@camstack/addon-post-analysis 1.2.275 → 1.2.276

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-Br0p61E2.js");
+const require_dist = require("../dist-BZaBVEUL.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -233,6 +233,434 @@ var MotionEpisodeTracker = class {
 	}
 };
 //#endregion
+//#region src/notification-center/alarm/alarm-mode-coverage.ts
+/**
+* Whether the panel just BECAME armed, in the sense a person means.
+*
+* Two transitions reach an `armed_*` state and only one of them is an arm:
+*
+*  - `arming`/`disarmed` → `armed_away` is somebody arming the alarm. Announce.
+*  - `triggered` → `armed_away` is the siren's duration ending and the panel
+*    re-arming itself. It is told too (D630), but as `alarm-rearmed`, never as
+*    an arm: "Away armed" in the middle of a break-in would read as somebody
+*    arming it. `alarmTransition` routes it there before asking this.
+*
+* `armed_home` → `armed_away` IS an arm: the operator changed mode, and the
+* set of devices covered just changed with it — which is the whole content of
+* the message.
+*
+* A null `previous` is the FIRST publish and never announces. A hub restarting
+* while armed re-publishes `armed_away`, and nobody armed anything — every
+* deploy would otherwise send one. Handled here rather than by the caller
+* happening to wire the hook late, because "it works because of the order two
+* unrelated things run in" is how this stops working.
+*/
+function shouldAnnounceArm(previous, next) {
+	if (previous === null) return false;
+	if (!next.startsWith("armed_")) return false;
+	if (previous === next) return false;
+	if (previous === "triggered") return false;
+	return true;
+}
+/** The mode inside an `armed_<mode>` state, or null for any other state. */
+function armModeOf(state, modes) {
+	for (const mode of modes) if (state === armedStateFor(mode)) return mode;
+	return null;
+}
+/** The `deviceState` word a rule must gate on for `mode` to cover it. */
+function armedStateFor(mode) {
+	return `armed_${mode}`;
+}
+/**
+* One entry per mode the panel offers, including modes nothing is gated on.
+*
+* Empty modes are KEPT rather than filtered: "Night arms nothing" is the single
+* most useful thing this can tell an operator, and a list that omits it looks
+* identical to a list where night is covered.
+*/
+function alarmModeCoverage(rules, panelDeviceId, modes, skipProbe) {
+	return modes.map((mode) => coverageFor(rules, panelDeviceId, mode, skipProbe));
+}
+function coverageFor(rules, panelDeviceId, mode, skipProbe) {
+	const wanted = armedStateFor(mode);
+	const ids = /* @__PURE__ */ new Set();
+	let ruleCount = 0;
+	let allDevices = false;
+	for (const rule of rules) {
+		if (!rule.enabled) continue;
+		const gate = rule.conditions.deviceState;
+		if (gate === void 0 || gate.deviceId !== panelDeviceId) continue;
+		if (!gate.states.includes(wanted)) continue;
+		ruleCount += 1;
+		const scope = rule.conditions.devices;
+		if (scope === void 0 || scope.length === 0) {
+			allDevices = true;
+			continue;
+		}
+		for (const id of scope) ids.add(id);
+	}
+	const deviceIds = [...ids].toSorted((a, b) => a - b);
+	return {
+		mode,
+		ruleCount,
+		allDevices,
+		deviceIds,
+		skippedDevices: skippedFor(deviceIds, skipProbe)
+	};
+}
+function skippedFor(deviceIds, skipProbe) {
+	if (skipProbe === void 0) return [];
+	const out = [];
+	for (const deviceId of deviceIds) {
+		const reason = skipProbe(deviceId);
+		if (reason !== void 0) out.push({
+			deviceId,
+			reason
+		});
+	}
+	return out;
+}
+/**
+* Whether this mode arms anything, and if not, which way it fails.
+*
+* An `allDevices` mode is never a gap: `skippedDevices` only ever probes the
+* ids a rule wrote down, so it cannot answer for a mode that covers every
+* camera on the hub, and reporting "all excluded" from a subset would be a
+* warning about protection that exists.
+*/
+function alarmCoverageGap(coverage) {
+	if (coverage.ruleCount === 0) return "uncovered";
+	if (coverage.allDevices) return null;
+	if (coverage.deviceIds.length === 0) return null;
+	if (coverage.skippedDevices.length < coverage.deviceIds.length) return null;
+	return "all-skipped";
+}
+/**
+* "Attivi: Cancello, Garage — Esclusi: Porta retro."
+*
+* A LIST, not a sentence. The mode is in the title and the body is one
+* `Label: names` line per device group, because this is read on a lock screen
+* and the question is always "which one" — the prose version ("3 dispositivi
+* attivi: …. Esclusi: ….") made the operator parse a paragraph to find a
+* window. Each variant still owns its own catalog key, so the Texts tab can
+* re-word "nothing is armed" without touching "these are armed".
+*
+* Names, not ids: this is read by a person standing at a door. An id that has
+* no name falls back to a NAMED, translated placeholder rather than being
+* dropped — a silently shorter list would understate what is armed, which is
+* the one error this message must not make. (It used to hard-code the English
+* `Device <id>` into both languages.)
+*
+* **Always a sentence.** It used to return null for a mode no rule is gated on,
+* on the grounds that "Night armed" followed by an unwatched night is a false
+* assurance — true, but the caller then emitted `alarm-armed` anyway with a
+* fallback body key that existed in NEITHER locale, so the operator received a
+* title and an empty line. Silence is not the third option here: SAYING that
+* the mode arms nothing is.
+*/
+function buildArmAnnouncement(coverage, deviceName, bypassed = []) {
+	const rules = `${coverage.ruleCount}`;
+	const mode = coverage.mode;
+	if (bypassed.length > 0) return armedWithBypass(coverage, bypassed, deviceName);
+	const gap = alarmCoverageGap(coverage);
+	if (gap === "uncovered") return {
+		bodyKey: "alarm.arm.body.uncovered",
+		textParams: { mode },
+		textCount: 0
+	};
+	if (gap === "all-skipped") {
+		const names = coverage.skippedDevices.map((s) => deviceName(s.deviceId));
+		return {
+			bodyKey: "alarm.arm.body.allSkipped",
+			textParams: {
+				rules,
+				mode,
+				devices: `${names.length}`,
+				names: names.join(", ")
+			},
+			textCount: names.length
+		};
+	}
+	if (coverage.allDevices) return {
+		bodyKey: "alarm.arm.body.allDevices",
+		textParams: {
+			rules,
+			mode
+		},
+		textCount: coverage.ruleCount
+	};
+	if (coverage.deviceIds.length === 0) return {
+		bodyKey: "alarm.arm.body.noDevices",
+		textParams: {
+			rules,
+			mode
+		},
+		textCount: coverage.ruleCount
+	};
+	const skipped = new Set(coverage.skippedDevices.map((s) => s.deviceId));
+	const names = coverage.deviceIds.filter((id) => !skipped.has(id)).map(deviceName);
+	if (skipped.size === 0) return {
+		bodyKey: "alarm.arm.body.devices",
+		textParams: {
+			rules,
+			mode,
+			devices: `${names.length}`,
+			names: names.join(", ")
+		},
+		textCount: names.length
+	};
+	return {
+		bodyKey: "alarm.arm.body.devicesSkipped",
+		textParams: {
+			rules,
+			mode,
+			devices: `${names.length}`,
+			names: names.join(", "),
+			skippedNames: coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ")
+		},
+		textCount: names.length
+	};
+}
+/**
+* "Attivi: 2 — Bypassati: Finestra veranda."
+*
+* The bypassed sensors are named and the armed ones are COUNTED, not listed:
+* this sentence's subject is the exception, and burying it under thirteen
+* camera names is how an operator stops reading the arm notification. The
+* count pluralises on what IS armed, like every other arm variant.
+*/
+function armedWithBypass(coverage, bypassed, deviceName) {
+	const skipped = new Set(coverage.skippedDevices.map((s) => s.deviceId));
+	const excluded = new Set(bypassed);
+	const armed = coverage.allDevices ? coverage.ruleCount : coverage.deviceIds.filter((id) => !skipped.has(id) && !excluded.has(id)).length;
+	return {
+		bodyKey: "alarm.arm.body.bypassed",
+		textParams: {
+			rules: `${coverage.ruleCount}`,
+			mode: coverage.mode,
+			devices: `${armed}`,
+			bypassedNames: bypassed.map(deviceName).join(", ")
+		},
+		textCount: armed
+	};
+}
+/**
+* "Aperti: Finestra veranda, Porta retro" + where the Arm anyway is.
+*
+* The one alarm sentence about something that did not happen, so it has to
+* carry both halves an operator needs to act: WHICH devices are open, and —
+* when the notification carries the button — that its Arm anyway arms without
+* them (D630: pressing arm again is refused again; there is no second-press
+* bypass any more, so the sentence never says "repeat within N seconds").
+* Naming them is the whole message, so the names are the FIRST line.
+*/
+function buildArmRefusedAnnouncement(mode, names, withArmAnyway) {
+	return {
+		bodyKey: withArmAnyway ? "alarm.armRefused.body.hint" : "alarm.armRefused.body",
+		textParams: {
+			mode,
+			devices: `${names.length}`,
+			names: names.join(", ")
+		},
+		textCount: names.length
+	};
+}
+/**
+* The EXCEPTIONS to the same coverage, said 30 seconds earlier.
+*
+* The exit-delay sentence is deliberately SHORTER than the arm one — it is read
+* on the way out of a door — and it carries exactly one thing the arm sentence
+* cannot: the warning arrives while the operator can still disarm and fix it.
+* A mode that arms nothing is worth interrupting somebody for at second 0 and
+* merely worth recording at second 30.
+*
+* **It never repeats the device list.** The countdown lives in the TITLE
+* (`system.alarm-arming.title.<mode>` renders `{{seconds}}`), and the armed
+* list arrives thirty seconds later in the arm announcement — printing it
+* twice is the verbosity that made the operator stop reading both. So the body
+* is what is WRONG: what was bypassed, what is excluded, or that nothing is.
+*
+* `seconds` stays in the params because the title asks for it, and `textCount`
+* stays with it: a row enqueued before this deploy still pluralises on the
+* countdown it was written for.
+*/
+function buildArmingAnnouncement(coverage, seconds, deviceName, bypassed = []) {
+	const textParams = {
+		mode: coverage.mode,
+		seconds: `${seconds}`
+	};
+	if (bypassed.length > 0) return {
+		bodyKey: "alarm.arming.body.bypassed",
+		textParams: {
+			...textParams,
+			bypassedNames: bypassed.map(deviceName).join(", ")
+		},
+		textCount: seconds
+	};
+	const skippedNames = coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ");
+	const gap = alarmCoverageGap(coverage);
+	if (gap === "uncovered") return {
+		bodyKey: "alarm.arming.body.uncovered",
+		textParams,
+		textCount: seconds
+	};
+	if (gap === "all-skipped") return {
+		bodyKey: "alarm.arming.body.allSkipped",
+		textParams: {
+			...textParams,
+			names: skippedNames
+		},
+		textCount: seconds
+	};
+	if (coverage.skippedDevices.length > 0) return {
+		bodyKey: "alarm.arming.body.skipped",
+		textParams: {
+			...textParams,
+			names: skippedNames
+		},
+		textCount: coverage.skippedDevices.length
+	};
+	return {
+		bodyKey: "alarm.arming.body",
+		textParams,
+		textCount: seconds
+	};
+}
+//#endregion
+//#region src/notification-center/alarm/alarm-arm-guard.ts
+/**
+* How long an Arm anyway stays pressable — the panel's refusal and the
+* button's grant TTL (`action-token.ts`) use this one constant. It lives here,
+* with the arm decision, so the token module does not import the device.
+*/
+var ARM_ANYWAY_TTL_MS = 5 * 6e4;
+/**
+* One covered device that reads OPEN, with the name a person will read and the
+* word its cap reported (`open`, `stopped`, `unlocked`, …) — not only contacts:
+* a cover or a lock that is not secure is an opening too (D630).
+*/
+var NcAlarmOpenDeviceSchema = require_dist.object({
+	deviceId: require_dist.number().int(),
+	name: require_dist.string(),
+	state: require_dist.string()
+}).readonly();
+/** Why an Arm anyway was not honoured — see `NcAlarmPanelDevice.armAnyway`. */
+var NcAlarmArmAnywayRejectionSchema = require_dist._enum([
+	"unknown-refusal",
+	"stale",
+	"expired",
+	"used"
+]);
+/**
+* What one arm attempt — plain or Arm anyway — came to.
+*
+* A schema, and it lives HERE, in the addon, because it is the response of the
+* `nc.armAlarm` / `nc.armAlarmAnyway` BRIDGE actions: the bridge validates
+* against the addon's own copy, so a refusal can travel as a result (its id and
+* the names of what is open) and the viewer can offer the Arm anyway bound to
+* it. The cap cannot: `alarm-panel.arm` answers `z.void()` on the HOST's router,
+* which is why the cap throws {@link NcAlarmArmRefusedError} instead.
+*/
+var NcAlarmArmOutcomeSchema = require_dist.discriminatedUnion("outcome", [
+	require_dist.object({
+		outcome: require_dist._enum(["armed", "arming"]),
+		excluded: require_dist.array(NcAlarmOpenDeviceSchema).readonly()
+	}).readonly(),
+	require_dist.object({
+		outcome: require_dist.literal("refused"),
+		refusalId: require_dist.string(),
+		blocking: require_dist.array(NcAlarmOpenDeviceSchema).readonly()
+	}).readonly(),
+	require_dist.object({
+		outcome: require_dist.literal("rejected"),
+		reason: NcAlarmArmAnywayRejectionSchema
+	}).readonly()
+]);
+/**
+* The devices a mode covers, ascending and de-duplicated.
+*
+* A rule qualifies when it is enabled and gated on THIS panel in THIS mode;
+* every device it names is covered, whatever its kind. A camera it names is
+* covered too, and is simply never an opening (`alarmOpeningFrom` answers
+* `not-opening` for it, and the arm check skips it without a word).
+*
+* A rule with NO device scope contributes nothing: it covers every device on
+* the hub, and blocking on a set the operator never wrote down produces a
+* refusal naming devices they never associated with the alarm. The caller says
+* so in a log line rather than inventing the list.
+*/
+function alarmCoveredDevices(rules, panelDeviceId, mode) {
+	const wanted = armedStateFor(mode);
+	const ids = /* @__PURE__ */ new Set();
+	for (const rule of rules) {
+		if (!rule.enabled) continue;
+		const gate = rule.conditions.deviceState;
+		if (gate === void 0 || gate.deviceId !== panelDeviceId) continue;
+		if (!gate.states.includes(wanted)) continue;
+		const scope = rule.conditions.devices;
+		if (scope === void 0 || scope.length === 0) continue;
+		for (const id of scope) ids.add(id);
+	}
+	return [...ids].toSorted((a, b) => a - b);
+}
+/**
+* Refuse or arm — the whole decision, as one partition of the open devices.
+*
+* A device may be open at arm time for exactly two reasons: the mode TOLERATES
+* it (its non-blocking list), or the operator was shown it in a refusal and
+* pressed that refusal's Arm anyway (`acknowledged`). Anything else open
+* refuses — including a device that opened AFTER the refusal the operator is
+* confirming: they were never shown it, and excluding it would arm the alarm
+* around an opening nobody agreed to.
+*
+* There is no memory here. A plain arm pressed twice is the same question
+* twice and gets the same answer; the only way past a refusal is the explicit
+* Arm anyway, whose lifecycle (one-shot, stale, expired) the panel owns.
+*
+* Excluded is EVERY open device — tolerated and acknowledged alike — and the
+* exclusion is two-phase (`alarm-exclusions.ts`): each one is watched again
+* once it has closed and opened.
+*/
+function decideArm(input) {
+	const tolerated = new Set([...input.nonBlocking, ...input.acknowledged ?? []]);
+	const blocking = input.open.filter((d) => !tolerated.has(d.deviceId));
+	if (blocking.length > 0) return {
+		kind: "refused",
+		blocking
+	};
+	return {
+		kind: "arm",
+		excluded: input.open
+	};
+}
+/**
+* The error `alarmPanel.arm` throws when it refuses.
+*
+* A THROW and not a return value, and the reason is a train: the hub's
+* generated router validates this method's response against the HOST's copy of
+* the cap, which says `z.void()`. An addon that answered a structured refusal
+* would have it rejected by the router in front of it — so the refusal reaches
+* the caller as the one channel that already works across that boundary, and
+* the operator's PHONE gets the sentence (`alarm-arm-refused`, through the
+* ordinary outbox, with its own Arm anyway) rather than a UI error being the
+* only trace.
+*
+* The message is deliberately actionable and English (an exception message is
+* a developer/API surface; the notification is the operator's).
+*/
+var NcAlarmArmRefusedError = class extends Error {
+	code = "alarm-arm-refused";
+	mode;
+	blocking;
+	constructor(input) {
+		const names = input.blocking.map((d) => d.name).join(", ");
+		super(`arm refused — open: ${names}. Use "Arm anyway" to arm with them excluded.`);
+		this.name = "NcAlarmArmRefusedError";
+		this.mode = input.mode;
+		this.blocking = input.blocking;
+	}
+};
+//#endregion
 //#region src/notification-center/action-token.ts
 /**
 * The authority behind a notification button.
@@ -263,6 +691,18 @@ var MotionEpisodeTracker = class {
 *    accepted: a deploy kills the buttons on notifications already delivered,
 *    which with a short TTL were nearly dead anyway.
 */
+/**
+* A granted action that ran and was REFUSED for a reason the person holding
+* the phone can act on — "the alarm changed since this notification". Its
+* message is shown on the page the tap lands on; any other throw stays the
+* generic "it did not work".
+*/
+var NcActionRefusedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "NcActionRefusedError";
+	}
+};
 /** Sign `(id, exp)` — the exact string the verifier recomputes. Same shape as
 *  the artifact plane's, deliberately: one signing convention in this addon. */
 function signActionToken(secret, id, expMs) {
@@ -328,7 +768,9 @@ var ALARM_DISARM_TTL_MS = 5 * 6e4;
 function actionTtlMs(subject) {
 	switch (subject.kind) {
 		case "snooze": return SNOOZE_ACTION_TTL_MS;
-		case "alarm": return subject.action === "disarm" ? ALARM_DISARM_TTL_MS : DEFAULT_ACTION_TTL_MS;
+		case "alarm":
+			if (subject.action === "arm-anyway") return ARM_ANYWAY_TTL_MS;
+			return subject.action === "disarm" ? ALARM_DISARM_TTL_MS : DEFAULT_ACTION_TTL_MS;
 		case "sequence": return DEFAULT_ACTION_TTL_MS;
 		case "addon-update": return DEFAULT_ACTION_TTL_MS;
 		case "server-update": return DEFAULT_ACTION_TTL_MS;
@@ -410,7 +852,9 @@ function describeGrant(grant) {
 	switch (grant.kind) {
 		case "sequence": return `${grant.ruleName} — ${grant.sequence}`;
 		case "snooze": return grant.classes === void 0 || grant.classes.length === 0 ? `Silenced for ${grant.minutes} min` : `Silenced for ${grant.minutes} min — ${grant.classes.join(", ")}`;
-		case "alarm": return grant.action === "disarm" ? "Alarm disarmed" : `Alarm armed${grant.mode !== void 0 ? ` (${grant.mode})` : ""}`;
+		case "alarm":
+			if (grant.action === "arm-anyway") return "Alarm armed, around the open devices";
+			return grant.action === "disarm" ? "Alarm disarmed" : `Alarm armed${grant.mode !== void 0 ? ` (${grant.mode})` : ""}`;
 		case "addon-update": return `${grant.packages.length} addon update(s) on ${grant.nodeId}`;
 		case "server-update": return `Server update on ${grant.nodeId}`;
 	}
@@ -437,7 +881,12 @@ function grantMeta(grant) {
 			minutes: grant.minutes,
 			classes: grant.classes ?? null
 		};
-		case "alarm": return {
+		case "alarm": return grant.action === "arm-anyway" ? {
+			...common,
+			alarm: grant.action,
+			refusalId: grant.refusalId,
+			panelDeviceId: grant.panelDeviceId
+		} : {
 			...common,
 			alarm: grant.action,
 			mode: grant.mode ?? null,
@@ -507,6 +956,18 @@ var NcActionPlane = class {
 			});
 			this.reply(res, background, 200, "Done", describeGrant(grant));
 		} catch (err) {
+			if (err instanceof NcActionRefusedError) {
+				this.deps.logger.info("nc action refused after the token was spent", {
+					tags: { deviceId: grant.deviceId },
+					meta: {
+						kind: grant.kind,
+						...grantMeta(grant),
+						reason: err.message
+					}
+				});
+				this.reply(res, background, 200, "Nothing was done", err.message);
+				return;
+			}
 			this.deps.logger.warn("nc action failed after the token was spent", {
 				tags: { deviceId: grant.deviceId },
 				meta: {
@@ -536,6 +997,334 @@ var NcActionPlane = class {
 	}
 };
 //#endregion
+//#region src/notification-center/alarm/alarm-openings.ts
+/**
+* What "open" means to the alarm — D630's table, in one place.
+*
+* Read from the RAW runtime slices, not from the collapsed `deviceState`
+* word: the collapse is first-match over every cap, so it cannot say whether a
+* device is an opening at all, and a camera and an unreadable window would both
+* come back `undefined`.
+*
+* Three answers, never two (D49 — an unreadable state is unknown, never closed
+* and never open):
+*
+*  - `not-opening` — no opening slice at all: a camera named by an intrusion
+*    rule, a switch. It takes no part in the arm decision.
+*  - `unknown` — an opening cap's slice IS there, but its field is missing or
+*    is not a word that cap defines, or the slice is a provider's PLACEHOLDER
+*    (`lastChangedAt === 0`: written by a constructor before anybody read the
+*    device — an HA lock's `unlocked`, an HA cover's `closed`, a binary
+*    sensor's `entryOpen: false`). It carries the cap and the raw value (for a
+*    placeholder, the whole slice) so the caller's log line can say what it
+*    saw. It never blocks and is never armed as secure on a guess — and a
+*    placeholder is never taken for a state, so neither the reconcile tick,
+*    the arm check nor an exclusion lift acts on one.
+*  - `reading` — open or secure, with the state word a person will read.
+*    ANY non-zero `lastChangedAt` is a reading, however old — including `1`,
+*    the stamp a provider writes on a value it REPLAYED after a respawn with
+*    no upstream change time (Homematic `HM_SEEDED_CHANGED_AT`): the value is
+*    known, only its change time is not. The transition gate
+*    (`sensor-transition-gate.ts`, "A placeholder slice is not a state") reads
+*    the same stamp as "not a fresh event"; `0` alone means "not read yet".
+*
+* A read that FAILED never reaches {@link alarmOpeningFrom}: the caller leaves
+* that id out of its answer (see {@link readAlarmOpenings}).
+*
+* Anything short of fully secure is open: a cover stopped half-way, a lock that
+* jammed, a cover still closing when the arm is decided.
+*
+* PRECEDENCE, when one device carries more than one opening slice: `contact`
+* first, then `cover`, then `lock-control`. The contact is the physical truth
+* about the opening — a reed switch on the frame says the window is open even
+* when the motor's last reported word says `closed`. A slice that cannot be
+* read falls through to the next; only when none of them reads is the device
+* `unknown`, naming the first unreadable cap.
+*
+* The vocabulary of each word is its cap's own schema (`CoverStateSchema`,
+* `LockStateSchema`) — a word the cap does not define is not guessed at.
+*/
+/** The one state word, per cap, that counts as secure. Everything else is open. */
+var COVER_SECURE = "closed";
+var LOCK_SECURE = "locked";
+var NOT_OPENING = { kind: "not-opening" };
+function sliceOf(runtime, cap) {
+	const slice = runtime[cap];
+	if (slice === void 0) return void 0;
+	return slice !== null && typeof slice === "object" ? slice : null;
+}
+function fieldOf(slice, field) {
+	if (slice === null) return void 0;
+	return Object.entries(slice).find(([key]) => key === field)?.[1];
+}
+/** A provider's cold placeholder: nobody has read the device yet (D49 ⇒ unknown). */
+function isPlaceholder(slice) {
+	return fieldOf(slice, "lastChangedAt") === 0;
+}
+function reading(word, secure) {
+	return {
+		kind: "reading",
+		reading: word === secure ? "secure" : "open",
+		state: word
+	};
+}
+function readContact(runtime) {
+	const slice = sliceOf(runtime, "contact");
+	if (slice === void 0) return { kind: "absent" };
+	if (isPlaceholder(slice)) return {
+		kind: "unknown",
+		cap: "contact",
+		raw: slice
+	};
+	const raw = fieldOf(slice, "entryOpen");
+	if (typeof raw !== "boolean") return {
+		kind: "unknown",
+		cap: "contact",
+		raw
+	};
+	return raw ? {
+		kind: "reading",
+		reading: "open",
+		state: "open"
+	} : {
+		kind: "reading",
+		reading: "secure",
+		state: "closed"
+	};
+}
+function readCover(runtime) {
+	const slice = sliceOf(runtime, "cover");
+	if (slice === void 0) return { kind: "absent" };
+	if (isPlaceholder(slice)) return {
+		kind: "unknown",
+		cap: "cover",
+		raw: slice
+	};
+	const raw = fieldOf(slice, "state");
+	const parsed = require_dist.CoverStateSchema.safeParse(raw);
+	return parsed.success ? reading(parsed.data, COVER_SECURE) : {
+		kind: "unknown",
+		cap: "cover",
+		raw
+	};
+}
+function readLock(runtime) {
+	const slice = sliceOf(runtime, "lock-control");
+	if (slice === void 0) return { kind: "absent" };
+	if (isPlaceholder(slice)) return {
+		kind: "unknown",
+		cap: "lock-control",
+		raw: slice
+	};
+	const raw = fieldOf(slice, "state");
+	const parsed = require_dist.LockStateSchema.safeParse(raw);
+	return parsed.success ? reading(parsed.data, LOCK_SECURE) : {
+		kind: "unknown",
+		cap: "lock-control",
+		raw
+	};
+}
+/** D630's table over one device's runtime slices — see the header for the three answers. */
+function alarmOpeningFrom(runtime) {
+	let firstUnknown = null;
+	for (const read of [
+		readContact(runtime),
+		readCover(runtime),
+		readLock(runtime)
+	]) {
+		if (read.kind === "reading") return read;
+		if (read.kind === "unknown" && firstUnknown === null) firstUnknown = read;
+	}
+	return firstUnknown ?? NOT_OPENING;
+}
+/**
+* The sensor-event kind (`CAP_TO_KIND` in `@camstack/types`) → the cap whose
+* slice the row's `value` is. Only the opening kinds; every other kind is not
+* an opening.
+*/
+var OPENING_CAP_BY_EVENT_KIND = {
+	contact: "contact",
+	cover: "cover",
+	lock: "lock-control"
+};
+/**
+* The same table, read off one sensor-event row: its `value` IS the slice of
+* the cap its `kind` names, so the event path and the reconcile read answer in
+* one vocabulary — a cover is secure only when `closed`, a lock only when
+* `locked`, whichever path saw it.
+*/
+function alarmOpeningFromSensorEvent(kind, value) {
+	const cap = OPENING_CAP_BY_EVENT_KIND[kind];
+	if (cap === void 0) return NOT_OPENING;
+	return alarmOpeningFrom({ [cap]: value });
+}
+function classifyCoveredOpening(opening) {
+	if (opening === void 0) return {
+		kind: "unknown",
+		why: "read-failed"
+	};
+	if (opening.kind === "unknown") return {
+		kind: "unknown",
+		why: "unknown-word",
+		cap: opening.cap,
+		raw: opening.raw
+	};
+	if (opening.kind === "not-opening" || opening.reading !== "open") return { kind: "skip" };
+	return {
+		kind: "open",
+		state: opening.state
+	};
+}
+/**
+* An `unknown` opening's `raw`, for a log line: a placeholder carries the whole
+* slice, which `String()` would flatten to `[object Object]`.
+*/
+function rawForLog(raw) {
+	return raw !== null && typeof raw === "object" ? JSON.stringify(raw) : String(raw);
+}
+/** How many runtime reads `readAlarmOpenings` keeps in flight at once. */
+var OPENINGS_READ_CONCURRENCY = 8;
+/**
+* The Notification Center's `readDeviceOpenings` dep, given the one runtime
+* read it needs. Every id that could be read is present with its
+* {@link NcAlarmOpening}; an id whose read THREW is ABSENT (unknown, D49) and
+* leaves one debug line tagged with its `deviceId`.
+*/
+async function readAlarmOpenings(ids, loadRuntime, logger) {
+	const out = /* @__PURE__ */ new Map();
+	const readOne = async (id) => {
+		try {
+			out.set(id, alarmOpeningFrom(await loadRuntime(id)));
+		} catch (err) {
+			logger.debug("device-opening read failed", {
+				tags: { deviceId: id },
+				meta: { error: String(err) }
+			});
+		}
+	};
+	for (let i = 0; i < ids.length; i += OPENINGS_READ_CONCURRENCY) await Promise.all(ids.slice(i, i + OPENINGS_READ_CONCURRENCY).map(readOne));
+	return out;
+}
+//#endregion
+//#region src/notification-center/alarm/alarm-exclusions.ts
+function isPhase(value) {
+	return value === "open" || value === "closed";
+}
+var NcAlarmExclusions = class {
+	entries = [];
+	/** Replace the whole set — one arm, one set of exclusions. */
+	exclude(deviceIds, at) {
+		this.entries = [...new Set(deviceIds)].map((deviceId) => ({
+			deviceId,
+			phase: "open",
+			at,
+			announced: false
+		}));
+	}
+	/** Every excluded sensor, in the order it was excluded. */
+	list() {
+		return this.entries.map((e) => e.deviceId);
+	}
+	/** True while this sensor's events must not reach the panel. */
+	blocks(deviceId) {
+		return this.entries.some((e) => e.deviceId === deviceId);
+	}
+	/**
+	* Feed one opening's reading, and say what it CHANGED.
+	*
+	* Three answers, not two, because the caller has to persist on both of the
+	* changes: the first `alarm-arm-refusal.spec.ts` run of this feature saved
+	* only the re-arm, so a hub redeployed between the close and the re-open came
+	* back with the sensor still in phase `open` — and the exclusion then needed
+	* a SECOND close to lift. A phase that lives only in RAM is half a durable
+	* exclusion.
+	*
+	* An unreadable state changes nothing (D49): a failed read must never lift an
+	* exclusion the operator asked for, and must never swallow the close that
+	* would have.
+	*/
+	observe(deviceId, reading, _at) {
+		if (reading === void 0) return "unchanged";
+		const current = this.entries.find((e) => e.deviceId === deviceId);
+		if (current === void 0) return "unchanged";
+		if (reading === "secure") {
+			if (current.phase === "closed") return "unchanged";
+			this.entries = this.entries.map((e) => e.deviceId === deviceId ? {
+				...e,
+				phase: "closed"
+			} : e);
+			return "closed";
+		}
+		if (current.phase === "open") return "unchanged";
+		this.entries = this.entries.filter((e) => e.deviceId !== deviceId);
+		return "rearmed";
+	}
+	/**
+	* Mark this sensor's ignored trigger as announced — true only the FIRST time
+	* in this arm (the caller then announces and persists), false for a repeat
+	* or for a sensor that is not excluded.
+	*/
+	markAnnounced(deviceId) {
+		const current = this.entries.find((e) => e.deviceId === deviceId);
+		if (current === void 0 || current.announced) return false;
+		this.entries = this.entries.map((e) => e.deviceId === deviceId ? {
+			...e,
+			announced: true
+		} : e);
+		return true;
+	}
+	/** The arm this belongs to is over. */
+	clear() {
+		this.entries = [];
+	}
+	/** What to persist. Plain data — it rides the panel's config blob. */
+	snapshot() {
+		return this.entries.map((e) => ({
+			deviceId: e.deviceId,
+			phase: e.phase,
+			at: e.at,
+			announced: e.announced
+		}));
+	}
+	/**
+	* Rebuild from the persisted blob — a GUARD, never a cast.
+	*
+	* Anything unrecognised restores NOTHING, which is the failure that shows
+	* itself (a bypassed sensor that fires) rather than the one that hides (a
+	* sensor excluded forever by a blob nobody can read). A bare id with no phase
+	* restores as still-OPEN: it needs a close before it can re-arm, which is the
+	* half that cannot cause a false alarm.
+	*/
+	restore(raw) {
+		if (!Array.isArray(raw)) return;
+		const out = [];
+		for (const item of raw) {
+			if (typeof item === "number" && Number.isInteger(item)) {
+				out.push({
+					deviceId: item,
+					phase: "open",
+					at: 0,
+					announced: false
+				});
+				continue;
+			}
+			if (item === null || typeof item !== "object") continue;
+			const rec = { ...item };
+			const deviceId = rec["deviceId"];
+			if (typeof deviceId !== "number" || !Number.isInteger(deviceId)) continue;
+			const phase = isPhase(rec["phase"]) ? rec["phase"] : "open";
+			const at = typeof rec["at"] === "number" ? rec["at"] : 0;
+			out.push({
+				deviceId,
+				phase,
+				at,
+				announced: rec["announced"] === true
+			});
+		}
+		this.entries = out;
+	}
+};
+//#endregion
 //#region src/notification-center/alarm/alarm-state-machine.ts
 /**
 * Defaults an operator can change per panel. `home` has no exit delay on
@@ -591,6 +1380,19 @@ function exitDelayAt(m, now) {
 		armedAt: m.armedAt
 	};
 }
+/**
+* The entry delay running at `now`, or `undefined` when none is. Gated on
+* `stateAt`, like {@link exitDelayAt}: `triggerAt` survives on the machine
+* after the siren sounds, until a settle drops it.
+*/
+function pendingAt(m, now) {
+	if (m.triggerAt === void 0) return void 0;
+	if (stateAt(m, now) !== "pending") return void 0;
+	return {
+		target: m.target,
+		triggerAt: m.triggerAt
+	};
+}
 /** Whether the panel is armed enough for a trigger to matter. */
 function isArmed(m, now) {
 	const s = stateAt(m, now);
@@ -683,512 +1485,6 @@ function settle(m, now) {
 	};
 	return m;
 }
-//#endregion
-//#region src/notification-center/alarm/alarm-mode-coverage.ts
-/**
-* Whether the panel just BECAME armed, in the sense a person means.
-*
-* Two transitions reach an `armed_*` state and only one of them is an arm:
-*
-*  - `arming`/`disarmed` → `armed_away` is somebody arming the alarm. Announce.
-*  - `triggered` → `armed_away` is the siren's duration ending and the panel
-*    re-arming itself. Announcing it would send "Away armed" in the middle of
-*    a break-in, seconds after the alarm notification, saying nothing new.
-*
-* `armed_home` → `armed_away` IS an arm: the operator changed mode, and the
-* set of devices covered just changed with it — which is the whole content of
-* the message.
-*
-* A null `previous` is the FIRST publish and never announces. A hub restarting
-* while armed re-publishes `armed_away`, and nobody armed anything — every
-* deploy would otherwise send one. Handled here rather than by the caller
-* happening to wire the hook late, because "it works because of the order two
-* unrelated things run in" is how this stops working.
-*/
-function shouldAnnounceArm(previous, next) {
-	if (previous === null) return false;
-	if (!next.startsWith("armed_")) return false;
-	if (previous === next) return false;
-	if (previous === "triggered") return false;
-	return true;
-}
-/** The mode inside an `armed_<mode>` state, or null for any other state. */
-function armModeOf(state, modes) {
-	for (const mode of modes) if (state === armedStateFor(mode)) return mode;
-	return null;
-}
-/** The `deviceState` word a rule must gate on for `mode` to cover it. */
-function armedStateFor(mode) {
-	return `armed_${mode}`;
-}
-/**
-* One entry per mode the panel offers, including modes nothing is gated on.
-*
-* Empty modes are KEPT rather than filtered: "Night arms nothing" is the single
-* most useful thing this can tell an operator, and a list that omits it looks
-* identical to a list where night is covered.
-*/
-function alarmModeCoverage(rules, panelDeviceId, modes, skipProbe) {
-	return modes.map((mode) => coverageFor(rules, panelDeviceId, mode, skipProbe));
-}
-function coverageFor(rules, panelDeviceId, mode, skipProbe) {
-	const wanted = armedStateFor(mode);
-	const ids = /* @__PURE__ */ new Set();
-	let ruleCount = 0;
-	let allDevices = false;
-	for (const rule of rules) {
-		if (!rule.enabled) continue;
-		const gate = rule.conditions.deviceState;
-		if (gate === void 0 || gate.deviceId !== panelDeviceId) continue;
-		if (!gate.states.includes(wanted)) continue;
-		ruleCount += 1;
-		const scope = rule.conditions.devices;
-		if (scope === void 0 || scope.length === 0) {
-			allDevices = true;
-			continue;
-		}
-		for (const id of scope) ids.add(id);
-	}
-	const deviceIds = [...ids].toSorted((a, b) => a - b);
-	return {
-		mode,
-		ruleCount,
-		allDevices,
-		deviceIds,
-		skippedDevices: skippedFor(deviceIds, skipProbe)
-	};
-}
-function skippedFor(deviceIds, skipProbe) {
-	if (skipProbe === void 0) return [];
-	const out = [];
-	for (const deviceId of deviceIds) {
-		const reason = skipProbe(deviceId);
-		if (reason !== void 0) out.push({
-			deviceId,
-			reason
-		});
-	}
-	return out;
-}
-/**
-* Whether this mode arms anything, and if not, which way it fails.
-*
-* An `allDevices` mode is never a gap: `skippedDevices` only ever probes the
-* ids a rule wrote down, so it cannot answer for a mode that covers every
-* camera on the hub, and reporting "all excluded" from a subset would be a
-* warning about protection that exists.
-*/
-function alarmCoverageGap(coverage) {
-	if (coverage.ruleCount === 0) return "uncovered";
-	if (coverage.allDevices) return null;
-	if (coverage.deviceIds.length === 0) return null;
-	if (coverage.skippedDevices.length < coverage.deviceIds.length) return null;
-	return "all-skipped";
-}
-/**
-* "Attivi: Cancello, Garage — Esclusi: Porta retro."
-*
-* A LIST, not a sentence. The mode is in the title and the body is one
-* `Label: names` line per device group, because this is read on a lock screen
-* and the question is always "which one" — the prose version ("3 dispositivi
-* attivi: …. Esclusi: ….") made the operator parse a paragraph to find a
-* window. Each variant still owns its own catalog key, so the Texts tab can
-* re-word "nothing is armed" without touching "these are armed".
-*
-* Names, not ids: this is read by a person standing at a door. An id that has
-* no name falls back to a NAMED, translated placeholder rather than being
-* dropped — a silently shorter list would understate what is armed, which is
-* the one error this message must not make. (It used to hard-code the English
-* `Device <id>` into both languages.)
-*
-* **Always a sentence.** It used to return null for a mode no rule is gated on,
-* on the grounds that "Night armed" followed by an unwatched night is a false
-* assurance — true, but the caller then emitted `alarm-armed` anyway with a
-* fallback body key that existed in NEITHER locale, so the operator received a
-* title and an empty line. Silence is not the third option here: SAYING that
-* the mode arms nothing is.
-*/
-function buildArmAnnouncement(coverage, deviceName, bypassed = []) {
-	const rules = `${coverage.ruleCount}`;
-	const mode = coverage.mode;
-	if (bypassed.length > 0) return armedWithBypass(coverage, bypassed, deviceName);
-	const gap = alarmCoverageGap(coverage);
-	if (gap === "uncovered") return {
-		bodyKey: "alarm.arm.body.uncovered",
-		textParams: { mode },
-		textCount: 0
-	};
-	if (gap === "all-skipped") {
-		const names = coverage.skippedDevices.map((s) => deviceName(s.deviceId));
-		return {
-			bodyKey: "alarm.arm.body.allSkipped",
-			textParams: {
-				rules,
-				mode,
-				devices: `${names.length}`,
-				names: names.join(", ")
-			},
-			textCount: names.length
-		};
-	}
-	if (coverage.allDevices) return {
-		bodyKey: "alarm.arm.body.allDevices",
-		textParams: {
-			rules,
-			mode
-		},
-		textCount: coverage.ruleCount
-	};
-	if (coverage.deviceIds.length === 0) return {
-		bodyKey: "alarm.arm.body.noDevices",
-		textParams: {
-			rules,
-			mode
-		},
-		textCount: coverage.ruleCount
-	};
-	const skipped = new Set(coverage.skippedDevices.map((s) => s.deviceId));
-	const names = coverage.deviceIds.filter((id) => !skipped.has(id)).map(deviceName);
-	if (skipped.size === 0) return {
-		bodyKey: "alarm.arm.body.devices",
-		textParams: {
-			rules,
-			mode,
-			devices: `${names.length}`,
-			names: names.join(", ")
-		},
-		textCount: names.length
-	};
-	return {
-		bodyKey: "alarm.arm.body.devicesSkipped",
-		textParams: {
-			rules,
-			mode,
-			devices: `${names.length}`,
-			names: names.join(", "),
-			skippedNames: coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ")
-		},
-		textCount: names.length
-	};
-}
-/**
-* "Attivi: 2 — Bypassati: Finestra veranda."
-*
-* The bypassed sensors are named and the armed ones are COUNTED, not listed:
-* this sentence's subject is the exception, and burying it under thirteen
-* camera names is how an operator stops reading the arm notification. The
-* count pluralises on what IS armed, like every other arm variant.
-*/
-function armedWithBypass(coverage, bypassed, deviceName) {
-	const skipped = new Set(coverage.skippedDevices.map((s) => s.deviceId));
-	const excluded = new Set(bypassed);
-	const armed = coverage.allDevices ? coverage.ruleCount : coverage.deviceIds.filter((id) => !skipped.has(id) && !excluded.has(id)).length;
-	return {
-		bodyKey: "alarm.arm.body.bypassed",
-		textParams: {
-			rules: `${coverage.ruleCount}`,
-			mode: coverage.mode,
-			devices: `${armed}`,
-			bypassedNames: bypassed.map(deviceName).join(", ")
-		},
-		textCount: armed
-	};
-}
-/**
-* "Aperti: Finestra veranda, Porta retro" + how to arm anyway.
-*
-* The one alarm sentence about something that did not happen, so it has to
-* carry both halves an operator needs to act: WHICH sensors are open, and that
-* pressing arm again arms without them. Naming them is the whole message — a
-* refusal that says only "cannot arm" is a panel the operator will conclude is
-* broken — so the names are the FIRST line and the retry hint is the second.
-*/
-function buildArmRefusedAnnouncement(mode, names, retrySeconds) {
-	return {
-		bodyKey: "alarm.armRefused.body",
-		textParams: {
-			mode,
-			devices: `${names.length}`,
-			names: names.join(", "),
-			seconds: `${retrySeconds}`
-		},
-		textCount: names.length
-	};
-}
-/**
-* The EXCEPTIONS to the same coverage, said 30 seconds earlier.
-*
-* The exit-delay sentence is deliberately SHORTER than the arm one — it is read
-* on the way out of a door — and it carries exactly one thing the arm sentence
-* cannot: the warning arrives while the operator can still disarm and fix it.
-* A mode that arms nothing is worth interrupting somebody for at second 0 and
-* merely worth recording at second 30.
-*
-* **It never repeats the device list.** The countdown lives in the TITLE
-* (`system.alarm-arming.title.<mode>` renders `{{seconds}}`), and the armed
-* list arrives thirty seconds later in the arm announcement — printing it
-* twice is the verbosity that made the operator stop reading both. So the body
-* is what is WRONG: what was bypassed, what is excluded, or that nothing is.
-*
-* `seconds` stays in the params because the title asks for it, and `textCount`
-* stays with it: a row enqueued before this deploy still pluralises on the
-* countdown it was written for.
-*/
-function buildArmingAnnouncement(coverage, seconds, deviceName, bypassed = []) {
-	const textParams = {
-		mode: coverage.mode,
-		seconds: `${seconds}`
-	};
-	if (bypassed.length > 0) return {
-		bodyKey: "alarm.arming.body.bypassed",
-		textParams: {
-			...textParams,
-			bypassedNames: bypassed.map(deviceName).join(", ")
-		},
-		textCount: seconds
-	};
-	const skippedNames = coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ");
-	const gap = alarmCoverageGap(coverage);
-	if (gap === "uncovered") return {
-		bodyKey: "alarm.arming.body.uncovered",
-		textParams,
-		textCount: seconds
-	};
-	if (gap === "all-skipped") return {
-		bodyKey: "alarm.arming.body.allSkipped",
-		textParams: {
-			...textParams,
-			names: skippedNames
-		},
-		textCount: seconds
-	};
-	if (coverage.skippedDevices.length > 0) return {
-		bodyKey: "alarm.arming.body.skipped",
-		textParams: {
-			...textParams,
-			names: skippedNames
-		},
-		textCount: coverage.skippedDevices.length
-	};
-	return {
-		bodyKey: "alarm.arming.body",
-		textParams,
-		textCount: seconds
-	};
-}
-//#endregion
-//#region src/notification-center/alarm/alarm-arm-guard.ts
-/**
-* How long a refusal stays confirmable.
-*
-* Long enough to read the notification and press again (the operator is
-* standing at the door, phone in hand); short enough that it cannot be the
-* state the panel is left in. Sixty seconds is also under the shortest exit
-* delay this panel ships with, so a bypass can never outlive the arm it
-* belongs to.
-*/
-var ARM_BYPASS_WINDOW_MS = 6e4;
-/** The taxonomy kind a door/window contact persists its events under. */
-var CONTACT_SENSOR_KIND = "contact";
-/**
-* The contact sensors a mode would arm, ascending and de-duplicated.
-*
-* A rule qualifies only when it is enabled, gated on THIS panel in THIS mode,
-* and about contacts (`sensorKinds` naming `contact`). Two exclusions are
-* deliberate and both are about refusing an arm the operator cannot fix:
-*
-*  - a rule that names CAMERAS (`Intrusione — Fuori casa` names thirteen) is
-*    not a contact rule, and a camera is never open;
-*  - a contact rule with NO device scope covers every contact on the hub, and
-*    blocking on a set the operator never wrote down produces a refusal naming
-*    devices they never associated with the alarm. The caller says so in a log
-*    line rather than inventing the list.
-*/
-function alarmBlockingCandidates(rules, panelDeviceId, mode) {
-	const wanted = armedStateFor(mode);
-	const ids = /* @__PURE__ */ new Set();
-	for (const rule of rules) {
-		if (!rule.enabled) continue;
-		const gate = rule.conditions.deviceState;
-		if (gate === void 0 || gate.deviceId !== panelDeviceId) continue;
-		if (!gate.states.includes(wanted)) continue;
-		const kinds = rule.conditions.sensorKinds;
-		if (kinds === void 0 || !kinds.includes(CONTACT_SENSOR_KIND)) continue;
-		const scope = rule.conditions.devices;
-		if (scope === void 0 || scope.length === 0) continue;
-		for (const id of scope) ids.add(id);
-	}
-	return [...ids].toSorted((a, b) => a - b);
-}
-/**
-* Every contact any mode of this panel could block on — the set whose state is
-* worth keeping mirrored.
-*
-* Read on the rule-reload tick, so the arm path has a recent answer even when
-* the targeted read at arm time fails, and so an excluded sensor's close can be
-* noticed on a hub where the sensor is linked to no camera (and therefore emits
-* no device event at all — the live installation on 2026-08-13).
-*/
-function alarmContactWatchList(rules, panelDeviceId, modes) {
-	const ids = /* @__PURE__ */ new Set();
-	for (const mode of modes) for (const id of alarmBlockingCandidates(rules, panelDeviceId, mode)) ids.add(id);
-	return [...ids].toSorted((a, b) => a - b);
-}
-/**
-* Refuse, bypass or proceed — the whole decision, as one comparison.
-*
-* The bypass requires the SAME mode. "Arm home" refused and "arm away" pressed
-* is a different intent about a different set of sensors, and letting one
-* confirm the other would arm a mode around a window nobody was told about.
-*
-* The bypassed set is what is open NOW, not what was open at the refusal: a
-* window shut between the two presses is armed with everything else, which is
-* the entire point of having refused.
-*/
-function decideArm(input) {
-	const window = input.windowMs ?? 6e4;
-	if (input.openContacts.length === 0) return { kind: "clear" };
-	const previous = input.previous;
-	if (previous !== null && previous.mode === input.mode && input.at - previous.at <= window) return {
-		kind: "bypassed",
-		bypassed: input.openContacts
-	};
-	return {
-		kind: "refused",
-		blocking: input.openContacts,
-		retryUntil: input.at + window
-	};
-}
-/**
-* The error `alarmPanel.arm` throws when it refuses.
-*
-* A THROW and not a return value, and the reason is a train: the hub's
-* generated router validates this method's response against the HOST's copy of
-* the cap, which says `z.void()`. An addon that answered a structured refusal
-* would have it rejected by the router in front of it — so the refusal reaches
-* the caller as the one channel that already works across that boundary, and
-* the operator's PHONE gets the sentence (`alarm-arm-refused`, through the
-* ordinary outbox) rather than a UI error being the only trace.
-*
-* The message is deliberately actionable and English (an exception message is
-* a developer/API surface; the notification is the operator's).
-*/
-var NcAlarmArmRefusedError = class extends Error {
-	code = "alarm-arm-refused";
-	mode;
-	blocking;
-	retryUntil;
-	constructor(input) {
-		const names = input.blocking.map((c) => c.name).join(", ");
-		const seconds = Math.round((input.windowMs ?? 6e4) / 1e3);
-		super(`arm refused — open: ${names}. Arm ${input.mode} again within ${String(seconds)}s to arm with them excluded.`);
-		this.name = "NcAlarmArmRefusedError";
-		this.mode = input.mode;
-		this.blocking = input.blocking;
-		this.retryUntil = input.retryUntil;
-	}
-};
-//#endregion
-//#region src/notification-center/alarm/alarm-exclusions.ts
-function isPhase(value) {
-	return value === "open" || value === "closed";
-}
-var NcAlarmExclusions = class {
-	entries = [];
-	/** Replace the whole set — one arm, one set of exclusions. */
-	exclude(deviceIds, at) {
-		this.entries = [...new Set(deviceIds)].map((deviceId) => ({
-			deviceId,
-			phase: "open",
-			at
-		}));
-	}
-	/** Every excluded sensor, in the order it was excluded. */
-	list() {
-		return this.entries.map((e) => e.deviceId);
-	}
-	/** True while this sensor's events must not reach the panel. */
-	blocks(deviceId) {
-		return this.entries.some((e) => e.deviceId === deviceId);
-	}
-	/**
-	* Feed one contact reading, and say what it CHANGED.
-	*
-	* Three answers, not two, because the caller has to persist on both of the
-	* changes: the first `alarm-arm-refusal.spec.ts` run of this feature saved
-	* only the re-arm, so a hub redeployed between the close and the re-open came
-	* back with the sensor still in phase `open` — and the exclusion then needed
-	* a SECOND close to lift. A phase that lives only in RAM is half a durable
-	* exclusion.
-	*
-	* An unreadable state changes nothing (D49): a failed read must never lift an
-	* exclusion the operator asked for, and must never swallow the close that
-	* would have.
-	*/
-	observe(deviceId, reading, _at) {
-		if (reading === void 0) return "unchanged";
-		const current = this.entries.find((e) => e.deviceId === deviceId);
-		if (current === void 0) return "unchanged";
-		if (reading === "closed") {
-			if (current.phase === "closed") return "unchanged";
-			this.entries = this.entries.map((e) => e.deviceId === deviceId ? {
-				...e,
-				phase: "closed"
-			} : e);
-			return "closed";
-		}
-		if (current.phase === "open") return "unchanged";
-		this.entries = this.entries.filter((e) => e.deviceId !== deviceId);
-		return "rearmed";
-	}
-	/** The arm this belongs to is over. */
-	clear() {
-		this.entries = [];
-	}
-	/** What to persist. Plain data — it rides the panel's config blob. */
-	snapshot() {
-		return this.entries.map((e) => ({
-			deviceId: e.deviceId,
-			phase: e.phase,
-			at: e.at
-		}));
-	}
-	/**
-	* Rebuild from the persisted blob — a GUARD, never a cast.
-	*
-	* Anything unrecognised restores NOTHING, which is the failure that shows
-	* itself (a bypassed sensor that fires) rather than the one that hides (a
-	* sensor excluded forever by a blob nobody can read). A bare id with no phase
-	* restores as still-OPEN: it needs a close before it can re-arm, which is the
-	* half that cannot cause a false alarm.
-	*/
-	restore(raw) {
-		if (!Array.isArray(raw)) return;
-		const out = [];
-		for (const item of raw) {
-			if (typeof item === "number" && Number.isInteger(item)) {
-				out.push({
-					deviceId: item,
-					phase: "open",
-					at: 0
-				});
-				continue;
-			}
-			if (item === null || typeof item !== "object") continue;
-			const rec = { ...item };
-			const deviceId = rec["deviceId"];
-			if (typeof deviceId !== "number" || !Number.isInteger(deviceId)) continue;
-			const phase = isPhase(rec["phase"]) ? rec["phase"] : "open";
-			const at = typeof rec["at"] === "number" ? rec["at"] : 0;
-			out.push({
-				deviceId,
-				phase,
-				at
-			});
-		}
-		this.entries = out;
-	}
-};
 /**
 * WHO the panel's current countdown belongs to.
 *
@@ -1287,6 +1583,18 @@ function alarmTransition(input) {
 		...input.source !== void 0 ? { source: input.source } : {}
 	};
 	if (next === "arming") return armingTransition(previous, input);
+	if (next === "pending") return pendingTransition(previous, input);
+	if (previous === "triggered" && next.startsWith("armed_")) {
+		const mode = armModeOf(next, input.modes);
+		if (mode === null) return null;
+		return {
+			kind: "alarm-rearmed",
+			state: next,
+			previous,
+			mode,
+			at
+		};
+	}
 	if (shouldAnnounceArm(previous, next)) {
 		const mode = armModeOf(next, input.modes);
 		if (mode === null) return null;
@@ -1329,6 +1637,27 @@ function armingTransition(previous, input) {
 		at: input.at
 	};
 }
+/**
+* The entry delay, as one notification at its START — the mirror of
+* {@link armingTransition}. Null when the panel did not say which mode the
+* countdown belongs to and when it ends: "Intrusion — s to disarm" is not a
+* sentence to send.
+*/
+function pendingTransition(previous, input) {
+	const pending = input.pending;
+	if (pending === void 0) return null;
+	const mode = armModeOf(pending.target, input.modes);
+	if (mode === null) return null;
+	return {
+		kind: "alarm-pending",
+		state: "pending",
+		previous,
+		mode,
+		seconds: Math.max(0, Math.ceil((pending.triggerAt - input.at) / 1e3)),
+		at: input.at,
+		...input.source !== void 0 ? { source: input.source } : {}
+	};
+}
 //#endregion
 //#region src/notification-center/alarm/alarm-panel-device.ts
 /**
@@ -1371,22 +1700,70 @@ var ncAlarmPanelSchema = require_dist.object({
 	exitDelaySec: require_dist.number().int().min(0).max(600).default(DEFAULT_DELAYS.exitDelaySec),
 	entryDelaySec: require_dist.number().int().min(0).max(600).default(DEFAULT_DELAYS.entryDelaySec),
 	triggeredDurationSec: require_dist.number().int().min(0).max(3600).default(DEFAULT_DELAYS.triggeredDurationSec),
-	/** Send a notification when a mode takes effect. Off until asked for. */
+	/**
+	* VESTIGIAL (D630): nothing reads it to decide anything any more — every
+	* transition is announced to `announceTargets`. Kept so a persisted blob
+	* and the settings cap still round-trip it, and read once at boot to tell
+	* an operator who had it OFF that their targets now hear every transition.
+	*/
 	announceArm: require_dist.boolean().default(false),
-	/** Target ids that announcement goes to — see `NcAlarmSettingsSchema`. */
+	/** Target ids EVERY alarm announcement goes to — see `NcAlarmSettingsSchema`. */
 	announceTargets: require_dist.array(require_dist.string()).default([]),
 	machine: require_dist.record(require_dist.string(), require_dist.unknown()).optional(),
 	/**
-	* Sensors the CURRENT arm is ignoring because they were open when the
-	* operator confirmed it, and how far each is through its two-phase lift.
+	* Devices the CURRENT arm is ignoring because they were open when it armed
+	* (tolerated by the mode's non-blocking list, or confirmed with Arm anyway),
+	* and how far each is through its two-phase lift.
 	*
 	* Persisted for the same reason the machine is: a deploy in the middle of an
 	* armed night would otherwise silently re-arm every sensor the operator
 	* agreed to leave out, and they would learn about it from the siren. Read
 	* back through a guard, never a cast — see `NcAlarmExclusions.restore`.
 	*/
-	exclusions: require_dist.array(require_dist.unknown()).default([])
+	exclusions: require_dist.array(require_dist.unknown()).default([]),
+	/**
+	* Per arm mode, the covered devices whose being open does not refuse the arm
+	* (D630). Loose on purpose — `mode` is a string here — and read back through
+	* {@link nonBlockingFromPersisted}, never a cast: a blob written by a later
+	* release with a mode this one does not know must drop that entry, not the
+	* whole config.
+	*/
+	nonBlocking: require_dist.array(require_dist.object({
+		mode: require_dist.string(),
+		deviceIds: require_dist.array(require_dist.number().int())
+	})).default([])
 });
+/**
+* The persisted non-blocking lists, narrowed to modes that exist, first entry
+* per mode kept — the same "at most one list per mode" the settings schema
+* enforces at the boundary. A type guard (`safeParse`), never a cast.
+*/
+function nonBlockingFromPersisted(raw) {
+	const seen = /* @__PURE__ */ new Set();
+	const lists = [];
+	for (const entry of raw) {
+		const mode = require_dist.AlarmArmModeSchema.safeParse(entry.mode);
+		if (!mode.success || seen.has(mode.data)) continue;
+		seen.add(mode.data);
+		lists.push({
+			mode: mode.data,
+			deviceIds: [...entry.deviceIds]
+		});
+	}
+	return lists;
+}
+/**
+* The log line for a trigger the state machine ignored, per state. `trigger`
+* ignores four: disarmed, arming (the exit delay), and pending / triggered
+* (already counting down or going off — a second sensor must not restart it).
+*/
+function ignoredTriggerMessage(state) {
+	if (state === "arming") return "alarm trigger ignored — the panel is still arming (exit delay)";
+	if (state === "pending") return "alarm trigger ignored — the entry delay is already running";
+	if (state === "triggered") return "alarm trigger ignored — the alarm is already going off";
+	if (state === "disarmed") return "alarm trigger ignored — the panel is disarmed";
+	return "alarm trigger ignored — the panel cannot be triggered in this state";
+}
 /** `armed_home` and friends — the only targets a machine may settle into. */
 function isArmTarget(value) {
 	return value === "disarmed" || typeof value === "string" && value.startsWith("armed_");
@@ -1440,20 +1817,26 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 	/** Who answers "is anything open" — null until the centre wires itself in. */
 	armGuard = null;
 	/**
-	* The arm attempt that was REFUSED, and is therefore confirmable.
+	* The LATEST refusal — the only one whose Arm anyway can still arm.
 	*
 	* In RAM and only in RAM, deliberately: it is a confirmation of something the
-	* operator read seconds ago, and a confirmation that survived a restart would
+	* operator read minutes ago, and a confirmation that survived a restart would
 	* let a process respawn arm the alarm around an open window nobody re-read.
-	* Losing it costs one extra press.
-	*/
-	lastRefusal = null;
+	* Losing it costs one extra tap. Nothing else clears it: a disarm or an arm
+	* moves `machine.changedAt`, and `armAnyway` then finds it stale.
+	*/
+	refusal = null;
+	/** The refusal whose Arm anyway was pressed last — a second press is `used`. */
+	spentRefusalId = null;
+	/** Makes refusal ids unique inside one millisecond. */
+	refusalSeq = 0;
 	constructor(ctx) {
 		super(ctx, ncAlarmPanelSchema, { type: require_dist.DeviceType.AlarmPanel });
 		this.delays = this.readDelays();
 		this.restore();
 		this.registerAlarmCap();
 		this.publish();
+		if (this.config.get("announceArm") === false && this.config.get("announceTargets").length > 0) this.ctx.logger.info("alarm announcements now cover every transition (D630) — the announceArm switch is gone", { tags: { deviceId: this.id } });
 	}
 	/** The operator-visible configuration, as the cap serves it. */
 	settings() {
@@ -1461,7 +1844,7 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 			...this.readDelays(),
 			announceArm: this.config.get("announceArm"),
 			announceTargets: [...this.config.get("announceTargets")],
-			nonBlocking: []
+			nonBlocking: nonBlockingFromPersisted(this.config.get("nonBlocking"))
 		};
 	}
 	/**
@@ -1478,6 +1861,10 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		if (patch.triggeredDurationSec !== void 0) await this.config.set("triggeredDurationSec", patch.triggeredDurationSec);
 		if (patch.announceArm !== void 0) await this.config.set("announceArm", patch.announceArm);
 		if (patch.announceTargets !== void 0) await this.config.set("announceTargets", [...patch.announceTargets]);
+		if (patch.nonBlocking !== void 0) await this.config.set("nonBlocking", patch.nonBlocking.map((l) => ({
+			mode: l.mode,
+			deviceIds: [...l.deviceIds]
+		})));
 		this.delays = this.readDelays();
 		return this.settings();
 	}
@@ -1506,11 +1893,106 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 	currentState(now = Date.now()) {
 		return stateAt(this.machine, now);
 	}
-	/** Wire the open-contact check and the refusal announcement. */
+	/** The mode the machine belongs to — see {@link NcAlarmPublishReport.target}. */
+	currentTarget() {
+		return this.machine.target;
+	}
+	/** Wire the openings check and the refusal / check-failed announcements. */
 	setArmGuard(hook) {
 		this.armGuard = hook;
 	}
 	/**
+	* A plain arm. Refused on any open covered device the mode does not tolerate
+	* — pressed once or ten times, the answer is the same; the only way past a
+	* refusal is {@link armAnyway} with that refusal's id.
+	*
+	* When the openings could not be read at all it arms (fail-open, announced
+	* as a check failure) and EXCLUDES NOTHING NEW: the previous exclusions are
+	* left as they were, since there is no reading to replace them with. An
+	* `unknown` device neither blocks nor is excluded — nobody was shown it.
+	*/
+	async armWith(mode) {
+		const now = Date.now();
+		const read = await this.applyArmGuard(mode);
+		if (read.kind === "unguarded") return this.settleArm(mode, null, now);
+		if (read.kind === "check-failed") {
+			const outcome = this.settleArm(mode, null, now);
+			this.announceUncheckedArm(mode, read.error, now);
+			return outcome;
+		}
+		if (read.verdict.kind === "refused") return this.refuse(mode, read.verdict.blocking, now);
+		return this.settleArm(mode, read.verdict.excluded.map((device) => ({
+			device,
+			why: "non-blocking"
+		})), now);
+	}
+	/**
+	* The Arm anyway on ONE refusal's notification — the only path that arms
+	* around a device that blocks.
+	*
+	*  1. no held refusal, or a different one (a later refusal replaced it) ⇒
+	*     `unknown-refusal`; the id of the refusal spent last ⇒ `used`;
+	*  2. the panel changed state since ⇒ `stale`, and the refusal is dropped;
+	*  3. older than {@link ARM_ANYWAY_TTL_MS} ⇒ `expired`, and it is dropped;
+	*  4. otherwise the openings are READ AGAIN. A device that opened since is a
+	*     NEW refusal (new id, new notification) listing EVERY device that
+	*     blocks now — the still-open confirmed ones too, so its own Arm anyway
+	*     can arm around all of them, and the confirmed ones the re-read reads
+	*     UNKNOWN (so that Arm anyway still excludes them). Otherwise the arm excludes what is open
+	*     now; a refused device that closed meanwhile is armed normally. A
+	*     confirmed device the re-read cannot vouch for — the read failed, or
+	*     it reads unknown — stays EXCLUDED (D49: unknown is never secure).
+	*  5. the refusal is spent on every outcome of step 4.
+	*/
+	async armAnyway(refusalId) {
+		const now = Date.now();
+		const held = this.refusal;
+		if (held === null || held.id !== refusalId) {
+			const reason = refusalId === this.spentRefusalId ? "used" : "unknown-refusal";
+			return this.rejectArmAnyway(refusalId, reason);
+		}
+		if (this.machine.changedAt !== held.panelChangedAt) {
+			this.refusal = null;
+			return this.rejectArmAnyway(refusalId, "stale");
+		}
+		if (now - held.at > 3e5) {
+			this.refusal = null;
+			return this.rejectArmAnyway(refusalId, "expired");
+		}
+		this.refusal = null;
+		this.spentRefusalId = held.id;
+		const read = await this.applyArmGuard(held.mode, held.blockingIds);
+		if (this.machine.changedAt !== held.panelChangedAt) return this.rejectArmAnyway(refusalId, "stale");
+		if (read.kind !== "read") {
+			const outcome = this.settleArm(held.mode, held.blocking.map((device) => ({
+				device,
+				why: "arm-anyway-unverified"
+			})), now);
+			if (read.kind === "check-failed") this.announceUncheckedArm(held.mode, read.error, now);
+			return outcome;
+		}
+		const tolerated = this.nonBlockingFor(held.mode);
+		const unknown = new Set(read.openings.unknown);
+		if (read.verdict.kind === "refused") {
+			const plain = decideArm({
+				mode: held.mode,
+				open: read.openings.open,
+				nonBlocking: tolerated
+			});
+			const blockingNow = plain.kind === "refused" ? plain.blocking : read.verdict.blocking;
+			const shownIds = new Set(blockingNow.map((d) => d.deviceId));
+			const blocking = [...blockingNow, ...held.blocking.filter((d) => unknown.has(d.deviceId) && !shownIds.has(d.deviceId))];
+			return this.refuse(held.mode, blocking, now);
+		}
+		return this.settleArm(held.mode, [...read.verdict.excluded.map((device) => ({
+			device,
+			why: tolerated.includes(device.deviceId) ? "non-blocking" : "arm-anyway"
+		})), ...held.blocking.filter((device) => unknown.has(device.deviceId)).map((device) => ({
+			device,
+			why: "arm-anyway-unknown"
+		}))], now);
+	}
+	/**
 	* Sensors the current arm is ignoring — what the armed/arming sentence names
 	* as excluded, and the only place that list is published.
 	*/
@@ -1518,26 +2000,54 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		return this.exclusions.list();
 	}
 	/**
-	* One contact reading, from whoever saw it — the sensor's own event, or the
-	* centre's reconcile tick.
+	* The same exclusions, each with its phase — `open` while the device is
+	* still open as it was when armed, `closed` once it has been secured and
+	* its next open re-arms it. What the live view shows; a read, never a copy.
+	*/
+	exclusionPhases() {
+		return this.exclusions.snapshot().map((e) => ({
+			deviceId: e.deviceId,
+			phase: e.phase
+		}));
+	}
+	/**
+	* Disarm — the ONE path, for the cap and the `nc.disarmAlarm` bridge alike.
+	* The exclusions belong to the ARM, and this one is over: keeping them would
+	* carry an open window's exemption into tonight's arm, which nobody
+	* confirmed.
+	*/
+	async disarm() {
+		this.machine = disarm(Date.now());
+		this.attribution.clear();
+		this.exclusions.clear();
+		this.publish();
+	}
+	/**
+	* One opening's reading (`open` / `secure`, D630's vocabulary — a cover is
+	* secure only when `closed`, a lock only when `locked`), from whoever saw
+	* it: the sensor's own event, or the centre's reconcile tick.
 	*
 	* The lift is two-phase (`alarm-exclusions.ts`), so this is safe to call with
 	* the same reading repeatedly, and an unreadable state changes nothing. Fed
 	* BEFORE the event that carried it is evaluated, so the open that re-arms a
 	* sensor is already lifted when the rule it fires reaches the panel.
 	*/
-	observeContact(deviceId, reading, now = Date.now()) {
+	observeOpening(deviceId, reading, now = Date.now()) {
 		const change = this.exclusions.observe(deviceId, reading, now);
 		if (change === "unchanged") return;
 		this.persist();
 		if (change === "closed") return;
-		this.ctx.logger.info("alarm exclusion lifted — the sensor closed and opened again", {
+		this.ctx.logger.info("alarm exclusion lifted — the device was secured and opened again", {
 			tags: { deviceId },
 			meta: {
 				panelDeviceId: this.id,
 				remaining: this.exclusions.list().length
 			}
 		});
+		this.announceBypass({
+			deviceId,
+			event: "lifted"
+		}, now);
 	}
 	/** Stop the countdown when the device goes away. The state itself is
 	*  persisted, so nothing is lost — only the announcements stop. */
@@ -1545,108 +2055,166 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		this.stopTicking();
 	}
 	/**
-	* Refuse the arm, bypass around it, or let it through — and leave the
-	* exclusions the arm will run with.
+	* Ask the centre what is open and decide — or say why there is nothing to
+	* decide with.
 	*
 	* Fail-OPEN by construction, in three places, and each one is a decision:
 	*
 	*  - no guard wired (an agent node, a boot pass before the centre exists) ⇒
-	*    arm. A panel that cannot ask must not refuse.
-	*  - the guard threw ⇒ arm, and SAY so. Refusing on a failed read would tell
-	*    the operator to go and shut a window that is already shut (the coverage
-	*    derivation makes the same choice: an unreadable authority answers
-	*    "unknown", never "excluded").
-	*  - nothing reads open ⇒ arm clean, and any exclusion a previous arm left
-	*    is dropped.
-	*
-	* The refusal throws. See {@link NcAlarmArmRefusedError} for why that is the
-	* channel rather than a return value.
-	*/
-	async applyArmGuard(mode, now) {
+	*    `unguarded`, arm. A panel that cannot ask must not refuse.
+	*  - the read threw (nothing could be read) ⇒ `check-failed`, arm, and SAY
+	*    so — a WARN here and, once the arm has LANDED, `announceCheckFailed` on
+	*    the operator's phone. Refusing on a failed read would send the operator
+	*    to shut a window that is already shut.
+	*  - a covered device whose state is UNKNOWN ⇒ never blocks and is never
+	*    counted secure (D49); the guard logs one line each, under its own id.
+	*
+	* `acknowledged` is what an Arm anyway confirms — the ids its refusal SHOWED.
+	*/
+	async applyArmGuard(mode, acknowledged) {
 		const guard = this.armGuard;
-		if (guard === null) return;
-		let openContacts;
+		if (guard === null) return { kind: "unguarded" };
+		let openings;
 		try {
-			openContacts = await guard.openContacts(mode);
+			openings = await guard.openings(mode);
 		} catch (err) {
-			this.ctx.logger.warn("alarm arm guard could not read the contacts — arming anyway", {
+			this.ctx.logger.warn("alarm arm guard could not read the openings — arming without the check", {
 				tags: { deviceId: this.id },
 				meta: {
 					mode,
 					error: String(err)
 				}
 			});
-			return;
+			return {
+				kind: "check-failed",
+				error: String(err)
+			};
 		}
 		const verdict = decideArm({
 			mode,
-			openContacts,
-			previous: this.lastRefusal,
-			at: now
+			open: openings.open,
+			nonBlocking: this.nonBlockingFor(mode),
+			...acknowledged !== void 0 ? { acknowledged } : {}
 		});
-		if (verdict.kind === "clear") {
-			this.lastRefusal = null;
-			if (this.exclusions.list().length > 0) {
-				this.exclusions.clear();
-				this.persist();
-			}
-			return;
-		}
-		if (verdict.kind === "bypassed") {
-			this.lastRefusal = null;
-			this.exclusions.exclude(verdict.bypassed.map((c) => c.deviceId), now);
+		return {
+			kind: "read",
+			openings,
+			verdict
+		};
+	}
+	/**
+	* The operator's copy of "armed WITHOUT the openings check" — called only
+	* after {@link settleArm}, with the state the panel is really in now. Never
+	* on a path that armed nothing: a stale Arm anyway whose re-read also failed
+	* used to push "Armed … without checking" for an arm that never happened.
+	*/
+	announceUncheckedArm(mode, error, now) {
+		this.armGuard?.announceCheckFailed({
+			mode,
+			state: stateAt(this.machine, now),
+			at: now,
+			error
+		});
+	}
+	/** This mode's non-blocking ids, from the persisted lists. */
+	nonBlockingFor(mode) {
+		return nonBlockingFromPersisted(this.config.get("nonBlocking")).find((l) => l.mode === mode)?.deviceIds ?? [];
+	}
+	/**
+	* Arm, with these exclusions.
+	*
+	* `null` exclusions (no guard, or nothing could be read on a plain arm) arm
+	* and leave the exclusions as they were — there is no reading to replace them with.
+	*/
+	settleArm(mode, exclusions, now) {
+		const excluded = (exclusions ?? []).map((e) => e.device);
+		if (exclusions !== null) {
+			if (excluded.length > 0) this.exclusions.exclude(excluded.map((d) => d.deviceId), now);
+			else this.exclusions.clear();
 			this.persist();
-			for (const contact of verdict.bypassed) this.ctx.logger.info("alarm armed with an open sensor excluded", {
-				tags: { deviceId: contact.deviceId },
-				meta: {
-					panelDeviceId: this.id,
-					mode,
-					name: contact.name
-				}
-			});
-			return;
 		}
-		this.lastRefusal = {
+		this.machine = arm(mode, this.delays, now);
+		this.attribution.clear();
+		this.publish(now);
+		for (const { device, why } of exclusions ?? []) this.ctx.logger.info("alarm armed with an open device excluded", {
+			tags: { deviceId: device.deviceId },
+			meta: {
+				panelDeviceId: this.id,
+				mode,
+				name: device.name,
+				state: device.state,
+				why
+			}
+		});
+		return {
+			outcome: stateAt(this.machine, now) === "arming" ? "arming" : "armed",
+			excluded
+		};
+	}
+	/**
+	* Record the refusal, say it per device, and hand it to the operator's phone.
+	*
+	* The record REPLACES any earlier one — only the latest refusal's Arm anyway
+	* can arm (an older notification's button is superseded).
+	*/
+	refuse(mode, blocking, now) {
+		this.refusalSeq += 1;
+		const refusal = {
+			id: `refusal:${String(this.id)}:${mode}:${String(now)}:${String(this.refusalSeq)}`,
 			mode,
-			at: now
+			blockingIds: blocking.map((d) => d.deviceId),
+			blocking,
+			at: now,
+			panelChangedAt: this.machine.changedAt
 		};
-		for (const contact of verdict.blocking) this.ctx.logger.warn("alarm arm REFUSED — this sensor is open", {
-			tags: { deviceId: contact.deviceId },
+		this.refusal = refusal;
+		for (const d of blocking) this.ctx.logger.warn("alarm arm REFUSED — this device is open", {
+			tags: { deviceId: d.deviceId },
 			meta: {
 				panelDeviceId: this.id,
 				mode,
-				name: contact.name
+				name: d.name,
+				state: d.state,
+				refusalId: refusal.id
 			}
 		});
-		guard.announceRefusal({
-			mode,
-			blocking: verdict.blocking,
-			retrySeconds: Math.round(ARM_BYPASS_WINDOW_MS / 1e3),
+		this.armGuard?.announceRefusal({
+			refusal,
+			blocking,
+			state: stateAt(this.machine, now),
 			at: now
 		});
-		throw new NcAlarmArmRefusedError({
-			mode,
-			blocking: verdict.blocking,
-			retryUntil: verdict.retryUntil
+		return {
+			outcome: "refused",
+			refusalId: refusal.id,
+			blocking
+		};
+	}
+	/** A pressed Arm anyway that did nothing — refused work, so it says so. */
+	rejectArmAnyway(refusalId, reason) {
+		this.ctx.logger.info("alarm Arm anyway rejected — nothing was armed", {
+			tags: { deviceId: this.id },
+			meta: {
+				refusalId,
+				reason
+			}
 		});
+		return {
+			outcome: "rejected",
+			reason
+		};
 	}
 	registerAlarmCap() {
 		this.ctx.registerNativeCap(require_dist.alarmPanelCapability, {
 			getStatus: async () => this.status(),
 			arm: async ({ mode }) => {
-				const now = Date.now();
-				await this.applyArmGuard(mode, now);
-				this.machine = arm(mode, this.delays, now);
-				this.attribution.clear();
-				this.publish(now);
-			},
-			disarm: async () => {
-				this.machine = disarm(Date.now());
-				this.attribution.clear();
-				this.exclusions.clear();
-				this.lastRefusal = null;
-				this.publish();
+				const outcome = await this.armWith(mode);
+				if (outcome.outcome === "refused") throw new NcAlarmArmRefusedError({
+					mode,
+					blocking: outcome.blocking
+				});
 			},
+			disarm: async () => this.disarm(),
 			trigger: async () => {
 				const now = Date.now();
 				const pending = this.attribution.pending(now);
@@ -1662,13 +2230,15 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 							state: stateAt(this.machine, now)
 						}
 					});
+					this.announceIgnoredTrigger(source, now);
 					return;
 				}
 				const next = trigger(this.machine, this.delays, now);
 				if (next === this.machine) {
-					this.ctx.logger.info("alarm trigger ignored — the panel is not armed", {
+					const state = stateAt(this.machine, now);
+					this.ctx.logger.info(ignoredTriggerMessage(state), {
 						tags: { deviceId: this.id },
-						meta: { state: stateAt(this.machine, now) }
+						meta: { state }
 					});
 					return;
 				}
@@ -1724,18 +2294,21 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		if (hook === null) return;
 		const source = this.attribution.current();
 		const arming = exitDelayAt(this.machine, now);
+		const pending = pendingAt(this.machine, now);
 		const transition = alarmTransition({
 			previous,
 			next: state,
 			modes: NC_ALARM_MODES,
 			at: now,
 			...source !== null ? { source } : {},
-			...arming !== void 0 ? { arming } : {}
+			...arming !== void 0 ? { arming } : {},
+			...pending !== void 0 ? { pending } : {}
 		});
 		if (transition?.kind === "alarm-triggered") this.attribution.clear();
 		try {
 			hook({
 				state,
+				target: this.machine.target,
 				transition
 			});
 		} catch (err) {
@@ -1749,6 +2322,70 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 			});
 		}
 	}
+	/**
+	* A dropped trigger is TOLD, not only logged — an intrusion the alarm
+	* deliberately did not act on is what the operator most needs to hear — but
+	* ONCE per sensor per arm (the mark rides the persisted exclusion), and only
+	* while the panel is armed: during the exit delay `trigger()` would have
+	* dropped it anyway, so the exclusion is not what ignored it.
+	*/
+	announceIgnoredTrigger(deviceId, now) {
+		if (!isArmed(this.machine, now)) {
+			this.ctx.logger.debug("alarm bypass not announced — the panel is not armed yet", {
+				tags: { deviceId },
+				meta: {
+					panelDeviceId: this.id,
+					state: stateAt(this.machine, now)
+				}
+			});
+			return;
+		}
+		if (!this.exclusions.markAnnounced(deviceId)) {
+			this.ctx.logger.debug("alarm bypass already announced in this arm — repeat not sent", {
+				tags: { deviceId },
+				meta: { panelDeviceId: this.id }
+			});
+			return;
+		}
+		this.persist();
+		this.announceBypass({
+			deviceId,
+			event: "ignored"
+		}, now);
+	}
+	/**
+	* Report a sensor the current arm ignored, or stopped ignoring, through the
+	* publish hook — a report whose state is UNCHANGED, so `lastPublished` is
+	* not touched and the next real transition is still computed from it.
+	*/
+	announceBypass(sensor, now) {
+		const hook = this.onPublish;
+		if (hook === null) return;
+		const state = stateAt(this.machine, now);
+		const transition = {
+			kind: "alarm-sensor-bypass",
+			state,
+			previous: state,
+			at: now,
+			sensor
+		};
+		try {
+			hook({
+				state,
+				target: this.machine.target,
+				transition
+			});
+		} catch (err) {
+			this.ctx.logger.warn("alarm publish hook failed", {
+				tags: { deviceId: this.id },
+				meta: {
+					state,
+					transition: transition.kind,
+					error: String(err)
+				}
+			});
+		}
+	}
 	/** The three durations, read from the persisted config. */
 	readDelays() {
 		return {
@@ -1811,6 +2448,25 @@ var NC_ALARM_DECLARATION = {
 	DeviceClass: NcAlarmPanelDevice
 };
 //#endregion
+//#region src/notification-center/alarm/alarm-panel-port.ts
+function ncAlarmPanelPort(panel) {
+	return {
+		deviceId: panel.id,
+		settings: () => panel.settings(),
+		applySettings: (patch) => panel.applySettings(patch),
+		availableModes: () => NC_ALARM_MODES,
+		noteRuleTrigger: (source) => panel.noteRuleTrigger(source),
+		excludedDevices: () => panel.excludedDevices(),
+		exclusionPhases: () => panel.exclusionPhases(),
+		currentState: () => panel.currentState(),
+		currentTarget: () => panel.currentTarget(),
+		armWith: (mode) => panel.armWith(mode),
+		armAnyway: (refusalId) => panel.armAnyway(refusalId),
+		disarm: () => panel.disarm(),
+		observeOpening: (deviceId, reading, now) => panel.observeOpening(deviceId, reading, now)
+	};
+}
+//#endregion
 //#region src/notification-center/artifact-index.ts
 /**
 * @durable class=ledger owner=notification-center
@@ -7111,10 +7767,10 @@ function replaceConditionReferences(monitor, condition, reference) {
 //#endregion
 //#region src/notification-center/snooze-exempt.ts
 /** The cap whose presence in a sequence makes the rule the alarm's trigger. */
-var ALARM_PANEL_CAP$1 = "alarm-panel";
+var ALARM_PANEL_CAP$2 = "alarm-panel";
 var ALARM_KINDS = new Set(require_dist.NC_ALARM_SYSTEM_EVENT_KINDS);
 function actuatesAlarmPanel(sequences) {
-	for (const sequence of sequences) for (const step of sequence.actions) if (step.kind === "cap" && step.cap === ALARM_PANEL_CAP$1) return true;
+	for (const sequence of sequences) for (const step of sequence.actions) if (step.kind === "cap" && step.cap === ALARM_PANEL_CAP$2) return true;
 	return false;
 }
 /**
@@ -7265,10 +7921,11 @@ var MAX_ARM_BUTTONS = 3;
 *
 * | notification | buttons |
 * | --- | --- |
-* | `alarm-arming` | **Disarma**, destructive |
-* | `alarm-triggered` | **Disarma**, destructive |
-* | `alarm-armed` | **Disarma**, destructive |
-* | `alarm-disarmed` | **Arma …** per declared mode, max three |
+* | `alarm-arming`, `alarm-armed`, `alarm-pending` | **Disarma**, destructive |
+* | `alarm-triggered`, `alarm-rearmed`, `alarm-check-failed` | **Disarma**, destructive |
+* | `alarm-disarmed` | **Arma …** per declared (enabled) mode, max three |
+* | `alarm-arm-refused` | **Arma comunque**, bound to the row's refusal |
+* | `alarm-sensor-bypass` | nothing — it reports, there is nothing to undo |
 *
 * The `alarm-arming` row is the one that earns its keep: that notification
 * arrives at the START of the exit delay, so its Disarm is the only alarm
@@ -7283,10 +7940,15 @@ var MAX_ARM_BUTTONS = 3;
 * browser. The disarm is `navigate`: it removes a protection, and the operator
 * doing it deserves to SEE that it happened rather than trust a POST nobody
 * confirmed.
+*
+* `panel.availableModes` ARE the enabled modes: CamStack has no per-mode
+* disable setting, so the Arm buttons offer exactly what the panel declares.
 */
 function buildAlarmButtons(input) {
 	const panel = input.panel;
 	if (panel === null) return [];
+	if (input.kind === "alarm-sensor-bypass") return [];
+	if (input.kind === "alarm-arm-refused") return armAnywayButton(input.refusalId, input);
 	if (input.kind === "alarm-disarmed") return panel.availableModes.slice(0, MAX_ARM_BUTTONS).map((mode) => {
 		const actionId = `alarm-arm-${mode}`;
 		return {
@@ -7314,6 +7976,28 @@ function buildAlarmButtons(input) {
 		mode: "navigate"
 	}];
 }
+/**
+* The one Arm anyway a refusal notification carries — or none, when the row
+* names no refusal. `navigate` and destructive, like the disarm: it arms
+* AROUND an open door, and the person doing it should see it happen. Its TTL
+* is the refusal's own (`ARM_ANYWAY_TTL_MS`, priced by the minter).
+*/
+function armAnywayButton(refusalId, input) {
+	if (refusalId === void 0) return [];
+	const actionId = "alarm-arm-anyway";
+	return [{
+		id: actionId,
+		label: input.labels.armAnyway,
+		url: input.mintUrl({
+			actionId,
+			action: "arm-anyway",
+			refusalId
+		}),
+		icon: "arm",
+		destructive: true,
+		mode: "navigate"
+	}];
+}
 //#endregion
 //#region src/notification-center/addon-update-apply.ts
 /**
@@ -7376,6 +8060,80 @@ function buildAddonUpdateButtons(input) {
 	}];
 }
 //#endregion
+//#region src/notification-center/alarm/alarm-gate-words.ts
+/** The states that belong to an armed mode without being it. */
+var INCIDENT_STATES = new Set(["pending", "triggered"]);
+/** `[state]`, plus `target` while `state` is `pending`/`triggered` of an armed mode. */
+function alarmGateWords(state, target) {
+	if (INCIDENT_STATES.has(state) && target.startsWith("armed_")) return [state, target];
+	return [state];
+}
+/**
+* The engine's lookup: every device answers its one mirrored word, and the
+* panel answers its gate words — but only while the mirror AGREES on the state.
+*
+* The mirror keeps the freshness policy (an expired or cold entry is
+* `undefined`, which fails the gate closed — D49); the alias only widens an
+* answer the mirror already gives. A target paired with a state it was not
+* published with would be a guess, so a disagreement answers the mirror alone.
+*/
+function panelAwareLookup(read, panel) {
+	return (deviceId) => {
+		const state = read(deviceId);
+		if (state === void 0) return void 0;
+		if (panel !== null && panel.deviceId === deviceId && sameWord(panel.words[0], state)) return panel.words;
+		return [state];
+	};
+}
+function sameWord(a, b) {
+	return a !== void 0 && a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+//#endregion
+//#region src/notification-center/alarm/alarm-live.ts
+/** Every covered id across all modes, ascending, once — what the one read asks for. */
+function alarmLiveReadIds(covered) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const list of covered.values()) for (const id of list) ids.add(id);
+	return [...ids].toSorted((a, b) => a - b);
+}
+function modeOpenings(input, mode) {
+	const tolerated = new Set(input.nonBlocking.find((l) => l.mode === mode)?.deviceIds ?? []);
+	const devices = [];
+	const unknown = [];
+	for (const deviceId of input.covered.get(mode) ?? []) {
+		const verdict = classifyCoveredOpening(input.openings.get(deviceId));
+		if (verdict.kind === "unknown") {
+			unknown.push(deviceId);
+			continue;
+		}
+		if (verdict.kind === "skip") continue;
+		devices.push({
+			deviceId,
+			name: input.name(deviceId),
+			state: verdict.state,
+			blocking: !tolerated.has(deviceId)
+		});
+	}
+	return {
+		mode,
+		devices,
+		unknown
+	};
+}
+function buildAlarmLive(input) {
+	return {
+		state: input.state,
+		targetMode: armModeOf(input.target, input.modes),
+		availableModes: [...input.modes],
+		openings: input.modes.map((mode) => modeOpenings(input, mode)),
+		exclusions: input.exclusions.map((e) => ({
+			deviceId: e.deviceId,
+			name: input.name(e.deviceId),
+			phase: e.phase
+		}))
+	};
+}
+//#endregion
 //#region src/notification-center/alerts/alert-store.ts
 /**
 * @durable class=ledger owner=notification-center
@@ -8070,6 +8828,52 @@ function maskPolygonOverlap(mask, maskWidth, maskHeight, bbox, polygon, _frameWi
 	return insidePolygon / totalMaskPixels;
 }
 //#endregion
+//#region src/notification-center/alarm/alarm-opening-edge.ts
+/**
+* Which way an OPENING moved, read off the slice one sensor event carries
+* (D630 "Alarm rules fire on the opening edge").
+*
+* A rule that belongs to the alarm fires when an opening OPENS — a contact
+* opens, a cover leaves closed, a lock unlocks — and never when it closes.
+*
+* Stateless on purpose: one state change is N SensorEvent rows (one per linked
+* camera), and a "previous reading" tracker would call the first row an edge
+* and the other N−1 steady — camera 2's alarm rule would lose the event. The
+* slice already says which way the device went, and the transition gate
+* upstream (`sensor-transition-gate.ts`) only lets a row through when the level
+* (the boolean, or a cover's state WORD) actually changed.
+*
+* What is open and what is secure is NOT decided here: it is
+* {@link alarmOpeningFromSensorEvent}'s table, the same one the arm check
+* reads. This file adds only the DIRECTION of a word that table calls open:
+* a word travelling towards secure (`closing`, `locking`) is a closing edge,
+* a halt or a fault (`stopped`, `jammed`) is `neither` — not an entry, so an
+* alarm rule does not fire on it, though the arm check still counts it as open
+* (a different question: "not secure" vs "just opened").
+*
+* `undefined` = this kind has no opening meaning, or the slice is unreadable
+* (D49 — never guessed). The caller then does not filter at all.
+*/
+/** Open words (per the openings table) that are travelling towards secure. */
+var TOWARD_SECURE = new Set(["closing", "locking"]);
+/** Open words that are a halt or a fault: neither an entry nor a close. */
+var HALTED = new Set(["stopped", "jammed"]);
+/** Open words that ARE the opening: leaving closed / leaving locked, or a contact apart. */
+var OPENING = new Set([
+	"open",
+	"opening",
+	"unlocked",
+	"unlocking"
+]);
+function sensorEdgeOf(kind, value) {
+	const opening = alarmOpeningFromSensorEvent(kind, value);
+	if (opening.kind !== "reading") return void 0;
+	if (opening.reading === "secure") return "closing";
+	if (TOWARD_SECURE.has(opening.state)) return "closing";
+	if (HALTED.has(opening.state)) return "neither";
+	if (OPENING.has(opening.state)) return "opening";
+}
+//#endregion
 //#region src/notification-center/audio-rule-matcher.ts
 /**
 * AudioWatcher — the Notification Center's matcher for audio rules
@@ -8545,6 +9349,7 @@ function readSensorEventType(value) {
 */
 function subjectFromSensorEvent(ev, markerTrackId) {
 	const eventType = readSensorEventType(ev.value);
+	const sensorEdge = sensorEdgeOf(ev.kind, ev.value);
 	return {
 		kind: "device-event",
 		recordId: String(ev.id),
@@ -8556,7 +9361,20 @@ function subjectFromSensorEvent(ev, markerTrackId) {
 		zones: [],
 		source: "sensor",
 		sensorKind: ev.kind,
-		...eventType !== void 0 ? { eventType } : {}
+		...eventType !== void 0 ? { eventType } : {},
+		...sensorEdge !== void 0 ? { sensorEdge } : {}
+	};
+}
+/**
+* Build the subject for a sensor no camera takes a row for (D630 §6): the
+* sensor is its own device (`deviceId === sourceDeviceId`, so no
+* `sourceDeviceId` field) and there is no marker track — nothing owns a frame
+* of it. `linkedCameraIds` carries every camera linking it (see the field).
+*/
+function subjectFromUnownedSensorEvent(ev, linkedCameraIds) {
+	return {
+		...subjectFromSensorEvent(ev),
+		linkedCameraIds: [...linkedCameraIds]
 	};
 }
 /**
@@ -8902,6 +9720,37 @@ function matchesIdentityScope(subject, scope) {
 function ruleAwaitsRecognition(rule) {
 	return rule.conditions.identities !== void 0 || rule.conditions.plates !== void 0;
 }
+var ARMED_WORD_PREFIX = "armed_";
+var ALARM_PANEL_CAP$1 = "alarm-panel";
+var ALARM_PANEL_TRIGGER_METHOD = "trigger";
+/**
+* A rule "belongs to the alarm" when its `deviceState` gate names ANY device's
+* `armed_*` word — CamStack's own panel or any other, e.g. an HA-mirrored
+* alarm panel — or when an ENABLED `onTrigger` sequence pulls the panel's
+* trigger itself. Such a rule fires on an opening's OPENING edge only: closing
+* a window while armed is not an intrusion (D630).
+*
+* This is NOT the arm check's coverage predicate (`alarm-mode-coverage.ts`):
+* it ignores which device the gate names, which mode, whether the rule is
+* enabled and what it is scoped to. It answers only "should this rule refuse
+* a closing edge", and erring wide there costs a closing notification nobody
+* gated on an armed word would have wanted anyway.
+*
+* Derived, never a stored flag: both rule editors prune condition keys to the
+* catalog on save, so a new key would be dropped by the first edit.
+*/
+function ruleBelongsToAlarm(rule) {
+	if ((rule.conditions.deviceState?.states ?? []).some((s) => s.trim().toLowerCase().startsWith(ARMED_WORD_PREFIX))) return true;
+	return (rule.actions?.onTrigger ?? []).some((sequence) => sequence.enabled && sequence.actions.some((step) => step.kind === "cap" && step.cap === ALARM_PANEL_CAP$1 && step.method === ALARM_PANEL_TRIGGER_METHOD));
+}
+/**
+* The edge an alarm rule refuses: a close, or a halt/fault (a cover stopped
+* after it already opened would otherwise fire twice; after a close it would
+* fire as if it had opened; a jammed lock is a fault, not an entry).
+*/
+function isRefusedAlarmEdge(edge) {
+	return edge === "closing" || edge === "neither";
+}
 /**
 * Does this rule stop firing on the object event and fire at TRACK CLOSE?
 *
@@ -9052,10 +9901,12 @@ function evaluateRule(rule, subject, deviceState, zoneOwners, sceneStates) {
 	}
 	const c = rule.conditions;
 	if (c.deviceState !== void 0) {
-		const current = deviceState?.(c.deviceState.deviceId);
-		if (current === void 0) return fail("deviceState");
-		if (!toLowerSet(c.deviceState.states).has(current.trim().toLowerCase())) return fail("deviceState");
+		const words = deviceState?.(c.deviceState.deviceId);
+		if (words === void 0 || words.length === 0) return fail("deviceState");
+		const wanted = toLowerSet(c.deviceState.states);
+		if (!words.some((w) => wanted.has(w.trim().toLowerCase()))) return fail("deviceState");
 	}
+	if (subject.kind === "device-event" && isRefusedAlarmEdge(subject.sensorEdge) && ruleBelongsToAlarm(rule)) return fail("sensorEdge");
 	if (c.scene !== void 0) {
 		const observation = sceneStates?.(c.scene.sceneId);
 		if (observation === void 0) return fail("scene");
@@ -9480,6 +10331,26 @@ function incomingFromSensorEvent(event, markerTrackId) {
 	};
 }
 /**
+* A sensor no camera takes a timeline row for (D630 §6) — evaluated, never
+* persisted. The sensor is its own device and there is no marker: a
+* text-only notification is the design here, not a degradation.
+*/
+function incomingFromUnownedSensorEvent(event, linkedCameraIds) {
+	return {
+		subject: subjectFromUnownedSensorEvent(event, linkedCameraIds),
+		kind: "device-event",
+		origin: "sensor",
+		log: () => ({
+			tags: { deviceId: event.deviceId },
+			meta: {
+				sensorEventId: event.id,
+				kind: event.kind,
+				linkedCameraIds: [...linkedCameraIds]
+			}
+		})
+	};
+}
+/**
 * Audio-event persist (classified episode).
 *
 * `stillOwnerId` is the audio still shelf's owner id for the photograph taken
@@ -10393,7 +11264,8 @@ function unique(values) {
 * therefore keeps the alarm's own sentence, which is also what every row
 * enqueued before this deploy carries.
 */
-function combinedAlarmText(source) {
+function combinedAlarmText(kind, source) {
+	if (kind !== "alarm-triggered") return null;
 	if (source?.className === void 0) return null;
 	return {
 		titleKey: "alarm.combined.title",
@@ -10401,6 +11273,43 @@ function combinedAlarmText(source) {
 	};
 }
 /**
+* The title and body keys an alarm row carries — ONE function, so the
+* catalog spec (`alarm-texts.spec.ts`) enumerates exactly what the intake can
+* select.
+*
+* VARIANT SELECTION AT INTAKE, like every other system sentence: the mode is
+* part of the words ("Away armed"), not a fragment substituted into them,
+* because the catalog renders in ONE pass and a `{{mode}}` filled with `away`
+* would deliver the enum value to a person.
+*/
+function alarmTextKeys(transition, body) {
+	const { kind, source } = transition;
+	const combined = combinedAlarmText(kind, source);
+	if (combined !== null) return combined;
+	const titleKey = transition.mode !== void 0 ? `system.${kind}.title.${transition.mode}` : `system.${kind}.title`;
+	if (body !== void 0) return {
+		titleKey,
+		bodyKey: body.bodyKey
+	};
+	if (kind === "alarm-sensor-bypass" && transition.sensor !== void 0) return {
+		titleKey,
+		bodyKey: `system.${kind}.body.${transition.sensor.event}`
+	};
+	if (kind === "alarm-disarmed" && (transition.previous === "triggered" || transition.previous === "pending")) return {
+		titleKey,
+		bodyKey: `system.${kind}.body.defused`
+	};
+	return {
+		titleKey,
+		bodyKey: source !== void 0 && (kind === "alarm-triggered" || kind === "alarm-pending") ? `system.${kind}.body.rule` : `system.${kind}.body`
+	};
+}
+/** Whose event the row is — see {@link incomingFromAlarmTransition}. */
+function alarmSubjectDevice(transition, panelDeviceId) {
+	if (transition.kind === "alarm-sensor-bypass" && transition.sensor !== void 0) return transition.sensor.deviceId;
+	return transition.source?.deviceId ?? panelDeviceId;
+}
+/**
 * The panel's own transition, as a system-event subject.
 *
 * IN-PROCESS, not off the bus. The alarm and the Notification Center live in
@@ -10416,42 +11325,53 @@ function combinedAlarmText(source) {
 * With one, it is about the CAMERA that set it off: that is the media owner,
 * the name the body reads out ("ALLARME — Ingresso"), and the device a rule
 * scoping `deviceIds` means. One sentence, and both halves of it are testable.
+* A SENSOR BYPASS is about the sensor — its name is the title.
 */
 function incomingFromAlarmTransition(input) {
 	const { transition, panelDeviceId } = input;
 	const source = transition.source;
-	const deviceId = source?.deviceId ?? panelDeviceId;
+	const deviceId = alarmSubjectDevice(transition, panelDeviceId);
 	const identity = input.lookup(deviceId);
 	const kind = transition.kind;
-	const combined = combinedAlarmText(source);
+	const keys = alarmTextKeys(transition, input.body);
+	const sensor = transition.sensor;
+	const alarmSource = kind === "alarm-triggered" ? source : void 0;
+	const facts = {
+		eventId: `alarm:${kind}:${String(transition.at)}${sensor !== void 0 ? `:${String(sensor.deviceId)}` : ""}${transition.refusalId !== void 0 ? `:${transition.refusalId}` : ""}`,
+		timestamp: transition.at,
+		category: `alarm.${kind.slice(6)}`,
+		data: {
+			panelDeviceId,
+			state: transition.state,
+			previous: transition.previous,
+			...transition.mode !== void 0 ? { mode: transition.mode } : {},
+			...source !== void 0 ? { sourceRuleId: source.ruleId } : {},
+			...transition.refusalId !== void 0 ? { refusalId: transition.refusalId } : {},
+			...sensor !== void 0 ? {
+				sensorDeviceId: sensor.deviceId,
+				event: sensor.event
+			} : {}
+		}
+	};
+	const deviceParams = deviceTextParams(deviceId, identity);
 	return systemSubject({
-		facts: {
-			eventId: `alarm:${kind}:${String(transition.at)}`,
-			timestamp: transition.at,
-			category: `alarm.${kind.slice(6)}`,
-			data: {
-				panelDeviceId,
-				state: transition.state,
-				previous: transition.previous,
-				...transition.mode !== void 0 ? { mode: transition.mode } : {},
-				...source !== void 0 ? { sourceRuleId: source.ruleId } : {}
-			}
-		},
+		facts,
 		kind,
 		subject: `alarm:${String(panelDeviceId)}`,
-		titleKey: combined !== null ? combined.titleKey : transition.mode !== void 0 ? `system.${kind}.title.${transition.mode}` : `system.${kind}.title`,
-		bodyKey: combined?.bodyKey ?? input.body?.bodyKey ?? (source !== void 0 ? `system.${kind}.body.rule` : `system.${kind}.body`),
+		titleKey: keys.titleKey,
+		bodyKey: keys.bodyKey,
 		textParams: {
-			...deviceTextParams(deviceId, identity),
+			...deviceParams,
+			...sensor?.name !== void 0 && identity === void 0 ? { deviceName: sensor.name } : {},
 			...transition.mode !== void 0 ? { mode: transition.mode } : {},
 			...source !== void 0 ? { rule: source.ruleName } : {},
-			...kind === "alarm-arming" ? { seconds: `${transition.seconds ?? 0}` } : {},
+			...kind === "alarm-arming" || kind === "alarm-pending" ? { seconds: `${transition.seconds ?? 0}` } : {},
 			...input.body?.textParams
 		},
 		deviceId,
 		...identity !== void 0 ? { deviceType: identity.type } : {},
 		...input.body !== void 0 ? { textCount: input.body.textCount } : {},
-		...source !== void 0 ? { alarmSource: source } : {}
+		...alarmSource !== void 0 ? { alarmSource } : {}
 	});
 }
 /** Re-stamp a live-producer envelope as a boot-reconcile replay of the same
@@ -11409,7 +12329,8 @@ var en_default = {
 	"alarm.arming.body.skipped": "Excluded: {{names}}",
 	"alarm.arm.body.bypassed": "Active: {{devices}}\nBypassed: {{bypassedNames}}",
 	"alarm.arming.body.bypassed": "Bypassed: {{bypassedNames}}",
-	"alarm.armRefused.body": "Open: {{names}}\nRepeat within {{seconds}}s to arm with bypass.",
+	"alarm.armRefused.body": "Open: {{names}}",
+	"alarm.armRefused.body.hint": "Open: {{names}}\nTap “Arm anyway” to arm with them excluded.",
 	"alarm.device.unnamed": "Device {{id}}",
 	"alarm.combined.title": "Alarm: {{deviceName}}",
 	"system.alarm-arm-refused.title.home": "Arming home refused",
@@ -11426,15 +12347,33 @@ var en_default = {
 	"system.alarm-armed.body": "Alarm armed",
 	"system.alarm-disarmed.title": "Disarmed",
 	"system.alarm-disarmed.body": "Alarm disarmed",
+	"system.alarm-disarmed.body.defused": "Alarm disarmed during an alarm",
 	"system.alarm-triggered.title": "ALARM",
 	"system.alarm-triggered.body": "Alarm triggered",
 	"system.alarm-triggered.body.rule": "Triggered by {{rule}} on {{deviceName}}",
+	"system.alarm-pending.title.home": "Intrusion — home, {{seconds}}s to disarm",
+	"system.alarm-pending.title.away": "Intrusion — away, {{seconds}}s to disarm",
+	"system.alarm-pending.title.night": "Intrusion — night, {{seconds}}s to disarm",
+	"system.alarm-pending.body": "Entry delay started",
+	"system.alarm-pending.body.rule": "Started by {{rule}} on {{deviceName}}",
+	"system.alarm-rearmed.title.home": "Re-armed: home",
+	"system.alarm-rearmed.title.away": "Re-armed: away",
+	"system.alarm-rearmed.title.night": "Re-armed: night",
+	"system.alarm-rearmed.body": "The siren ended and the alarm is armed again",
+	"system.alarm-sensor-bypass.title": "{{deviceName}}",
+	"system.alarm-sensor-bypass.body.ignored": "Ignored: it was open when the alarm was armed",
+	"system.alarm-sensor-bypass.body.lifted": "Monitored again: it closed and opened",
+	"system.alarm-check-failed.title.home": "Armed home without checking openings",
+	"system.alarm-check-failed.title.away": "Armed away without checking openings",
+	"system.alarm-check-failed.title.night": "Armed night without checking openings",
+	"system.alarm-check-failed.body": "The device states could not be read",
 	"button.snooze.minutes": "Snooze {{minutes}} min",
 	"button.snooze.hours": {
 		"one": "Snooze {{hours}} hour",
 		"other": "Snooze {{hours}} hours"
 	},
 	"button.alarm.disarm": "Disarm",
+	"button.alarm.armAnyway": "Arm anyway",
 	"button.alarm.arm.home": "Arm home",
 	"button.alarm.arm.away": "Arm away",
 	"button.alarm.arm.night": "Arm night",
@@ -11678,7 +12617,8 @@ var it_default = {
 	"alarm.arming.body.skipped": "Esclusi: {{names}}",
 	"alarm.arm.body.bypassed": "Attivi: {{devices}}\nBypassati: {{bypassedNames}}",
 	"alarm.arming.body.bypassed": "Bypassati: {{bypassedNames}}",
-	"alarm.armRefused.body": "Aperti: {{names}}\nRipeti entro {{seconds}}s per inserire con bypass.",
+	"alarm.armRefused.body": "Aperti: {{names}}",
+	"alarm.armRefused.body.hint": "Aperti: {{names}}\nTocca “Arma comunque” per armare escludendoli.",
 	"alarm.device.unnamed": "Dispositivo {{id}}",
 	"alarm.combined.title": "Allarme: {{deviceName}}",
 	"system.alarm-arm-refused.title.home": "Inserimento Casa rifiutato",
@@ -11695,15 +12635,33 @@ var it_default = {
 	"system.alarm-armed.body": "Allarme inserito",
 	"system.alarm-disarmed.title": "Disinserito",
 	"system.alarm-disarmed.body": "Allarme disinserito",
+	"system.alarm-disarmed.body.defused": "Allarme disinserito durante un allarme",
 	"system.alarm-triggered.title": "ALLARME",
 	"system.alarm-triggered.body": "Allarme scattato",
 	"system.alarm-triggered.body.rule": "Scattato da {{rule}} su {{deviceName}}",
+	"system.alarm-pending.title.home": "Intrusione — Casa, {{seconds}}s per disinserire",
+	"system.alarm-pending.title.away": "Intrusione — Fuori, {{seconds}}s per disinserire",
+	"system.alarm-pending.title.night": "Intrusione — Notte, {{seconds}}s per disinserire",
+	"system.alarm-pending.body": "Ritardo di ingresso avviato",
+	"system.alarm-pending.body.rule": "Avviato da {{rule}} su {{deviceName}}",
+	"system.alarm-rearmed.title.home": "Reinserito: Casa",
+	"system.alarm-rearmed.title.away": "Reinserito: Fuori",
+	"system.alarm-rearmed.title.night": "Reinserito: Notte",
+	"system.alarm-rearmed.body": "La sirena è terminata e l'allarme è di nuovo inserito",
+	"system.alarm-sensor-bypass.title": "{{deviceName}}",
+	"system.alarm-sensor-bypass.body.ignored": "Ignorato: era aperto all'inserimento",
+	"system.alarm-sensor-bypass.body.lifted": "Di nuovo sorvegliato: si è chiuso e riaperto",
+	"system.alarm-check-failed.title.home": "Inserito Casa senza controllare le aperture",
+	"system.alarm-check-failed.title.away": "Inserito Fuori senza controllare le aperture",
+	"system.alarm-check-failed.title.night": "Inserito Notte senza controllare le aperture",
+	"system.alarm-check-failed.body": "Non è stato possibile leggere lo stato dei dispositivi",
 	"button.snooze.minutes": "Silenzia {{minutes}} min",
 	"button.snooze.hours": {
 		"one": "Silenzia {{hours}} ora",
 		"other": "Silenzia {{hours}} ore"
 	},
 	"button.alarm.disarm": "Disarma",
+	"button.alarm.armAnyway": "Arma comunque",
 	"button.alarm.arm.home": "Arma casa",
 	"button.alarm.arm.away": "Arma fuori",
 	"button.alarm.arm.night": "Arma notte",
@@ -16328,6 +17286,8 @@ var OUTBOX_RECORD_KINDS = new Set([
 function isOutboxRecordKind(x) {
 	return typeof x === "string" && OUTBOX_RECORD_KINDS.has(x);
 }
+/** A stored row back to an entry — a guard, never a cast. Exported for the
+*  specs that read the store a centre wrote to. */
 function rowToEntry$1(id, data) {
 	const ruleId = data["ruleId"];
 	const targetId = data["targetId"];
@@ -23191,6 +24151,26 @@ var TIMELAPSE_LOOKAHEAD_MS = 9 * 864e5;
 */
 var NC_ALARM_ANNOUNCE_RULE_ID = "nc-alarm-announce";
 /**
+* A rule's media policy, as the fields a row freezes — ONE derivation, used by
+* every row a rule addresses AND by the alarm's own announcement row when it is
+* the COMBINED siren (the triggering rule's pictures on the alarm's words).
+*/
+function mediaPolicyFields(mediaRule, cropZoneIds) {
+	const media = mediaRule.media;
+	return {
+		media: media.attach,
+		...media.zoneCrop === true && cropZoneIds !== void 0 ? { mediaZoneIds: [...cropZoneIds] } : {},
+		...cropZoneIds !== void 0 ? { triggerZoneIds: [...cropZoneIds] } : {},
+		...media.frame !== void 0 ? { mediaFrame: media.frame } : {},
+		...media.profile !== void 0 ? { mediaProfile: media.profile } : {},
+		...media.gif === true ? { mediaGif: true } : {},
+		...media.clip === true ? { mediaClip: true } : {},
+		...media.clipPreRollSec !== void 0 ? { mediaClipPreRollSec: media.clipPreRollSec } : {},
+		...media.clipSpeed !== void 0 ? { mediaClipSpeed: media.clipSpeed } : {},
+		...media.clipPostRollSec !== void 0 ? { mediaClipPostRollSec: media.clipPostRollSec } : {}
+	};
+}
+/**
 * Synthetic rule id for an export's on-screen picker.
 *
 * The operator named these targets on the export screen, not in a rule. The
@@ -23208,10 +24188,35 @@ var NC_EXPORT_NOTIFY_RULE_ID = "nc-export-notify";
 * notification that says the alarm was disarmed is worse than offering nothing.
 */
 function alarmButtonKind(kind) {
-	if (kind === "alarm-triggered" || kind === "alarm-armed" || kind === "alarm-arming" || kind === "alarm-disarmed") return kind;
-	return null;
+	switch (kind) {
+		case "alarm-triggered":
+		case "alarm-armed":
+		case "alarm-arming":
+		case "alarm-disarmed":
+		case "alarm-pending":
+		case "alarm-rearmed":
+		case "alarm-check-failed":
+		case "alarm-arm-refused":
+		case "alarm-sensor-bypass": return kind;
+		default: return null;
+	}
+}
+/** The refusal id an `alarm-arm-refused` row froze (`incomingFromAlarmTransition`). */
+function rowRefusalId(systemEvent) {
+	const value = systemEvent?.data["refusalId"];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 /**
+* What a pressed Arm anyway that did nothing tells the person holding the
+* phone — one sentence per reason the panel refused it.
+*/
+var ARM_ANYWAY_REJECTION_COPY = {
+	stale: "The alarm changed since this notification — nothing was armed",
+	expired: "This button expired — arm again from the app",
+	used: "Already used",
+	"unknown-refusal": "This refusal is no longer current — arm again"
+};
+/**
 * What the sustained-state alerts run on when nothing wired the settings in.
 *
 * The SHIPPED DEFAULTS, not "off". A wiring that silently disabled the feature
@@ -23315,7 +24320,6 @@ function consumablesSliceOf(event) {
 */
 var NC_ALARM_SETTINGS_FALLBACK = {
 	...DEFAULT_DELAYS,
-	announceArm: false,
 	announceTargets: [],
 	nonBlocking: []
 };
@@ -23425,47 +24429,6 @@ function historyRecordKind(kind) {
 	return kind;
 }
 /**
-* The system-event half of a history row, in the CAP's shape.
-*
-* The cap contract (`NcHistoryEntry`, frozen in `@camstack/types`) wants a
-* title and a body, and a row written since the text catalog carries keys
-* instead. So history resolves them through the SAME catalog the delivery used
-* — history must read as what the operator was actually sent, and a page that
-* showed a key while the phone showed a sentence would be a second vocabulary
-* to keep in step. A pre-catalog row falls back to the pair frozen on it.
-*/
-/**
-* Cap-facing downgrade of a system-event kind — the SAME device as
-* {@link historyRecordKind}, and it exists for the same reason.
-*
-* This addon bundles its own `@camstack/types` (self-contained externals), so
-* it can emit a kind the enum in the RUNNING SERVER does not have. The history
-* router does not: it validates its output against the host's
-* `NcHistorySubjectSchema`, whose `kind` is a `z.enum`. One row carrying a kind
-* the host has never heard of therefore does not degrade — it fails the whole
-* `getHistory` call, for every row, exactly as the enum's own legacy-tail note
-* warns.
-*
-* `alarm-arming` is projected onto `alarm-armed`, its nearest member: same
-* panel, same lifecycle, adjacent instant. Nothing a person reads changes —
-* the row's title and body are resolved from the arming keys ("Inserimento
-* Fuori — attivo tra 30 secondi") — only the machine-facing word does.
-*
-* DELETE THIS when a `@camstack/server` closure carrying `alarm-arming` in
-* `NcSystemEventKindSchema` is installed everywhere this addon runs. Until
-* then it is what lets the exit-delay notification ship without a train.
-*/
-/**
-* The mirrored device-state word, narrowed to a contact reading.
-*
-* Anything that is not one of the two contact words is `undefined` — a device
-* whose slice the state table read as `on` / `armed_home` is not a contact, and
-* an exclusion must never be lifted by a word that belongs to another cap.
-*/
-function contactReadingOf(state) {
-	if (state === "open" || state === "closed") return state;
-}
-/**
 * The subject kind a persisted record kind maps to.
 *
 * `NcOutboxRecordKind` carries two kinds a rule subject never has —
@@ -23503,11 +24466,16 @@ function cooldownSubjectFromOutbox(entry) {
 		...subject.systemEvent !== void 0 ? { systemEvent: subject.systemEvent } : {}
 	};
 }
-function historySystemEventKind(kind) {
-	if (kind === "alarm-arming") return "alarm-armed";
-	if (kind === "alarm-arm-refused") return "alarm-disarmed";
-	return kind;
-}
+/**
+* The system-event half of a history row, in the CAP's shape.
+*
+* The cap contract (`NcHistoryEntry`, frozen in `@camstack/types`) wants a
+* title and a body, and a row written since the text catalog carries keys
+* instead. So history resolves them through the SAME catalog the delivery used
+* — history must read as what the operator was actually sent, and a page that
+* showed a key while the phone showed a sentence would be a second vocabulary
+* to keep in step. A pre-catalog row falls back to the pair frozen on it.
+*/
 function historySystemEvent(texts, systemEvent) {
 	const vars = systemEvent.textParams ?? {};
 	const count = systemEvent.textCount;
@@ -23520,7 +24488,7 @@ function historySystemEvent(texts, systemEvent) {
 		return frozen ?? "";
 	};
 	return {
-		kind: historySystemEventKind(systemEvent.kind),
+		kind: systemEvent.kind,
 		subject: systemEvent.subject,
 		title: resolve(systemEvent.titleKey, systemEvent.title),
 		body: resolve(systemEvent.bodyKey, systemEvent.body),
@@ -23708,6 +24676,13 @@ var NotificationCenter = class NotificationCenter {
 	audioEnabled = false;
 	/** The panel this node owns, or null. See {@link NcAlarmPanelPort}. */
 	alarmPanel = null;
+	/**
+	* The words the panel answers the `deviceState` gate with — its state, plus
+	* the armed mode a `pending`/`triggered` belongs to (D630). Refreshed on
+	* every publish, next to the one-word mirror; the lookup only uses them
+	* while the mirror agrees on the state (`panelAwareLookup`).
+	*/
+	panelGateWords = null;
 	/** In-memory cooldown map — seeded from persisted outbox rows on start. */
 	lastFiredAt = /* @__PURE__ */ new Map();
 	/**
@@ -23805,11 +24780,12 @@ var NotificationCenter = class NotificationCenter {
 	async mintButtons(input) {
 		const mint = this.deps.mintActionUrl;
 		if (mint === void 0) return [];
-		const rule = this.rules.get(input.ruleId);
-		if (rule === null) return [];
+		const stored = this.rules.get(input.ruleId);
+		const announcement = stored === null && input.ruleId === "nc-alarm-announce";
+		if (stored === null && !announcement) return [];
 		const drafts = [];
-		const sequenceButtons = this.actionRunner === null ? [] : buildActionButtons({
-			actions: rule.actions,
+		const sequenceButtons = this.actionRunner === null || stored === null ? [] : buildActionButtons({
+			actions: stored.actions,
 			mintUrl: ({ sequence, actionId }) => {
 				const id = (0, node_crypto.randomUUID)();
 				drafts.push({
@@ -23830,8 +24806,8 @@ var NotificationCenter = class NotificationCenter {
 				return id;
 			}
 		});
-		const snoozeButtons = input.ownerUserId === void 0 ? [] : buildSnoozeButtons({
-			rule,
+		const snoozeButtons = input.ownerUserId === void 0 || stored === null ? [] : buildSnoozeButtons({
+			rule: stored,
 			label: (minutes) => this.snoozeButtonLabel(minutes),
 			mintUrl: ({ actionId, minutes }) => {
 				const id = (0, node_crypto.randomUUID)();
@@ -23858,36 +24834,63 @@ var NotificationCenter = class NotificationCenter {
 		});
 		const alarmKind = alarmButtonKind(input.systemEvent?.kind);
 		const panel = this.alarmPanel;
+		const refusalId = rowRefusalId(input.systemEvent);
+		if (alarmKind === "alarm-arm-refused" && refusalId === void 0) this.logger.debug("refusal notification carries no Arm anyway — the row names no refusal", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				ruleId: input.ruleId,
+				targetId: input.targetId
+			}
+		});
 		const alarmButtons = alarmKind === null ? [] : buildAlarmButtons({
 			kind: alarmKind,
 			panel: panel === null ? null : {
 				deviceId: panel.deviceId,
 				availableModes: panel.availableModes()
 			},
+			...refusalId !== void 0 ? { refusalId } : {},
 			labels: {
 				disarm: this.texts.text({ key: "button.alarm.disarm" }),
-				arm: (mode) => this.texts.text({ key: `button.alarm.arm.${mode}` })
+				arm: (mode) => this.texts.text({ key: `button.alarm.arm.${mode}` }),
+				armAnyway: this.texts.text({ key: "button.alarm.armAnyway" })
 			},
-			mintUrl: ({ actionId, action, mode }) => {
+			mintUrl: (button) => {
 				const id = (0, node_crypto.randomUUID)();
-				const panelDeviceId = panel?.deviceId ?? 0;
+				const common = {
+					kind: "alarm",
+					id,
+					panelDeviceId: panel?.deviceId ?? 0,
+					deviceId: input.deviceId,
+					actionId: button.actionId,
+					targetId: input.targetId
+				};
 				drafts.push({
 					id,
 					ttlMs: actionTtlMs({
 						kind: "alarm",
-						action
+						action: button.action
 					}),
-					grant: (expiresAt) => ({
-						kind: "alarm",
-						id,
-						action,
-						...mode !== void 0 ? { mode } : {},
-						panelDeviceId,
-						deviceId: input.deviceId,
-						actionId,
-						targetId: input.targetId,
-						expiresAt
-					})
+					grant: (expiresAt) => {
+						switch (button.action) {
+							case "arm-anyway": return {
+								...common,
+								action: "arm-anyway",
+								refusalId: button.refusalId,
+								expiresAt
+							};
+							case "arm": return {
+								...common,
+								action: "arm",
+								mode: button.mode,
+								expiresAt
+							};
+							case "disarm": return {
+								...common,
+								action: "disarm",
+								expiresAt
+							};
+						}
+					}
 				});
 				return id;
 			}
@@ -24069,10 +25072,11 @@ var NotificationCenter = class NotificationCenter {
 	/** Arm or disarm the panel a button granted. Throws when the panel is gone —
 	*  the plane turns that into the page that says so. */
 	async applyGrantedAlarm(grant) {
-		if (this.deps.actuate === void 0) throw new Error("no actuator is wired on this node");
 		const panel = this.alarmPanel;
 		if (panel === null) throw new Error("this node has no alarm panel");
 		if (panel.deviceId !== grant.panelDeviceId) throw new Error("this button was minted for a different alarm panel");
+		if (grant.action === "arm-anyway") return this.applyGrantedArmAnyway(panel, grant);
+		if (this.deps.actuate === void 0) throw new Error("no actuator is wired on this node");
 		await this.actuateWithAttribution({
 			deviceId: panel.deviceId,
 			cap: ALARM_PANEL_CAP,
@@ -24080,6 +25084,34 @@ var NotificationCenter = class NotificationCenter {
 			args: grant.action === "arm" && grant.mode !== void 0 ? { mode: grant.mode } : {}
 		});
 	}
+	/**
+	* The Arm anyway on a refusal notification — IN-PROCESS, `armAnyway(refusalId)`,
+	* never the cap: `alarm-panel.arm` has no field for a refusal, and a plain
+	* arm would simply be refused again.
+	*
+	* The token claim is already atomic and single-use; the panel adds its own
+	* one-shot on the refusal, so a second phone's copy of the same button is
+	* `used`. Every way it does nothing throws a sentence the page shows.
+	*/
+	async applyGrantedArmAnyway(panel, grant) {
+		const outcome = await panel.armAnyway(grant.refusalId);
+		switch (outcome.outcome) {
+			case "rejected": throw new NcActionRefusedError(ARM_ANYWAY_REJECTION_COPY[outcome.reason]);
+			case "refused": throw new NcActionRefusedError("Something else is open now — see the new notification");
+			case "arming":
+			case "armed":
+				this.logger.info("alarm armed from a refusal notification (Arm anyway)", {
+					tags: { deviceId: panel.deviceId },
+					meta: {
+						refusalId: grant.refusalId,
+						outcome: outcome.outcome,
+						excluded: outcome.excluded.length,
+						targetId: grant.targetId ?? null
+					}
+				});
+				return;
+		}
+	}
 	/** The registry the action plane claims against. */
 	get actionTokenRegistry() {
 		return this.actionTokens;
@@ -25139,17 +26171,38 @@ var NotificationCenter = class NotificationCenter {
 	* before it.
 	*/
 	onSensorEventPersisted(event, markerTrackId) {
-		this.observeContactEvent(event);
+		this.observeOpeningEvent(event);
 		this.consumeEvent(incomingFromSensorEvent(event, markerTrackId));
 	}
-	/** The contact reading a sensor row carries, handed to the panel. Nothing at
-	*  all for any other sensor kind — see {@link observeAlarmContacts}. */
-	observeContactEvent(event) {
+	/**
+	* Called for a sensor state change no camera takes a timeline row for
+	* (`ingestSensorStateChange`'s `onUnowned`, D630 §6): linked to no camera
+	* (`linkedCameraIds` = []), or linked only by cameras that did not opt it
+	* into tracked events (`linkedCameraIds` = those cameras). Nothing was
+	* persisted, but the event is evaluated exactly like a persisted one, so a
+	* contact rule fires and the contact reaches the alarm panel. The sensor is
+	* its own device, and the notification is text-only (no marker).
+	*
+	* A separate door from {@link onSensorEventPersisted} because the SUBJECT
+	* differs, not the path: both feed the panel first and then the same
+	* evaluation. Same lossy boundary: no row, so no reconcile.
+	*/
+	onUnownedSensorEvent(event, linkedCameraIds) {
+		this.observeOpeningEvent(event);
+		this.consumeEvent(incomingFromUnownedSensorEvent(event, linkedCameraIds));
+	}
+	/**
+	* The opening reading a sensor row carries — a contact, a cover or a lock,
+	* read with D630's table (`alarmOpeningFromSensorEvent`) — handed to the
+	* panel. A row that is not an opening, or whose word is unknown, hands over
+	* nothing: an unreadable state must never move an exclusion (D49).
+	*/
+	observeOpeningEvent(event) {
 		const panel = this.alarmPanel;
-		if (panel === null || event.kind !== "contact") return;
-		const entryOpen = event.value?.["entryOpen"];
-		if (typeof entryOpen !== "boolean") return;
-		panel.observeContact(event.sourceDeviceId, entryOpen ? "open" : "closed", event.timestamp);
+		if (panel === null) return;
+		const opening = alarmOpeningFromSensorEvent(event.kind, event.value);
+		if (opening.kind !== "reading") return;
+		panel.observeOpening(event.sourceDeviceId, opening.reading, event.timestamp);
 	}
 	/**
 	* Called at the AUDIO-event persist site (`eventStore.insertAudio`), in the
@@ -25501,22 +26554,7 @@ var NotificationCenter = class NotificationCenter {
 				return { success: true };
 			},
 			getAlarmConfig: async () => this.alarmConfig(),
-			setAlarmConfig: async ({ patch }) => {
-				const panel = this.alarmPanel;
-				if (panel === null) throw new Error("this node has no alarm panel");
-				const settings = await panel.applySettings(patch);
-				this.logger.info("alarm settings changed", {
-					tags: { deviceId: panel.deviceId },
-					meta: {
-						exitDelaySec: settings.exitDelaySec,
-						entryDelaySec: settings.entryDelaySec,
-						triggeredDurationSec: settings.triggeredDurationSec,
-						announceArm: settings.announceArm,
-						announceTargets: settings.announceTargets.length
-					}
-				});
-				return this.alarmConfig();
-			}
+			setAlarmConfig: async ({ patch }) => this.setAlarmConfig(patch)
 		};
 	}
 	/**
@@ -25526,66 +26564,96 @@ var NotificationCenter = class NotificationCenter {
 	*/
 	setAlarmPanel(panel) {
 		this.alarmPanel = panel;
+		if (panel === null || this.panelGateWords?.deviceId !== panel.deviceId) this.panelGateWords = null;
+	}
+	/**
+	* The `deviceState` lookup the engine gets — live path and dry-run alike, so
+	* the tester predicts what the saved rule will do. Every device answers its
+	* one word from `read`; the panel this node owns also answers the armed mode
+	* its `pending`/`triggered` belongs to (D630).
+	*/
+	deviceStateLookup(read) {
+		return panelAwareLookup(read, this.panelGateWords);
 	}
 	/**
 	* What the panel asks before it arms — see {@link NcAlarmArmGuardHook}.
 	*
 	* Handed to the panel by the same wiring that hands it the publish hook: the
 	* panel owns the state machine, the centre owns the rules that say which
-	* contacts a mode covers, and neither can reach the other on its own.
+	* devices a mode covers, and neither can reach the other on its own.
 	*/
 	alarmArmGuard() {
 		return {
-			openContacts: (mode) => this.alarmOpenContacts(mode),
-			announceRefusal: (input) => this.announceArmRefused(input)
+			openings: (mode) => this.alarmOpenings(mode),
+			announceRefusal: (input) => this.announceArmRefused(input),
+			announceCheckFailed: (input) => this.announceArmCheckFailed(input)
 		};
 	}
 	/**
-	* Which of the contacts this mode covers read OPEN, right now.
+	* Which of the devices this mode covers are OPEN right now, and which could
+	* not be read (D630).
 	*
-	* A TARGETED read of at most the handful of sensors the mode names, not a
-	* refresh of the whole watched set: the arm is a person pressing a button and
-	* the answer has to be about this second, but it must not become a fan-out
-	* over every gated device on the hub.
+	* A TARGETED read of at most the handful of devices the mode's rules name,
+	* not a refresh of the whole watched set: the arm is a person pressing a
+	* button and the answer has to be about this second, but it must not become
+	* a fan-out over every gated device on the hub. Read through
+	* `readDeviceOpenings`, so a cover or a lock that is not secure is open too,
+	* and a camera an intrusion rule names is `not-opening` and takes no part.
 	*
-	* Three fail-open rules, and all three exist because refusing an arm on
-	* ignorance is worse than arming:
+	* Never a guess, in either direction (D49):
 	*
-	*  - a sensor the read could not answer for falls back to the mirrored state
-	*    (bounded staleness, the same contract the `deviceState` gate lives with);
-	*  - a sensor NEITHER can answer for is not blocking, and says so in a line;
-	*  - a mode whose contact rule names no devices blocks nothing, and says so —
-	*    an unscoped contact rule covers every contact on the hub, and a refusal
-	*    naming devices the operator never associated with the alarm is one they
-	*    cannot act on.
+	*  - a device the read could not answer for (absent), or whose opening slice
+	*    carries a word its cap does not define (`unknown`), is UNKNOWN — it
+	*    never blocks, is never counted secure, and says so in one line each;
+	*  - a mode whose rules name no devices blocks nothing — an unscoped rule
+	*    covers every device on the hub, and a refusal naming devices the
+	*    operator never associated with the alarm is one they cannot act on;
+	*  - when NOTHING could be read (no reader, the read threw, or every id came
+	*    back absent) this THROWS, and the panel arms and announces that it
+	*    armed without the check.
 	*/
-	async alarmOpenContacts(mode) {
+	async alarmOpenings(mode) {
 		const panel = this.alarmPanel;
-		if (panel === null) return [];
-		const candidates = alarmBlockingCandidates(this.rules.list(), panel.deviceId, mode);
-		if (candidates.length === 0) return [];
-		const fresh = await this.readContactStates(candidates);
+		if (panel === null) return {
+			open: [],
+			unknown: []
+		};
+		const candidates = alarmCoveredDevices(this.rules.list(), panel.deviceId, mode);
+		if (candidates.length === 0) return {
+			open: [],
+			unknown: []
+		};
+		const read = this.deps.readDeviceOpenings;
+		if (read === void 0) throw new Error("no openings reader is wired on this node");
+		const openings = await read(candidates);
+		if (openings.size === 0) throw new Error(`none of the ${String(candidates.length)} covered devices could be read`);
 		const name = this.deviceNameFromDirectory();
 		const open = [];
 		const unknown = [];
 		for (const deviceId of candidates) {
-			const state = fresh.get(deviceId) ?? this.deviceStates.get(deviceId);
-			if (state === void 0) {
+			const verdict = classifyCoveredOpening(openings.get(deviceId));
+			if (verdict.kind === "unknown") {
 				unknown.push(deviceId);
+				this.logger.info("alarm arm check: device state unreadable — it cannot block this arm", {
+					tags: { deviceId },
+					meta: {
+						panelDeviceId: panel.deviceId,
+						mode,
+						why: verdict.why,
+						...verdict.why === "unknown-word" ? {
+							cap: verdict.cap,
+							raw: rawForLog(verdict.raw)
+						} : {}
+					}
+				});
 				continue;
 			}
-			if (state === "open") open.push({
+			if (verdict.kind === "open") open.push({
 				deviceId,
-				name: name(deviceId)
+				name: name(deviceId),
+				state: verdict.state
 			});
 		}
-		for (const deviceId of unknown) this.logger.info("alarm arm check: no contact state — the sensor cannot block this arm", {
-			tags: { deviceId },
-			meta: {
-				panelDeviceId: panel.deviceId,
-				mode
-			}
-		});
 		this.logger.info("alarm arm check", {
 			tags: { deviceId: panel.deviceId },
 			meta: {
@@ -25593,55 +26661,198 @@ var NotificationCenter = class NotificationCenter {
 				candidates: candidates.length,
 				open: open.length,
 				unknown: unknown.length,
-				openIds: open.map((c) => c.deviceId).join(",")
+				openIds: open.map((d) => d.deviceId).join(",")
 			}
 		});
-		return open;
-	}
-	/** One bounded read of the named contacts. Never throws — an unreadable
-	*  sensor is simply absent, exactly as `NcDeviceStateCache` contracts. */
-	async readContactStates(ids) {
-		const read = this.deps.readDeviceStates;
-		if (read === void 0) return /* @__PURE__ */ new Map();
-		try {
-			return await read(ids);
-		} catch (err) {
-			this.logger.warn("alarm arm check: contact read failed — falling back to the mirror", { meta: {
-				devices: ids.length,
-				error: String(err)
-			} });
-			return /* @__PURE__ */ new Map();
-		}
+		return {
+			open,
+			unknown
+		};
 	}
 	/**
 	* The refusal, as an ordinary notification.
 	*
-	* Same path the arm announcement takes (D126: the alarm speaks through the
-	* ordinary notification path), so it is durable, retried, in history and
+	* Same path every alarm announcement takes (D126: the alarm speaks through
+	* the ordinary notification path), so it is durable, retried, in history and
 	* worded in the reader's language at send time. It is the operator's ONLY
 	* copy: the thrown error reaches whoever called the cap, and when that caller
-	* is a notification button on a phone, nobody ever sees it.
+	* is a notification button on a phone, nobody ever sees it. The refusal id
+	* rides the transition onto the ROW, where the Arm anyway button is minted
+	* from (D630).
 	*/
 	announceArmRefused(input) {
 		const panel = this.alarmPanel;
 		if (panel === null) return;
-		const text = buildArmRefusedAnnouncement(input.mode, input.blocking.map((c) => c.name), input.retrySeconds);
-		const transition = {
+		this.scheduleAlarmTransition(panel, {
 			kind: "alarm-arm-refused",
-			state: "disarmed",
-			previous: "disarmed",
+			state: input.state,
+			previous: input.state,
+			mode: input.refusal.mode,
+			at: input.at,
+			refusalId: input.refusal.id,
+			blocking: input.blocking.map((d) => ({
+				deviceId: d.deviceId,
+				name: d.name,
+				state: d.state
+			}))
+		});
+	}
+	/**
+	* The panel armed WITHOUT the openings check — nothing could be read. A
+	* line on the panel AND an `alarm-check-failed` notification to its
+	* recipients: "armed, but I could not check the windows" is exactly what the
+	* operator has to hear before leaving.
+	*/
+	announceArmCheckFailed(input) {
+		const panel = this.alarmPanel;
+		if (panel === null) return;
+		this.logger.warn("alarm armed WITHOUT the openings check — nothing could be read", {
+			tags: { deviceId: panel.deviceId },
+			meta: {
+				mode: input.mode,
+				at: input.at,
+				error: input.error
+			}
+		});
+		this.scheduleAlarmTransition(panel, {
+			kind: "alarm-check-failed",
+			state: input.state,
+			previous: input.state,
 			mode: input.mode,
 			at: input.at
+		});
+	}
+	/**
+	* The alarm, for the `nc.*` bridge — the viewer's and the admin tab's
+	* surface (`nc-actions.ts` decides who may call what). The same paths the cap
+	* and the notification buttons take: `armWith`, `armAnyway`, `disarm` on the
+	* panel, and the one config reader/writer below.
+	*/
+	alarmActions() {
+		const requirePanel = () => {
+			const panel = this.alarmPanel;
+			if (panel === null) throw new Error("this node has no alarm panel");
+			return panel;
 		};
-		const settings = panel.settings();
-		const targetIds = settings.announceArm ? settings.announceTargets : [];
-		this.scheduleAlarmTransition(panel, transition, {
-			text,
-			targetIds
+		return {
+			status: async () => {
+				const panel = this.alarmPanel;
+				if (panel === null) return {
+					deviceId: null,
+					live: null
+				};
+				return {
+					deviceId: panel.deviceId,
+					live: await this.alarmLive(panel)
+				};
+			},
+			arm: async (mode, userId) => {
+				const panel = requirePanel();
+				const outcome = await panel.armWith(mode);
+				this.logger.info("alarm arm requested through the bridge", {
+					tags: { deviceId: panel.deviceId },
+					meta: {
+						userId,
+						mode,
+						outcome: outcome.outcome
+					}
+				});
+				return outcome;
+			},
+			armAnyway: async (refusalId, userId) => {
+				const panel = requirePanel();
+				const outcome = await panel.armAnyway(refusalId);
+				this.logger.info("alarm Arm anyway requested through the bridge", {
+					tags: { deviceId: panel.deviceId },
+					meta: {
+						userId,
+						refusalId,
+						outcome: outcome.outcome
+					}
+				});
+				return outcome;
+			},
+			disarm: async (userId) => {
+				const panel = requirePanel();
+				await panel.disarm();
+				this.logger.info("alarm disarm requested through the bridge", {
+					tags: { deviceId: panel.deviceId },
+					meta: { userId }
+				});
+			},
+			getConfig: () => this.alarmConfig(),
+			setConfig: (patch) => this.setAlarmConfig(patch)
+		};
+	}
+	async setAlarmConfig(patch) {
+		const panel = this.alarmPanel;
+		if (panel === null) throw new Error("this node has no alarm panel");
+		const settings = await panel.applySettings(patch);
+		this.logger.info("alarm settings changed", {
+			tags: { deviceId: panel.deviceId },
+			meta: {
+				exitDelaySec: settings.exitDelaySec,
+				entryDelaySec: settings.entryDelaySec,
+				triggeredDurationSec: settings.triggeredDurationSec,
+				announceTargets: settings.announceTargets.length
+			}
+		});
+		return this.alarmConfig();
+	}
+	/**
+	* The panel as it is NOW — see `alarm-live.ts`.
+	*
+	* ONE read of the union of every mode's covered devices, so each is read
+	* once however many modes cover it. A read that fails is not an error here:
+	* every covered device is then `unknown` (D49) and the line says why — a
+	* status the UI polls must not fail because a contact is asleep.
+	*/
+	async alarmLive(panel) {
+		const modes = panel.availableModes();
+		const rules = this.rules.list();
+		const covered = new Map(modes.map((mode) => [mode, alarmCoveredDevices(rules, panel.deviceId, mode)]));
+		const ids = alarmLiveReadIds(covered);
+		let openings = /* @__PURE__ */ new Map();
+		const read = this.deps.readDeviceOpenings;
+		let readThrew = false;
+		if (ids.length > 0 && read === void 0) this.logger.warn("alarm live view: no openings reader is wired — every opening is unknown", {
+			tags: { deviceId: panel.deviceId },
+			meta: { covered: ids.length }
+		});
+		else if (ids.length > 0 && read !== void 0) try {
+			openings = await read(ids);
+		} catch (err) {
+			readThrew = true;
+			this.logger.warn("alarm live view: openings read failed — every opening is unknown", {
+				tags: { deviceId: panel.deviceId },
+				meta: {
+					covered: ids.length,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		const unanswered = ids.filter((id) => !openings.has(id));
+		if (read !== void 0 && !readThrew && unanswered.length > 0) this.logger.warn("alarm live view: covered devices did not answer — shown as unknown", {
+			tags: { deviceId: panel.deviceId },
+			meta: {
+				covered: ids.length,
+				unanswered: unanswered.length,
+				unansweredIds: unanswered.join(",")
+			}
+		});
+		return buildAlarmLive({
+			state: panel.currentState(),
+			target: panel.currentTarget(),
+			modes,
+			covered,
+			openings,
+			nonBlocking: panel.settings().nonBlocking,
+			exclusions: panel.exclusionPhases(),
+			name: this.deviceNameFromDirectory()
 		});
 	}
-	/** Settings + the DERIVED coverage. Read together — see the cap doc. */
-	alarmConfig() {
+	/** Settings + the DERIVED coverage + the live panel. Read together — see the cap doc. */
+	async alarmConfig() {
 		const panel = this.alarmPanel;
 		if (panel === null) return {
 			deviceId: null,
@@ -25651,6 +26862,7 @@ var NotificationCenter = class NotificationCenter {
 		return {
 			deviceId: panel.deviceId,
 			settings: panel.settings(),
+			live: await this.alarmLive(panel),
 			coverage: this.coverageFor(panel).map((c) => ({
 				...c,
 				deviceIds: [...c.deviceIds],
@@ -25794,6 +27006,10 @@ var NotificationCenter = class NotificationCenter {
 		const panel = this.alarmPanel;
 		if (panel === null) return;
 		this.deviceStates.note(panel.deviceId, report.state);
+		this.panelGateWords = {
+			deviceId: panel.deviceId,
+			words: alarmGateWords(report.state, report.target)
+		};
 		const transition = report.transition;
 		if (transition === null) return;
 		this.scheduleAlarmTransition(panel, transition);
@@ -25805,28 +27021,29 @@ var NotificationCenter = class NotificationCenter {
 	* On the SAME serialized chain as every other evaluation, because both of
 	* those follow-ups read what the evaluation just enqueued:
 	*
-	*  - an ARM is also announced to the panel's own `announceTargets`, which no
-	*    rule addresses — but only where a rule has not already delivered it, or
-	*    a target that is both would get the same sentence twice;
+	*  - EVERY alarm transition is also announced to the panel's own
+	*    `announceTargets`, which no rule addresses (D630) — but only where a
+	*    rule has not already delivered it, or a target that is both would get
+	*    the same sentence twice;
 	*  - a TRIGGERED with an attribution supersedes the triggering rule's own
 	*    still-pending rows, for exactly the targets the alarm reached. That is
 	*    the combined notification: one row carrying the alarm's words and that
 	*    rule's pictures, instead of two pushes about one incident.
 	*/
-	scheduleAlarmTransition(panel, transition, prepared) {
-		const arm = prepared ?? this.armAnnouncement(panel, transition);
+	scheduleAlarmTransition(panel, transition) {
+		const announcement = this.alarmAnnouncement(panel, transition);
 		const incoming = incomingFromAlarmTransition({
 			transition,
 			panelDeviceId: panel.deviceId,
 			lookup: this.deviceDirectory.lookup(),
-			...arm !== null ? { body: arm.text } : {}
+			...announcement.text !== null ? { body: announcement.text } : {}
 		});
 		this.evalChain = this.evalChain.then(async () => {
 			try {
 				const report = await this.evaluateAndEnqueue(incoming);
 				const reached = new Set(report.outcomes.flatMap((o) => o.targetIds));
-				if (arm !== null) await this.enqueueArmAnnouncement(panel, incoming, arm, reached);
-				await this.settleCombinedAlarm(transition, incoming, report, reached);
+				const announced = await this.enqueueAlarmAnnouncement(panel, incoming, announcement, reached);
+				await this.settleCombinedAlarm(transition, incoming, report, reached, announced);
 			} catch (err) {
 				this.logger.warn("alarm transition evaluation failed", {
 					tags: { deviceId: panel.deviceId },
@@ -25840,28 +27057,41 @@ var NotificationCenter = class NotificationCenter {
 		});
 	}
 	/**
-	* The arm/arming sentence and the targets it goes to, or null when the
-	* transition is not one of those two.
+	* The sentence an alarm transition is said with, and the targets it goes to
+	* — for EVERY alarm kind, always the panel's `announceTargets` (D630: the
+	* `announceArm` switch is gone; rules may add more recipients, never fewer).
 	*
-	* Both kinds compose from the SAME coverage — "what does this mode actually
-	* watch" — because they are the same answer given thirty seconds apart. The
-	* arming one is the useful one: it reaches the operator while the exit delay
-	* is still running, so a mode that protects nothing can still be fixed.
+	* `text` is a composed body only where the words depend on the rule set:
 	*
-	* Every way of NOT announcing produces a line: an announcement that silently
-	* did not arrive is indistinguishable from the alarm not having armed, which
-	* is the exact confusion this feature exists to remove. A COVERAGE GAP no
-	* longer suppresses the sentence — it changes it. Suppressing it left the
-	* operator with a title and an empty line (the fallback body key existed in
-	* neither locale) and no way to learn that the mode was gated on by nothing.
+	*  - ARM and ARMING compose from the SAME coverage — "what does this mode
+	*    actually watch" — because they are the same answer given thirty seconds
+	*    apart. A COVERAGE GAP does not suppress the sentence, it changes it.
+	*  - a REFUSAL names the devices that refused it, and — since its row
+	*    carries the Arm anyway — where the button is.
+	*
+	* Every other kind is `null`: the intake picks its catalog body and params.
 	*/
-	armAnnouncement(panel, transition) {
+	alarmAnnouncement(panel, transition) {
+		const targetIds = panel.settings().announceTargets;
+		if (targetIds.length === 0) this.logger.info("alarm transition has no announcement target", {
+			tags: { deviceId: panel.deviceId },
+			meta: { kind: transition.kind }
+		});
+		return {
+			text: this.alarmAnnouncementText(panel, transition),
+			targetIds
+		};
+	}
+	/** The composed body of {@link alarmAnnouncement}, or null for a catalog body. */
+	alarmAnnouncementText(panel, transition) {
 		const kind = transition.kind;
-		if (kind !== "alarm-armed" && kind !== "alarm-arming") return null;
 		const mode = transition.mode;
+		if (kind === "alarm-arm-refused") {
+			if (mode === void 0) return null;
+			return buildArmRefusedAnnouncement(mode, (transition.blocking ?? []).map((d) => d.name), transition.refusalId !== void 0);
+		}
+		if (kind !== "alarm-armed" && kind !== "alarm-arming") return null;
 		if (mode === void 0) return null;
-		const settings = panel.settings();
-		const tags = { deviceId: panel.deviceId };
 		const coverage = this.coverageFor(panel).find((c) => c.mode === mode);
 		if (coverage === void 0) return null;
 		const name = this.deviceNameFromDirectory();
@@ -25869,7 +27099,7 @@ var NotificationCenter = class NotificationCenter {
 		const text = kind === "alarm-arming" ? buildArmingAnnouncement(coverage, transition.seconds ?? 0, name, bypassed) : buildArmAnnouncement(coverage, name, bypassed);
 		const gap = alarmCoverageGap(coverage);
 		if (gap !== null) this.logger.warn("alarm armed into a mode that watches nothing", {
-			tags,
+			tags: { deviceId: panel.deviceId },
 			meta: {
 				mode,
 				kind,
@@ -25879,41 +27109,27 @@ var NotificationCenter = class NotificationCenter {
 				skipped: coverage.skippedDevices.length
 			}
 		});
-		if (!settings.announceArm) return {
-			text,
-			targetIds: []
-		};
-		if (settings.announceTargets.length === 0) {
-			this.logger.info("alarm armed but no announcement target is configured", {
-				tags,
-				meta: { mode }
-			});
-			return {
-				text,
-				targetIds: []
-			};
-		}
-		return {
-			text,
-			targetIds: settings.announceTargets
-		};
+		return text;
 	}
 	/**
-	* Put the arm announcement in the outbox, under {@link NC_ALARM_ANNOUNCE_RULE_ID}.
+	* Put the alarm announcement in the outbox, under {@link NC_ALARM_ANNOUNCE_RULE_ID}.
 	*
 	* The row is what makes this a notification like any other: durable, retried,
 	* visible in history, and rendered in the reader's language at send time
-	* rather than frozen in the hub's at arm time. `recordId` is the transition's
-	* own id, so every arm is a new row (cooldown 0) and a replay of the same one
-	* is deduped.
+	* rather than frozen in the hub's at transition time. `recordId` is the
+	* transition's own id, so every transition is a new row (cooldown 0) and a
+	* replay of the same one is deduped.
 	*
-	* Targets a RULE already reached are skipped — one arm, one sentence, one
-	* push per person, whichever path addressed them.
+	* Targets a RULE already reached are skipped — one transition, one sentence,
+	* one push per person, whichever path addressed them.
 	*/
-	async enqueueArmAnnouncement(panel, incoming, arm, reached) {
-		const targets = arm.targetIds.filter((id) => !reached.has(id));
-		if (targets.length === 0) return;
+	async enqueueAlarmAnnouncement(panel, incoming, announcement, reached) {
+		const targets = announcement.targetIds.filter((id) => !reached.has(id));
+		if (targets.length === 0) return [];
 		const subject = incoming.subject;
+		const alarmSource = subject.systemEvent?.alarmSource;
+		const sourceRule = alarmSource !== void 0 ? this.rules.get(alarmSource.ruleId) : null;
+		const media = sourceRule !== null ? mediaPolicyFields(sourceRule, void 0) : { media: "none" };
 		const entries = targets.map((targetId) => ({
 			ruleId: NC_ALARM_ANNOUNCE_RULE_ID,
 			targetId,
@@ -25924,9 +27140,11 @@ var NotificationCenter = class NotificationCenter {
 				ruleName: "alarm",
 				delivery: "system-event",
 				priority: 2,
-				media: "none",
+				...media,
 				subject: {
 					deviceId: panel.deviceId,
+					...alarmSource?.trackId !== void 0 ? { trackId: alarmSource.trackId } : {},
+					...alarmSource?.eventId !== void 0 ? { eventId: alarmSource.eventId } : {},
 					className: "alarm",
 					zones: [],
 					timestamp: subject.timestamp,
@@ -25935,14 +27153,17 @@ var NotificationCenter = class NotificationCenter {
 			}
 		}));
 		const inserted = await this.outbox.enqueue(entries);
-		this.logger.info("alarm arm announcement enqueued", {
+		this.logger.info("alarm announcement enqueued", {
 			tags: { deviceId: panel.deviceId },
 			meta: {
+				kind: subject.systemEvent?.kind,
 				targets: targets.length,
 				inserted,
-				bodyKey: arm.text.bodyKey
+				bodyKey: subject.systemEvent?.bodyKey,
+				media: media.media
 			}
 		});
+		return targets;
 	}
 	/**
 	* Deliver to targets the producer named (`controls.directTargetIds`).
@@ -26001,12 +27222,12 @@ var NotificationCenter = class NotificationCenter {
 	* went out twenty seconds ago — that is not a duplicate, it is the
 	* escalation, and this says so rather than silently doing nothing.
 	*/
-	async settleCombinedAlarm(transition, incoming, report, reached) {
+	async settleCombinedAlarm(transition, incoming, report, reached, announced) {
 		if (transition.kind !== "alarm-triggered") return;
 		const tags = { deviceId: incoming.subject.deviceId };
 		const source = transition.source;
-		if (reached.size === 0) {
-			this.logger.warn("alarm TRIGGERED but no enabled rule is gated on alarm-triggered", {
+		if (reached.size === 0 && announced.length === 0) {
+			this.logger.warn("alarm TRIGGERED but neither a rule nor an announce target heard it", {
 				tags,
 				meta: {
 					candidates: report.candidates,
@@ -26016,19 +27237,21 @@ var NotificationCenter = class NotificationCenter {
 			return;
 		}
 		if (source === void 0) return;
+		const combined = new Set([...reached, ...announced]);
 		const dropped = await this.outbox.supersede({
 			ruleId: source.ruleId,
 			recordId: source.recordId,
-			targetIds: [...reached]
+			targetIds: [...combined]
 		});
 		this.logger.info("alarm notification combined with the rule that triggered it", {
 			tags,
 			meta: {
 				sourceRuleId: source.ruleId,
 				rule: source.ruleName,
-				targets: reached.size,
+				targets: combined.size,
+				announced: announced.length,
 				superseded: dropped,
-				alreadyDelivered: reached.size - dropped
+				alreadyDelivered: combined.size - dropped
 			}
 		});
 	}
@@ -26128,7 +27351,7 @@ var NotificationCenter = class NotificationCenter {
 		let noOwnerReported = false;
 		const rejections = [];
 		for (const rule of candidates) {
-			const evaluation = evaluateRule(rule, subject, (id) => this.deviceStates.get(id), (id) => this.zoneOwners.get(id), (sceneId) => this.sceneStates.get(sceneId));
+			const evaluation = evaluateRule(rule, subject, this.deviceStateLookup((id) => this.deviceStates.get(id)), (id) => this.zoneOwners.get(id), (sceneId) => this.sceneStates.get(sceneId));
 			if (!evaluation.matched) {
 				if (evaluation.failedCondition === "scene") this.reportSceneSuppression(rule, subject);
 				if (evaluation.excludedBySystemEventFilter !== void 0) this.reportSystemFilterExclusion(rule, subject, evaluation.excludedBySystemEventFilter);
@@ -26150,6 +27373,7 @@ var NotificationCenter = class NotificationCenter {
 						kind,
 						failed: evaluation.failedCondition,
 						classes: subject.classNames,
+						...subject.sensorEdge !== void 0 ? { sensorEdge: subject.sensorEdge } : {},
 						eventId: subject.recordId,
 						...subject.trackId !== void 0 ? { trackId: subject.trackId } : {}
 					}
@@ -26273,15 +27497,24 @@ var NotificationCenter = class NotificationCenter {
 			});
 			if (!noOwnerReported && kind === "device-event" && subject.trackId === void 0 && rule.media.attach !== "none") {
 				noOwnerReported = true;
-				this.logger.warn("device event has no marker track — this notification ships text-only", {
+				const linked = subject.linkedCameraIds;
+				const meta = {
+					recordId: subject.recordId,
+					...subject.sensorKind !== void 0 ? { sensorKind: subject.sensorKind } : {},
+					ruleId: rule.id,
+					rule: rule.name
+				};
+				if (linked !== void 0) this.logger.debug(linked.length === 0 ? "device event from a sensor linked to no camera — this notification ships text-only" : `device event from a sensor linked to ${linked.length} camera(s), none opted into tracked events — this notification ships text-only`, {
 					tags: { deviceId: subject.deviceId },
 					meta: {
-						recordId: subject.recordId,
-						...subject.sensorKind !== void 0 ? { sensorKind: subject.sensorKind } : {},
-						ruleId: rule.id,
-						rule: rule.name
+						...meta,
+						linkedCameraIds: [...linked]
 					}
 				});
+				else this.logger.warn("device event has no marker track — this notification ships text-only", {
+					tags: { deviceId: subject.deviceId },
+					meta
+				});
 			}
 			if (!noOwnerReported && (kind === "audio-window" || kind === "audio-event") && subject.trackId === void 0 && rule.media.attach !== "none") {
 				noOwnerReported = true;
@@ -26609,20 +27842,11 @@ var NotificationCenter = class NotificationCenter {
 				...upgrade !== void 0 ? { enhancement: true } : {},
 				priority: rule.priority,
 				...rule.template !== void 0 ? { template: rule.template } : {},
-				media: noMedia ? "none" : mediaRule.media.attach,
-				...!noMedia && mediaRule.media.zoneCrop === true && cropZoneIds !== void 0 ? { mediaZoneIds: [...cropZoneIds] } : {},
-				...!noMedia && cropZoneIds !== void 0 ? { triggerZoneIds: [...cropZoneIds] } : {},
+				...noMedia ? { media: "none" } : mediaPolicyFields(mediaRule, cropZoneIds),
 				...confirm !== void 0 ? {
 					confirm,
 					...cooldown !== void 0 ? { cooldown } : {}
 				} : {},
-				...!noMedia && mediaRule.media.frame !== void 0 ? { mediaFrame: mediaRule.media.frame } : {},
-				...!noMedia && mediaRule.media.profile !== void 0 ? { mediaProfile: mediaRule.media.profile } : {},
-				...!noMedia && mediaRule.media.gif === true ? { mediaGif: true } : {},
-				...!noMedia && mediaRule.media.clip === true ? { mediaClip: true } : {},
-				...!noMedia && mediaRule.media.clipPreRollSec !== void 0 ? { mediaClipPreRollSec: mediaRule.media.clipPreRollSec } : {},
-				...!noMedia && mediaRule.media?.clipSpeed !== void 0 ? { mediaClipSpeed: mediaRule.media.clipSpeed } : {},
-				...!noMedia && mediaRule.media.clipPostRollSec !== void 0 ? { mediaClipPostRollSec: mediaRule.media.clipPostRollSec } : {},
 				...matchedOn !== void 0 && matchedOn.length > 0 ? { matchedOn } : {},
 				...group !== void 0 && group.members.length > 1 ? { group: {
 					key: group.key,
@@ -26853,8 +28077,6 @@ var NotificationCenter = class NotificationCenter {
 			const devices = rule.conditions.devices;
 			if (zones !== void 0 && zones.ids.length > 0 && devices !== void 0) zoneScoped.push(...devices);
 		}
-		const panel = this.alarmPanel;
-		if (panel !== null) gated.push(...alarmContactWatchList(this.rules.list(), panel.deviceId, panel.availableModes()));
 		this.deviceStates.setWatched(gated);
 		this.zoneOwners.setWatched(zoneScoped);
 		this.sceneStates.setWatched(sceneIds);
@@ -26868,21 +28090,41 @@ var NotificationCenter = class NotificationCenter {
 		}
 	}
 	/**
-	* Feed every excluded sensor's mirrored state back to the panel.
+	* Read every excluded device's opening and feed it back to the panel.
 	*
 	* The reconcile half of the two-phase lift. The EVENT half
-	* ({@link onSensorEventPersisted}) is the fast one, but it only exists for a
-	* sensor linked to a camera — the seven contacts on this hub are linked to
-	* none, so without this an exclusion would never lift at all and the sensor
-	* would stay out of the alarm until a disarm.
-	*/
-	observeAlarmContacts() {
+	* ({@link observeOpeningEvent}) is the fast one, but an event can be dropped
+	* (D8), so the tick re-reads the handful of excluded devices — through the
+	* same `readDeviceOpenings` table the arm check uses, so a cover lifts on
+	* `closed` and a lock on `locked` exactly as on the event path. A device the
+	* read cannot answer for, or that reads unknown, changes nothing (D49).
+	* Never throws into the tick.
+	*/
+	async observeAlarmOpenings() {
 		const panel = this.alarmPanel;
-		if (panel === null) return;
+		const read = this.deps.readDeviceOpenings;
+		if (panel === null || read === void 0) return;
 		const excluded = panel.excludedDevices();
 		if (excluded.length === 0) return;
+		let openings;
+		try {
+			openings = await read(excluded);
+		} catch (err) {
+			this.logger.warn("alarm exclusion reconcile: the openings read failed — nothing lifted", {
+				tags: { deviceId: panel.deviceId },
+				meta: {
+					excluded: excluded.length,
+					error: String(err)
+				}
+			});
+			return;
+		}
 		const now = this.now();
-		for (const deviceId of excluded) panel.observeContact(deviceId, contactReadingOf(this.deviceStates.get(deviceId)), now);
+		for (const deviceId of excluded) {
+			const opening = openings.get(deviceId);
+			if (opening?.kind !== "reading") continue;
+			panel.observeOpening(deviceId, opening.reading, now);
+		}
 	}
 	/**
 	* Log the watched occupancy key set, on CHANGE only.
@@ -27021,7 +28263,7 @@ var NotificationCenter = class NotificationCenter {
 		await this.deviceDirectory.refresh();
 		await this.zoneOwners.refresh();
 		this.sceneStates.refresh();
-		this.observeAlarmContacts();
+		await this.observeAlarmOpenings();
 		await this.occupancyStore.pruneExcept(this.activeOccupancyKeys());
 	}
 	/**
@@ -27323,11 +28565,11 @@ var NotificationCenter = class NotificationCenter {
 			const tracks = await this.deps.listRecentTracks(since, TEST_RULE_MAX_RESULTS);
 			for (const track of tracks) subjects.push(incomingFromTrack(track).subject);
 		}
-		let lookup = (id) => this.deviceStates.get(id);
+		let lookup = this.deviceStateLookup((id) => this.deviceStates.get(id));
 		const gated = rule.conditions.deviceState;
 		if (gated !== void 0 && this.deps.readDeviceStates !== void 0) try {
 			const fresh = await this.deps.readDeviceStates([gated.deviceId]);
-			lookup = (id) => fresh.get(id) ?? this.deviceStates.get(id);
+			lookup = this.deviceStateLookup((id) => fresh.get(id) ?? this.deviceStates.get(id));
 		} catch {}
 		let zoneLookup = this.zoneOwners.lookup();
 		const zoneScope = rule.conditions.devices;
@@ -27591,15 +28833,28 @@ function systemEventKeys(kind) {
 		titleKey: `system.${kind}.title`,
 		bodyKey: `system.${kind}.body.agent`
 	};
-	if (kind === "alarm-armed" || kind === "alarm-arming" || kind === "alarm-arm-refused") return {
+	if (PER_MODE_TITLE_KINDS.has(kind)) return {
 		titleKey: `system.${kind}.title.${TEST_ALARM_MODE}`,
 		bodyKey: `system.${kind}.body`
 	};
+	if (kind === "alarm-sensor-bypass") return {
+		titleKey: `system.${kind}.title`,
+		bodyKey: `system.${kind}.body.ignored`
+	};
 	return {
 		titleKey: `system.${kind}.title`,
 		bodyKey: `system.${kind}.body`
 	};
 }
+/** The alarm kinds whose TITLE key is per arm mode (`….title.<mode>`). */
+var PER_MODE_TITLE_KINDS = new Set([
+	"alarm-arm-refused",
+	"alarm-check-failed",
+	"alarm-arming",
+	"alarm-armed",
+	"alarm-pending",
+	"alarm-rearmed"
+]);
 /** The arm mode a synthetic alarm event stands in for — see {@link systemEventKeys}. */
 var TEST_ALARM_MODE = "away";
 /** The runner a synthetic `addon-crash-loop` stands in for. A test fire has no
@@ -27834,6 +29089,17 @@ var NcTrackGroupSchema = require_dist.object({
 	sealed: require_dist.boolean()
 });
 /**
+* `nc.getAlarmStatus` — the panel as it is now (admin-only for now; see the
+* envelope's comment). `deviceId: null`
+* with `live: null` is a node with no panel, which a client must not read as
+* "disarmed, nothing open". `live` is the published `NcAlarmConfig.live`
+* schema, taken from it rather than re-declared.
+*/
+var NcAlarmStatusSchema = require_dist.object({
+	deviceId: require_dist.number().int().nullable(),
+	live: require_dist.NcAlarmConfigSchema.shape.live.unwrap().nullable()
+});
+/**
 * The action catalog — the tRPC contract Group B (the viewer client) consumes
 * against `addonId: 'pipeline-analytics'`. Every entry that depends on the
 * caller identity is declared `caller: 'required'` so the dispatcher forwards
@@ -27899,6 +29165,76 @@ var ncActions = require_dist.defineCustomActions({
 		caller: "required"
 	}),
 	/**
+	* The ALARM, for the viewer and the admin Alarm tab (D630).
+	*
+	* Bridge actions and not cap methods, for one reason each way:
+	*
+	*  - A REFUSED ARM IS A RESULT HERE. `alarm-panel.arm` is validated by the
+	*    hub's generated router against the HOST's copy of the cap, which says
+	*    `z.void()` — so on the cap a refusal can only be a thrown string. The
+	*    response schema of these actions ({@link NcAlarmArmOutcomeSchema})
+	*    lives in the addon and is validated only here, so a refusal travels as
+	*    `{ outcome: 'refused', refusalId, blocking }` and the viewer can offer
+	*    the Arm anyway bound to exactly that refusal.
+	*  - The UIs never send a device id. There is one panel per hub and the
+	*    centre already holds it; an id on the wire would be one more thing a
+	*    client could get wrong.
+	*
+	* WHO may call what. The WRITES — arm, Arm anyway, disarm — are ADMIN-ONLY,
+	* in the envelope and again in the handler. This is not the cap's authority
+	* and must not pretend to be: `alarm-panel.arm` / `disarm` are DEVICE-scoped
+	* (the host checks the caller's grant on THAT panel), while `addons.custom`
+	* is SYSTEM-scoped and knows nothing about per-device grants. Opening these
+	* to any authenticated user would widen who can disarm the house to anyone
+	* with a login. A non-admin keeps arming and disarming through the
+	* device-scoped cap, exactly as today, and gets past a refusal with the Arm
+	* anyway button on the refusal notification (an HMAC grant bound to that one
+	* refusal).
+	*
+	* `nc.getAlarmStatus` is READ-ONLY, and ADMIN-ONLY too until the viewer
+	* work scopes it. It names every covered device, open or not, with its name
+	* and state — a map of which windows of the house are open, served over the
+	* system-scoped `addons.custom` to ANY login, regardless of which devices
+	* that login may see. The device-scoped way to read a panel is the cap's
+	* `getStatus`; this one opens up once it filters to the caller's grants.
+	* The config pair is the admin's, as `getAlarmConfig` / `setAlarmConfig` are
+	* on the cap: it carries the delays, the recipients and the non-blocking
+	* lists.
+	*/
+	"nc.getAlarmStatus": require_dist.customAction(require_dist.object({}), NcAlarmStatusSchema, {
+		auth: "admin",
+		caller: "required"
+	}),
+	"nc.armAlarm": require_dist.customAction(require_dist.object({ mode: require_dist.AlarmArmModeSchema }), NcAlarmArmOutcomeSchema, {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	/**
+	* `panel.armAnyway(refusalId)` — the same bound, one-shot path the refusal
+	* notification's button takes: a second press is `used`, a panel that moved
+	* since is `stale`, and a device that opened since is a NEW refusal.
+	*/
+	"nc.armAlarmAnyway": require_dist.customAction(require_dist.object({ refusalId: require_dist.string().min(1) }), NcAlarmArmOutcomeSchema, {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	"nc.disarmAlarm": require_dist.customAction(require_dist.object({}), require_dist.object({ success: require_dist.literal(true) }), {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	"nc.getAlarmConfig": require_dist.customAction(require_dist.object({}), require_dist.NcAlarmConfigSchema, {
+		auth: "admin",
+		caller: "required"
+	}),
+	"nc.setAlarmConfig": require_dist.customAction(require_dist.object({ patch: require_dist.NcAlarmSettingsPatchSchema }), require_dist.NcAlarmConfigSchema, {
+		kind: "mutation",
+		auth: "admin",
+		caller: "required"
+	}),
+	/**
 	* The profiles a rule's AI section may be PINNED to — the picker's options.
 	*
 	* A bridge action and not `llm.listProfiles` straight from the client, for
@@ -28246,7 +29582,22 @@ function requireCaller$1(caller) {
 	if (!caller || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error("forbidden: authenticated caller required");
 	return caller;
 }
+/**
+* An ADMIN caller, or a refusal. The dispatcher already gates an
+* `auth: 'admin'` action; this is the same check on this side of the bridge,
+* so a dispatcher that did not forward the flag cannot open it.
+*/
+function requireAdmin(caller) {
+	const c = requireCaller$1(caller);
+	if (!c.isAdmin) throw new Error("forbidden: admin required");
+	return c;
+}
 function makeNcActionHandlers(deps) {
+	/** The alarm half, or a refusal by name — never a made-up "disarmed". */
+	const requireAlarm = (action) => {
+		if (deps.alarm === void 0) throw new Error(`${action}: the alarm is not wired on this node`);
+		return deps.alarm;
+	};
 	/** A rule the caller may EDIT — must exist and be owned by the caller. */
 	const assertOwnsRule = (ruleId) => {
 		const rule = deps.ruleStore.get(ruleId);
@@ -28467,6 +29818,31 @@ function makeNcActionHandlers(deps) {
 			} });
 			return { success: true };
 		},
+		"nc.getAlarmStatus": async (_input, caller) => {
+			requireAdmin(caller);
+			return requireAlarm("nc.getAlarmStatus").status();
+		},
+		"nc.armAlarm": async (input, caller) => {
+			const c = requireAdmin(caller);
+			return requireAlarm("nc.armAlarm").arm(input.mode, c.userId);
+		},
+		"nc.armAlarmAnyway": async (input, caller) => {
+			const c = requireAdmin(caller);
+			return requireAlarm("nc.armAlarmAnyway").armAnyway(input.refusalId, c.userId);
+		},
+		"nc.disarmAlarm": async (_input, caller) => {
+			const c = requireAdmin(caller);
+			await requireAlarm("nc.disarmAlarm").disarm(c.userId);
+			return { success: true };
+		},
+		"nc.getAlarmConfig": async (_input, caller) => {
+			requireAdmin(caller);
+			return requireAlarm("nc.getAlarmConfig").getConfig();
+		},
+		"nc.setAlarmConfig": async (input, caller) => {
+			requireAdmin(caller);
+			return requireAlarm("nc.setAlarmConfig").setConfig(input.patch);
+		},
 		"nc.listAiProfiles": async (_input, caller) => {
 			requireCaller$1(caller);
 			const list = deps.listAiProfiles;
@@ -70725,8 +72101,27 @@ var LinkedCamerasCache = class {
 	deps;
 	ttlMs;
 	index = /* @__PURE__ */ new Map();
+	/**
+	* source deviceId → EVERY camera that has it among its linked devices,
+	* ignoring the tracked-events opt-in. Built in the same loop as
+	* {@link index}; the opt-in governs timeline rows only.
+	*/
+	allIndex = /* @__PURE__ */ new Map();
 	/** Every camera id seen by the last successful build. */
 	cameras = /* @__PURE__ */ new Set();
+	/**
+	* Each camera's links as last READ successfully. A later rebuild that cannot
+	* read a camera's links carries these forward rather than dropping them: the
+	* mirror stays authoritative until something contradicts it (D49).
+	*/
+	linksByCamera = /* @__PURE__ */ new Map();
+	/** False until a camera list has been read once. A later failed list keeps
+	*  the previous index, and this stays true. */
+	cameraListRead = false;
+	/** Listed cameras whose links have NEVER been read. Non-empty (or no camera
+	*  list yet) ⇒ the index has not answered: a device absent from it is
+	*  UNKNOWN, not unlinked (D49). */
+	unanswered = [];
 	/** Ms timestamp of the last build; null = never built / invalidated. */
 	builtAt = null;
 	building = null;
@@ -70740,6 +72135,32 @@ var LinkedCamerasCache = class {
 		return this.index.get(sourceDeviceId) ?? [];
 	}
 	/**
+	* EVERY camera that links `sourceDeviceId`, whether or not it opted the
+	* device into tracked events ([] when none). The notification side asks this
+	* one; timeline rows ask {@link camerasFor}.
+	*/
+	async allCamerasFor(sourceDeviceId, nowMs = Date.now()) {
+		await this.ensureFresh(nowMs);
+		return this.allIndex.get(sourceDeviceId) ?? [];
+	}
+	/**
+	* True when the index ANSWERED: a camera list has been read, and every listed
+	* camera's links have been read at least once (a camera whose read failed
+	* later answers with its last good links). False means an empty answer from the other methods
+	* is not knowledge and must not be acted on as "linked to nothing".
+	*/
+	async answered(nowMs = Date.now()) {
+		await this.ensureFresh(nowMs);
+		return this.cameraListRead && this.unanswered.length === 0;
+	}
+	/** What the index could not answer, as of the last build — no refresh. */
+	gap() {
+		return {
+			cameraListRead: this.cameraListRead,
+			unansweredCameraIds: [...this.unanswered]
+		};
+	}
+	/**
 	* True when `deviceId` is ITSELF a camera. Answered off the same build as
 	* {@link camerasFor} — a sensor cap bound on a camera needs both facts in
 	* the same event, and a second enumeration would double the cost of the
@@ -70754,10 +72175,13 @@ var LinkedCamerasCache = class {
 		this.builtAt = null;
 	}
 	/** Test/maintenance hook: replace the index directly. */
-	seed(index, builtAt, cameraIds = []) {
+	seed(index, builtAt, cameraIds = [], allIndex = index) {
 		this.index = new Map(index);
+		this.allIndex = new Map(allIndex);
 		this.cameras = new Set(cameraIds);
 		this.builtAt = builtAt;
+		this.cameraListRead = true;
+		this.unanswered = [];
 	}
 	/** Rebuild (single-flight) when never built or past the TTL. */
 	async ensureFresh(nowMs) {
@@ -70779,7 +72203,8 @@ var LinkedCamerasCache = class {
 	*
 	* A batch that REJECTS falls back rather than emptying the index: a stale
 	* reverse index still routes sensor events, an empty one silently routes
-	* none.
+	* none. A camera whose links could not be read is simply ABSENT from the
+	* returned map — the caller carries its previous links forward.
 	*/
 	async resolveLinks(cameraIds) {
 		const batch = this.deps.linkedDevicesBatch;
@@ -70794,23 +72219,38 @@ var LinkedCamerasCache = class {
 			const { devices } = await this.deps.linkedDevices.getLinkedDevices({ deviceId: cameraId });
 			out.set(cameraId, devices);
 		} catch (err) {
-			this.deps.onError?.("getLinkedDevices", err);
+			this.deps.onError?.("getLinkedDevices", err, cameraId);
 		}
 		return out;
 	}
 	async rebuild(nowMs) {
 		try {
 			const cameraIds = await this.deps.cameras.listCameraIds();
-			const linksByCamera = await this.resolveLinks(cameraIds);
+			const fresh = await this.resolveLinks(cameraIds);
+			const linksByCamera = /* @__PURE__ */ new Map();
+			const unanswered = [];
+			for (const cameraId of cameraIds) {
+				const links = fresh.get(cameraId) ?? this.linksByCamera.get(cameraId);
+				if (links === void 0) unanswered.push(cameraId);
+				else linksByCamera.set(cameraId, links);
+			}
 			const next = /* @__PURE__ */ new Map();
+			const nextAll = /* @__PURE__ */ new Map();
 			for (const cameraId of cameraIds) for (const d of linksByCamera.get(cameraId) ?? []) {
+				const all = nextAll.get(d.deviceId);
+				if (all === void 0) nextAll.set(d.deviceId, [cameraId]);
+				else if (!all.includes(cameraId)) all.push(cameraId);
 				if (d.producesTrackedEvents === false) continue;
 				const list = next.get(d.deviceId);
 				if (list === void 0) next.set(d.deviceId, [cameraId]);
 				else if (!list.includes(cameraId)) list.push(cameraId);
 			}
 			this.index = next;
+			this.allIndex = nextAll;
 			this.cameras = new Set(cameraIds);
+			this.linksByCamera = linksByCamera;
+			this.unanswered = unanswered;
+			this.cameraListRead = true;
 			this.builtAt = nowMs;
 		} catch (err) {
 			this.deps.onError?.("listCameraIds", err);
@@ -70834,13 +72274,25 @@ async function resolveSensorEventCameras(cache, data) {
 	const linkedCameraIds = await cache.camerasFor(data.deviceId);
 	const isCamera = await cache.isCamera(data.deviceId);
 	const cameraIds = isCamera && selfCameraMayEmit(data.capName) && !linkedCameraIds.includes(data.deviceId) ? [data.deviceId, ...linkedCameraIds] : linkedCameraIds;
-	if (cameraIds.length === 0) return {
+	if (cameraIds.length > 0) return {
+		cameraIds,
+		dropReason: null,
+		linkedCameraIds: []
+	};
+	if (isCamera) return {
+		cameraIds,
+		dropReason: "camera-native-cap",
+		linkedCameraIds: []
+	};
+	if (!await cache.answered()) return {
 		cameraIds,
-		dropReason: isCamera ? "camera-native-cap" : "no-camera"
+		dropReason: "camera-index-unknown",
+		linkedCameraIds: []
 	};
 	return {
 		cameraIds,
-		dropReason: null
+		dropReason: "no-camera",
+		linkedCameraIds: await cache.allCamerasFor(data.deviceId)
 	};
 }
 /**
@@ -70850,20 +72302,37 @@ async function resolveSensorEventCameras(cache, data) {
 * camera 615 — see `SELF_CAMERA_EXCLUDED_CAPS` for the one cap that is not
 * self-ingested). The EVENT_KIND_BY_CAP gate exits first so non-sensor cap
 * churn costs one map lookup. Returns the number of rows inserted (0 when
-* unmapped, or when the device belongs to no camera at all).
+* unmapped, or when no camera takes a row for the device — a non-camera
+* sensor then goes to `onUnowned` instead, evaluated without a row, once the
+* camera index answered).
 * Telemetry-lossy by design (D8) — inserts are best-effort.
 */
 async function ingestSensorStateChange(deps, data, timestamp) {
 	const descriptor = require_dist.EVENT_KIND_BY_CAP[data.capName];
 	if (descriptor === void 0) return 0;
-	const { cameraIds, dropReason } = await resolveSensorEventCameras(deps.cache, data);
+	const { cameraIds, dropReason, linkedCameraIds } = await resolveSensorEventCameras(deps.cache, data);
+	const slice = data.slice;
+	const value = slice !== null && slice !== void 0 && typeof slice === "object" && !Array.isArray(slice) ? slice : null;
+	const makeId = deps.makeId ?? (() => `pa-sensor-${(0, node_crypto.randomUUID)()}`);
+	if (dropReason === "no-camera" && deps.onUnowned !== void 0) {
+		const ev = {
+			id: makeId(),
+			deviceId: data.deviceId,
+			sourceDeviceId: data.deviceId,
+			kind: descriptor.kind,
+			value,
+			timestamp
+		};
+		deps.onUnowned({
+			event: ev,
+			linkedCameraIds
+		});
+		return 0;
+	}
 	if (dropReason !== null) {
 		deps.onDropped?.(dropReason, descriptor.kind);
 		return 0;
 	}
-	const slice = data.slice;
-	const value = slice !== null && slice !== void 0 && typeof slice === "object" && !Array.isArray(slice) ? slice : null;
-	const makeId = deps.makeId ?? (() => `pa-sensor-${(0, node_crypto.randomUUID)()}`);
 	let inserted = 0;
 	for (const cameraId of cameraIds) {
 		const ev = {
@@ -71933,12 +73402,12 @@ async function projectSensorMarkers(deps, data, timestamp) {
 *
 * `EVENT_KIND_BY_CAP` covers sixteen caps; `SOURCE_CAP_ACTIVE_FIELD` covers the
 * ten that have a boolean whose edge means something. `doorbell`, `button`,
-* `lock-control`, `presence`, `enum-sensor` and `event-emitter` are NOT levels
-* — their ARRIVAL is the event, and three presses in a row are three markers.
+* `presence`, `enum-sensor` and `event-emitter` are NOT levels — their ARRIVAL
+* is the event, and three presses in a row are three markers.
 * Gating them would re-ship the failure of 2026-08-08, when camera 615's press
 * produced a row, a ring, a matched rule and no marker.
 *
-* ## A cover is a level whose level is a WORD
+* ## A cover — and a lock — is a level whose level is a WORD
 *
 * `cover` is the sixteenth cap, and it is neither of the above. Its level is
 * the `state` word (`open`, `opening`, `closing`, `closed`, `stopped`), and its
@@ -71966,6 +73435,39 @@ async function projectSensorMarkers(deps, data, timestamp) {
 * is reported once as if the word had just changed. The alarm needs covers
 * to be eventful to see one open (D630).
 *
+* `lock-control` follows the same rule on its `state` word, with `locked` as
+* the resting word. It used to pass through as "arrival is the event", and a
+* lock is exactly what the alarm watches: a placeholder `unlocked` written by
+* a provider constructor after a respawn was an unlock, and the armed panel
+* could fire on it (D630).
+*
+* ## A placeholder slice is not a state
+*
+* Provider constructors write a cold slice before they have read the device —
+* `{ entryOpen: false, lastChangedAt: 0 }` for an HA binary sensor, `unlocked`
+* for an HA or Homematic lock, `closed` for an HA cover. `lastChangedAt: 0`
+* is the one field that says "nobody has read this yet", and a slice carrying
+* it is dropped BEFORE any cap-specific rule (`cold-slice`) and writes no
+* memory. Remembered, it became a baseline the real state then "changed"
+* from: a placeholder `closed` followed by the real `open` was an opening,
+* and while the panel was armed that opening could lift an exclusion and fire
+* the siren. Dropped, the real slice is a first sighting and goes through the
+* freshness floor like any other.
+*
+* The change stamp is a three-way convention every provider writes and this
+* gate and the alarm (`alarm-openings.ts`) both read:
+*
+*  - `0` — a placeholder: the VALUE is unknown. Dropped here, `unknown` there.
+*  - `> 0` but below the floor — a KNOWN value whose change time is old or
+*    unknown. A provider that REPLAYS a cached value after a respawn and has
+*    no upstream change time (Homematic: XML-RPC `getParamset` carries none)
+*    stamps it `1`, epoch + 1 ms (`HM_SEEDED_CHANGED_AT`). Here it seeds a
+*    baseline and is never a first-sighting event; there it is a real reading,
+*    so an arm check still blocks on a lock that is really unlocked. Stamping
+*    such a replay `now` is the laundering this rules out: a lock unlocked for
+*    hours cleared the floor as a fresh unlock after a hub restart.
+*  - at or above the floor — a change that happened then.
+*
 * ## Nothing here logs, and no drop is silent
 *
 * The gate is pure towards the world (no bus, no logger, no clock of its own —
@@ -71980,9 +73482,15 @@ async function projectSensorMarkers(deps, data, timestamp) {
 * Caps whose level is a string word rather than a boolean: cap → slice field.
 * See "A cover is a level whose level is a WORD" above.
 */
-var WORD_LEVEL_FIELD = { cover: "state" };
+var WORD_LEVEL_FIELD = {
+	cover: "state",
+	"lock-control": "state"
+};
 /** The word a word-level cap rests in — its `false`, for the first-sighting rule. */
-var WORD_LEVEL_INACTIVE = { cover: "closed" };
+var WORD_LEVEL_INACTIVE = {
+	cover: "closed",
+	"lock-control": "locked"
+};
 var SensorTransitionGate = class {
 	/** Last observed boolean, keyed by `${deviceId}:${capName}`. */
 	lastValues = /* @__PURE__ */ new Map();
@@ -72005,11 +73513,13 @@ var SensorTransitionGate = class {
 	/**
 	* Feed one `DeviceStateChanged` slice for a cap `EVENT_KIND_BY_CAP` maps.
 	*
-	* A cap with no level passes through unconditionally. A cap that HAS one
-	* passes only when its level moved — a boolean in either direction, or a
-	* word-level cap's word changing.
+	* A placeholder slice (`lastChangedAt === 0`) is dropped first, for every
+	* cap, and remembers nothing. Otherwise a cap with no level passes through
+	* unconditionally, and a cap that HAS one passes only when its level moved —
+	* a boolean in either direction, or a word-level cap's word changing.
 	*/
 	observe(deviceId, capName, slice) {
+		if (slice["lastChangedAt"] === 0) return this.drop(deviceId, capName, "cold-slice");
 		const wordField = WORD_LEVEL_FIELD[capName];
 		if (wordField !== void 0) return this.observeWord(deviceId, capName, slice, wordField);
 		if (!require_dist.isSourceCap(capName)) return { changed: true };
@@ -72094,6 +73604,36 @@ var SensorTransitionGate = class {
 		});
 	}
 };
+var CameraIndexUnknownDrops = class {
+	drops = /* @__PURE__ */ new Map();
+	windowStartedAt;
+	windowMs;
+	constructor(options) {
+		this.windowStartedAt = options.nowMs;
+		this.windowMs = options.windowMs ?? 6e4;
+	}
+	record(deviceId, capName) {
+		const key = `${deviceId}:${capName}`;
+		const prior = this.drops.get(key);
+		this.drops.set(key, {
+			deviceId,
+			capName,
+			count: (prior?.count ?? 0) + 1
+		});
+	}
+	/**
+	* The window's drops, sorted by `(deviceId, capName)`, once the window has
+	* elapsed; [] before that or when nothing dropped. Taking resets the window.
+	*/
+	takeSummary(nowMs) {
+		if (nowMs - this.windowStartedAt < this.windowMs) return [];
+		this.windowStartedAt = nowMs;
+		if (this.drops.size === 0) return [];
+		const out = [...this.drops.values()].sort((a, b) => a.deviceId - b.deviceId || a.capName.localeCompare(b.capName));
+		this.drops.clear();
+		return out;
+	}
+};
 //#endregion
 //#region src/pipeline-analytics/services/synthetic-track.ts
 /**
@@ -77250,6 +78790,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		startedAtMs: Date.now(),
 		now: () => Date.now()
 	});
+	/** `camera-index-unknown` drops, summarised per window — see the file. */
+	cameraIndexUnknownDrops = new CameraIndexUnknownDrops({ nowMs: Date.now() });
 	/** The ONE projector of non-spatial events into synthetic snapshot-carrying
 	*  tracks — linked sensor/control state changes AND audio markers. */
 	syntheticTracks = null;
@@ -78672,6 +80214,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			previewTexts: center.textCatalog,
 			...this.ncArtifactIndex !== null ? { artifacts: this.ncArtifactIndex } : {},
 			artifactShelf: { remove: async (id) => await this.ncArtifactStore?.remove(id) ?? false },
+			alarm: center.alarmActions(),
 			ruleStatus: {
 				forRule: (rule) => center.ruleStatusFor(rule),
 				forTimelapseRule: (rule) => center.timelapseStatusFor(rule, async ({ ruleId, deviceId }) => {
@@ -78800,19 +80343,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		const panel = this.alarmPanelDevice;
 		if (panel === null || this.alarmPanelWired) return;
 		this.alarmPanelWired = true;
-		center.setAlarmPanel({
-			deviceId: panel.id,
-			settings: () => panel.settings(),
-			applySettings: (patch) => panel.applySettings(patch),
-			availableModes: () => NC_ALARM_MODES,
-			noteRuleTrigger: (source) => panel.noteRuleTrigger(source),
-			excludedDevices: () => panel.excludedDevices(),
-			observeContact: (deviceId, reading, now) => panel.observeContact(deviceId, reading, now)
-		});
+		center.setAlarmPanel(ncAlarmPanelPort(panel));
 		panel.setPublishHook((report) => center.onAlarmPublish(report));
 		panel.setArmGuard(center.alarmArmGuard());
 		center.onAlarmPublish({
 			state: panel.currentState(),
+			target: panel.currentTarget(),
 			transition: null
 		});
 		this.ctx.logger.info("alarm panel wired to the notification center", { tags: { deviceId: panel.id } });
@@ -79255,10 +80791,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			} },
 			linkedDevices: { getLinkedDevices: (input) => api.deviceManager.getLinkedDevices.query(input) },
 			linkedDevicesBatch: { getLinkedDevicesBatch: (input) => api.deviceManager.getLinkedDevicesBatch.query(input) },
-			onError: (scope, err) => logger.warn("linked-cameras cache refresh failed", { meta: {
-				scope,
-				error: require_dist.errMsg(err)
-			} })
+			onError: (scope, err, cameraId) => logger.warn("linked-cameras cache refresh failed", {
+				...cameraId !== void 0 ? { tags: { deviceId: cameraId } } : {},
+				meta: {
+					scope,
+					error: require_dist.errMsg(err)
+				}
+			})
 		});
 		const syntheticTracks = new SyntheticTrackMaterializer({
 			snapshot: { getSnapshot: (i) => api.snapshot.getSnapshot.query(i) },
@@ -79711,6 +81250,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				}
 				return out;
 			},
+			readDeviceOpenings: (ids) => readAlarmOpenings(ids, (deviceId) => api.deviceManager.loadRuntimeState.query({ deviceId }), this.ctx.logger),
 			readSceneStates: () => (this.sceneProvider?.listAllEnabled() ?? []).map(({ deviceId, monitor }) => ({
 				sceneId: monitor.id,
 				deviceId,
@@ -85442,11 +86982,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		if (store === null || cache === null) return;
 		if (!this.sensorSliceCarriedATransition(data)) return;
 		const persisted = [];
+		const unowned = [];
 		try {
 			await ingestSensorStateChange({
 				sink: store,
 				cache,
 				onPersisted: (ev) => persisted.push(ev),
+				onUnowned: (u) => unowned.push(u),
 				onDropped: (reason, kind) => this.logSensorIngestDrop(data, reason, kind)
 			}, data, timestamp);
 		} catch (err) {
@@ -85458,6 +87000,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				}
 			});
 		}
+		this.flushCameraIndexUnknownDrops();
 		const markerByCamera = /* @__PURE__ */ new Map();
 		const materializer = this.syntheticTracks;
 		if (materializer !== null) try {
@@ -85501,7 +87044,39 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				}
 			});
 		}
-		for (const ev of persisted) this.notificationCenter?.onSensorEventPersisted(ev, markerByCamera.get(ev.deviceId)?.trackId);
+		for (const ev of persisted) try {
+			this.notificationCenter?.onSensorEventPersisted(ev, markerByCamera.get(ev.deviceId)?.trackId);
+		} catch (err) {
+			this.ctx.logger.warn("sensor event hand-off to the notification centre failed", {
+				tags: { deviceId: ev.deviceId },
+				meta: {
+					kind: ev.kind,
+					sourceDeviceId: ev.sourceDeviceId,
+					error: require_dist.errMsg(err)
+				}
+			});
+		}
+		for (const { event: ev, linkedCameraIds } of unowned) {
+			this.ctx.logger.debug(linkedCameraIds.length === 0 ? "sensor event linked to no camera — evaluated without a timeline row" : `sensor event linked to ${linkedCameraIds.length} camera(s), none opted into tracked events — evaluated without a timeline row`, {
+				tags: { deviceId: ev.sourceDeviceId },
+				meta: {
+					kind: ev.kind,
+					linkedCameraIds: [...linkedCameraIds]
+				}
+			});
+			try {
+				this.notificationCenter?.onUnownedSensorEvent(ev, linkedCameraIds);
+			} catch (err) {
+				this.ctx.logger.warn("sensor event hand-off to the notification centre failed", {
+					tags: { deviceId: ev.sourceDeviceId },
+					meta: {
+						kind: ev.kind,
+						linkedCameraIds: [...linkedCameraIds],
+						error: require_dist.errMsg(err)
+					}
+				});
+			}
+		}
 	}
 	/**
 	* True when this slice carried a real transition of its sensor.
@@ -85555,6 +87130,29 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		});
 	}
 	/**
+	* One `info` line per (device, cap) per window for the evaluations refused
+	* because the camera index has not answered, or none. It drops evaluations
+	* (a contact that might trigger the alarm), so it is `info`; it is a COUNT
+	* so a cold-start outage cannot log at bus rate. `unansweredCameraIds` names
+	* the cameras whose links were never read (`cameraListRead: false` = not
+	* even the camera list).
+	*/
+	flushCameraIndexUnknownDrops() {
+		const summary = this.cameraIndexUnknownDrops.takeSummary(Date.now());
+		if (summary.length === 0) return;
+		const gap = this.linkedCamerasCache?.gap();
+		for (const drop of summary) this.ctx.logger.info("sensor events NOT evaluated — the camera index has not answered, so \"linked to no camera\" is unknown", {
+			tags: { deviceId: drop.deviceId },
+			meta: {
+				capName: drop.capName,
+				count: drop.count,
+				reason: "camera-index-unknown",
+				cameraListRead: gap?.cameraListRead ?? false,
+				unansweredCameraIds: [...gap?.unansweredCameraIds ?? []]
+			}
+		});
+	}
+	/**
 	* Say out loud that a MAPPED sensor cap ingested nothing, and why.
 	*
 	* BOTH branches are `debug`, deliberately. After the self-camera fix neither
@@ -85565,7 +87163,10 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	*    binds a native `motion` cap on the camera device and motion churns
 	*    continuously (camera 590 flaps at ~2 Hz), so an `info` here would be a
 	*    log flood measured in millions of lines a day — its own outage.
-	*  - `no-camera` is every sensor in the fleet that no camera links.
+	*  - `no-camera` is every sensor in the fleet that no camera links. Since
+	*    D630 §6 it is still EVALUATED by the notification rules (through
+	*    `onUnowned`) — this line only says no timeline row was written, and it
+	*    fires only when no one took the camera-less event.
 	*
 	* What must never happen again is the branch being INVISIBLE: a doorbell
 	* press that ingested nothing produced not one line for months. A debug line
@@ -85573,7 +87174,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* dark" the moment anyone asks it.
 	*/
 	logSensorIngestDrop(data, reason, kind) {
-		const message = reason === "camera-native-cap" ? "sensor-event ingest produced NO row — the camera already emits this cap through its own path" : "sensor-event ingest produced NO row — the device is not a camera and is linked to none";
+		if (reason === "camera-index-unknown") {
+			this.cameraIndexUnknownDrops.record(data.deviceId, data.capName);
+			return;
+		}
+		const message = reason === "camera-native-cap" ? "sensor-event ingest produced NO row — the camera already emits this cap through its own path" : "sensor-event ingest produced NO row — no camera takes a row for this device, and nothing took it for evaluation";
 		this.ctx.logger.debug(message, {
 			tags: { deviceId: data.deviceId },
 			meta: {