@camstack/addon-export-hap 1.2.89 → 1.2.91

package/dist/hap-export.addon.js

@@ -84,7 +84,7 @@ function carryForward(base, existing, keys) {
 	return out;
 }
 //#endregion
-//#region ../types/dist/event-category-zAv7pMUz.mjs
+//#region ../types/dist/event-category-CnLqLOKs.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -279,6 +279,19 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessCrashed"] = "process.crashed";
 	EventCategory["ProcessRestartScheduled"] = "process.restart_scheduled";
 	EventCategory["ProcessRestarted"] = "process.restarted";
+	/**
+	* The SET of storage locations changed — one was created, edited, enabled,
+	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	*
+	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
+	* it must also converge on its own periodic path, because a dropped event
+	* must not leave a node writing to yesterday's disk set forever. It exists
+	* because there was NO signal at all — an operator who added a second
+	* recordings disk in the admin UI got nothing, and the recorder kept its
+	* resolved locations until something else happened to re-resolve them
+	* (D387). Payload `StorageLocationsChangedPayload`.
+	*/
+	EventCategory["StorageLocationsChanged"] = "storage.locations-changed";
 	EventCategory["RecordingStarted"] = "recording.started";
 	EventCategory["RecordingStopped"] = "recording.stopped";
 	EventCategory["RecordingError"] = "recording.error";
@@ -8281,111 +8294,6 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
-/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -9307,6 +9215,21 @@ var StorageCleanupJobSchema = object({
 });
 var StorageCleanupStatusInputSchema = object({ jobId: string().optional() });
 /**
+* The one typed state of a storage location. Authoritative Zod schema — the TS
+* alias below is `z.infer<>` of it, never a second spelling.
+*/
+var StorageLocationModeSchema = _enum([
+	"active",
+	"readonly",
+	"drain",
+	"disabled"
+]);
+_enum([
+	"normal",
+	"never",
+	"drain"
+]);
+/**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
 * storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
 * so the persisted record schema and the consumer-facing cap can both consume it
@@ -9331,8 +9254,11 @@ var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -9353,23 +9279,37 @@ var StorageLocationSchema = object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: string().optional(),
-	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: boolean().optional(),
+	/**
+	* THE state of this location (D385), and the only authority on what may be
+	* written, read or evicted here. Interpreted in exactly one place —
+	* `storage-location-mode.ts` — which also folds the legacy
+	* `enabled` / `config.readOnly` pair into a mode so an old row is never
+	* ambiguous.
+	*
+	* OPTIONAL only for the wire and for rows written before D385: absence is
+	* resolved by `resolveLocationMode`, and the orchestrator stamps every
+	* unstamped row ONCE at hydrate so absence stops existing rather than being
+	* re-derived on every read. `enabled` survives one release as a DERIVED
+	* mirror (`mode === 'active'`); `withLocationMode` is the only writer of
+	* either, so the two cannot disagree.
+	*/
+	mode: StorageLocationModeSchema.optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
 	*  for node-local locations it can reach) — never persisted, absent when the
 	*  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -9377,13 +9317,50 @@ var StorageLocationSchema = object({
 		totalBytes: number(),
 		availableBytes: number()
 	}).nullable().optional(),
+	/**
+	* How much of that volume CamStack ITSELF holds on this location (D388) —
+	* COMPUTED at read time from the `storage-occupancy` providers' own figures,
+	* never persisted, never a filesystem walk.
+	*
+	* **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
+	* location yet — nobody stores here, the owning addon is down, or the first
+	* refresh has not completed. A UI must omit the segment rather than draw it
+	* at zero, which would claim we occupy nothing (D315). It is an OBJECT and
+	* not a bare number precisely so that a `?? 0` on the consuming side has to
+	* be spelled out loud instead of appearing by accident.
+	*
+	* `measuredAtMs` is the OLDEST contributing measurement, so it is honest
+	* about the whole figure rather than about its freshest part.
+	*/
+	owned: object({
+		bytes: number().int().nonnegative(),
+		measuredAtMs: number().int().nonnegative()
+	}).optional(),
 	createdAt: number(),
 	updatedAt: number()
 });
+object({ isDefault: boolean().optional() });
+/**
+* How far a `drain` has got (D386) — the read a UI renders, and nothing more.
+*
+* `estimatedEmptyAtMs` is derived from the growth the ratchet has actually
+* OBSERVED and is `null` when it has observed none. Never a fabricated date: a
+* drain with no observed growth has no honest ETA, and inventing one is how an
+* operator learns not to believe the screen.
+*/
+var StorageDrainProgressSchema = object({
+	locationId: string(),
+	startedAtMs: number(),
+	startBytes: number(),
+	bytesRemaining: number(),
+	drained: boolean(),
+	estimatedEmptyAtMs: number().nullable()
+});
 /**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -9559,6 +9536,111 @@ var DecoderSessionConfigSchema = object({
 	*/
 	debug: boolean().optional()
 });
+/**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
 function pickPreferredRtspEntry(entries, pref, deviceId, options = {}) {
 	if (entries.length === 0) return null;
 	const prefix = `${deviceId}/`;
@@ -22358,7 +22440,7 @@ method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -22370,7 +22452,7 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), object({
+}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
 	ok: boolean(),
 	error: string().optional()
 }), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
@@ -22440,6 +22522,51 @@ method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin"
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(StorageMigrationJobSchema).readonly(), { auth: "admin" });
+/**
+* `storage-occupancy` — how many bytes an addon actually HOLDS on a storage
+* location (D388).
+*
+* ## Why this is not `storage-evictable`
+*
+* `storage-evictable.getEvictableUsage` looks like the same question and is
+* not, in two ways that both matter and both bite hardest on the locations an
+* operator most wants a figure for:
+*
+*  - it reports the whole eviction DOMAIN, not the location. `recordings:default`
+*    and `recordingsLow:default` deliberately share one root and evict as one
+*    oldest-first pool, so both answer with the SAME combined total. As an
+*    occupancy figure that double-counts the disk.
+*  - it reports ZERO for a location whose eviction policy is `never` (D385) —
+*    a `readonly` or `disabled` disk. Those are exactly the disks an operator
+*    is retiring and staring at.
+*
+* So this is its own contract with its own quantity, and the quantity is
+* OCCUPIED: every byte the addon holds on that location, whether or not it
+* would ever be willing to delete it. A provider that can only answer
+* "evictable" must not register here — a number that silently means different
+* things per class is worse than no number.
+*
+* ## Absence is an answer
+*
+* A location nobody reports for is UNKNOWN, never zero (D315). The orchestrator
+* stamps `StorageLocation.owned` only for locations it has a report for, and
+* the field is an OBJECT rather than a bare number so that a `?? 0` on the
+* consuming side has to be written out loud instead of appearing by accident.
+*
+* `internal: true` — consumed by the orchestrator's `listLocations` stamp, never
+* a public client surface. Clients read the stamped `StorageLocation.owned`.
+*/
+/** One provider's occupancy answer for one location. */
+var StorageOccupancyReportSchema = object({
+	locationId: string(),
+	/** Bytes this provider holds on THAT location — not its eviction domain, and
+	*  not net of what it is willing to delete. */
+	ownedBytes: number().int().nonnegative(),
+	/** When the provider last actually measured this. The orchestrator carries it
+	*  through so a UI can say how old the figure is instead of implying "now". */
+	measuredAtMs: number().int().nonnegative()
+});
+method(object({ locationIds: array(string()).readonly() }), array(StorageOccupancyReportSchema).readonly(), { auth: "admin" });
 var ProviderInfoSchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
 	displayName: string().min(1),
@@ -24079,39 +24206,6 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, meth
 	deviceId: number(),
 	status: BatteryStatusSchema
 });
-/**
-* Network-link snapshot. Same shape for every provider (a Reolink wifi
-* camera, a Home Assistant device with a signal-strength sensor, a Tapo
-* plug): one slice under `device.runtimeState['network-link']`, one badge,
-* one Home Assistant projection.
-*/
-var NetworkLinkStatusSchema = object({
-	/** The link the device is on. `'unknown'` = not read yet, not "no link". */
-	type: _enum([
-		"wifi",
-		"ethernet",
-		"cellular",
-		"unknown"
-	]),
-	/**
-	* Link quality, 0..100 inclusive, normalised by the provider from whatever
-	* the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
-	* KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
-	* one whose reading has not landed must not be drawn at 0 %. Consumers
-	* SKIP a null rather than coerce it.
-	*/
-	signalPercent: number().min(0).max(100).nullable(),
-	/** Raw received signal strength in dBm, when the firmware reports one. */
-	rssiDbm: number().optional(),
-	/** Network name of a wireless link, when the firmware reports it. */
-	ssid: string().optional(),
-	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
-	lastUpdated: number()
-});
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.Light, DeviceType.Lock, DeviceType.Siren, object({
-	deviceId: number(),
-	status: NetworkLinkStatusSchema
-});
 object({
 	on: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
@@ -26509,6 +26603,236 @@ DeviceType.Camera, method(object({
 	detection: NativeDetectionSchema
 });
 /**
+* `navigation` — a device-scoped capability that natively expresses the FULL
+* navigation / action surface of a robot that DRIVES ITSELF and carries an
+* on-board camera (the Dreame robot-vacuum camera is the first provider).
+*
+* Why a NEW cap rather than overloading `ptz`:
+*   - `ptz` moves a *gimbal* on a fixed camera (pan/tilt/zoom of the lens). A
+*     robot vacuum has no gimbal — the whole chassis drives, turns and spins.
+*     The two are different physical models: PTZ is absolute-position + presets,
+*     navigation is momentary drive nudges + discrete robot ACTIONS
+*     (dock / spot-clean / follow-pet / go-to-point / …).
+*   - This cap is the SOURCE OF TRUTH. Two consumers adapt from it rather than
+*     the reverse:
+*       1. a native CamStack navigation panel (data-driven from `listActions`
+*          / `getOptions`), and
+*       2. the PTZ surface — a thin adapter mimics `ptz` from `navigation` so a
+*          robot camera shows up in the existing PTZ control path without every
+*          PTZ provider learning about robots. The mapping lives in the adapter,
+*          not here (see the addon design note):
+*            ptz.continuousMove({pan,tilt}) → navigation.move({pan,tilt})
+*            ptz.stop()                      → navigation.stop()
+*            ptz.goHome()                    → navigation.runAction('goHome')
+*            ptz.getPresets()                → navigation.listActions()  (id→preset)
+*            ptz.goToPreset(id)              → navigation.runAction(id)
+*
+* ## Continuous drive
+*
+* `move` is MOMENTARY. Fluid navigation comes from the UI (or the PTZ adapter)
+* sending `move({pan,tilt})` REPEATEDLY at ~1 Hz while a direction is held, and
+* one `stop()` on release — exactly like the robot app's remote-drive joystick.
+* The provider forwards EACH `move` to one drive write; it must NOT debounce or
+* coalesce them. The UI owns the cadence.
+*
+* ## The action dictionary
+*
+* The discrete controls (dock / locate / spot-clean / follow / flash / sounds)
+* are a DATA-DRIVEN dictionary the cap exposes via `listActions()`. Each entry
+* carries `{ id, kind, label, icon }` (plus `soundId` for sound entries) so the
+* native panel AND the PTZ mimic render buttons WITHOUT hardcoding a
+* vendor-specific list. `kind: 'action'` entries are triggered with
+* `runAction({ actionId })`; `kind: 'sound'` entries with `playSound({ soundId })`
+* (the entry carries the `soundId` to pass). The general primitives — `move`,
+* `stop`, `goToPoint` — stay as first-class methods, not dictionary entries.
+*
+* NOTE (provider wiring): the first provider (Dreame) drives this with the RAW
+* `callAction(siid,aiid,in)` / `setProperty({siid,piid,value})` MIoT primitives
+* that the currently-published `@apocaliss92/nodedreame` already exposes on
+* every device handle. A future nodedreame publish adds a typed
+* `DreameCameraController` (drive / playPetSound / spotClean / findPet / …); the
+* provider can then swap the raw calls for the typed methods with no change to
+* THIS contract.
+*/
+/**
+* A momentary drive nudge. The robot MOVES (no gimbal) for as long as the caller
+* keeps sending nudges (~1 Hz); an explicit `stop` (or letting the nudges lapse)
+* halts it.
+*
+*   - `pan`   — turn: negative = left, positive = right, 0 = straight.
+*   - `tilt`  — throttle: positive = forward, negative = spin / turn-around.
+*   - `speed` — optional intensity hint [0, 1]; the provider may scale the drive
+*               vector by it (drivers without proportional drive ignore it).
+*
+* `pan` / `tilt` are normalized [-1, 1]. Both optional so a caller can nudge one
+* axis alone; an all-undefined nudge is a no-op.
+*/
+var NavigationMoveCommandSchema = object({
+	pan: number().min(-1).max(1).optional(),
+	tilt: number().min(-1).max(1).optional(),
+	speed: number().min(0).max(1).optional()
+});
+/**
+* The enumerated discrete actions a navigation-capable robot can perform via
+* `runAction`. This is the CLOSED vocabulary; a given device advertises the
+* subset it supports through `listActions`. Sounds are NOT here — they go through
+* `playSound` (see the `sound` dictionary entries).
+*/
+var NavigationActionIdSchema = _enum([
+	"goHome",
+	"locate",
+	"spotClean",
+	"findPet",
+	"personFollow",
+	"stop",
+	"startClean",
+	"pauseClean",
+	"dockWash",
+	"autoEmpty",
+	"flashOn",
+	"flashOff"
+]);
+/** Whether a dictionary entry is a `runAction` action or a `playSound` sound. */
+var NavigationEntryKindSchema = _enum(["action", "sound"]);
+/**
+* One entry in the navigation action dictionary — the DATA-DRIVEN unit both the
+* native panel and the PTZ mimic render as a button.
+*
+*   - `id`      — stable id. For `kind:'action'` it is a {@link NavigationActionId}
+*                 (pass to `runAction`); for `kind:'sound'` it is a namespaced id
+*                 (`sound:meow`) whose `soundId` is passed to `playSound`.
+*   - `icon`    — icon HINT (lucide-style name; the UI maps it to its own set).
+*   - `label`   — operator-facing English label.
+*   - `soundId` — wire sound id, present only on `kind:'sound'` entries.
+*   - `enabled` — per-device FEATURE FLAG. `listActions` reports it so the UI /
+*                 PTZ render ONLY enabled entries. Data-driven: the provider
+*                 flips it from config, never by editing code.
+*/
+var NavigationActionEntrySchema = object({
+	id: string(),
+	kind: NavigationEntryKindSchema,
+	label: string(),
+	icon: string(),
+	/** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
+	soundId: number().int().optional(),
+	/** Per-device feature flag — render this entry only when true. */
+	enabled: boolean()
+});
+/** Coordinates for `goToPoint` — a point on the robot's live map. */
+var NavigationPointSchema = object({
+	x: number(),
+	y: number()
+});
+/**
+* Per-device FEATURE-FLAG report for the general (non-dictionary) primitives.
+* The cap reports which are enabled so the UI / PTZ render only the controls
+* that are turned on for THIS device. Data-driven: the provider derives these
+* from config + probe, never hardcoded in the UI. The per-DICTIONARY-entry flags
+* live on {@link NavigationActionEntrySchema.enabled}; these gate the primitives
+* that are not dictionary entries.
+*
+*   - `move` / `stop`   — the momentary drive joystick.
+*   - `goToPoint`       — send-to-map-coordinate. Ships OFF on Dreame until the
+*                         map-coordinate plumbing is wired.
+*   - `runAction`       — the discrete action buttons (dictionary `kind:'action'`).
+*   - `playSound`       — the sound buttons (dictionary `kind:'sound'`).
+*   - `light`           — the on/off fill-light toggle (works anytime).
+*   - `lightMode`       — the auto/manual selector + manual level slider (a
+*                         camera-service control; needs an active stream).
+*/
+var NavigationFeaturesSchema = object({
+	move: boolean(),
+	stop: boolean(),
+	goToPoint: boolean(),
+	runAction: boolean(),
+	playSound: boolean(),
+	light: boolean(),
+	lightMode: boolean()
+});
+/** Light mode: `auto` lets the camera choose brightness; `manual` uses `level`. */
+var NavigationLightModeSchema = _enum(["auto", "manual"]);
+/**
+* Live navigation state so the UI can reflect what the robot is doing:
+*   - `mode`       — coarse activity (idle / cleaning / following / …).
+*   - `following`  — person/pet follow is currently armed.
+*   - `flash`      — the on-camera fill light is on.
+*   - `lightMode`  — auto vs manual fill-light mode.
+*   - `lightLevel` — manual fill-light level (40..100); meaningful when
+*                    `lightMode === 'manual'`.
+*/
+var NavigationStatusSchema = object({
+	mode: _enum([
+		"idle",
+		"cleaning",
+		"spot",
+		"following",
+		"goto",
+		"returning",
+		"paused",
+		"unknown"
+	]),
+	following: boolean(),
+	flash: boolean(),
+	lightMode: NavigationLightModeSchema,
+	lightLevel: number().min(40).max(100),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+NavigationStatusSchema.extend({ lastFetchedAt: number() });
+DeviceType.Camera, method(NavigationMoveCommandSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(NavigationPointSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), array(NavigationActionEntrySchema)), method(object({
+	deviceId: number(),
+	actionId: NavigationActionIdSchema
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	soundId: number().int()
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	on: boolean()
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	mode: NavigationLightModeSchema,
+	level: number().min(40).max(100).optional()
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	level: number().min(40).max(100)
+}), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), NavigationFeaturesSchema), object({
+	deviceId: number(),
+	status: NavigationStatusSchema
+});
+/**
+* Network-link snapshot. Same shape for every provider (a Reolink wifi
+* camera, a Home Assistant device with a signal-strength sensor, a Tapo
+* plug): one slice under `device.runtimeState['network-link']`, one badge,
+* one Home Assistant projection.
+*/
+var NetworkLinkStatusSchema = object({
+	/** The link the device is on. `'unknown'` = not read yet, not "no link". */
+	type: _enum([
+		"wifi",
+		"ethernet",
+		"cellular",
+		"unknown"
+	]),
+	/**
+	* Link quality, 0..100 inclusive, normalised by the provider from whatever
+	* the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
+	* KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
+	* one whose reading has not landed must not be drawn at 0 %. Consumers
+	* SKIP a null rather than coerce it.
+	*/
+	signalPercent: number().min(0).max(100).nullable(),
+	/** Raw received signal strength in dBm, when the firmware reports one. */
+	rssiDbm: number().optional(),
+	/** Network name of a wireless link, when the firmware reports it. */
+	ssid: string().optional(),
+	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
+	lastUpdated: number()
+});
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.Light, DeviceType.Lock, DeviceType.Siren, object({
+	deviceId: number(),
+	status: NetworkLinkStatusSchema
+});
+/**
 * network-quality — system-scoped singleton capability tracking RTT,
 * jitter, and observed/peak bandwidth per device + per client.
 *
@@ -27750,203 +28074,6 @@ DeviceType.Camera, method(object({ deviceId: number() }), PtzAutotrackStatusSche
 	deviceId: number(),
 	status: PtzAutotrackStatusSchema
 });
-/**
-* `navigation` — a device-scoped capability that natively expresses the FULL
-* navigation / action surface of a robot that DRIVES ITSELF and carries an
-* on-board camera (the Dreame robot-vacuum camera is the first provider).
-*
-* Why a NEW cap rather than overloading `ptz`:
-*   - `ptz` moves a *gimbal* on a fixed camera (pan/tilt/zoom of the lens). A
-*     robot vacuum has no gimbal — the whole chassis drives, turns and spins.
-*     The two are different physical models: PTZ is absolute-position + presets,
-*     navigation is momentary drive nudges + discrete robot ACTIONS
-*     (dock / spot-clean / follow-pet / go-to-point / …).
-*   - This cap is the SOURCE OF TRUTH. Two consumers adapt from it rather than
-*     the reverse:
-*       1. a native CamStack navigation panel (data-driven from `listActions`
-*          / `getOptions`), and
-*       2. the PTZ surface — a thin adapter mimics `ptz` from `navigation` so a
-*          robot camera shows up in the existing PTZ control path without every
-*          PTZ provider learning about robots. The mapping lives in the adapter,
-*          not here (see the addon design note):
-*            ptz.continuousMove({pan,tilt}) → navigation.move({pan,tilt})
-*            ptz.stop()                      → navigation.stop()
-*            ptz.goHome()                    → navigation.runAction('goHome')
-*            ptz.getPresets()                → navigation.listActions()  (id→preset)
-*            ptz.goToPreset(id)              → navigation.runAction(id)
-*
-* ## Continuous drive
-*
-* `move` is MOMENTARY. Fluid navigation comes from the UI (or the PTZ adapter)
-* sending `move({pan,tilt})` REPEATEDLY at ~1 Hz while a direction is held, and
-* one `stop()` on release — exactly like the robot app's remote-drive joystick.
-* The provider forwards EACH `move` to one drive write; it must NOT debounce or
-* coalesce them. The UI owns the cadence.
-*
-* ## The action dictionary
-*
-* The discrete controls (dock / locate / spot-clean / follow / flash / sounds)
-* are a DATA-DRIVEN dictionary the cap exposes via `listActions()`. Each entry
-* carries `{ id, kind, label, icon }` (plus `soundId` for sound entries) so the
-* native panel AND the PTZ mimic render buttons WITHOUT hardcoding a
-* vendor-specific list. `kind: 'action'` entries are triggered with
-* `runAction({ actionId })`; `kind: 'sound'` entries with `playSound({ soundId })`
-* (the entry carries the `soundId` to pass). The general primitives — `move`,
-* `stop`, `goToPoint` — stay as first-class methods, not dictionary entries.
-*
-* NOTE (provider wiring): the first provider (Dreame) drives this with the RAW
-* `callAction(siid,aiid,in)` / `setProperty({siid,piid,value})` MIoT primitives
-* that the currently-published `@apocaliss92/nodedreame` already exposes on
-* every device handle. A future nodedreame publish adds a typed
-* `DreameCameraController` (drive / playPetSound / spotClean / findPet / …); the
-* provider can then swap the raw calls for the typed methods with no change to
-* THIS contract.
-*/
-/**
-* A momentary drive nudge. The robot MOVES (no gimbal) for as long as the caller
-* keeps sending nudges (~1 Hz); an explicit `stop` (or letting the nudges lapse)
-* halts it.
-*
-*   - `pan`   — turn: negative = left, positive = right, 0 = straight.
-*   - `tilt`  — throttle: positive = forward, negative = spin / turn-around.
-*   - `speed` — optional intensity hint [0, 1]; the provider may scale the drive
-*               vector by it (drivers without proportional drive ignore it).
-*
-* `pan` / `tilt` are normalized [-1, 1]. Both optional so a caller can nudge one
-* axis alone; an all-undefined nudge is a no-op.
-*/
-var NavigationMoveCommandSchema = object({
-	pan: number().min(-1).max(1).optional(),
-	tilt: number().min(-1).max(1).optional(),
-	speed: number().min(0).max(1).optional()
-});
-/**
-* The enumerated discrete actions a navigation-capable robot can perform via
-* `runAction`. This is the CLOSED vocabulary; a given device advertises the
-* subset it supports through `listActions`. Sounds are NOT here — they go through
-* `playSound` (see the `sound` dictionary entries).
-*/
-var NavigationActionIdSchema = _enum([
-	"goHome",
-	"locate",
-	"spotClean",
-	"findPet",
-	"personFollow",
-	"stop",
-	"startClean",
-	"pauseClean",
-	"dockWash",
-	"autoEmpty",
-	"flashOn",
-	"flashOff"
-]);
-/** Whether a dictionary entry is a `runAction` action or a `playSound` sound. */
-var NavigationEntryKindSchema = _enum(["action", "sound"]);
-/**
-* One entry in the navigation action dictionary — the DATA-DRIVEN unit both the
-* native panel and the PTZ mimic render as a button.
-*
-*   - `id`      — stable id. For `kind:'action'` it is a {@link NavigationActionId}
-*                 (pass to `runAction`); for `kind:'sound'` it is a namespaced id
-*                 (`sound:meow`) whose `soundId` is passed to `playSound`.
-*   - `icon`    — icon HINT (lucide-style name; the UI maps it to its own set).
-*   - `label`   — operator-facing English label.
-*   - `soundId` — wire sound id, present only on `kind:'sound'` entries.
-*   - `enabled` — per-device FEATURE FLAG. `listActions` reports it so the UI /
-*                 PTZ render ONLY enabled entries. Data-driven: the provider
-*                 flips it from config, never by editing code.
-*/
-var NavigationActionEntrySchema = object({
-	id: string(),
-	kind: NavigationEntryKindSchema,
-	label: string(),
-	icon: string(),
-	/** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
-	soundId: number().int().optional(),
-	/** Per-device feature flag — render this entry only when true. */
-	enabled: boolean()
-});
-/** Coordinates for `goToPoint` — a point on the robot's live map. */
-var NavigationPointSchema = object({
-	x: number(),
-	y: number()
-});
-/**
-* Per-device FEATURE-FLAG report for the general (non-dictionary) primitives.
-* The cap reports which are enabled so the UI / PTZ render only the controls
-* that are turned on for THIS device. Data-driven: the provider derives these
-* from config + probe, never hardcoded in the UI. The per-DICTIONARY-entry flags
-* live on {@link NavigationActionEntrySchema.enabled}; these gate the primitives
-* that are not dictionary entries.
-*
-*   - `move` / `stop`   — the momentary drive joystick.
-*   - `goToPoint`       — send-to-map-coordinate. Ships OFF on Dreame until the
-*                         map-coordinate plumbing is wired.
-*   - `runAction`       — the discrete action buttons (dictionary `kind:'action'`).
-*   - `playSound`       — the sound buttons (dictionary `kind:'sound'`).
-*   - `light`           — the on/off fill-light toggle (works anytime).
-*   - `lightMode`       — the auto/manual selector + manual level slider (a
-*                         camera-service control; needs an active stream).
-*/
-var NavigationFeaturesSchema = object({
-	move: boolean(),
-	stop: boolean(),
-	goToPoint: boolean(),
-	runAction: boolean(),
-	playSound: boolean(),
-	light: boolean(),
-	lightMode: boolean()
-});
-/** Light mode: `auto` lets the camera choose brightness; `manual` uses `level`. */
-var NavigationLightModeSchema = _enum(["auto", "manual"]);
-/**
-* Live navigation state so the UI can reflect what the robot is doing:
-*   - `mode`       — coarse activity (idle / cleaning / following / …).
-*   - `following`  — person/pet follow is currently armed.
-*   - `flash`      — the on-camera fill light is on.
-*   - `lightMode`  — auto vs manual fill-light mode.
-*   - `lightLevel` — manual fill-light level (40..100); meaningful when
-*                    `lightMode === 'manual'`.
-*/
-var NavigationStatusSchema = object({
-	mode: _enum([
-		"idle",
-		"cleaning",
-		"spot",
-		"following",
-		"goto",
-		"returning",
-		"paused",
-		"unknown"
-	]),
-	following: boolean(),
-	flash: boolean(),
-	lightMode: NavigationLightModeSchema,
-	lightLevel: number().min(40).max(100),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
-});
-NavigationStatusSchema.extend({ lastFetchedAt: number() });
-DeviceType.Camera, method(NavigationMoveCommandSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(NavigationPointSchema.extend({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), array(NavigationActionEntrySchema)), method(object({
-	deviceId: number(),
-	actionId: NavigationActionIdSchema
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	soundId: number().int()
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	on: boolean()
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	mode: NavigationLightModeSchema,
-	level: number().min(40).max(100).optional()
-}), _void(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	level: number().min(40).max(100)
-}), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), NavigationFeaturesSchema), object({
-	deviceId: number(),
-	status: NavigationStatusSchema
-});
 DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, method(object({ deviceId: number().int().nonnegative() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
@@ -35280,13 +35407,13 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
+	"storage.list": {
 		capName: "storage",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"storage.list": {
+	"storage.listDrainProgress": {
 		capName: "storage",
 		capScope: "system",
 		addonId: null,
@@ -35436,6 +35563,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storageOccupancy.getOccupancy": {
+		capName: "storage-occupancy",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageProvider.abortUpload": {
 		capName: "storage-provider",
 		capScope: "system",
@@ -38816,32 +38949,221 @@ DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
-/**
-* Compute the stable 64-char lowercase-hex fingerprint of a device's
-* export-relevant shape. Two structurally-equal shapes (any feature order,
-* any duplicates, any deviceId) hash identically.
-*/
-function canonicalDeviceFingerprint(shape) {
-	const features = [...new Set(shape.features)].toSorted();
-	return canonicalHash({
-		deviceType: shape.deviceType,
-		features
-	});
-}
-/**
-* Resolve the fingerprint an exporter should feed into `diffExportTargets`
-* for one device this cycle.
-*
-* When a device is NOT yet probe-ready, carry forward its last-advertised
-* (persisted) fingerprint so it nets to NO CHANGE in `diffExportTargets`
-* (neither update nor remove) — never advertise a partial mid-probe shape. A
-* brand-new un-probed device with no persisted entry falls back to `fresh` so
-* it can advertise once.
-*/
-function resolveExportFingerprint(input) {
-	if (input.ready) return input.fresh;
-	return input.persisted ?? input.fresh;
-}
+var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
+/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
+var FRAGMENT_LOG_EVERY = 30;
+var Fmp4FragmentChild = class {
+	deps;
+	args;
+	child = null;
+	splitter = new Fmp4BoxSplitter();
+	stopped = false;
+	unitsOut = 0;
+	activeHwAccel = null;
+	constructor(deps, args) {
+		this.deps = deps;
+		this.args = args;
+	}
+	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
+	async start() {
+		const requested = this.args.invocation.decodeHwAccel;
+		this.activeHwAccel = requested;
+		try {
+			await this.spawnAttempt(requested);
+			return;
+		} catch (err) {
+			if (this.stopped) throw err;
+			if (requested === null || isSoftwareDecode(requested)) throw err;
+			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					decodeHwAccel: requested,
+					error: errMsg$15(err)
+				}
+			});
+			this.killChild();
+			this.splitter = new Fmp4BoxSplitter();
+			this.activeHwAccel = null;
+			await this.spawnAttempt(null);
+		}
+	}
+	/** The backend the child ACTUALLY ran with — `null` for software. */
+	activeDecodeHwAccel() {
+		const value = this.activeHwAccel;
+		return value === null || value === "none" || value === "copy" ? null : value;
+	}
+	/** Kill ffmpeg and end the plane. Idempotent. */
+	async stop() {
+		if (this.stopped) return;
+		this.stopped = true;
+		this.killChild();
+		this.args.plane.end("the fragment child stopped");
+	}
+	spawnAttempt(decodeHwAccel) {
+		const args = buildFfmpegArgs({
+			...this.args.invocation,
+			decodeHwAccel,
+			sink: {
+				kind: "stdout",
+				container: "mp4",
+				fragmentMs: this.args.fragmentMs
+			}
+		});
+		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				fragmentMs: this.args.fragmentMs,
+				decodeHwAccel: decodeHwAccel ?? "software",
+				argv: args.join(" ")
+			}
+		});
+		return new Promise((resolve, reject) => {
+			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			] });
+			this.child = child;
+			let settled = false;
+			/**
+			* This attempt FAILED. Set before the kill, because SIGTERM makes the
+			* child exit and that exit must not be reported as a death: the retry —
+			* or the caller's rejection — already owns what happens next. Without it
+			* the timeout path ends the plane the software retry is about to fill,
+			* and the consumer sees a stream that stopped for no reason. A "which
+			* spawn is current" counter does NOT cover this: the retry has not been
+			* spawned when the kill's exit arrives.
+			*/
+			let failed = false;
+			/**
+			* This attempt is still the live producer: it has not failed (a failure
+			* hands ownership to the retry, or to the caller's rejection) and nothing
+			* has stopped the child. Those two cover every way an attempt stops being
+			* current — `start` only respawns after a rejection.
+			*/
+			const isCurrent = () => !this.stopped && !failed;
+			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
+			const settle = (fail) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				if (fail) {
+					failed = true;
+					reject(fail);
+				} else resolve();
+			};
+			const timer = setTimeout(() => {
+				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
+				this.killChild();
+			}, timeoutMs);
+			timer.unref?.();
+			child.stdout?.on("data", (chunk) => {
+				for (const unit of this.splitter.push(chunk)) {
+					this.unitsOut += 1;
+					this.args.plane.publish(unit);
+					if (unit.kind === "init") {
+						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
+							tags: { deviceId: this.args.deviceId },
+							meta: {
+								sourceId: this.args.sourceId,
+								bytes: unit.data.length
+							}
+						});
+						settle();
+					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
+						tags: { deviceId: this.args.deviceId },
+						meta: {
+							sourceId: this.args.sourceId,
+							unitsOut: this.unitsOut,
+							bytes: unit.data.length,
+							subscribers: this.args.plane.subscriberCount
+						}
+					});
+				}
+				const fault = this.splitter.fault;
+				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
+			});
+			child.stderr?.setEncoding("utf8");
+			child.stderr?.on("data", (line) => {
+				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						line: line.trim()
+					}
+				});
+			});
+			child.once("error", (err) => {
+				if (!settled) {
+					settle(err);
+					return;
+				}
+				if (!isCurrent()) return;
+				this.args.plane.end("the fragment child errored");
+				this.deps.onChildExit?.(err);
+			});
+			child.once("exit", (code, signal) => {
+				if (!settled) {
+					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
+					return;
+				}
+				if (!isCurrent()) return;
+				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
+				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						code,
+						signal,
+						unitsOut: this.unitsOut
+					}
+				});
+				this.args.plane.end("the fragment child exited");
+				this.deps.onChildExit?.(error);
+			});
+		});
+	}
+	/**
+	* The byte stream stopped being splittable. Not recoverable — the splitter
+	* cannot resynchronise mid-box — so the child is a corpse and every consumer
+	* has to be told, loudly, with the reason.
+	*/
+	onFault(reason, wasLive, current, settle) {
+		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
+		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				unitsOut: this.unitsOut,
+				interstitial: this.splitter.discardedInterstitialTypes,
+				reason
+			}
+		});
+		this.killChild();
+		settle(error);
+		if (wasLive && current) {
+			this.args.plane.end("the fragment child produced unsplittable output");
+			this.deps.onChildExit?.(error);
+		}
+	}
+	killChild() {
+		const child = this.child;
+		this.child = null;
+		if (child && !child.killed) try {
+			child.kill("SIGTERM");
+		} catch (err) {
+			this.deps.logger.warn("fmp4 fragment child: kill error", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					error: errMsg$15(err)
+				}
+			});
+		}
+	}
+};
 /**
 * Fmp4FragmentPlane — a SUBSCRIBABLE fragmented-MP4 plane, fed by one
 * {@link import('./fmp4-box-splitter.js').Fmp4BoxSplitter}.
@@ -39127,221 +39449,32 @@ var Fmp4FragmentPlane = class {
 		}
 	}
 };
-var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
-/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
-var FRAGMENT_LOG_EVERY = 30;
-var Fmp4FragmentChild = class {
-	deps;
-	args;
-	child = null;
-	splitter = new Fmp4BoxSplitter();
-	stopped = false;
-	unitsOut = 0;
-	activeHwAccel = null;
-	constructor(deps, args) {
-		this.deps = deps;
-		this.args = args;
-	}
-	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
-	async start() {
-		const requested = this.args.invocation.decodeHwAccel;
-		this.activeHwAccel = requested;
-		try {
-			await this.spawnAttempt(requested);
-			return;
-		} catch (err) {
-			if (this.stopped) throw err;
-			if (requested === null || isSoftwareDecode(requested)) throw err;
-			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
-				tags: { deviceId: this.args.deviceId },
-				meta: {
-					sourceId: this.args.sourceId,
-					decodeHwAccel: requested,
-					error: errMsg$15(err)
-				}
-			});
-			this.killChild();
-			this.splitter = new Fmp4BoxSplitter();
-			this.activeHwAccel = null;
-			await this.spawnAttempt(null);
-		}
-	}
-	/** The backend the child ACTUALLY ran with — `null` for software. */
-	activeDecodeHwAccel() {
-		const value = this.activeHwAccel;
-		return value === null || value === "none" || value === "copy" ? null : value;
-	}
-	/** Kill ffmpeg and end the plane. Idempotent. */
-	async stop() {
-		if (this.stopped) return;
-		this.stopped = true;
-		this.killChild();
-		this.args.plane.end("the fragment child stopped");
-	}
-	spawnAttempt(decodeHwAccel) {
-		const args = buildFfmpegArgs({
-			...this.args.invocation,
-			decodeHwAccel,
-			sink: {
-				kind: "stdout",
-				container: "mp4",
-				fragmentMs: this.args.fragmentMs
-			}
-		});
-		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
-			tags: { deviceId: this.args.deviceId },
-			meta: {
-				sourceId: this.args.sourceId,
-				fragmentMs: this.args.fragmentMs,
-				decodeHwAccel: decodeHwAccel ?? "software",
-				argv: args.join(" ")
-			}
-		});
-		return new Promise((resolve, reject) => {
-			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			] });
-			this.child = child;
-			let settled = false;
-			/**
-			* This attempt FAILED. Set before the kill, because SIGTERM makes the
-			* child exit and that exit must not be reported as a death: the retry —
-			* or the caller's rejection — already owns what happens next. Without it
-			* the timeout path ends the plane the software retry is about to fill,
-			* and the consumer sees a stream that stopped for no reason. A "which
-			* spawn is current" counter does NOT cover this: the retry has not been
-			* spawned when the kill's exit arrives.
-			*/
-			let failed = false;
-			/**
-			* This attempt is still the live producer: it has not failed (a failure
-			* hands ownership to the retry, or to the caller's rejection) and nothing
-			* has stopped the child. Those two cover every way an attempt stops being
-			* current — `start` only respawns after a rejection.
-			*/
-			const isCurrent = () => !this.stopped && !failed;
-			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
-			const settle = (fail) => {
-				if (settled) return;
-				settled = true;
-				clearTimeout(timer);
-				if (fail) {
-					failed = true;
-					reject(fail);
-				} else resolve();
-			};
-			const timer = setTimeout(() => {
-				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
-				this.killChild();
-			}, timeoutMs);
-			timer.unref?.();
-			child.stdout?.on("data", (chunk) => {
-				for (const unit of this.splitter.push(chunk)) {
-					this.unitsOut += 1;
-					this.args.plane.publish(unit);
-					if (unit.kind === "init") {
-						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
-							tags: { deviceId: this.args.deviceId },
-							meta: {
-								sourceId: this.args.sourceId,
-								bytes: unit.data.length
-							}
-						});
-						settle();
-					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
-						tags: { deviceId: this.args.deviceId },
-						meta: {
-							sourceId: this.args.sourceId,
-							unitsOut: this.unitsOut,
-							bytes: unit.data.length,
-							subscribers: this.args.plane.subscriberCount
-						}
-					});
-				}
-				const fault = this.splitter.fault;
-				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
-			});
-			child.stderr?.setEncoding("utf8");
-			child.stderr?.on("data", (line) => {
-				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
-					tags: { deviceId: this.args.deviceId },
-					meta: {
-						sourceId: this.args.sourceId,
-						line: line.trim()
-					}
-				});
-			});
-			child.once("error", (err) => {
-				if (!settled) {
-					settle(err);
-					return;
-				}
-				if (!isCurrent()) return;
-				this.args.plane.end("the fragment child errored");
-				this.deps.onChildExit?.(err);
-			});
-			child.once("exit", (code, signal) => {
-				if (!settled) {
-					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
-					return;
-				}
-				if (!isCurrent()) return;
-				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
-				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
-					tags: { deviceId: this.args.deviceId },
-					meta: {
-						sourceId: this.args.sourceId,
-						code,
-						signal,
-						unitsOut: this.unitsOut
-					}
-				});
-				this.args.plane.end("the fragment child exited");
-				this.deps.onChildExit?.(error);
-			});
-		});
-	}
-	/**
-	* The byte stream stopped being splittable. Not recoverable — the splitter
-	* cannot resynchronise mid-box — so the child is a corpse and every consumer
-	* has to be told, loudly, with the reason.
-	*/
-	onFault(reason, wasLive, current, settle) {
-		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
-		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
-			tags: { deviceId: this.args.deviceId },
-			meta: {
-				sourceId: this.args.sourceId,
-				unitsOut: this.unitsOut,
-				interstitial: this.splitter.discardedInterstitialTypes,
-				reason
-			}
-		});
-		this.killChild();
-		settle(error);
-		if (wasLive && current) {
-			this.args.plane.end("the fragment child produced unsplittable output");
-			this.deps.onChildExit?.(error);
-		}
-	}
-	killChild() {
-		const child = this.child;
-		this.child = null;
-		if (child && !child.killed) try {
-			child.kill("SIGTERM");
-		} catch (err) {
-			this.deps.logger.warn("fmp4 fragment child: kill error", {
-				tags: { deviceId: this.args.deviceId },
-				meta: {
-					sourceId: this.args.sourceId,
-					error: errMsg$15(err)
-				}
-			});
-		}
-	}
-};
+/**
+* Compute the stable 64-char lowercase-hex fingerprint of a device's
+* export-relevant shape. Two structurally-equal shapes (any feature order,
+* any duplicates, any deviceId) hash identically.
+*/
+function canonicalDeviceFingerprint(shape) {
+	const features = [...new Set(shape.features)].toSorted();
+	return canonicalHash({
+		deviceType: shape.deviceType,
+		features
+	});
+}
+/**
+* Resolve the fingerprint an exporter should feed into `diffExportTargets`
+* for one device this cycle.
+*
+* When a device is NOT yet probe-ready, carry forward its last-advertised
+* (persisted) fingerprint so it nets to NO CHANGE in `diffExportTargets`
+* (neither update nor remove) — never advertise a partial mid-probe shape. A
+* brand-new un-probed device with no persisted entry falls back to `fresh` so
+* it can advertise once.
+*/
+function resolveExportFingerprint(input) {
+	if (input.ready) return input.fresh;
+	return input.persisted ?? input.fresh;
+}
 //#endregion
 //#region ../../node_modules/tslib/tslib.es6.mjs
 var tslib_es6_exports = /* @__PURE__ */ __exportAll({