@camstack/addon-pipeline 1.2.295 → 1.2.296

package/dist/{dist-CuxSNLKW.mjs → dist-CCd0Q3nr.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BaRu0bS5.mjs
+//#region ../types/dist/sleep-BXv0ZcRa.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6193,6 +6193,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -11299,6 +11333,43 @@ var FailureCounters = class {
 		this.counters.clear();
 	}
 };
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -11515,7 +11586,14 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -16236,6 +16314,13 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*/
+var LinkedDevicesSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+DeviceType.Camera;
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -16761,16 +16846,101 @@ var EmbeddingResultSchema = object({
 	embedding: array(number()),
 	inferenceMs: number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = _enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	crashes: number(),
+	windowMs: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	attempts: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
 var EmbeddingInfoSchema = object({
 	modelId: string(),
 	embeddingDim: number(),
-	ready: boolean()
-});
+	ready: boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+_enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
 method(object({
 	crop: _instanceof(Uint8Array),
 	width: number(),
 	height: number()
-}), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
+}), EmbeddingResultSchema, { auth: "admin" }), method(object({
+	text: string(),
+	modelId: string().min(1).optional()
+}), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" }), method(object({ modelId: string().min(1).optional() }), object({
+	cleared: array(string()),
+	nodeId: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `failure-contribution` — the capability an addon reports its OWN losses
 * through, per camera, with the denominator attached. It stores nothing.
@@ -20573,7 +20743,12 @@ var NcMediaPolicySchema = object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
@@ -21951,6 +22126,257 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
+*/
+/**
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
+*/
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+/**
+* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
+* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
+*/
+var CLUSTER_MODEL_SCOPED_STEPS = [{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}];
+/**
+* The settings key holding one step's cluster model choice.
+*
+* Step-qualified so the keys stay unique across the addon's whole schema, which
+* is what lets {@link pickClusterStepModels} walk every section instead of
+* trusting the section id.
+*/
+function clusterModelSettingKey(stepId) {
+	return `clusterModel:${stepId}`;
+}
+/** The cluster row when nobody has configured one — today's catalog defaults. */
+var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
+function interpretStoredClusterModel(raw) {
+	if (raw === void 0 || raw === null || raw === "") return { kind: "absent" };
+	if (typeof raw === "string") return {
+		kind: "chosen",
+		modelId: raw
+	};
+	return {
+		kind: "invalid",
+		value: raw
+	};
+}
+/**
+* The cluster-scoped steps whose stored value is `invalid` under
+* {@link interpretStoredClusterModel} — for the runtime's log line, so the
+* default it runs on such a row is never run in silence.
+*/
+function invalidClusterStepModelEntries(config) {
+	const out = [];
+	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
+		const read = interpretStoredClusterModel(config[clusterModelSettingKey(step.stepId)]);
+		if (read.kind === "invalid") out.push({
+			stepId: step.stepId,
+			value: read.value
+		});
+	}
+	return out;
+}
+/**
+* Narrow a FLAT settings record to the cluster row.
+*
+* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
+* junk face model must not also discard a valid clip model. An `absent` or
+* `invalid` value ({@link interpretStoredClusterModel}) resolves to the step's
+* catalog default — never to a blank id, because a blank id downstream becomes
+* "substitute the format default", which is precisely the substitution this
+* scope exists to forbid.
+*/
+function readClusterStepModels(config) {
+	const out = {};
+	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
+		const read = interpretStoredClusterModel(config[clusterModelSettingKey(step.stepId)]);
+		out[step.stepId] = read.kind === "chosen" ? read.modelId : step.defaultModelId;
+	}
+	return out;
+}
+function isHydratedField$2(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+/**
+* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) is the defaults.
+*/
+function pickClusterStepModels(view) {
+	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
+	return readClusterStepModels(flattenHydratedView(view, clusterModelKeys()));
+}
+/**
+* The `invalid` stored cluster model values a hydrated view carries — what the
+* runtime logs when it runs a default on a row it could not read as a choice.
+* A `null` view (owner mid-boot) carries nothing to judge.
+*/
+function pickInvalidClusterStepModels(view) {
+	if (view === null) return [];
+	return invalidClusterStepModelEntries(flattenHydratedView(view, clusterModelKeys()));
+}
+function clusterModelKeys() {
+	return new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
+}
+/** The `wanted` keys of a hydrated view as one flat record, every section walked. */
+function flattenHydratedView(view, wanted) {
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+	}
+	return flat;
+}
+/**
+* The cluster model for `stepId`, or `null` when the step is node-scoped.
+*
+* `null` is the signal to LEAVE THE CALLER'S RESOLUTION ALONE — it is not "no
+* model". Returning a default here for a node-scoped step would quietly
+* override every per-(node,device) selection in the fleet.
+*/
+function resolveClusterStepModelId(stepId, models) {
+	const step = CLUSTER_MODEL_SCOPED_STEPS.find((s) => s.stepId === stepId);
+	if (step === void 0) return null;
+	const chosen = models[stepId];
+	return chosen !== void 0 && chosen !== "" ? chosen : step.defaultModelId;
+}
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+var DEFAULT_CLUSTER_STEP_SETTINGS = readClusterStepSettings({});
+function pickClusterStepSettings(view) {
+	if (view === null) return DEFAULT_CLUSTER_STEP_SETTINGS;
+	return readClusterStepSettings(flattenHydratedView(view, new Set(CLUSTER_STEP_SETTING_FIELDS.map((field) => clusterStepSettingKey(field.stepId, field.key)))));
+}
+/**
+* Cluster knobs win over leftover per-device values. The cluster row is the
+* authority; a device-local copy is a leftover of the old per-node editor.
+*/
+function overlayClusterStepSettings(stepId, deviceSettings, cluster) {
+	const overlay = cluster[stepId];
+	if (overlay === void 0 || Object.keys(overlay).length === 0) return deviceSettings === void 0 ? void 0 : { ...deviceSettings };
+	if (deviceSettings === void 0) return { ...overlay };
+	return {
+		...deviceSettings,
+		...overlay
+	};
+}
+/**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
 * objects, per-kind event collections (motion / object / audio), and
@@ -22766,7 +23192,8 @@ var MediaFileKindEnum = _enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -23318,7 +23745,23 @@ var SearchObjectEventsInput = object({
 	until: number().optional(),
 	classFilter: string().optional(),
 	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: string().min(1).optional()
 });
 var TrackCascadeCountsSchema = object({
 	/** Persisted track roots deleted (authoritative). */
@@ -23453,7 +23896,41 @@ var RebuildObjectEmbeddingsInput = object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var WipeObjectEmbeddingsResultSchema = object({
+	deleted: number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: array(string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = _enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -23466,7 +23943,12 @@ var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
 var RebuildObjectEmbeddingsResultSchema = object({
 	started: boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
+	alreadyRunning: boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: string().optional(),
+	index: string().optional()
 });
 var RebuildStatusSchema = object({
 	running: boolean(),
@@ -23500,7 +23982,11 @@ var RebuildStatusSchema = object({
 	startedAtMs: number().nullable(),
 	finishedAtMs: number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	error: string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -23821,7 +24307,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	deviceId: number(),
 	ownerKind: MediaPresenceOwnerKindSchema,
 	ownerIds: array(string()).max(5e3)
-}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
+}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly(), { caller: "required" }), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
@@ -25052,6 +25538,17 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = object({
+	modelId: string().optional(),
+	settings: record(string(), unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -25063,7 +25560,16 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 var RunnerInferenceDeviceSchema = object({
 	deviceKey: string(),
 	weight: number().positive().default(1),
-	maxSessions: number().int().positive().nullable().default(null)
+	maxSessions: number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: record(string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -26130,6 +26636,28 @@ var NodeInferenceDeviceSchema = object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("stored"),
+		modelId: string()
+	}),
+	object({
+		kind: literal("absent"),
+		defaultModelId: string()
+	}),
+	object({
+		kind: literal("unreadable"),
+		reason: _enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -26157,10 +26685,17 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({ migrated: number() }), {
+}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({
+	migrated: number(),
+	skipped: array(object({
+		deviceId: number(),
+		targetNodeId: string(),
+		reason: string()
+	})).default([])
+}), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
+}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(object({ stepId: string() }), ClusterModelChoiceSchema), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
 	nodeId: string(),
 	capName: string(),
 	addonId: string()
@@ -28756,6 +29291,271 @@ var videoclipsCapability = {
 	}
 };
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+DeviceType.Camera;
+DeviceType.Button, DeviceType.Camera;
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema)
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -30708,17 +31508,6 @@ object({
 	deviceId: number(),
 	status: DeviceStatusSchema
 });
-object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-object({
-	deviceId: number(),
-	timestamp: number()
-});
-DeviceType.Button, DeviceType.Camera;
 /**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -38029,146 +38818,6 @@ DeviceType.Camera, method(object({
 	detection: array(ZoneRuleSchema).readonly(),
 	package: array(ZoneRuleSchema).readonly()
 });
-/**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
-* The same caps → the slice field carrying the ms-epoch timestamp of the
-* last transition. Every source cap MUST appear here (guarded by a spec):
-* without a transition timestamp the evaluator cannot tell a genuine rise
-* from a boot-time hydration when the FIRST slice it ever sees is already
-* active, and errs towards silence — swallowing the rise.
-*
-* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
-* provider derives them from `state.last_changed`, so they survive our own
-* restarts and correctly read as "hours ago" for a state that has been
-* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
-*/
-var SOURCE_CAP_CHANGED_AT_FIELD = {
-	contact: "lastChangedAt",
-	binary: "lastChangedAt",
-	switch: "lastChangedAt",
-	motion: "lastDetectedAt",
-	flood: "lastChangedAt",
-	gas: "lastChangedAt",
-	smoke: "lastChangedAt",
-	"carbon-monoxide": "lastChangedAt",
-	vibration: "lastChangedAt",
-	tamper: "lastChangedAt"
-};
-/** True when a cap is a recognised binary/switch source. */
-function isSourceCap(capName) {
-	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
-}
-/** Extract the "active" boolean a source cap's slice carries, or null when
-*  the cap is unknown or the field is missing / non-boolean. */
-function sliceActiveValue(capName, slice) {
-	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	return typeof raw === "boolean" ? raw : null;
-}
-/** Ms-epoch transition timestamp a source cap's slice carries, or null when
-*  it is absent, non-numeric or the zero "never observed" sentinel. */
-function sliceChangedAt(capName, slice) {
-	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
-	return raw;
-}
-/**
-* How recent a source's own transition timestamp must be for a FIRST
-* sighting that is already active to count as a genuine rise rather than a
-* hydration of long-standing state.
-*/
-var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
-/**
-* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
-* porta `prior`, `nowMs` e il proprio `startedAtMs`.
-*
-* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
-* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
-* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
-* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
-* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
-* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
-* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
-* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
-*/
-function evaluateSensorEdge(input) {
-	const value = sliceActiveValue(input.capName, input.slice);
-	if (value === null) return {
-		edge: "none",
-		value: null,
-		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
-	};
-	if (input.prior === void 0) {
-		if (!value) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-inactive"
-		};
-		const changedAt = sliceChangedAt(input.capName, input.slice);
-		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
-		if (changedAt === null || changedAt < floor) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-stale-active"
-		};
-		return {
-			edge: "rising",
-			value: true
-		};
-	}
-	if (input.prior === value) return {
-		edge: "none",
-		value,
-		reason: "no-change"
-	};
-	if (!value) return {
-		edge: "none",
-		value,
-		reason: "falling-edge"
-	};
-	return {
-		edge: "rising",
-		value: true
-	};
-}
 var HF_BASE_URL = `https://huggingface.co/camstack/camstack-models/resolve/main`;
 /**
 * Accessory device helpers — shared across drivers.
@@ -40988,6 +41637,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -41738,6 +42411,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -44072,6 +44751,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -46897,6 +47582,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -49406,205 +50111,6 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
-/**
-* A model choice has a SCOPE, and a scope change has a workflow.
-*
-* ## The two scopes
-*
-* Almost every pipeline step's model is a **node** question: which build runs
-* fastest on THIS accelerator. Two nodes may legitimately answer differently —
-* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
-* are compared against nothing. They produce boxes, and a box is a box.
-*
-* Two steps are not like that. `face-embedding` and `clip-embedding` produce
-* **vectors that land in ONE shared index** (`identity_samples`,
-* `vec_object_clip`) and are ranked against each other by cosine similarity.
-* Cosine similarity between two encoders is not a weak signal, it is a
-* meaningless number — and nothing inside a vector can tell you it happened.
-* So for those two steps the model is a **cluster** question with exactly one
-* answer, stored in exactly one row.
-*
-* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
-* for the crop convention (`detail-crop.ts`), one level up: the crop decides
-* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
-* cluster-wide for the same reason and neither may become per-node.
-*
-* ## Why the registry lives here and not in the step catalog
-*
-* The scope itself is declared on the step, in
-* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
-* — that is where a new step declares what kind of choice its model is. But the
-* catalog lives inside `addon-pipeline`, and three packages that must NOT
-* import an addon need to know the set: the orchestrator (which renders and
-* stores the row), post-analysis (which pins the row for a re-embed pass) and
-* admin-ui (which mirrors it). So the set is mirrored here, and
-* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
-* A hand-copied key that stops matching is exactly how a setting silently stops
-* arriving while both sides still look correct.
-*
-* ## The defaults ARE today's behaviour
-*
-* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
-* of both steps. Declaring the scope therefore changes nothing on the day it
-* ships: the cluster row starts out saying what every node was already doing.
-* Changing it is legitimate — that is what the knob is for — but it invalidates
-* the stored vectors of that surface, and must be followed by a re-embed pass
-* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
-*/
-/**
-* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
-* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
-*/
-var CLUSTER_MODEL_SCOPED_STEPS = [{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}];
-/**
-* The settings key holding one step's cluster model choice.
-*
-* Step-qualified so the keys stay unique across the addon's whole schema, which
-* is what lets {@link pickClusterStepModels} walk every section instead of
-* trusting the section id.
-*/
-function clusterModelSettingKey(stepId) {
-	return `clusterModel:${stepId}`;
-}
-/** The cluster row when nobody has configured one — today's catalog defaults. */
-var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
-/** A stored choice is a non-empty model id, or it is not a choice. */
-var ChosenModelIdSchema = string().min(1);
-/**
-* Narrow a FLAT settings record to the cluster row.
-*
-* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
-* junk face model must not also discard a valid clip model. An absent, empty or
-* non-string value resolves to the step's catalog default — the historical
-* behaviour — never to a blank id, because a blank id downstream becomes
-* "substitute the format default", which is precisely the substitution this
-* scope exists to forbid.
-*/
-function readClusterStepModels(config) {
-	const out = {};
-	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
-		const parsed = ChosenModelIdSchema.safeParse(config[clusterModelSettingKey(step.stepId)]);
-		out[step.stepId] = parsed.success ? parsed.data : step.defaultModelId;
-	}
-	return out;
-}
-function isHydratedField$2(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the defaults. A `null` payload
-* (addon mid-boot) is the defaults.
-*/
-function pickClusterStepModels(view) {
-	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
-	const flat = {};
-	const wanted = new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
-		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readClusterStepModels(flat);
-}
-/**
-* The cluster model for `stepId`, or `null` when the step is node-scoped.
-*
-* `null` is the signal to LEAVE THE CALLER'S RESOLUTION ALONE — it is not "no
-* model". Returning a default here for a node-scoped step would quietly
-* override every per-(node,device) selection in the fleet.
-*/
-function resolveClusterStepModelId(stepId, models) {
-	const step = CLUSTER_MODEL_SCOPED_STEPS.find((s) => s.stepId === stepId);
-	if (step === void 0) return null;
-	const chosen = models[stepId];
-	return chosen !== void 0 && chosen !== "" ? chosen : step.defaultModelId;
-}
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-var DEFAULT_CLUSTER_STEP_SETTINGS = readClusterStepSettings({});
-function pickClusterStepSettings(view) {
-	if (view === null) return DEFAULT_CLUSTER_STEP_SETTINGS;
-	const flat = {};
-	const wanted = new Set(CLUSTER_STEP_SETTING_FIELDS.map((field) => clusterStepSettingKey(field.stepId, field.key)));
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
-		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readClusterStepSettings(flat);
-}
-/**
-* Cluster knobs win over leftover per-device values. The cluster row is the
-* authority; a device-local copy is a leftover of the old per-node editor.
-*/
-function overlayClusterStepSettings(stepId, deviceSettings, cluster) {
-	const overlay = cluster[stepId];
-	if (overlay === void 0 || Object.keys(overlay).length === 0) return deviceSettings === void 0 ? void 0 : { ...deviceSettings };
-	if (deviceSettings === void 0) return { ...overlay };
-	return {
-		...deviceSettings,
-		...overlay
-	};
-}
 var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
 var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
 /**
@@ -50805,4 +51311,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { declareLogChannel as $, webrtcSessionCapability as $t, OpsLogEntrySchema as A, lazy as An, pickClusterStepSettings as At, VIDEOCLIPS_MAX_OFFER_BYTES as B, resolveClusterStepModelId as Bt, ExportRecordSchema as C, parseProfileBrokerId as Cn, mayWriteToLocation as Ct, MOTION_CLOSE_AFTER_MS as D, array as Dn, overlayClusterStepSettings as Dt, HF_BASE_URL as E, _enum as En, motionDetectionCapability as Et, RECORDING_SOURCE_CAMSTACK as F, record as Fn, rankStreams as Ft, audioAnalyzerCapability as G, resolveRecordingProfiles as Gt, YAMNET_TO_MACRO as H, resolveEgressDecodeHwAccel as Ht, RECORDING_SOURCE_CAMSTACK_ADDON as I, string as In, recordingArchiveCapability as It, cameraStreamsCapability as J, storageOccupancyCapability as Jt, audioKindId as K, runtimeDevices as Kt, RecordingConfigSchema as L, union as Ln, recordingCapability as Lt, RATE_CONTROL_RELAXED as M, number as Mn, pickNativeLeaseOverride as Mt, RATE_CONTROL_TIGHT as N, object as Nn, pipelineExecutorCapability as Nt, NativeLeaseAdmissionSchema as O, boolean as On, parseProcStatus as Ot, RECORDING_EXPORT_MAX_READ_BYTES as P, preprocess as Pn, pipelineRunnerCapability as Pt, createLogChannelsProvider as Q, videoclipsCapability as Qt, RecordingSignalStatusSchema as R, EventCategory as Rn, recordingExportCapability as Rt, EncodeProfileSchema as S, parseJsonUnknown as Sn, mayReadLocation as St, G711_SCALE_CORRECTION_DB as T, sleep as Tn, modeMayWrite as Tt, addonWidgetsSourceCapability as U, resolveLocationMode as Ut, VISIT_MERGE_GAP_MS as V, resolveCreateExportSubject as Vt, audioAnalysisCapability as W, resolvePoolMemoryPolicy as Wt, clipExportFailureOf as X, stripRetiredBandPreBufferSec as Xt, clipExportFailure as Y, streamBrokerCapability as Yt, createHwAccelCache as Z, supportedRuntimes as Zt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as _, hydrateSchema as _n, isFirstLevelMacroClass as _t, BatteryStatusSchema as a, isSoftwareDecode as an, egressTranscodeSharingKey as at, EVENT_OWNER_TYPES as b, makeSourceBrokerId as bn, mapAudioLabelToMacro as bt, CLIP_STILL_REASON_HEADER as c, CAM_PROFILE_ORDER as cn, evaluateSensorEdge as ct, COCO_TO_MACRO as d, DeviceType as dn, evictionPolicyOfLocation as dt, errMsg as en, defaultDeviceFor as et, DEFAULT_AUDIO_ANALYZER_CONFIG as f, audioChunkBytesPerSample as fn, exportSubjectOf as ft, DEFAULT_EVENTS_BAND_BUFFER_SEC as g, expandAudioChunkToF32le as gn, inferModelProvider as gt, DEFAULT_DETAIL_CROP_CONVENTION as h, defineCustomActions as hn, hfModelUrl as ht, BackgroundRunRegistry as i, invocationFromEncodeProfile as in, detectionPipelineCapability as it, PoolMemoryWatchdog as j, literal as jn, pickDetailCropConvention as jt, NativeLeaseSettingsSchema as k, discriminatedUnion as kn, pickClusterStepModels as kt, CLIP_STREAM_TRANSPORT_HEADER as l, CamProfileSchema as ln, evaluateZoneRules as lt, DEFAULT_CLUSTER_STEP_SETTINGS as m, customAction as mn, gbToBytes as mt, AUDIO_BACKEND_CHOICES as n, Fmp4BoxSplitter as nn, deriveDetailCropRect as nt, CLIP_BROKER_PACED_RATES as o, BOOT_RECOVERY_BACKOFF_MS as on, egressTransportFromRequest as ot, DEFAULT_CLUSTER_STEP_MODELS as p, createEvent as pn, failureContributionCapability as pt, batteryCapability as q, storageEvictableCapability as qt, AUDIO_MACRO_LABELS as r, buildFfmpegArgs as rn, deriveRecordingMode as rt, CLIP_STILL_REASON_CODE_HEADER as s, BaseAddon as sn, enumerateInferenceDevices as st, APPLE_SA_TO_MACRO as t, AUDIO_PRESETS as tn, deriveBatteryPresence as tt, COCO_80_LABELS as u, DeviceFeature as un, evictionPolicyForMode as ut, DEFAULT_NATIVE_LEASE_SETTINGS as v, isEvent as vn, loadContributionCapability as vt, FailureCounters as w, selectAssignedProfileSlots as wn, migrateLegacyDeviceSignalConfig as wt, EVENT_PAD_MS as x, nodePin as xn, maskUrlCredentials as xt, DEVICE_BACKEND_TO_FORMAT as y, makeProfileBrokerId as yn, logChannelsCapability as yt, RingBuffer as z, recordingSignalCapability as zt };
+export { declareLogChannel as $, videoclipsCapability as $t, OpsLogEntrySchema as A, discriminatedUnion as An, pickClusterStepSettings as At, VIDEOCLIPS_MAX_OFFER_BYTES as B, recordingSignalCapability as Bt, ExportRecordSchema as C, parseJsonUnknown as Cn, mayWriteToLocation as Ct, MOTION_CLOSE_AFTER_MS as D, _enum as Dn, overlayClusterStepSettings as Dt, HF_BASE_URL as E, sleep as En, motionDetectionCapability as Et, RECORDING_SOURCE_CAMSTACK as F, preprocess as Fn, pipelineRunnerCapability as Ft, audioAnalyzerCapability as G, resolvePoolMemoryPolicy as Gt, YAMNET_TO_MACRO as H, resolveCreateExportSubject as Ht, RECORDING_SOURCE_CAMSTACK_ADDON as I, record as In, rankStreams as It, cameraStreamsCapability as J, storageEvictableCapability as Jt, audioKindId as K, resolveRecordingProfiles as Kt, RecordingConfigSchema as L, string as Ln, recordingArchiveCapability as Lt, RATE_CONTROL_RELAXED as M, literal as Mn, pickInvalidClusterStepModels as Mt, RATE_CONTROL_TIGHT as N, number as Nn, pickNativeLeaseOverride as Nt, NativeLeaseAdmissionSchema as O, array as On, parseProcStatus as Ot, RECORDING_EXPORT_MAX_READ_BYTES as P, object as Pn, pipelineExecutorCapability as Pt, createLogChannelsProvider as Q, supportedRuntimes as Qt, RecordingSignalStatusSchema as R, union as Rn, recordingCapability as Rt, EncodeProfileSchema as S, nodePin as Sn, mayReadLocation as St, G711_SCALE_CORRECTION_DB as T, selectAssignedProfileSlots as Tn, modeMayWrite as Tt, addonWidgetsSourceCapability as U, resolveEgressDecodeHwAccel as Ut, VISIT_MERGE_GAP_MS as V, resolveClusterStepModelId as Vt, audioAnalysisCapability as W, resolveLocationMode as Wt, clipExportFailureOf as X, streamBrokerCapability as Xt, clipExportFailure as Y, storageOccupancyCapability as Yt, createHwAccelCache as Z, stripRetiredBandPreBufferSec as Zt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as _, expandAudioChunkToF32le as _n, isFirstLevelMacroClass as _t, BatteryStatusSchema as a, invocationFromEncodeProfile as an, egressTranscodeSharingKey as at, EVENT_OWNER_TYPES as b, makeProfileBrokerId as bn, mapAudioLabelToMacro as bt, CLIP_STILL_REASON_HEADER as c, BaseAddon as cn, evaluateSensorEdge as ct, COCO_TO_MACRO as d, DeviceFeature as dn, evictionPolicyOfLocation as dt, webrtcSessionCapability as en, defaultDeviceFor as et, DEFAULT_AUDIO_ANALYZER_CONFIG as f, DeviceType as fn, exportSubjectOf as ft, DEFAULT_EVENTS_BAND_BUFFER_SEC as g, defineCustomActions as gn, inferModelProvider as gt, DEFAULT_DETAIL_CROP_CONVENTION as h, customAction as hn, hfModelUrl as ht, BackgroundRunRegistry as i, buildFfmpegArgs as in, detectionPipelineCapability as it, PoolMemoryWatchdog as j, lazy as jn, pickDetailCropConvention as jt, NativeLeaseSettingsSchema as k, boolean as kn, pickClusterStepModels as kt, CLIP_STREAM_TRANSPORT_HEADER as l, CAM_PROFILE_ORDER as ln, evaluateZoneRules as lt, DEFAULT_CLUSTER_STEP_SETTINGS as m, createEvent as mn, gbToBytes as mt, AUDIO_BACKEND_CHOICES as n, AUDIO_PRESETS as nn, deriveDetailCropRect as nt, CLIP_BROKER_PACED_RATES as o, isSoftwareDecode as on, egressTransportFromRequest as ot, DEFAULT_CLUSTER_STEP_MODELS as p, audioChunkBytesPerSample as pn, failureContributionCapability as pt, batteryCapability as q, runtimeDevices as qt, AUDIO_MACRO_LABELS as r, Fmp4BoxSplitter as rn, deriveRecordingMode as rt, CLIP_STILL_REASON_CODE_HEADER as s, BOOT_RECOVERY_BACKOFF_MS as sn, enumerateInferenceDevices as st, APPLE_SA_TO_MACRO as t, errMsg as tn, deriveBatteryPresence as tt, COCO_80_LABELS as u, CamProfileSchema as un, evictionPolicyForMode as ut, DEFAULT_NATIVE_LEASE_SETTINGS as v, hydrateSchema as vn, loadContributionCapability as vt, FailureCounters as w, parseProfileBrokerId as wn, migrateLegacyDeviceSignalConfig as wt, EVENT_PAD_MS as x, makeSourceBrokerId as xn, maskUrlCredentials as xt, DEVICE_BACKEND_TO_FORMAT as y, isEvent as yn, logChannelsCapability as yt, RingBuffer as z, EventCategory as zn, recordingExportCapability as zt };