@camstack/addon-pipeline 1.2.69 → 1.2.71

package/dist/{dist-tJF2BzWi.js → dist-CtOVWTCi.js}

@@ -8584,7 +8584,15 @@ function deriveRecordingMode(config) {
 * Each completed/failed run also lands one durable ops-log row on its owning
 * addon surface.
 */
+/**
+* `queued` exists because the recorder mover is SINGLE-FLIGHT and an operator
+* rebalance enqueues one job per (camera, profile). Refusing the second job —
+* what the engine did before — turned a fifteen-camera rebalance into fifteen
+* manual retries. Queued jobs run FIFO; a queued job that is cancelled never
+* runs at all.
+*/
 var RelocateJobStateSchema = _enum([
+	"queued",
 	"running",
 	"done",
 	"failed",
@@ -8619,6 +8627,15 @@ var RelocateFootageInputSchema = object({
 	/** Limits relocation to the logical profile class. Omit only for the
 	* pre-orchestration compatibility path. */
 	footageClass: RelocateFootageClassSchema.optional(),
+	/** Scope the move to ONE camera. Absent = every camera on the source, which
+	*  is what a whole-disk drain means. The rebalance path always sets it: its
+	*  unit is a (camera, profile) pile, not a disk. */
+	deviceId: number().int().optional(),
+	/** Scope the move to specific segment profiles (`high` / `mid` / `low`).
+	*  Finer than `footageClass`, which cannot separate high from mid — and the
+	*  placement plan assigns those two independently, so a rebalance that could
+	*  only say "recordings" would move footage the plan never asked to move. */
+	profiles: array(string()).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: number().min(1).max(1e3).optional()
@@ -15671,6 +15688,13 @@ var MaskGridDimsSchema = object({
 * `package-event` are pure trigger kinds (no urgency dimension). Extending
 * this one field keeps the schema additive — a rule still declares exactly
 * one trigger.
+*
+* AUDIO rules add no member here, for the reason occupancy added none: the
+* enum is mirrored by hand in the viewer (`scripts/check-viewer-condition-
+* mirror.ts` fails the build on a member the app cannot render) and every
+* member costs a release train. A sustained-sound rule is therefore an
+* `immediate` rule carrying {@link NcConditions.audio} — the condition is the
+* trigger discriminator, exactly as `occupancy` is on `device-event`.
 */
 var NcDeliverySchema = _enum([
 	"immediate",
@@ -15685,15 +15709,32 @@ var NcDeliverySchema = _enum([
 * depend on a provider's raw event name or payload shape.
 */
 var NcSystemEventKindSchema = _enum([
-	"camera-online",
-	"camera-offline",
+	"device-online",
+	"device-offline",
+	"device-disabled",
+	"device-enabled",
 	"stream-online",
 	"stream-offline",
 	"node-online",
 	"node-offline",
 	"addon-update-available",
-	"server-update-available"
+	"server-update-available",
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed",
+	"camera-online",
+	"camera-offline",
+	"camera-disabled",
+	"camera-enabled"
 ]);
+/** The legacy tail of {@link NcSystemEventKindSchema} — see its docblock. */
+var NC_LEGACY_SYSTEM_EVENT_KINDS = new Set([
+	"camera-online",
+	"camera-offline",
+	"camera-disabled",
+	"camera-enabled"
+]);
+NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
 /**
 * One coherent system-event condition. `kinds` is the required opt-in safety
 * gate; the remaining lists are optional narrowing filters relevant to the
@@ -15702,6 +15743,18 @@ var NcSystemEventKindSchema = _enum([
 var NcSystemEventConditionSchema = object({
 	kinds: array(NcSystemEventKindSchema).min(1),
 	deviceIds: array(number().int()).min(1).optional(),
+	/**
+	* Narrow a `device-*` kind to these device TYPES (`DeviceType` values —
+	* `camera`, `switch`, `sensor`, `container`, …). Absent = every type, which
+	* is what a liveness rule means when nobody said otherwise.
+	*
+	* This is where "only my cameras" is expressed, and it lives on the rule for
+	* one reason: the intake cannot know which devices this household cares
+	* about, and a producer-side filter is one no operator can change. Fails
+	* CLOSED — a subject whose device type is unknown (an id the device mirror
+	* does not carry) matches no `deviceTypes` list.
+	*/
+	deviceTypes: array(string().min(1)).min(1).optional(),
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
@@ -15752,6 +15805,47 @@ var NcOccupancyConditionSchema = object({
 	sustainSeconds: number().int().min(0).max(3600).default(15)
 });
 /**
+* Audio condition (IMMEDIATE trigger) — a rule on SOUND, not on a picture.
+*
+* Operator-approved vocabulary (2026-08-12, option A — the same one the
+* reference notifier uses, so an operator moving between them re-uses what
+* they already know): a rule matches when, over a sampling window of
+* `samplingSeconds`, at least `hitPercent`% of the audio samples in that
+* window are HITS. A sample is a hit when it satisfies BOTH present filters:
+*
+*  - `dbThreshold` — its level is at or above this many dBFS (see
+*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale);
+*  - `labels` — the classifier put at least one of these labels on it.
+*
+* Both are OPTIONAL and independent, which is the point of the shape: a
+* loudness rule ("something loud at 3am") needs no model to be right, and a
+* label rule ("a dog barked") needs no threshold. **Fail-closed when NEITHER
+* is given** — a window in which every sample is trivially a hit would fire on
+* silence, so the engine refuses such a condition rather than notifying on
+* nothing (the schema cannot express "at least one of" without becoming a
+* ZodEffects the cap path would have to special-case).
+*
+* `hitPercent` is over the samples the window actually HOLDS, and the window
+* must be FULL before it can match — a window that has been open for two
+* seconds of its ten is 100% of nothing, and firing on it would make
+* `samplingSeconds` decorative.
+*
+* Labels are the audio macro classes (`AUDIO_MACRO_LABELS` / the NC taxonomy's
+* `audio-*` ids). Both spellings are accepted — the matcher normalizes the
+* `audio-` prefix away on both sides, so a picker that offers taxonomy ids and
+* an operator who typed `dog` mean the same thing.
+*/
+var NcAudioConditionSchema = object({
+	/** Audio macro labels; absent = any sound (level-only rule). */
+	labels: array(string().min(1)).min(1).optional(),
+	/** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+	dbThreshold: number().min(-96).max(0).optional(),
+	/** Percentage of the window's samples that must be hits (1–100). */
+	hitPercent: number().int().min(1).max(100).default(60),
+	/** Length of the sampling window in seconds. */
+	samplingSeconds: number().int().min(1).max(300).default(10)
+});
+/**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
 *
 * The values are not symmetric, and deliberately so — the absent value has to
@@ -16024,7 +16118,33 @@ var NcConditionsSchema = object({
 	* threshold and holds for `sustainSeconds`. Fail-closed on missing
 	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
 	*/
-	occupancy: NcOccupancyConditionSchema.optional()
+	occupancy: NcOccupancyConditionSchema.optional(),
+	/**
+	* IMMEDIATE only. Sustained-sound matcher — `hitPercent` of the samples in a
+	* `samplingSeconds` window clear the optional `dbThreshold` and carry one of
+	* the optional `labels`. Fail-closed on missing substrate (no audio samples,
+	* a window that is not full yet, neither filter given). See
+	* {@link NcAudioCondition}.
+	*
+	* Presence of this key is what makes a rule an AUDIO rule: the engine fires
+	* it ONLY on a confirmed audio window, and a rule carrying it never fires on
+	* a detection, a track or a device event (the same fail-closed pairing
+	* `occupancy` has with the `device-event` trigger). That is how audio labels
+	* leave `classes`: an audio rule names its sounds HERE, and the legacy path
+	* (an `immediate` rule naming an `audio-*` class, one notification per
+	* classified sample) stays exactly as it was for rules that already use it.
+	*
+	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
+	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
+	* (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* condition fields it does not know when a rule is saved from the phone.
+	* Publishing an editor for a condition the app cannot round-trip is how an
+	* operator loses a rule's conditions by opening it — so the descriptor, the
+	* admin widget and the viewer mirror land together (P2 + P3), and only then
+	* does an audio rule become authorable.
+	*/
+	audio: NcAudioConditionSchema.optional()
 });
 /** One delivery target: a `notification-output` Target ref + passthrough params. */
 var NcRuleTargetSchema = object({
@@ -16138,6 +16258,73 @@ var NcThrottleSchema = object({
 	*/
 	granularity: NcThrottleGranularitySchema.optional()
 });
+/**
+* How long the confirm gate may hold ONE notification, and how big the picture
+* it judges may be.
+*
+* The clamp is the product decision, not a coincidence of the model: p50 was
+* 4.9 s warm and 15.3 s cold against qwen3-vl-8b, and a notification that
+* arrives after the visitor has gone is not a notification. 448 px was enough
+* to score 16/16 on the operator's parking scenario — bigger costs latency and
+* tokens for pixels the model pools away.
+*/
+var NC_CONFIRM_MIN_TIMEOUT_MS = 1e3;
+var NC_CONFIRM_MAX_TIMEOUT_MS = 2e4;
+var NC_CONFIRM_DEFAULT_TIMEOUT_MS = 8e3;
+/** Comparison the model's COUNT must satisfy for the notification to fire. */
+var NcConfirmExpectSchema = object({
+	op: _enum([
+		">=",
+		">",
+		"<=",
+		"<",
+		"=="
+	]),
+	count: number().int().min(0).max(1e3)
+});
+/**
+* AI CONFIRM — a vision model looks at the picture this notification is about
+* to ship and says whether it agrees with the rule.
+*
+* It runs AFTER the attachments resolve, deliberately: the crop JUDGED is the
+* crop SHIPPED (D52). A verdict about a different pixel rectangle than the one
+* on the operator's phone is not a verdict about this notification.
+*
+* FAIL-OPEN is the only safe default. A gate that cannot reach its model, or
+* whose model is cold, must not silence a camera — so `onTimeout: 'fire'` is
+* the default and every fail-open is COUNTED, because a gate that always fails
+* open looks in the log exactly like a gate that works.
+*
+* Every field is `.optional()` rather than relied on as a Zod default at the
+* runtime seam: a Zod default does NOT run on the addon→addon cap path (three
+* production failures in one day), so the gate reads absent as the constant
+* above rather than trusting a parse it may never have seen.
+*/
+var NcConfirmSchema = object({
+	/** Off unless asked for. An absent `confirm` and `enabled:false` are the
+	*  same thing, and both mean "deliver exactly as before". */
+	enabled: boolean().default(false),
+	/** Explicit vision profile; absent = the `purpose:'vision'` cluster default. */
+	profileId: string().optional(),
+	/**
+	* The operator's question, in his own words. Absent = a question derived
+	* from the rule (its class and its expectation).
+	*
+	* NEVER composed with text READ OUT OF THE FRAME. The model reads OSD
+	* banners, signage and plates as instructions if you let them reach the
+	* prompt — proven live — so the authoritative contract stays in the system
+	* turn and only rule-authored words land here.
+	*/
+	prompt: string().max(1e3).optional(),
+	/** Fire only when the model's count satisfies this. Absent = the model's
+	*  own boolean verdict decides. */
+	expect: NcConfirmExpectSchema.optional(),
+	timeoutMs: number().int().min(NC_CONFIRM_MIN_TIMEOUT_MS).max(NC_CONFIRM_MAX_TIMEOUT_MS).default(NC_CONFIRM_DEFAULT_TIMEOUT_MS),
+	/** What a timeout / unreachable model MEANS. `fire` (default) = fail-open. */
+	onTimeout: _enum(["fire", "suppress"]).default("fire"),
+	/** Longest edge the judged image is downscaled to before it is sent. */
+	maxImagePx: number().int().min(64).max(2048).default(448)
+});
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = object({
 	name: string().min(1).max(200),
@@ -16198,7 +16385,13 @@ var NcRuleInputSchema = object({
 	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
 	* shape as every other actuation.
 	*/
-	actions: NcRuleActionsSchema.optional()
+	actions: NcRuleActionsSchema.optional(),
+	/**
+	* AI CONFIRM — see {@link NcConfirmSchema}. `.optional()`, never defaulted:
+	* a rule that predates the gate must keep delivering byte-for-byte as it
+	* did, and absent is the only way to say that without a migration.
+	*/
+	confirm: NcConfirmSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -16209,7 +16402,37 @@ var NcRuleInputSchema = object({
 * still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
 * `updateRule` patch.
 */
-var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: array(string()).optional() });
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
+	disabledTargetIds: array(string()).optional(),
+	/**
+	* `.partial()` DOES NOT REMOVE A FIELD'S `.default()`.
+	*
+	* It makes the key optional to SUPPLY; the parse still materialises the
+	* default when the key is absent. And `NcRuleStore.update` merges with
+	* `{ ...existing, ...patch }`, so a materialised key OVERWRITES the stored
+	* one — which made every partial edit destructive:
+	*
+	*   nc.updateRule({ throttle })         → conditions reset to `{}`
+	*   nc.setRuleTargetEnabled(...)        → conditions reset to `{}`
+	*   setEnabled(ruleId, false)           → conditions reset to `{}`
+	*
+	* A rule scoped to one camera and one zone silently became a rule that
+	* matches EVERY event on EVERY camera, and lost its `media` policy
+	* (zoneCrop / gif / clip / frame) and its `priority` at the same time. Seen
+	* live on 2026-08-12: a rule scoped to device 617 fired on 590 and 615
+	* within a minute of a two-field patch.
+	*
+	* So every defaulted field is re-declared here WITHOUT its default. The
+	* inner defaults still apply when the caller DOES send the key — `{}` for
+	* conditions remains a real instruction ("clear them") — and only the
+	* absent key is now genuinely absent.
+	*/
+	enabled: boolean().optional(),
+	conditions: NcConditionsSchema.optional(),
+	media: NcMediaPolicySchema.optional(),
+	throttle: NcThrottleSchema.optional(),
+	priority: number().int().min(1).max(5).optional()
+});
 /** A persisted rule. */
 var NcRuleSchema = NcRuleInputSchema.extend({
 	id: string(),
@@ -16510,6 +16733,25 @@ var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
 * copy would lie the first time a rule is disabled.
 */
+/**
+* Why a device a mode NAMES is nonetheless not armed by it.
+*
+* Each value is an existing authority, never a new flag (D62): `muted` is the
+* per-camera notification switch the Notification Center already owns,
+* `detection-off` is the device's own detection binding being inactive, and
+* `offline` is the device manager's liveness. A fourth reason would mean a
+* fourth authority, and inventing one here is how a panel starts disagreeing
+* with the switches the operator actually used.
+*/
+var NcAlarmSkipReasonSchema = _enum([
+	"muted",
+	"detection-off",
+	"offline"
+]);
+var NcAlarmSkippedDeviceSchema = object({
+	deviceId: number().int(),
+	reason: NcAlarmSkipReasonSchema
+});
 var NcAlarmModeCoverageSchema = object({
 	mode: AlarmArmModeSchema,
 	/** Enabled rules gated on `armed_<mode>`. Zero means the mode does nothing. */
@@ -16517,7 +16759,18 @@ var NcAlarmModeCoverageSchema = object({
 	/** At least one covering rule has no device scope, so the mode covers all. */
 	allDevices: boolean(),
 	/** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
-	deviceIds: array(number().int())
+	deviceIds: array(number().int()),
+	/**
+	* Devices this mode NAMES but cannot actually arm, each with the switch that
+	* excludes it.
+	*
+	* "Away armed — 12 cameras" is a promise, and a muted camera among those
+	* twelve makes it false in exactly the way nobody notices until an incident.
+	* Defaulted to `[]` so a coverage answer computed before this field existed
+	* still parses as "nothing known to be skipped" rather than failing the whole
+	* alarm tab.
+	*/
+	skippedDevices: array(NcAlarmSkippedDeviceSchema).default([])
 });
 var NcAlarmConfigSchema = object({
 	/**
@@ -25223,7 +25476,19 @@ var RecordingManifestSchema = object({
 *  profiles/subtrees/locations on this node). */
 var RecordingDeviceUsageSchema = object({
 	deviceId: number(),
-	usedBytes: number()
+	usedBytes: number(),
+	/**
+	* Start of this camera's OLDEST indexed segment, across every profile and
+	* location — the "Oldest footage" column in Recordings → Storage, and the
+	* only honest answer to "is retention actually holding?" per camera.
+	*
+	* `null` = the camera has no footage. OPTIONAL because a recorder that
+	* predates this field omits it entirely, and a hub whose types carry the
+	* field must keep validating that older provider's payload: the framework
+	* (types) and the addon ship on different trains, and the addon is usually
+	* the later of the two.
+	*/
+	oldestMs: number().nullable().optional()
 });
 /** Recording storage usage + capacity for one storage location. */
 var RecordingLocationUsageSchema = object({
@@ -25251,6 +25516,57 @@ var RecordingStorageUsageSchema = object({
 	locations: array(RecordingLocationUsageSchema)
 });
 /**
+* The OPERATOR-ARMED half of multi-location recordings (D116).
+*
+* The placement plan decides where NEW writes go and moves nothing. A rebalance
+* is the operator asking for the EXISTING archive to be brought into line with
+* that plan: one relocate job per (camera, profile) pile that sits on the wrong
+* location, run FIFO behind the single-flight mover.
+*
+* `plan…` and `start…` return the SAME shape deliberately — what the operator
+* confirms is exactly what gets enqueued, and `jobIds` is the only difference
+* (empty on the plan).
+*/
+var RecordingRebalanceMoveSchema = object({
+	deviceId: number(),
+	profile: string(),
+	fromLocationId: string(),
+	toLocationId: string(),
+	bytes: number(),
+	files: number().int()
+});
+/** Why a pile that is out of place is staying there. Every refusal is
+*  reported: a rebalance that silently drops a camera reads exactly like one
+*  that had nothing to do. */
+var RecordingRebalanceSkipReasonSchema = _enum([
+	"unassigned",
+	"target-not-writable",
+	"below-threshold",
+	"no-headroom"
+]);
+var RecordingRebalanceSkipSchema = object({
+	deviceId: number(),
+	profile: string(),
+	fromLocationId: string(),
+	/** The location the plan wants; null when the camera has no assignment. */
+	toLocationId: string().nullable(),
+	bytes: number(),
+	reason: RecordingRebalanceSkipReasonSchema
+});
+var RecordingRebalancePlanSchema = object({
+	moves: array(RecordingRebalanceMoveSchema),
+	skipped: array(RecordingRebalanceSkipSchema),
+	bytesToMove: number(),
+	/** Relocate job ids enqueued. Always empty for the plan (dry-run) call. */
+	jobIds: array(string())
+});
+var RecordingRebalanceInputSchema = object({
+	/** Copy throttle in MB/s (default 40) — a rebalance is a background chore. */
+	throttleMbps: number().min(1).max(1e3).optional(),
+	/** Ignore piles smaller than this (default 1 GB). */
+	minMoveGb: number().min(0).optional()
+});
+/**
 * Result of locating footage at a wall-clock instant for one device/profile.
 * `segment` carries the covering segment's window; `gap` reports the forward
 * nearest covered edge (`null` past the end of footage / when none exists)
@@ -25494,6 +25810,36 @@ var recordingCapability = {
 		cancelStorageMigrationMove: method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Move footage between locations — the OPERATOR's mover, scoped to one
+		* camera (and optionally to specific profiles) rather than a whole disk.
+		* Queued FIFO behind the single-flight engine, so arming several is safe.
+		*/
+		relocateFootage: method(RelocateFootageInputSchema, object({ jobId: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every relocate job this recorder knows about, newest first (in RAM: the
+		*  move is resumable, so a lost list costs nothing but the display). */
+		listRelocateJobs: method(object({}), array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Cancel a running or queued relocate job. A queued job never runs. */
+		cancelRelocateJob: method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** What a rebalance WOULD move, and what it would refuse. Moves nothing. */
+		planStorageRebalance: method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Arm the rebalance: enqueue one relocate job per planned move. */
+		startStorageRebalance: method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -25514,13 +25860,24 @@ var recordingCapability = {
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
+*
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -30894,6 +31251,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocateJob": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.cancelStorageMigrationMove": {
 		capName: "recording",
 		capScope: "system",
@@ -30948,6 +31311,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.listRelocateJobs": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.locateSegment": {
 		capName: "recording",
 		capScope: "system",
@@ -30960,6 +31329,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.planStorageRebalance": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.pruneFootage": {
 		capName: "recording",
 		capScope: "system",
@@ -30984,6 +31359,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.renderClip": {
 		capName: "recording",
 		capScope: "system",
@@ -31020,6 +31401,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.startStorageRebalance": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recordingExport.cancelExport": {
 		capName: "recording-export",
 		capScope: "system",
@@ -32434,6 +32821,104 @@ var FramerateField = number().int().min(1).max(60);
 var TargetsField = array(NcRuleTargetSchema).min(1);
 var PriorityField = number().int().min(1).max(5);
 /**
+* Explicit override of the DENSE sampling cadence, seconds.
+*
+* Absent ⇒ derived as `max(1s, cadenceSec / 30)` — a 30 s base samples every
+* 1 s inside a detection range. (It was `base / 10` until 2026-08-12, which
+* made that same base 3 s and rendered a person pass as two frames.)
+*
+* THE ARITHMETIC. A detection range of `rangeSec` seconds sampled every
+* `denseCadenceSec` and played at `framerate` occupies
+*
+*     outputSeconds = (rangeSec / denseCadenceSec) / framerate
+*
+* so a 7 s pass at 1 s / 12 fps is 0.58 s of video, and at 0.5 s it is 1.17 s.
+* Halving this field doubles the frames INSIDE ranges only — the base cadence,
+* and therefore the length of a quiet night, does not move.
+*
+* Floored at {@link TIMELAPSE_DENSE_FLOOR_SEC}: asking for frames faster than
+* the recording has them returns the same frames, requested twice. Must be
+* STRICTLY smaller than `cadenceSec` — a dense rate that is not denser renders
+* a uniform video the operator believes is two-rate — and upsert refuses it
+* rather than letting the export cap reject the render hours after the window.
+*/
+var DenseCadenceSecField = number().min(.1).max(3600);
+/**
+* Minimum seconds of OUTPUT video each detection range must occupy.
+*
+* The operator-facing form of the arithmetic above: instead of solving for a
+* cadence, state the dwell and let the renderer solve. `minDwellSec: 1` on a
+* 30 s base at 12 fps turns a 7 s pass into a full second of video by sampling
+* that range every ~583 ms.
+*
+* ONE CADENCE SERVES EVERY RANGE. `ExportDenseSchema.everyMs` is global — the
+* ranges are terms of a single ffmpeg `select` expression that cannot vary rate
+* per term — so the MOST DEMANDING (shortest) range sets the rate and longer
+* ranges are sampled denser than they need. Per-range cadences require a cap
+* schema change and are the tracked follow-up.
+*
+* A range too short to reach the dwell even at {@link TIMELAPSE_DENSE_FLOOR_SEC}
+* is rendered with every frame that EXISTS and no more: the guarantee is capped
+* by real footage, never met by duplicating frames into motion that never
+* happened.
+*/
+var MinDwellSecField = number().min(0).max(60);
+/**
+* Caption burned into the notification's preview frame.
+*
+* Same `{{var}}` vocabulary as {@link TimelapseTemplateSchema} (`camera`,
+* `rule`, `from`, `to`) and rendered by the SAME renderer — a second
+* templating dialect for one field would be a second thing to explain.
+*
+* Absent ⇒ {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}. An EMPTY STRING is the
+* operator saying "the frame, no caption" — a distinct, reachable answer, and
+* the reason this is not `.min(1)`.
+*/
+var PreviewTextField = string().max(200);
+/**
+* Whether the notification's preview is a STILL or a short animation.
+*
+* The operator's ask, verbatim: *"inviato come gif o video (come per le altre
+* rule)"* — his Scrypted advanced-notifier has a `gifRule`, and a ten-hour
+* night reads better as three seconds of motion than as one frame of it. Both
+* modes get the SAME treatment (blurred frame, large centred title); `'gif'`
+* simply applies it to a dozen frames sampled across the render and assembles
+* them.
+*
+* `'image'` is the default and stays the default: a GIF costs a dozen ffmpeg
+* seeks and a palette pass, and no rule that never asked for one should start
+* paying that on the deploy that shipped it.
+*
+* A GIF that cannot be assembled DEGRADES to the still — never to nothing.
+*/
+var PreviewModeField = _enum(["image", "gif"]);
+/**
+* Which detection classes the notification reports counts for.
+*
+* The counts come from the tracks the render ALREADY fetched for its dense-range
+* plan — no second query — aggregated per class. Absent or empty means "every
+* class the window actually contained", which is what an operator who never
+* opened the field wants; a list narrows it (`['person']` on a driveway that
+* counts cars all night).
+*
+* Class names are the tracker's own (`person`, `vehicle`, `animal`, `package`,
+* …). An unknown name simply never matches and reports nothing — it is not an
+* error, because a rule may legitimately name a class this camera's model does
+* not emit.
+*
+* The counts are exposed to {@link TimelapseTemplateSchema} as:
+*  - `{{detections}}` — total over the reported classes
+*  - `{{detectionSummary}}` — `2 persone, 1 veicolo`
+*  - `{{count_person}}` / `{{count_vehicle}}` / `{{count_animal}}` / … —
+*    one per class, `count_` + the class name
+*
+* With NO custom body template the summary is appended to the derived body, and
+* only when the total is non-zero: a nightly `0 rilevamenti` is a line nobody
+* reads. With a custom template the operator owns every word — nothing is
+* appended, so `{{detectionSummary}}` is how he asks for it.
+*/
+var ReportClassesField = array(string().min(1).max(40)).max(20);
+/**
 * Client-supplied timelapse-rule fields. The server stamps id / createdBy /
 * createdAt / updatedAt / ownerUserId / lastGeneratedAt — none of them appear
 * here (see the ownership note above).
@@ -32453,9 +32938,30 @@ var TimelapseRuleInputSchema = object({
 	cadenceSec: CadenceSecField.default(15),
 	/** Output frames per second of the assembled mp4 (predecessor parity). */
 	framerate: FramerateField.default(10),
+	/**
+	* Explicit dense cadence — see {@link DenseCadenceSecField}. Absent ⇒ derived
+	* as `max(1s, cadenceSec / 30)`, which is what every rule written before this
+	* field gets.
+	*/
+	denseCadenceSec: DenseCadenceSecField.optional(),
+	/** Output-seconds guarantee per detection range — see {@link MinDwellSecField}. */
+	minDwellSec: MinDwellSecField.optional(),
 	/** `notification-output` targets the finished video/thumbnail is sent to. */
 	targets: TargetsField,
 	template: TimelapseTemplateSchema.optional(),
+	/**
+	* Caption on the notification's PREVIEW FRAME — see {@link PreviewTextField}
+	* and {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}.
+	*
+	* Deliberately NOT part of {@link TimelapseTemplateSchema}: that object is
+	* the notification's title/body, and clearing it (`template: null`) must not
+	* silently clear the caption too.
+	*/
+	previewText: PreviewTextField.optional(),
+	/** Still or animation — see {@link PreviewModeField}. */
+	previewMode: PreviewModeField.default("image"),
+	/** Classes the notification counts — see {@link ReportClassesField}. */
+	reportClasses: ReportClassesField.optional(),
 	/** Canonical notification priority ordinal (1..5); per-target overridable. */
 	priority: PriorityField.default(3)
 });
@@ -32466,8 +32972,13 @@ object({
 	schedule: NcScheduleSchema.optional(),
 	cadenceSec: CadenceSecField.optional(),
 	framerate: FramerateField.optional(),
+	denseCadenceSec: DenseCadenceSecField.optional(),
+	minDwellSec: MinDwellSecField.optional(),
 	targets: TargetsField.optional(),
 	template: TimelapseTemplateSchema.nullable().optional(),
+	previewText: PreviewTextField.optional(),
+	previewMode: PreviewModeField.optional(),
+	reportClasses: ReportClassesField.optional(),
 	priority: PriorityField.optional()
 });
 TimelapseRuleInputSchema.extend({
@@ -32652,10 +33163,11 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 		h
 	};
 }
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
 var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -32682,25 +33194,32 @@ var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 */
 var NativeLeaseSettingsSchema = object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
+	*
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -32726,22 +33245,45 @@ var NativeLeaseSettingsSchema = object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
 * Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
@@ -32751,7 +33293,7 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 * precedence being true and being a lie. `addon-settings.getGlobalSettings`
 * returns a HYDRATED payload, and `hydrateField` fills an unstored field with
 * the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* opened the form still reports `nativeLeaseHoldFrames = 8`). A reader that took
 * that at face value would report all three knobs as "set" on every cluster on
 * the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
 * emergency override that the precedence promises. There is no raw-store read on
@@ -32785,25 +33327,28 @@ function readAdmissionKnob(raw) {
 * {@link readKnob} for why the default counts as unset.
 */
 function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const holdFrames = readKnob("holdFrames", config[NATIVE_LEASE_HOLD_KEY]);
 	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
 	return {
-		...ttlMs === null ? {} : { ttlMs },
+		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
+		...admission === null ? {} : { admission },
+		...tileBudgetMb === null ? {} : { tileBudgetMb }
 	};
 }
 function isHydratedField(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_HOLD_KEY,
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
+	NATIVE_LEASE_ADMISSION_KEY,
+	NATIVE_LEASE_TILE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an