camstack 1.2.84 → 1.2.86

package/dist/{launcher-EQ3SI35Z.js → launcher-3OHBVI43.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-TEwQZL3g.js
-var require_dist_TEwQZL3g = __commonJS({
-  "../system/dist/dist-TEwQZL3g.js"(exports) {
+// ../system/dist/dist-D8VIyu_0.js
+var require_dist_D8VIyu_0 = __commonJS({
+  "../system/dist/dist-D8VIyu_0.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -31077,7 +31077,26 @@ var require_dist_TEwQZL3g = __commonJS({
       * identity ahead of adoption. Rendering metadata (unit, precision)
       * flows live through the cap STATUS SLICE after adoption.
       */
-      sourceInfo: SourceInfoSchema.optional()
+      sourceInfo: SourceInfoSchema.optional(),
+      /**
+      * Set when this candidate is a device the provider ALREADY owns.
+      *
+      * A scan cannot generally produce the identity a device was onboarded under
+      * (Reolink keys on `mac-<mac>`, learned at adopt time), so a stableId
+      * comparison never matches and an owned device looks addable. Re-adopting one
+      * overwrites its config with scan-derived values — that is how a Home Hub's
+      * Baichuan port was overwritten with its ONVIF port, taking the hub and its
+      * three child cameras offline for four hours.
+      *
+      * A provider that can recognise its own devices says so here. Absent means
+      * "not recognised", which is not the same as "known to be new" — a provider
+      * that cannot tell simply never sets it.
+      */
+      alreadyOnboarded: zod.z.boolean().optional(),
+      /** Numeric id of the device this candidate was matched to. Set with `alreadyOnboarded`. */
+      onboardedDeviceId: zod.z.number().optional(),
+      /** Operator-facing name of the matched device, so the UI can say WHICH one it is. */
+      onboardedName: zod.z.string().optional()
     });
     var DeviceSummarySchema = zod.z.object({
       id: zod.z.number(),
@@ -31114,6 +31133,35 @@ var require_dist_TEwQZL3g = __commonJS({
           name: zod.z.string(),
           type: zod.z.string()
         }))),
+        /**
+        * Tear down and reconstruct ONE device in place from its persisted rows —
+        * touching no other device this provider owns.
+        *
+        * The primitive `deviceManager.migrateDevice` uses to flush the two
+        * migrated numbers: after `swapIds` the runner's live instance still
+        * carries the PRE-swap numeric id (baked into the object, its native-cap
+        * registrations and its log tags), and a live object cannot be renumbered.
+        * Before this method the only flush was restarting the whole owning addon
+        * — which took every camera the provider owns down with it (28 devices
+        * for one migrated camera, measured 2026-09-04, and the morning of the
+        * same day ~27 devices' native caps did not come back on their own).
+        *
+        * Keyed by `stableId`, deliberately: the numeric id is exactly the thing
+        * that changes. The reply carries the id the device answers on NOW.
+        * Implemented once in `BaseDeviceProvider` — decommission the live
+        * instance (if any), then re-create from the persisted row: the same
+        * teardown/rehydrate pair every graceful shutdown + boot already uses.
+        * An RPC, never an event: a dropped event would leave the runner writing
+        * against the wrong camera (D8).
+        *
+        * Construction can dial hardware, and the migrated source is
+        * characteristically dead — the timeout covers a full activate window
+        * rather than the 60 s default.
+        */
+        reloadDevice: method(zod.z.object({ stableId: zod.z.string() }), zod.z.object({ deviceId: zod.z.number() }), {
+          kind: "mutation",
+          timeoutMs: 3 * 6e4
+        }),
         supportsDiscovery: method(zod.z.object({}), zod.z.boolean()),
         /**
         * Run a network scan. `params` carries optional provider-specific scan
@@ -31434,13 +31482,21 @@ var require_dist_TEwQZL3g = __commonJS({
         * `sourceStillLive` names what stayed live; empty is the only value that
         * means the old hardware is quiet. The migration proceeds either way —
         * refusing would refuse the case this exists for.
+        *
+        * **Safe to retry.** A duplicate call while a migration involving either
+        * device is in flight is REFUSED, never queued; a repeat of a swap that
+        * already completed (matched against the `addonId`/`stableId` fingerprint
+        * the swap left on the rows, within 15 min) is a no-op returning the
+        * original report. A blind re-run can no longer silently undo the
+        * migration it retried.
         */
         migrateDevice: method(zod.z.object({
           sourceId: zod.z.number(),
           targetId: zod.z.number()
         }), MigrateDeviceResultSchema, {
           kind: "mutation",
-          auth: "admin"
+          auth: "admin",
+          timeoutMs: 12 * 6e4
         }),
         /** Register a device in the DB + in-memory registry. Called by DeviceManagerApi.register(). */
         registerDevice: method(DeviceRegisterPayloadSchema, zod.z.void(), { kind: "mutation" }),
@@ -52508,6 +52564,12 @@ var require_dist_TEwQZL3g = __commonJS({
         addonId: null,
         access: "view"
       },
+      "deviceProvider.reloadDevice": {
+        capName: "device-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "deviceProvider.start": {
         capName: "device-provider",
         capScope: "system",
@@ -59999,7 +60061,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -60818,7 +60880,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -60912,7 +60974,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -61809,11 +61871,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-DauPtbFR.js
-var require_retired_settings_keys_DauPtbFR = __commonJS({
-  "../system/dist/retired-settings-keys-DauPtbFR.js"(exports) {
+// ../system/dist/retired-settings-keys-wakiINPT.js
+var require_retired_settings_keys_wakiINPT = __commonJS({
+  "../system/dist/retired-settings-keys-wakiINPT.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -64027,8 +64089,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
-    var require_retired_settings_keys = require_retired_settings_keys_DauPtbFR();
+    var require_dist10 = require_dist_D8VIyu_0();
+    var require_retired_settings_keys = require_retired_settings_keys_wakiINPT();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -65504,7 +65566,10 @@ var require_device_manager_addon = __commonJS({
         stableId: d.stableId,
         type: d.type,
         suggestedName: d.suggestedName,
-        prefilledConfig: d.prefilledConfig
+        prefilledConfig: d.prefilledConfig,
+        ...d.alreadyOnboarded === true ? { alreadyOnboarded: true } : {},
+        ...d.onboardedDeviceId !== void 0 ? { onboardedDeviceId: d.onboardedDeviceId } : {},
+        ...d.onboardedName !== void 0 ? { onboardedName: d.onboardedName } : {}
       }));
     }
     async function adoptDevice(pctx, input) {
@@ -66527,10 +66592,26 @@ var require_device_manager_addon = __commonJS({
         detail
       };
     }
+    async function setSwitchBounded(deps, deviceId, switchId, enabled) {
+      const budget = deps.switchTimeoutMs ?? 15e3;
+      const write = deps.setSwitch(deviceId, switchId, enabled);
+      write.catch(() => {
+      });
+      let timer;
+      try {
+        await Promise.race([write, new Promise((_resolve, reject) => {
+          timer = setTimeout(() => {
+            reject(/* @__PURE__ */ new Error(`switch write did not answer within ${budget}ms \u2014 reported unreachable; if it lands late, a duplicate write of the same value is a no-op`));
+          }, budget);
+        })]);
+      } finally {
+        if (timer !== void 0) clearTimeout(timer);
+      }
+    }
     async function applyAll(deps, deviceId, enabled) {
       const out = [];
       for (const switchId of require_dist10.CAMERA_SWITCH_ORDER) try {
-        await deps.setSwitch(deviceId, switchId, enabled);
+        await setSwitchBounded(deps, deviceId, switchId, enabled);
         out.push({
           deviceId,
           switchId,
@@ -66571,7 +66652,6 @@ var require_device_manager_addon = __commonJS({
         });
       }
       const up = await applyAll(deps, sourceId, true);
-      await deps.respawnRunners([sourceId, targetId]);
       deps.log("camera migrated", {
         sourceId,
         targetId,
@@ -66586,6 +66666,50 @@ var require_device_manager_addon = __commonJS({
         swapped: true
       };
     }
+    async function reloadMigratedDevices(pctx, targets) {
+      const ctx = pctx.host.ctx;
+      for (const target of targets) {
+        pctx.metaStore.idToAddonId.set(target.deviceId, target.addonId);
+        pctx.host.remoteNativeCaps.delete(target.deviceId);
+        pctx.host.capabilityRegistry?.unregisterAllNativeForDevice(target.deviceId);
+      }
+      const fallbackAddons = /* @__PURE__ */ new Map();
+      await Promise.all(targets.map(async (target) => {
+        try {
+          const reloaded = await (await pctx.host.requireDeviceProvider(target.addonId)).reloadDevice({ stableId: target.stableId });
+          ctx.logger.info("migration: device reloaded in place \u2014 no other device disturbed", {
+            tags: { deviceId: target.deviceId },
+            meta: {
+              addonId: target.addonId,
+              stableId: target.stableId,
+              reloadedAs: reloaded.deviceId
+            }
+          });
+        } catch (err) {
+          ctx.logger.error("migration: in-place reload FAILED \u2014 falling back to a provider restart", {
+            tags: { deviceId: target.deviceId },
+            meta: {
+              addonId: target.addonId,
+              stableId: target.stableId,
+              error: err instanceof Error ? err.message : String(err)
+            }
+          });
+          fallbackAddons.set(target.addonId, target.deviceId);
+        }
+      }));
+      if (fallbackAddons.size === 0) return;
+      await Promise.all([...fallbackAddons.entries()].map(async ([addonId, migratedDeviceId]) => {
+        const owned = [...pctx.metaStore.idToAddonId.entries()].filter(([, a]) => a === addonId).length;
+        ctx.logger.info("migration: restarting a whole provider to flush the id maps", {
+          tags: { deviceId: migratedDeviceId },
+          meta: {
+            addonId,
+            devicesTakenDown: owned
+          }
+        });
+        await ctx.api.addons.restartAddon.mutate({ addonId });
+      }));
+    }
     var PROFILE_MAP_CONFIG_KEY = "_profileMap";
     var ROLE_SCOPED_CONFIG_KEYS = new Set(DEVICE_STORE_SECTIONS.flatMap((section) => [...section.keys]));
     function splitConfig(config) {
@@ -66674,68 +66798,110 @@ var require_device_manager_addon = __commonJS({
     async function migrateDevice(pctx, input) {
       const { sourceId, targetId } = input;
       const ctx = pctx.host.ctx;
-      return await pctx.metaStore.withMetaWriteLock(async () => {
-        for (const id of [sourceId, targetId]) if (await pctx.metaStore.rows.get(id) === null) throw new Error(`[device-manager] migrateDevice: device ${id} does not exist`);
-        const tempId = await pctx.metaStore.allocateNextDeviceId();
-        return await migrateDevice$1({
-          setSwitch: async (deviceId, switchId, enabled) => {
-            await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
-              deviceId,
-              switchId,
-              enabled
-            });
-          },
-          swapIds: async (a, b) => {
-            await pctx.metaStore.rows.swapIds(a, b, tempId);
-          },
-          swapHardwareState: async (a, b) => {
-            const swapped = await swapHardwareState(pctx.settings, a, b);
-            pctx.host.seedMirror(a, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtSource));
-            pctx.host.seedMirror(b, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtTarget));
-            ctx.logger.info("migration: hardware-scoped device state swapped", {
-              tags: { deviceId: a },
+      pctx.migrationGuard.begin(sourceId, targetId);
+      try {
+        const outcome = await pctx.metaStore.withMetaWriteLock(async () => {
+          const sourceRow = await pctx.metaStore.rows.get(sourceId);
+          if (sourceRow === null) throw new Error(`[device-manager] migrateDevice: device ${sourceId} does not exist`);
+          const targetRow = await pctx.metaStore.rows.get(targetId);
+          if (targetRow === null) throw new Error(`[device-manager] migrateDevice: device ${targetId} does not exist`);
+          const replay = pctx.migrationGuard.matchReplay(sourceId, targetId, {
+            addonId: sourceRow.meta.addonId,
+            stableId: sourceRow.meta.stableId
+          }, {
+            addonId: targetRow.meta.addonId,
+            stableId: targetRow.meta.stableId
+          });
+          if (replay !== null) {
+            ctx.logger.info("migrateDevice: this swap already completed \u2014 replaying the original report, NOTHING re-run", {
+              tags: { deviceId: sourceId },
               meta: {
-                sourceId: a,
-                targetId: b,
-                hardwareKeysToSource: swapped.hardwareKeysToSource,
-                hardwareKeysToTarget: swapped.hardwareKeysToTarget,
-                roleKeysKeptAtSource: swapped.roleKeysKeptAtSource,
-                roleKeysKeptAtTarget: swapped.roleKeysKeptAtTarget
+                sourceId,
+                targetId
               }
             });
-          },
-          forgetStreamState: async (deviceId) => {
-            await ctx.api.streamBroker.forgetDeviceHardware.mutate({ deviceId });
-          },
-          respawnRunners: async (deviceIds) => {
-            const owners = /* @__PURE__ */ new Set();
-            for (const deviceId of deviceIds) {
-              const addonId = pctx.metaStore.idToAddonId.get(deviceId);
-              if (addonId !== void 0) owners.add(addonId);
-            }
-            for (const addonId of owners) {
-              const owned = [...pctx.metaStore.idToAddonId.entries()].filter(([, a]) => a === addonId).length;
-              ctx.logger.info("migration: restarting a whole provider to flush the id maps", {
-                tags: { deviceId: sourceId },
+            return {
+              result: replay,
+              reloadTargets: null
+            };
+          }
+          const tempId = await pctx.metaStore.allocateNextDeviceId();
+          const result = await migrateDevice$1({
+            setSwitch: async (deviceId, switchId, enabled) => {
+              if (switchId === "stream-broker") {
+                const moved = await writeDisabledFlagUnderLock(pctx, deviceId, !enabled);
+                emitDisabledEvents(pctx, deviceId, !enabled, moved);
+                return;
+              }
+              await ctx.api.pipelineOrchestrator.setCameraSwitch.mutate({
+                deviceId,
+                switchId,
+                enabled
+              });
+            },
+            swapIds: async (a, b) => {
+              await pctx.metaStore.rows.swapIds(a, b, tempId);
+            },
+            swapHardwareState: async (a, b) => {
+              const swapped = await swapHardwareState(pctx.settings, a, b);
+              pctx.host.seedMirror(a, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtSource));
+              pctx.host.seedMirror(b, pctx.host.withResetSessionProbe(swapped.runtimeStateNowAtTarget));
+              ctx.logger.info("migration: hardware-scoped device state swapped", {
+                tags: { deviceId: a },
                 meta: {
-                  addonId,
-                  devicesTakenDown: owned
+                  sourceId: a,
+                  targetId: b,
+                  hardwareKeysToSource: swapped.hardwareKeysToSource,
+                  hardwareKeysToTarget: swapped.hardwareKeysToTarget,
+                  roleKeysKeptAtSource: swapped.roleKeysKeptAtSource,
+                  roleKeysKeptAtTarget: swapped.roleKeysKeptAtTarget
                 }
               });
-              await ctx.api.addons.restartAddon.mutate({ addonId });
+            },
+            forgetStreamState: async (deviceId) => {
+              await ctx.api.streamBroker.forgetDeviceHardware.mutate({ deviceId });
+            },
+            log: (message, meta) => {
+              ctx.logger.info(message, {
+                tags: { deviceId: sourceId },
+                meta
+              });
             }
-          },
-          log: (message, meta) => {
-            ctx.logger.info(message, {
-              tags: { deviceId: sourceId },
-              meta
-            });
-          }
-        }, {
-          sourceId,
-          targetId
+          }, {
+            sourceId,
+            targetId
+          });
+          pctx.migrationGuard.recordCompleted({
+            sourceId,
+            targetId,
+            identityAtSource: {
+              addonId: targetRow.meta.addonId,
+              stableId: targetRow.meta.stableId
+            },
+            identityAtTarget: {
+              addonId: sourceRow.meta.addonId,
+              stableId: sourceRow.meta.stableId
+            },
+            result
+          });
+          return {
+            result,
+            reloadTargets: [{
+              deviceId: sourceId,
+              addonId: targetRow.meta.addonId,
+              stableId: targetRow.meta.stableId
+            }, {
+              deviceId: targetId,
+              addonId: sourceRow.meta.addonId,
+              stableId: sourceRow.meta.stableId
+            }]
+          };
         });
-      });
+        if (outcome.reloadTargets !== null) await reloadMigratedDevices(pctx, outcome.reloadTargets);
+        return outcome.result;
+      } finally {
+        pctx.migrationGuard.end(sourceId, targetId);
+      }
     }
     async function registerDevice(pctx, input) {
       const { addonId, stableId, id, type, name, parentDeviceId, features, config } = input;
@@ -67256,18 +67422,17 @@ var require_device_manager_addon = __commonJS({
         }
       });
     }
-    async function setDisabled(pctx, input) {
-      const { deviceId, disabled } = input;
-      const moved = await pctx.metaStore.withMetaWriteLock(async () => {
-        const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-        if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
-        const { meta: m } = persisted;
-        await pctx.metaStore.rows.patch(deviceId, { disabled });
-        return {
-          changed: (m.disabled ?? false) !== disabled,
-          integrationId: m.integrationId ?? ""
-        };
-      });
+    async function writeDisabledFlagUnderLock(pctx, deviceId, disabled) {
+      const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+      if (!persisted) throw new Error(`[device-manager] setDisabled: unknown device id=${deviceId}`);
+      const { meta: m } = persisted;
+      await pctx.metaStore.rows.patch(deviceId, { disabled });
+      return {
+        changed: (m.disabled ?? false) !== disabled,
+        integrationId: m.integrationId ?? ""
+      };
+    }
+    function emitDisabledEvents(pctx, deviceId, disabled, moved) {
       pctx.host.ctx.eventBus.emit({
         id: (0, node_crypto.randomUUID)(),
         timestamp: /* @__PURE__ */ new Date(),
@@ -67297,6 +67462,10 @@ var require_device_manager_addon = __commonJS({
         }
       });
     }
+    async function setDisabled(pctx, input) {
+      const { deviceId, disabled } = input;
+      emitDisabledEvents(pctx, deviceId, disabled, await pctx.metaStore.withMetaWriteLock(() => writeDisabledFlagUnderLock(pctx, deviceId, disabled)));
+    }
     async function loadRuntimeState(pctx, input) {
       const { deviceId } = input;
       if (!await pctx.metaStore.resolvePersistedById(deviceId)) return {};
@@ -68677,6 +68846,42 @@ var require_device_manager_addon = __commonJS({
       };
       return resolveRemoteNativeCapFromRegistry(pctx.bindingsDeps, capName, deviceId);
     }
+    function sameIdentity(a, b) {
+      return a.addonId === b.addonId && a.stableId === b.stableId;
+    }
+    function createMigrationGuard(now = Date.now) {
+      const inFlight = /* @__PURE__ */ new Set();
+      const completed = /* @__PURE__ */ new Map();
+      const pairKey = (sourceId, targetId) => `${sourceId}->${targetId}`;
+      return {
+        begin(sourceId, targetId) {
+          for (const id of [sourceId, targetId]) if (inFlight.has(id)) throw new Error(`[device-manager] migrateDevice: a migration involving device ${id} is already in flight \u2014 this call was refused, not queued. The running migration's report stands; re-read the device rows before retrying.`);
+          inFlight.add(sourceId);
+          inFlight.add(targetId);
+        },
+        end(sourceId, targetId) {
+          inFlight.delete(sourceId);
+          inFlight.delete(targetId);
+        },
+        recordCompleted(record) {
+          completed.set(pairKey(record.sourceId, record.targetId), {
+            ...record,
+            completedAt: now()
+          });
+        },
+        matchReplay(sourceId, targetId, atSource, atTarget) {
+          const key = pairKey(sourceId, targetId);
+          const record = completed.get(key);
+          if (record === void 0) return null;
+          if (now() - record.completedAt > 9e5) {
+            completed.delete(key);
+            return null;
+          }
+          if (!sameIdentity(record.identityAtSource, atSource) || !sameIdentity(record.identityAtTarget, atTarget)) return null;
+          return record.result;
+        }
+      };
+    }
     var DeviceManagerAddon = class extends require_dist10.BaseAddon {
       constructor() {
         super({});
@@ -68915,6 +69120,7 @@ var require_device_manager_addon = __commonJS({
           settings,
           registry,
           bindingsDeps: this.bindingsDeps,
+          migrationGuard: createMigrationGuard(),
           requireDeviceOps,
           stampIntegrationId: stampIntegrationId$1,
           get provider() {
@@ -69156,7 +69362,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -69293,7 +69499,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -69483,7 +69689,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -77296,7 +77502,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -77861,7 +78067,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -80445,7 +80651,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -81561,8 +81767,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
-    var require_retired_settings_keys = require_retired_settings_keys_DauPtbFR();
+    var require_dist10 = require_dist_D8VIyu_0();
+    var require_retired_settings_keys = require_retired_settings_keys_wakiINPT();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -84052,7 +84258,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var require_hub_cap_forward = require_hub_cap_forward_DmHNjbB0();
     var zod = require_zod();
     var node_crypto = __require("crypto");
@@ -87003,7 +87209,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -105064,7 +105270,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -107007,9 +107213,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-BDmIj1HV.js
-var require_sleep_BDmIj1HV = __commonJS({
-  "../types/dist/sleep-BDmIj1HV.js"(exports) {
+// ../types/dist/sleep-jdpPltQH.js
+var require_sleep_jdpPltQH = __commonJS({
+  "../types/dist/sleep-jdpPltQH.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -109933,6 +110139,7 @@ var require_sleep_BDmIj1HV = __commonJS({
           getDeviceLiveContribution: (input) => dispatchSystem("deviceManager", "getDeviceLiveContribution", "query", input),
           applyDeviceSettingsPatch: (input) => dispatchSystem("deviceManager", "applyDeviceSettingsPatch", "mutation", input)
         },
+        deviceProvider: { reloadDevice: (input) => dispatchSystem("deviceProvider", "reloadDevice", "mutation", input) },
         deviceState: {
           getSnapshot: (input) => dispatchSystem("deviceState", "getSnapshot", "query", input),
           getCapSlice: (input) => dispatchSystem("deviceState", "getCapSlice", "query", input),
@@ -110682,7 +110889,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_BDmIj1HV();
+    var require_sleep = require_sleep_jdpPltQH();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -117565,12 +117772,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-system-deps-BVIr3MYJ.js
-var require_manifest_system_deps_BVIr3MYJ = __commonJS({
-  "../system/dist/manifest-system-deps-BVIr3MYJ.js"(exports) {
+// ../system/dist/manifest-system-deps-BbP419V1.js
+var require_manifest_system_deps_BbP419V1 = __commonJS({
+  "../system/dist/manifest-system-deps-BbP419V1.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_TEwQZL3g();
+    require_dist_D8VIyu_0();
     require_hub_cap_forward_DmHNjbB0();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
@@ -129637,7 +129844,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_TEwQZL3g();
+    var require_dist10 = require_dist_D8VIyu_0();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -129664,7 +129871,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_system_deps = require_manifest_system_deps_BVIr3MYJ();
+    var require_manifest_system_deps = require_manifest_system_deps_BbP419V1();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -210754,7 +210961,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_BDmIj1HV();
+    var require_sleep = require_sleep_jdpPltQH();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -218062,7 +218269,26 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * identity ahead of adoption. Rendering metadata (unit, precision)
       * flows live through the cap STATUS SLICE after adoption.
       */
-      sourceInfo: SourceInfoSchema.optional()
+      sourceInfo: SourceInfoSchema.optional(),
+      /**
+      * Set when this candidate is a device the provider ALREADY owns.
+      *
+      * A scan cannot generally produce the identity a device was onboarded under
+      * (Reolink keys on `mac-<mac>`, learned at adopt time), so a stableId
+      * comparison never matches and an owned device looks addable. Re-adopting one
+      * overwrites its config with scan-derived values — that is how a Home Hub's
+      * Baichuan port was overwritten with its ONVIF port, taking the hub and its
+      * three child cameras offline for four hours.
+      *
+      * A provider that can recognise its own devices says so here. Absent means
+      * "not recognised", which is not the same as "known to be new" — a provider
+      * that cannot tell simply never sets it.
+      */
+      alreadyOnboarded: zod.z.boolean().optional(),
+      /** Numeric id of the device this candidate was matched to. Set with `alreadyOnboarded`. */
+      onboardedDeviceId: zod.z.number().optional(),
+      /** Operator-facing name of the matched device, so the UI can say WHICH one it is. */
+      onboardedName: zod.z.string().optional()
     });
     var DeviceSummarySchema = zod.z.object({
       id: zod.z.number(),
@@ -218099,6 +218325,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           name: zod.z.string(),
           type: zod.z.string()
         }))),
+        /**
+        * Tear down and reconstruct ONE device in place from its persisted rows —
+        * touching no other device this provider owns.
+        *
+        * The primitive `deviceManager.migrateDevice` uses to flush the two
+        * migrated numbers: after `swapIds` the runner's live instance still
+        * carries the PRE-swap numeric id (baked into the object, its native-cap
+        * registrations and its log tags), and a live object cannot be renumbered.
+        * Before this method the only flush was restarting the whole owning addon
+        * — which took every camera the provider owns down with it (28 devices
+        * for one migrated camera, measured 2026-09-04, and the morning of the
+        * same day ~27 devices' native caps did not come back on their own).
+        *
+        * Keyed by `stableId`, deliberately: the numeric id is exactly the thing
+        * that changes. The reply carries the id the device answers on NOW.
+        * Implemented once in `BaseDeviceProvider` — decommission the live
+        * instance (if any), then re-create from the persisted row: the same
+        * teardown/rehydrate pair every graceful shutdown + boot already uses.
+        * An RPC, never an event: a dropped event would leave the runner writing
+        * against the wrong camera (D8).
+        *
+        * Construction can dial hardware, and the migrated source is
+        * characteristically dead — the timeout covers a full activate window
+        * rather than the 60 s default.
+        */
+        reloadDevice: require_sleep.method(zod.z.object({ stableId: zod.z.string() }), zod.z.object({ deviceId: zod.z.number() }), {
+          kind: "mutation",
+          timeoutMs: 3 * 6e4
+        }),
         supportsDiscovery: require_sleep.method(zod.z.object({}), zod.z.boolean()),
         /**
         * Run a network scan. `params` carries optional provider-specific scan
@@ -218420,13 +218675,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * `sourceStillLive` names what stayed live; empty is the only value that
         * means the old hardware is quiet. The migration proceeds either way —
         * refusing would refuse the case this exists for.
+        *
+        * **Safe to retry.** A duplicate call while a migration involving either
+        * device is in flight is REFUSED, never queued; a repeat of a swap that
+        * already completed (matched against the `addonId`/`stableId` fingerprint
+        * the swap left on the rows, within 15 min) is a no-op returning the
+        * original report. A blind re-run can no longer silently undo the
+        * migration it retried.
         */
         migrateDevice: require_sleep.method(zod.z.object({
           sourceId: zod.z.number(),
           targetId: zod.z.number()
         }), MigrateDeviceResultSchema, {
           kind: "mutation",
-          auth: "admin"
+          auth: "admin",
+          timeoutMs: 12 * 6e4
         }),
         /** Register a device in the DB + in-memory registry. Called by DeviceManagerApi.register(). */
         registerDevice: require_sleep.method(DeviceRegisterPayloadSchema, zod.z.void(), { kind: "mutation" }),
@@ -239111,6 +239374,138 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
       }
     };
+    var DEVICE_RESTORE_RETRY_DELAYS_MS = [
+      1e4,
+      3e4,
+      9e4
+    ];
+    var DEVICE_RESTORE_RETRY_CONCURRENCY = 4;
+    function sleep$1(ms, signal) {
+      return new Promise((resolve) => {
+        if (signal.aborted) {
+          resolve();
+          return;
+        }
+        const onAbort = () => {
+          clearTimeout(timer);
+          resolve();
+        };
+        const timer = setTimeout(() => {
+          signal.removeEventListener("abort", onAbort);
+          resolve();
+        }, ms);
+        timer.unref?.();
+        signal.addEventListener("abort", onAbort, { once: true });
+      });
+    }
+    async function runWithConcurrency(items, width, fn) {
+      const queue = [...items];
+      const laneCount = Math.max(1, Math.min(width, queue.length));
+      const lane = async () => {
+        for (; ; ) {
+          const item = queue.shift();
+          if (item === void 0) return;
+          await fn(item);
+        }
+      };
+      await Promise.all(Array.from({ length: laneCount }, lane));
+    }
+    var DeviceRestoreRetryScheduler = class {
+      #logger;
+      #attempt;
+      #onPermanentFailure;
+      #delaysMs;
+      #concurrency;
+      #now;
+      #abort = new AbortController();
+      constructor(options) {
+        this.#logger = options.logger;
+        this.#attempt = options.attempt;
+        this.#onPermanentFailure = options.onPermanentFailure;
+        this.#delaysMs = options.delaysMs ?? DEVICE_RESTORE_RETRY_DELAYS_MS;
+        this.#concurrency = options.concurrency ?? 4;
+        this.#now = options.now ?? Date.now;
+      }
+      /** Stop retrying (shutdown). Pending entries are NOT marked
+      *  permanently failed — the next boot restores them from disk. */
+      cancel() {
+        this.#abort.abort();
+      }
+      /**
+      * Run the bounded retry rounds. Resolves when every entry has either
+      * restored, been marked permanently failed, or the scheduler was
+      * cancelled. Never rejects.
+      */
+      async run(initialFailures) {
+        let pending = initialFailures.map((failure) => ({
+          saved: failure.saved,
+          lastError: failure.error,
+          attempts: 1
+        }));
+        for (let round = 0; round < this.#delaysMs.length; round += 1) {
+          if (pending.length === 0 || this.#abort.signal.aborted) break;
+          await sleep$1(this.#delaysMs[round] ?? 0, this.#abort.signal);
+          if (this.#abort.signal.aborted) break;
+          pending = await this.#runRound(pending, round);
+        }
+        if (this.#abort.signal.aborted) return [];
+        const terminal = pending.map((entry) => ({
+          deviceId: entry.saved.id,
+          stableId: entry.saved.stableId,
+          type: String(entry.saved.type),
+          attempts: entry.attempts,
+          lastError: entry.lastError,
+          failedAt: this.#now()
+        }));
+        for (const failure of terminal) this.#onPermanentFailure(failure);
+        return terminal;
+      }
+      /** One retry round: parents first (phase 0), then hub-adopted
+      *  children (phase 1) — a child's attempt depends on its parent
+      *  having landed, exactly like the initial two-pass restore. */
+      async #runRound(pending, round) {
+        const next = [];
+        const parents = pending.filter((entry) => entry.saved.parentDeviceId === null);
+        const children = pending.filter((entry) => entry.saved.parentDeviceId !== null);
+        for (const phase of [parents, children]) await runWithConcurrency(phase, this.#concurrency, async (entry) => {
+          if (this.#abort.signal.aborted) {
+            next.push(entry);
+            return;
+          }
+          const attemptNo = entry.attempts + 1;
+          try {
+            await this.#attempt(entry.saved);
+            this.#logger.info("Device restored on retry", {
+              tags: {
+                deviceId: entry.saved.id,
+                stableId: entry.saved.stableId
+              },
+              meta: { attempt: attemptNo }
+            });
+          } catch (err) {
+            const lastError = err instanceof Error ? err.message : String(err);
+            const remainingRetries = this.#delaysMs.length - (round + 1);
+            this.#logger.warn("Device restore retry failed", {
+              tags: {
+                deviceId: entry.saved.id,
+                stableId: entry.saved.stableId
+              },
+              meta: {
+                attempt: attemptNo,
+                remainingRetries,
+                error: lastError
+              }
+            });
+            next.push({
+              saved: entry.saved,
+              lastError,
+              attempts: attemptNo
+            });
+          }
+        });
+        return next;
+      }
+    };
     function toDeviceSummary(device2, addonId) {
       const config = {};
       for (const entry of device2.config.entries()) config[entry.key] = entry.value;
@@ -239136,6 +239531,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         }];
       }
       async onShutdown() {
+        this.cancelRestoreRetries();
         const devices = await this.ctx.kernel.devices?.getAll() ?? [];
         for (const device2 of devices) try {
           await this.ctx.kernel.devices?.decommission(device2.id);
@@ -239155,9 +239551,16 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       async stop() {
       }
       async getStatus() {
+        const all = await this.ctx.kernel.devices?.getAll() ?? [];
+        const summary = this.restoreFailureSummary();
+        if (summary === null) return {
+          connected: true,
+          deviceCount: all.length
+        };
         return {
           connected: true,
-          deviceCount: (await this.ctx.kernel.devices?.getAll() ?? []).length
+          deviceCount: all.length,
+          error: summary
         };
       }
       async getDevices() {
@@ -239247,8 +239650,137 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         };
       }
       async restoreDevices(savedDevices) {
-        await this.onRestoreDevices(savedDevices);
-        if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
+        const report = await this.onRestoreDevices(savedDevices);
+        if (savedDevices.length === 0) return;
+        if (report && report.failedCount > 0) {
+          this.ctx.logger.warn(`Restored ${report.restoredCount}/${savedDevices.length} ${this.providerName} device(s) \u2014 ${report.failedCount} failed, bounded retry scheduled`);
+          return;
+        }
+        const restoredCount = report ? report.restoredCount : savedDevices.length;
+        this.ctx.logger.info(`Restored ${restoredCount} ${this.providerName} device(s)`);
+      }
+      /** Retry schedule. Overridable (tests use millisecond delays). */
+      restoreRetryDelaysMs = DEVICE_RESTORE_RETRY_DELAYS_MS;
+      /** Retry lane width. See `device-restore-retry.ts` for why retries
+      *  never re-stampede full-width while the initial pass does (D167). */
+      restoreRetryConcurrency = 4;
+      _restoreRetryScheduler = null;
+      _restoreRetryCompletion = null;
+      _permanentRestoreFailures = /* @__PURE__ */ new Map();
+      /** Settles when the background retry rounds finish (or `null` when
+      *  nothing failed). Exposed for tests and subclass diagnostics —
+      *  boot NEVER awaits this: the runner's post-init handshake goes out
+      *  with the devices that restored, and a late success is announced
+      *  through the `native-cap-change` → `updateCaps` path. */
+      get restoreRetryCompletion() {
+        return this._restoreRetryCompletion;
+      }
+      /** Devices that exhausted the retry bound this process lifetime. */
+      get permanentRestoreFailures() {
+        return [...this._permanentRestoreFailures.values()];
+      }
+      /** One-line operator-facing summary for `getStatus().error`, or
+      *  `null` when every device restored. */
+      restoreFailureSummary() {
+        if (this._permanentRestoreFailures.size === 0) return null;
+        const ids = [...this._permanentRestoreFailures.keys()].join(", ");
+        return `${this._permanentRestoreFailures.size} device(s) permanently failed restore (deviceIds: ${ids}) \u2014 restart the ${this.providerName} provider to retry`;
+      }
+      cancelRestoreRetries() {
+        this._restoreRetryScheduler?.cancel();
+        this._restoreRetryScheduler = null;
+      }
+      recordPermanentRestoreFailure(failure) {
+        this._permanentRestoreFailures.set(failure.deviceId, failure);
+        this.ctx.logger.error("Device restore permanently failed \u2014 its capabilities will not register until the provider restarts", {
+          tags: {
+            deviceId: failure.deviceId,
+            stableId: failure.stableId
+          },
+          meta: {
+            type: failure.type,
+            attempts: failure.attempts,
+            error: failure.lastError
+          }
+        });
+      }
+      scheduleRestoreRetries(failures, attempt) {
+        const scheduler2 = new DeviceRestoreRetryScheduler({
+          logger: this.ctx.logger,
+          delaysMs: this.restoreRetryDelaysMs,
+          concurrency: this.restoreRetryConcurrency,
+          attempt,
+          onPermanentFailure: (failure) => this.recordPermanentRestoreFailure(failure)
+        });
+        this._restoreRetryScheduler = scheduler2;
+        this._restoreRetryCompletion = scheduler2.run(failures).then(() => void 0).catch((err) => {
+          this.ctx.logger.error("Restore retry scheduler crashed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+        });
+      }
+      /**
+      * Tear down and reconstruct ONE device from its persisted rows — the
+      * `deviceProvider.reloadDevice` cap method. Persistence is never touched,
+      * and no other device this provider owns is disturbed.
+      *
+      * Keyed by `stableId` because the caller's whole reason to be here is that
+      * the NUMERIC id changed (`deviceManager.migrateDevice` swapped it): the
+      * fresh instance resolves its id through `allocateDeviceId`, which returns
+      * whatever number the row carries NOW. The teardown is `decommission` —
+      * exactly what a graceful shutdown runs per device (fires `removeDevice()`,
+      * unregisters native caps, drops the registry entry) — and the rebuild is
+      * the boot restore's own `create()` path, including its pass 2: first-class
+      * children (hub-adopted cameras under an NVR) are decommissioned with the
+      * parent by the cascade and must be re-created explicitly, because only
+      * accessory children come back through `getAccessoryChildren()`.
+      *
+      * Reloading an accessory child directly is refused (no device class) —
+      * reload its parent instead.
+      */
+      async reloadDevice(input) {
+        const { stableId } = input;
+        const devices = this.ctx.kernel.devices;
+        if (!devices) throw new Error(`${this.providerName}: kernel.devices unavailable \u2014 cannot reload`);
+        const live = (await devices.getAll()).find((d) => d.stableId === stableId);
+        if (live) await devices.decommission(live.id);
+        const { id } = await this.ctx.api.deviceManager.allocateDeviceId.mutate({
+          addonId: this.addonId,
+          stableId
+        });
+        const meta = await this.ctx.api.deviceManager.loadMeta.query({ deviceId: id });
+        if (meta === null) throw new Error(`${this.providerName}: no persisted meta for "${stableId}" (id ${id}) \u2014 cannot reload`);
+        const deviceType = Object.values(require_sleep.DeviceType).find((t) => t === meta.type);
+        const Class = deviceType !== void 0 ? this.deviceClasses[deviceType] : void 0;
+        if (!Class) throw new Error(`${this.providerName}: no device class for type "${meta.type}" \u2014 "${stableId}" is an accessory child; reload its parent instead`);
+        await devices.create(stableId, Class, {}, meta.parentDeviceId ?? null);
+        const rows = await this.ctx.api.deviceManager.listPersistedByAddon.query({ addonId: this.addonId });
+        for (const row of rows) {
+          if (row.parentDeviceId !== id) continue;
+          const childType = Object.values(require_sleep.DeviceType).find((t) => t === row.type);
+          const ChildClass = childType !== void 0 ? this.deviceClasses[childType] : void 0;
+          if (!ChildClass) continue;
+          try {
+            await devices.create(row.stableId, ChildClass, {}, id);
+          } catch (err) {
+            this.ctx.logger.warn("reloadDevice: failed to re-create first-class child", {
+              tags: {
+                deviceId: row.id,
+                stableId: row.stableId
+              },
+              meta: {
+                parentDeviceId: id,
+                error: err instanceof Error ? err.message : String(err)
+              }
+            });
+          }
+        }
+        this.ctx.logger.info("device reloaded in place from persisted rows", {
+          tags: { deviceId: id },
+          meta: {
+            stableId,
+            type: meta.type
+          }
+        });
+        return { deviceId: id };
       }
       /**
       * Restore devices from persisted state. Two-pass:
@@ -239274,55 +239806,126 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       * accessory-spawn flow handles via the parent's
       * `getAccessoryChildren()`. Override only when the default doesn't
       * fit.
+      *
+      * A row that fails either pass is NOT terminal (D347): it is handed
+      * to a bounded background retry (`DeviceRestoreRetryScheduler`).
+      * Only after the bound is exhausted is the device marked permanently
+      * failed — logged at ERROR with `tags.deviceId` and surfaced via
+      * `getStatus().error`.
+      */
+      /**
+      * Repair a row's PERSISTED config blob immediately before it is restored.
+      * Default: no-op — most providers have nothing to heal.
+      *
+      * This exists because a restored device self-hydrates from the DB: `create()`
+      * passes `{}` and `BaseDevice` parses the stored blob against the device
+      * schema. A blob that lost a REQUIRED field therefore fails restore forever,
+      * and no later pass revisits it — a hub-adopted Reolink camera whose blob had
+      * been emptied failed all four bounded attempts against fields
+      * (`host`, `password`) it inherits from its parent and never dials itself.
+      *
+      * Implementations get every saved row, so a child can read its parent's blob.
+      * A heal that throws is treated like any other restore failure: retried under
+      * the bound, then reported — never swallowed.
       */
+      async healSavedConfig(_saved, _allSaved) {
+      }
       async onRestoreDevices(savedDevices) {
         const restored = /* @__PURE__ */ new Set();
+        const failures = [];
+        const attemptRestore = async (saved) => {
+          if (restored.has(saved.id)) return;
+          const Class = this.deviceClasses[saved.type];
+          if (!Class) throw new Error(`no device class registered for type "${saved.type}"`);
+          if (saved.parentDeviceId !== null && !restored.has(saved.parentDeviceId)) throw new Error(`parent device ${saved.parentDeviceId} not restored`);
+          await this.healSavedConfig(saved, savedDevices);
+          await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
+          restored.add(saved.id);
+        };
         const topLevel = savedDevices.filter((saved) => saved.parentDeviceId === null);
         const restoreOne = async (saved) => {
-          const Class = this.deviceClasses[saved.type];
-          if (!Class) {
+          if (!this.deviceClasses[saved.type]) {
             this.ctx.logger.warn("No device class registered for restored type \u2014 skipping", {
-              tags: { stableId: saved.stableId },
+              tags: {
+                deviceId: saved.id,
+                stableId: saved.stableId
+              },
               meta: { type: saved.type }
             });
             return;
           }
           try {
-            await this.ctx.kernel.devices.create(saved.stableId, Class, {});
-            restored.add(saved.id);
+            await attemptRestore(saved);
           } catch (err) {
-            this.ctx.logger.warn("Failed to restore device", {
-              tags: { stableId: saved.stableId },
+            const error = err instanceof Error ? err.message : String(err);
+            this.ctx.logger.warn("Failed to restore device \u2014 bounded retry scheduled", {
+              tags: {
+                deviceId: saved.id,
+                stableId: saved.stableId
+              },
               meta: {
                 type: saved.type,
-                error: err instanceof Error ? err.message : String(err)
+                attempt: 1,
+                error
               }
             });
+            failures.push({
+              saved,
+              error
+            });
           }
         };
         await Promise.all(topLevel.map((saved) => restoreOne(saved)));
+        const failedTopLevelIds = new Set(failures.map((failure) => failure.saved.id));
         const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
         for (const saved of childRows) {
-          const Class = this.deviceClasses[saved.type];
-          if (!Class) continue;
+          if (!this.deviceClasses[saved.type]) continue;
           if (saved.parentDeviceId === null) continue;
-          if (!restored.has(saved.parentDeviceId)) continue;
-          try {
-            await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
-            restored.add(saved.id);
-          } catch (err) {
-            this.ctx.logger.warn("Failed to restore hub-adopted child", {
+          if (restored.has(saved.parentDeviceId)) {
+            try {
+              await attemptRestore(saved);
+            } catch (err) {
+              const error = err instanceof Error ? err.message : String(err);
+              this.ctx.logger.warn("Failed to restore hub-adopted child \u2014 bounded retry scheduled", {
+                tags: {
+                  deviceId: saved.id,
+                  stableId: saved.stableId,
+                  parentDeviceId: saved.parentDeviceId
+                },
+                meta: {
+                  type: saved.type,
+                  attempt: 1,
+                  error
+                }
+              });
+              failures.push({
+                saved,
+                error
+              });
+            }
+            continue;
+          }
+          if (failedTopLevelIds.has(saved.parentDeviceId)) {
+            this.ctx.logger.warn("Hub-adopted child deferred \u2014 parent failed initial restore", {
               tags: {
+                deviceId: saved.id,
                 stableId: saved.stableId,
                 parentDeviceId: saved.parentDeviceId
               },
-              meta: {
-                type: saved.type,
-                error: err instanceof Error ? err.message : String(err)
-              }
+              meta: { type: saved.type }
             });
+            failures.push({
+              saved,
+              error: `parent device ${saved.parentDeviceId} not restored`
+            });
+            continue;
           }
         }
+        if (failures.length > 0) this.scheduleRestoreRetries(failures, attemptRestore);
+        return {
+          restoredCount: restored.size,
+          failedCount: failures.length
+        };
       }
       /** Convert an IDevice to the flat DeviceSummary for the cap router. */
       toSummary(device2) {
@@ -243418,6 +244021,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "deviceProvider.reloadDevice": {
+        capName: "device-provider",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
       "deviceProvider.start": {
         capName: "device-provider",
         capScope: "system",
@@ -253822,6 +254431,8 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
     exports.DEVICE_CHILDREN_BATCH_MAX = DEVICE_CHILDREN_BATCH_MAX;
     exports.DEVICE_PROFILES = DEVICE_PROFILES;
+    exports.DEVICE_RESTORE_RETRY_CONCURRENCY = DEVICE_RESTORE_RETRY_CONCURRENCY;
+    exports.DEVICE_RESTORE_RETRY_DELAYS_MS = DEVICE_RESTORE_RETRY_DELAYS_MS;
     exports.DEVICE_SCOPED_CAPS = require_sleep.DEVICE_SCOPED_CAPS;
     exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_sleep.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
     exports.DEVICE_STATE_READERS = DEVICE_STATE_READERS;
@@ -253851,6 +254462,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.DeviceFeature = require_sleep.DeviceFeature;
     exports.DeviceInfoSchema = DeviceInfoSchema;
     exports.DeviceNetworkStatsSchema = DeviceNetworkStatsSchema;
+    exports.DeviceRestoreRetryScheduler = DeviceRestoreRetryScheduler;
     exports.DeviceRole = require_sleep.DeviceRole;
     exports.DeviceRuntimeState = DeviceRuntimeState;
     exports.DeviceSelectorSchema = DeviceSelectorSchema;