camstack 1.2.65 → 1.2.66

package/dist/{launcher-3XCU3XJF.js → launcher-EJVL74UN.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-Ck2jkBZk.js
-var require_dist_Ck2jkBZk = __commonJS({
-  "../system/dist/dist-Ck2jkBZk.js"(exports) {
+// ../system/dist/dist-CcvXUhHK.js
+var require_dist_CcvXUhHK = __commonJS({
+  "../system/dist/dist-CcvXUhHK.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -26259,6 +26259,21 @@ var require_dist_Ck2jkBZk = __commonJS({
       bytesMoved: zod.z.number().int(),
       /** Total files discovered up front; null while (or when) unknown. */
       filesTotal: zod.z.number().int().nullable(),
+      /**
+      * Rows this run CORRECTED while moving them — a durable mutation the move
+      * made that nobody asked for, so it is reported where the operator reads the
+      * job rather than only in a log line.
+      *
+      * A footage segment records its byte count in its own NAME, and the durable
+      * hour row derives its aggregates from those names. A file that does not
+      * match its name therefore makes the ledger's sums — and with them quota and
+      * pressure eviction — wrong by the difference, and only a rename can fix it.
+      * On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+      *
+      * Absent on lanes where the question has no meaning: a media blob's size is
+      * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+      */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -26301,11 +26316,18 @@ var require_dist_Ck2jkBZk = __commonJS({
       /** Omitted = `move`, the pre-existing behaviour. */
       mode: MediaRelocateModeSchema.optional()
     });
-    var UnstampedEventMediaCountSchema = zod.z.object({
-      media: zod.z.number().int().nonnegative(),
-      retrainFrames: zod.z.number().int().nonnegative(),
-      total: zod.z.number().int().nonnegative()
+    var UnstampedRowsSchema = zod.z.object({
+      present: zod.z.boolean(),
+      rows: zod.z.number().int().nonnegative().nullable()
     });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: UnstampedRowsSchema,
+      retrainFrames: UnstampedRowsSchema,
+      /** True when EITHER collection holds one. The refusal reads this. */
+      anyPresent: zod.z.boolean(),
+      /** Sum across both, or `null` when either lane could not be counted. */
+      total: zod.z.number().int().nonnegative().nullable()
+    }).nullable();
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
@@ -26352,6 +26374,10 @@ var require_dist_Ck2jkBZk = __commonJS({
       /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
       filesTotal: zod.z.number().int().nonnegative().nullable(),
       bytesMoved: zod.z.number().int().nonnegative(),
+      /** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+      *  a lane that cannot reconcile. A migration that silently rewrote durable
+      *  rows would be the same failure as one that silently skipped them. */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       /** The MOVER's start, not the migration's: a drain restarted after an addon
       *  crash gets a new mover, and a rate computed from the migration's start
       *  would silently average in the time nothing was running. */
@@ -31507,6 +31533,15 @@ var require_dist_Ck2jkBZk = __commonJS({
         * calls are sync. Bindings change rarely (only on wrapper toggle or
         * device add/remove) — clients invalidate via the
         * `capability.binding-changed` event.
+        *
+        * "A single round-trip" describes the CLIENT's side and used not to
+        * describe the server's: until 2026-08-30 the resolver read the persisted
+        * wrapper activations once per device, so answering this cost one
+        * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+        * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+        * The server side is now two reads for the whole fleet. Anything PERIODIC
+        * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+        * a warm seed.
         */
         getAllBindings: method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
         /**
@@ -37480,6 +37515,17 @@ var require_dist_Ck2jkBZk = __commonJS({
         * happens to stamp it. This count is what the migration planner's
         * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
         * it to zero.
+        *
+        * TWO indexed statements per collection, not a walk. It used to page the
+        * whole collection at 200 rows per RPC ordered by an unindexed column, so
+        * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+        * time it was called, and the migration it gates could never start. The
+        * cheap question (`present`: is there at least one) is asked first and
+        * separately from the expensive one (`rows`), because only the first has
+        * to be answerable for the gate to do its job.
+        *
+        * **`null` is "not measurable", never zero** — at either level. An
+        * unreadable collection must not read as a sealed one.
         */
         countUnstampedEventMedia: method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /**
@@ -59066,7 +59112,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59885,7 +59931,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59979,7 +60025,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60876,11 +60922,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-Dp_CyuCW.js
-var require_retired_settings_keys_Dp_CyuCW = __commonJS({
-  "../system/dist/retired-settings-keys-Dp_CyuCW.js"(exports) {
+// ../system/dist/retired-settings-keys-DXZ2xe7C.js
+var require_retired_settings_keys_DXZ2xe7C = __commonJS({
+  "../system/dist/retired-settings-keys-DXZ2xe7C.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63094,8 +63140,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
-    var require_retired_settings_keys = require_retired_settings_keys_Dp_CyuCW();
+    var require_dist10 = require_dist_CcvXUhHK();
+    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -63558,10 +63604,17 @@ var require_device_manager_addon = __commonJS({
       const live = deps.ctx.kernel?.deviceRegistry?.getById(deviceId)?.type;
       return typeof live === "string" && live.length > 0 ? live : void 0;
     }
-    async function resolveDevicePresence(deps, row, deviceId) {
+    async function resolveDevicePresence(deps, row, deviceId, ledgerNonEmpty) {
       if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
       if (row !== null) return "present";
-      return await deps.rows.count() > 0 ? "absent" : "unknown";
+      return await ledgerNonEmpty() ? "absent" : "unknown";
+    }
+    function onceLedgerNonEmpty(deps) {
+      let pending = null;
+      return () => {
+        if (pending === null) pending = deps.rows.count().then((n) => n > 0);
+        return pending;
+      };
     }
     function capAppliesToDeviceType(def, deviceType) {
       if (deviceType === void 0) return true;
@@ -63570,14 +63623,17 @@ var require_device_manager_addon = __commonJS({
       return declared.some((t) => t === deviceType);
     }
     async function getBindings(deps, input) {
-      const row = await deps.rows.get(input.deviceId);
-      return resolveBindingsForDevice(deps, input.deviceId, row);
+      const [row, store] = await Promise.all([deps.rows.get(input.deviceId), readBindingsStore(deps)]);
+      return resolveBindingsForDevice(deps, input.deviceId, row, {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      });
     }
-    async function resolveBindingsForDevice(deps, deviceId, row) {
+    async function resolveBindingsForDevice(deps, deviceId, row, pass) {
       const storeKey = String(deviceId);
-      const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+      const perDevice = pass.store.deviceBindings[storeKey] ?? {};
       const deviceType = resolveDeviceType(deps, row, deviceId);
-      const presence = await resolveDevicePresence(deps, row, deviceId);
+      const presence = await resolveDevicePresence(deps, row, deviceId, pass.ledgerNonEmpty);
       const entries = [];
       const seenCaps = /* @__PURE__ */ new Set();
       const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
@@ -63677,13 +63733,17 @@ var require_device_manager_addon = __commonJS({
     }
     async function getBindingsBatch(deps, input) {
       const ids = [...new Set(input.deviceIds)];
-      const rows = await deps.rows.getMany(ids);
+      const [rows, store] = await Promise.all([deps.rows.getMany(ids), readBindingsStore(deps)]);
+      const pass = {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      };
       const out = [];
-      for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null));
+      for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null, pass));
       return out;
     }
     async function getAllBindings(deps) {
-      const fleet = await deps.rows.listAll();
+      const [fleet, store] = await Promise.all([deps.rows.listAll(), readBindingsStore(deps)]);
       const rowById = /* @__PURE__ */ new Map();
       const ids = /* @__PURE__ */ new Set();
       for (const row of fleet) {
@@ -63696,8 +63756,12 @@ var require_device_manager_addon = __commonJS({
         deps.ctx.logger.warn("getAllBindings found no devices \u2014 warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
         return [];
       }
+      const pass = {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      };
       const out = [];
-      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null));
+      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null, pass));
       return out;
     }
     async function lookupPersistedStableId(deps, deviceId) {
@@ -64257,7 +64321,12 @@ var require_device_manager_addon = __commonJS({
         ...sourceInfoGetDevice !== void 0 ? { sourceInfo: sourceInfoGetDevice } : {}
       };
     }
-    async function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren) {
+    function persistedChildIds(childRows, liveChildren) {
+      const live = /* @__PURE__ */ new Set();
+      for (const device of liveChildren) live.add(device.id);
+      return childRows.filter((row) => !live.has(row.meta.id)).map((row) => row.meta.id);
+    }
+    function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs) {
       const results = [];
       const seen = /* @__PURE__ */ new Set();
       const rowById = /* @__PURE__ */ new Map();
@@ -64273,9 +64342,9 @@ var require_device_manager_addon = __commonJS({
         const childStableId = m.stableId;
         const key = String(m.id);
         if (seen.has(key)) continue;
-        const persistedConfig = await pctx.settings.readDeviceStore(m.id);
+        const persistedConfig = configs.get(m.id) ?? {};
         const metadata = row.metadata;
-        const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
+        const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig, childStableId, ownerAddonId);
         results.push({
           id: m.id,
           stableId: childStableId,
@@ -64290,7 +64359,7 @@ var require_device_manager_addon = __commonJS({
           probed: pctx.host.resolveDeviceProbed(m.id),
           features: persistedFeatures(m.features),
           isCamera: false,
-          config: persistedConfig ?? {},
+          config: persistedConfig,
           metadata,
           ...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
           ...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -64317,7 +64386,8 @@ var require_device_manager_addon = __commonJS({
       }
       const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
       const liveChildren = pctx.registry?.getChildren(parentDeviceId) ?? [];
-      return [...await projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren)];
+      const configs = await readDeviceConfigs(pctx, persistedChildIds(childRows, liveChildren));
+      return [...projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs)];
     }
     async function getChildrenBatch(pctx, input) {
       const parentIds = [...new Set(input.parentDeviceIds)];
@@ -64345,11 +64415,14 @@ var require_device_manager_addon = __commonJS({
         if (bucket === void 0) liveByParent.set(parentId, [device]);
         else bucket.push(device);
       }
+      const configIds = [];
+      for (const parentId of owners.keys()) configIds.push(...persistedChildIds(rowsByParent.get(parentId) ?? [], liveByParent.get(parentId) ?? []));
+      const configs = await readDeviceConfigs(pctx, configIds);
       for (const [parentId, ownerAddonId] of owners) {
         const childRows = rowsByParent.get(parentId) ?? [];
         const liveChildren = liveByParent.get(parentId) ?? [];
         if (childRows.length === 0 && liveChildren.length === 0) continue;
-        const projected = await projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren);
+        const projected = projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren, configs);
         if (projected.length > 0) out[String(parentId)] = [...projected];
       }
       return out;
@@ -65391,18 +65464,20 @@ var require_device_manager_addon = __commonJS({
     }
     async function setWrapperActive(deps, input) {
       const storeKey = String(input.deviceId);
-      const store = await readBindingsStore(deps.bindingsDeps);
-      const perDevice = { ...store.deviceBindings[storeKey] };
-      if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
-      else perDevice[input.capName] = { wrapperAddonId: null };
-      const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
-        ...store.deviceBindings,
-        [storeKey]: perDevice
-      } : (() => {
-        const { [storeKey]: _drop, ...rest } = store.deviceBindings;
-        return rest;
-      })();
-      await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+      await deps.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const store = await readBindingsStore(deps.bindingsDeps);
+        const perDevice = { ...store.deviceBindings[storeKey] };
+        if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
+        else perDevice[input.capName] = { wrapperAddonId: null };
+        const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
+          ...store.deviceBindings,
+          [storeKey]: perDevice
+        } : (() => {
+          const { [storeKey]: _drop, ...rest } = store.deviceBindings;
+          return rest;
+        })();
+        await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+      });
       deps.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
         timestamp: /* @__PURE__ */ new Date(),
@@ -65681,12 +65756,13 @@ var require_device_manager_addon = __commonJS({
       });
       await pctx.settings.clearDeviceStore(deviceId);
       await pctx.settings.clearDeviceRuntimeState(deviceId);
-      const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
       const bindingKey = String(deviceId);
-      if (bindingsStore.deviceBindings[bindingKey]) {
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
+        if (!bindingsStore.deviceBindings[bindingKey]) return;
         const { [bindingKey]: _removedBindings, ...restBindings } = bindingsStore.deviceBindings;
         await writeBindingsStore(pctx.bindingsDeps, { deviceBindings: restBindings });
-      }
+      });
       pctx.host.remoteNativeCaps.delete(deviceId);
       pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(deviceId);
       pctx.metaStore.idToAddonId.delete(deviceId);
@@ -66028,7 +66104,9 @@ var require_device_manager_addon = __commonJS({
         ...def,
         unit: require_dist10.normalizeUnit(def.unit) ?? def.unit
       } : def]));
-      await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+      });
     }
     async function applyInitialMeta(pctx, input) {
       const { deviceId, name, location, type, integrationId, linkDeviceId, role } = input;
@@ -66171,16 +66249,21 @@ var require_device_manager_addon = __commonJS({
     async function addLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) throw new Error("[device-manager] addLocation: name must be non-empty");
-      const current = (await pctx.metaStore.readStore()).locations ?? [];
-      if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
-      await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const current = (await pctx.metaStore.readStore()).locations ?? [];
+        if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
+        await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+      });
     }
     async function removeLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) return;
-      const current = (await pctx.metaStore.readStore()).locations ?? [];
-      const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
-      if (remaining.length !== current.length) await pctx.settings.writeAddonStore({ locations: remaining });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const current = (await pctx.metaStore.readStore()).locations ?? [];
+        const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
+        if (remaining.length === current.length) return;
+        await pctx.settings.writeAddonStore({ locations: remaining });
+      });
       if (input.cascade !== true) return;
       const cleared = await pctx.metaStore.withMetaWriteLock(async () => {
         const out = [];
@@ -66221,23 +66304,40 @@ var require_device_manager_addon = __commonJS({
     function isRoleDisplayDefaults(value) {
       return value !== null && typeof value === "object" && !Array.isArray(value);
     }
+    function createWriteLock() {
+      let chain = Promise.resolve();
+      return async (fn) => {
+        const previous = chain;
+        let release = () => {
+        };
+        chain = new Promise((resolve) => {
+          release = resolve;
+        });
+        try {
+          await previous.catch(() => {
+          });
+          return await fn();
+        } finally {
+          release();
+        }
+      };
+    }
     var DeviceMetaStore = class {
       settings;
       registry;
       rows;
+      withAddonStoreWriteLock;
       /** Synchronous ownership cache, keyed by NUMERIC deviceId → owning addonId.
       *  The persisted row store is authoritative but reads are async; hub-side
       *  callers (e.g. `CapabilityRegistry.getNativeProvider` fallback) need
       *  ownership without awaiting. Kept in sync with every register/remove and
       *  warmed from persistence on boot. */
       idToAddonId = /* @__PURE__ */ new Map();
-      /** Serialises every read-modify-write of a device row through one promise
-      *  chain (see `withMetaWriteLock`). Per-instance state. */
-      metaWriteChain = Promise.resolve();
-      constructor(settings, registry, rows) {
+      constructor(settings, registry, rows, withAddonStoreWriteLock = createWriteLock()) {
         this.settings = settings;
         this.registry = registry;
         this.rows = rows;
+        this.withAddonStoreWriteLock = withAddonStoreWriteLock;
       }
       /** The read currently in flight, or null. Never a settled value — see
       *  {@link readStore}. */
@@ -66268,22 +66368,7 @@ var require_device_manager_addon = __commonJS({
         this.inFlightRead = read;
         return read;
       };
-      withMetaWriteLock = async (fn) => {
-        const previous = this.metaWriteChain;
-        let release = () => {
-        };
-        const next = new Promise((resolve) => {
-          release = resolve;
-        });
-        this.metaWriteChain = next;
-        try {
-          await previous.catch(() => {
-          });
-          return await fn();
-        } finally {
-          release();
-        }
-      };
+      withMetaWriteLock = createWriteLock();
       /** The whole persisted row for one device, or `null`. */
       getRow = async (deviceId) => this.rows.get(deviceId);
       /**
@@ -66317,11 +66402,24 @@ var require_device_manager_addon = __commonJS({
         ids.delete(parentId);
         return [...ids];
       };
-      allocateNextDeviceId = async () => {
+      /**
+      * Mint the next numeric device id.
+      *
+      * A read-modify-write of `nextDeviceId`, and it must hold the addon-store
+      * lock for the whole of it. Serialising the WRITES is not enough and never
+      * was: two callers that both read `N` both write `N + 1` and both return
+      * `N`, so two devices receive the same id. (`writeAddonStore` is itself
+      * read-modify-write over the addon's whole key range, so an unlocked bump
+      * can also be reverted wholesale by a concurrent `setWrapperActive`.)
+      *
+      * Callers hold {@link withMetaWriteLock} — this is the one nesting, and it
+      * only ever goes meta ⊃ addon-store.
+      */
+      allocateNextDeviceId = async () => this.withAddonStoreWriteLock(async () => {
         const current = (await this.readStore()).nextDeviceId ?? 1;
         await this.settings.writeAddonStore({ nextDeviceId: current + 1 });
         return current;
-      };
+      });
     };
     var CENSUS_STACK_FRAMES = 3;
     function siteFromStack(stack) {
@@ -67515,6 +67613,17 @@ var require_device_manager_addon = __commonJS({
       * it through {@link bindingsDeps} or the `ProviderContext`.
       */
       deviceRows = null;
+      /**
+      * The ONE lock ordering every read-modify-write of this addon's
+      * `addon-settings` key range (`deviceBindings`, `locations`, `nextDeviceId`,
+      * `roleDisplayDefaults`).
+      *
+      * It lives on the addon rather than on `DeviceMetaStore` because the writers
+      * do not all go through that class — `setWrapperActive` and `removeDevice`'s
+      * bindings purge reach the store through `BindingsDeps` — and two locks over
+      * one key range is the same defect one level up. Handed to both.
+      */
+      addonStoreWriteLock = createWriteLock();
       /** Build the dependency context the extracted binding resolvers consume. */
       get bindingsDeps() {
         const rows = this.deviceRows;
@@ -67523,7 +67632,8 @@ var require_device_manager_addon = __commonJS({
           ctx: this.ctx,
           capabilityRegistry: this.capabilityRegistry,
           remoteNativeCaps: this.remoteNativeCaps,
-          rows
+          rows,
+          withAddonStoreWriteLock: this.addonStoreWriteLock
         };
       }
       async getBindings(input) {
@@ -67592,7 +67702,7 @@ var require_device_manager_addon = __commonJS({
         } catch (err) {
           this.ctx.logger.warn("retired-row purge failed", { meta: { error: require_dist10.errMsg(err) } });
         }
-        const metaStore = new DeviceMetaStore(settings, registry, deviceRows);
+        const metaStore = new DeviceMetaStore(settings, registry, deviceRows, this.addonStoreWriteLock);
         this.stateMirrorImpl = new DeviceStateMirror(this.ctx);
         const stateMirror = this.stateMirrorImpl;
         const resolvePersistedById = metaStore.resolvePersistedById;
@@ -67844,7 +67954,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67981,7 +68091,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -68171,7 +68281,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75984,7 +76094,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76549,7 +76659,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -79171,7 +79281,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -80287,8 +80397,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
-    var require_retired_settings_keys = require_retired_settings_keys_Dp_CyuCW();
+    var require_dist10 = require_dist_CcvXUhHK();
+    var require_retired_settings_keys = require_retired_settings_keys_DXZ2xe7C();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -80619,11 +80729,16 @@ var require_sqlite_settings_addon = __commonJS({
       const resolve = (field) => {
         const expr = fieldExprFor(field, shape);
         if (expr === null && mode === "mutate") throw new UnsafeFilterError(`filter refers to "${field}", which this collection cannot express \u2014 refusing to run a bulk mutation with a dropped predicate`);
+        if (expr === null && mode === "measure") throw new UnsafeFilterError(`filter refers to "${field}", which this collection cannot express \u2014 refusing to answer with a number counted over a different question`);
         return expr;
       };
       for (const [field, value] of Object.entries(filter?.where ?? {})) {
         const expr = resolve(field);
         if (expr === null) continue;
+        if (value === null) {
+          clauses.push(`${expr} IS NULL`);
+          continue;
+        }
         clauses.push(`${expr} = ?`);
         params.push(serialize2(value));
       }
@@ -80646,6 +80761,10 @@ var require_sqlite_settings_addon = __commonJS({
       for (const [field, value] of Object.entries(filter?.whereNot ?? {})) {
         const expr = resolve(field);
         if (expr === null) continue;
+        if (value === null) {
+          clauses.push(`${expr} IS NOT NULL`);
+          continue;
+        }
         clauses.push(`(${expr} IS NULL OR ${expr} != ?)`);
         params.push(serialize2(value));
       }
@@ -81158,13 +81277,17 @@ var require_sqlite_settings_addon = __commonJS({
       * (visibility, kind, device, time window, expiry) — so `total` counted rows
       * the page could never show, including other users'.
       *
-      * `select` mode, deliberately: `count` must be forgiving in exactly the way
-      * `query` is, or the two disagree again for a new reason.
+      * `measure` mode. `count` compiles the same predicates `query` does — the
+      * two must never disagree about WHICH rows they are talking about — but it
+      * refuses a predicate it cannot express rather than skipping it. `query`
+      * hands back rows and a caller can see the filter did not bite; a count
+      * hands back a number, and the whole collection and the intended subset are
+      * the same shape.
       */
       async count({ namespace, collection, filter }) {
         const scoped = this.scopedName(namespace, collection);
         const decl = this.requireDeclared(scoped);
-        const { whereSql, params } = compileFilter$1(filter, this.shapeOf(decl), "select", (v) => this.serializeColumnValue(v));
+        const { whereSql, params } = compileFilter$1(filter, this.shapeOf(decl), "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT COUNT(*) AS cnt FROM "${scoped}"${whereSql}`;
         return this.measured({
           op: "count",
@@ -81182,8 +81305,10 @@ var require_sqlite_settings_addon = __commonJS({
       * projection — an unresolvable field THROWS rather than being dropped, because
       * a missing aggregate comes back as a number that looks real.
       *
-      * `select` mode on the filter, so this agrees with `query` and `count` about
-      * which rows it is talking about.
+      * `measure` mode on the filter, so this agrees with `query` and `count`
+      * about which rows it is talking about — and, since 2026-08-30, refuses an
+      * unresolvable PREDICATE for the same reason it already refused an
+      * unresolvable FIELD. Both come back as a number that looks real.
       */
       async aggregate({ namespace, collection, fields, filter }) {
         const scoped = this.scopedName(namespace, collection);
@@ -81195,7 +81320,7 @@ var require_sqlite_settings_addon = __commonJS({
           if (col === null) throw new UnsafeFilterError(`aggregate cannot read "${f.field}" on "${scoped}" \u2014 it is not a column of this collection, and answering without it would return a number that looks real`);
           selects.push(`${f.op.toUpperCase()}(${col}) AS "a${i}"`);
         });
-        const { whereSql, params } = compileFilter$1(filter, shape, "select", (v) => this.serializeColumnValue(v));
+        const { whereSql, params } = compileFilter$1(filter, shape, "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT ${selects.join(", ")} FROM "${scoped}"${whereSql}`;
         const row = this.measured({
           op: "aggregate",
@@ -81219,7 +81344,7 @@ var require_sqlite_settings_addon = __commonJS({
         const shape = this.shapeOf(decl);
         const col = fieldExprFor(field, shape);
         if (col === null) return [];
-        const { whereSql: where, params } = compileFilter$1(filter, shape, "select", (v) => this.serializeColumnValue(v));
+        const { whereSql: where, params } = compileFilter$1(filter, shape, "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT ${`CAST((${col} - ?) / ? AS INTEGER)`} AS bucket, COUNT(*) AS count FROM "${scoped}"${where} GROUP BY bucket ORDER BY bucket`;
         return this.measured({
           op: "histogram",
@@ -81500,8 +81625,10 @@ var require_sqlite_settings_addon = __commonJS({
       * connection whose `sqlite_stat1` visibility and temp schema match.
       *
       * `EXPLAIN QUERY PLAN` prepares and plans; it does not execute the statement,
-      * so it costs no page reads of its own. It is still called only from the
-      * slow-call path, once per shape per window.
+      * so it costs no page reads of its own. In production it is called only from
+      * the slow-call path, once per shape per window; it is public so a guard can
+      * assert that a declared index is the one the planner actually picks — "we
+      * added an index" and "the query uses it" are different claims.
       *
       * Never throws. A plan that cannot be taken (a statement the engine will no
       * longer prepare, a closed handle mid-shutdown) is a missing ANSWER, not a
@@ -82650,7 +82777,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82856,6 +82983,10 @@ var require_storage_orchestrator_addon = __commonJS({
       "recorder",
       "pipeline"
     ];
+    function describeUnstamped(lane) {
+      if (!lane.present) return "0";
+      return lane.rows === null ? "an unknown number of" : lane.rows.toString();
+    }
     var StorageMigrationCoordinator = class {
       deps;
       active = null;
@@ -82899,12 +83030,21 @@ var require_storage_orchestrator_addon = __commonJS({
         if (moves.length === 0) throw new Error("select at least one storage class");
         if (moves.some((move) => move.storageClass === "eventMedia")) {
           const unstamped = await this.deps.participants.analytics.countUnstamped();
-          if (unstamped.total > 0) {
-            if (mode === "nonBlocking") throw new Error(`${unstamped.total.toString()} event-media row(s) still carry no locationId (${unstamped.media.toString()} media, ${unstamped.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+          if (unstamped === null) {
+            if (mode === "nonBlocking") throw new Error("could not determine whether any event-media row still carries no locationId. A non-blocking cutover repoints the default and would silently orphan every such row, so an unmeasured collection is refused exactly like a non-empty one. Retry, or run the blocking mode, which stamps rows as it moves them.");
+            findings.push({
+              code: "unstampedEventMediaRows",
+              storageClass: "eventMedia",
+              message: "the count of event-media rows carrying no locationId could not be taken \u2014 treat it as unknown, not as zero. This blocking migration stamps them as it moves them, so it is safe regardless; a non-blocking one would be refused."
+            });
+          } else if (unstamped.anyPresent) {
+            const scale = unstamped.total === null ? "an unknown number of" : unstamped.total.toString();
+            const perLane = `${describeUnstamped(unstamped.media)} media, ${describeUnstamped(unstamped.retrainFrames)} retrain frames`;
+            if (mode === "nonBlocking") throw new Error(`${scale} event-media row(s) still carry no locationId (${perLane}). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
             findings.push({
               code: "unstampedEventMediaRows",
               storageClass: "eventMedia",
-              message: `${unstamped.total.toString()} event-media row(s) carry no locationId. This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
+              message: `${scale} event-media row(s) carry no locationId (${perLane}). This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
             });
           }
         }
@@ -83153,6 +83293,7 @@ var require_storage_orchestrator_addon = __commonJS({
             const remaining = residue.filter((entry) => entry.storageClass === storageClass);
             if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its default location \u2014 there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
             for (const entry of remaining) {
+              if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED \u2014 a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen, or make an enabled location the "${storageClass}" default first.`);
               moves.push({
                 storageClass,
                 fromLocationId: entry.fromLocationId,
@@ -83404,6 +83545,7 @@ var require_storage_orchestrator_addon = __commonJS({
               filesMoved: status.filesMoved,
               filesTotal: status.filesTotal,
               bytesMoved: status.bytesMoved,
+              ...status.rowsReconciled === void 0 ? {} : { rowsReconciled: status.rowsReconciled },
               startedAt: status.startedAt,
               observedAt: this.deps.now()
             };
@@ -83426,9 +83568,10 @@ var require_storage_orchestrator_addon = __commonJS({
       *
       * The gate is the RE-COUNT, not the seal job's terminal state: a seal that
       * failed some rows still finishes, and "finished" is not "there are none
-      * left". A non-zero count here fails the job while nothing has been paused
+      * left". A remaining row here fails the job while nothing has been paused
       * and nothing has been repointed, which is the cheapest possible place to
-      * discover it.
+      * discover it. So does a re-count that could not be TAKEN: the gate opens on
+      * a measured absence, and only on that.
       *
       * The seal's own mover job id is deliberately NOT durable. It is idempotent
       * and cheap, so a coordinator restart mid-seal simply re-runs the whole
@@ -83438,7 +83581,8 @@ var require_storage_orchestrator_addon = __commonJS({
       async sealEventMedia(job) {
         const move = job.moves.find((candidate) => candidate.storageClass === "eventMedia");
         if (move === void 0) return;
-        if ((await this.deps.participants.analytics.countUnstamped()).total > 0) {
+        const before = await this.deps.participants.analytics.countUnstamped();
+        if (before === null || before.anyPresent) {
           const started = await this.deps.participants.analytics.startDrain({
             toLocationId: move.fromLocationId,
             mode: "seal"
@@ -83447,7 +83591,8 @@ var require_storage_orchestrator_addon = __commonJS({
           if (job.cancelRequested) return;
         }
         const after = await this.deps.participants.analytics.countUnstamped();
-        if (after.total > 0) throw new Error(`event-media seal left ${after.total.toString()} row(s) without a locationId (${after.media.toString()} media, ${after.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
+        if (after === null) throw new Error("event-media seal ran, but whether any row still carries no locationId could not be measured afterwards. Unknown is not zero; nothing has been paused or repointed.");
+        if (after.anyPresent) throw new Error(`event-media seal left ${after.total === null ? "an unknown number of" : after.total.toString()} row(s) without a locationId (${describeUnstamped(after.media)} media, ${describeUnstamped(after.retrainFrames)} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
       }
       async waitForSeal(job, moverJobId) {
         const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -83796,6 +83941,34 @@ var require_storage_orchestrator_addon = __commonJS({
           backfilled: backfill.length,
           total: this.locations.size
         } });
+        this.reportDisabledDefaults();
+      }
+      /**
+      * Shout about a persisted row that is BOTH the type default and disabled.
+      *
+      * `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
+      * default) and neither can `setDefaultLocations` — but hydrate writes rows
+      * straight into the map without either, so a hand-edited store, a partial
+      * migration or a row written by another build can. It matters because every
+      * bare-type ref resolves through {@link getDefaultLocation}: on such a row
+      * `storage.write({ location: 'eventMedia' })` and the migration coordinator's
+      * drain destination both point at a disk the operator turned off. That is the
+      * one thing this model must never do silently.
+      *
+      * Reported, never repaired: flipping an operator's flag back on at boot would
+      * be the system overruling the switch instead of obeying it. The coordinator
+      * refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
+      * path is deliberately left working, because narrowing a READ is a worse bug
+      * than the one this line reports.
+      */
+      reportDisabledDefaults() {
+        for (const loc of this.locations.values()) {
+          if (!loc.isDefault || loc.enabled !== false) continue;
+          this.logger.error("storage-orchestrator: the type DEFAULT is disabled \u2014 every bare-type ref for this type resolves to a location the operator turned off. Enable it, or make another location the default.", { meta: {
+            id: loc.id,
+            type: loc.type
+          } });
+        }
       }
       /**
       * Inject the declaration-driven cardinality source. Called once by the
@@ -83867,6 +84040,7 @@ var require_storage_orchestrator_addon = __commonJS({
           loaded: this.locations.size,
           isSystemUpgraded: upgraded
         } });
+        this.reportDisabledDefaults();
       }
       /**
       * Boot backfill (SP1): stamp `nodeId` on every persisted node-local
@@ -85178,7 +85352,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -103239,7 +103413,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -115732,12 +115906,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-8boi90D9.js
-var require_manifest_system_deps_8boi90D9 = __commonJS({
-  "../system/dist/manifest-system-deps-8boi90D9.js"(exports) {
+// ../system/dist/manifest-system-deps-oJMkWSX-.js
+var require_manifest_system_deps_oJMkWSX = __commonJS({
+  "../system/dist/manifest-system-deps-oJMkWSX-.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_Ck2jkBZk();
+    require_dist_CcvXUhHK();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -119845,6 +120019,174 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
         createClient: (nodeId) => new UdsLocalTransportClient(localEndpointPath(nodeId))
       };
     }
+    var DEFAULT_RETENTION_SECONDS = 300;
+    var DEFAULT_MAX_TRIPLES = 4e3;
+    var PARENT_ROUTED_PROVIDER_ADDON_ID = "(unresolved: parent-routed)";
+    var CapUsageRegistry = class {
+      retentionSeconds;
+      maxTriples;
+      map = /* @__PURE__ */ new Map();
+      triples = 0;
+      droppedTriples = 0;
+      constructor(opts) {
+        this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? DEFAULT_RETENTION_SECONDS);
+        this.maxTriples = Math.max(1, opts?.maxTriples ?? DEFAULT_MAX_TRIPLES);
+      }
+      /**
+      * Record one observed cap call.
+      *
+      * On the hot path: this runs once per cross-process cap call on hub-main's
+      * event loop, which is the cluster's only queue (D181). Three Map lookups, an
+      * integer increment, and — only when the wall clock has moved on — a bounded
+      * clear. No allocation once a triple exists, and it NEVER throws into the
+      * call it observes.
+      */
+      recordCall(rec) {
+        try {
+          if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
+          if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
+          const window2 = this.windowFor(rec);
+          if (window2 === null) return;
+          const sec = Math.floor(rec.atMs / 1e3);
+          if (window2.lastCallAtMs !== 0) {
+            const lastSec = Math.floor(window2.lastCallAtMs / 1e3);
+            const advanced = Math.min(sec - lastSec, this.retentionSeconds);
+            for (let k = 1; k <= advanced; k++) window2.buckets[(lastSec + k) % this.retentionSeconds] = 0;
+          }
+          const idx = sec % this.retentionSeconds;
+          window2.buckets[idx] = (window2.buckets[idx] ?? 0) + 1;
+          if (rec.atMs > window2.lastCallAtMs) window2.lastCallAtMs = rec.atMs;
+        } catch {
+        }
+      }
+      getGraph(opts) {
+        const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
+        const minMs = opts.nowMs - windowSeconds * 1e3;
+        const nowSec = Math.floor(opts.nowMs / 1e3);
+        const out = [];
+        for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window2] of byCap) {
+          if (window2.lastCallAtMs < minMs) continue;
+          const count = this.sumWindow(window2, nowSec, windowSeconds);
+          if (count === 0) continue;
+          const callsPerMin = count / windowSeconds * 60;
+          out.push({
+            callerAddonId: caller,
+            providerAddonId: provider,
+            capName,
+            callsPerMin,
+            lastCallAtMs: window2.lastCallAtMs
+          });
+        }
+        return out;
+      }
+      /** See {@link CapUsageStats}. Cheap — three counters, no scan. */
+      getStats() {
+        return {
+          triples: this.triples,
+          maxTriples: this.maxTriples,
+          droppedTriples: this.droppedTriples
+        };
+      }
+      /** Test / diagnostic helper — drops all recorded calls. */
+      clear() {
+        this.map.clear();
+        this.triples = 0;
+        this.droppedTriples = 0;
+      }
+      /**
+      * Sum the buckets covering `(nowSec - windowSeconds, nowSec]`.
+      *
+      * The scan starts at `lastSec`, never at `nowSec`. `recordCall` clears the
+      * buckets the ring has advanced OVER, which by definition stops at the last
+      * write: the buckets for the seconds since then still hold whatever the
+      * previous pass left in them, and reading `nowSec` down would count it. A
+      * triple that went quiet for a couple of minutes and then made one call would
+      * report the burst it made five minutes earlier.
+      *
+      * No lower bound is needed beyond the window itself: every bucket at or below
+      * `lastSec - retention` was cleared by the advance that reached `lastSec`, so
+      * it reads zero anyway. The loop is bounded by `windowSeconds ≤ retention`.
+      */
+      sumWindow(window2, nowSec, windowSeconds) {
+        const lastSec = Math.floor(window2.lastCallAtMs / 1e3);
+        const from = Math.min(nowSec, lastSec);
+        const floorSec = nowSec - windowSeconds;
+        let count = 0;
+        for (let s = from; s > floorSec; s--) count += window2.buckets[s % this.retentionSeconds] ?? 0;
+        return count;
+      }
+      /**
+      * The ring for this triple, creating it if the ceiling allows. `null` means
+      * the observation is dropped — counted, never silent (see
+      * {@link CapUsageStats.droppedTriples}).
+      */
+      windowFor(rec) {
+        let byProvider = this.map.get(rec.callerAddonId);
+        if (!byProvider) {
+          byProvider = /* @__PURE__ */ new Map();
+          this.map.set(rec.callerAddonId, byProvider);
+        }
+        let byCap = byProvider.get(rec.providerAddonId);
+        if (!byCap) {
+          byCap = /* @__PURE__ */ new Map();
+          byProvider.set(rec.providerAddonId, byCap);
+        }
+        const existing = byCap.get(rec.capName);
+        if (existing) return existing;
+        if (this.triples >= this.maxTriples) {
+          this.reclaimExpired(rec.atMs);
+          if (this.triples >= this.maxTriples) {
+            this.droppedTriples++;
+            return null;
+          }
+          byProvider = this.map.get(rec.callerAddonId);
+          if (!byProvider) {
+            byProvider = /* @__PURE__ */ new Map();
+            this.map.set(rec.callerAddonId, byProvider);
+          }
+          byCap = byProvider.get(rec.providerAddonId);
+          if (!byCap) {
+            byCap = /* @__PURE__ */ new Map();
+            byProvider.set(rec.providerAddonId, byCap);
+          }
+        }
+        const created = {
+          buckets: new Uint32Array(this.retentionSeconds),
+          lastCallAtMs: 0
+        };
+        byCap.set(rec.capName, created);
+        this.triples++;
+        return created;
+      }
+      /**
+      * Drop every triple whose whole ring has aged out — its last call is older
+      * than the retention window, so it can contribute to no query. O(triples),
+      * and only reachable when the ceiling is full, so it is amortised away by the
+      * admissions it enables.
+      */
+      reclaimExpired(nowMs) {
+        const cutoff = nowMs - this.retentionSeconds * 1e3;
+        for (const [caller, byProvider] of this.map) {
+          for (const [provider, byCap] of byProvider) {
+            for (const [capName, window2] of byCap) {
+              if (window2.lastCallAtMs >= cutoff) continue;
+              byCap.delete(capName);
+              this.triples--;
+            }
+            if (byCap.size === 0) byProvider.delete(provider);
+          }
+          if (byProvider.size === 0) this.map.delete(caller);
+        }
+      }
+    };
+    var singleton = null;
+    function getCapUsageRegistry() {
+      if (!singleton) singleton = new CapUsageRegistry();
+      return singleton;
+    }
+    function __resetCapUsageRegistryForTests() {
+      singleton = null;
+    }
     function createSharedBusState(retainRecent = false) {
       return {
         handlers: /* @__PURE__ */ new Map(),
@@ -120391,6 +120733,8 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
       isAddonPinnedCall;
       /** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
       capTimeoutMs;
+      /** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+      capUsageObserver;
       /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
       egressRoutedCaps = /* @__PURE__ */ new Set();
       /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -120422,6 +120766,7 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
           this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
           this.isAddonPinnedCall = opts.isAddonPinnedCall;
           this.capTimeoutMs = opts.capTimeoutMs;
+          this.capUsageObserver = opts.capUsageObserver;
         } else {
           this.server = serverOrOptions;
           this.onUnownedCall = onUnownedCallArg;
@@ -120588,6 +120933,30 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
         }
         return candidates[0];
       }
+      /**
+      * Publish one cap-usage observation, if a sink is wired.
+      *
+      * Cost discipline — this is on the hot path (D181: hub-main's event loop is
+      * the cluster's only queue): no sink means one undefined check; with a sink
+      * it is one object literal and one `Date.now()`, and the sink itself is O(1).
+      * Wrapped so a broken observer can never fail the call it observes — the
+      * registry swallows too, and BOTH matter: this catch also covers a sink that
+      * is not the registry.
+      */
+      recordCapUsage(callerChildId, providerChildId, capName, methodName) {
+        const sink = this.capUsageObserver;
+        if (sink === void 0 || callerChildId === null) return;
+        try {
+          sink({
+            callerAddonId: callerChildId,
+            providerAddonId: providerChildId ?? "(unresolved: parent-routed)",
+            capName,
+            methodName,
+            atMs: Date.now()
+          });
+        } catch {
+        }
+      }
       /** First child whose cap manifest contains a descriptor matching `predicate`. */
       findChildId(predicate) {
         for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
@@ -120857,7 +121226,9 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
             const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
             const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
             const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
-            if ((!(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+            const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
+            this.recordCapUsage(childId, target, out.capName, out.method);
+            if (target !== null) {
               if (!this.egressRoutedCaps.has(out.capName)) {
                 this.egressRoutedCaps.add(out.capName);
                 this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -121714,77 +122085,6 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
       }
       return links;
     }
-    var CapUsageRegistry = class {
-      retentionSeconds;
-      map = /* @__PURE__ */ new Map();
-      constructor(opts) {
-        this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? 300);
-      }
-      recordCall(rec) {
-        try {
-          if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
-          if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
-          let byProvider = this.map.get(rec.callerAddonId);
-          if (!byProvider) {
-            byProvider = /* @__PURE__ */ new Map();
-            this.map.set(rec.callerAddonId, byProvider);
-          }
-          let byCap = byProvider.get(rec.providerAddonId);
-          if (!byCap) {
-            byCap = /* @__PURE__ */ new Map();
-            byProvider.set(rec.providerAddonId, byCap);
-          }
-          let window2 = byCap.get(rec.capName);
-          if (!window2) {
-            window2 = {
-              buckets: Array.from({ length: this.retentionSeconds }, () => 0),
-              lastCallAtMs: 0
-            };
-            byCap.set(rec.capName, window2);
-          }
-          const bucketIdx = Math.floor(rec.atMs / 1e3) % this.retentionSeconds;
-          window2.buckets[bucketIdx] = (window2.buckets[bucketIdx] ?? 0) + 1;
-          if (rec.atMs > window2.lastCallAtMs) window2.lastCallAtMs = rec.atMs;
-        } catch {
-        }
-      }
-      getGraph(opts) {
-        const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
-        const minMs = opts.nowMs - windowSeconds * 1e3;
-        const out = [];
-        for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window2] of byCap) {
-          if (window2.lastCallAtMs < minMs) continue;
-          const nowBucket = Math.floor(opts.nowMs / 1e3);
-          let count = 0;
-          for (let i = 0; i < windowSeconds; i++) {
-            const b = (nowBucket - i + this.retentionSeconds * 1e6) % this.retentionSeconds;
-            count += window2.buckets[b] ?? 0;
-          }
-          if (count === 0) continue;
-          const callsPerMin = count / windowSeconds * 60;
-          out.push({
-            callerAddonId: caller,
-            providerAddonId: provider,
-            capName,
-            callsPerMin,
-            lastCallAtMs: window2.lastCallAtMs
-          });
-        }
-        return out;
-      }
-      /** Test / diagnostic helper — drops all recorded calls. */
-      clear() {
-        this.map.clear();
-      }
-    };
-    var singleton = null;
-    function getCapUsageRegistry() {
-      if (!singleton) singleton = new CapUsageRegistry();
-      return singleton;
-    }
-    function __resetCapUsageRegistryForTests() {
-      singleton = null;
-    }
     function safeExistsSync(path) {
       try {
         return node_fs.existsSync(path);
@@ -123220,6 +123520,12 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
         return NATIVE_PROVIDER_SERVICE_INFIX;
       }
     });
+    Object.defineProperty(exports, "PARENT_ROUTED_PROVIDER_ADDON_ID", {
+      enumerable: true,
+      get: function() {
+        return PARENT_ROUTED_PROVIDER_ADDON_ID;
+      }
+    });
     Object.defineProperty(exports, "RSS_BUDGET_REANNOUNCE_MIN_MS", {
       enumerable: true,
       get: function() {
@@ -127634,7 +127940,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_CcvXUhHK();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -127660,7 +127966,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_8boi90D9();
+    var require_manifest_system_deps = require_manifest_system_deps_oJMkWSX();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -208146,6 +208452,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.NativeMetricsProvider = require_builtins_native_metrics_native_metrics_addon.NativeMetricsProvider;
     exports.NetworkQualityTracker = NetworkQualityTracker;
     exports.NotificationService = NotificationService;
+    exports.PARENT_ROUTED_PROVIDER_ADDON_ID = require_manifest_system_deps.PARENT_ROUTED_PROVIDER_ADDON_ID;
     Object.defineProperty(exports, "PYTHON_VERSION", {
       enumerable: true,
       get: function() {
@@ -209794,6 +210101,21 @@ var require_dist4 = __commonJS({
       bytesMoved: zod.z.number().int(),
       /** Total files discovered up front; null while (or when) unknown. */
       filesTotal: zod.z.number().int().nullable(),
+      /**
+      * Rows this run CORRECTED while moving them — a durable mutation the move
+      * made that nobody asked for, so it is reported where the operator reads the
+      * job rather than only in a log line.
+      *
+      * A footage segment records its byte count in its own NAME, and the durable
+      * hour row derives its aggregates from those names. A file that does not
+      * match its name therefore makes the ledger's sums — and with them quota and
+      * pressure eviction — wrong by the difference, and only a rename can fix it.
+      * On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+      *
+      * Absent on lanes where the question has no meaning: a media blob's size is
+      * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+      */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -209836,11 +210158,18 @@ var require_dist4 = __commonJS({
       /** Omitted = `move`, the pre-existing behaviour. */
       mode: MediaRelocateModeSchema.optional()
     });
-    var UnstampedEventMediaCountSchema = zod.z.object({
-      media: zod.z.number().int().nonnegative(),
-      retrainFrames: zod.z.number().int().nonnegative(),
-      total: zod.z.number().int().nonnegative()
+    var UnstampedRowsSchema = zod.z.object({
+      present: zod.z.boolean(),
+      rows: zod.z.number().int().nonnegative().nullable()
     });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: UnstampedRowsSchema,
+      retrainFrames: UnstampedRowsSchema,
+      /** True when EITHER collection holds one. The refusal reads this. */
+      anyPresent: zod.z.boolean(),
+      /** Sum across both, or `null` when either lane could not be counted. */
+      total: zod.z.number().int().nonnegative().nullable()
+    }).nullable();
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
@@ -209887,6 +210216,10 @@ var require_dist4 = __commonJS({
       /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
       filesTotal: zod.z.number().int().nonnegative().nullable(),
       bytesMoved: zod.z.number().int().nonnegative(),
+      /** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+      *  a lane that cannot reconcile. A migration that silently rewrote durable
+      *  rows would be the same failure as one that silently skipped them. */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       /** The MOVER's start, not the migration's: a drain restarted after an addon
       *  crash gets a new mover, and a rate computed from the migration's start
       *  would silently average in the time nothing was running. */
@@ -216211,6 +216544,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * calls are sync. Bindings change rarely (only on wrapper toggle or
         * device add/remove) — clients invalidate via the
         * `capability.binding-changed` event.
+        *
+        * "A single round-trip" describes the CLIENT's side and used not to
+        * describe the server's: until 2026-08-30 the resolver read the persisted
+        * wrapper activations once per device, so answering this cost one
+        * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+        * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+        * The server side is now two reads for the whole fleet. Anything PERIODIC
+        * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+        * a warm seed.
         */
         getAllBindings: require_sleep.method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
         /**
@@ -222996,6 +223338,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * happens to stamp it. This count is what the migration planner's
         * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
         * it to zero.
+        *
+        * TWO indexed statements per collection, not a walk. It used to page the
+        * whole collection at 200 rows per RPC ordered by an unindexed column, so
+        * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+        * time it was called, and the migration it gates could never start. The
+        * cheap question (`present`: is there at least one) is asked first and
+        * separately from the expensive one (`rows`), because only the first has
+        * to be answerable for the gate to do its job.
+        *
+        * **`null` is "not measurable", never zero** — at either level. An
+        * unreadable collection must not read as a sealed one.
         */
         countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /**
@@ -251323,6 +251676,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
     exports.UnitConversionError = UnitConversionError;
     exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
+    exports.UnstampedRowsSchema = UnstampedRowsSchema;
     exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
     exports.UpdateStatusSchema = UpdateStatusSchema;
     exports.UpdateUserInputSchema = UpdateUserInputSchema;
@@ -385633,6 +385987,14 @@ var require_main2 = __commonJS({
           // cap). A pin to ANOTHER node still bypasses the sibling → onUnownedCall.
           ownNodeId: agentNodeId,
           onUnownedCall
+          // NO `capUsageObserver` here, deliberately. `getCapUsageRegistry()` is a
+          // per-process singleton and the reader (`nodes.getCapUsageGraph`) runs on
+          // hub-main; recording in the agent would produce a map nobody ever reads,
+          // which is exactly the shape that made this graph return `[]` for
+          // months. An agent's addon traffic is a KNOWN blind spot of the graph —
+          // see `LocalChildRegistryOptions.capUsageObserver`. Closing it needs the
+          // caller identity to survive `$hub-cap-fwd`'s envelope, which today it
+          // does not.
         });
         await agentUdsRegistry.start();
         agentUdsRegistry.onChildRegistered((child) => {
@@ -410443,8 +410805,30 @@ var require_cap_providers = __commonJS({
           }
           return result;
         },
+        /**
+         * Observed caller → provider → cap edges over the last `windowSeconds`.
+         *
+         * **Read the blind spots before drawing a conclusion.** This reads
+         * hub-main's `CapUsageRegistry`, written by the hub's `LocalChildRegistry`
+         * on every `cap-call-out` a hub-local forked addon sends. It therefore does
+         * NOT contain: hub-main → hub-main in-process calls (one shared `ctx.api`
+         * client, no per-caller identity), a runner's own co-located calls, or any
+         * traffic originating on an agent. An edge missing here means "not seen on
+         * this plane", never "did not happen" — the full list is on
+         * `LocalChildRegistryOptions.capUsageObserver`.
+         */
         getCapUsageGraph: async (input) => {
           const reg = (0, system_1.getCapUsageRegistry)();
+          const stats = reg.getStats();
+          if (stats.droppedTriples > 0) {
+            logger?.warn("cap-usage graph is truncated \u2014 the triple ceiling was reached", {
+              meta: {
+                triples: stats.triples,
+                maxTriples: stats.maxTriples,
+                droppedTriples: stats.droppedTriples
+              }
+            });
+          }
           return reg.getGraph({ windowSeconds: input.windowSeconds, nowMs: Date.now() });
         },
         setProcessLogLevel: async (input) => {
@@ -421469,6 +421853,14 @@ var require_moleculer_service = __commonJS({
             // below, so a method that survives 16 minutes across nodes survives it
             // across a socket too — and one that hangs is cut off on both.
             capTimeoutMs: (capName, method) => this.capabilityService.getRegistry()?.getDefinition(capName)?.methods?.[method]?.timeoutMs,
+            // Feed the cap-usage graph from the one place that sees a forked
+            // addon's outbound `ctx.api` traffic AND runs in the process that reads
+            // it back (`nodes.getCapUsageGraph` → `cap-providers.ts`). The
+            // runner-side observer in `addon-context-factory.ts` writes to the
+            // RUNNER's own module singleton, which hub-main never sees — which is
+            // why the graph answered `[]` on a hub running 64 addons. Blind spots
+            // that remain are listed on `LocalChildRegistryOptions.capUsageObserver`.
+            capUsageObserver: (obs) => (0, system_1.getCapUsageRegistry)().recordCall(obs),
             logger: {
               info: (msg, meta) => logger.info(msg, meta !== null && meta !== void 0 ? { meta } : void 0)
             },