camstack 1.2.65 → 1.2.67

package/dist/{launcher-3XCU3XJF.js → launcher-5FCVBL5M.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-Ck2jkBZk.js
-var require_dist_Ck2jkBZk = __commonJS({
-  "../system/dist/dist-Ck2jkBZk.js"(exports) {
+// ../system/dist/dist-Keu5TDO7.js
+var require_dist_Keu5TDO7 = __commonJS({
+  "../system/dist/dist-Keu5TDO7.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -26259,6 +26259,21 @@ var require_dist_Ck2jkBZk = __commonJS({
       bytesMoved: zod.z.number().int(),
       /** Total files discovered up front; null while (or when) unknown. */
       filesTotal: zod.z.number().int().nullable(),
+      /**
+      * Rows this run CORRECTED while moving them — a durable mutation the move
+      * made that nobody asked for, so it is reported where the operator reads the
+      * job rather than only in a log line.
+      *
+      * A footage segment records its byte count in its own NAME, and the durable
+      * hour row derives its aggregates from those names. A file that does not
+      * match its name therefore makes the ledger's sums — and with them quota and
+      * pressure eviction — wrong by the difference, and only a rename can fix it.
+      * On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+      *
+      * Absent on lanes where the question has no meaning: a media blob's size is
+      * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+      */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -26301,11 +26316,18 @@ var require_dist_Ck2jkBZk = __commonJS({
       /** Omitted = `move`, the pre-existing behaviour. */
       mode: MediaRelocateModeSchema.optional()
     });
-    var UnstampedEventMediaCountSchema = zod.z.object({
-      media: zod.z.number().int().nonnegative(),
-      retrainFrames: zod.z.number().int().nonnegative(),
-      total: zod.z.number().int().nonnegative()
+    var UnstampedRowsSchema = zod.z.object({
+      present: zod.z.boolean(),
+      rows: zod.z.number().int().nonnegative().nullable()
     });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: UnstampedRowsSchema,
+      retrainFrames: UnstampedRowsSchema,
+      /** True when EITHER collection holds one. The refusal reads this. */
+      anyPresent: zod.z.boolean(),
+      /** Sum across both, or `null` when either lane could not be counted. */
+      total: zod.z.number().int().nonnegative().nullable()
+    }).nullable();
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
@@ -26352,6 +26374,10 @@ var require_dist_Ck2jkBZk = __commonJS({
       /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
       filesTotal: zod.z.number().int().nonnegative().nullable(),
       bytesMoved: zod.z.number().int().nonnegative(),
+      /** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+      *  a lane that cannot reconcile. A migration that silently rewrote durable
+      *  rows would be the same failure as one that silently skipped them. */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       /** The MOVER's start, not the migration's: a drain restarted after an addon
       *  crash gets a new mover, and a rate computed from the migration's start
       *  would silently average in the time nothing was running. */
@@ -31507,6 +31533,15 @@ var require_dist_Ck2jkBZk = __commonJS({
         * calls are sync. Bindings change rarely (only on wrapper toggle or
         * device add/remove) — clients invalidate via the
         * `capability.binding-changed` event.
+        *
+        * "A single round-trip" describes the CLIENT's side and used not to
+        * describe the server's: until 2026-08-30 the resolver read the persisted
+        * wrapper activations once per device, so answering this cost one
+        * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+        * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+        * The server side is now two reads for the whole fleet. Anything PERIODIC
+        * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+        * a warm seed.
         */
         getAllBindings: method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
         /**
@@ -31905,6 +31940,80 @@ var require_dist_Ck2jkBZk = __commonJS({
         getInfo: method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
       }
     };
+    var FailureReasonCountSchema = zod.z.object({
+      /**
+      * Why the attempt did not land, in the contributor's own vocabulary —
+      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+      * strings that already appear in this repo's logs and, where one exists, the
+      * same string the per-track `previewMissReason` records (D276): a second
+      * vocabulary for the same loss would make the row and the counter
+      * un-joinable.
+      */
+      reason: zod.z.string(),
+      count: zod.z.number().int().nonnegative()
+    });
+    var FailureContributionSchema = zod.z.object({
+      /**
+      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+      * `unit` free: the families are owned by different addons and a shared enum
+      * is a central list that rots invisibly.
+      */
+      family: zod.z.string(),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. Never nullable and never absent: a contributor that
+      * cannot name the camera must not emit the entry, because a fleet total
+      * cannot answer the only question anybody asks of this surface.
+      */
+      deviceId: zod.z.number().int().positive(),
+      /**
+      * A second dimension inside the family: the model / step id for an inference
+      * timeout, so "which camera AND which model" is one read. Absent when the
+      * family has a single variant.
+      */
+      variant: zod.z.string().optional(),
+      /**
+      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
+      * differencing two reads must drop the interval when it changes, because the
+      * counter restarted from zero in a respawned runner. Same discipline as
+      * `LoadContribution.startedAtMs`.
+      */
+      sinceMs: zod.z.number(),
+      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+      atMs: zod.z.number(),
+      /**
+      * THE DENOMINATOR — every attempt on this path for this camera in the
+      * window. A failure count published without it is the mistake this schema
+      * exists to make impossible.
+      */
+      attempts: zod.z.number().int().nonnegative(),
+      /** Attempts that landed. `attempts - succeeded` is the loss. */
+      succeeded: zod.z.number().int().nonnegative(),
+      /** The loss, partitioned. Sums to `attempts - succeeded`. */
+      reasons: zod.z.array(FailureReasonCountSchema).readonly()
+    });
+    var failureContributionCapability = {
+      name: "failure-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's per-camera failure counters, read live from bounded in-RAM
+        * state it already keeps. Inert: no persistence, no sampling, no timer.
+        *
+        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+        * consumer that wants a rate differences two reads. A draining read would
+        * make two operators with the page open each destroy half of the other's
+        * numbers, and `load-contribution` already settled the same question the
+        * same way for `cpuSeconds`.
+        */
+        list: method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var DirEntrySchema = zod.z.object({
       name: zod.z.string(),
       path: zod.z.string()
@@ -32442,145 +32551,6 @@ var require_dist_Ck2jkBZk = __commonJS({
         })
       }
     };
-    var LogChannelApplyResultSchema = zod.z.object({
-      /** How many declared channels are armed in this process after the call. */
-      armed: zod.z.number().int().min(0),
-      /**
-      * Names the document armed that this process does not declare. Reported
-      * rather than swallowed: a name here is either a typo or an addon that has
-      * not booted, and both deserve a line instead of silence.
-      */
-      unknown: zod.z.array(zod.z.string()).readonly()
-    });
-    var logChannelsCapability = {
-      name: "log-channels",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /** The channels this addon declares. Inert: no value, no state. */
-        list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
-        /**
-        * Refresh this process's mirror from the document's FULL set of armed
-        * windows.
-        *
-        * Full and not incremental on purpose: the document is the authority, so a
-        * channel it does not name is disarmed here. An incremental apply would
-        * let a disarm get lost in transit and leave a channel running that
-        * nobody can see is running.
-        */
-        apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
-    var LogLevelSchema = zod.z.enum([
-      "debug",
-      "info",
-      "warn",
-      "error"
-    ]);
-    var LogEntrySchema = zod.z.object({
-      timestamp: zod.z.date(),
-      level: LogLevelSchema,
-      scope: zod.z.array(zod.z.string()),
-      message: zod.z.string(),
-      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-    });
-    var logDestinationCapability = {
-      name: "log-destination",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        write: method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-        query: method(zod.z.object({
-          scope: zod.z.array(zod.z.string()).optional(),
-          level: LogLevelSchema.optional(),
-          since: zod.z.date().optional(),
-          until: zod.z.date().optional(),
-          limit: zod.z.number().optional(),
-          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-        }), zod.z.array(LogEntrySchema).readonly())
-      },
-      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-      mount: { kind: "skip" }
-    };
-    var FailureReasonCountSchema = zod.z.object({
-      /**
-      * Why the attempt did not land, in the contributor's own vocabulary —
-      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-      * strings that already appear in this repo's logs and, where one exists, the
-      * same string the per-track `previewMissReason` records (D276): a second
-      * vocabulary for the same loss would make the row and the counter
-      * un-joinable.
-      */
-      reason: zod.z.string(),
-      count: zod.z.number().int().nonnegative()
-    });
-    var FailureContributionSchema = zod.z.object({
-      /**
-      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-      * `unit` free: the families are owned by different addons and a shared enum
-      * is a central list that rots invisibly.
-      */
-      family: zod.z.string(),
-      /**
-      * The NUMERIC device id — the same value every log line carries as
-      * `tags.deviceId`. Never nullable and never absent: a contributor that
-      * cannot name the camera must not emit the entry, because a fleet total
-      * cannot answer the only question anybody asks of this surface.
-      */
-      deviceId: zod.z.number().int().positive(),
-      /**
-      * A second dimension inside the family: the model / step id for an inference
-      * timeout, so "which camera AND which model" is one read. Absent when the
-      * family has a single variant.
-      */
-      variant: zod.z.string().optional(),
-      /**
-      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
-      * differencing two reads must drop the interval when it changes, because the
-      * counter restarted from zero in a respawned runner. Same discipline as
-      * `LoadContribution.startedAtMs`.
-      */
-      sinceMs: zod.z.number(),
-      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-      atMs: zod.z.number(),
-      /**
-      * THE DENOMINATOR — every attempt on this path for this camera in the
-      * window. A failure count published without it is the mistake this schema
-      * exists to make impossible.
-      */
-      attempts: zod.z.number().int().nonnegative(),
-      /** Attempts that landed. `attempts - succeeded` is the loss. */
-      succeeded: zod.z.number().int().nonnegative(),
-      /** The loss, partitioned. Sums to `attempts - succeeded`. */
-      reasons: zod.z.array(FailureReasonCountSchema).readonly()
-    });
-    var failureContributionCapability = {
-      name: "failure-contribution",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /**
-        * This addon's per-camera failure counters, read live from bounded in-RAM
-        * state it already keeps. Inert: no persistence, no sampling, no timer.
-        *
-        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-        * consumer that wants a rate differences two reads. A draining read would
-        * make two operators with the page open each destroy half of the other's
-        * numbers, and `load-contribution` already settled the same question the
-        * same way for `cpuSeconds`.
-        */
-        list: method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
     var LoadContributionSchema = zod.z.object({
       role: zod.z.enum([
         "decode",
@@ -32658,6 +32628,71 @@ var require_dist_Ck2jkBZk = __commonJS({
       /** In-process only — enumerated through `addons.listCapabilityProviders`. */
       mount: { kind: "skip" }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
+    var LogLevelSchema = zod.z.enum([
+      "debug",
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogEntrySchema = zod.z.object({
+      timestamp: zod.z.date(),
+      level: LogLevelSchema,
+      scope: zod.z.array(zod.z.string()),
+      message: zod.z.string(),
+      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+    });
+    var logDestinationCapability = {
+      name: "log-destination",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        write: method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+        query: method(zod.z.object({
+          scope: zod.z.array(zod.z.string()).optional(),
+          level: LogLevelSchema.optional(),
+          since: zod.z.date().optional(),
+          until: zod.z.date().optional(),
+          limit: zod.z.number().optional(),
+          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+        }), zod.z.array(LogEntrySchema).readonly())
+      },
+      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -36745,9 +36780,13 @@ var require_dist_Ck2jkBZk = __commonJS({
     var MediaFileSchema = zod.z.object({
       key: zod.z.string(),
       kind: MediaFileKindEnum,
-      base64: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
+    }).extend({
+      /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+      url: zod.z.string(),
+      /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+      base64: zod.z.string()
     });
     var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
     var RetrainMacroClassSchema = zod.z.enum([
@@ -37480,6 +37519,17 @@ var require_dist_Ck2jkBZk = __commonJS({
         * happens to stamp it. This count is what the migration planner's
         * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
         * it to zero.
+        *
+        * TWO indexed statements per collection, not a walk. It used to page the
+        * whole collection at 200 rows per RPC ordered by an unindexed column, so
+        * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+        * time it was called, and the migration it gates could never start. The
+        * cheap question (`present`: is there at least one) is asked first and
+        * separately from the expensive one (`rows`), because only the first has
+        * to be answerable for the gate to do its job.
+        *
+        * **`null` is "not measurable", never zero** — at either level. An
+        * unreadable collection must not read as a sealed one.
         */
         countUnstampedEventMedia: method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /**
@@ -37803,6 +37853,26 @@ var require_dist_Ck2jkBZk = __commonJS({
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
+        * What media an EVENT has, without any of it — the twin `getEventMedia`
+        * never had.
+        *
+        * `listTrackMedia` above got this treatment because a track's media is
+        * 5-8 MB. An event's is worse per row, not better: an old-style event owns
+        * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+        * modal — the one surface that legitimately shows the big kinds — unions
+        * both listings to build its filmstrip. It then renders every tile from
+        * the `event-media` plane by key and throws the bytes away. Measured on
+        * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+        * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+        *
+        * Same `deviceId` authorization subject as `getEventMedia`, and the same
+        * rows — this is a projection of that method, never a different question.
+        */
+        listEventMedia: method(zod.z.object({
+          eventId: zod.z.string(),
+          deviceId: zod.z.number()
+        }), zod.z.array(MediaFileInfoSchema).readonly()),
+        /**
         * Search object events by text query using CLIP cosine similarity.
         * Encodes `text` via the `embedding-encoder` cap, queries the
         * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -43098,7 +43168,7 @@ var require_dist_Ck2jkBZk = __commonJS({
     var MediaFileLiteSchema$1 = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -45991,7 +46061,7 @@ var require_dist_Ck2jkBZk = __commonJS({
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -53299,6 +53369,12 @@ var require_dist_Ck2jkBZk = __commonJS({
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listGroups": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -56922,6 +56998,11 @@ var require_dist_Ck2jkBZk = __commonJS({
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listEventMedia": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.listGroups": [{
         name: "deviceIds",
         form: "array",
@@ -59066,7 +59147,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59885,7 +59966,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59979,7 +60060,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60876,11 +60957,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-Dp_CyuCW.js
-var require_retired_settings_keys_Dp_CyuCW = __commonJS({
-  "../system/dist/retired-settings-keys-Dp_CyuCW.js"(exports) {
+// ../system/dist/retired-settings-keys-BBohF-eC.js
+var require_retired_settings_keys_BBohF_eC = __commonJS({
+  "../system/dist/retired-settings-keys-BBohF-eC.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63094,8 +63175,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
-    var require_retired_settings_keys = require_retired_settings_keys_Dp_CyuCW();
+    var require_dist10 = require_dist_Keu5TDO7();
+    var require_retired_settings_keys = require_retired_settings_keys_BBohF_eC();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -63558,10 +63639,17 @@ var require_device_manager_addon = __commonJS({
       const live = deps.ctx.kernel?.deviceRegistry?.getById(deviceId)?.type;
       return typeof live === "string" && live.length > 0 ? live : void 0;
     }
-    async function resolveDevicePresence(deps, row, deviceId) {
+    async function resolveDevicePresence(deps, row, deviceId, ledgerNonEmpty) {
       if (deps.ctx.kernel?.deviceRegistry?.getById(deviceId)) return "present";
       if (row !== null) return "present";
-      return await deps.rows.count() > 0 ? "absent" : "unknown";
+      return await ledgerNonEmpty() ? "absent" : "unknown";
+    }
+    function onceLedgerNonEmpty(deps) {
+      let pending = null;
+      return () => {
+        if (pending === null) pending = deps.rows.count().then((n) => n > 0);
+        return pending;
+      };
     }
     function capAppliesToDeviceType(def, deviceType) {
       if (deviceType === void 0) return true;
@@ -63570,14 +63658,17 @@ var require_device_manager_addon = __commonJS({
       return declared.some((t) => t === deviceType);
     }
     async function getBindings(deps, input) {
-      const row = await deps.rows.get(input.deviceId);
-      return resolveBindingsForDevice(deps, input.deviceId, row);
+      const [row, store] = await Promise.all([deps.rows.get(input.deviceId), readBindingsStore(deps)]);
+      return resolveBindingsForDevice(deps, input.deviceId, row, {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      });
     }
-    async function resolveBindingsForDevice(deps, deviceId, row) {
+    async function resolveBindingsForDevice(deps, deviceId, row, pass) {
       const storeKey = String(deviceId);
-      const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+      const perDevice = pass.store.deviceBindings[storeKey] ?? {};
       const deviceType = resolveDeviceType(deps, row, deviceId);
-      const presence = await resolveDevicePresence(deps, row, deviceId);
+      const presence = await resolveDevicePresence(deps, row, deviceId, pass.ledgerNonEmpty);
       const entries = [];
       const seenCaps = /* @__PURE__ */ new Set();
       const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
@@ -63677,13 +63768,17 @@ var require_device_manager_addon = __commonJS({
     }
     async function getBindingsBatch(deps, input) {
       const ids = [...new Set(input.deviceIds)];
-      const rows = await deps.rows.getMany(ids);
+      const [rows, store] = await Promise.all([deps.rows.getMany(ids), readBindingsStore(deps)]);
+      const pass = {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      };
       const out = [];
-      for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null));
+      for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null, pass));
       return out;
     }
     async function getAllBindings(deps) {
-      const fleet = await deps.rows.listAll();
+      const [fleet, store] = await Promise.all([deps.rows.listAll(), readBindingsStore(deps)]);
       const rowById = /* @__PURE__ */ new Map();
       const ids = /* @__PURE__ */ new Set();
       for (const row of fleet) {
@@ -63696,8 +63791,12 @@ var require_device_manager_addon = __commonJS({
         deps.ctx.logger.warn("getAllBindings found no devices \u2014 warm boot will see nothing", { meta: { hasRegistry: deps.ctx.kernel?.deviceRegistry !== void 0 } });
         return [];
       }
+      const pass = {
+        store,
+        ledgerNonEmpty: onceLedgerNonEmpty(deps)
+      };
       const out = [];
-      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null));
+      for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null, pass));
       return out;
     }
     async function lookupPersistedStableId(deps, deviceId) {
@@ -64257,7 +64356,12 @@ var require_device_manager_addon = __commonJS({
         ...sourceInfoGetDevice !== void 0 ? { sourceInfo: sourceInfoGetDevice } : {}
       };
     }
-    async function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren) {
+    function persistedChildIds(childRows, liveChildren) {
+      const live = /* @__PURE__ */ new Set();
+      for (const device of liveChildren) live.add(device.id);
+      return childRows.filter((row) => !live.has(row.meta.id)).map((row) => row.meta.id);
+    }
+    function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs) {
       const results = [];
       const seen = /* @__PURE__ */ new Set();
       const rowById = /* @__PURE__ */ new Map();
@@ -64273,9 +64377,9 @@ var require_device_manager_addon = __commonJS({
         const childStableId = m.stableId;
         const key = String(m.id);
         if (seen.has(key)) continue;
-        const persistedConfig = await pctx.settings.readDeviceStore(m.id);
+        const persistedConfig = configs.get(m.id) ?? {};
         const metadata = row.metadata;
-        const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
+        const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig, childStableId, ownerAddonId);
         results.push({
           id: m.id,
           stableId: childStableId,
@@ -64290,7 +64394,7 @@ var require_device_manager_addon = __commonJS({
           probed: pctx.host.resolveDeviceProbed(m.id),
           features: persistedFeatures(m.features),
           isCamera: false,
-          config: persistedConfig ?? {},
+          config: persistedConfig,
           metadata,
           ...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
           ...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -64317,7 +64421,8 @@ var require_device_manager_addon = __commonJS({
       }
       const childRows = await pctx.metaStore.rows.listByParent(parentDeviceId);
       const liveChildren = pctx.registry?.getChildren(parentDeviceId) ?? [];
-      return [...await projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren)];
+      const configs = await readDeviceConfigs(pctx, persistedChildIds(childRows, liveChildren));
+      return [...projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChildren, configs)];
     }
     async function getChildrenBatch(pctx, input) {
       const parentIds = [...new Set(input.parentDeviceIds)];
@@ -64345,11 +64450,14 @@ var require_device_manager_addon = __commonJS({
         if (bucket === void 0) liveByParent.set(parentId, [device]);
         else bucket.push(device);
       }
+      const configIds = [];
+      for (const parentId of owners.keys()) configIds.push(...persistedChildIds(rowsByParent.get(parentId) ?? [], liveByParent.get(parentId) ?? []));
+      const configs = await readDeviceConfigs(pctx, configIds);
       for (const [parentId, ownerAddonId] of owners) {
         const childRows = rowsByParent.get(parentId) ?? [];
         const liveChildren = liveByParent.get(parentId) ?? [];
         if (childRows.length === 0 && liveChildren.length === 0) continue;
-        const projected = await projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren);
+        const projected = projectChildren(pctx, parentId, ownerAddonId, childRows, liveChildren, configs);
         if (projected.length > 0) out[String(parentId)] = [...projected];
       }
       return out;
@@ -65391,18 +65499,20 @@ var require_device_manager_addon = __commonJS({
     }
     async function setWrapperActive(deps, input) {
       const storeKey = String(input.deviceId);
-      const store = await readBindingsStore(deps.bindingsDeps);
-      const perDevice = { ...store.deviceBindings[storeKey] };
-      if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
-      else perDevice[input.capName] = { wrapperAddonId: null };
-      const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
-        ...store.deviceBindings,
-        [storeKey]: perDevice
-      } : (() => {
-        const { [storeKey]: _drop, ...rest } = store.deviceBindings;
-        return rest;
-      })();
-      await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+      await deps.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const store = await readBindingsStore(deps.bindingsDeps);
+        const perDevice = { ...store.deviceBindings[storeKey] };
+        if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
+        else perDevice[input.capName] = { wrapperAddonId: null };
+        const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
+          ...store.deviceBindings,
+          [storeKey]: perDevice
+        } : (() => {
+          const { [storeKey]: _drop, ...rest } = store.deviceBindings;
+          return rest;
+        })();
+        await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+      });
       deps.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
         timestamp: /* @__PURE__ */ new Date(),
@@ -65681,12 +65791,13 @@ var require_device_manager_addon = __commonJS({
       });
       await pctx.settings.clearDeviceStore(deviceId);
       await pctx.settings.clearDeviceRuntimeState(deviceId);
-      const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
       const bindingKey = String(deviceId);
-      if (bindingsStore.deviceBindings[bindingKey]) {
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const bindingsStore = await readBindingsStore(pctx.bindingsDeps);
+        if (!bindingsStore.deviceBindings[bindingKey]) return;
         const { [bindingKey]: _removedBindings, ...restBindings } = bindingsStore.deviceBindings;
         await writeBindingsStore(pctx.bindingsDeps, { deviceBindings: restBindings });
-      }
+      });
       pctx.host.remoteNativeCaps.delete(deviceId);
       pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(deviceId);
       pctx.metaStore.idToAddonId.delete(deviceId);
@@ -66028,7 +66139,9 @@ var require_device_manager_addon = __commonJS({
         ...def,
         unit: require_dist10.normalizeUnit(def.unit) ?? def.unit
       } : def]));
-      await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        await pctx.settings.writeAddonStore({ roleDisplayDefaults: normalized });
+      });
     }
     async function applyInitialMeta(pctx, input) {
       const { deviceId, name, location, type, integrationId, linkDeviceId, role } = input;
@@ -66171,16 +66284,21 @@ var require_device_manager_addon = __commonJS({
     async function addLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) throw new Error("[device-manager] addLocation: name must be non-empty");
-      const current = (await pctx.metaStore.readStore()).locations ?? [];
-      if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
-      await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const current = (await pctx.metaStore.readStore()).locations ?? [];
+        if (current.some((l) => l.toLowerCase() === trimmed.toLowerCase())) return;
+        await pctx.settings.writeAddonStore({ locations: [...current, trimmed] });
+      });
     }
     async function removeLocation(pctx, input) {
       const trimmed = input.name.trim();
       if (trimmed.length === 0) return;
-      const current = (await pctx.metaStore.readStore()).locations ?? [];
-      const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
-      if (remaining.length !== current.length) await pctx.settings.writeAddonStore({ locations: remaining });
+      await pctx.bindingsDeps.withAddonStoreWriteLock(async () => {
+        const current = (await pctx.metaStore.readStore()).locations ?? [];
+        const remaining = current.filter((l) => l.toLowerCase() !== trimmed.toLowerCase());
+        if (remaining.length === current.length) return;
+        await pctx.settings.writeAddonStore({ locations: remaining });
+      });
       if (input.cascade !== true) return;
       const cleared = await pctx.metaStore.withMetaWriteLock(async () => {
         const out = [];
@@ -66221,23 +66339,40 @@ var require_device_manager_addon = __commonJS({
     function isRoleDisplayDefaults(value) {
       return value !== null && typeof value === "object" && !Array.isArray(value);
     }
+    function createWriteLock() {
+      let chain = Promise.resolve();
+      return async (fn) => {
+        const previous = chain;
+        let release = () => {
+        };
+        chain = new Promise((resolve) => {
+          release = resolve;
+        });
+        try {
+          await previous.catch(() => {
+          });
+          return await fn();
+        } finally {
+          release();
+        }
+      };
+    }
     var DeviceMetaStore = class {
       settings;
       registry;
       rows;
+      withAddonStoreWriteLock;
       /** Synchronous ownership cache, keyed by NUMERIC deviceId → owning addonId.
       *  The persisted row store is authoritative but reads are async; hub-side
       *  callers (e.g. `CapabilityRegistry.getNativeProvider` fallback) need
       *  ownership without awaiting. Kept in sync with every register/remove and
       *  warmed from persistence on boot. */
       idToAddonId = /* @__PURE__ */ new Map();
-      /** Serialises every read-modify-write of a device row through one promise
-      *  chain (see `withMetaWriteLock`). Per-instance state. */
-      metaWriteChain = Promise.resolve();
-      constructor(settings, registry, rows) {
+      constructor(settings, registry, rows, withAddonStoreWriteLock = createWriteLock()) {
         this.settings = settings;
         this.registry = registry;
         this.rows = rows;
+        this.withAddonStoreWriteLock = withAddonStoreWriteLock;
       }
       /** The read currently in flight, or null. Never a settled value — see
       *  {@link readStore}. */
@@ -66268,22 +66403,7 @@ var require_device_manager_addon = __commonJS({
         this.inFlightRead = read;
         return read;
       };
-      withMetaWriteLock = async (fn) => {
-        const previous = this.metaWriteChain;
-        let release = () => {
-        };
-        const next = new Promise((resolve) => {
-          release = resolve;
-        });
-        this.metaWriteChain = next;
-        try {
-          await previous.catch(() => {
-          });
-          return await fn();
-        } finally {
-          release();
-        }
-      };
+      withMetaWriteLock = createWriteLock();
       /** The whole persisted row for one device, or `null`. */
       getRow = async (deviceId) => this.rows.get(deviceId);
       /**
@@ -66317,11 +66437,24 @@ var require_device_manager_addon = __commonJS({
         ids.delete(parentId);
         return [...ids];
       };
-      allocateNextDeviceId = async () => {
+      /**
+      * Mint the next numeric device id.
+      *
+      * A read-modify-write of `nextDeviceId`, and it must hold the addon-store
+      * lock for the whole of it. Serialising the WRITES is not enough and never
+      * was: two callers that both read `N` both write `N + 1` and both return
+      * `N`, so two devices receive the same id. (`writeAddonStore` is itself
+      * read-modify-write over the addon's whole key range, so an unlocked bump
+      * can also be reverted wholesale by a concurrent `setWrapperActive`.)
+      *
+      * Callers hold {@link withMetaWriteLock} — this is the one nesting, and it
+      * only ever goes meta ⊃ addon-store.
+      */
+      allocateNextDeviceId = async () => this.withAddonStoreWriteLock(async () => {
         const current = (await this.readStore()).nextDeviceId ?? 1;
         await this.settings.writeAddonStore({ nextDeviceId: current + 1 });
         return current;
-      };
+      });
     };
     var CENSUS_STACK_FRAMES = 3;
     function siteFromStack(stack) {
@@ -67515,6 +67648,17 @@ var require_device_manager_addon = __commonJS({
       * it through {@link bindingsDeps} or the `ProviderContext`.
       */
       deviceRows = null;
+      /**
+      * The ONE lock ordering every read-modify-write of this addon's
+      * `addon-settings` key range (`deviceBindings`, `locations`, `nextDeviceId`,
+      * `roleDisplayDefaults`).
+      *
+      * It lives on the addon rather than on `DeviceMetaStore` because the writers
+      * do not all go through that class — `setWrapperActive` and `removeDevice`'s
+      * bindings purge reach the store through `BindingsDeps` — and two locks over
+      * one key range is the same defect one level up. Handed to both.
+      */
+      addonStoreWriteLock = createWriteLock();
       /** Build the dependency context the extracted binding resolvers consume. */
       get bindingsDeps() {
         const rows = this.deviceRows;
@@ -67523,7 +67667,8 @@ var require_device_manager_addon = __commonJS({
           ctx: this.ctx,
           capabilityRegistry: this.capabilityRegistry,
           remoteNativeCaps: this.remoteNativeCaps,
-          rows
+          rows,
+          withAddonStoreWriteLock: this.addonStoreWriteLock
         };
       }
       async getBindings(input) {
@@ -67592,7 +67737,7 @@ var require_device_manager_addon = __commonJS({
         } catch (err) {
           this.ctx.logger.warn("retired-row purge failed", { meta: { error: require_dist10.errMsg(err) } });
         }
-        const metaStore = new DeviceMetaStore(settings, registry, deviceRows);
+        const metaStore = new DeviceMetaStore(settings, registry, deviceRows, this.addonStoreWriteLock);
         this.stateMirrorImpl = new DeviceStateMirror(this.ctx);
         const stateMirror = this.stateMirrorImpl;
         const resolvePersistedById = metaStore.resolvePersistedById;
@@ -67844,7 +67989,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67981,7 +68126,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -68171,7 +68316,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75984,7 +76129,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76549,7 +76694,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -79171,7 +79316,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -80287,8 +80432,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
-    var require_retired_settings_keys = require_retired_settings_keys_Dp_CyuCW();
+    var require_dist10 = require_dist_Keu5TDO7();
+    var require_retired_settings_keys = require_retired_settings_keys_BBohF_eC();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -80619,11 +80764,16 @@ var require_sqlite_settings_addon = __commonJS({
       const resolve = (field) => {
         const expr = fieldExprFor(field, shape);
         if (expr === null && mode === "mutate") throw new UnsafeFilterError(`filter refers to "${field}", which this collection cannot express \u2014 refusing to run a bulk mutation with a dropped predicate`);
+        if (expr === null && mode === "measure") throw new UnsafeFilterError(`filter refers to "${field}", which this collection cannot express \u2014 refusing to answer with a number counted over a different question`);
         return expr;
       };
       for (const [field, value] of Object.entries(filter?.where ?? {})) {
         const expr = resolve(field);
         if (expr === null) continue;
+        if (value === null) {
+          clauses.push(`${expr} IS NULL`);
+          continue;
+        }
         clauses.push(`${expr} = ?`);
         params.push(serialize2(value));
       }
@@ -80646,6 +80796,10 @@ var require_sqlite_settings_addon = __commonJS({
       for (const [field, value] of Object.entries(filter?.whereNot ?? {})) {
         const expr = resolve(field);
         if (expr === null) continue;
+        if (value === null) {
+          clauses.push(`${expr} IS NOT NULL`);
+          continue;
+        }
         clauses.push(`(${expr} IS NULL OR ${expr} != ?)`);
         params.push(serialize2(value));
       }
@@ -81158,13 +81312,17 @@ var require_sqlite_settings_addon = __commonJS({
       * (visibility, kind, device, time window, expiry) — so `total` counted rows
       * the page could never show, including other users'.
       *
-      * `select` mode, deliberately: `count` must be forgiving in exactly the way
-      * `query` is, or the two disagree again for a new reason.
+      * `measure` mode. `count` compiles the same predicates `query` does — the
+      * two must never disagree about WHICH rows they are talking about — but it
+      * refuses a predicate it cannot express rather than skipping it. `query`
+      * hands back rows and a caller can see the filter did not bite; a count
+      * hands back a number, and the whole collection and the intended subset are
+      * the same shape.
       */
       async count({ namespace, collection, filter }) {
         const scoped = this.scopedName(namespace, collection);
         const decl = this.requireDeclared(scoped);
-        const { whereSql, params } = compileFilter$1(filter, this.shapeOf(decl), "select", (v) => this.serializeColumnValue(v));
+        const { whereSql, params } = compileFilter$1(filter, this.shapeOf(decl), "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT COUNT(*) AS cnt FROM "${scoped}"${whereSql}`;
         return this.measured({
           op: "count",
@@ -81182,8 +81340,10 @@ var require_sqlite_settings_addon = __commonJS({
       * projection — an unresolvable field THROWS rather than being dropped, because
       * a missing aggregate comes back as a number that looks real.
       *
-      * `select` mode on the filter, so this agrees with `query` and `count` about
-      * which rows it is talking about.
+      * `measure` mode on the filter, so this agrees with `query` and `count`
+      * about which rows it is talking about — and, since 2026-08-30, refuses an
+      * unresolvable PREDICATE for the same reason it already refused an
+      * unresolvable FIELD. Both come back as a number that looks real.
       */
       async aggregate({ namespace, collection, fields, filter }) {
         const scoped = this.scopedName(namespace, collection);
@@ -81195,7 +81355,7 @@ var require_sqlite_settings_addon = __commonJS({
           if (col === null) throw new UnsafeFilterError(`aggregate cannot read "${f.field}" on "${scoped}" \u2014 it is not a column of this collection, and answering without it would return a number that looks real`);
           selects.push(`${f.op.toUpperCase()}(${col}) AS "a${i}"`);
         });
-        const { whereSql, params } = compileFilter$1(filter, shape, "select", (v) => this.serializeColumnValue(v));
+        const { whereSql, params } = compileFilter$1(filter, shape, "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT ${selects.join(", ")} FROM "${scoped}"${whereSql}`;
         const row = this.measured({
           op: "aggregate",
@@ -81219,7 +81379,7 @@ var require_sqlite_settings_addon = __commonJS({
         const shape = this.shapeOf(decl);
         const col = fieldExprFor(field, shape);
         if (col === null) return [];
-        const { whereSql: where, params } = compileFilter$1(filter, shape, "select", (v) => this.serializeColumnValue(v));
+        const { whereSql: where, params } = compileFilter$1(filter, shape, "measure", (v) => this.serializeColumnValue(v));
         const sql = `SELECT ${`CAST((${col} - ?) / ? AS INTEGER)`} AS bucket, COUNT(*) AS count FROM "${scoped}"${where} GROUP BY bucket ORDER BY bucket`;
         return this.measured({
           op: "histogram",
@@ -81500,8 +81660,10 @@ var require_sqlite_settings_addon = __commonJS({
       * connection whose `sqlite_stat1` visibility and temp schema match.
       *
       * `EXPLAIN QUERY PLAN` prepares and plans; it does not execute the statement,
-      * so it costs no page reads of its own. It is still called only from the
-      * slow-call path, once per shape per window.
+      * so it costs no page reads of its own. In production it is called only from
+      * the slow-call path, once per shape per window; it is public so a guard can
+      * assert that a declared index is the one the planner actually picks — "we
+      * added an index" and "the query uses it" are different claims.
       *
       * Never throws. A plan that cannot be taken (a statement the engine will no
       * longer prepare, a closed handle mid-shutdown) is a missing ANSWER, not a
@@ -82650,7 +82812,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82856,6 +83018,10 @@ var require_storage_orchestrator_addon = __commonJS({
       "recorder",
       "pipeline"
     ];
+    function describeUnstamped(lane) {
+      if (!lane.present) return "0";
+      return lane.rows === null ? "an unknown number of" : lane.rows.toString();
+    }
     var StorageMigrationCoordinator = class {
       deps;
       active = null;
@@ -82899,12 +83065,21 @@ var require_storage_orchestrator_addon = __commonJS({
         if (moves.length === 0) throw new Error("select at least one storage class");
         if (moves.some((move) => move.storageClass === "eventMedia")) {
           const unstamped = await this.deps.participants.analytics.countUnstamped();
-          if (unstamped.total > 0) {
-            if (mode === "nonBlocking") throw new Error(`${unstamped.total.toString()} event-media row(s) still carry no locationId (${unstamped.media.toString()} media, ${unstamped.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
+          if (unstamped === null) {
+            if (mode === "nonBlocking") throw new Error("could not determine whether any event-media row still carries no locationId. A non-blocking cutover repoints the default and would silently orphan every such row, so an unmeasured collection is refused exactly like a non-empty one. Retry, or run the blocking mode, which stamps rows as it moves them.");
+            findings.push({
+              code: "unstampedEventMediaRows",
+              storageClass: "eventMedia",
+              message: "the count of event-media rows carrying no locationId could not be taken \u2014 treat it as unknown, not as zero. This blocking migration stamps them as it moves them, so it is safe regardless; a non-blocking one would be refused."
+            });
+          } else if (unstamped.anyPresent) {
+            const scale = unstamped.total === null ? "an unknown number of" : unstamped.total.toString();
+            const perLane = `${describeUnstamped(unstamped.media)} media, ${describeUnstamped(unstamped.retrainFrames)} retrain frames`;
+            if (mode === "nonBlocking") throw new Error(`${scale} event-media row(s) still carry no locationId (${perLane}). A non-blocking cutover would silently orphan them. Run the seal first: pipelineAnalytics.relocateMedia({ mode: "seal", toLocationId: "${this.deps.locations.getDefaultLocation("eventMedia")?.id ?? "eventMedia"}" }).`);
             findings.push({
               code: "unstampedEventMediaRows",
               storageClass: "eventMedia",
-              message: `${unstamped.total.toString()} event-media row(s) carry no locationId. This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
+              message: `${scale} event-media row(s) carry no locationId (${perLane}). This blocking migration stamps them as it moves them, but a non-blocking one would be refused until a seal pass drives the count to zero.`
             });
           }
         }
@@ -83153,6 +83328,7 @@ var require_storage_orchestrator_addon = __commonJS({
             const remaining = residue.filter((entry) => entry.storageClass === storageClass);
             if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its default location \u2014 there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
             for (const entry of remaining) {
+              if (this.deps.locations.getLocationById(entry.toLocationId)?.enabled === false) throw new Error(`The "${storageClass}" drain destination "${entry.toLocationId}" is DISABLED \u2014 a disabled location takes no writes, and a drain is the largest write there is. Enable it on the Storage screen, or make an enabled location the "${storageClass}" default first.`);
               moves.push({
                 storageClass,
                 fromLocationId: entry.fromLocationId,
@@ -83404,6 +83580,7 @@ var require_storage_orchestrator_addon = __commonJS({
               filesMoved: status.filesMoved,
               filesTotal: status.filesTotal,
               bytesMoved: status.bytesMoved,
+              ...status.rowsReconciled === void 0 ? {} : { rowsReconciled: status.rowsReconciled },
               startedAt: status.startedAt,
               observedAt: this.deps.now()
             };
@@ -83426,9 +83603,10 @@ var require_storage_orchestrator_addon = __commonJS({
       *
       * The gate is the RE-COUNT, not the seal job's terminal state: a seal that
       * failed some rows still finishes, and "finished" is not "there are none
-      * left". A non-zero count here fails the job while nothing has been paused
+      * left". A remaining row here fails the job while nothing has been paused
       * and nothing has been repointed, which is the cheapest possible place to
-      * discover it.
+      * discover it. So does a re-count that could not be TAKEN: the gate opens on
+      * a measured absence, and only on that.
       *
       * The seal's own mover job id is deliberately NOT durable. It is idempotent
       * and cheap, so a coordinator restart mid-seal simply re-runs the whole
@@ -83438,7 +83616,8 @@ var require_storage_orchestrator_addon = __commonJS({
       async sealEventMedia(job) {
         const move = job.moves.find((candidate) => candidate.storageClass === "eventMedia");
         if (move === void 0) return;
-        if ((await this.deps.participants.analytics.countUnstamped()).total > 0) {
+        const before = await this.deps.participants.analytics.countUnstamped();
+        if (before === null || before.anyPresent) {
           const started = await this.deps.participants.analytics.startDrain({
             toLocationId: move.fromLocationId,
             mode: "seal"
@@ -83447,7 +83626,8 @@ var require_storage_orchestrator_addon = __commonJS({
           if (job.cancelRequested) return;
         }
         const after = await this.deps.participants.analytics.countUnstamped();
-        if (after.total > 0) throw new Error(`event-media seal left ${after.total.toString()} row(s) without a locationId (${after.media.toString()} media, ${after.retrainFrames.toString()} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
+        if (after === null) throw new Error("event-media seal ran, but whether any row still carries no locationId could not be measured afterwards. Unknown is not zero; nothing has been paused or repointed.");
+        if (after.anyPresent) throw new Error(`event-media seal left ${after.total === null ? "an unknown number of" : after.total.toString()} row(s) without a locationId (${describeUnstamped(after.media)} media, ${describeUnstamped(after.retrainFrames)} retrain frames). A non-blocking cutover would silently orphan them; nothing has been paused or repointed.`);
       }
       async waitForSeal(job, moverJobId) {
         const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -83796,6 +83976,34 @@ var require_storage_orchestrator_addon = __commonJS({
           backfilled: backfill.length,
           total: this.locations.size
         } });
+        this.reportDisabledDefaults();
+      }
+      /**
+      * Shout about a persisted row that is BOTH the type default and disabled.
+      *
+      * `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
+      * default) and neither can `setDefaultLocations` — but hydrate writes rows
+      * straight into the map without either, so a hand-edited store, a partial
+      * migration or a row written by another build can. It matters because every
+      * bare-type ref resolves through {@link getDefaultLocation}: on such a row
+      * `storage.write({ location: 'eventMedia' })` and the migration coordinator's
+      * drain destination both point at a disk the operator turned off. That is the
+      * one thing this model must never do silently.
+      *
+      * Reported, never repaired: flipping an operator's flag back on at boot would
+      * be the system overruling the switch instead of obeying it. The coordinator
+      * refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
+      * path is deliberately left working, because narrowing a READ is a worse bug
+      * than the one this line reports.
+      */
+      reportDisabledDefaults() {
+        for (const loc of this.locations.values()) {
+          if (!loc.isDefault || loc.enabled !== false) continue;
+          this.logger.error("storage-orchestrator: the type DEFAULT is disabled \u2014 every bare-type ref for this type resolves to a location the operator turned off. Enable it, or make another location the default.", { meta: {
+            id: loc.id,
+            type: loc.type
+          } });
+        }
       }
       /**
       * Inject the declaration-driven cardinality source. Called once by the
@@ -83867,6 +84075,7 @@ var require_storage_orchestrator_addon = __commonJS({
           loaded: this.locations.size,
           isSystemUpgraded: upgraded
         } });
+        this.reportDisabledDefaults();
       }
       /**
       * Boot backfill (SP1): stamp `nodeId` on every persisted node-local
@@ -85178,7 +85387,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -103239,7 +103448,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -105182,9 +105391,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CWWLTM6W.js
-var require_sleep_CWWLTM6W = __commonJS({
-  "../types/dist/sleep-CWWLTM6W.js"(exports) {
+// ../types/dist/sleep-C3AniWy-.js
+var require_sleep_C3AniWy = __commonJS({
+  "../types/dist/sleep-C3AniWy-.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -107906,6 +108115,7 @@ var require_sleep_CWWLTM6W = __commonJS({
           getEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMedia", "query", input),
           getTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrackMedia", "query", input),
           listTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTrackMedia", "query", input),
+          listEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listEventMedia", "query", input),
           searchObjectEvents: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "searchObjectEvents", "query", input),
           wipeObjectEmbeddings: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "wipeObjectEmbeddings", "mutation", input),
           rebuildObjectEmbeddings: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "rebuildObjectEmbeddings", "mutation", input),
@@ -108850,7 +109060,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CWWLTM6W();
+    var require_sleep = require_sleep_C3AniWy();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -115732,12 +115942,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-8boi90D9.js
-var require_manifest_system_deps_8boi90D9 = __commonJS({
-  "../system/dist/manifest-system-deps-8boi90D9.js"(exports) {
+// ../system/dist/manifest-system-deps-DYv4ZPo2.js
+var require_manifest_system_deps_DYv4ZPo2 = __commonJS({
+  "../system/dist/manifest-system-deps-DYv4ZPo2.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_Ck2jkBZk();
+    require_dist_Keu5TDO7();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -119845,6 +120055,174 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
         createClient: (nodeId) => new UdsLocalTransportClient(localEndpointPath(nodeId))
       };
     }
+    var DEFAULT_RETENTION_SECONDS = 300;
+    var DEFAULT_MAX_TRIPLES = 4e3;
+    var PARENT_ROUTED_PROVIDER_ADDON_ID = "(unresolved: parent-routed)";
+    var CapUsageRegistry = class {
+      retentionSeconds;
+      maxTriples;
+      map = /* @__PURE__ */ new Map();
+      triples = 0;
+      droppedTriples = 0;
+      constructor(opts) {
+        this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? DEFAULT_RETENTION_SECONDS);
+        this.maxTriples = Math.max(1, opts?.maxTriples ?? DEFAULT_MAX_TRIPLES);
+      }
+      /**
+      * Record one observed cap call.
+      *
+      * On the hot path: this runs once per cross-process cap call on hub-main's
+      * event loop, which is the cluster's only queue (D181). Three Map lookups, an
+      * integer increment, and — only when the wall clock has moved on — a bounded
+      * clear. No allocation once a triple exists, and it NEVER throws into the
+      * call it observes.
+      */
+      recordCall(rec) {
+        try {
+          if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
+          if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
+          const window2 = this.windowFor(rec);
+          if (window2 === null) return;
+          const sec = Math.floor(rec.atMs / 1e3);
+          if (window2.lastCallAtMs !== 0) {
+            const lastSec = Math.floor(window2.lastCallAtMs / 1e3);
+            const advanced = Math.min(sec - lastSec, this.retentionSeconds);
+            for (let k = 1; k <= advanced; k++) window2.buckets[(lastSec + k) % this.retentionSeconds] = 0;
+          }
+          const idx = sec % this.retentionSeconds;
+          window2.buckets[idx] = (window2.buckets[idx] ?? 0) + 1;
+          if (rec.atMs > window2.lastCallAtMs) window2.lastCallAtMs = rec.atMs;
+        } catch {
+        }
+      }
+      getGraph(opts) {
+        const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
+        const minMs = opts.nowMs - windowSeconds * 1e3;
+        const nowSec = Math.floor(opts.nowMs / 1e3);
+        const out = [];
+        for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window2] of byCap) {
+          if (window2.lastCallAtMs < minMs) continue;
+          const count = this.sumWindow(window2, nowSec, windowSeconds);
+          if (count === 0) continue;
+          const callsPerMin = count / windowSeconds * 60;
+          out.push({
+            callerAddonId: caller,
+            providerAddonId: provider,
+            capName,
+            callsPerMin,
+            lastCallAtMs: window2.lastCallAtMs
+          });
+        }
+        return out;
+      }
+      /** See {@link CapUsageStats}. Cheap — three counters, no scan. */
+      getStats() {
+        return {
+          triples: this.triples,
+          maxTriples: this.maxTriples,
+          droppedTriples: this.droppedTriples
+        };
+      }
+      /** Test / diagnostic helper — drops all recorded calls. */
+      clear() {
+        this.map.clear();
+        this.triples = 0;
+        this.droppedTriples = 0;
+      }
+      /**
+      * Sum the buckets covering `(nowSec - windowSeconds, nowSec]`.
+      *
+      * The scan starts at `lastSec`, never at `nowSec`. `recordCall` clears the
+      * buckets the ring has advanced OVER, which by definition stops at the last
+      * write: the buckets for the seconds since then still hold whatever the
+      * previous pass left in them, and reading `nowSec` down would count it. A
+      * triple that went quiet for a couple of minutes and then made one call would
+      * report the burst it made five minutes earlier.
+      *
+      * No lower bound is needed beyond the window itself: every bucket at or below
+      * `lastSec - retention` was cleared by the advance that reached `lastSec`, so
+      * it reads zero anyway. The loop is bounded by `windowSeconds ≤ retention`.
+      */
+      sumWindow(window2, nowSec, windowSeconds) {
+        const lastSec = Math.floor(window2.lastCallAtMs / 1e3);
+        const from = Math.min(nowSec, lastSec);
+        const floorSec = nowSec - windowSeconds;
+        let count = 0;
+        for (let s = from; s > floorSec; s--) count += window2.buckets[s % this.retentionSeconds] ?? 0;
+        return count;
+      }
+      /**
+      * The ring for this triple, creating it if the ceiling allows. `null` means
+      * the observation is dropped — counted, never silent (see
+      * {@link CapUsageStats.droppedTriples}).
+      */
+      windowFor(rec) {
+        let byProvider = this.map.get(rec.callerAddonId);
+        if (!byProvider) {
+          byProvider = /* @__PURE__ */ new Map();
+          this.map.set(rec.callerAddonId, byProvider);
+        }
+        let byCap = byProvider.get(rec.providerAddonId);
+        if (!byCap) {
+          byCap = /* @__PURE__ */ new Map();
+          byProvider.set(rec.providerAddonId, byCap);
+        }
+        const existing = byCap.get(rec.capName);
+        if (existing) return existing;
+        if (this.triples >= this.maxTriples) {
+          this.reclaimExpired(rec.atMs);
+          if (this.triples >= this.maxTriples) {
+            this.droppedTriples++;
+            return null;
+          }
+          byProvider = this.map.get(rec.callerAddonId);
+          if (!byProvider) {
+            byProvider = /* @__PURE__ */ new Map();
+            this.map.set(rec.callerAddonId, byProvider);
+          }
+          byCap = byProvider.get(rec.providerAddonId);
+          if (!byCap) {
+            byCap = /* @__PURE__ */ new Map();
+            byProvider.set(rec.providerAddonId, byCap);
+          }
+        }
+        const created = {
+          buckets: new Uint32Array(this.retentionSeconds),
+          lastCallAtMs: 0
+        };
+        byCap.set(rec.capName, created);
+        this.triples++;
+        return created;
+      }
+      /**
+      * Drop every triple whose whole ring has aged out — its last call is older
+      * than the retention window, so it can contribute to no query. O(triples),
+      * and only reachable when the ceiling is full, so it is amortised away by the
+      * admissions it enables.
+      */
+      reclaimExpired(nowMs) {
+        const cutoff = nowMs - this.retentionSeconds * 1e3;
+        for (const [caller, byProvider] of this.map) {
+          for (const [provider, byCap] of byProvider) {
+            for (const [capName, window2] of byCap) {
+              if (window2.lastCallAtMs >= cutoff) continue;
+              byCap.delete(capName);
+              this.triples--;
+            }
+            if (byCap.size === 0) byProvider.delete(provider);
+          }
+          if (byProvider.size === 0) this.map.delete(caller);
+        }
+      }
+    };
+    var singleton = null;
+    function getCapUsageRegistry() {
+      if (!singleton) singleton = new CapUsageRegistry();
+      return singleton;
+    }
+    function __resetCapUsageRegistryForTests() {
+      singleton = null;
+    }
     function createSharedBusState(retainRecent = false) {
       return {
         handlers: /* @__PURE__ */ new Map(),
@@ -120391,6 +120769,8 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
       isAddonPinnedCall;
       /** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
       capTimeoutMs;
+      /** See {@link LocalChildRegistryOptions.capUsageObserver}. */
+      capUsageObserver;
       /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
       egressRoutedCaps = /* @__PURE__ */ new Set();
       /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -120422,6 +120802,7 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
           this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
           this.isAddonPinnedCall = opts.isAddonPinnedCall;
           this.capTimeoutMs = opts.capTimeoutMs;
+          this.capUsageObserver = opts.capUsageObserver;
         } else {
           this.server = serverOrOptions;
           this.onUnownedCall = onUnownedCallArg;
@@ -120588,6 +120969,30 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
         }
         return candidates[0];
       }
+      /**
+      * Publish one cap-usage observation, if a sink is wired.
+      *
+      * Cost discipline — this is on the hot path (D181: hub-main's event loop is
+      * the cluster's only queue): no sink means one undefined check; with a sink
+      * it is one object literal and one `Date.now()`, and the sink itself is O(1).
+      * Wrapped so a broken observer can never fail the call it observes — the
+      * registry swallows too, and BOTH matter: this catch also covers a sink that
+      * is not the registry.
+      */
+      recordCapUsage(callerChildId, providerChildId, capName, methodName) {
+        const sink = this.capUsageObserver;
+        if (sink === void 0 || callerChildId === null) return;
+        try {
+          sink({
+            callerAddonId: callerChildId,
+            providerAddonId: providerChildId ?? "(unresolved: parent-routed)",
+            capName,
+            methodName,
+            atMs: Date.now()
+          });
+        } catch {
+        }
+      }
       /** First child whose cap manifest contains a descriptor matching `predicate`. */
       findChildId(predicate) {
         for (const entry of this.children.values()) if (entry.caps.some(predicate)) return entry.childId;
@@ -120857,7 +121262,9 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
             const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
             const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
             const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
-            if ((!(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+            const target = !(out.native === true) && !aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null;
+            this.recordCapUsage(childId, target, out.capName, out.method);
+            if (target !== null) {
               if (!this.egressRoutedCaps.has(out.capName)) {
                 this.egressRoutedCaps.add(out.capName);
                 this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -121714,77 +122121,6 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
       }
       return links;
     }
-    var CapUsageRegistry = class {
-      retentionSeconds;
-      map = /* @__PURE__ */ new Map();
-      constructor(opts) {
-        this.retentionSeconds = Math.max(1, opts?.retentionSeconds ?? 300);
-      }
-      recordCall(rec) {
-        try {
-          if (rec.callerAddonId === "" || rec.providerAddonId === "" || rec.capName === "") return;
-          if (!Number.isFinite(rec.atMs) || rec.atMs < 0) return;
-          let byProvider = this.map.get(rec.callerAddonId);
-          if (!byProvider) {
-            byProvider = /* @__PURE__ */ new Map();
-            this.map.set(rec.callerAddonId, byProvider);
-          }
-          let byCap = byProvider.get(rec.providerAddonId);
-          if (!byCap) {
-            byCap = /* @__PURE__ */ new Map();
-            byProvider.set(rec.providerAddonId, byCap);
-          }
-          let window2 = byCap.get(rec.capName);
-          if (!window2) {
-            window2 = {
-              buckets: Array.from({ length: this.retentionSeconds }, () => 0),
-              lastCallAtMs: 0
-            };
-            byCap.set(rec.capName, window2);
-          }
-          const bucketIdx = Math.floor(rec.atMs / 1e3) % this.retentionSeconds;
-          window2.buckets[bucketIdx] = (window2.buckets[bucketIdx] ?? 0) + 1;
-          if (rec.atMs > window2.lastCallAtMs) window2.lastCallAtMs = rec.atMs;
-        } catch {
-        }
-      }
-      getGraph(opts) {
-        const windowSeconds = Math.max(1, Math.min(opts.windowSeconds, this.retentionSeconds));
-        const minMs = opts.nowMs - windowSeconds * 1e3;
-        const out = [];
-        for (const [caller, byProvider] of this.map) for (const [provider, byCap] of byProvider) for (const [capName, window2] of byCap) {
-          if (window2.lastCallAtMs < minMs) continue;
-          const nowBucket = Math.floor(opts.nowMs / 1e3);
-          let count = 0;
-          for (let i = 0; i < windowSeconds; i++) {
-            const b = (nowBucket - i + this.retentionSeconds * 1e6) % this.retentionSeconds;
-            count += window2.buckets[b] ?? 0;
-          }
-          if (count === 0) continue;
-          const callsPerMin = count / windowSeconds * 60;
-          out.push({
-            callerAddonId: caller,
-            providerAddonId: provider,
-            capName,
-            callsPerMin,
-            lastCallAtMs: window2.lastCallAtMs
-          });
-        }
-        return out;
-      }
-      /** Test / diagnostic helper — drops all recorded calls. */
-      clear() {
-        this.map.clear();
-      }
-    };
-    var singleton = null;
-    function getCapUsageRegistry() {
-      if (!singleton) singleton = new CapUsageRegistry();
-      return singleton;
-    }
-    function __resetCapUsageRegistryForTests() {
-      singleton = null;
-    }
     function safeExistsSync(path) {
       try {
         return node_fs.existsSync(path);
@@ -123220,6 +123556,12 @@ var require_manifest_system_deps_8boi90D9 = __commonJS({
         return NATIVE_PROVIDER_SERVICE_INFIX;
       }
     });
+    Object.defineProperty(exports, "PARENT_ROUTED_PROVIDER_ADDON_ID", {
+      enumerable: true,
+      get: function() {
+        return PARENT_ROUTED_PROVIDER_ADDON_ID;
+      }
+    });
     Object.defineProperty(exports, "RSS_BUDGET_REANNOUNCE_MIN_MS", {
       enumerable: true,
       get: function() {
@@ -127634,7 +127976,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_dist10 = require_dist_Keu5TDO7();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -127660,7 +128002,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_8boi90D9();
+    var require_manifest_system_deps = require_manifest_system_deps_DYv4ZPo2();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -207872,6 +208214,19 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       * per-task abort timeout. On success the resolved `stagedPath` is returned; on
       * failure the task is marked `failed` and `null` is returned (so the apply
       * phase skips it). Other tasks are unaffected.
+      *
+      * **`toVersion` is REWRITTEN here, to the version that was actually
+      * fetched.** A task's `toVersion` starts as the REQUEST, and the request is
+      * routinely a dist-tag: `addons.updatePackage` with no version resolves to
+      * the literal `'latest'`. The staging area already resolves it — it reads
+      * the version out of the unpacked tarball and returns `resolvedVersion` —
+      * and dropping that answer sent the string `'latest'` onward as if it were a
+      * version. It became the manifest's recorded version, the version the Addons
+      * page displayed, and the `toVersion` on the `addon.updated` event, which an
+      * operator read on his phone as "@camstack/addon-terminal 0.0.0 → latest"
+      * (2026-08-30). Everything downstream of the apply reads a version; none of
+      * it can resolve a tag, and none of it could tell that it had been handed
+      * one.
       */
       async fetchAddonTask(job, task) {
         try {
@@ -207881,20 +208236,28 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           });
           const ac = new AbortController();
           const timer = setTimeout(() => ac.abort(), this.deps.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS);
-          let stagedPath;
+          let staged;
           try {
-            stagedPath = (await this.deps.staging.fetchAndStage({
+            staged = await this.deps.staging.fetchAndStage({
               jobId: job.jobId,
               name: task.packageName,
               version: task.toVersion,
               signal: ac.signal
-            })).stagedPath;
+            });
           } finally {
             clearTimeout(timer);
           }
-          this.advance(job.jobId, task, "staged", { stagedPath });
+          const stagedPath = staged.stagedPath;
+          const resolved = {
+            ...task,
+            toVersion: staged.resolvedVersion
+          };
+          this.advance(job.jobId, task, "staged", {
+            stagedPath,
+            toVersion: resolved.toVersion
+          });
           return {
-            task,
+            task: resolved,
             stagedPath
           };
         } catch (err) {
@@ -208146,6 +208509,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.NativeMetricsProvider = require_builtins_native_metrics_native_metrics_addon.NativeMetricsProvider;
     exports.NetworkQualityTracker = NetworkQualityTracker;
     exports.NotificationService = NotificationService;
+    exports.PARENT_ROUTED_PROVIDER_ADDON_ID = require_manifest_system_deps.PARENT_ROUTED_PROVIDER_ADDON_ID;
     Object.defineProperty(exports, "PYTHON_VERSION", {
       enumerable: true,
       get: function() {
@@ -208462,7 +208826,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CWWLTM6W();
+    var require_sleep = require_sleep_C3AniWy();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -209794,6 +210158,21 @@ var require_dist4 = __commonJS({
       bytesMoved: zod.z.number().int(),
       /** Total files discovered up front; null while (or when) unknown. */
       filesTotal: zod.z.number().int().nullable(),
+      /**
+      * Rows this run CORRECTED while moving them — a durable mutation the move
+      * made that nobody asked for, so it is reported where the operator reads the
+      * job rather than only in a log line.
+      *
+      * A footage segment records its byte count in its own NAME, and the durable
+      * hour row derives its aggregates from those names. A file that does not
+      * match its name therefore makes the ledger's sums — and with them quota and
+      * pressure eviction — wrong by the difference, and only a rename can fix it.
+      * On 2026-08-30 one such row also stalled a 110 749-file drain permanently.
+      *
+      * Absent on lanes where the question has no meaning: a media blob's size is
+      * in its row, not in its name, so `MediaRelocateEngine` never reconciles one.
+      */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       startedAt: zod.z.number(),
       finishedAt: zod.z.number().nullable(),
       error: zod.z.string().nullable()
@@ -209836,11 +210215,18 @@ var require_dist4 = __commonJS({
       /** Omitted = `move`, the pre-existing behaviour. */
       mode: MediaRelocateModeSchema.optional()
     });
-    var UnstampedEventMediaCountSchema = zod.z.object({
-      media: zod.z.number().int().nonnegative(),
-      retrainFrames: zod.z.number().int().nonnegative(),
-      total: zod.z.number().int().nonnegative()
+    var UnstampedRowsSchema = zod.z.object({
+      present: zod.z.boolean(),
+      rows: zod.z.number().int().nonnegative().nullable()
     });
+    var UnstampedEventMediaCountSchema = zod.z.object({
+      media: UnstampedRowsSchema,
+      retrainFrames: UnstampedRowsSchema,
+      /** True when EITHER collection holds one. The refusal reads this. */
+      anyPresent: zod.z.boolean(),
+      /** Sum across both, or `null` when either lane could not be counted. */
+      total: zod.z.number().int().nonnegative().nullable()
+    }).nullable();
     var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
     var StorageMigrationClassSchema = zod.z.enum([
       "recordings",
@@ -209887,6 +210273,10 @@ var require_dist4 = __commonJS({
       /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
       filesTotal: zod.z.number().int().nonnegative().nullable(),
       bytesMoved: zod.z.number().int().nonnegative(),
+      /** Rows the mover corrected while moving them — see `RelocateJob`. Absent on
+      *  a lane that cannot reconcile. A migration that silently rewrote durable
+      *  rows would be the same failure as one that silently skipped them. */
+      rowsReconciled: zod.z.number().int().nonnegative().optional(),
       /** The MOVER's start, not the migration's: a drain restarted after an addon
       *  crash gets a new mover, and a rate computed from the migration's start
       *  would silently average in the time nothing was running. */
@@ -216211,6 +216601,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * calls are sync. Bindings change rarely (only on wrapper toggle or
         * device add/remove) — clients invalidate via the
         * `capability.binding-changed` event.
+        *
+        * "A single round-trip" describes the CLIENT's side and used not to
+        * describe the server's: until 2026-08-30 the resolver read the persisted
+        * wrapper activations once per device, so answering this cost one
+        * settings-door RPC per device — 1 020 on the live 1 019-device hub, and
+        * it did not return in 240 s against `SystemMirror.init`'s 15 s budget.
+        * The server side is now two reads for the whole fleet. Anything PERIODIC
+        * still belongs on `getBindings` / `getBindingsBatch` (D12); this remains
+        * a warm seed.
         */
         getAllBindings: require_sleep.method(zod.z.object({}), zod.z.array(DeviceBindingsForDeviceSchema)),
         /**
@@ -216609,6 +217008,80 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         getInfo: require_sleep.method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
       }
     };
+    var FailureReasonCountSchema = zod.z.object({
+      /**
+      * Why the attempt did not land, in the contributor's own vocabulary —
+      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
+      * strings that already appear in this repo's logs and, where one exists, the
+      * same string the per-track `previewMissReason` records (D276): a second
+      * vocabulary for the same loss would make the row and the counter
+      * un-joinable.
+      */
+      reason: zod.z.string(),
+      count: zod.z.number().int().nonnegative()
+    });
+    var FailureContributionSchema = zod.z.object({
+      /**
+      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
+      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
+      * `unit` free: the families are owned by different addons and a shared enum
+      * is a central list that rots invisibly.
+      */
+      family: zod.z.string(),
+      /**
+      * The NUMERIC device id — the same value every log line carries as
+      * `tags.deviceId`. Never nullable and never absent: a contributor that
+      * cannot name the camera must not emit the entry, because a fleet total
+      * cannot answer the only question anybody asks of this surface.
+      */
+      deviceId: zod.z.number().int().positive(),
+      /**
+      * A second dimension inside the family: the model / step id for an inference
+      * timeout, so "which camera AND which model" is one read. Absent when the
+      * family has a single variant.
+      */
+      variant: zod.z.string().optional(),
+      /**
+      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
+      * differencing two reads must drop the interval when it changes, because the
+      * counter restarted from zero in a respawned runner. Same discipline as
+      * `LoadContribution.startedAtMs`.
+      */
+      sinceMs: zod.z.number(),
+      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
+      atMs: zod.z.number(),
+      /**
+      * THE DENOMINATOR — every attempt on this path for this camera in the
+      * window. A failure count published without it is the mistake this schema
+      * exists to make impossible.
+      */
+      attempts: zod.z.number().int().nonnegative(),
+      /** Attempts that landed. `attempts - succeeded` is the loss. */
+      succeeded: zod.z.number().int().nonnegative(),
+      /** The loss, partitioned. Sums to `attempts - succeeded`. */
+      reasons: zod.z.array(FailureReasonCountSchema).readonly()
+    });
+    var failureContributionCapability = {
+      name: "failure-contribution",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /**
+        * This addon's per-camera failure counters, read live from bounded in-RAM
+        * state it already keeps. Inert: no persistence, no sampling, no timer.
+        *
+        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
+        * consumer that wants a rate differences two reads. A draining read would
+        * make two operators with the page open each destroy half of the other's
+        * numbers, and `load-contribution` already settled the same question the
+        * same way for `cpuSeconds`.
+        */
+        list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
     var DirEntrySchema = zod.z.object({
       name: zod.z.string(),
       path: zod.z.string()
@@ -217153,145 +217626,6 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         })
       }
     };
-    var LogChannelApplyResultSchema = zod.z.object({
-      /** How many declared channels are armed in this process after the call. */
-      armed: zod.z.number().int().min(0),
-      /**
-      * Names the document armed that this process does not declare. Reported
-      * rather than swallowed: a name here is either a typo or an addon that has
-      * not booted, and both deserve a line instead of silence.
-      */
-      unknown: zod.z.array(zod.z.string()).readonly()
-    });
-    var logChannelsCapability = {
-      name: "log-channels",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /** The channels this addon declares. Inert: no value, no state. */
-        list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
-        /**
-        * Refresh this process's mirror from the document's FULL set of armed
-        * windows.
-        *
-        * Full and not incremental on purpose: the document is the authority, so a
-        * channel it does not name is disarmed here. An incremental apply would
-        * let a disarm get lost in transit and leave a channel running that
-        * nobody can see is running.
-        */
-        apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
-    var LogLevelSchema = zod.z.enum([
-      "debug",
-      "info",
-      "warn",
-      "error"
-    ]);
-    var LogEntrySchema = zod.z.object({
-      timestamp: zod.z.date(),
-      level: LogLevelSchema,
-      scope: zod.z.array(zod.z.string()),
-      message: zod.z.string(),
-      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-    });
-    var logDestinationCapability = {
-      name: "log-destination",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-        query: require_sleep.method(zod.z.object({
-          scope: zod.z.array(zod.z.string()).optional(),
-          level: LogLevelSchema.optional(),
-          since: zod.z.date().optional(),
-          until: zod.z.date().optional(),
-          limit: zod.z.number().optional(),
-          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-        }), zod.z.array(LogEntrySchema).readonly())
-      },
-      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-      mount: { kind: "skip" }
-    };
-    var FailureReasonCountSchema = zod.z.object({
-      /**
-      * Why the attempt did not land, in the contributor's own vocabulary —
-      * `worker-lease-gone`, `queue-overflow`, `timeout`, `empty-read`. The same
-      * strings that already appear in this repo's logs and, where one exists, the
-      * same string the per-track `previewMissReason` records (D276): a second
-      * vocabulary for the same loss would make the row and the counter
-      * un-joinable.
-      */
-      reason: zod.z.string(),
-      count: zod.z.number().int().nonnegative()
-    });
-    var FailureContributionSchema = zod.z.object({
-      /**
-      * The failing path — `enrichment-crop`, `inference`, `plate-ocr`,
-      * `person-over-vehicle`. Free text, for the reason `load-contribution` keeps
-      * `unit` free: the families are owned by different addons and a shared enum
-      * is a central list that rots invisibly.
-      */
-      family: zod.z.string(),
-      /**
-      * The NUMERIC device id — the same value every log line carries as
-      * `tags.deviceId`. Never nullable and never absent: a contributor that
-      * cannot name the camera must not emit the entry, because a fleet total
-      * cannot answer the only question anybody asks of this surface.
-      */
-      deviceId: zod.z.number().int().positive(),
-      /**
-      * A second dimension inside the family: the model / step id for an inference
-      * timeout, so "which camera AND which model" is one read. Absent when the
-      * family has a single variant.
-      */
-      variant: zod.z.string().optional(),
-      /**
-      * Epoch ms this counter started — the INCARNATION MARKER. A consumer
-      * differencing two reads must drop the interval when it changes, because the
-      * counter restarted from zero in a respawned runner. Same discipline as
-      * `LoadContribution.startedAtMs`.
-      */
-      sinceMs: zod.z.number(),
-      /** Epoch ms it was read. `atMs - sinceMs` is the interval this covers. */
-      atMs: zod.z.number(),
-      /**
-      * THE DENOMINATOR — every attempt on this path for this camera in the
-      * window. A failure count published without it is the mistake this schema
-      * exists to make impossible.
-      */
-      attempts: zod.z.number().int().nonnegative(),
-      /** Attempts that landed. `attempts - succeeded` is the loss. */
-      succeeded: zod.z.number().int().nonnegative(),
-      /** The loss, partitioned. Sums to `attempts - succeeded`. */
-      reasons: zod.z.array(FailureReasonCountSchema).readonly()
-    });
-    var failureContributionCapability = {
-      name: "failure-contribution",
-      scope: "system",
-      mode: "collection",
-      internal: true,
-      methods: {
-        /**
-        * This addon's per-camera failure counters, read live from bounded in-RAM
-        * state it already keeps. Inert: no persistence, no sampling, no timer.
-        *
-        * READING NEVER RESETS. The counters are CUMULATIVE since `sinceMs`, and a
-        * consumer that wants a rate differences two reads. A draining read would
-        * make two operators with the page open each destroy half of the other's
-        * numbers, and `load-contribution` already settled the same question the
-        * same way for `cpuSeconds`.
-        */
-        list: require_sleep.method(zod.z.void(), zod.z.array(FailureContributionSchema).readonly())
-      },
-      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
-      mount: { kind: "skip" }
-    };
     var LOAD_CONTRIBUTION_ROLES = [
       "decode",
       "transcode",
@@ -217371,6 +217705,71 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       /** In-process only — enumerated through `addons.listCapabilityProviders`. */
       mount: { kind: "skip" }
     };
+    var LogChannelApplyResultSchema = zod.z.object({
+      /** How many declared channels are armed in this process after the call. */
+      armed: zod.z.number().int().min(0),
+      /**
+      * Names the document armed that this process does not declare. Reported
+      * rather than swallowed: a name here is either a typo or an addon that has
+      * not booted, and both deserve a line instead of silence.
+      */
+      unknown: zod.z.array(zod.z.string()).readonly()
+    });
+    var logChannelsCapability = {
+      name: "log-channels",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        /** The channels this addon declares. Inert: no value, no state. */
+        list: require_sleep.method(zod.z.void(), zod.z.array(LogChannelDescriptorSchema).readonly()),
+        /**
+        * Refresh this process's mirror from the document's FULL set of armed
+        * windows.
+        *
+        * Full and not incremental on purpose: the document is the authority, so a
+        * channel it does not name is disarmed here. An incremental apply would
+        * let a disarm get lost in transit and leave a channel running that
+        * nobody can see is running.
+        */
+        apply: require_sleep.method(zod.z.object({ windows: zod.z.array(LogChannelWindowSchema).readonly() }), LogChannelApplyResultSchema, { kind: "mutation" })
+      },
+      /** In-process only — enumerated through `addons.listCapabilityProviders`. */
+      mount: { kind: "skip" }
+    };
+    var LogLevelSchema = zod.z.enum([
+      "debug",
+      "info",
+      "warn",
+      "error"
+    ]);
+    var LogEntrySchema = zod.z.object({
+      timestamp: zod.z.date(),
+      level: LogLevelSchema,
+      scope: zod.z.array(zod.z.string()),
+      message: zod.z.string(),
+      meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+      tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+    });
+    var logDestinationCapability = {
+      name: "log-destination",
+      scope: "system",
+      mode: "collection",
+      internal: true,
+      methods: {
+        write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+        query: require_sleep.method(zod.z.object({
+          scope: zod.z.array(zod.z.string()).optional(),
+          level: LogLevelSchema.optional(),
+          since: zod.z.date().optional(),
+          until: zod.z.date().optional(),
+          limit: zod.z.number().optional(),
+          tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+        }), zod.z.array(LogEntrySchema).readonly())
+      },
+      /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+      mount: { kind: "skip" }
+    };
     var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
     var RedirectLoginMethodSchema = zod.z.object({
       kind: zod.z.literal("redirect"),
@@ -222258,13 +222657,18 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "keyFrameSmall",
       "thumbnailSmall"
     ]);
-    var MediaFileSchema = zod.z.object({
+    var MediaFileRefSchema = zod.z.object({
       key: zod.z.string(),
       kind: MediaFileKindEnum,
-      base64: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
+    var MediaFileSchema = MediaFileRefSchema.extend({
+      /** `/addon/<addonId>/event-media/<encoded stored key>`. Always present. */
+      url: zod.z.string(),
+      /** @deprecated Transitional — see the schema docblock. Use {@link url}. */
+      base64: zod.z.string()
+    });
     var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
     var RetrainMacroClassSchema = zod.z.enum([
       "person",
@@ -222996,6 +223400,17 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * happens to stamp it. This count is what the migration planner's
         * non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
         * it to zero.
+        *
+        * TWO indexed statements per collection, not a walk. It used to page the
+        * whole collection at 200 rows per RPC ordered by an unindexed column, so
+        * on the live hub — 1 254 576 rows — it hit the 60 s RPC deadline every
+        * time it was called, and the migration it gates could never start. The
+        * cheap question (`present`: is there at least one) is asked first and
+        * separately from the expensive one (`rows`), because only the first has
+        * to be answerable for the gate to do its job.
+        *
+        * **`null` is "not measurable", never zero** — at either level. An
+        * unreadable collection must not read as a sealed one.
         */
         countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
         /**
@@ -223319,6 +223734,26 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           deviceId: zod.z.number()
         }), zod.z.array(MediaFileInfoSchema).readonly()),
         /**
+        * What media an EVENT has, without any of it — the twin `getEventMedia`
+        * never had.
+        *
+        * `listTrackMedia` above got this treatment because a track's media is
+        * 5-8 MB. An event's is worse per row, not better: an old-style event owns
+        * a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+        * modal — the one surface that legitimately shows the big kinds — unions
+        * both listings to build its filmstrip. It then renders every tile from
+        * the `event-media` plane by key and throws the bytes away. Measured on
+        * the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+        * ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+        *
+        * Same `deviceId` authorization subject as `getEventMedia`, and the same
+        * rows — this is a projection of that method, never a different question.
+        */
+        listEventMedia: require_sleep.method(zod.z.object({
+          eventId: zod.z.string(),
+          deviceId: zod.z.number()
+        }), zod.z.array(MediaFileInfoSchema).readonly()),
+        /**
         * Search object events by text query using CLIP cosine similarity.
         * Encodes `text` via the `embedding-encoder` cap, queries the
         * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
@@ -228781,7 +229216,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var MediaFileLiteSchema$1 = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -231676,7 +232111,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     var MediaFileLiteSchema = zod.z.object({
       key: zod.z.string(),
       kind: zod.z.string(),
-      base64: zod.z.string(),
+      url: zod.z.string(),
       sizeBytes: zod.z.number(),
       timestamp: zod.z.number()
     });
@@ -241924,6 +242359,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "pipelineAnalytics.listEventMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.listGroups": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -245805,6 +246246,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "array",
         optional: false
       }],
+      "pipelineAnalytics.listEventMedia": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "pipelineAnalytics.listGroups": [{
         name: "deviceIds",
         form: "array",
@@ -250845,6 +251291,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.MaskShapeKindSchema = MaskShapeKindSchema;
     exports.MaskShapeSchema = MaskShapeSchema;
     exports.MediaFileInfoSchema = MediaFileInfoSchema;
+    exports.MediaFileRefSchema = MediaFileRefSchema;
     exports.MediaFileSchema = MediaFileSchema;
     exports.MediaPlayerRepeatSchema = MediaPlayerRepeatSchema;
     exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
@@ -251323,6 +251770,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
     exports.UnitConversionError = UnitConversionError;
     exports.UnstampedEventMediaCountSchema = UnstampedEventMediaCountSchema;
+    exports.UnstampedRowsSchema = UnstampedRowsSchema;
     exports.UpdateIntegrationInputSchema = UpdateIntegrationInputSchema;
     exports.UpdateStatusSchema = UpdateStatusSchema;
     exports.UpdateUserInputSchema = UpdateUserInputSchema;
@@ -385633,6 +386081,14 @@ var require_main2 = __commonJS({
           // cap). A pin to ANOTHER node still bypasses the sibling → onUnownedCall.
           ownNodeId: agentNodeId,
           onUnownedCall
+          // NO `capUsageObserver` here, deliberately. `getCapUsageRegistry()` is a
+          // per-process singleton and the reader (`nodes.getCapUsageGraph`) runs on
+          // hub-main; recording in the agent would produce a map nobody ever reads,
+          // which is exactly the shape that made this graph return `[]` for
+          // months. An agent's addon traffic is a KNOWN blind spot of the graph —
+          // see `LocalChildRegistryOptions.capUsageObserver`. Closing it needs the
+          // caller identity to survive `$hub-cap-fwd`'s envelope, which today it
+          // does not.
         });
         await agentUdsRegistry.start();
         agentUdsRegistry.onChildRegistered((child) => {
@@ -402542,7 +402998,7 @@ var require_addon_package_service = __commonJS({
             this.requireInstaller();
             const addonInstaller = this.installer;
             const previousVersion = this.getInstalledPackageVersion(name);
-            const isFirstInstall = !previousVersion;
+            const isFirstInstall = previousVersion === null;
             let result;
             if (isFirstInstall) {
               const r = await addonInstaller.installFromNpm(name, version);
@@ -402568,12 +403024,13 @@ var require_addon_package_service = __commonJS({
           const targetDir = path.join(addonsDir, dirName);
           const packageSpec = version ? `${name}@${version}` : name;
           await installPackageFromNpm(packageSpec, targetDir);
-          updatedVersion = this.getInstalledPackageVersion(name);
+          const installedVersion = this.getInstalledPackageVersion(name);
+          updatedVersion = installedVersion ?? "";
           this.cachedUpdates = null;
           this.logger.info("Core package updated -- restart required", {
-            meta: { name, updatedVersion }
+            meta: { name, updatedVersion: installedVersion }
           });
-          this.sendUpdateNotification(name, updatedVersion);
+          this.sendUpdateNotification(name, installedVersion);
           return { success: true, version: updatedVersion, requiresRestart: true };
         } catch (error) {
           const msg = (0, types_1.errMsg)(error);
@@ -403260,36 +403717,39 @@ var require_addon_package_service = __commonJS({
       // Private: general helpers
       // =========================================================================
       /**
-       * Read the currently installed version of a package.
-       * Checks data/addons/ first, then falls back to Node module resolution.
-       * Returns '0.0.0' if not found.
+       * The version of `packageName` INSTALLED RIGHT NOW, or `null` when the hub
+       * has no readable copy.
+       *
+       * Delegates to the installer, which is the one place that knows the on-disk
+       * layout (`<addonsDir>/@camstack/<pkg>/`, with the pre-scope flat form as a
+       * fallback). This method used to restate that path and got it wrong —
+       * `packageName.replace(/^@camstack\//, '')` looked ONLY in the flat form, so
+       * every scoped install missed. It then fell back to
+       * `require.resolve('<pkg>/package.json')`, which cannot succeed either: an
+       * addon is installed under the data directory, not in the hub's own
+       * node_modules. Both misses landed on the literal `'0.0.0'`, and that string
+       * was published on the `addon.updated` event as the version the operator had
+       * been running ("@camstack/addon-terminal 0.0.0 → latest", 2026-08-30).
+       *
+       * `null`, not `'0.0.0'`: a version nobody installed is indistinguishable
+       * from one that was, and the caller must be forced to decide what to say
+       * about "unknown" rather than inherit a number that looks like an answer.
        */
       getInstalledPackageVersion(packageName) {
         try {
-          const addonsDir = this.resolveAddonsDir();
-          const dirName = packageName.replace(/^@camstack\//, "");
-          const pkgJsonPath = path.join(addonsDir, dirName, "package.json");
-          if (fs.existsSync(pkgJsonPath)) {
-            const pkgJson = readJsonObject(pkgJsonPath);
-            const v = asString(pkgJson?.["version"]);
-            if (v)
-              return v;
-          }
-        } catch (err) {
-          this.logger.debug("Version lookup via fs failed, trying require.resolve", {
-            meta: { packageName, error: (0, types_1.errMsg)(err) }
-          });
-        }
-        try {
-          const pkgJsonPath = __require.resolve(`${packageName}/package.json`);
-          const pkgJson = readJsonObject(pkgJsonPath);
-          return asString(pkgJson?.["version"], "0.0.0");
+          const installed = this.installer?.getInstalledPackage(packageName) ?? null;
+          const version = installed === null ? "" : asString(installed.version);
+          if (version)
+            return version;
         } catch (err) {
-          this.logger.debug("Could not resolve version, returning 0.0.0", {
+          this.logger.debug("Installed-version lookup failed", {
             meta: { packageName, error: (0, types_1.errMsg)(err) }
           });
-          return "0.0.0";
         }
+        this.logger.debug("No readable installed copy \u2014 previous version is unknown", {
+          meta: { packageName }
+        });
+        return null;
       }
       /** Only allow @camstack/* scoped packages */
       isAllowedPackage(name) {
@@ -403341,11 +403801,18 @@ var require_addon_package_service = __commonJS({
           throw new Error("AddonInstaller is not available -- @camstack/system may not be installed");
         }
       }
-      /** Send notification and toast for a successful package update */
+      /**
+       * Send notification and toast for a successful package update.
+       *
+       * `version === null` means the hub could not read back what it just
+       * installed. The sentence then says the package was updated and stops —
+       * never "updated to v0.0.0", which reads as a real version.
+       */
       sendUpdateNotification(name, version) {
+        const sentence = version === null ? `${name} updated` : `${name} updated to v${version}`;
         this.notificationService.notify({
           title: "Package Updated",
-          body: `${name} updated to v${version}`,
+          body: sentence,
           format: "text",
           priority: 3,
           category: "system",
@@ -403356,7 +403823,7 @@ var require_addon_package_service = __commonJS({
         });
         this.toastService.broadcast({
           title: "Package Updated",
-          message: `${name} updated to v${version}`,
+          message: sentence,
           severity: "info",
           duration: 5e3
         });
@@ -410443,8 +410910,30 @@ var require_cap_providers = __commonJS({
           }
           return result;
         },
+        /**
+         * Observed caller → provider → cap edges over the last `windowSeconds`.
+         *
+         * **Read the blind spots before drawing a conclusion.** This reads
+         * hub-main's `CapUsageRegistry`, written by the hub's `LocalChildRegistry`
+         * on every `cap-call-out` a hub-local forked addon sends. It therefore does
+         * NOT contain: hub-main → hub-main in-process calls (one shared `ctx.api`
+         * client, no per-caller identity), a runner's own co-located calls, or any
+         * traffic originating on an agent. An edge missing here means "not seen on
+         * this plane", never "did not happen" — the full list is on
+         * `LocalChildRegistryOptions.capUsageObserver`.
+         */
         getCapUsageGraph: async (input) => {
           const reg = (0, system_1.getCapUsageRegistry)();
+          const stats = reg.getStats();
+          if (stats.droppedTriples > 0) {
+            logger?.warn("cap-usage graph is truncated \u2014 the triple ceiling was reached", {
+              meta: {
+                triples: stats.triples,
+                maxTriples: stats.maxTriples,
+                droppedTriples: stats.droppedTriples
+              }
+            });
+          }
           return reg.getGraph({ windowSeconds: input.windowSeconds, nowMs: Date.now() });
         },
         setProcessLogLevel: async (input) => {
@@ -416873,6 +417362,7 @@ var require_addon_registry_service = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.AddonRegistryService = void 0;
     exports.shouldEvictMissingOnDisk = shouldEvictMissingOnDisk;
+    exports.addonUpdatePayload = addonUpdatePayload;
     exports.shouldEmitProviderRegisteredReady = shouldEmitProviderRegisteredReady;
     var node_crypto_1 = __require("crypto");
     var fs = __importStar(__require("fs"));
@@ -416895,6 +417385,12 @@ var require_addon_registry_service = __commonJS({
     function shouldEvictMissingOnDisk(entry, id, onDiskIds) {
       return entry.source === "installed" && entry.packageName !== "@camstack/system" && !onDiskIds.has(id);
     }
+    function addonUpdatePayload(fromVersion, toVersion) {
+      return {
+        ...fromVersion !== null ? { fromVersion } : {},
+        toVersion
+      };
+    }
     function isSettingsStore(backend) {
       const required = [
         "getSystem",
@@ -417970,14 +418466,17 @@ var require_addon_registry_service = __commonJS({
         this.healthMonitor.forget(packageName);
         this.addonLoader.clearLoadFailures(packageName);
       }
-      /** Emit addon.updated lifecycle event for all addons belonging to a package */
+      /**
+       * Emit `addon.updated` for every addon belonging to a package.
+       *
+       * The payload shape is {@link addonUpdatePayload} — an unknown predecessor
+       * is an ABSENT key, never a placeholder.
+       */
       emitUpdateEvent(packageName, fromVersion, toVersion) {
+        const payload = addonUpdatePayload(fromVersion, toVersion);
         for (const [id, entry] of this.addonEntries) {
           if (entry.packageName === packageName) {
-            this.emitAddonLifecycleEvent("addon.updated", id, {
-              fromVersion,
-              toVersion
-            });
+            this.emitAddonLifecycleEvent("addon.updated", id, payload);
           }
         }
       }
@@ -421469,6 +421968,14 @@ var require_moleculer_service = __commonJS({
             // below, so a method that survives 16 minutes across nodes survives it
             // across a socket too — and one that hangs is cut off on both.
             capTimeoutMs: (capName, method) => this.capabilityService.getRegistry()?.getDefinition(capName)?.methods?.[method]?.timeoutMs,
+            // Feed the cap-usage graph from the one place that sees a forked
+            // addon's outbound `ctx.api` traffic AND runs in the process that reads
+            // it back (`nodes.getCapUsageGraph` → `cap-providers.ts`). The
+            // runner-side observer in `addon-context-factory.ts` writes to the
+            // RUNNER's own module singleton, which hub-main never sees — which is
+            // why the graph answered `[]` on a hub running 64 addons. Blind spots
+            // that remain are listed on `LocalChildRegistryOptions.capUsageObserver`.
+            capUsageObserver: (obs) => (0, system_1.getCapUsageRegistry)().recordCall(obs),
             logger: {
               info: (msg, meta) => logger.info(msg, meta !== null && meta !== void 0 ? { meta } : void 0)
             },