@camstack/addon-export-hap 1.2.11 → 1.2.13

package/dist/export-hap.addon.mjs

@@ -2,7 +2,7 @@ import { createRequire } from "node:module";
 import { createHash, randomBytes } from "node:crypto";
 import * as path from "node:path";
 import { spawn } from "node:child_process";
-import { Accessory, AudioBitrate, AudioRecordingCodecType, AudioRecordingSamplerate, AudioStreamingCodecType, AudioStreamingSamplerate, CameraController, Categories, Characteristic, DoorbellController, EventTriggerOption, H264Level, H264Profile, HAPStorage, MediaContainerType, SRTPCryptoSuites, Service, VideoCodecType, uuid } from "@homebridge/hap-nodejs";
+import { Accessory, AudioBitrate, AudioStreamingCodecType, AudioStreamingSamplerate, CameraController, Categories, Characteristic, DoorbellController, H264Level, H264Profile, HAPStorage, SRTPCryptoSuites, Service, uuid } from "@homebridge/hap-nodejs";
 import * as fs from "node:fs/promises";
 import { createSocket } from "node:dgram";
 import { networkInterfaces } from "node:os";
@@ -774,7 +774,7 @@ var propertyKeyTypes = /* @__PURE__*/ new Set([
 	"number",
 	"symbol"
 ]);
-function escapeRegex$1(str) {
+function escapeRegex(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -1504,7 +1504,7 @@ var $ZodCheckUpperCase = /*@__PURE__*/ $constructor("$ZodCheckUpperCase", (inst,
 });
 var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const escapedRegex = escapeRegex$1(def.includes);
+	const escapedRegex = escapeRegex(def.includes);
 	const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
 	def.pattern = pattern;
 	inst._zod.onattach.push((inst) => {
@@ -1527,7 +1527,7 @@ var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, d
 });
 var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`^${escapeRegex$1(def.prefix)}.*`);
+	const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -1549,7 +1549,7 @@ var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (ins
 });
 var $ZodCheckEndsWith = /*@__PURE__*/ $constructor("$ZodCheckEndsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`.*${escapeRegex$1(def.suffix)}$`);
+	const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -2785,7 +2785,7 @@ var $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
 	const values = getEnumValues(def.entries);
 	const valuesSet = new Set(values);
 	inst._zod.values = valuesSet;
-	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex$1(o) : o.toString()).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (valuesSet.has(input)) return payload;
@@ -2803,7 +2803,7 @@ var $ZodLiteral = /*@__PURE__*/ $constructor("$ZodLiteral", (inst, def) => {
 	if (def.values.length === 0) throw new Error("Cannot create literal schema with no valid values");
 	const values = new Set(def.values);
 	inst._zod.values = values;
-	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex$1(o) : o ? escapeRegex$1(o.toString()) : String(o)).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (values.has(input)) return payload;
@@ -6496,6 +6496,36 @@ var ProfileRtspEntrySchema = object({
 	resolution: CamStreamResolutionSchema.optional()
 });
 /**
+* Per-call node pinning for `ctx.api` capability calls.
+*
+* A capability call normally resolves to its DEFAULT provider — a `singleton`
+* cap resolves to the hub, a device-scoped cap to the device's owning node. To
+* query a SPECIFIC node's provider instead (e.g. a remote agent's own
+* in-process `platform-probe` hardware, which the hub cannot probe), pin the
+* call to that node.
+*
+* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
+* method args), so capability method signatures stay `nodeId`-free — node
+* targeting is a property of the CALL, not of the method. The transport lifts
+* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
+* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
+* which classifies a pinned agent node as `agent-child-forward`
+* (`$agent-cap-fwd.forward` → the agent's in-process provider).
+*
+* Usage at a call site:
+*
+*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
+*/
+/** tRPC `op.context` key carrying a per-call node pin. */
+var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
+/**
+* Build the tRPC request options that pin a single capability call to `nodeId`.
+* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*/
+function nodePin(nodeId) {
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+}
+/**
 * Output schema shared by the contribution + live methods.
 *
 * Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
@@ -6943,6 +6973,39 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	action: string().min(1),
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+//#endregion
+//#region ../types/dist/canonical-hash-7nfBbEqR.mjs
+/**
+* Deterministic SHA-256 hash of an arbitrary serialisable value. The
+* canonical form sorts object keys alphabetically at every depth so two
+* structurally-equal inputs with different key insertion orders produce
+* the same hash. Returns a 64-char lowercase hex digest.
+*
+* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
+* accessory-rebuild work when the upstream shape is byte-identical to
+* the last applied state — preventing user-visible "re-discovery"
+* notifications on every addon-runner respawn. Each respawn re-fires
+* `DeviceBindingsChanged` for every cap registration, which without
+* this guard would propagate redundant pushes.
+*
+* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
+* subscription. The proper fix is a single "device ready" lifecycle
+* barrier so exports react only when the full cap set has landed —
+* tracked separately for post-HA-integration work.
+*/
+function canonicalHash(value) {
+	const canonical = JSON.stringify(value, replaceWithSortedKeys);
+	return createHash("sha256").update(canonical ?? "").digest("hex");
+}
+function replaceWithSortedKeys(_key, value) {
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const obj = value;
+		const out = {};
+		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
+		return out;
+	}
+	return value;
+}
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -6955,6 +7018,14 @@ var EncodeProfileSchema = object({
 			"main",
 			"high"
 		]).optional(),
+		/**
+		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+		* it, or it ships a stream that does not match its own advertisement — the
+		* defect class that kept HomeKit black for a year and that Alexa carried
+		* silently. Optional because a browser negotiates the level itself.
+		*/
+		level: string().optional(),
 		width: number().int().positive().optional(),
 		height: number().int().positive().optional(),
 		fps: number().positive().optional(),
@@ -7002,6 +7073,29 @@ var EncodeProfileSchema = object({
 	outputArgs: array(string()).optional()
 });
 /**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
+		width: 1280,
+		height: 720,
+		fps: 25,
+		bitrateKbps: 2500,
+		gopFrames: 25,
+		bf: 0,
+		preset: "veryfast",
+		tune: "zerolatency"
+	},
+	audio: "passthrough"
+};
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
+({ ...BASE_LIVE_EGRESS_PROFILE });
+/**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
 * node. Produced by the backend `WiringHealthService` and surfaced via
@@ -7051,6 +7145,105 @@ object({
 	})
 });
 /**
+* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
+* pipeline functions an operator thinks in terms of.
+*
+* ## This file adds no state
+*
+* Every switch here is a VIEW onto an authority that already existed
+* ([D61](../../../../docs/decisions/adr-0062.md)). The whole point of the
+* group is that there is exactly one place each function is turned off, and
+* the group routes to it:
+*
+* | Switch | Authority | Proven "off stops the work" gate |
+* | --- | --- | --- |
+* | `stream-broker` | `deviceManager.setDisabled` | `StreamBrokerManager.reconcileAllCatalogs` releases the brokers; `ensureBroker` refuses re-creation |
+* | `object-detection` | `deviceManager.setWrapperActive('detection-pipeline')` | `PipelineSettingsStore.resolvePipelineForDevice` returns `{ steps: [], audio: null }` |
+* | `audio-analysis` | `deviceManager.setWrapperActive('audio-analysis')` | `AudioSubscriptionController.subscribeAudioStream` returns `null` before opening the stream |
+* | `recording` | `recording.setDeviceConfig` → `RecordingConfig.enabled` | `band-decision.shouldRecord` returns false; the controller detaches the device |
+* | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
+*
+* The wrapper-binding pair is not a new idea: `legacy-migrations.ts` already
+* migrated the legacy `audioEnabled` / `pipelineEnabled` /
+* `motionDetectionEnabled` booleans ONTO `setWrapperActive`. The group is the
+* surface that decision never got.
+*
+* ## Two rules that are load-bearing
+*
+* - **Recording's switch is `enabled`, never the bands.** `bands` is the only
+*   authored intent and `mode` is derived from it (`deriveRecordingMode`).
+*   Expressing "off" by clearing bands destroys the operator's schedule and
+*   turning the camera back on would then silently record nothing.
+* - **A switch that is off must be reported as off**, not merely produce
+*   nothing. {@link CameraSwitch.enabled} is what a status surface renders as
+*   "disabled by an operator" instead of "broken" — see
+*   `CameraStatus.switchedOff`.
+*/
+/**
+* The five functions the operator named (2026-08-05). Deliberately NOT one id
+* per pipeline step: face recognition and plate/LPR are per-step toggles on
+* `pipelineOrchestrator.setCameraStepToggle` and belong in the pipeline
+* editor, not in a five-button safety group.
+*/
+var CameraSwitchIdSchema = _enum([
+	"stream-broker",
+	"object-detection",
+	"audio-analysis",
+	"recording",
+	"notifications"
+]);
+/**
+* WHERE the switch's state actually lives. A discriminated union rather than a
+* string so both the writer (the orchestrator's `setCameraSwitch`) and any
+* reader can exhaustively narrow — and so "the group added a parallel map" is
+* a compile error rather than a review comment.
+*/
+var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
+	object({ kind: literal("device-disabled") }),
+	object({
+		kind: literal("wrapper-binding"),
+		capName: string()
+	}),
+	object({ kind: literal("recording-config") }),
+	object({ kind: literal("notification-mute") })
+]);
+/**
+* Why a switch is not offered for this camera. Rendered instead of the
+* control, never as a dead control — an absent function and a broken one must
+* not look the same.
+*/
+var CameraSwitchUnavailableReasonSchema = _enum(["no-provider", "source-unreachable"]);
+/**
+* One switch, resolved for one camera.
+*
+* `label` and `costWhenOff` travel ON THE WIRE rather than being looked up
+* client-side: the viewer is a separate repository that does not import
+* `@camstack/types`, and a cost line duplicated in two clients is a cost line
+* that will disagree with itself. Five rows per camera is nothing.
+*/
+var CameraSwitchSchema = object({
+	id: CameraSwitchIdSchema,
+	label: string(),
+	/**
+	* What the operator LOSES while this is off, in one sentence. Required, not
+	* optional: a switch that cannot say what it costs should not ship.
+	*/
+	costWhenOff: string(),
+	/** False = do not render a control. `unavailableReason` says why. */
+	available: boolean(),
+	unavailableReason: CameraSwitchUnavailableReasonSchema.optional(),
+	/** Current state. Meaningless when `available` is false — read it as `true`. */
+	enabled: boolean(),
+	authority: CameraSwitchAuthoritySchema
+});
+/** The whole group for one camera. */
+var CameraSwitchGroupSchema = object({
+	deviceId: number().int(),
+	switches: array(CameraSwitchSchema).readonly(),
+	/** Unix ms when the group was composed server-side. */
+	fetchedAt: number()
+});
+/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -7069,14 +7262,16 @@ var OpsLogOpSchema = _enum([
 	"manual-delete",
 	"rescan",
 	"retention-run",
-	"relocate"
+	"relocate",
+	"orphan-audit"
 ]);
 /** Why the operation ran. */
 var OpsLogReasonSchema = _enum([
 	"retention",
 	"quota",
 	"manual",
-	"operator"
+	"operator",
+	"maintenance"
 ]);
 /** One audit row, shared verbatim by both domains. */
 var OpsLogEntrySchema = object({
@@ -8991,6 +9186,100 @@ var RtpSourceSchema = object({
 	encoder: string(),
 	pipelineKey: string()
 });
+/**
+* The encode request — **structured and serialisable, with NO raw-flag escape
+* hatch.** This is deliberate and it is the one lesson taken from
+* `getStreamWithCodec`: that method's `outputArgs: string[]` is simultaneously
+* its extensibility mechanism AND part of `pipelineKeyFor`'s sharing key, so
+* adding a flag silently forks the shared child, and two consumers that mean
+* the same thing but spell it differently never share. Here every knob is a
+* NAMED field: a new requirement becomes a schema field (and a codegen run),
+* never an opaque array.
+*
+* `inputArgs` / `outputArgs` are omitted from the profile for the same reason.
+* The operator-facing derived-stream transform editor still has them — that is
+* a different surface (`publishCameraStream({ kind: 'derived' })`) with a
+* different purpose (reshaping a badly-behaved SOURCE), and it is unchanged.
+*/
+var EgressEncodeSchema = EncodeProfileSchema.omit({
+	inputArgs: true,
+	outputArgs: true
+});
+/**
+* How the encoder is bounded. `'tight'` is a one-second VBV window for a
+* consumer whose budget is enforced per second (HomeKit); `'relaxed'` is two
+* seconds, letting a keyframe spike borrow from the next second (a browser,
+* an Echo). Named rather than numeric so the INTENT survives.
+*/
+var EgressRateControlSchema = _enum(["tight", "relaxed"]);
+var EgressTranscodeRequestSchema = object({
+	deviceId: number().int().nonnegative(),
+	/** Which published stream to read. */
+	source: discriminatedUnion("kind", [object({
+		kind: literal("profile"),
+		profile: CamProfileSchema
+	}), object({
+		kind: literal("cam-stream"),
+		camStreamId: string().min(1)
+	})]),
+	encode: EgressEncodeSchema,
+	rateControl: EgressRateControlSchema.optional(),
+	/**
+	* `-bsf:v`. A consumer that negotiates its OWN SDP (HomeKit) cannot carry
+	* out-of-band extradata and needs `dump_extra` on both the copy and encode
+	* branches. Enumerated, not free text.
+	*/
+	bitstreamFilter: _enum([
+		"dump_extra",
+		"h264_mp4toannexb",
+		"hevc_mp4toannexb"
+	]).optional(),
+	pixelFormat: _enum(["yuv420p", "nv12"]).optional(),
+	/**
+	* Operator/consumer override for decode hardware. ABSENT is the normal case
+	* and the one that matters: the broker then resolves the backend from the
+	* DECODER ADDON's per-node `probedBestHwaccel` (see
+	* `@camstack/types` `ffmpeg/hwaccel.ts`), which is the ranking known to work
+	* on this hardware — never the raw kernel resolver's qsv-first order.
+	*/
+	decodeHwAccel: _enum([
+		"auto",
+		"none",
+		"videotoolbox",
+		"vaapi",
+		"qsv",
+		"cuda"
+	]).optional(),
+	/**
+	* Host to embed in the returned restream `url`. The broker mints hub-local
+	* `127.0.0.1` URLs; a consumer on another node passes a cluster-resolvable
+	* host (`NodeTopologyService.reachableHostByNode`) so the returned URL is
+	* dialable from there. Same contract as `getStreamWithCodec.hostname` —
+	* `substituteRtspHost` rewrites only the dial address, never the restreamer.
+	*/
+	hostname: string().optional(),
+	/** Attribution for the broker panel. Never part of the sharing key. */
+	tag: string().optional()
+});
+var EgressTranscodeSchema = object({
+	/** Dial-able RTSP url (host-substituted when `hostname` was supplied). */
+	url: string(),
+	/** Release handle. Refcounted — the child dies when the last holder releases. */
+	pipelineKey: string(),
+	videoCodec: _enum(["H264", "H265"]),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	transcoded: boolean(),
+	encoder: string(),
+	/**
+	* The decode backend the child ACTUALLY ran with — `null` for software.
+	* Returned rather than assumed: a consumer that asked for hardware and got
+	* software needs to be able to see that without reading the broker's logs.
+	*/
+	decodeHwAccel: string().nullable()
+});
 method(object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string().min(1),
@@ -9100,6 +9389,15 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(EgressTranscodeRequestSchema, EgressTranscodeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ pipelineKey: string() }), object({
+	released: boolean(),
+	refcount: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
 	subscriptionId: string(),
 	maxCount: number().int().positive().default(8)
@@ -9554,6 +9852,62 @@ method(_void(), EngineInfoSchema), method(object({
 	indexes: array(CollectionIndexSchema).readonly().optional()
 }), _void(), { kind: "mutation" });
 /**
+* Stable UI option list for the `hwaccel` setting. Decoder addons
+* reuse this for `globalSettingsSchema()` so the dropdown is
+* identical everywhere. Order: auto → off → common backends by
+* platform affinity (macOS, NVIDIA, Intel/AMD, Windows, Linux).
+*/
+var HWACCEL_OPTIONS = [
+	{
+		value: "auto",
+		label: "Auto (defer to probed best)"
+	},
+	{
+		value: "none",
+		label: "Off (software)"
+	},
+	{
+		value: "videotoolbox",
+		label: "VideoToolbox (macOS)"
+	},
+	{
+		value: "cuda",
+		label: "CUDA (NVIDIA)"
+	},
+	{
+		value: "nvdec",
+		label: "NVDEC (NVIDIA legacy)"
+	},
+	{
+		value: "vaapi",
+		label: "VAAPI (Linux Intel/AMD)"
+	},
+	{
+		value: "qsv",
+		label: "QuickSync (Intel)"
+	},
+	{
+		value: "d3d11va",
+		label: "D3D11VA (Windows)"
+	},
+	{
+		value: "dxva2",
+		label: "DXVA2 (Windows legacy)"
+	},
+	{
+		value: "amf",
+		label: "AMF (AMD)"
+	},
+	{
+		value: "vdpau",
+		label: "VDPAU (Linux NVIDIA legacy)"
+	},
+	{
+		value: "drm",
+		label: "DRM (Linux generic)"
+	}
+];
+/**
 * shm ring usage stats for a `frameSink: 'shm'` decoder session —
 * exposed via `decoder.getShmStats` so downstream consumers can
 * observe ring pressure (slot count, byte budget, hit/miss ratio).
@@ -12903,7 +13257,7 @@ var DETECTION_SUB_COLORS = {
 	zebra: "#404040",
 	giraffe: "#d4a373"
 };
-function titleCase(id) {
+function titleCase$1(id) {
 	return id.split(/[-_ ]/).filter((p) => p.length > 0).map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(" ");
 }
 var entries = /* @__PURE__ */ new Map();
@@ -12942,7 +13296,7 @@ macro("control", "control", TAXONOMY_COLORS.control, "control", "Control");
 for (const [cocoClass, macroClass] of Object.entries(COCO_TO_MACRO.mapping)) {
 	if (macroClass !== "vehicle" && macroClass !== "animal") continue;
 	if (entries.has(cocoClass)) continue;
-	sub(cocoClass, macroClass, "detection", DETECTION_SUB_COLORS[cocoClass] ?? TAXONOMY_COLORS.genericDetection, cocoClass, titleCase(cocoClass));
+	sub(cocoClass, macroClass, "detection", DETECTION_SUB_COLORS[cocoClass] ?? TAXONOMY_COLORS.genericDetection, cocoClass, titleCase$1(cocoClass));
 }
 sub("package-delivered", "package", "package", TAXONOMY_COLORS.package, "package", "Package delivered");
 sub("package-picked-up", "package", "package", TAXONOMY_COLORS.package, "package", "Package picked up");
@@ -13451,12 +13805,13 @@ var NcConditionsSchema = object({
 	* source; otherwise the subject's source must equal it. Legacy records
 	* with no stamped source are treated as `pipeline`. The union spans both
 	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
+	* tracks carry `sensor` (a linked device) or `audio` (a D62 audio marker).
 	*/
 	source: _enum([
 		"pipeline",
 		"onboard",
 		"sensor",
+		"audio",
 		"any"
 	]).optional(),
 	/**
@@ -14032,6 +14387,12 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), object({ mutedDeviceIds: array(number().int()).readonly() }), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	rule: NcRuleInputSchema,
 	lookbackMinutes: number().int().min(1).max(1440).default(60)
@@ -14370,12 +14731,60 @@ var TrackAudioLabelSchema = object({
 });
 /**
 * How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. `sensor` = a SYNTHETIC track projected from a
-* linked sensor/control state change (no positions; carries a snapshot). The
-* spatial subsystems (tracker association, occupancy count, re-id/embedding,
-* resurrection) MUST skip `sensor` tracks — they have no bbox trajectory.
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
+*
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
+*/
+var TrackSourceSchema = _enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* What the flags DO is deliberately UNDEFINED at the time of writing: they are
+* operator curation, and the behaviour they drive will be specified separately.
+* In particular a `markForTrain` track is NOT pinned against retention — see
+* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+*/
+var TrackFlagFields = {
+	/** Operator marked this track as training material. */
+	markForTrain: boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: boolean().optional()
+};
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
 */
-var TrackSourceSchema = _enum(["pipeline", "sensor"]);
+var TrackFlagsSchema = object({
+	trackId: string(),
+	markForTrain: boolean(),
+	debug: boolean()
+});
 var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
@@ -14418,7 +14827,8 @@ var TrackSchema = object({
 	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-	envelope: TrackEnvelopeSchema.optional()
+	envelope: TrackEnvelopeSchema.optional(),
+	...TrackFlagFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -14631,7 +15041,8 @@ var KeyEventSchema = object({
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: number().optional()
+	windowMs: number().optional(),
+	...TrackFlagFields
 });
 object({
 	trackId: string(),
@@ -14702,6 +15113,104 @@ var EventPruneCountsSchema = object({
 	object: number().int(),
 	audio: number().int()
 });
+/**
+* Re-embed stored tracks from their key frames.
+*
+* The reason this is an operator-callable method and not a migration script:
+* every knob that decides what a vector MEANS — encoder model, crop margin,
+* squaring — is only changeable if the existing vectors can be regenerated.
+* Mixing feature spaces in one index makes cosine scores incomparable, and the
+* symptom is a quality regression with no visible cause.
+*/
+var RebuildObjectEmbeddingsInput = object({
+	/** Restrict to one camera. Omit for the whole fleet. */
+	deviceId: number().optional(),
+	since: number().optional(),
+	until: number().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: number().int().positive().optional(),
+	/**
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
+	*/
+	executeOnNodeId: string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: number().int().nonnegative().optional()
+});
+/**
+* Result of emptying the CLIP index.
+*
+* The clean slate before a policy change: a new crop margin or encoder model
+* leaves two feature spaces in one index whose cosine scores are not
+* comparable, so wiping and rebuilding is the only way to be sure every vector
+* means the same thing.
+*/
+var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+/**
+* Acknowledgement that a rebuild STARTED.
+*
+* The pass costs ~1s per track — 45 minutes for a 2,600-track fleet — so it
+* runs detached and this returns immediately. Waiting for it made the client
+* time out while the work carried on server-side, which is the worst of both:
+* no result and no way to know it was still going. Poll
+* `getObjectEmbeddingRebuildStatus` for progress.
+*/
+var RebuildObjectEmbeddingsResultSchema = object({
+	started: boolean(),
+	/** True when a pass was already running; the new request is ignored. */
+	alreadyRunning: boolean()
+});
+var RebuildStatusSchema = object({
+	running: boolean(),
+	scanned: number(),
+	rebuilt: number(),
+	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	missingKeyFrame: number(),
+	/** Tracks with no usable detection box. */
+	missingBbox: number(),
+	/**
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
+	*/
+	notRunnable: number(),
+	/**
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
+	*/
+	noCapableNode: number(),
+	failed: number(),
+	/** Set once a pass ends: true only when EVERYTHING was covered. */
+	complete: boolean().nullable(),
+	startedAtMs: number().nullable(),
+	finishedAtMs: number().nullable(),
+	/** Present when the pass ended by throwing. */
+	error: string().nullable()
+});
 DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).readonly()), method(object({
 	deviceId: number(),
 	trackId: string()
@@ -14765,7 +15274,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), EventStoreFootprintSchema, {
+}), method(object({
+	/** Log/audit scope only — the trackId is globally unique on its own. */
+	deviceId: number(),
+	trackId: string(),
+	flags: TrackFlagsPatchSchema
+}), TrackFlagsSchema, { kind: "mutation" }), method(object({}), EventStoreFootprintSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({
@@ -14795,7 +15309,13 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), RebuildStatusSchema), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -15369,6 +15889,53 @@ var DetailResultSchema = object({
 	nativeFaceShortSidePx: number().optional()
 });
 /**
+* Why an executing node REFUSED a stateless step run (`runStatelessStep`).
+*
+* A refusal is a first-class answer, not an error, because the caller's next
+* move depends on WHICH one it is — and because "the pass produced nothing"
+* must never be reachable without a named, counted cause. The two tiers:
+*
+* - **node-level** (`unknown-step`, `model-not-servable`) — this node can
+*   never serve this (step, model) pair. The caller drops it from its rotation
+*   and retries the same work elsewhere; nothing about the work changes.
+* - **work-level** (`unreadable-frame`, `execution-failed`) — this node is
+*   fine, this one request is not. Retrying it on another node would only
+*   spread the same failure.
+*/
+var StatelessStepRefusalSchema = _enum([
+	"unknown-step",
+	"model-not-servable",
+	"unreadable-frame",
+	"execution-failed"
+]);
+/**
+* Answer to `runStatelessStep` — a discriminated union rather than a nullable
+* result, because `null` is exactly what made the camera-bound detail path
+* unable to tell "refused" from "never asked".
+*/
+var RunStatelessStepResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("ran"),
+	/** The node that actually executed it — the pin, echoed back for the log. */
+	nodeId: string(),
+	/**
+	* The model the step ran with.
+	*
+	* The node verified this exact id has a build for the format it dispatched
+	* on BEFORE running, so the executor's format resolution returns it
+	* unchanged. A caller that pinned a model must compare this field and
+	* treat a mismatch as a refusal — the whole point of the pin is that a
+	* pass writes one feature space.
+	*/
+	modelId: string(),
+	details: array(DetailResultSchema)
+}), object({
+	kind: literal("refused"),
+	nodeId: string(),
+	reason: StatelessStepRefusalSchema,
+	/** Human-readable specifics — the format tried, the formats shipped, etc. */
+	detail: string()
+})]);
+/**
 * Per-camera tunable ranges + defaults. Single source of truth used
 * by both the Zod data schema (validation + default fallback) and
 * the device settings UI (slider min/max/step). Touch one place and
@@ -15704,10 +16271,46 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 }), NativeCropResultSchema.nullable()), method(object({
 	deviceId: number(),
 	frameHandle: FrameHandleSchema.optional(),
+	/**
+	* FULL FRAME (base64 JPEG). The runner derives the crop rectangle from
+	* `parent.bbox` with the cluster crop convention and cuts it itself —
+	* do NOT pre-crop for this field, that is what `cropJpeg` is.
+	*/
+	frameJpeg: string().optional(),
+	/**
+	* PRE-CUT tile (base64 JPEG), used verbatim — NO padding is applied.
+	* The fallback when the lease/session backing the frame is gone and the
+	* caller already holds a crop.
+	*/
 	cropJpeg: string().optional(),
 	parent: DetailParentSchema,
 	steps: array(string()).optional()
-}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
+}), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" }), method(object({
+	/** Catalog step id, e.g. `clip-embedding`. */
+	stepId: string(),
+	/**
+	* REQUIRED model pin. The node runs this exact model or refuses with
+	* `model-not-servable` — it never substitutes a format default, because
+	* a fleet pass that round-robins across nodes would then fill one index
+	* from several encoders.
+	*/
+	modelId: string(),
+	/** FULL FRAME, base64 JPEG. The runner cuts — do NOT pre-crop. */
+	frameJpeg: string(),
+	/**
+	* The subject box, NORMALISED [0,1] against `frameJpeg`. Normalised on
+	* purpose: the caller stores boxes against a downscaled analysis frame
+	* while the stored key frame is native-resolution, and the only side
+	* that reliably knows the image's pixel dimensions is the side that
+	* decodes it. Denormalising here removes a second reader of the
+	* dimensions and the class of mismatch that comes with it.
+	*/
+	bbox: NativeCropBboxSchema,
+	/** Parent class of the subject (`person`, `vehicle`, …) — carried into the result. */
+	className: string(),
+	/** Camera the pixels came from. Diagnostics + log tags ONLY — never routing. */
+	sourceDeviceId: number()
+}), RunStatelessStepResultSchema, { kind: "mutation" });
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -16005,6 +16608,20 @@ var CameraStatusSchema = object({
 	detection: CameraDetectionStatusSchema.nullable(),
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
+	/**
+	* Per-camera function switches an OPERATOR has turned off
+	* ([D61](../../../../docs/decisions/adr-0067.md)).
+	*
+	* This is the difference between DISABLED and BROKEN. A camera whose
+	* `detection` block reports zero fps and whose `switchedOff` contains
+	* `'object-detection'` was switched off by a person; the same camera with an
+	* empty list is failing. Every status surface must render the two
+	* differently — a quiet camera that looks identical to a dead one is the
+	* silence-reads-as-never-happened trap this repo keeps paying for.
+	*
+	* Empty when nothing is off. Never contains a switch no provider offers.
+	*/
+	switchedOff: array(CameraSwitchIdSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -16173,7 +16790,14 @@ method(object({
 }), method(object({
 	deviceId: number(),
 	agentNodeId: string().optional()
-}), CameraPipelineConfigSchema), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
+}), CameraPipelineConfigSchema), method(object({ deviceId: number() }), CameraSwitchGroupSchema), method(object({
+	deviceId: number(),
+	switchId: CameraSwitchIdSchema,
+	enabled: boolean()
+}), CameraSwitchGroupSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), CameraStatusSchema), method(object({ deviceIds: array(number()).optional() }), array(CameraStatusSchema).readonly()), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
 	name: string(),
 	description: string().optional(),
 	config: CameraPipelineConfigSchema
@@ -17029,6 +17653,24 @@ var VectorDeleteByFilterInputSchema = object({
 	filter: VectorFilterSchema
 });
 var VectorDeleteResultSchema = object({ deleted: number() });
+var VectorGetInputSchema = object({
+	index: string(),
+	ids: array(string())
+});
+/**
+* Metadata for the requested ids, WITHOUT their vectors.
+*
+* The only caller is a best-of gate that compares a candidate's confidence
+* against the stored one, and shipping 512 floats back to answer "is 0.91 >
+* 0.87" would undo the point of the compact encoding. Ids with no row are
+* simply absent — a caller distinguishing "not stored" from "stored" reads the
+* length, and a null placeholder would invite a `?? 0` that treats a missing
+* row as confidence zero.
+*/
+var VectorGetResultSchema = object({ items: array(object({
+	id: string(),
+	metadata: VectorMetadataSchema
+})) });
 var VectorStatsInputSchema = object({ index: string() });
 var VectorStatsResultSchema = object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -17041,7 +17683,7 @@ var VectorStatsResultSchema = object({
 	/** False when the backend ranks approximately. */
 	exact: boolean()
 });
-method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
+method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
 /**
 * `videoclips` — the unified, navigable-clip surface for a camera.
 *
@@ -25112,6 +25754,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listDeviceMutes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listRules": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -25130,6 +25778,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.setDeviceMuted": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -25304,6 +25958,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getObjectEmbeddingRebuildStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -25382,6 +26042,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.rebuildObjectEmbeddings": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.relocateMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -25394,12 +26060,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.setTrackFlags": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.wipeObjectEmbeddings": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -25694,6 +26372,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getCameraSwitches": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getCapabilityBindings": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -25826,6 +26510,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSwitch": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCapabilityBinding": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -25916,6 +26606,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.runStatelessStep": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -26732,6 +27428,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.acquireEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.assignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -26840,6 +27542,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.releaseEgressTranscode": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.releaseStreamWithCodec": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -27320,6 +28028,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"vectorStore.getByIds": {
+		capName: "vector-store",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"vectorStore.query": {
 		capName: "vector-store",
 		capScope: "system",
@@ -27594,37 +28308,30 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
-/**
-* Deterministic SHA-256 hash of an arbitrary serialisable value. The
-* canonical form sorts object keys alphabetically at every depth so two
-* structurally-equal inputs with different key insertion orders produce
-* the same hash. Returns a 64-char lowercase hex digest.
-*
-* Used by export adapters (Alexa, HAP) to short-circuit re-discovery /
-* accessory-rebuild work when the upstream shape is byte-identical to
-* the last applied state — preventing user-visible "re-discovery"
-* notifications on every addon-runner respawn. Each respawn re-fires
-* `DeviceBindingsChanged` for every cap registration, which without
-* this guard would propagate redundant pushes.
-*
-* Note: this is a SYMPTOMATIC fix layered on top of the binding-change
-* subscription. The proper fix is a single "device ready" lifecycle
-* barrier so exports react only when the full cap set has landed —
-* tracked separately for post-HA-integration work.
-*/
-function canonicalHash(value) {
-	const canonical = JSON.stringify(value, replaceWithSortedKeys);
-	return createHash("sha256").update(canonical ?? "").digest("hex");
-}
-function replaceWithSortedKeys(_key, value) {
-	if (value && typeof value === "object" && !Array.isArray(value)) {
-		const obj = value;
-		const out = {};
-		for (const k of Object.keys(obj).toSorted()) out[k] = obj[k];
-		return out;
-	}
-	return value;
-}
+object({
+	/**
+	* Fraction of the box's own size added on EACH side before cutting.
+	*
+	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
+	* removes exactly the context it is strongest on (a dog cut to its outline
+	* is a dark blob). The right value is an empirical question, which is why it
+	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
+	*/
+	paddingRatio: number().min(0).max(4),
+	/**
+	* Square the window (in PIXELS) before cutting.
+	*
+	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
+	* — a standing person becomes a shape the model never saw. Squaring costs
+	* extra background, which is context the model wants anyway. Off by default
+	* because the live path has never squared and the stored index reflects that.
+	*/
+	square: boolean()
+});
+({
+	paddingRatio: .15,
+	square: false
+}).paddingRatio;
 /**
 * Compute the stable 64-char lowercase-hex fingerprint of a device's
 * export-relevant shape. Two structurally-equal shapes (any feature order,
@@ -27796,6 +28503,110 @@ function firstExposedAccessorySetupUri(exposed, logger) {
 		}
 	}
 }
+/**
+* hap-nodejs' `checkName` regex, verbatim.
+*
+* Duplicated rather than imported because it is `@private Private API` in that
+* package and not exported. Duplicating a private regex is a liability, so the
+* guard against drift is behavioural, not textual: `service-naming.spec.ts`
+* builds real services and asserts hap-nodejs emits ZERO characteristic
+* warnings — if this expression ever diverges from theirs, that test fails.
+*/
+var HAP_NAME_PATTERN = /^[\p{L}\p{N}][\p{L}\p{N}\p{Zs}’'&!._:;()/,-]*[\p{L}\p{N}]$/u;
+/** Characters HAP tolerates INSIDE a name. Anything else becomes a space. */
+var HAP_NAME_INNER = /[^\p{L}\p{N}\p{Zs}’'&!._:;()/,-]/gu;
+/** Would hap-nodejs accept this as a `Name` characteristic value? */
+function isHapServiceName(value) {
+	return HAP_NAME_PATTERN.test(value);
+}
+/**
+* Build one HAP-valid service name from device-derived parts.
+*
+* Empty and absent parts are dropped rather than joined, so a missing role
+* never produces a double space. `fallback` is used ONLY when nothing
+* device-derived survives sanitisation — it is the last resort, not the
+* default, because a name that says nothing about the device is the defect
+* this module exists to end.
+*/
+function hapServiceName(parts, fallback) {
+	const trimmed = trimToHapName(parts.map((part) => typeof part === "string" ? part : "").map((part) => part.replace(HAP_NAME_INNER, " ")).join(" ").replace(/\s+/gu, " ").trim());
+	if (trimmed !== null) return trimmed;
+	return trimToHapName(fallback.replace(HAP_NAME_INNER, " ").replace(/\s+/gu, " ").trim()) ?? "";
+}
+/**
+* The privacy-mask switch.
+*
+* The camera's own name carries the meaning; "Privacy" only says which of the
+* camera's switches this is. It used to be the WHOLE name, which is why the
+* operator saw a switch that named neither its camera nor, with two cameras
+* exposed, which camera it belonged to.
+*/
+function privacyServiceName(deviceName) {
+	return hapServiceName([deviceName, PRIVACY_SUFFIX], PRIVACY_SUFFIX);
+}
+/**
+* Deliberately not localised, and deliberately not a translation table.
+*
+* The device half of the name is the operator's own text and arrives in the
+* operator's language. This half names a camstack capability (`privacy-mask`)
+* and there is no locale in an addon's context to resolve it against; the word
+* is also identical in the operator's language. A translation layer for one
+* word would be the kind of leftover that reads as verification.
+*/
+var PRIVACY_SUFFIX = "Privacy";
+/**
+* An accessory child (siren, floodlight, spotlight) rendered as a service on
+* the parent camera.
+*
+* The child's OWN stored name wins. It is the string the operator typed, in
+* the operator's language, and the previous rule threw it away: `role` was
+* consulted first and title-cased, so every siren on the fleet published as
+* the English word "Siren" no matter what the operator had called it.
+*
+* The parent name is prefixed only when the child's name does not already
+* carry it — providers name children both ways ("Sirena" and "Videocamera
+* cucina Sirena") and the result must be one form, not two.
+*/
+function childServiceName(parentName, child) {
+	const own = child.name.trim();
+	if (own.length > 0) return mentions(own, parentName) ? hapServiceName([own], parentName) : hapServiceName([parentName, own], own);
+	return hapServiceName([parentName, typeof child.role === "string" ? titleCase(child.role) : ""], parentName);
+}
+/**
+* A PTZ action switch.
+*
+* The action labels themselves stay in `ptz-labels.ts` — they name a HomeKit
+* control, not a device — but the service is still qualified by the camera, so
+* a home with two PTZ cameras does not publish two switches called "Preset
+* ingresso".
+*/
+function ptzServiceName(deviceName, actionLabel) {
+	return hapServiceName([deviceName, actionLabel], actionLabel);
+}
+/** Does `name` already contain `parentName` as a whole word? */
+function mentions(name, parentName) {
+	const needle = parentName.trim().toLowerCase();
+	if (needle.length === 0) return true;
+	return name.toLowerCase().includes(needle);
+}
+/**
+* Truncate to the HAP ceiling and shave any leading/trailing character the
+* pattern forbids. Returns `null` when nothing usable is left — the caller
+* decides what to do with that, because "fall back" and "drop the part" are
+* different answers.
+*/
+function trimToHapName(value) {
+	let out = value.length > 64 ? value.slice(0, 64) : value;
+	while (out.length > 0 && !isAlphanumeric(out[out.length - 1])) out = out.slice(0, -1);
+	while (out.length > 0 && !isAlphanumeric(out[0])) out = out.slice(1);
+	return isHapServiceName(out) ? out : null;
+}
+function isAlphanumeric(ch) {
+	return ch !== void 0 && /[\p{L}\p{N}]/u.test(ch);
+}
+function titleCase(raw) {
+	return raw.split(/[-_\s]+/u).filter((part) => part.length > 0).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
 //#endregion
 //#region src/mappers/builders/battery.ts
 /**
@@ -27820,7 +28631,7 @@ var LOW_BATTERY_THRESHOLD_PCT = 20;
 async function buildBattery(bctx) {
 	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const service = accessory.addService(Service.Battery, displayName);
+	const service = accessory.addService(Service.Battery, hapServiceName([displayName], `Camera ${numericDeviceId}`));
 	try {
 		const status = await proxy.battery?.getStatus({});
 		if (status) applyToService(service, status);
@@ -38150,13 +38961,1035 @@ var require_src = /* @__PURE__ */ __commonJSMin(((exports) => {
 	__exportStar(require_util(), exports);
 }));
 //#endregion
-//#region src/mappers/builders/camera-streams.ts
+//#region src/mappers/builders/rtcp-gate.ts
 var import_src = require_src();
+/** `packet@42ms` / `timeout@1000ms` — one compact log field. */
+function formatRtcpGate(resolution) {
+	if (resolution === null) return "pending";
+	return `${resolution.reason}@${resolution.waitedMs}ms`;
+}
+/**
+* Resolve as soon as ANY packet arrives on `socket`, or after `timeoutMs`.
+* One-shot: the listener is detached on either path.
+*/
+function makeRtcpGate(socket, timeoutMs) {
+	const armedAt = Date.now();
+	return new Promise((resolve) => {
+		const onMessage = () => {
+			socket.removeListener("message", onMessage);
+			clearTimeout(timer);
+			resolve({
+				reason: "packet",
+				waitedMs: Date.now() - armedAt
+			});
+		};
+		const timer = setTimeout(() => {
+			socket.removeListener("message", onMessage);
+			resolve({
+				reason: "timeout",
+				waitedMs: Date.now() - armedAt
+			});
+		}, timeoutMs);
+		socket.on("message", onMessage);
+	});
+}
+/** V/P/RC byte + PT byte + 16-bit length. */
+var RTCP_HEADER_BYTES = 4;
+/** SSRC of the packet sender, first field of both SR and RR bodies. */
+var RTCP_SENDER_SSRC_BYTES = 4;
+/** NTP + RTP timestamp, packet count, octet count — present only on an SR. */
+var RTCP_SENDER_INFO_BYTES = 20;
+/** One report block: SSRC_n, loss, highest seq, jitter, LSR, DLSR. */
+var RTCP_REPORT_BLOCK_BYTES = 24;
+/** `fraction lost` is an 8-bit fixed-point fraction of 256. */
+var FRACTION_LOST_DENOMINATOR = 256;
+/** `delay since last SR` counts 1/65536 of a second. */
+var DLSR_UNITS_PER_SECOND = 65536;
+/** `cumulative number of packets lost` is a SIGNED 24-bit field. */
+var SIGNED_24_SIGN_BIT = 8388608;
+var SIGNED_24_MODULUS = 16777216;
+function readSigned24(packet, at) {
+	const raw = packet[at] << 16 | packet[at + 1] << 8 | packet[at + 2];
+	return raw >= SIGNED_24_SIGN_BIT ? raw - SIGNED_24_MODULUS : raw;
+}
+function readReportBlock(packet, at) {
+	const fractionLostRaw = packet[at + 4];
+	const dlsr = packet.readUInt32BE(at + 20);
+	return {
+		aboutSsrc: packet.readUInt32BE(at),
+		fractionLostRaw,
+		fractionLostPct: Math.round(fractionLostRaw / FRACTION_LOST_DENOMINATOR * 1e3) / 10,
+		cumulativePacketsLost: readSigned24(packet, at + 5),
+		extendedHighestSequence: packet.readUInt32BE(at + 8),
+		jitter: packet.readUInt32BE(at + 12),
+		lastSrTimestamp: packet.readUInt32BE(at + 16),
+		delaySinceLastSrMs: Math.round(dlsr / DLSR_UNITS_PER_SECOND * 1e3)
+	};
+}
+/**
+* Walk a (possibly compound) RTCP datagram and extract every report block.
+*
+* An RR is routinely bundled behind an SDES, and a controller with nothing to
+* report yet sends an RR with a reception-report count of zero. Both are
+* normal; neither is a failure. What IS a failure is a packet whose declared
+* length runs past the buffer or whose report count exceeds its own body —
+* those get named so a decrypt fault cannot masquerade as silence.
+*/
+function parseCompoundRtcp(packet) {
+	if (packet.length === 0) return {
+		ok: false,
+		failure: "empty",
+		atOffset: 0
+	};
+	const packetTypes = [];
+	const reports = [];
+	let offset = 0;
+	while (offset < packet.length) {
+		if (packet.length - offset < RTCP_HEADER_BYTES) return {
+			ok: false,
+			failure: "short-header",
+			atOffset: offset
+		};
+		const firstByte = packet[offset];
+		if ((firstByte >> 6 & 3) !== 2) return {
+			ok: false,
+			failure: "bad-version",
+			atOffset: offset
+		};
+		const reportCount = firstByte & 31;
+		const packetType = packet[offset + 1];
+		const totalBytes = (packet.readUInt16BE(offset + 2) + 1) * 4;
+		if (offset + totalBytes > packet.length) return {
+			ok: false,
+			failure: "length-overrun",
+			atOffset: offset
+		};
+		packetTypes.push(packetType);
+		if (packetType === 201 || packetType === 200) {
+			const senderSsrcAt = offset + RTCP_HEADER_BYTES;
+			const blocksAt = senderSsrcAt + RTCP_SENDER_SSRC_BYTES + (packetType === 200 ? RTCP_SENDER_INFO_BYTES : 0);
+			if (blocksAt + reportCount * RTCP_REPORT_BLOCK_BYTES > offset + totalBytes) return {
+				ok: false,
+				failure: "truncated-body",
+				atOffset: offset
+			};
+			const blocks = [];
+			for (let index = 0; index < reportCount; index += 1) blocks.push(readReportBlock(packet, blocksAt + index * RTCP_REPORT_BLOCK_BYTES));
+			reports.push({
+				packetType,
+				reporterSsrc: packet.readUInt32BE(senderSsrcAt),
+				blocks
+			});
+		}
+		offset += totalBytes;
+	}
+	return {
+		ok: true,
+		packetTypes,
+		reports
+	};
+}
+function emptyReceiverReportTally() {
+	return {
+		reportsParsed: 0,
+		blocksParsed: 0,
+		unreadable: 0,
+		lastFractionLostPct: null,
+		worstFractionLostPct: null,
+		lastCumulativePacketsLost: null,
+		maxCumulativePacketsLost: null,
+		lastJitter: null,
+		maxJitter: null,
+		lastExtendedHighestSequence: null
+	};
+}
+function maxOrValue(previous, next) {
+	return previous === null ? next : Math.max(previous, next);
+}
+/** Fold one report block into the tally. Returns a new tally. */
+function applyReceiverReportBlock(tally, block) {
+	return {
+		...tally,
+		blocksParsed: tally.blocksParsed + 1,
+		lastFractionLostPct: block.fractionLostPct,
+		worstFractionLostPct: maxOrValue(tally.worstFractionLostPct, block.fractionLostPct),
+		lastCumulativePacketsLost: block.cumulativePacketsLost,
+		maxCumulativePacketsLost: maxOrValue(tally.maxCumulativePacketsLost, block.cumulativePacketsLost),
+		lastJitter: block.jitter,
+		maxJitter: maxOrValue(tally.maxJitter, block.jitter),
+		lastExtendedHighestSequence: block.extendedHighestSequence
+	};
+}
+/** Book an RTCP datagram we could not read. Counted, never discarded silently. */
+function recordUnreadableRtcp(tally) {
+	return {
+		...tally,
+		unreadable: tally.unreadable + 1
+	};
+}
+/**
+* Parse one decrypted RTCP datagram and fold it into a leg's tally.
+*
+* This is the seam the delegate calls: it owns SRTCP decryption and logging,
+* this owns everything that can be asserted from bytes alone. A malformed
+* packet returns a failure and an incremented `unreadable` — it never throws,
+* because this runs on a UDP `message` handler where a throw would take the
+* session with it.
+*/
+function ingestDecryptedRtcp(plaintext, tally) {
+	const parsed = parseCompoundRtcp(plaintext);
+	if (!parsed.ok) return {
+		tally: recordUnreadableRtcp(tally),
+		reports: [],
+		failure: parsed.failure
+	};
+	let next = tally;
+	for (const report of parsed.reports) {
+		if (report.blocks.length === 0) continue;
+		next = {
+			...next,
+			reportsParsed: next.reportsParsed + 1
+		};
+		for (const block of report.blocks) next = applyReceiverReportBlock(next, block);
+	}
+	return {
+		tally: next,
+		reports: parsed.reports,
+		failure: null
+	};
+}
+//#endregion
+//#region src/mappers/builders/stream-bitrate.ts
+/**
+* Fraction of the negotiated ceiling we actually aim the encoder at.
+*
+* `max_bit_rate` is what the controller budgeted for the stream; what crosses
+* the wire is the encoded payload PLUS its packetisation. At `mtu = 1378` each
+* packet carries a 12-byte RTP header and a 10-byte SRTP auth tag, and the
+* datagram adds 8 (UDP) + 20 (IPv4) — 50 bytes on ~1378, i.e. **3.6 %**. The
+* remaining ~6 % is margin for a VBV overshoot inside the buffer window.
+* Reserving it is the difference between "at the ceiling" and "over it".
+*/
+var BITRATE_HEADROOM = .9;
+/** Encoder slots a `stream-params` provider exposes, in the cap's own order. */
+var ENCODER_PROFILE_KEYS = [
+	"main",
+	"sub",
+	"ext"
+];
+/**
+* Resolve every profile slot's rate from the camera's configuration, with the
+* broker's flow reading kept alongside it as a lower bound.
+*
+* A slot with neither simply carries two nulls — absence is never rendered as
+* a number, because a wrong number here silently re-creates the overshoot this
+* module exists to end.
+*/
+function resolveProfileBitrates(input) {
+	const camStreamById = /* @__PURE__ */ new Map();
+	for (const stream of input.camStreams) camStreamById.set(stream.camStreamId, stream);
+	const measuredByProfile = /* @__PURE__ */ new Map();
+	for (const choice of input.choices) {
+		if (choice.target.kind !== "profile") continue;
+		const plausible = plausibleMeasured(choice.bitrateKbps);
+		if (plausible !== null) measuredByProfile.set(choice.target.profile, plausible);
+	}
+	const out = /* @__PURE__ */ new Map();
+	for (const slot of input.slots) {
+		const source = slot.sourceCamStreamId === null ? void 0 : camStreamById.get(slot.sourceCamStreamId);
+		out.set(slot.profile, {
+			profile: slot.profile,
+			publishedKbps: publishedRateFor(slot, source, input.streamParams),
+			measuredKbps: measuredByProfile.get(slot.profile) ?? null
+		});
+	}
+	for (const [profile, measured] of measuredByProfile) {
+		if (out.has(profile)) continue;
+		out.set(profile, {
+			profile,
+			publishedKbps: null,
+			measuredKbps: measured
+		});
+	}
+	return out;
+}
+/**
+* The rate the encoder may actually use, or `null` when the controller
+* negotiated no usable ceiling.
+*/
+function budgetForNegotiatedRate(negotiatedMaxBitrateKbps) {
+	if (!Number.isFinite(negotiatedMaxBitrateKbps) || negotiatedMaxBitrateKbps <= 0) return null;
+	const budget = Math.floor(negotiatedMaxBitrateKbps * BITRATE_HEADROOM);
+	return budget > 0 ? budget : null;
+}
+/**
+* Does this slot fit?
+*
+* Only the CONFIGURED rate can answer yes. The measured rate is a lower bound,
+* so it is allowed to answer no — including against an optimistic publication.
+*/
+function classifyBitrateFit(evidence, budgetKbps) {
+	if (evidence === void 0) return "unknown";
+	const { publishedKbps, measuredKbps } = evidence;
+	if (measuredKbps !== null && measuredKbps > budgetKbps) return "over-budget";
+	if (publishedKbps === null) return "unknown";
+	return publishedKbps <= budgetKbps ? "fits" : "over-budget";
+}
+/**
+* Pick the stream to serve, and decide whether it can be passed through.
+*
+* The selection runs the SAME `pickPreferredRtspEntry` the advertisement is
+* derived from (D51) — only the candidate set narrows. When at least one
+* pass-through-capable slot fits the budget, the picker resolves the target
+* resolution among those and we copy. Otherwise the picker resolves among ALL
+* entries — so the transcode decodes the slot closest to the negotiated
+* resolution rather than the largest one on the camera — and we re-encode.
+*
+* A pinned `streamPreference` is never overridden by the budget: the pinned
+* slot is transcoded rather than swapped for a cheaper one.
+*
+* Returns `null` when nothing is publishable at all.
+*/
+function selectStreamForBudget(input) {
+	const budgetKbps = budgetForNegotiatedRate(input.negotiatedMaxBitrateKbps);
+	const notes = fitNotes(input.entries, input.bitrates, budgetKbps);
+	const fallback = pickPreferredRtspEntry(input.entries, input.pref, input.deviceId, { targetResolution: input.targetResolution });
+	if (fallback === null) return null;
+	const fallbackProfile = toCamProfile$1(fallback.profileId);
+	if (budgetKbps === null) {
+		const base = {
+			picked: fallback,
+			profile: fallbackProfile,
+			budgetKbps: null,
+			notes
+		};
+		return canPassThrough(fallback.codec) ? {
+			kind: "copy",
+			reason: "no-negotiated-budget",
+			...base
+		} : {
+			kind: "transcode",
+			reason: "source-codec",
+			...base
+		};
+	}
+	const affordable = (input.pref !== "auto" && fallbackProfile === input.pref ? input.entries.filter((entry) => entry.profile === fallbackProfile) : input.entries).filter((entry) => {
+		if (!canPassThrough(entry.codec)) return false;
+		return classifyBitrateFit(input.bitrates.get(entry.profile), budgetKbps) === "fits";
+	});
+	if (affordable.length > 0) {
+		const picked = pickPreferredRtspEntry(affordable, input.pref, input.deviceId, { targetResolution: input.targetResolution });
+		if (picked !== null) return {
+			kind: "copy",
+			reason: "source-fits-budget",
+			picked,
+			profile: toCamProfile$1(picked.profileId),
+			budgetKbps,
+			notes
+		};
+	}
+	if (canPassThrough(fallback.codec)) return {
+		kind: "copy",
+		reason: "over-budget-tolerated",
+		picked: fallback,
+		profile: fallbackProfile,
+		budgetKbps,
+		notes
+	};
+	return {
+		kind: "transcode",
+		reason: transcodeReason(fallback, fallbackProfile, input.bitrates, budgetKbps),
+		picked: fallback,
+		profile: fallbackProfile,
+		budgetKbps,
+		notes
+	};
+}
+/**
+* Fill in a codec the profile restream entry did not carry, from its broker
+* slot. `getProfileRtspEntries` has historically omitted it for legacy
+* entries, and a slot whose codec is unknown must not be mistaken for H.264.
+*/
+function withSlotCodecs(entries, slots) {
+	const codecByProfile = /* @__PURE__ */ new Map();
+	for (const slot of slots) if (slot.codec !== void 0) codecByProfile.set(slot.profile, slot.codec);
+	return entries.map((entry) => {
+		if (entry.codec !== void 0) return entry;
+		const codec = codecByProfile.get(entry.profile);
+		return codec === void 0 ? entry : {
+			...entry,
+			codec
+		};
+	});
+}
+/**
+* The rate we will actually deliver: never more than the controller asked for,
+* and never more than the source produces. `-r` above the source rate makes
+* ffmpeg DUPLICATE frames, which spends the budget on nothing.
+*/
+function deliverableFps(negotiatedFps, slotFps) {
+	if (slotFps === null || !Number.isFinite(slotFps) || slotFps <= 0) return negotiatedFps;
+	return Math.min(negotiatedFps, Math.floor(slotFps));
+}
+/**
+* The ffmpeg video-output arguments.
+*
+* Pass-through carries `-bsf:v dump_extra` so every IDR inlines its own
+* SPS/PPS — sources that publish parameter sets only in the RTSP SDP hand iOS
+* a keyframe it cannot decode otherwise.
+*
+* The transcode's cap is three flags, not one: `-b:v` is an average and on its
+* own permits exactly the burst that was measured. `-maxrate` plus a
+* **one-second** `-bufsize` bounds any one-second window at the negotiated
+* rate, which is also the only lever available on the 3.03 s peak jitter — the
+* VBV window is what forces x264 to size a key frame to fit rather than
+* emitting it as one tight burst.
+*/
+/**
+* Seconds between forced IDRs on the transcode path.
+*
+* A join can only start decoding at a key frame, so this is the worst-case
+* wait a controller pays before the first picture — and the bound the RTSP
+* join-burst withhold falls back on when it declines to replay a wide GOP.
+*/
+var KEYFRAME_INTERVAL_SEC = 4;
+function buildVideoEncodeArgs(input) {
+	if (!input.transcode) return [
+		"-c:v",
+		"copy",
+		"-bsf:v",
+		"dump_extra"
+	];
+	const rate = input.budgetKbps === null ? [] : [
+		"-b:v",
+		`${input.budgetKbps}k`,
+		"-maxrate",
+		`${input.budgetKbps}k`,
+		"-bufsize",
+		`${input.budgetKbps}k`
+	];
+	return [
+		"-c:v",
+		"libx264",
+		"-preset",
+		"ultrafast",
+		"-tune",
+		"zerolatency",
+		"-pix_fmt",
+		"yuv420p",
+		"-r",
+		String(input.fps),
+		"-s",
+		`${input.width}x${input.height}`,
+		"-g",
+		String(Math.max(1, Math.round(input.fps * KEYFRAME_INTERVAL_SEC))),
+		...rate,
+		"-profile:v",
+		"baseline",
+		"-level",
+		"3.1",
+		"-bsf:v",
+		"dump_extra"
+	];
+}
+/** Compact `mid=2048pub/9meas:over-budget` rendering for a single log field. */
+function formatFitNotes(notes) {
+	return notes.map((n) => `${n.profile}=${n.publishedKbps ?? "?"}pub/${n.measuredKbps ?? "?"}meas:${n.verdict}`);
+}
+function fitNotes(entries, bitrates, budgetKbps) {
+	return entries.map((entry) => {
+		const evidence = bitrates.get(entry.profile);
+		return {
+			profile: entry.profile,
+			verdict: budgetKbps === null ? "unknown" : classifyBitrateFit(evidence, budgetKbps),
+			publishedKbps: evidence?.publishedKbps ?? null,
+			measuredKbps: evidence?.measuredKbps ?? null
+		};
+	});
+}
+function transcodeReason(picked, profile, bitrates, budgetKbps) {
+	if (!canPassThrough(picked.codec)) return "source-codec";
+	if (profile === null) return "unknown-bitrate";
+	return classifyBitrateFit(bitrates.get(profile), budgetKbps) === "over-budget" ? "over-budget" : "unknown-bitrate";
+}
+/**
+* iOS Home renders only H.264 over the classic HAP SRTP path, so an H.265
+* source can never be passed through. An UNKNOWN codec is treated the same
+* way: guessing H.264 is how a camera that changed its encoder ends up
+* shipping bytes no controller can decode.
+*/
+function canPassThrough(codec) {
+	if (codec === void 0) return false;
+	const lower = codec.toLowerCase();
+	if (lower.includes("h265") || lower.includes("hevc")) return false;
+	return lower.includes("h264") || lower.includes("avc");
+}
+function plausibleMeasured(value) {
+	if (value === null || !Number.isFinite(value)) return null;
+	return value >= 64 ? value : null;
+}
+/**
+* Map a profile slot onto the camera encoder feeding it, and read that
+* encoder's configured bitrate.
+*
+* The link is the slot's assigned cam-stream: its resolution (and frame rate,
+* when two encoders share a resolution) identifies which of `main`/`sub`/`ext`
+* produces it. Vendor-neutral on purpose — the cam-stream ids (`native:main`,
+* `native:slot-3`, …) are provider strings and matching on them would work for
+* exactly one provider. An ambiguous match returns `null`.
+*/
+function publishedRateFor(slot, source, streamParams) {
+	if (streamParams === null) return null;
+	const resolution = source?.resolution ?? slot.resolution;
+	if (resolution === void 0) return null;
+	const byResolution = ENCODER_PROFILE_KEYS.map((key) => encoderConfig(streamParams, key)).filter((cfg) => cfg !== null && cfg.width === resolution.width && cfg.height === resolution.height);
+	if (byResolution.length === 1) return positiveOrNull(byResolution[0]?.bitrate);
+	const fps = source?.fps;
+	if (fps === void 0) return null;
+	const byFps = byResolution.filter((cfg) => cfg !== null && Math.floor(cfg.framerate) === Math.floor(fps));
+	return byFps.length === 1 ? positiveOrNull(byFps[0]?.bitrate) : null;
+}
+function encoderConfig(status, key) {
+	return status[key] ?? null;
+}
+function positiveOrNull(value) {
+	if (value === void 0 || !Number.isFinite(value) || value <= 0) return null;
+	return value;
+}
+var CAM_PROFILES$1 = [
+	"high",
+	"mid",
+	"low"
+];
+/**
+* `PickedStream.profileId` is the brokerId suffix, which for a profile-keyed
+* entry IS the profile name. Anything else addresses a raw cam-stream and must
+* not be coerced into a profile.
+*/
+function toCamProfile$1(profileId) {
+	return CAM_PROFILES$1.find((p) => p === profileId) ?? null;
+}
+//#endregion
+//#region src/mappers/builders/stream-bitrate-probe.ts
+/**
+* Resolve every profile slot's rate. Never throws: an unresolvable slot ends
+* up `unknown`, which the selector treats as "cannot prove it fits" and
+* therefore transcodes — the safe direction on the wire.
+*/
+async function probeProfileBitrates(input) {
+	const { proxy } = input.bctx;
+	const camStreams = await probe$1(() => proxy.cameraStreams?.getCameraStreams({}), "cameraStreams.getCameraStreams", input.log);
+	const streamParams = await probe$1(() => proxy.streamParams?.getStatus({}), "streamParams.getStatus", input.log);
+	const choices = await probe$1(() => proxy.webrtcSession?.listStreams({}), "webrtcSession.listStreams", input.log);
+	return resolveProfileBitrates({
+		slots: input.slots,
+		camStreams: camStreams ?? [],
+		streamParams,
+		choices: choices ?? []
+	});
+}
+async function probe$1(call, label, log) {
+	try {
+		const pending = call();
+		if (pending === void 0) {
+			log.info("export-hap: bitrate probe skipped — cap not bound on this device", { meta: { call: label } });
+			return null;
+		}
+		return await pending;
+	} catch (err) {
+		log.warn("export-hap: bitrate probe failed — the slot rate stays UNKNOWN", { meta: {
+			call: label,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+		return null;
+	}
+}
+/**
+* Two outputs from one input: video SRTP and audio SRTP, one process, one
+* lifetime, one kill signal. ffmpeg-internal stream selection (`-vn` / `-an`
+* plus per-output codec args) keeps both flowing through it.
+*/
+function buildSessionFfmpegArgs(input) {
+	return [
+		"-hide_banner",
+		"-loglevel",
+		"warning",
+		...input.decodeArgs,
+		"-rtsp_transport",
+		"tcp",
+		"-i",
+		input.rtspUrl,
+		"-an",
+		"-map",
+		"0:v:0",
+		...input.videoArgs,
+		"-payload_type",
+		String(input.videoPayloadType),
+		"-ssrc",
+		String(input.videoSsrcSigned),
+		"-f",
+		"rtp",
+		input.videoTarget,
+		"-vn",
+		"-map",
+		"0:a:0?",
+		"-af",
+		"aresample=async=1000:first_pts=0",
+		"-c:a",
+		"libopus",
+		"-application",
+		"lowdelay",
+		"-frame_duration",
+		String(input.audioPacketTimeMs),
+		"-flags",
+		"+global_header",
+		"-ar",
+		String(input.audioSampleRateKhz * 1e3),
+		"-b:a",
+		`24k`,
+		"-bufsize",
+		`96k`,
+		"-ac",
+		String(1),
+		"-payload_type",
+		String(input.audioPayloadType),
+		"-ssrc",
+		String(input.audioSsrcSigned),
+		"-f",
+		"rtp",
+		input.audioTarget
+	];
+}
+/**
+* The resolutions we offer, before rates are attached. Same list the delegate
+* advertised before R2 — only the frame rate changes, so a controller that had
+* already negotiated a resolution keeps finding it.
+*/
+var CANDIDATE_RESOLUTIONS = [
+	[1920, 1080],
+	[1280, 720],
+	[1024, 768],
+	[640, 480],
+	[640, 360],
+	[480, 360],
+	[480, 270],
+	[320, 240],
+	[320, 180]
+];
+/**
+* Resolve the real frame rate of each profile slot.
+*
+* A slot with no measurement, no publication and no assignment simply does not
+* appear in the map — the caller then advertises {@link ASSUMED_FPS} and says
+* so. Absence is never silently rendered as a number.
+*/
+function resolveProfileFps(input) {
+	const publishedByProfile = publishedFpsByProfile(input.slots, input.camStreams);
+	const out = /* @__PURE__ */ new Map();
+	for (const choice of input.choices) {
+		if (choice.target.kind !== "profile") continue;
+		const profile = choice.target.profile;
+		const measured = clampFps(choice.inputFps);
+		if (measured !== null) {
+			out.set(profile, {
+				profile,
+				fps: measured,
+				source: "measured"
+			});
+			continue;
+		}
+		const published = clampFps(publishedByProfile.get(profile) ?? null);
+		out.set(profile, published !== null ? {
+			profile,
+			fps: published,
+			source: "published"
+		} : {
+			profile,
+			fps: 30,
+			source: "assumed"
+		});
+	}
+	for (const [profile, fps] of publishedByProfile) {
+		if (out.has(profile)) continue;
+		const published = clampFps(fps);
+		if (published !== null) out.set(profile, {
+			profile,
+			fps: published,
+			source: "published"
+		});
+	}
+	return out;
+}
+/**
+* Attach a frame rate to each candidate resolution by asking the REAL picker
+* which slot the START path would dial for it. That coupling is the point: if
+* the picker's steering changes, the advertisement changes with it instead of
+* drifting into a second, silently different opinion.
+*/
+function deriveAdvertisedResolutions(input) {
+	const candidates = input.candidates.length > 0 ? input.candidates : CANDIDATE_RESOLUTIONS;
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const [width, height] of candidates) {
+		const picked = pickPreferredRtspEntry(input.entries, input.pref, input.deviceId, { targetResolution: {
+			width,
+			height
+		} });
+		const profile = picked === null ? null : toCamProfile(picked.profileId);
+		const resolved = profile === null ? void 0 : input.fpsByProfile.get(profile);
+		const advertised = {
+			width,
+			height,
+			fps: resolved?.fps ?? 30,
+			profile,
+			source: resolved?.source ?? "assumed"
+		};
+		const key = `${advertised.width}x${advertised.height}@${advertised.fps}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(advertised);
+	}
+	return out;
+}
+/** Project onto the `[width, height, fps]` triples hap-nodejs expects. */
+function toHapResolutions(advertised) {
+	return advertised.map((a) => [
+		a.width,
+		a.height,
+		a.fps
+	]);
+}
+/** Compact `1280x720@10(measured)` rendering for a single log field. */
+function formatAdvertisedResolutions(advertised) {
+	return advertised.map((a) => `${a.width}x${a.height}@${a.fps}/${a.profile ?? "-"}(${a.source})`);
+}
+function publishedFpsByProfile(slots, camStreams) {
+	const fpsByCamStream = /* @__PURE__ */ new Map();
+	for (const stream of camStreams) if (typeof stream.fps === "number") fpsByCamStream.set(stream.camStreamId, stream.fps);
+	const out = /* @__PURE__ */ new Map();
+	for (const slot of slots) {
+		if (slot.sourceCamStreamId === null) continue;
+		const fps = fpsByCamStream.get(slot.sourceCamStreamId);
+		if (fps !== void 0) out.set(slot.profile, fps);
+	}
+	return out;
+}
+/**
+* Coerce a probe reading into an advertisable integer rate, or null when the
+* reading carries no information (absent, zero because the broker is idle,
+* negative, NaN, or below the representable floor).
+*/
+function clampFps(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return null;
+	const floored = Math.floor(value);
+	if (floored < 1) return null;
+	return Math.min(floored, 30);
+}
+var CAM_PROFILES = [
+	"high",
+	"mid",
+	"low"
+];
+/**
+* `PickedStream.profileId` is the brokerId suffix, which for a profile-keyed
+* entry IS the profile name. Anything else (a raw cam-stream id) is not a
+* profile and must not be coerced into one.
+*/
+function toCamProfile(profileId) {
+	return CAM_PROFILES.find((p) => p === profileId) ?? null;
+}
+/**
+* How long after spawn an exit still counts as "hardware init failed".
+*
+* Same window the ffmpeg decoder addon uses for its own cascade. A hardware
+* context that cannot be created fails within milliseconds; anything that ran
+* longer produced no frames for a different reason, and re-spawning it in
+* software would just hide that reason.
+*/
+var HW_DECODE_FALLBACK_WINDOW_MS = 4e3;
+/** Backends whose decode binds to a DRM render node. */
+var RENDER_NODE_BACKENDS = ["vaapi", "qsv"];
+/**
+* Values of the decoder cap's `hwaccel` field that are operator CHOICES rather
+* than devices.
+*/
+var HWACCEL_NON_BACKEND_CHOICES = ["auto", "none"];
+/**
+* Every backend the decoder cap can publish, taken from the cap's own UI option
+* list so this module cannot drift from it. A hand-written copy of the union is
+* exactly the "hand-written cap interface that rots silently" this repo has
+* been bitten by.
+*/
+var HWACCEL_BACKENDS = new Set(HWACCEL_OPTIONS.map((option) => option.value).filter((value) => !HWACCEL_NON_BACKEND_CHOICES.includes(value)));
+/** Is this string a hardware backend, as opposed to `auto`, `none` or junk? */
+function isHwAccelBackend(value) {
+	return HWACCEL_BACKENDS.has(value);
+}
+/**
+* Decide how this session decodes, and produce the ffmpeg input-side flags.
+*
+* Every path that ends in software carries a named reason, because a session
+* that quietly stopped using the GPU and a session that never had one look
+* identical in a CPU graph.
+*/
+function selectHwDecode(input) {
+	if (!input.transcode) return software("pass-through");
+	if (input.hardwareAlreadyFailed === true) return software("hardware-attempt-failed");
+	if (input.reading === null) return software("no-decoder-reading");
+	const chosen = (input.reading.hwaccel ?? "").trim();
+	if (chosen === "none") return software("operator-disabled");
+	if (chosen !== "" && chosen !== "auto") return isHwAccelBackend(chosen) ? hardware(chosen, "operator", input) : software("unrecognised-backend");
+	const probed = (input.reading.probedBestHwaccel ?? "").trim();
+	if (probed === "" || probed === "none") return software("not-probed");
+	return isHwAccelBackend(probed) ? hardware(probed, "probed", input) : software("unrecognised-backend");
+}
+/**
+* Did this ffmpeg exit look like a failed hardware init, rather than a
+* teardown or a fault software would hit too?
+*
+* All five conditions are necessary. Dropping the controller-stop check in
+* particular would respawn on every normal teardown, because iOS restarts a
+* session it is not enjoying and that is indistinguishable at the exit code.
+*/
+function shouldRetryInSoftware(input) {
+	if (!input.usedHardware) return false;
+	if (input.hardwareAlreadyFailed) return false;
+	if (input.stopRequestedByController) return false;
+	if (input.videoPacketsForwarded > 0) return false;
+	return input.runtimeMs <= HW_DECODE_FALLBACK_WINDOW_MS;
+}
+function software(reason) {
+	return {
+		kind: "software",
+		reason,
+		args: []
+	};
+}
+function hardware(backend, source, input) {
+	return {
+		kind: "hardware",
+		backend,
+		source,
+		args: decodeArgs(backend, input)
+	};
+}
+/**
+* The input-side flags, and nothing else.
+*
+* No `-hwaccel_output_format`: the decoded frames have to land in system
+* memory for libx264 to scale and encode them. Setting it would keep them on
+* the GPU, which only pays off with a GPU scale filter — and that is the
+* decoder addon's job, not a two-output SRTP session's.
+*/
+function decodeArgs(backend, input) {
+	if (backend === "videotoolbox" && input.platform === "darwin") return ["-hwaccel", "auto"];
+	const args = ["-hwaccel", backend];
+	if (RENDER_NODE_BACKENDS.includes(backend)) args.push("-hwaccel_device", input.renderDevice ?? "/dev/dri/renderD128");
+	return args;
+}
+//#endregion
+//#region src/mappers/builders/stream-hwaccel-probe.ts
+/**
+* Read this node's decode-hwaccel state, or `null` when nothing answered.
+*
+* Never throws. `null` means "we do not know", which
+* {@link import('./stream-hwaccel.js').selectHwDecode} turns into software —
+* the safe direction, because a guess here costs the whole stream.
+*/
+async function probeDecoderHwaccel(input) {
+	const { ctx, log } = input;
+	const nodeId = ctx.kernel?.localNodeId;
+	if (nodeId === void 0 || nodeId.length === 0) {
+		log.warn("export-hap: hwaccel probe skipped — no local node id, decoding in SOFTWARE");
+		return null;
+	}
+	try {
+		const info = await ctx.api.decoder.getInfo.query(void 0, nodePin(nodeId));
+		if (info === null || info === void 0) {
+			log.info("export-hap: hwaccel probe returned nothing — decoding in SOFTWARE", { meta: { nodeId } });
+			return null;
+		}
+		return {
+			hwaccel: info.hwaccel ?? null,
+			probedBestHwaccel: info.probedBestHwaccel ?? null
+		};
+	} catch (err) {
+		log.warn("export-hap: hwaccel probe failed — decoding in SOFTWARE", { meta: {
+			nodeId,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+		return null;
+	}
+}
+//#endregion
+//#region src/mappers/builders/stream-telemetry.ts
+/**
+* Every branch on the streaming path that discards work, and its starting
+* count. This object is the single source of the reason set: the union below
+* is its `keyof`, so adding a silent `return` without adding a reason here is
+* a compile error rather than an invisible hole.
+*/
+var ZERO_DROP_COUNTERS = {
+	/** Outbound: the leg has no SRTP session (prepareStream init failed). */
+	"no-srtp-session": 0,
+	/** Outbound: the leg has no return-path gate — forwarding was never armed. */
+	"no-gate": 0,
+	/** Outbound: werift refused to encrypt the packet. */
+	"srtp-encrypt-failed": 0,
+	/** Outbound: the UDP send itself errored. */
+	"srtp-send-failed": 0,
+	/** Outbound RTCP: the leg has no SRTCP context, so no Sender Report can go out. */
+	"rtcp-no-srtcp": 0,
+	/** Outbound RTCP: building or encrypting the Sender Report failed. */
+	"rtcp-encrypt-failed": 0,
+	/** Inbound RTCP: the leg has no SRTCP context, so the controller's report is unreadable. */
+	"inbound-rtcp-no-srtcp": 0,
+	/** Inbound RTCP: SRTCP decryption of a controller packet failed. */
+	"inbound-rtcp-decrypt-failed": 0,
+	/** Inbound RTCP: the decrypted bytes did not parse as RTCP. */
+	"inbound-rtcp-parse-failed": 0,
+	/** Upstream: packet shorter than an RTP header. */
+	"upstream-short-packet": 0,
+	/** Upstream: no inbound SRTP context (init failed at prepareStream). */
+	"upstream-no-srtp": 0,
+	/** Upstream: SRTP authentication/decrypt failed. */
+	"upstream-decrypt-failed": 0,
+	/** Upstream: decrypted bytes did not parse as RTP. */
+	"upstream-parse-failed": 0,
+	/** Upstream: audio arrived before `handleStreamRequest('start')` settled. */
+	"upstream-before-start": 0,
+	/** Upstream: payload type is not the negotiated audio PT (RTCP / keepalive). */
+	"upstream-pt-mismatch": 0,
+	/** Upstream: RTP carried a zero-length payload. */
+	"upstream-empty-payload": 0,
+	/** Upstream: no camera-side talk session, so the frame has nowhere to go. */
+	"upstream-no-talk-session": 0,
+	/** Upstream: the camera-side `pushTalkAudio` rejected the frame. */
+	"upstream-push-failed": 0,
+	/** Snapshot: the `snapshot` cap returned nothing. */
+	"snapshot-unavailable": 0
+};
+function emptyDropCounters() {
+	return { ...ZERO_DROP_COUNTERS };
+}
+/** Immutable increment — returns a new record, never touches the input. */
+function recordDrop(counters, reason) {
+	return {
+		...counters,
+		[reason]: counters[reason] + 1
+	};
+}
+/** Only the reasons that actually fired, so a clean session logs `{}`. */
+function nonZeroDrops(counters) {
+	const out = {};
+	for (const [reason, count] of Object.entries(counters)) if (count > 0) out[reason] = count;
+	return out;
+}
+/**
+* Classify a packet received on one of our advertised return ports.
+*
+* RTP and RTCP arrive on the same symmetric port here. RTCP packet types are
+* 200..207, which sit inside the 192..223 band RFC 5761 §4 reserves precisely
+* so the two can be told apart on a shared socket (an RTP packet's marker bit
+* plus payload type can never land there for any payload type we negotiate).
+* The payloads are SRTP/SRTCP-encrypted, but both keep the first two bytes in
+* the clear.
+*/
+function classifyInboundPacket(packet) {
+	if (packet.length < 2) return "malformed";
+	if ((packet[0] >> 6 & 3) !== 2) return "malformed";
+	const typeByte = packet[1];
+	if (typeByte >= 192 && typeByte <= 223) return "rtcp";
+	return "rtp";
+}
+/**
+* Loss at or above this is not a start-up transient.
+*
+* A stream whose first key frame is slow reliably produces one report in the
+* low single digits; a transmit-side defect produces tens of percent, because
+* whatever makes a packet unusable makes most packets unusable. The threshold
+* sits between those two regimes rather than at any measured boundary — it is
+* a reading aid, and the raw `worstFractionLostPct` is always in the line
+* beside it.
+*/
+var TRANSMIT_SUSPECT_FRACTION_LOST_PCT = 5;
+function lossVerdict(tally) {
+	if (tally.blocksParsed === 0 || tally.worstFractionLostPct === null) return "no-reports";
+	return tally.worstFractionLostPct >= TRANSMIT_SUSPECT_FRACTION_LOST_PCT ? "transmit-suspect" : "decode-suspect";
+}
+/**
+* Build the meta for `export-hap: stream session summary` — the single line a
+* future session greps to answer "why did this session die".
+*/
+function summariseSession(snapshot) {
+	const durationMs = snapshot.startedAtMs !== null && snapshot.endedAtMs !== null ? snapshot.endedAtMs - snapshot.startedAtMs : null;
+	const negotiated = snapshot.negotiated;
+	const slot = snapshot.selectedSlot;
+	return {
+		sessionId: snapshot.sessionId,
+		durationMs,
+		stopRequestedByController: snapshot.stopRequestedByController,
+		ffmpegExitCode: snapshot.ffmpegExit?.code ?? null,
+		ffmpegExitSignal: snapshot.ffmpegExit?.signal ?? null,
+		negotiatedResolution: negotiated ? `${negotiated.width}x${negotiated.height}` : null,
+		negotiatedFps: negotiated?.fps ?? null,
+		negotiatedMaxBitrateKbps: negotiated?.maxBitrateKbps ?? null,
+		selectedProfile: slot?.profile ?? null,
+		selectedBrokerId: slot?.brokerId ?? null,
+		advertisedFps: slot?.advertisedFps ?? null,
+		advertisedFpsSource: slot?.advertisedFpsSource ?? null,
+		deliveredFps: slot?.deliveredFps ?? null,
+		transcode: slot?.transcode ?? null,
+		fitReason: slot?.fitReason ?? null,
+		slotPublishedKbps: slot?.publishedKbps ?? null,
+		slotMeasuredKbps: slot?.measuredKbps ?? null,
+		encodeBudgetKbps: slot?.budgetKbps ?? null,
+		fitNotes: slot?.fitNotes ?? [],
+		videoPacketsForwarded: snapshot.videoPacketsForwarded,
+		audioPacketsForwarded: snapshot.audioPacketsForwarded,
+		videoRtcpSrSent: snapshot.videoRtcpSrSent,
+		audioRtcpSrSent: snapshot.audioRtcpSrSent,
+		videoRtcpReceived: snapshot.videoRtcpReceived,
+		audioRtcpReceived: snapshot.audioRtcpReceived,
+		videoRtpReceived: snapshot.videoRtpReceived,
+		audioRtpReceived: snapshot.audioRtpReceived,
+		videoGate: formatRtcpGate(snapshot.videoGate),
+		audioGate: formatRtcpGate(snapshot.audioGate),
+		videoReceiverReports: snapshot.videoReceiverReports,
+		audioReceiverReports: snapshot.audioReceiverReports,
+		videoLossVerdict: lossVerdict(snapshot.videoReceiverReports),
+		audioLossVerdict: lossVerdict(snapshot.audioReceiverReports),
+		mediaStarved: snapshot.videoPacketsForwarded === 0,
+		drops: nonZeroDrops(snapshot.drops)
+	};
+}
+//#endregion
+//#region src/mappers/builders/camera-streams.ts
 var SRTP_KEY_LEN = 16;
 var SRTP_SALT_LEN = 14;
-var OPUS_BITRATE_KBPS = 24;
-var OPUS_CHANNELS = 1;
-function buildCameraStreamingDelegate(bctx) {
+/**
+* Cadence of the per-session heartbeat log.
+*
+* This timer LOGS ONLY. It never kills ffmpeg, never closes a socket and never
+* ends a session. That distinction matters: the two mainstream open-source
+* HomeKit camera stacks arm an idle watchdog that tears the stream down at
+* exactly 30 000 ms, and the ~31 s teardown here was misdiagnosed as one for a
+* long time before it was proven that this accessory has no such timer. Do not
+* make this one act.
+*/
+var SESSION_HEARTBEAT_MS = 5e3;
+/**
+* Floor between two `export-hap: controller receiver report` lines on one leg.
+*
+* The controller sends several Receiver Reports a second — 21 and 34 in two
+* ~10 s sessions on 2026-08-06 — and every one of them at `info` would drown
+* the very line it is meant to make findable. The FIRST report on each leg is
+* always logged, in full and under its own message; after that this throttles
+* to the heartbeat's cadence so a session still produces a running record of
+* what the controller thinks without becoming one.
+*/
+var RECEIVER_REPORT_LOG_INTERVAL_MS = 5e3;
+function buildCameraStreamingDelegate(bctx, advertised) {
 	const { ctx, numericDeviceId } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const sessions = /* @__PURE__ */ new Map();
@@ -38175,7 +40008,7 @@ function buildCameraStreamingDelegate(bctx) {
 				});
 			},
 			handleStreamRequest(request, callback) {
-				handleStreamRequest(request, sessions, bctx).then(() => callback()).catch((err) => {
+				handleStreamRequest(request, sessions, bctx, advertised).then(() => callback()).catch((err) => {
 					log.warn("export-hap: handleStreamRequest failed", { meta: { error: errMsg$8(err) } });
 					callback(err instanceof Error ? err : new Error(errMsg$8(err)));
 				});
@@ -38196,58 +40029,7 @@ function buildCameraStreamingDelegate(bctx) {
 						H264Level.LEVEL4_0
 					]
 				},
-				resolutions: [
-					[
-						1920,
-						1080,
-						30
-					],
-					[
-						1280,
-						720,
-						30
-					],
-					[
-						1024,
-						768,
-						30
-					],
-					[
-						640,
-						480,
-						30
-					],
-					[
-						640,
-						360,
-						30
-					],
-					[
-						480,
-						360,
-						30
-					],
-					[
-						480,
-						270,
-						30
-					],
-					[
-						320,
-						240,
-						30
-					],
-					[
-						320,
-						240,
-						15
-					],
-					[
-						320,
-						180,
-						30
-					]
-				]
+				resolutions: toHapResolutions(advertised.resolutions)
 			},
 			audio: {
 				codecs: [{
@@ -38262,10 +40044,16 @@ function buildCameraStreamingDelegate(bctx) {
 		},
 		dispose: async () => {
 			for (const session of sessions.values()) {
+				session.teardownTrigger = "accessory-dispose";
+				const hadFfmpeg = session.ffmpeg !== null;
 				killFfmpeg(session, ctx, numericDeviceId);
+				stopHeartbeat(session);
+				if (!hadFfmpeg) logSessionSummary(session, log, "accessory-dispose-no-ffmpeg");
 				await closeIntercomTalkSession(session, bctx).catch(() => void 0);
 				closeSocket(session.videoUdp);
 				closeSocket(session.audioUdp);
+				closeSocket(session.videoLoopUdp);
+				closeSocket(session.audioLoopUdp);
 			}
 			sessions.clear();
 		}
@@ -38275,7 +40063,10 @@ async function handleSnapshot(bctx, request) {
 	const { proxy, ctx, numericDeviceId } = bctx;
 	const result = await proxy.snapshot?.getSnapshot({});
 	if (!result || typeof result.base64 !== "string") {
-		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: snapshot returned null");
+		ctx.logger.withTags({ deviceId: numericDeviceId }).info("export-hap: snapshot dropped", { meta: {
+			reason: "snapshot-unavailable",
+			capBound: proxy.snapshot !== void 0
+		} });
 		throw new Error("snapshot unavailable");
 	}
 	return Buffer.from(result.base64, "base64");
@@ -38305,7 +40096,7 @@ async function prepareStream(request, sessions, bctx) {
 		},
 		profile: import_src.ProtectionProfileAes128CmHmacSha1_80
 	});
-	const makeOutSrtcp = (key, salt) => new import_src.SrtcpSession({
+	const makeSrtcp = (key, salt) => new import_src.SrtcpSession({
 		keys: {
 			localMasterKey: key,
 			localMasterSalt: salt,
@@ -38316,13 +40107,17 @@ async function prepareStream(request, sessions, bctx) {
 	});
 	let videoOutSrtp;
 	let videoOutSrtcp;
+	let videoInSrtcp;
 	let audioOutSrtp;
 	let audioOutSrtcp;
+	let audioInSrtcp;
 	try {
 		videoOutSrtp = makeOutSrtp(request.video.srtp_key, request.video.srtp_salt);
-		videoOutSrtcp = makeOutSrtcp(request.video.srtp_key, request.video.srtp_salt);
+		videoOutSrtcp = makeSrtcp(request.video.srtp_key, request.video.srtp_salt);
+		videoInSrtcp = makeSrtcp(request.video.srtp_key, request.video.srtp_salt);
 		audioOutSrtp = makeOutSrtp(request.audio.srtp_key, request.audio.srtp_salt);
-		audioOutSrtcp = makeOutSrtcp(request.audio.srtp_key, request.audio.srtp_salt);
+		audioOutSrtcp = makeSrtcp(request.audio.srtp_key, request.audio.srtp_salt);
+		audioInSrtcp = makeSrtcp(request.audio.srtp_key, request.audio.srtp_salt);
 	} catch (err) {
 		closeSocket(videoUdp);
 		closeSocket(audioUdp);
@@ -38347,6 +40142,30 @@ async function prepareStream(request, sessions, bctx) {
 	const videoSsrc = randomSsrc();
 	const audioSsrc = randomSsrc();
 	const session = {
+		sessionId: request.sessionID,
+		startedAtMs: null,
+		endedAtMs: null,
+		negotiated: null,
+		selectedSlot: null,
+		ffmpegExit: null,
+		stopRequestedByController: false,
+		teardownTrigger: null,
+		drops: emptyDropCounters(),
+		videoPacketsForwarded: 0,
+		audioPacketsForwarded: 0,
+		videoRtcpSrSent: 0,
+		audioRtcpSrSent: 0,
+		videoRtcpReceived: 0,
+		audioRtcpReceived: 0,
+		videoRtpReceived: 0,
+		audioRtpReceived: 0,
+		videoReceiverReports: emptyReceiverReportTally(),
+		audioReceiverReports: emptyReceiverReportTally(),
+		videoRrLoggedAt: 0,
+		audioRrLoggedAt: 0,
+		videoGate: null,
+		audioGate: null,
+		heartbeat: null,
 		hapVideoPort: request.video.port,
 		hapAddress: request.targetAddress,
 		videoSrtpKey: request.video.srtp_key,
@@ -38355,6 +40174,7 @@ async function prepareStream(request, sessions, bctx) {
 		videoLoopUdp,
 		videoOutSrtp,
 		videoOutSrtcp,
+		videoInSrtcp,
 		videoOutPacketCount: 0,
 		videoOutOctetCount: 0,
 		videoOutLastRtpTimestamp: 0,
@@ -38369,6 +40189,7 @@ async function prepareStream(request, sessions, bctx) {
 		audioLoopUdp,
 		audioOutSrtp,
 		audioOutSrtcp,
+		audioInSrtcp,
 		audioSendGate: null,
 		ipVersion,
 		ffmpeg: null,
@@ -38391,19 +40212,33 @@ async function prepareStream(request, sessions, bctx) {
 		audioRtcpIntervalMs: 5e3
 	};
 	sessions.set(request.sessionID, session);
+	const tagLog = bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId });
 	session.videoSendGate = makeRtcpGate(videoUdp, 1e3);
 	session.audioSendGate = makeRtcpGate(audioUdp, 1e3);
-	const tagLog = bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId });
-	let videoPacketsForwarded = 0;
-	let audioPacketsForwarded = 0;
+	session.videoSendGate.then((resolution) => {
+		session.videoGate = resolution;
+		logGateResolved(session, "video", resolution, tagLog);
+	});
+	session.audioSendGate.then((resolution) => {
+		session.audioGate = resolution;
+		logGateResolved(session, "audio", resolution, tagLog);
+	});
+	videoUdp.on("message", (packet) => {
+		countInbound(session, "video", packet, tagLog);
+	});
+	audioUdp.on("message", (packet) => {
+		countInbound(session, "audio", packet, tagLog);
+	});
 	videoLoopUdp.on("message", (rtpPacket) => {
-		videoPacketsForwarded += 1;
-		if (videoPacketsForwarded === 1 || videoPacketsForwarded % 500 === 0) tagLog.info("export-hap: video loopback packets forwarded", { meta: { count: videoPacketsForwarded } });
+		session.videoPacketsForwarded += 1;
+		if (session.videoPacketsForwarded === 1) tagLog.info("export-hap: first video packet from ffmpeg", { meta: {
+			sessionId: session.sessionId,
+			bytes: rtpPacket.length
+		} });
 		forwardEncryptedRtp(session, rtpPacket, "video", tagLog);
 	});
 	audioLoopUdp.on("message", (rtpPacket) => {
-		audioPacketsForwarded += 1;
-		if (audioPacketsForwarded === 1 || audioPacketsForwarded % 100 === 0) tagLog.info("export-hap: audio loopback packets forwarded", { meta: { count: audioPacketsForwarded } });
+		session.audioPacketsForwarded += 1;
 		forwardEncryptedRtp(session, rtpPacket, "audio", tagLog);
 	});
 	audioUdp.on("message", (packet, rinfo) => {
@@ -38411,6 +40246,19 @@ async function prepareStream(request, sessions, bctx) {
 			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$8(err) } });
 		});
 	});
+	tagLog.info("export-hap: stream prepared", { meta: {
+		sessionId: request.sessionID,
+		controllerAddress: request.targetAddress,
+		addressVersion: ipVersion,
+		localIp,
+		advertisedVideoPort: localVideoPort,
+		advertisedAudioPort: localAudioPort,
+		controllerVideoPort: request.video.port,
+		controllerAudioPort: request.audio.port,
+		videoSsrc,
+		audioSsrc,
+		upstreamAudioDecrypt: upstreamAudioSrtp !== null
+	} });
 	return {
 		video: {
 			port: localVideoPort,
@@ -38485,30 +40333,225 @@ function sameIpv4Subnet(a, mask, b) {
 async function bindLoopback(ipVersion) {
 	return bindUdp(ipVersion, ipVersion === "ipv6" ? "::1" : "127.0.0.1");
 }
+/** Book a named drop. Every silent `return` on the streaming path routes here. */
+function drop(session, reason) {
+	session.drops = recordDrop(session.drops, reason);
+}
 /**
-* Build a promise that resolves as soon as ANY packet (RTP or RTCP)
-* arrives on `socket`, OR `timeoutMs` elapses. The loopback reader
-* awaits this before forwarding the first encrypted SRTP frame so
-* iOS sees a return-path handshake before our actual stream begins.
-*
-* One-shot: the listener is removed on the first message OR on
-* timeout — the gate then stays resolved for the rest of the session.
+* Report a gate resolution. `timeout` is the interesting one: it means we are
+* about to stream into a port the controller never touched, and it was
+* indistinguishable from a successful probe until now.
 */
-function makeRtcpGate(socket, timeoutMs) {
-	return new Promise((resolve) => {
-		const onMessage = () => {
-			socket.removeListener("message", onMessage);
-			clearTimeout(timer);
-			resolve();
-		};
-		const timer = setTimeout(() => {
-			socket.removeListener("message", onMessage);
-			resolve();
-		}, timeoutMs);
-		socket.on("message", onMessage);
+function logGateResolved(session, leg, resolution, log) {
+	const meta = {
+		sessionId: session.sessionId,
+		leg,
+		reason: resolution.reason,
+		waitedMs: resolution.waitedMs
+	};
+	if (resolution.reason === "packet") log.info("export-hap: RTCP gate opened on a REAL controller packet", { meta });
+	else log.warn("export-hap: RTCP gate opened on the 1s FALLBACK — controller never probed", { meta });
+}
+/** Count and classify one packet the controller sent to a return port. */
+function countInbound(session, leg, packet, log) {
+	const kind = classifyInboundPacket(packet);
+	const firstRtcp = kind === "rtcp" && (leg === "video" ? session.videoRtcpReceived : session.audioRtcpReceived) === 0;
+	if (leg === "video") {
+		if (kind === "rtcp") session.videoRtcpReceived += 1;
+		else if (kind === "rtp") session.videoRtpReceived += 1;
+	} else if (kind === "rtcp") session.audioRtcpReceived += 1;
+	else if (kind === "rtp") session.audioRtpReceived += 1;
+	if (firstRtcp) log.info("export-hap: first inbound RTCP from controller", { meta: {
+		sessionId: session.sessionId,
+		leg,
+		bytes: packet.length
+	} });
+	if (kind === "rtcp") readControllerRtcp(session, leg, packet, log);
+}
+/** Fold a decrypted RTCP datagram into the leg's tally. Immutable, per `ReceiverReportTally`. */
+function storeReceiverReports(session, leg, tally) {
+	if (leg === "video") session.videoReceiverReports = tally;
+	else session.audioReceiverReports = tally;
+}
+/**
+* Decrypt one inbound RTCP datagram and read the controller's Receiver Report.
+*
+* This is the datum the 2026-08-06 telemetry left missing. That round proved
+* iOS DOES send us RTCP on the video leg — 21 and 34 packets across two
+* sessions, the gate opening on a real controller packet at ~550 ms — which
+* killed the long-standing "iOS never probes us" belief. But counting packets
+* says only that the controller spoke; a Receiver Report says WHAT it said,
+* and that splits the remaining causes into two disjoint families that nothing
+* else in this system can tell apart. See `LossVerdict`.
+*
+* Runs on a UDP `message` handler, so nothing here may throw: a controller
+* that sends one deformed datagram must not take the session with it. Every
+* failure books a named drop and increments `unreadable`, because a report we
+* could not read and a report that never came must never look alike.
+*/
+function readControllerRtcp(session, leg, packet, log) {
+	const srtcp = leg === "video" ? session.videoInSrtcp : session.audioInSrtcp;
+	const tally = leg === "video" ? session.videoReceiverReports : session.audioReceiverReports;
+	if (!srtcp) {
+		drop(session, "inbound-rtcp-no-srtcp");
+		storeReceiverReports(session, leg, recordUnreadableRtcp(tally));
+		logUnreadableRtcp(session, leg, "no-srtcp-context", log);
+		return;
+	}
+	let plaintext;
+	try {
+		plaintext = srtcp.decrypt(packet);
+	} catch (err) {
+		drop(session, "inbound-rtcp-decrypt-failed");
+		storeReceiverReports(session, leg, recordUnreadableRtcp(tally));
+		logUnreadableRtcp(session, leg, `decrypt: ${errMsg$8(err)}`, log);
+		return;
+	}
+	const outcome = ingestDecryptedRtcp(plaintext, tally);
+	storeReceiverReports(session, leg, outcome.tally);
+	if (outcome.failure !== null) {
+		drop(session, "inbound-rtcp-parse-failed");
+		logUnreadableRtcp(session, leg, `parse: ${outcome.failure}`, log);
+		return;
+	}
+	const isFirst = tally.reportsParsed === 0 && outcome.tally.reportsParsed > 0;
+	logReceiverReports(session, leg, outcome.reports, isFirst, log);
+}
+/** Throttled per leg — a controller sending nothing but garbage must not become the log. */
+function logUnreadableRtcp(session, leg, reason, log) {
+	const tally = leg === "video" ? session.videoReceiverReports : session.audioReceiverReports;
+	if (!shouldLogReceiverReport(session, leg)) return;
+	log.warn("export-hap: inbound RTCP could not be read", { meta: {
+		sessionId: session.sessionId,
+		leg,
+		reason,
+		unreadable: tally.unreadable
+	} });
+}
+/**
+* True at most once per `RECEIVER_REPORT_LOG_INTERVAL_MS` per leg. Stamps the
+* leg on the way out so the caller cannot forget to.
+*/
+function shouldLogReceiverReport(session, leg) {
+	const now = Date.now();
+	if (now < (leg === "video" ? session.videoRrLoggedAt : session.audioRrLoggedAt) + RECEIVER_REPORT_LOG_INTERVAL_MS) return false;
+	if (leg === "video") session.videoRrLoggedAt = now;
+	else session.audioRrLoggedAt = now;
+	return true;
+}
+/**
+* Emit the controller's own numbers.
+*
+* The FIRST report on a leg gets its own message: that one arriving at all is
+* the proof iOS is engaged with the stream, and it was worth a year of
+* argument. Everything after it is throttled to the heartbeat's cadence.
+*/
+function logReceiverReports(session, leg, reports, isFirst, log) {
+	const tally = leg === "video" ? session.videoReceiverReports : session.audioReceiverReports;
+	const block = reports.flatMap((report) => report.blocks).at(-1);
+	if (!block) return;
+	const reporter = reports.find((report) => report.blocks.length > 0);
+	const meta = {
+		sessionId: session.sessionId,
+		leg,
+		reporterSsrc: reporter?.reporterSsrc ?? null,
+		aboutSsrc: block.aboutSsrc,
+		fractionLostPct: block.fractionLostPct,
+		cumulativePacketsLost: block.cumulativePacketsLost,
+		extendedHighestSequence: block.extendedHighestSequence,
+		jitter: block.jitter,
+		delaySinceLastSrMs: block.delaySinceLastSrMs,
+		reportsParsed: tally.reportsParsed,
+		worstFractionLostPct: tally.worstFractionLostPct
+	};
+	if (isFirst) {
+		shouldLogReceiverReport(session, leg);
+		log.info("export-hap: FIRST RTCP Receiver Report from controller — iOS is receiving and reporting", { meta });
+		return;
+	}
+	if (!shouldLogReceiverReport(session, leg)) return;
+	log.info("export-hap: controller receiver report", { meta });
+}
+/** Snapshot every counter into the summary meta. */
+function sessionSummaryMeta(session) {
+	return summariseSession({
+		sessionId: session.sessionId,
+		startedAtMs: session.startedAtMs,
+		endedAtMs: session.endedAtMs,
+		negotiated: session.negotiated,
+		selectedSlot: session.selectedSlot,
+		videoPacketsForwarded: session.videoPacketsForwarded,
+		audioPacketsForwarded: session.audioPacketsForwarded,
+		videoRtcpSrSent: session.videoRtcpSrSent,
+		audioRtcpSrSent: session.audioRtcpSrSent,
+		videoRtcpReceived: session.videoRtcpReceived,
+		audioRtcpReceived: session.audioRtcpReceived,
+		videoRtpReceived: session.videoRtpReceived,
+		audioRtpReceived: session.audioRtpReceived,
+		videoGate: session.videoGate,
+		audioGate: session.audioGate,
+		videoReceiverReports: session.videoReceiverReports,
+		audioReceiverReports: session.audioReceiverReports,
+		drops: session.drops,
+		ffmpegExit: session.ffmpegExit,
+		stopRequestedByController: session.stopRequestedByController
 	});
 }
 /**
+* Arm the per-session heartbeat. LOGS ONLY — see `SESSION_HEARTBEAT_MS`. It
+* exists so a session that stops producing media says so while it is still
+* alive, instead of being reconstructed after the fact from its final line.
+*/
+function armHeartbeat(session, log) {
+	if (session.heartbeat) clearInterval(session.heartbeat);
+	let lastVideo = session.videoPacketsForwarded;
+	const timer = setInterval(() => {
+		const forwarded = session.videoPacketsForwarded - lastVideo;
+		lastVideo = session.videoPacketsForwarded;
+		log.info("export-hap: stream heartbeat", { meta: {
+			...sessionSummaryMeta(session),
+			videoPacketsSinceLastBeat: forwarded,
+			videoStalled: forwarded === 0
+		} });
+	}, SESSION_HEARTBEAT_MS);
+	timer.unref();
+	session.heartbeat = timer;
+}
+function stopHeartbeat(session) {
+	if (!session.heartbeat) return;
+	clearInterval(session.heartbeat);
+	session.heartbeat = null;
+}
+/**
+* **`export-hap: stream session summary` is the line to grep** when asking why
+* a HomeKit session died. It carries the negotiated parameters, the slot we
+* dialled and the rate we had promised for it, packet counts in both
+* directions on both legs, each leg's gate outcome, ffmpeg's exit, who asked
+* for the teardown, every named drop — and, since 2026-08-06, what the
+* controller itself reported receiving.
+*
+* Read `videoLossVerdict` first. `transmit-suspect` says the controller is not
+* getting our packets intact and nothing past the wire matters;
+* `decode-suspect` says it got them and rendered nothing anyway;
+* `no-reports` says we still cannot tell, and `videoReceiverReports.unreadable`
+* then distinguishes "the controller said nothing" from "we could not read what
+* it said".
+*
+* Emitted from the ffmpeg `exit` handler — the only place the exit code is
+* known — and directly from the teardown paths when there is no ffmpeg to wait
+* for. It deliberately does NOT touch the heartbeat: iOS restarts a session
+* in place when it is not getting a picture (one on record was started three
+* times in 16 s), and stopping the heartbeat on the superseded process's exit
+* would silence the replacement.
+*/
+function logSessionSummary(session, log, trigger) {
+	session.endedAtMs = Date.now();
+	log.info("export-hap: stream session summary", { meta: {
+		...sessionSummaryMeta(session),
+		trigger
+	} });
+}
+/**
 * Build the NTP timestamp expected in an RTCP Sender Report.
 *
 * NTP timestamps are 64-bit: upper 32 bits = seconds since 1900-01-01,
@@ -38541,7 +40584,10 @@ function ntpTime() {
 */
 function sendRtcpSr(session, kind, log) {
 	const srtcp = kind === "video" ? session.videoOutSrtcp : session.audioOutSrtcp;
-	if (!srtcp) return;
+	if (!srtcp) {
+		drop(session, "rtcp-no-srtcp");
+		return;
+	}
 	const sink = kind === "video" ? session.videoUdp : session.audioUdp;
 	const port = kind === "video" ? session.hapVideoPort : session.hapAudioPort;
 	try {
@@ -38556,15 +40602,31 @@ function sendRtcpSr(session, kind, log) {
 		});
 		const encrypted = srtcp.encrypt(sr.serialize());
 		sink.send(encrypted, port, session.hapAddress, (err) => {
-			if (err) log.debug("export-hap: RTCP send error", { meta: {
-				kind,
-				error: err.message
-			} });
+			if (err) {
+				drop(session, "srtp-send-failed");
+				log.warn("export-hap: RTCP send error", { meta: {
+					sessionId: session.sessionId,
+					kind,
+					error: err.message
+				} });
+			}
 		});
-		if (kind === "video") session.videoOutLastRtcpAt = Date.now();
-		else session.audioOutLastRtcpAt = Date.now();
+		if (kind === "video") {
+			session.videoOutLastRtcpAt = Date.now();
+			session.videoRtcpSrSent += 1;
+			if (session.videoRtcpSrSent === 1) log.info("export-hap: first VIDEO RTCP Sender Report sent", { meta: {
+				sessionId: session.sessionId,
+				rtpTimestamp: session.videoOutLastRtpTimestamp,
+				intervalMs: session.videoRtcpIntervalMs
+			} });
+		} else {
+			session.audioOutLastRtcpAt = Date.now();
+			session.audioRtcpSrSent += 1;
+		}
 	} catch (err) {
-		log.debug("export-hap: RTCP SR build/encrypt failed", { meta: {
+		drop(session, "rtcp-encrypt-failed");
+		log.warn("export-hap: RTCP SR build/encrypt failed", { meta: {
+			sessionId: session.sessionId,
 			kind,
 			error: err instanceof Error ? err.message : String(err)
 		} });
@@ -38586,7 +40648,14 @@ function forwardEncryptedRtp(session, rtpPacket, kind, log) {
 	const sink = kind === "video" ? session.videoUdp : session.audioUdp;
 	const port = kind === "video" ? session.hapVideoPort : session.hapAudioPort;
 	const gate = kind === "video" ? session.videoSendGate : session.audioSendGate;
-	if (!srtp || !gate) return;
+	if (!srtp) {
+		drop(session, "no-srtp-session");
+		return;
+	}
+	if (!gate) {
+		drop(session, "no-gate");
+		return;
+	}
 	gate.then(() => {
 		try {
 			const parsed = import_src.RtpPacket.deSerialize(rtpPacket);
@@ -38622,32 +40691,46 @@ function forwardEncryptedRtp(session, rtpPacket, kind, log) {
 			}
 			const encrypted = srtp.encrypt(parsed.payload, parsed.header);
 			sink.send(encrypted, port, session.hapAddress, (err) => {
-				if (err) log.debug("export-hap: SRTP send error", { meta: {
-					kind,
-					error: err.message
-				} });
+				if (err) {
+					drop(session, "srtp-send-failed");
+					log.debug("export-hap: SRTP send error", { meta: {
+						sessionId: session.sessionId,
+						kind,
+						error: err.message
+					} });
+				}
 			});
 			const now = Date.now();
 			if (kind === "video") {
 				if (firstVideo || now > session.videoOutLastRtcpAt + session.videoRtcpIntervalMs) sendRtcpSr(session, "video", log);
 			} else if (firstAudio || now > session.audioOutLastRtcpAt + session.audioRtcpIntervalMs) sendRtcpSr(session, "audio", log);
 		} catch (err) {
+			drop(session, "srtp-encrypt-failed");
 			log.debug("export-hap: SRTP encrypt failed", { meta: {
+				sessionId: session.sessionId,
 				kind,
 				error: err instanceof Error ? err.message : String(err)
 			} });
 		}
 	});
 }
-async function handleStreamRequest(request, sessions, bctx) {
+async function handleStreamRequest(request, sessions, bctx, advertised) {
 	const log = bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId });
 	const session = sessions.get(request.sessionID);
 	if (!session) {
-		log.warn("export-hap: stream request for unknown session", { meta: { sessionID: request.sessionID } });
+		log.warn("export-hap: stream request for unknown session", { meta: {
+			sessionID: request.sessionID,
+			type: request.type
+		} });
 		return;
 	}
 	if (request.type === "stop") {
+		session.stopRequestedByController = true;
+		session.teardownTrigger = "controller-stop";
+		const hadFfmpeg = session.ffmpeg !== null;
 		killFfmpeg(session, bctx.ctx, bctx.numericDeviceId);
+		stopHeartbeat(session);
+		if (!hadFfmpeg) logSessionSummary(session, log, "controller-stop-no-ffmpeg");
 		await closeIntercomTalkSession(session, bctx).catch(() => void 0);
 		closeSocket(session.videoUdp);
 		closeSocket(session.audioUdp);
@@ -38673,6 +40756,27 @@ async function handleStreamRequest(request, sessions, bctx) {
 		session.videoOutOctetCount = 0;
 		session.videoOutLastRtpTimestamp = 0;
 		session.videoOutLastRtcpAt = 0;
+		session.negotiated = {
+			width: request.video.width,
+			height: request.video.height,
+			fps: request.video.fps,
+			maxBitrateKbps: request.video.max_bit_rate,
+			mtu: request.video.mtu,
+			videoPt: request.video.pt,
+			videoSsrc: session.videoSsrc,
+			videoRtcpIntervalMs: session.videoRtcpIntervalMs,
+			audioPt: request.audio.pt,
+			audioSsrc: session.audioOutSsrc,
+			audioSampleRateKhz: request.audio.sample_rate,
+			audioPacketTimeMs: packetTimeMs,
+			audioRtcpIntervalMs: session.audioRtcpIntervalMs,
+			audioMaxBitrateKbps: request.audio.max_bit_rate
+		};
+		session.startedAtMs = Date.now();
+		log.info("export-hap: stream negotiated", { meta: {
+			sessionId: request.sessionID,
+			...session.negotiated
+		} });
 		session.lastStartParams = {
 			pt: request.video.pt,
 			mtu: request.video.mtu,
@@ -38693,7 +40797,8 @@ async function handleStreamRequest(request, sessions, bctx) {
 			sample_rate: request.audio.sample_rate,
 			packet_time: packetTimeMs
 		};
-		await startFfmpegForSession(bctx, session, request.sessionID, startParams);
+		await startFfmpegForSession(bctx, session, request.sessionID, startParams, advertised);
+		armHeartbeat(session, log);
 		return;
 	}
 	if (request.type === "reconfigure") {
@@ -38720,147 +40825,266 @@ async function handleStreamRequest(request, sessions, bctx) {
 			sample_rate: session.lastStartParams.audioSampleRateEnum,
 			packet_time: session.lastStartParams.audioPacketTimeMs
 		};
-		await startFfmpegForSession(bctx, session, request.sessionID, startParams);
+		log.info("export-hap: stream reconfigured", { meta: {
+			sessionId: request.sessionID,
+			width: request.video.width,
+			height: request.video.height,
+			fps: request.video.fps,
+			maxBitrateKbps: request.video.max_bit_rate
+		} });
+		await startFfmpegForSession(bctx, session, request.sessionID, startParams, advertised);
+		armHeartbeat(session, log);
 	}
 }
-async function startFfmpegForSession(bctx, session, sessionId, video) {
+async function startFfmpegForSession(bctx, session, sessionId, video, advertised) {
 	const { ctx, proxy, numericDeviceId, options } = bctx;
+	const startLog = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const entries = await proxy.cameraStreams?.getProfileRtspEntries({}) ?? [];
-	if (entries.length === 0) throw new Error(`export-hap: no profile RTSP entries for device ${numericDeviceId}`);
+	if (entries.length === 0) {
+		startLog.warn("export-hap: stream start DROPPED — device publishes no profile RTSP entries", { meta: {
+			sessionId,
+			capBound: proxy.cameraStreams !== void 0
+		} });
+		throw new Error(`export-hap: no profile RTSP entries for device ${numericDeviceId}`);
+	}
 	const pref = options.hapDeviceSettings.streamPreference;
-	const picked = pickPreferredRtspEntry(entries, pref, numericDeviceId, { targetResolution: {
-		width: video.width,
-		height: video.height
-	} });
-	if (!picked) throw new Error(`export-hap: no enabled RTSP entries for device ${numericDeviceId}`);
+	const brokerStreams = await proxy.cameraStreams?.getBrokerStreams({}) ?? [];
+	const bitrates = await probeProfileBitrates({
+		bctx,
+		slots: brokerStreams,
+		log: startLog
+	});
+	const fit = selectStreamForBudget({
+		entries: withSlotCodecs(entries, brokerStreams),
+		deviceId: numericDeviceId,
+		pref,
+		targetResolution: {
+			width: video.width,
+			height: video.height
+		},
+		negotiatedMaxBitrateKbps: video.max_bit_rate,
+		bitrates
+	});
+	if (fit === null) {
+		startLog.warn("export-hap: stream start DROPPED — no ENABLED profile RTSP entry", { meta: {
+			sessionId,
+			streamPreference: pref,
+			targetResolution: `${video.width}x${video.height}`,
+			entries: entries.map((e) => `${e.profile}:${e.enabled ? "enabled" : "disabled"}`)
+		} });
+		throw new Error(`export-hap: no enabled RTSP entries for device ${numericDeviceId}`);
+	}
+	const picked = fit.picked;
 	const rtspUrl = picked.url;
-	const slot = (await proxy.cameraStreams?.getBrokerStreams({}) ?? []).find((s) => s.brokerId === picked.brokerId);
+	const slot = brokerStreams.find((s) => s.profile === fit.profile);
 	const codec = (picked.codec ?? slot?.codec ?? "").toLowerCase();
-	const needsTranscode = codec.includes("h265") || codec.includes("hevc");
+	const needsTranscode = fit.kind === "transcode";
+	const pickedProfile = toKnownProfile(picked.profileId);
+	const resolvedFps = pickedProfile === null ? void 0 : advertised.fpsByProfile.get(pickedProfile);
+	const advertisedFps = resolvedFps?.fps ?? video.fps;
+	const advertisedFpsSource = resolvedFps?.source ?? "assumed";
+	const deliveredFps = needsTranscode ? deliverableFps(video.fps, resolvedFps?.fps ?? null) : advertisedFps;
+	const slotEvidence = pickedProfile === null ? void 0 : bitrates.get(pickedProfile);
+	const fitNotes = formatFitNotes(fit.notes);
+	session.selectedSlot = {
+		profile: pickedProfile,
+		brokerId: picked.brokerId,
+		width: picked.resolution?.width ?? null,
+		height: picked.resolution?.height ?? null,
+		advertisedFps,
+		advertisedFpsSource,
+		deliveredFps,
+		codec: codec.length > 0 ? codec : "unknown",
+		transcode: needsTranscode,
+		fitReason: fit.reason,
+		publishedKbps: slotEvidence?.publishedKbps ?? null,
+		measuredKbps: slotEvidence?.measuredKbps ?? null,
+		budgetKbps: fit.budgetKbps,
+		fitNotes
+	};
+	startLog.info("export-hap: stream bitrate fit resolved", { meta: {
+		sessionId,
+		decision: fit.kind,
+		reason: fit.reason,
+		negotiatedMaxBitrateKbps: video.max_bit_rate,
+		encodeBudgetKbps: fit.budgetKbps,
+		profile: pickedProfile,
+		brokerId: picked.brokerId,
+		slotPublishedKbps: slotEvidence?.publishedKbps ?? null,
+		slotMeasuredKbps: slotEvidence?.measuredKbps ?? null,
+		candidates: fitNotes
+	} });
+	if (deliveredFps !== video.fps) startLog.warn("export-hap: negotiated fps does NOT match the rate we are about to deliver", { meta: {
+		sessionId,
+		negotiatedFps: video.fps,
+		slotFps: advertisedFps,
+		slotFpsSource: advertisedFpsSource,
+		deliveredFps,
+		profile: pickedProfile,
+		brokerId: picked.brokerId,
+		transcode: needsTranscode
+	} });
 	const videoLoopPort = session.videoLoopUdp.address().port;
 	const audioLoopPort = session.audioLoopUdp.address().port;
 	const videoTarget = `rtp://127.0.0.1:${videoLoopPort}?pkt_size=${video.mtu}`;
 	const audioTarget = `rtp://127.0.0.1:${audioLoopPort}?pkt_size=${video.mtu}`;
-	const videoArgs = needsTranscode ? [
-		"-c:v",
-		"libx264",
-		"-preset",
-		"ultrafast",
-		"-tune",
-		"zerolatency",
-		"-pix_fmt",
-		"yuv420p",
-		"-r",
-		String(video.fps),
-		"-s",
-		`${video.width}x${video.height}`,
-		"-b:v",
-		`${video.max_bit_rate}k`,
-		"-bufsize",
-		`${video.max_bit_rate * 2}k`,
-		"-maxrate",
-		`${video.max_bit_rate}k`,
-		"-profile:v",
-		"baseline",
-		"-level",
-		"3.1"
-	] : [
-		"-c:v",
-		"copy",
-		"-bsf:v",
-		"dump_extra"
-	];
+	const videoArgs = buildVideoEncodeArgs({
+		transcode: needsTranscode,
+		width: video.width,
+		height: video.height,
+		fps: deliveredFps,
+		budgetKbps: fit.budgetKbps
+	});
+	const hwDecode = selectHwDecode({
+		transcode: needsTranscode,
+		reading: needsTranscode ? await probeDecoderHwaccel({
+			ctx,
+			log: startLog
+		}) : null,
+		platform: process.platform
+	});
+	logDecodePath(startLog, sessionId, hwDecode, needsTranscode);
 	const videoSsrcSigned = session.videoSsrc | 0;
 	const audioSsrcSigned = video.audio_ssrc | 0;
-	const args = [
-		"-hide_banner",
-		"-loglevel",
-		"warning",
-		"-rtsp_transport",
-		"tcp",
-		"-i",
+	const buildArgs = (decodeArgs) => buildSessionFfmpegArgs({
+		decodeArgs,
 		rtspUrl,
-		"-an",
-		"-map",
-		"0:v:0",
-		...videoArgs,
-		"-payload_type",
-		String(video.pt),
-		"-ssrc",
-		String(videoSsrcSigned),
-		"-f",
-		"rtp",
+		videoArgs,
 		videoTarget,
-		"-vn",
-		"-map",
-		"0:a:0?",
-		"-af",
-		"aresample=async=1000:first_pts=0",
-		"-c:a",
-		"libopus",
-		"-application",
-		"lowdelay",
-		"-frame_duration",
-		String(video.packet_time ?? 20),
-		"-flags",
-		"+global_header",
-		"-ar",
-		String((video.sample_rate ?? 16) * 1e3),
-		"-b:a",
-		`${OPUS_BITRATE_KBPS}k`,
-		"-bufsize",
-		`${OPUS_BITRATE_KBPS * 4}k`,
-		"-ac",
-		String(OPUS_CHANNELS),
-		"-payload_type",
-		String(video.audio_pt),
-		"-ssrc",
-		String(audioSsrcSigned),
-		"-f",
-		"rtp",
-		audioTarget
-	];
-	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const proc = spawn("ffmpeg", args, { stdio: [
-		"ignore",
-		"ignore",
-		"pipe"
-	] });
-	session.ffmpeg = proc;
-	proc.stderr?.on("data", (chunk) => {
-		const line = chunk.toString("utf8").trim();
-		if (!line) return;
-		log.info("export-hap: ffmpeg", { meta: {
-			sessionId,
-			line
-		} });
+		audioTarget,
+		videoPayloadType: video.pt,
+		videoSsrcSigned,
+		audioPayloadType: video.audio_pt,
+		audioSsrcSigned,
+		audioPacketTimeMs: video.packet_time ?? 20,
+		audioSampleRateKhz: video.sample_rate ?? 16
 	});
-	proc.once("exit", (code, signal) => {
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	let hardwareAlreadyFailed = false;
+	const spawnFfmpeg = (decision) => {
+		const spawnedAtMs = Date.now();
+		const usedHardware = decision.kind === "hardware";
+		const proc = spawn("ffmpeg", buildArgs(decision.args), { stdio: [
+			"ignore",
+			"ignore",
+			"pipe"
+		] });
+		session.ffmpeg = proc;
+		proc.stderr?.on("data", (chunk) => {
+			const line = chunk.toString("utf8").trim();
+			if (!line) return;
+			log.info("export-hap: ffmpeg", { meta: {
+				sessionId,
+				line
+			} });
+		});
+		proc.once("exit", (code, signal) => {
+			if (shouldRetryInSoftware({
+				usedHardware,
+				hardwareAlreadyFailed,
+				stopRequestedByController: session.stopRequestedByController,
+				videoPacketsForwarded: session.videoPacketsForwarded,
+				runtimeMs: Date.now() - spawnedAtMs
+			})) {
+				hardwareAlreadyFailed = true;
+				log.warn("export-hap: hardware decode FAILED at init — respawning ffmpeg in software", { meta: {
+					sessionId,
+					backend: decision.kind === "hardware" ? decision.backend : null,
+					backendSource: decision.kind === "hardware" ? decision.source : null,
+					code,
+					signal,
+					runtimeMs: Date.now() - spawnedAtMs
+				} });
+				if (session.ffmpeg === proc) session.ffmpeg = null;
+				spawnFfmpeg({
+					kind: "software",
+					reason: "hardware-attempt-failed",
+					args: []
+				});
+				return;
+			}
+			onFfmpegExit(proc, code, signal);
+		});
+		proc.once("error", (err) => {
+			log.warn("export-hap: ffmpeg spawn failed", { meta: {
+				sessionId,
+				error: err.message
+			} });
+		});
+	};
+	const onFfmpegExit = (proc, code, signal) => {
+		session.ffmpegExit = {
+			code,
+			signal
+		};
 		const ok = code === 0 && signal === null;
 		const meta = {
 			sessionId,
 			code,
-			signal
+			signal,
+			stopRequestedByController: session.stopRequestedByController,
+			videoPacketsForwarded: session.videoPacketsForwarded
 		};
-		if (ok) log.info("export-hap: ffmpeg exited", { meta });
-		else log.warn("export-hap: ffmpeg exited abnormally", { meta });
+		if (ok || session.stopRequestedByController) log.info("export-hap: ffmpeg exited", { meta });
+		else log.warn("export-hap: ffmpeg exited without a controller stop", { meta });
 		if (session.ffmpeg === proc) session.ffmpeg = null;
-	});
-	proc.once("error", (err) => {
-		log.warn("export-hap: ffmpeg spawn failed", { meta: {
-			sessionId,
-			error: err.message
-		} });
-	});
+		logSessionSummary(session, log, session.teardownTrigger ?? "ffmpeg-exit");
+	};
+	spawnFfmpeg(hwDecode);
 	log.info("export-hap: stream started", { meta: {
 		sessionId,
 		transcode: needsTranscode,
-		rtspUrl: picked.brokerId,
+		brokerId: picked.brokerId,
+		profile: pickedProfile,
+		sourceResolution: picked.resolution === void 0 ? null : `${picked.resolution.width}x${picked.resolution.height}`,
+		sourceCodec: codec.length > 0 ? codec : "unknown",
+		negotiated: `${video.width}x${video.height}@${video.fps} ${video.max_bit_rate}kbps`,
+		slotFps: advertisedFps,
+		slotFpsSource: advertisedFpsSource,
+		deliveredFps,
+		fitReason: fit.reason,
+		encodeBudgetKbps: fit.budgetKbps,
 		audioCodec: "opus",
-		audioBitrateKbps: OPUS_BITRATE_KBPS
+		audioBitrateKbps: 24,
+		videoDecode: hwDecode.kind === "hardware" ? hwDecode.backend : "software"
+	} });
+}
+/**
+* Say which decode path was resolved, and WHY, once per session.
+*
+* At `info` on purpose — Loki carries `info+`, and "did this session use the
+* GPU" is the first question anyone asks of a transcoding hub. The software
+* branch is the one that must never be silent: it is a real cost being paid,
+* and every reason it can be reached is a different fix.
+*/
+function logDecodePath(log, sessionId, decision, transcode) {
+	if (decision.kind === "hardware") {
+		log.info("export-hap: video decode path resolved — HARDWARE", { meta: {
+			sessionId,
+			backend: decision.backend,
+			backendSource: decision.source,
+			decodeArgs: decision.args
+		} });
+		return;
+	}
+	const level = transcode ? "warn" : "info";
+	const message = level === "warn" ? "export-hap: video decode path resolved — SOFTWARE, this transcode costs a core" : "export-hap: video decode path resolved — none needed";
+	log[level](message, { meta: {
+		sessionId,
+		reason: decision.reason,
+		transcode
 	} });
 }
 /**
+* `PickedStream.profileId` is the brokerId suffix; for a profile-keyed entry
+* that IS the profile name. Anything else addresses a raw cam-stream and must
+* not be coerced into a profile.
+*/
+function toKnownProfile(profileId) {
+	if (profileId === "high" || profileId === "mid" || profileId === "low") return profileId;
+	return null;
+}
+/**
 * Handle one incoming SRTP audio packet from iOS Home.
 *
 * End-to-end flow:
@@ -38881,15 +41105,22 @@ async function startFfmpegForSession(bctx, session, sessionId, video) {
 *     stays codec-agnostic.
 */
 async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
-	if (packet.length < 12) return;
+	if (packet.length < 12) {
+		drop(session, "upstream-short-packet");
+		return;
+	}
 	const log = bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId });
 	session.upstreamRtpPacketsReceived += 1;
-	if (!session.upstreamAudioSrtp) return;
+	if (!session.upstreamAudioSrtp) {
+		drop(session, "upstream-no-srtp");
+		return;
+	}
 	let decryptedPacket;
 	try {
 		decryptedPacket = session.upstreamAudioSrtp.decrypt(packet);
 		session.upstreamRtpPacketsDecrypted += 1;
 	} catch (err) {
+		drop(session, "upstream-decrypt-failed");
 		session.upstreamRtpDecryptFailures += 1;
 		if (session.upstreamRtpDecryptFailures % 100 === 1) log.debug("export-hap: SRTP decrypt failed (rate-limited)", { meta: {
 			failures: session.upstreamRtpDecryptFailures,
@@ -38906,18 +41137,28 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		rtpTimestamp = parsedRtp.header.timestamp;
 		rtpPayloadType = parsedRtp.header.payloadType;
 	} catch (err) {
+		drop(session, "upstream-parse-failed");
 		log.debug("export-hap: RTP parse failed after decrypt", { meta: { error: errMsg$8(err) } });
 		return;
 	}
 	const negotiatedAudioPt = session.lastStartParams?.audioPt;
-	if (negotiatedAudioPt === void 0) return;
-	if (rtpPayloadType !== negotiatedAudioPt) return;
+	if (negotiatedAudioPt === void 0) {
+		drop(session, "upstream-before-start");
+		return;
+	}
+	if (rtpPayloadType !== negotiatedAudioPt) {
+		drop(session, "upstream-pt-mismatch");
+		return;
+	}
 	if (session.firstUpstreamRtpTimestamp === null) {
 		session.firstUpstreamRtpTimestamp = rtpTimestamp;
 		log.info("export-hap: first upstream RTP packet received");
 	}
 	const payload = decryptedPayload;
-	if (payload.length === 0) return;
+	if (payload.length === 0) {
+		drop(session, "upstream-empty-payload");
+		return;
+	}
 	if (session.intercomTalkSessionId === null) {
 		session.intercomTalkSessionId = "";
 		const opened = await openIntercomTalkSession(bctx).catch((err) => {
@@ -38929,7 +41170,10 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 			log.info("export-hap: intercom talk session opened", { meta: { sessionId: opened.sessionId } });
 		}
 	}
-	if (!session.intercomTalkSessionId) return;
+	if (!session.intercomTalkSessionId) {
+		drop(session, "upstream-no-talk-session");
+		return;
+	}
 	const opusSampleRateHz = (session.lastStartParams?.audioSampleRateEnum ?? 16) * 1e3;
 	session.intercomPcmSequence += 1;
 	session.upstreamPcmFramesDecoded += 1;
@@ -38942,6 +41186,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 			sequenceNumber: session.intercomPcmSequence
 		});
 	} catch (err) {
+		drop(session, "upstream-push-failed");
 		log.debug("export-hap: intercom.pushTalkAudio failed (will re-open on next frame)", { meta: {
 			sequenceNumber: session.intercomPcmSequence,
 			error: errMsg$8(err)
@@ -39025,140 +41270,6 @@ function errMsg$7(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
-//#region src/mappers/builders/hksv.ts
-/**
-* HomeKit Secure Video (HKSV) — stub recording delegate.
-*
-* Wires the camera as HKSV-capable so iOS Home shows the "Activity"
-* tab, the per-camera recording settings UI ("Stream and Allow
-* Recording" / "Off"), and notifications. The delegate stub:
-*  - logs every protocol callback (active toggle, config change,
-*    stream request, close);
-*  - returns from `handleRecordingStreamRequest` immediately without
-*    yielding any fragment — iOS sees "no recording available" but
-*    the camera otherwise behaves like an HKSV camera in the UI.
-*
-* Why a stub: a real implementation needs an fMP4 segmenter that runs
-* a per-camera ffmpeg with a sustained pre-buffer, key/IV-derived
-* encrypter, motion-anchored fragment alignment, and storage for the
-* resulting clips. That work belongs behind the `recording` cap
-* (recording + playback-manifest surface) once it grows fragment export,
-* so the segmenter lives in the recorder addon and HKSV becomes a thin
-* wrapper that asks the cap for "fragments since T" and streams them to iOS.
-*
-* Until that cap lands this stub keeps HKSV characteristics visible
-* (a) so the operator can flip "Allow Recording" without HomeKit
-* complaining the camera lacks the service, and (b) so the
-* `CameraController` advertises a `RecordingManagement` service for
-* iOS-side analytics + Activity-tab UX scaffolding.
-*
-* Constructor returns a `{ options, delegate }` pair the caller
-* passes verbatim into `new CameraController({ ..., recording })`.
-*/
-var RECORDING_OPTIONS = {
-	prebufferLength: 4e3,
-	mediaContainerConfiguration: [{
-		type: MediaContainerType.FRAGMENTED_MP4,
-		fragmentLength: 4e3
-	}],
-	video: {
-		type: VideoCodecType.H264,
-		parameters: {
-			profiles: [
-				H264Profile.BASELINE,
-				H264Profile.MAIN,
-				H264Profile.HIGH
-			],
-			levels: [
-				H264Level.LEVEL3_1,
-				H264Level.LEVEL3_2,
-				H264Level.LEVEL4_0
-			]
-		},
-		resolutions: [
-			[
-				1920,
-				1080,
-				30
-			],
-			[
-				1920,
-				1080,
-				24
-			],
-			[
-				1920,
-				1080,
-				15
-			],
-			[
-				1280,
-				720,
-				30
-			],
-			[
-				1280,
-				720,
-				24
-			],
-			[
-				1280,
-				720,
-				15
-			]
-		]
-	},
-	audio: { codecs: [{
-		type: AudioRecordingCodecType.AAC_LC,
-		bitrateMode: AudioBitrate.VARIABLE,
-		audioChannels: 1,
-		samplerate: [AudioRecordingSamplerate.KHZ_16, AudioRecordingSamplerate.KHZ_24]
-	}] },
-	overrideEventTriggerOptions: [EventTriggerOption.MOTION]
-};
-function buildHksvStub(bctx) {
-	const { ctx, numericDeviceId } = bctx;
-	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	let activeStreamId = null;
-	return {
-		options: RECORDING_OPTIONS,
-		delegate: {
-			updateRecordingActive(active) {
-				log.info("export-hap: HKSV recording active changed", { meta: { active } });
-			},
-			updateRecordingConfiguration(configuration) {
-				if (!configuration) {
-					log.info("export-hap: HKSV recording configuration cleared");
-					return;
-				}
-				log.info("export-hap: HKSV recording configuration applied", { meta: {
-					prebufferLength: configuration.prebufferLength,
-					fragmentLength: configuration.mediaContainerConfiguration.fragmentLength,
-					videoResolution: `${configuration.videoCodec.resolution[0]}x${configuration.videoCodec.resolution[1]}@${configuration.videoCodec.resolution[2]}`,
-					videoBitrate: configuration.videoCodec.parameters.bitRate,
-					eventTriggers: configuration.eventTriggerTypes
-				} });
-			},
-			async *handleRecordingStreamRequest(streamId, _signal) {
-				activeStreamId = streamId;
-				log.warn("export-hap: HKSV stream requested — stub returns empty (no clip source yet)", { meta: { streamId } });
-			},
-			acknowledgeStream(streamId) {
-				if (activeStreamId === streamId) activeStreamId = null;
-				log.debug("export-hap: HKSV stream acknowledged", { meta: { streamId } });
-			},
-			closeRecordingStream(streamId, reason) {
-				if (activeStreamId === streamId) activeStreamId = null;
-				log.info("export-hap: HKSV stream closed", { meta: {
-					streamId,
-					reason: reason ?? null
-				} });
-			}
-		},
-		handle: { async dispose() {} }
-	};
-}
-//#endregion
 //#region src/mappers/builders/intercom.ts
 async function buildIntercom(input) {
 	const { bctx, streamingOptions } = input;
@@ -39186,7 +41297,7 @@ async function buildIntercom(input) {
 var RESET_DEBOUNCE_MS = 5e3;
 async function buildMotionSensor(bctx) {
 	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
-	const motionService = accessory.addService(Service.MotionSensor, displayName);
+	const motionService = accessory.addService(Service.MotionSensor, hapServiceName([displayName], `Camera ${numericDeviceId}`));
 	motionService.setCharacteristic(Characteristic.MotionDetected, false);
 	try {
 		const detected = await proxy.motion?.isDetected({});
@@ -39241,12 +41352,12 @@ function errMsg$6(err) {
 * camera-enabled switch — distinct from privacy-mask).
 */
 async function buildPrivacySwitch(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId } = bctx;
+	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const subtype = "privacy-mask";
-	const configuredName = "Privacy";
-	const service = accessory.addService(Service.Switch, configuredName, subtype);
-	service.setCharacteristic(Characteristic.ConfiguredName, configuredName);
+	const serviceName = privacyServiceName(displayName);
+	const service = accessory.addService(Service.Switch, serviceName, subtype);
+	service.setCharacteristic(Characteristic.Name, serviceName);
 	try {
 		const status = await proxy.privacyMask?.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(Characteristic.On, status.enabled);
@@ -39336,18 +41447,23 @@ function ptzPresetLabel(presetName) {
 *    `proxy.ptzAutotrack.setEnabled({enabled})`. Initial value is
 *    hydrated from `getStatus({})`.
 *
-* Naming: each switch uses a BARE per-action label ("Preset stanza",
-* "Pan Left", "Autotrack") set as BOTH the service name AND its
-* `ConfiguredName`, mirroring `child-switch.ts` / `privacy-switch.ts`.
-* iOS Home renders sibling services on an accessory by their
-* `ConfiguredName`. The old `${displayName} — <action>` form (em-dash
-* U+2014 + redundant camera prefix) was rejected by HAP-NodeJS as an
-* invalid `Name` characteristic, so iOS discarded it and showed generic
-* "Interruttore N".
+* Naming: `<camera> <action>` — "Videocamera ingresso Preset stanza" — built
+* by `ptzServiceName` and written to the `Name` characteristic.
+*
+* TWO separate naming defects have been through this file, and both are fixed
+* by that one line:
+*  - `${displayName} — <action>` embedded an em-dash (U+2014), which is
+*    outside Apple's permitted set. hap-nodejs' `checkName` warned, iOS
+*    discarded the name and showed "Interruttore N". A previous round dropped
+*    the camera prefix along with the em-dash; only the em-dash was the fault.
+*  - The bare label that replaced it was then written to `ConfiguredName`,
+*    which `Service.Switch` does not list, so hap-nodejs rejected the
+*    characteristic outright — SIX rejections per PTZ camera per build, never
+*    reported because only the two switches on the non-PTZ camera were noticed.
 */
 var MOMENTARY_RESET_MS = 1e3;
 async function buildPtz(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId, options } = bctx;
+	const { ctx, accessory, proxy, numericDeviceId, displayName, options } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const timers = /* @__PURE__ */ new Set();
 	const armReset = (cb, delay) => {
@@ -39359,10 +41475,10 @@ async function buildPtz(bctx) {
 	};
 	const presets = await readPresets(bctx);
 	for (const preset of presets) {
-		const label = ptzPresetLabel(preset.name);
+		const label = ptzServiceName(displayName, ptzPresetLabel(preset.name));
 		const subtype = `ptz-preset-${preset.id}`;
 		const service = accessory.addService(Service.Switch, label, subtype);
-		service.setCharacteristic(Characteristic.ConfiguredName, label);
+		service.setCharacteristic(Characteristic.Name, label);
 		service.getCharacteristic(Characteristic.On).onSet(async (value) => {
 			if (value !== true) return;
 			try {
@@ -39377,9 +41493,9 @@ async function buildPtz(bctx) {
 		});
 	}
 	if (proxy.ptz) for (const dir of PTZ_DIRECTIONS) {
-		const label = dir.label;
+		const label = ptzServiceName(displayName, dir.label);
 		const service = accessory.addService(Service.Switch, label, dir.subtype);
-		service.setCharacteristic(Characteristic.ConfiguredName, label);
+		service.setCharacteristic(Characteristic.Name, label);
 		service.getCharacteristic(Characteristic.On).onSet(async (value) => {
 			if (value !== true) return;
 			try {
@@ -39423,12 +41539,12 @@ async function readPresets(bctx) {
 	}
 }
 async function tryBuildAutotrack(bctx) {
-	const { ctx, accessory, proxy, numericDeviceId } = bctx;
+	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
 	if (!proxy.ptzAutotrack) return { async dispose() {} };
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
-	const label = PTZ_AUTOTRACK_LABEL;
+	const label = ptzServiceName(displayName, PTZ_AUTOTRACK_LABEL);
 	const service = accessory.addService(Service.Switch, label, "ptz-autotrack");
-	service.setCharacteristic(Characteristic.ConfiguredName, label);
+	service.setCharacteristic(Characteristic.Name, label);
 	try {
 		const status = await proxy.ptzAutotrack.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(Characteristic.On, status.enabled);
@@ -39452,6 +41568,65 @@ function errMsg$4(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
+//#region src/mappers/builders/stream-fps-probe.ts
+async function probeAdvertisedVideoProfile(bctx) {
+	const { ctx, proxy, numericDeviceId, options } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const entries = await probe(() => proxy.cameraStreams?.getProfileRtspEntries({}), "cameraStreams.getProfileRtspEntries", log);
+	const slots = await probe(() => proxy.cameraStreams?.getBrokerStreams({}), "cameraStreams.getBrokerStreams", log);
+	const camStreams = await probe(() => proxy.cameraStreams?.getCameraStreams({}), "cameraStreams.getCameraStreams", log);
+	const choices = await probe(() => proxy.webrtcSession?.listStreams({}), "webrtcSession.listStreams", log);
+	const fpsByProfile = resolveProfileFps({
+		choices: choices ?? [],
+		slots: slots ?? [],
+		camStreams: camStreams ?? []
+	});
+	const resolutions = deriveAdvertisedResolutions({
+		candidates: CANDIDATE_RESOLUTIONS,
+		entries: entries ?? [],
+		deviceId: numericDeviceId,
+		pref: options.hapDeviceSettings.streamPreference,
+		fpsByProfile
+	});
+	const assumed = resolutions.filter((r) => r.source === "assumed").length;
+	log.info("export-hap: advertised video profile derived", { meta: {
+		streamPreference: options.hapDeviceSettings.streamPreference,
+		resolutions: formatAdvertisedResolutions(resolutions),
+		profileFps: [...fpsByProfile.values()].map((f) => `${f.profile}=${f.fps}(${f.source})`),
+		assumedCount: assumed,
+		previouslyAdvertisedFps: 30
+	} });
+	if (assumed === resolutions.length) log.warn("export-hap: no measured or published frame rate for ANY profile — advertising the assumed rate", { meta: {
+		entries: entries?.length ?? 0,
+		choices: choices?.length ?? 0
+	} });
+	return {
+		resolutions,
+		fpsByProfile
+	};
+}
+/**
+* Run one cap read. Returns null both when the cap is not bound and when the
+* call throws — and LOGS which, because "the camera has no telemetry" and "the
+* telemetry call failed" lead to different fixes.
+*/
+async function probe(call, label, log) {
+	try {
+		const pending = call();
+		if (pending === void 0) {
+			log.info("export-hap: fps probe skipped — cap not bound on this device", { meta: { call: label } });
+			return null;
+		}
+		return await pending;
+	} catch (err) {
+		log.warn("export-hap: fps probe failed — falling back to a lower-authority source", { meta: {
+			call: label,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+		return null;
+	}
+}
+//#endregion
 //#region src/mappers/builders/child-switch.ts
 /**
 * Child-switch builder — turns a camstack accessory child device (siren,
@@ -39496,7 +41671,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 	const isLightingDevice = deviceType === DeviceType.Light || deviceType === DeviceType.Generic;
 	const useLightbulb = hasBrightness && isLightingDevice;
 	const service = useLightbulb ? accessory.addService(Service.Lightbulb, displayName, subtype) : accessory.addService(Service.Switch, displayName, subtype);
-	service.setCharacteristic(Characteristic.ConfiguredName, displayName);
+	service.setCharacteristic(Characteristic.Name, displayName);
 	try {
 		const switchStatus = await proxy.switch?.getStatus({});
 		if (switchStatus && typeof switchStatus.on === "boolean") service.updateCharacteristic(Characteristic.On, switchStatus.on);
@@ -39568,7 +41743,7 @@ async function buildChildServicesFor(input) {
 			accessory: parentCtx.accessory,
 			proxy: childProxy,
 			numericDeviceId: child.id,
-			displayName: formatChildServiceName(parentDisplayName, child),
+			displayName: childServiceName(parentDisplayName, child),
 			options
 		};
 		const subtype = `child-${child.id}`;
@@ -39599,21 +41774,6 @@ async function listChildren(ctx, parentNumericId) {
 	}
 }
 /**
-* Service name displayed inside the camera tile detail in iOS Home.
-* Prefer the child's own role ("Siren", "Floodlight") when meaningful
-* — the camera name is already implied by the surrounding Accessory.
-* Falls back to the child's stored device name when role is empty.
-*/
-function formatChildServiceName(parentName, child) {
-	const role = child.role && child.role.length > 0 ? toTitleCase(child.role) : null;
-	if (role) return role;
-	if (child.name.toLowerCase().includes(parentName.toLowerCase())) {
-		const stripped = child.name.replace(new RegExp(`\\b${escapeRegex(parentName)}\\b`, "i"), "").replace(/\s+[—-]\s+/, " ").trim();
-		if (stripped.length > 0) return stripped;
-	}
-	return child.name;
-}
-/**
 * Coerce the raw `child.type` string (from `deviceManager.getChildren`)
 * to a `DeviceType` enum value. Unknown / mis-cased values fall back to
 * `Generic` so an unrecognised driver behaves like the safest existing
@@ -39625,12 +41785,6 @@ function asDeviceType(raw) {
 	for (const value of Object.values(DeviceType)) if (value === lower) return value;
 	return DeviceType.Generic;
 }
-function escapeRegex(s) {
-	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function toTitleCase(raw) {
-	return raw.split("-").filter((part) => part.length > 0).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
-}
 function errMsg$2(err) {
 	return err instanceof Error ? err.message : String(err);
 }
@@ -39678,24 +41832,18 @@ async function buildCameraAccessory(input) {
 		displayName,
 		options
 	};
-	const streams = buildCameraStreamingDelegate(bctx);
+	const streams = buildCameraStreamingDelegate(bctx, await probeAdvertisedVideoProfile(bctx));
 	const handles = [];
 	if (capNames.has("intercom")) handles.push(await buildIntercom({
 		bctx,
 		streamingOptions: streams.streamingOptions
 	}));
-	const hksv = capNames.has("motion-detection") ? buildHksvStub(bctx) : null;
 	const controller = new (isDoorbell ? DoorbellController : CameraController)({
 		delegate: streams.delegate,
 		streamingOptions: streams.streamingOptions,
-		cameraStreamCount: 2,
-		...hksv ? { recording: {
-			options: hksv.options,
-			delegate: hksv.delegate
-		} } : {}
+		cameraStreamCount: 2
 	});
 	accessory.configureController(controller);
-	if (hksv) handles.push(hksv.handle);
 	if (capNames.has("motion-detection")) handles.push(await buildMotionSensor(bctx));
 	if (isDoorbell && controller instanceof DoorbellController) handles.push(await buildDoorbell({
 		bctx,