dsh-media-guard

Configuration

Override the plugin row from your profile's cordis.patch.yml with a flat patch entry targeting the row id (the same form DSH's own bundles use):

- id: media-guard
  config:
    mode: protect            # observe | optimize | protect
    log: false               # true prints a one-line summary per projection
    budget:
      maxMediaBlocks: 8
      maxSerializedMediaBytes: 2097152
      maxDecodedMediaBytes: 1572864
      maxSerializedBytesPerImage: 524288
    profiles:                # keyed by the request's provider route id
      my-vision-gateway:
        maxSerializedMediaBytes: 12582912
        maxDecodedMediaBytes: 9437184

A profiles entry is more specific than the top-level budget, so for the fields it declares it wins on its route even when both are set.

Modes:

• observe: inventory and report only;
• optimize: compress but do not externalize;
• protect: compress, then externalize overflow media (default).

enabled: false bypasses the guard entirely. Every config field is validated individually; an invalid value falls back to its protective default and is reported — a broken config can never widen a budget or switch the guard off.

Unlike the Pi original there are no built-in provider profiles: DSH provider routes are deployment-defined, so every route gets the conservative default until you declare a profile for it.