports.createV8Reclaimer = require_manifest_system_deps.createV8Reclaimer;
     exports.deleteModelFromDisk = require_file_data_plane.deleteModelFromDisk;
     exports.deriveAgentListenPort = deriveAgentListenPort;
     exports.describeProviderKindDrift = describeProviderKindDrift;
-    exports.describeRss = require_manifest_python_deps.describeRss;
+    exports.describeRss = require_manifest_system_deps.describeRss;
     exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
-    exports.diffEventPlane = require_manifest_python_deps.diffEventPlane;
-    exports.diffSocketPlane = require_manifest_python_deps.diffSocketPlane;
+    exports.diffEventPlane = require_manifest_system_deps.diffEventPlane;
+    exports.diffSocketPlane = require_manifest_system_deps.diffSocketPlane;
     Object.defineProperty(exports, "downloadBinary", {
       enumerable: true,
       get: function() {
@@ -207386,8 +208587,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.downloadFile = require_file_data_plane.downloadFile;
     exports.downloadModel = require_file_data_plane.downloadModel;
     exports.emitDownForOwnedCaps = require_dist10.emitDownForOwnedCaps;
-    exports.emitHeapDiagnosticReport = require_manifest_python_deps.emitHeapDiagnosticReport;
-    exports.encodeFrame = require_manifest_python_deps.encodeFrame;
+    exports.emitHeapDiagnosticReport = require_manifest_system_deps.emitHeapDiagnosticReport;
+    exports.encodeFrame = require_manifest_system_deps.encodeFrame;
     exports.ensureAddonNativePrebuilds = ensureAddonNativePrebuilds;
     Object.defineProperty(exports, "ensureBinary", {
       enumerable: true,
@@ -207421,12 +208622,12 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return _camstack_types_node.findInPath;
       }
     });
-    exports.formatEventPlane = require_manifest_python_deps.formatEventPlane;
-    exports.formatHeapSpaces = require_manifest_python_deps.formatHeapSpaces;
+    exports.formatEventPlane = require_manifest_system_deps.formatEventPlane;
+    exports.formatHeapSpaces = require_manifest_system_deps.formatHeapSpaces;
     exports.formatLogLine = require_formatter.formatLogLine;
-    exports.formatSocketPlane = require_manifest_python_deps.formatSocketPlane;
-    exports.getBrokerEventBus = require_manifest_python_deps.getBrokerEventBus;
-    exports.getCapUsageRegistry = require_manifest_python_deps.getCapUsageRegistry;
+    exports.formatSocketPlane = require_manifest_system_deps.formatSocketPlane;
+    exports.getBrokerEventBus = require_manifest_system_deps.getBrokerEventBus;
+    exports.getCapUsageRegistry = require_manifest_system_deps.getCapUsageRegistry;
     Object.defineProperty(exports, "getFfmpegDownloadUrl", {
       enumerable: true,
       get: function() {
@@ -207435,9 +208636,9 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     });
     exports.getLoggingGate = getLoggingGate;
     exports.getModelFilePath = require_file_data_plane.getModelFilePath;
-    exports.getMoleculerEventStats = require_manifest_python_deps.getMoleculerEventStats;
-    exports.getOrInitReadinessRegistry = require_manifest_python_deps.getOrInitReadinessRegistry;
-    exports.getOrInitReadinessRegistryForClient = require_manifest_python_deps.getOrInitReadinessRegistryForClient;
+    exports.getMoleculerEventStats = require_manifest_system_deps.getMoleculerEventStats;
+    exports.getOrInitReadinessRegistry = require_manifest_system_deps.getOrInitReadinessRegistry;
+    exports.getOrInitReadinessRegistryForClient = require_manifest_system_deps.getOrInitReadinessRegistryForClient;
     exports.getPidStats = require_resource_monitor.getPidStats;
     Object.defineProperty(exports, "getPlatformInfo", {
       enumerable: true,
@@ -207453,14 +208654,15 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     });
     exports.getRestartMarkerPath = getRestartMarkerPath;
     exports.getSinglePidStats = require_resource_monitor.getSinglePidStats;
-    exports.getWorkerDeviceRegistry = require_manifest_python_deps.getWorkerDeviceRegistry;
+    exports.getWorkerDeviceRegistry = require_manifest_system_deps.getWorkerDeviceRegistry;
     exports.hasDotNode = hasDotNode;
     exports.hashClusterSecret = hashClusterSecret;
-    exports.heapSnapshotAuthorised = require_manifest_python_deps.heapSnapshotAuthorised;
-    exports.heapSpaceField = require_manifest_python_deps.heapSpaceField;
-    exports.hubMainRssBudget = require_manifest_python_deps.hubMainRssBudget;
-    exports.installManifestNativeDeps = require_manifest_python_deps.installManifestNativeDeps;
-    exports.installManifestPythonDeps = require_manifest_python_deps.installManifestPythonDeps;
+    exports.heapSnapshotAuthorised = require_manifest_system_deps.heapSnapshotAuthorised;
+    exports.heapSpaceField = require_manifest_system_deps.heapSpaceField;
+    exports.hubMainRssBudget = require_manifest_system_deps.hubMainRssBudget;
+    exports.installManifestNativeDeps = require_manifest_system_deps.installManifestNativeDeps;
+    exports.installManifestPythonDeps = require_manifest_system_deps.installManifestPythonDeps;
+    exports.installManifestSystemDeps = require_manifest_system_deps.installManifestSystemDeps;
     exports.installPackageFromNpm = installPackageFromNpm;
     Object.defineProperty(exports, "installPythonPackages", {
       enumerable: true,
@@ -207474,7 +208676,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return _camstack_types_node.installPythonRequirements;
       }
     });
-    exports.ipcParentLink = require_manifest_python_deps.ipcParentLink;
+    exports.ipcParentLink = require_manifest_system_deps.ipcParentLink;
     exports.isAddonDeploySource = isAddonDeploySource;
     exports.isArrayOutputSchema = require_dist10.isArrayOutputSchema;
     exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
@@ -207484,55 +208686,55 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.isSourceNewer = isSourceNewer;
     exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
     exports.loadTlsCert = require_tls$1.loadTlsCert;
-    exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
-    exports.localProviderLink = require_manifest_python_deps.localProviderLink;
-    exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
-    exports.nextRssBudgetState = require_manifest_python_deps.nextRssBudgetState;
-    exports.parseCapAction = require_manifest_python_deps.parseCapAction;
+    exports.localEndpointPath = require_manifest_system_deps.localEndpointPath;
+    exports.localProviderLink = require_manifest_system_deps.localProviderLink;
+    exports.mountNativeCapService = require_manifest_system_deps.mountNativeCapService;
+    exports.nextRssBudgetState = require_manifest_system_deps.nextRssBudgetState;
+    exports.parseCapAction = require_manifest_system_deps.parseCapAction;
     exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
-    exports.parseRssBudgetMb = require_manifest_python_deps.parseRssBudgetMb;
+    exports.parseRssBudgetMb = require_manifest_system_deps.parseRssBudgetMb;
     exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
     exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
     exports.proxyToUpstream = proxyToUpstream;
     exports.quarantineAddonResidue = quarantineAddonResidue;
     exports.readExtraSans = require_tls$1.readExtraSans;
-    exports.readHeapSpaces = require_manifest_python_deps.readHeapSpaces;
+    exports.readHeapSpaces = require_manifest_system_deps.readHeapSpaces;
     exports.readLanHttpState = require_tls$1.readLanHttpState;
-    exports.readMoleculerFanoutMode = require_manifest_python_deps.readMoleculerFanoutMode;
+    exports.readMoleculerFanoutMode = require_manifest_system_deps.readMoleculerFanoutMode;
     exports.readPendingRestart = readPendingRestart;
     exports.readTlsAccessStatus = require_tls$1.readTlsAccessStatus;
     exports.readTlsMode = require_tls$1.readTlsMode;
     exports.readinessKey = require_dist10.readinessKey;
-    exports.reclaimIntervalMs = require_manifest_python_deps.reclaimIntervalMs;
-    exports.recordSocketFrame = require_manifest_python_deps.recordSocketFrame;
-    exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
+    exports.reclaimIntervalMs = require_manifest_system_deps.reclaimIntervalMs;
+    exports.recordSocketFrame = require_manifest_system_deps.recordSocketFrame;
+    exports.registerEventBusService = require_manifest_system_deps.registerEventBusService;
     exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
     exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
     exports.resolveFilePath = require_file_data_plane.resolveFilePath;
-    exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
-    exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
+    exports.resolveHwAccel = require_manifest_system_deps.resolveHwAccel;
+    exports.resolveNpmInvocation = require_manifest_system_deps.resolveNpmInvocation;
     exports.runHubAddonBoot = runHubAddonBoot;
-    exports.runNpm = require_manifest_python_deps.runNpm;
-    exports.sampleSocketDirection = require_manifest_python_deps.sampleSocketDirection;
+    exports.runNpm = require_manifest_system_deps.runNpm;
+    exports.sampleSocketDirection = require_manifest_system_deps.sampleSocketDirection;
     exports.scheduleSelfRestart = scheduleSelfRestart;
     exports.scopeKey = require_dist10.scopeKey;
     exports.scopesAllowAddon = require_dist10.scopesAllowAddon;
     exports.scopesAllowDeviceCap = require_dist10.scopesAllowDeviceCap;
     exports.selectAddonResidue = selectAddonResidue;
-    exports.selectReportedSpaces = require_manifest_python_deps.selectReportedSpaces;
-    exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays;
-    exports.setHubConnected = require_manifest_python_deps.setHubConnected;
-    exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
-    exports.shouldReclaim = require_manifest_python_deps.shouldReclaim;
-    exports.socketDirectionBytes = require_manifest_python_deps.socketDirectionBytes;
-    exports.socketDirectionMessages = require_manifest_python_deps.socketDirectionMessages;
-    exports.startHeapWatch = require_manifest_python_deps.startHeapWatch;
-    exports.startRunnerHeapWatch = require_manifest_python_deps.startRunnerHeapWatch;
-    exports.strandedMb = require_manifest_python_deps.strandedMb;
+    exports.selectReportedSpaces = require_manifest_system_deps.selectReportedSpaces;
+    exports.serializeTypedArrays = require_manifest_system_deps.serializeTypedArrays;
+    exports.setHubConnected = require_manifest_system_deps.setHubConnected;
+    exports.setNodeEventInterest = require_manifest_system_deps.setNodeEventInterest;
+    exports.shouldReclaim = require_manifest_system_deps.shouldReclaim;
+    exports.socketDirectionBytes = require_manifest_system_deps.socketDirectionBytes;
+    exports.socketDirectionMessages = require_manifest_system_deps.socketDirectionMessages;
+    exports.startHeapWatch = require_manifest_system_deps.startHeapWatch;
+    exports.startRunnerHeapWatch = require_manifest_system_deps.startRunnerHeapWatch;
+    exports.strandedMb = require_manifest_system_deps.strandedMb;
     exports.stripCamstackDeps = stripCamstackDeps;
-    exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
-    exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
-    exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
+    exports.subscribePassthrough = require_manifest_system_deps.subscribePassthrough;
+    exports.udsChildLogToWorkerEntry = require_manifest_system_deps.udsChildLogToWorkerEntry;
+    exports.validateProviderRegistrations = require_manifest_system_deps.validateProviderRegistrations;
     exports.validateUploadedTls = require_tls$1.validateUploadedTls;
     exports.waitUntilReady = waitUntilReady;
     exports.writeExtraSans = require_tls$1.writeExtraSans;
@@ -207567,7 +208769,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CJrvRDlD();
+    var require_sleep = require_sleep_CWWLTM6W();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -208277,6 +209479,48 @@ var require_dist4 = __commonJS({
         unreadable
       };
     }
+    var REDACTED_SECRET = "__camstack_redacted__";
+    function isSecretConfigField(field) {
+      if (field.type === "password") return true;
+      return "secret" in field && field.secret === true;
+    }
+    function collectSecretConfigKeys(schema) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+      return keys;
+    }
+    function schemaDeclaresAnyField(schema) {
+      for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
+      return false;
+    }
+    function isRecord$2(value) {
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+    function sectionsOf(schema) {
+      if (!isRecord$2(schema)) return [];
+      const sections = schema["sections"];
+      return Array.isArray(sections) ? sections : [];
+    }
+    function fieldsOf(node) {
+      if (!isRecord$2(node)) return [];
+      const fields = node["fields"];
+      return Array.isArray(fields) ? fields : [];
+    }
+    function walkField(field, out) {
+      if (!isRecord$2(field)) return;
+      const type = field["type"];
+      const key = field["key"];
+      if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+      if (type === "group") {
+        for (const child of fieldsOf(field)) walkField(child, out);
+        return;
+      }
+      if (type === "sub-tabs") {
+        const tabs = field["tabs"];
+        if (!Array.isArray(tabs)) return;
+        for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+      }
+    }
     var STREAM_QUALITY_LABELS = {
       high: "High",
       mid: "Mid",
@@ -208857,6 +210101,21 @@ var require_dist4 = __commonJS({
       bytesMoved: zod.z.number().int(),
       /** Total files discovered up front; null while (or when) unknown. */
       filesTotal: zod.z.number().int().nullable(),
+      /**
+      * Rows this run CORRECTED while moving them — a durable mutation the move
+      * made that nobody asked for, so it is reported where the operator reads the
+      * job rather than only in a log line.
+      *
+      * A footage segment records its byte count in its own NAME, and the durable
+      * hour row derives its aggregates from those names. A file that does not
+      * match its name therefore makes the ledger's sums — and with them quota and
+      * pressure eviction — wrong by the difference, and only a rename can fix it.
+      * On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+      *
+      * Absent on lanes where the question has no meaning: a media blob's size is
+      * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+      */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -208899,11 +210158,18 @@ var require_dist4 = __commonJS({
       /** Omitted = `move`, the pre-existing behaviour. */
       mode: MediaRelocateModeSchema.optional()
     });
-    var UnstampedEventMediaCountSchema = zod.z.object({
-      media: zod.z.number().int().nonnegative(),
-      retrainFrames: zod.z.number().int().nonnegative(),
-      total: zod.z.number().int().nonnegative()
+    var UnstampedRowsSchema = zod.z.object({
+      present: zod.z.boolean(),
+      rows: zod.z.number().int().nonnegative().nullable()
     });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: UnstampedRowsSchema,
+      retrainFrames: UnstampedRowsSchema,
+      /** True when EITHER collection holds one. The refusal reads this. */
+      anyPresent: zod.z.boolean(),
+      /** Sum across both, or `null` when either lane could not be counted. */
+      total: zod.z.number().int().nonnegative().nullable()
+    }).nullable();
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
@@ -208945,13 +210211,33 @@ var require_dist4 = __commonJS({
       "recorder",
       "analytics"
     ]);
+    var StorageMigrationMoveProgressSchema = zod.z.object({
+      filesMoved: zod.z.number().int().nonnegative(),
+      /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
+      filesTotal: zod.z.number().int().nonnegative().nullable(),
+      bytesMoved: zod.z.number().int().nonnegative(),
+      /** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+      *  a lane that cannot reconcile. A migration that silently rewrote durable
+      *  rows would be the same failure as one that silently skipped them. */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
+      /** The MOVER's start, not the migration's: a drain restarted after an addon
+      *  crash gets a new mover, and a rate computed from the migration's start
+      *  would silently average in the time nothing was running. */
+      startedAt: zod.z.number(),
+      /** When the coordinator last read these numbers. Paired with `startedAt` it
+      *  is the only honest rate: both clocks are the hub's, so a UI never has to
+      *  subtract its own. */
+      observedAt: zod.z.number()
+    });
     var StorageMigrationMoveSchema = zod.z.object({
       storageClass: StorageMigrationClassSchema,
       fromLocationId: zod.z.string(),
       toLocationId: zod.z.string(),
       moverJobId: zod.z.string().nullable(),
       state: RelocateJobStateSchema.nullable(),
-      error: zod.z.string().nullable()
+      error: zod.z.string().nullable(),
+      /** Last observed mover counters; `null` until the mover has been polled once. */
+      progress: StorageMigrationMoveProgressSchema.nullable()
     });
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
@@ -208997,6 +210283,52 @@ var require_dist4 = __commonJS({
       })),
       findings: zod.z.array(StorageMigrationFindingSchema)
     });
+    var StorageMigrationLaneSchema = zod.z.enum(["footage", "media"]);
+    var StorageMigrationMoverSchema = zod.z.object({
+      lane: StorageMigrationLaneSchema,
+      job: RelocateJobSchema,
+      /** The coordinator job that armed this mover, or `null` for a mover armed
+      *  directly against the owning addon. */
+      migrationJobId: zod.z.string().nullable(),
+      /** When the hub read these counters. Stamped here so a rate is `bytesMoved`
+      *  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
+      *  a browser subtracting its own `Date.now()` from a server `startedAt` is a
+      *  rate made of two different clocks. */
+      observedAt: zod.z.number()
+    });
+    var StorageMigrationResidueSchema = zod.z.object({
+      storageClass: StorageMigrationClassSchema,
+      /** The location still holding the data. `'*'` for the media lane, whose rows
+      *  move from wherever they are rather than from one named source. */
+      fromLocationId: zod.z.string(),
+      /** Where a drain would move it — the class's CURRENT default. */
+      toLocationId: zod.z.string(),
+      /** Segments (footage lane) or rows (media lane) still on the source. */
+      items: zod.z.number().int().nonnegative().nullable(),
+      /** Bytes on the source; `null` when the lane counts rows rather than bytes. */
+      bytes: zod.z.number().int().nonnegative().nullable()
+    });
+    var StorageMigrationDrainInputSchema = zod.z.object({
+      /** The classes to drain. Each must appear in `storageMigration.residue`, so
+      *  a class whose source is already empty is refused rather than started. */
+      classes: zod.z.array(StorageMigrationClassSchema).min(1),
+      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+    });
+    var RelocateResidueInputSchema = zod.z.object({
+      fromLocationId: zod.z.string().min(1),
+      /** Narrow to one logical class; omit for every profile on the location. */
+      footageClass: RelocateFootageClassSchema.optional()
+    });
+    var RelocateResidueSchema = zod.z.object({
+      segments: zod.z.number().int().nonnegative(),
+      bytes: zod.z.number().int().nonnegative()
+    }).nullable();
+    var RelocatableMediaCountSchema = zod.z.object({ rows: zod.z.number().int().nonnegative() }).nullable();
+    var RelocatableMediaCountInputSchema = zod.z.object({
+      toLocationId: zod.z.string().min(1),
+      /** Omitted = `move`. */
+      mode: MediaRelocateModeSchema.optional()
+    });
     var SUB_DETECTION_TYPES = ["face", "plate"];
     var RECOGNITION_TYPES = [
       "face",
@@ -209047,6 +210379,8 @@ var require_dist4 = __commonJS({
       updatedAt: zod.z.number()
     });
     var StorageLocationRefSchema = zod.z.union([StorageLocationTypeSchema, zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
+    var StorageAccessSchema = zod.z.enum(["local-path", "cap-mediated"]);
+    var STORAGE_ACCESS_FALLBACK = "local-path";
     var StorageLocationDeclarationSchema = zod.z.object({
       /**
       * Global location identifier, e.g. `recordings` or `recordingsLow`.
@@ -209066,6 +210400,19 @@ var require_dist4 = __commonJS({
       */
       cardinality: zod.z.enum(["single", "multi"]),
       /**
+      * HOW the declaring service reaches the bytes — and therefore WHICH
+      * providers may back a location of this kind. See {@link StorageAccessSchema}
+      * and {@link STORAGE_ACCESS_FALLBACK}.
+      *
+      * Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+      * can only over-restrict (refuse a remote provider for a kind that might
+      * have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+      * permissive direction and is therefore never inferred — a repo guard
+      * (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+      * reached by omission.
+      */
+      access: StorageAccessSchema.optional(),
+      /**
       * When set, the default instance for this location inherits its resolved
       * root from the named location's default instance. Useful for derivative
       * slots (e.g. `recordingsLow` → `recordings`) so operators only need to
@@ -215197,6 +216544,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * calls are sync. Bindings change rarely (only on wrapper toggle or
         * device add/remove) — clients invalidate via the
         * `capability.binding-changed` event.
+        *
+        * "A single round-trip" describes the CLIENT's side and used not to
+        * describe the server's: until 2026-08-30 the resolver read the persisted
+        * wrapper activations once per device, so answering this cost one
+        * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+        * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+        * The server side is now two reads for the whole fleet. Anything PERIODIC
+        * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+        * a warm seed.
         */
         getAllBindings: require_sleep.method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
         /**
@@ -220998,8 +222354,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       lastSeen: zod.z.number(),
       /** Frame-rate position history (subject to maxPositionHistory cap). */
       positions: zod.z.array(TrackPositionSchema).readonly(),
-      /** Periodic snapshots at snapshotIntervalMs cadence (subject to
-      *  saveThumbnails policy). */
+      /** Periodic snapshots at snapshotIntervalMs cadence — DEBUG media, produced
+      *  only while `MediaSettings.debugMediaEnabled` is on for the camera (D299;
+      *  the retired `saveThumbnails` used to gate this and the rolling
+      *  `lastFrame` together). Empty is the healthy default, not a capture gap. */
       snapshots: zod.z.array(TrackSnapshotSchema).readonly(),
       /** Deduplicated zones the track has entered at least once. Zone IDS. */
       zonesVisited: zod.z.array(zod.z.string()).readonly(),
@@ -221980,8 +223338,34 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * happens to stamp it. This count is what the migration planner's
         * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
         * it to zero.
+        *
+        * TWO indexed statements per collection, not a walk. It used to page the
+        * whole collection at 200 rows per RPC ordered by an unindexed column, so
+        * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+        * time it was called, and the migration it gates could never start. The
+        * cheap question (`present`: is there at least one) is asked first and
+        * separately from the expensive one (`rows`), because only the first has
+        * to be answerable for the gate to do its job.
+        *
+        * **`null` is "not measurable", never zero** — at either level. An
+        * unreadable collection must not read as a sealed one.
         */
         countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
+        /**
+        * How many rows a pass would STILL act on against `toLocationId`.
+        *
+        * One derivation, two consumers: it is the media lane's denominator (the
+        * **M** the footage lane gets from the ledger census — D295) and it is the
+        * residue behind "drain remaining". Deriving them separately is how "N of M"
+        * ends up comparing two different populations.
+        *
+        * `null` means the count could not be taken; it is never zero-filled,
+        * because a zero here reads as "nothing left to move".
+        */
+        countRelocatableMedia: require_sleep.method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: require_sleep.method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -224686,6 +226070,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         cancel: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
           auth: "admin"
+        }),
+        /**
+        * Every mover running RIGHT NOW, in both lanes, with its counters.
+        *
+        * `status` covers a migration's own moves — the coordinator folds their
+        * progress onto the durable job record it is already polling. This covers
+        * the other case, and it is not hypothetical: a drain armed straight against
+        * `recording.relocateFootage` (the only path that existed before
+        * {@link drain}) has no job to fold into and would otherwise be invisible.
+        */
+        movers: require_sleep.method(zod.z.object({}), zod.z.array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }),
+        /**
+        * What each class's SOURCE still holds, from the archive — never from the
+        * resident index (D295). Only classes with something left (or something
+        * unknown) are listed, so an empty list means there is nothing to drain and
+        * the UI has no honest button to offer.
+        */
+        residue: require_sleep.method(zod.z.object({}), zod.z.array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }),
+        /**
+        * Run the drain half alone, on a class whose default has ALREADY moved.
+        *
+        * It never repoints anything, which is what lets `start` keep refusing a
+        * destination that is already the default: the two verbs cannot be confused
+        * for one another, and no operator can re-repoint a migrated class through
+        * this door.
+        */
+        drain: require_sleep.method(StorageMigrationDrainInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+          kind: "mutation",
+          auth: "admin"
         })
       }
     };
@@ -225195,7 +226608,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       scanned: zod.z.number(),
       /** True when the backend could not consider every row that passed the filter. */
-      truncated: zod.z.boolean()
+      truncated: zod.z.boolean(),
+      /**
+      * The `topK` the backend actually ran with.
+      *
+      * Every backend has a ceiling — sqlite-vec's is 4,096 — and a caller asking
+      * past it used to learn nothing but a boolean, from a WARN in the provider's
+      * own log rather than in its answer. That is how an audit asking for 20,000
+      * consumed 4,096 and reported `examined: 4096` as if it had walked the index,
+      * for weeks. `truncated` says THAT the answer was short; this says BY HOW
+      * MUCH, in the return value, where the caller cannot fail to see it.
+      *
+      * Equals the requested `topK` whenever nothing was lowered.
+      */
+      effectiveTopK: zod.z.number().int().positive()
     });
     var VectorDeleteInputSchema = zod.z.object({
       index: zod.z.string(),
@@ -225214,6 +226640,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       id: zod.z.string(),
       metadata: VectorMetadataSchema
     })) });
+    var VectorFetchInputSchema = zod.z.object({
+      index: zod.z.string(),
+      ids: zod.z.array(zod.z.string())
+    });
+    var VectorFetchResultSchema = zod.z.object({ items: zod.z.array(zod.z.object({
+      id: zod.z.string(),
+      /** base64 Float32LE — the same wire form `upsert` accepts. */
+      vector: zod.z.string(),
+      metadata: VectorMetadataSchema
+    })) });
+    var VectorScanInputSchema = zod.z.object({
+      index: zod.z.string(),
+      /** Opaque resume point. `0` starts at the top; pass back `nextCursor`. */
+      cursor: zod.z.number().int().nonnegative().default(0),
+      limit: zod.z.number().int().positive()
+    });
+    var VectorScanResultSchema = zod.z.object({
+      items: zod.z.array(zod.z.object({
+        id: zod.z.string(),
+        metadata: VectorMetadataSchema
+      })),
+      /**
+      * Where the next page starts, or `null` when the walk reached the end.
+      *
+      * `null` is the ONLY end-of-index signal. A caller must not infer the end
+      * from a short page: a backend is free to return fewer rows than asked.
+      */
+      nextCursor: zod.z.number().int().nonnegative().nullable()
+    });
     var VectorStatsInputSchema = zod.z.object({ index: zod.z.string() });
     var VectorStatsResultSchema = zod.z.object({
       /** Provider id, so an operator can tell brute force from an ANN index. */
@@ -225244,6 +226699,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         query: require_sleep.method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
         /** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
         getByIds: require_sleep.method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+        /** Metadata AND vectors, by named id — see {@link VectorFetchInputSchema}. */
+        fetchByIds: require_sleep.method(VectorFetchInputSchema, VectorFetchResultSchema, { auth: "admin" }),
+        /** One page of the whole index, unranked — see {@link VectorScanInputSchema}. */
+        scan: require_sleep.method(VectorScanInputSchema, VectorScanResultSchema, { auth: "admin" }),
         deleteByIds: require_sleep.method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
           kind: "mutation",
           auth: "admin"
@@ -231714,6 +233173,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * What a location STILL holds, asked of the durable hour ledger.
+        *
+        * The number behind "drain remaining": segments and bytes that would still
+        * have to move off `fromLocationId`. It is a ledger aggregate — the archive
+        * — because the resident index is not the archive (D295), and a drain sized
+        * off the index is exactly what reported `done` over 80.3 GB on 2026-08-29.
+        * `null` means the archive could not be asked (no ledger on this node, or
+        * the aggregate failed) and is never conflated with an empty source.
+        */
+        getRelocateResidue: require_sleep.method(RelocateResidueInputSchema, RelocateResidueSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Cancel a running or queued relocate job. A queued job never runs. */
         cancelRelocateJob: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
@@ -240654,6 +242127,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countRelocatableMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.countUnstampedEventMedia": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -241818,6 +243297,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "recording.getRelocateResidue": {
+        capName: "recording",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "recording.getStorageMigrationMoveStatus": {
         capName: "recording",
         capScope: "system",
@@ -242364,12 +243849,30 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "storageMigration.drain": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "storageMigration.movers": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.plan": {
         capName: "storage-migration",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "storageMigration.residue": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.start": {
         capName: "storage-migration",
         capScope: "system",
@@ -243204,6 +244707,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "delete"
       },
+      "vectorStore.fetchByIds": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.getByIds": {
         capName: "vector-store",
         capScope: "system",
@@ -243216,6 +244725,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "vectorStore.scan": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.stats": {
         capName: "vector-store",
         capScope: "system",
@@ -246390,6 +247905,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           cancelStorageMigrationMove: (input) => dispatch("recording", "cancelStorageMigrationMove", "mutation", input),
           relocateFootage: (input) => dispatch("recording", "relocateFootage", "mutation", input),
           listRelocateJobs: (input) => dispatch("recording", "listRelocateJobs", "query", input),
+          getRelocateResidue: (input) => dispatch("recording", "getRelocateResidue", "query", input),
           cancelRelocateJob: (input) => dispatch("recording", "cancelRelocateJob", "mutation", input),
           planStorageRebalance: (input) => dispatch("recording", "planStorageRebalance", "query", input),
           startStorageRebalance: (input) => dispatch("recording", "startStorageRebalance", "mutation", input)
@@ -246453,7 +247969,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           plan: (input) => dispatch("storageMigration", "plan", "query", input),
           start: (input) => dispatch("storageMigration", "start", "mutation", input),
           status: (input) => dispatch("storageMigration", "status", "query", input),
-          cancel: (input) => dispatch("storageMigration", "cancel", "mutation", input)
+          cancel: (input) => dispatch("storageMigration", "cancel", "mutation", input),
+          movers: (input) => dispatch("storageMigration", "movers", "query", input),
+          residue: (input) => dispatch("storageMigration", "residue", "query", input),
+          drain: (input) => dispatch("storageMigration", "drain", "mutation", input)
         },
         streamBroker: {
           fetchEventMedia: (input) => dispatch("streamBroker", "fetchEventMedia", "mutation", input),
@@ -249907,6 +251426,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.REACHABILITY_PROBE_TIMEOUT_MS = REACHABILITY_PROBE_TIMEOUT_MS;
     exports.RECOGNITION_TYPES = RECOGNITION_TYPES;
     exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
+    exports.REDACTED_SECRET = REDACTED_SECRET;
     exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
     exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
     exports.ROOT_BUCKET_KEY = ROOT_BUCKET_KEY;
@@ -249945,11 +251465,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RecordingTriggersSchema = RecordingTriggersSchema;
     exports.RecordingWeekdaySchema = RecordingWeekdaySchema;
     exports.RedirectLoginMethodSchema = RedirectLoginMethodSchema;
+    exports.RelocatableMediaCountInputSchema = RelocatableMediaCountInputSchema;
+    exports.RelocatableMediaCountSchema = RelocatableMediaCountSchema;
     exports.RelocateFootageClassSchema = RelocateFootageClassSchema;
     exports.RelocateFootageInputSchema = RelocateFootageInputSchema;
     exports.RelocateJobSchema = RelocateJobSchema;
     exports.RelocateJobStateSchema = RelocateJobStateSchema;
     exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
+    exports.RelocateResidueInputSchema = RelocateResidueInputSchema;
+    exports.RelocateResidueSchema = RelocateResidueSchema;
     exports.RenderedAsSchema = RenderedAsSchema;
     exports.ReportMotionInputSchema = ReportMotionInputSchema;
     exports.ReportedFailureContributionSchema = ReportedFailureContributionSchema;
@@ -250000,6 +251524,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.SOURCE_CAP_CHANGED_AT_FIELD = SOURCE_CAP_CHANGED_AT_FIELD;
     exports.SOURCE_DEVICE_TYPES = SOURCE_DEVICE_TYPES;
     exports.SOURCE_INFO_METADATA_KEY = SOURCE_INFO_METADATA_KEY;
+    exports.STORAGE_ACCESS_FALLBACK = STORAGE_ACCESS_FALLBACK;
     exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
     exports.STREAM_QUALITY_LABELS = STREAM_QUALITY_LABELS;
     exports.SUB_DETECTION_TYPES = SUB_DETECTION_TYPES;
@@ -250049,6 +251574,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StartEmbeddedInputSchema = StartEmbeddedInputSchema;
     exports.StationaryObjectSchema = StationaryObjectSchema;
     exports.StorageAbortUploadInputSchema = AbortUploadInputSchema;
+    exports.StorageAccessSchema = StorageAccessSchema;
     exports.StorageBeginDownloadInputSchema = BeginDownloadInputSchema;
     exports.StorageBeginDownloadResultSchema = BeginDownloadResultSchema;
     exports.StorageBeginUploadInputSchema = BeginUploadInputSchema;
@@ -250061,18 +251587,23 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
     exports.StorageMigrationClassSchema = StorageMigrationClassSchema;
     exports.StorageMigrationDestinationsSchema = StorageMigrationDestinationsSchema;
+    exports.StorageMigrationDrainInputSchema = StorageMigrationDrainInputSchema;
     exports.StorageMigrationFindingCodeSchema = StorageMigrationFindingCodeSchema;
     exports.StorageMigrationFindingSchema = StorageMigrationFindingSchema;
     exports.StorageMigrationFootageMoveInputSchema = StorageMigrationFootageMoveInputSchema;
     exports.StorageMigrationInputSchema = StorageMigrationInputSchema;
     exports.StorageMigrationJobSchema = StorageMigrationJobSchema;
+    exports.StorageMigrationLaneSchema = StorageMigrationLaneSchema;
     exports.StorageMigrationLeaseInputSchema = StorageMigrationLeaseInputSchema;
     exports.StorageMigrationMediaMoveInputSchema = StorageMigrationMediaMoveInputSchema;
     exports.StorageMigrationModeSchema = StorageMigrationModeSchema;
+    exports.StorageMigrationMoveProgressSchema = StorageMigrationMoveProgressSchema;
     exports.StorageMigrationMoveSchema = StorageMigrationMoveSchema;
+    exports.StorageMigrationMoverSchema = StorageMigrationMoverSchema;
     exports.StorageMigrationParticipantSchema = StorageMigrationParticipantSchema;
     exports.StorageMigrationPhaseSchema = StorageMigrationPhaseSchema;
     exports.StorageMigrationPlanSchema = StorageMigrationPlanSchema;
+    exports.StorageMigrationResidueSchema = StorageMigrationResidueSchema;
     exports.StorageProviderInfoSchema = ProviderInfoSchema;
     exports.StorageReadChunkInputSchema = ReadChunkInputSchema;
     exports.StorageTestLocationResultSchema = TestLocationResultSchema;
@@ -250145,6 +251676,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
     exports.UnitConversionError = UnitConversionError;
     exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
+    exports.UnstampedRowsSchema = UnstampedRowsSchema;
     exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
     exports.UpdateStatusSchema = UpdateStatusSchema;
     exports.UpdateUserInputSchema = UpdateUserInputSchema;
@@ -250266,6 +251798,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.clusterStepSettingKey = clusterStepSettingKey;
     exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
     exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
+    exports.collectSecretConfigKeys = collectSecretConfigKeys;
     exports.colorCapability = colorCapability;
     exports.colorForKind = colorForKind;
     exports.commitWatchdogRestart = commitWatchdogRestart;
@@ -250406,6 +251939,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.isRestoredCap = isRestoredCap;
     exports.isSameAddonId = isSameAddonId;
     exports.isScheduleActive = isScheduleActive;
+    exports.isSecretConfigField = isSecretConfigField;
     exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
     exports.isSourceCap = isSourceCap;
     exports.isSystemDelivery = isSystemDelivery;
@@ -250553,6 +252087,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.runtimeDevices = runtimeDevices;
     exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
     exports.sceneMonitorCapability = sceneMonitorCapability;
+    exports.schemaDeclaresAnyField = schemaDeclaresAnyField;
     exports.scopeInherits = scopeInherits;
     exports.scopeKey = require_sleep.scopeKey;
     exports.scopesAllowAddon = scopesAllowAddon;
@@ -384452,6 +385987,14 @@ var require_main2 = __commonJS({
           // cap). A pin to ANOTHER node still bypasses the sibling → onUnownedCall.
           ownNodeId: agentNodeId,
           onUnownedCall
+          // NO `capUsageObserver` here, deliberately. `getCapUsageRegistry()` is a
+          // per-process singleton and the reader (`nodes.getCapUsageGraph`) runs on
+          // hub-main; recording in the agent would produce a map nobody ever reads,
+          // which is exactly the shape that made this graph return `[]` for
+          // months. An agent's addon traffic is a KNOWN blind spot of the graph —
+          // see `LocalChildRegistryOptions.capUsageObserver`. Closing it needs the
+          // caller identity to survive `$hub-cap-fwd`'s envelope, which today it
+          // does not.
         });
         await agentUdsRegistry.start();
         agentUdsRegistry.onChildRegistered((child) => {
@@ -409262,8 +410805,30 @@ var require_cap_providers = __commonJS({
           }
           return result;
         },
+        /**
+         * Observed caller → provider → cap edges over the last `windowSeconds`.
+         *
+         * **Read the blind spots before drawing a conclusion.** This reads
+         * hub-main's `CapUsageRegistry`, written by the hub's `LocalChildRegistry`
+         * on every `cap-call-out` a hub-local forked addon sends. It therefore does
+         * NOT contain: hub-main → hub-main in-process calls (one shared `ctx.api`
+         * client, no per-caller identity), a runner's own co-located calls, or any
+         * traffic originating on an agent. An edge missing here means "not seen on
+         * this plane", never "did not happen" — the full list is on
+         * `LocalChildRegistryOptions.capUsageObserver`.
+         */
         getCapUsageGraph: async (input) => {
           const reg = (0, system_1.getCapUsageRegistry)();
+          const stats = reg.getStats();
+          if (stats.droppedTriples > 0) {
+            logger?.warn("cap-usage graph is truncated \u2014 the triple ceiling was reached", {
+              meta: {
+                triples: stats.triples,
+                maxTriples: stats.maxTriples,
+                droppedTriples: stats.droppedTriples
+              }
+            });
+          }
           return reg.getGraph({ windowSeconds: input.windowSeconds, nowMs: Date.now() });
         },
         setProcessLogLevel: async (input) => {
@@ -420288,6 +421853,14 @@ var require_moleculer_service = __commonJS({
             // below, so a method that survives 16 minutes across nodes survives it
             // across a socket too — and one that hangs is cut off on both.
             capTimeoutMs: (capName, method) => this.capabilityService.getRegistry()?.getDefinition(capName)?.methods?.[method]?.timeoutMs,
+            // Feed the cap-usage graph from the one place that sees a forked
+            // addon's outbound `ctx.api` traffic AND runs in the process that reads
+            // it back (`nodes.getCapUsageGraph` → `cap-providers.ts`). The
+            // runner-side observer in `addon-context-factory.ts` writes to the
+            // RUNNER's own module singleton, which hub-main never sees — which is
+            // why the graph answered `[]` on a hub running 64 addons. Blind spots
+            // that remain are listed on `LocalChildRegistryOptions.capUsageObserver`.
+            capUsageObserver: (obs) => (0, system_1.getCapUsageRegistry)().recordCall(obs),
             logger: {
               info: (msg, meta) => logger.info(msg, meta !== null && meta !== void 0 ? { meta } : void 0)
             },