@camstack/addon-export-alexa 1.2.11 → 1.2.12

package/dist/export-alexa.addon.js

@@ -26,604 +26,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 //#endregion
 let node_crypto = require("node:crypto");
 node_crypto = __toESM(node_crypto);
-//#region ../types/dist/event-category-41fKf-q9.mjs
-var EventCategory = /* @__PURE__ */ function(EventCategory) {
-	EventCategory["SystemBoot"] = "system.boot";
-	EventCategory["SystemAddonsReady"] = "system.addons-ready";
-	EventCategory["SystemRestarting"] = "system.restarting";
-	/**
-	* Fired exactly once after the hub finishes booting following a
-	* restart that was triggered by `RestartCoordinator` (today: framework
-	* live-update). Payload is the marker that was on disk at boot
-	* (`PendingRestartMarkerPayload`); admin UI listens for it to display a
-	* success toast describing what changed.
-	*
-	* Spec: docs/superpowers/specs/2026-05-14-framework-live-update-design.md
-	*/
-	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
-	/**
-	* Readiness transition for a capability provider. Every producer emits
-	* this event on `onInitialize` completion, `onDestroy`, and
-	* `$node.reconnect`; every consumer that needs to gate on a cross-process
-	* cap subscribes via the kernel's readiness module (`awaitReady` /
-	* `onReadyState`) instead of polling. Payload is
-	* `SystemReadyStatePayload` — see event-bus.ts.
-	*/
-	EventCategory["SystemReadyState"] = "system.ready-state";
-	EventCategory["AddonStarted"] = "addon.started";
-	EventCategory["AddonStopped"] = "addon.stopped";
-	EventCategory["AddonRestarted"] = "addon.restarted";
-	EventCategory["AddonUpdated"] = "addon.updated";
-	EventCategory["AddonInstalled"] = "addon.installed";
-	EventCategory["AddonUninstalled"] = "addon.uninstalled";
-	EventCategory["AddonCrashed"] = "addon.crashed";
-	EventCategory["AddonError"] = "addon.error";
-	EventCategory["AddonPageReady"] = "addon.page-ready";
-	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
-	/**
-	* Addon failed to load (import or initialize). Emitted by the kernel's
-	* AddonHealthMonitor only AFTER the boot grace period ends — failures
-	* during the first 5 minutes are silently retried without alerting
-	* (slow-starting addons must have time to come up). Post-grace, this
-	* event is emitted exactly once per failure-streak; AlertCenter
-	* consumes it to create a persistent operator-visible alert.
-	*
-	* Payload: `{ packageName, addonId?, error: { message, stack }, retryCount, nextRetryAt }`.
-	*/
-	EventCategory["AddonLoadFailed"] = "addon.load-failed";
-	/**
-	* Addon recovered from a previous failure. Emitted when an addon
-	* transitions from `failed` back to `healthy` (typically via the
-	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
-	* AlertCenter dismisses the corresponding `AddonLoadFailed` alert
-	* on this event.
-	*/
-	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
-	/**
-	* Monitor scheduled the next retry for a failed addon. Transient —
-	* surfaced to the UI for live-updating the "next retry in Ns"
-	* countdown on the Addons page row, NOT persisted as an alert.
-	*/
-	EventCategory["AddonRetryScheduled"] = "addon.retry-scheduled";
-	/**
-	* A liveness invariant of this node is false — it has no devices, every
-	* camera is offline, or a camera that was recording has stopped producing
-	* segments. Emitted by the `liveness-monitor` builtin, once per fault (the
-	* `findingId` is stable across ticks), only after its boot grace period.
-	* AlertCenter raises a persistent operator-visible alert.
-	*
-	* It exists because on 2026-08-03 the hub ran four hours with zero devices
-	* and zero recordings while every surface stayed quiet.
-	*
-	* Payload: `{ findingId, severity, title, message, deviceId? }`.
-	*/
-	EventCategory["SystemLivenessFailed"] = "system.liveness-failed";
-	/**
-	* A previously reported liveness fault is true again. AlertCenter dismisses
-	* the matching `SystemLivenessFailed` alert.
-	*
-	* Payload: `{ findingId }`.
-	*/
-	EventCategory["SystemLivenessRecovered"] = "system.liveness-recovered";
-	/**
-	* Monitor is attempting to reload a failed addon NOW. UI uses this
-	* to show a spinner during the retry attempt. Same transient nature
-	* as AddonRetryScheduled.
-	*/
-	EventCategory["AddonRetryAttempting"] = "addon.retry-attempting";
-	EventCategory["DeviceRegistered"] = "device.registered";
-	EventCategory["DeviceUnregistered"] = "device.unregistered";
-	EventCategory["DeviceEnabled"] = "device.enabled";
-	EventCategory["DeviceDisabled"] = "device.disabled";
-	EventCategory["DeviceSettingsUpdated"] = "device.settings-updated";
-	/**
-	* Emitted when the set of native capability providers bound to a device
-	* changes — e.g. an addon registers a new native cap via
-	* `DeviceContext.registerNativeCap`, or all native bindings for a device
-	* are cleared on removal. Hub consumers re-resolve device-proxy routes
-	* when this fires.
-	*/
-	EventCategory["DeviceBindingsChanged"] = "device.bindings-changed";
-	/**
-	* Emitted when the operator-organisational meta surface changes
-	* (`name` / `location` / `disabled`). Payload: `{deviceId, field,
-	* value}`. Live consumers (UI device list, alert center) react
-	* without polling. Distinct from `DeviceSettingsUpdated` which
-	* fires on hardware-config changes (host/port/credentials/etc).
-	*/
-	EventCategory["DeviceMetaChanged"] = "device.meta-changed";
-	/**
-	* Emitted by `BaseDevice.updateSourceInfo()` after a successful patch
-	* to the device's upstream-system identity / rendering envelope. The
-	* full new SourceInfo travels in the payload so cross-process listeners
-	* (UI, export adapters) don't need to re-read the meta blob.
-	*
-	* Payload: `{deviceId, sourceInfo}`.
-	*
-	* Distinct from `DeviceMetaChanged` which covers the operator-edited
-	* surface (`name` / `location` / `disabled`). The two share the
-	* persistence layer (both ride on `device-manager.setMetadata` for
-	* SourceInfo, or `setName`/`setLocation`/`setDisabled` for the meta
-	* fields) but consumers care about different subsets.
-	*/
-	EventCategory["DeviceSourceInfoChanged"] = "device.source-info-changed";
-	/**
-	* Emitted by DeviceStreamWiringService after a successful
-	* `stream-broker.registerDeviceStreams` call. Payload includes
-	* deviceId — consumers look up the full registered device info via
-	* `brokerManager.getRegisteredDevice(deviceId)`.
-	*
-	* Replaces the legacy `StreamRouterService.onDeviceRegistered` callback.
-	*/
-	EventCategory["DeviceStreamsRegistered"] = "device.streams-registered";
-	/**
-	* Device-level "fully provisioned" signal — the EXPORT trigger. Emitted once
-	* a device's persisted export-relevant shape (its `DeviceFeature` set) is
-	* established or changes, carrying `{deviceId, fingerprint, generation}`.
-	* Export adapters (Alexa / HAP) react to THIS instead of the chatty per-cap
-	* `DeviceBindingsChanged`, turning a boot's incomplete→complete trickle into
-	* one clean delta. `fingerprint` is `canonicalDeviceFingerprint(shape)`.
-	*
-	* Spec: docs/superpowers/specs/2026-06-01-alexa-hap-export-reconciler-design.md
-	*/
-	EventCategory["DeviceProvisioned"] = "device.provisioned";
-	/**
-	* Fires once when a device's initial feature-probe completes successfully
-	* (lastProbedAt 0→>0); exported shape is now stable. Telemetry (may be
-	* dropped) — consumers MUST also gate on the device record's `probed` flag.
-	*/
-	EventCategory["DeviceReady"] = "device.ready";
-	EventCategory["IntegrationEnabled"] = "integration.enabled";
-	EventCategory["IntegrationDisabled"] = "integration.disabled";
-	EventCategory["IntegrationDeleted"] = "integration.deleted";
-	/** Emitted when a broker connection's status flips (connected /
-	*  disconnected / error). Carries `{ brokerId, status, error? }`. */
-	EventCategory["BrokerStatusChanged"] = "broker.status-changed";
-	/** Emitted for every subscription-matched message routed by a
-	*  broker provider. Carries `{ brokerId, subscriptionId, key, payload }`.
-	*  Consumers filter by `brokerId` + `subscriptionId` in the handler. */
-	EventCategory["BrokerMessage"] = "broker.message";
-	EventCategory["ProviderStarted"] = "provider.started";
-	EventCategory["ProviderStopped"] = "provider.stopped";
-	EventCategory["ProcessCrashed"] = "process.crashed";
-	EventCategory["ProcessRestartScheduled"] = "process.restart_scheduled";
-	EventCategory["ProcessRestarted"] = "process.restarted";
-	EventCategory["RecordingStarted"] = "recording.started";
-	EventCategory["RecordingStopped"] = "recording.stopped";
-	EventCategory["RecordingError"] = "recording.error";
-	EventCategory["RecordingHealthDegraded"] = "recording.health.degraded";
-	EventCategory["RecordingStorageCritical"] = "recording.storage.critical";
-	EventCategory["RecordingSegmentWritten"] = "recording.segment.written";
-	EventCategory["RecordingPolicyFallback"] = "recording.policy.fallback";
-	EventCategory["RecordingRetentionCompleted"] = "recording.retention.completed";
-	/** Export render progress (0–100). Telemetry (D8): a lost tick is a stale
-	*  progress bar the client reconciles via `recordingExport.getExport`. */
-	EventCategory["RecordingExportProgress"] = "recording.export.progress";
-	EventCategory["RecordingExportCompleted"] = "recording.export.completed";
-	EventCategory["RecordingExportFailed"] = "recording.export.failed";
-	EventCategory["DetectionEvent"] = "detection.event";
-	EventCategory["SessionTrackNew"] = "session.track.new";
-	EventCategory["SessionTrackExpired"] = "session.track.expired";
-	EventCategory["BenchmarkProgress"] = "benchmark.progress";
-	EventCategory["PlatformProbePhase"] = "platform-probe.phase";
-	EventCategory["PipelineProgress"] = "pipeline.progress";
-	/** Per-frame execution trace emitted by the pipeline executor for live observability. */
-	EventCategory["PipelineTrace"] = "pipeline.trace";
-	/**
-	* Raw inference output emitted by `addon-pipeline-runner` after running the
-	* detection pipeline on a frame. Carries the `FrameResult` (with
-	* `detections[]`, `width`/`height`, timing debug) — never the frame
-	* buffer itself. Hub-side consumers (analysis pipeline, class filters,
-	* notifications) subscribe to this and re-emit `detection.result` after
-	* post-processing.
-	*/
-	EventCategory["PipelineInferenceResult"] = "pipeline.inference-result";
-	/**
-	* Camera lifecycle event emitted by `addon-pipeline-orchestrator` when it
-	* assigns or unassigns a camera to/from an agent. Carries no frame data;
-	* pure observability for UI dashboards and metrics consumers.
-	*/
-	EventCategory["PipelineCameraAssigned"] = "pipeline.camera-assigned";
-	EventCategory["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
-	/**
-	* Per-camera pipeline config was mutated by the orchestrator
-	* (3-level settings change via `setAgentAddonDefaults` /
-	* `setCameraStepToggle` / `setCameraPipelineForAgent` or a
-	* pipeline-scoped `applyDeviceSettingsPatch`). Orchestrator
-	* subscribes to its own emission to hot-reload the assigned runner
-	* via `attachCamera` so the next frame executes against the new
-	* engine/steps without waiting for a rebalance or the next
-	* `DeviceStreamsRegistered` cycle.
-	*/
-	EventCategory["PipelineCameraUpdated"] = "pipeline.camera-updated";
-	/**
-	* The cluster camera-source OWNER changed (`clusterRoles.ingestNode`).
-	* Emitted by addon-pipeline-orchestrator whenever it (re)derives node
-	* capabilities — at boot, on agent online/offline, and on an ingest-node
-	* flip. Carries the resolved `ownerNodeId`. The stream-broker consumes it to
-	* keep its ingest-owner-gate decision current WITHOUT a per-`ensureBroker`
-	* cross-process `getIngestOwner` query (push the authority's decision instead
-	* of polling it on the hot path). Idempotent state — re-emitted on every
-	* topology change, so a dropped event self-heals on the next one (plus the
-	* broker's long backstop reconcile query).
-	*/
-	EventCategory["PipelineIngestOwnerChanged"] = "pipeline.ingest-owner-changed";
-	/**
-	* Periodic snapshot of per-node pipeline-runner load
-	* (`RunnerLocalLoad`). Emitted ~1Hz by every runner so UI dashboards
-	* subscribe instead of polling `pipelineRunner.getLocalLoad`.
-	* `nodeId` carried in the payload + on `event.source.nodeId`.
-	*/
-	EventCategory["PipelineRunnerLoadSnapshot"] = "pipeline.runner-load-snapshot";
-	/**
-	* Periodic snapshot of per-camera pipeline metrics (`CameraMetrics`
-	* + `deviceId` + `nodeId`). Emitted ~1Hz by every runner for each
-	* attached camera. UI subscribes to drive overlay phase / fps /
-	* inference time without polling `getCameraMetrics`.
-	*/
-	EventCategory["PipelineCameraMetricsSnapshot"] = "pipeline.camera-metrics-snapshot";
-	/**
-	* Periodic snapshot of stream-broker per-broker statistics (input
-	* fps, decoded fps, bitrate, codec). Emitted ~1Hz by every
-	* stream-broker process for each active broker so the UI can drive
-	* the Stream / Cluster dashboards without polling
-	* `streamBroker.listAllProfileSlots` and friends.
-	*/
-	EventCategory["StreamBrokerMetricsSnapshot"] = "stream-broker.metrics-snapshot";
-	/**
-	* Cap event fired by `stream-broker` when a profile slot enters
-	* "demanded" state — a cam stream has been assigned and at least one
-	* consumer (RTSP restream, decoded subscriber, WebRTC session, …) is
-	* present. Camera-provider addons (Reolink Baichuan push, …)
-	* subscribe to this category to start their underlying transport
-	* lazily. Payload: `{ deviceId, camStreamId, profile }`.
-	*/
-	EventCategory["StreamBrokerOnCamStreamDemand"] = "stream-broker.onCamStreamDemand";
-	/**
-	* Cap event fired by `stream-broker` when the last consumer leaves a
-	* previously-demanded cam stream. Providers tear down their
-	* underlying transport on receipt. Payload: `{ deviceId, camStreamId }`.
-	*/
-	EventCategory["StreamBrokerOnCamStreamIdle"] = "stream-broker.onCamStreamIdle";
-	/**
-	* Cap event fired by `stream-broker` when a broker fails to dial a
-	* managed-loopback source (today: `pull-rfc4571`) and the publisher
-	* needs to refresh the cached URL. The lib's TCP server idle-tears-down
-	* on its own schedule, so a re-publish with a fresh `host:port` is the
-	* only way to keep the broker dialable. Camera providers (Reolink
-	* Baichuan native, …) subscribe and respond by re-running their publish
-	* pipeline.
-	* Payload: `{ deviceId, camStreamId, brokerId }`.
-	*/
-	EventCategory["StreamBrokerOnRequestStreamSourceRefresh"] = "stream-broker.onRequestStreamSourceRefresh";
-	/**
-	* A camera provider changed a device's stream parameters (codec /
-	* resolution / bitrate / a stream added or removed). A LOW-LATENCY NUDGE
-	* for the stream-broker's catalog reconcile: it carries NO authoritative
-	* data — the broker re-PULLS that device's `stream-catalog` cap on receipt
-	* (the 30s reconcile poll is the backstop if this nudge is dropped). Emitted
-	* by providers from `stream-params.setProfile`. Payload: `{ deviceId }`.
-	*/
-	EventCategory["StreamParamsChanged"] = "stream-params.changed";
-	/**
-	* Generic per-device runtime-state change. Fired by `device-manager`
-	* whenever a persisted slice in any cap's `runtimeState` shape
-	* mutates. Payload: `{deviceId, capName, slice}`. Subscribers are
-	* the `deviceState` cap router (cross-process listeners) and the
-	* deviceProxy reactive bindings (`device.state.<capName>.value`).
-	* Cap-specific events (`battery.onStatusChanged`, …) still fire
-	* — they're authoritative for callers that want a typed payload
-	* without filtering on `capName`.
-	*/
-	EventCategory["DeviceStateChanged"] = "device.state-changed";
-	/**
-	* Frame occupancy for a camera CHANGED — a tracked object was gained or
-	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
-	*
-	* Emitted only on a change, so a steady scene is silent. It exists so a
-	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
-	* one live badge with no push signal at all, and it cost a request every
-	* four seconds per visible camera.
-	*
-	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
-	* keeps a slow reconcile rather than trusting it alone.
-	*/
-	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
-	/**
-	* Cap event fired by every device that registers the `battery`
-	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
-	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
-	* snapshot wrapper, UI) react to charge/sleep transitions without
-	* polling `batteryCapability.getStatus`.
-	*/
-	EventCategory["BatteryOnStatusChanged"] = "battery.onStatusChanged";
-	/**
-	* Emitted by the battery cap provider WHEN `wakeForStream` enters the
-	* "wake in progress" window — between the Baichuan wake-up issue and
-	* the camera's first dialed-back RTP packet. The stream-broker
-	* manager subscribes to flip the per-broker placeholder reason to
-	* `'waking'` so viewers see a labelled "WAKING UP" tile instead of
-	* the generic `'reconnecting'` frame. Carries `{ deviceId }`. The
-	* complementary "wake complete" signal is the existing
-	* `BatteryOnStatusChanged { sleeping: false }` event.
-	*/
-	EventCategory["BatteryOnWakeStarted"] = "battery.onWakeStarted";
-	/**
-	* Cap event fired by every device that registers the `doorbell`
-	* capability. Mirrors `doorbellCapability.events.onPressed`. Carries
-	* `{ deviceId, timestamp }`. Operators consuming the UI subscribe
-	* here to render transient ring toasts and a "Recent presses" row
-	* on the device detail page.
-	*/
-	EventCategory["DoorbellOnPressed"] = "doorbell.onPressed";
-	/**
-	* Cap event fired by every device that registers the `event-emitter`
-	* capability. Mirrors `eventEmitterCapability.events.onEvent`. Carries
-	* `{ deviceId, eventType, data, timestamp, seq }` — the device's EXACT
-	* declared event verbatim (NO normalization). Subscribers (UI event
-	* stream, advanced-notifier rules) react to fired events without
-	* holding a cap reference.
-	*/
-	EventCategory["EventEmitted"] = "event-emitter.event";
-	/**
-	* Periodic snapshot of the per-node detection-pipeline engine
-	* registry (loaded engines, models resident, in-use cameras, idle
-	* TTL). Emitted ~0.2Hz (every 5 s) by every detection-pipeline
-	* process. The Engines tab subscribes to drive its inventory view
-	* without polling `pipelineExecutor.listLoadedEngines`.
-	*/
-	EventCategory["PipelineEngineMetricsSnapshot"] = "pipeline.engine-metrics-snapshot";
-	/**
-	* Per-node detection-engine runtime-provisioning transition. Emitted by
-	* the detection-pipeline provider on every state change of its lazy
-	* engine-provisioning machine (idle → installing → verifying → ready,
-	* or → failed with a `nextRetryAt`). Payload is the
-	* `EngineProvisioningState` snapshot; `event.source.nodeId` carries the
-	* node. The Pipeline page subscribes to drive a live "installing
-	* OpenVINO… / ready" indicator per node without polling
-	* `pipelineExecutor.getEngineProvisioning`. Telemetry-grade (D8): the UI
-	* also reads the cap snapshot on mount / reconnect. Phase 2.
-	*/
-	EventCategory["PipelineEngineProvisioning"] = "pipeline.engine-provisioning";
-	/**
-	* Cluster topology snapshot. Carries the same payload returned by
-	* `nodes.topology` (every reachable node + addons + processes).
-	* Emitted by the hub on any agent / addon lifecycle change
-	* (debounced) plus a periodic safety net. Replaces UI polling on
-	* `nodes.topology` — admin-ui dashboards subscribe to drive the
-	* cluster view directly from the event payload.
-	*/
-	EventCategory["ClusterTopologySnapshot"] = "cluster.topology-snapshot";
-	/**
-	* Periodic per-node system metrics snapshot (CPU / memory / GPU /
-	* disk / network). Emitted ~0.2 Hz by the metrics-provider addon
-	* for each node. Drives the dashboard SystemStatus / ProcessResources
-	* widgets without polling `metricsProvider.getCurrent`.
-	*/
-	EventCategory["MetricsNodeResourcesSnapshot"] = "metrics.node-resources-snapshot";
-	/**
-	* Periodic per-node process-tree snapshot (camstack-related pids
-	* with ghost / managed / root classification). Emitted ~0.2 Hz by
-	* the metrics-provider addon. Drives the Cluster → Processes tab
-	* without polling `metricsProvider.listNodeProcesses`.
-	*/
-	EventCategory["MetricsNodeProcessesSnapshot"] = "metrics.node-processes-snapshot";
-	/**
-	* Capability binding change event emitted by `addon-pipeline-orchestrator`
-	* when a user changes which addon implements a cap on a node. Subscribed
-	* by every kernel process to update its local `preferredProviderRegistry`
-	* so future capability lookups respect the new binding.
-	*/
-	/**
-	* A capability binding was changed for a node — addon X now provides
-	* capability `cap` on node `nodeId`. Lives under the generic
-	* `capability.*` namespace because capability bindings are a kernel-
-	* level concept used by many addons, not strictly pipeline-scoped.
-	*/
-	EventCategory["CapabilityBindingChanged"] = "capability.binding-changed";
-	EventCategory["ModelDownloadProgress"] = "model.download.progress";
-	EventCategory["AgentRegistered"] = "agent.registered";
-	EventCategory["AgentUnregistered"] = "agent.unregistered";
-	EventCategory["AgentOnline"] = "agent.online";
-	EventCategory["AgentOffline"] = "agent.offline";
-	/** Forked worker process (e.g. hub/pipeline) connected to the broker. */
-	EventCategory["WorkerOnline"] = "worker.online";
-	/** Forked worker process disconnected from the broker. */
-	EventCategory["WorkerOffline"] = "worker.offline";
-	EventCategory["AgentTaskDispatched"] = "agent.task.dispatched";
-	EventCategory["AgentTaskAssigned"] = "agent.task.assigned";
-	EventCategory["AgentTrpcConnected"] = "agent.trpc.connected";
-	EventCategory["AgentWsConnected"] = "agent.ws.connected";
-	EventCategory["AgentWsDisconnected"] = "agent.ws.disconnected";
-	EventCategory["AgentBackupActivated"] = "agent.backup.activated";
-	EventCategory["OrchestrationSettingsUpdated"] = "orchestration.settings-updated";
-	/**
-	* Per-agent hwaccel preference changed (user override set, cleared, or
-	* re-probed). Observability event — decoders pull the current pref at
-	* `createSession`, so running sessions keep their current backend until
-	* they rotate naturally (camera add/remove, stream restart). Future
-	* work can wire a listener in stream-broker that force-rotates live
-	* sessions; for now this event powers logs + admin-UI toast feedback.
-	*/
-	EventCategory["PipelineAgentHwaccelChanged"] = "pipeline.agent-hwaccel-changed";
-	EventCategory["MotionAnalysis"] = "detection.motion-analysis";
-	/** All raw motion zones from CCL before minArea filter — for UI debug overlay. */
-	EventCategory["MotionZonesRaw"] = "detection.motion-zones-raw";
-	/**
-	* Per-camera motion phase transition (`watching ↔ active`) emitted
-	* by the runner. Mirrors the `motion.onMotionChanged` cap event
-	* surface — payload `MotionOnMotionChangedPayload` carries
-	* `{deviceId, detected, timestamp, source, regions?}`. Subscribers
-	* include addons that need to react to motion state without
-	* polling the runtime-state mirror.
-	*/
-	EventCategory["MotionOnMotionChanged"] = "motion.on-motion-changed";
-	EventCategory["DetectionResult"] = "detection.result";
-	EventCategory["DetectionRaw"] = "detection.raw";
-	EventCategory["DetectionCameraNative"] = "detection.camera-native";
-	/**
-	* Canonical per-chunk live audio pipeline output. Payload is
-	* `PipelineAudioInferenceResultPayload` carrying a full `AudioResult`
-	* (level + detections + debug). Lives on the pipeline.* namespace
-	* alongside `pipeline.inference-result` (video) for symmetry.
-	*/
-	EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
-	EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
-	EventCategory["ProviderMotion"] = "provider.motion";
-	EventCategory["ProviderDetection"] = "provider.detection";
-	EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
-	EventCategory["EnrichmentSceneStateChanged"] = "enrichment.scene.state-changed";
-	EventCategory["EnrichmentActivitySummary"] = "enrichment.activity.summary";
-	/**
-	* Unified track-lifecycle event: ONE category carrying `phase:
-	* 'start' | 'update' | 'end'` with a rich, typed
-	* `PipelineAnalyticsTrackLifecyclePayload`. Supersedes the thin
-	* `PipelineAnalyticsTrackStarted` / `PipelineAnalyticsTrackEnded`
-	* pair — a consumer subscribes once and branches on `phase`.
-	*/
-	EventCategory["PipelineAnalyticsTrackLifecycle"] = "pipeline-analytics.track-lifecycle";
-	/**
-	* @deprecated Superseded by {@link PipelineAnalyticsTrackLifecycle}
-	* (`phase:'start'`). Kept as a soft alias — no known subscribers.
-	*/
-	EventCategory["PipelineAnalyticsTrackStarted"] = "pipeline-analytics.track-started";
-	/**
-	* @deprecated Superseded by {@link PipelineAnalyticsTrackLifecycle}
-	* (`phase:'end'`). Kept as a soft alias — no known subscribers.
-	*/
-	EventCategory["PipelineAnalyticsTrackEnded"] = "pipeline-analytics.track-ended";
-	EventCategory["PipelineAnalyticsDetectionEvent"] = "pipeline-analytics.detection-event";
-	EventCategory["PipelineAnalyticsFrameTracked"] = "pipeline-analytics.frame-tracked";
-	/**
-	* Fired by `addon-post-analysis` when a parked (stationary) object appears
-	* (a track was promoted to a stationary-registry entry) or departs (the
-	* object moved / was removed). Telemetry (D8): lossy, drives a UI refresh of
-	* the dedicated "Stationary" section — never the live event feed. Payload:
-	* `{ deviceId, entryId, className, phase:'appeared'|'departed', timestamp }`.
-	*/
-	EventCategory["PipelineAnalyticsStationaryChanged"] = "pipeline-analytics.stationary-changed";
-	/**
-	* Fired by `addon-post-analysis` when a package-drop is confirmed inside
-	* a package zone — a newly-appeared stationary object of a package class
-	* that cleared the class / zone / dwell / size gates. Payload:
-	* `PipelineAnalyticsPackageDeliveredPayload` carrying `{ deviceId,
-	* entryId, className, zoneIds, keyFrameMediaKey?, bbox, timestamp }`.
-	* Telemetry (D8): the durable record is the `package-events` store row;
-	* this bus topic drives notifier rules + live UI. See
-	* docs/superpowers/specs/2026-07-17-package-zones-design.md §5.1.
-	*/
-	EventCategory["PipelineAnalyticsPackageDelivered"] = "pipeline-analytics.package-delivered";
-	/**
-	* Fired by `addon-post-analysis` when a previously-delivered package
-	* leaves its zone (the stationary entry departed — moved or swept).
-	* Payload: `PipelineAnalyticsPackagePickedUpPayload` carrying
-	* `{ deviceId, entryId, deliveredEventId, className, timestamp }`.
-	* Telemetry (D8). See package-zones-design §5.2.
-	*/
-	EventCategory["PipelineAnalyticsPackagePickedUp"] = "pipeline-analytics.package-picked-up";
-	/**
-	* Fired by `addon-post-analysis` whenever a gallery face row changes:
-	* `kind:'buffered'` a new detected face was persisted, `'assigned'` /
-	* `'unassigned'` its identity link changed, `'deleted'` the row was
-	* removed. Telemetry semantics (D8): a lost event only delays a refresh,
-	* never a correctness issue. Payload `PipelineAnalyticsFaceGalleryChangedPayload`.
-	*/
-	EventCategory["PipelineAnalyticsFaceGalleryChanged"] = "pipeline-analytics.face-gallery-changed";
-	/**
-	* Fired by `addon-post-analysis` whenever a gallery plate row changes:
-	* `kind:'buffered'` a new read was persisted (`PlateRecognizer.onTrackEnd`),
-	* `'assigned'` / `'unassigned'` its vehicle link changed
-	* (`PlateGalleryProvider`), `'deleted'` the row was removed. Telemetry
-	* semantics (D8): a lost event only delays a refresh, never a correctness
-	* issue. Payload `PipelineAnalyticsPlateGalleryChangedPayload`.
-	*/
-	EventCategory["PipelineAnalyticsPlateGalleryChanged"] = "pipeline-analytics.plate-gallery-changed";
-	EventCategory["FrigateLiveEvent"] = "frigate.live-event";
-	EventCategory["CameraStreamsProfileSlotsChanged"] = "camera-streams.onProfileSlotsChanged";
-	/**
-	* Stream-broker health watchdog. Per-broker (deviceId/profile) emission.
-	* `stream.offline` fires after STREAM_STALE_TIMEOUT_MS without an encoded
-	* packet on an active broker. `stream.online` fires on first packet
-	* after a stale gap (or on initial first packet). Payload includes
-	* the assigned camStreamId as `profileKey`.
-	*/
-	EventCategory["StreamOnline"] = "stream.online";
-	EventCategory["StreamOffline"] = "stream.offline";
-	EventCategory["NetworkTunnelStarted"] = "network.tunnel.started";
-	EventCategory["NetworkTunnelStopped"] = "network.tunnel.stopped";
-	/** Fired by the `local-network` cap when the host's interface set
-	*  changes (new IP from DHCP, VPN connect, docker bridge added). */
-	EventCategory["LocalNetworkChanged"] = "network.local.changed";
-	/**
-	* Fired by a `mesh-network` provider (Tailscale, …) when its
-	* mesh-reachable host changes (join / leave / MagicDNS or 100.x IP
-	* change). Lets `local-network` fold the mesh endpoint into its
-	* connection-endpoint list without a cross-package import. Payload
-	* carries the preferred host (`host: ''` = no longer reachable),
-	* the hub port, and the scheme. Telemetry-grade (D8): consumers
-	* pull-reconcile from the provider's `getStatus` on reconnect. */
-	EventCategory["MeshNetworkChanged"] = "network.mesh.changed";
-	EventCategory["BackupCompleted"] = "backup.completed";
-	EventCategory["BackupRestored"] = "backup.restored";
-	EventCategory["NotificationDispatched"] = "notification.dispatched";
-	EventCategory["NotificationFailed"] = "notification.failed";
-	EventCategory["DeviceUpdated"] = "device.updated";
-	/**
-	* Transport-level connectivity. Emitted by the device driver when
-	* the underlying control socket actually connects / disconnects
-	* (Baichuan TCP, ONVIF probe response, RTSP DESCRIBE, …) — NOT for
-	* power-state transitions on a battery camera. For battery wake /
-	* doze cycles see `DeviceAwake` / `DeviceSleeping`.
-	*/
-	EventCategory["DeviceOnline"] = "device.online";
-	/**
-	* Stream-broker watchdog — emitted when no encoded packet has been
-	* received for STREAM_STALE_TIMEOUT_MS on an active broker (rtsp or
-	* push). Paired with DeviceOnline which fires on first packet after
-	* a stale gap. Payload: DeviceStreamHealthPayload.
-	*/
-	EventCategory["DeviceOffline"] = "device.offline";
-	/**
-	* Battery cam woke up — physical power-state transition reported
-	* by the device firmware. Distinct from `DeviceOnline` so a UI panel
-	* watching power state doesn't flap on every UDP socket reconnect.
-	*/
-	EventCategory["DeviceAwake"] = "device.awake";
-	/**
-	* Battery cam went to sleep. See `DeviceAwake`.
-	*/
-	EventCategory["DeviceSleeping"] = "device.sleeping";
-	EventCategory["RetentionCleanup"] = "retention.cleanup";
-	/**
-	* Legacy bulk-update progress snapshot (payload `BulkUpdateState`). No longer
-	* emitted — F3 removed the coordinator that produced it; "Update all" now runs
-	* as one lifecycle engine job (`AddonsJobProgress`/`AddonsJobLog`). Retained
-	* (with `BulkUpdateState`) only to avoid regenerating the event maps; removed
-	* in F4 once live bulk progress is re-implemented over the engine events.
-	*/
-	EventCategory["AddonsBulkUpdateProgress"] = "addons.bulk-update-progress";
-	EventCategory["AddonsJobProgress"] = "addons.job-progress";
-	EventCategory["AddonsJobLog"] = "addons.job-log";
-	/**
-	* A container's child visibility toggled (hidden/shown). Emitted by the
-	* `accessories` cap when a child device is hidden or revealed.
-	* Payload: `{ deviceId, childDeviceId, hidden }`.
-	*/
-	EventCategory["AccessoriesChildVisibilityChanged"] = "accessories.onChildVisibilityChanged";
-	/**
-	* A container's child set changed (children added/removed/reordered).
-	* Payload: `{ deviceId, childDeviceIds, hiddenChildIds }`.
-	*/
-	EventCategory["AccessoriesChanged"] = "accessories.onAccessoriesChanged";
-	/**
-	* Progress update from a running model conversion job.
-	* Payload: `{ kind: 'model-convert', phase, sessionId?, pct?, detail? }`.
-	* Emitted by `addon-model-studio` on the converting node.
-	*/
-	EventCategory["ModelConvertProgress"] = "model-convert.progress";
-	return EventCategory;
-}({});
-//#endregion
 //#region ../../node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -5279,6 +4681,604 @@ var ZodIssueCode = {
 /** @deprecated Do not use. Stub definition, only included for zod-to-json-schema compatibility. */
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
+//#endregion
+//#region ../types/dist/event-category-41fKf-q9.mjs
+var EventCategory = /* @__PURE__ */ function(EventCategory) {
+	EventCategory["SystemBoot"] = "system.boot";
+	EventCategory["SystemAddonsReady"] = "system.addons-ready";
+	EventCategory["SystemRestarting"] = "system.restarting";
+	/**
+	* Fired exactly once after the hub finishes booting following a
+	* restart that was triggered by `RestartCoordinator` (today: framework
+	* live-update). Payload is the marker that was on disk at boot
+	* (`PendingRestartMarkerPayload`); admin UI listens for it to display a
+	* success toast describing what changed.
+	*
+	* Spec: docs/superpowers/specs/2026-05-14-framework-live-update-design.md
+	*/
+	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
+	/**
+	* Readiness transition for a capability provider. Every producer emits
+	* this event on `onInitialize` completion, `onDestroy`, and
+	* `$node.reconnect`; every consumer that needs to gate on a cross-process
+	* cap subscribes via the kernel's readiness module (`awaitReady` /
+	* `onReadyState`) instead of polling. Payload is
+	* `SystemReadyStatePayload` — see event-bus.ts.
+	*/
+	EventCategory["SystemReadyState"] = "system.ready-state";
+	EventCategory["AddonStarted"] = "addon.started";
+	EventCategory["AddonStopped"] = "addon.stopped";
+	EventCategory["AddonRestarted"] = "addon.restarted";
+	EventCategory["AddonUpdated"] = "addon.updated";
+	EventCategory["AddonInstalled"] = "addon.installed";
+	EventCategory["AddonUninstalled"] = "addon.uninstalled";
+	EventCategory["AddonCrashed"] = "addon.crashed";
+	EventCategory["AddonError"] = "addon.error";
+	EventCategory["AddonPageReady"] = "addon.page-ready";
+	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
+	/**
+	* Addon failed to load (import or initialize). Emitted by the kernel's
+	* AddonHealthMonitor only AFTER the boot grace period ends — failures
+	* during the first 5 minutes are silently retried without alerting
+	* (slow-starting addons must have time to come up). Post-grace, this
+	* event is emitted exactly once per failure-streak; AlertCenter
+	* consumes it to create a persistent operator-visible alert.
+	*
+	* Payload: `{ packageName, addonId?, error: { message, stack }, retryCount, nextRetryAt }`.
+	*/
+	EventCategory["AddonLoadFailed"] = "addon.load-failed";
+	/**
+	* Addon recovered from a previous failure. Emitted when an addon
+	* transitions from `failed` back to `healthy` (typically via the
+	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
+	* AlertCenter dismisses the corresponding `AddonLoadFailed` alert
+	* on this event.
+	*/
+	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
+	/**
+	* Monitor scheduled the next retry for a failed addon. Transient —
+	* surfaced to the UI for live-updating the "next retry in Ns"
+	* countdown on the Addons page row, NOT persisted as an alert.
+	*/
+	EventCategory["AddonRetryScheduled"] = "addon.retry-scheduled";
+	/**
+	* A liveness invariant of this node is false — it has no devices, every
+	* camera is offline, or a camera that was recording has stopped producing
+	* segments. Emitted by the `liveness-monitor` builtin, once per fault (the
+	* `findingId` is stable across ticks), only after its boot grace period.
+	* AlertCenter raises a persistent operator-visible alert.
+	*
+	* It exists because on 2026-08-03 the hub ran four hours with zero devices
+	* and zero recordings while every surface stayed quiet.
+	*
+	* Payload: `{ findingId, severity, title, message, deviceId? }`.
+	*/
+	EventCategory["SystemLivenessFailed"] = "system.liveness-failed";
+	/**
+	* A previously reported liveness fault is true again. AlertCenter dismisses
+	* the matching `SystemLivenessFailed` alert.
+	*
+	* Payload: `{ findingId }`.
+	*/
+	EventCategory["SystemLivenessRecovered"] = "system.liveness-recovered";
+	/**
+	* Monitor is attempting to reload a failed addon NOW. UI uses this
+	* to show a spinner during the retry attempt. Same transient nature
+	* as AddonRetryScheduled.
+	*/
+	EventCategory["AddonRetryAttempting"] = "addon.retry-attempting";
+	EventCategory["DeviceRegistered"] = "device.registered";
+	EventCategory["DeviceUnregistered"] = "device.unregistered";
+	EventCategory["DeviceEnabled"] = "device.enabled";
+	EventCategory["DeviceDisabled"] = "device.disabled";
+	EventCategory["DeviceSettingsUpdated"] = "device.settings-updated";
+	/**
+	* Emitted when the set of native capability providers bound to a device
+	* changes — e.g. an addon registers a new native cap via
+	* `DeviceContext.registerNativeCap`, or all native bindings for a device
+	* are cleared on removal. Hub consumers re-resolve device-proxy routes
+	* when this fires.
+	*/
+	EventCategory["DeviceBindingsChanged"] = "device.bindings-changed";
+	/**
+	* Emitted when the operator-organisational meta surface changes
+	* (`name` / `location` / `disabled`). Payload: `{deviceId, field,
+	* value}`. Live consumers (UI device list, alert center) react
+	* without polling. Distinct from `DeviceSettingsUpdated` which
+	* fires on hardware-config changes (host/port/credentials/etc).
+	*/
+	EventCategory["DeviceMetaChanged"] = "device.meta-changed";
+	/**
+	* Emitted by `BaseDevice.updateSourceInfo()` after a successful patch
+	* to the device's upstream-system identity / rendering envelope. The
+	* full new SourceInfo travels in the payload so cross-process listeners
+	* (UI, export adapters) don't need to re-read the meta blob.
+	*
+	* Payload: `{deviceId, sourceInfo}`.
+	*
+	* Distinct from `DeviceMetaChanged` which covers the operator-edited
+	* surface (`name` / `location` / `disabled`). The two share the
+	* persistence layer (both ride on `device-manager.setMetadata` for
+	* SourceInfo, or `setName`/`setLocation`/`setDisabled` for the meta
+	* fields) but consumers care about different subsets.
+	*/
+	EventCategory["DeviceSourceInfoChanged"] = "device.source-info-changed";
+	/**
+	* Emitted by DeviceStreamWiringService after a successful
+	* `stream-broker.registerDeviceStreams` call. Payload includes
+	* deviceId — consumers look up the full registered device info via
+	* `brokerManager.getRegisteredDevice(deviceId)`.
+	*
+	* Replaces the legacy `StreamRouterService.onDeviceRegistered` callback.
+	*/
+	EventCategory["DeviceStreamsRegistered"] = "device.streams-registered";
+	/**
+	* Device-level "fully provisioned" signal — the EXPORT trigger. Emitted once
+	* a device's persisted export-relevant shape (its `DeviceFeature` set) is
+	* established or changes, carrying `{deviceId, fingerprint, generation}`.
+	* Export adapters (Alexa / HAP) react to THIS instead of the chatty per-cap
+	* `DeviceBindingsChanged`, turning a boot's incomplete→complete trickle into
+	* one clean delta. `fingerprint` is `canonicalDeviceFingerprint(shape)`.
+	*
+	* Spec: docs/superpowers/specs/2026-06-01-alexa-hap-export-reconciler-design.md
+	*/
+	EventCategory["DeviceProvisioned"] = "device.provisioned";
+	/**
+	* Fires once when a device's initial feature-probe completes successfully
+	* (lastProbedAt 0→>0); exported shape is now stable. Telemetry (may be
+	* dropped) — consumers MUST also gate on the device record's `probed` flag.
+	*/
+	EventCategory["DeviceReady"] = "device.ready";
+	EventCategory["IntegrationEnabled"] = "integration.enabled";
+	EventCategory["IntegrationDisabled"] = "integration.disabled";
+	EventCategory["IntegrationDeleted"] = "integration.deleted";
+	/** Emitted when a broker connection's status flips (connected /
+	*  disconnected / error). Carries `{ brokerId, status, error? }`. */
+	EventCategory["BrokerStatusChanged"] = "broker.status-changed";
+	/** Emitted for every subscription-matched message routed by a
+	*  broker provider. Carries `{ brokerId, subscriptionId, key, payload }`.
+	*  Consumers filter by `brokerId` + `subscriptionId` in the handler. */
+	EventCategory["BrokerMessage"] = "broker.message";
+	EventCategory["ProviderStarted"] = "provider.started";
+	EventCategory["ProviderStopped"] = "provider.stopped";
+	EventCategory["ProcessCrashed"] = "process.crashed";
+	EventCategory["ProcessRestartScheduled"] = "process.restart_scheduled";
+	EventCategory["ProcessRestarted"] = "process.restarted";
+	EventCategory["RecordingStarted"] = "recording.started";
+	EventCategory["RecordingStopped"] = "recording.stopped";
+	EventCategory["RecordingError"] = "recording.error";
+	EventCategory["RecordingHealthDegraded"] = "recording.health.degraded";
+	EventCategory["RecordingStorageCritical"] = "recording.storage.critical";
+	EventCategory["RecordingSegmentWritten"] = "recording.segment.written";
+	EventCategory["RecordingPolicyFallback"] = "recording.policy.fallback";
+	EventCategory["RecordingRetentionCompleted"] = "recording.retention.completed";
+	/** Export render progress (0–100). Telemetry (D8): a lost tick is a stale
+	*  progress bar the client reconciles via `recordingExport.getExport`. */
+	EventCategory["RecordingExportProgress"] = "recording.export.progress";
+	EventCategory["RecordingExportCompleted"] = "recording.export.completed";
+	EventCategory["RecordingExportFailed"] = "recording.export.failed";
+	EventCategory["DetectionEvent"] = "detection.event";
+	EventCategory["SessionTrackNew"] = "session.track.new";
+	EventCategory["SessionTrackExpired"] = "session.track.expired";
+	EventCategory["BenchmarkProgress"] = "benchmark.progress";
+	EventCategory["PlatformProbePhase"] = "platform-probe.phase";
+	EventCategory["PipelineProgress"] = "pipeline.progress";
+	/** Per-frame execution trace emitted by the pipeline executor for live observability. */
+	EventCategory["PipelineTrace"] = "pipeline.trace";
+	/**
+	* Raw inference output emitted by `addon-pipeline-runner` after running the
+	* detection pipeline on a frame. Carries the `FrameResult` (with
+	* `detections[]`, `width`/`height`, timing debug) — never the frame
+	* buffer itself. Hub-side consumers (analysis pipeline, class filters,
+	* notifications) subscribe to this and re-emit `detection.result` after
+	* post-processing.
+	*/
+	EventCategory["PipelineInferenceResult"] = "pipeline.inference-result";
+	/**
+	* Camera lifecycle event emitted by `addon-pipeline-orchestrator` when it
+	* assigns or unassigns a camera to/from an agent. Carries no frame data;
+	* pure observability for UI dashboards and metrics consumers.
+	*/
+	EventCategory["PipelineCameraAssigned"] = "pipeline.camera-assigned";
+	EventCategory["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
+	/**
+	* Per-camera pipeline config was mutated by the orchestrator
+	* (3-level settings change via `setAgentAddonDefaults` /
+	* `setCameraStepToggle` / `setCameraPipelineForAgent` or a
+	* pipeline-scoped `applyDeviceSettingsPatch`). Orchestrator
+	* subscribes to its own emission to hot-reload the assigned runner
+	* via `attachCamera` so the next frame executes against the new
+	* engine/steps without waiting for a rebalance or the next
+	* `DeviceStreamsRegistered` cycle.
+	*/
+	EventCategory["PipelineCameraUpdated"] = "pipeline.camera-updated";
+	/**
+	* The cluster camera-source OWNER changed (`clusterRoles.ingestNode`).
+	* Emitted by addon-pipeline-orchestrator whenever it (re)derives node
+	* capabilities — at boot, on agent online/offline, and on an ingest-node
+	* flip. Carries the resolved `ownerNodeId`. The stream-broker consumes it to
+	* keep its ingest-owner-gate decision current WITHOUT a per-`ensureBroker`
+	* cross-process `getIngestOwner` query (push the authority's decision instead
+	* of polling it on the hot path). Idempotent state — re-emitted on every
+	* topology change, so a dropped event self-heals on the next one (plus the
+	* broker's long backstop reconcile query).
+	*/
+	EventCategory["PipelineIngestOwnerChanged"] = "pipeline.ingest-owner-changed";
+	/**
+	* Periodic snapshot of per-node pipeline-runner load
+	* (`RunnerLocalLoad`). Emitted ~1Hz by every runner so UI dashboards
+	* subscribe instead of polling `pipelineRunner.getLocalLoad`.
+	* `nodeId` carried in the payload + on `event.source.nodeId`.
+	*/
+	EventCategory["PipelineRunnerLoadSnapshot"] = "pipeline.runner-load-snapshot";
+	/**
+	* Periodic snapshot of per-camera pipeline metrics (`CameraMetrics`
+	* + `deviceId` + `nodeId`). Emitted ~1Hz by every runner for each
+	* attached camera. UI subscribes to drive overlay phase / fps /
+	* inference time without polling `getCameraMetrics`.
+	*/
+	EventCategory["PipelineCameraMetricsSnapshot"] = "pipeline.camera-metrics-snapshot";
+	/**
+	* Periodic snapshot of stream-broker per-broker statistics (input
+	* fps, decoded fps, bitrate, codec). Emitted ~1Hz by every
+	* stream-broker process for each active broker so the UI can drive
+	* the Stream / Cluster dashboards without polling
+	* `streamBroker.listAllProfileSlots` and friends.
+	*/
+	EventCategory["StreamBrokerMetricsSnapshot"] = "stream-broker.metrics-snapshot";
+	/**
+	* Cap event fired by `stream-broker` when a profile slot enters
+	* "demanded" state — a cam stream has been assigned and at least one
+	* consumer (RTSP restream, decoded subscriber, WebRTC session, …) is
+	* present. Camera-provider addons (Reolink Baichuan push, …)
+	* subscribe to this category to start their underlying transport
+	* lazily. Payload: `{ deviceId, camStreamId, profile }`.
+	*/
+	EventCategory["StreamBrokerOnCamStreamDemand"] = "stream-broker.onCamStreamDemand";
+	/**
+	* Cap event fired by `stream-broker` when the last consumer leaves a
+	* previously-demanded cam stream. Providers tear down their
+	* underlying transport on receipt. Payload: `{ deviceId, camStreamId }`.
+	*/
+	EventCategory["StreamBrokerOnCamStreamIdle"] = "stream-broker.onCamStreamIdle";
+	/**
+	* Cap event fired by `stream-broker` when a broker fails to dial a
+	* managed-loopback source (today: `pull-rfc4571`) and the publisher
+	* needs to refresh the cached URL. The lib's TCP server idle-tears-down
+	* on its own schedule, so a re-publish with a fresh `host:port` is the
+	* only way to keep the broker dialable. Camera providers (Reolink
+	* Baichuan native, …) subscribe and respond by re-running their publish
+	* pipeline.
+	* Payload: `{ deviceId, camStreamId, brokerId }`.
+	*/
+	EventCategory["StreamBrokerOnRequestStreamSourceRefresh"] = "stream-broker.onRequestStreamSourceRefresh";
+	/**
+	* A camera provider changed a device's stream parameters (codec /
+	* resolution / bitrate / a stream added or removed). A LOW-LATENCY NUDGE
+	* for the stream-broker's catalog reconcile: it carries NO authoritative
+	* data — the broker re-PULLS that device's `stream-catalog` cap on receipt
+	* (the 30s reconcile poll is the backstop if this nudge is dropped). Emitted
+	* by providers from `stream-params.setProfile`. Payload: `{ deviceId }`.
+	*/
+	EventCategory["StreamParamsChanged"] = "stream-params.changed";
+	/**
+	* Generic per-device runtime-state change. Fired by `device-manager`
+	* whenever a persisted slice in any cap's `runtimeState` shape
+	* mutates. Payload: `{deviceId, capName, slice}`. Subscribers are
+	* the `deviceState` cap router (cross-process listeners) and the
+	* deviceProxy reactive bindings (`device.state.<capName>.value`).
+	* Cap-specific events (`battery.onStatusChanged`, …) still fire
+	* — they're authoritative for callers that want a typed payload
+	* without filtering on `capName`.
+	*/
+	EventCategory["DeviceStateChanged"] = "device.state-changed";
+	/**
+	* Frame occupancy for a camera CHANGED — a tracked object was gained or
+	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
+	*
+	* Emitted only on a change, so a steady scene is silent. It exists so a
+	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
+	* one live badge with no push signal at all, and it cost a request every
+	* four seconds per visible camera.
+	*
+	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
+	* keeps a slow reconcile rather than trusting it alone.
+	*/
+	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
+	/**
+	* Cap event fired by every device that registers the `battery`
+	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
+	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
+	* snapshot wrapper, UI) react to charge/sleep transitions without
+	* polling `batteryCapability.getStatus`.
+	*/
+	EventCategory["BatteryOnStatusChanged"] = "battery.onStatusChanged";
+	/**
+	* Emitted by the battery cap provider WHEN `wakeForStream` enters the
+	* "wake in progress" window — between the Baichuan wake-up issue and
+	* the camera's first dialed-back RTP packet. The stream-broker
+	* manager subscribes to flip the per-broker placeholder reason to
+	* `'waking'` so viewers see a labelled "WAKING UP" tile instead of
+	* the generic `'reconnecting'` frame. Carries `{ deviceId }`. The
+	* complementary "wake complete" signal is the existing
+	* `BatteryOnStatusChanged { sleeping: false }` event.
+	*/
+	EventCategory["BatteryOnWakeStarted"] = "battery.onWakeStarted";
+	/**
+	* Cap event fired by every device that registers the `doorbell`
+	* capability. Mirrors `doorbellCapability.events.onPressed`. Carries
+	* `{ deviceId, timestamp }`. Operators consuming the UI subscribe
+	* here to render transient ring toasts and a "Recent presses" row
+	* on the device detail page.
+	*/
+	EventCategory["DoorbellOnPressed"] = "doorbell.onPressed";
+	/**
+	* Cap event fired by every device that registers the `event-emitter`
+	* capability. Mirrors `eventEmitterCapability.events.onEvent`. Carries
+	* `{ deviceId, eventType, data, timestamp, seq }` — the device's EXACT
+	* declared event verbatim (NO normalization). Subscribers (UI event
+	* stream, advanced-notifier rules) react to fired events without
+	* holding a cap reference.
+	*/
+	EventCategory["EventEmitted"] = "event-emitter.event";
+	/**
+	* Periodic snapshot of the per-node detection-pipeline engine
+	* registry (loaded engines, models resident, in-use cameras, idle
+	* TTL). Emitted ~0.2Hz (every 5 s) by every detection-pipeline
+	* process. The Engines tab subscribes to drive its inventory view
+	* without polling `pipelineExecutor.listLoadedEngines`.
+	*/
+	EventCategory["PipelineEngineMetricsSnapshot"] = "pipeline.engine-metrics-snapshot";
+	/**
+	* Per-node detection-engine runtime-provisioning transition. Emitted by
+	* the detection-pipeline provider on every state change of its lazy
+	* engine-provisioning machine (idle → installing → verifying → ready,
+	* or → failed with a `nextRetryAt`). Payload is the
+	* `EngineProvisioningState` snapshot; `event.source.nodeId` carries the
+	* node. The Pipeline page subscribes to drive a live "installing
+	* OpenVINO… / ready" indicator per node without polling
+	* `pipelineExecutor.getEngineProvisioning`. Telemetry-grade (D8): the UI
+	* also reads the cap snapshot on mount / reconnect. Phase 2.
+	*/
+	EventCategory["PipelineEngineProvisioning"] = "pipeline.engine-provisioning";
+	/**
+	* Cluster topology snapshot. Carries the same payload returned by
+	* `nodes.topology` (every reachable node + addons + processes).
+	* Emitted by the hub on any agent / addon lifecycle change
+	* (debounced) plus a periodic safety net. Replaces UI polling on
+	* `nodes.topology` — admin-ui dashboards subscribe to drive the
+	* cluster view directly from the event payload.
+	*/
+	EventCategory["ClusterTopologySnapshot"] = "cluster.topology-snapshot";
+	/**
+	* Periodic per-node system metrics snapshot (CPU / memory / GPU /
+	* disk / network). Emitted ~0.2 Hz by the metrics-provider addon
+	* for each node. Drives the dashboard SystemStatus / ProcessResources
+	* widgets without polling `metricsProvider.getCurrent`.
+	*/
+	EventCategory["MetricsNodeResourcesSnapshot"] = "metrics.node-resources-snapshot";
+	/**
+	* Periodic per-node process-tree snapshot (camstack-related pids
+	* with ghost / managed / root classification). Emitted ~0.2 Hz by
+	* the metrics-provider addon. Drives the Cluster → Processes tab
+	* without polling `metricsProvider.listNodeProcesses`.
+	*/
+	EventCategory["MetricsNodeProcessesSnapshot"] = "metrics.node-processes-snapshot";
+	/**
+	* Capability binding change event emitted by `addon-pipeline-orchestrator`
+	* when a user changes which addon implements a cap on a node. Subscribed
+	* by every kernel process to update its local `preferredProviderRegistry`
+	* so future capability lookups respect the new binding.
+	*/
+	/**
+	* A capability binding was changed for a node — addon X now provides
+	* capability `cap` on node `nodeId`. Lives under the generic
+	* `capability.*` namespace because capability bindings are a kernel-
+	* level concept used by many addons, not strictly pipeline-scoped.
+	*/
+	EventCategory["CapabilityBindingChanged"] = "capability.binding-changed";
+	EventCategory["ModelDownloadProgress"] = "model.download.progress";
+	EventCategory["AgentRegistered"] = "agent.registered";
+	EventCategory["AgentUnregistered"] = "agent.unregistered";
+	EventCategory["AgentOnline"] = "agent.online";
+	EventCategory["AgentOffline"] = "agent.offline";
+	/** Forked worker process (e.g. hub/pipeline) connected to the broker. */
+	EventCategory["WorkerOnline"] = "worker.online";
+	/** Forked worker process disconnected from the broker. */
+	EventCategory["WorkerOffline"] = "worker.offline";
+	EventCategory["AgentTaskDispatched"] = "agent.task.dispatched";
+	EventCategory["AgentTaskAssigned"] = "agent.task.assigned";
+	EventCategory["AgentTrpcConnected"] = "agent.trpc.connected";
+	EventCategory["AgentWsConnected"] = "agent.ws.connected";
+	EventCategory["AgentWsDisconnected"] = "agent.ws.disconnected";
+	EventCategory["AgentBackupActivated"] = "agent.backup.activated";
+	EventCategory["OrchestrationSettingsUpdated"] = "orchestration.settings-updated";
+	/**
+	* Per-agent hwaccel preference changed (user override set, cleared, or
+	* re-probed). Observability event — decoders pull the current pref at
+	* `createSession`, so running sessions keep their current backend until
+	* they rotate naturally (camera add/remove, stream restart). Future
+	* work can wire a listener in stream-broker that force-rotates live
+	* sessions; for now this event powers logs + admin-UI toast feedback.
+	*/
+	EventCategory["PipelineAgentHwaccelChanged"] = "pipeline.agent-hwaccel-changed";
+	EventCategory["MotionAnalysis"] = "detection.motion-analysis";
+	/** All raw motion zones from CCL before minArea filter — for UI debug overlay. */
+	EventCategory["MotionZonesRaw"] = "detection.motion-zones-raw";
+	/**
+	* Per-camera motion phase transition (`watching ↔ active`) emitted
+	* by the runner. Mirrors the `motion.onMotionChanged` cap event
+	* surface — payload `MotionOnMotionChangedPayload` carries
+	* `{deviceId, detected, timestamp, source, regions?}`. Subscribers
+	* include addons that need to react to motion state without
+	* polling the runtime-state mirror.
+	*/
+	EventCategory["MotionOnMotionChanged"] = "motion.on-motion-changed";
+	EventCategory["DetectionResult"] = "detection.result";
+	EventCategory["DetectionRaw"] = "detection.raw";
+	EventCategory["DetectionCameraNative"] = "detection.camera-native";
+	/**
+	* Canonical per-chunk live audio pipeline output. Payload is
+	* `PipelineAudioInferenceResultPayload` carrying a full `AudioResult`
+	* (level + detections + debug). Lives on the pipeline.* namespace
+	* alongside `pipeline.inference-result` (video) for symmetry.
+	*/
+	EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
+	EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
+	EventCategory["ProviderMotion"] = "provider.motion";
+	EventCategory["ProviderDetection"] = "provider.detection";
+	EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
+	EventCategory["EnrichmentSceneStateChanged"] = "enrichment.scene.state-changed";
+	EventCategory["EnrichmentActivitySummary"] = "enrichment.activity.summary";
+	/**
+	* Unified track-lifecycle event: ONE category carrying `phase:
+	* 'start' | 'update' | 'end'` with a rich, typed
+	* `PipelineAnalyticsTrackLifecyclePayload`. Supersedes the thin
+	* `PipelineAnalyticsTrackStarted` / `PipelineAnalyticsTrackEnded`
+	* pair — a consumer subscribes once and branches on `phase`.
+	*/
+	EventCategory["PipelineAnalyticsTrackLifecycle"] = "pipeline-analytics.track-lifecycle";
+	/**
+	* @deprecated Superseded by {@link PipelineAnalyticsTrackLifecycle}
+	* (`phase:'start'`). Kept as a soft alias — no known subscribers.
+	*/
+	EventCategory["PipelineAnalyticsTrackStarted"] = "pipeline-analytics.track-started";
+	/**
+	* @deprecated Superseded by {@link PipelineAnalyticsTrackLifecycle}
+	* (`phase:'end'`). Kept as a soft alias — no known subscribers.
+	*/
+	EventCategory["PipelineAnalyticsTrackEnded"] = "pipeline-analytics.track-ended";
+	EventCategory["PipelineAnalyticsDetectionEvent"] = "pipeline-analytics.detection-event";
+	EventCategory["PipelineAnalyticsFrameTracked"] = "pipeline-analytics.frame-tracked";
+	/**
+	* Fired by `addon-post-analysis` when a parked (stationary) object appears
+	* (a track was promoted to a stationary-registry entry) or departs (the
+	* object moved / was removed). Telemetry (D8): lossy, drives a UI refresh of
+	* the dedicated "Stationary" section — never the live event feed. Payload:
+	* `{ deviceId, entryId, className, phase:'appeared'|'departed', timestamp }`.
+	*/
+	EventCategory["PipelineAnalyticsStationaryChanged"] = "pipeline-analytics.stationary-changed";
+	/**
+	* Fired by `addon-post-analysis` when a package-drop is confirmed inside
+	* a package zone — a newly-appeared stationary object of a package class
+	* that cleared the class / zone / dwell / size gates. Payload:
+	* `PipelineAnalyticsPackageDeliveredPayload` carrying `{ deviceId,
+	* entryId, className, zoneIds, keyFrameMediaKey?, bbox, timestamp }`.
+	* Telemetry (D8): the durable record is the `package-events` store row;
+	* this bus topic drives notifier rules + live UI. See
+	* docs/superpowers/specs/2026-07-17-package-zones-design.md §5.1.
+	*/
+	EventCategory["PipelineAnalyticsPackageDelivered"] = "pipeline-analytics.package-delivered";
+	/**
+	* Fired by `addon-post-analysis` when a previously-delivered package
+	* leaves its zone (the stationary entry departed — moved or swept).
+	* Payload: `PipelineAnalyticsPackagePickedUpPayload` carrying
+	* `{ deviceId, entryId, deliveredEventId, className, timestamp }`.
+	* Telemetry (D8). See package-zones-design §5.2.
+	*/
+	EventCategory["PipelineAnalyticsPackagePickedUp"] = "pipeline-analytics.package-picked-up";
+	/**
+	* Fired by `addon-post-analysis` whenever a gallery face row changes:
+	* `kind:'buffered'` a new detected face was persisted, `'assigned'` /
+	* `'unassigned'` its identity link changed, `'deleted'` the row was
+	* removed. Telemetry semantics (D8): a lost event only delays a refresh,
+	* never a correctness issue. Payload `PipelineAnalyticsFaceGalleryChangedPayload`.
+	*/
+	EventCategory["PipelineAnalyticsFaceGalleryChanged"] = "pipeline-analytics.face-gallery-changed";
+	/**
+	* Fired by `addon-post-analysis` whenever a gallery plate row changes:
+	* `kind:'buffered'` a new read was persisted (`PlateRecognizer.onTrackEnd`),
+	* `'assigned'` / `'unassigned'` its vehicle link changed
+	* (`PlateGalleryProvider`), `'deleted'` the row was removed. Telemetry
+	* semantics (D8): a lost event only delays a refresh, never a correctness
+	* issue. Payload `PipelineAnalyticsPlateGalleryChangedPayload`.
+	*/
+	EventCategory["PipelineAnalyticsPlateGalleryChanged"] = "pipeline-analytics.plate-gallery-changed";
+	EventCategory["FrigateLiveEvent"] = "frigate.live-event";
+	EventCategory["CameraStreamsProfileSlotsChanged"] = "camera-streams.onProfileSlotsChanged";
+	/**
+	* Stream-broker health watchdog. Per-broker (deviceId/profile) emission.
+	* `stream.offline` fires after STREAM_STALE_TIMEOUT_MS without an encoded
+	* packet on an active broker. `stream.online` fires on first packet
+	* after a stale gap (or on initial first packet). Payload includes
+	* the assigned camStreamId as `profileKey`.
+	*/
+	EventCategory["StreamOnline"] = "stream.online";
+	EventCategory["StreamOffline"] = "stream.offline";
+	EventCategory["NetworkTunnelStarted"] = "network.tunnel.started";
+	EventCategory["NetworkTunnelStopped"] = "network.tunnel.stopped";
+	/** Fired by the `local-network` cap when the host's interface set
+	*  changes (new IP from DHCP, VPN connect, docker bridge added). */
+	EventCategory["LocalNetworkChanged"] = "network.local.changed";
+	/**
+	* Fired by a `mesh-network` provider (Tailscale, …) when its
+	* mesh-reachable host changes (join / leave / MagicDNS or 100.x IP
+	* change). Lets `local-network` fold the mesh endpoint into its
+	* connection-endpoint list without a cross-package import. Payload
+	* carries the preferred host (`host: ''` = no longer reachable),
+	* the hub port, and the scheme. Telemetry-grade (D8): consumers
+	* pull-reconcile from the provider's `getStatus` on reconnect. */
+	EventCategory["MeshNetworkChanged"] = "network.mesh.changed";
+	EventCategory["BackupCompleted"] = "backup.completed";
+	EventCategory["BackupRestored"] = "backup.restored";
+	EventCategory["NotificationDispatched"] = "notification.dispatched";
+	EventCategory["NotificationFailed"] = "notification.failed";
+	EventCategory["DeviceUpdated"] = "device.updated";
+	/**
+	* Transport-level connectivity. Emitted by the device driver when
+	* the underlying control socket actually connects / disconnects
+	* (Baichuan TCP, ONVIF probe response, RTSP DESCRIBE, …) — NOT for
+	* power-state transitions on a battery camera. For battery wake /
+	* doze cycles see `DeviceAwake` / `DeviceSleeping`.
+	*/
+	EventCategory["DeviceOnline"] = "device.online";
+	/**
+	* Stream-broker watchdog — emitted when no encoded packet has been
+	* received for STREAM_STALE_TIMEOUT_MS on an active broker (rtsp or
+	* push). Paired with DeviceOnline which fires on first packet after
+	* a stale gap. Payload: DeviceStreamHealthPayload.
+	*/
+	EventCategory["DeviceOffline"] = "device.offline";
+	/**
+	* Battery cam woke up — physical power-state transition reported
+	* by the device firmware. Distinct from `DeviceOnline` so a UI panel
+	* watching power state doesn't flap on every UDP socket reconnect.
+	*/
+	EventCategory["DeviceAwake"] = "device.awake";
+	/**
+	* Battery cam went to sleep. See `DeviceAwake`.
+	*/
+	EventCategory["DeviceSleeping"] = "device.sleeping";
+	EventCategory["RetentionCleanup"] = "retention.cleanup";
+	/**
+	* Legacy bulk-update progress snapshot (payload `BulkUpdateState`). No longer
+	* emitted — F3 removed the coordinator that produced it; "Update all" now runs
+	* as one lifecycle engine job (`AddonsJobProgress`/`AddonsJobLog`). Retained
+	* (with `BulkUpdateState`) only to avoid regenerating the event maps; removed
+	* in F4 once live bulk progress is re-implemented over the engine events.
+	*/
+	EventCategory["AddonsBulkUpdateProgress"] = "addons.bulk-update-progress";
+	EventCategory["AddonsJobProgress"] = "addons.job-progress";
+	EventCategory["AddonsJobLog"] = "addons.job-log";
+	/**
+	* A container's child visibility toggled (hidden/shown). Emitted by the
+	* `accessories` cap when a child device is hidden or revealed.
+	* Payload: `{ deviceId, childDeviceId, hidden }`.
+	*/
+	EventCategory["AccessoriesChildVisibilityChanged"] = "accessories.onChildVisibilityChanged";
+	/**
+	* A container's child set changed (children added/removed/reordered).
+	* Payload: `{ deviceId, childDeviceIds, hiddenChildIds }`.
+	*/
+	EventCategory["AccessoriesChanged"] = "accessories.onAccessoriesChanged";
+	/**
+	* Progress update from a running model conversion job.
+	* Payload: `{ kind: 'model-convert', phase, sessionId?, pct?, detail? }`.
+	* Emitted by `addon-model-studio` on the converting node.
+	*/
+	EventCategory["ModelConvertProgress"] = "model-convert.progress";
+	return EventCategory;
+}({});
 Object.fromEntries([
 	{
 		id: "overview",
@@ -6286,17 +6286,6 @@ var ProfileSlotSchema = object({
 	errorMessage: string().optional()
 });
 /**
-* The broker id keying a physical SOURCE stream: `${deviceId}/${camStreamId}`.
-* This is the broker's internal source key (`brokerIdFor` in the manager) — a
-* `camStreamId` like `native:main` — as opposed to the public profile alias
-* {@link makeProfileBrokerId}. Used to resolve a source's restream endpoint
-* (e.g. routing a transcode's ffmpeg input through the broker so it rides the
-* single source dial instead of opening a second camera connection).
-*/
-function makeSourceBrokerId(deviceId, camStreamId) {
-	return `${deviceId}/${camStreamId}`;
-}
-/**
 * Zod schema for StreamSourceEntry — the canonical stream descriptor
 * exposed by ICameraDevice.getStreamSources() and consumed by the broker.
 */
@@ -7113,6 +7102,14 @@ var EncodeProfileSchema = object({
 			"main",
 			"high"
 		]).optional(),
+		/**
+		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+		* it, or it ships a stream that does not match its own advertisement — the
+		* defect class that kept HomeKit black for a year and that Alexa carried
+		* silently. Optional because a browser negotiates the level itself.
+		*/
+		level: string().optional(),
 		width: number().int().positive().optional(),
 		height: number().int().positive().optional(),
 		fps: number().positive().optional(),
@@ -7160,6 +7157,55 @@ var EncodeProfileSchema = object({
 	outputArgs: array(string()).optional()
 });
 /**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
+		width: 1280,
+		height: 720,
+		fps: 25,
+		bitrateKbps: 2500,
+		gopFrames: 25,
+		bf: 0,
+		preset: "veryfast",
+		tune: "zerolatency"
+	},
+	audio: "passthrough"
+};
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
+/**
+* Alexa's egress profile. Alexa's audio ALSO rides the WebRTC session's own
+* audio plane (out-of-band), so this is `passthrough` exactly like the browser
+* — see the ADR for why the previous in-band Opus was encoded and discarded.
+*/
+/**
+* Alexa's egress asks for OPUS, and that is a change with a history.
+*
+* The previous profile encoded Opus IN-BAND into an MPEG-TS, where it was
+* discarded: Opus is `stream_type 0x06` and the broker's demuxer maps only
+* `0x0f` (aac), `0x03`/`0x04` (mp2) and `0x81` (ac3). Every frame it produced
+* died at the demuxer, so the encode was replaced with `passthrough` — correct,
+* because paying libopus for nothing is worse than silence.
+*
+* But `passthrough` means the egress emits NO audio at all, and Alexa's audio
+* does not arrive by magic: it rides the published stream, which is what the
+* WebRTC session dials. So the Echo had video and silence either way.
+*
+* Opus here now reaches the egress AUDIO SIDECAR — a separate RTP leg the
+* restreamer grafts onto its SDP — which never touches the MPEG-TS demuxer that
+* killed the in-band attempt. Same codec, different plane, and this one the
+* consumer can actually negotiate.
+*/
+var ALEXA_EGRESS_PROFILE = {
+	...BASE_LIVE_EGRESS_PROFILE,
+	audio: { codec: "opus" }
+};
+/**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
 * node. Produced by the backend `WiringHealthService` and surfaced via
@@ -7209,6 +7255,154 @@ object({
 	})
 });
 /**
+* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
+* pipeline functions an operator thinks in terms of.
+*
+* ## This file adds no state
+*
+* Every switch here is a VIEW onto an authority that already existed
+* ([D62](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* group is that there is exactly one place each function is turned off, and
+* the group routes to it:
+*
+* | Switch | Authority | Proven "off stops the work" gate |
+* | --- | --- | --- |
+* | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
+* | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
+* | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
+* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+* | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
+* | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+*
+* ## The two switches whose authority is not on this server
+*
+* `privacy-mask` and `device-audio` write the CAMERA. That is not a loophole
+* in "the group stores nothing" — it is the purest form of it: the camera
+* holds the fact, every read is a read-through, and there is no server-side
+* copy that could drift. Their availability therefore cannot come from
+* `listBindableCapsForDeviceType` (a device-NATIVE cap carries no wrappers and
+* is filtered out there); it comes from the cap's own camera-probed
+* `privacyMask.getOptions()`, which is strictly more honest — it answers for
+* THIS camera rather than for the device type
+* ([D74](../../../../docs/decisions/adr-0074.md)).
+*
+* ## `privacy-mask` is the one row whose ON is not "the function is working"
+*
+* Every other switch means *this camera's function is doing its job*, so
+* `enabled: false` is a thing an operator took away. `privacy-mask` means **the
+* MASK is active** — `enabled: true` is video deliberately obscured. The
+* polarity is not a choice made here: `addon-export-hap`'s privacy `Switch`
+* (`builders/privacy-switch.ts`) already mirrors `patch.enabled` verbatim, and
+* a HomeKit toggle that disagreed with the app's toggle for the same camera is
+* worse than either surface not having one.
+*
+* Two consequences follow and both are load-bearing:
+*
+* - **It never counts as `switchedOff`.** `countsAsSwitchedOff` is `false` for
+*   exactly this row. With the polarity above, every camera that has NOT drawn
+*   a privacy mask would otherwise report `switchedOff: ['privacy-mask']` — the
+*   normal, healthy state of most cameras rendered as an operator disablement.
+* - **Its cost line names BOTH directions.** `costWhenOff` is rendered
+*   unconditionally by both clients, so for this row it has to read correctly
+*   whichever way the switch is sitting.
+*
+* The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
+* migrated the legacy `audioEnabled` / `pipelineEnabled` /
+* `motionDetectionEnabled` booleans ONTO `setWrapperActive`. The group is the
+* surface that decision never got.
+*
+* ## Two rules that are load-bearing
+*
+* - **Recording's switch is `enabled`, never the bands.** `bands` is the only
+*   authored intent and `mode` is derived from it (`deriveRecordingMode`).
+*   Expressing "off" by clearing bands destroys the operator's schedule and
+*   turning the camera back on would then silently record nothing.
+* - **A switch that is off must be reported as off**, not merely produce
+*   nothing. {@link CameraSwitch.enabled} is what a status surface renders as
+*   "disabled by an operator" instead of "broken" — see
+*   `CameraStatus.switchedOff`.
+*/
+/**
+* The functions the operator named — five on 2026-08-05, plus the camera's own
+* microphone on 2026-08-07. Deliberately NOT one id per pipeline step: face
+* recognition and plate/LPR are per-step toggles on
+* `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
+* editor, not in a safety group.
+*/
+var CameraSwitchIdSchema = _enum([
+	"stream-broker",
+	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"audio-analysis",
+	"recording",
+	"notifications"
+]);
+/**
+* WHERE the switch's state actually lives. A discriminated union rather than a
+* string so both the writer (the orchestrator's `setCameraSwitch`) and any
+* reader can exhaustively narrow — and so "the group added a parallel map" is
+* a compile error rather than a review comment.
+*/
+var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
+	object({ kind: literal("device-disabled") }),
+	object({
+		kind: literal("wrapper-binding"),
+		capName: string()
+	}),
+	object({ kind: literal("recording-config") }),
+	object({ kind: literal("notification-mute") }),
+	object({
+		kind: literal("camera-audio"),
+		capName: string()
+	}),
+	object({
+		kind: literal("camera-mask"),
+		capName: string()
+	})
+]);
+/**
+* Why a switch is not offered for this camera. Rendered instead of the
+* control, never as a dead control — an absent function and a broken one must
+* not look the same.
+*/
+var CameraSwitchUnavailableReasonSchema = _enum([
+	"no-provider",
+	"source-unreachable",
+	"not-configured"
+]);
+/**
+* One switch, resolved for one camera.
+*
+* `label` and `costWhenOff` travel ON THE WIRE rather than being looked up
+* client-side: the viewer is a separate repository that does not import
+* `@camstack/types`, and a cost line duplicated in two clients is a cost line
+* that will disagree with itself. Five rows per camera is nothing.
+*/
+var CameraSwitchSchema = object({
+	id: CameraSwitchIdSchema,
+	label: string(),
+	/**
+	* What the operator LOSES while this is off, in one sentence. Required, not
+	* optional: a switch that cannot say what it costs should not ship.
+	*/
+	costWhenOff: string(),
+	/** False = do not render a control. `unavailableReason` says why. */
+	available: boolean(),
+	unavailableReason: CameraSwitchUnavailableReasonSchema.optional(),
+	/** Current state. Meaningless when `available` is false — read it as `true`. */
+	enabled: boolean(),
+	authority: CameraSwitchAuthoritySchema
+});
+/** The whole group for one camera. */
+var CameraSwitchGroupSchema = object({
+	deviceId: number().int(),
+	switches: array(CameraSwitchSchema).readonly(),
+	/** Unix ms when the group was composed server-side. */
+	fetchedAt: number()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -7227,14 +7421,16 @@ var OpsLogOpSchema = _enum([
 	"manual-delete",
 	"rescan",
 	"retention-run",
-	"relocate"
+	"relocate",
+	"orphan-audit"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
 	"retention",
 	"quota",
 	"manual",
-	"operator"
+	"operator",
+	"maintenance"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = object({
@@ -9168,6 +9364,126 @@ var RtpSourceSchema = object({
 	encoder: string(),
 	pipelineKey: string()
 });
+/**
+* The encode request — **structured and serialisable, with NO raw-flag escape
+* hatch.** This is deliberate and it is the one lesson taken from
+* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
+* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
+* adding a flag silently forks the shared child, and two consumers that mean
+* the same thing but spell it differently never share. Here every knob is a
+* NAMED field: a new requirement becomes a schema field (and a codegen run),
+* never an opaque array.
+*
+* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
+* The operator-facing derived-stream transform editor still has them — that is
+* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
+* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
+*/
+var EgressEncodeSchema = EncodeProfileSchema.omit({
+	inputArgs: true,
+	outputArgs: true
+});
+/**
+* How the encoder is bounded. `'tight'` is a one-second VBV window for a
+* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
+* seconds, letting a keyframe spike borrow from the next second (a browser,
+* an Echo). Named rather than numeric so the INTENT survives.
+*/
+var EgressRateControlSchema = _enum(["tight", "relaxed"]);
+var EgressTranscodeRequestSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** Which published stream to read. */
+	source: discriminatedUnion("kind", [object({
+		kind: literal("profile"),
+		profile: CamProfileSchema
+	}), object({
+		kind: literal("cam-stream"),
+		camStreamId: string().min(1)
+	})]),
+	encode: EgressEncodeSchema,
+	rateControl: EgressRateControlSchema.optional(),
+	/**
+	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
+	* out-of-band extradata and needs `dump_extra` on both the copy and encode
+	* branches. Enumerated, not free text.
+	*/
+	bitstreamFilter: _enum([
+		"dump_extra",
+		"h264_mp4toannexb",
+		"hevc_mp4toannexb"
+	]).optional(),
+	/**
+	* Publish the transcode as a LOCAL push cam stream, instead of leaving the
+	* consumer to dial the returned url. The broker picks the id and returns it
+	* as `camStreamId` — a caller-supplied one would be circular, since the
+	* sharing key is computed FROM this request.
+	*
+	* The url is still returned and still the contract for a transcode pinned to
+	* another node. But dialling it locally costs an RTSP round trip that changes
+	* the transport underneath the consumer: a dialled stream is an RTP source,
+	* so `isRtpSource()` is true and the session takes the RTP-passthrough +
+	* repacketizer branch. The push branch — the one the derived mechanism has
+	* live hours on — is never reached. Measured on Alexa: broker registered, RTP
+	* arriving, key frame arriving, black screen, on a chain healthy at every
+	* other point.
+	*
+	* Same idea the transport already applies to CALLS, where `classifyCapRoute`
+	* gives priority to `hub-in-process` so a local call never leaves the node.
+	* This is that rule for media.
+	*/
+	publishLocally: boolean().optional(),
+	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
+	/**
+	* Operator/consumer override for decode hardware. ABSENT is the normal case
+	* and the one that matters: the broker then resolves the backend from the
+	* DECODER ADDON's per-node `probedBestHwaccel` (see
+	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
+	* on this hardware — never the raw kernel resolver's qsv-first order.
+	*/
+	decodeHwAccel: _enum([
+		"auto",
+		"none",
+		"videotoolbox",
+		"vaapi",
+		"qsv",
+		"cuda"
+	]).optional(),
+	/**
+	* Host to embed in the returned restream `url`. The broker mints hub-local
+	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
+	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
+	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
+	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	*/
+	hostname: string().optional(),
+	/** Attribution for the broker panel. Never part of the sharing key. */
+	tag: string().optional()
+});
+var EgressTranscodeSchema = object({
+	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
+	url: string(),
+	/** Release handle. Refcounted — the child dies when the last holder releases. */
+	pipelineKey: string(),
+	videoCodec: _enum(["H264", "H265"]),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	transcoded: boolean(),
+	encoder: string(),
+	/**
+	* The decode backend the child ACTUALLY ran with — `null` for software.
+	* Returned rather than assumed: a consumer that asked for hardware and got
+	* software needs to be able to see that without reading the broker's logs.
+	*/
+	decodeHwAccel: string().nullable(),
+	/**
+	* Set when `publishLocally` was honoured: attach to THIS instead of dialling
+	* `url`, and the session takes the push/deframe transport rather than the
+	* RTP-passthrough one. `null` means the consumer must dial.
+	*/
+	camStreamId: string().nullable()
+});
 method(object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string().min(1),
@@ -9277,6 +9593,15 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ pipelineKey: string() }), object({
+	released: boolean(),
+	refcount: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
 	subscriptionId: string(),
 	maxCount: number().int().positive().default(8)
@@ -13650,12 +13975,13 @@ var NcConditionsSchema = object({
 	* source; otherwise the subject's source must equal it. Legacy records
 	* with no stamped source are treated as `pipeline`. The union spans both
 	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
+	* tracks carry `sensor` (a linked device) or `audio` (a D62 audio marker).
 	*/
 	source: _enum([
 		"pipeline",
 		"onboard",
 		"sensor",
+		"audio",
 		"any"
 	]).optional(),
 	/**
@@ -14231,6 +14557,12 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	rule: NcRuleInputSchema,
 	lookbackMinutes: number().int().min(1).max(1440).default(60)
@@ -14575,12 +14907,60 @@ var TrackAudioLabelSchema = object({
 });
 /**
 * How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
-* linked sensor/control state change (no positions; carries a snapshot). The
-* spatial subsystems (tracker association, occupancy count, re-id/embedding,
-* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
+*
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
+*/
+var TrackSourceSchema = _enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* What the flags DO is deliberately UNDEFINED at the time of writing: they are
+* operator curation, and the behaviour they drive will be specified separately.
+* In particular a `markForTrain` track is NOT pinned against retention — see
+* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
 */
-var TrackSourceSchema = _enum(["pipeline", "sensor"]);
+var TrackFlagFields = {
+	/** Operator marked this track as training material. */
+	markForTrain: boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: boolean().optional()
+};
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
+*/
+var TrackFlagsSchema = object({
+	trackId: string(),
+	markForTrain: boolean(),
+	debug: boolean()
+});
 var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
@@ -14623,7 +15003,8 @@ var TrackSchema = object({
 	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-	envelope: TrackEnvelopeSchema.optional()
+	envelope: TrackEnvelopeSchema.optional(),
+	...TrackFlagFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -14836,7 +15217,8 @@ var KeyEventSchema = object({
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: number().optional()
+	windowMs: number().optional(),
+	...TrackFlagFields
 });
 object({
 	trackId: string(),
@@ -14921,16 +15303,32 @@ var RebuildObjectEmbeddingsInput = object({
 	deviceId: number().optional(),
 	since: number().optional(),
 	until: number().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: number().int().positive().optional(),
 	/**
-	* Fraction added on EACH side of the detection box before cropping.
-	* ~0.2 (a 1.4x window) gives CLIP the surroundings it is trained on; 0 is
-	* the pixel-tight crop the first implementation used.
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
 	*/
-	cropMargin: number().min(0).max(4).optional(),
-	/** Square the window before extracting, so a tall subject is not squashed. */
-	square: boolean().optional(),
-	/** Stop after this many tracks; the result reports whether more remain. */
-	maxTracks: number().int().positive().optional()
+	executeOnNodeId: string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: number().int().nonnegative().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -14963,6 +15361,24 @@ var RebuildStatusSchema = object({
 	missingKeyFrame: number(),
 	/** Tracks with no usable detection box. */
 	missingBbox: number(),
+	/**
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
+	*/
+	notRunnable: number(),
+	/**
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
+	*/
+	noCapableNode: number(),
 	failed: number(),
 	/** Set once a pass ends: true only when EVERYTHING was covered. */
 	complete: boolean().nullable(),
@@ -15034,7 +15450,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), EventStoreFootprintSchema, {
+}), method(object({
+	/** Log/audit scope only — the trackId is globally unique on its own. */
+	deviceId: number(),
+	trackId: string(),
+	flags: TrackFlagsPatchSchema
+}), TrackFlagsSchema, { kind: "mutation" }), method(object({}), EventStoreFootprintSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({
@@ -15644,6 +16065,53 @@ var DetailResultSchema = object({
 	nativeFaceShortSidePx: number().optional()
 });
 /**
+* Why an executing node REFUSED a stateless step run (`runStatelessStep`).
+*
+* A refusal is a first-class answer, not an error, because the caller's next
+* move depends on WHICH one it is — and because "the pass produced nothing"
+* must never be reachable without a named, counted cause. The two tiers:
+*
+* - **node-level** (`unknown-step`, `model-not-servable`) — this node can
+*   never serve this (step, model) pair. The caller drops it from its rotation
+*   and retries the same work elsewhere; nothing about the work changes.
+* - **work-level** (`unreadable-frame`, `execution-failed`) — this node is
+*   fine, this one request is not. Retrying it on another node would only
+*   spread the same failure.
+*/
+var StatelessStepRefusalSchema = _enum([
+	"unknown-step",
+	"model-not-servable",
+	"unreadable-frame",
+	"execution-failed"
+]);
+/**
+* Answer to `runStatelessStep` — a discriminated union rather than a nullable
+* result, because `null` is exactly what made the camera-bound detail path
+* unable to tell "refused" from "never asked".
+*/
+var RunStatelessStepResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("ran"),
+	/** The node that actually executed it — the pin, echoed back for the log. */
+	nodeId: string(),
+	/**
+	* The model the step ran with.
+	*
+	* The node verified this exact id has a build for the format it dispatched
+	* on BEFORE running, so the executor's format resolution returns it
+	* unchanged. A caller that pinned a model must compare this field and
+	* treat a mismatch as a refusal — the whole point of the pin is that a
+	* pass writes one feature space.
+	*/
+	modelId: string(),
+	details: array(DetailResultSchema)
+}), object({
+	kind: literal("refused"),
+	nodeId: string(),
+	reason: StatelessStepRefusalSchema,
+	/** Human-readable specifics — the format tried, the formats shipped, etc. */
+	detail: string()
+})]);
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -15979,10 +16447,46 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 }), NativeCropResultSchema.nullable()), method(object({
 	deviceId: number(),
 	frameHandle: FrameHandleSchema.optional(),
+	/**
+	* FULL FRAME (base64 JPEG). The runner derives the crop rectangle from
+	* `parent.bbox` with the cluster crop convention and cuts it itself —
+	* do NOT pre-crop for this field, that is what `cropJpeg` is.
+	*/
+	frameJpeg: string().optional(),
+	/**
+	* PRE-CUT tile (base64 JPEG), used verbatim — NO padding is applied.
+	* The fallback when the lease/session backing the frame is gone and the
+	* caller already holds a crop.
+	*/
 	cropJpeg: string().optional(),
 	parent: DetailParentSchema,
 	steps: array(string()).optional()
-}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
+}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" }), method(object({
+	/** Catalog step id, e.g. `clip-embedding`. */
+	stepId: string(),
+	/**
+	* REQUIRED model pin. The node runs this exact model or refuses with
+	* `model-not-servable` — it never substitutes a format default, because
+	* a fleet pass that round-robins across nodes would then fill one index
+	* from several encoders.
+	*/
+	modelId: string(),
+	/** FULL FRAME, base64 JPEG. The runner cuts — do NOT pre-crop. */
+	frameJpeg: string(),
+	/**
+	* The subject box, NORMALISED [0,1] against `frameJpeg`. Normalised on
+	* purpose: the caller stores boxes against a downscaled analysis frame
+	* while the stored key frame is native-resolution, and the only side
+	* that reliably knows the image's pixel dimensions is the side that
+	* decodes it. Denormalising here removes a second reader of the
+	* dimensions and the class of mismatch that comes with it.
+	*/
+	bbox: NativeCropBboxSchema,
+	/** Parent class of the subject (`person`, `vehicle`, …) — carried into the result. */
+	className: string(),
+	/** Camera the pixels came from. Diagnostics + log tags ONLY — never routing. */
+	sourceDeviceId: number()
+}), RunStatelessStepResultSchema, { kind: "mutation" });
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -16280,6 +16784,20 @@ var CameraStatusSchema = object({
 	detection: CameraDetectionStatusSchema.nullable(),
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
+	/**
+	* Per-camera function switches an OPERATOR has turned off
+	* ([D61](../../../../docs/decisions/adr-0067.md)).
+	*
+	* This is the difference between DISABLED and BROKEN. A camera whose
+	* `detection` block reports zero fps and whose `switchedOff` contains
+	* `'object-detection'` was switched off by a person; the same camera with an
+	* empty list is failing. Every status surface must render the two
+	* differently — a quiet camera that looks identical to a dead one is the
+	* silence-reads-as-never-happened trap this repo keeps paying for.
+	*
+	* Empty when nothing is off. Never contains a switch no provider offers.
+	*/
+	switchedOff: array(CameraSwitchIdSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -16448,7 +16966,14 @@ method(object({
 }), method(object({
 	deviceId: number(),
 	agentNodeId: string().optional()
-}), CameraPipelineConfigSchema), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
+}), CameraPipelineConfigSchema), method(object({ deviceId: number() }), CameraSwitchGroupSchema), method(object({
+	deviceId: number(),
+	switchId: CameraSwitchIdSchema,
+	enabled: boolean()
+}), CameraSwitchGroupSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
 	name: string(),
 	description: string().optional(),
 	config: CameraPipelineConfigSchema
@@ -16771,9 +17296,15 @@ DeviceType.Camera, method(object({
 	* Bypass the cache freshness check and fetch directly from the
 	* native (or stream-broker fallback). Triggered by the UI's
 	* "refresh" button so an operator can force a fresh frame
-	* even when the cache is well within `snapshotMaxAgeMs`.
-	* On battery cams this WILL wake the camera — accept the
-	* cost only when the user explicitly asks for it.
+	* even when the cache is well within the device's
+	* `snapshotMaxAgeS` window.
+	*
+	* **`force` is an OPERATOR signal, not a freshness preference.** On a
+	* battery camera it is the one thing that walks past the wrapper's
+	* sleep gate and wakes the camera, so a background caller — a poller,
+	* an event handler, a thumbnail — must NEVER set it. Every such caller
+	* gets the cached frame, which on a sleeping battery camera is the
+	* correct answer: stale but honest beats woken.
 	*/
 	force: boolean().optional()
 }), SnapshotImageSchema.nullable()), method(object({ deviceId: number() }), _void(), {
@@ -21055,12 +21586,30 @@ object({
 });
 DeviceType.Sensor;
 /**
-* Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
-* cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
-* ISAPI `<RegionCoordinatesList>` zones are free polygons (this camera:
-* exactly 4 vertices, not necessarily axis-aligned). The cap composes the
-* shared rect|polygon subset of the MaskShape vocabulary. All coords are
-* normalized 0..1 (top-left origin).
+* PRIVACY — what the camera deliberately does not capture. Two planes:
+*
+*  - **video**: up to `maxRegions` SHAPES the camera blanks out (NOT a cell
+*    grid). Reolink `<shelterList>` zones are rectangles; Hikvision ISAPI
+*    `<RegionCoordinatesList>` zones are free polygons (this camera: exactly
+*    4 vertices, not necessarily axis-aligned). The cap composes the shared
+*    rect|polygon subset of the MaskShape vocabulary. All coords are
+*    normalized 0..1 (top-left origin).
+*  - **audio**: the camera's microphone. `setAudioEnabled(false)` stops the
+*    camera encoding an audio track at all, so EVERY consumer — live view,
+*    recording, the audio analyzer, an export — sees silent video. There is
+*    no server-side copy of this fact; the camera is the store and every read
+*    is a read-through, which is why a switch over it cannot drift
+*    ([D62](../../../../docs/decisions/adr-0062.md)).
+*
+* Both belong here for one reason: they are the two things an operator turns
+* off when the answer to "what is this camera allowed to record" changes, and
+* both are applied ON the device, before anything leaves it.
+*
+* **The audio flag has exactly one writer.** `stream-params` used to carry a
+* per-profile `audio` in its patch schema — reachable from no UI and honoured
+* by one provider — and it was removed when this landed. A second writer onto
+* one device register is the shape of every knob this repo has shipped that
+* disagreed with the one the reader read.
 */
 /** A privacy-mask region's geometry — rectangle or free polygon. */
 var PrivacyMaskShapeSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
@@ -21076,16 +21625,40 @@ object({
 	enabled: boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: array(PrivacyMaskRegionSchema),
+	/**
+	* Is the camera capturing sound right now? Read from the camera, never from
+	* a server-side mirror.
+	*
+	* `null` means "no answer" — either this camera exposes no controllable
+	* microphone (`getOptions().supportsAudioMute === false`) or the read
+	* failed. A consumer must render `null` as UNKNOWN and never as `false`:
+	* "the microphone is off" and "we could not ask" look identical to an
+	* operator only until one of them is wrong.
+	*
+	* On a camera whose profiles carry the flag independently (Reolink writes
+	* it per stream), `true` means AT LEAST ONE profile still carries audio —
+	* privacy is only satisfied when every one of them is silent.
+	*/
+	audioEnabled: boolean().nullable(),
 	lastFetchedAt: number()
 });
-/** Per-camera availability. */
+/** Per-camera availability. Probed, never assumed from the model name. */
 var PrivacyMaskOptionsSchema = object({
 	/** Maximum number of supported zones. */
 	maxRegions: number(),
 	/** Shape kinds this camera accepts — Reolink: ['rect']; Hikvision: ['rect','polygon']. */
 	supportedShapes: array(MaskShapeKindSchema),
 	/** Polygon vertex bounds when 'polygon' is supported (Hikvision: {min:4,max:4}). */
-	polygonVertices: MaskPolygonVerticesSchema.optional()
+	polygonVertices: MaskPolygonVerticesSchema.optional(),
+	/**
+	* Does this camera expose a microphone switch we can actually write?
+	*
+	* Camera-probed: `true` only when the firmware answered with an audio flag
+	* we know how to patch. A camera that never answered is `false` — a control
+	* the operator can press that changes nothing is worse than no control, and
+	* the switch group renders "not available" instead.
+	*/
+	supportsAudioMute: boolean()
 });
 /** Partial change — every field optional. */
 var PrivacyMaskPatchSchema = object({
@@ -21098,6 +21671,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), PrivacyMaskOptionsSche
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
 });
 var PtzPresetSchema = object({
 	id: string(),
@@ -21307,6 +21886,21 @@ var LocateSegmentResultSchema = discriminatedUnion("kind", [object({
 })]);
 /** Raw bytes of one finalized footage segment (read off disk on the recording node). */
 var ReadSegmentBytesResultSchema = object({ data: _instanceof(Uint8Array) });
+/**
+* One GOP of a finalized segment, cut by byte range through the segment's own
+* `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+* the single `moof`+`mdat` covering the requested instant — standalone-
+* demuxable, never the whole file. When the segment's index cannot be parsed
+* the provider degrades INSIDE the mechanism to the whole segment (still one
+* `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+*/
+var ReadGopBytesResultSchema = object({
+	data: _instanceof(Uint8Array),
+	/** Absolute epoch ms of the returned fragment's first sample. */
+	gopStartMs: number(),
+	/** Media ms the returned fragment covers. */
+	gopDurMs: number()
+});
 method(object({
 	deviceId: number(),
 	fromMs: number(),
@@ -21349,6 +21943,14 @@ method(object({
 }), ReadSegmentBytesResultSchema, {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	profile: string(),
+	startMs: number(),
+	epochMs: number()
+}), ReadGopBytesResultSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	config: RecordingConfigSchema
@@ -21829,6 +22431,16 @@ var StreamProfileConfigSchema = object({
 		"baseline"
 	]).optional(),
 	gop: number().optional(),
+	/**
+	* Whether THIS profile currently carries an audio track. READ-ONLY here.
+	*
+	* There is no matching field on {@link StreamProfilePatchSchema}: the
+	* camera's microphone is owned by `privacy-mask` (`setAudioEnabled`), which
+	* writes every profile at once so "audio off" means silent everywhere. A
+	* per-profile writer beside it would let a camera be half-muted and would be
+	* a second knob onto one device register — the failure D62 exists to
+	* prevent. Absent when the firmware does not report the flag.
+	*/
 	audio: boolean().optional()
 });
 object({
@@ -21869,7 +22481,13 @@ var StreamParamsOptionsSchema = object({
 	ext: StreamProfileOptionsSchema.optional()
 });
 /** A partial change to one profile — every field optional; a provider
-*  ignores fields it doesn't support. */
+*  ignores fields it doesn't support.
+*
+*  There is deliberately NO `audio` here. It existed until 2026-08-07,
+*  reachable from no form and honoured by exactly one provider, while the
+*  camera's microphone is a whole-device fact. It now has one writer,
+*  `privacyMask.setAudioEnabled`, which writes every profile — see
+*  `privacy-mask.cap.ts`. */
 var StreamProfilePatchSchema = object({
 	width: number().optional(),
 	height: number().optional(),
@@ -21882,8 +22500,7 @@ var StreamProfilePatchSchema = object({
 		"main",
 		"baseline"
 	]).optional(),
-	gop: number().optional(),
-	audio: boolean().optional()
+	gop: number().optional()
 });
 DeviceType.Camera, method(object({ deviceId: number() }), StreamParamsOptionsSchema), method(object({
 	deviceId: number(),
@@ -25405,6 +26022,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listDeviceMutes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listRules": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -25423,6 +26046,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.setDeviceMuted": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -25693,11 +26322,17 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.searchObjectEvents": {
+	"pipelineAnalytics.searchObjectEvents": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
@@ -26005,6 +26640,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraSwitches": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCapabilityBindings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -26137,6 +26778,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSwitch": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCapabilityBinding": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -26227,6 +26874,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runStatelessStep": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -26359,6 +27012,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"privacyMask.setAudioEnabled": {
+		capName: "privacy-mask",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"privacyMask.setMask": {
 		capName: "privacy-mask",
 		capScope: "device",
@@ -26527,6 +27186,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.readGopBytes": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.readSegmentBytes": {
 		capName: "recording",
 		capScope: "system",
@@ -27043,6 +27708,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.acquireEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.assignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -27151,6 +27822,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.releaseEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.releaseStreamWithCodec": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -27911,6 +28588,112 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
+object({
+	/**
+	* Fraction of the box's own size added on EACH side before cutting.
+	*
+	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
+	* removes exactly the context it is strongest on (a dog cut to its outline
+	* is a dark blob). The right value is an empirical question, which is why it
+	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
+	*/
+	paddingRatio: number().min(0).max(4),
+	/**
+	* Square the window (in PIXELS) before cutting.
+	*
+	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
+	* — a standing person becomes a shape the model never saw. Squaring costs
+	* extra background, which is context the model wants anyway. Off by default
+	* because the live path has never squared and the stored index reflects that.
+	*/
+	square: boolean()
+});
+({
+	paddingRatio: .15,
+	square: false
+}).paddingRatio;
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
+object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
+DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 //#endregion
 //#region src/custom-actions.ts
 /**
@@ -27942,6 +28725,87 @@ var exportAlexaActions = defineCustomActions({
 	}), { kind: "mutation" })
 });
 //#endregion
+//#region src/egress/alexa-rtc-egress.ts
+/**
+* Acquire Alexa's encoded stream and make it dialable by a WebRTC session.
+*
+* The request carries NO raw ffmpeg flags — the primitive's schema has no
+* escape hatch, on purpose: an opaque `outputArgs` array would be both the
+* extensibility mechanism AND part of the sharing key, so one extra flag would
+* silently fork the shared child and two consumers meaning the same thing but
+* spelling it differently would never share.
+*
+* Placement note: the call is UNPINNED, so `classifyCapRoute` serves it
+* hub-in-process. Moving Alexa's transcode to another node is a `nodePin` here
+* plus a `hostname` this addon can dial — nothing else in this function
+* assumes hub-locality.
+*/
+async function acquireAlexaEgress(input) {
+	const { api, deviceId, sourceProfile, sessionId } = input;
+	const transcode = await api.streamBroker.acquireEgressTranscode.mutate({
+		deviceId,
+		source: {
+			kind: "profile",
+			profile: sourceProfile
+		},
+		encode: ALEXA_EGRESS_PROFILE,
+		rateControl: "relaxed",
+		publishLocally: true,
+		tag: `alexa/${sessionId}`
+	});
+	const camStreamId = transcode.camStreamId;
+	if (camStreamId === null) {
+		await api.streamBroker.releaseEgressTranscode.mutate({ pipelineKey: transcode.pipelineKey }).catch(() => void 0);
+		input.logger?.warn("alexa egress: broker did not publish locally — released the handle", {
+			tags: {
+				deviceId,
+				sessionId
+			},
+			meta: { pipelineKey: transcode.pipelineKey }
+		});
+		throw new Error("alexa egress: broker declined to publish the transcode locally");
+	}
+	input.logger?.info("alexa egress: acquired through the ffmpeg primitive", {
+		tags: {
+			deviceId,
+			sessionId
+		},
+		meta: {
+			pipelineKey: transcode.pipelineKey,
+			camStreamId,
+			encoder: transcode.encoder,
+			decodeHwAccel: transcode.decodeHwAccel ?? "software"
+		}
+	});
+	return {
+		camStreamId,
+		pipelineKey: transcode.pipelineKey,
+		transcode
+	};
+}
+/**
+* Drop this session's reference, and retract the published stream once the LAST
+* holder has gone.
+*
+* Never throws. Alexa expects an `Alexa.Response` to `SessionDisconnected`, and
+* a stale handle after a broker respawn is a normal event — turning either into
+* an error envelope would make a clean teardown look like a fault.
+*/
+async function releaseAlexaEgress(input) {
+	const { api, deviceId, pipelineKey } = input;
+	try {
+		await api.streamBroker.releaseEgressTranscode.mutate({ pipelineKey });
+	} catch (err) {
+		input.logger?.warn("alexa egress: release failed — the handle may leak until the broker restarts", {
+			tags: { deviceId },
+			meta: {
+				pipelineKey,
+				error: errMsg(err)
+			}
+		});
+	}
+}
+//#endregion
 //#region src/handlers/types.ts
 /**
 * Zod schemas for the subset of the Alexa Smart Home directive surface
@@ -28655,169 +29519,7 @@ async function handleInitializeCameraStreams(header, endpointRaw, payloadRaw, de
 	} };
 }
 //#endregion
-//#region src/egress/alexa-rtc-egress.ts
-/**
-* `AlexaRtcEgress` — placeholder `RtpEgress` adapter for the Alexa RTC
-* session path.
-*
-* Today Alexa RTC works by handing the SDP offer received in the
-* `Alexa.RTCSessionController.InitiateSessionWithOffer` directive to the
-* `webrtc-session` cap's `handleOffer` mutation. That call lives inside
-* `addon-pipeline`, runs through the broker-resident `AdaptiveSession`,
-* and ultimately wires the same DTLS-SRTP-over-werift egress as the
-* browser viewer. The Alexa path is therefore "WebRTC over a different
-* signalling channel" — the egress is functionally `WebRtcEgress`.
-*
-* This wrapper exists for two reasons:
-*  1. So the four export targets (WebRTC viewer, HomeKit, Alexa, future
-*     SRTP-out) each have an `RtpEgress`-typed entry point. The fan-out
-*     loop in the broker is then symmetric — every consumer is "an
-*     `RtpEgress` someone started".
-*  2. So the typechecker can keep us honest as the shared-transcode
-*     refactor lands. Once the broker exposes a stream-source that fan-
-*     outs to N egresses, the Alexa handler will switch from "post the
-*     offer to webrtcSession.handleOffer" to "build a local
-*     AdaptiveSession + register an `AlexaRtcEgress` with the broker".
-*
-* The class itself is therefore intentionally minimal: it accepts the
-* `webrtc-session` session handle from the handler, exposes the
-* RtpEgress contract, and delegates pushVideo/pushAudio to a no-op. The
-* real RTP flow remains owned by the AdaptiveSession the cap created
-* for us — none of the bytes flow through this object today.
-*
-* Derived-stream helpers
-* ─────────────────────
-* `computeAlexaDerivedName` and `getOrSpawnAlexaDerivedBroker` (exported
-* below) implement the derived-broker spawn path. The serve path
-* MUST call `getOrSpawnAlexaDerivedBroker` instead of reaching the broker
-* directly so that identical EncodeProfile params share a single ffmpeg
-* instance (single-flight via a deterministic brokerId).
-*
-*/
-/**
-* Wrapper around an already-negotiated `webrtc-session` (created by the
-* Alexa directive handler via `webrtcSession.handleOffer`). The
-* AdaptiveSession owns the RTP pump, so this adapter is a no-op for
-* `pushVideoRtp` / `pushAudioRtp`. The `stop()` method calls back into
-* the directive handler so the underlying cap session is torn down
-* when an upstream consumer disposes the egress.
-*/
-var AlexaRtcEgress = class {
-	id;
-	logger;
-	closeSessionRemote;
-	started = false;
-	stopped = false;
-	constructor(opts) {
-		this.id = opts.id;
-		this.logger = opts.logger;
-		this.closeSessionRemote = opts.closeSessionRemote;
-	}
-	async start(opts) {
-		if (this.started) return;
-		if (this.stopped) throw new Error("AlexaRtcEgress: cannot restart after stop()");
-		this.started = true;
-		this.logger.debug("AlexaRtcEgress started", { meta: { egressId: this.id } });
-	}
-	pushVideoRtp(rtpPacket) {}
-	pushAudioRtp(rtpPacket) {}
-	async stop() {
-		if (this.stopped) return;
-		this.stopped = true;
-		this.started = false;
-		try {
-			await this.closeSessionRemote();
-		} catch (err) {
-			this.logger.warn("AlexaRtcEgress closeSessionRemote threw", { meta: {
-				egressId: this.id,
-				error: errMsg(err)
-			} });
-		}
-	}
-};
-/**
-* Derives a deterministic, human-readable name for an Alexa derived
-* stream from the device id + encode profile. Identical params always
-* produce the same name so the broker can reuse a running instance.
-*
-* Format: `alexa-<deviceId>-<sha1[0..8]>`
-*/
-function computeAlexaDerivedName(deviceId, profile) {
-	return `alexa-${deviceId}-${(0, node_crypto.createHash)("sha1").update(JSON.stringify(profile)).digest("hex").slice(0, 8)}`;
-}
-/**
-* The single encode profile used for every Alexa derived stream. The
-* operator-facing encode-profile config was removed, so this constant is
-* the sole profile passed to `getOrSpawnAlexaDerivedBroker`. Alexa requires
-* Opus audio; H.264 baseline keeps compatibility with Echo Show hardware
-* decoders.
-*
-* Intentionally duplicated here so `addon-export-alexa` has no dependency
-* on any other addon's preset registry (cross-addon imports are forbidden).
-* These values mirror the `alexa-baseline` preset in the stream-broker; the
-* broker-side preset is authoritative for broker scheduling while this
-* constant is the local fallback for the Alexa egress path only.
-*/
-var ALEXA_FALLBACK_ENCODE_PROFILE = {
-	video: {
-		codec: "h264",
-		profile: "baseline",
-		width: 1280,
-		height: 720,
-		fps: 25,
-		bitrateKbps: 2500,
-		gopFrames: 25,
-		bf: 0,
-		preset: "veryfast",
-		tune: "zerolatency"
-	},
-	audio: {
-		codec: "opus",
-		bitrateKbps: 64,
-		sampleRateHz: 48e3,
-		channels: 1
-	}
-};
-/**
-* Resolves the source camStreamId for the requested profile slot, then
-* calls `publishCameraStream({ kind: 'derived', … })` on the broker.
-*
-* The broker is idempotent for identical `(camStreamId, encodeProfile)`
-* pairs, so calling this multiple times for the same session is safe.
-*
-* Throws `ALEXA_NO_SOURCE_FOR_PROFILE` if the slot has no source assigned.
-*/
-async function getOrSpawnAlexaDerivedBroker(opts) {
-	const slot = (await opts.api.streamBroker.listAllProfileSlots.query()).find((s) => s.deviceId === opts.deviceId && s.profile === opts.sourceProfile);
-	if (slot?.sourceCamStreamId == null) throw new Error(`ALEXA_NO_SOURCE_FOR_PROFILE: profile=${opts.sourceProfile} deviceId=${opts.deviceId}`);
-	const camStreamId = `derived:${computeAlexaDerivedName(opts.deviceId, opts.encodeProfile)}`;
-	await opts.api.streamBroker.publishCameraStream.mutate({
-		deviceId: opts.deviceId,
-		camStreamId,
-		kind: "derived",
-		sourceCamStreamId: slot.sourceCamStreamId,
-		encodeProfile: opts.encodeProfile
-	});
-	return { brokerId: makeSourceBrokerId(opts.deviceId, camStreamId) };
-}
-//#endregion
 //#region src/handlers/rtc-session.ts
-/**
-* `Alexa.RTCSessionController` handler.
-*
-* Alexa's flow is "client (Echo / Alexa Cloud) sends the SDP offer →
-* skill returns the answer", the dual of our default `createSession`
-* flow (server offers first). The `webrtc-session` device cap exposes
-* `handleOffer({ deviceId, sdpOffer, sessionId? })` for exactly this
-* direction; this dispatcher just translates Alexa's directive
-* envelope to/from the cap call.
-*
-* Echo / Alexa Cloud will send `InitiateSessionWithOffer` when an
-* RTSP fallback isn't preferred (Show 10/15, voice "show me"
-* commands). On disconnect, Alexa sends `SessionDisconnected` and we
-* tear the session down via `closeSession` so the broker stops
-* forwarding frames.
-*/
 var InitiateSessionWithOfferDirectiveSchema = object({
 	endpoint: EndpointRefSchema,
 	payload: InitiateSessionWithOfferPayloadSchema
@@ -28826,6 +29528,23 @@ var SessionDisconnectedDirectiveSchema = object({
 	endpoint: EndpointRefSchema,
 	payload: SessionDisconnectedPayloadSchema
 });
+/**
+* Live egress handles, keyed by `<deviceId>/<sessionId>`.
+*
+* The primitive's refcount has no lease TTL: a holder that vanishes without
+* releasing leaks a child until the broker restarts (D67). This handler is a
+* holder, so it keeps the one piece of state that lets it not be that holder —
+* the `pipelineKey` its `SessionDisconnected` has to release.
+*
+* A module-level map is right here because the directive handlers are free
+* functions called per directive; the entry is written on a successful acquire
+* and deleted on the release path, both of which are the same tick as the
+* directive that owns it.
+*/
+var EGRESS_HANDLES = /* @__PURE__ */ new Map();
+function egressHandleKey(deviceId, sessionId) {
+	return `${deviceId}/${sessionId}`;
+}
 var WEBRTC_PROFILE_NAMES = [
 	"high",
 	"mid",
@@ -28868,7 +29587,6 @@ async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, d
 		if (pref === "low" || pref === "mid" || pref === "high") return pref;
 	})();
 	const sourceProfile = explicitSourceProfile ?? mappedFromPreference ?? "high";
-	const encodeProfile = ALEXA_FALLBACK_ENCODE_PROFILE;
 	try {
 		if (isSleepingBatteryStatus(null)) {
 			const wakeStart = Date.now();
@@ -28892,6 +29610,13 @@ async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, d
 		return value["sleeping"] === true;
 	}
 	let derivedTarget;
+	/**
+	* The primitive's release handle, when this session acquired one. Recorded so
+	* `SessionDisconnected` can release it: a refcount whose holder disappears is
+	* the one gap D67 leaves open, and the least this handler can do is not BE
+	* that holder.
+	*/
+	let egressPipelineKey = null;
 	const picked = await api.cameraStreams.pickStream.query({
 		deviceId,
 		requirements: {
@@ -28915,18 +29640,21 @@ async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, d
 			camStreamId: picked.camStreamId
 		};
 	} else try {
-		const { brokerId } = await getOrSpawnAlexaDerivedBroker({
+		const acquired = await acquireAlexaEgress({
 			api,
 			deviceId,
 			sourceProfile,
-			encodeProfile
+			sessionId,
+			logger: log
 		});
+		egressPipelineKey = acquired.pipelineKey;
+		EGRESS_HANDLES.set(egressHandleKey(deviceId, sessionId), acquired.pipelineKey);
 		derivedTarget = {
 			kind: "cam-stream",
-			camStreamId: brokerId.split("/").slice(1).join("/")
+			camStreamId: acquired.camStreamId
 		};
 	} catch (err) {
-		log.warn("alexa rtc-session: derived spawn failed, falling back to streamPreference target", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		log.warn("alexa rtc-session: egress acquire failed, falling back to streamPreference target", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		derivedTarget = resolveWebrtcTarget(exposedEntry?.settings?.streamPreference ?? "auto");
 	}
 	try {
@@ -28993,6 +29721,15 @@ async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, d
 			mSections: mSectionSummary,
 			offerSdp: sdpOffer
 		} });
+		if (egressPipelineKey !== null) {
+			EGRESS_HANDLES.delete(egressHandleKey(deviceId, sessionId));
+			await releaseAlexaEgress({
+				api,
+				deviceId,
+				pipelineKey: egressPipelineKey,
+				logger: log
+			});
+		}
 		return errorEnvelope(header, "INTERNAL_ERROR", `webrtc-session.handleOffer failed: ${message}`);
 	}
 }
@@ -29004,19 +29741,32 @@ async function handleSessionDisconnected(header, endpointRaw, payloadRaw, deps,
 	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
 	const endpoint = parsed.data.endpoint;
 	const parsedId = parseCameraEndpointId(endpoint.endpointId);
-	if (parsedId.kind === "camera") try {
-		await deps.ctx.api.webrtcSession.closeSession.mutate({
-			deviceId: parsedId.deviceId,
-			sessionId: parsed.data.payload.sessionId
-		});
-	} catch (err) {
-		deps.logger.warn("alexa rtc-session: closeSession threw on disconnect (continuing to ack)", {
-			tags: {
+	if (parsedId.kind === "camera") {
+		const handleKey = egressHandleKey(parsedId.deviceId, parsed.data.payload.sessionId);
+		const pipelineKey = EGRESS_HANDLES.get(handleKey);
+		if (pipelineKey !== void 0) {
+			EGRESS_HANDLES.delete(handleKey);
+			await releaseAlexaEgress({
+				api: deps.ctx.api,
+				deviceId: parsedId.deviceId,
+				pipelineKey,
+				logger: deps.logger
+			});
+		}
+		try {
+			await deps.ctx.api.webrtcSession.closeSession.mutate({
 				deviceId: parsedId.deviceId,
 				sessionId: parsed.data.payload.sessionId
-			},
-			meta: { error: err instanceof Error ? err.message : String(err) }
-		});
+			});
+		} catch (err) {
+			deps.logger.warn("alexa rtc-session: closeSession threw on disconnect (continuing to ack)", {
+				tags: {
+					deviceId: parsedId.deviceId,
+					sessionId: parsed.data.payload.sessionId
+				},
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
 	}
 	const disconnectedDeviceId = parsedId.kind === "camera" ? parsedId.deviceId : void 0;
 	deps.logger.info("alexa rtc-session: SessionDisconnected", {
@@ -29954,6 +30704,89 @@ async function handleDirective(request, reply, deps) {
 	reply.code(result.status).send(result.body);
 }
 //#endregion
+//#region src/motion-clear-hold.ts
+/**
+* Default hold. Matches `RESET_DEBOUNCE_MS` in
+* `addon-export-hap/src/mappers/builders/motion-sensor.ts` — the same problem
+* (a source that never reliably clears, or clears too eagerly) already has an
+* answer in this repo and a second number would only invite them to drift.
+*/
+var DEFAULT_MOTION_CLEAR_HOLD_MS = 5e3;
+var MotionClearHold = class {
+	entries = /* @__PURE__ */ new Map();
+	holdMs;
+	setTimer;
+	clearTimer;
+	constructor(options) {
+		this.holdMs = options.holdMs;
+		this.setTimer = options.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+		this.clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+	}
+	/**
+	* The source reports motion.
+	*
+	* @returns `true` when Alexa must be told (it currently believes
+	*   NOT_DETECTED). `false` when Alexa already believes DETECTED — including
+	*   the case where a clear was pending, which this call cancels.
+	*/
+	onDetected(key) {
+		const entry = this.entries.get(key);
+		if (entry?.state === "detected") return false;
+		if (entry?.state === "holding") {
+			if (entry.timer !== null) this.clearTimer(entry.timer);
+			this.entries.set(key, {
+				state: "detected",
+				timer: null
+			});
+			return false;
+		}
+		this.entries.set(key, {
+			state: "detected",
+			timer: null
+		});
+		return true;
+	}
+	/**
+	* The source reports no motion. Arms the hold; `release` runs once the
+	* source has stayed clear for `holdMs`. A no-op when we KNOW Alexa already
+	* believes NOT_DETECTED, or when a clear is already pending.
+	*
+	* An UNKNOWN key arms the hold rather than returning early, and that is the
+	* whole reason this branch is spelled out. This map is in-memory: after an
+	* addon restart it is empty, while Alexa's copy of `detectionState` is
+	* whatever we last told it. If the addon respawned during a motion — which a
+	* `camstack deploy` does routinely — treating "unknown" as "already clear"
+	* leaves the Alexa app showing motion until that camera happens to trigger
+	* again, which on a quiet camera is hours. The cost of the other choice is
+	* at most one redundant NOT_DETECTED per camera per restart.
+	*/
+	onCleared(key, release) {
+		const entry = this.entries.get(key);
+		if (entry !== void 0 && entry.state !== "detected") return;
+		const timer = this.setTimer(() => {
+			this.entries.set(key, {
+				state: "idle",
+				timer: null
+			});
+			release();
+		}, this.holdMs);
+		this.entries.set(key, {
+			state: "holding",
+			timer
+		});
+	}
+	/** What Alexa currently believes for this key — for logs and assertions. */
+	believedDetected(key) {
+		const state = this.entries.get(key)?.state;
+		return state === "detected" || state === "holding";
+	}
+	/** Cancel every pending clear and forget all state. */
+	clear() {
+		for (const entry of this.entries.values()) if (entry.timer !== null) this.clearTimer(entry.timer);
+		this.entries.clear();
+	}
+};
+//#endregion
 //#region src/lwa-event-gateway.ts
 /**
 * LWA Event Gateway client for Alexa proactive events.
@@ -29991,6 +30824,32 @@ var LWA_TOKEN_URL = "https://api.amazon.com/auth/o2/token";
 var THROTTLE_WINDOW_MS = 3e4;
 var REFRESH_PROACTIVE_WINDOW_MS = 300 * 1e3;
 var REFRESH_SCAN_INTERVAL_MS = 60 * 1e3;
+/** The interface an endpoint must advertise for a `DoorbellPress` to survive
+*  the Alexa cloud. */
+var DOORBELL_INTERFACE = "Alexa.DoorbellEventSource";
+/**
+* The interface an endpoint must advertise for an `ObjectDetection` event to
+* survive the Alexa cloud — and which `buildParentCameraEndpoint` does NOT
+* currently declare (the two `capabilities.push(SMART_VISION_*)` lines are
+* commented out there, deliberately).
+*
+* Measured 2026-08-07: 223 `smartvision person posted status=202` in 692 s on
+* endpoint 590 alone, every one of them against an endpoint whose discovered
+* capability list has never contained this string. The Event Gateway answers
+* 202 because the ENVELOPE parsed; the cloud then drops the event because the
+* endpoint cannot host it. This is D76 exactly — an accepted POST is not
+* evidence of delivery — and it is why the operator sees no events in the app
+* while the log reads as though they were delivered.
+*/
+var SMART_VISION_INTERFACE = "Alexa.SmartVision.ObjectDetectionSensor";
+/**
+* How often the "SmartVision is not declared" drop is allowed to speak. A
+* branch that drops work must log it (`CLAUDE.md`), but at 223 drops per 11
+* minutes a per-event line is a line nobody reads — the same lesson the egress
+* teardown warn taught on 2026-08-07. First occurrence per endpoint, then every
+* hundredth, carrying the running count so the volume is never hidden.
+*/
+var SMART_VISION_DROP_LOG_EVERY = 100;
 var LwaEventGateway = class {
 	deps;
 	unsubscribe = null;
@@ -29998,10 +30857,17 @@ var LwaEventGateway = class {
 	unsubscribeBattery = null;
 	refreshTimer = null;
 	lastSentAt = /* @__PURE__ */ new Map();
-	/** Last reported motion detection state per `userId|endpointId` — only
-	*  state TRANSITIONS are pushed to Alexa (a chatty source re-emitting
-	*  `detected:true` every tick must not flood the Event Gateway). */
-	lastMotionState = /* @__PURE__ */ new Map();
+	/**
+	* What Alexa believes about each `userId|endpointId`'s `detectionState`,
+	* and the falling-edge hold that keeps a flapping source from becoming a
+	* flapping ChangeReport stream. This is the SINGLE authority on the motion
+	* state we have reported — see `motion-clear-hold.ts` for the measurement
+	* that made a plain transition dedupe insufficient.
+	*/
+	motionHold = new MotionClearHold({ holdMs: DEFAULT_MOTION_CLEAR_HOLD_MS });
+	/** Per-endpoint count of `ObjectDetection` events dropped because the
+	*  endpoint does not declare {@link SMART_VISION_INTERFACE}. */
+	smartVisionDropped = /* @__PURE__ */ new Map();
 	/** Last reported integer battery percentage per `userId|endpointId` —
 	*  battery providers may push the same level every poll cycle and
 	*  Alexa Smart Home rate-limits ChangeReports per property; dedupe
@@ -30046,15 +30912,30 @@ var LwaEventGateway = class {
 		if (this.refreshTimer) clearInterval(this.refreshTimer);
 		this.refreshTimer = null;
 		this.lastSentAt.clear();
-		this.lastMotionState.clear();
+		this.motionHold.clear();
+		this.smartVisionDropped.clear();
 		this.lastBatteryLevel.clear();
 	}
 	async onDoorbellPress(data) {
 		const childDevice = await this.deps.ctx.api.deviceManager.getDevice.query({ deviceId: data.deviceId }).catch(() => null);
-		if (!childDevice) return;
+		if (!childDevice) {
+			this.deps.logger.warn("alexa lwa-gateway: doorbell press DROPPED — the pressing device is not in the registry", { tags: { deviceId: data.deviceId } });
+			return;
+		}
 		const parentDeviceId = childDevice.parentDeviceId ?? data.deviceId;
-		if (!this.deps.listExposed().some((e) => e.deviceId === parentDeviceId)) return;
+		if (!this.deps.listExposed().some((e) => e.deviceId === parentDeviceId)) {
+			this.deps.logger.info("alexa lwa-gateway: doorbell press ignored — the camera is not exposed to Alexa", { tags: { deviceId: parentDeviceId } });
+			return;
+		}
 		const endpointId = String(parentDeviceId);
+		const signature = this.deps.getExportedSignature(parentDeviceId);
+		if (signature !== null && !signature.includes(DOORBELL_INTERFACE)) this.deps.logger.warn(`alexa lwa-gateway: the endpoint Alexa knows does NOT declare ${DOORBELL_INTERFACE} — this press will be accepted by the gateway and DROPPED by the cloud; the discovery reconcile must re-push this endpoint`, {
+			tags: { deviceId: parentDeviceId },
+			meta: {
+				endpointId,
+				signature
+			}
+		});
 		const linked = this.deps.listLinkedAccounts();
 		if (linked.length === 0) {
 			this.deps.logger.info("alexa lwa-gateway: doorbell press but no linked accounts — skipped", { meta: { parentDeviceId } });
@@ -30063,7 +30944,10 @@ var LwaEventGateway = class {
 		if (!this.hasProactiveCredentials()) return;
 		for (const account of linked) {
 			if (!this.findToken(account.userId)) {
-				this.deps.logger.info("alexa lwa-gateway: no LWA token for user — skipped", { meta: { userId: account.userId } });
+				this.deps.logger.info("alexa lwa-gateway: no LWA token for user — skipped", {
+					tags: { deviceId: parentDeviceId },
+					meta: { userId: account.userId }
+				});
 				continue;
 			}
 			if (this.isThrottled({
@@ -30091,12 +30975,16 @@ var LwaEventGateway = class {
 		return false;
 	}
 	async postDoorbellPress(opts) {
-		await this.postEventBody(opts.userId, opts.endpointId, buildDoorbellPressPayload(opts), "doorbell press");
+		await this.postEventBody(opts.userId, opts.endpointId, (accessToken) => buildDoorbellPressPayload({
+			...opts,
+			accessToken
+		}), "doorbell press");
 	}
 	/**
-	* Camera-native motion flipped. Report each detection-state TRANSITION as
-	* an `Alexa.MotionSensor` ChangeReport, deduped per endpoint so a chatty
-	* source re-emitting `detected:true` every tick doesn't flood the gateway.
+	* Camera-native motion flipped. Report it as an `Alexa.MotionSensor`
+	* ChangeReport: the rising edge immediately, the falling edge only once the
+	* source has stayed quiet (see `MotionClearHold` for the 590 measurement
+	* that made a plain transition dedupe insufficient).
 	*/
 	async onMotionChanged(data) {
 		if (!this.deps.listExposed().some((e) => e.deviceId === data.deviceId)) return;
@@ -30107,24 +30995,90 @@ var LwaEventGateway = class {
 		for (const account of linked) {
 			if (!this.findToken(account.userId)) continue;
 			const key = `${account.userId}|${endpointId}`;
-			if (this.lastMotionState.get(key) === data.detected) continue;
-			this.lastMotionState.set(key, data.detected);
-			await this.postEventBody(account.userId, endpointId, buildMotionChangeReportPayload({
+			if (!data.detected) {
+				this.motionHold.onCleared(key, () => {
+					this.postMotionChange({
+						userId: account.userId,
+						endpointId,
+						detected: false,
+						timestamp: Date.now()
+					}).catch((err) => {
+						this.deps.logger.warn("alexa lwa-gateway: held motion clear failed to post", {
+							tags: { deviceId: data.deviceId },
+							meta: {
+								endpointId,
+								error: err instanceof Error ? err.message : String(err)
+							}
+						});
+					});
+				});
+				continue;
+			}
+			if (!this.motionHold.onDetected(key)) continue;
+			await this.postMotionChange({
 				userId: account.userId,
 				endpointId,
-				detected: data.detected,
+				detected: true,
 				timestamp: data.timestamp
-			}), `motion ${data.detected ? "DETECTED" : "NOT_DETECTED"}`);
-			if (data.detected) await this.postEventBody(account.userId, endpointId, buildSmartVisionObjectDetectionEvent({
+			});
+			await this.postObjectDetection({
 				userId: account.userId,
+				deviceId: data.deviceId,
 				endpointId,
-				detections: [{
-					eventIdentifier: `${endpointId}-${data.timestamp}`,
-					imageNetClass: "person"
-				}],
 				timestamp: data.timestamp
-			}), `smartvision person`);
+			});
+		}
+	}
+	async postMotionChange(opts) {
+		await this.postEventBody(opts.userId, opts.endpointId, (accessToken) => buildMotionChangeReportPayload({
+			...opts,
+			accessToken
+		}), `motion ${opts.detected ? "DETECTED" : "NOT_DETECTED"}`);
+	}
+	/**
+	* Pair a reported DETECTED with a SmartVision `ObjectDetection` event — the
+	* event that populates the per-camera Events box in the Alexa app
+	* (`Alexa.MotionSensor` alone only feeds the account-wide Activity feed).
+	*
+	* **Gated on the endpoint actually declaring the interface, and today that
+	* gate is closed.** `buildParentCameraEndpoint` does not push
+	* `SMART_VISION_OBJECT_DETECTION_SENSOR`, so every one of these events was
+	* being accepted by the gateway (202) and discarded by the cloud. Posting
+	* into that is not harmless: it is ~1 POST/s per flapping camera against a
+	* rate-limited gateway, and it makes the log assert a delivery that never
+	* happened. The doorbell path learned the same lesson today and only warns
+	* — it can, because `Alexa.DoorbellEventSource` IS built for a doorbell and
+	* a missing one means stale discovery, i.e. a bet worth taking. Here the
+	* interface is absent by construction, so the bet is a certain loss.
+	*
+	* Re-opening this gate is a design item, not a toggle: see
+	* `docs/design/2026-08-07-alexa-events-and-hksv-assessment.md`.
+	*/
+	async postObjectDetection(opts) {
+		const signature = this.deps.getExportedSignature(opts.deviceId);
+		if (signature === null || !signature.includes(SMART_VISION_INTERFACE)) {
+			const dropped = (this.smartVisionDropped.get(opts.endpointId) ?? 0) + 1;
+			this.smartVisionDropped.set(opts.endpointId, dropped);
+			if (dropped === 1 || dropped % SMART_VISION_DROP_LOG_EVERY === 0) this.deps.logger.info(`alexa lwa-gateway: ObjectDetection NOT posted — the endpoint Alexa knows does not declare ${SMART_VISION_INTERFACE}, so the cloud would accept and discard it`, {
+				tags: { deviceId: opts.deviceId },
+				meta: {
+					endpointId: opts.endpointId,
+					droppedSoFar: dropped,
+					signature
+				}
+			});
+			return;
 		}
+		await this.postEventBody(opts.userId, opts.endpointId, (accessToken) => buildSmartVisionObjectDetectionEvent({
+			userId: opts.userId,
+			endpointId: opts.endpointId,
+			detections: [{
+				eventIdentifier: `${opts.endpointId}-${opts.timestamp}`,
+				imageNetClass: "person"
+			}],
+			timestamp: opts.timestamp,
+			accessToken
+		}), `smartvision person`);
 	}
 	/**
 	* Battery slice changed. Push an `Alexa.BatteryLevelSensor`
@@ -30146,11 +31100,12 @@ var LwaEventGateway = class {
 			const key = `${account.userId}|${endpointId}`;
 			if (this.lastBatteryLevel.get(key) === level) continue;
 			this.lastBatteryLevel.set(key, level);
-			await this.postEventBody(account.userId, endpointId, buildBatteryChangeReportPayload({
+			await this.postEventBody(account.userId, endpointId, (accessToken) => buildBatteryChangeReportPayload({
 				userId: account.userId,
 				endpointId,
 				batteryLevel: level,
-				timestamp: Date.now()
+				timestamp: Date.now(),
+				accessToken
 			}), `battery ${level}%`);
 		}
 	}
@@ -30185,7 +31140,7 @@ var LwaEventGateway = class {
 		let attemptedAccounts = 0;
 		for (const account of linked) {
 			if (!this.findToken(account.userId)) continue;
-			await this.postEventBody(account.userId, "discovery", buildDeleteReportPayload(account.userId, endpointIds), `discovery delete (manual purge, ${endpointIds.length})`);
+			await this.postEventBody(account.userId, "discovery", (accessToken) => buildDeleteReportPayload(account.userId, endpointIds, accessToken), `discovery delete (manual purge, ${endpointIds.length})`);
 			attemptedAccounts += 1;
 		}
 		return {
@@ -30194,13 +31149,21 @@ var LwaEventGateway = class {
 			attemptedAccounts
 		};
 	}
-	/** Public delivery used by the SyncEngine. Returns true on gateway 2xx. */
-	async postReport(userId, body, label) {
-		return this.postEventBody(userId, "discovery", body, label);
+	/** Public delivery used by the SyncEngine. Returns true on gateway 2xx.
+	*  `buildBody` is handed the access token the request will actually be sent
+	*  with, so the body's `scope.token` and the `Authorization` header can never
+	*  disagree — including after a 401 refresh. */
+	async postReport(userId, buildBody, label) {
+		return this.postEventBody(userId, "discovery", buildBody, label);
 	}
 	/** POST a proactive-event body to the region's Event Gateway, refreshing
-	*  the LWA token once on 401. */
-	async postEventBody(userId, endpointId, body, label) {
+	*  the LWA token once on 401.
+	*
+	*  The body is BUILT PER ATTEMPT from the token that attempt uses: the
+	*  Smart Home payloads carry the bearer token inside `scope.token` as well
+	*  as in the header, and a body built with the expired token then retried
+	*  with a fresh header would ship a token Amazon has already rejected. */
+	async postEventBody(userId, endpointId, buildBody, label) {
 		const url = EVENT_GATEWAY_URLS[this.deps.getRegion()];
 		const send = async (accessToken) => fetch(url, {
 			method: "POST",
@@ -30208,7 +31171,7 @@ var LwaEventGateway = class {
 				"Content-Type": "application/json",
 				Authorization: `Bearer ${accessToken}`
 			},
-			body: JSON.stringify(body)
+			body: JSON.stringify(buildBody(accessToken))
 		});
 		const initial = this.findToken(userId);
 		if (!initial) return false;
@@ -30248,7 +31211,8 @@ var LwaEventGateway = class {
 		}
 		this.deps.logger.info(`alexa lwa-gateway: ${label} posted`, { meta: {
 			userId,
-			endpointId
+			endpointId,
+			status: response.status
 		} });
 		return true;
 	}
@@ -30336,7 +31300,7 @@ function buildDoorbellPressPayload(opts) {
 		endpoint: {
 			scope: {
 				type: "BearerToken",
-				token: "replaced-by-authorization-header"
+				token: opts.accessToken
 			},
 			endpointId: opts.endpointId
 		},
@@ -30359,7 +31323,7 @@ function buildMotionChangeReportPayload(opts) {
 			endpoint: {
 				scope: {
 					type: "BearerToken",
-					token: "replaced-by-authorization-header"
+					token: opts.accessToken
 				},
 				endpointId: opts.endpointId
 			},
@@ -30390,7 +31354,7 @@ function buildBatteryChangeReportPayload(opts) {
 			endpoint: {
 				scope: {
 					type: "BearerToken",
-					token: "replaced-by-authorization-header"
+					token: opts.accessToken
 				},
 				endpointId: opts.endpointId
 			},
@@ -30420,7 +31384,7 @@ function buildSmartVisionObjectDetectionEvent(opts) {
 		endpoint: {
 			scope: {
 				type: "BearerToken",
-				token: "replaced-by-authorization-header"
+				token: opts.accessToken
 			},
 			endpointId: opts.endpointId
 		},
@@ -30435,7 +31399,7 @@ function buildSmartVisionObjectDetectionEvent(opts) {
 		})) }
 	} };
 }
-function buildAddOrUpdateReportPayload(userId, endpoints) {
+function buildAddOrUpdateReportPayload(userId, endpoints, accessToken) {
 	return { event: {
 		header: {
 			namespace: "Alexa.Discovery",
@@ -30447,12 +31411,12 @@ function buildAddOrUpdateReportPayload(userId, endpoints) {
 			endpoints,
 			scope: {
 				type: "BearerToken",
-				token: "replaced-by-authorization-header"
+				token: accessToken
 			}
 		}
 	} };
 }
-function buildDeleteReportPayload(userId, endpointIds) {
+function buildDeleteReportPayload(userId, endpointIds, accessToken) {
 	return { event: {
 		header: {
 			namespace: "Alexa.Discovery",
@@ -30464,12 +31428,34 @@ function buildDeleteReportPayload(userId, endpointIds) {
 			endpoints: endpointIds.map((endpointId) => ({ endpointId })),
 			scope: {
 				type: "BearerToken",
-				token: "replaced-by-authorization-header"
+				token: accessToken
 			}
 		}
 	} };
 }
 //#endregion
+//#region src/endpoint-signature.ts
+/** One capability's identity as Alexa distinguishes it. */
+function capabilityKey(capability) {
+	const instance = typeof capability.instance === "string" ? capability.instance : "";
+	return instance.length > 0 ? `${capability.interface}#${instance}` : capability.interface;
+}
+/** Stable, order-independent signature of ONE endpoint's advertised shape. */
+function endpointKey(endpoint) {
+	const interfaces = endpoint.capabilities.map(capabilityKey).sort().join(",");
+	const categories = [...endpoint.displayCategories].sort().join(",");
+	return `${endpoint.endpointId}|${categories}|${interfaces}`;
+}
+/**
+* Stable signature of the endpoint set built for ONE device. Two builds that
+* would land identically in Alexa's registry produce the same string; any
+* added, removed or renamed interface — or a changed display category —
+* produces a different one.
+*/
+function endpointsSignature(endpoints) {
+	return endpoints.map(endpointKey).sort().join(";");
+}
+//#endregion
 //#region src/sync-engine.ts
 var SyncEngine = class {
 	deps;
@@ -30486,7 +31472,7 @@ var SyncEngine = class {
 		};
 		const endpoints = await this.deps.buildEndpoints(deviceId);
 		if (endpoints.length === 0) {
-			await this.recordEndpoints(deviceId, []);
+			await this.recordEndpoints(deviceId, [], null);
 			return {
 				deviceCount: 0,
 				endpointCount: 0,
@@ -30497,7 +31483,7 @@ var SyncEngine = class {
 		const endpointIds = endpoints.map((e) => e.endpointId);
 		const failures = [];
 		for (const account of accounts) if (!await this.deps.postAddOrUpdate(account.userId, endpoints)) failures.push(`${account.userId}:${deviceId}`);
-		await this.recordEndpoints(deviceId, endpointIds);
+		await this.recordEndpoints(deviceId, endpointIds, endpointsSignature(endpoints));
 		return {
 			deviceCount: 1,
 			endpointCount: endpoints.length,
@@ -30543,7 +31529,7 @@ var SyncEngine = class {
 			const endpoints = await this.deps.buildEndpoints(deviceId);
 			if (endpoints.length === 0) continue;
 			if (!await this.deps.postAddOrUpdate(userId, endpoints)) failures.push(`${userId}:${deviceId}`);
-			await this.recordEndpoints(deviceId, endpoints.map((e) => e.endpointId));
+			await this.recordEndpoints(deviceId, endpoints.map((e) => e.endpointId), endpointsSignature(endpoints));
 			deviceCount += 1;
 			endpointCount += endpoints.length;
 		}
@@ -30565,7 +31551,7 @@ var SyncEngine = class {
 		const accounts = this.deps.listLinkedAccounts();
 		const failures = [];
 		for (const account of accounts) if (!await this.deps.postDelete(account.userId, ids)) failures.push(`${account.userId}:${deviceId}`);
-		await this.recordEndpoints(deviceId, []);
+		await this.recordEndpoints(deviceId, [], null);
 		return {
 			deviceId,
 			endpointCount: ids.length,
@@ -30573,11 +31559,76 @@ var SyncEngine = class {
 			failures
 		};
 	}
-	async recordEndpoints(deviceId, ids) {
+	/**
+	* Re-push ONE exposed device if the endpoint shape it builds today differs
+	* from the shape Alexa was last told about.
+	*
+	* A build that yields NO endpoints (transient registry miss) is never
+	* pushed — an empty AddOrUpdateReport is an Alexa protocol error — and never
+	* clears the recorded signature: forgetting it would make the next reconcile
+	* re-push a shape Alexa already has.
+	*/
+	async reconcileDevice(deviceId) {
+		if (!this.deps.listExposed().some((e) => e.deviceId === deviceId)) return {
+			deviceId,
+			pushed: false
+		};
+		if (this.deps.listLinkedAccounts().length === 0 || !this.deps.hasProactiveCredentials()) return {
+			deviceId,
+			pushed: false
+		};
+		const endpoints = await this.deps.buildEndpoints(deviceId);
+		if (endpoints.length === 0) {
+			this.deps.logger.warn("alexa sync: reconcile built ZERO endpoints — leaving Alexa untouched (transient registry miss)", { tags: { deviceId } });
+			return {
+				deviceId,
+				pushed: false
+			};
+		}
+		const current = endpointsSignature(endpoints);
+		const last = this.deps.getExportedSignatures()[deviceId];
+		if (last === current) return {
+			deviceId,
+			pushed: false
+		};
+		this.deps.logger.info("alexa sync: endpoint shape drifted — re-pushing AddOrUpdateReport so the cloud advertises the current interfaces", {
+			tags: { deviceId },
+			meta: {
+				from: last ?? "never-recorded",
+				to: current,
+				interfaces: endpoints.flatMap((e) => e.capabilities.map((c) => c.interface))
+			}
+		});
+		await this.pushDevice(deviceId);
+		return {
+			deviceId,
+			pushed: true
+		};
+	}
+	/** Reconcile every exposed device (boot pass + manual safety net). */
+	async reconcileAllExposed() {
+		const checkedDeviceIds = [];
+		const pushedDeviceIds = [];
+		for (const { deviceId } of this.deps.listExposed()) {
+			checkedDeviceIds.push(deviceId);
+			if ((await this.reconcileDevice(deviceId)).pushed) pushedDeviceIds.push(deviceId);
+		}
+		return {
+			checkedDeviceIds,
+			pushedDeviceIds
+		};
+	}
+	/** Persist the endpoint ids AND the shape signature for a device.
+	*  `signature === null` forgets both (delete / empty build). */
+	async recordEndpoints(deviceId, ids, signature) {
 		const next = { ...this.deps.getExportedEndpoints() };
 		if (ids.length > 0) next[deviceId] = ids;
 		else delete next[deviceId];
 		await this.deps.setExportedEndpoints(next);
+		const nextSignatures = { ...this.deps.getExportedSignatures() };
+		if (signature !== null) nextSignatures[deviceId] = signature;
+		else delete nextSignatures[deviceId];
+		await this.deps.setExportedSignatures(nextSignatures);
 	}
 };
 //#endregion
@@ -30644,6 +31695,14 @@ var DEFAULT_DEVICE_SETTINGS = {
 *     tokens to `/oauth/lwa-tokens`, which this addon records.
 *   - Admin-UI wizard that walks the operator through skill creation.
 */
+/** Per-device debounce for the bindings-change → discovery reconcile. A
+*  provider respawn emits one `DeviceBindingsChanged` per cap; reconciling in
+*  the middle of that burst would read a half-registered binding set. */
+var BINDINGS_RECONCILE_DEBOUNCE_MS = 5e3;
+/** Delay before the boot-time reconcile pass. Long enough for device providers
+*  to have registered their caps — a device whose bindings have not landed
+*  builds a shape we must never push to Alexa. */
+var BOOT_RECONCILE_DELAY_MS = 6e4;
 var STREAM_PREFERENCE_OPTIONS = [
 	{
 		value: "auto",
@@ -30672,6 +31731,7 @@ var DEFAULT_CONFIG = {
 	linkedAccounts: [],
 	tokens: [],
 	exportedEndpoints: {},
+	exportedSignatures: {},
 	publicHubUrl: "",
 	availableEndpoints: [],
 	ingressToken: "",
@@ -30682,6 +31742,8 @@ var SUPPORTED_KINDS = ["camera", "doorbell"];
 var ExportAlexaAddon = class extends BaseAddon {
 	lwaGateway = null;
 	syncEngine = null;
+	/** Per-device debounce timers for the bindings-change discovery reconcile. */
+	pendingReconcileTimers = /* @__PURE__ */ new Map();
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
@@ -30779,7 +31841,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 			upsertToken: (input) => this.upsertToken(input),
 			removeLinkedAccount: (userId) => this.removeLinkedAccount(userId),
 			getLwaCredentials: () => this.lwaCredentials(),
-			getRegion: () => this.config.region
+			getRegion: () => this.config.region,
+			getExportedSignature: (deviceId) => this.config.exportedSignatures[deviceId] ?? null
 		});
 		this.lwaGateway.start();
 		this.syncEngine = new SyncEngine({
@@ -30788,11 +31851,15 @@ var ExportAlexaAddon = class extends BaseAddon {
 			listLinkedAccounts: () => this.config.linkedAccounts,
 			hasProactiveCredentials: () => this.lwaCredentials() !== null,
 			buildEndpoints: (deviceId) => this.buildEndpointsForOneDevice(deviceId),
-			postAddOrUpdate: (userId, endpoints) => this.requireGateway().postReport(userId, buildAddOrUpdateReportPayload(userId, endpoints), `add/update (${endpoints.length})`),
-			postDelete: (userId, ids) => this.requireGateway().postReport(userId, buildDeleteReportPayload(userId, ids), `delete (${ids.length})`),
+			postAddOrUpdate: (userId, endpoints) => this.requireGateway().postReport(userId, (accessToken) => buildAddOrUpdateReportPayload(userId, endpoints, accessToken), `add/update (${endpoints.length})`),
+			postDelete: (userId, ids) => this.requireGateway().postReport(userId, (accessToken) => buildDeleteReportPayload(userId, ids, accessToken), `delete (${ids.length})`),
 			getExportedEndpoints: () => this.config.exportedEndpoints,
-			setExportedEndpoints: (next) => this.updateGlobalSettings({ exportedEndpoints: next })
+			setExportedEndpoints: (next) => this.updateGlobalSettings({ exportedEndpoints: next }),
+			getExportedSignatures: () => this.config.exportedSignatures,
+			setExportedSignatures: (next) => this.updateGlobalSettings({ exportedSignatures: next })
 		});
+		this.subscribeBindingsChangedForReconcile();
+		this.scheduleBootDiscoveryReconcile();
 		const offRemoved = this.ctx.eventBus.subscribe({ category: EventCategory.DeviceUnregistered }, (event) => {
 			const id = event.data?.deviceId;
 			if (typeof id !== "number") return;
@@ -30908,6 +31975,66 @@ var ExportAlexaAddon = class extends BaseAddon {
 	}
 	/** Manual "Re-sync devices" button — awaited so the form gets the counts.
 	*  Pushes EVERY exposed device to every linked account unconditionally. */
+	/**
+	* Reconcile ONE device's Alexa endpoint shape whenever its capability
+	* bindings change. Debounced per device so the burst a provider respawn
+	* produces (one event per cap) collapses into a single rebuild, and so the
+	* reconcile reads the bindings AFTER the burst settles rather than in the
+	* middle of it.
+	*/
+	subscribeBindingsChangedForReconcile() {
+		const off = this.ctx.eventBus.subscribe({ category: EventCategory.DeviceBindingsChanged }, (event) => {
+			const deviceId = event.data?.deviceId;
+			if (typeof deviceId !== "number") return;
+			if (!this.config.exposed.some((e) => e.deviceId === deviceId)) return;
+			const pending = this.pendingReconcileTimers.get(deviceId);
+			if (pending) clearTimeout(pending);
+			const timer = setTimeout(() => {
+				this.pendingReconcileTimers.delete(deviceId);
+				this.reconcileDeviceDiscovery(deviceId);
+			}, BINDINGS_RECONCILE_DEBOUNCE_MS);
+			if (typeof timer.unref === "function") timer.unref();
+			this.pendingReconcileTimers.set(deviceId, timer);
+		});
+		this.ctx.addDisposer(async () => {
+			off();
+			for (const timer of this.pendingReconcileTimers.values()) clearTimeout(timer);
+			this.pendingReconcileTimers.clear();
+		});
+	}
+	/**
+	* One reconcile pass over every exposed device shortly after boot. This is
+	* what heals a shape that drifted while the addon was DOWN (or under an
+	* older build that had no signature at all) with no operator click — the
+	* doorbell wrapper bound on 615 is exactly that case. Deliberately late
+	* enough that device providers have registered their caps: a device whose
+	* bindings have not landed yet builds a shape we must not push.
+	*/
+	scheduleBootDiscoveryReconcile() {
+		const timer = setTimeout(() => {
+			this.requireSyncEngine().reconcileAllExposed().then((r) => {
+				this.ctx.logger.info("export-alexa: boot discovery reconcile", { meta: {
+					checked: r.checkedDeviceIds.length,
+					pushed: r.pushedDeviceIds
+				} });
+			}).catch((err) => {
+				this.ctx.logger.warn("export-alexa: boot discovery reconcile failed", { meta: { error: errMsg(err) } });
+			});
+		}, BOOT_RECONCILE_DELAY_MS);
+		if (typeof timer.unref === "function") timer.unref();
+		this.ctx.addDisposer(async () => clearTimeout(timer));
+	}
+	/** Run (and report) one device's discovery reconcile. Never throws. */
+	async reconcileDeviceDiscovery(deviceId) {
+		try {
+			if (!(await this.requireSyncEngine().reconcileDevice(deviceId)).pushed) this.ctx.logger.debug("export-alexa: bindings changed but the Alexa endpoint shape is unchanged — no re-push", { tags: { deviceId } });
+		} catch (err) {
+			this.ctx.logger.warn("export-alexa: bindings-change discovery reconcile failed", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
 	async resyncDiscovery() {
 		const r = await this.requireSyncEngine().pushAllExposed();
 		this.ctx.logger.info("export-alexa: manual discovery re-sync", { meta: { ...r } });
@@ -31461,7 +32588,9 @@ var ExportAlexaAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-exports.AlexaRtcEgress = AlexaRtcEgress;
+exports.ALEXA_EGRESS_PROFILE = ALEXA_EGRESS_PROFILE;
 exports.ExportAlexaAddon = ExportAlexaAddon;
 exports.default = ExportAlexaAddon;
+exports.acquireAlexaEgress = acquireAlexaEgress;
 exports.exportAlexaActions = exportAlexaActions;
+exports.releaseAlexaEgress = releaseAlexaEgress;