@camstack/addon-pipeline-orchestrator 1.2.297 → 1.2.298

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-//#region ../types/dist/event-category-B_0XEcLF.mjs
+//#region ../types/dist/event-category-DaIZi00R.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -81,6 +81,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadFailed"] = "addon.load-failed";
 	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
 	* Addon recovered from a previous failure. Emitted when an addon
 	* transitions from `failed` back to `healthy` (typically via the
 	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
@@ -5373,7 +5380,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-Cr5YOk3m.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5452,6 +5459,97 @@ function buildAlawTable() {
 }
 buildUlawTable();
 buildAlawTable();
+/** Is this field's stored value a credential? */
+function isSecretConfigField(field) {
+	if (field.type === "password") return true;
+	return "secret" in field && field.secret === true;
+}
+/**
+* Is this field's value stored in the KEYCHAIN (D787)? Every secret field is,
+* by its TYPE, unless it opts out with `storage: 'inline'` — never by its name.
+*/
+function isKeychainStoredField(field) {
+	if (!isSecretConfigField(field)) return false;
+	if (field.type === "textarea" && field.isJson === true) return false;
+	return !("storage" in field && field.storage === "inline");
+}
+/**
+* What a settings blob holds where a secret used to be.
+*
+* A keychain-stored field never holds its value. It holds a self-describing
+* MARKER, `{"$secret":"secret://…","v":1}` — an object, never a string, so no
+* code can mistake it for a credential and no form can send it to a camera as
+* a password. The empty state is `null` / absent, never `''`.
+*
+* The same shapes travel to and from the admin UI:
+*
+*  - read: `hydrateSchema` hands a secret field a {@link SecretFieldView}
+*    (`{ $secret, v, set: true }`) or `null` — the browser learns whether a
+*    value is set, never the value.
+*  - write: an untouched field submits the view back unchanged (KEEP); a typed
+*    value is a plain non-empty string (CHANGE); the Clear button submits
+*    {@link SECRET_CLEAR} (CLEAR). `''`, `null` and the legacy redaction tokens
+*    are KEEP — an empty string is what a defaults-fallback pushes back, and
+*    treating it as "clear" is how a save destroyed a stored credential before.
+*
+* Pure and browser-safe.
+*/
+var SECRET_CLEAR = { $secretClear: true };
+/** The `'***'` token D634 redaction writes for non-admins. */
+var LEGACY_DEVICE_REDACTION = "***";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function makeSecretMarker(ref) {
+	return {
+		$secret: ref,
+		v: 1
+	};
+}
+/** A stored marker: an object whose `$secret` is a non-empty string. */
+function isSecretMarker(value) {
+	if (!isRecord$1(value)) return false;
+	const ref = value["$secret"];
+	return typeof ref === "string" && ref.length > 0;
+}
+function isSecretClear(value) {
+	return isRecord$1(value) && value["$secretClear"] === true;
+}
+/**
+* The UI view of a stored secret field value: a marker becomes "set", inline
+* plaintext becomes "set (inline)", nothing becomes `null`. A value never
+* survives this function.
+*/
+function toSecretFieldView(stored) {
+	if (isSecretMarker(stored)) return {
+		$secret: stored.$secret,
+		v: 1,
+		set: true
+	};
+	if (typeof stored === "string" && stored.length > 0) return {
+		$secret: null,
+		v: 1,
+		set: true,
+		inline: true
+	};
+	return null;
+}
+/**
+* Classify an incoming value for a secret path. Only a non-empty string that is
+* not a redaction token sets a value; only {@link SECRET_CLEAR} clears.
+* Everything else — a marker (ours or anyone's), a UI view, `''`, `null`,
+* `undefined`, a redaction token, a non-string — keeps what is stored.
+*/
+function classifySecretWrite(incoming) {
+	if (isSecretClear(incoming)) return { kind: "clear" };
+	if (typeof incoming !== "string") return { kind: "keep" };
+	if (incoming.length === 0) return { kind: "keep" };
+	if (incoming === "__camstack_redacted__" || incoming === LEGACY_DEVICE_REDACTION) return { kind: "keep" };
+	return {
+		kind: "set",
+		value: incoming
+	};
+}
 Object.fromEntries([
 	{
 		id: "overview",
@@ -5623,33 +5721,19 @@ Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button";
 }
-/**
-* Merge a `ConfigUISchema` with a raw `values` record into a
-* `ConfigUISchemaWithValues`. Used by every `get*Settings` backend endpoint
-* before returning to the admin UI. Groups are walked recursively.
-*
-* For each leaf field:
-*   - structural fields (`separator`, `info`, `button`) pass through unchanged
-*   - other fields get `value = values[key] ?? field.default ?? null`
-*
-* Unknown keys in `values` (keys not declared in the schema) are silently
-* ignored — they don't contribute to the output. Missing keys fall back to
-* the schema default or `null`. This mirrors the old backend behaviour where
-* `FormBuilder` rendered `values[key] ?? field.default`.
-*/
-function hydrateSchema(schema, values) {
+function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
 		sections: schema.sections.map((section) => ({
 			...section,
-			fields: section.fields.map((field) => hydrateField(field, values))
+			fields: section.fields.map((field) => hydrateField(field, values, options))
 		}))
 	};
 }
-function hydrateField(field, values) {
+function hydrateField(field, values, options) {
 	if (isValuelessField(field)) return field;
 	if (field.type === "group") {
-		const hydratedChildren = field.fields.map((child) => hydrateField(child, values));
+		const hydratedChildren = field.fields.map((child) => hydrateField(child, values, options));
 		return {
 			...field,
 			fields: hydratedChildren
@@ -5658,7 +5742,7 @@ function hydrateField(field, values) {
 	if (field.type === "sub-tabs") {
 		const hydratedTabs = field.tabs.map((tab) => ({
 			...tab,
-			fields: tab.fields.map((child) => hydrateField(child, values))
+			fields: tab.fields.map((child) => hydrateField(child, values, options))
 		}));
 		return {
 			...field,
@@ -5668,6 +5752,33 @@ function hydrateField(field, values) {
 	const key = field.key;
 	const storedValue = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 	const defaultValue = field.default;
+	const asView = (v) => isSecretMarker(v) || options.inlineSecretsAsViews === true && v !== void 0;
+	if (isKeychainStoredField(field) && asView(storedValue)) return {
+		...field,
+		value: toSecretFieldView(storedValue)
+	};
+	if (isKeychainStoredField(field) && options.inlineSecretsAsViews === true) return {
+		...field,
+		value: null
+	};
+	if (field.type === "editable-array" && Array.isArray(storedValue)) {
+		const secretItemKeys = field.itemFields.filter((item) => "key" in item && isKeychainStoredField(item)).map((item) => "key" in item ? item.key : "");
+		if (secretItemKeys.length > 0) {
+			const rows = storedValue.map((row) => {
+				if (row === null || typeof row !== "object" || Array.isArray(row)) return row;
+				const out = { ...row };
+				for (const k of secretItemKeys) {
+					const v = Reflect.get(row, k);
+					if (asView(v)) out[k] = toSecretFieldView(v);
+				}
+				return out;
+			});
+			return {
+				...field,
+				value: rows
+			};
+		}
+	}
 	if (field.multiple) {
 		const stored = Array.isArray(storedValue) ? storedValue : storedValue !== void 0 && storedValue !== null ? [storedValue] : [];
 		const itemFallback = field.multiple.itemDefault !== void 0 ? field.multiple.itemDefault : defaultValue !== void 0 ? defaultValue : typeOf(field) === "string" ? "" : null;
@@ -5926,6 +6037,431 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+var GLOBAL_SCOPE = { kind: "global" };
+/** The scope every addon-wide (not per-node, not per-device) setting lives in. */
+function globalSecretScope() {
+	return GLOBAL_SCOPE;
+}
+function encodeSegment(value) {
+	return encodeURIComponent(value);
+}
+/**
+* The field path of a value inside an array item, addressed by the item's id:
+* `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
+* `providers[authentik].clientSecret`.
+*/
+function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
+	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
+}
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+var KeychainWriteRefusedError = class extends Error {
+	fieldPath;
+	constructor(fieldPath, cause) {
+		super(`secret "${fieldPath}" was not saved: the keychain could not store it (${cause instanceof Error ? cause.message : String(cause)}). Nothing was written.`);
+		this.fieldPath = fieldPath;
+		this.name = "KeychainWriteRefusedError";
+	}
+};
+var KEEP = { kind: "keep" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defaultMintId() {
+	return globalThis.crypto.randomUUID();
+}
+/** Every marker ref anywhere under `value`. */
+function collectSecretMarkerRefs(value, out = []) {
+	if (isSecretMarker(value)) {
+		out.push(value.$secret);
+		return out;
+	}
+	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
+	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	return out;
+}
+async function storedValueEquals(secrets, marker, candidate) {
+	const resolved = (await secrets.resolve([marker.$secret]))[marker.$secret];
+	return resolved?.kind === "value" && resolved.value === candidate;
+}
+async function writeLeaf(ctx, incoming, stored, fieldPath) {
+	const intent = classifySecretWrite(incoming);
+	const ref = ctx.secrets.ref(ctx.scope, fieldPath);
+	const storedIsOurs = isSecretMarker(stored) && stored.$secret === ref;
+	if (intent.kind === "keep") return KEEP;
+	if (intent.kind === "set" && !ctx.operatorWrite && typeof stored === "string" && stored === intent.value) return KEEP;
+	if (intent.kind === "clear") {
+		if (storedIsOurs) ctx.deletes.push(ref);
+		return {
+			kind: "value",
+			value: null
+		};
+	}
+	if (storedIsOurs && await storedValueEquals(ctx.secrets, stored, intent.value)) return {
+		kind: "value",
+		value: stored
+	};
+	try {
+		await ctx.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(fieldPath, err);
+	}
+	return {
+		kind: "value",
+		value: makeSecretMarker(ref)
+	};
+}
+/** Apply a member result onto `out`: KEEP restores the stored member, or removes it. */
+function applyMember(out, key, result, storedParent) {
+	if (result.kind === "value") {
+		out[key] = result.value;
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(storedParent, key)) out[key] = storedParent[key];
+	else delete out[key];
+}
+async function writeMembers(ctx, children, incoming, stored, pathOf) {
+	const out = { ...incoming };
+	for (const [member, node] of children) applyMember(out, member, await writeNode(ctx, node, incoming[member], stored[member], pathOf(member)), stored);
+	return out;
+}
+function rowId$1(row, idKey) {
+	const raw = row[idKey];
+	if (typeof raw === "string" && raw.length > 0) return raw;
+	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
+	return null;
+}
+async function writeArray(ctx, node, incoming, stored, fieldPath) {
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	if (!Array.isArray(incoming)) {
+		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
+		return {
+			kind: "value",
+			value: incoming
+		};
+	}
+	const storedById = /* @__PURE__ */ new Map();
+	for (const row of storedRows) {
+		const id = rowId$1(row, node.idKey);
+		if (id !== null) storedById.set(id, row);
+	}
+	const kept = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const row of incoming) {
+		if (!isRecord(row)) {
+			rows.push(row);
+			continue;
+		}
+		const id = rowId$1(row, node.idKey) ?? ctx.mintId();
+		kept.add(id);
+		const withId = {
+			...row,
+			[node.idKey]: row[node.idKey] ?? id
+		};
+		if (rowId$1(withId, node.idKey) === null) withId[node.idKey] = id;
+		const storedRow = storedById.get(id) ?? {};
+		rows.push(await writeMembers(ctx, node.item, withId, storedRow, (member) => arrayItemFieldPath(fieldPath, id, member)));
+	}
+	for (const [id, row] of storedById) if (!kept.has(id)) ctx.deletes.push(...collectSecretMarkerRefs(row));
+	return {
+		kind: "value",
+		value: rows
+	};
+}
+async function writeNode(ctx, node, incoming, stored, fieldPath) {
+	switch (node.kind) {
+		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
+		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
+		case "object": {
+			if (!isRecord(incoming)) {
+				if (incoming === void 0) return KEEP;
+				ctx.deletes.push(...collectSecretMarkerRefs(stored));
+				return {
+					kind: "value",
+					value: incoming
+				};
+			}
+			const storedObj = isRecord(stored) ? stored : {};
+			return {
+				kind: "value",
+				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
+			};
+		}
+	}
+}
+/** Split a perNode-scoped key (`key@nodeId`). */
+function splitNodeKey(key) {
+	const at = key.indexOf("@");
+	return at <= 0 ? {
+		base: key,
+		nodeId: null
+	} : {
+		base: key.slice(0, at),
+		nodeId: key.slice(at + 1)
+	};
+}
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+async function transformSecretWrite(input) {
+	const deletes = [];
+	const base = {
+		secrets: input.secrets,
+		mintId: input.mintId ?? defaultMintId,
+		deletes,
+		operatorWrite: input.operatorWrite === true
+	};
+	const out = {};
+	for (const [key, incoming] of Object.entries(input.patch)) {
+		const { base: baseKey, nodeId } = splitNodeKey(key);
+		const node = input.tree.get(baseKey);
+		if (node === void 0) {
+			out[key] = incoming;
+			continue;
+		}
+		const scope = nodeId !== null && nodeId.length > 0 ? {
+			kind: "node",
+			nodeId
+		} : input.scope ?? globalSecretScope();
+		const result = await writeNode({
+			...base,
+			scope
+		}, node, incoming, input.stored[key], baseKey);
+		if (result.kind === "value") out[key] = result.value;
+	}
+	return {
+		patch: out,
+		afterWrite: async () => {
+			if (deletes.length === 0) return { orphaned: [] };
+			try {
+				await input.secrets.delete([...new Set(deletes)]);
+				return { orphaned: [] };
+			} catch {
+				return { orphaned: [...new Set(deletes)] };
+			}
+		}
+	};
+}
+/**
+* Replace every marker in `value` with its keychain value. Returns the SAME
+* reference when there is no marker (no allocation, no keychain call).
+*/
+async function resolveSecretMarkers(value, secrets) {
+	const refs = collectSecretMarkerRefs(value);
+	if (refs.length === 0) return {
+		value,
+		unresolved: []
+	};
+	const answers = await secrets.resolve(refs);
+	const unresolved = [];
+	for (const ref of new Set(refs)) {
+		const answer = answers[ref];
+		if (answer === void 0) unresolved.push({
+			ref,
+			reason: "not-initialized"
+		});
+		else if (answer.kind === "unavailable") unresolved.push({
+			ref,
+			reason: answer.reason
+		});
+		else if (answer.kind === "missing" || answer.kind === "forbidden") unresolved.push({
+			ref,
+			reason: answer.kind
+		});
+	}
+	const substitute = (v) => {
+		if (isSecretMarker(v)) {
+			const answer = answers[v.$secret];
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(v)) {
+			const items = [];
+			for (const item of v) {
+				const s = substitute(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (isRecord(v)) {
+			const out = {};
+			for (const [k, child] of Object.entries(v)) {
+				const s = substitute(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value: v
+		};
+	};
+	return {
+		value: substitute(value).value,
+		unresolved
+	};
+}
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/** The blob as stored now; a failed read REFUSES the write instead of guessing. */
+async function readStoredAddonBlob(raw) {
+	const threeWay = raw.readAddonStoreResult;
+	if (threeWay === void 0) return raw.readAddonStore();
+	const result = await threeWay.call(raw);
+	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
+	return result.kind === "missing" ? {} : result.value;
+}
+function createSecretAwareSettings(raw, opts) {
+	const chains = /* @__PURE__ */ new Map();
+	const serialize = (key, fn) => {
+		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+		const tail = next.catch(() => void 0);
+		chains.set(key, tail);
+		tail.then(() => {
+			if (chains.get(key) === tail) chains.delete(key);
+		});
+		return next;
+	};
+	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(tree, patch)) return rawWrite(patch);
+		return serialize(chainKey, async () => {
+			const stored = await readStored();
+			const result = await transformSecretWrite({
+				tree,
+				secrets: opts.secrets,
+				patch,
+				stored,
+				...scope !== void 0 ? { scope } : {},
+				operatorWrite: opts.isOperatorWrite?.() === true
+			});
+			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const { orphaned } = await result.afterWrite();
+			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+		});
+	};
+	const wrapped = {
+		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
+		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
+			kind: "device",
+			deviceId
+		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	};
+	return new Proxy(raw, { get(target, prop, receiver) {
+		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
+		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+function withSecretAwareSettings(context, opts) {
+	const raw = context.settings;
+	if (raw === void 0) return context;
+	const settings = createSecretAwareSettings(raw, opts);
+	return new Proxy(context, { get(target, prop, receiver) {
+		if (prop === "settings") return settings;
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+var LEAF = { kind: "leaf" };
+var DEFAULT_ITEM_ID_KEY = "id";
+function collectFields(fields, out) {
+	for (const field of fields) {
+		if (field.type === "group") {
+			collectFields(field.fields, out);
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collectFields(tab.fields, out);
+			continue;
+		}
+		if (field.type === "editable-array") {
+			const item = /* @__PURE__ */ new Map();
+			for (const itemField of field.itemFields) if ("key" in itemField && isKeychainStoredField(itemField)) item.set(itemField.key, LEAF);
+			if (item.size > 0) out.set(field.key, {
+				kind: "array",
+				idKey: field.itemIdKey ?? DEFAULT_ITEM_ID_KEY,
+				item
+			});
+			continue;
+		}
+		if (!("key" in field) || typeof field.key !== "string") continue;
+		if (isKeychainStoredField(field)) out.set(field.key, LEAF);
+	}
+}
+/** The secret tree a settings schema declares. */
+function secretTreeFromSchema(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (schema === null) return out;
+	for (const section of schema.sections) collectFields(section.fields, out);
+	return out;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+function parseSecretStatePath(path) {
+	const segments = [];
+	for (const raw of path.split(".")) {
+		const m = /^([^[\]]+)(?:\[([^[\]]+)\])?$/.exec(raw);
+		if (m === null || m[1] === void 0) throw new Error(`secretStatePaths: malformed path "${path}"`);
+		segments.push(m[2] !== void 0 ? {
+			key: m[1],
+			idKey: m[2]
+		} : { key: m[1] });
+	}
+	if (segments.length === 0) throw new Error(`secretStatePaths: empty path`);
+	if (segments[segments.length - 1]?.idKey !== void 0) throw new Error(`secretStatePaths: "${path}" ends on an array — name the member that is secret`);
+	return segments;
+}
+function insert(into, segments) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return;
+	if (rest.length === 0) {
+		into.set(head.key, LEAF);
+		return;
+	}
+	const existing = into.get(head.key);
+	if (head.idKey !== void 0) {
+		const item = new Map(existing?.kind === "array" ? existing.item : []);
+		insert(item, rest);
+		into.set(head.key, {
+			kind: "array",
+			idKey: head.idKey,
+			item
+		});
+		return;
+	}
+	const children = new Map(existing?.kind === "object" ? existing.children : []);
+	insert(children, rest);
+	into.set(head.key, {
+		kind: "object",
+		children
+	});
+}
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+function mergeSecretStatePaths(tree, paths) {
+	if (paths.length === 0) return tree;
+	const out = new Map(tree);
+	for (const path of paths) insert(out, parseSecretStatePath(path));
+	return out;
+}
+/** First retry of a secret the keychain could not serve; doubles to {@link SECRET_RETRY_MAX_MS}. */
+var SECRET_RETRY_FIRST_MS = 5e3;
+var SECRET_RETRY_MAX_MS = 5 * 6e4;
+/** Coalesces a burst of `keychain.changed` events into one re-resolve. */
+var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
@@ -5995,6 +6531,25 @@ var BaseAddon = class {
 	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
+	/**
+	* Hidden-state paths that hold secrets (D787) — values the addon writes
+	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* Stored in the keychain exactly like a `password` field. Syntax:
+	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+	* (`key[<id field>]` addresses array items by id, never by index).
+	*/
+	secretStatePaths = [];
+	_addonSecretTree = null;
+	_deviceSecretTree = null;
+	/** Refs the last resolved config pointed at — a change to one re-resolves. */
+	_configSecretRefs = /* @__PURE__ */ new Set();
+	_unresolvedSecrets = [];
+	_secretRetryTimer = null;
+	_secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+	_secretChangeTimer = null;
+	_secretChangeUnsub = null;
+	/** >0 while an OPERATOR's settings write is being applied. */
+	_operatorWriteDepth = 0;
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -6030,8 +6585,18 @@ var BaseAddon = class {
 		return this._config;
 	}
 	async initialize(context) {
-		this._ctx = context;
+		const secrets = context.secrets;
+		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
+			secrets,
+			addonTree: () => this.addonSecretTree(),
+			deviceTree: () => this.deviceSecretTree(),
+			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+			isOperatorWrite: () => this._operatorWriteDepth > 0
+		}) : context;
 		await this.resolveConfig();
+		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
+			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
+		});
 		const result = await this.onInitialize();
 		this.emitLifecycle(EventCategory.AddonStarted);
 		const normalized = normalizeAddonInitResult(result);
@@ -6064,6 +6629,12 @@ var BaseAddon = class {
 	*/
 	async onHubReachable() {}
 	async shutdown() {
+		this._secretChangeUnsub?.();
+		this._secretChangeUnsub = null;
+		if (this._secretRetryTimer !== null) clearTimeout(this._secretRetryTimer);
+		if (this._secretChangeTimer !== null) clearTimeout(this._secretChangeTimer);
+		this._secretRetryTimer = null;
+		this._secretChangeTimer = null;
 		this.emitLifecycle(EventCategory.AddonStopped);
 		if (this.autoEmitReadiness) this.emitReadinessForProviders("down");
 		await this.onShutdown();
@@ -6142,7 +6713,7 @@ var BaseAddon = class {
 		return hydrateSchema(schema, overlay ? {
 			...projected,
 			...overlay
-		} : projected);
+		} : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -6191,7 +6762,7 @@ var BaseAddon = class {
 		return hydrateSchema({
 			...schema,
 			sections
-		}, projected);
+		}, projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -6245,18 +6816,50 @@ var BaseAddon = class {
 			value: result.value[key]
 		};
 	}
+	/**
+	* The OPERATOR's write — a settings form or an admin API call, dispatched by
+	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the operator sends is stored as sent even when it equals a pre-keychain
+	* inline value: the operator re-entering a password is a change, an addon
+	* writing back what it read is not (D787).
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.applyGlobalPatch(patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
 	async updateGlobalSettings(patch, nodeId) {
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	/**
+	* REMOVE stored secrets — their keychain values and their markers (D787).
+	*
+	* Writing `''` to a secret field KEEPS what is stored (an empty string is
+	* what a defaults fallback writes back, and it must never destroy a
+	* credential), so code that means "forget this token" says so here. Without
+	* a keychain (an older kernel) it writes `''`, as such code always did.
+	*/
+	async clearSecrets(keys, nodeId) {
+		const tree = this.addonSecretTree();
+		const keychain = this._ctx?.secrets !== void 0;
+		const patch = {};
+		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	async applyGlobalPatch(barePatch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		const barePatch = patch;
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(patch, this.globalSettingsSchema());
+		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -6281,7 +6884,7 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patch, schema) {
+	maybeAutoRestart(patchKeys, schema) {
 		if (!schema) return;
 		const restartKeys = /* @__PURE__ */ new Set();
 		for (const section of schema.sections) for (const field of section.fields) {
@@ -6289,13 +6892,13 @@ var BaseAddon = class {
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
 		if (restartKeys.size === 0) return;
-		if (!Object.keys(patch).some((k) => restartKeys.has(k))) return;
+		if (!patchKeys.some((k) => restartKeys.has(k))) return;
 		const ctx = this._ctx;
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
 			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
-				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: Object.keys(patch).filter((k) => restartKeys.has(k)) } });
+				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
@@ -6304,7 +6907,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -6434,7 +7037,7 @@ var BaseAddon = class {
 	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
-		const stored = await this.readAddonStoreWithRetry();
+		const stored = await this.resolveStoredSecrets(await this.readAddonStoreWithRetry());
 		const perNode = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
@@ -6459,7 +7062,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: () => this.readAddonStoreWithRetry(),
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeAddonStore(patch);
 			},
@@ -6476,7 +7079,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => await this._ctx?.settings?.readDeviceStore(deviceId) ?? {},
+			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -6488,6 +7091,70 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+	addonSecretTree() {
+		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		return this._addonSecretTree;
+	}
+	deviceSecretTree() {
+		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		return this._deviceSecretTree;
+	}
+	/**
+	* Secrets of this addon's stored config that could not be resolved on the
+	* last read, with why. Non-empty means the addon is running WITHOUT them —
+	* an addon whose function needs one should report itself degraded rather
+	* than start on an empty credential.
+	*/
+	get unresolvedSecrets() {
+		return this._unresolvedSecrets;
+	}
+	/**
+	* Substitute every keychain marker in a stored blob with its value. With no
+	* keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+	* An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+	* value — and, when the cause can pass, retried with backoff. Nothing is
+	* ever written back from here.
+	*/
+	async resolveStoredSecrets(blob, trackForConfig = true) {
+		const secrets = this._ctx?.secrets;
+		if (secrets === void 0) return blob;
+		const refs = collectSecretMarkerRefs(blob);
+		if (trackForConfig) this._configSecretRefs = new Set(refs);
+		if (refs.length === 0) {
+			if (trackForConfig) this._unresolvedSecrets = [];
+			return blob;
+		}
+		const { value, unresolved } = await resolveSecretMarkers(blob, secrets);
+		if (trackForConfig) {
+			this._unresolvedSecrets = unresolved;
+			if (unresolved.length > 0) {
+				this._ctx?.logger?.error?.("secret unavailable — running without it, will retry", { meta: { secrets: unresolved.map((u) => ({
+					ref: u.ref,
+					reason: u.reason
+				})) } });
+				if (unresolved.some((u) => u.reason !== "missing" && u.reason !== "forbidden")) {
+					this.scheduleSecretReresolve(this._secretRetryDelayMs);
+					this._secretRetryDelayMs = Math.min(this._secretRetryDelayMs * 2, SECRET_RETRY_MAX_MS);
+				}
+			} else this._secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+		}
+		return value;
+	}
+	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+	scheduleSecretReresolve(delayMs) {
+		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
+		if (this[timerOf] !== null) return;
+		const timer = setTimeout(() => {
+			this[timerOf] = null;
+			if (this._ctx === null) return;
+			this.resolveConfig().then(() => this.onConfigChanged()).catch((err) => {
+				this._ctx?.logger?.error?.("re-resolving secrets failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, delayMs);
+		timer.unref?.();
+		this[timerOf] = timer;
+	}
 	/**
 	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
 	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
@@ -15067,6 +15734,196 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `keychain` — the hub's encrypted store of secret values (D787).
+*
+* Settings blobs never hold a secret: they hold a marker
+* `{"$secret":"secret://<owner>/<scope>/<fieldPath>","v":1}` and the value
+* lives here, AES-256-GCM under a data key that a master key wraps. This cap
+* is the OWNER's door to its own values: every method is owner-checked
+* against the CALLER, never against anything the caller claims.
+*
+* Who the caller is: the transport stamps `callerAddonId` into the args of a
+* call that crossed a process (the parent `LocalChildRegistry` from the UDS
+* connection, the agent from its child's connection carried in
+* `$hub-cap-fwd`'s envelope). A stamp always overwrites; a wire call with no
+* stamp has its claim stripped. Only a hub in-process caller may state its own
+* identity — `ctx.secrets` does that with the addon id closed over. This is
+* identity against BUGS and misrouting, not against a malicious addon (every
+* runner is the same OS user): see the threat model in
+* `docs/design/2026-10-08-secrets-keychain.md`.
+*
+* `callerAddonId` is deliberately NOT in any input schema: the tRPC router
+* parses the input, so a session can never supply it, and the internal mount
+* floors every method to admin anyway (D240).
+*
+* Internal: addons reach it through `ctx.secrets`, never directly.
+*/
+/** Why a value cannot be served right now. Never folded into "missing". */
+var KeychainUnavailableReasonSchema = _enum([
+	"key-missing",
+	"wrong-key",
+	"key-file-unreadable",
+	"store-unavailable",
+	"not-initialized",
+	"decrypt-failed"
+]);
+var KeychainStateSchema = discriminatedUnion("state", [object({ state: literal("ready") }), object({
+	state: literal("locked"),
+	reason: KeychainUnavailableReasonSchema
+})]);
+var KeychainResolveEntrySchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("value"),
+		value: string(),
+		version: number().int()
+	}),
+	object({ kind: literal("missing") }),
+	object({
+		kind: literal("unavailable"),
+		reason: KeychainUnavailableReasonSchema
+	}),
+	object({ kind: literal("forbidden") })
+]);
+var KeychainResolveResultSchema = record(string(), KeychainResolveEntrySchema);
+/** Metadata of one stored value — never the value. */
+var KeychainSecretMetaSchema = object({
+	ref: string(),
+	owner: string(),
+	/** Formatted scope (`global`, `node/<id>`, `device/<id>`, …). */
+	scope: string(),
+	fieldPath: string(),
+	version: number().int(),
+	createdAt: number(),
+	updatedAt: number(),
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	updatedBy: string(),
+	/** Coarse — written at most once an hour per ref. `null` = never read. */
+	lastReadAt: number().nullable()
+});
+var RefListSchema = array(string().min(1)).max(512);
+method(object({
+	ref: string().min(1),
+	value: string().min(1)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }), method(object({ refs: RefListSchema }), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+var KeychainKeySourceSchema = object({
+	kind: _enum([
+		"config-file",
+		"previous-config-file",
+		"platform",
+		"default-file"
+	]),
+	/** File sources only — a path is not a secret. */
+	path: string().optional(),
+	/**
+	* True when a whole-volume backup of the data directory carries this key
+	* next to the database it protects (the default file). The page warns.
+	*/
+	sharesBackupWithDatabase: boolean()
+});
+var KeychainStatusSchema = object({
+	keychain: KeychainStateSchema,
+	/** The source of the master key in use; `null` while locked. */
+	keySource: KeychainKeySourceSchema.nullable(),
+	/** The source configured to be primary — differs from `keySource` while a rotation is pending. */
+	configuredSource: KeychainKeySourceSchema,
+	/** Short fingerprint of the master key in use (`HMAC(KEK, label)`, 16 hex). */
+	fingerprint: string().nullable(),
+	activeKeyId: string().nullable(),
+	/**
+	* The keychain unlocked with a NON-primary source: the configured primary
+	* key is not the one that wraps the data key yet. `rotateMasterKey` moves it.
+	*/
+	rotationPending: boolean(),
+	/** Wrapped copies of the data key under a previous master key, kept until purged. */
+	retiredWraps: number().int(),
+	recoveryKeyDownloadedAt: number().nullable(),
+	secretCount: number().int()
+});
+/**
+* Whether a stored value is still pointed at by its owner's settings.
+* `unknown` is a first-class answer: a scope whose blob could not be read is
+* never reported as an orphan (and never deleted as one).
+*/
+var KeychainSecretUsageSchema = _enum([
+	"in-use",
+	"orphan",
+	"unknown"
+]);
+var KeychainAdminSecretSchema = KeychainSecretMetaSchema.extend({ usage: KeychainSecretUsageSchema });
+var KeychainAuditActionSchema = _enum([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"initialize"
+]);
+var KeychainAuditEntrySchema = object({
+	id: string(),
+	at: number(),
+	action: KeychainAuditActionSchema,
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	actor: string(),
+	ref: string().nullable(),
+	detail: string().nullable()
+});
+method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}), array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }), method(object({ limit: number().int().min(1).max(500).optional() }), array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }), method(object({ ref: string().min(1) }), object({
+	value: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ refs: array(string().min(1)).max(1e3) }), object({
+	deleted: array(string()).readonly(),
+	kept: array(object({
+		ref: string(),
+		usage: KeychainSecretUsageSchema
+	})).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({
+	fingerprint: string(),
+	keySource: KeychainKeySourceSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({ purged: number().int() }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({
+	key: string(),
+	fingerprint: string(),
+	keySource: KeychainKeySourceSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ confirm: literal("RESET KEYCHAIN") }), object({
+	archivedCollection: string().nullable(),
+	archived: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+});
 method(_void(), object({
 	id: string(),
 	name: string(),
@@ -15884,6 +16741,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -16089,12 +16950,22 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
-	data: record(string(), unknown())
+	data: record(string(), unknown()),
+	/** The paths the device's schema declares secret (D783), when the caller
+	*  knows them — those values are kept in the keychain, not the blob (D787).
+	*  Absent: the paths the device last reported at `registerDevice` apply. */
+	secretConfigPaths: array(string()).optional()
 });
 /** What a migration actually did, per switch. `unreachable` is a first-class
 *  answer: a camera that could not be asked is not a camera that was silenced. */
@@ -17748,7 +18619,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -23116,8 +23994,23 @@ var RetrainMacroClassSchema = _enum([
 ]);
 /** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
 var RetrainAnnotationKindSchema = _enum(["subject", "model_error"]);
-/** Did a human draw this box, or did the assist propose it? */
-var RetrainAnnotationSourceSchema = _enum(["operator", "assist"]);
+/**
+* Where a box came from. A machine-sourced box is a DRAFT on the page until
+* the operator confirms it; once saved it keeps its source as provenance.
+*
+* - `operator` — drawn by hand.
+* - `assist`   — proposed by a detector run on the copy (the camera's own
+*   model, or a larger teacher model).
+* - `pipeline` — the box the live pipeline actually drew on that frame, read
+*   back from the track store (never a re-run).
+* - `llm`      — proposed by a vision-capable LLM profile.
+*/
+var RetrainAnnotationSourceSchema = _enum([
+	"operator",
+	"assist",
+	"pipeline",
+	"llm"
+]);
 /** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
 var RetrainBboxSchema = object({
 	x: number(),
@@ -23135,7 +24028,8 @@ var RetrainBboxSchema = object({
 */
 var RetrainAnnotationSchema = object({
 	id: string(),
-	trackId: string(),
+	/** The frame's track. Absent on a recording still, which has none. */
+	trackId: string().optional(),
 	deviceId: number(),
 	/** The COPY in retrain storage — never the source track's media key. */
 	mediaKey: string(),
@@ -23184,18 +24078,63 @@ var RetrainFrameCandidateSchema = object({
 	*  fail, whatever became of the original. */
 	copied: boolean()
 });
+/**
+* One box the live pipeline drew on a copied frame — what a correction starts
+* from. Derived when the frame is listed, from the track store: the subject
+* box recorded on the source media row when there is one, else the track
+* position nearest the frame's capture time. Never stored as an annotation
+* until the operator confirms it.
+*/
+var RetrainPipelineBoxSchema = object({
+	/** Normalised `[0,1]` against the full frame. */
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: string().optional(),
+	subLabel: string().optional(),
+	/** The detection score of the position used, when it was recorded. */
+	score: number().optional(),
+	/** The root model that produced the track, when it was recorded. */
+	modelId: string().optional(),
+	trackId: string(),
+	/** `subject-box`: recorded on this very frame. `position`: the track's
+	*  position nearest the capture time, `deltaMs` away. */
+	basis: _enum(["subject-box", "position"]),
+	deltaMs: number()
+});
+/**
+* Where a retrain frame came from: a TRACK's stored media (copy-on-select),
+* or the RECORDING at an instant — the frame a model saw nothing in has no
+* track at all.
+*/
+var RetrainFrameOriginSchema = _enum(["track", "recording"]);
 /** A frame the dataset OWNS: bytes copied at selection time. */
 var RetrainFrameSchema = object({
 	frameId: string(),
 	deviceId: number(),
-	trackId: string(),
-	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaId: number().int(),
+	origin: RetrainFrameOriginSchema,
+	/** The track it was copied from. Absent on a recording still. */
+	trackId: string().optional(),
+	/** Provenance only. It may already point at nothing — that is expected.
+	*  Absent on a recording still. */
+	sourceMediaId: number().int().optional(),
+	/** A recording still: the playhead instant it was taken at. */
+	epochMs: number().optional(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean(),
+	/** The boxes the pipeline drew on this frame. Present on list answers;
+	*  empty when nothing the track store holds can be placed on it. */
+	pipelineBoxes: array(RetrainPipelineBoxSchema).readonly().optional(),
+	/** The named collections this frame belongs to. Present on list answers. */
+	collectionIds: array(string()).readonly().optional()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -23216,6 +24155,53 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	/** Only frames in at least one of these named collections. */
+	collectionIds: array(string()).max(200).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -23245,6 +24231,109 @@ var RetrainAssistResultSchema = discriminatedUnion("kind", [object({
 	reason: string(),
 	detail: string().optional()
 })]);
+/** A named set over the retrain corpus — membership only, it owns no pixels. */
+var RetrainCollectionSchema = object({
+	id: string(),
+	name: string(),
+	createdAt: number(),
+	frameCount: number().int()
+});
+var RetrainCollectionCreateResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("created"),
+	collection: RetrainCollectionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum(["empty-name", "duplicate-name"])
+})]);
+var RetrainCollectionRenameResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("renamed"),
+	collection: RetrainCollectionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"empty-name",
+		"duplicate-name",
+		"unknown-collection"
+	])
+})]);
+/**
+* The outcome of adding the frame at a recording instant. Every refusal is
+* named: `still-unavailable` (not recording, a gap, or an undecodable frame —
+* `detail` says which), `still-busy` (the recorder is at its decode bound; try
+* again), `unreadable-image`, `write-failed`, `unknown-collection`.
+*/
+var AddRetrainFrameFromRecordingResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("added"),
+	collectionId: string(),
+	frame: RetrainFrameSchema,
+	/** The moment was already in the dataset; nothing was decoded. */
+	reused: boolean()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"unknown-collection",
+		"still-unavailable",
+		"still-busy",
+		"unreadable-image",
+		"write-failed"
+	]),
+	detail: string().optional()
+})]);
+/** A vision LLM profile the AI assist may use, and where it sends the frame. */
+var RetrainAssistProfileSchema = object({
+	id: string(),
+	name: string(),
+	model: string(),
+	kind: string(),
+	/** `true` when the frame would leave the house (a cloud vendor, or an
+	*  endpoint that is not on the local network). The page confirms each such
+	*  run, and the provider refuses one without `allowCloud`. */
+	leavesHouse: boolean()
+});
+/** A box the AI assist proposed: a draft, plus the model's own reason. */
+var RetrainLlmProposalSchema = RetrainAnnotationDraftSchema.extend({ reason: string() });
+/** What the AI assist said about a box that was already on the canvas. */
+var RetrainLlmReviewSchema = object({
+	/** The `ref` the page sent the box under. */
+	ref: string(),
+	verdict: _enum([
+		"confirmed",
+		"wrong-class",
+		"not-an-object",
+		"uncertain"
+	]),
+	suggestedClass: RetrainMacroClassSchema.optional(),
+	reason: string()
+});
+/**
+* The AI assist's answer. `proposed` carries drafts (`source: 'llm'`, the
+* model and its confidence) and reviews; items the model got wrong (a box off
+* the frame, an unasked class, an unknown ref) are dropped and counted in
+* `rejected`. A whole answer that is not the schema is `malformed-answer`.
+*/
+var RetrainLlmAssistResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("proposed"),
+	profileId: string(),
+	model: string(),
+	/** The frame was sent outside the house for this answer. */
+	leftHouse: boolean(),
+	proposals: array(RetrainLlmProposalSchema).readonly(),
+	reviews: array(RetrainLlmReviewSchema).readonly(),
+	rejected: number().int()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"unknown-frame",
+		"unreadable-frame",
+		"unknown-profile",
+		"profile-disabled",
+		"no-vision",
+		"cloud-not-confirmed",
+		"llm-error",
+		"malformed-answer"
+	]),
+	detail: string().optional()
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = object({
 	trackId: string(),
@@ -23962,7 +25051,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	trackId: string().optional(),
 	frameId: string()
 }), object({
 	removed: boolean(),
@@ -23979,7 +25068,8 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	/** The frame's track, when it has one — checked against the frame. */
+	trackId: string().optional(),
 	frameId: string(),
 	subject: RetrainAssistSubjectSchema,
 	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
@@ -23987,12 +25077,16 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainAssistResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
+}), method(object({
+	trackId: string().optional(),
+	frameIds: array(string()).max(2e3).optional()
+}), array(RetrainAnnotationSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	/** The frame's track, when it has one — checked against the frame. */
+	trackId: string().optional(),
 	frameId: string(),
 	annotations: array(RetrainAnnotationDraftSchema)
 }), array(RetrainAnnotationSchema).readonly(), {
@@ -24010,7 +25104,91 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string().optional(),
+	frameId: string(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
+}), method(object({}), array(RetrainAssistProfileSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string().optional(),
+	frameId: string(),
+	profileId: string(),
+	classes: array(RetrainMacroClassSchema).min(1),
+	boxes: array(object({
+		ref: string(),
+		bbox: RetrainBboxSchema,
+		macroClass: RetrainMacroClassSchema,
+		label: string().optional()
+	})).max(50),
+	allowCloud: boolean()
+}), RetrainLlmAssistResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 18e4
+}), method(object({ name: string().max(120) }), RetrainCollectionCreateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RetrainCollectionSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	id: string(),
+	name: string().max(120)
+}), RetrainCollectionRenameResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), object({
+	deleted: boolean(),
+	removedFrames: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collectionId: string(),
+	deviceId: number(),
+	epochMs: number()
+}), AddRetrainFrameFromRecordingResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 6e4
+}), method(object({
+	collectionId: string(),
+	frameIds: array(string()).min(1).max(500)
+}), object({
+	added: number().int(),
+	alreadyMember: number().int(),
+	unknownFrameIds: array(string()).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collectionId: string(),
+	frameId: string()
+}), object({
+	removed: boolean(),
+	deletedFrame: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ collectionId: string() }), array(RetrainFrameSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({
@@ -24838,13 +26016,31 @@ var RecommendationReasonSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("no-family-build"),
 		format: ModelFormatSchema$1
+	}),
+	object({
+		kind: literal("kept-custom-pin"),
+		modelId: string(),
+		deviceKey: string()
 	})
 ]);
+/** Why a device is left exactly as it is, whatever the plan would pick (D786). */
+var KeptReasonSchema = _enum(["custom-pin"]);
+/**
+* Where a choice's latency came from (D791): this node's own benchmark
+* result, or the hardware-class table. Measured on the node beats the table.
+*/
+var LatencySourceSchema = discriminatedUnion("kind", [object({ kind: literal("table") }), object({
+	kind: literal("node-benchmark"),
+	resultId: string(),
+	measuredAtMs: number()
+})]);
 var DeviceModelChoiceSchema = object({
 	modelId: string(),
 	p50Ms: number(),
 	fps: number(),
 	measured: boolean(),
+	/** Absent on a plan from before D791 — read as the table. */
+	source: LatencySourceSchema.optional(),
 	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
 	capacitySessions: number(),
 	personRecall: number()
@@ -24855,6 +26051,8 @@ var DeviceRecommendationSchema = object({
 	enabled: boolean(),
 	available: boolean(),
 	chosen: DeviceModelChoiceSchema.nullable(),
+	/** Present when the device is kept as is: Apply writes nothing on it. */
+	kept: KeptReasonSchema.optional(),
 	reasons: array(RecommendationReasonSchema).readonly()
 });
 var NodeRecommendationSchema = object({
@@ -24908,6 +26106,17 @@ var AutoTuneWarningSchema = discriminatedUnion("kind", [
 		kind: literal("coral-enabled"),
 		nodeId: string(),
 		deviceKey: string()
+	}),
+	object({
+		kind: literal("custom-pin-kept"),
+		nodeId: string(),
+		deviceKey: string().nullable(),
+		deviceId: number().nullable(),
+		modelId: string()
+	}),
+	object({
+		kind: literal("custom-registry-unreadable"),
+		error: string()
 	})
 ]);
 var AutoTuneOptionsSchema = object({
@@ -25098,13 +26307,14 @@ var SuggestSharesResultSchema = object({
 	nodes: array(SuggestedNodeShareSchema).readonly()
 });
 /**
-* Where the node and device shares come from (D750, D755).
-*  - `hardware` (default) — computed by the system from each node's static
-*    capacity (its accelerators at their Auto tune models, from the measured
-*    latency table), recomputed whenever a node or device joins, leaves, is
-*    switched on or off, or changes model. No load input.
-*  - `benchmark` — the same, from each node's measured capacity (node
-*    benchmark results); a node without results falls back to `hardware`.
+* Where the node and device shares come from (D750, D755, D791).
+*  - `benchmark` (default since D791) — each node's capacity as its own node
+*    benchmark measured it; a node without fresh results is sized from
+*    `hardware` and says so. Measured on the node beats the table.
+*  - `hardware` — computed from each node's static capacity only (its
+*    accelerators at their Auto tune models, from the latency table).
+*  Both are recomputed whenever a node or device joins, leaves, is switched
+*  on or off, changes model, or a benchmark result is written. No load input.
 *  - `manual` — the operator's stored sliders.
 * Either way a node or device that cannot take sessions gives its share to
 * the others in proportion; the stored values are never rewritten for that.
@@ -25114,7 +26324,7 @@ var ShareSourceSchema = _enum([
 	"benchmark",
 	"manual"
 ]);
-var DEFAULT_SHARE_SOURCE = "hardware";
+var DEFAULT_SHARE_SOURCE = "benchmark";
 /** `hardware` or `benchmark`: the system computes the shares. */
 function isAutomaticShareSource(source) {
 	return source !== "manual";
@@ -25128,6 +26338,7 @@ var SHARE_SOURCE_SETTING_KEY = "shareSource";
 * D755 split it) reads as `hardware` — that is what it computed.
 */
 function parseShareSource(value) {
+	if (value === "auto") return "hardware";
 	const parsed = ShareSourceSchema.safeParse(value);
 	return parsed.success ? parsed.data : DEFAULT_SHARE_SOURCE;
 }
@@ -25170,6 +26381,363 @@ var EffectiveSharesSchema = object({
 	nodeWeights: record(string(), number()),
 	deviceWeights: record(string(), record(string(), number()))
 });
+/**
+* Wire shapes of the node benchmark (D791): the operator's plan, the
+* preflight the confirmation shows, the run the orchestrator owns, what the
+* measuring runner reports, and the result rows Auto tune and the automatic
+* shares read.
+*
+* ONE node at a time, owned by the pipeline orchestrator. While a run is
+* active the cluster is in BENCHMARK MODE for that node: it is not a
+* detection candidate, camera pins naming it are ignored so its sessions move
+* elsewhere, and both come back when the mode ends — after a crash or a hub
+* restart too (a persisted manifest, reconciled against the registry).
+*
+* Two measurements, both on the node, driven by its own runner (frames never
+* cross a process at frame rate, D9):
+*  - `device` — one accelerator × one candidate detector, root only, open
+*    loop: how many streams at the camera rate it carries inside the frame
+*    interval;
+*  - `pipeline` — the chosen detector plus the operator's detail steps
+*    (faces, plates, classifiers, CLIP…), on varied frames from the bench
+*    clip: how many parallel sessions the node carries before latency, drops,
+*    CPU, RAM or the event loop give out.
+*/
+/** Defaults and bounds, one place. */
+var NODE_BENCHMARK_DEFAULTS = {
+	fpsPerStream: 10,
+	budgetMinutes: 45,
+	minBudgetMinutes: 10,
+	maxBudgetMinutes: 120,
+	/** A result older than this no longer beats the table. */
+	staleAfterDays: 30,
+	/** Warm-in per ramp step (not accounted). */
+	settleSec: 5,
+	/** Accounted window per ramp step. */
+	measureSec: 20,
+	/** Longest the drain may take before the run is refused. */
+	drainTimeoutSec: 120,
+	/** Candidate models per device in one run. */
+	maxModelsPerDevice: 6
+};
+/** The two measurements a run can make. */
+var NodeBenchmarkPhaseSchema = _enum(["device", "pipeline"]);
+var NodeBenchmarkDevicePlanSchema = object({
+	/** `<backend>:<device>` — `openvino:npu`, `coreml:all`, `cpu`. */
+	deviceKey: string().min(1),
+	/**
+	* Root detector candidates for the `device` measurement, in the order
+	* measured. The FIRST is the one the `pipeline` measurement runs.
+	*/
+	modelIds: array(string().min(1)).min(1).max(NODE_BENCHMARK_DEFAULTS.maxModelsPerDevice)
+});
+/** What the operator confirmed. */
+var NodeBenchmarkPlanSchema = object({
+	nodeId: string().min(1),
+	devices: array(NodeBenchmarkDevicePlanSchema).min(1),
+	/** Which measurements run. At least one. */
+	phases: array(NodeBenchmarkPhaseSchema).min(1).default(["device", "pipeline"]),
+	/**
+	* Detail steps (catalog step ids under the root: faces, plates,
+	* classifiers, CLIP…) the `pipeline` measurement enables. The root
+	* detector always runs.
+	*/
+	steps: array(string().min(1)).default([]),
+	/** Offered rate of one stream / session. */
+	fpsPerStream: number().int().min(1).max(30).default(NODE_BENCHMARK_DEFAULTS.fpsPerStream),
+	/** Hard deadline: the mode ends and the cluster is restored when it passes. */
+	budgetMinutes: number().int().min(NODE_BENCHMARK_DEFAULTS.minBudgetMinutes).max(NODE_BENCHMARK_DEFAULTS.maxBudgetMinutes).default(NODE_BENCHMARK_DEFAULTS.budgetMinutes),
+	/** Keep the models the run downloaded (default: delete what was not installed before). */
+	keepDownloadedModels: boolean().default(false),
+	/** Start although the other nodes' capacity does not cover the sessions running now. */
+	acceptInsufficientHeadroom: boolean().default(false)
+});
+var NodeBenchmarkRefusalSchema = object({
+	kind: _enum([
+		"benchmark-active",
+		"node-offline",
+		"unknown-device",
+		"no-phase",
+		"insufficient-headroom"
+	]),
+	detail: string(),
+	overridable: boolean()
+});
+/** A camera whose detection leaves the node for the run. */
+var NodeBenchmarkMovingCameraSchema = object({
+	deviceId: number(),
+	/** Placed on the node now (a standing attach or a running session). */
+	placedOnNode: boolean(),
+	/** A node pin naming this node, ignored for the run. */
+	pinnedToNode: boolean()
+});
+/** A camera that cannot leave: no other node can obtain its frames. */
+var NodeBenchmarkStayingCameraSchema = object({
+	deviceId: number(),
+	reason: literal("only-frame-source")
+});
+var NodeBenchmarkPreflightSchema = object({
+	nodeId: string(),
+	online: boolean(),
+	moving: array(NodeBenchmarkMovingCameraSchema).readonly(),
+	/** Keep running on the node during the run; the result is flagged contaminated. */
+	staying: array(NodeBenchmarkStayingCameraSchema).readonly(),
+	estimatedDurationMs: number(),
+	/** The run ends and the cluster is restored at the latest after this long. */
+	budgetMs: number(),
+	phases: array(NodeBenchmarkPhaseSchema).readonly(),
+	steps: array(string()).readonly(),
+	devices: array(NodeBenchmarkDevicePlanSchema).readonly(),
+	/** Parallel sessions the cluster runs now, and what the other nodes can carry. */
+	headroom: object({
+		sessionsNow: number(),
+		otherNodesCapacitySessions: number().nullable()
+	}),
+	refusals: array(NodeBenchmarkRefusalSchema).readonly(),
+	canStart: boolean()
+});
+/** Where the measuring runner is. */
+var NodeBenchProgressSchema = object({
+	phase: _enum([
+		"preparing",
+		"device",
+		"pipeline",
+		"cleanup"
+	]),
+	deviceKey: string().nullable(),
+	modelId: string().nullable(),
+	/** Streams (device) or sessions (pipeline) of the step running now. */
+	load: number().nullable(),
+	cellsDone: number(),
+	cellsTotal: number(),
+	message: string()
+});
+/** What limited a ramp. `none` = the ramp ran out of steps still passing. */
+var NodeBenchLimitSchema = _enum([
+	"p95",
+	"drops",
+	"errors",
+	"stall",
+	"cpu",
+	"ram",
+	"none"
+]);
+var NodeBenchRampStepSchema = object({
+	load: number(),
+	pass: boolean(),
+	p95Ms: number(),
+	dropRatio: number(),
+	/** Completed frames per second over the accounted window. */
+	fps: number(),
+	cpuPct: number().nullable(),
+	ramFreePct: number().nullable(),
+	failReasons: array(string()).readonly()
+});
+var NodeBenchCellSchema = discriminatedUnion("phase", [object({
+	phase: literal("device"),
+	deviceKey: string(),
+	modelId: string(),
+	/** Single-stream latency (the K = 1 step). */
+	p50Ms: number(),
+	p95Ms: number(),
+	p99Ms: number(),
+	/** Frames per second sustained at the last passing step. */
+	fps: number(),
+	/** Streams at the camera rate the device carried inside the frame interval; 0 = not even one. */
+	kMax: number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** First call (model load + warm-up). */
+	warmupMs: number(),
+	ramp: array(NodeBenchRampStepSchema).readonly()
+}), object({
+	phase: literal("pipeline"),
+	deviceKey: string(),
+	modelId: string(),
+	steps: array(string()).readonly(),
+	/** Parallel sessions at the camera rate the node carried; 0 = not even one. */
+	maxSessions: number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** Detail steps that produced at least one result on the clip — a step that never fired measured nothing. */
+	stepsFired: array(string()).readonly(),
+	warmupMs: number(),
+	ramp: array(NodeBenchRampStepSchema).readonly()
+})]);
+/**
+* What a result was measured ON. A result whose fingerprint no longer matches
+* the node no longer beats the table.
+*/
+var NodeBenchFingerprintSchema = object({
+	pipelineVersion: string().nullable(),
+	cpuModel: string().nullable(),
+	ramGb: number().nullable(),
+	os: string().nullable(),
+	/** Per device: the pool the cells ran on (runtime + tuning). */
+	pools: record(string(), object({
+		runtime: string(),
+		numWorkers: number(),
+		concurrency: number(),
+		batchMode: string()
+	})).default({})
+});
+/** The frames the run used. */
+var NodeBenchClipSchema = object({
+	/** `camstack-bench-v1` or `reference-images` (the fallback when the clip is not reachable). */
+	id: string(),
+	revision: string().nullable(),
+	frames: number(),
+	width: number(),
+	height: number()
+});
+var NodeBenchRunnerInputSchema = object({
+	runId: string().min(1),
+	devices: array(NodeBenchmarkDevicePlanSchema).min(1),
+	phases: array(NodeBenchmarkPhaseSchema).min(1),
+	/** The full detail step tree root for the `pipeline` measurement is built on the node from these ids. */
+	steps: array(string()).default([]),
+	fpsPerStream: number().int().min(1).max(30),
+	/** The runner stops on its own past this instant, whatever the hub does. */
+	deadlineAtMs: number(),
+	settleSec: number().min(0).max(60).default(NODE_BENCHMARK_DEFAULTS.settleSec),
+	measureSec: number().min(2).max(300).default(NODE_BENCHMARK_DEFAULTS.measureSec),
+	keepDownloadedModels: boolean().default(false)
+});
+var NodeBenchRunnerStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"aborted"
+]);
+var NodeBenchRunnerStatusSchema = object({
+	runId: string(),
+	nodeId: string(),
+	state: NodeBenchRunnerStateSchema,
+	progress: NodeBenchProgressSchema.nullable(),
+	/** Every finished cell so far — a run stopped half way keeps what it measured. */
+	cells: array(NodeBenchCellSchema).readonly(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Cameras seen running on the node during the run (they share its pools). */
+	activeCameraIds: array(number()).readonly(),
+	/** Models the run downloaded and then deleted (not installed before). */
+	deletedModels: array(string()).readonly(),
+	error: string().nullable(),
+	startedAtMs: number(),
+	finishedAtMs: number().nullable()
+});
+var NodeBenchmarkStateSchema = _enum([
+	"draining",
+	"measuring",
+	"restoring",
+	"done",
+	"failed",
+	"aborted"
+]);
+/** Why a run ended. */
+var NodeBenchmarkEndReasonSchema = _enum([
+	"completed",
+	"operator-abort",
+	"deadline",
+	"node-lost",
+	"runner-lost",
+	"hub-restart",
+	"drain-timeout",
+	"failed"
+]);
+var NodeBenchmarkRunSchema = object({
+	runId: string(),
+	nodeId: string(),
+	state: NodeBenchmarkStateSchema,
+	plan: NodeBenchmarkPlanSchema,
+	startedAtMs: number(),
+	deadlineAtMs: number(),
+	finishedAtMs: number().nullable(),
+	endReason: NodeBenchmarkEndReasonSchema.nullable(),
+	error: string().nullable(),
+	/** Cameras moved off the node for the run. */
+	moved: array(number()).readonly(),
+	/** Cameras that stayed (their only frame source is the node). */
+	staying: array(number()).readonly(),
+	/** Something else ran on the node's pools during the run. */
+	contaminated: boolean(),
+	progress: NodeBenchProgressSchema.nullable(),
+	resultIds: array(string()).readonly()
+});
+/** `getNodeBenchmarkStatus`: the active run (or the last one), and whether benchmark mode is on. */
+var NodeBenchmarkStatusSchema = object({
+	/** The node the cluster is in benchmark mode for; null = none. */
+	modeNodeId: string().nullable(),
+	run: NodeBenchmarkRunSchema.nullable()
+});
+/**
+* One stored measurement — the only authority Auto tune and the automatic
+* shares read measured capacity from. Written by the orchestrator when a run
+* ends, never by anyone else.
+*/
+var NodeBenchmarkResultSchema = object({
+	id: string(),
+	runId: string(),
+	nodeId: string(),
+	cell: NodeBenchCellSchema,
+	fpsPerStream: number(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Other work shared the node's pools (a camera that could not move, or the hub's own duties). */
+	contaminated: boolean(),
+	stayingCameras: array(number()).readonly(),
+	/** The run ended early; the cell itself completed. */
+	partialRun: boolean(),
+	measuredAtMs: number()
+});
+var ListNodeBenchmarkResultsInputSchema = object({
+	nodeId: string().optional(),
+	deviceKey: string().optional()
+});
+/** A result with its standing today: does it still beat the table? */
+var NodeBenchmarkResultViewSchema = NodeBenchmarkResultSchema.extend({
+	/** `fresh` beats the table; `stale` falls back to it; `superseded` = a newer row covers the same cell. */
+	standing: _enum([
+		"fresh",
+		"stale",
+		"superseded"
+	]),
+	staleWhy: _enum([
+		"age",
+		"runtime",
+		"pool-tuning"
+	]).nullable()
+});
+/** The manifest persisted BEFORE benchmark mode changes anything; its presence means "restore". */
+var NodeBenchmarkManifestSchema = object({
+	runId: string(),
+	nodeId: string(),
+	startedAtMs: number(),
+	deadlineAtMs: number(),
+	plan: NodeBenchmarkPlanSchema,
+	moved: array(number()).readonly(),
+	staying: array(number()).readonly()
+});
+/** Candidate detectors per device, for the plan editor. */
+var NodeBenchmarkCandidatesSchema = object({
+	nodeId: string(),
+	reachable: boolean(),
+	devices: array(object({
+		deviceKey: string(),
+		enabled: boolean(),
+		available: boolean(),
+		/** Ordered: what Auto tune would pick first, then the rest of the family by accuracy. */
+		suggested: array(string()).readonly(),
+		/** Every root detector the device has a build for. */
+		all: array(string()).readonly(),
+		/** The model the device runs now, when pinned. */
+		currentModelId: string().nullable()
+	})).readonly(),
+	/** Detail steps the node's catalog offers under the root (for the `pipeline` measurement). */
+	steps: array(object({
+		id: string(),
+		name: string(),
+		slot: string()
+	})).readonly()
+});
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -26486,7 +28054,16 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 }), ParkedTrackFrameSchema.nullable()), method(object({
 	deviceId: number(),
 	trackId: string()
-}), object({ released: number().int().nonnegative() }), { kind: "mutation" });
+}), object({ released: number().int().nonnegative() }), { kind: "mutation" }), method(NodeBenchRunnerInputSchema, object({
+	accepted: literal(true),
+	runId: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ runId: string() }), NodeBenchRunnerStatusSchema.nullable(), { auth: "admin" }), method(object({ runId: string() }), object({ aborted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -27412,6 +28989,51 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Node benchmark — what a run of this plan would do, without doing it:
+		* the cameras that leave the node, those that cannot (the node is their
+		* only frame source; they stay and flag the run), the estimated duration
+		* and every reason it may not start. The confirmation shows this.
+		*/
+		getNodeBenchmarkPreflight: method(NodeBenchmarkPlanSchema, NodeBenchmarkPreflightSchema, { auth: "admin" }),
+		/**
+		* Node benchmark — start ONE run (cluster-wide lock). The orchestrator
+		* persists a restore manifest, enters benchmark mode for the node (out of
+		* placement, its camera pins ignored, nothing rewritten), drains it, drives
+		* the node's own runner, then restores — always, including after an
+		* abort, a lost node or a hub restart. Answers at once; poll
+		* `getNodeBenchmarkStatus`. Refused runs carry the preflight.
+		*/
+		startNodeBenchmark: method(NodeBenchmarkPlanSchema, discriminatedUnion("kind", [object({
+			kind: literal("started"),
+			runId: string()
+		}), object({
+			kind: literal("refused"),
+			preflight: NodeBenchmarkPreflightSchema
+		})]), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Node benchmark — the active run (or the last one) and the node in benchmark mode. */
+		getNodeBenchmarkStatus: method(_void(), NodeBenchmarkStatusSchema, { auth: "admin" }),
+		/** Node benchmark — stop the active run; the cluster is restored as it was. */
+		abortNodeBenchmark: method(object({ runId: string() }), object({ aborted: boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Node benchmark — root detector candidates per device (what Auto tune
+		* would pick first, then the family) and the detail steps the node's
+		* catalog offers, for the plan editor.
+		*/
+		getNodeBenchmarkCandidates: method(object({ nodeId: string() }), NodeBenchmarkCandidatesSchema, { auth: "admin" }),
+		/** Node benchmark — stored results, newest first, each with its standing today. */
+		listNodeBenchmarkResults: method(ListNodeBenchmarkResultsInputSchema, array(NodeBenchmarkResultViewSchema).readonly(), { auth: "admin" }),
+		/** Node benchmark — delete one result; Auto tune and the shares stop reading it. */
+		deleteNodeBenchmarkResult: method(object({ id: string() }), object({ deleted: boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Read one camera's settings. Null when never touched (inherits agent defaults fully). */
 		getCameraSettings: method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()),
 		/** Set or clear the 3-state toggle for one (camera, addonId). Pass `enabled: null` to clear and revert to agent default. */
@@ -28164,7 +29786,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -30070,7 +31704,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string(),
 	sdpAnswer: string()
@@ -32582,6 +34231,9 @@ var CreateIntegrationInputSchema = object({
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional(),
 	settings: record(string(), unknown()).optional(),
+	/** Keys of `settings` the form's schema declares secret (by type) — kept in
+	*  the keychain, not the table (D787). */
+	secretKeys: array(string()).optional(),
 	skipRestart: boolean().optional()
 });
 var UpdateIntegrationInputSchema = object({
@@ -32605,7 +34257,9 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	auth: "admin"
 }), method(object({ id: string() }), record(string(), unknown()), { auth: "admin" }), method(object({
 	id: string(),
-	settings: record(string(), unknown())
+	settings: record(string(), unknown()),
+	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
+	secretKeys: array(string()).optional()
 }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -38169,6 +39823,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -38282,7 +39962,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string(),
 	username: string(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string(),
+	issuer: string()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string(),
+	issuer: string().min(1),
+	label: string().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -41380,6 +43075,90 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychain.delete": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychain.getState": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.listMeta": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.put": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychain.resolve": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.deleteOrphans": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.downloadRecoveryKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.listAudit": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.listSecrets": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.purgeRetiredKeys": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.resetKeychain": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.reveal": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.rotateMasterKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.status": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"lawnMowerControl.dock": {
 		capName: "lawn-mower-control",
 		capScope: "device",
@@ -42754,6 +44533,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.addRetrainFrameFromRecording": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.addRetrainFramesToCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.applyDeviceSettingsPatch": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -42802,12 +44593,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.createRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -43012,6 +44815,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAssistProfiles": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollectionFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollections": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -43060,6 +44881,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -43114,6 +44941,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.removeRetrainFrameFromCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"pipelineAnalytics.renameRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -43144,6 +44983,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -43180,6 +45025,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -43390,6 +45241,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.abortNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.applyAutoTune": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -43414,6 +45271,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.deleteNodeBenchmarkResult": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.getAgentLoad": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -43522,6 +45385,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getNodeBenchmarkCandidates": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkPreflight": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getNodeInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -43564,6 +45445,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.listNodeBenchmarkResults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.pauseForStorageMigration": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -43708,6 +45595,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.startNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.suggestShares": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -43726,6 +45619,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.abortNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineRunner.attachCamera": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -43774,6 +45673,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNodeBenchStatus": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.getParkedTrackFrame": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -43816,6 +45721,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.startNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -45532,18 +47443,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -45622,6 +47551,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -48749,6 +50684,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.addRetrainFrameFromRecording": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -48939,6 +50879,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.pruneEventsBefore": [{
 		name: "deviceId",
 		form: "single",
@@ -48989,6 +50934,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -51421,6 +53371,22 @@ function capacitySessionsOf(fps, headroom, cameraFps) {
 	if (!(fps > 0) || !(cameraFps > 0)) return 0;
 	return Math.max(0, Math.floor(fps * (1 - headroom) / cameraFps + 1e-9));
 }
+/** The table column with the node's own measurements laid over it. */
+function overlayMeasured(table, measured) {
+	if (measured === void 0 || Object.keys(measured).length === 0) return table;
+	const out = { ...table };
+	for (const [modelId, m] of Object.entries(measured)) out[modelId] = {
+		p50Ms: m.p50Ms,
+		fps: m.fps,
+		measured: true,
+		source: {
+			kind: "node-benchmark",
+			resultId: m.resultId,
+			measuredAtMs: m.measuredAtMs
+		}
+	};
+	return out;
+}
 function round(value, digits = 3) {
 	const f = 10 ** digits;
 	return Math.round(value * f) / f;
@@ -51493,6 +53459,7 @@ function choiceOn(ctx, modelId, sizing) {
 		p50Ms: cell.p50Ms,
 		fps: cell.fps,
 		measured: cell.measured,
+		source: cell.source ?? { kind: "table" },
 		capacitySessions: sessionsOn(cell, sizing),
 		personRecall: DETECTOR_ACCURACY[modelId]?.personRecall ?? 0
 	};
@@ -51541,11 +53508,14 @@ function recommendNode(input) {
 	if (node.hardware === null) return skippedNode(node, { kind: "no-hardware-facts" }, null);
 	const hardware = node.hardware;
 	const { hardwareClass, cpuModel } = classifyInferenceHardware(hardware);
-	const classTable = perf[hardwareClass];
-	if (hardwareClass === "unknown" || classTable === void 0) return skippedNode(node, {
+	const measured = input.measured ?? {};
+	const hasMeasured = Object.values(measured).some((m) => Object.keys(m).length > 0);
+	const knownTable = hardwareClass === "unknown" ? void 0 : perf[hardwareClass];
+	if (knownTable === void 0 && !hasMeasured) return skippedNode(node, {
 		kind: "no-measured-data",
 		hardwareClass
 	}, hardwareClass);
+	const classTable = knownTable ?? {};
 	const devices = node.devices.toSorted((a, b) => a.key.localeCompare(b.key));
 	const contexts = /* @__PURE__ */ new Map();
 	const early = /* @__PURE__ */ new Map();
@@ -51563,7 +53533,7 @@ function recommendNode(input) {
 			early.set(device.key, [{ kind: "device-unavailable" }]);
 			continue;
 		}
-		const column = accelerator === null ? void 0 : classTable[accelerator];
+		const column = accelerator === null ? void 0 : overlayMeasured(classTable[accelerator], measured[device.key]);
 		if (accelerator === null || column === void 0) {
 			early.set(device.key, [{
 				kind: "no-family-build",
@@ -51578,13 +53548,28 @@ function recommendNode(input) {
 		});
 	}
 	const isCpu = (a) => a === "x86-cpu" || a === "arm-cpu";
-	const accelerators = [...contexts.values()].filter((c) => !isCpu(c.accelerator));
-	const cpus = [...contexts.values()].filter((c) => isCpu(c.accelerator));
+	const keptByKey = /* @__PURE__ */ new Map();
+	const keptReasonOf = (group) => {
+		const pinned = group.find((c) => c.device.customPinModelId !== void 0);
+		if (pinned?.device.customPinModelId === void 0) return null;
+		const reason = {
+			kind: "kept-custom-pin",
+			modelId: pinned.device.customPinModelId,
+			deviceKey: pinned.device.key
+		};
+		for (const c of group) keptByKey.set(c.device.key, [reason]);
+		return reason;
+	};
+	const acceleratorGroup = [...contexts.values()].filter((c) => !isCpu(c.accelerator));
+	const acceleratorKept = keptReasonOf(acceleratorGroup);
+	const accelerators = acceleratorKept === null ? acceleratorGroup : [];
+	const cpus = [...contexts.values()].filter((c) => isCpu(c.accelerator)).filter((c) => keptReasonOf([c]) === null);
 	const chosenByKey = /* @__PURE__ */ new Map();
 	const reasonsByKey = /* @__PURE__ */ new Map();
 	const nodeReasons = [];
 	let acceleratorModelId = null;
 	const groupPick = accelerators.length > 0 ? pickForGroup(accelerators, node.formatsByModel, sizing) : null;
+	if (acceleratorKept !== null) nodeReasons.push(acceleratorKept);
 	if (groupPick !== null) {
 		acceleratorModelId = groupPick.modelId;
 		nodeReasons.push(...groupPick.reasons);
@@ -51628,7 +53613,8 @@ function recommendNode(input) {
 			enabled: device.enabled,
 			available: device.available,
 			chosen: chosenByKey.get(device.key) ?? null,
-			reasons: early.get(device.key) ?? reasonsByKey.get(device.key) ?? []
+			...keptByKey.has(device.key) ? { kept: "custom-pin" } : {},
+			reasons: early.get(device.key) ?? keptByKey.get(device.key) ?? reasonsByKey.get(device.key) ?? []
 		})),
 		reasons: nodeReasons
 	};
@@ -51740,24 +53726,6 @@ function resolveEffectiveShares(input) {
 		deviceWeights
 	};
 }
-/**
-* Automatic shares from CAPACITY (D755). Pure.
-*
-* A node's share is its capacity in parallel sessions over the cluster's; a
-* device's share inside its node follows its throughput. There is no load
-* input: nothing here depends on how many sessions ran, only on what each
-* node can carry.
-*
-* Two places a capacity can come from:
-*  - `hardware` — each enabled accelerator at its Auto tune model, from the
-*    measured latency table: ⌊fps × (1 − headroom) / camera fps⌋ sessions;
-*  - `benchmark` — the node's own measured max sessions per device, read
-*    through a {@link NodeCapacitySource}. A node whose results do not cover
-*    every enabled device it would be sized on is sized from `hardware`
-*    instead, and the answer says so per node — never a silent mix.
-*/
-/** A source that has no results — the benchmark store before it exists. */
-var NO_MEASURED_CAPACITY = { readMeasuredCapacity: async () => /* @__PURE__ */ new Map() };
 /** Integer shares summing to 100 (largest remainder); ties broken by key. */
 function toPercentShares(weights) {
 	const total = [...weights.values()].reduce((a, b) => a + b, 0);
@@ -51872,6 +53840,258 @@ function computeCapacityShares(input) {
 	};
 }
 /**
+* Benchmark mode (D791) — the pure rules of "one node under test". Pure.
+*
+* While the cluster is in benchmark mode for node N:
+*  - N is not a detection candidate for any camera that another node can
+*    serve ({@link eligibleUnderBenchmark});
+*  - a node pin naming N is ignored for such a camera
+*    ({@link pinUnderBenchmark}) — the stored pin is never rewritten, so it
+*    is "restored" the moment the mode ends;
+*  - a camera whose ONLY frame source is N stays on N (never blind) and the
+*    run is flagged contaminated.
+*/
+/** The detection candidates of one camera while `benchNodeId` is under test. */
+function eligibleUnderBenchmark(eligible, benchNodeId) {
+	if (benchNodeId === null || !eligible.includes(benchNodeId)) return eligible;
+	const others = eligible.filter((n) => n !== benchNodeId);
+	return others.length > 0 ? others : eligible;
+}
+/** A camera's node pin while `benchNodeId` is under test (null = no pin). */
+function pinUnderBenchmark(pin, benchNodeId, eligible) {
+	if (pin === null || benchNodeId === null || pin !== benchNodeId) return pin;
+	return eligible.some((n) => n !== benchNodeId) ? null : pin;
+}
+/** Which cameras leave the node for the run, and which cannot. */
+function classifyCamerasForBenchmark(nodeId, cameras) {
+	const moving = [];
+	const staying = [];
+	for (const cam of cameras.toSorted((a, b) => a.deviceId - b.deviceId)) {
+		const placedOnNode = cam.placedNodeId === nodeId;
+		const pinnedToNode = cam.nodePin === nodeId;
+		if (!placedOnNode && !pinnedToNode) continue;
+		if (!cam.frameSourceNodes.some((n) => n !== nodeId)) staying.push({
+			deviceId: cam.deviceId,
+			reason: "only-frame-source"
+		});
+		else moving.push({
+			deviceId: cam.deviceId,
+			placedOnNode,
+			pinnedToNode
+		});
+	}
+	return {
+		moving,
+		staying
+	};
+}
+/** Ramp steps the runner tries per cell, at most. */
+var DEVICE_RAMP = [
+	1,
+	2,
+	4,
+	6,
+	8,
+	12,
+	16,
+	24,
+	32
+];
+var PIPELINE_RAMP = [
+	1,
+	2,
+	3,
+	4,
+	6,
+	8,
+	10,
+	12,
+	16
+];
+/** Fixed costs around the measurement: drain, clip, warm-ups, restore. */
+var OVERHEAD_MS = 3 * 6e4;
+var WARMUP_PER_CELL_MS = 2e4;
+/**
+* An upper bound on how long the run takes: every ramp step of every cell,
+* plus the drain, the clip and the restore — capped at the budget, which is
+* the hard deadline anyway. A ramp usually stops well before its last step.
+*/
+function estimateNodeBenchmarkDurationMs(plan, timing = {}) {
+	const stepMs = ((timing.settleSec ?? NODE_BENCHMARK_DEFAULTS.settleSec) + (timing.measureSec ?? NODE_BENCHMARK_DEFAULTS.measureSec)) * 1e3;
+	let total = OVERHEAD_MS;
+	if (plan.phases.includes("device")) for (const device of plan.devices) total += device.modelIds.length * (WARMUP_PER_CELL_MS + DEVICE_RAMP.length * stepMs);
+	if (plan.phases.includes("pipeline")) total += plan.devices.length * (WARMUP_PER_CELL_MS + PIPELINE_RAMP.length * stepMs);
+	return Math.min(total, plan.budgetMinutes * 6e4);
+}
+/** Why a run cannot start, in the order the operator should read them. */
+function nodeBenchmarkRefusals(input) {
+	const out = [];
+	if (input.activeRunNodeId !== null) out.push({
+		kind: "benchmark-active",
+		detail: `A benchmark of ${input.activeRunNodeId} is running — one node at a time.`,
+		overridable: false
+	});
+	if (!input.online) out.push({
+		kind: "node-offline",
+		detail: `${input.plan.nodeId} is not online.`,
+		overridable: false
+	});
+	const unknown = input.plan.devices.map((d) => d.deviceKey).filter((k) => !input.knownDeviceKeys.includes(k));
+	if (unknown.length > 0) out.push({
+		kind: "unknown-device",
+		detail: `${input.plan.nodeId} reports no device ${unknown.join(", ")}.`,
+		overridable: false
+	});
+	if (input.plan.phases.length === 0) out.push({
+		kind: "no-phase",
+		detail: "Choose at least one measurement.",
+		overridable: false
+	});
+	const capacity = input.otherNodesCapacitySessions;
+	if (capacity !== null && input.sessionsNow > capacity && !input.plan.acceptInsufficientHeadroom) out.push({
+		kind: "insufficient-headroom",
+		detail: `The cluster runs ${input.sessionsNow} sessions now; the other nodes can carry ${capacity}.`,
+		overridable: true
+	});
+	return out;
+}
+/** The cell a row measures — two rows with the same key measure the same thing. */
+function resultCellKey(row) {
+	const { cell } = row;
+	const steps = cell.phase === "pipeline" ? cell.steps.toSorted().join(",") : "";
+	return [
+		row.nodeId,
+		cell.deviceKey,
+		cell.phase,
+		cell.modelId,
+		steps
+	].join("|");
+}
+function staleWhy(row, ctx) {
+	const bound = ctx.staleAfterMs ?? NODE_BENCHMARK_DEFAULTS.staleAfterDays * 864e5;
+	if (ctx.nowMs - row.measuredAtMs > bound) return "age";
+	const now = ctx.currentPools[row.nodeId]?.[row.cell.deviceKey];
+	const then = row.fingerprint?.pools[row.cell.deviceKey];
+	if (now === void 0 || then === void 0) return null;
+	if (now.runtime !== then.runtime) return "runtime";
+	if (now.numWorkers !== then.numWorkers || now.concurrency !== then.concurrency || now.batchMode !== then.batchMode) return "pool-tuning";
+	return null;
+}
+/** The standing of every row, by id. */
+function resultStandings(rows, ctx) {
+	const newest = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const key = resultCellKey(row);
+		const held = newest.get(key);
+		if (held === void 0 || row.measuredAtMs > held.measuredAtMs) newest.set(key, row);
+	}
+	const out = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (newest.get(resultCellKey(row))?.id !== row.id) {
+			out.set(row.id, {
+				standing: "superseded",
+				staleWhy: null
+			});
+			continue;
+		}
+		const why = staleWhy(row, ctx);
+		out.set(row.id, why === null ? {
+			standing: "fresh",
+			staleWhy: null
+		} : {
+			standing: "stale",
+			staleWhy: why
+		});
+	}
+	return out;
+}
+/** Rows that beat the table today. */
+function freshResults(rows, ctx) {
+	const standings = resultStandings(rows, ctx);
+	return rows.filter((r) => standings.get(r.id)?.standing === "fresh");
+}
+/** deviceKey → modelId → the fresh `device` measurement on `nodeId`. */
+function measuredDetectorCells(rows, nodeId, ctx) {
+	const out = {};
+	for (const row of freshResults(rows, ctx)) {
+		if (row.nodeId !== nodeId || row.cell.phase !== "device") continue;
+		const perDevice = out[row.cell.deviceKey] ?? {};
+		perDevice[row.cell.modelId] = {
+			p50Ms: Math.round(row.cell.p50Ms * 100) / 100,
+			fps: row.cell.fps,
+			resultId: row.id,
+			measuredAtMs: row.measuredAtMs
+		};
+		out[row.cell.deviceKey] = perDevice;
+	}
+	return out;
+}
+/**
+* Per node, each device at its newest fresh `pipeline` measurement — the
+* `NodeCapacitySource` answer the automatic shares read.
+*/
+function measuredCapacityFromResults(rows, nodeIds, ctx) {
+	const byNode = /* @__PURE__ */ new Map();
+	for (const row of freshResults(rows, ctx)) {
+		if (!nodeIds.includes(row.nodeId) || row.cell.phase !== "pipeline") continue;
+		const devices = byNode.get(row.nodeId) ?? /* @__PURE__ */ new Map();
+		const held = devices.get(row.cell.deviceKey);
+		if (held === void 0 || row.measuredAtMs > held.measuredAtMs) devices.set(row.cell.deviceKey, row);
+		byNode.set(row.nodeId, devices);
+	}
+	const out = /* @__PURE__ */ new Map();
+	for (const nodeId of nodeIds) {
+		const devices = byNode.get(nodeId);
+		if (devices === void 0) continue;
+		out.set(nodeId, {
+			nodeId,
+			devices: [...devices.values()].toSorted((a, b) => a.cell.deviceKey.localeCompare(b.cell.deviceKey)).map((r) => ({
+				deviceKey: r.cell.deviceKey,
+				maxSessions: r.cell.phase === "pipeline" ? r.cell.maxSessions : 0,
+				modelId: r.cell.modelId,
+				measuredAtMs: r.measuredAtMs
+			}))
+		});
+	}
+	return out;
+}
+var BENCH_ROOT_STEP_ID = "object-detection";
+function slotAddons(schema, slot) {
+	return schema.slots.find((s) => s.id === slot)?.addons ?? [];
+}
+var feeds = (from, to) => to.inputClasses.some((c) => from.outputClasses.includes(c));
+function layout(schema) {
+	const root = slotAddons(schema, "detector").find((a) => a.id === BENCH_ROOT_STEP_ID);
+	if (root === void 0) return null;
+	const classifiers = slotAddons(schema, "classifier");
+	const croppers = slotAddons(schema, "cropper").filter((c) => feeds(root, c)).map((cropper) => ({
+		cropper,
+		recognizers: classifiers.filter((k) => feeds(cropper, k))
+	}));
+	const underCropper = new Set(croppers.flatMap((c) => c.recognizers.map((r) => r.id)));
+	return {
+		root,
+		croppers,
+		classifiers: classifiers.filter((k) => feeds(root, k) && !underCropper.has(k.id)),
+		refiners: slotAddons(schema, "refiner")
+	};
+}
+/** The detail steps the operator can choose, in tree order. */
+function listBenchDetailSteps(schema) {
+	const l = layout(schema);
+	if (l === null) return [];
+	const of = (a) => ({
+		id: a.id,
+		name: a.name,
+		slot: a.slot
+	});
+	return [
+		...l.croppers.flatMap((c) => [of(c.cropper), ...c.recognizers.map(of)]),
+		...l.classifiers.map(of),
+		...l.refiners.map(of)
+	];
+}
+/**
 * THE detail-crop convention — the single derivation of the rectangle a
 * detail/enrichment step (clip-embedding, face-detection, plate-detection…)
 * is fed.
@@ -52215,6 +54435,959 @@ function deviceBackendToFormat(backend) {
 	return DEVICE_BACKEND_TO_FORMAT[backend] ?? "onnx";
 }
 //#endregion
+//#region src/durable/durable-ledger.ts
+/** Default reseed cap — every current consumer's row set is installation-bounded. */
+var DEFAULT_LOAD_LIMIT = 1e5;
+var DurableLedger = class DurableLedger {
+	mirror = /* @__PURE__ */ new Map();
+	/** Whether ANY load has read the store successfully — see {@link hasAnswered}. */
+	answered = false;
+	spec;
+	store;
+	logger;
+	constructor(deps) {
+		this.spec = deps.spec;
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	/**
+	* Register the collection. MUST run at boot, before any read or write: the
+	* SQLite backend answers 412 for an undeclared collection and takes the whole
+	* runner down with it (the addon-ai boot-crash lesson).
+	*/
+	static declare(store, spec) {
+		return store.declareCollection.mutate({
+			collection: spec.collection,
+			columns: [...spec.columns],
+			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
+		});
+	}
+	declare() {
+		return DurableLedger.declare(this.store, this.spec);
+	}
+	/** The collection this ledger owns — for the caller's own log lines. */
+	get collection() {
+		return this.spec.collection;
+	}
+	/**
+	* Boot reseed. Replaces the mirror with what the store holds and returns the
+	* rows, so a caller that must hydrate something else (a watcher, a registry)
+	* gets them without a second read.
+	*
+	* **A failure returns what is already mirrored** rather than clearing it —
+	* see contract rule 2. The count is worth logging out loud at the call site:
+	* "loaded 0" after a container recreate is the one line that explains a
+	* silent flood.
+	*/
+	async load() {
+		try {
+			const records = await this.store.query.query({
+				collection: this.spec.collection,
+				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
+			});
+			const next = /* @__PURE__ */ new Map();
+			let skipped = 0;
+			for (const record of records) {
+				const row = this.spec.fromRecord(record.id, record.data);
+				if (row === null) {
+					skipped += 1;
+					continue;
+				}
+				next.set(this.spec.keyOf(row), row);
+			}
+			this.mirror.clear();
+			for (const [key, row] of next) this.mirror.set(key, row);
+			this.answered = true;
+			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
+				collection: this.spec.collection,
+				skipped
+			} });
+			return [...this.mirror.values()];
+		} catch (err) {
+			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
+				collection: this.spec.collection,
+				error: String(err),
+				held: this.mirror.size
+			} });
+			return [...this.mirror.values()];
+		}
+	}
+	/**
+	* Whether the mirror is an ANSWER from the store: true once any load has
+	* succeeded, and never false again (a later failed load keeps that answer).
+	* Before it, an empty mirror is "not read yet", never "the store is empty" —
+	* {@link load} swallows its failure, so a caller that must tell the two apart
+	* asks here (D642 review I1).
+	*/
+	hasAnswered() {
+		return this.answered;
+	}
+	/** Every mirrored row, insertion-ordered. */
+	snapshot() {
+		return [...this.mirror.values()];
+	}
+	/** The row currently held for a key, if any. Pure RAM — never I/O. */
+	get(key) {
+		return this.mirror.get(key);
+	}
+	has(key) {
+		return this.mirror.has(key);
+	}
+	get size() {
+		return this.mirror.size;
+	}
+	/**
+	* Judge ONE observation against what the ledger already accepted, and advance
+	* it.
+	*
+	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
+	* alone, so a decision can never be gated on an I/O that might fail (D49).
+	* The durable write is kicked off behind it and its failure changes no
+	* verdict.
+	*
+	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
+	* carries, which therefore means "when this key last CHANGED", not "when it
+	* last spoke". That is the timestamp anyone reading the table wants.
+	*/
+	observe(row) {
+		const equalFact = this.spec.equalFact;
+		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
+		const key = this.spec.keyOf(row);
+		const held = this.mirror.get(key);
+		if (held !== void 0 && equalFact(held, row)) return "no-flip";
+		this.mirror.set(key, row);
+		this.persist(row);
+		return held === void 0 ? "seeded" : "flip";
+	}
+	/**
+	* Upsert a row without a verdict — the write path for a ledger whose owner
+	* has already decided the value changed.
+	*
+	* The order of the mirror advance and the durable write is the spec's
+	* {@link DurableWriteMode}, not the call site's: two call sites that
+	* disagreed about it would be two different durability guarantees on one
+	* collection.
+	*/
+	async put(row) {
+		const key = this.spec.keyOf(row);
+		if (this.spec.writeMode === "write-behind") {
+			this.mirror.set(key, row);
+			await this.persist(row);
+			return;
+		}
+		await this.store.set.mutate({
+			collection: this.spec.collection,
+			key,
+			value: this.spec.toValue(row)
+		});
+		this.mirror.set(key, row);
+	}
+	/**
+	* Advance the mirror WITHOUT persisting, for an owner that deliberately
+	* coalesces its writes.
+	*
+	* The stationary registry is the reason this exists: a parked car is
+	* re-confirmed on every processed frame (5–30 Hz), and persisting each
+	* confirmation would offer thousands of commits a day to the checkpoint
+	* lottery (D96) to maintain a handful of rows. It stages the advance and
+	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
+	*
+	* **The cost is stated, not hidden**: a staged value that is never flushed
+	* is lost on a crash. An owner may only stage a field whose staleness its
+	* own TTL absorbs. Anything that GATES work must go through {@link put} or
+	* {@link observe}.
+	*/
+	stage(row) {
+		this.mirror.set(this.spec.keyOf(row), row);
+	}
+	/**
+	* Drop a key from the MIRROR only — the durable row survives.
+	*
+	* What a scope-unbind needs: this process stops holding the value, and a
+	* rebind reloads it from the store. Deliberately distinct from
+	* {@link forget}, which deletes; conflating the two is how an unbind turns
+	* into a wipe.
+	*/
+	evict(key) {
+		this.mirror.delete(key);
+	}
+	/**
+	* Drop one key, mirror and row. Best-effort on the durable half: a failed
+	* delete leaves a row that the next load will re-mirror, which is a stale
+	* value rather than a lost one.
+	*/
+	async forget(key) {
+		this.mirror.delete(key);
+		try {
+			await this.store.delete.mutate({
+				collection: this.spec.collection,
+				key
+			});
+		} catch (err) {
+			this.logger.debug("durable delete failed", { meta: {
+				collection: this.spec.collection,
+				key,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
+	*
+	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
+	* fallible read is work destroyed on an error (D49/D130) — that is why this
+	* is a method a feature opts into rather than a policy the primitive runs.
+	* Best-effort per row: a failed delete keeps the key (retried next prune)
+	* rather than aborting the sweep.
+	*/
+	async pruneExcept(activeKeys) {
+		let pruned = 0;
+		for (const key of [...this.mirror.keys()]) {
+			if (activeKeys.has(key)) continue;
+			try {
+				await this.store.delete.mutate({
+					collection: this.spec.collection,
+					key
+				});
+				this.mirror.delete(key);
+				pruned += 1;
+			} catch (err) {
+				this.logger.debug("durable prune delete failed", { meta: {
+					collection: this.spec.collection,
+					key,
+					error: String(err)
+				} });
+			}
+		}
+		return pruned;
+	}
+	/**
+	* Write-behind durable upsert. Best-effort and logged, never thrown at the
+	* decision path: the mirror already holds the truth for this process, and the
+	* worst a lost write can do is one silent re-seed after the next restart.
+	*/
+	async persist(row) {
+		const deviceId = this.spec.deviceIdOf?.(row);
+		try {
+			await this.store.set.mutate({
+				collection: this.spec.collection,
+				key: this.spec.keyOf(row),
+				value: this.spec.toValue(row)
+			});
+		} catch (err) {
+			this.logger.warn("durable persist failed — this key may re-seed on boot", {
+				...deviceId !== void 0 ? { tags: { deviceId } } : {},
+				meta: {
+					collection: this.spec.collection,
+					key: this.spec.keyOf(row),
+					error: String(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
+//#region src/node-benchmark/node-benchmark-store.ts
+/**
+* The node benchmark's three durable collections (D791), all owned by the
+* orchestrator — the placement authority that enters and leaves benchmark
+* mode, and the one writer of the results Auto tune and the shares read.
+*
+*  - the MANIFEST: one row, written BEFORE benchmark mode changes anything
+*    and removed only after the cluster is restored. Its presence at boot or
+*    on a reconcile with no live run means "restore now".
+*  - the RUNS: what each run did and why it ended (bounded history).
+*  - the RESULTS: one row per measured cell.
+*/
+/**
+* @durable class=ledger owner=pipeline-orchestrator
+*   write="once when benchmark mode is entered (write-through, BEFORE any change), removed once the cluster is restored"
+*   retention="at most one row (key `active`); its presence means a restore is owed"
+*/
+var NODE_BENCHMARK_MODE_COLLECTION = "pipeline-orchestrator:node-benchmark-mode";
+/**
+* @durable class=audit owner=pipeline-orchestrator
+*   write="one row per run, rewritten when the run ends"
+*   retention="the newest 50 runs; older rows are removed when a run is recorded"
+*/
+var NODE_BENCHMARK_RUNS_COLLECTION = "pipeline-orchestrator:node-benchmark-runs";
+/**
+* @durable class=ledger owner=pipeline-orchestrator
+*   write="one row per measured cell, written when its run ends; deleted by the operator"
+*   retention="the newest 500 rows; a row older than the stale bound stays listed but no longer beats the table"
+*/
+var NODE_BENCHMARK_RESULTS_COLLECTION = "pipeline-orchestrator:node-benchmarks";
+var JSON_ROW_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "body",
+		type: "JSON",
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	}
+];
+var MANIFEST_KEY = "active";
+function jsonSpec(collection, schema, keyOf, at) {
+	return {
+		collection,
+		columns: JSON_ROW_COLUMNS,
+		writeMode: "write-through",
+		keyOf,
+		toValue: (row) => ({
+			body: row,
+			at: at(row)
+		}),
+		fromRecord: (_key, data) => {
+			const parsed = schema.safeParse(data["body"]);
+			return parsed.success ? parsed.data : null;
+		}
+	};
+}
+var MANIFEST_SPEC = jsonSpec(NODE_BENCHMARK_MODE_COLLECTION, NodeBenchmarkManifestSchema, () => MANIFEST_KEY, (m) => m.startedAtMs);
+var RUNS_SPEC = jsonSpec(NODE_BENCHMARK_RUNS_COLLECTION, NodeBenchmarkRunSchema, (r) => r.runId, (r) => r.startedAtMs);
+var RESULTS_SPEC = jsonSpec(NODE_BENCHMARK_RESULTS_COLLECTION, NodeBenchmarkResultSchema, (r) => r.id, (r) => r.measuredAtMs);
+/** Keep the newest `max` rows by `at`; the rest are the ones to drop. */
+function overflow(rows, max, at) {
+	if (rows.length <= max) return [];
+	return rows.toSorted((a, b) => at(b) - at(a)).slice(max);
+}
+var NodeBenchmarkStore = class {
+	manifest;
+	runs;
+	results;
+	constructor(deps) {
+		this.manifest = new DurableLedger({
+			spec: MANIFEST_SPEC,
+			...deps
+		});
+		this.runs = new DurableLedger({
+			spec: RUNS_SPEC,
+			...deps
+		});
+		this.results = new DurableLedger({
+			spec: RESULTS_SPEC,
+			...deps
+		});
+	}
+	static async declare(store) {
+		await DurableLedger.declare(store, MANIFEST_SPEC);
+		await DurableLedger.declare(store, RUNS_SPEC);
+		await DurableLedger.declare(store, RESULTS_SPEC);
+	}
+	async load() {
+		await this.manifest.load();
+		await this.runs.load();
+		await this.results.load();
+	}
+	readManifest() {
+		return this.manifest.get(MANIFEST_KEY) ?? null;
+	}
+	writeManifest(manifest) {
+		return this.manifest.put(manifest);
+	}
+	clearManifest() {
+		return this.manifest.forget(MANIFEST_KEY);
+	}
+	async recordRun(run) {
+		await this.runs.put(run);
+		for (const old of overflow(this.runs.snapshot(), 50, (r) => r.startedAtMs)) await this.runs.forget(old.runId);
+	}
+	listRuns() {
+		return this.runs.snapshot().toSorted((a, b) => b.startedAtMs - a.startedAtMs);
+	}
+	async writeResults(rows) {
+		for (const row of rows) await this.results.put(row);
+		for (const old of overflow(this.results.snapshot(), 500, (r) => r.measuredAtMs)) await this.results.forget(old.id);
+	}
+	listResults() {
+		return this.results.snapshot().toSorted((a, b) => b.measuredAtMs - a.measuredAtMs);
+	}
+	async deleteResult(id) {
+		if (!this.results.has(id)) return false;
+		await this.results.forget(id);
+		return true;
+	}
+};
+//#endregion
+//#region src/node-benchmark/node-benchmark-service.ts
+/**
+* The node benchmark lifecycle (D791) — the orchestrator owns it because it
+* is the placement authority: entering benchmark mode is a placement change,
+* and only the owner of placement can promise to undo it.
+*
+*   start ─► preflight ─► MANIFEST (persisted first) ─► mode on ─► draining
+*        ─► measuring (the node's runner, polled) ─► restoring ─► done | failed | aborted
+*
+* Invariants:
+*  - ONE run cluster-wide; it does not matter which runner the request
+*    reached — the orchestrator drives the target node's runner by nodePin.
+*  - The manifest is written BEFORE anything changes and removed only AFTER
+*    the cluster is restored. Its presence without a live run — at boot, or
+*    on any reconcile tick — means "restore now" (registry-driven, never a
+*    timer or an event that may be lost).
+*  - Restoring always runs (`finally`): mode off, cameras pinned to the node
+*    re-placed, the runner told to stop, the results written, the run
+*    recorded. An abort leaves the cluster as it was.
+*  - Nothing the operator owns is written: no detect flag, no pin, no cap.
+*    Pins are ignored by the mode, never rewritten, so ending the mode IS the
+*    restore of the pins.
+*/
+var DEFAULT_POLL_MS = 3e3;
+/** After the deadline the runner gets this long to stop before the restore is forced. */
+var DEADLINE_GRACE_MS = 2 * 6e4;
+/** The node whose duties never stop for a benchmark: its numbers always share the CPU. */
+var HUB_NODE_ID = "hub";
+function toRun(manifest) {
+	return {
+		runId: manifest.runId,
+		nodeId: manifest.nodeId,
+		state: "draining",
+		plan: manifest.plan,
+		startedAtMs: manifest.startedAtMs,
+		deadlineAtMs: manifest.deadlineAtMs,
+		finishedAtMs: null,
+		endReason: null,
+		error: null,
+		moved: manifest.moved,
+		staying: manifest.staying,
+		contaminated: manifest.staying.length > 0 || manifest.nodeId === HUB_NODE_ID,
+		progress: null,
+		resultIds: []
+	};
+}
+/** Pipeline cells whose requested steps did not all fire measured something else — dropped. */
+function publishableCells(cells, requestedSteps) {
+	const unfired = /* @__PURE__ */ new Set();
+	return {
+		kept: cells.filter((cell) => {
+			if (cell.phase !== "pipeline") return true;
+			const missing = requestedSteps.filter((s) => !cell.stepsFired.includes(s));
+			for (const s of missing) unfired.add(s);
+			return missing.length === 0;
+		}),
+		unfired: [...unfired].toSorted()
+	};
+}
+var NodeBenchmarkService = class {
+	deps;
+	active = null;
+	modeNodeIdValue = null;
+	lastRun = null;
+	restoring = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	now() {
+		return this.deps.now?.() ?? Date.now();
+	}
+	sleep(ms) {
+		if (this.deps.sleep) return this.deps.sleep(ms);
+		return new Promise((resolve) => {
+			setTimeout(resolve, ms).unref?.();
+		});
+	}
+	/** The node the cluster is in benchmark mode for (null = none). Read by placement. */
+	modeNodeId() {
+		return this.modeNodeIdValue;
+	}
+	setMode(nodeId) {
+		if (this.modeNodeIdValue === nodeId) return;
+		this.modeNodeIdValue = nodeId;
+		this.deps.logger.info(nodeId === null ? "benchmark mode off" : "benchmark mode on — node out of placement", { meta: { nodeId } });
+		this.deps.onModeChanged?.(nodeId);
+	}
+	status() {
+		const run = this.active?.run ?? this.lastRun ?? this.deps.persistence.listRuns()[0] ?? null;
+		return {
+			modeNodeId: this.modeNodeIdValue,
+			run
+		};
+	}
+	async preflight(planInput) {
+		const plan = NodeBenchmarkPlanSchema.parse(planInput);
+		const online = this.deps.isNodeOnline(plan.nodeId);
+		const knownDeviceKeys = online ? await this.deps.listDeviceKeys(plan.nodeId) : [];
+		const { moving, staying } = classifyCamerasForBenchmark(plan.nodeId, await this.deps.cameraFacts());
+		const headroom = await this.deps.headroom(plan.nodeId);
+		const refusals = nodeBenchmarkRefusals({
+			plan,
+			activeRunNodeId: this.active?.run.nodeId ?? this.modeNodeIdValue,
+			online,
+			knownDeviceKeys,
+			sessionsNow: headroom.sessionsNow,
+			otherNodesCapacitySessions: headroom.otherNodesCapacitySessions
+		});
+		return {
+			nodeId: plan.nodeId,
+			online,
+			moving,
+			staying,
+			estimatedDurationMs: estimateNodeBenchmarkDurationMs(plan),
+			budgetMs: plan.budgetMinutes * 6e4,
+			phases: plan.phases,
+			steps: plan.steps,
+			devices: plan.devices,
+			headroom,
+			refusals,
+			canStart: refusals.length === 0
+		};
+	}
+	/** Start a run, or say why not (the preflight with its refusals). */
+	async start(planInput) {
+		const preflight = await this.preflight(planInput);
+		if (!preflight.canStart || this.active !== null || this.modeNodeIdValue !== null) return {
+			kind: "refused",
+			preflight: preflight.canStart ? {
+				...preflight,
+				canStart: false,
+				refusals: [{
+					kind: "benchmark-active",
+					detail: "Another benchmark started first — one node at a time.",
+					overridable: false
+				}]
+			} : preflight
+		};
+		const plan = NodeBenchmarkPlanSchema.parse(planInput);
+		const startedAtMs = this.now();
+		const manifest = {
+			runId: this.deps.newRunId?.() ?? `nb-${startedAtMs.toString(36)}`,
+			nodeId: plan.nodeId,
+			startedAtMs,
+			deadlineAtMs: startedAtMs + plan.budgetMinutes * 6e4,
+			plan,
+			moved: preflight.moving.map((c) => c.deviceId),
+			staying: preflight.staying.map((c) => c.deviceId)
+		};
+		const run = toRun(manifest);
+		this.active = {
+			run,
+			abortRequested: null
+		};
+		try {
+			await this.deps.persistence.writeManifest(manifest);
+		} catch (err) {
+			this.active = null;
+			throw new Error(`node benchmark: could not persist the restore manifest — nothing changed (${errMsg$2(err)})`, { cause: err });
+		}
+		this.setMode(plan.nodeId);
+		this.deps.logger.info("node benchmark started", { meta: {
+			runId: run.runId,
+			nodeId: run.nodeId,
+			moving: manifest.moved.length,
+			staying: manifest.staying.length,
+			deadlineAtMs: manifest.deadlineAtMs
+		} });
+		this.execute(manifest);
+		return {
+			kind: "started",
+			runId: run.runId
+		};
+	}
+	/** Ask the active run to stop; the restore follows. */
+	abort(runId) {
+		if (this.active === null || this.active.run.runId !== runId) return { aborted: false };
+		this.active.abortRequested ??= "operator-abort";
+		this.deps.logger.info("node benchmark abort requested", { meta: { runId } });
+		return { aborted: true };
+	}
+	update(patch) {
+		if (this.active === null) return;
+		this.active = {
+			...this.active,
+			run: {
+				...this.active.run,
+				...patch
+			}
+		};
+	}
+	stopReason(manifest) {
+		if (this.active?.abortRequested) return this.active.abortRequested;
+		if (this.now() >= manifest.deadlineAtMs) return "deadline";
+		if (!this.deps.isNodeOnline(manifest.nodeId)) return "node-lost";
+		return null;
+	}
+	async drainPhase(manifest) {
+		this.update({ state: "draining" });
+		const moved = new Set(manifest.moved);
+		if (moved.size > 0) await this.deps.drain(moved);
+		const timeout = this.deps.drainTimeoutMs ?? NODE_BENCHMARK_DEFAULTS.drainTimeoutSec * 1e3;
+		const until = this.now() + timeout;
+		const staying = new Set(manifest.staying);
+		for (;;) {
+			const stop = this.stopReason(manifest);
+			if (stop !== null) return stop;
+			const left = (await this.deps.camerasOnNode(manifest.nodeId)).filter((id) => !staying.has(id));
+			if (left.length === 0) return null;
+			if (this.now() >= until) {
+				this.deps.logger.warn("node benchmark: drain timed out — cameras still on the node", { meta: {
+					runId: manifest.runId,
+					nodeId: manifest.nodeId,
+					left
+				} });
+				return "drain-timeout";
+			}
+			await this.deps.drain(new Set(left));
+			await this.sleep(this.deps.pollIntervalMs ?? DEFAULT_POLL_MS);
+		}
+	}
+	async measurePhase(manifest) {
+		this.update({ state: "measuring" });
+		const { plan } = manifest;
+		await this.deps.runner.start(manifest.nodeId, {
+			runId: manifest.runId,
+			devices: plan.devices,
+			phases: plan.phases,
+			steps: plan.steps,
+			fpsPerStream: plan.fpsPerStream,
+			deadlineAtMs: manifest.deadlineAtMs,
+			keepDownloadedModels: plan.keepDownloadedModels
+		});
+		let last = null;
+		let unknown = 0;
+		const lostAfter = this.deps.runnerLostAfter ?? 3;
+		for (;;) {
+			await this.sleep(this.deps.pollIntervalMs ?? DEFAULT_POLL_MS);
+			let status = null;
+			try {
+				status = await this.deps.runner.status(manifest.nodeId, manifest.runId);
+			} catch (err) {
+				this.deps.logger.debug("node benchmark: runner status read failed", { meta: {
+					runId: manifest.runId,
+					error: errMsg$2(err)
+				} });
+			}
+			if (status === null) {
+				unknown += 1;
+				if (!this.deps.isNodeOnline(manifest.nodeId)) return {
+					reason: "node-lost",
+					status: last
+				};
+				if (unknown >= lostAfter) return {
+					reason: "runner-lost",
+					status: last
+				};
+			} else {
+				unknown = 0;
+				last = status;
+				this.update({
+					progress: status.progress,
+					contaminated: this.active?.run.contaminated === true || status.activeCameraIds.length > 0
+				});
+				if (status.state === "done") return {
+					reason: "completed",
+					status
+				};
+				if (status.state === "failed") return {
+					reason: "failed",
+					status
+				};
+				if (status.state === "aborted") return {
+					reason: this.active?.abortRequested ?? "deadline",
+					status
+				};
+			}
+			const stop = this.stopReason(manifest);
+			if (stop !== null) {
+				await this.deps.runner.abort(manifest.nodeId, manifest.runId).catch(() => void 0);
+				return {
+					reason: stop,
+					status: await this.deps.runner.status(manifest.nodeId, manifest.runId).catch(() => null) ?? last
+				};
+			}
+		}
+	}
+	async execute(manifest) {
+		let reason = "failed";
+		let status = null;
+		let error = null;
+		try {
+			const drained = await this.drainPhase(manifest);
+			if (drained !== null) reason = drained;
+			else {
+				const measured = await this.measurePhase(manifest);
+				reason = measured.reason;
+				status = measured.status;
+				if (reason === "failed") error = status?.error ?? "the runner failed";
+			}
+		} catch (err) {
+			reason = this.active?.abortRequested ?? "failed";
+			error = errMsg$2(err);
+			this.deps.logger.warn("node benchmark failed", { meta: {
+				runId: manifest.runId,
+				error
+			} });
+			await this.deps.runner.abort(manifest.nodeId, manifest.runId).catch(() => void 0);
+		} finally {
+			await this.restore(manifest, reason, status, error);
+		}
+	}
+	/**
+	* Leave benchmark mode and put the cluster back. Idempotent; every step is
+	* attempted whatever the previous one did.
+	*/
+	async restore(manifest, reason, status, error) {
+		this.update({ state: "restoring" });
+		this.setMode(null);
+		const pinnedBack = new Set(manifest.moved);
+		try {
+			if (pinnedBack.size > 0) await this.deps.restorePins(pinnedBack);
+		} catch (err) {
+			this.deps.logger.warn("node benchmark: re-placing the moved cameras failed — the reconcile retries", { meta: {
+				runId: manifest.runId,
+				error: errMsg$2(err)
+			} });
+		}
+		const finishedAtMs = this.now();
+		const base = this.active?.run ?? toRun(manifest);
+		const contaminated = base.contaminated || (status?.activeCameraIds.length ?? 0) > 0;
+		const { kept, unfired } = publishableCells(status?.cells ?? [], manifest.plan.steps);
+		const rows = kept.map((cell, i) => ({
+			id: `${manifest.runId}:${i}`,
+			runId: manifest.runId,
+			nodeId: manifest.nodeId,
+			cell,
+			fpsPerStream: manifest.plan.fpsPerStream,
+			fingerprint: status?.fingerprint ?? null,
+			clip: status?.clip ?? null,
+			contaminated,
+			stayingCameras: manifest.staying,
+			partialRun: reason !== "completed",
+			measuredAtMs: finishedAtMs
+		}));
+		const notes = [error, unfired.length > 0 ? `Not stored: the pipeline measurement's steps ${unfired.join(", ")} never produced a result on the clip.` : null].filter((n) => n !== null);
+		try {
+			if (rows.length > 0) await this.deps.persistence.writeResults(rows);
+		} catch (err) {
+			notes.push(`Results not stored: ${errMsg$2(err)}`);
+		}
+		const run = {
+			...base,
+			state: reason === "completed" ? "done" : reason === "failed" ? "failed" : "aborted",
+			finishedAtMs,
+			endReason: reason,
+			error: notes.length > 0 ? notes.join(" ") : null,
+			contaminated,
+			resultIds: rows.map((r) => r.id)
+		};
+		try {
+			await this.deps.persistence.recordRun(run);
+		} catch (err) {
+			this.deps.logger.warn("node benchmark: run record not stored", { meta: {
+				runId: run.runId,
+				error: errMsg$2(err)
+			} });
+		}
+		await this.deps.persistence.clearManifest().catch(() => void 0);
+		this.lastRun = run;
+		this.active = null;
+		this.deps.logger.info("node benchmark ended", { meta: {
+			runId: run.runId,
+			nodeId: run.nodeId,
+			endReason: reason,
+			results: rows.length,
+			contaminated,
+			error: run.error
+		} });
+		if (rows.length > 0) this.deps.onResultsWritten(manifest.nodeId);
+	}
+	/**
+	* Registry-driven recovery: a manifest with no live run means the run died
+	* with its process (hub restart) — restore now. A live run far past its
+	* deadline is forced out of the mode. Called at boot and on every tick.
+	*/
+	async reconcile(trigger) {
+		if (this.restoring !== null) return this.restoring;
+		const work = async () => {
+			if (this.active !== null) {
+				const { run } = this.active;
+				if (this.now() > run.deadlineAtMs + DEADLINE_GRACE_MS && this.modeNodeIdValue !== null) {
+					this.deps.logger.warn("node benchmark: past its deadline and still not restored — forcing benchmark mode off", { meta: {
+						runId: run.runId,
+						nodeId: run.nodeId
+					} });
+					this.active.abortRequested ??= "deadline";
+					this.setMode(null);
+				}
+				return;
+			}
+			if (this.modeNodeIdValue !== null) this.setMode(null);
+			const manifest = this.deps.persistence.readManifest();
+			if (manifest === null) return;
+			const known = this.deps.persistence.listRuns().find((r) => r.runId === manifest.runId);
+			if (known !== void 0 && known.finishedAtMs !== null) {
+				await this.deps.persistence.clearManifest().catch(() => void 0);
+				return;
+			}
+			this.deps.logger.warn("node benchmark: restore owed from an interrupted run", { meta: {
+				runId: manifest.runId,
+				nodeId: manifest.nodeId,
+				trigger
+			} });
+			await this.deps.runner.abort(manifest.nodeId, manifest.runId).catch(() => void 0);
+			this.active = {
+				run: toRun(manifest),
+				abortRequested: "hub-restart"
+			};
+			await this.restore(manifest, trigger === "boot" ? "hub-restart" : "runner-lost", null, null);
+		};
+		this.restoring = work().finally(() => {
+			this.restoring = null;
+		});
+		return this.restoring;
+	}
+};
+//#endregion
+//#region src/node-benchmark/node-benchmark-wiring.ts
+/**
+* Binds the node benchmark service (D791) to the orchestrator's real
+* controllers: the placement ledger and topology for the camera facts, a
+* SCOPED rebalance for the drain and the restore, the shares for headroom,
+* and the target node's runner through `nodePin` — whichever runner the
+* operator's request first reached, the measurement runs on the node chosen.
+*/
+function makeRunnerClient(ctx) {
+	return {
+		start: async (nodeId, input) => {
+			await ctx().api.pipelineRunner.startNodeBench.mutate(input, nodePin(nodeId));
+		},
+		status: async (nodeId, runId) => ctx().api.pipelineRunner.getNodeBenchStatus.query({ runId }, nodePin(nodeId)),
+		abort: async (nodeId, runId) => {
+			await ctx().api.pipelineRunner.abortNodeBench.mutate({ runId }, nodePin(nodeId));
+		}
+	};
+}
+/** Every camera the orchestrator places, as the preflight reads it (benchmark ignored). */
+async function collectCameraFacts(deps) {
+	const out = [];
+	for (const deviceId of deps.ledger.listConfigIds()) out.push({
+		deviceId,
+		placedNodeId: deps.ledger.getAssignment(deviceId)?.agentNodeId ?? deps.activeSessionNode(deviceId),
+		nodePin: await deps.readStoredPipelinePin(deviceId),
+		frameSourceNodes: deps.topology.detectionEligibleNodesIgnoringBenchmark(deviceId)
+	});
+	return out;
+}
+function createNodeBenchmarkService(deps) {
+	const logger = deps.ctx().logger;
+	return new NodeBenchmarkService({
+		logger,
+		persistence: deps.persistence,
+		runner: makeRunnerClient(deps.ctx),
+		isNodeOnline: (nodeId) => deps.topology.collectRunnerNodeIds().includes(nodeId),
+		listDeviceKeys: deps.listDeviceKeys,
+		cameraFacts: () => collectCameraFacts(deps),
+		headroom: async (nodeId) => {
+			let other = null;
+			try {
+				other = (await deps.suggestShares()).nodes.filter((n) => n.nodeId !== nodeId && n.skippedReason === null).reduce((sum, n) => sum + n.capacitySessions, 0);
+			} catch (err) {
+				logger.debug("node benchmark: capacity read failed — headroom unknown", { meta: { error: errMsg$2(err) } });
+			}
+			return {
+				sessionsNow: deps.sessionsNow(),
+				otherNodesCapacitySessions: other
+			};
+		},
+		drain: async (deviceIds) => {
+			const result = await deps.rebalance({
+				minImprovement: 0,
+				onlyDeviceIds: deviceIds
+			});
+			logger.info("node benchmark: drain pass", { meta: {
+				migrated: result.migrated,
+				skipped: result.skipped.length
+			} });
+		},
+		camerasOnNode: async (nodeId) => deps.ledger.listAssignments().filter((a) => a.agentNodeId === nodeId).map((a) => a.deviceId).concat(deps.ledger.listConfigIds().filter((id) => deps.ledger.getAssignment(id) === null && deps.activeSessionNode(id) === nodeId)),
+		restorePins: async (deviceIds) => {
+			const result = await deps.rebalance({
+				minImprovement: 0,
+				onlyDeviceIds: deviceIds
+			});
+			logger.info("node benchmark: cameras re-placed after the run", { meta: {
+				migrated: result.migrated,
+				skipped: result.skipped.length
+			} });
+		},
+		onResultsWritten: deps.onResultsWritten,
+		...deps.pollIntervalMs !== void 0 ? { pollIntervalMs: deps.pollIntervalMs } : {}
+	});
+}
+//#endregion
+//#region src/node-benchmark/node-benchmark-reads.ts
+/**
+* Read paths of the node benchmark (D791): the plan editor's candidates and
+* the results with their standing today. Pure over injected reads.
+*/
+var DETECTOR_STEP_ID$1 = "object-detection";
+/** The family Auto tune picks from (D745) — the suggestions follow it. */
+var SUGGESTED_FAMILY = "yolov9";
+var MAX_SUGGESTED = 3;
+function detectorFormats(catalog) {
+	const out = /* @__PURE__ */ new Map();
+	for (const slot of catalog?.slots ?? []) for (const addon of slot.addons) {
+		if (addon.id !== DETECTOR_STEP_ID$1) continue;
+		for (const model of addon.models) {
+			if (model.legacy === true) continue;
+			out.set(model.id, MODEL_FORMATS.filter((f) => f in model.formats));
+		}
+	}
+	return out;
+}
+/** Candidates per device: Auto tune's pick first, then the family by person recall. */
+async function readNodeBenchmarkCandidates(deps) {
+	const devices = await deps.readDevices(deps.nodeId);
+	const catalog = await deps.readCatalog(deps.nodeId).catch(() => null);
+	let picks = {};
+	try {
+		picks = await deps.autoTunePicks(deps.nodeId);
+	} catch (err) {
+		deps.logger.debug("node benchmark candidates: Auto tune pick unavailable", { meta: {
+			nodeId: deps.nodeId,
+			error: errMsg$2(err)
+		} });
+	}
+	const formats = detectorFormats(catalog);
+	const family = Object.keys(DETECTOR_ACCURACY).filter((id) => id.startsWith(SUGGESTED_FAMILY)).toSorted((a, b) => (DETECTOR_ACCURACY[b]?.personRecall ?? 0) - (DETECTOR_ACCURACY[a]?.personRecall ?? 0) || a.localeCompare(b));
+	return {
+		nodeId: deps.nodeId,
+		reachable: devices.reachable,
+		devices: devices.devices.map((d) => {
+			const runs = (id) => (formats.get(id) ?? []).includes(d.format);
+			const all = [...formats.keys()].filter(runs).toSorted();
+			const pick = picks[d.key];
+			const ordered = [...pick !== void 0 && runs(pick) ? [pick] : [], ...family.filter((id) => runs(id) && id !== pick)];
+			return {
+				deviceKey: d.key,
+				enabled: d.enabled,
+				available: d.available,
+				suggested: ordered.slice(0, MAX_SUGGESTED),
+				all,
+				currentModelId: d.steps?.[DETECTOR_STEP_ID$1]?.modelId ?? d.defaultModelId ?? null
+			};
+		}),
+		steps: catalog === null ? [] : listBenchDetailSteps(catalog)
+	};
+}
+/** Results filtered, newest first, each with its standing today. */
+function listNodeBenchmarkResultViews(rows, input, ctx) {
+	const standings = resultStandings(rows, ctx);
+	return rows.filter((r) => input.nodeId === void 0 || r.nodeId === input.nodeId).filter((r) => input.deviceKey === void 0 || r.cell.deviceKey === input.deviceKey).toSorted((a, b) => b.measuredAtMs - a.measuredAtMs).map((r) => ({
+		...r,
+		standing: standings.get(r.id)?.standing ?? "stale",
+		staleWhy: standings.get(r.id)?.staleWhy ?? null
+	}));
+}
+//#endregion
 //#region src/cluster-model-choice.ts
 /**
 * The owner's answer to "which model did the operator choose for this
@@ -58764,258 +61937,6 @@ function buildRunnerConfig(base, overrides) {
 		preRollInferenceFrames: config.preRollInferenceFrames
 	};
 }
-//#endregion
-//#region src/durable/durable-ledger.ts
-/** Default reseed cap — every current consumer's row set is installation-bounded. */
-var DEFAULT_LOAD_LIMIT = 1e5;
-var DurableLedger = class DurableLedger {
-	mirror = /* @__PURE__ */ new Map();
-	/** Whether ANY load has read the store successfully — see {@link hasAnswered}. */
-	answered = false;
-	spec;
-	store;
-	logger;
-	constructor(deps) {
-		this.spec = deps.spec;
-		this.store = deps.store;
-		this.logger = deps.logger;
-	}
-	/**
-	* Register the collection. MUST run at boot, before any read or write: the
-	* SQLite backend answers 412 for an undeclared collection and takes the whole
-	* runner down with it (the addon-ai boot-crash lesson).
-	*/
-	static declare(store, spec) {
-		return store.declareCollection.mutate({
-			collection: spec.collection,
-			columns: [...spec.columns],
-			...spec.indexes !== void 0 ? { indexes: [...spec.indexes] } : {}
-		});
-	}
-	declare() {
-		return DurableLedger.declare(this.store, this.spec);
-	}
-	/** The collection this ledger owns — for the caller's own log lines. */
-	get collection() {
-		return this.spec.collection;
-	}
-	/**
-	* Boot reseed. Replaces the mirror with what the store holds and returns the
-	* rows, so a caller that must hydrate something else (a watcher, a registry)
-	* gets them without a second read.
-	*
-	* **A failure returns what is already mirrored** rather than clearing it —
-	* see contract rule 2. The count is worth logging out loud at the call site:
-	* "loaded 0" after a container recreate is the one line that explains a
-	* silent flood.
-	*/
-	async load() {
-		try {
-			const records = await this.store.query.query({
-				collection: this.spec.collection,
-				filter: { limit: this.spec.loadLimit ?? DEFAULT_LOAD_LIMIT }
-			});
-			const next = /* @__PURE__ */ new Map();
-			let skipped = 0;
-			for (const record of records) {
-				const row = this.spec.fromRecord(record.id, record.data);
-				if (row === null) {
-					skipped += 1;
-					continue;
-				}
-				next.set(this.spec.keyOf(row), row);
-			}
-			this.mirror.clear();
-			for (const [key, row] of next) this.mirror.set(key, row);
-			this.answered = true;
-			if (skipped > 0) this.logger.warn("durable rows skipped as malformed — they gate NOTHING", { meta: {
-				collection: this.spec.collection,
-				skipped
-			} });
-			return [...this.mirror.values()];
-		} catch (err) {
-			this.logger.warn("durable load failed — keeping the state already in memory", { meta: {
-				collection: this.spec.collection,
-				error: String(err),
-				held: this.mirror.size
-			} });
-			return [...this.mirror.values()];
-		}
-	}
-	/**
-	* Whether the mirror is an ANSWER from the store: true once any load has
-	* succeeded, and never false again (a later failed load keeps that answer).
-	* Before it, an empty mirror is "not read yet", never "the store is empty" —
-	* {@link load} swallows its failure, so a caller that must tell the two apart
-	* asks here (D642 review I1).
-	*/
-	hasAnswered() {
-		return this.answered;
-	}
-	/** Every mirrored row, insertion-ordered. */
-	snapshot() {
-		return [...this.mirror.values()];
-	}
-	/** The row currently held for a key, if any. Pure RAM — never I/O. */
-	get(key) {
-		return this.mirror.get(key);
-	}
-	has(key) {
-		return this.mirror.has(key);
-	}
-	get size() {
-		return this.mirror.size;
-	}
-	/**
-	* Judge ONE observation against what the ledger already accepted, and advance
-	* it.
-	*
-	* Synchronous on purpose: the verdict is a function of the in-RAM mirror
-	* alone, so a decision can never be gated on an I/O that might fail (D49).
-	* The durable write is kicked off behind it and its failure changes no
-	* verdict.
-	*
-	* `no-flip` leaves the held row UNTOUCHED — including any timestamp it
-	* carries, which therefore means "when this key last CHANGED", not "when it
-	* last spoke". That is the timestamp anyone reading the table wants.
-	*/
-	observe(row) {
-		const equalFact = this.spec.equalFact;
-		if (equalFact === void 0) throw new Error(`DurableLedger(${this.spec.collection}): observe() requires the spec to declare equalFact`);
-		const key = this.spec.keyOf(row);
-		const held = this.mirror.get(key);
-		if (held !== void 0 && equalFact(held, row)) return "no-flip";
-		this.mirror.set(key, row);
-		this.persist(row);
-		return held === void 0 ? "seeded" : "flip";
-	}
-	/**
-	* Upsert a row without a verdict — the write path for a ledger whose owner
-	* has already decided the value changed.
-	*
-	* The order of the mirror advance and the durable write is the spec's
-	* {@link DurableWriteMode}, not the call site's: two call sites that
-	* disagreed about it would be two different durability guarantees on one
-	* collection.
-	*/
-	async put(row) {
-		const key = this.spec.keyOf(row);
-		if (this.spec.writeMode === "write-behind") {
-			this.mirror.set(key, row);
-			await this.persist(row);
-			return;
-		}
-		await this.store.set.mutate({
-			collection: this.spec.collection,
-			key,
-			value: this.spec.toValue(row)
-		});
-		this.mirror.set(key, row);
-	}
-	/**
-	* Advance the mirror WITHOUT persisting, for an owner that deliberately
-	* coalesces its writes.
-	*
-	* The stationary registry is the reason this exists: a parked car is
-	* re-confirmed on every processed frame (5–30 Hz), and persisting each
-	* confirmation would offer thousands of commits a day to the checkpoint
-	* lottery (D96) to maintain a handful of rows. It stages the advance and
-	* flushes on its 5-minute sweep — 288 writes a day instead of ~10⁶.
-	*
-	* **The cost is stated, not hidden**: a staged value that is never flushed
-	* is lost on a crash. An owner may only stage a field whose staleness its
-	* own TTL absorbs. Anything that GATES work must go through {@link put} or
-	* {@link observe}.
-	*/
-	stage(row) {
-		this.mirror.set(this.spec.keyOf(row), row);
-	}
-	/**
-	* Drop a key from the MIRROR only — the durable row survives.
-	*
-	* What a scope-unbind needs: this process stops holding the value, and a
-	* rebind reloads it from the store. Deliberately distinct from
-	* {@link forget}, which deletes; conflating the two is how an unbind turns
-	* into a wipe.
-	*/
-	evict(key) {
-		this.mirror.delete(key);
-	}
-	/**
-	* Drop one key, mirror and row. Best-effort on the durable half: a failed
-	* delete leaves a row that the next load will re-mirror, which is a stale
-	* value rather than a lost one.
-	*/
-	async forget(key) {
-		this.mirror.delete(key);
-		try {
-			await this.store.delete.mutate({
-				collection: this.spec.collection,
-				key
-			});
-		} catch (err) {
-			this.logger.debug("durable delete failed", { meta: {
-				collection: this.spec.collection,
-				key,
-				error: String(err)
-			} });
-		}
-	}
-	/**
-	* Drop every mirrored key NOT in `activeKeys`. Returns how many rows went.
-	*
-	* **The caller must hold an AUTHORITATIVE active set.** A prune driven by a
-	* fallible read is work destroyed on an error (D49/D130) — that is why this
-	* is a method a feature opts into rather than a policy the primitive runs.
-	* Best-effort per row: a failed delete keeps the key (retried next prune)
-	* rather than aborting the sweep.
-	*/
-	async pruneExcept(activeKeys) {
-		let pruned = 0;
-		for (const key of [...this.mirror.keys()]) {
-			if (activeKeys.has(key)) continue;
-			try {
-				await this.store.delete.mutate({
-					collection: this.spec.collection,
-					key
-				});
-				this.mirror.delete(key);
-				pruned += 1;
-			} catch (err) {
-				this.logger.debug("durable prune delete failed", { meta: {
-					collection: this.spec.collection,
-					key,
-					error: String(err)
-				} });
-			}
-		}
-		return pruned;
-	}
-	/**
-	* Write-behind durable upsert. Best-effort and logged, never thrown at the
-	* decision path: the mirror already holds the truth for this process, and the
-	* worst a lost write can do is one silent re-seed after the next restart.
-	*/
-	async persist(row) {
-		const deviceId = this.spec.deviceIdOf?.(row);
-		try {
-			await this.store.set.mutate({
-				collection: this.spec.collection,
-				key: this.spec.keyOf(row),
-				value: this.spec.toValue(row)
-			});
-		} catch (err) {
-			this.logger.warn("durable persist failed — this key may re-seed on boot", {
-				...deviceId !== void 0 ? { tags: { deviceId } } : {},
-				meta: {
-					collection: this.spec.collection,
-					key: this.spec.keyOf(row),
-					error: String(err)
-				}
-			});
-		}
-	}
-};
 var DEVICE_FEATURES_SPEC = {
 	collection: "pipeline-orchestrator:device-features",
 	columns: [
@@ -61372,16 +64293,20 @@ var PlacementService = class {
 		let migrated = 0;
 		const skipped = [];
 		for (const [deviceId, config] of this.deps.ledger.configEntries()) {
+			if (opts?.onlyDeviceIds !== void 0 && !opts.onlyDeviceIds.has(deviceId)) continue;
 			if (this.deps.isIdleSessionCamera(deviceId)) continue;
 			const current = this.deps.ledger.getAssignment(deviceId);
-			if (current?.pinned) continue;
+			const eligibleNodes = this.deps.topology.detectionEligibleNodes(deviceId);
+			const benchNode = this.deps.benchmarkNodeId?.() ?? null;
+			const pinnedOffBenchNode = current !== null && current.agentNodeId === benchNode && !eligibleNodes.includes(current.agentNodeId);
+			if (current?.pinned && !pinnedOffBenchNode) continue;
 			const preferredAgent = await this.deps.readPipelinePin(deviceId);
 			const decision = balance({
 				nodes: talliedLoads(),
 				preferredAgent,
 				nodeCaps,
 				weights: nodeWeights,
-				eligibleNodes: this.deps.topology.detectionEligibleNodes(deviceId)
+				eligibleNodes
 			});
 			if (!decision) continue;
 			if (decision.kind === "pending") {
@@ -61389,7 +64314,7 @@ var PlacementService = class {
 				continue;
 			}
 			if (current && current.agentNodeId === decision.agentNodeId) continue;
-			if (current && minImprovement > 0) {
+			if (current && minImprovement > 0 && eligibleNodes.includes(current.agentNodeId)) {
 				const tallied = talliedLoads();
 				const currentLoad = tallied.find((l) => l.nodeId === current.agentNodeId);
 				const targetLoad = tallied.find((l) => l.nodeId === decision.agentNodeId);
@@ -63313,7 +66238,17 @@ var NodeTopologyService = class {
 			remoteSourcingNodes: this._remoteSourcingNodes
 		});
 	}
+	/**
+	* The nodes that may run this camera's detection. While the cluster is in
+	* benchmark mode for a node (D791), that node is left out — unless it is
+	* the camera's only frame source, in which case the camera stays (never
+	* blind) and the run is flagged contaminated.
+	*/
 	detectionEligibleNodes(deviceId) {
+		return eligibleUnderBenchmark(this.detectionEligibleNodesIgnoringBenchmark(deviceId), this.deps.benchmarkNodeId?.() ?? null);
+	}
+	/** {@link detectionEligibleNodes} as if no benchmark ran — the camera's real candidates. */
+	detectionEligibleNodesIgnoringBenchmark(deviceId) {
 		const frameSource = this.frameSourceNodes(deviceId);
 		return this._enabledNodes.filter((nodeId) => frameSource.includes(nodeId));
 	}
@@ -68882,7 +71817,8 @@ async function buildOrchestratorControllers(deps) {
 		eventBus: deps.ctx().eventBus,
 		logger: deps.ctx().logger,
 		localNodeId: () => localNodeId,
-		addonId: () => deps.ctx().id
+		addonId: () => deps.ctx().id,
+		benchmarkNodeId: () => deps.benchmarkNodeId?.() ?? null
 	});
 	deps.setTopology(topology);
 	let motionSliceGate = null;
@@ -69054,6 +71990,7 @@ async function buildOrchestratorControllers(deps) {
 		return selection.kind === "selected" ? selection.camStreamId : null;
 	};
 	const placement = new PlacementService({
+		benchmarkNodeId: () => deps.benchmarkNodeId?.() ?? null,
 		ctx: () => deps.ctx(),
 		ctxIfReady: () => deps.ctxIfReady(),
 		ledger,
@@ -70289,6 +73226,9 @@ var pipelineOrchestratorWidgets = [{
 *    is gone the node's recommended model runs.
 *  - never: `stepToggles`, devices' enablement, pins of
 *    embedding steps (cluster-scoped, changing one forces a re-index).
+*  - never anything on a KEPT (node, device) — a custom-registry detector pin,
+*    or an accelerator of its group — and never a camera's detector override
+*    that pins a custom model (a canary), with its thresholds (D786).
 */
 /** The root detector step. */
 var DETECTOR_STEP_ID = "object-detection";
@@ -70296,6 +73236,17 @@ var DETECTOR_STEP_ID = "object-detection";
 function isModelPinKept(stepId) {
 	return stepId.endsWith("-embedding");
 }
+/** The `keptDevices` key of one (node, device). */
+function keptDeviceKey(nodeId, deviceKey) {
+	return `${nodeId}|${deviceKey}`;
+}
+function isKeptDevice(input, nodeId, deviceKey) {
+	return input.keptDevices?.has(keptDeviceKey(nodeId, deviceKey)) === true;
+}
+/** A root-detector entry that pins a custom model — a canary, kept whole. */
+function isCustomDetectorPin(input, stepId, modelId) {
+	return stepId === "object-detection" && modelId !== void 0 && input.isCustomModel?.(modelId) === true;
+}
 function boundKeysFor(input, stepId) {
 	return input.boundKeysByStep[stepId] ?? [];
 }
@@ -70355,6 +73306,10 @@ function applyNodeAutoTune(blob, input) {
 		const nextDevices = {};
 		for (const deviceKey of deviceKeys) {
 			const device = stored[deviceKey];
+			if (isKeptDevice(input, nodeId, deviceKey)) {
+				if (device !== void 0) nextDevices[deviceKey] = device;
+				continue;
+			}
 			const target = targets.get(deviceKey);
 			const steps = { ...device?.steps };
 			if (target !== void 0 && steps["object-detection"] === void 0) steps[DETECTOR_STEP_ID] = {};
@@ -70399,6 +73354,7 @@ function applyNodeAutoTune(blob, input) {
 /** Scrub a wholesale snapshot tree; collects one clear per changed step. */
 function scrubTree(steps, input, onClear) {
 	return steps.map((step) => {
+		if (isCustomDetectorPin(input, step.addonId, step.modelId)) return step;
 		const children = step.children ? scrubTree(step.children, input, onClear) : void 0;
 		const inScope = step.addonId === "object-detection" || pinInScope(step.addonId);
 		const { kept, removed } = stripBound(step.settings, boundKeysFor(input, step.addonId));
@@ -70432,8 +73388,16 @@ function applyCameraAutoTune(blob, input) {
 				}
 				const nextByDevice = {};
 				for (const [deviceKey, byStep] of Object.entries(byDevice)) {
+					if (isKeptDevice(input, nodeId, deviceKey)) {
+						nextByDevice[deviceKey] = byStep;
+						continue;
+					}
 					const nextByStep = {};
 					for (const [stepId, patch] of Object.entries(byStep)) {
+						if (isCustomDetectorPin(input, stepId, patch.modelId)) {
+							nextByStep[stepId] = patch;
+							continue;
+						}
 						const inScope = stepId === "object-detection" || pinInScope(stepId);
 						const { kept, removed } = stripBound(patch.settings, boundKeysFor(input, stepId));
 						const dropPin = inScope && patch.modelId !== void 0;
@@ -70522,6 +73486,13 @@ function applyCameraAutoTune(blob, input) {
 *  5. re-dispatch the cameras of every touched node.
 * A failure after phase 2 leaves "overrides cleared, previous node model",
 * which is a valid configuration (the defaults run); re-running converges.
+*
+* Custom models are never overwritten (D786): a (node, device) whose root
+* detector is pinned to a custom-registry model is KEPT by the recommender, and
+* the diff writes nothing there; a camera override pinning one (a canary) is
+* kept with its thresholds, and its per-camera detector thresholds are not
+* cleared. The plan warns about each. A registry that does not answer keeps
+* every pin outside the measured catalog — unknown is never "not custom".
 */
 function minSessionsOf(input) {
 	return input.minSessionsPerDevice ?? 2;
@@ -70554,6 +73525,46 @@ function boundKeysOf(catalogs) {
 	}
 	return Object.fromEntries([...byStep].map(([step, set]) => [step, [...set].toSorted()]));
 }
+/** `node|deviceKey → custom model` of every stored root-detector pin to a custom model. */
+function storedCustomPins(agent, isCustomModel) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [nodeId, entry] of Object.entries(agent)) for (const [deviceKey, device] of Object.entries(entry?.inferenceDevices ?? {})) {
+		const modelId = device?.steps?.[DETECTOR_STEP_ID]?.modelId;
+		if (modelId !== void 0 && isCustomModel(modelId)) out.set(keptDeviceKey(nodeId, deviceKey), modelId);
+	}
+	return out;
+}
+/** Every camera override that pins a custom root detector (a canary). */
+function cameraCustomPins(cameras, isCustomModel) {
+	const out = [];
+	for (const [key, camera] of Object.entries(cameras)) {
+		const deviceId = Number(key);
+		for (const [nodeId, byDevice] of Object.entries(camera?.stepOverridesByDevice ?? {})) for (const [deviceKey, byStep] of Object.entries(byDevice)) {
+			const modelId = byStep[DETECTOR_STEP_ID]?.modelId;
+			if (modelId !== void 0 && isCustomModel(modelId)) out.push({
+				deviceId,
+				nodeId,
+				deviceKey,
+				modelId
+			});
+		}
+		for (const [nodeId, snapshot] of Object.entries(camera?.pipelineByAgent ?? {})) {
+			const walk = (steps) => {
+				for (const step of steps) {
+					if (step.addonId === "object-detection" && step.modelId !== void 0 && isCustomModel(step.modelId)) out.push({
+						deviceId,
+						nodeId,
+						deviceKey: null,
+						modelId: step.modelId
+					});
+					if (step.children) walk(step.children);
+				}
+			};
+			walk(snapshot.steps);
+		}
+	}
+	return out.toSorted((a, b) => a.deviceId - b.deviceId || a.nodeId.localeCompare(b.nodeId));
+}
 var AutoTuneService = class {
 	deps;
 	applying = false;
@@ -70591,8 +73602,13 @@ var AutoTuneService = class {
 			minSessionsPerDevice
 		});
 	}
-	/** Gather every node and recommend. Nothing but hardware, catalog and the sizing goes in. */
-	async recommend(headroom, minSessionsPerDevice) {
+	/**
+	* Gather every node and recommend. Nothing but hardware, catalog, the sizing
+	* and — for a plan — the custom pins goes in. `customPins` maps
+	* `node|deviceKey` to the custom model pinned there; shares pass none
+	* (capacity is a property of the hardware, not of what it runs).
+	*/
+	async recommend(headroom, minSessionsPerDevice, customPins = /* @__PURE__ */ new Map()) {
 		const nodeIds = [...new Set(["hub", ...this.deps.runnerNodeIds()])].toSorted();
 		const gathered = await Promise.all(nodeIds.map(async (nodeId) => {
 			const [devices, hardware, catalog] = await Promise.all([
@@ -70611,30 +73627,49 @@ var AutoTuneService = class {
 			nodeId: g.nodeId,
 			reachable: g.devices.reachable && g.catalog !== null,
 			hardware: g.hardware,
-			devices: g.devices.devices.map((d) => ({
-				key: d.key,
-				format: d.format,
-				enabled: d.enabled,
-				available: d.available
-			})),
+			devices: g.devices.devices.map((d) => {
+				const pinned = customPins.get(keptDeviceKey(g.nodeId, d.key));
+				return {
+					key: d.key,
+					format: d.format,
+					enabled: d.enabled,
+					available: d.available,
+					...pinned !== void 0 ? { customPinModelId: pinned } : {}
+				};
+			}),
 			formatsByModel: formatsByModelOf(g.catalog)
 		}));
 		const observedFps = await this.deps.cameraFps();
 		const cameraFps = observedFps !== null && observedFps > 0 ? observedFps : 10;
+		let measured = /* @__PURE__ */ new Map();
+		try {
+			measured = await this.deps.measuredLatency?.(nodeIds) ?? /* @__PURE__ */ new Map();
+		} catch (err) {
+			this.deps.logger.warn("auto tune: node benchmark results unreadable — the table decides", { meta: { error: errMsg(err) } });
+		}
 		return {
 			gathered,
 			nodes,
-			recommendations: nodes.map((node) => recommendNode({
-				node,
-				headroom,
-				minSessionsPerDevice,
-				cameraFps
-			})),
+			recommendations: nodes.map((node) => {
+				const own = measured.get(node.nodeId);
+				return recommendNode({
+					node,
+					headroom,
+					minSessionsPerDevice,
+					cameraFps,
+					...own !== void 0 ? { measured: own } : {}
+				});
+			}),
 			cameraFps
 		};
 	}
 	async computePlan(headroom, minSessionsPerDevice) {
-		const { gathered, nodes, recommendations, cameraFps } = await this.recommend(headroom, minSessionsPerDevice);
+		const warnings = [];
+		const isCustomModel = await this.customModelPredicate(warnings);
+		const agentSettings = await this.deps.readAgentSettings();
+		const cameraSettings = await this.deps.readCameraSettings();
+		const customPins = storedCustomPins(agentSettings, isCustomModel);
+		const { gathered, nodes, recommendations, cameraFps } = await this.recommend(headroom, minSessionsPerDevice, customPins);
 		const touchedNodes = new Set(recommendations.filter((r) => !r.skipped).map((r) => r.nodeId));
 		const targets = /* @__PURE__ */ new Map();
 		const formats = /* @__PURE__ */ new Map();
@@ -70656,18 +73691,40 @@ var AutoTuneService = class {
 			targets.set(rec.nodeId, list);
 			formats.set(rec.nodeId, byKey);
 		}
+		const keptDevices = new Set(customPins.keys());
+		for (const rec of recommendations) for (const d of rec.devices) if (d.kept !== void 0) keptDevices.add(keptDeviceKey(rec.nodeId, d.deviceKey));
 		const diffInput = {
 			touchedNodes,
 			targets,
-			boundKeysByStep: boundKeysOf(gathered.map((g) => g.catalog))
+			boundKeysByStep: boundKeysOf(gathered.map((g) => g.catalog)),
+			keptDevices,
+			isCustomModel
 		};
-		const nodeChanges = applyNodeAutoTune(await this.deps.readAgentSettings(), diffInput).changes;
-		const cameraClears = applyCameraAutoTune(await this.deps.readCameraSettings(), diffInput).clears;
-		const warnings = [];
+		const nodeChanges = applyNodeAutoTune(agentSettings, diffInput).changes;
+		const cameraClears = applyCameraAutoTune(cameraSettings, diffInput).clears;
+		const canaries = cameraCustomPins(cameraSettings, isCustomModel);
+		for (const [key, modelId] of [...customPins].toSorted(([a], [b]) => a.localeCompare(b))) {
+			const [nodeId = "", deviceKey = ""] = key.split("|");
+			warnings.push({
+				kind: "custom-pin-kept",
+				nodeId,
+				deviceKey,
+				deviceId: null,
+				modelId
+			});
+		}
+		for (const c of canaries) warnings.push({
+			kind: "custom-pin-kept",
+			nodeId: c.nodeId,
+			deviceKey: c.deviceKey,
+			deviceId: c.deviceId,
+			modelId: c.modelId
+		});
+		const canaryCameras = new Set(canaries.map((c) => c.deviceId));
 		let detectorStoreClears = [];
 		if (touchedNodes.size > 0) try {
 			const answer = await this.deps.detectorStore({ dryRun: true });
-			detectorStoreClears = answer.entries.map((e) => ({
+			detectorStoreClears = answer.entries.filter((e) => !canaryCameras.has(e.deviceId)).map((e) => ({
 				deviceId: e.deviceId,
 				keys: [...e.keys]
 			}));
@@ -70701,7 +73758,11 @@ var AutoTuneService = class {
 					picks: recommendations.map((r) => ({
 						nodeId: r.nodeId,
 						skipped: r.skipped,
-						devices: r.devices.map((d) => [d.deviceKey, d.chosen?.modelId ?? null])
+						devices: r.devices.map((d) => [
+							d.deviceKey,
+							d.chosen?.modelId ?? null,
+							d.kept ?? null
+						])
 					})),
 					nodeChanges,
 					cameraClears,
@@ -70722,6 +73783,25 @@ var AutoTuneService = class {
 			formats
 		};
 	}
+	/**
+	* "Is this model custom?" from the registry. A registry that does not
+	* answer is NOT an empty registry: every pin outside the measured catalog
+	* is then treated as custom, and the plan says so.
+	*/
+	async customModelPredicate(warnings) {
+		try {
+			const ids = await this.deps.readCustomModelIds();
+			return (modelId) => ids.has(modelId);
+		} catch (err) {
+			const error = errMsg(err);
+			this.deps.logger.warn("auto tune: custom-model registry unreadable — every pin outside the measured catalog is kept", { meta: { error } });
+			warnings.push({
+				kind: "custom-registry-unreadable",
+				error
+			});
+			return (modelId) => !(modelId in DETECTOR_ACCURACY);
+		}
+	}
 	async apply(input) {
 		if (this.applying) return {
 			kind: "refused",
@@ -71340,6 +74420,12 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	readShareSource = () => DEFAULT_SHARE_SOURCE;
 	autoTuneService = null;
 	effectiveSharesService = null;
+	/** The node benchmark lifecycle (D791); null before init. */
+	nodeBenchmark = null;
+	nodeBenchmarkStore = null;
+	nodeBenchmarkTimer = null;
+	/** How often the active run's runner is polled (a test seam). */
+	nodeBenchmarkPollMs = 3e3;
 	/**
 	* Single owner of the shared placement state (`assignments`/`cameraConfigs`/
 	* `pendingReasons`/`dispatchingDevices`) — see `placement-ledger.ts` (S6
@@ -71617,6 +74703,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			rebalance: (opts) => this.rebalance(opts),
 			setCameraPipelineForAgent: (input) => this.setCameraPipelineForAgent(input),
 			maintenancePaused: () => this.storageMigrationLeaseId !== null,
+			benchmarkNodeId: () => this.nodeBenchmark?.modeNodeId() ?? null,
 			placementStats: this.placementStats,
 			setTopology: (topology) => {
 				this.topology = topology;
@@ -71666,6 +74753,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.autoRebalanceTimer = controllers.autoRebalanceTimer;
 		this.nodeStressLts = controllers.nodeStressLts;
 		this.nodeStressLtsTimer = controllers.nodeStressLtsTimer;
+		await this.initNodeBenchmark();
 		const widgetsProvider = { listWidgets: async () => pipelineOrchestratorWidgets };
 		this.clusterModelChoiceReady = true;
 		return {
@@ -71752,6 +74840,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			clearInterval(this.nodeStressLtsTimer);
 			this.nodeStressLtsTimer = null;
 		}
+		if (this.nodeBenchmarkTimer !== null) {
+			clearInterval(this.nodeBenchmarkTimer);
+			this.nodeBenchmarkTimer = null;
+		}
 		this.nodeStressLts = null;
 		this.unsubOrchestratorSubscriptions?.();
 		this.unsubOrchestratorSubscriptions = null;
@@ -71977,6 +75069,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* node id, or `null` when neither key holds a pin (auto-balance).
 	*/
 	async readPipelinePin(deviceId) {
+		return pinUnderBenchmark(await this.readStoredPipelinePin(deviceId), this.nodeBenchmark?.modeNodeId() ?? null, this.topology?.detectionEligibleNodesIgnoringBenchmark(deviceId) ?? []);
+	}
+	/** The stored node pin as written — see {@link readPipelinePin} for the placement view. */
+	async readStoredPipelinePin(deviceId) {
 		if (!this.ctx?.settings) return null;
 		try {
 			const settings = await this.ctx.settings.readDeviceStore(deviceId);
@@ -72740,7 +75836,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			rewriteAgentSettings: (transform) => store.rewriteAgentSettingsMap(transform),
 			rewriteCameraSettings: (transform) => store.rewriteCameraSettingsMap(transform),
 			cameraFps: async () => this.autoTuneCameraFps(),
-			measuredCapacity: NO_MEASURED_CAPACITY,
+			measuredCapacity: { readMeasuredCapacity: (nodeIds) => this.readMeasuredCapacity(nodeIds) },
+			measuredLatency: (nodeIds) => this.readMeasuredLatency(nodeIds),
 			detectorStore: async (input) => {
 				const api = this.ctx.api;
 				if (!api) throw new Error("ctx.api unavailable");
@@ -72759,6 +75856,12 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 					format
 				}, nodePin(nodeId));
 			},
+			readCustomModelIds: async () => {
+				const api = this.ctx.api;
+				if (!api) throw new Error("ctx.api unavailable");
+				const models = await api.customModelRegistry.listModels.query();
+				return new Set(models.map((m) => m.entry.id));
+			},
 			invalidateCatalog: () => store.invalidateCatalog(),
 			redispatch: (nodeId) => this.placement.redispatchCamerasOnAgent(nodeId),
 			now: () => Date.now()
@@ -72867,6 +75970,166 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			} });
 		});
 	}
+	/** The benchmark reconcile cadence — a restore owed is never older than this. */
+	static NODE_BENCHMARK_RECONCILE_MS = 3e4;
+	/** How long a node's answered pool tuning is reused for result standings. */
+	static CURRENT_POOL_TTL_MS = 6e4;
+	currentPoolCache = /* @__PURE__ */ new Map();
+	/**
+	* Build the benchmark lifecycle, then reconcile its manifest: a run that
+	* died with the previous process is restored NOW, before anything else
+	* can trust the cluster's placement. Never fails the boot.
+	*/
+	async initNodeBenchmark() {
+		const store = new NodeBenchmarkStore({
+			store: this.ctx.api.settingsStore,
+			logger: this.ctx.logger
+		});
+		try {
+			await NodeBenchmarkStore.declare(this.ctx.api.settingsStore);
+			await store.load();
+		} catch (err) {
+			this.ctx.logger.warn("node benchmark: store unavailable at boot — runs refused until it answers", { meta: { error: errMsg$2(err) } });
+		}
+		this.nodeBenchmarkStore = store;
+		this.nodeBenchmark = createNodeBenchmarkService({
+			ctx: () => this.ctx,
+			persistence: store,
+			ledger: this.ledger,
+			topology: this.topology,
+			rebalance: (opts) => this.placement.rebalance(opts),
+			activeSessionNode: (deviceId) => this.session.activeSessionNode(deviceId),
+			readStoredPipelinePin: (deviceId) => this.readStoredPipelinePin(deviceId),
+			listDeviceKeys: async (nodeId) => (await this.getNodeInferenceDevices({ nodeId })).devices.map((d) => d.key),
+			sessionsNow: () => this.placementStats.snapshot(6e4).sessionsNow,
+			suggestShares: () => this.autoTune().suggestShares({
+				headroom: AUTO_SHARE_HEADROOM,
+				source: "benchmark"
+			}),
+			pollIntervalMs: this.nodeBenchmarkPollMs,
+			onResultsWritten: (nodeId) => {
+				this.currentPoolCache.clear();
+				this.noteShareChange(`benchmark-results:${nodeId}`);
+			}
+		});
+		await this.nodeBenchmark.reconcile("boot").catch((err) => {
+			this.ctx.logger.warn("node benchmark: boot reconcile failed — retried on the next tick", { meta: { error: errMsg$2(err) } });
+		});
+		this.nodeBenchmarkTimer = setInterval(() => {
+			this.nodeBenchmark?.reconcile("tick").catch((err) => {
+				this.ctx.logger.debug("node benchmark: reconcile tick failed", { meta: { error: errMsg$2(err) } });
+			});
+		}, PipelineOrchestratorAddon.NODE_BENCHMARK_RECONCILE_MS);
+		this.nodeBenchmarkTimer.unref?.();
+	}
+	benchmarkService() {
+		if (this.nodeBenchmark === null) throw new Error("node benchmark: not initialised");
+		return this.nodeBenchmark;
+	}
+	async getNodeBenchmarkPreflight(input) {
+		return this.benchmarkService().preflight(input);
+	}
+	async startNodeBenchmark(input) {
+		return this.benchmarkService().start(input);
+	}
+	async getNodeBenchmarkStatus() {
+		return this.benchmarkService().status();
+	}
+	async abortNodeBenchmark(input) {
+		return this.benchmarkService().abort(input.runId);
+	}
+	async getNodeBenchmarkCandidates(input) {
+		return readNodeBenchmarkCandidates({
+			nodeId: input.nodeId,
+			readDevices: (nodeId) => this.getNodeInferenceDevices({ nodeId }),
+			readCatalog: (nodeId) => this.settingsStore.readCatalogForNode(nodeId),
+			autoTunePicks: async (nodeId) => {
+				const node = (await this.autoTune().plan({ headroom: AUTO_SHARE_HEADROOM })).nodes.find((n) => n.nodeId === nodeId);
+				const out = {};
+				for (const d of node?.devices ?? []) if (d.chosen !== null) out[d.deviceKey] = d.chosen.modelId;
+				return out;
+			},
+			logger: this.ctx.logger
+		});
+	}
+	async listNodeBenchmarkResults(input) {
+		const rows = this.nodeBenchmarkStore?.listResults() ?? [];
+		return listNodeBenchmarkResultViews(rows, input, {
+			nowMs: Date.now(),
+			currentPools: await this.readCurrentPools(rows)
+		});
+	}
+	async deleteNodeBenchmarkResult(input) {
+		const deleted = await this.nodeBenchmarkStore?.deleteResult(input.id) ?? false;
+		if (deleted) {
+			this.ctx.logger.info("node benchmark result deleted", { meta: { id: input.id } });
+			this.noteShareChange("benchmark-result-deleted");
+		}
+		return { deleted };
+	}
+	/**
+	* The pool each (node, device) of `rows` runs today, for the fingerprint
+	* check. Unanswered = unknown, which never makes a result stale.
+	*/
+	async readCurrentPools(rows) {
+		const out = {};
+		const api = this.ctx.api;
+		const pairs = new Set(rows.map((r) => `${r.nodeId}\u0000${r.cell.deviceKey}`));
+		const now = Date.now();
+		await Promise.all([...pairs].map(async (key) => {
+			const [nodeId = "", deviceKey = ""] = key.split("\0");
+			const hit = this.currentPoolCache.get(key);
+			let pool;
+			if (hit !== void 0 && now - hit.at < PipelineOrchestratorAddon.CURRENT_POOL_TTL_MS) pool = hit.pool;
+			else {
+				pool = null;
+				if (this.topology?.collectRunnerNodeIds().includes(nodeId)) try {
+					const t = await api.pipelineExecutor.getEffectiveTuning.query({ deviceKey }, nodePin(nodeId));
+					pool = {
+						runtime: t.runtime,
+						numWorkers: t.numWorkers,
+						concurrency: t.concurrency,
+						batchMode: t.batchMode
+					};
+				} catch {
+					pool = null;
+				}
+				this.currentPoolCache.set(key, {
+					at: now,
+					pool
+				});
+			}
+			if (pool !== null) out[nodeId] = {
+				...out[nodeId],
+				[deviceKey]: pool
+			};
+		}));
+		return out;
+	}
+	/** Each node's fresh detector measurements — what Auto tune lays over the table. */
+	async readMeasuredLatency(nodeIds) {
+		const rows = this.nodeBenchmarkStore?.listResults() ?? [];
+		const out = /* @__PURE__ */ new Map();
+		if (rows.length === 0) return out;
+		const ctx = {
+			nowMs: Date.now(),
+			currentPools: await this.readCurrentPools(rows)
+		};
+		for (const nodeId of nodeIds) {
+			const cells = measuredDetectorCells(rows, nodeId, ctx);
+			if (Object.keys(cells).length > 0) out.set(nodeId, cells);
+		}
+		return out;
+	}
+	/** The measured capacity the automatic shares read (D755 `NodeCapacitySource`). */
+	async readMeasuredCapacity(nodeIds) {
+		const rows = this.nodeBenchmarkStore?.listResults() ?? [];
+		if (rows.length === 0) return /* @__PURE__ */ new Map();
+		return measuredCapacityFromResults(rows, nodeIds, {
+			nowMs: Date.now(),
+			currentPools: await this.readCurrentPools(rows)
+		});
+	}
 	async getEffectiveShares() {
 		const service = this.effectiveShares();
 		const nodeIds = [...new Set(["hub", ...this.topology.collectRunnerNodeIds()])].toSorted();