@camstack/addon-post-analysis 1.2.280 → 1.2.282

package/dist/pipeline-analytics/index.mjs

@@ -1,4 +1,4 @@
-import { $ as RECORDING_SOURCE_CAMSTACK_ADDON, $t as CamProfileSchema, At as isScheduleActive, B as NcRuleUpdateInputSchema, Bt as readDeviceStateFrom, C as MAX_BIRTH_DECISION_RECORDS, Ct as faceGalleryCapability, D as NC_ALARM_SYSTEM_EVENT_KINDS, Dt as isEventOwnerType, E as MediaFileKindEnum, Et as isDetectionMacroClass, F as NcConditionDescriptorSchema, Ft as occupancyScope, G as NcSystemEventKindSchema, Gt as storageOccupancyCapability, H as NcSnoozeInputSchema, Ht as resolveLocationMode, I as NcRuleInputSchema, J as NcTemplatePreviewSchema, Jt as templateVarsFor, K as NcTaxonomySchema, Kt as subKindsOf, L as NcRulePatchSchema, Lt as pickClusterStepModels, M as NC_TEMPLATE_VARS, Mt as kebabToCamel, N as NcAlarmConfigSchema, Nt as mayWriteToLocation, O as NC_CONDITION_CATALOG, Ot as isKnownTemplateVar, P as NcAlarmSettingsPatchSchema, Pt as notificationRulesCapability, Q as RECORDING_EXPORT_MAX_READ_BYTES, Qt as BaseAddon, R as NcRuleSchema, Rt as pipelineAnalyticsCapability, S as MAX_ARCHIVED_DEBUG_NOTES, St as evictionPolicyOfLocation, T as MOTION_CLOSE_AFTER_MS, U as NcSnoozeSchema, V as NcScheduleSchema, Vt as readTimelapseGeneratedAt, W as NcSnoozeSuppressedSchema, Wt as sceneMonitorCapability, X as OpsLogEntrySchema, Xt as zoneAnalyticsCapability, Y as NcTemplateVarDescriptorSchema, Yt as vectorDimFromBase64, Zt as errMsg$1, _ as FIRST_LEVEL_MACRO_CLASSES, _n as string, _t as cosineSimilarity$1, a as BirthDecisionRecordSchema, an as isDeviceScopedCap, at as SceneMonitorSchema, b as LabelAttributionSchema, bt as encodeVectorBase64, c as CoverStateSchema, cn as _enum, ct as TimelapseRulePatchSchema, dn as discriminatedUnion, dt as addonWidgetsSourceCapability, en as DeviceType, et as RetrainStatusSchema, f as DETECTION_MACRO_CLASSES, fn as literal, ft as alarmPanelCapability, g as EVENT_OWNER_TYPES, gn as record, gt as buildEventKindDescriptor, h as EVENT_KIND_BY_CAP, hn as partialRecord, ht as audioModeOf, i as BaseDevice, in as hydrateSchema, it as SCENE_DIVERGED, j as NC_TAXONOMY, jt as isSourceCap, k as NC_DEFAULT_SNOOZE_MINUTES, kt as isMediaOwnerType, l as DEFAULT_EVENT_COLOR, ln as array, lt as TimelapseRuleSchema, m as DeclaredDevices, mn as object, mt as audioMetricsCapability, n as AlarmArmModeSchema, nn as customAction, nt as SCENE_DEFAULT_ANCHOR_THRESHOLD, o as CLUSTER_MODEL_SCOPED_STEPS, on as nodePin, ot as TIMELAPSE_DENSE_FLOOR_SEC, pn as number, pt as assertTimelapseCadences, q as NcTemplatePreviewInputSchema, qt as systemEventFilterApplies, r as ArchivedDebugNoteSchema, rn as defineCustomActions, rt as SCENE_DEFAULT_UNCOVERED_POLICY, s as COCO_TO_MACRO, sn as sleep$1, st as TimelapseRuleInputSchema, t as AUDIO_MACRO_LABELS, tn as createEvent, un as boolean, ut as TrackSourceSchema, v as FULL_IMAGE_BBOX, vn as unknown, vt as deriveRecordingMode, wt as failureContributionCapability, x as LockStateSchema, xt as evaluateSensorEdge, y as FailureCounters, yn as EventCategory, z as NcRuleTargetSchema, zt as plateGalleryCapability } from "../dist-Z6AO1MsY.mjs";
+import { $t as systemEventFamilyProblems, A as NC_SENSOR_TRANSITION_KINDS, At as isEventOwnerType, B as NcRuleSchema, C as MAX_BIRTH_DECISION_RECORDS, Cn as partialRecord, Ct as encodeVectorBase64, D as NC_ALARM_SYSTEM_EVENT_KINDS, Dn as EventCategory, Dt as failureContributionCapability, E as MediaFileKindEnum, En as unknown, Et as faceGalleryCapability, F as NcAlarmSettingsPatchSchema, Ft as isSystemDelivery, G as NcSnoozeSchema, Gt as readTimelapseGeneratedAt, H as NcRuleUpdateInputSchema, Ht as pipelineAnalyticsCapability, I as NcConditionDescriptorSchema, It as kebabToCamel, J as NcTaxonomySchema, Jt as ruleBelongsToAlarm$1, K as NcSnoozeSuppressedSchema, Kt as resolveLocationMode, L as NcConditionsSchema, Lt as mayWriteToLocation, M as NC_TAXONOMY, Mt as isMediaOwnerType, N as NC_TEMPLATE_VARS, Nt as isScheduleActive, O as NC_CONDITION_CATALOG, P as NcAlarmConfigSchema, Pt as isSourceCap, Q as OpsLogEntrySchema, Qt as subKindsOf, R as NcRuleInputSchema, Rt as notificationRulesCapability, S as MAX_ARCHIVED_DEBUG_NOTES, Sn as object, T as MOTION_CLOSE_AFTER_MS, Tn as string, Tt as evictionPolicyOfLocation, U as NcScheduleSchema, Ut as plateGalleryCapability, V as NcRuleTargetSchema, Vt as pickClusterStepModels, W as NcSnoozeInputSchema, Wt as readDeviceStateFrom, X as NcTemplatePreviewSchema, Xt as sensorRaisedOf, Y as NcTemplatePreviewInputSchema, Yt as sceneMonitorCapability, Z as NcTemplateVarDescriptorSchema, Zt as storageOccupancyCapability, _ as FIRST_LEVEL_MACRO_CLASSES, _n as array, _t as audioModeOf, a as BirthDecisionRecordSchema, an as canonicalHash, at as SCENE_DEFAULT_UNCOVERED_POLICY, b as LabelAttributionSchema, bn as literal, bt as deriveRecordingMode, c as CoverStateSchema, cn as DeviceType, ct as TIMELAPSE_DENSE_FLOOR_SEC, dn as defineCustomActions, dt as TimelapseRuleSchema, en as systemEventFilterApplies, et as RECORDING_EXPORT_MAX_READ_BYTES, f as DETECTION_MACRO_CLASSES, fn as hydrateSchema, ft as TrackSourceSchema, g as EVENT_OWNER_TYPES, gn as _enum, gt as audioMetricsCapability, h as EVENT_KIND_BY_CAP, hn as sleep$1, ht as assertTimelapseCadences, i as BaseDevice, in as errMsg$1, it as SCENE_DEFAULT_ANCHOR_THRESHOLD, jt as isKnownTemplateVar, k as NC_DEFAULT_SNOOZE_MINUTES, kt as isDetectionMacroClass, l as DEFAULT_EVENT_COLOR, ln as createEvent, lt as TimelapseRuleInputSchema, m as DeclaredDevices, mn as nodePin, mt as alarmPanelCapability, n as AlarmArmModeSchema, nn as vectorDimFromBase64, nt as RetrainStatusSchema, o as CLUSTER_MODEL_SCOPED_STEPS, on as BaseAddon, ot as SCENE_DIVERGED, pn as isDeviceScopedCap, pt as addonWidgetsSourceCapability, q as NcSystemEventKindSchema, r as ArchivedDebugNoteSchema, rn as zoneAnalyticsCapability, s as COCO_TO_MACRO, sn as CamProfileSchema, st as SceneMonitorSchema, t as AUDIO_MACRO_LABELS, tn as templateVarsFor, tt as RECORDING_SOURCE_CAMSTACK_ADDON, un as customAction, ut as TimelapseRulePatchSchema, v as FULL_IMAGE_BBOX, vn as boolean, vt as buildEventKindDescriptor, wn as record, wt as evaluateSensorEdge, x as LockStateSchema, xn as number, xt as describeSystemEventFamilyProblem, y as FailureCounters, yn as discriminatedUnion, yt as cosineSimilarity$1, z as NcRulePatchSchema, zt as occupancyScope } from "../dist-C3zTKShG.mjs";
 import { t as __exportAll } from "../embedding-encoder/index.mjs";
 import * as fs from "node:fs";
 import { promises } from "node:fs";
@@ -281,6 +281,7 @@ function coverageFor(rules, panelDeviceId, mode, skipProbe) {
 	const ids = /* @__PURE__ */ new Set();
 	let ruleCount = 0;
 	let allDevices = false;
+	let except = null;
 	for (const rule of rules) {
 		if (!rule.enabled) continue;
 		const gate = rule.conditions.deviceState;
@@ -288,21 +289,35 @@ function coverageFor(rules, panelDeviceId, mode, skipProbe) {
 		if (!gate.states.includes(wanted)) continue;
 		ruleCount += 1;
 		const scope = rule.conditions.devices;
+		const excluded = rule.conditions.devicesExclude ?? [];
 		if (scope === void 0 || scope.length === 0) {
 			allDevices = true;
+			except = narrowExcept(except, excluded);
 			continue;
 		}
-		for (const id of scope) ids.add(id);
+		for (const id of scope) if (!excluded.includes(id)) ids.add(id);
 	}
 	const deviceIds = [...ids].toSorted((a, b) => a - b);
+	const allDevicesExcept = except === null || except === "none" ? [] : [...except].filter((id) => !ids.has(id)).toSorted((a, b) => a - b);
 	return {
 		mode,
 		ruleCount,
 		allDevices,
+		allDevicesExcept,
 		deviceIds,
 		skippedDevices: skippedFor(deviceIds, skipProbe)
 	};
 }
+/**
+* Fold one UNSCOPED covering rule into the except-set: with no exclusion it
+* covers everything (`'none'`, final); otherwise only what every unscoped rule
+* excludes stays uncovered — the intersection.
+*/
+function narrowExcept(current, excluded) {
+	if (current === "none" || excluded.length === 0) return "none";
+	if (current === null) return new Set(excluded);
+	return new Set(excluded.filter((id) => current.has(id)));
+}
 function skippedFor(deviceIds, skipProbe) {
 	if (skipProbe === void 0) return [];
 	const out = [];
@@ -376,6 +391,19 @@ function buildArmAnnouncement(coverage, deviceName, bypassed = []) {
 			textCount: names.length
 		};
 	}
+	if (coverage.allDevices && coverage.allDevicesExcept.length > 0) {
+		const names = coverage.allDevicesExcept.map(deviceName);
+		return {
+			bodyKey: "alarm.arm.body.allDevicesExcept",
+			textParams: {
+				rules,
+				mode,
+				count: `${names.length}`,
+				names: names.join(", ")
+			},
+			textCount: names.length
+		};
+	}
 	if (coverage.allDevices) return {
 		bodyKey: "alarm.arm.body.allDevices",
 		textParams: {
@@ -594,7 +622,8 @@ function alarmCoveredDevices(rules, panelDeviceId, mode) {
 		if (!gate.states.includes(wanted)) continue;
 		const scope = rule.conditions.devices;
 		if (scope === void 0 || scope.length === 0) continue;
-		for (const id of scope) ids.add(id);
+		const excluded = rule.conditions.devicesExclude ?? [];
+		for (const id of scope) if (!excluded.includes(id)) ids.add(id);
 	}
 	return [...ids].toSorted((a, b) => a - b);
 }
@@ -7788,10 +7817,10 @@ function replaceConditionReferences(monitor, condition, reference) {
 //#endregion
 //#region src/notification-center/snooze-exempt.ts
 /** The cap whose presence in a sequence makes the rule the alarm's trigger. */
-var ALARM_PANEL_CAP$2 = "alarm-panel";
+var ALARM_PANEL_CAP$1 = "alarm-panel";
 var ALARM_KINDS = new Set(NC_ALARM_SYSTEM_EVENT_KINDS);
 function actuatesAlarmPanel(sequences) {
-	for (const sequence of sequences) for (const step of sequence.actions) if (step.kind === "cap" && step.cap === ALARM_PANEL_CAP$2) return true;
+	for (const sequence of sequences) for (const step of sequence.actions) if (step.kind === "cap" && step.cap === ALARM_PANEL_CAP$1) return true;
 	return false;
 }
 /**
@@ -9556,6 +9585,7 @@ function isLinkedSetSubject(subject) {
 function subjectFromSensorEvent(ev, markerTrackId, linked) {
 	const eventType = readSensorEventType(ev.value);
 	const sensorEdge = sensorEdgeOf(ev.kind, ev.value);
+	const sensorRaised = sensorRaisedOf(ev.kind, ev.value);
 	return {
 		kind: "device-event",
 		recordId: String(ev.id),
@@ -9569,6 +9599,7 @@ function subjectFromSensorEvent(ev, markerTrackId, linked) {
 		sensorKind: ev.kind,
 		...eventType !== void 0 ? { eventType } : {},
 		...sensorEdge !== void 0 ? { sensorEdge } : {},
+		...sensorRaised !== void 0 ? { sensorRaised } : {},
 		...linked !== void 0 ? {
 			linkedSensorId: ev.sourceDeviceId,
 			linkedCameraIds: [...linked.linkedCameraIds],
@@ -9796,6 +9827,7 @@ function presentConditionIds(c) {
 	const ids = [];
 	if (c.systemEvent !== void 0) ids.push("systemEvent");
 	if (c.devices !== void 0 && c.devices.length > 0) ids.push("devices");
+	if (c.devicesExclude !== void 0 && c.devicesExclude.length > 0) ids.push("devicesExclude");
 	if (c.source !== void 0 && c.source !== "any") ids.push("source");
 	if (c.classes !== void 0 && c.classes.length > 0) ids.push("classes");
 	if (c.classesExclude !== void 0 && c.classesExclude.length > 0) ids.push("classesExclude");
@@ -9812,6 +9844,7 @@ function presentConditionIds(c) {
 	if (c.plates !== void 0) ids.push("plates");
 	if (c.sensorKinds !== void 0 && c.sensorKinds.length > 0) ids.push("sensorKinds");
 	if (c.eventTypeTokens !== void 0 && c.eventTypeTokens.length > 0) ids.push("eventTypeTokens");
+	if (c.sensorTransition !== void 0) ids.push("sensorTransition");
 	if (c.packagePhase !== void 0 && c.packagePhase !== "both") ids.push("packagePhase");
 	if (c.customZones !== void 0 && c.customZones.length > 0) ids.push("customZones");
 	if (c.occupancy !== void 0) ids.push("occupancy");
@@ -9906,12 +9939,23 @@ function zonesVisitedBy(subject) {
 * before the subject exists (the linked-camera capture gate). Coarse in one
 * direction only: `true` may still fail later; `false` never would have fired.
 */
-function deviceEventRuleMayFireOnKind(rule, sensorKind) {
+function deviceEventRuleMayFireOnKind(rule, sensorKind, sensorRaised) {
 	const c = rule.conditions;
 	if (c.occupancy !== void 0) return false;
+	if (sensorTransitionRefuses(c.sensorTransition, sensorRaised)) return false;
 	if (c.sensorKinds === void 0 || c.sensorKinds.length === 0) return true;
 	return toLowerSet(c.sensorKinds).has(sensorKind.trim().toLowerCase());
 }
+/**
+* Does a rule's `sensorTransition` refuse this edge? Only a KNOWN edge can be
+* refused: `sensorRaised === undefined` (a kind with no raise, an unreadable
+* slice) always passes — a flood rule never goes silent on a bad read (D640).
+* The ONE predicate {@link evaluateRule} and the capture gate both ask.
+*/
+function sensorTransitionRefuses(transition, sensorRaised) {
+	if (transition === void 0 || sensorRaised === void 0) return false;
+	return sensorRaised !== (transition === "raised");
+}
 function toLowerSet(values) {
 	return new Set(values.map((v) => v.trim().toLowerCase()));
 }
@@ -9948,9 +9992,6 @@ function matchesIdentityScope(subject, scope) {
 function ruleAwaitsRecognition(rule) {
 	return rule.conditions.identities !== void 0 || rule.conditions.plates !== void 0;
 }
-var ARMED_WORD_PREFIX = "armed_";
-var ALARM_PANEL_CAP$1 = "alarm-panel";
-var ALARM_PANEL_TRIGGER_METHOD = "trigger";
 /**
 * A rule "belongs to the alarm" when its `deviceState` gate names ANY device's
 * `armed_*` word — CamStack's own panel or any other, e.g. an HA-mirrored
@@ -9968,8 +10009,10 @@ var ALARM_PANEL_TRIGGER_METHOD = "trigger";
 * catalog on save, so a new key would be dropped by the first edit.
 */
 function ruleBelongsToAlarm(rule) {
-	if ((rule.conditions.deviceState?.states ?? []).some((s) => s.trim().toLowerCase().startsWith(ARMED_WORD_PREFIX))) return true;
-	return (rule.actions?.onTrigger ?? []).some((sequence) => sequence.enabled && sequence.actions.some((step) => step.kind === "cap" && step.cap === ALARM_PANEL_CAP$1 && step.method === ALARM_PANEL_TRIGGER_METHOD));
+	return ruleBelongsToAlarm$1({
+		conditions: rule.conditions,
+		...rule.actions?.onTrigger !== void 0 ? { onTrigger: rule.actions.onTrigger } : {}
+	});
 }
 /**
 * The edge an alarm rule refuses: a close, or a halt/fault (a cover stopped
@@ -10145,6 +10188,7 @@ function evaluateRule(rule, subject, deviceState, zoneOwners, sceneStates) {
 		if (!sceneConditionSatisfied(c.scene, observation)) return fail("scene");
 	}
 	if (c.devices !== void 0 && c.devices.length > 0 && !matchesDeviceScope(c.devices, subject)) return fail("devices");
+	if (c.devicesExclude !== void 0 && deviceScopeExcludes(c.devicesExclude, subject)) return fail("devicesExclude");
 	if (c.source !== void 0 && c.source !== "any") {
 		if ((subject.source ?? "pipeline") !== c.source) return fail("source");
 	}
@@ -10221,6 +10265,7 @@ function evaluateRule(rule, subject, deviceState, zoneOwners, sceneStates) {
 	if (c.eventTypeTokens !== void 0 && c.eventTypeTokens.length > 0) {
 		if (subject.eventType === void 0 || !toLowerSet(c.eventTypeTokens).has(subject.eventType.trim().toLowerCase())) return fail("eventTypeTokens");
 	}
+	if (sensorTransitionRefuses(c.sensorTransition, subject.sensorRaised)) return fail("sensorTransition");
 	if (c.packagePhase !== void 0 && c.packagePhase !== "both") {
 		if (subject.packagePhase !== c.packagePhase) return fail("packagePhase");
 	}
@@ -10326,6 +10371,27 @@ function matchesDeviceScope(scope, subject) {
 	if (scope.includes(subject.deviceId)) return true;
 	return subject.sourceDeviceId !== void 0 && scope.includes(subject.sourceDeviceId);
 }
+/**
+* Does a rule's `devicesExclude` (D641) exclude this subject?
+*
+* The exact complement of {@link matchesDeviceScope}, row by row. A per-camera
+* row is excluded by its camera OR by the sensor that fired, the two ids an
+* include matches on. A linked set stands for the rows it replaced (D630 §6):
+* it is excluded when its SENSOR is, or when EVERY camera that took a row is —
+* one excluded row camera leaves the others firing, as their own rows would
+* have. A camera that only LINKS the sensor excludes nothing, for the reason it
+* includes nothing: ADR 0632 widens the media, never which rules fire.
+*/
+function deviceScopeExcludes(excluded, subject) {
+	if (excluded.length === 0) return false;
+	if (subject.linkedSensorId !== void 0) {
+		if (excluded.includes(subject.linkedSensorId)) return true;
+		const rows = subject.rowCameraIds ?? [];
+		return rows.length > 0 && rows.every((cameraId) => excluded.includes(cameraId));
+	}
+	if (excluded.includes(subject.deviceId)) return true;
+	return subject.sourceDeviceId !== void 0 && excluded.includes(subject.sourceDeviceId);
+}
 function cooldownKey(rule, subject) {
 	const first = subject.classNames[0];
 	const classKey = keysPerClass(rule, subject) && first !== void 0 ? `:c:${first}` : "";
@@ -12453,6 +12519,7 @@ var en_default = {
 	"snooze.scope.anyRule": "A rule",
 	"snooze.scope.rule": "“{{rule}}”",
 	"alarm.arm.body.allDevices": "Active: all devices",
+	"alarm.arm.body.allDevicesExcept": "Active: all devices except {{count}}: {{names}}",
 	"alarm.arm.body.noDevices": "Active: no device restriction",
 	"alarm.arm.body.devices": "Active: {{names}}",
 	"alarm.arm.body.devicesSkipped": "Active: {{names}}\nExcluded: {{skippedNames}}",
@@ -12741,6 +12808,7 @@ var it_default = {
 	"snooze.scope.anyRule": "Una regola",
 	"snooze.scope.rule": "“{{rule}}”",
 	"alarm.arm.body.allDevices": "Attivi: tutti i dispositivi",
+	"alarm.arm.body.allDevicesExcept": "Attivi: tutti i dispositivi tranne {{count}}: {{names}}",
 	"alarm.arm.body.noDevices": "Attivi: nessuna restrizione",
 	"alarm.arm.body.devices": "Attivi: {{names}}",
 	"alarm.arm.body.devicesSkipped": "Attivi: {{names}}\nEsclusi: {{skippedNames}}",
@@ -13143,6 +13211,245 @@ function pickTrackNarrationFrames(rows, max) {
 	return picked;
 }
 //#endregion
+//#region src/notification-center/rule-family-guard.ts
+/**
+* The hub's half of D637: a NEW or UPDATED system-event rule answers ONE family
+* (device events, system, alarm) and carries only that family's filters.
+*
+* THE authority for the invariant. The cap-provider route
+* (`notificationRules.createRule/updateRule`, index.ts) and the rule bridge
+* (`nc.createRule/updateRule`, nc-actions.ts) both call it through
+* `guardRuleFamily` (create) and `guardPatchFamily` (update), so the two save
+* paths cannot drift. This is the same
+* arrangement as `assertRuleHasAddressee`.
+*
+* Not in Zod: a cross-field refine on `NcConditionsSchema` would also reject the
+* STORED mixed rules at load (NcRuleSchema.parse in the store), and those must
+* keep firing until the operator recreates them. The engine is untouched, and
+* so is the device-prune runner: removing a deleted device id from a stored
+* rule is not authoring.
+*/
+var NcRuleFamilyRefusal = class extends Error {
+	problems;
+	/** The rule that was judged: the input on a create, the MERGED rule on an update. */
+	rule;
+	constructor(problems, rule) {
+		super(`system-event rule refused: ${problems.map(describeSystemEventFamilyProblem).join("; ")}`);
+		this.name = "NcRuleFamilyRefusal";
+		this.problems = problems;
+		this.rule = rule;
+	}
+};
+function assertRuleFamily(rule) {
+	if (!isSystemDelivery(rule.delivery)) return;
+	const problems = systemEventFamilyProblems(rule.conditions.systemEvent);
+	if (problems.length > 0) throw new NcRuleFamilyRefusal(problems, rule);
+}
+var byValue = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var byNumber = (a, b) => a - b;
+/**
+* A system-event condition with every list sorted. The engine reads `kinds` and
+* the id-list filters as SETS (membership only), so an editor that re-sorts
+* them — the admin's `toggleSystemEventKind` puts kinds in option order — has
+* not changed the rule. Copies; the input is never touched.
+*/
+function sortedSystemEvent(condition) {
+	const { kinds, deviceIds, excludeDeviceIds, deviceTypes, nodeIds, packageNames } = condition;
+	return {
+		...condition,
+		kinds: kinds.toSorted(byValue),
+		...deviceIds !== void 0 ? { deviceIds: deviceIds.toSorted(byNumber) } : {},
+		...excludeDeviceIds !== void 0 ? { excludeDeviceIds: excludeDeviceIds.toSorted(byNumber) } : {},
+		...deviceTypes !== void 0 ? { deviceTypes: deviceTypes.toSorted(byValue) } : {},
+		...nodeIds !== void 0 ? { nodeIds: nodeIds.toSorted(byValue) } : {},
+		...packageNames !== void 0 ? { packageNames: packageNames.toSorted(byValue) } : {}
+	};
+}
+/** The canonical form two conditions are compared in. */
+function conditionsFingerprint(conditions) {
+	const { systemEvent } = conditions;
+	return canonicalHash(systemEvent === void 0 ? conditions : {
+		...conditions,
+		systemEvent: sortedSystemEvent(systemEvent)
+	});
+}
+/**
+* Do two conditions say the same thing? Both go through `NcConditionsSchema`
+* (the normalisation the store applies on every write) and are compared
+* canonically: key order is irrelevant, an `undefined` key equals an absent
+* one, and the system-event `kinds` and id-list filters are compared as SETS.
+* Every other array keeps its order. A side that does not parse is treated as
+* a change, so it is judged rather than waved through.
+*/
+function sameConditions(a, b) {
+	const left = NcConditionsSchema.safeParse(a);
+	const right = NcConditionsSchema.safeParse(b);
+	if (!left.success || !right.success) return false;
+	return conditionsFingerprint(left.data) === conditionsFingerprint(right.data);
+}
+/**
+* The rule a patch WOULD produce, as far as the family is concerned — merged
+* the way the store merges it: `delivery` and `conditions` replace whole.
+*
+* `null` when the patch CHANGES neither. Both editors send the whole rule on
+* every save, so "the patch carries `conditions`" is not "the patch changes
+* them": an unchanged full-form save of a stored mixed rule (a rename, a
+* retarget) must pass, and only a save that alters the delivery or the
+* conditions is judged.
+*/
+function mergedFamilySubject(existing, patch) {
+	const deliveryChanged = patch.delivery !== void 0 && patch.delivery !== existing.delivery;
+	const conditionsChanged = patch.conditions !== void 0 && !sameConditions(patch.conditions, existing.conditions);
+	if (!deliveryChanged && !conditionsChanged) return null;
+	return {
+		delivery: patch.delivery ?? existing.delivery,
+		conditions: patch.conditions ?? existing.conditions
+	};
+}
+/**
+* On update, the MERGED rule is judged. A patch that changes neither `delivery`
+* nor `conditions` (absent, or equal to what is stored) leaves the kinds as
+* they are, so a stored mixed rule can still be switched off, renamed or
+* retargeted before the operator recreates it.
+*/
+function assertPatchKeepsFamily(existing, patch) {
+	if (existing === null) return;
+	const merged = mergedFamilySubject(existing, patch);
+	if (merged !== null) assertRuleFamily(merged);
+}
+/**
+* Run a family check and LOG a refusal: who tried to save, the rule that was
+* judged (its delivery and kinds) and every problem in words (the families,
+* the offending kind or filter). Then rethrow. A refused save is dropped work,
+* and dropped work is never silent. Any other error passes through unlogged.
+*/
+function logRefusal$2(check, ctx) {
+	try {
+		check();
+	} catch (err) {
+		if (err instanceof NcRuleFamilyRefusal) ctx.logger.warn("nc rule refused: outside one family", { meta: {
+			...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+			by: ctx.by,
+			delivery: err.rule.delivery,
+			kinds: err.rule.conditions.systemEvent?.kinds ?? [],
+			problems: err.problems.map(describeSystemEventFamilyProblem)
+		} });
+		throw err;
+	}
+}
+/** {@link assertRuleFamily}, logged. The create path of both routes. */
+function guardRuleFamily(rule, ctx) {
+	logRefusal$2(() => assertRuleFamily(rule), ctx);
+}
+/** {@link assertPatchKeepsFamily}, logged. The update path of both routes. */
+function guardPatchFamily(existing, patch, ctx) {
+	logRefusal$2(() => assertPatchKeepsFamily(existing, patch), ctx);
+}
+//#endregion
+//#region src/notification-center/device-scope-guard.ts
+/**
+* The deliveries whose evaluation reads the device scope — the `devices`
+* descriptor's `appliesTo`, restated as the one delivery that lacks it.
+*/
+var NO_DEVICE_SCOPE_DELIVERY = "system-event";
+var NcDevicesExcludeRefusal = class extends Error {
+	delivery;
+	devicesExclude;
+	constructor(delivery, devicesExclude) {
+		super(`rule refused: devicesExclude does not apply to a '${delivery}' rule — a system rule excludes devices with systemEvent.excludeDeviceIds`);
+		this.name = "NcDevicesExcludeRefusal";
+		this.delivery = delivery;
+		this.devicesExclude = devicesExclude;
+	}
+};
+function assertDevicesExcludeDelivery(rule) {
+	const excluded = rule.conditions.devicesExclude;
+	if (excluded === void 0 || rule.delivery !== NO_DEVICE_SCOPE_DELIVERY) return;
+	throw new NcDevicesExcludeRefusal(rule.delivery, excluded);
+}
+/** Run the check; a refusal is dropped work, so it is logged before it is rethrown. */
+function logRefusal$1(check, ctx) {
+	try {
+		check();
+	} catch (err) {
+		if (err instanceof NcDevicesExcludeRefusal) warnRefusal$1(ctx.logger, err, ctx);
+		throw err;
+	}
+}
+function warnRefusal$1(logger, err, ctx) {
+	logger.warn("nc rule refused: devicesExclude on a system rule", { meta: {
+		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+		by: ctx.by,
+		delivery: err.delivery,
+		devicesExclude: [...err.devicesExclude]
+	} });
+}
+/** The create path of both routes. */
+function guardRuleDevicesExclude(rule, ctx) {
+	logRefusal$1(() => assertDevicesExcludeDelivery(rule), ctx);
+}
+/**
+* The update path of both routes: the MERGED rule is judged, and only when the
+* patch changes `delivery` or `conditions`.
+*/
+function guardPatchDevicesExclude(existing, patch, ctx) {
+	if (existing === null) return;
+	const merged = mergedFamilySubject(existing, patch);
+	if (merged === null) return;
+	logRefusal$1(() => assertDevicesExcludeDelivery(merged), ctx);
+}
+//#endregion
+//#region src/notification-center/sensor-transition-guard.ts
+/** The one delivery whose subject carries a sensor edge. */
+var SENSOR_TRANSITION_DELIVERY = "device-event";
+var NcSensorTransitionRefusal = class extends Error {
+	delivery;
+	sensorTransition;
+	constructor(delivery, sensorTransition) {
+		super(`rule refused: sensorTransition '${sensorTransition}' applies only to a device-event rule, not '${delivery}'`);
+		this.name = "NcSensorTransitionRefusal";
+		this.delivery = delivery;
+		this.sensorTransition = sensorTransition;
+	}
+};
+function assertSensorTransitionDelivery(rule) {
+	const transition = rule.conditions.sensorTransition;
+	if (transition === void 0 || rule.delivery === SENSOR_TRANSITION_DELIVERY) return;
+	throw new NcSensorTransitionRefusal(rule.delivery, transition);
+}
+/** Run the check; a refusal is dropped work, so it is logged before it is rethrown. */
+function logRefusal(check, ctx) {
+	try {
+		check();
+	} catch (err) {
+		if (err instanceof NcSensorTransitionRefusal) warnRefusal(ctx.logger, err, ctx);
+		throw err;
+	}
+}
+function warnRefusal(logger, err, ctx) {
+	logger.warn("nc rule refused: sensorTransition off a device-event rule", { meta: {
+		...ctx.ruleId !== void 0 ? { ruleId: ctx.ruleId } : {},
+		by: ctx.by,
+		delivery: err.delivery,
+		sensorTransition: err.sensorTransition
+	} });
+}
+/** The create path of both routes. */
+function guardRuleSensorTransition(rule, ctx) {
+	logRefusal(() => assertSensorTransitionDelivery(rule), ctx);
+}
+/**
+* The update path of both routes: the MERGED rule is judged, and only when the
+* patch changes `delivery` or `conditions` — an unchanged full-form save
+* (a rename, a retarget) is not re-judged.
+*/
+function guardPatchSensorTransition(existing, patch, ctx) {
+	if (existing === null) return;
+	const merged = mergedFamilySubject(existing, patch);
+	if (merged === null) return;
+	logRefusal(() => assertSensorTransitionDelivery(merged), ctx);
+}
+//#endregion
 //#region src/notification-center/occupancy-watcher.ts
 /** Sentinel key segments for the "no zone" (whole-frame) and "no class" scopes. */
 var FRAME_SCOPE = "@frame";
@@ -13911,6 +14218,19 @@ function labelFor(conditions) {
 	return conditions.identities?.[0] ?? conditions.labelEquals?.[0] ?? conditions.plates?.values?.[0] ?? void 0;
 }
 /**
+* The edge a planned sensor event carries (D640): RAISED by default — the
+* alert, which is what an operator pressing Test on a flood rule expects to
+* see — and cleared only for a rule that asks for the clear. Only for a kind
+* that HAS a raise: a doorbell press carries none in production, and a test
+* subject claiming one would be a subject no real record could be.
+*/
+function sensorEdgeFor(trigger, c) {
+	const kind = c.sensorKinds?.[0];
+	if (trigger !== "device-event" || kind === void 0) return {};
+	if (!NC_SENSOR_TRANSITION_KINDS.includes(kind.trim().toLowerCase())) return {};
+	return { sensorRaised: c.sensorTransition !== "cleared" };
+}
+/**
 * Plan the injection that fires this rule.
 *
 * Every condition the engine reads off the SUBJECT is satisfied here; the two
@@ -13932,6 +14252,10 @@ function planRuleTest(input) {
 		note: "This rule names no camera and none was supplied, so the event is attributed to no device and carries no picture. Scope the rule to a camera, or pick one, to see the notification it would really send."
 	});
 	const deviceId = scopedDeviceId ?? NC_SYSTEM_DEVICE_ID;
+	if (trigger !== "system-event" && (c.devicesExclude ?? []).includes(deviceId)) notes.push({
+		conditionId: "devicesExclude",
+		note: "The camera this test uses is one the rule excludes, so the evaluation will refuse the event — exactly as it refuses every real one there. Pick another camera to see the notification."
+	});
 	const scheduledAt = scheduleActiveAt(rule.schedule, now);
 	if (scheduledAt === null) notes.push({
 		conditionId: "schedule",
@@ -13981,6 +14305,7 @@ function planRuleTest(input) {
 			} } : {},
 			...c.sensorKinds?.[0] !== void 0 ? { sensorKind: c.sensorKinds[0] } : {},
 			...c.eventTypeTokens?.[0] !== void 0 ? { eventType: c.eventTypeTokens[0] } : {},
+			...sensorEdgeFor(trigger, c),
 			...trigger === "package-event" ? { packagePhase: c.packagePhase === "picked-up" ? "picked-up" : "delivered" } : {},
 			...c.source !== void 0 && c.source !== "any" ? { source: c.source } : {},
 			...bbox !== void 0 ? { bbox } : {},
@@ -14499,6 +14824,10 @@ var NcTestEventInputSchema = object({
 	/** DEVICE-EVENT: the raw device event-type token, when the source is an
 	*  event-emitter slice. */
 	eventType: string().optional(),
+	/** DEVICE-EVENT: which edge a boolean sensor moved on — true raised, false
+	*  cleared (D640). Absent = the slice could not say, which production
+	*  answers for a doorbell press or an unreadable read. */
+	sensorRaised: boolean().optional(),
 	/** PACKAGE-EVENT: which lifecycle phase. */
 	packagePhase: _enum(["delivered", "picked-up"]).optional(),
 	/** Detection provenance. Absent = `pipeline` (what a record with no stamped
@@ -14717,6 +15046,7 @@ function buildSyntheticEvent(input, recordId, now) {
 			...input.labelConfidence !== void 0 ? { labelConfidence: input.labelConfidence } : {},
 			...input.sensorKind !== void 0 ? { sensorKind: input.sensorKind } : {},
 			...input.eventType !== void 0 ? { eventType: input.eventType } : {},
+			...input.sensorRaised !== void 0 ? { sensorRaised: input.sensorRaised } : {},
 			...input.packagePhase !== void 0 ? { packagePhase: input.packagePhase } : {},
 			...input.bbox !== void 0 ? { bbox: input.bbox } : {},
 			...input.crossing !== void 0 ? { crossing: input.crossing } : {},
@@ -15843,6 +16173,18 @@ function makeNcActionHandlers(deps) {
 			const parsed = NcRuleInputSchema.parse(input.rule);
 			assertAdminOnlyFields(parsed, [], c);
 			assertRuleHasAddressee(parsed.targets, parsed.targetUsers);
+			guardRuleFamily(parsed, {
+				logger: deps.logger,
+				by: c.userId
+			});
+			guardRuleSensorTransition(parsed, {
+				logger: deps.logger,
+				by: c.userId
+			});
+			guardRuleDevicesExclude(parsed, {
+				logger: deps.logger,
+				by: c.userId
+			});
 			await assertTargetsOwned(parsed.targets.map((t) => t.targetId), c);
 			const rule = await deps.ruleStore.create({
 				...parsed,
@@ -15861,6 +16203,21 @@ function makeNcActionHandlers(deps) {
 			const clear = input.clear ?? [];
 			assertAdminOnlyFields(patch, clear, c, existing);
 			assertPatchKeepsAddressee(existing, patch, clear);
+			guardPatchFamily(existing, patch, {
+				logger: deps.logger,
+				by: c.userId,
+				ruleId: input.ruleId
+			});
+			guardPatchSensorTransition(existing, patch, {
+				logger: deps.logger,
+				by: c.userId,
+				ruleId: input.ruleId
+			});
+			guardPatchDevicesExclude(existing, patch, {
+				logger: deps.logger,
+				by: c.userId,
+				ruleId: input.ruleId
+			});
 			if (patch.targets !== void 0) await assertTargetsOwned(patch.targets.map((t) => t.targetId), c);
 			const { ownerUserId: _owner, disabledTargetIds: _optOut, ...safe } = patch;
 			const rule = await deps.ruleStore.update(input.ruleId, safe, clear);
@@ -19004,6 +19361,19 @@ function pruneRuleConditions(conditions, isDead, notes) {
 			notes.removed("conditions.devices", deviceSubjects(verdict.dead));
 		}
 	}
+	const excluded = conditions.devicesExclude;
+	if (excluded !== void 0) {
+		const verdict = judgeList(excluded, isDead);
+		if (!verdict.untouched) {
+			const { devicesExclude: _dead, ...rest } = next;
+			next = verdict.last ? rest : {
+				...rest,
+				devicesExclude: [...verdict.next]
+			};
+			changed = true;
+			notes.removed("conditions.devicesExclude", deviceSubjects(verdict.dead));
+		}
+	}
 	const systemEvent = conditions.systemEvent;
 	if (systemEvent?.deviceIds !== void 0) {
 		const verdict = judgeList(systemEvent.deviceIds, isDead);
@@ -19184,6 +19554,7 @@ function referencedDeviceIds(snapshot) {
 	for (const rule of snapshot.rules) {
 		const c = rule.conditions;
 		add(c.devices);
+		add(c.devicesExclude);
 		add(c.systemEvent?.deviceIds);
 		if (c.deviceState !== void 0) ids.add(c.deviceState.deviceId);
 		if (c.scene?.deviceId !== void 0) ids.add(c.scene.deviceId);
@@ -22037,6 +22408,50 @@ var NcOutbox = class {
 			return [];
 		}
 	}
+	/**
+	* The rows `getRuleLastRuns` reduces — ONE statement: fire time inside
+	* `[sinceMs, ∞)`, newest-first on `idx_nc_outbox_created`, projected to the
+	* four columns the reduction reads (never the `payload` JSON), at most
+	* `limit` rows. `sinceMs: null` = no lower bound (the operator keeps the
+	* outbox forever); `limit` still bounds the read.
+	*
+	* Unlike {@link queryHistory} this THROWS on a store error: its caller
+	* answers "which rules did not run", and an empty page from a failed read
+	* would answer "none of them did" (D393).
+	*/
+	async queryLastRunRows(sinceMs, limit) {
+		const rows = await this.store.query.query({
+			collection: NC_OUTBOX_COLLECTION,
+			filter: {
+				...sinceMs !== null ? { whereBetween: { createdAt: [sinceMs, Number.MAX_SAFE_INTEGER] } } : {},
+				orderBy: {
+					field: "createdAt",
+					direction: "desc"
+				},
+				limit
+			},
+			columns: [...NC_LAST_RUN_COLUMNS]
+		});
+		const out = [];
+		let malformed = 0;
+		let oldestReadAt = null;
+		for (const row of rows) {
+			const at = Number(row.data["createdAt"]);
+			if (Number.isFinite(at) && (oldestReadAt === null || at < oldestReadAt)) oldestReadAt = at;
+			const parsed = lastRunRow(row.data);
+			if (parsed === null) malformed += 1;
+			else out.push(parsed);
+		}
+		if (malformed > 0) this.logger.warn("last-run read skipped malformed outbox rows", { meta: {
+			malformed,
+			read: rows.length
+		} });
+		return {
+			rows: out,
+			truncated: rows.length >= limit,
+			oldestReadAt
+		};
+	}
 	async getWatermark() {
 		try {
 			const row = await this.store.get.query({
@@ -22324,6 +22739,27 @@ function rowToEntry$1(id, data) {
 		payload
 	};
 }
+/** The columns {@link NcOutbox.queryLastRunRows} projects. */
+var NC_LAST_RUN_COLUMNS = [
+	"ruleId",
+	"createdAt",
+	"status",
+	"deviceId"
+];
+/** A projected row back to a {@link NcLastRunRow} — a guard, never a cast. */
+function lastRunRow(data) {
+	const ruleId = data["ruleId"];
+	const createdAt = Number(data["createdAt"]);
+	const deviceId = Number(data["deviceId"]);
+	const status = data["status"];
+	if (typeof ruleId !== "string" || !Number.isFinite(createdAt) || !Number.isFinite(deviceId) || status !== "pending" && status !== "sent" && status !== "dead") return null;
+	return {
+		ruleId,
+		createdAt,
+		status,
+		deviceId
+	};
+}
 //#endregion
 //#region src/notification-center/rule-actions.ts
 var NcRuleActionRunner = class {
@@ -23015,6 +23451,58 @@ var NcRuleAiStore = class {
 	}
 };
 //#endregion
+//#region src/notification-center/rule-last-runs.ts
+/**
+* Row bound of the one read. Projected rows are four scalars (~100 B), so the
+* bound costs ~2 MB at worst. The live outbox volume was NOT measured when
+* this was chosen. It exists so a runaway rule cannot turn an admin page load
+* into a table walk — and when it bites, `horizonMs` says so.
+*/
+var NC_RULE_LAST_RUNS_SCAN_LIMIT = 2e4;
+/** Least successful first: a fire that reached some targets and not others
+*  did not "deliver". */
+var STATUS_SEVERITY = {
+	sent: 0,
+	pending: 1,
+	dead: 2
+};
+function worse(a, b) {
+	return STATUS_SEVERITY[b] > STATUS_SEVERITY[a] ? b : a;
+}
+/**
+* Reduce newest-first rows to one run per rule, in one pass.
+*
+* Rows sharing the newest `createdAt` of a rule are one fire to several
+* targets; they merge into the least successful status. `read.rows` MUST be
+* ordered newest-first — that is what the outbox read asks the store for.
+*/
+function summariseRuleLastRuns(read, scan) {
+	const byRule = /* @__PURE__ */ new Map();
+	for (const row of read.rows) {
+		const seen = byRule.get(row.ruleId);
+		if (seen === void 0) byRule.set(row.ruleId, {
+			ruleId: row.ruleId,
+			lastAt: row.createdAt,
+			status: row.status,
+			deviceId: row.deviceId
+		});
+		else if (seen.lastAt === row.createdAt && worse(seen.status, row.status) !== seen.status) byRule.set(row.ruleId, {
+			...seen,
+			status: row.status,
+			deviceId: row.deviceId
+		});
+	}
+	return {
+		runs: [...byRule.values()],
+		horizonMs: horizonOf(read, scan)
+	};
+}
+/** How far back the answer really looked — see the module doc. */
+function horizonOf(read, scan) {
+	if (read.truncated && read.oldestReadAt !== null) return Math.max(0, scan.now - read.oldestReadAt);
+	return scan.windowMs;
+}
+//#endregion
 //#region src/notification-center/durable-reread.ts
 function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -27979,9 +28467,14 @@ function outboxEntryToHistory(texts, entry) {
 function renderAudioSpec(spec) {
 	return spec.mode === "label" ? `label:${spec.labels.join("+")}` : `level:${String(spec.dbThreshold)}dBFS|h${String(spec.hitPercent)}|s${String(spec.samplingSeconds)}`;
 }
-/** The camera scope in one token — `@all` is a real answer, not a missing one. */
-function renderAudioScope(devices) {
-	return devices.length === 0 ? "@all" : devices.join("+");
+/**
+* The camera scope in one token — `@all` is a real answer, not a missing one,
+* and `@all-except:<ids>` is a different one (D641): an excluding rule logged
+* as `@all` would claim the camera it never watches.
+*/
+function renderAudioScope(devices, excluded) {
+	if (devices.length === 0) return excluded.length === 0 ? "@all" : `@all-except:${excluded.join("+")}`;
+	return devices.filter((id) => !excluded.includes(id)).join("+");
 }
 var NotificationCenter = class NotificationCenter {
 	logger;
@@ -29723,7 +30216,7 @@ var NotificationCenter = class NotificationCenter {
 	* scope the evaluation will match on (`matchesDeviceScope`).
 	*/
 	beginLinkedStills(request) {
-		const { sensorId, sensorKind, cameraIds, atMs, rowCameraIds } = request;
+		const { sensorId, sensorKind, cameraIds, atMs, rowCameraIds, sensorRaised } = request;
 		const shelf = this.linkedStills;
 		if (shelf === null || !this.evaluationActive || cameraIds.length < 2) return void 0;
 		if (this.deviceMutes.isMuted(sensorId)) return void 0;
@@ -29733,7 +30226,13 @@ var NotificationCenter = class NotificationCenter {
 		const involved = [sensorId, ...rowShown];
 		if (!this.rules.listEnabled("device-event").some((rule) => {
 			if (rule.media.attach === "none") return false;
-			if (!deviceEventRuleMayFireOnKind(rule, sensorKind)) return false;
+			if (!deviceEventRuleMayFireOnKind(rule, sensorKind, sensorRaised)) return false;
+			const excluded = rule.conditions.devicesExclude;
+			if (excluded !== void 0 && deviceScopeExcludes(excluded, {
+				deviceId: sensorId,
+				linkedSensorId: sensorId,
+				rowCameraIds: rowShown
+			})) return false;
 			const devices = rule.conditions.devices;
 			return devices === void 0 || devices.length === 0 || devices.some((id) => involved.includes(id));
 		})) return void 0;
@@ -29855,6 +30354,8 @@ var NotificationCenter = class NotificationCenter {
 			if (!(mode === "condition" ? rule.conditions.audio !== void 0 : rule.conditions.audio === void 0 && referencesAudioClass(rule.conditions.classes))) continue;
 			const devices = rule.conditions.devices;
 			if (devices !== void 0 && devices.length > 0 && !devices.includes(deviceId)) continue;
+			const excluded = rule.conditions.devicesExclude;
+			if (excluded !== void 0 && deviceScopeExcludes(excluded, { deviceId })) continue;
 			return shelf.capture(deviceId, atMs, "audio");
 		}
 	}
@@ -29957,6 +30458,8 @@ var NotificationCenter = class NotificationCenter {
 			if (occ === void 0 || !matchesOccupancy(occ, subject)) continue;
 			const devices = rule.conditions.devices;
 			if (devices !== void 0 && devices.length > 0 && !devices.includes(edge.deviceId)) continue;
+			const excluded = rule.conditions.devicesExclude;
+			if (excluded !== void 0 && deviceScopeExcludes(excluded, { deviceId: edge.deviceId })) continue;
 			return shelf.capture(edge.deviceId, edge.timestamp, "occupancy");
 		}
 	}
@@ -30088,6 +30591,18 @@ var NotificationCenter = class NotificationCenter {
 			getRule: async ({ ruleId }) => ({ rule: this.rules.get(ruleId) }),
 			createRule: async ({ rule, caller }) => {
 				assertRuleHasAddressee(rule.targets, rule.targetUsers);
+				guardRuleFamily(rule, {
+					logger: this.logger,
+					by: caller.userId
+				});
+				guardRuleSensorTransition(rule, {
+					logger: this.logger,
+					by: caller.userId
+				});
+				guardRuleDevicesExclude(rule, {
+					logger: this.logger,
+					by: caller.userId
+				});
 				await this.validateTargetRefs(rule.targets.map((t) => t.targetId));
 				const created = await this.rules.create(rule, caller.userId);
 				this.logger.info("notification rule created", { meta: {
@@ -30099,7 +30614,23 @@ var NotificationCenter = class NotificationCenter {
 			},
 			updateRule: async ({ ruleId, patch, clear, caller }) => {
 				if (patch.targets !== void 0) await this.validateTargetRefs(patch.targets.map((t) => t.targetId));
-				assertPatchKeepsAddressee(this.rules.get(ruleId), patch, clear ?? []);
+				const existing = this.rules.get(ruleId);
+				assertPatchKeepsAddressee(existing, patch, clear ?? []);
+				guardPatchFamily(existing, patch, {
+					logger: this.logger,
+					by: caller.userId,
+					ruleId
+				});
+				guardPatchSensorTransition(existing, patch, {
+					logger: this.logger,
+					by: caller.userId,
+					ruleId
+				});
+				guardPatchDevicesExclude(existing, patch, {
+					logger: this.logger,
+					by: caller.userId,
+					ruleId
+				});
 				const { disabledTargetIds: _optOut, ...safePatch } = patch;
 				const updated = await this.rules.update(ruleId, safePatch, clear ?? []);
 				this.logger.info("notification rule updated", { meta: {
@@ -30141,6 +30672,14 @@ var NotificationCenter = class NotificationCenter {
 				}
 				return { entries: mapped };
 			},
+			getRuleLastRuns: async () => {
+				const now = this.now();
+				const windowMs = (await this.deps.pruneWindows()).outboxMs;
+				return summariseRuleLastRuns(await this.outbox.queryLastRunRows(windowMs !== null ? now - windowMs : null, NC_RULE_LAST_RUNS_SCAN_LIMIT), {
+					now,
+					windowMs
+				});
+			},
 			resolveArtifactUrl: async ({ artifactId }) => ({ url: await this.deps.resolveArtifactUrl?.(artifactId) ?? null }),
 			listDeviceMutes: async () => ({ mutedDeviceIds: this.deviceMutes.listMuted() }),
 			setDeviceMuted: async ({ deviceId, muted }) => {
@@ -30472,6 +31011,7 @@ var NotificationCenter = class NotificationCenter {
 			coverage: this.coverageFor(panel).map((c) => ({
 				...c,
 				deviceIds: [...c.deviceIds],
+				allDevicesExcept: [...c.allDevicesExcept],
 				skippedDevices: c.skippedDevices.map((s) => ({ ...s }))
 			}))
 		};
@@ -30981,6 +31521,9 @@ var NotificationCenter = class NotificationCenter {
 						failed: evaluation.failedCondition,
 						classes: subject.classNames,
 						...subject.sensorEdge !== void 0 ? { sensorEdge: subject.sensorEdge } : {},
+						...subject.sensorRaised !== void 0 ? { sensorRaised: subject.sensorRaised } : {},
+						...subject.sourceDeviceId !== void 0 ? { sourceDeviceId: subject.sourceDeviceId } : {},
+						...subject.linkedSensorId !== void 0 ? { linkedSensorId: subject.linkedSensorId } : {},
 						eventId: subject.recordId,
 						...subject.trackId !== void 0 ? { trackId: subject.trackId } : {}
 					}
@@ -31090,7 +31633,11 @@ var NotificationCenter = class NotificationCenter {
 					eventId: subject.recordId,
 					...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
 					...subject.confidence !== void 0 ? { confidence: subject.confidence } : {},
-					...subject.zones.length > 0 ? { zones: subject.zones } : {}
+					...subject.zones.length > 0 ? { zones: subject.zones } : {},
+					...rule.conditions.sensorTransition !== void 0 ? {
+						sensorTransition: rule.conditions.sensorTransition,
+						sensorRaised: subject.sensorRaised ?? null
+					} : {}
 				}
 			});
 			const unresolvable = unresolvableButtons(rule.actions);
@@ -31697,7 +32244,8 @@ var NotificationCenter = class NotificationCenter {
 				ruleId: rule.id,
 				ruleName: rule.name,
 				spec,
-				devices: rule.conditions.devices ?? []
+				devices: rule.conditions.devices ?? [],
+				excluded: rule.conditions.devicesExclude ?? []
 			});
 		}
 		this.audioWatcher.setWatchedSpecs(audioSpecs);
@@ -31789,10 +32337,12 @@ var NotificationCenter = class NotificationCenter {
 	* for at all"; the per-camera line answers "why is 617 not notifying" — and
 	* that question is ALWAYS asked per camera, so the line carries
 	* `tags.deviceId` and a rule scoped to no camera is reported as watching
-	* every one rather than silently omitted.
+	* every one rather than silently omitted — every one EXCEPT its
+	* `devicesExclude` cameras (D641), each of which gets its own NOT-watching
+	* line on that camera.
 	*/
 	reportAudioWatch(entries) {
-		const rendered = entries.map((e) => `${e.ruleId}=${renderAudioSpec(e.spec)}@${renderAudioScope(e.devices)}`).toSorted().join(",");
+		const rendered = entries.map((e) => `${e.ruleId}=${renderAudioSpec(e.spec)}@${renderAudioScope(e.devices, e.excluded)}`).toSorted().join(",");
 		if (rendered === this.lastAudioWatchReport) return;
 		this.lastAudioWatchReport = rendered;
 		this.logger.info("audio watched specs", { meta: {
@@ -31806,14 +32356,28 @@ var NotificationCenter = class NotificationCenter {
 				mode: entry.spec.mode,
 				spec: renderAudioSpec(entry.spec)
 			};
+			for (const deviceId of entry.excluded) this.logger.info("audio rule NOT watching camera", {
+				tags: { deviceId },
+				meta: {
+					...meta,
+					reason: "devicesExclude"
+				}
+			});
 			if (entry.devices.length === 0) {
-				this.logger.info("audio rule watching every camera", { meta });
+				if (entry.excluded.length === 0) this.logger.info("audio rule watching every camera", { meta });
+				else this.logger.info("audio rule watching every camera except the excluded", { meta: {
+					...meta,
+					excluded: [...entry.excluded]
+				} });
 				continue;
 			}
-			for (const deviceId of entry.devices) this.logger.info("audio rule watching camera", {
-				tags: { deviceId },
-				meta
-			});
+			for (const deviceId of entry.devices) {
+				if (entry.excluded.includes(deviceId)) continue;
+				this.logger.info("audio rule watching camera", {
+					tags: { deviceId },
+					meta
+				});
+			}
 		}
 	}
 	/** Boot reseed of confirmed occupancy edge-state (durability, constraint 4) —
@@ -89201,10 +89765,12 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends BaseAddon {
 	startLinkedStills(data, timestamp, cameras) {
 		const sensorKind = EVENT_KIND_BY_CAP[data.capName]?.kind;
 		if (sensorKind === void 0) return void 0;
+		const sensorRaised = sensorRaisedOf(sensorKind, sensorSliceRecord(data.slice));
 		try {
 			return this.notificationCenter?.beginLinkedStills({
 				sensorId: data.deviceId,
 				sensorKind,
+				...sensorRaised !== void 0 ? { sensorRaised } : {},
 				cameraIds: cameras.mediaCameraIds,
 				rowCameraIds: cameras.rowCameraIds,
 				atMs: timestamp