camstack 1.2.83 → 1.2.85

package/dist/{launcher-FITGLHP4.js → launcher-6T2UFXIG.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-C7qWwrK1.js
-var require_dist_C7qWwrK1 = __commonJS({
-  "../system/dist/dist-C7qWwrK1.js"(exports) {
+// ../system/dist/dist-whe0b4_3.js
+var require_dist_whe0b4_3 = __commonJS({
+  "../system/dist/dist-whe0b4_3.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -28488,6 +28488,68 @@ var require_dist_C7qWwrK1 = __commonJS({
       fileCount: zod.z.number(),
       present: zod.z.boolean()
     });
+    var BackupRunStateSchema = zod.z.enum([
+      "queued",
+      "running",
+      "succeeded",
+      "failed",
+      "cancelled"
+    ]);
+    var BackupRunPhaseSchema = zod.z.enum([
+      "queued",
+      "building",
+      "uploading",
+      "done"
+    ]);
+    var BackupRunSchema = zod.z.object({
+      /** Stable run id — the handle `backup.cancel` takes. */
+      id: zod.z.string(),
+      state: BackupRunStateSchema,
+      phase: BackupRunPhaseSchema,
+      /**
+      * Resolved destination location ids. Empty while queued (targets are
+      * resolved when the run starts, against the then-current policies).
+      */
+      destinationIds: zod.z.array(zod.z.string()).readonly(),
+      label: zod.z.string().optional(),
+      /** ms-epoch when the run was submitted (trigger call / schedule fire). */
+      requestedAt: zod.z.number(),
+      /** ms-epoch when the run left the queue and started building. */
+      startedAt: zod.z.number().optional(),
+      /** ms-epoch when the run reached a terminal state. */
+      finishedAt: zod.z.number().optional(),
+      /** Compressed bytes of the staging archive written so far. */
+      stagedBytes: zod.z.number(),
+      /** Final staged archive size, once the build phase completes. */
+      archiveSizeBytes: zod.z.number().optional(),
+      /** Bytes pushed to the destination currently uploading. */
+      uploadedBytes: zod.z.number(),
+      /** Destinations where the archive fully landed (uploaded + indexed). */
+      completedDestinationIds: zod.z.array(zod.z.string()).readonly(),
+      /** Destinations that failed during the fan-out. */
+      failedDestinationIds: zod.z.array(zod.z.string()).readonly(),
+      /** Failure message when `state === 'failed'`. */
+      error: zod.z.string().optional(),
+      /**
+      * 1-based place in the execution queue — 1 = runs next. Present only
+      * while `state === 'queued'`. Stamped by the orchestrator from the
+      * queue's OWN pending order, never derived from timestamps, so the
+      * UI cannot show an order the executor will not honour.
+      */
+      queuePosition: zod.z.number().int().min(1).optional()
+    });
+    var BackupTriggerResultSchema = zod.z.object({
+      /** The run this trigger mapped to — poll it via `listRuns`, stop it via `cancel`. */
+      runId: zod.z.string(),
+      /** True when the run waited behind an in-flight run instead of starting immediately. */
+      queued: zod.z.boolean(),
+      /** True when this trigger was coalesced onto an identical already-queued run. */
+      joined: zod.z.boolean(),
+      /** True when the run was cancelled before completing every destination. */
+      cancelled: zod.z.boolean(),
+      /** One entry per destination the archive landed at (partial on cancel). */
+      entries: zod.z.array(BackupEntrySchema).readonly()
+    });
     var BackupScheduleSchema = zod.z.object({
       /** Stable id. Generated by the orchestrator on first upsert if absent. */
       id: zod.z.string(),
@@ -28524,6 +28586,11 @@ var require_dist_C7qWwrK1 = __commonJS({
         * Trigger a backup. Without `destinations` the orchestrator fans
         * out to every destination flagged as enabled in the routing
         * config; with it, only the listed addons receive the archive.
+        *
+        * At most ONE backup run executes at a time — the source tree and
+        * the staging disk are shared by every run, so a second trigger
+        * while one is in flight is enqueued (or joined onto an identical
+        * queued run) and the result says so. See D342.
         */
         trigger: method(zod.z.object({
           /** Subset of registered `backup-destination` addon ids to write to. */
@@ -28537,7 +28604,30 @@ var require_dist_C7qWwrK1 = __commonJS({
           * retention (manual runs).
           */
           retentionCount: zod.z.number().int().min(1).max(1e3).optional()
-        }).optional(), zod.z.array(BackupEntrySchema).readonly(), {
+        }).optional(), BackupTriggerResultSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /**
+        * Every run the orchestrator knows about, in EXECUTION order: the
+        * running run first, then queued runs in the exact order they will
+        * execute (each with `queuePosition`, 1 = next), then the bounded
+        * finished history newest-first. Only one run executes at a time
+        * (D342) — the queued section IS the line. Each run carries live
+        * phase + byte counters so a runaway build is visible in seconds,
+        * not via `du`.
+        */
+        listRuns: method(zod.z.void(), zod.z.array(BackupRunSchema).readonly(), { auth: "admin" }),
+        /**
+        * Stop a backup run. Mirrors `storage-migration.cancel` semantics:
+        * id in, `{ cancelled }` out — `false` when the run is unknown or
+        * already terminal. A QUEUED run is removed before it ever starts;
+        * the RUNNING run has its tar/upload stream actually aborted, the
+        * half-written staging archive is deleted, and the in-flight
+        * destination upload is aborted server-side (partial discarded).
+        * Destinations that already completed keep their archive.
+        */
+        cancel: method(zod.z.object({ runId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
           auth: "admin"
         }),
@@ -29277,6 +29367,38 @@ var require_dist_C7qWwrK1 = __commonJS({
           auth: "admin"
         }),
         /**
+        * The HARDWARE behind a device number was replaced
+        * (`deviceManager.migrateDevice`). Forget every piece of broker state that
+        * described the old box, so the next catalog pull derives everything from
+        * the camera that is actually there:
+        *
+        *  - every `derived:*` stream definition — a derived is authored against a
+        *    specific profile layout, and against the wrong hardware its feeder
+        *    respawns forever (observed at attempt 2732 on the live hub,
+        *    2026-09-01);
+        *  - the profile-slot assignment entry, PURGED (not unassigned — unassign
+        *    marks the slot manual, which would pin the stale choice instead of
+        *    letting `computeInitialAssignment` re-derive it);
+        *  - the probe snapshots (`<deviceId>/…` — probed codec/resolution of the
+        *    old hardware);
+        *  - the persisted RTSP token rows for the device's brokers (keyed
+        *    `<deviceId>/<camStreamId>`; the stream ids change with the hardware,
+        *    so the rows are dead URLs).
+        *
+        * An RPC, deliberately — an event is telemetry and may be dropped (D8),
+        * and a dropped forget leaves a feeder respawning against a stream that
+        * does not exist.
+        */
+        forgetDeviceHardware: method(zod.z.object({ deviceId: zod.z.number().int().nonnegative() }), zod.z.object({
+          derivedStreamsDeleted: zod.z.array(zod.z.string()).readonly(),
+          assignmentsPurged: zod.z.boolean(),
+          probeSnapshotsDropped: zod.z.number().int().nonnegative(),
+          rtspTokenRowsDeleted: zod.z.number().int().nonnegative()
+        }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /**
         * Render a short GIF or MP4 from the broker's PRE-BUFFER around an instant.
         *
         * The pre-buffer is the only source that already holds the seconds BEFORE
@@ -30992,6 +31114,35 @@ var require_dist_C7qWwrK1 = __commonJS({
           name: zod.z.string(),
           type: zod.z.string()
         }))),
+        /**
+        * Tear down and reconstruct ONE device in place from its persisted rows —
+        * touching no other device this provider owns.
+        *
+        * The primitive `deviceManager.migrateDevice` uses to flush the two
+        * migrated numbers: after `swapIds` the runner's live instance still
+        * carries the PRE-swap numeric id (baked into the object, its native-cap
+        * registrations and its log tags), and a live object cannot be renumbered.
+        * Before this method the only flush was restarting the whole owning addon
+        * — which took every camera the provider owns down with it (28 devices
+        * for one migrated camera, measured 2026-09-04, and the morning of the
+        * same day ~27 devices' native caps did not come back on their own).
+        *
+        * Keyed by `stableId`, deliberately: the numeric id is exactly the thing
+        * that changes. The reply carries the id the device answers on NOW.
+        * Implemented once in `BaseDeviceProvider` — decommission the live
+        * instance (if any), then re-create from the persisted row: the same
+        * teardown/rehydrate pair every graceful shutdown + boot already uses.
+        * An RPC, never an event: a dropped event would leave the runner writing
+        * against the wrong camera (D8).
+        *
+        * Construction can dial hardware, and the migrated source is
+        * characteristically dead — the timeout covers a full activate window
+        * rather than the 60 s default.
+        */
+        reloadDevice: method(zod.z.object({ stableId: zod.z.string() }), zod.z.object({ deviceId: zod.z.number() }), {
+          kind: "mutation",
+          timeoutMs: 3 * 6e4
+        }),
         supportsDiscovery: method(zod.z.object({}), zod.z.boolean()),
         /**
         * Run a network scan. `params` carries optional provider-specific scan
@@ -31312,13 +31463,21 @@ var require_dist_C7qWwrK1 = __commonJS({
         * `sourceStillLive` names what stayed live; empty is the only value that
         * means the old hardware is quiet. The migration proceeds either way —
         * refusing would refuse the case this exists for.
+        *
+        * **Safe to retry.** A duplicate call while a migration involving either
+        * device is in flight is REFUSED, never queued; a repeat of a swap that
+        * already completed (matched against the `addonId`/`stableId` fingerprint
+        * the swap left on the rows, within 15 min) is a no-op returning the
+        * original report. A blind re-run can no longer silently undo the
+        * migration it retried.
         */
         migrateDevice: method(zod.z.object({
           sourceId: zod.z.number(),
           targetId: zod.z.number()
         }), MigrateDeviceResultSchema, {
           kind: "mutation",
-          auth: "admin"
+          auth: "admin",
+          timeoutMs: 12 * 6e4
         }),
         /** Register a device in the DB + in-memory registry. Called by DeviceManagerApi.register(). */
         registerDevice: method(DeviceRegisterPayloadSchema, zod.z.void(), { kind: "mutation" }),
@@ -51132,6 +51291,12 @@ var require_dist_C7qWwrK1 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "backup.cancel": {
+        capName: "backup",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "backup.delete": {
         capName: "backup",
         capScope: "system",
@@ -51174,6 +51339,12 @@ var require_dist_C7qWwrK1 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "backup.listRuns": {
+        capName: "backup",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "backup.listSchedules": {
         capName: "backup",
         capScope: "system",
@@ -52374,6 +52545,12 @@ var require_dist_C7qWwrK1 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "deviceProvider.reloadDevice": {
+        capName: "device-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "deviceProvider.start": {
         capName: "device-provider",
         capScope: "system",
@@ -55740,6 +55917,12 @@ var require_dist_C7qWwrK1 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "streamBroker.forgetDeviceHardware": {
+        capName: "stream-broker",
+        capScope: "system",
+        addonId: null,
+        access: "delete"
+      },
       "streamBroker.getAllRtspEntries": {
         capName: "stream-broker",
         capScope: "system",
@@ -58198,6 +58381,11 @@ var require_dist_C7qWwrK1 = __commonJS({
         form: "single",
         optional: false
       }],
+      "streamBroker.forgetDeviceHardware": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "streamBroker.getDeviceAudioMute": [{
         name: "deviceId",
         form: "single",
@@ -59854,7 +60042,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -60673,7 +60861,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -60767,7 +60955,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -61664,11 +61852,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-3soU9pfP.js
-var require_retired_settings_keys_3soU9pfP = __commonJS({
-  "../system/dist/retired-settings-keys-3soU9pfP.js"(exports) {
+// ../system/dist/retired-settings-keys-BdvmiaK7.js
+var require_retired_settings_keys_BdvmiaK7 = __commonJS({
+  "../system/dist/retired-settings-keys-BdvmiaK7.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -63882,8 +64070,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
-    var require_retired_settings_keys = require_retired_settings_keys_3soU9pfP();
+    var require_dist10 = require_dist_whe0b4_3();
+    var require_retired_settings_keys = require_retired_settings_keys_BdvmiaK7();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -65546,7 +65734,13 @@ var require_device_manager_addon = __commonJS({
       if (config.mode === "auto") {
         if (selfLocation !== null && selfLocation.length > 0) for (const c of candidates) {
           if (c.type === require_dist10.DeviceType.Container) continue;
-          if (c.location === selfLocation) ids.add(c.id);
+          if (c.location !== selfLocation) continue;
+          const parent = c.parentDeviceId !== null ? byId.get(c.parentDeviceId) : void 0;
+          if (parent !== void 0 && parent.type === require_dist10.DeviceType.Container) {
+            expand(parent.id);
+            continue;
+          }
+          ids.add(c.id);
         }
       } else for (const id of config.manualIds) if (byId.has(id)) expand(id);
       ids.delete(selfId);
@@ -66376,10 +66570,26 @@ var require_device_manager_addon = __commonJS({
         detail
       };
     }
+    async function setSwitchBounded(deps, deviceId, switchId, enabled) {
+      const budget = deps.switchTimeoutMs ?? 15e3;
+      const write = deps.setSwitch(deviceId, switchId, enabled);
+      write.catch(() => {
+      });
+      let timer;
+      try {
+        await Promise.race([write, new Promise((_resolve, reject) => {
+          timer = setTimeout(() => {
+            reject(/* @__PURE__ */ new Error(`switch write did not answer within ${budget}ms \u2014 reported unreachable; if it lands late, a duplicate write of the same value is a no-op`));
+          }, budget);
+        })]);
+      } finally {
+        if (timer !== void 0) clearTimeout(timer);
+      }
+    }
     async function applyAll(deps, deviceId, enabled) {
       const out = [];
       for (const switchId of require_dist10.CAMERA_SWITCH_ORDER) try {
-        await deps.setSwitch(deviceId, switchId, enabled);
+        await setSwitchBounded(deps, deviceId, switchId, enabled);
         out.push({
           deviceId,
           switchId,
@@ -66409,8 +66619,17 @@ var require_device_manager_addon = __commonJS({
       const down = [...await applyAll(deps, sourceId, false), ...await applyAll(deps, targetId, false)];
       const sourceStillLive = down.filter((r) => r.deviceId === sourceId && r.outcome === "unreachable").map((r) => r.switchId);
       await deps.swapIds(sourceId, targetId);
+      await deps.swapHardwareState(sourceId, targetId);
+      for (const deviceId of [sourceId, targetId]) try {
+        await deps.forgetStreamState(deviceId);
+      } catch (err) {
+        deps.log("migration: broker hardware state NOT forgotten \u2014 stale stream state survives", {
+          deviceId,
+          error: err instanceof Error ? err.message : String(err),
+          remedy: "delete the device's derived streams and reassign its stream profiles, or update the stream-broker addon and re-run streamBroker.forgetDeviceHardware"
+        });
+      }
       const up = await applyAll(deps, sourceId, true);
-      await deps.respawnRunners([sourceId, targetId]);
       deps.log("camera migrated", {
         sourceId,
         targetId,
@@ -66425,6 +66644,93 @@ var require_device_manager_addon = __commonJS({
         swapped: true
       };
     }
+    async function reloadMigratedDevices(pctx, targets) {
+      const ctx = pctx.host.ctx;
+      for (const target of targets) {
+        pctx.metaStore.idToAddonId.set(target.deviceId, target.addonId);
+        pctx.host.remoteNativeCaps.delete(target.deviceId);
+        pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(target.deviceId);
+      }
+      const fallbackAddons = /* @__PURE__ */ new Map();
+      await Promise.all(targets.map(async (target) => {
+        try {
+          const reloaded = await (await pctx.host.requireDeviceProvider(target.addonId)).reloadDevice({ stableId: target.stableId });
+          ctx.logger.info("migration: device reloaded in place \u2014 no other device disturbed", {
+            tags: { deviceId: target.deviceId },
+            meta: {
+              addonId: target.addonId,
+              stableId: target.stableId,
+              reloadedAs: reloaded.deviceId
+            }
+          });
+        } catch (err) {
+          ctx.logger.error("migration: in-place reload FAILED \u2014 falling back to a provider restart", {
+            tags: { deviceId: target.deviceId },
+            meta: {
+              addonId: target.addonId,
+              stableId: target.stableId,
+              error: err instanceof Error ? err.message : String(err)
+            }
+          });
+          fallbackAddons.set(target.addonId, target.deviceId);
+        }
+      }));
+      if (fallbackAddons.size === 0) return;
+      await Promise.all([...fallbackAddons.entries()].map(async ([addonId, migratedDeviceId]) => {
+        const owned = [...pctx.metaStore.idToAddonId.entries()].filter(([, a]) => a === addonId).length;
+        ctx.logger.info("migration: restarting a whole provider to flush the id maps", {
+          tags: { deviceId: migratedDeviceId },
+          meta: {
+            addonId,
+            devicesTakenDown: owned
+          }
+        });
+        await ctx.api.addons.restartAddon.mutate({ addonId });
+      }));
+    }
+    var PROFILE_MAP_CONFIG_KEY = "_profileMap";
+    var ROLE_SCOPED_CONFIG_KEYS = new Set(DEVICE_STORE_SECTIONS.flatMap((section) => [...section.keys]));
+    function splitConfig(config) {
+      const hardware = {};
+      const role = {};
+      for (const [key, value] of Object.entries(config)) {
+        if (key === PROFILE_MAP_CONFIG_KEY) continue;
+        if (ROLE_SCOPED_CONFIG_KEYS.has(key)) role[key] = value;
+        else hardware[key] = value;
+      }
+      return {
+        hardware,
+        role
+      };
+    }
+    async function swapHardwareState(settings, sourceId, targetId) {
+      const sourceConfig = await settings.readDeviceStore(sourceId);
+      const targetConfig = await settings.readDeviceStore(targetId);
+      const source = splitConfig(sourceConfig);
+      const target = splitConfig(targetConfig);
+      await settings.clearDeviceStore(sourceId);
+      await settings.writeDeviceStore(sourceId, {
+        ...target.hardware,
+        ...source.role
+      });
+      await settings.clearDeviceStore(targetId);
+      await settings.writeDeviceStore(targetId, {
+        ...source.hardware,
+        ...target.role
+      });
+      const sourceRuntimeState = await settings.readDeviceRuntimeState(sourceId);
+      const targetRuntimeState = await settings.readDeviceRuntimeState(targetId);
+      await settings.writeDeviceRuntimeState(sourceId, targetRuntimeState);
+      await settings.writeDeviceRuntimeState(targetId, sourceRuntimeState);
+      return {
+        runtimeStateNowAtSource: targetRuntimeState,
+        runtimeStateNowAtTarget: sourceRuntimeState,
+        hardwareKeysToSource: Object.keys(target.hardware).toSorted(),
+        hardwareKeysToTarget: Object.keys(source.hardware).toSorted(),
+        roleKeysKeptAtSource: Object.keys(source.role).toSorted(),
+        roleKeysKeptAtTarget: Object.keys(target.role).toSorted()
+      };
+    }
     async function stampIntegrationId(metaStore, ctx, deviceId, integrationId) {
       await metaStore.withMetaWriteLock(async () => {
         if (!await metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] stampIntegrationId: unknown device id=${deviceId}`);
@@ -66470,39 +66776,110 @@ var require_device_manager_addon = __commonJS({
     async function migrateDevice(pctx, input) {
       const { sourceId, targetId } = input;
       const ctx = pctx.host.ctx;
-      return await pctx.metaStore.withMetaWriteLock(async () => {
-        for (const id of [sourceId, targetId]) if (await pctx.metaStore.rows.get(id) === null) throw new Error(`[device-manager] migrateDevice: device ${id} does not exist`);
-        const tempId = await pctx.metaStore.allocateNextDeviceId();
-        return await migrateDevice$1({
-          setSwitch: async (deviceId, switchId, enabled) => {
-            await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
-              deviceId,
-              switchId,
-              enabled
-            });
-          },
-          swapIds: async (a, b) => {
-            await pctx.metaStore.rows.swapIds(a, b, tempId);
-          },
-          respawnRunners: async (deviceIds) => {
-            const owners = /* @__PURE__ */ new Set();
-            for (const deviceId of deviceIds) {
-              const addonId = pctx.metaStore.idToAddonId.get(deviceId);
-              if (addonId !== void 0) owners.add(addonId);
-            }
-            for (const addonId of owners) await ctx.api.addons.restartAddon.mutate({ addonId });
-          },
-          log: (message, meta) => {
-            ctx.logger.info(message, {
+      pctx.migrationGuard.begin(sourceId, targetId);
+      try {
+        const outcome = await pctx.metaStore.withMetaWriteLock(async () => {
+          const sourceRow = await pctx.metaStore.rows.get(sourceId);
+          if (sourceRow === null) throw new Error(`[device-manager] migrateDevice: device ${sourceId} does not exist`);
+          const targetRow = await pctx.metaStore.rows.get(targetId);
+          if (targetRow === null) throw new Error(`[device-manager] migrateDevice: device ${targetId} does not exist`);
+          const replay = pctx.migrationGuard.matchReplay(sourceId, targetId, {
+            addonId: sourceRow.meta.addonId,
+            stableId: sourceRow.meta.stableId
+          }, {
+            addonId: targetRow.meta.addonId,
+            stableId: targetRow.meta.stableId
+          });
+          if (replay !== null) {
+            ctx.logger.info("migrateDevice: this swap already completed \u2014 replaying the original report, NOTHING re-run", {
               tags: { deviceId: sourceId },
-              meta
+              meta: {
+                sourceId,
+                targetId
+              }
             });
+            return {
+              result: replay,
+              reloadTargets: null
+            };
           }
-        }, {
-          sourceId,
-          targetId
+          const tempId = await pctx.metaStore.allocateNextDeviceId();
+          const result = await migrateDevice$1({
+            setSwitch: async (deviceId, switchId, enabled) => {
+              if (switchId === "stream-broker") {
+                const moved = await writeDisabledFlagUnderLock(pctx, deviceId, !enabled);
+                emitDisabledEvents(pctx, deviceId, !enabled, moved);
+                return;
+              }
+              await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
+                deviceId,
+                switchId,
+                enabled
+              });
+            },
+            swapIds: async (a, b) => {
+              await pctx.metaStore.rows.swapIds(a, b, tempId);
+            },
+            swapHardwareState: async (a, b) => {
+              const swapped = await swapHardwareState(pctx.settings, a, b);
+              pctx.host.seedMirror(a, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtSource));
+              pctx.host.seedMirror(b, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtTarget));
+              ctx.logger.info("migration: hardware-scoped device state swapped", {
+                tags: { deviceId: a },
+                meta: {
+                  sourceId: a,
+                  targetId: b,
+                  hardwareKeysToSource: swapped.hardwareKeysToSource,
+                  hardwareKeysToTarget: swapped.hardwareKeysToTarget,
+                  roleKeysKeptAtSource: swapped.roleKeysKeptAtSource,
+                  roleKeysKeptAtTarget: swapped.roleKeysKeptAtTarget
+                }
+              });
+            },
+            forgetStreamState: async (deviceId) => {
+              await ctx.api.streamBroker.forgetDeviceHardware.mutate({ deviceId });
+            },
+            log: (message, meta) => {
+              ctx.logger.info(message, {
+                tags: { deviceId: sourceId },
+                meta
+              });
+            }
+          }, {
+            sourceId,
+            targetId
+          });
+          pctx.migrationGuard.recordCompleted({
+            sourceId,
+            targetId,
+            identityAtSource: {
+              addonId: targetRow.meta.addonId,
+              stableId: targetRow.meta.stableId
+            },
+            identityAtTarget: {
+              addonId: sourceRow.meta.addonId,
+              stableId: sourceRow.meta.stableId
+            },
+            result
+          });
+          return {
+            result,
+            reloadTargets: [{
+              deviceId: sourceId,
+              addonId: targetRow.meta.addonId,
+              stableId: targetRow.meta.stableId
+            }, {
+              deviceId: targetId,
+              addonId: sourceRow.meta.addonId,
+              stableId: sourceRow.meta.stableId
+            }]
+          };
         });
-      });
+        if (outcome.reloadTargets !== null) await reloadMigratedDevices(pctx, outcome.reloadTargets);
+        return outcome.result;
+      } finally {
+        pctx.migrationGuard.end(sourceId, targetId);
+      }
     }
     async function registerDevice(pctx, input) {
       const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
@@ -67023,18 +67400,17 @@ var require_device_manager_addon = __commonJS({
         }
       });
     }
-    async function setDisabled(pctx, input) {
-      const { deviceId, disabled } = input;
-      const moved = await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        await pctx.metaStore.rows.patch(deviceId, { disabled });
-        return {
-          changed: (m.disabled ?? false) !== disabled,
-          integrationId: m.integrationId ?? ""
-        };
-      });
+    async function writeDisabledFlagUnderLock(pctx, deviceId, disabled) {
+      const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+      if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
+      const { meta: m } = persisted;
+      await pctx.metaStore.rows.patch(deviceId, { disabled });
+      return {
+        changed: (m.disabled ?? false) !== disabled,
+        integrationId: m.integrationId ?? ""
+      };
+    }
+    function emitDisabledEvents(pctx, deviceId, disabled, moved) {
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
         timestamp: /* @__PURE__ */ new Date(),
@@ -67064,6 +67440,10 @@ var require_device_manager_addon = __commonJS({
         }
       });
     }
+    async function setDisabled(pctx, input) {
+      const { deviceId, disabled } = input;
+      emitDisabledEvents(pctx, deviceId, disabled, await pctx.metaStore.withMetaWriteLock(() => writeDisabledFlagUnderLock(pctx, deviceId, disabled)));
+    }
     async function loadRuntimeState(pctx, input) {
       const { deviceId } = input;
       if (!await pctx.metaStore.resolvePersistedById(deviceId)) return {};
@@ -68444,6 +68824,42 @@ var require_device_manager_addon = __commonJS({
       };
       return resolveRemoteNativeCapFromRegistry(pctx.bindingsDeps, capName, deviceId);
     }
+    function sameIdentity(a, b) {
+      return a.addonId === b.addonId && a.stableId === b.stableId;
+    }
+    function createMigrationGuard(now = Date.now) {
+      const inFlight = /* @__PURE__ */ new Set();
+      const completed = /* @__PURE__ */ new Map();
+      const pairKey = (sourceId, targetId) => `${sourceId}->${targetId}`;
+      return {
+        begin(sourceId, targetId) {
+          for (const id of [sourceId, targetId]) if (inFlight.has(id)) throw new Error(`[device-manager] migrateDevice: a migration involving device ${id} is already in flight \u2014 this call was refused, not queued. The running migration's report stands; re-read the device rows before retrying.`);
+          inFlight.add(sourceId);
+          inFlight.add(targetId);
+        },
+        end(sourceId, targetId) {
+          inFlight.delete(sourceId);
+          inFlight.delete(targetId);
+        },
+        recordCompleted(record) {
+          completed.set(pairKey(record.sourceId, record.targetId), {
+            ...record,
+            completedAt: now()
+          });
+        },
+        matchReplay(sourceId, targetId, atSource, atTarget) {
+          const key = pairKey(sourceId, targetId);
+          const record = completed.get(key);
+          if (record === void 0) return null;
+          if (now() - record.completedAt > 9e5) {
+            completed.delete(key);
+            return null;
+          }
+          if (!sameIdentity(record.identityAtSource, atSource) || !sameIdentity(record.identityAtTarget, atTarget)) return null;
+          return record.result;
+        }
+      };
+    }
     var DeviceManagerAddon = class extends require_dist10.BaseAddon {
       constructor() {
         super({});
@@ -68682,6 +69098,7 @@ var require_device_manager_addon = __commonJS({
           settings,
           registry,
           bindingsDeps: this.bindingsDeps,
+          migrationGuard: createMigrationGuard(),
           requireDeviceOps,
           stampIntegrationId: stampIntegrationId$1,
           get provider() {
@@ -68923,7 +69340,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -69060,7 +69477,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -69250,7 +69667,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -77063,7 +77480,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -77628,7 +78045,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -80212,7 +80629,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -81328,8 +81745,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
-    var require_retired_settings_keys = require_retired_settings_keys_3soU9pfP();
+    var require_dist10 = require_dist_whe0b4_3();
+    var require_retired_settings_keys = require_retired_settings_keys_BdvmiaK7();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -83819,7 +84236,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var require_hub_cap_forward = require_hub_cap_forward_DmHNjbB0();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -86770,7 +87187,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -104831,7 +105248,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -106774,9 +107191,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-BwGJ_wL_.js
-var require_sleep_BwGJ_wL = __commonJS({
-  "../types/dist/sleep-BwGJ_wL_.js"(exports) {
+// ../types/dist/sleep-jdpPltQH.js
+var require_sleep_jdpPltQH = __commonJS({
+  "../types/dist/sleep-jdpPltQH.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -109700,6 +110117,7 @@ var require_sleep_BwGJ_wL = __commonJS({
           getDeviceLiveContribution: (input) => dispatchSystem("deviceManager", "getDeviceLiveContribution", "query", input),
           applyDeviceSettingsPatch: (input) => dispatchSystem("deviceManager", "applyDeviceSettingsPatch", "mutation", input)
         },
+        deviceProvider: { reloadDevice: (input) => dispatchSystem("deviceProvider", "reloadDevice", "mutation", input) },
         deviceState: {
           getSnapshot: (input) => dispatchSystem("deviceState", "getSnapshot", "query", input),
           getCapSlice: (input) => dispatchSystem("deviceState", "getCapSlice", "query", input),
@@ -109784,6 +110202,7 @@ var require_sleep_BwGJ_wL = __commonJS({
           retractCameraStream: (input) => dispatchSystem("streamBroker", "retractCameraStream", "mutation", input),
           assignProfile: (input) => dispatchSystem("streamBroker", "assignProfile", "mutation", input),
           unassignProfile: (input) => dispatchSystem("streamBroker", "unassignProfile", "mutation", input),
+          forgetDeviceHardware: (input) => dispatchSystem("streamBroker", "forgetDeviceHardware", "mutation", input),
           renderPreBufferClip: (input) => dispatchSystem("streamBroker", "renderPreBufferClip", "mutation", input),
           produceEventMedia: (input) => dispatchSystem("streamBroker", "produceEventMedia", "mutation", input),
           restartProfile: (input) => dispatchSystem("streamBroker", "restartProfile", "mutation", input),
@@ -110448,7 +110867,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_BwGJ_wL();
+    var require_sleep = require_sleep_jdpPltQH();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -117331,12 +117750,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-PAIfmNun.js
-var require_manifest_system_deps_PAIfmNun = __commonJS({
-  "../system/dist/manifest-system-deps-PAIfmNun.js"(exports) {
+// ../system/dist/manifest-system-deps-y5vZBO6q.js
+var require_manifest_system_deps_y5vZBO6q = __commonJS({
+  "../system/dist/manifest-system-deps-y5vZBO6q.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_C7qWwrK1();
+    require_dist_whe0b4_3();
     require_hub_cap_forward_DmHNjbB0();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
@@ -129403,7 +129822,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_C7qWwrK1();
+    var require_dist10 = require_dist_whe0b4_3();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -129430,7 +129849,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_PAIfmNun();
+    var require_manifest_system_deps = require_manifest_system_deps_y5vZBO6q();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -132468,7 +132887,265 @@ var require_dist3 = __commonJS({
         };
       }
     };
+    function parseVersion(value) {
+      const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(value.trim());
+      if (!m) return null;
+      return {
+        major: Number(m[1]),
+        minor: Number(m[2]),
+        patch: Number(m[3]),
+        prerelease: m[4] ?? null
+      };
+    }
+    function compareTriple(a, b) {
+      if (a.major !== b.major) return a.major < b.major ? -1 : 1;
+      if (a.minor !== b.minor) return a.minor < b.minor ? -1 : 1;
+      if (a.patch !== b.patch) return a.patch < b.patch ? -1 : 1;
+      return 0;
+    }
+    function closureSatisfiesRange(range, version2) {
+      const trimmedRange = range.trim();
+      const v2 = parseVersion(version2);
+      if (v2 === null) return false;
+      if (v2.prerelease !== null) return trimmedRange === version2.trim() || trimmedRange === `=${version2.trim()}`;
+      const exactBase = parseVersion(trimmedRange.startsWith("=") ? trimmedRange.slice(1) : trimmedRange);
+      if (exactBase !== null) return exactBase.prerelease === null && compareTriple(v2, exactBase) === 0;
+      const operator = trimmedRange[0];
+      if (operator !== "^" && operator !== "~") return false;
+      const base = parseVersion(trimmedRange.slice(1));
+      if (base === null || base.prerelease !== null) return false;
+      if (operator === "~") return v2.major === base.major && v2.minor === base.minor && compareTriple(v2, base) >= 0;
+      if (base.major > 0) return v2.major === base.major && compareTriple(v2, base) >= 0;
+      if (base.minor > 0) return v2.major === 0 && v2.minor === base.minor && compareTriple(v2, base) >= 0;
+      return compareTriple(v2, base) === 0;
+    }
+    function sameCompatLine(a, b) {
+      const pa = parseVersion(a);
+      const pb = parseVersion(b);
+      if (pa === null || pb === null) return false;
+      if (pa.major !== pb.major) return false;
+      if (pa.major === 0) return pa.minor === pb.minor;
+      return true;
+    }
+    function planClosureDedupe(input) {
+      const links = [];
+      const keeps = [];
+      for (const candidate of input.candidates) {
+        if (candidate.name.startsWith("@camstack/")) {
+          keeps.push({
+            name: candidate.name,
+            reason: "camstack-package"
+          });
+          continue;
+        }
+        if (input.neverLink.has(candidate.name)) {
+          keeps.push({
+            name: candidate.name,
+            reason: "never-link"
+          });
+          continue;
+        }
+        const closureVersion = input.closureVersions.get(candidate.name);
+        if (closureVersion === void 0) {
+          keeps.push({
+            name: candidate.name,
+            reason: "not-in-closure"
+          });
+          continue;
+        }
+        if (closureVersion === candidate.version) {
+          links.push({
+            name: candidate.name,
+            closureVersion
+          });
+          continue;
+        }
+        const ranges = input.requirements.get(candidate.name) ?? [];
+        if (ranges.length > 0 && ranges.every((range) => closureSatisfiesRange(range, closureVersion)) && sameCompatLine(closureVersion, candidate.version)) links.push({
+          name: candidate.name,
+          closureVersion
+        });
+        else keeps.push({
+          name: candidate.name,
+          reason: "version-incompatible"
+        });
+      }
+      return {
+        links,
+        keeps
+      };
+    }
+    function readTreeManifest(pkgJsonPath) {
+      let raw;
+      try {
+        raw = require_dist10.asJsonObject(require_dist10.parseJsonUnknown(node_fs.readFileSync(pkgJsonPath, "utf-8")));
+      } catch {
+        return null;
+      }
+      if (raw === null) return null;
+      const ranges = /* @__PURE__ */ new Map();
+      for (const key of [
+        "dependencies",
+        "optionalDependencies",
+        "peerDependencies"
+      ]) {
+        const deps = require_dist10.asJsonObject(raw[key]);
+        if (deps === null) continue;
+        for (const [name2, range] of Object.entries(deps)) if (typeof range === "string" && !ranges.has(name2)) ranges.set(name2, range);
+      }
+      const version2 = require_dist10.asString(raw["version"]);
+      return {
+        version: version2.length > 0 ? version2 : null,
+        ranges
+      };
+    }
+    function listTopLevelEntries(nodeModulesDir) {
+      let entries;
+      try {
+        entries = node_fs.readdirSync(nodeModulesDir, { withFileTypes: true });
+      } catch {
+        return [];
+      }
+      const names = [];
+      for (const entry of entries) {
+        if (entry.name.startsWith(".")) continue;
+        if (entry.name.startsWith("@")) {
+          let inner;
+          try {
+            inner = node_fs.readdirSync(node_path.join(nodeModulesDir, entry.name), { withFileTypes: true });
+          } catch {
+            continue;
+          }
+          for (const sub of inner) if (!sub.name.startsWith(".")) names.push(`${entry.name}/${sub.name}`);
+        } else names.push(entry.name);
+      }
+      return names;
+    }
+    function collectAddonTreeState(addonDir) {
+      const nodeModulesDir = node_path.join(addonDir, "node_modules");
+      const requirements = /* @__PURE__ */ new Map();
+      const addRange = (name2, range) => {
+        const existing = requirements.get(name2);
+        if (existing === void 0) requirements.set(name2, [range]);
+        else existing.push(range);
+      };
+      const rootManifest = readTreeManifest(node_path.join(addonDir, "package.json"));
+      if (rootManifest !== null) for (const [name2, range] of rootManifest.ranges) addRange(name2, range);
+      const candidates = [];
+      const existingLinks = [];
+      for (const name2 of listTopLevelEntries(nodeModulesDir)) {
+        const entryDir = node_path.join(nodeModulesDir, name2);
+        let isLink = false;
+        try {
+          isLink = node_fs.lstatSync(entryDir).isSymbolicLink();
+        } catch {
+          continue;
+        }
+        if (isLink) {
+          let target = "";
+          try {
+            target = node_fs.readlinkSync(entryDir);
+          } catch {
+          }
+          existingLinks.push({
+            name: name2,
+            target
+          });
+        }
+        const manifest = readTreeManifest(node_path.join(entryDir, "package.json"));
+        if (manifest === null) continue;
+        if (!isLink && manifest.version !== null) candidates.push({
+          name: name2,
+          version: manifest.version
+        });
+        for (const [depName, range] of manifest.ranges) {
+          if (node_fs.existsSync(node_path.join(entryDir, "node_modules", depName))) continue;
+          addRange(depName, range);
+        }
+      }
+      return {
+        candidates,
+        requirements,
+        existingLinks
+      };
+    }
+    function readClosureVersions(closureNodeModulesDir, names) {
+      const versions = /* @__PURE__ */ new Map();
+      for (const name2 of names) {
+        const manifest = readTreeManifest(node_path.join(closureNodeModulesDir, name2, "package.json"));
+        if (manifest !== null && manifest.version !== null) versions.set(name2, manifest.version);
+      }
+      return versions;
+    }
+    function resolveClosureNodeModulesDir(explicitDir) {
+      const frameworkDir = explicitDir ?? process.env["CAMSTACK_FRAMEWORK_DIR"];
+      if (frameworkDir === void 0 || frameworkDir.length === 0) return null;
+      const nodeModulesDir = explicitDir ?? node_path.join(frameworkDir, "node_modules");
+      return node_fs.existsSync(nodeModulesDir) ? nodeModulesDir : null;
+    }
+    function symlinkType() {
+      return process.platform === "win32" ? "junction" : "dir";
+    }
+    function executeClosureDedupe(addonDir, closureNodeModulesDir, plan, logger) {
+      if (plan.links.length === 0) return [];
+      const nodeModulesDir = node_path.join(addonDir, "node_modules");
+      const probePath = node_path.join(nodeModulesDir, ".closure-link-probe");
+      try {
+        node_fs.mkdirSync(nodeModulesDir, { recursive: true });
+        node_fs.rmSync(probePath, { force: true });
+        node_fs.symlinkSync(closureNodeModulesDir, probePath, symlinkType());
+        node_fs.rmSync(probePath, { force: true });
+      } catch (err) {
+        logger.warn("closure dedupe skipped \u2014 symlinks unavailable on this volume", { meta: {
+          addonDir,
+          error: require_dist10.errMsg(err)
+        } });
+        return [];
+      }
+      const linked = [];
+      for (const link of plan.links) {
+        const target = node_path.join(closureNodeModulesDir, link.name);
+        const manifest = readTreeManifest(node_path.join(target, "package.json"));
+        if (manifest === null || manifest.version !== link.closureVersion) {
+          logger.warn("closure dedupe \u2014 closure changed under the plan; keeping own copy", { meta: {
+            name: link.name,
+            planned: link.closureVersion,
+            found: manifest?.version ?? null
+          } });
+          continue;
+        }
+        const entryDir = node_path.join(nodeModulesDir, link.name);
+        try {
+          node_fs.rmSync(entryDir, {
+            recursive: true,
+            force: true
+          });
+          node_fs.mkdirSync(node_path.dirname(entryDir), { recursive: true });
+          node_fs.symlinkSync(target, entryDir, symlinkType());
+          linked.push(link.name);
+        } catch (err) {
+          logger.warn("closure dedupe \u2014 link failed; entry removed copy may need reinstall", { meta: {
+            name: link.name,
+            error: require_dist10.errMsg(err)
+          } });
+        }
+      }
+      return linked;
+    }
+    function isClosureLinkTarget(linkTarget, closureNodeModulesDir) {
+      if (linkTarget.length === 0) return false;
+      const normalized = node_path.resolve(linkTarget);
+      const root = node_path.resolve(closureNodeModulesDir);
+      return normalized === root || normalized.startsWith(`${root}${node_path.sep}`);
+    }
     var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    function readNativeDependencyNames(pkg) {
+      if (pkg === void 0) return /* @__PURE__ */ new Set();
+      const camstack = require_dist10.asJsonObject(pkg["camstack"]);
+      if (camstack === null) return /* @__PURE__ */ new Set();
+      const native = require_dist10.asJsonObject(camstack["nativeDependencies"]);
+      return native === null ? /* @__PURE__ */ new Set() : new Set(Object.keys(native));
+    }
     function parseInstallSource(value) {
       switch (value) {
         case "npm":
@@ -132530,6 +133207,8 @@ var require_dist3 = __commonJS({
       installSource;
       logger;
       isPackageResolvable;
+      /** Test seam — production resolves via `CAMSTACK_FRAMEWORK_DIR`. */
+      closureNodeModulesDir;
       /**
       * Central manifest of installed addons. Tracks version + source +
       * timestamps + last-backup pointer per package, written atomically
@@ -132551,6 +133230,7 @@ var require_dist3 = __commonJS({
         this.logger = logger;
         this.manifest = new AddonManifest(config.addonsDir);
         this.isPackageResolvable = config.isPackageResolvable;
+        this.closureNodeModulesDir = config.closureNodeModulesDir;
         if (config.installSource) this.installSource = config.installSource;
         else this.installSource = "npm";
       }
@@ -132738,6 +133418,140 @@ var require_dist3 = __commonJS({
         return changes;
       }
       /**
+      * Make every INSTALLED addon's runtime dependencies resolvable — doing the
+      * least work that achieves it. Runs at boot on hub and agent, which is what
+      * turns a restore back into a working node: a system backup archives no
+      * node_modules (D338), so before this pass every restored non-bootstrap
+      * addon failed its first import until someone redeployed it by hand.
+      *
+      * Per addon, in order:
+      *  1. drop closure links that no longer hold (dangling, or the closure
+      *     moved to a version the addon tree's recorded ranges refuse) — those
+      *     addons get a reinstall;
+      *  2. a declared dep that already resolves in the addon tree costs nothing;
+      *  3. a missing declared dep the closure provides at a COMPATIBLE version
+      *     becomes a link — no npm, no network;
+      *  4. only an addon left with a genuinely unresolvable dep gets an npm
+      *     install (then dedupe + native ensure, same tail as a fresh install).
+      *
+      * "Only when necessary" is the contract: an addon whose deps are all
+      * satisfied is not touched at all. Failures are per-addon and non-fatal —
+      * a dep that cannot be re-fetched leaves that addon exactly as broken as
+      * it already was, but LOUDLY, and never blocks the rest of the boot.
+      */
+      async ensureAddonRuntimeDeps() {
+        const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+        const linked = [];
+        const reinstalled = [];
+        const failed = [];
+        const installedPackages = this.listInstalled();
+        for (const pkg of installedPackages) {
+          try {
+            if (node_fs.lstatSync(pkg.dir).isSymbolicLink()) continue;
+          } catch {
+            continue;
+          }
+          try {
+            const outcome = this.ensureOneAddonDeps(pkg.dir, pkg.name, closureNodeModules);
+            for (const dep of outcome.linked) linked.push(`${pkg.name}:${dep}`);
+            if (outcome.needsInstall) {
+              await this.reinstallAddonDeps(pkg.dir, pkg.name);
+              reinstalled.push(pkg.name);
+            }
+          } catch (err) {
+            failed.push(pkg.name);
+            this.logger.error(`${pkg.name} \u2014 runtime dependencies could NOT be ensured; the addon will fail to load until its deps install`, { meta: {
+              dir: pkg.dir,
+              error: require_dist10.errMsg(err)
+            } });
+          }
+        }
+        return {
+          checked: installedPackages.length,
+          linked,
+          reinstalled,
+          failed
+        };
+      }
+      /**
+      * One addon's dependency audit (steps 1–3 of `ensureAddonRuntimeDeps`).
+      * Pure decision + link creation; the npm fallback is the caller's.
+      */
+      ensureOneAddonDeps(addonDir, packageName, closureNodeModules) {
+        const pkgView = readPackageJson(node_path.join(addonDir, "package.json"));
+        const declared = pkgView === null ? null : require_dist10.asJsonObject(pkgView.raw["dependencies"]);
+        const declaredEntries = declared === null ? [] : Object.entries(declared);
+        const state = collectAddonTreeState(addonDir);
+        const nodeModulesDir = node_path.join(addonDir, "node_modules");
+        let needsInstall = false;
+        if (closureNodeModules !== null) for (const link of state.existingLinks) {
+          if (!isClosureLinkTarget(link.target, closureNodeModules)) continue;
+          const linkDir = node_path.join(nodeModulesDir, link.name);
+          const targetManifest = node_fs.existsSync(node_path.join(linkDir, "package.json"));
+          const ranges = state.requirements.get(link.name) ?? [];
+          let holds = targetManifest;
+          if (holds && ranges.length > 0) {
+            const version2 = readClosureVersions(closureNodeModules, [link.name]).get(link.name);
+            holds = version2 !== void 0 && ranges.every((range) => closureSatisfiesRange(range, version2));
+          }
+          if (!holds) {
+            this.logger.warn(`${packageName} \u2014 closure link for ${link.name} no longer holds; reinstalling this addon's deps`, { meta: { target: link.target } });
+            node_fs.rmSync(linkDir, { force: true });
+            needsInstall = true;
+          }
+        }
+        const linked = [];
+        for (const [depName, range] of declaredEntries) {
+          if (typeof range !== "string") continue;
+          if (node_fs.existsSync(node_path.join(nodeModulesDir, depName, "package.json"))) continue;
+          const closureVersion = closureNodeModules === null ? void 0 : readClosureVersions(closureNodeModules, [depName]).get(depName);
+          if (closureNodeModules !== null && closureVersion !== void 0 && closureSatisfiesRange(range, closureVersion)) {
+            if (executeClosureDedupe(addonDir, closureNodeModules, {
+              links: [{
+                name: depName,
+                closureVersion
+              }],
+              keeps: []
+            }, this.logger).length === 1) {
+              this.logger.info(`${packageName} \u2014 ${depName} linked from the server closure`, { meta: { closureVersion } });
+              linked.push(depName);
+              continue;
+            }
+          }
+          needsInstall = true;
+        }
+        return {
+          linked,
+          needsInstall
+        };
+      }
+      /**
+      * npm-install an installed addon's runtime deps IN PLACE (the restore /
+      * repair path — the tree is not yet running at boot), then the same tail
+      * every fresh install gets: closure dedupe + native deps + prebuild ensure.
+      * Closure links are stripped first so npm reifies against plain missing
+      * dirs instead of symlinks it does not own.
+      */
+      async reinstallAddonDeps(addonDir, packageName) {
+        const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+        if (closureNodeModules !== null) {
+          const state = collectAddonTreeState(addonDir);
+          for (const link of state.existingLinks) if (isClosureLinkTarget(link.target, closureNodeModules)) node_fs.rmSync(node_path.join(addonDir, "node_modules", link.name), { force: true });
+        }
+        this.logger.info(`${packageName} \u2014 reinstalling runtime dependencies`, { meta: { addonDir } });
+        await require_manifest_system_deps.runNpm([
+          "install",
+          "--omit=dev",
+          "--omit=peer",
+          "--no-audit",
+          "--no-fund",
+          "--no-package-lock",
+          ...this.registry ? ["--registry", this.registry] : []
+        ], this.npmRunOptions(addonDir, 24e4));
+        this.dedupeTreeAgainstClosure(addonDir, packageName);
+        await this.installNativeDependencies(addonDir, packageName);
+      }
+      /**
       * Install a single addon — on-demand installer used by AddonPackageService
       * (admin UI "Install addon" / "Reinstall" buttons).
       *
@@ -132845,6 +133659,7 @@ var require_dist3 = __commonJS({
           logger: this.logger,
           bundledSourceDir: sourceDir
         });
+        this.dedupeTreeAgainstClosure(targetDir, packageName);
         this.logger.info(`${packageName} \u2014 copied from ${sourceDir}`);
         return {
           name: pkgData.name,
@@ -133149,6 +133964,40 @@ var require_dist3 = __commonJS({
           logger: this.logger
         });
       }
+      /**
+      * Stop copying what the server closure already provides: replace each
+      * top-level `node_modules` entry the closure serves at a COMPATIBLE version
+      * with a symlink into the closure (see `deps/closure-dedupe.ts` for the
+      * plan rules and the live measurements). Runs LAST in tree
+      * materialisation — after the runtime-dep npm install AND the native-dep
+      * steps — so no later npm invocation can fight the links.
+      *
+      * Non-fatal by design: dedupe is an optimisation, and its failure mode is
+      * "the addon keeps its own copies", which is exactly today's behaviour. A
+      * refusal on version grounds is logged loudly — that line is the answer to
+      * "why does this addon still carry its own zod".
+      */
+      dedupeTreeAgainstClosure(pkgDir, packageName) {
+        const closureNodeModules = resolveClosureNodeModulesDir(this.closureNodeModulesDir);
+        if (closureNodeModules === null) return;
+        try {
+          const state = collectAddonTreeState(pkgDir);
+          if (state.candidates.length === 0) return;
+          const pkgView = readPackageJson(node_path.join(pkgDir, "package.json"));
+          const plan = planClosureDedupe({
+            candidates: state.candidates,
+            closureVersions: readClosureVersions(closureNodeModules, state.candidates.map((c) => c.name)),
+            requirements: state.requirements,
+            neverLink: readNativeDependencyNames(pkgView?.raw)
+          });
+          const linked = executeClosureDedupe(pkgDir, closureNodeModules, plan, this.logger);
+          if (linked.length > 0) this.logger.info(`${packageName} \u2014 ${linked.length} node_modules entr${linked.length === 1 ? "y" : "ies"} now resolve from the server closure`, { meta: { linked } });
+          const refused = plan.keeps.filter((k2) => k2.reason === "version-incompatible");
+          if (refused.length > 0) this.logger.info(`${packageName} \u2014 kept own copy where the closure version is incompatible`, { meta: { kept: refused.map((k2) => k2.name) } });
+        } catch (err) {
+          this.logger.warn(`${packageName} \u2014 closure dedupe failed (copies kept)`, { meta: { error: require_dist10.errMsg(err) } });
+        }
+      }
       /** Install addon from a tgz file (uploaded or downloaded) */
       async installFromTgz(tgzPath) {
         const stagingRoot = node_path.join(this.addonsDir, ".staging");
@@ -133174,6 +134023,7 @@ var require_dist3 = __commonJS({
           const targetDir = node_path.join(this.addonsDir, pkgView.name);
           await this.installRuntimeDependencies(pkgDir, pkgView.name);
           await this.installNativeDependencies(pkgDir, pkgView.name);
+          this.dedupeTreeAgainstClosure(pkgDir, pkgView.name);
           await this.evictInstallDir(targetDir);
           ensureDir(node_path.dirname(targetDir));
           await node_fs.promises.rename(pkgDir, targetDir);
@@ -133306,6 +134156,7 @@ var require_dist3 = __commonJS({
         if (!node_fs.existsSync(addonDir)) throw new Error(`Cannot update ${packageName}: install dir ${addonDir} missing`);
         await this.installRuntimeDependencies(stagedPath, packageName);
         await this.installNativeDependencies(stagedPath, packageName);
+        this.dedupeTreeAgainstClosure(stagedPath, packageName);
         const ts2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
         const backupRoot = node_path.join(this.addonsDir, ".backups", packageName);
         ensureDir(backupRoot);
@@ -163521,7 +164372,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
     }));
     var require_symlink_type2 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports2, module2) => {
       var fs2 = require_graceful_fs2();
-      function symlinkType(srcpath, type2, callback) {
+      function symlinkType2(srcpath, type2, callback) {
         callback = typeof type2 === "function" ? type2 : callback;
         type2 = typeof type2 === "function" ? false : type2;
         if (type2) return callback(null, type2);
@@ -163542,7 +164393,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
         return stats && stats.isDirectory() ? "dir" : "file";
       }
       module2.exports = {
-        symlinkType,
+        symlinkType: symlinkType2,
         symlinkTypeSync
       };
     }));
@@ -163557,7 +164408,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
       var symlinkPaths = _symlinkPaths.symlinkPaths;
       var symlinkPathsSync = _symlinkPaths.symlinkPathsSync;
       var _symlinkType = require_symlink_type2();
-      var symlinkType = _symlinkType.symlinkType;
+      var symlinkType2 = _symlinkType.symlinkType;
       var symlinkTypeSync = _symlinkType.symlinkTypeSync;
       var pathExists = require_path_exists2().pathExists;
       function createSymlink(srcpath, dstpath, type2, callback) {
@@ -163569,7 +164420,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur
           symlinkPaths(srcpath, dstpath, (err2, relative) => {
             if (err2) return callback(err2);
             srcpath = relative.toDst;
-            symlinkType(relative.toCwd, type2, (err3, type3) => {
+            symlinkType2(relative.toCwd, type2, (err3, type3) => {
               if (err3) return callback(err3);
               const dir = path$23.dirname(dstpath);
               pathExists(dir, (err4, dirExists) => {
@@ -210088,7 +210939,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_BwGJ_wL();
+    var require_sleep = require_sleep_jdpPltQH();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -214698,6 +215549,68 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       fileCount: zod.z.number(),
       present: zod.z.boolean()
     });
+    var BackupRunStateSchema = zod.z.enum([
+      "queued",
+      "running",
+      "succeeded",
+      "failed",
+      "cancelled"
+    ]);
+    var BackupRunPhaseSchema = zod.z.enum([
+      "queued",
+      "building",
+      "uploading",
+      "done"
+    ]);
+    var BackupRunSchema = zod.z.object({
+      /** Stable run id — the handle `backup.cancel` takes. */
+      id: zod.z.string(),
+      state: BackupRunStateSchema,
+      phase: BackupRunPhaseSchema,
+      /**
+      * Resolved destination location ids. Empty while queued (targets are
+      * resolved when the run starts, against the then-current policies).
+      */
+      destinationIds: zod.z.array(zod.z.string()).readonly(),
+      label: zod.z.string().optional(),
+      /** ms-epoch when the run was submitted (trigger call / schedule fire). */
+      requestedAt: zod.z.number(),
+      /** ms-epoch when the run left the queue and started building. */
+      startedAt: zod.z.number().optional(),
+      /** ms-epoch when the run reached a terminal state. */
+      finishedAt: zod.z.number().optional(),
+      /** Compressed bytes of the staging archive written so far. */
+      stagedBytes: zod.z.number(),
+      /** Final staged archive size, once the build phase completes. */
+      archiveSizeBytes: zod.z.number().optional(),
+      /** Bytes pushed to the destination currently uploading. */
+      uploadedBytes: zod.z.number(),
+      /** Destinations where the archive fully landed (uploaded + indexed). */
+      completedDestinationIds: zod.z.array(zod.z.string()).readonly(),
+      /** Destinations that failed during the fan-out. */
+      failedDestinationIds: zod.z.array(zod.z.string()).readonly(),
+      /** Failure message when `state === 'failed'`. */
+      error: zod.z.string().optional(),
+      /**
+      * 1-based place in the execution queue — 1 = runs next. Present only
+      * while `state === 'queued'`. Stamped by the orchestrator from the
+      * queue's OWN pending order, never derived from timestamps, so the
+      * UI cannot show an order the executor will not honour.
+      */
+      queuePosition: zod.z.number().int().min(1).optional()
+    });
+    var BackupTriggerResultSchema = zod.z.object({
+      /** The run this trigger mapped to — poll it via `listRuns`, stop it via `cancel`. */
+      runId: zod.z.string(),
+      /** True when the run waited behind an in-flight run instead of starting immediately. */
+      queued: zod.z.boolean(),
+      /** True when this trigger was coalesced onto an identical already-queued run. */
+      joined: zod.z.boolean(),
+      /** True when the run was cancelled before completing every destination. */
+      cancelled: zod.z.boolean(),
+      /** One entry per destination the archive landed at (partial on cancel). */
+      entries: zod.z.array(BackupEntrySchema).readonly()
+    });
     var BackupScheduleSchema = zod.z.object({
       /** Stable id. Generated by the orchestrator on first upsert if absent. */
       id: zod.z.string(),
@@ -214734,6 +215647,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * Trigger a backup. Without `destinations` the orchestrator fans
         * out to every destination flagged as enabled in the routing
         * config; with it, only the listed addons receive the archive.
+        *
+        * At most ONE backup run executes at a time — the source tree and
+        * the staging disk are shared by every run, so a second trigger
+        * while one is in flight is enqueued (or joined onto an identical
+        * queued run) and the result says so. See D342.
         */
         trigger: require_sleep.method(zod.z.object({
           /** Subset of registered `backup-destination` addon ids to write to. */
@@ -214747,7 +215665,30 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           * retention (manual runs).
           */
           retentionCount: zod.z.number().int().min(1).max(1e3).optional()
-        }).optional(), zod.z.array(BackupEntrySchema).readonly(), {
+        }).optional(), BackupTriggerResultSchema, {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /**
+        * Every run the orchestrator knows about, in EXECUTION order: the
+        * running run first, then queued runs in the exact order they will
+        * execute (each with `queuePosition`, 1 = next), then the bounded
+        * finished history newest-first. Only one run executes at a time
+        * (D342) — the queued section IS the line. Each run carries live
+        * phase + byte counters so a runaway build is visible in seconds,
+        * not via `du`.
+        */
+        listRuns: require_sleep.method(zod.z.void(), zod.z.array(BackupRunSchema).readonly(), { auth: "admin" }),
+        /**
+        * Stop a backup run. Mirrors `storage-migration.cancel` semantics:
+        * id in, `{ cancelled }` out — `false` when the run is unknown or
+        * already terminal. A QUEUED run is removed before it ever starts;
+        * the RUNNING run has its tar/upload stream actually aborted, the
+        * half-written staging archive is deleted, and the in-flight
+        * destination upload is aborted server-side (partial discarded).
+        * Destinations that already completed keep their archive.
+        */
+        cancel: require_sleep.method(zod.z.object({ runId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
           auth: "admin"
         }),
@@ -215487,6 +216428,38 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           auth: "admin"
         }),
         /**
+        * The HARDWARE behind a device number was replaced
+        * (`deviceManager.migrateDevice`). Forget every piece of broker state that
+        * described the old box, so the next catalog pull derives everything from
+        * the camera that is actually there:
+        *
+        *  - every `derived:*` stream definition — a derived is authored against a
+        *    specific profile layout, and against the wrong hardware its feeder
+        *    respawns forever (observed at attempt 2732 on the live hub,
+        *    2026-09-01);
+        *  - the profile-slot assignment entry, PURGED (not unassigned — unassign
+        *    marks the slot manual, which would pin the stale choice instead of
+        *    letting `computeInitialAssignment` re-derive it);
+        *  - the probe snapshots (`<deviceId>/…` — probed codec/resolution of the
+        *    old hardware);
+        *  - the persisted RTSP token rows for the device's brokers (keyed
+        *    `<deviceId>/<camStreamId>`; the stream ids change with the hardware,
+        *    so the rows are dead URLs).
+        *
+        * An RPC, deliberately — an event is telemetry and may be dropped (D8),
+        * and a dropped forget leaves a feeder respawning against a stream that
+        * does not exist.
+        */
+        forgetDeviceHardware: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int().nonnegative() }), zod.z.object({
+          derivedStreamsDeleted: zod.z.array(zod.z.string()).readonly(),
+          assignmentsPurged: zod.z.boolean(),
+          probeSnapshotsDropped: zod.z.number().int().nonnegative(),
+          rtspTokenRowsDeleted: zod.z.number().int().nonnegative()
+        }), {
+          kind: "mutation",
+          auth: "admin"
+        }),
+        /**
         * Render a short GIF or MP4 from the broker's PRE-BUFFER around an instant.
         *
         * The pre-buffer is the only source that already holds the seconds BEFORE
@@ -217311,6 +218284,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           name: zod.z.string(),
           type: zod.z.string()
         }))),
+        /**
+        * Tear down and reconstruct ONE device in place from its persisted rows —
+        * touching no other device this provider owns.
+        *
+        * The primitive `deviceManager.migrateDevice` uses to flush the two
+        * migrated numbers: after `swapIds` the runner's live instance still
+        * carries the PRE-swap numeric id (baked into the object, its native-cap
+        * registrations and its log tags), and a live object cannot be renumbered.
+        * Before this method the only flush was restarting the whole owning addon
+        * — which took every camera the provider owns down with it (28 devices
+        * for one migrated camera, measured 2026-09-04, and the morning of the
+        * same day ~27 devices' native caps did not come back on their own).
+        *
+        * Keyed by `stableId`, deliberately: the numeric id is exactly the thing
+        * that changes. The reply carries the id the device answers on NOW.
+        * Implemented once in `BaseDeviceProvider` — decommission the live
+        * instance (if any), then re-create from the persisted row: the same
+        * teardown/rehydrate pair every graceful shutdown + boot already uses.
+        * An RPC, never an event: a dropped event would leave the runner writing
+        * against the wrong camera (D8).
+        *
+        * Construction can dial hardware, and the migrated source is
+        * characteristically dead — the timeout covers a full activate window
+        * rather than the 60 s default.
+        */
+        reloadDevice: require_sleep.method(zod.z.object({ stableId: zod.z.string() }), zod.z.object({ deviceId: zod.z.number() }), {
+          kind: "mutation",
+          timeoutMs: 3 * 6e4
+        }),
         supportsDiscovery: require_sleep.method(zod.z.object({}), zod.z.boolean()),
         /**
         * Run a network scan. `params` carries optional provider-specific scan
@@ -217632,13 +218634,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * `sourceStillLive` names what stayed live; empty is the only value that
         * means the old hardware is quiet. The migration proceeds either way —
         * refusing would refuse the case this exists for.
+        *
+        * **Safe to retry.** A duplicate call while a migration involving either
+        * device is in flight is REFUSED, never queued; a repeat of a swap that
+        * already completed (matched against the `addonId`/`stableId` fingerprint
+        * the swap left on the rows, within 15 min) is a no-op returning the
+        * original report. A blind re-run can no longer silently undo the
+        * migration it retried.
         */
         migrateDevice: require_sleep.method(zod.z.object({
           sourceId: zod.z.number(),
           targetId: zod.z.number()
         }), MigrateDeviceResultSchema, {
           kind: "mutation",
-          auth: "admin"
+          auth: "admin",
+          timeoutMs: 12 * 6e4
         }),
         /** Register a device in the DB + in-memory registry. Called by DeviceManagerApi.register(). */
         registerDevice: require_sleep.method(DeviceRegisterPayloadSchema, zod.z.void(), { kind: "mutation" }),
@@ -238323,6 +239333,138 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
       }
     };
+    var DEVICE_RESTORE_RETRY_DELAYS_MS = [
+      1e4,
+      3e4,
+      9e4
+    ];
+    var DEVICE_RESTORE_RETRY_CONCURRENCY = 4;
+    function sleep$1(ms, signal) {
+      return new Promise((resolve) => {
+        if (signal.aborted) {
+          resolve();
+          return;
+        }
+        const onAbort = () => {
+          clearTimeout(timer);
+          resolve();
+        };
+        const timer = setTimeout(() => {
+          signal.removeEventListener("abort", onAbort);
+          resolve();
+        }, ms);
+        timer.unref?.();
+        signal.addEventListener("abort", onAbort, { once: true });
+      });
+    }
+    async function runWithConcurrency(items, width, fn) {
+      const queue = [...items];
+      const laneCount = Math.max(1, Math.min(width, queue.length));
+      const lane = async () => {
+        for (; ; ) {
+          const item = queue.shift();
+          if (item === void 0) return;
+          await fn(item);
+        }
+      };
+      await Promise.all(Array.from({ length: laneCount }, lane));
+    }
+    var DeviceRestoreRetryScheduler = class {
+      #logger;
+      #attempt;
+      #onPermanentFailure;
+      #delaysMs;
+      #concurrency;
+      #now;
+      #abort = new AbortController();
+      constructor(options) {
+        this.#logger = options.logger;
+        this.#attempt = options.attempt;
+        this.#onPermanentFailure = options.onPermanentFailure;
+        this.#delaysMs = options.delaysMs ?? DEVICE_RESTORE_RETRY_DELAYS_MS;
+        this.#concurrency = options.concurrency ?? 4;
+        this.#now = options.now ?? Date.now;
+      }
+      /** Stop retrying (shutdown). Pending entries are NOT marked
+      *  permanently failed — the next boot restores them from disk. */
+      cancel() {
+        this.#abort.abort();
+      }
+      /**
+      * Run the bounded retry rounds. Resolves when every entry has either
+      * restored, been marked permanently failed, or the scheduler was
+      * cancelled. Never rejects.
+      */
+      async run(initialFailures) {
+        let pending = initialFailures.map((failure) => ({
+          saved: failure.saved,
+          lastError: failure.error,
+          attempts: 1
+        }));
+        for (let round = 0; round < this.#delaysMs.length; round += 1) {
+          if (pending.length === 0 || this.#abort.signal.aborted) break;
+          await sleep$1(this.#delaysMs[round] ?? 0, this.#abort.signal);
+          if (this.#abort.signal.aborted) break;
+          pending = await this.#runRound(pending, round);
+        }
+        if (this.#abort.signal.aborted) return [];
+        const terminal = pending.map((entry) => ({
+          deviceId: entry.saved.id,
+          stableId: entry.saved.stableId,
+          type: String(entry.saved.type),
+          attempts: entry.attempts,
+          lastError: entry.lastError,
+          failedAt: this.#now()
+        }));
+        for (const failure of terminal) this.#onPermanentFailure(failure);
+        return terminal;
+      }
+      /** One retry round: parents first (phase 0), then hub-adopted
+      *  children (phase 1) — a child's attempt depends on its parent
+      *  having landed, exactly like the initial two-pass restore. */
+      async #runRound(pending, round) {
+        const next = [];
+        const parents = pending.filter((entry) => entry.saved.parentDeviceId === null);
+        const children = pending.filter((entry) => entry.saved.parentDeviceId !== null);
+        for (const phase of [parents, children]) await runWithConcurrency(phase, this.#concurrency, async (entry) => {
+          if (this.#abort.signal.aborted) {
+            next.push(entry);
+            return;
+          }
+          const attemptNo = entry.attempts + 1;
+          try {
+            await this.#attempt(entry.saved);
+            this.#logger.info("Device restored on retry", {
+              tags: {
+                deviceId: entry.saved.id,
+                stableId: entry.saved.stableId
+              },
+              meta: { attempt: attemptNo }
+            });
+          } catch (err) {
+            const lastError = err instanceof Error ? err.message : String(err);
+            const remainingRetries = this.#delaysMs.length - (round + 1);
+            this.#logger.warn("Device restore retry failed", {
+              tags: {
+                deviceId: entry.saved.id,
+                stableId: entry.saved.stableId
+              },
+              meta: {
+                attempt: attemptNo,
+                remainingRetries,
+                error: lastError
+              }
+            });
+            next.push({
+              saved: entry.saved,
+              lastError,
+              attempts: attemptNo
+            });
+          }
+        });
+        return next;
+      }
+    };
     function toDeviceSummary(device2, addonId) {
       const config = {};
       for (const entry of device2.config.entries()) config[entry.key] = entry.value;
@@ -238348,6 +239490,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         }];
       }
       async onShutdown() {
+        this.cancelRestoreRetries();
         const devices = await this.ctx.kernel.devices?.getAll() ?? [];
         for (const device2 of devices) try {
           await this.ctx.kernel.devices?.decommission(device2.id);
@@ -238367,9 +239510,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       async stop() {
       }
       async getStatus() {
+        const all = await this.ctx.kernel.devices?.getAll() ?? [];
+        const summary = this.restoreFailureSummary();
+        if (summary === null) return {
+          connected: true,
+          deviceCount: all.length
+        };
         return {
           connected: true,
-          deviceCount: (await this.ctx.kernel.devices?.getAll() ?? []).length
+          deviceCount: all.length,
+          error: summary
         };
       }
       async getDevices() {
@@ -238459,8 +239609,137 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         };
       }
       async restoreDevices(savedDevices) {
-        await this.onRestoreDevices(savedDevices);
-        if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
+        const report = await this.onRestoreDevices(savedDevices);
+        if (savedDevices.length === 0) return;
+        if (report && report.failedCount > 0) {
+          this.ctx.logger.warn(`Restored ${report.restoredCount}/${savedDevices.length} ${this.providerName} device(s) \u2014 ${report.failedCount} failed, bounded retry scheduled`);
+          return;
+        }
+        const restoredCount = report ? report.restoredCount : savedDevices.length;
+        this.ctx.logger.info(`Restored ${restoredCount} ${this.providerName} device(s)`);
+      }
+      /** Retry schedule. Overridable (tests use millisecond delays). */
+      restoreRetryDelaysMs = DEVICE_RESTORE_RETRY_DELAYS_MS;
+      /** Retry lane width. See `device-restore-retry.ts` for why retries
+      *  never re-stampede full-width while the initial pass does (D167). */
+      restoreRetryConcurrency = 4;
+      _restoreRetryScheduler = null;
+      _restoreRetryCompletion = null;
+      _permanentRestoreFailures = /* @__PURE__ */ new Map();
+      /** Settles when the background retry rounds finish (or `null` when
+      *  nothing failed). Exposed for tests and subclass diagnostics —
+      *  boot NEVER awaits this: the runner's post-init handshake goes out
+      *  with the devices that restored, and a late success is announced
+      *  through the `native-cap-change` → `updateCaps` path. */
+      get restoreRetryCompletion() {
+        return this._restoreRetryCompletion;
+      }
+      /** Devices that exhausted the retry bound this process lifetime. */
+      get permanentRestoreFailures() {
+        return [...this._permanentRestoreFailures.values()];
+      }
+      /** One-line operator-facing summary for `getStatus().error`, or
+      *  `null` when every device restored. */
+      restoreFailureSummary() {
+        if (this._permanentRestoreFailures.size === 0) return null;
+        const ids = [...this._permanentRestoreFailures.keys()].join(", ");
+        return `${this._permanentRestoreFailures.size} device(s) permanently failed restore (deviceIds: ${ids}) \u2014 restart the ${this.providerName} provider to retry`;
+      }
+      cancelRestoreRetries() {
+        this._restoreRetryScheduler?.cancel();
+        this._restoreRetryScheduler = null;
+      }
+      recordPermanentRestoreFailure(failure) {
+        this._permanentRestoreFailures.set(failure.deviceId, failure);
+        this.ctx.logger.error("Device restore permanently failed \u2014 its capabilities will not register until the provider restarts", {
+          tags: {
+            deviceId: failure.deviceId,
+            stableId: failure.stableId
+          },
+          meta: {
+            type: failure.type,
+            attempts: failure.attempts,
+            error: failure.lastError
+          }
+        });
+      }
+      scheduleRestoreRetries(failures, attempt) {
+        const scheduler2 = new DeviceRestoreRetryScheduler({
+          logger: this.ctx.logger,
+          delaysMs: this.restoreRetryDelaysMs,
+          concurrency: this.restoreRetryConcurrency,
+          attempt,
+          onPermanentFailure: (failure) => this.recordPermanentRestoreFailure(failure)
+        });
+        this._restoreRetryScheduler = scheduler2;
+        this._restoreRetryCompletion = scheduler2.run(failures).then(() => void 0).catch((err) => {
+          this.ctx.logger.error("Restore retry scheduler crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+        });
+      }
+      /**
+      * Tear down and reconstruct ONE device from its persisted rows — the
+      * `deviceProvider.reloadDevice` cap method. Persistence is never touched,
+      * and no other device this provider owns is disturbed.
+      *
+      * Keyed by `stableId` because the caller's whole reason to be here is that
+      * the NUMERIC id changed (`deviceManager.migrateDevice` swapped it): the
+      * fresh instance resolves its id through `allocateDeviceId`, which returns
+      * whatever number the row carries NOW. The teardown is `decommission` —
+      * exactly what a graceful shutdown runs per device (fires `removeDevice()`,
+      * unregisters native caps, drops the registry entry) — and the rebuild is
+      * the boot restore's own `create()` path, including its pass 2: first-class
+      * children (hub-adopted cameras under an NVR) are decommissioned with the
+      * parent by the cascade and must be re-created explicitly, because only
+      * accessory children come back through `getAccessoryChildren()`.
+      *
+      * Reloading an accessory child directly is refused (no device class) —
+      * reload its parent instead.
+      */
+      async reloadDevice(input) {
+        const { stableId } = input;
+        const devices = this.ctx.kernel.devices;
+        if (!devices) throw new Error(`${this.providerName}: kernel.devices unavailable \u2014 cannot reload`);
+        const live = (await devices.getAll()).find((d) => d.stableId === stableId);
+        if (live) await devices.decommission(live.id);
+        const { id } = await this.ctx.api.deviceManager.allocateDeviceId.mutate({
+          addonId: this.addonId,
+          stableId
+        });
+        const meta = await this.ctx.api.deviceManager.loadMeta.query({ deviceId: id });
+        if (meta === null) throw new Error(`${this.providerName}: no persisted meta for "${stableId}" (id ${id}) \u2014 cannot reload`);
+        const deviceType = Object.values(require_sleep.DeviceType).find((t) => t === meta.type);
+        const Class = deviceType !== void 0 ? this.deviceClasses[deviceType] : void 0;
+        if (!Class) throw new Error(`${this.providerName}: no device class for type "${meta.type}" \u2014 "${stableId}" is an accessory child; reload its parent instead`);
+        await devices.create(stableId, Class, {}, meta.parentDeviceId ?? null);
+        const rows = await this.ctx.api.deviceManager.listPersistedByAddon.query({ addonId: this.addonId });
+        for (const row of rows) {
+          if (row.parentDeviceId !== id) continue;
+          const childType = Object.values(require_sleep.DeviceType).find((t) => t === row.type);
+          const ChildClass = childType !== void 0 ? this.deviceClasses[childType] : void 0;
+          if (!ChildClass) continue;
+          try {
+            await devices.create(row.stableId, ChildClass, {}, id);
+          } catch (err) {
+            this.ctx.logger.warn("reloadDevice: failed to re-create first-class child", {
+              tags: {
+                deviceId: row.id,
+                stableId: row.stableId
+              },
+              meta: {
+                parentDeviceId: id,
+                error: err instanceof Error ? err.message : String(err)
+              }
+            });
+          }
+        }
+        this.ctx.logger.info("device reloaded in place from persisted rows", {
+          tags: { deviceId: id },
+          meta: {
+            stableId,
+            type: meta.type
+          }
+        });
+        return { deviceId: id };
       }
       /**
       * Restore devices from persisted state. Two-pass:
@@ -238486,55 +239765,108 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * accessory-spawn flow handles via the parent's
       * `getAccessoryChildren()`. Override only when the default doesn't
       * fit.
+      *
+      * A row that fails either pass is NOT terminal (D347): it is handed
+      * to a bounded background retry (`DeviceRestoreRetryScheduler`).
+      * Only after the bound is exhausted is the device marked permanently
+      * failed — logged at ERROR with `tags.deviceId` and surfaced via
+      * `getStatus().error`.
       */
       async onRestoreDevices(savedDevices) {
         const restored = /* @__PURE__ */ new Set();
+        const failures = [];
+        const attemptRestore = async (saved) => {
+          if (restored.has(saved.id)) return;
+          const Class = this.deviceClasses[saved.type];
+          if (!Class) throw new Error(`no device class registered for type "${saved.type}"`);
+          if (saved.parentDeviceId !== null && !restored.has(saved.parentDeviceId)) throw new Error(`parent device ${saved.parentDeviceId} not restored`);
+          await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
+          restored.add(saved.id);
+        };
         const topLevel = savedDevices.filter((saved) => saved.parentDeviceId === null);
         const restoreOne = async (saved) => {
-          const Class = this.deviceClasses[saved.type];
-          if (!Class) {
+          if (!this.deviceClasses[saved.type]) {
             this.ctx.logger.warn("No device class registered for restored type \u2014 skipping", {
-              tags: { stableId: saved.stableId },
+              tags: {
+                deviceId: saved.id,
+                stableId: saved.stableId
+              },
               meta: { type: saved.type }
             });
             return;
           }
           try {
-            await this.ctx.kernel.devices.create(saved.stableId, Class, {});
-            restored.add(saved.id);
+            await attemptRestore(saved);
           } catch (err) {
-            this.ctx.logger.warn("Failed to restore device", {
-              tags: { stableId: saved.stableId },
+            const error = err instanceof Error ? err.message : String(err);
+            this.ctx.logger.warn("Failed to restore device \u2014 bounded retry scheduled", {
+              tags: {
+                deviceId: saved.id,
+                stableId: saved.stableId
+              },
               meta: {
                 type: saved.type,
-                error: err instanceof Error ? err.message : String(err)
+                attempt: 1,
+                error
               }
             });
+            failures.push({
+              saved,
+              error
+            });
           }
         };
         await Promise.all(topLevel.map((saved) => restoreOne(saved)));
+        const failedTopLevelIds = new Set(failures.map((failure) => failure.saved.id));
         const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
         for (const saved of childRows) {
-          const Class = this.deviceClasses[saved.type];
-          if (!Class) continue;
+          if (!this.deviceClasses[saved.type]) continue;
           if (saved.parentDeviceId === null) continue;
-          if (!restored.has(saved.parentDeviceId)) continue;
-          try {
-            await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
-            restored.add(saved.id);
-          } catch (err) {
-            this.ctx.logger.warn("Failed to restore hub-adopted child", {
+          if (restored.has(saved.parentDeviceId)) {
+            try {
+              await attemptRestore(saved);
+            } catch (err) {
+              const error = err instanceof Error ? err.message : String(err);
+              this.ctx.logger.warn("Failed to restore hub-adopted child \u2014 bounded retry scheduled", {
+                tags: {
+                  deviceId: saved.id,
+                  stableId: saved.stableId,
+                  parentDeviceId: saved.parentDeviceId
+                },
+                meta: {
+                  type: saved.type,
+                  attempt: 1,
+                  error
+                }
+              });
+              failures.push({
+                saved,
+                error
+              });
+            }
+            continue;
+          }
+          if (failedTopLevelIds.has(saved.parentDeviceId)) {
+            this.ctx.logger.warn("Hub-adopted child deferred \u2014 parent failed initial restore", {
               tags: {
+                deviceId: saved.id,
                 stableId: saved.stableId,
                 parentDeviceId: saved.parentDeviceId
               },
-              meta: {
-                type: saved.type,
-                error: err instanceof Error ? err.message : String(err)
-              }
+              meta: { type: saved.type }
             });
+            failures.push({
+              saved,
+              error: `parent device ${saved.parentDeviceId} not restored`
+            });
+            continue;
           }
         }
+        if (failures.length > 0) this.scheduleRestoreRetries(failures, attemptRestore);
+        return {
+          restoredCount: restored.size,
+          failedCount: failures.length
+        };
       }
       /** Convert an IDevice to the flat DeviceSummary for the cap router. */
       toSummary(device2) {
@@ -241376,6 +242708,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "backup.cancel": {
+        capName: "backup",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "backup.delete": {
         capName: "backup",
         capScope: "system",
@@ -241418,6 +242756,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "backup.listRuns": {
+        capName: "backup",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "backup.listSchedules": {
         capName: "backup",
         capScope: "system",
@@ -242618,6 +243962,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "deviceProvider.reloadDevice": {
+        capName: "device-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "deviceProvider.start": {
         capName: "device-provider",
         capScope: "system",
@@ -245984,6 +247334,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "streamBroker.forgetDeviceHardware": {
+        capName: "stream-broker",
+        capScope: "system",
+        addonId: null,
+        access: "delete"
+      },
       "streamBroker.getAllRtspEntries": {
         capName: "stream-broker",
         capScope: "system",
@@ -248700,6 +250056,11 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         form: "single",
         optional: false
       }],
+      "streamBroker.forgetDeviceHardware": [{
+        name: "deviceId",
+        form: "single",
+        optional: false
+      }],
       "streamBroker.getDeviceAudioMute": [{
         name: "deviceId",
         form: "single",
@@ -249071,6 +250432,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       "recordingExport.listExports",
       "streamBroker.acquireEgressTranscode",
       "streamBroker.assignProfile",
+      "streamBroker.forgetDeviceHardware",
       "streamBroker.getDeviceAudioMute",
       "streamBroker.getStreamWithCodec",
       "streamBroker.produceEventMedia",
@@ -249569,6 +250931,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         backup: {
           listDestinations: (input) => dispatch("backup", "listDestinations", "query", input),
           trigger: (input) => dispatch("backup", "trigger", "mutation", input),
+          listRuns: (input) => dispatch("backup", "listRuns", "query", input),
+          cancel: (input) => dispatch("backup", "cancel", "mutation", input),
           list: (input) => dispatch("backup", "list", "query", input),
           listLocations: (input) => dispatch("backup", "listLocations", "query", input),
           getEntries: (input) => dispatch("backup", "getEntries", "query", input),
@@ -252848,6 +254212,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.BacklightModeSchema = BacklightModeSchema;
     exports.BackupDestinationInfoSchema = BackupDestinationInfoSchema;
     exports.BackupEntrySchema = BackupEntrySchema;
+    exports.BackupRunPhaseSchema = BackupRunPhaseSchema;
+    exports.BackupRunSchema = BackupRunSchema;
+    exports.BackupRunStateSchema = BackupRunStateSchema;
+    exports.BackupTriggerResultSchema = BackupTriggerResultSchema;
     exports.BaseAddon = require_sleep.BaseAddon;
     exports.BaseDevice = BaseDevice;
     exports.BaseDeviceProvider = BaseDeviceProvider;
@@ -253004,6 +254372,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
     exports.DEVICE_CHILDREN_BATCH_MAX = DEVICE_CHILDREN_BATCH_MAX;
     exports.DEVICE_PROFILES = DEVICE_PROFILES;
+    exports.DEVICE_RESTORE_RETRY_CONCURRENCY = DEVICE_RESTORE_RETRY_CONCURRENCY;
+    exports.DEVICE_RESTORE_RETRY_DELAYS_MS = DEVICE_RESTORE_RETRY_DELAYS_MS;
     exports.DEVICE_SCOPED_CAPS = require_sleep.DEVICE_SCOPED_CAPS;
     exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_sleep.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
     exports.DEVICE_STATE_READERS = DEVICE_STATE_READERS;
@@ -253033,6 +254403,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DeviceFeature = require_sleep.DeviceFeature;
     exports.DeviceInfoSchema = DeviceInfoSchema;
     exports.DeviceNetworkStatsSchema = DeviceNetworkStatsSchema;
+    exports.DeviceRestoreRetryScheduler = DeviceRestoreRetryScheduler;
     exports.DeviceRole = require_sleep.DeviceRole;
     exports.DeviceRuntimeState = DeviceRuntimeState;
     exports.DeviceSelectorSchema = DeviceSelectorSchema;
@@ -387819,6 +389190,16 @@ var require_main2 = __commonJS({
         installSource: resolvedSource
       });
       await installer.ensureRequiredPackages(system_1.AddonInstaller.AGENT_PACKAGES);
+      if (typeof installer.ensureAddonRuntimeDeps === "function") {
+        try {
+          const depsResult = await installer.ensureAddonRuntimeDeps();
+          if (depsResult.linked.length > 0 || depsResult.reinstalled.length > 0 || depsResult.failed.length > 0) {
+            console.log(`[Agent] Addon runtime deps ensured \u2014 linked: [${depsResult.linked.join(", ")}], reinstalled: [${depsResult.reinstalled.join(", ")}], failed: [${depsResult.failed.join(", ")}] (${depsResult.checked} checked)`);
+          }
+        } catch (err) {
+          console.warn(`[Agent] ensureAddonRuntimeDeps failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
       console.log(`[Agent] Addon packages ready in ${config.addonsDir}`);
       let broker = (0, system_1.createBroker)({
         nodeID: config.nodeId,
@@ -427674,6 +429055,18 @@ var require_launcher = __commonJS({
         console.warn(`[launcher] first-boot addon plan failed: ${err instanceof Error ? err.message : String(err)}`);
       }
       await installer.ensureRequiredPackages(bootstrapRequired);
+      if (typeof installer.ensureAddonRuntimeDeps === "function") {
+        try {
+          const depsResult = await installer.ensureAddonRuntimeDeps();
+          if (depsResult.linked.length > 0 || depsResult.reinstalled.length > 0 || depsResult.failed.length > 0) {
+            console.log(`[launcher] Addon runtime deps ensured \u2014 linked: [${depsResult.linked.join(", ")}], reinstalled: [${depsResult.reinstalled.join(", ")}], failed: [${depsResult.failed.join(", ")}] (${depsResult.checked} checked)`);
+          }
+        } catch (err) {
+          console.warn(`[launcher] ensureAddonRuntimeDeps failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      } else {
+        console.warn("[launcher] ensureAddonRuntimeDeps unavailable \u2014 skipping addon dep repair");
+      }
       if (typeof installer.reconcileManifest === "function") {
         const reconciled = installer.reconcileManifest();
         if (reconciled > 0) {