Cameras on devices (openpanel C1): frames in memory, a binary uplink, demand

- Volatile frames are held in memory with a byte-bounded queue instead of
  the /dev/shm ring scanned on every put; workers keep writing to the
  directory, which is trimmed on a timer. A volatile upload no longer spools
  to disk. ARTIFACT_VOLATILE_BYTES=0 turns the ring off.
- A device sends camera frames as binary messages on its socket, held and
  published in one step and credited to its device node; refused frames are
  logged and dropped. Its snapshot carries demand and the uplink (binary, or
  http through the portal).
- One demand registry for every socket's wanted media, the tunnel's
  included, plus what running flows read, mapped onto on-demand ports and
  published as device_demand; at most 8 media names per socket.
- Per-message deflate off in serve and dev; a device may fetch the last 8
  digests of a message; published dashboards cached per store revision; a
  revoked device socket is closed with 1008.
- Media tiles want bytes only while on screen; the Devices tab previews a
  wired camera; the device node warns when a flow reads an on-demand port.

docs/reference/configuration.md

@@ -167,14 +167,16 @@ MIG entries are passed on as written.
 | `MAX_ARTIFACT_BYTES` | `2147483648` (2 GiB) | upload limit; `0` removes it |
 | `ARTIFACT_GC_INTERVAL_S` | `3600` | cleanup interval; `0` disables |
 | `ARTIFACT_GC_GRACE_S` | `3600` | minimum age before cleanup |
-| `ARTIFACT_VOLATILE_DIR` | auto-detected | live-media directory under `/dev/shm`, or the temporary directory |
-| `ARTIFACT_VOLATILE_BYTES` | `50331648` (48 MiB) | live-media ring size; `0` stores volatile saves durably |
+| `ARTIFACT_VOLATILE_DIR` | auto-detected | where local workers write live frames, under `/dev/shm` or the temporary directory |
+| `ARTIFACT_VOLATILE_BYTES` | `50331648` (48 MiB) | live-media ring size, in the engine's memory and again in that directory; `0` stores volatile saves durably |
 
 Cleanup removes durable artifacts no longer referenced by recorded runs or
-current messages, and pauses while a run is active. Volatile artifacts use a
-bounded ring; the oldest disappear as it fills. Recorded run outputs are
-copied into durable storage. If you increase the ring size in Docker, increase
-`shm_size` too.
+current messages, and pauses while a run is active. Volatile artifacts live in
+a bounded ring in the engine's memory, and the oldest disappear as it fills.
+Recorded run outputs are copied into durable storage. A worker in the engine's
+container writes its frames to `ARTIFACT_VOLATILE_DIR` instead, which the
+engine trims to the same size every few seconds. If workers publish frames
+under Docker, raise `shm_size` with the ring size.
 
 ## Agents