@camstack/addon-notifiers 1.2.20 → 1.2.22

package/dist/addon.js

@@ -29,7 +29,7 @@ let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = __toESM(node_path);
 let node_url = require("node:url");
-//#region ../types/dist/event-category-Cv9dO26A.mjs
+//#region ../types/dist/event-category-Bxo5yJjt.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -236,6 +236,33 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["PipelineCameraAssigned"] = "pipeline.camera-assigned";
 	EventCategory["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
 	/**
+	* A node the orchestrator would otherwise place cameras on has NO usable
+	* inference device: the operator enabled one or more accelerators there and
+	* the live probe reports every one of them unavailable. Emitted once per
+	* TRANSITION into that state (never per dispatch), and the node is dropped
+	* from the placement candidate set for as long as it holds.
+	*
+	* This exists because the state was previously invisible: little-unraid
+	* absorbed 283k inference errors in a day while still being handed cameras,
+	* and nothing in the system said so.
+	*
+	* A node with no accelerators configured at all is NOT this — its devices
+	* are `disabled`, not `unavailable`, and the runner's default CPU pool
+	* serves it exactly as before.
+	*/
+	EventCategory["PipelineNodeInferenceUnavailable"] = "pipeline.node-inference-unavailable";
+	/**
+	* A camera has an OPEN detection session and has produced no detection at
+	* all for longer than the blind threshold — the camera is being decoded and
+	* inferred and is returning nothing. Emitted once per transition into blind,
+	* per camera.
+	*
+	* The failure it reports: a 1h43 detection blackout on the entrance camera
+	* that nobody noticed, because "a camera that detects nothing" and "a quiet
+	* camera" produce byte-identical silence.
+	*/
+	EventCategory["PipelineDetectionBlind"] = "pipeline.detection-blind";
+	/**
 	* Per-camera pipeline config was mutated by the orchestrator
 	* (3-level settings change via `setAgentAddonDefaults` /
 	* `setCameraStepToggle` / `setCameraPipelineForAgent` or a
@@ -3027,6 +3054,9 @@ function handlePipeResult(left, next, ctx) {
 		fallback: left.fallback
 	}, ctx);
 }
+var $ZodPreprocess = /*@__PURE__*/ $constructor("$ZodPreprocess", (inst, def) => {
+	$ZodPipe.init(inst, def);
+});
 var $ZodReadonly = /*@__PURE__*/ $constructor("$ZodReadonly", (inst, def) => {
 	$ZodType.init(inst, def);
 	defineLazy(inst._zod, "propValues", () => def.innerType._zod.propValues);
@@ -5212,6 +5242,10 @@ function pipe(in_, out) {
 		out
 	});
 }
+var ZodPreprocess = /*@__PURE__*/ $constructor("ZodPreprocess", (inst, def) => {
+	ZodPipe.init(inst, def);
+	$ZodPreprocess.init(inst, def);
+});
 var ZodReadonly = /*@__PURE__*/ $constructor("ZodReadonly", (inst, def) => {
 	$ZodReadonly.init(inst, def);
 	ZodType.init(inst, def);
@@ -5270,6 +5304,13 @@ function _instanceof(cls, params = {}) {
 	};
 	return inst;
 }
+function preprocess(fn, schema) {
+	return new ZodPreprocess({
+		type: "pipe",
+		in: transform(fn),
+		out: schema
+	});
+}
 //#endregion
 //#region ../../node_modules/zod/v4/classic/compat.js
 /** @deprecated Use the raw string literal codes instead, e.g. "invalid_type". */
@@ -10948,6 +10989,8 @@ var QueryFilterSchema = object({
 	where: record(string(), unknown()).optional(),
 	whereIn: record(string(), array(unknown())).optional(),
 	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	/** NULL-safe exclusion: matches rows whose field is NULL OR != the value. */
+	whereNot: record(string(), unknown()).optional(),
 	orderBy: object({
 		field: string(),
 		direction: _enum(["asc", "desc"])
@@ -10967,7 +11010,8 @@ var QueryFilterSchema = object({
 var MutationFilterSchema = object({
 	where: record(string(), unknown()).optional(),
 	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional()
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	whereNot: record(string(), unknown()).optional()
 });
 /** A single stored record: `{ id, data }`. */
 var SettingsRecordSchema = object({
@@ -12324,6 +12368,17 @@ var LlmImageSchema = object({
 	bytes: _instanceof(Uint8Array),
 	mimeType: string()
 });
+/**
+* Retry policy. `enabled: false` is NOT the same as `maxAttempts: 1` in intent —
+* the flag is what a consumer table flips, the count is what the operator tunes.
+* A retry doubles the wall time of a call, so the two gates that run inside a
+* notification's budget keep it off (see `CONSUMER_RETRY_POLICY` in addon-ai).
+*/
+var LlmRetryPolicySchema = object({
+	enabled: boolean().default(false),
+	/** Total attempts INCLUDING the first. 1 = no retry. */
+	maxAttempts: number().int().min(1).max(5).default(1)
+});
 var LlmGenerateBaseInputSchema = object({
 	/** Collection routing (the notification-output posture). */
 	addonId: string().optional(),
@@ -12338,7 +12393,28 @@ var LlmGenerateBaseInputSchema = object({
 	jsonSchema: record(string(), unknown()).optional(),
 	/** Per-call override of the profile default. */
 	maxTokens: number().int().positive().optional(),
-	temperature: number().optional()
+	temperature: number().optional(),
+	/** Per-call override of the profile default (nucleus sampling). */
+	topP: number().min(0).max(1).optional(),
+	/** Per-call override of the profile default (top-k sampling). */
+	topK: number().int().positive().optional(),
+	/** Per-call override of `profile.timeoutMs` — the total generation bound. */
+	timeoutMs: number().int().positive().optional(),
+	/** Per-call override; beats both the consumer table and the profile. */
+	retry: LlmRetryPolicySchema.optional(),
+	/**
+	* Caller-minted id that makes this generation CANCELLABLE.
+	*
+	* Without it a caller that stops waiting cannot stop the work: the gates race
+	* the call against 8 s and free their own slot when the timer wins, while the
+	* generation upstream keeps running to `profile.timeoutMs` — 60 s by default,
+	* on a single-threaded local model. The per-camera bound then counts WAITS,
+	* not generations, and the real load is unbounded.
+	*
+	* `AbortSignal` cannot cross a process boundary; an id can. Pass one here and
+	* `llm.cancel({ requestId })` tears the socket down.
+	*/
+	requestId: string().optional()
 });
 /**
 * `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
@@ -12351,6 +12427,18 @@ var LlmGenerateBaseInputSchema = object({
 * Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
 * watchdog — operator decision #3).
 */
+/**
+* A companion artifact that MUST land beside the main GGUF: the `mmproj`
+* projector of a vision model, or shards 2..N of a split GGUF. Carried on the
+* REF rather than looked up at install time, so what the operator approved in
+* the preview is exactly what the node downloads.
+*/
+var ManagedModelExtraFileSchema = object({
+	url: string(),
+	filename: string(),
+	sizeBytes: number(),
+	sha256: string().optional()
+});
 var ManagedModelRefSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("catalog"),
@@ -12359,7 +12447,11 @@ var ManagedModelRefSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("url"),
 		url: string(),
-		sha256: string().optional()
+		sha256: string().optional(),
+		/** Picker/status label; the file basename when absent. */
+		label: string().optional(),
+		sizeBytes: number().optional(),
+		extraFiles: array(ManagedModelExtraFileSchema).optional()
 	}),
 	object({
 		kind: literal("path"),
@@ -12377,13 +12469,82 @@ var ManagedRuntimeConfigSchema = object({
 	gpuLayers: number().int().default(0),
 	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
 	threads: number().int().optional(),
-	/** Concurrent slots. */
+	/** Concurrent slots (`--parallel`). */
 	parallel: number().int().default(1),
+	/** Logical batch size (`-b`). Larger = faster prompt ingest, more RAM. */
+	batchSize: number().int().positive().optional(),
+	/** Physical batch / micro-batch (`-ub`). */
+	ubatchSize: number().int().positive().optional(),
+	/**
+	* `--flash-attn`. Cuts KV-cache memory on the backends that implement it and
+	* is a no-op elsewhere, so it is offered rather than assumed.
+	*/
+	flashAttention: boolean().default(false),
+	/**
+	* `--mlock`. Pins the weights in RAM so the OS cannot page them out mid
+	* inference. Costs the full model size in resident memory — which is exactly
+	* what the RAM budget is counting.
+	*/
+	mlock: boolean().default(false),
+	/**
+	* `--no-mmap`. Reads the whole GGUF up front instead of mapping it. Slower to
+	* start, but avoids the page-fault stalls a network or spinning-disk model
+	* store produces on every first token.
+	*/
+	noMmap: boolean().default(false),
+	/** `--cache-type-k` / `--cache-type-v` — quantising the KV cache is the
+	*  cheapest way to fit a longer context in the same RAM. */
+	cacheTypeK: _enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
+	cacheTypeV: _enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
+	/**
+	* Escape hatch for llama-server flags this schema does NOT model — `--jinja`
+	* (which most vision chat templates need and some language-only models
+	* dislike), `--cont-batching`, `--rope-scaling`, …
+	*
+	* It is NOT a second place to set the flags above. A token that collides
+	* with a typed field is REJECTED at start, naming the field that owns it
+	* (`assertNoOwnedFlags`), because two knobs writing the same argv is exactly
+	* the "two switches that disagree" failure this repo has already shipped
+	* twice (D62).
+	*/
+	extraArgs: array(string()).default([]),
 	/** Else lazy: first generate boots it. */
 	autoStart: boolean().default(false),
 	/** 0 = never; frees RAM after quiet periods. */
 	idleStopMinutes: number().int().default(30)
 });
+/**
+* Where a multi-GB install currently is. A single 0..1 fraction cannot answer
+* "is it stuck?" for an install that is three files (shards + mmproj) followed
+* by a sha256 pass over 22 GB — during which the fraction sat at 1.0 and the
+* node looked hung. Phase + file + bytes is the smallest shape that does.
+*/
+var LlmDownloadProgressSchema = object({
+	phase: _enum(["downloading", "verifying"]),
+	/** The artifact currently moving, e.g. `mmproj-F16.gguf`. */
+	file: string(),
+	fileIndex: number().int(),
+	fileCount: number().int(),
+	/** Across the WHOLE install, not the current file. */
+	downloadedBytes: number(),
+	totalBytes: number().optional()
+});
 var LlmRuntimeStatusSchema = object({
 	/** Status is ALWAYS node-qualified. */
 	nodeId: string(),
@@ -12400,6 +12561,8 @@ var LlmRuntimeStatusSchema = object({
 	modelPath: string().optional(),
 	modelId: string().optional(),
 	downloadProgress: number().min(0).max(1).optional(),
+	/** Detail behind `downloadProgress`; present for the same lifetime. */
+	download: LlmDownloadProgressSchema.optional(),
 	lastError: string().optional(),
 	crashesInWindow: number(),
 	/** Child RSS (sampled best-effort). */
@@ -12410,7 +12573,14 @@ var LlmNodeModelSchema = object({
 	file: string(),
 	sizeBytes: number(),
 	catalogId: string().optional(),
-	installedAt: number().optional()
+	installedAt: number().optional(),
+	/**
+	* Absolute path on the node. Present so a file that is on disk but matches
+	* no catalog entry — a custom Hugging Face install, or a GGUF the operator
+	* copied in by hand — is still SELECTABLE, as a `{kind:'path'}` ref. Without
+	* it the picker could list such a file and do nothing with it.
+	*/
+	path: string().optional()
 });
 var LlmRuntimeDiskUsageSchema = object({
 	nodeId: string(),
@@ -12466,10 +12636,47 @@ var LlmProfileSchema = object({
 	baseUrl: string().optional(),
 	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
 	apiKey: string().optional(),
+	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
+	*  degraded to text — that shipped once and produced a confident answer to a
+	*  question about a picture nobody sent. */
 	supportsVision: boolean(),
 	temperature: number().min(0).max(2).optional(),
+	/** Nucleus sampling. Every wire we speak has it. */
+	topP: number().min(0).max(1).optional(),
+	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
+	*  wire does, and the client drops it there (measured: the request body gets
+	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
+	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
+	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
+	*  the model with, so it is the one field that changes a PROCESS. */
+	contextLength: number().int().positive().optional(),
+	/** Default system prompt. A caller's `system` REPLACES it (never appends —
+	*  two system prompts fighting is worse than either alone). */
+	systemPrompt: string().optional(),
+	/** Total generation bound — the only one a unary call has. */
 	timeoutMs: number().int().positive().default(6e4),
+	/** The TCP handshake only — "is the port even open". NOT the wait for
+	*  response headers: on the LM Studio / llama-server wire those are written
+	*  once the model has finished loading, so they belong to the bound below. */
+	connectTimeoutMs: number().int().positive().default(1e4),
+	/** Accepted, but no output yet — response headers included, because a cold
+	*  GPU load is exactly what happens before them. */
+	firstTokenTimeoutMs: number().int().positive().default(12e4),
+	/** Output started then stopped. */
+	idleTimeoutMs: number().int().positive().default(6e4),
+	/** Profile-level default. The per-consumer table and a per-call override
+	*  both beat it — see `resolveRetryPolicy`. */
+	retry: LlmRetryPolicySchema.default({
+		enabled: false,
+		maxAttempts: 1
+	}),
+	/** Whether this profile may use tools. The tool-call plumbing rides the
+	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
+	*  `true` here buys the wiring, not behaviour, until tools are registered. */
+	toolsEnabled: boolean().default(false),
 	extraHeaders: record(string(), string()).optional(),
 	/** kind === 'managed-local' only (spec §4). */
 	runtime: ManagedRuntimeConfigSchema.optional()
@@ -12519,6 +12726,36 @@ var ManagedModelCatalogEntrySchema = object({
 	/** Vision models: companion projector file. */
 	mmprojUrl: string().optional()
 });
+/**
+* The outcome of turning one operator-typed Hugging Face reference into a
+* download plan. A RESULT, never a throw: "this repo has 24 quantizations and
+* I will not pick for you" is a normal answer the UI has to render, not an
+* exception.
+*
+* `candidates` is the whole reason the refusal is usable — every string in it
+* is a tag that resolves when pasted back as `<org>/<repo>:<TAG>`.
+*/
+var HfModelResolutionSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	/** Ready to hand to `installModel` unchanged. */
+	model: ManagedModelRefSchema,
+	label: string(),
+	repo: string(),
+	quantization: string(),
+	purpose: _enum(["text", "vision"]),
+	totalBytes: number(),
+	/** mmproj + shards, for the preview: an operator approving 23 GB should
+	*  see that 0.9 GB of it is a projector they did not name. */
+	extraFilenames: array(string())
+}), object({
+	ok: literal(false),
+	code: string(),
+	message: string(),
+	candidates: array(string()).optional(),
+	/** Set when the refusal was only the ceiling: re-calling with
+	*  `maxBytes: requiredBytes` is the operator's explicit override. */
+	requiredBytes: number().optional()
+})]);
 var LlmRuntimeNodeSchema = object({
 	nodeId: string(),
 	reachable: boolean(),
@@ -12531,7 +12768,10 @@ var ProfileRefInputSchema = object({
 	addonId: string(),
 	profileId: string()
 });
-method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
+method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({
+	addonId: string().optional(),
+	requestId: string()
+}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(ProfileRefInputSchema, _void(), {
@@ -12552,6 +12792,15 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }
 	consumer: string().optional(),
 	profileId: string().optional()
 }), array(LlmUsageRollupSchema)), method(object({}), array(ManagedModelCatalogEntrySchema)), method(object({}), array(LlmRuntimeNodeSchema)), method(object({ nodeId: string() }), array(LlmNodeModelSchema)), method(object({
+	/** `https://huggingface.co/<org>/<repo>/resolve/main/<f>.gguf`,
+	*  `<org>/<repo>/<f>.gguf`, `<org>/<repo>` or `<org>/<repo>:<QUANT>`. */
+	ref: string(),
+	/** Explicit ceiling override, in bytes. Absent = the built-in ceiling. */
+	maxBytes: number().positive().optional()
+}), HfModelResolutionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	nodeId: string(),
 	model: ManagedModelRefSchema
 }), _void(), {
@@ -13111,11 +13360,33 @@ var NotificationFormatSchema = _enum([
 * Named by INTENT, never by glyph. "check" would tie the vocabulary to one
 * renderer's icon set; "acknowledge" survives an adapter that draws it
 * differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
 */
 var NotificationActionIconSchema = _enum([
 	"acknowledge",
 	"dismiss",
 	"silence",
+	"snooze",
 	"view",
 	"play",
 	"open",
@@ -13123,9 +13394,13 @@ var NotificationActionIconSchema = _enum([
 	"lock",
 	"unlock",
 	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
 	"disarm",
 	"light",
-	"alert"
+	"alert",
+	"camera"
 ]);
 /** A single tap-through action button. */
 var NotificationActionSchema = object({
@@ -13339,6 +13614,24 @@ var notificationOutputCapability = {
 		}), _void(), { kind: "mutation" })
 	}
 };
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
 var COCO_TO_MACRO = {
 	mapping: {
 		person: "person",
@@ -14131,11 +14424,15 @@ var NcSystemEventKindSchema = _enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-inference-unavailable",
+	"detection-blind",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
 	"alarm-armed",
 	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -14190,7 +14487,16 @@ var NcScheduleSchema = object({
 });
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
-	values: array(string().min(1)).min(1),
+	/**
+	* Plate texts (or gallery vehicle names) to match. EMPTY = **any plate the
+	* pipeline could read** — the plate half of "no selection = no narrowing",
+	* and the switch that says this rule is about vehicles that were IDENTIFIED
+	* rather than merely seen. A subject carrying no plate still fails.
+	*
+	* The `.min(1)` this used to carry made that state unauthorable; nothing has
+	* ever persisted an empty list, so widening it cannot change an existing rule.
+	*/
+	values: array(string().min(1)),
 	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
 	maxDistance: number().int().min(0).max(3).default(1)
 });
@@ -14224,28 +14530,36 @@ var NcOccupancyConditionSchema = object({
 /**
 * Audio condition (IMMEDIATE trigger) — a rule on SOUND, not on a picture.
 *
-* Operator-approved vocabulary (2026-08-12, option A — the same one the
-* reference notifier uses, so an operator moving between them re-uses what
-* they already know): a rule matches when, over a sampling window of
-* `samplingSeconds`, at least `hitPercent`% of the audio samples in that
-* window are HITS. A sample is a hit when it satisfies BOTH present filters:
-*
-*  - `dbThreshold` — its level is at or above this many dBFS (see
-*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale);
-*  - `labels` — the classifier put at least one of these labels on it.
-*
-* Both are OPTIONAL and independent, which is the point of the shape: a
-* loudness rule ("something loud at 3am") needs no model to be right, and a
-* label rule ("a dog barked") needs no threshold. **Fail-closed when NEITHER
-* is given** — a window in which every sample is trivially a hit would fire on
-* silence, so the engine refuses such a condition rather than notifying on
-* nothing (the schema cannot express "at least one of" without becoming a
-* ZodEffects the cap path would have to special-case).
-*
-* `hitPercent` is over the samples the window actually HOLDS, and the window
-* must be FULL before it can match — a window that has been open for two
-* seconds of its ten is 100% of nothing, and firing on it would make
-* `samplingSeconds` decorative.
+* **TWO EXCLUSIVE MODES** (operator decision 2026-08-14, D157). Which one a
+* rule is in is not a stored field — it is WHICH FILTER the rule carries, so
+* there is no second switch that can disagree with the first and every rule
+* authored before the decision migrates for free (`audioModeOf`):
+*
+*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
+*    classifier labels with one of them. No window, no percentage:
+*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
+*    `throttle` cooldown is the only brake. The per-label confidence floor is
+*    the analyzer's (`classificationMinScore`, per device) — a label only
+*    reaches this condition if the classifier was already confident enough.
+*  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
+*    the condition: at least `hitPercent`% of the samples over
+*    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
+*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale). The window
+*    must be FULL before it can match — a window open for two of its ten
+*    seconds is 100% of nothing.
+*
+* **Why label mode has no window.** It had one, and it never fired: the
+* analyzer emits ~1 audio frame per second but YAMNet only LABELS one to three
+* of them per episode, even through continuous crying. The measured maximum
+* `hitPercent` over the whole live history was 40 — under the shipped default
+* of 60, so a label rule could not fire at all, ever. A percentage of frames is
+* the wrong question to ask of a sparse classifier.
+*
+* **Fail-closed when NEITHER is given** — every sample would be a trivial hit
+* and the rule would fire on silence. The schema cannot express "exactly one
+* of" without becoming a ZodEffects the cap path would have to special-case, so
+* the exclusivity is enforced where every editor writes (`patchAudio`) and a
+* legacy rule carrying both resolves to LABEL (the mode that fires).
 *
 * Labels are the audio macro classes (`AUDIO_MACRO_LABELS` / the NC taxonomy's
 * `audio-*` ids). Both spellings are accepted — the matcher normalizes the
@@ -14253,13 +14567,13 @@ var NcOccupancyConditionSchema = object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = object({
-	/** Audio macro labels; absent = any sound (level-only rule). */
+	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
 	labels: array(string().min(1)).min(1).optional(),
-	/** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: number().min(-96).max(0).optional(),
-	/** Percentage of the window's samples that must be hits (1–100). */
+	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: number().int().min(1).max(100).default(60),
-	/** Length of the sampling window in seconds. */
+	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
 	samplingSeconds: number().int().min(1).max(300).default(10)
 });
 /**
@@ -14397,13 +14711,81 @@ var NcRuleActionsSchema = object({
 	*/
 	buttons: array(NcRuleNotificationButtonSchema).max(8).optional()
 });
+/**
+* "This rule applies only while `deviceId` is in one of `states`."
+*
+* The states are the DEVICE's own vocabulary — `AlarmState` for a panel,
+* `on`/`off` for a switch — not a normalised set, because normalising would
+* make the condition lie about devices whose states have no equivalent.
+*
+* An unreadable state does NOT match: see the engine's fail-closed gate. A
+* condition that fired on "I could not read it" would be worse than no gate.
+*/
+var NcDeviceStateConditionSchema = object({
+	deviceId: number().int(),
+	/** Any of these matches. */
+	states: array(string().min(1)).min(1)
+});
+/**
+* "This rule applies only while scene `sceneId` is `matched` / `diverged`."
+*
+* A GATE, not a trigger. `occupancy` and `audio` each DISCRIMINATE their rule —
+* carrying one makes the rule fire on that subject and nothing else. Scene is
+* the other shape entirely, the `deviceState` shape: it narrows a rule that
+* already has a trigger ("tell me about a person at the front door, but only
+* while the bin is still out"). That is why it composes with every delivery
+* instead of owning one, and why no new `NcDelivery` member and no new subject
+* kind exist for it — see D159.
+*
+* ── Identity ───────────────────────────────────────────────────────────────
+* `sceneId` is `SceneMonitor.id`, a `randomUUID()` minted by `createScene` —
+* globally unique, so it needs no device to disambiguate it. `deviceId` is
+* carried as a HINT for the editor and for the log line, never as part of the
+* lookup key: a rule whose hint drifted must still gate correctly.
+*
+* ── Which boolean ──────────────────────────────────────────────────────────
+* `latched` ABSENT means "whatever the scene itself says" — `SceneMonitor.emit`
+* already declares which boolean drives notification rules, and a second knob
+* that could disagree with it is exactly the D62 failure. Set it only to
+* override one rule against the scene's own default.
+*
+*  - LIVE reading (`emit`/`latched` resolve to live): passes iff
+*    `verdict === requiredState`. `unknown` — no reference for this light, view
+*    shifted, no snapshot — passes NEITHER. A scene that cannot judge is not
+*    evidence, in either direction.
+*  - LATCHED reading: passes iff `latched === (requiredState === 'diverged')`.
+*    The latch is a durable fact about the past ("it has diverged since I armed
+*    it"), so a camera that has gone dark does not clear it — that is the whole
+*    reason the operator asked for a latch.
+*
+* The gate reads an in-memory mirror (`NcSceneStateCache`) refreshed OFF the
+* event path, never the cap: D49. A mirror that has never loaded, or a scene it
+* does not carry, reads absent and the rule does NOT fire — fail closed, and
+* said out loud in the log rather than dropped in silence.
+*/
+var NcSceneConditionSchema = object({
+	/** `SceneMonitor.id` — the uuid the cap mints. The whole lookup key. */
+	sceneId: string().min(1),
+	/** The camera the scene lives on. A hint for the editor and the log line. */
+	deviceId: number().int().optional(),
+	/** The state the scene must be in for the rule to fire. */
+	requiredState: _enum(["matched", "diverged"]),
+	/**
+	* Read the LATCH (`true`) or the LIVE verdict (`false`). Absent = follow the
+	* scene's own `emit` field, which is the only place that decision belongs.
+	*/
+	latched: boolean().optional()
+});
 var NcConditionsSchema = object({
 	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
-	deviceState: object({
-		deviceId: number().int(),
-		/** Any of these matches. */
-		states: array(string().min(1)).min(1)
-	}).optional(),
+	deviceState: NcDeviceStateConditionSchema.optional(),
+	/**
+	* Gate on a SCENE's state — "only while the bin is still out". Composes with
+	* every trigger (detection, occupancy, audio, sensor, package, track-end);
+	* unlike `occupancy`/`audio` it discriminates nothing. See
+	* {@link NcSceneCondition} and D159.
+	*/
+	scene: NcSceneConditionSchema.optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -14429,18 +14811,47 @@ var NcConditionsSchema = object({
 	*/
 	labelEquals: array(string().min(1)).optional(),
 	/**
-	* Identity matcher. P1 boundary: matched against the record's collapsed
-	* `label` (the identity display name propagated by the face pipeline) —
-	* identity-ID matching rides in P2 when identity ids reach the record.
+	* KNOWN FACES — the rule's identity scope, and the switch that says the rule
+	* is about recognised people at all.
+	*
+	* Three states, and the empty one is the point:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the rule does not care who it is; an unrecognised person matches |
+	* | `[]` | **only known faces** — any identity in the gallery, nobody in particular |
+	* | a list | only these identities |
+	*
+	* `[]` is the repo-wide "no selection = no narrowing" reading (an absent
+	* `devices` list is every device), applied one level down: the operator has
+	* turned the face scope ON and narrowed it to nothing, which is every known
+	* face. No second field states the same thing — a switch that can disagree
+	* with the list under it is worse than no switch (D62).
+	*
+	* MEMBERS ARE FACE-GALLERY `Identity.id`s (uuid), not display names. A name is
+	* renameable, and a rule authored on "Gianluca" went silently dark the moment
+	* the operator fixed the spelling. The id reaches the record on
+	* `LabelAttribution.identityId`; the name is what the editor shows and what
+	* `{{label}}` renders.
+	*
+	* Rules written before this carry NAMES, and are resolved to ids lazily at
+	* load (`NcRuleStore.load`) against the live gallery — a name nothing answers
+	* for is left as it stands and reported, never dropped. The engine also
+	* accepts a display-name hit as a compatibility leg, so a rule whose
+	* migration could not resolve keeps matching exactly what it matched before.
 	*/
 	identities: array(string().min(1)).optional(),
-	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	/**
+	* KNOWN PLATES / VEHICLES — the plate mirror of {@link identities}, including
+	* the empty-list reading: `values: []` is "any plate the OCR could read",
+	* a non-empty list is those plates (fuzzily). See {@link NcPlateMatcherSchema}.
+	*/
 	plates: NcPlateMatcherSchema.optional(),
 	/**
-	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
-	* Same P1 boundary: matched against the record's collapsed `label` (the
-	* identity display name). A record with NO label passes (nothing to
-	* exclude), unlike the include variant which fails on an absent label.
+	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics, and
+	* the same id members and the same lazy name→id migration. A record with NO
+	* identity passes (nothing to exclude), unlike the include variant which
+	* fails on an unrecognised subject. An EMPTY list excludes nobody.
 	*/
 	identitiesExclude: array(string().min(1)).optional(),
 	/**
@@ -14832,7 +15243,80 @@ var NcRuleInputSchema = object({
 	* a rule that predates the gate must keep delivering byte-for-byte as it
 	* did, and absent is the only way to say that without a migration.
 	*/
-	confirm: NcConfirmSchema.optional()
+	confirm: NcConfirmSchema.optional(),
+	/**
+	* WAIT for face/plate recognition before saying anything.
+	*
+	* A notification's TEXT is frozen at enqueue and its media is re-resolved at
+	* send; the identity is neither. A face is confirmed after `confirmFrames`
+	* agreeing observations — p50 **11.4 s** after the track was first seen,
+	* measured on this hub — and an `immediate` rule enqueues on the first object
+	* event, seconds before that. So "Gianluca è arrivato" is unsayable on the
+	* immediate path, and no amount of media re-resolution fixes a sentence.
+	*
+	* Only two honest answers exist, and this flag picks between them. It has
+	* effect ONLY on a rule that declares a recognition scope
+	* ({@link NcConditions.identities} or {@link NcConditions.plates}) — on any
+	* other rule there is nothing to wait for and the flag is inert.
+	*
+	* | value | what happens |
+	* | --- | --- |
+	* | `true` | the rule stops firing on the object event and fires at TRACK CLOSE instead, once, with the name — later, and complete |
+	* | absent / `false` | it fires at once WITHOUT the name, and if recognition lands before the track closes a SECOND, "…is Gianluca" notification follows (one per track, per rule, per target) |
+	*
+	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
+	* on the addon cap path, and absent has to keep meaning exactly what every
+	* rule authored before this field meant.
+	*
+	* The cost of `true` is stated here because the editor states it too: a rule
+	* that waits also inherits track-close SEMANTICS — its `zones` condition
+	* tests every zone the track visited and a `crossing` condition can no longer
+	* be satisfied, because a closed track carries no crossing.
+	*/
+	waitForEnhancement: boolean().optional(),
+	/**
+	* GROUP a burst of subjects into ONE notification that grows.
+	*
+	* Seconds of quiet after the last matching subject before the burst is
+	* considered over. While it is open, the first subject enqueues immediately —
+	* **exactly as today, with no added latency** — and every real growth (a new
+	* subject, or a name confirmed on one already in it) REPLACES that
+	* notification with an updated one naming everybody. The push carries the
+	* group's own coalescing tag, so the phone replaces rather than stacks.
+	*
+	* `0` / absent = off, and off is today's behaviour byte for byte.
+	*
+	* ### Why an idle cutoff and not a window
+	*
+	* The measured seven-person arrival on device 590 spans 110 s with every
+	* internal gap under 30 s. A 12 s fixed window cuts it into three groups; an
+	* idle cutoff holds it as one and ends it when the arrival actually ends.
+	* 30 is Frigate's shipped value for the same decision.
+	*
+	* ### What it replaces
+	*
+	* The blind cooldown, which collapses a burst by DISCARDING it. Measured on
+	* device 615 / *Persona su Uscio* over six days: 116 qualifying tracks → 74
+	* notifications, **44 (37.9%) suppressed outright**, 23 of them overlapping a
+	* track that did fire and 7 carrying a confirmed identity nobody heard about.
+	* A group collapses the same volume by MERGING, so the cooldown becomes a
+	* budget over GROUPS — which is what it always meant — and a growth is never
+	* throttled by the window its own first member spent.
+	*
+	* ### Interaction with {@link waitForEnhancement}
+	*
+	* They compose, and the order matters. `waitForEnhancement` defers the rule to
+	* TRACK CLOSE, so with both set the group is opened by the first member to
+	* CLOSE — already carrying its name — and grows as later members close. That
+	* is later, and complete. With grouping alone the group opens on the first
+	* object event and picks up names as they are confirmed, through the growth
+	* path. Neither combination fires twice for one subject.
+	*
+	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
+	* on the addon cap path, so absent must keep meaning what it meant before this
+	* field existed.
+	*/
+	groupIdleSec: number().int().min(0).max(600).optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -14939,6 +15423,7 @@ var NcConditionDescriptorSchema = object({
 		"occupancy",
 		"audio",
 		"deviceState",
+		"scene",
 		"systemEvent"
 	]),
 	operator: _enum([
@@ -15344,7 +15829,87 @@ var MethodAccessSchema = _enum([
 var AllowedProviderSchema = union([literal("*"), array(string())]);
 var AllowedDevicesSchema = record(string(), union([literal("*"), array(string())]));
 var CapScopeSchema = _enum(["device", "system"]);
-var TokenScopeSchema = discriminatedUnion("type", [
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = discriminatedUnion("kind", [
+	object({ kind: literal("all") }),
+	object({
+		kind: literal("ids"),
+		ids: array(number().int()).min(1)
+	}),
+	object({
+		kind: literal("types"),
+		types: array(_enum(DeviceType)).min(1)
+	}),
+	object({
+		kind: literal("locations"),
+		locations: array(string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = object({
+	type: literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = preprocess(migrateLegacyTokenScope, discriminatedUnion("type", [
 	object({
 		type: literal("category"),
 		target: CapScopeSchema,
@@ -15360,18 +15925,8 @@ var TokenScopeSchema = discriminatedUnion("type", [
 		target: string(),
 		access: array(MethodAccessSchema).min(1)
 	}),
-	object({
-		type: literal("device"),
-		/**
-		* One or more deviceIds (serialised as strings for wire-format
-		* consistency with the rest of the union). Matcher accepts if
-		* `input.deviceId` ∈ `targets`. Array shape avoids the row-explosion
-		* of one scope-per-device when granting access to a set of cameras.
-		*/
-		targets: array(string()).min(1),
-		access: array(MethodAccessSchema).min(1)
-	})
-]);
+	DeviceTokenScopeSchema
+]));
 object({
 	id: string(),
 	username: string(),
@@ -15688,7 +16243,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace, hasRider) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -15824,7 +16379,21 @@ union([literal(1), literal(2)]);
 var LabelAttributionSchema = object({
 	stepId: string(),
 	modelId: string().optional(),
-	decidedAt: number()
+	decidedAt: number(),
+	/**
+	* The GALLERY id behind a recognised tier-2 label — a face-gallery
+	* `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
+	*
+	* The text alone is a DISPLAY NAME, and a display name is renameable: a
+	* notification rule authored on "Gianluca" stopped matching the moment the
+	* operator fixed the spelling in the gallery, and nothing said so. The id is
+	* the thing that does not move, so it is what a rule matches on
+	* (`NcConditions.identities`) and the text is what a human is shown.
+	*
+	* Absent when the label names no gallery row — a plate the OCR read but no
+	* vehicle claims, a sub-class, a species, any tier-1 value.
+	*/
+	identityId: string().optional()
 });
 /**
 * The TIERED label model (roadmap 4g), spread into `TrackSchema` and
@@ -15961,6 +16530,28 @@ var TrackSchema = object({
 	* `=== true` and render nothing otherwise, never infer "no face".
 	*/
 	hasFace: boolean().optional(),
+	/**
+	* This subject CONTAINS a folded rider — a person the rider-pairing step
+	* ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
+	* so the passage is tracked once and as a VEHICLE.
+	*
+	* It exists because the fold's record was dishonest. D34 and the code both
+	* said "the person is not lost — it is reported so both entities stay on the
+	* record"; in fact the pair went into a per-processor RAM field behind an
+	* accessor nobody called, and every durable surface said `vehicle`, full
+	* stop. This is the composition note that makes the row true.
+	*
+	* A COMPOSITION, never a class and never a label. "This vehicle contains a
+	* person" is not an answer to "what is this" — both label tiers would refuse
+	* a macro token anyway (D89), and correctly. Nothing here changes what the
+	* subject IS: a cyclist stays one vehicle track, occupancy still counts one,
+	* and a `person` rule still does not fire for someone cycling past.
+	*
+	* **Absent ≠ false**, exactly like {@link hasFace}: every row written before
+	* the column, and every hub that predates the field, omits it. Test
+	* `=== true` and render nothing otherwise — never infer "no rider".
+	*/
+	hasRider: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -16310,7 +16901,10 @@ var RecentTracksQueryInput = object({
 	*  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
 	cursor: string().optional(),
 	/** See {@link TrackProjectionSchema}. Default `full`. */
-	projection: TrackProjectionSchema.optional()
+	projection: TrackProjectionSchema.optional(),
+	/** Include stationary-promoted rows (parked objects). Default false: the
+	*  feed lists passages; parking records live on the stationary registry. */
+	includeStationary: boolean().optional()
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -16528,7 +17122,11 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	zone: TrackZoneFilterSchema.optional(),
 	/** See {@link TrackProjectionSchema}. Default `full` (backward
 	*  compatible — omitting the field keeps today's exact behaviour). */
-	projection: TrackProjectionSchema.optional()
+	projection: TrackProjectionSchema.optional(),
+	/** Include stationary-promoted rows (parked objects handed to the
+	*  stationary registry). Default false: the timeline lists passages,
+	*  not parking records (operator decision, 2026-08-15). */
+	includeStationary: boolean().optional()
 }), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -16692,11 +17290,16 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	auth: "admin"
 }), method(object({
 	eventId: string(),
-	kind: MediaFileKindEnum.optional()
+	kind: MediaFileKindEnum.optional(),
+	deviceId: number()
+}), array(MediaFileSchema).readonly()), method(object({
+	trackId: string(),
+	kinds: array(MediaFileKindEnum).optional(),
+	deviceId: number()
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
-	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+	deviceId: number()
+}), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
@@ -17356,6 +17959,17 @@ var maxSessionHoldMsField = {
 	default: 12e4,
 	step: 5e3
 };
+/**
+* Quiet period that closes an `audioMode: 'on-motion'` audio window. Floor of
+* 5s so a rearm can never degenerate into per-event stream churn; default 90s
+* comfortably outlives the gap between two PIR wakes on a battery camera.
+*/
+var audioMotionWindowMsField = {
+	min: 5e3,
+	max: 6e5,
+	default: 9e4,
+	step: 5e3
+};
 var motionFpsField = {
 	min: 1,
 	max: 30,
@@ -17368,10 +17982,26 @@ var detectionFpsField = {
 	default: 10,
 	step: 1
 };
+/**
+* The occupancy re-check interval. DEFAULT 300 s (2026-08-13 — was 30 s).
+*
+* The recheck is now on by default (a parked car is invisible to occupancy
+* rules until the stationary registry has been rebuilt by motion, which after a
+* restart may be never on a quiet camera). Each cycle re-subscribes a detection
+* session — an RTSP re-dial — so the switch is only affordable at a WIDE
+* interval: 300 s is ~12 re-dials an hour per camera, against 120 at the old
+* 30 s. A parked car is therefore counted within 5 minutes of a restart.
+*
+* Why not wider: `max` is 300 and raising it is TRAIN-BOUND, not addon-bound —
+* the host validates `attachCamera` against ITS copy of this schema, so a
+* runner asked for 600 would be rejected by the hub until a `@camstack/server`
+* carrying the wider bound is installed everywhere. 300 is the widest value
+* that ships with an addon deploy.
+*/
 var occupancyRecheckSecField = {
 	min: 0,
 	max: 300,
-	default: 30,
+	default: 300,
 	step: 5
 };
 var occupancyRecheckFramesField = {
@@ -17516,6 +18146,27 @@ var RunnerCameraConfigSchema = object({
 	* resolved `CameraDetectionConfig`.
 	*/
 	maxSessionHoldMs: number().min(maxSessionHoldMsField.min).max(maxSessionHoldMsField.max).optional(),
+	/**
+	* Orchestrator-side quiet period (ms) that closes an `audioMode:
+	* 'on-motion'` audio window, measured from the LAST motion event.
+	*
+	* This exists because the falling edge cannot be relied on. Camera-native
+	* providers emit motion as a RISING EDGE ONLY (Reolink's Baichuan push and
+	* its email-push SMTP path both emit `detected: true` and never the
+	* counterpart); only the frame-diff analyzer emits falls. So on an
+	* onboard-only camera a window that closed only on `detected: false` never
+	* closed at all, and `on-motion` silently behaved as `always-on` — on a
+	* battery camera, the one failure mode the mode exists to prevent.
+	*
+	* Every motion event rearms this timer WITHOUT restarting the stream, so a
+	* burst of re-fires costs nothing. A falling edge, when one does arrive,
+	* still closes earlier via `motionCooldownMs` — whichever comes first wins.
+	*
+	* Not consumed by the runner: carried here so it shares the per-camera
+	* device-settings surface with `motionCooldownMs`, exactly like
+	* `maxSessionHoldMs`.
+	*/
+	audioMotionWindowMs: number().min(audioMotionWindowMsField.min).max(audioMotionWindowMsField.max).optional(),
 	motionFps: number().min(motionFpsField.min).max(motionFpsField.max).default(motionFpsField.default),
 	detectionFps: number().min(detectionFpsField.min).max(detectionFpsField.max).default(detectionFpsField.default),
 	motionStreamId: string(),
@@ -17569,15 +18220,21 @@ var RunnerCameraConfigSchema = object({
 	*/
 	onboardMotionDrivesAnalyzer: boolean().default(true),
 	/**
-	* Master toggle for the occupancy re-check. When `false` (DEFAULT) the runner
-	* never arms the periodic recheck timer, regardless of `occupancyRecheckSec` —
-	* this is off by default because the recheck re-subscribes a detection session
-	* every N seconds while `watching`, a major source of pull-decoder re-dial
-	* churn (each cycle creates+tears a session → RTSP re-dial → latency). The
+	* Master toggle for the occupancy re-check. When `false` the runner never arms
+	* the periodic recheck timer, regardless of `occupancyRecheckSec`; the
 	* `occupancyRecheckSec` / `occupancyRecheckFrames` sliders only take effect
 	* (and only render) when this is enabled.
-	*/
-	occupancyRecheckEnabled: boolean().default(false),
+	*
+	* DEFAULT `true` since 2026-08-13 (was `false`). It was off because the
+	* recheck re-subscribes a detection session every N seconds while `watching`
+	* — each cycle creates+tears a session ⇒ an RTSP re-dial ⇒ latency, a major
+	* pull-decoder churn source. What that bought was a blind spot: a STATIONARY
+	* object is counted only while the stationary registry holds it, and the
+	* registry rebuilds from motion, so after a restart a parked car was invisible
+	* to every occupancy rule until something moved in front of it. The churn is
+	* now paid on the interval instead — see `occupancyRecheckSecField`.
+	*/
+	occupancyRecheckEnabled: boolean().default(true),
 	occupancyRecheckSec: number().min(occupancyRecheckSecField.min).max(occupancyRecheckSecField.max).default(occupancyRecheckSecField.default),
 	occupancyRecheckFrames: number().min(occupancyRecheckFramesField.min).max(occupancyRecheckFramesField.max).default(occupancyRecheckFramesField.default),
 	/**
@@ -17605,7 +18262,7 @@ var RunnerCameraConfigSchema = object({
 	*/
 	inferenceDevices: array(RunnerInferenceDeviceSchema).readonly().optional()
 });
-motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
+motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, audioMotionWindowMsField.min, audioMotionWindowMsField.max, audioMotionWindowMsField.step, audioMotionWindowMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
 /**
 * Runtime load summary returned by `getLocalLoad`. Used by the orchestrator's
 * load-balancing levels (L2 capacity-based, L3 hardware-aware) to decide
@@ -18621,7 +19278,16 @@ targets: array(object({
 	/** A sleeping battery camera: the frame is deliberately stale and will
 	*  NOT refresh in the background. A surface should say so rather than
 	*  present it as current. */
-	sleeping: boolean()
+	sleeping: boolean(),
+	/** Current device state rendered over the cached frame. State images
+	*  remain authoritative even when their photographic background is
+	*  old; null means the link must carry a current camera frame. */
+	stateReason: _enum([
+		"disabled",
+		"sleeping",
+		"unreachable",
+		"waking"
+	]).nullable()
 })));
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
@@ -20143,6 +20809,25 @@ var BatteryStatusSchema = object({
 	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
 	lastUpdated: number(),
 	/**
+	* Ms epoch of the last time the device PROVED it was reachable — a
+	* completed firmware round-trip, an observed wake, or an inbound push
+	* (firmware event, email). `0`/absent = never since this slice was born.
+	*
+	* This is the ONLY input that separates "asleep" from "gone", and it is
+	* fed exclusively by PASSIVE signals: nothing may write it by reaching
+	* for the radio, because a poll that confirms reachability is the same
+	* poll that drains the battery. See {@link deriveBatteryPresence} — the
+	* single derivation every consumer must use; no surface computes its own.
+	*
+	* It is deliberately NOT a clock in the
+	* `scripts/check-runtime-state-durability.ts` sense: it is the
+	* observation itself, and it is the only thing a 30-hour silence is
+	* visible in. Writers quantise it (see `CONTACT_WRITE_QUANTUM_MS` in the
+	* Reolink provider) so a value that means "recently" cannot cost a
+	* SQLite commit per round-trip.
+	*/
+	lastContactAt: number().optional(),
+	/**
 	* True when the source is a BINARY low-battery indicator (HA
 	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
 	* charge level — `percentage` is then a coarse stand-in (100 = normal,
@@ -23680,7 +24365,7 @@ method(object({
 	toMs: number()
 }), RecordingAvailabilitySchema, {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number(),
 	fromMs: number(),
@@ -23688,14 +24373,14 @@ method(object({
 	tzOffsetMinutes: number()
 }), RecordingDaysSchema, {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
 }), method(object({
 	deviceId: number(),
 	fromMs: number(),
 	toMs: number()
 }), RecordingManifestSchema, {
 	kind: "query",
-	auth: "admin"
+	auth: "protected"
 }), method(object({}), RecordingStorageUsageSchema, {
 	kind: "query",
 	auth: "admin"
@@ -23985,14 +24670,77 @@ method(object({
 * thing except the comparator: `similarity` (CLIP cosine at the same ROI coords
 * vs condition-tagged references) and `llm` (vision-LLM judgment over the crop).
 *
-* D14 device-config archetype (`deviceConfig.ui.kind:'widget'`) — the framework
-* derives the device-detail contribution; the provider carries NO hand-written
-* settings-contribution methods. `status.kind:'push'` — the engine pushes on
-* every hysteresis flip / availability change; consumers never poll.
-*/
-/** Extensible condition tag. Seeded 'day' | 'night'; open by design so more can
-*  be added without a wire break (matching falls back to any-condition refs). */
+* **No `deviceConfig`, deliberately.** This shipped as the D14 widget archetype,
+* which put a "Scenes" tab on one camera's detail page. That is the wrong shape
+* for the thing: a scene is a standing question about the property ("is the bin
+* still out"), and the operator's question is "which of my scenes have tripped",
+* across every camera at once — not "what does camera 617 think". Buried one
+* camera deep it also could not be found. The surface is now a top-level admin
+* page (`/scenes`, `pages/Scenes.tsx`) that lists every scene on every camera and
+* picks the camera inside the create flow, the same shape Events and Faces have.
+*
+* The consequence to keep in mind: `host/scene-monitor-editor` is gone from
+* `HOST_WIDGETS` too. `scripts/check-host-widget-resolves.ts` asserts BOTH
+* directions, so a registration nobody declares fails exactly as loudly as a
+* declaration nobody registers. The editor is imported directly by the page.
+*
+* `status.kind:'push'` — the engine pushes on every hysteresis flip /
+* availability change; consumers never poll.
+*/
+/** Extensible condition tag. Seeded 'day' | 'ir' (the two variants the operator
+*  captures) plus 'night' | 'dawn' | 'dusk' from the resolver's sun-times band.
+*  Open by design so more can be added without a wire break.
+*
+*  Matching does NOT fall back across conditions: cross-condition cosines are
+*  not comparable, so "I have never seen this scene in this light" is reported
+*  as `unknown`, never guessed. A day reference scored against an IR frame
+*  collapses the cosine and would latch a false alarm every single night. */
 var SceneConditionSchema = string();
+/**
+* What a scene does when the CURRENT light has no reference of its own.
+*
+* The lighting variants are not equally likely to exist. Almost every operator
+* captures daylight and then never stands outside at 22:00 to capture IR, and a
+* scene that is only ever going to be asked about a daytime question ("is the
+* bin still on the kerb at 08:00") does not need a night reference at all. The
+* night half must therefore be OPTIONAL, and optional means the scene keeps
+* working without it rather than degrading into a permanent complaint.
+*
+* - `skip` (default) — the check in that light is not made. Not a verdict, not
+*   an alarm, not even an `unknown`: the live state simply stays whatever the
+*   last covered light left it at, the latch is untouched, and the hysteresis
+*   run is neither spent nor cleared. The scene resumes by itself at first
+*   light. This is the only behaviour under which "I never captured IR" is a
+*   configuration choice instead of a nightly fault.
+* - `judge-anyway` — score against the OTHER conditions' references. Available
+*   for cameras whose IR frame is close enough to daylight (a floodlit
+*   driveway, an always-white-light doorbell), and wrong for everything else:
+*   cross-condition cosines are not comparable, so a day reference against a
+*   true IR frame collapses and the scene reports a theft at 21:40.
+*
+* Never applies when the scene has NO comparable reference at all — that is
+* "not armed yet", it is reported as `no-reference-for-condition`, and silence
+* there would hide a scene the operator never finished setting up.
+*/
+var SceneUncoveredPolicySchema = _enum(["skip", "judge-anyway"]);
+/** `matched` = the baseline is what we see; `diverged` = it demonstrably is not;
+*  `unknown` = we cannot judge (no reference for this condition, encoder model
+*  changed, view shifted, no snapshot). `unknown` is a real value, not a null,
+*  and never counts toward hysteresis in either direction. */
+var SceneVerdictSchema = _enum([
+	"matched",
+	"diverged",
+	"unknown"
+]);
+/** Why a scene cannot judge. Named, because this feature's failure mode is
+*  silence that reads as "nothing has happened". */
+var SceneUnavailableSchema = _enum([
+	"no-reference-for-condition",
+	"view-shifted",
+	"no-vision-profile",
+	"encoder-model-changed",
+	"no-snapshot"
+]);
 /** One captured reference — condition-tagged, model-version-gated. `embedding`
 *  is `number[]` (Float32Array does NOT survive MsgPack/UDS). */
 var SceneReferenceSchema = object({
@@ -24000,7 +24748,14 @@ var SceneReferenceSchema = object({
 	modelId: string(),
 	condition: SceneConditionSchema,
 	capturedAt: number(),
-	thumbnailMediaId: string().optional()
+	thumbnailMediaId: string().optional(),
+	/** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
+	*  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
+	*  normalized rect frame a different piece of world, and the scene would
+	*  diverge forever with a perfectly plausible cosine. Checked LAZILY, only
+	*  when hysteresis is about to flip — one extra encode per candidate
+	*  transition, not per poll. */
+	anchorEmbedding: array(number()).optional()
 });
 var SceneMonitorStateSchema = object({
 	id: string(),
@@ -24022,6 +24777,28 @@ var SceneCheckSchema = discriminatedUnion("mode", [object({
 	profileId: string().optional(),
 	hysteresisCount: number().int().positive()
 })]);
+var SCENE_DEFAULT_ANCHOR_THRESHOLD = .85;
+/** Night is OPTIONAL. A scene with only a daylight reference sits the IR hours
+*  out in silence rather than reporting a fault every night. */
+var SCENE_DEFAULT_UNCOVERED_POLICY = "skip";
+/**
+* Vision-model adjudication of a candidate flip. Field names deliberately
+* mirror `NcConfirmSchema` so an operator meets one vocabulary, not two.
+*
+* `onTimeout` defaults to **'hold'**, the OPPOSITE of `NcConfirmGate`'s
+* fail-open: a notification suppressed is the worse error there, but a vision
+* model that timed out has not told us the bin is gone, and a latch is a
+* stateful claim that costs the operator a trip to reset.
+*/
+var SceneConfirmSchema = object({
+	enabled: boolean().default(false),
+	prompt: string().min(1).max(1e3),
+	profileId: string().optional(),
+	timeoutMs: number().int().min(1e3).max(2e4).default(8e3),
+	maxImagePx: number().int().min(64).max(2048).default(448),
+	/** What a timeout / unavailable model means for the PENDING flip. */
+	onTimeout: _enum(["flip", "hold"]).default("hold")
+});
 var SceneMonitorSchema = object({
 	id: string(),
 	label: string(),
@@ -24040,7 +24817,56 @@ var SceneMonitorSchema = object({
 	lastConfidence: number().nullable(),
 	currentCondition: SceneConditionSchema.nullable(),
 	availability: _enum(["ok", "unavailable"]),
-	unavailableReason: string().nullable()
+	unavailableReason: string().nullable(),
+	/** Which state is "the initial screen". `null` until the first capture. */
+	baselineStateId: string().nullable(),
+	/** Which boolean drives notification rules and any export. */
+	emit: _enum(["latched", "live"]).default("latched"),
+	/** Live: does the region match the baseline RIGHT NOW. */
+	verdict: SceneVerdictSchema,
+	/** Has it been `diverged` at least once since `armedAt` — the operator's boolean. */
+	latched: boolean(),
+	/** Last reset (or creation). */
+	armedAt: number(),
+	divergedAt: number().nullable(),
+	restoredAt: number().nullable(),
+	/** A check is only COUNTED when the device has been quiet this long. Motion
+	*  during the window DISCARDS the observation — a car pulling up in front of
+	*  the bin must not be able to spend hysteresis credit. */
+	quietSeconds: number().int().min(0).max(3600).default(60),
+	/** An observation only advances the pending count when it is at least this
+	*  far from the previously counted one, so N agreeing checks span real time
+	*  rather than N adjacent polls inside one occlusion. */
+	minObservationSpacingSec: number().int().min(0).max(3600).default(120),
+	/** Vision-model adjudication of a candidate flip. Similarity primary only. */
+	confirm: SceneConfirmSchema.optional(),
+	/** Whole-frame anchor cosine below which a flip is REFUSED as `view-shifted`. */
+	anchorThreshold: number().min(0).max(1).default(SCENE_DEFAULT_ANCHOR_THRESHOLD),
+	/** Clear the latch on its own when the scene matches again? Default false —
+	*  `restoredAt` and the `scene-restored` edge are recorded regardless, so an
+	*  automation can react to the bin coming back without the operator's own
+	*  alarm silently clearing itself. */
+	autoRestore: boolean().default(false),
+	/** What to do when the current light has no reference of its own. See
+	*  {@link SceneUncoveredPolicySchema} — the default makes night OPTIONAL. */
+	onUncoveredCondition: SceneUncoveredPolicySchema.default(SCENE_DEFAULT_UNCOVERED_POLICY),
+	/**
+	* The light whose checks are currently being SAT OUT under
+	* `onUncoveredCondition: 'skip'` — `null` when the scene is checking normally.
+	*
+	* Engine-reported and advisory only: it moves no verdict, no latch and no
+	* hysteresis. It exists so the card can say *"night (IR) — checks paused,
+	* nothing captured in this light"* in the same calm voice as the coverage
+	* line, because the alternative is a scene that silently stops answering
+	* after sunset with nothing anywhere saying why. A skipped check must never
+	* read as a broken one.
+	*/
+	suspendedCondition: SceneConditionSchema.nullable().default(null),
+	/** Named cause when `verdict === 'unknown'`. */
+	unavailable: SceneUnavailableSchema.nullable(),
+	/** Conditions that have at least one comparable reference — the coverage line
+	*  ("day ✓ · ir ✓ · dusk ✗") that turns a silent fallback into a visible fact. */
+	coveredConditions: array(SceneConditionSchema)
 });
 var SceneMonitorStatusSchema = object({
 	monitors: array(SceneMonitorSchema),
@@ -24073,7 +24899,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), SceneMonitorStatusSche
 			"both"
 		]).optional(),
 		checkIntervalSec: number().optional(),
-		check: SceneCheckSchema.optional()
+		check: SceneCheckSchema.optional(),
+		emit: _enum(["latched", "live"]).optional(),
+		quietSeconds: number().int().min(0).max(3600).optional(),
+		minObservationSpacingSec: number().int().min(0).max(3600).optional(),
+		anchorThreshold: number().min(0).max(1).optional(),
+		autoRestore: boolean().optional(),
+		onUncoveredCondition: SceneUncoveredPolicySchema.optional(),
+		/** `null` clears the vision-model adjudicator. */
+		confirm: SceneConfirmSchema.nullable().optional()
 	})
 }), _void(), {
 	kind: "mutation",
@@ -24110,6 +24944,14 @@ DeviceType.Camera, method(object({ deviceId: number() }), SceneMonitorStatusSche
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	monitorId: string(),
+	/** Defaults to TRUE at the provider seam — see `SCENE_RESET_RECAPTURES`. */
+	recapture: boolean().optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * Per-stage gating mode applied to the zones a rule references.
@@ -24263,6 +25105,16 @@ var CamStreamDescriptorSchema = object({
 	/** Transport-specific opaque metadata (e.g. rfc4571 SDP). */
 	metadata: record(string(), unknown()).optional()
 });
+object({
+	/** The descriptors as last built from a real camera response. Never a guess:
+	*  a failed or refused build writes NOTHING, so a restored catalog is always
+	*  one the camera itself once produced. */
+	descriptors: array(CamStreamDescriptorSchema),
+	/** Ms epoch of the build that produced {@link descriptors}. Lets the wake
+	*  path decide whether the camera's own awake window is worth spending on a
+	*  re-read. */
+	lastFetchedAt: number()
+});
 DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(CamStreamDescriptorSchema).readonly());
 /** One of the camera's stream profiles. */
 var StreamProfileSchema = _enum([
@@ -24418,12 +25270,64 @@ var NetworkAddressSchema = object({
 	family: string(),
 	internal: boolean()
 });
+/**
+* Provenance of the site coordinates, and the whole reason this is not just two
+* numbers.
+*
+*   - `operator-set` — a human typed it, or accepted a detection. Authoritative;
+*     nothing overwrites it.
+*   - `derived-from-ip` — the hub geolocated its own public IP once, because a
+*     default that is right to a few kilometres beats the coarse UTC clock split
+*     the sun-times consumers otherwise fall back to.
+*
+* The UI shows which one it is. An operator who cannot tell a guess from their
+* own input will eventually trust the guess.
+*/
+var SiteLocationSourceSchema = _enum(["operator-set", "derived-from-ip"]);
+/**
+* The read shape: the location plus the honest state of the one-shot derivation.
+*
+* `derivationAttemptedAt` is what makes the "one call, ever" contract
+* inspectable. When it is set and `location` is null, the geo-IP lookup ran and
+* failed; the hub will NOT try again on its own — the fallback is declared
+* (consumers degrade to their own last resort) and the operator either types the
+* coordinates or presses detect.
+*/
+var SiteLocationStatusSchema = object({
+	location: object({
+		/** WGS84 decimal degrees. */
+		latitude: number().min(-90).max(90),
+		longitude: number().min(-180).max(180),
+		source: SiteLocationSourceSchema,
+		/** Epoch ms the value was last written. */
+		updatedAt: number(),
+		/**
+		* Human-readable place the geo-IP service reported ("Napoli, IT"). Display
+		* only — never parsed, never matched on. Absent for an operator-typed value.
+		*/
+		label: string().optional()
+	}).nullable(),
+	derivationAttemptedAt: number().nullable(),
+	/** Why the last derivation failed, for the UI to show instead of a shrug. */
+	derivationError: string().nullable()
+});
+/** `null` clears the location and re-arms nothing — the derivation stays spent. */
+var SetSiteLocationInputSchema = object({
+	latitude: number().min(-90).max(90),
+	longitude: number().min(-180).max(180)
+}).nullable();
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), SiteLocationStatusSchema), method(SetSiteLocationInputSchema, SiteLocationStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), SiteLocationStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 object({
 	/** True when the device's tamper switch / case-open contact is
@@ -27153,6 +28057,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"llm.cancel": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.deleteModel": {
 		capName: "llm",
 		capScope: "system",
@@ -27237,6 +28147,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"llm.resolveModelRef": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.setDefault": {
 		capName: "llm",
 		capScope: "system",
@@ -29403,6 +30319,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"sceneMonitor.resetScene": {
+		capName: "scene-monitor",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"sceneMonitor.updateScene": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -30081,6 +31003,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.detectSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.featureFlags": {
 		capName: "system",
 		capScope: "system",
@@ -30099,6 +31027,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.getSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.health": {
 		capName: "system",
 		capScope: "system",
@@ -30123,6 +31057,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.setSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.adoptLegacyMonitor": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -30694,6 +31634,1704 @@ Object.freeze({
 		access: "create"
 	}
 });
+Object.freeze({
+	"accessories.setChildHidden": [{
+		name: "childDeviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"addonSettings.getDeviceSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"addonSettings.updateDeviceSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"alarmPanel.arm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"alarmPanel.disarm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"alarmPanel.trigger": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioAnalysis.resolveDeviceSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioAnalyzer.classify": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"audioMetrics.getCurrentSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioMetrics.getHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"automationControl.disable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"automationControl.enable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"automationControl.trigger": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"battery.wakeForStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"brightness.setBrightness": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"button.press": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraCredentials.getCredentials": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getBrokerStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getCameraStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getProfileRtspEntries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.getRtspEntries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraStreams.pickStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setFanMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setPreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setSwingHorizontal": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setSwingVertical": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setTarget": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setTargetHumidity": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.setTargetRange": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"color.setColor": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"consumables.reset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"control.setValue": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.close": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.open": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.setPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.setTiltPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cover.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dayNight.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"dayNight.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"decoder.createSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceAdoption.release": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceAdoption.resync": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.adoptDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.listDiscovered": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.refreshDiscovery": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceDiscovery.releaseDevice": [{
+		name: "childDeviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.adoptionRelease": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.adoptionResync": [{
+		name: "camDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.applyInitialMeta": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "linkDeviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceManager.disable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.enable": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getBindings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getChildren": [{
+		name: "parentDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getConfigSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceLiveInfoAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceSettingsAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceStatusAggregate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getDeviceStatusAggregateBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"deviceManager.getLinkedDevices": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getSettingsSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getStreamProfileMap": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getStreamSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.getWireableFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.loadConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.loadMeta": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.loadRuntimeState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.persistConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.probeStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.registerDevice": [{
+		name: "parentDeviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceManager.remove": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.removeDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.runDeviceAction": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setChildLayout": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setDisabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setDisplay": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setIntegrationId": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setLinkDeviceId": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "linkDeviceId",
+		form: "single",
+		optional: true
+	}],
+	"deviceManager.setLocation": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setMetadata": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setName": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setPrimaryChildEntityId": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setRole": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setStreamProfileMap": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setType": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.setWrapperActive": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.testField": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.updateConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.updateDeviceField": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceManager.updateDeviceFieldsBatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getConfigEntries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getRawState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getSettingsSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.getStreamSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.removeDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.runAction": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceOps.setConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.getCapSlice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.getSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.setCapSlice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"events.getEventClipUrl": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"events.getEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"events.getEventThumbnail": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"faceGallery.getFaceByTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"faceGallery.listRecentFaces": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"fanControl.setDirection": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"fanControl.setOscillating": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"fanControl.setPercentage": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"fanControl.setPreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"humidifier.setMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"humidifier.setOn": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"humidifier.setTargetHumidity": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"imageSettings.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"imageSettings.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.endTalkSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.handleAnswer": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.pushTalkAudio": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.startSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.startTalkSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"intercom.stopSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lawnMowerControl.dock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lawnMowerControl.pause": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lawnMowerControl.startMowing": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lockControl.lock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lockControl.open": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"lockControl.unlock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.next": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.pause": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.play": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.playMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.previous": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.seek": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.selectSource": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setMute": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setRepeat": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setShuffle": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.setVolume": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motion.isDetected": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionDetection.analyze": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionDetection.removeCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionTrigger.setMotionTrigger": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionZones.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionZones.setZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"nativeObjectDetection.setEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"networkQuality.getDeviceStats": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"networkQuality.reportClientStats": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"notificationRules.setDeviceMuted": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"notifier.cancel": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"notifier.send": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osd.setOverlay": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.clearSlotBinding": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.copyDeviceConfiguration": [{
+		name: "sourceDeviceId",
+		form: "single",
+		optional: false
+	}, {
+		name: "targetDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.getDeviceOsd": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.getSourceCatalog": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.previewSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.renderDevice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osdManager.setSlotBinding": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.callPet": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.cancelFeed": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.feed": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.markFoodReplenished": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.playSound": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.resetDesiccant": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setChildLock": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setFeedSound": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setIndicatorLight": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFeeder.setVolume": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.clearTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.completeRetrainTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.deleteDeviceEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.deleteTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.deselectRetrainFrame": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getActiveTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getAudioEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getEventDensity": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getKeyEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getMotionEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getObjectEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getRetrainExportUrl": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.getSensorEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getTrackMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getTrainingExportSummary": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.getTrainingExportUrl": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.listEventKinds": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.listEventKindsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"pipelineAnalytics.listOpsLog": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineAnalytics.listRecentTracks": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"pipelineAnalytics.listRetrainStaging": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineAnalytics.listTrackMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.listTracks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.proposeRetrainAnnotations": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.pruneEventsBefore": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.pruneTracksBefore": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.rebuildObjectEmbeddings": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineAnalytics.restageRetrainTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.saveRetrainAnnotations": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.searchObjectEvents": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineAnalytics.selectRetrainFrames": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.setTrackFlags": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.wipeAllAnalytics": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineExecutor.runPipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineExecutor.runPipelineBatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"pipelineOrchestrator.assignAudio": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.assignPipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getAudioAssignment": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraMetrics": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraStatuses": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
+	"pipelineOrchestrator.getCameraStepOverrides": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getCameraSwitches": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getPipelineAssignment": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getPipelineDevicePin": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.resolvePipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraPipelineForAgent": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraStepOverride": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraStepToggle": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setCameraSwitch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.setPipelineDevicePin": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.unassignAudio": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.unassignPipeline": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.attachCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.detachCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.getCameraMetrics": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.reportMotion": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.runDetailSubtree": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineRunner.runStatelessStep": [{
+		name: "sourceDeviceId",
+		form: "single",
+		optional: false
+	}],
+	"plateGallery.getPlateByTrack": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"plateGallery.listPlates": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"privacyMask.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"privacyMask.setAudioEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"privacyMask.setMask": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.continuousMove": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.deletePreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.getPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.getPresets": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.goHome": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.goToPreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.move": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.savePreset": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.setAutofocus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptz.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.getSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.setEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"ptzAutotrack.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"reboot.reboot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.deleteFootprint": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getAvailability": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getDaysWithRecordings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getDeviceConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.getPlaybackManifest": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.listOpsLog": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"recording.locateSegment": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.pruneFootage": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.readGopBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.readSegmentBytes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.relocateFootage": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"recording.renderClip": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.renderGif": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.rescanStorage": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.setDeviceConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recording.startStorageMigrationMove": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"recordingExport.createExport": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recordingExport.listExports": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"sceneMonitor.captureReference": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.createScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.deleteReference": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.deleteScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.listScenes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.recheckNow": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.resetScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"sceneMonitor.updateScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"scriptRunner.run": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"scriptRunner.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"snapshot.getSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"snapshot.getSnapshotLinks": [{
+		name: "targets",
+		form: "object-array",
+		optional: false,
+		itemField: "deviceId"
+	}],
+	"snapshot.getSnapshotOverview": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
+	"snapshot.invalidateCache": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.acquireEgressTranscode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.assignProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.getDeviceAudioMute": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.getStreamWithCodec": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.produceEventMedia": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.publishCameraStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.renderPreBufferClip": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.restartProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.retractCameraStream": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.setDeviceAudioMute": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.unassignProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamCatalog.getCatalog": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamParams.getConfigSchema": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamParams.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamParams.setProfile": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"switch.setState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.locate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.pause": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.returnToBase": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.setFanSpeed": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.start": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.close": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.open": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.setPosition": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"valve.stop": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"videoclips.getClipPlayback": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"videoclips.listClips": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"waterHeater.setAway": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"waterHeater.setOperationMode": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"waterHeater.setTargetTemp": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.addIceCandidate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.closeSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.createSession": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.getIceCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.getSessionState": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.handleAnswer": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.handleOffer": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.hasAdaptiveBitrate": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"webrtcSession.listStreams": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getCameraHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getCurrentSnapshot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getUnzonedHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneAnalytics.getZoneHistory": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneRules.listRules": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zoneRules.setRules": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.addZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.listZones": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.removeZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"zones.updateZone": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}]
+});
 Object.freeze({
 	"broker": "broker",
 	"device-export": "device-export",
@@ -32433,6 +35071,21 @@ var ntfyAdapter = {
 				max: 1
 			},
 			actions: MAX_ACTIONS$1,
+			/**
+			* ntfy has NO per-action icon, and this says so out loud.
+			*
+			* Its action object is `{action, label, url, clear, headers, body}` and the
+			* `X-Actions` header form is `action, label, url[, extras]` — there is no
+			* icon field in either, and the `icon` ntfy does have is the NOTIFICATION's
+			* icon (an attachment URL, handled above), not a per-button one.
+			*
+			* Left EXPLICIT rather than absent: absent and `false` behave identically
+			* (the degrade engine reads a missing value as unsupported), but only one
+			* of them proves somebody checked. The degrade engine then strips the icon
+			* centrally and puts `actionIcons` in `renderedAs.dropped`, so the loss is
+			* reported instead of being discovered on a phone.
+			*/
+			actionIcons: false,
 			levels: [
 				{
 					id: "min",
@@ -33616,6 +36269,82 @@ function userIdsFrom(config) {
 	return [];
 }
 /**
+* Canonical icon token → the string Zentik's client actually renders.
+*
+* ── EVIDENCE (read from the Zentik sources, not guessed) ────────────
+* `NotificationActionDto.icon` is `@IsOptional() @IsString()` — the BACKEND
+* validates nothing, so a wrong value is accepted, stored and delivered. The
+* rendering happens on the client, and both iOS paths do the same thing
+* (`ZentikNotificationService/NotificationService.swift`,
+* `ZentikNotificationContentExtension/NotificationViewController.swift`):
+*
+*     let actualIconName = iconName.hasPrefix("sfsymbols:")
+*       ? String(iconName.dropFirst("sfsymbols:".count)) : iconName
+*     icon = UNNotificationActionIcon(systemImageName: actualIconName)
+*
+* So the value is an **SF Symbol name**, with an optional `sfsymbols:` prefix
+* that is stripped. Zentik's own UI confirms the convention: its icon field
+* placeholder is "e.g., house.fill, heart, gear" and its picker writes
+* `sfsymbols:${iconName}`.
+*
+* `UNNotificationActionIcon(systemImageName:)` with a name iOS does not know
+* renders NOTHING — silently. That is the whole failure: we sent `silence`,
+* `arm` and `disarm`, none of which are SF Symbols, and every button arrived
+* blank with nothing anywhere saying why.
+*
+* The prefix is emitted explicitly even though bare names work, because the
+* bare form is indistinguishable from an un-translated intent token in a
+* captured payload — and telling those two apart is what cost the time.
+*
+* A `Record` over the closed enum, NOT a lookup with a fallback: adding a
+* vocabulary member without deciding its glyph fails the build here.
+*
+* Android: Zentik's Android client does not render per-action icons at all
+* (an Android notification action needs a bundled drawable, not a name), so
+* this is an iOS/watchOS enrichment and a no-op elsewhere — which is a
+* cosmetic loss, not a wrong glyph.
+*/
+var ZENTIK_ACTION_ICONS = {
+	acknowledge: "checkmark.circle",
+	dismiss: "xmark.circle",
+	silence: "bell.slash",
+	snooze: "zzz",
+	view: "eye",
+	play: "play.fill",
+	open: "door.left.hand.open",
+	close: "door.left.hand.closed",
+	lock: "lock.fill",
+	unlock: "lock.open.fill",
+	arm: "shield.fill",
+	"arm-home": "house.fill",
+	"arm-away": "figure.walk",
+	"arm-night": "moon.fill",
+	disarm: "shield.slash.fill",
+	light: "lightbulb.fill",
+	alert: "exclamationmark.triangle.fill",
+	camera: "video.fill"
+};
+/** The `sfsymbols:` prefix Zentik's clients strip before resolving the symbol. */
+var SFSYMBOLS_PREFIX = "sfsymbols:";
+/**
+* The Zentik value for one icon token, or `undefined` when there is none.
+*
+* Typed on `string`, not on `NotificationActionIcon`, because that is what this
+* boundary actually receives: an addon deployed against a hub whose vocabulary
+* moved on hands over a token this build has never heard of. Omitting it is the
+* honest answer — forwarding it raw would put a string iOS ignores on the wire
+* and produce exactly the blank button this map exists to fix.
+*
+* `Object.hasOwn` and not a truthiness check: an inherited `toString` must not
+* read as a mapping.
+*/
+function zentikActionIcon(icon) {
+	const table = ZENTIK_ACTION_ICONS;
+	if (!Object.hasOwn(ZENTIK_ACTION_ICONS, icon)) return void 0;
+	const symbol = table[icon];
+	return symbol === void 0 ? void 0 : `${SFSYMBOLS_PREFIX}${symbol}`;
+}
+/**
 * How a `BACKGROUND_CALL` names its request: `METHOD::url`.
 *
 * The whole reason the type exists here: a "silence this for 30 minutes"
@@ -33627,9 +36356,10 @@ var BACKGROUND_CALL_PREFIX = "POST::";
 function actionsFor(prepared) {
 	const out = [];
 	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) {
+		const symbol = action.icon === void 0 ? void 0 : zentikActionIcon(action.icon);
 		const decoration = {
 			...action.destructive !== void 0 ? { destructive: action.destructive } : {},
-			...action.icon !== void 0 ? { icon: action.icon } : {}
+			...symbol !== void 0 ? { icon: symbol } : {}
 		};
 		if (action.url === void 0 || action.url.length === 0) {
 			out.push({
@@ -33821,12 +36551,14 @@ var zentikAdapter = {
 			format: ["text"],
 			clickUrl: true,
 			/**
-			* `NotificationActionDto.icon` is a documented field, so the engine hands
-			* the icon over instead of stripping it centrally. What Zentik's client
-			* DRAWS for a given name is not documented — so the intent name travels
-			* verbatim, exactly as the webhook kind forwards it, and a name the app
-			* does not know renders as no icon rather than as a wrong one. This is a
-			* pass-through claim, not a rendering claim.
+			* A RENDERING claim, which it was not before.
+			*
+			* This used to say the intent name "travels verbatim … a name the app does
+			* not know renders as no icon rather than as a wrong one" — true, and it
+			* described a feature that never once drew an icon, because NO intent name
+			* is an SF Symbol. The engine handed the icon over and the adapter put it
+			* on the wire untranslated. `ZENTIK_ACTION_ICONS` is what makes this claim
+			* honest; keep it exhaustive or this reverts to a pass-through that lies.
 			*/
 			actionIcons: true,
 			sound: true,