@camstack/addon-osd-manager 0.1.140 → 0.1.142

package/dist/index.mjs

@@ -5359,7 +5359,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BaRu0bS5.mjs
+//#region ../types/dist/sleep-DC-wdyeS.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6144,6 +6144,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -9498,6 +9532,43 @@ var LogChannelWindowSchema = object({
 	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
 	deviceIds: array(number().int()).readonly().nullable()
 });
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -9701,7 +9772,14 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -15303,6 +15381,42 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*
+* `trackedDeviceIds` (D655) is the tracked-event opt-in, exactly what
+* `_linkedDeviceTrackedIds` persists: which linked devices materialize a
+* synthetic tracked event on the camera. A read always carries it AS STORED
+* (an absent key reads as `[]`, which is what the resolver makes of it —
+* NONE). On a write it is optional: absent leaves the opt-in untouched, so a
+* card built before D655 cannot erase it by saving the pick list. A present
+* list REPLACES the opt-in; each id must be a pick, a device the camera links
+* by structure (the row's `impliedSources`: tree children, a picked
+* container's child) or already stored — so what was read can always be
+* written back unchanged, and a NEW opt-in outside the linked set is refused.
+*/
+var LinkedDevicesSlotValueSchema = object({
+	deviceIds: array(number().int().positive()),
+	trackedDeviceIds: array(number().int().positive()).optional()
+});
+/**
+* The `linked-devices` slot — a camera's companion devices, owned by the
+* device manager over `_linkedDeviceIds` (D648, D356). Any device may be a
+* source except a container (its children are picked in its place) and the
+* camera itself.
+*/
+var LINKED_DEVICES_SLOT = {
+	id: "linked-devices",
+	label: "Linked devices",
+	description: "Companion devices of this camera: their controls appear with it, and the ones you opt in produce tracked events on it.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: "any",
+	cardinality: "many",
+	value: LinkedDevicesSlotValueSchema
+};
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -15452,7 +15566,7 @@ var deviceManagerCapability = {
 	name: "device-manager",
 	scope: "system",
 	mode: "singleton",
-	exposesDeviceSettings: true,
+	extensionSlots: [LINKED_DEVICES_SLOT],
 	methods: {
 		/** Reserve (or re-resolve) a progressive numeric id for `(addonId, stableId)`.
 		*  Idempotent: returns the existing id if one is already persisted for the
@@ -15955,11 +16069,12 @@ var deviceManagerCapability = {
 		/**
 		* Resolve the devices LINKED to a camera — the single policy authority
 		* both consumers call (viewer devices panel + pipeline-analytics event
-		* kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
-		* (default) adds every device sharing the camera's non-null `location`,
-		* mode 'manual' adds the persisted manual list instead. Excludes the
-		* camera itself; deduped. Configuration is standard per-device settings
-		* (see the module docblock) — there are no bespoke link mutations.
+		* kinds/ingest). Device-tree children are ALWAYS included, plus the
+		* operator's persisted pick list (`mode` is always `manual` since D356:
+		* same-location devices are suggested by the picker, never linked on
+		* their own). Excludes the camera itself; deduped. The list is written by
+		* the `linked-devices` extension slot over `_linkedDeviceIds` (see the
+		* module docblock).
 		*/
 		getLinkedDevices: method(object({ deviceId: number() }), object({
 			mode: LinkedDevicesModeSchema,
@@ -16504,11 +16619,98 @@ var EmbeddingResultSchema = object({
 	embedding: array(number()),
 	inferenceMs: number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = _enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	crashes: number(),
+	windowMs: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	attempts: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
 var EmbeddingInfoSchema = object({
 	modelId: string(),
 	embeddingDim: number(),
-	ready: boolean()
-});
+	ready: boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+_enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
+/**
+* ONE provider per node (`placement: any-node`), addressed like every global
+* collection: the codegen injects a `{ nodeId?, addonId? }` selector on the
+* void methods and lifts a top-level `nodeId` off the object ones. A call
+* that names no node is answered by the HUB's provider — never by a merge
+* across nodes, because no global collection fans out across nodes (only the
+* providers of one node are `concatCollection`-fanned). So a fleet view of
+* `failedModels` is one `getInfo({ nodeId })` per node, and every answer
+* names the node it came from (D649 round 4); a node that cannot be asked is
+* UNKNOWN to the reader, never "no failures" (D315).
+*/
 var embeddingEncoderCapability = {
 	name: "embedding-encoder",
 	scope: "system",
@@ -16527,8 +16729,30 @@ var embeddingEncoderCapability = {
 			width: number(),
 			height: number()
 		}), EmbeddingResultSchema, { auth: "admin" }),
-		encodeText: method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }),
-		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" })
+		/**
+		* `modelId` (a CLIP IMAGE model id, whose catalog `clip.textModelId` names
+		* the text tower) encodes in that model's space; absent, the cluster row's
+		* `clip-embedding` model — the space every writer is in (D649).
+		*/
+		encodeText: method(object({
+			text: string(),
+			modelId: string().min(1).optional()
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		/** Answers for ONE node — the `nodeId` selector's, else the hub's. */
+		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" }),
+		/**
+		* The operator's explicit clear of the `failed` state (one model, or all)
+		* on ONE node — pass `nodeId` for an agent; the result names the node it
+		* cleared. The only way out besides a model change: a crashing tower is
+		* not retried on a timer.
+		*/
+		resetFailedModels: method(object({ modelId: string().min(1).optional() }), object({
+			cleared: array(string()),
+			nodeId: string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -20296,7 +20520,12 @@ var NcMediaPolicySchema = object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
@@ -22394,6 +22623,130 @@ var oauthIntegrationCapability = {
 getDescriptor: method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 /**
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
+*/
+/**
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
+*/
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+Object.freeze(Object.fromEntries([{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}].map((s) => [s.stepId, s.defaultModelId])));
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
+/**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
 * objects, per-kind event collections (motion / object / audio), and
@@ -23209,7 +23562,8 @@ var MediaFileKindEnum = _enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -23761,7 +24115,23 @@ var SearchObjectEventsInput = object({
 	until: number().optional(),
 	classFilter: string().optional(),
 	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: string().min(1).optional()
 });
 var TrackCascadeCountsSchema = object({
 	/** Persisted track roots deleted (authoritative). */
@@ -23896,7 +24266,41 @@ var RebuildObjectEmbeddingsInput = object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var WipeObjectEmbeddingsResultSchema = object({
+	deleted: number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: array(string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = _enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -23909,7 +24313,12 @@ var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
 var RebuildObjectEmbeddingsResultSchema = object({
 	started: boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
+	alreadyRunning: boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: string().optional(),
+	index: string().optional()
 });
 var RebuildStatusSchema = object({
 	running: boolean(),
@@ -23943,7 +24352,11 @@ var RebuildStatusSchema = object({
 	startedAtMs: number().nullable(),
 	finishedAtMs: number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	error: string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -24887,7 +25300,7 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()),
+		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly(), { caller: "required" }),
 		wipeObjectEmbeddings: method(object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -25528,7 +25941,14 @@ var pipelineExecutorCapability = {
 		*/
 		inferCached: method(object({
 			stepId: string(),
-			frameId: number().int()
+			frameId: number().int(),
+			/**
+			* The model to time — REQUIRED (D658). Without it the pool answered the
+			* step's ACTIVE variant (the first loaded after boot), so a benchmark
+			* of model B silently timed model A. Callers pass the `rootModelId`
+			* their warmup `runPipeline` reported: the model that actually ran.
+			*/
+			modelId: string().min(1)
 		}), record(string(), unknown()), { kind: "mutation" }),
 		/**
 		* Release a cached frame from the Python pool's memory.
@@ -26180,6 +26600,17 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = object({
+	modelId: string().optional(),
+	settings: record(string(), unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -26191,7 +26622,16 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 var RunnerInferenceDeviceSchema = object({
 	deviceKey: string(),
 	weight: number().positive().default(1),
-	maxSessions: number().int().positive().nullable().default(null)
+	maxSessions: number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: record(string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -27258,6 +27698,28 @@ var NodeInferenceDeviceSchema = object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("stored"),
+		modelId: string()
+	}),
+	object({
+		kind: literal("absent"),
+		defaultModelId: string()
+	}),
+	object({
+		kind: literal("unreadable"),
+		reason: _enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -27354,9 +27816,19 @@ var pipelineOrchestratorCapability = {
 		* Trigger a full rebalance pass. Iterates over all assigned cameras,
 		* recomputes the optimal agent for each one based on current load +
 		* hardware affinity, and migrates cameras whose current agent is no
-		* longer optimal. Pinned cameras are never migrated.
-		*/
-		rebalance: method(_void(), object({ migrated: number() }), {
+		* longer optimal. Pinned cameras are never migrated. `skipped` names the
+		* cameras the pass wanted to move and could not, with why — a target node
+		* that has not answered its catalog / device health yet, or a device that
+		* cannot run the camera's root (D650).
+		*/
+		rebalance: method(_void(), object({
+			migrated: number(),
+			skipped: array(object({
+				deviceId: number(),
+				targetNodeId: string(),
+				reason: string()
+			})).default([])
+		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -27366,6 +27838,13 @@ var pipelineOrchestratorCapability = {
 		getPipelineAssignment: method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()),
 		/** Get per-agent load summaries used by the load balancer + dashboards. */
 		getAgentLoad: method(_void(), array(AgentLoadSummarySchema).readonly()),
+		/**
+		* The operator's STORED model choice for one cluster-scoped step (D651).
+		* Read three-way from this addon's own store, only once its boot has
+		* settled. Unlike `addonSettings.getGlobalSettings`, it never answers a
+		* default as though someone chose it.
+		*/
+		getClusterModelChoice: method(object({ stepId: string() }), ClusterModelChoiceSchema),
 		/** Aggregate global metrics across the whole detection cluster. */
 		getGlobalMetrics: method(_void(), GlobalMetricsSchema),
 		/**
@@ -30626,6 +31105,286 @@ var videoclipsCapability = {
 	}
 };
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+var DoorbellPressEventSchema = object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+/** Every device type at least one slot is offered on — `device-extension`'s `deviceTypes`. */
+var EXTENSION_HOST_DEVICE_TYPES = [DeviceType.Camera];
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: array(ExtensionSlotSourceSchema).optional()
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+var deviceExtensionCapability = {
+	name: "device-extension",
+	scope: "device",
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: EXTENSION_HOST_DEVICE_TYPES,
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/extensions-panel",
+		tab: "general",
+		label: "Extensions",
+		order: 72
+	} },
+	methods: {
+		/** One row per slot owner — the D554 source listing `slotRef` routes by. */
+		listSources: method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)),
+		/**
+		* Every slot this device is offered, read by each owner from its own
+		* store. A provider that throws is ONE `unreachable` row (D554.4).
+		*/
+		listSlots: method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)),
+		/** The devices the slot's editor may offer, suggestions pre-marked (D356). */
+		listCandidates: method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema),
+		/**
+		* Write one slot through its owner's EXISTING write path. The owner
+		* validates (a container is never a linked device, a camera is never its
+		* own source) and refuses by name before persisting.
+		*/
+		setSlot: method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -33471,75 +34230,6 @@ onStatusChanged: { data: object({
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-var DoorbellPressEventSchema = object({
-	deviceId: number(),
-	timestamp: number()
-});
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: { data: DoorbellPressEventSchema } },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
 * states, weather conditions, contact-source channels, mode strings).
@@ -43292,42 +43982,6 @@ function readDeviceStateFrom(runtimeState) {
 	}
 }
 /**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -44750,6 +45404,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	deviceAdoptionCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
+	deviceExtensionCapability,
 	deviceManagerCapability,
 	deviceOpsCapability,
 	deviceProviderCapability,
@@ -46298,6 +46953,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -46370,12 +47049,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.applyDeviceSettingsPatch": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.applyInitialMeta": {
 		capName: "device-manager",
 		capScope: "system",
@@ -46478,12 +47151,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceLiveContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceLiveInfoAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -46496,12 +47163,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceSettingsContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceStatusAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -47006,24 +47667,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"doorbell.applyDeviceSettingsPatch": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
-	"doorbell.getDeviceLiveContribution": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"doorbell.getDeviceSettingsContribution": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"doorbell.getStatus": {
 		capName: "doorbell",
 		capScope: "device",
@@ -47048,6 +47691,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -49382,6 +50031,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52207,6 +52862,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -54746,68 +55421,6 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
-Object.freeze(Object.fromEntries([{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}].map((s) => [s.stepId, s.defaultModelId])));
-string().min(1);
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.