@camstack/addon-google-services 0.2.40 → 0.2.41

package/dist/google-services.addon.js

@@ -5985,7 +5985,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BX_MqzUe.mjs
+//#region ../types/dist/sleep-CdKka2ri.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6669,137 +6669,95 @@ async function runAddonMigrations(host, migrations, logger, options = {}) {
 		blockOwner
 	};
 }
-/**
-* Build a {@link DurableState} over a single store key. Transport-agnostic:
-* `read`/`write` are the addon-store or device-store accessors. The whole
-* validated value round-trips on every read/write — the schema is the
-* single source of truth for what is persisted, so no hand-listed field
-* set can drop a key on save.
-*/
-function createDurableState(deps) {
-	const get = async () => {
-		const raw = (await deps.read())[deps.key];
-		if (raw === void 0) return deps.fallback;
-		const parsed = deps.schema.safeParse(raw);
-		if (!parsed.success) {
-			deps.onParseError?.(deps.key, parsed.error);
-			return deps.fallback;
-		}
-		return parsed.data;
-	};
-	const set = async (next) => {
-		const validated = deps.schema.parse(next);
-		await deps.write({ [deps.key]: validated });
-	};
-	const update = async (fn) => {
-		await set(fn(await get()));
-	};
+/** The record calls the one-switch migration makes, over the migration API. */
+function switchRecordsOverMigrationApi(api) {
+	return { kind: (definition) => {
+		const handle = api.records.kind(definition);
+		return {
+			get: (id) => handle.get({ id }),
+			put: (input, opts) => handle.put({
+				...input,
+				...opts?.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+			}),
+			patch: (id, partial) => handle.patch({
+				id,
+				partial
+			})
+		};
+	} };
+}
+function integrationRowsApiOver(api) {
 	return {
-		get,
-		set,
-		update
+		list: async () => (await api.integrations.list({})).integrations,
+		readLegacyIntegrationRows: (input) => api.legacyRows.read(input),
+		clearLegacyIntegrationRows: (input) => api.legacyRows.clear(input)
 	};
 }
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
 /**
-* Per-node scoping for the shared addon-settings blob.
-*
-* An addon's settings store is hub-central (the `addon-settings` cap is
-* hub-routed — the hub instance answers for every node), so fields whose
-* value is a NODE fact (decoder backend, engine pick, probed hardware
-* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
-* the single shared blob. The SCHEMA field key stays bare: the write path
-* ({@link scopePatch}) maps the bare field onto the target node's scoped
-* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
-* back, so UI forms and `resolveConfig` only ever see the bare key.
-*
-* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
-* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
-* schema and routes reads/writes through these helpers.
-*
-* ## No bare-key fallback — deliberate
-*
-* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
-* scoped key resolves to `undefined` so the field's schema `default` wins —
-* NEVER `store[base]` and never another node's value. A bare legacy key in
-* the store is invisible to every node, hub included, so one node's
-* selection can never leak onto another. (This generalizes the
-* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
-* arbitrary set of per-node field keys.)
-*
-* Pure functions only — no I/O, no imports beyond the language. This is a
-* LEAF module: import it via its deep path, never from the root barrel.
-*/
-/**
-* Normalize a raw kernel node id to the bare node id used for scoping.
-* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
-* processes; per-node settings are per-NODE, so strip the addon segment.
-* `undefined` / `null` / empty falls back to `'hub'`.
-*/
-function normalizeNodeId(raw) {
-	if (raw === void 0 || raw === null || raw === "") return "hub";
-	const slashIdx = raw.indexOf("/");
-	if (slashIdx < 0) return raw;
-	const bare = raw.slice(0, slashIdx);
-	return bare === "" ? "hub" : bare;
-}
-/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
-function nodeScopedKey(base, nodeId) {
-	return `${base}@${normalizeNodeId(nodeId)}`;
-}
-/**
-* Read a node's value for a per-node field from the raw shared store:
-* the node-scoped key when present, otherwise `undefined`.
-* Deliberately NO bare-key fallback (see module doc) — the caller lets the
-* schema `default` win on `undefined`.
+* The link primitive's declaration half (D1013 rule 5): what a link field names and how a kind
+* records it. Split from `instance-link.ts` so `RecordIntegrationInstances` can read the links of
+* its kind without importing the builders that import it.
 */
-function readNodeValue(store, base, nodeId) {
-	return store[nodeScopedKey(base, nodeId)];
+/** The body field of a link: the id of the instance it names; the target rides in the field meta. */
+function linkField(target) {
+	return string().meta({ link: target });
 }
-/**
-* Re-map a UI/settings patch so every bare perNode field persists under the
-* TARGET node's scoped key; all other keys pass through unchanged. Used on
-* the write path so a save for one node never clobbers another node's value
-* (and the bare key is never written). Returns a new object — the input
-* patch is not mutated.
-*/
-function scopePatch(patch, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
-	return out;
+function linkTargetOf(meta) {
+	if (typeof meta !== "object" || meta === null) return void 0;
+	const link = Reflect.get(meta, "link");
+	const parsed = LinkTargetSchema.safeParse(link);
+	return parsed.success ? parsed.data : void 0;
 }
-/**
-* Project the raw shared store onto the bare schema keys for ONE node so a
-* UI schema (whose field keys are bare) hydrates from that node's own
-* values:
-*
-* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
-* - Every bare perNode key is dropped from the pass-through (a stray bare
-*   legacy key must never hydrate any node — no bare fallback).
-* - THIS node's effective value ({@link readNodeValue}) is then laid onto
-*   each bare perNode key; when the node has no scoped key the bare key is
-*   left ABSENT so the field's schema `default` wins.
-*
-* Returns a new object — the input store is not mutated.
-*/
-function projectStore(store, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(store)) {
-		if (key.includes("@")) continue;
-		if (perNodeKeys.has(key)) continue;
-		out[key] = value;
-	}
-	for (const base of perNodeKeys) {
-		const value = readNodeValue(store, base, nodeId);
-		if (value !== void 0) out[base] = value;
+var LinkTargetSchema = object({
+	cap: string().min(1),
+	kind: string().min(1).optional()
+});
+/** The links a kind declares, read from the meta of its body fields. */
+function linksOfKind(kind) {
+	const schema = kind.schema;
+	if (!(schema instanceof ZodObject)) return [];
+	const links = [];
+	for (const [field, fieldSchema] of Object.entries(schema.shape)) {
+		const to = linkTargetOf(globalRegistry.get(fieldSchema));
+		if (to !== void 0) links.push({
+			field,
+			to
+		});
 	}
-	return out;
+	return links;
 }
-/** Every scope, in the order the guard and the docs list them. */
-var SCOPED_SETTINGS_SCOPES = [
-	"cluster",
-	"device-defaults",
-	"node"
-];
 /**
 * The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
 *
@@ -6934,6 +6892,643 @@ function parseSecretRef(ref) {
 		fieldPath
 	};
 }
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each,
+			map
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$6(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$6(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$6(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	if (segment.map) {
+		if (!isRecord$6(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* A stored secret, as an admin read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by ref
+* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
+* stored secret (the records door reads a view as KEEP).
+*
+* ONE implementation for the entries service and for every addon that serves
+* its own instances (`RecordIntegrationInstances`).
+*/
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function secretViewsOf(owner, kind, id, decl, data) {
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord$5(shown) ? shown : data;
+}
+/** The most instances one addon lists (an integrations page, not a table). */
+var INSTANCES_LIST_MAX = 1e3;
+/**
+* The ONE reader of an instance's switch (D996): an absent field means on, so a row written
+* before the field existed needs no migration. Every consumer of an instance body asks this.
+*/
+function isInstanceEnabled(body) {
+	return body.enabled !== false;
+}
+/** The body key of the switch; only {@link RecordIntegrationInstances.setInstanceEnabled} writes it. */
+var SWITCH_KEY = "enabled";
+/** The keys of the kind's secret fields that sit at the top level of the body. */
+function topLevelSecretKeys(paths) {
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+var RecordIntegrationInstances = class {
+	records;
+	kind;
+	hooks;
+	handle;
+	secretKeys;
+	secretMaps;
+	nameField;
+	switchListeners = /* @__PURE__ */ new Set();
+	constructor(records, kind, hooks) {
+		this.records = records;
+		this.kind = kind;
+		this.hooks = hooks;
+		this.handle = records.kind(kind);
+		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
+		this.nameField = kind.declaration.entry?.nameField ?? "name";
+	}
+	/**
+	* One instance read for the addon's own runtime; null when absent. When the keychain is
+	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
+	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
+	*/
+	async readResolved(id) {
+		try {
+			const record = await this.handle.getResolved(id);
+			return record === null ? null : {
+				id,
+				body: record.data,
+				enabled: isInstanceEnabled(record.data),
+				secrets: "resolved"
+			};
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.handle.get(id);
+			if (stored === null) return null;
+			return {
+				id,
+				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
+				enabled: isInstanceEnabled(stored.data),
+				secrets: "unavailable"
+			};
+		}
+	}
+	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
+	async getResolved(id) {
+		return (await this.readResolved(id))?.body ?? null;
+	}
+	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
+	async listResolved() {
+		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
+		const out = [];
+		for (const record of page.records) {
+			const read = await this.readResolved(record.id);
+			if (read !== null) out.push(read);
+		}
+		return out;
+	}
+	viewOf(record) {
+		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
+		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
+		return {
+			id: record.id,
+			name: typeof rawName === "string" ? rawName : record.id,
+			configured: this.hooks.configured(record.data),
+			enabled: isInstanceEnabled(record.data),
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
+		};
+	}
+	describe = async () => {
+		const declared = linksOfKind(this.kind);
+		const links = this.hooks.description.links !== void 0 || declared.length === 0 ? {} : { links: declared.map((link) => ({
+			kind: this.kind.name,
+			field: link.field,
+			to: link.to
+		})) };
+		return {
+			...this.hooks.description,
+			...links,
+			...this.hooks.mintId === void 0 ? {} : { mintsId: true }
+		};
+	};
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
+	listInstances = async () => {
+		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
+	};
+	getInstance = async ({ id }) => {
+		const record = await this.handle.get(id);
+		return record === null ? null : this.viewOf(record);
+	};
+	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
+	createInstance = async ({ id, name, kind, values }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		await this.handle.put({
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
+		}, { ifRev: 0 });
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
+	};
+	updateInstance = async ({ id, name, values }) => {
+		const patch = this.patchOf(values);
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
+	patchOf(values) {
+		const patch = {};
+		for (const [key, value] of Object.entries(values)) {
+			if (value === void 0) continue;
+			if (key === "enabled") continue;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
+			else if (isSecretClear(value)) patch[key] = null;
+			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
+		}
+		return patch;
+	}
+	/**
+	* Listen to the switch of ANY instance of this helper (in the process that serves it). The
+	* durable replacement of the `integration.enabled` / `integration.disabled` events (D8): the
+	* addon reconciles from the record, whichever way it flipped.
+	*/
+	onSwitched(listener) {
+		this.switchListeners.add(listener);
+	}
+	/**
+	* The ONE writer of the switch (D996, D1014): the record body's `enabled`, for every role. A
+	* configured thing is an instance, so an id with no record yet (a default integration that was
+	* never configured) gets its record from `initialBody` before the switch is written.
+	*/
+	setInstanceEnabled = async ({ id, enabled }) => {
+		if (await this.handle.get(id) === null) await this.handle.put({
+			id,
+			data: this.hooks.initialBody(id)
+		}, { ifRev: 0 });
+		await this.handle.patch(id, { [SWITCH_KEY]: enabled });
+		await this.hooks.onChanged?.(id, "enabled");
+		for (const listener of this.switchListeners) await listener(id, enabled);
+		return { ok: true };
+	};
+	/** The row and its keychain refs go together (the records door). */
+	deleteInstance = async ({ id }) => {
+		await this.handle.delete(id);
+		await this.hooks.onChanged?.(id, "deleted");
+		return { ok: true };
+	};
+	testInstance = async (input) => {
+		if (this.hooks.test === void 0) return {
+			success: false,
+			status: "unsupported",
+			error: "This integration declares no connection test"
+		};
+		return this.hooks.test(input);
+	};
+	/** The flat provider object to hand to `registerProvider`. */
+	toProvider() {
+		return {
+			describe: this.describe,
+			instanceFormSchema: this.instanceFormSchema,
+			listInstances: this.listInstances,
+			getInstance: this.getInstance,
+			createInstance: this.createInstance,
+			updateInstance: this.updateInstance,
+			setInstanceEnabled: this.setInstanceEnabled,
+			deleteInstance: this.deleteInstance,
+			testInstance: this.testInstance
+		};
+	}
+};
+/**
+* The one-switch migration (epic #440, step 3). An integration's on/off state used to live in the
+* registry's `enabled` column for a device addon; it now lives only in the instance record's
+* body (`enabled`, D1007 superseded). This moves a registry `enabled = false` into the body, once.
+*
+* For every registry row of the addon that is OFF:
+*  - no record under its id: the record is created from `initialBody(name)` with `enabled: false`
+*    (a default integration that never had settings, Reolink's among them);
+*  - a record whose body states no `enabled`: `enabled: false` is written into it;
+*  - a record that already states `enabled` (either way) is the newer truth and is left alone.
+* A row that is ON writes nothing: an absent field reads as on. A rerun finds every off row with
+* a stated switch and does nothing, so nothing switched off comes back on and nothing switched on
+* goes off. The registry column itself is neither read afterwards nor written; its drop is step 5.
+*
+* It runs in the addon process, BEFORE the addon registers its `integration-instances` provider,
+* which is also why `integrations.list` still answers the stored column at that point.
+*/
+function registrySwitchToBodyId(addonId, date) {
+	return `${addonId}/${date}-registry-switch-to-body`;
+}
+async function moveRegistrySwitchToBody(ports, spec) {
+	const rows = await ports.listIntegrations(spec.addonId);
+	let created = 0;
+	let switched = 0;
+	let kept = 0;
+	for (const row of rows) {
+		if (row.enabled) continue;
+		const body = await ports.readBody(row.id);
+		if (body === null) {
+			if (await ports.createRecord(row.id, {
+				...spec.initialBody(row.name),
+				["enabled"]: false
+			}) === "created") created += 1;
+			else kept += 1;
+			continue;
+		}
+		if ("enabled" in body) {
+			kept += 1;
+			continue;
+		}
+		await ports.switchOff(row.id);
+		switched += 1;
+	}
+	const summary = {
+		integrations: rows.length,
+		off: rows.filter((r) => !r.enabled).length,
+		created,
+		switched,
+		kept
+	};
+	return created === 0 && switched === 0 ? {
+		outcome: "already-done",
+		summary
+	} : {
+		outcome: "done",
+		summary
+	};
+}
+/** A migration entry: an addon states its kind and how a new body starts, nothing else. */
+function registrySwitchToBodyMigration(spec) {
+	return {
+		meta: {
+			id: registrySwitchToBodyId(spec.addonId, spec.date),
+			owner: spec.addonId,
+			level: "addon-state",
+			seq: spec.seq,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Move the registry enabled flag of every switched-off integration into its instance record body, creating the record when there is none",
+			fixtureMark: "enabled"
+		},
+		procedure: (ports) => moveRegistrySwitchToBody(ports, {
+			addonId: spec.addonId,
+			initialBody: spec.initialBody
+		})
+	};
+}
+/** The hub and records sides of {@link registrySwitchToBodyMigration}. */
+function registrySwitchPortsOver(deps) {
+	const handle = deps.records.kind({
+		name: deps.kind.name,
+		declaration: deps.kind.declaration,
+		schema: record(string(), unknown())
+	});
+	return {
+		listIntegrations: async (addonId) => (await deps.api.list()).filter((i) => i.addonId === addonId).map((i) => ({
+			id: i.id,
+			name: i.name,
+			enabled: i.enabled !== false
+		})),
+		readBody: async (id) => (await handle.get(id))?.data ?? null,
+		createRecord: async (id, body) => {
+			if (await handle.get(id) !== null) return "exists";
+			await handle.put({
+				id,
+				data: body
+			}, { ifRev: 0 });
+			return "created";
+		},
+		switchOff: async (id) => {
+			await handle.patch(id, { [SWITCH_KEY]: false });
+		}
+	};
+}
+/**
+* Build a {@link DurableState} over a single store key. Transport-agnostic:
+* `read`/`write` are the addon-store or device-store accessors. The whole
+* validated value round-trips on every read/write — the schema is the
+* single source of truth for what is persisted, so no hand-listed field
+* set can drop a key on save.
+*/
+function createDurableState(deps) {
+	const get = async () => {
+		const raw = (await deps.read())[deps.key];
+		if (raw === void 0) return deps.fallback;
+		const parsed = deps.schema.safeParse(raw);
+		if (!parsed.success) {
+			deps.onParseError?.(deps.key, parsed.error);
+			return deps.fallback;
+		}
+		return parsed.data;
+	};
+	const set = async (next) => {
+		const validated = deps.schema.parse(next);
+		await deps.write({ [deps.key]: validated });
+	};
+	const update = async (fn) => {
+		await set(fn(await get()));
+	};
+	return {
+		get,
+		set,
+		update
+	};
+}
+/**
+* Per-node scoping for the shared addon-settings blob.
+*
+* An addon's settings store is hub-central (the `addon-settings` cap is
+* hub-routed — the hub instance answers for every node), so fields whose
+* value is a NODE fact (decoder backend, engine pick, probed hardware
+* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
+* the single shared blob. The SCHEMA field key stays bare: the write path
+* ({@link scopePatch}) maps the bare field onto the target node's scoped
+* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
+* back, so UI forms and `resolveConfig` only ever see the bare key.
+*
+* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
+* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
+* schema and routes reads/writes through these helpers.
+*
+* ## No bare-key fallback — deliberate
+*
+* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
+* scoped key resolves to `undefined` so the field's schema `default` wins —
+* NEVER `store[base]` and never another node's value. A bare legacy key in
+* the store is invisible to every node, hub included, so one node's
+* selection can never leak onto another. (This generalizes the
+* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
+* arbitrary set of per-node field keys.)
+*
+* Pure functions only — no I/O, no imports beyond the language. This is a
+* LEAF module: import it via its deep path, never from the root barrel.
+*/
+/**
+* Normalize a raw kernel node id to the bare node id used for scoping.
+* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
+* processes; per-node settings are per-NODE, so strip the addon segment.
+* `undefined` / `null` / empty falls back to `'hub'`.
+*/
+function normalizeNodeId(raw) {
+	if (raw === void 0 || raw === null || raw === "") return "hub";
+	const slashIdx = raw.indexOf("/");
+	if (slashIdx < 0) return raw;
+	const bare = raw.slice(0, slashIdx);
+	return bare === "" ? "hub" : bare;
+}
+/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
+function nodeScopedKey(base, nodeId) {
+	return `${base}@${normalizeNodeId(nodeId)}`;
+}
+/**
+* Read a node's value for a per-node field from the raw shared store:
+* the node-scoped key when present, otherwise `undefined`.
+* Deliberately NO bare-key fallback (see module doc) — the caller lets the
+* schema `default` win on `undefined`.
+*/
+function readNodeValue(store, base, nodeId) {
+	return store[nodeScopedKey(base, nodeId)];
+}
+/**
+* Re-map a UI/settings patch so every bare perNode field persists under the
+* TARGET node's scoped key; all other keys pass through unchanged. Used on
+* the write path so a save for one node never clobbers another node's value
+* (and the bare key is never written). Returns a new object — the input
+* patch is not mutated.
+*/
+function scopePatch(patch, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
+	return out;
+}
+/**
+* Project the raw shared store onto the bare schema keys for ONE node so a
+* UI schema (whose field keys are bare) hydrates from that node's own
+* values:
+*
+* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
+* - Every bare perNode key is dropped from the pass-through (a stray bare
+*   legacy key must never hydrate any node — no bare fallback).
+* - THIS node's effective value ({@link readNodeValue}) is then laid onto
+*   each bare perNode key; when the node has no scoped key the bare key is
+*   left ABSENT so the field's schema `default` wins.
+*
+* Returns a new object — the input store is not mutated.
+*/
+function projectStore(store, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(store)) {
+		if (key.includes("@")) continue;
+		if (perNodeKeys.has(key)) continue;
+		out[key] = value;
+	}
+	for (const base of perNodeKeys) {
+		const value = readNodeValue(store, base, nodeId);
+		if (value !== void 0) out[base] = value;
+	}
+	return out;
+}
+/** Every scope, in the order the guard and the docs list them. */
+var SCOPED_SETTINGS_SCOPES = [
+	"cluster",
+	"device-defaults",
+	"node"
+];
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -6944,7 +7539,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$6(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6957,7 +7552,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$6(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -7012,7 +7607,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$6) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -7028,7 +7623,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$6(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -7053,7 +7648,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$6(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -7061,7 +7656,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$6(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -7184,7 +7779,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$6(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -7216,7 +7811,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$5(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -7245,7 +7840,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$5(item) && isRecord$5(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -7256,7 +7851,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$5(value) && isRecord$5(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -7264,7 +7859,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$5(incoming) || !isRecord$5(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -7295,7 +7890,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$5(a) && isRecord$5(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -7319,7 +7914,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$5(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7816,13 +8411,48 @@ var BaseAddon = class {
 		if (api === void 0) throw new Error(`${this.ctx.id}: the migration API is not available on this context`);
 		return this.runBound(sets.flatMap((set) => set.bind(api)), options);
 	}
-	async runBound(migrations, options) {
+	/**
+	* A device addon states its instance kind once, before its migrations run, and the one-switch
+	* migration (registry `enabled` to the instance body, epic #440 step 3) joins whatever
+	* catalogue the addon runs, in the SAME declaration (the engine replaces an owner's catalogue
+	* on every declare).
+	*/
+	declareRegistrySwitch(spec) {
+		this.registrySwitchSpec = spec;
+	}
+	registrySwitchSpec = null;
+	registrySwitchBound() {
+		const spec = this.registrySwitchSpec;
+		if (spec === null) return [];
+		const api = this.ctx.migrationApi;
+		if (api === void 0) {
+			this.ctx.logger.warn("the registry switch migration is skipped: the migration API is not available on this context");
+			return [];
+		}
+		return migrationSet([registrySwitchToBodyMigration({
+			addonId: this.ctx.id,
+			date: "2026-11-06",
+			seq: 1e3,
+			initialBody: spec.initialBody
+		})], (a) => registrySwitchPortsOver({
+			api: integrationRowsApiOver(a),
+			records: switchRecordsOverMigrationApi(a),
+			kind: spec.kind
+		})).bind(api);
+	}
+	async runBound(declared, options) {
+		const added = this.registrySwitchBound();
+		const migrations = [...declared, ...added];
+		const phased = options?.only === void 0 || added.length === 0 ? options : {
+			...options,
+			only: [...options.only, ...added.map((m) => m.meta.id)]
+		};
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger, options);
+		}, migrations, this.ctx.logger, phased);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -8895,245 +9525,94 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
-var PREFIX = "records/";
-/** The base of every records failure. `detail` is the human part of the message. */
-var RecordsError = class extends Error {
-	code;
-	detail;
-	constructor(code, detail) {
-		super(`${PREFIX}${code}: ${detail}`);
-		this.name = "RecordsError";
-		this.code = code;
-		this.detail = detail;
-	}
-};
-/** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
-	constructor(detail) {
-		super("secret-unavailable", detail);
-		this.name = "RecordSecretUnavailableError";
-	}
-};
-var InvalidRecordError = class extends RecordsError {
-	constructor(detail) {
-		super("invalid-record", detail);
-		this.name = "InvalidRecordError";
-	}
-};
-/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
-	constructor(detail) {
-		super("declaration-refused", detail);
-		this.name = "DeclarationRefusedError";
-	}
-};
-/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
-/** The files a kind may live in. `history` is device-history's (D850), never records. */
-var RECORD_DATABASES = ["settings", "events"];
-/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
-var RECORD_CLASSES = [
-	"config",
-	"ledger",
-	"audit",
-	"mirror",
-	"ephemeral"
-];
-var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
-var RECORD_MAX_DATA_BYTES = 1024 * 1024;
-var RECORD_BATCH_MAX = 1e3;
-var RECORD_QUERY_MAX = 1e3;
-/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
-var RECORD_SETTINGS_MAX_ROWS = 5e4;
-/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
-var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+object({
+	field: string().min(1),
+	on: literal("advance")
+});
 /**
-* Secret fields of a record, addressed the way a Zod schema declares them
-* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
-* (`auth.accessToken`, `headers[].value`).
-*
-* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
-* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
-* key releases exactly that key's secret.
+* Output schema shared by the contribution + live methods.
 *
-* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
-* `{ headers: 'name' }`), never by index, so reordering a list keeps every
-* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
-* leaf names its element: `headers[X-Api].value`.
+* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
+* tabs[]) without importing from `../interfaces/config-ui.js` — a
+* concrete-but-lenient Zod object keeps tRPC output inference happy
+* (using `z.unknown()` here collapses unrelated router branches to
+* `unknown` when the generator re-inlines the huge AppRouter type).
 *
-* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
-*/
-/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
-function parseSecretPath(path) {
-	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
-	return path.split(".").map((raw) => {
-		const each = raw.endsWith("[]");
-		const map = raw.endsWith("{}");
-		const key = each || map ? raw.slice(0, -2) : raw;
-		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
-		return {
-			key,
-			each,
-			map
-		};
-	});
-}
-/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
-function secretArrayPrefixes(path) {
-	const segments = parseSecretPath(path);
-	const prefixes = [];
-	const walked = [];
-	for (const segment of segments) {
-		walked.push(segment.key);
-		if (segment.each) prefixes.push(walked.join("."));
-	}
-	return prefixes;
-}
-function isRecord$4(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function elementId(element, idKey, declared, prefix) {
-	const id = isRecord$4(element) ? element[idKey] : void 0;
-	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
-	return id;
-}
-/**
-* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
-* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
-* result is a new body, `data` is untouched.
+* `.passthrough()` on sections/fields accepts whatever FormBuilder
+* extensions the caller adds (showWhen, displayScale, …) without
+* rebuilding every time a new field kind is introduced.
 */
-var REMOVE_LEAF = Symbol("remove-leaf");
-function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
-	if (!isRecord$4(node)) return node;
-	const segment = segments[index];
-	if (segment === void 0) return node;
-	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
-	const child = node[segment.key];
-	const keys = [...walkedKeys, segment.key];
-	const last = index === segments.length - 1;
-	if (segment.each) {
-		if (!Array.isArray(child)) return node;
-		const prefix = keys.join(".");
-		const idKey = arrayKeys[prefix];
-		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
-		const mapped = child.map((element) => {
-			const id = elementId(element, idKey, declared, prefix);
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
-			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
-		});
-		return {
-			...node,
-			[segment.key]: mapped
-		};
-	}
-	if (segment.map) {
-		if (!isRecord$4(child)) return node;
-		const kept = Object.entries(child).map(([mapKey, value]) => {
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
-			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
-			return [mapKey, visit({
-				declared,
-				concrete,
-				value
-			})];
-		}).filter(([, value]) => value !== REMOVE_LEAF);
-		return {
-			...node,
-			[segment.key]: Object.fromEntries(kept)
-		};
-	}
-	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
-	if (last) {
-		const replacement = visit({
-			declared,
-			concrete,
-			value: child
-		});
-		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
-		return {
-			...node,
-			[segment.key]: replacement
-		};
-	}
+var ContributionSectionSchema = object({
+	id: string(),
+	title: string(),
+	description: string().optional(),
+	style: _enum(["card", "accordion"]).optional(),
+	defaultCollapsed: boolean().optional(),
+	columns: union([
+		literal(1),
+		literal(2),
+		literal(3),
+		literal(4)
+	]).optional(),
+	tab: string().optional(),
+	location: _enum([
+		"settings",
+		"top-tab",
+		"hero"
+	]).optional(),
+	order: number().optional(),
+	fields: array(any())
+});
+object({
+	tabs: array(object({
+		id: string(),
+		label: string(),
+		icon: string(),
+		order: number().optional()
+	})).optional(),
+	sections: array(ContributionSectionSchema)
+}).nullable();
+object({ deviceId: number() }), object({ deviceId: number() }), object({
+	deviceId: number(),
+	patch: record(string(), unknown())
+}), object({ success: literal(true) });
+object({ deviceId: number() }), unknown().nullable();
+function method(input, output, options) {
 	return {
-		...node,
-		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
+		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.role !== void 0 ? { role: options.role } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
+		timeoutMs: options?.timeoutMs
 	};
 }
-/** Replace/remove every present secret leaf; returns a NEW body. */
-function mapSecretLeaves(data, paths, arrayKeys, visit) {
-	let current = data;
-	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
-	return current;
-}
 /**
-* The keychain collection name a kind's secrets live under. Prefixed so a
-* record's refs never collide with the refs a legacy collection of the same name
-* already holds during an adoption.
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
 */
-function recordSecretCollection(kind) {
-	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
-}
-/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
-function recordSecretRef(owner, kind, rowId, concretePath) {
-	return buildSecretRef({
-		owner,
-		scope: {
-			kind: "row",
-			collection: recordSecretCollection(kind),
-			rowId
-		},
-		fieldPath: concretePath
-	});
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
 }
 /**
-* A stored secret, as an admin read shows it: a VIEW naming the row's own
-* keychain ref (`set: true`), never the value and no longer the bare redaction
-* token. The form hands it to the secret field, which reveals the value by ref
-* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
-* stored secret (the records door reads a view as KEEP).
-*
-* ONE implementation for the entries service and for every addon that serves
-* its own instances (`RecordIntegrationInstances`).
+* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
+* on `InferProvider`. The `providerOptional: true` literal is what
+* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
+* for when this is the honest answer and when it is a soft stub.
 */
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function secretViewsOf(owner, kind, id, decl, data) {
-	if (decl.secretPaths.length === 0) return data;
-	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
-		if (leaf.value !== "__camstack_redacted__") return leaf.value;
-		return {
-			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
-			v: 1,
-			set: true
-		};
-	});
-	return isRecord$3(shown) ? shown : data;
+function optionalMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		providerOptional: true
+	};
 }
-/**
-* The share-view scope kinds a share-link token can carry. The hub mints
-* and validates them (`ShareViewGrantSchema` builds its
-* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
-*/
-var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
-/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
-var PeerBytesTicketSchema = object({
-	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
-	url: string().min(1),
-	/**
-	* The HOST node this URL means something on — the hub or a named agent,
-	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
-	* refuses `cross-node` by name when they differ, without dialling.
-	*/
-	hostNodeId: string().min(1),
-	expiresAtMs: number().int().nonnegative(),
-	/**
-	* What the producer DECLARED the body to be, when it knows — `null` when it
-	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
-	* must be able to tell "the producer did not say" from "the body is empty".
-	*/
-	declaredBytes: number().int().nonnegative().nullable()
-});
 function defOf(schema) {
 	const zodBag = Reflect.get(schema, "_zod");
 	if (typeof zodBag !== "object" || zodBag === null) return {};
@@ -9363,6 +9842,7 @@ function defineRecordKinds(specs) {
 function entryBody(shape) {
 	return object({
 		name: string().min(1),
+		enabled: boolean().optional(),
 		...shape
 	});
 }
@@ -9389,94 +9869,30 @@ function defineEntryKind(name, spec) {
 	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
 	return defined;
 }
-object({
-	field: string().min(1),
-	on: literal("advance")
-});
 /**
-* Output schema shared by the contribution + live methods.
-*
-* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
-* tabs[]) without importing from `../interfaces/config-ui.js` — a
-* concrete-but-lenient Zod object keeps tRPC output inference happy
-* (using `z.unknown()` here collapses unrelated router branches to
-* `unknown` when the generator re-inlines the huge AppRouter type).
-*
-* `.passthrough()` on sections/fields accepts whatever FormBuilder
-* extensions the caller adds (showWhen, displayScale, …) without
-* rebuilding every time a new field kind is introduced.
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
 */
-var ContributionSectionSchema = object({
-	id: string(),
-	title: string(),
-	description: string().optional(),
-	style: _enum(["card", "accordion"]).optional(),
-	defaultCollapsed: boolean().optional(),
-	columns: union([
-		literal(1),
-		literal(2),
-		literal(3),
-		literal(4)
-	]).optional(),
-	tab: string().optional(),
-	location: _enum([
-		"settings",
-		"top-tab",
-		"hero"
-	]).optional(),
-	order: number().optional(),
-	fields: array(any())
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: string().min(1),
+	expiresAtMs: number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: number().int().nonnegative().nullable()
 });
-object({
-	tabs: array(object({
-		id: string(),
-		label: string(),
-		icon: string(),
-		order: number().optional()
-	})).optional(),
-	sections: array(ContributionSectionSchema)
-}).nullable();
-object({ deviceId: number() }), object({ deviceId: number() }), object({
-	deviceId: number(),
-	patch: record(string(), unknown())
-}), object({ success: literal(true) });
-object({ deviceId: number() }), unknown().nullable();
-function method(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		...options?.auth !== void 0 ? { auth: options.auth } : {},
-		...options?.access !== void 0 ? { access: options.access } : {},
-		...options?.role !== void 0 ? { role: options.role } : {},
-		...options?.caller !== void 0 ? { caller: options.caller } : {},
-		timeoutMs: options?.timeoutMs
-	};
-}
-/**
-* A wrapper/system-only method: served exclusively by the cap's system-level
-* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
-* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
-* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
-*/
-function systemMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		systemOnly: true
-	};
-}
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
-function optionalMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		providerOptional: true
-	};
-}
 var READING_QUANTITIES = [
 	"temperature",
 	"pressure",
@@ -10055,7 +10471,6 @@ var CAP_NAMES = Object.freeze([
 	"climate-control",
 	"color",
 	"composer",
-	"connection-test",
 	"connectivity",
 	"consumables",
 	"contact",
@@ -11202,6 +11617,10 @@ Object.freeze({
 				"all",
 				"one"
 			]
+		},
+		{
+			"path": "positionUpdatedAt",
+			"valueType": "number"
 		}
 	],
 	"meter": [{
@@ -11456,22 +11875,6 @@ Object.freeze({
 			"path": "pumpRunning",
 			"valueType": "boolean"
 		},
-		{
-			"path": "lastDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "currentHourDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "last24hDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "todayDrink",
-			"valueType": "number"
-		},
 		{
 			"path": "error",
 			"valueType": "string"
@@ -12037,6 +12440,59 @@ Object.freeze({
 		}
 	]
 });
+Object.freeze({
+	"actions": { "run": 363e4 },
+	"audio-analyzer": { "classify": 3e4 },
+	"custom-model-registry": { "importModelBundle": 18e5 },
+	"database-snapshot": { "writeSnapshot": 18e5 },
+	"device-manager": {
+		"migrateDevice": 72e4,
+		"runDiscoverySweep": 12e4
+	},
+	"device-provider": { "reloadDevice": 18e4 },
+	"llm": {
+		"generate": 6e5,
+		"generateVision": 6e5,
+		"testProfile": 6e5
+	},
+	"llm-runtime": {
+		"complete": 6e5,
+		"completeApple": 6e5,
+		"ensureStarted": 6e5,
+		"installModel": 36e5
+	},
+	"local-network": { "scanNetwork": 9e4 },
+	"model-convert": { "convert": 6e5 },
+	"pipeline-analytics": {
+		"addRetrainFrameFromRecording": 6e4,
+		"offerRetrainArchive": 12e4,
+		"proposeRetrainAnnotationsWithLlm": 18e4,
+		"resolveRetrainTrainingCorpus": 6e4,
+		"writeRetrainArchive": 36e5
+	},
+	"server-management": { "applyServerUpdate": 96e4 },
+	"terminal-session": { "pullOutput": 15e3 },
+	"training": {
+		"canaryResult": 12e4,
+		"cancelJob": 12e4,
+		"planJob": 6e4,
+		"registerResult": 18e5,
+		"rollbackCanary": 12e4,
+		"startJob": 12e4,
+		"startJobBatch": 12e4
+	},
+	"training-provider": {
+		"cancelJob": 6e4,
+		"cleanupJob": 3e5,
+		"getJob": 6e4,
+		"listJobEvents": 6e4,
+		"listJobs": 12e4,
+		"offerArtifact": 3e5,
+		"readResult": 3e5,
+		"submitJob": 18e5,
+		"uploadDataset": 72e5
+	}
+});
 object({
 	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
 	params: record(string(), union([string(), number()])).optional()
@@ -12056,7 +12512,7 @@ function userError(code, params, englishFallback) {
 	return new CamstackError(code, params, englishFallback);
 }
 //#endregion
-//#region ../types/dist/composition-pOHbTzRB.mjs
+//#region ../types/dist/composition-BmBHuDTQ.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12360,7 +12816,7 @@ var table = {
 	},
 	dwell: {
 		minArgs: 3,
-		maxArgs: 3,
+		maxArgs: 4,
 		apply: () => {
 			throw new ExpressionEvalError("dwell: stateful evaluation context is required");
 		}
@@ -13520,254 +13976,6 @@ function buildCapturingReply(envelope) {
 	};
 	return wrapper;
 }
-/**
-* The link primitive's declaration half (D1013 rule 5): what a link field names and how a kind
-* records it. Split from `instance-link.ts` so `RecordIntegrationInstances` can read the links of
-* its kind without importing the builders that import it.
-*/
-/** The body field of a link: the id of the instance it names; the target rides in the field meta. */
-function linkField(target) {
-	return string().meta({ link: target });
-}
-function linkTargetOf(meta) {
-	if (typeof meta !== "object" || meta === null) return void 0;
-	const link = Reflect.get(meta, "link");
-	const parsed = LinkTargetSchema.safeParse(link);
-	return parsed.success ? parsed.data : void 0;
-}
-var LinkTargetSchema = object({
-	cap: string().min(1),
-	kind: string().min(1).optional()
-});
-/** The links a kind declares, read from the meta of its body fields. */
-function linksOfKind(kind) {
-	const schema = kind.schema;
-	if (!(schema instanceof ZodObject)) return [];
-	const links = [];
-	for (const [field, fieldSchema] of Object.entries(schema.shape)) {
-		const to = linkTargetOf(globalRegistry.get(fieldSchema));
-		if (to !== void 0) links.push({
-			field,
-			to
-		});
-	}
-	return links;
-}
-/**
-* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
-* entry kind, so an addon that holds a connection serves it in ~30 lines.
-*
-* Every instance is one record of the addon's own kind, keyed by the
-* `integrations` registry id. The records door does the secret work: a field the
-* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
-* deleting the row deletes the secret, and one row's value is never another's.
-*
-* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
-* token or the view the form was given KEEP the stored secret;
-* `{ $secretClear: true }` clears it; any other string replaces it.
-*/
-/** The most instances one addon lists (an integrations page, not a table). */
-var INSTANCES_LIST_MAX = 1e3;
-/** The keys of the kind's secret fields that sit at the top level of the body. */
-function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
-}
-/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
-function secretMapKeys(paths) {
-	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
-}
-/**
-* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
-* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
-* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
-*/
-function secretMapPatch(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-	const out = {};
-	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
-	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
-	return Object.keys(out).length > 0 ? out : null;
-}
-/** Does the kind's body schema carry an `enabled` field? */
-function declaresEnabled(kind) {
-	const json = toJSONSchema(kind.schema, {
-		unrepresentable: "any",
-		io: "input"
-	});
-	const properties = Reflect.get(json, "properties");
-	return typeof properties === "object" && properties !== null && "enabled" in properties;
-}
-var RecordIntegrationInstances = class {
-	records;
-	kind;
-	hooks;
-	handle;
-	secretKeys;
-	secretMaps;
-	nameField;
-	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
-	registryOwnsEnabled;
-	constructor(records, kind, hooks) {
-		this.records = records;
-		this.kind = kind;
-		this.hooks = hooks;
-		this.handle = records.kind(kind);
-		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
-		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
-		this.nameField = kind.declaration.entry?.nameField ?? "name";
-		this.registryOwnsEnabled = hooks.description.role === "devices";
-		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
-	}
-	/**
-	* One instance read for the addon's own runtime; null when absent. When the keychain is
-	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
-	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
-	*/
-	async readResolved(id) {
-		try {
-			const record = await this.handle.getResolved(id);
-			return record === null ? null : {
-				id,
-				body: record.data,
-				enabled: record.data.enabled !== false,
-				secrets: "resolved"
-			};
-		} catch (err) {
-			if (!(err instanceof RecordSecretUnavailableError)) throw err;
-			const stored = await this.handle.get(id);
-			if (stored === null) return null;
-			return {
-				id,
-				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
-				enabled: stored.data.enabled !== false,
-				secrets: "unavailable"
-			};
-		}
-	}
-	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
-	async getResolved(id) {
-		return (await this.readResolved(id))?.body ?? null;
-	}
-	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
-	async listResolved() {
-		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
-		const out = [];
-		for (const record of page.records) {
-			const read = await this.readResolved(record.id);
-			if (read !== null) out.push(read);
-		}
-		return out;
-	}
-	viewOf(record) {
-		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
-		const rawName = record.data[this.nameField];
-		const kind = this.hooks.kindOf?.(record.data);
-		const health = this.hooks.health?.(record.data, record.id);
-		return {
-			id: record.id,
-			name: typeof rawName === "string" ? rawName : record.id,
-			configured: this.hooks.configured(record.data),
-			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
-			formValues: shown,
-			...kind !== void 0 ? { kind } : {},
-			...health?.status !== void 0 ? { status: health.status } : {},
-			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
-		};
-	}
-	describe = async () => {
-		const declared = linksOfKind(this.kind);
-		const links = this.hooks.description.links !== void 0 || declared.length === 0 ? {} : { links: declared.map((link) => ({
-			kind: this.kind.name,
-			field: link.field,
-			to: link.to
-		})) };
-		return {
-			...this.hooks.description,
-			...links,
-			...this.hooks.mintId === void 0 ? {} : { mintsId: true }
-		};
-	};
-	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
-	listInstances = async () => {
-		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
-	};
-	getInstance = async ({ id }) => {
-		const record = await this.handle.get(id);
-		return record === null ? null : this.viewOf(record);
-	};
-	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name, kind, values }) => {
-		const minted = id ?? this.hooks.mintId?.({
-			name,
-			...kind !== void 0 ? { kind } : {}
-		});
-		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
-		await this.handle.put({
-			id: minted,
-			data: this.hooks.initialBody(name, kind)
-		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
-		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
-		await this.hooks.onChanged?.(minted, "created");
-		return { id: minted };
-	};
-	updateInstance = async ({ id, name, values }) => {
-		const patch = this.patchOf(values);
-		if (name !== void 0) patch[this.nameField] = name;
-		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id, "updated");
-		return { ok: true };
-	};
-	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
-	patchOf(values) {
-		const patch = {};
-		for (const [key, value] of Object.entries(values)) {
-			if (value === void 0) continue;
-			if (this.secretMaps.has(key)) {
-				const entries = secretMapPatch(value);
-				if (entries !== null) patch[key] = entries;
-			} else if (!this.secretKeys.has(key)) patch[key] = value;
-			else if (isSecretClear(value)) patch[key] = null;
-			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
-		}
-		return patch;
-	}
-	/** The switch lives in the record body; the addon is told so it applies it (D996). */
-	setInstanceEnabled = async ({ id, enabled }) => {
-		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
-		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id, "enabled");
-		return { ok: true };
-	};
-	/** The row and its keychain refs go together (the records door). */
-	deleteInstance = async ({ id }) => {
-		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id, "deleted");
-		return { ok: true };
-	};
-	testInstance = async (input) => {
-		if (this.hooks.test === void 0) return {
-			success: false,
-			status: "unsupported",
-			error: "This integration declares no connection test"
-		};
-		return this.hooks.test(input);
-	};
-	/** The flat provider object to hand to `registerProvider`. */
-	toProvider() {
-		return {
-			describe: this.describe,
-			instanceFormSchema: this.instanceFormSchema,
-			listInstances: this.listInstances,
-			getInstance: this.getInstance,
-			createInstance: this.createInstance,
-			updateInstance: this.updateInstance,
-			setInstanceEnabled: this.setInstanceEnabled,
-			deleteInstance: this.deleteInstance,
-			testInstance: this.testInstance
-		};
-	}
-};
 /** No part holds the id a call named. */
 var UnknownInstanceError = class extends Error {
 	instanceId;
@@ -13797,6 +14005,17 @@ function composeInstanceKinds(parts, base) {
 		if (part === void 0) throw new UnknownInstanceKindError(kindId);
 		return part;
 	};
+	/**
+	* The part a DRAFT test runs on. A named kind is that kind; an unnamed one is the provider's only
+	* testable kind. Several testable kinds and none named is a typed refusal that lists them, never a throw.
+	*/
+	const draftPart = (kindId) => {
+		if (kindId !== void 0) return parts.find((candidate) => candidate.kind.id === kindId) ?? { error: `Unknown instance kind '${kindId}'` };
+		const testable = parts.filter((part) => part.kind.canTest !== false);
+		const only = testable.length === 1 ? testable[0] : parts.length === 1 ? parts[0] : void 0;
+		if (only !== void 0) return only;
+		return { error: `This provider has several kinds: name one of ${(testable.length > 0 ? testable : parts).map((part) => part.kind.id).join(", ")}` };
+	};
 	const holderOf = async (id) => {
 		for (const part of parts) if (await part.provider.getInstance({ id }) !== null) return part;
 		throw new UnknownInstanceError(id);
@@ -13832,7 +14051,13 @@ function composeInstanceKinds(parts, base) {
 		setInstanceEnabled: async (input) => (await holderOf(input.id)).provider.setInstanceEnabled(input),
 		deleteInstance: async (input) => (await holderOf(input.id)).provider.deleteInstance(input),
 		testInstance: async (input) => {
-			const test = (input.id === null ? byKind(input.kind) : await holderOf(input.id)).provider.testInstance;
+			const resolved = input.id === null ? draftPart(input.kind) : await holderOf(input.id);
+			if ("error" in resolved) return {
+				success: false,
+				status: "inconclusive",
+				error: resolved.error
+			};
+			const test = resolved.provider.testInstance;
 			if (test === void 0) return {
 				success: false,
 				status: "inconclusive",
@@ -13842,6 +14067,432 @@ function composeInstanceKinds(parts, base) {
 		}
 	};
 }
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$4 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$4,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
+	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = object({
+	ok: boolean(),
+	resolvedUrl: string(),
+	httpStatus: number().int().optional(),
+	stateInstance: string().optional(),
+	error: string().optional()
+});
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional(),
+	/**
+	* When editing / duplicating, the blank password field never round-trips
+	* the stored token. Pass the source target id so the provider can restore
+	* secrets server-side before dialling (same merge as upsert).
+	*/
+	targetId: string().optional()
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
+	kind: string(),
+	config: record(string(), unknown()),
+	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+	targetId: string().optional()
+}), ProbeTargetConfigResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	target: TargetSchema,
+	/**
+	* Duplicate flow: create a NEW target id while copying secrets from an
+	* existing row. The UI never holds the stored token; blank / redacted
+	* password fields are restored from this source (D634 still applies if
+	* destinations diverge without a re-typed secret).
+	*/
+	cloneSecretsFrom: string().optional()
+}), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ targetId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+looseObject({
+	name: string().min(1),
+	enabled: boolean().optional()
+});
+TargetSchema.omit({ id: true });
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -20026,31 +20677,21 @@ var APPLIANCE_CAP_VOCABULARY = {
 	"pet-fountain": {
 		scope: "device",
 		noun: t("Pet fountain", "Fontana per animali"),
-		actions: [
-			{
-				id: "petFountain.pumpOn",
-				method: "setPump",
-				label: t("Pump on", "Pompa accesa"),
-				phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
-				icon: "play",
-				args: { on: true }
-			},
-			{
-				id: "petFountain.pumpOff",
-				method: "setPump",
-				label: t("Pump off", "Pompa spenta"),
-				phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
-				icon: "square",
-				args: { on: false }
-			},
-			{
-				id: "petFountain.resetDailyConsumption",
-				method: "resetDailyConsumption",
-				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
-				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
-				icon: "rotate-ccw"
-			}
-		],
+		actions: [{
+			id: "petFountain.pumpOn",
+			method: "setPump",
+			label: t("Pump on", "Pompa accesa"),
+			phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
+			icon: "play",
+			args: { on: true }
+		}, {
+			id: "petFountain.pumpOff",
+			method: "setPump",
+			label: t("Pump off", "Pompa spenta"),
+			phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
+			icon: "square",
+			args: { on: false }
+		}],
 		state: [{
 			kind: "boolean",
 			field: "empty",
@@ -22069,7 +22710,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"calendar-source": system(INTERNAL),
 	calendars: system("calendars feed schedules and conditions, not device actions"),
 	composer: system("device composition — an authoring tool, not an action"),
-	"connection-test": system(INTERNAL),
 	"core-blocks": system(INTERNAL),
 	"custom-model-registry": system(ML),
 	"data-store-provider": system(INTERNAL),
@@ -43795,610 +44435,196 @@ var AutomationRunTraceSchema = object({
 	startedAt: number(),
 	endedAt: number(),
 	trigger: AutomationTriggerTraceSchema,
-	conditions: array(AutomationConditionTraceNodeSchema),
-	verdict: AutomationRunVerdictSchema.optional(),
-	steps: array(AutomationStepTraceSchema),
-	outcome: AutomationRunOutcomeSchema,
-	/** How many identical consecutive skips this trace stands for (>= 1). */
-	repeat: number().int().min(1),
-	/** When the latest of those repeats happened. */
-	lastAt: number(),
-	/**
-	* A scheduler point's own outcome (D983). `outcome` carries the closest
-	* automation outcome so a reader that does not know schedulers still reads
-	* the trace; this field says exactly what happened.
-	*/
-	scheduler: SchedulerOutcomeSchema.optional()
-});
-/**
-* What the hub's `runs` ledger holds for one owner (`automation:<blockId>` or
-* `action:<actionId>`): the cooldown stamp and the trace ring.
-*/
-var AutomationStateDocSchema = object({
-	version: literal(1),
-	lastRunStartedAt: number().nullable(),
-	traces: array(AutomationRunTraceSchema)
-});
-/**
-* Actions — named, runnable things an operator (or an automation) can start,
-* declared as LIST ENTRIES, never as devices.
-*
-* An entry is either **internal** (a short list of cap/wait steps kept in the
-* hub's `actions` record kind) or declared by an addon through the
-* `action-source` collection (a Home Assistant script, a scene …). The one
-* surface the UI and automations talk to is the `actions` cap; it keeps no
-* catalog of its own (D3) — every `list` asks the providers live.
-*
-* This file is the data half: the entry schema, the variables an entry may
-* declare, and the pure resolution of the values a run was given. It holds no
-* runtime.
-*/
-/** What a variable's value is. `select` takes one of `options`. */
-var ActionVariableTypeSchema = _enum([
-	"string",
-	"number",
-	"boolean",
-	"select"
-]);
-var ACTION_VARIABLE_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var ActionVariableValueSchema = union([
-	string(),
-	number(),
-	boolean()
-]);
-/**
-* One declared variable. Steps reference it as `{ $var: 'name' }` (the whole
-* value) or `{{vars.name}}` (inside a string) in their args.
-*/
-var ActionVariableSchema = object({
-	name: string().regex(ACTION_VARIABLE_NAME_RE),
-	label: string().min(1).max(120).optional(),
-	type: ActionVariableTypeSchema,
-	required: boolean().optional(),
-	default: ActionVariableValueSchema.optional(),
-	/** The allowed values of a `select`. */
-	options: array(string().min(1)).min(1).optional()
-}).superRefine((v, ctx) => {
-	if (v.type === "select" && v.options === void 0) ctx.addIssue({
-		code: "custom",
-		message: "a select variable needs options",
-		path: ["options"]
-	});
-	if (v.default !== void 0 && variableValueError(v, v.default) !== null) ctx.addIssue({
-		code: "custom",
-		message: variableValueError(v, v.default) ?? "invalid default",
-		path: ["default"]
-	});
-});
-/** Why `value` is not a legal value for the variable, or null when it is. */
-function variableValueError(variable, value) {
-	switch (variable.type) {
-		case "string": return typeof value === "string" ? null : `variable "${variable.name}" must be a string`;
-		case "number": return typeof value === "number" && Number.isFinite(value) ? null : `variable "${variable.name}" must be a number`;
-		case "boolean": return typeof value === "boolean" ? null : `variable "${variable.name}" must be true or false`;
-		case "select": return typeof value === "string" && (variable.options ?? []).includes(value) ? null : `variable "${variable.name}" must be one of ${(variable.options ?? []).join(", ")}`;
-	}
-}
-var ActionSourceKindSchema = _enum(["internal", "addon"]);
-function isInternalActionId(actionId) {
-	return actionId.startsWith("internal:") && actionId.length > 9;
-}
-/** The addon behind a `<addonId>:<localId>` id, or null for anything else (internal included). */
-function addonIdOfActionId(actionId) {
-	if (isInternalActionId(actionId)) return null;
-	const at = actionId.indexOf(":");
-	return at > 0 && at < actionId.length - 1 ? actionId.slice(0, at) : null;
-}
-var ActionStatusSchema = object({
-	isRunning: boolean(),
-	/** Ms epoch the latest run STARTED; null when it never ran. */
-	lastRunAt: number().nullable(),
-	/** The latest run's failure; null on success or when it never ran. */
-	lastError: string().nullable()
-});
-var ActionEntrySchema = object({
-	/** `internal:<uuid>` or `<addonId>:<localId>`. */
-	id: string().min(3),
-	name: string().min(1).max(120),
-	/** The addon that declared it; `core-blocks` for an internal one. */
-	addonId: string().min(1),
-	source: ActionSourceKindSchema,
-	/** An addon-declared entry is edited where it was declared. */
-	readOnly: boolean(),
-	/** Internal only: cap and wait steps. No action-in-action, so no cycles. */
-	steps: array(ActionStepSchema).min(1).max(50).optional(),
-	variables: array(ActionVariableSchema).max(20).optional(),
-	status: ActionStatusSchema
-}).superRefine((entry, ctx) => {
-	if (entry.source === "internal") {
-		if (!isInternalActionId(entry.id)) ctx.addIssue({
-			code: "custom",
-			message: "an internal action id is internal:<uuid>",
-			path: ["id"]
-		});
-		return;
-	}
-	if (entry.steps !== void 0) ctx.addIssue({
-		code: "custom",
-		message: "only an internal action carries steps",
-		path: ["steps"]
-	});
-	if (!entry.readOnly) ctx.addIssue({
-		code: "custom",
-		message: "an addon action is read-only here",
-		path: ["readOnly"]
-	});
-	if (addonIdOfActionId(entry.id) === null) ctx.addIssue({
-		code: "custom",
-		message: "an addon action id is <addonId>:<localId>",
-		path: ["id"]
-	});
-});
-/** What an operator writes for an internal action. */
-var ActionInputSchema = object({
-	name: string().min(1).max(120),
-	steps: array(ActionStepSchema).min(1).max(50),
-	variables: array(ActionVariableSchema).max(20).optional()
-});
-/** Who started a run. Absent = the operator pressed it. */
-var ActionRunOriginSchema = object({ 
-/** The automation block whose step started it. */
-blockId: string().min(1).optional() });
-/** `started` = the caller did not ask to wait. */
-var ActionRunOutcomeSchema = union([AutomationRunOutcomeSchema, literal("started")]);
-var ActionRunResultSchema = object({
-	runId: string().min(1),
-	outcome: ActionRunOutcomeSchema,
-	/** Why it did not run, or what failed. */
-	message: string().optional()
-});
-_enum([
-	"not-found",
-	"read-only",
-	"invalid-variables",
-	"invalid-steps",
-	"not-linked",
-	"busy"
-]);
-object({
-	actionId: string(),
-	runId: string(),
-	isRunning: boolean(),
-	/** Set when the run ended. */
-	outcome: AutomationRunOutcomeSchema.optional(),
-	lastRunAt: number().nullable(),
-	lastError: string().nullable()
-});
-/** A bare number accepted as a base unit — the save succeeded, say so. */
-var UnitWarningSchema = object({
-	/** Where in the saved record, e.g. `conditions.children.0` or `steps.2.args.grams`. */
-	path: string(),
-	deviceId: number().int().optional(),
-	field: string(),
-	value: number(),
-	assumedUnit: string(),
-	message: string()
-});
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
-*/
-var NotificationActionIconSchema = _enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: _enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = union([
-	string(),
-	number(),
-	boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = object({
-	key: string().min(1),
-	label: string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: string().optional(),
-	type: _enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: array(object({
-		value: string(),
-		label: string()
-	})).optional(),
-	/** `number` only. */
-	min: number().optional(),
-	max: number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: record(string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: boolean().optional(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough$4 = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: array(string()).optional(),
-	supportsDiscovery: boolean(),
+	conditions: array(AutomationConditionTraceNodeSchema),
+	verdict: AutomationRunVerdictSchema.optional(),
+	steps: array(AutomationStepTraceSchema),
+	outcome: AutomationRunOutcomeSchema,
+	/** How many identical consecutive skips this trace stands for (>= 1). */
+	repeat: number().int().min(1),
+	/** When the latest of those repeats happened. */
+	lastAt: number(),
 	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
+	* A scheduler point's own outcome (D983). `outcome` carries the closest
+	* automation outcome so a reader that does not know schedulers still reads
+	* the trace; this field says exactly what happened.
 	*/
-	deliveryParams: array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
+	scheduler: SchedulerOutcomeSchema.optional()
 });
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* What the hub's `runs` ledger holds for one owner (`automation:<blockId>` or
+* `action:<actionId>`): the cooldown stamp and the trace ring.
 */
-var TargetSchema = object({
-	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
+var AutomationStateDocSchema = object({
+	version: literal(1),
+	lastRunStartedAt: number().nullable(),
+	traces: array(AutomationRunTraceSchema)
 });
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
+/**
+* Actions — named, runnable things an operator (or an automation) can start,
+* declared as LIST ENTRIES, never as devices.
+*
+* An entry is either **internal** (a short list of cap/wait steps kept in the
+* hub's `actions` record kind) or declared by an addon through the
+* `action-source` collection (a Home Assistant script, a scene …). The one
+* surface the UI and automations talk to is the `actions` cap; it keeps no
+* catalog of its own (D3) — every `list` asks the providers live.
+*
+* This file is the data half: the entry schema, the variables an entry may
+* declare, and the pure resolution of the values a run was given. It holds no
+* runtime.
+*/
+/** What a variable's value is. `select` takes one of `options`. */
+var ActionVariableTypeSchema = _enum([
+	"string",
+	"number",
+	"boolean",
+	"select"
+]);
+var ACTION_VARIABLE_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ActionVariableValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One declared variable. Steps reference it as `{ $var: 'name' }` (the whole
+* value) or `{{vars.name}}` (inside a string) in their args.
+*/
+var ActionVariableSchema = object({
+	name: string().regex(ACTION_VARIABLE_NAME_RE),
+	label: string().min(1).max(120).optional(),
+	type: ActionVariableTypeSchema,
+	required: boolean().optional(),
+	default: ActionVariableValueSchema.optional(),
+	/** The allowed values of a `select`. */
+	options: array(string().min(1)).min(1).optional()
+}).superRefine((v, ctx) => {
+	if (v.type === "select" && v.options === void 0) ctx.addIssue({
+		code: "custom",
+		message: "a select variable needs options",
+		path: ["options"]
+	});
+	if (v.default !== void 0 && variableValueError(v, v.default) !== null) ctx.addIssue({
+		code: "custom",
+		message: variableValueError(v, v.default) ?? "invalid default",
+		path: ["default"]
+	});
 });
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
+/** Why `value` is not a legal value for the variable, or null when it is. */
+function variableValueError(variable, value) {
+	switch (variable.type) {
+		case "string": return typeof value === "string" ? null : `variable "${variable.name}" must be a string`;
+		case "number": return typeof value === "number" && Number.isFinite(value) ? null : `variable "${variable.name}" must be a number`;
+		case "boolean": return typeof value === "boolean" ? null : `variable "${variable.name}" must be true or false`;
+		case "select": return typeof value === "string" && (variable.options ?? []).includes(value) ? null : `variable "${variable.name}" must be one of ${(variable.options ?? []).join(", ")}`;
+	}
+}
+var ActionSourceKindSchema = _enum(["internal", "addon"]);
+function isInternalActionId(actionId) {
+	return actionId.startsWith("internal:") && actionId.length > 9;
+}
+/** The addon behind a `<addonId>:<localId>` id, or null for anything else (internal included). */
+function addonIdOfActionId(actionId) {
+	if (isInternalActionId(actionId)) return null;
+	const at = actionId.indexOf(":");
+	return at > 0 && at < actionId.length - 1 ? actionId.slice(0, at) : null;
+}
+var ActionStatusSchema = object({
+	isRunning: boolean(),
+	/** Ms epoch the latest run STARTED; null when it never ran. */
+	lastRunAt: number().nullable(),
+	/** The latest run's failure; null on success or when it never ran. */
+	lastError: string().nullable()
 });
-var SendResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
+var ActionEntrySchema = object({
+	/** `internal:<uuid>` or `<addonId>:<localId>`. */
+	id: string().min(3),
+	name: string().min(1).max(120),
+	/** The addon that declared it; `core-blocks` for an internal one. */
+	addonId: string().min(1),
+	source: ActionSourceKindSchema,
+	/** An addon-declared entry is edited where it was declared. */
+	readOnly: boolean(),
+	/** Internal only: cap and wait steps. No action-in-action, so no cycles. */
+	steps: array(ActionStepSchema).min(1).max(50).optional(),
+	variables: array(ActionVariableSchema).max(20).optional(),
+	status: ActionStatusSchema
+}).superRefine((entry, ctx) => {
+	if (entry.source === "internal") {
+		if (!isInternalActionId(entry.id)) ctx.addIssue({
+			code: "custom",
+			message: "an internal action id is internal:<uuid>",
+			path: ["id"]
+		});
+		return;
+	}
+	if (entry.steps !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "only an internal action carries steps",
+		path: ["steps"]
+	});
+	if (!entry.readOnly) ctx.addIssue({
+		code: "custom",
+		message: "an addon action is read-only here",
+		path: ["readOnly"]
+	});
+	if (addonIdOfActionId(entry.id) === null) ctx.addIssue({
+		code: "custom",
+		message: "an addon action id is <addonId>:<localId>",
+		path: ["id"]
+	});
 });
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
+/** What an operator writes for an internal action. */
+var ActionInputSchema = object({
+	name: string().min(1).max(120),
+	steps: array(ActionStepSchema).min(1).max(50),
+	variables: array(ActionVariableSchema).max(20).optional()
+});
+/** Who started a run. Absent = the operator pressed it. */
+var ActionRunOriginSchema = object({ 
+/** The automation block whose step started it. */
+blockId: string().min(1).optional() });
 /**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
+* `started` = the caller did not ask to wait. `timed-out` = the run reached the
+* ceiling (`ACTION_RUN_MAX_MS`) and was stopped; it is never a `ran`.
 */
-var ProbeTargetConfigResultSchema = object({
-	ok: boolean(),
-	resolvedUrl: string(),
-	httpStatus: number().int().optional(),
-	stateInstance: string().optional(),
-	error: string().optional()
+var ActionRunOutcomeSchema = union([
+	AutomationRunOutcomeSchema,
+	literal("started"),
+	literal("timed-out")
+]);
+var ActionRunResultSchema = object({
+	runId: string().min(1),
+	outcome: ActionRunOutcomeSchema,
+	/** Why it did not run, or what failed. */
+	message: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: string().optional()
-}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
+_enum([
+	"not-found",
+	"read-only",
+	"invalid-variables",
+	"invalid-steps",
+	"not-linked",
+	"busy"
+]);
+object({
+	actionId: string(),
+	runId: string(),
+	isRunning: boolean(),
+	/** Set when the run ended. */
+	outcome: AutomationRunOutcomeSchema.optional(),
+	lastRunAt: number().nullable(),
+	lastError: string().nullable()
+});
+/** A bare number accepted as a base unit — the save succeeded, say so. */
+var UnitWarningSchema = object({
+	/** Where in the saved record, e.g. `conditions.children.0` or `steps.2.args.grams`. */
+	path: string(),
+	deviceId: number().int().optional(),
+	field: string(),
+	value: number(),
+	assumedUnit: string(),
+	message: string()
 });
 _enum([
 	"automation",
@@ -44467,6 +44693,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	kind: "mutation",
 	auth: "admin"
 });
+/** `timeoutMs` of `actions.run`: a waited call outlives any legal run. */
+var ACTION_RUN_TIMEOUT_MS = 363e4;
 /**
 * actions — the ONE surface for runnable actions, for the UI and for
 * automations. Provided by the core-blocks builtin on the hub.
@@ -44485,6 +44713,12 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 * An admin, and an in-process caller (an automation block), may run any action.
 * Every refusal is typed (`[not-linked] …`) and logged.
 *
+* **A run lasts at most `ACTION_RUN_MAX_MS` (60 min).** The provider stops a
+* run that reaches it and answers `timed-out` (never `ran`); an action whose
+* `wait` steps alone add up to more is refused at create/update
+* (`[invalid-steps]`). `run` declares a `timeoutMs` above that ceiling, so a
+* waited call (an automation step) is never cut by the 60 s transport default.
+*
 * A second `run` of an action that is already running is REFUSED — traced and
 * logged — never queued.
 */
@@ -44511,7 +44745,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	role: "viewer",
 	auth: "protected",
 	kind: "mutation",
-	caller: "required"
+	caller: "required",
+	timeoutMs: ACTION_RUN_TIMEOUT_MS
 }), method(ActionIdInput, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -48297,37 +48532,6 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
-var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
-	object({
-		outcome: literal("validated"),
-		/** Round-trip of the sign-in, when the provider measured it. */
-		latencyMs: number().nonnegative().optional(),
-		/** Optional human detail worth showing next to the tick
-		*  ("3 devices visible on this account"). */
-		detail: string().optional()
-	}).strict(),
-	object({
-		outcome: literal("rejected"),
-		error: string()
-	}).strict(),
-	object({
-		outcome: literal("inconclusive"),
-		error: string()
-	}).strict()
-]);
-var ConnectionTestInputSchema = object({ 
-/** Candidate integration settings, exactly as the create form collected them. */
-settings: record(string(), unknown()) });
-/**
-* What the provider's test actually DOES, so the UI can say it in words before
-* the operator presses the button ("Signs in to the Dreo cloud"). Purely
-* descriptive — it never changes routing.
-*/
-var ConnectionTestDescriptorSchema = object({ label: string() });
-method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
 object({
 	/** True when the upstream system considers the entity connected. */
 	connected: boolean(),
@@ -48585,6 +48789,9 @@ var MediaPlayerStatusSchema = object({
 	/** Repeat mode. Null when no repeat surface.
 	*  Pair with `DeviceFeature.MediaPlayerRepeat`. */
 	repeat: MediaPlayerRepeatSchema.nullable(),
+	/** Ms epoch when `position` was read from the device. Null when the driver
+	*  does not say; a UI that advances the position while playing counts from it. */
+	positionUpdatedAt: number().nullable().default(null),
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
@@ -49164,7 +49371,9 @@ var ThresholdTransformDraftSchema = object({
 	comparison: _enum(["gte", "lte"]),
 	threshold: number(),
 	startDwellMs: number().nonnegative(),
-	stopDwellMs: number().nonnegative()
+	stopDwellMs: number().nonnegative(),
+	/** Samples a start needs; absent = the compiler's default for the source (2 for running power, else 1). */
+	minSamples: number().int().min(1).optional()
 });
 var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
 	IdentityTransformDraftSchema,
@@ -54117,6 +54326,7 @@ var IntegrationWithStateSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -54129,6 +54339,7 @@ var IntegrationLiteSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -54174,10 +54385,9 @@ var AvailableIntegrationTypeSchema = object({
 	*  locations" checkbox. Provider-declared in the addon manifest. */
 	supportsLocationImport: boolean(),
 	/**
-	* True when this integration DECLARES a pre-creation test (the
-	* `connection-test` cap, or a broker whose settings it stores). Drives the
-	* Test button: an integration that cannot be tested must say so up front
-	* rather than offering a button that always answers the same nonsense.
+	* True when this integration's instances declare a Test (`integration-instances.describe().canTest`,
+	* D1016). An integration that cannot be tested must say so up front rather than offering a
+	* button that always answers the same nonsense.
 	*/
 	canTest: boolean(),
 	existingInstances: array(object({
@@ -54228,15 +54438,21 @@ var TestConnectionResultSchema = object({
 var CreateIntegrationInputSchema = object({
 	addonId: string(),
 	name: string(),
-	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
-	settings: record(string(), unknown()).optional()
+	settings: record(string(), unknown()).optional(),
+	/** The instance kind being created, for a provider with several; omitted = its only testable kind. */
+	kind: string().min(1).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
+	/**
+	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
+	* terminal), which keeps no instance record: the registry flag is its one store. Any other
+	* integration is switched through `integration-instances.setInstanceEnabled`.
+	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
 });
@@ -54253,13 +54469,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(object({ id: string() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
-	addonId: string(),
-	settings: record(string(), unknown())
-}), TestConnectionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
+}), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" });
 /**
 * `integration-instances` - the connection of an addon that holds ONE or SEVERAL
 * (an account, a relay, a destination) as typed records (D985, D986). The addon's
@@ -54284,7 +54494,7 @@ var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
 * What the addon's instances ARE for the Integrations page (planning#416). `devices`: each
-* instance is an integration that brings devices (the registry owns its on/off switch);
+* instance is an integration that brings devices (its record body owns the on/off switch);
 * `services`: a connection configured from the addon's own function page, never listed on
 * Integrations.
 * It is the same vocabulary as the manifest's `integrationRole`, which stays as an override.
@@ -54401,8 +54611,8 @@ var IntegrationInstanceSchema = object({
 	configured: boolean(),
 	/**
 	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
-	* so a row written before the field existed is on). Absent when the `integrations` registry
-	* owns the switch (`describe().role` is `devices`): read it from the registry row.
+	* so a row written before the field existed is on). The same for every role, `devices` included:
+	* the body is the one store, `setInstanceEnabled` the one writer (epic #440, step 3).
 	*/
 	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
@@ -54452,7 +54662,8 @@ var integrationInstancesCapability = {
 			auth: "admin"
 		}),
 		/**
-		* Switch ONE instance on or off. A row control, not a form field: `updateInstance.values` is the
+		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
+		* initial body. A row control, not a form field: `updateInstance.values` is the
 		* form patch (D62, D996). An off instance keeps its record and secrets and does no work.
 		*/
 		setInstanceEnabled: method(object({
@@ -57263,6 +57474,8 @@ var MigrationIntegrationSchema = object({
 	addonId: string(),
 	name: string(),
 	info: Rows,
+	/** The registry's stored switch: read by the one-switch migration, nothing else. */
+	enabled: boolean().optional(),
 	originStableId: string().optional()
 });
 var MigrationDeviceSchema = object({
@@ -62499,13 +62712,6 @@ var AddBrokerInputSchema = object({
 });
 var AddBrokerResultSchema = object({ id: string() });
 var IdInputSchema = object({ id: string() });
-var TestResultSchema$1 = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
 var StartEmbeddedInputSchema = object({
 	port: number().int().min(1).max(65535).default(1883),
 	/** Allow anonymous connect (no username/password). Default: false. */
@@ -62528,9 +62734,6 @@ method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnection
 }), method(IdInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(IdInputSchema, TestResultSchema$1, {
-	kind: "mutation",
-	auth: "admin"
 }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -66781,14 +66984,6 @@ object({
 	empty: boolean().nullable(),
 	/** True while the pump is running. Null while unknown. */
 	pumpRunning: boolean().nullable(),
-	/** Water drunk in the last drink, in litres. */
-	lastDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk in the current hour, in litres. */
-	currentHourDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk over the last 24 hours (rolling), in litres. */
-	last24hDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk since local midnight, in litres. Null when the fountain has no such sensor. */
-	todayDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
 	error: string().nullable(),
 	/** Ms epoch when the slice was last refreshed. */
@@ -66801,9 +66996,6 @@ DeviceType.PetFountain, method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
-}), method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
-	kind: "mutation",
-	auth: "protected"
 });
 /**
 * The wire shapes of the Auto tune plan and apply (D745), used by the
@@ -74166,7 +74358,7 @@ var TrainingProviderTypeSchema = object({
 	label: string(),
 	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
 	iconAsset: string(),
-	/** Owning `training-provider` addon — collection selector for createEntry. */
+	/** Owning `training-provider` addon. */
 	addonId: string(),
 	/**
 	* Fields for one entry of this type (credentials + defaults). Absent on a
@@ -74211,36 +74403,6 @@ var TrainingProviderDescriptorSchema = object({
 	*/
 	formValues: record(string(), unknown()).optional()
 });
-/**
-* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
-* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
-* `{ $secretClear: true }` clears it.
-*/
-var TrainingProviderUpdateEntryInputSchema = object({
-	entryId: string().min(1),
-	name: string().min(1),
-	tokenId: string().optional(),
-	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	environment: string().optional(),
-	gpuType: string().optional(),
-	region: string().optional(),
-	costCapUsd: number().nonnegative().optional(),
-	maxRuntimeSec: number().int().positive().optional(),
-	failedDatasetGraceHours: number().nonnegative().optional()
-});
-var TrainingCredentialCheckSchema = object({
-	ok: boolean(),
-	/** Workspace / account name, when the provider says. */
-	account: string().optional(),
-	reason: _enum([
-		"missing",
-		"invalid",
-		"forbidden",
-		"network",
-		"quota"
-	]).optional(),
-	detail: string().optional()
-});
 var ProviderJobStateSchema = _enum([
 	"pending",
 	"starting",
@@ -74288,22 +74450,6 @@ var TrainingLogLineSchema = object({
 	text: string()
 });
 method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderTypeSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderEntrySchema).readonly(), { auth: "admin" }), method(object({
-	typeId: string().min(1),
-	name: string().min(1)
-}), object({ entryId: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: 3e4
-}), method(object({
 	entryId: string().min(1),
 	gpuType: string(),
 	region: string(),
@@ -77689,20 +77835,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"connectionTest.describeTest": {
-		capName: "connection-test",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"connectionTest.testSettings": {
-		capName: "connection-test",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"connectivity.getStatus": {
 		capName: "connectivity",
 		capScope: "device",
@@ -80069,13 +80201,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.testConnection": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.update": {
 		capName: "integrations",
 		capScope: "system",
@@ -81308,13 +81433,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"mqttBroker.testConnection": {
-		capName: "mqtt-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"nativeObjectDetection.getOptions": {
 		capName: "native-object-detection",
 		capScope: "device",
@@ -82190,13 +82308,6 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
-	"petFountain.resetDailyConsumption": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "delete",
-		role: "viewer"
-	},
 	"petFountain.setPump": {
 		capName: "pet-fountain",
 		capScope: "device",
@@ -86152,20 +86263,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.createEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"trainingProvider.deleteEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"trainingProvider.describe": {
 		capName: "training-provider",
 		capScope: "system",
@@ -86236,13 +86333,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.updateEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -86250,13 +86340,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.validateCredentials": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -88593,11 +88676,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"petFountain.resetDailyConsumption": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"petFountain.setPump": [{
 		name: "deviceId",
 		form: "single",
@@ -91385,11 +91463,6 @@ function linkFieldDescriptor(key, target, labels) {
 		...target.kind !== void 0 ? { kind: target.kind } : {}
 	};
 }
-/**
-* Declare the record kind of a service that links to other instances. The body is
-* `{ name, ...links, ...fields }`; the links are recorded in the kind (read back by
-* {@link linksOfKind}) so the hub can index who points at what.
-*/
 function declareLinkKind(spec) {
 	const linkShape = {};
 	for (const [field, target] of Object.entries(spec.links)) linkShape[field] = linkField(target);
@@ -91446,7 +91519,6 @@ function buildLinkedInstances(records, spec) {
 	});
 	return instances;
 }
-entryBody({ brokerId: string() });
 /**
 * The calendars an account imports leave the account (D1013). An account record used to carry a
 * `calendarIds` array; each calendar is now a record of its own that LINKS to the account
@@ -91549,22 +91621,12 @@ var GoogleBrokerEntrySchema = object({
 	fromAddress: string().default(""),
 	fromName: string().default("")
 });
-var GoogleServicesConfigSchema = object({
-	brokers: array(GoogleBrokerEntrySchema).default([]),
-	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
-	clientId: string().optional(),
-	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
-	clientSecret: string().optional().meta({ secret: true }),
-	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
-	calendarFilter: string().optional(),
-	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
-	fromAddress: string().optional(),
-	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
-	fromName: string().optional()
-});
+/**
+* The addon keeps no addon-level settings: every account is a `brokers` record and its tokens
+* live in the durable `oauthAccounts` state.
+*/
+var GoogleServicesConfigSchema = object({});
 var DEFAULT_GOOGLE_CONFIG = GoogleServicesConfigSchema.parse({});
-/** Flat pre-broker config (singleton). Parsed only for one-shot migration. */
-var LegacyGoogleFlatConfigSchema = GoogleServicesConfigSchema;
 var DEFAULT_OAUTH_STATE = {
 	refreshToken: "",
 	accessToken: "",
@@ -91634,52 +91696,6 @@ function brokerEntryToSettings(entry) {
 		fromName: entry.fromName
 	};
 }
-/**
-* One-shot: flat singleton config + legacy `oauth` state → `google_001`.
-* Idempotent when `brokers` already present.
-*/
-function migrateLegacyToBrokers(rawConfig, legacyOauth) {
-	const loose = LegacyGoogleFlatConfigSchema.safeParse(rawConfig);
-	const flat = loose.success ? loose.data : {};
-	const existingBrokers = flat.brokers ?? [];
-	if (existingBrokers.length > 0) return {
-		brokers: existingBrokers.map((b) => GoogleBrokerEntrySchema.parse(b)),
-		oauthAccounts: [],
-		didMigrate: false
-	};
-	const hasClient = (flat.clientId ?? "").length > 0 || (flat.clientSecret ?? "").length > 0;
-	const hasOauth = legacyOauth !== null && legacyOauth.refreshToken.length > 0;
-	if (!hasClient && !hasOauth) return {
-		brokers: [],
-		oauthAccounts: [],
-		didMigrate: false
-	};
-	const id = "google_001";
-	const email = legacyOauth?.accountEmail?.trim() ?? "";
-	const name = email.length > 0 ? email : "Google account";
-	const entry = GoogleBrokerEntrySchema.parse({
-		id,
-		name,
-		clientId: flat.clientId ?? "",
-		clientSecret: flat.clientSecret ?? "",
-		calendarFilter: flat.calendarFilter ?? "",
-		fromAddress: flat.fromAddress ?? "",
-		fromName: flat.fromName ?? ""
-	});
-	const oauthAccounts = legacyOauth !== null && (legacyOauth.refreshToken.length > 0 || legacyOauth.accessToken.length > 0) ? [{
-		id,
-		refreshToken: legacyOauth.refreshToken,
-		accessToken: legacyOauth.accessToken,
-		accessExpiresAt: legacyOauth.accessExpiresAt,
-		accountEmail: legacyOauth.accountEmail,
-		needsReauth: false
-	}] : [];
-	return {
-		brokers: [entry],
-		oauthAccounts,
-		didMigrate: true
-	};
-}
 /** Local calendar id stamped as `brokerId:googleCalendarId`. */
 function stampCalendarId(brokerId, googleCalendarId) {
 	return `${brokerId}:${googleCalendarId}`;
@@ -91795,9 +91811,6 @@ var GoogleBrokerRegistry = class {
 	connectedSize() {
 		return this.entries.filter((e) => this.isConnected(e.id)).length;
 	}
-	toConfig() {
-		return { brokers: [...this.entries] };
-	}
 	seedCounterFromEntries(entries) {
 		let maxSeen = 0;
 		for (const e of entries) {
@@ -92708,6 +92721,245 @@ async function planDropSharedCalendarIds(ports) {
 		} })
 	}] };
 }
+//#endregion
+//#region src/migrations/drop-config-brokers-and-legacy-oauth.ts
+/**
+* The addon-level `brokers` setting and the singleton `oauth` state are gone (planning#440 step 5):
+* every account is a `brokers` record and its tokens live in `oauthAccounts`. This deletes the two
+* leftover keys, each only when nothing in them is still the only copy:
+*
+* - `brokers` goes when the `brokers` kind holds records, or when the setting itself is empty. A
+*   non-empty setting with an empty kind was never copied: it stays.
+* - `oauth` goes when it carries no token (the empty state the old boot migration left behind), or
+*   when `oauthAccounts` already holds accounts. A token with no account to hold it stays.
+*
+* Each edit carries a precondition read, so a row that changed since the plan was made is not
+* deleted; a second run finds nothing to plan.
+*/
+var BROKERS_KEY = "brokers";
+var LEGACY_OAUTH_KEY = "oauth";
+/** The flat singleton client the boot migration used to clear. */
+var FLAT_KEYS = [
+	"clientId",
+	"clientSecret",
+	"calendarFilter",
+	"fromAddress",
+	"fromName"
+];
+var OAUTH_ACCOUNTS_KEY = "oauthAccounts";
+function present$1(answer, key) {
+	if (answer.kind === "unreadable") throw new Error(`google-services: the stored '${key}' cannot be read (${answer.reason})`);
+	return answer.kind === "absent" ? null : { value: answer.value };
+}
+function field(value, key) {
+	return typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
+}
+/** A token field that holds nothing: absent or the empty string. A secret marker is something. */
+function isBlank(value) {
+	return value === void 0 || value === null || value === "";
+}
+function stringList(value) {
+	if (!Array.isArray(value)) return null;
+	const out = [];
+	for (const item of value) {
+		if (typeof item !== "string") return null;
+		out.push(item);
+	}
+	return out;
+}
+function holdsAccounts(value) {
+	const accounts = field(value, "accounts");
+	return Array.isArray(accounts) && accounts.length > 0;
+}
+async function planDropConfigBrokersAndLegacyOauth(ports) {
+	const rows = {};
+	const keys = [];
+	const take = (key, value) => {
+		const id = `${GOOGLE_ADDON_ID}.${key}`;
+		keys.push(id);
+		rows[id] = {
+			addonId: GOOGLE_ADDON_ID,
+			key,
+			value
+		};
+	};
+	const brokers = present$1(await ports.readStored(BROKERS_KEY), BROKERS_KEY);
+	if (brokers !== null) {
+		if (!(Array.isArray(brokers.value) && brokers.value.length > 0) || (await ports.listBrokers()).length > 0) take(BROKERS_KEY, brokers.value);
+	}
+	for (const key of FLAT_KEYS) {
+		const flat = present$1(await ports.readStored(key), key);
+		if (flat !== null && (await ports.listBrokers()).length > 0) take(key, flat.value);
+	}
+	const shared = present$1(await ports.readStored(SHARED_CALENDAR_IDS_KEY), SHARED_CALENDAR_IDS_KEY);
+	if (shared !== null) {
+		const sharedIds = stringList(shared.value);
+		if (sharedIds === null) throw new Error(`google-services: the stored '${SHARED_CALENDAR_IDS_KEY}' is not a list of ids — nothing dropped`);
+		else {
+			const brokers = await ports.listBrokers();
+			const same = (ids) => ids === void 0 || ids.length === sharedIds.length && ids.every((id) => sharedIds.includes(id));
+			if (brokers.length > 0 && brokers.every((b) => same(b.calendarIds))) take(SHARED_CALENDAR_IDS_KEY, shared.value);
+		}
+	}
+	const oauth = present$1(await ports.readStored(LEGACY_OAUTH_KEY), LEGACY_OAUTH_KEY);
+	if (oauth !== null) {
+		const tokenless = isBlank(field(oauth.value, "refreshToken")) && isBlank(field(oauth.value, "accessToken"));
+		const accounts = present$1(await ports.readStored(OAUTH_ACCOUNTS_KEY), OAUTH_ACCOUNTS_KEY);
+		if (tokenless || accounts !== null && holdsAccounts(accounts.value)) take(LEGACY_OAUTH_KEY, oauth.value);
+	}
+	if (keys.length === 0) return { edits: [] };
+	return { edits: [{
+		op: "deleteKeys",
+		scope: ADDON_SETTINGS_TABLE,
+		keys,
+		precondition: preconditionOf(rows)
+	}] };
+}
+//#endregion
+//#region src/migrations/legacy-brokers-to-records.ts
+/**
+* The accounts a pre-record install kept in the addon settings become `brokers` records and
+* `oauthAccounts` entries (planning#440 step 5). Three legacy shapes feed it, the ones the boot
+* migration used to read:
+*
+* - the `brokers` setting (a list of entries);
+* - the flat singleton (`clientId`, `clientSecret`, `calendarFilter`, `fromAddress`, `fromName`),
+*   which becomes `google_001`;
+* - the singleton `oauth` state, whose token follows its account (`google_001`, or the first
+*   broker when brokers already existed).
+*
+* Reads come RESOLVED (the settings view answers values, not keychain markers); a value the
+* keychain could not serve is not a string and REFUSES the step, so nothing is written from a
+* guess. Each record is read back with its secret before the step reports done, and an account
+* that already has a record is never overwritten. The shared `calendarIds` set goes onto every
+* broker this step creates (the calendar migrations before it found no broker to give it to),
+* then becomes calendar records, so the selection is not lost whichever order the steps ran in. The legacy keys stay where they are: the drop
+* migration deletes them only after this one landed.
+*/
+var LEGACY_BROKER_ID = "google_001";
+var LEGACY_FLAT_KEYS = [
+	"clientId",
+	"clientSecret",
+	"calendarFilter",
+	"fromAddress",
+	"fromName"
+];
+function present(answer, key) {
+	if (answer.kind === "unreadable") throw new Error(`google-services: the stored '${key}' cannot be read (${answer.reason})`);
+	return answer.kind === "absent" ? void 0 : answer.value;
+}
+function text(value, what) {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "string") return value;
+	throw new Error(`google-services: ${what} is not a plain value (is the keychain available?)`);
+}
+function legacyOauthOf(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const refreshToken = text(Reflect.get(value, "refreshToken"), "the legacy oauth refreshToken");
+	if (refreshToken.length === 0) return null;
+	const expires = Reflect.get(value, "accessExpiresAt");
+	return {
+		refreshToken,
+		accessToken: text(Reflect.get(value, "accessToken"), "the legacy oauth accessToken"),
+		accessExpiresAt: typeof expires === "number" ? expires : 0,
+		accountEmail: text(Reflect.get(value, "accountEmail"), "the legacy oauth accountEmail").trim()
+	};
+}
+async function flatFields(ports) {
+	const out = {};
+	for (const key of LEGACY_FLAT_KEYS) out[key] = text(present(await ports.readStored(key), key), `the stored '${key}'`);
+	return out;
+}
+async function legacyEntries(ports, oauth) {
+	const listed = present(await ports.readStored("brokers"), "brokers");
+	if (Array.isArray(listed) && listed.length > 0) return listed.map((item) => {
+		const parsed = GoogleBrokerEntrySchema.safeParse(item);
+		if (!parsed.success) throw new Error(`google-services: a stored broker is invalid — ${parsed.error.message}`);
+		return parsed.data;
+	});
+	const flat = await flatFields(ports);
+	if (!flat["clientId"] && !flat["clientSecret"] && oauth === null) return [];
+	const email = oauth?.accountEmail ?? "";
+	return [GoogleBrokerEntrySchema.parse({
+		id: LEGACY_BROKER_ID,
+		name: email.length > 0 ? email : "Google account",
+		...flat
+	})];
+}
+async function sharedCalendarIds(ports) {
+	const value = present(await ports.readStored("calendarIds"), "calendarIds");
+	if (value === void 0) return null;
+	if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) throw new Error("google-services: the shared calendarIds is not a list of ids — nothing copied");
+	return value;
+}
+/** The keys a legacy install left that no record holds yet, for the init warning. */
+async function leftoverLegacyKeys(ports) {
+	const left = [];
+	const listed = await ports.readStored("brokers");
+	if (listed.kind === "present" && Array.isArray(listed.value) && listed.value.length > 0) left.push("brokers");
+	for (const key of ["clientId", "clientSecret"]) {
+		const answer = await ports.readStored(key);
+		if (answer.kind === "present" && answer.value !== "" && answer.value !== null) left.push(key);
+	}
+	const oauth = await ports.readStored("oauth");
+	if (oauth.kind === "present") {
+		const token = typeof oauth.value === "object" && oauth.value !== null ? Reflect.get(oauth.value, "refreshToken") : void 0;
+		if (token !== void 0 && token !== "" && token !== null) left.push("oauth");
+	}
+	return left;
+}
+async function copyLegacyBrokersToRecords(ports) {
+	const oauth = legacyOauthOf(present(await ports.readStored("oauth"), "oauth"));
+	const entries = await legacyEntries(ports, oauth);
+	if (entries.length === 0) return {
+		outcome: "already-done",
+		summary: { reason: "no-legacy-data" }
+	};
+	const have = new Set((await ports.listBrokers()).map((b) => b.id));
+	const shared = await sharedCalendarIds(ports);
+	let created = 0;
+	let selections = 0;
+	for (const entry of entries) {
+		if (have.has(entry.id)) continue;
+		await ports.putBroker(entry);
+		const back = await ports.readBroker(entry.id);
+		if (back === null || back.clientId !== entry.clientId || back.clientSecret !== entry.clientSecret) throw new Error(`google-services: broker '${entry.id}' did not read back as written`);
+		created += 1;
+		if (shared !== null && await ports.setBrokerCalendarIds(entry.id, shared)) selections += 1;
+	}
+	if (selections > 0) await moveCalendarIdsToRecords(ports, { calendarIdOf: (accountId, stamped) => {
+		const parsed = parseStampedCalendarId(stamped);
+		return parsed?.brokerId === accountId ? parsed.googleCalendarId : null;
+	} });
+	let account = 0;
+	const primary = entries[0];
+	if (oauth !== null && primary !== void 0) {
+		if ((await ports.listOauthAccountIds()).length === 0) {
+			await ports.putOauthAccount({
+				id: primary.id,
+				refreshToken: oauth.refreshToken,
+				accessToken: oauth.accessToken,
+				accessExpiresAt: oauth.accessExpiresAt,
+				accountEmail: oauth.accountEmail,
+				needsReauth: false
+			});
+			const back = await ports.readOauthAccount(primary.id);
+			if (back === null || back.refreshToken !== oauth.refreshToken) throw new Error(`google-services: the oauth account of '${primary.id}' did not read back`);
+			account = 1;
+		}
+	}
+	return {
+		outcome: created + account === 0 ? "already-done" : "done",
+		summary: {
+			brokers: created,
+			oauthAccounts: account
+		}
+	};
+}
+//#endregion
+//#region src/migrations/index.ts
+var CALENDAR_IDS_TO_RECORDS_ID = "google-services/2026-11-07-calendar-ids-to-calendar-records";
+var LEGACY_BROKERS_TO_RECORDS_ID = "google-services/2026-11-06-legacy-brokers-to-records";
 /** The `google-services` catalogue (D987): offered to the engine when the addon initialises. */
 var ADDON_MIGRATIONS = [
 	{
@@ -92744,7 +92996,7 @@ var ADDON_MIGRATIONS = [
 	},
 	{
 		meta: {
-			id: "google-services/2026-11-07-calendar-ids-to-calendar-records",
+			id: CALENDAR_IDS_TO_RECORDS_ID,
 			owner: "google-services",
 			level: "addon-state",
 			seq: 3,
@@ -92760,6 +93012,38 @@ var ADDON_MIGRATIONS = [
 			const parsed = parseStampedCalendarId(entry);
 			return parsed?.brokerId === accountId ? parsed.googleCalendarId : null;
 		} })
+	},
+	{
+		meta: {
+			id: LEGACY_BROKERS_TO_RECORDS_ID,
+			owner: "google-services",
+			level: "addon-state",
+			seq: 4,
+			dependsOn: [CALENDAR_IDS_TO_RECORDS_ID],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "Copy the addon-level brokers setting or the flat singleton client, and the legacy oauth token, into broker records and oauthAccounts, each read back",
+			fixtureMark: "the client secret of a flat singleton, read back from its record"
+		},
+		procedure: copyLegacyBrokersToRecords
+	},
+	{
+		meta: {
+			id: "google-services/2026-11-06-drop-config-brokers-and-legacy-oauth",
+			owner: "google-services",
+			level: "addon-state",
+			seq: 5,
+			dependsOn: [LEGACY_BROKERS_TO_RECORDS_ID],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the addon-level brokers setting once the brokers records exist, and the singleton oauth state once it holds no token",
+			fixtureMark: "the brokers setting kept when its records are missing"
+		},
+		plan: planDropConfigBrokersAndLegacyOauth
 	}
 ];
 //#endregion
@@ -92845,6 +93129,22 @@ var GoogleBrokerStore = class GoogleBrokerStore {
 		}
 		return out;
 	}
+	async putOne(entry) {
+		const { id, name, clientId, clientSecret, calendarFilter, fromAddress, fromName } = entry;
+		const parsed = googleBrokersEntryKind.schema.safeParse({
+			name,
+			clientId,
+			clientSecret,
+			calendarFilter,
+			fromAddress,
+			fromName
+		});
+		if (!parsed.success) throw new Error(`invalid Google broker '${id}': ${parsed.error.message}`);
+		await this.kind.put({
+			id,
+			data: parsed.data
+		});
+	}
 	async replaceAll(entries) {
 		const page = await this.kind.query({ limit: 1e3 });
 		const nextIds = new Set(entries.map((e) => e.id));
@@ -92886,19 +93186,8 @@ var GoogleCallbackError = class extends Error {
 var CALLBACK_PATH = "/oauth/callback";
 var START_PATH = "/oauth/start";
 var DISCONNECT_PATH = "/oauth/disconnect";
-var LegacyOauthStateSchema = object({
-	refreshToken: string().default("").meta({ secret: true }),
-	accessToken: string().default("").meta({ secret: true }),
-	accessExpiresAt: number().default(0),
-	accountEmail: string().default("")
-});
 var GoogleServicesAddon = class extends BaseAddon {
-	secretStatePaths = [
-		"oauthAccounts.accounts[id].refreshToken",
-		"oauthAccounts.accounts[id].accessToken",
-		"oauth.refreshToken",
-		"oauth.accessToken"
-	];
+	secretStatePaths = ["oauthAccounts.accounts[id].refreshToken", "oauthAccounts.accounts[id].accessToken"];
 	oauthAccountsHandle = null;
 	registry = new GoogleBrokerRegistry();
 	brokerStore = null;
@@ -92915,40 +93204,6 @@ var GoogleServicesAddon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		this.oauthAccountsHandle = this.state("oauthAccounts", GoogleOauthAccountsStateSchema, { accounts: [] });
-		let oauthAccounts = await this.oauthAccountsHandle.get();
-		const legacyHandle = this.state("oauth", LegacyOauthStateSchema, { ...DEFAULT_OAUTH_STATE });
-		const legacyOauth = await legacyHandle.get();
-		const migrated = migrateLegacyToBrokers(this.config, legacyOauth);
-		if (migrated.didMigrate) {
-			await this.updateGlobalSettings({
-				brokers: [...migrated.brokers],
-				clientId: void 0,
-				clientSecret: void 0,
-				calendarFilter: void 0,
-				fromAddress: void 0,
-				fromName: void 0
-			});
-			if (migrated.oauthAccounts.length > 0) {
-				oauthAccounts = { accounts: [...migrated.oauthAccounts] };
-				await this.oauthAccountsHandle.set(oauthAccounts);
-			}
-			await legacyHandle.set({ ...DEFAULT_OAUTH_STATE });
-			this.ctx.logger.info("google-services: migrated singleton OAuth to broker google_001", { meta: {
-				brokerId: "google_001",
-				accountEmail: legacyOauth.accountEmail || void 0
-			} });
-		} else if (oauthAccounts.accounts.length === 0 && legacyOauth.refreshToken.length > 0 && this.config.brokers.length > 0) {
-			oauthAccounts = { accounts: [{
-				id: this.config.brokers[0].id,
-				refreshToken: legacyOauth.refreshToken,
-				accessToken: legacyOauth.accessToken,
-				accessExpiresAt: legacyOauth.accessExpiresAt,
-				accountEmail: legacyOauth.accountEmail,
-				needsReauth: false
-			}] };
-			await this.oauthAccountsHandle.set(oauthAccounts);
-			await legacyHandle.set({ ...DEFAULT_OAUTH_STATE });
-		}
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("google-services: ctx.records is required (hub-only addon)");
 		await records.declare({
@@ -92962,12 +93217,9 @@ var GoogleServicesAddon = class extends BaseAddon {
 			onChanged: () => this.refreshCalendarSelection()
 		});
 		this.activeBrokers = await this.loadPersistedBrokers();
-		if ((await this.brokerStore.listResolved()).length === 0 && this.config.brokers.length > 0) {
-			await this.brokerStore.replaceAll(this.config.brokers);
-			this.activeBrokers = await this.loadPersistedBrokers();
-		}
 		await this.migrateCalendarIds(records);
 		await this.refreshCalendarSelection();
+		const oauthAccounts = await this.oauthAccountsHandle.get();
 		this.registry.seedFrom(this.activeBrokers, oauthAccounts.accounts);
 		await this.refreshPublicOrigin();
 		const calendarProvider = createGoogleCalendarSource({
@@ -93403,27 +93655,61 @@ var GoogleServicesAddon = class extends BaseAddon {
 				brokers,
 				calendars: records.kind(googleCalendarsEntryKind),
 				warn: (message) => this.ctx.logger.warn(message)
-			})
+			}),
+			...this.legacyBrokerPorts()
+		};
+		const report = await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, ports));
+		if (report.applied.length > 0) this.activeBrokers = await this.loadPersistedBrokers();
+		if (this.activeBrokers.length === 0) {
+			const left = await leftoverLegacyKeys(ports);
+			if (left.length > 0) this.ctx.logger.error("google-services: legacy account data was NOT copied into broker records — Google stays unavailable until it is", { meta: {
+				leftoverKeys: left,
+				failed: report.failed
+			} });
+		}
+	}
+	/** The legacy-broker migration's writes: a broker record and an `oauthAccounts` entry, each read back. */
+	legacyBrokerPorts() {
+		return {
+			putBroker: async (entry) => {
+				const store = this.brokerStore;
+				if (store === null) throw new Error("google-services: the brokers store is not ready");
+				await store.putOne(entry);
+			},
+			readBroker: async (id) => {
+				const store = this.brokerStore;
+				if (store === null) throw new Error("google-services: the brokers store is not ready");
+				const found = (await store.listResolved()).find((b) => b.id === id);
+				return found === void 0 ? null : found;
+			},
+			listOauthAccountIds: async () => {
+				const handle = this.oauthAccountsHandle;
+				if (handle === null) return [];
+				return (await handle.get()).accounts.map((a) => a.id);
+			},
+			putOauthAccount: async (account) => {
+				const handle = this.oauthAccountsHandle;
+				if (handle === null) throw new Error("google-services: oauthAccounts is not ready");
+				const current = await handle.get();
+				await handle.set({ accounts: [...current.accounts, account] });
+			},
+			readOauthAccount: async (id) => {
+				const handle = this.oauthAccountsHandle;
+				if (handle === null) return null;
+				return (await handle.get()).accounts.find((a) => a.id === id) ?? null;
+			}
 		};
-		if ((await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, ports))).applied.length > 0) this.activeBrokers = await this.loadPersistedBrokers();
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
-		if (store !== null) {
-			const fromRecords = await store.listResolved();
-			if (fromRecords.length > 0) return fromRecords;
-		}
-		return this.config.brokers;
+		return store === null ? [] : store.listResolved();
 	}
 	async persistBrokers() {
 		const entries = [...this.registry.listEntries()];
 		this.activeBrokers = entries;
 		const store = this.brokerStore;
-		if (store !== null) {
-			await store.replaceAll(entries);
-			return;
-		}
-		await this.updateGlobalSettings({ brokers: entries });
+		if (store === null) throw new Error("google-services: the brokers store is not ready");
+		await store.replaceAll(entries);
 	}
 	async persistOauthAccounts() {
 		if (!this.oauthAccountsHandle) return;
@@ -93595,7 +93881,6 @@ exports.createGoogleCalendarSource = createGoogleCalendarSource;
 exports.exchangeCode = exchangeCode;
 exports.introHtml = introHtml;
 exports.mapGoogleEvent = mapGoogleEvent;
-exports.migrateLegacyToBrokers = migrateLegacyToBrokers;
 exports.needsRefresh = needsRefresh;
 exports.parseStampedCalendarId = parseStampedCalendarId;
 exports.redirectUriDisplay = redirectUriDisplay;