@camstack/addon-post-analysis 1.2.284 → 1.2.285

package/dist/{dist-C770IfQJ.mjs → dist-D2tXUMfE.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DU7mu4wb.mjs
+//#region ../types/dist/sleep-BaRu0bS5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -10024,7 +10024,7 @@ var ModelFormatEntrySchema = object({
 	/** Multi-file payload (directory members or sibling files). */
 	files: array(string()).readonly().optional(),
 	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["node", "python"])).readonly().optional()
+	runtimes: array(_enum(["python"])).readonly().optional()
 });
 /**
 * Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
@@ -18095,6 +18095,25 @@ var NcScheduleSchema = object({
 	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
 	invert: boolean().optional()
 });
+/**
+* How a system-event rule of the `device-events` or `system` family speaks
+* (D647): at once, per event (`instant`, the only behaviour before D647), or
+* as a STATE SUMMARY at the end of each window of `schedule`.
+*/
+var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
+/**
+* `summary`: the rule sends NOTHING per event. When a window of `schedule`
+* CLOSES, it sends one notification with the current state of its kinds
+* (low batteries, consumables to replace, devices offline, updates
+* available, ...), after its own filters. Nothing to report sends nothing.
+* The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
+* midnight crossing); the send time is each window's END. Refused on the
+* `alarm` family, which stays instant (`systemEventDeliveryProblems`).
+*/
+var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
+	mode: literal("summary"),
+	schedule: NcScheduleSchema
+})]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
 	/**
@@ -18830,6 +18849,16 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
+	/**
+	* A `device-events` / `system` rule's delivery (D647): absent or `instant`
+	* is a notification per event; `summary` is one state summary per closed
+	* window of its schedule. `.optional()` and never defaulted: absent must
+	* keep meaning what every rule authored before D647 meant, with no
+	* migration. Top-level rather than inside `conditions.systemEvent`, so a
+	* client that does not know it (an older viewer re-sending `conditions`
+	* whole) leaves it standing through the store's patch merge.
+	*/
+	systemEventDelivery: NcSystemEventDeliverySchema.optional(),
 	/** May be empty when `targetUsers` addresses at least one user — the
 	*  "at least one addressee" invariant is enforced by the provider, because
 	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
@@ -19058,6 +19087,28 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	*/
 	disabledTargetIds: array(string()).default([])
 });
+/** One section of a previewed state summary. `unavailable` = its state could not be read. */
+var NcStateSummaryPreviewSectionSchema = object({
+	id: string(),
+	status: _enum(["read", "unavailable"]),
+	items: number().int().nonnegative(),
+	reason: string().optional()
+});
+/**
+* The summary a rule would send now. `empty` = nothing to report and every
+* section read: such a summary is NOT sent. `dropped` counts the open states
+* the rule's own filters (or a camera mute) left out, by reason.
+* `excludedGroups` names the kind groups selected that have no state to report
+* (backups & exports).
+*/
+var NcStateSummaryPreviewSchema = object({
+	empty: boolean(),
+	count: number().int().nonnegative(),
+	text: string(),
+	sections: array(NcStateSummaryPreviewSectionSchema),
+	dropped: record(string(), number().int().nonnegative()),
+	excludedGroups: array(string())
+});
 var NcTestResultSchema = object({
 	recordId: string(),
 	recordKind: _enum([
@@ -19149,6 +19200,13 @@ var NcTemplateVarDescriptorSchema = object({
 	kinds: array(NcTemplateVarKindSchema).optional(),
 	deliveries: array(NcDeliverySchema).optional(),
 	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	/**
+	* Which system-event DELIVERY has a value for it (D647). Absent = an
+	* instant row only when the descriptor names `systemEventKinds` (a
+	* per-event fact: a summary row has no single device), and both otherwise.
+	* `['summary']` marks the state-summary vocabulary (`{{summaryText}}`, ...).
+	*/
+	systemEventDeliveries: array(NcSystemEventDeliveryModeSchema).optional(),
 	dynamic: object({
 		prefix: literal("count_"),
 		from: literal("classes")
@@ -19161,7 +19219,9 @@ var NcTemplatePreviewInputSchema = object({
 		field: NcTemplateFieldSchema,
 		kind: NcRuleKindSchema.optional(),
 		delivery: NcDeliverySchema.optional(),
-		systemEventKinds: array(NcSystemEventKindSchema).optional()
+		systemEventKinds: array(NcSystemEventKindSchema).optional(),
+		/** The rule's system-event delivery (D647); absent = instant. */
+		systemEventDelivery: NcSystemEventDeliveryModeSchema.optional()
 	}),
 	template: object({
 		title: string().max(500).optional(),
@@ -20295,6 +20355,17 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* The STATE SUMMARY a system rule would send now (D647) — for a saved rule
+		* or an unsaved draft. Pure: sends nothing, stamps nothing. A MUTATION
+		* only for transport (a whole rule does not belong in a GET URL). Admin,
+		* like `testRule`: it names devices and nodes across the installation.
+		*/
+		previewStateSummary: method(object({ rule: NcRuleInputSchema }), NcStateSummaryPreviewSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "view"
+		}),
+		/**
 		* The machine-readable condition surface a rule editor renders from, plus
 		* the picker VOCABULARY those conditions draw on.
 		*
@@ -20739,646 +20810,6 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* Reference to the frame's retained NATIVE surface + the parent crop's placement
-* within the frame, so the executor can re-cut a leaf child ROI at native
-* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
-*/
-var NativeCropRefSchema = object({
-	/** Handle keying the retained native surface (node-pinned to its owner). */
-	handle: FrameHandleSchema,
-	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-	cropFrameSpace: object({
-		x: number(),
-		y: number(),
-		w: number(),
-		h: number()
-	})
-});
-object({
-	crop: object({
-		left: number(),
-		top: number(),
-		width: number().positive(),
-		height: number().positive()
-	}).optional(),
-	content: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}),
-	fit: _enum(["stretch", "contain"]),
-	format: _enum([
-		"rgb",
-		"gray",
-		"jpeg"
-	])
-});
-/**
-* Process-local frame identity. It is serializable so it can ride an in-process
-* capability call, but `registryId` deliberately prevents resolution in any
-* other process or execution group.
-*/
-var FrameRefSchema = object({
-	registryId: string().min(1),
-	id: string().min(1),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum(["rgb", "gray"]),
-	timestamp: number(),
-	capturedAt: number().optional()
-});
-var ModelFormatSchema$1 = _enum([
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-]);
-var PipelineSlotSchema = _enum([
-	"detector",
-	"cropper",
-	"classifier",
-	"refiner",
-	"audio-classifier"
-]);
-var PipelineEngineChoiceSchema = object({
-	runtime: _enum(["node", "python"]),
-	backend: string(),
-	format: ModelFormatSchema$1,
-	device: string().optional()
-});
-var AvailableEngineSchema = object({
-	engine: PipelineEngineChoiceSchema,
-	devices: array(object({
-		id: string(),
-		label: string(),
-		description: string().optional()
-	})).readonly(),
-	defaultDevice: string()
-});
-var PipelineDefaultStepSchema = lazy(() => object({
-	addonId: string(),
-	addonName: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineDefaultStepSchema).readonly(),
-	group: string().optional(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
-});
-var PipelineModelOptionSchema = object({
-	id: string(),
-	name: string(),
-	formats: record(string(), object({
-		downloaded: boolean(),
-		sizeMB: number()
-	})),
-	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
-});
-var ConfigFieldBridge = custom();
-var PipelineAddonSchemaSchema = object({
-	id: string(),
-	name: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	childSlots: array(PipelineSlotSchema).readonly(),
-	models: array(PipelineModelOptionSchema).readonly(),
-	defaultModelId: string(),
-	defaultModelIdByFormat: record(string(), string()).optional(),
-	enabledByDefault: boolean().optional(),
-	backfillIntoExistingOverrides: boolean().optional(),
-	defaultConfidence: number(),
-	group: string().optional(),
-	configSchema: array(ConfigFieldBridge).readonly().optional()
-});
-var PipelineSlotSchemaSchema = object({
-	id: PipelineSlotSchema,
-	label: string(),
-	priority: number(),
-	parentSlot: PipelineSlotSchema.nullable(),
-	addons: array(PipelineAddonSchemaSchema).readonly()
-});
-var PipelineSchemaSchema = object({
-	availableEngines: array(AvailableEngineSchema).readonly(),
-	selectedEngine: PipelineEngineChoiceSchema,
-	slots: array(PipelineSlotSchemaSchema).readonly()
-});
-var EngineProvisioningSchema = object({
-	runtimeId: _enum([
-		"onnx",
-		"openvino",
-		"coreml",
-		"edgetpu"
-	]).nullable(),
-	device: string().nullable(),
-	state: _enum([
-		"idle",
-		"installing",
-		"verifying",
-		"ready",
-		"failed"
-	]),
-	progress: number().optional(),
-	error: string().optional(),
-	nextRetryAt: number().optional(),
-	/**
-	* Gate A (config-correctness gate at engine change): human-readable
-	* config issues surfaced EAGERLY when the node's engine changes — model
-	* substitutions ("chose X, running Y") and zero-build steps ("no model
-	* has a <format> build"). Additive/optional: informational only, never
-	* enforced here — `assertEngineReady` (readiness) still gates inference.
-	* Absent/empty when the node-default tree resolves cleanly.
-	*/
-	configIssues: array(string()).optional()
-});
-var PipelineStepInputSchema = lazy(() => object({
-	addonId: string(),
-	modelId: string().optional(),
-	enabled: boolean().default(true),
-	children: array(PipelineStepInputSchema).optional(),
-	settings: record(string(), unknown()).optional(),
-	jumpDeviceKey: string().optional()
-}));
-var ModelSubstitutionSchema = object({
-	addonId: string(),
-	chosen: string(),
-	running: string(),
-	format: string()
-});
-var PipelineValidationIssueSchema = object({
-	addonId: string(),
-	kind: _enum(["unknown-addon", "no-format-build"]),
-	detail: string()
-});
-var PipelineValidationResultSchema = object({
-	ok: boolean(),
-	issues: array(PipelineValidationIssueSchema).readonly(),
-	substitutions: array(ModelSubstitutionSchema).readonly(),
-	/** The node's `currentEngine.format` this validation ran against. */
-	format: string()
-});
-var ReferenceImageEntrySchema = object({
-	filename: string(),
-	stepIds: array(string()).readonly().optional()
-});
-var ReferenceImageBodySchema = object({
-	base64: string(),
-	filename: string()
-});
-var ReferenceAudioEntrySchema = object({
-	filename: string(),
-	sizeKb: number()
-});
-var ReferenceAudioBodySchema = object({ base64: string() });
-var AudioBackendSchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	available: boolean(),
-	/**
-	* Raw classifier labels this backend can emit (e.g. YAMNet's
-	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
-	* the benchmark UI to populate the `enabledMicroClasses` filter
-	* specific to the selected backend without a separate fetch.
-	*/
-	rawLabels: array(string()).readonly().optional()
-});
-var AudioCapabilitiesSchema = object({
-	activeBackend: string(),
-	availableBackends: array(AudioBackendSchema).readonly(),
-	sampleRate: number(),
-	chunkDurationMs: number()
-});
-var DownloadModelResultSchema = object({
-	filePath: string(),
-	sizeMB: number(),
-	durationMs: number()
-});
-/**
-* Wrapper carrying a single test run's result. Replaces the legacy
-* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
-* canonical `AudioResult` from the Phase 6 output rework: one
-* `AudioDetection` per class above `minScore`, top-N candidates in
-* `debug.alternateLabels['audio-classifier']`, per-source timings in
-* `debug.stepTimings`. The outer `success`/`error` fields stay so the
-* benchmark UI can still report a clean failure when the classifier
-* cap isn't available.
-*/
-var AudioTestResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	frame: custom().optional()
-});
-var PipelineConfigBridge = custom();
-var ConfigUISchemaBridge = custom();
-var ConfigUISchemaNullableBridge = custom();
-var InferenceCapabilitiesBridge = custom();
-var ModelAvailabilityListBridge = custom();
-var PipelineRunResultBridge = custom();
-method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-}))), method(object({ steps: record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-})) }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({
-	success: literal(true),
-	clearedDevices: number()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
-	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
-	deviceKey: string(),
-	/**
-	* `failed` — the per-device restart budget is exhausted; no pool
-	* will be spawned until an operator re-arms it or the runner
-	* respawns. `backoff` — under budget, waiting out the backoff (or
-	* a cached pool observed dead and not yet condemned).
-	*/
-	state: _enum(["failed", "backoff"]),
-	/** Epoch ms of the death that produced this state. */
-	since: number(),
-	/** Pool deaths inside the current window. */
-	deaths: number(),
-	/** The last death's message. */
-	lastError: string()
-})).readonly() })), method(object({
-	nodeId: string(),
-	deviceKey: string()
-}), object({ rearmed: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frame: FrameInputSchema.optional(),
-	/**
-	* Process-local lazy frame. Valid only when caller and provider resolve
-	* in the same execution-group process; split/cross-node callers use
-	* `frame`/`image` inline compatibility instead.
-	*/
-	frameRef: FrameRefSchema.optional(),
-	/**
-	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-	* the decoded pixels live in. One more member of the one-of
-	* frame/frameHandle/image/imageBase64/referenceImage group.
-	*/
-	frameHandle: FrameHandleSchema.optional(),
-	imageBase64: string().optional(),
-	/**
-	* Binary JPEG bytes — preferred over `imageBase64` on internal
-	* hops (hub → forked worker via Moleculer MsgPack) because it
-	* skips the 33% base64 overhead + the per-call base64 decode on
-	* the detection-pipeline worker. Callers can pass either; exactly
-	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-	*/
-	image: _instanceof(Uint8Array).optional(),
-	referenceImage: string().optional(),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Execution plane. 'full' (default) runs the whole tree — benchmark,
-	* reference-image, and detail-subtree calls. 'frame' is the live
-	* per-frame dispatch: ONLY root-plane steps run; crop children
-	* (inputClasses ≠ null) are skipped and served per-track via
-	* pipelineRunner.runDetailSubtree (two-plane design).
-	*/
-	plane: _enum(["full", "frame"]).optional(),
-	/**
-	* Inference-device selector (Phase 2 multi-device). Format
-	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-	* Omitted ⇒ the runner's default device (current single-engine
-	* behaviour). Selects WHICH device pool of the node runs the call.
-	*/
-	deviceKey: string().optional(),
-	/**
-	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-	* when the parent crop was resolved from the frame's retained NATIVE
-	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-	* resolution from that surface — the SAME quality path faces already
-	* had — instead of the downscaled parent tile. `handle` keys the native
-	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
-	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-	* the executor's crop-normalized child ROI back into frame-normalized
-	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-	* (today's behaviour on the fallback path).
-	*/
-	nativeCropRef: NativeCropRefSchema.optional()
-}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frames: array(FrameInputSchema).min(1).max(255),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-	* the batch to the Python pool's bench preprocess cache
-	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-	* preprocessed ONCE and every later inference is a pure-inference cache
-	* hit — the sustained-throughput run measures inference, not
-	* decode+preprocess+infer. Omitted/0 for live frames (all different →
-	* full preprocess every call, correct). Fresh per sustained run;
-	* released via `uncacheFrame`.
-	*/
-	frameId: number().int().nonnegative().optional(),
-	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-	deviceKey: string().optional()
-}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
-	data: _instanceof(Uint8Array),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum([
-		"rgb",
-		"bgr",
-		"gray"
-	])
-}), object({
-	frameId: number(),
-	width: number(),
-	height: number()
-}), { kind: "mutation" }), method(object({
-	stepId: string(),
-	frameId: number().int()
-}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(_void(), object({
-	batchMode: string(),
-	windowMs: number(),
-	maxBatchSize: number(),
-	concurrency: number()
-})), method(_void(), array(object({
-	engineKey: string(),
-	engine: PipelineEngineChoiceSchema,
-	modelsLoaded: array(string()).readonly(),
-	inUseByCameras: array(number()).readonly(),
-	/**
-	* Origin of this resident factory.
-	*  - `runtime`       — main camera-serving engine (no idle TTL).
-	*  - `warm-override` — benchmark/test override held in the warm
-	*                      cache; auto-disposed after the idle TTL.
-	*  - `device-pool`   — a concurrent per-device pool (Phase 2
-	*                      multi-device, keyed by `deviceKey`) resolved
-	*                      via `resolveDeviceFactory`. Runs alongside the
-	*                      `runtime` engine on a DIFFERENT accelerator
-	*                      (NPU / iGPU / Coral) — this is how the
-	*                      Engines tab shows all pools running at once.
-	*/
-	kind: _enum([
-		"runtime",
-		"warm-override",
-		"device-pool"
-	]),
-	/** Native pid of the underlying Python pool (null when no pool). */
-	poolPid: number().nullable(),
-	/** ms since this factory was last used (null when not warm-tracked). */
-	idleMs: number().nullable(),
-	/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-	idleTtlMs: number().nullable()
-})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	engine: PipelineEngineChoiceSchema,
-	force: boolean().optional()
-}), object({
-	success: boolean(),
-	reason: string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
-	addonId: string(),
-	modelId: string(),
-	filename: string().optional(),
-	settings: record(string(), unknown()).optional()
-}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
-/**
-* Per-stage gating mode applied to the zones a rule references.
-*
-* - `include`: the rule contributes to a **whitelist** for its stage.
-*   When at least one `include` rule fires for a stage, only entities
-*   inside one of those zones pass that stage.
-* - `exclude`: the rule contributes to a **blacklist** for its stage.
-*   Entities inside one of those zones are dropped at that stage.
-*
-* `monitor`-style observation (count without filtering) is not a rule
-* mode — zones without any matching rule are observed naturally by
-* `zone-analytics` (live snapshot + history), so an "I just want to
-* count, not filter" use case needs no rule at all.
-*/
-var ZoneRuleModeEnum = _enum(["include", "exclude"]);
-/**
-* Per-consumer rule that references existing zones (geometry) and
-* defines how a specific pipeline stage should treat them. Each
-* consumer addon owns its own `ZoneRule[]` array in its per-device
-* settings:
-*
-* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
-* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
-* - future: notification rules, audio gating, etc.
-*
-* One rule applies to N zones (`zoneIds[]`) so the operator can
-* express "ignore motion in ALL of {garden, street}" with a single
-* rule. `classFilter` narrows the rule to specific object classes —
-* "drop person detections in the street, but keep cars" is one
-* `exclude` rule with `classFilter: ['person']`.
-*
-* `enabled` is a soft toggle — the operator can keep the rule
-* configured but inert without deleting it.
-*/
-var ZoneRuleSchema = object({
-	/** Stable rule id — survives edits, used by the UI for diffing. */
-	id: string(),
-	/** Optional human-readable label rendered in the rule editor. */
-	name: string().optional(),
-	/** Zones this rule targets. The rule's `mode` applies to ALL
-	*  listed zones (OR-set: a detection in any one of them counts).
-	*  At least one zone id required — a rule with no targets is a
-	*  configuration mistake and the form validator rejects it. */
-	zoneIds: array(string()).min(1).readonly(),
-	mode: ZoneRuleModeEnum,
-	/**
-	* Class names this rule applies to. Empty / undefined ⇒ rule
-	* applies to every class. Class strings match the `macroClass`
-	* field on detections (e.g. `person`, `car`, `dog`).
-	*/
-	classFilter: array(string()).readonly().optional(),
-	/**
-	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
-	* required to consider an entity "in the zone". Defaults to the
-	* consumer's stage default when omitted. Kept for back-compat with
-	* existing per-rule overrides; new operators pick the value via
-	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-	* set, the lower-level engine reads it as a 0–1 fraction.
-	*/
-	overlapThreshold: number().min(0).max(1).optional(),
-	/**
-	* Operator-friendly version of `overlapThreshold` — the percentage
-	* of the detection's bbox that must lie inside the zone for the
-	* rule to match. Documented default is 85%; the engine substitutes
-	* that when the field is omitted (kept optional so existing rules
-	* stored without it stay valid).
-	*
-	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-	* rule, the engine prefers `bboxInclusionPct` because it's the
-	* field exposed in the UI. Internally both feed the same gate.
-	*/
-	bboxInclusionPct: number().min(0).max(100).optional(),
-	/**
-	* When `true` and a detection has a segmentation mask, use the
-	* mask for overlap instead of the bbox. Detection-stage only;
-	* motion rules ignore this field.
-	*/
-	preferMask: boolean().optional(),
-	/**
-	* Soft-toggle: `false` disables the rule without deleting it.
-	* Defaults to `true` so operators creating a rule via the UI
-	* see it active immediately.
-	*/
-	enabled: boolean().default(true)
-});
-array(ZoneRuleSchema).readonly();
-/**
-* Zone — pure geometry + identity. NO filtering behaviour.
-*
-* Zones describe **where** in the frame the operator wants to flag
-* something; consumer-owned {@link ZoneRule} arrays describe **how**
-* each pipeline stage uses them. Splitting the two means a single
-* polygon "Driveway" can simultaneously back a motion-exclude rule,
-* a detection-include rule on `['car']`, and an occupancy aggregate
-* — without three duplicated polygons.
-*
-* Owned by the orchestrator addon (provider) and mirrored into the
-* `zones` device-state slice on every mutation. Consumers
-* (motion-wasm, pipeline-executor, analytics, admin UI) read either
-* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
-* mirror with `onChanged`).
-*
-* Coordinates are normalised fractions of the frame (0–1) so zones
-* survive resolution changes and stream profile switches.
-*
-* `kind` discriminates between full polygons (closed regions used
-* for intrusion / occupancy filters) and tripwires (open 2-point
-* line segments used for cross events). Onboard / firmware-reported
-* zones (Reolink, ONVIF) are out of scope for now — see the deferred
-* task list.
-*/
-var ZoneKindEnum = _enum(["polygon", "tripwire"]);
-/** Polygon vertex in fraction-of-frame coordinates (0–1). */
-var PolygonPointSchema = object({
-	x: number(),
-	y: number()
-});
-/** A camera detection zone — pure geometry/identity. */
-var ZoneSchema = object({
-	id: string(),
-	name: string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: string().default("#3b82f6")
-});
-/**
-* Zones capability — per-camera CRUD over polygon detection zones.
-*
-* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
-* to per-device settings and mirrors into the `zones` device-state
-* slice on every mutation, so downstream consumers can subscribe via
-* `dev.state.zones.onChanged`.
-*
-* The cap surface only handles geometry + identity; filtering
-* behaviour (per-class, include/exclude, threshold) lives in the
-* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
-* `capabilities/schemas/zone-rule.js`.
-*/
-var zonesCapability = {
-	name: "zones",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
-		addZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		removeZone: method(object({
-			deviceId: number(),
-			zoneId: string()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		updateZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	/**
-	* Runtime-state slice — the live zone catalogue mirrored by the
-	* orchestrator on every CRUD mutation. Consumers read via
-	* `device.state.zones.value` / `.watch(...)` without round-tripping
-	* the cap, and the codegen DeviceProxy auto-wires the reactive
-	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
-	* (e.g. zone groupings) can sit alongside the polygon list.
-	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
-	/**
-	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
 * objects, per-kind event collections (motion / object / audio), and
@@ -21949,6 +21380,22 @@ var TrackSchema = object({
 	* omit it. Render nothing when absent.
 	*/
 	previewMissReason: string().optional(),
+	/**
+	* The ROOT model that produced this track — the `FrameResult.rootModelId` of
+	* the frame it was BORN on (D646). What a later replay compares against, so
+	* "the original model" is named rather than assumed. A birth fact: never
+	* rewritten by a later frame. **Absent ≠ unknown-model**: a row from before
+	* the column, and a track the camera's own detector produced, carry none.
+	*/
+	modelId: string().optional(),
+	/**
+	* Size (px) of the detection frame this track's `positions[].bbox` live in —
+	* the frame it was born on, else the camera's latest analysis frame at
+	* persist time. Divide a position by these to normalise it. Absent when the
+	* size was never known.
+	*/
+	frameWidth: number().optional(),
+	frameHeight: number().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -22955,24 +22402,6 @@ var MediaReclaimStatusSchema = object({
 	finishedAtMs: number().nullable(),
 	error: string().nullable()
 });
-var ReplayFrameInputSchema = object({
-	timestamp: number(),
-	frame: PipelineRunResultBridge
-});
-var RunReplayFrameProcessorResultSchema = object({ tracks: array(object({
-	className: string(),
-	firstSeenMs: number(),
-	lastSeenMs: number(),
-	/** Bbox of the track's FIRST matched detection, pixel-space in the clip's
-	*  frame — a representative box for the diff's `(className, window, IoU)`
-	*  pairing (`replay-diff.ts`). A replay does not need the full per-frame
-	*  trajectory production's `Track.positions` keeps. */
-	bbox: BoundingBoxSchema,
-	/** How many of the input frames this track matched a real detection on
-	*  (never a coasted/extrapolated frame) — the replay's own signal for "how
-	*  solid is this track", cheaper than re-deriving it from a trajectory. */
-	framesMatched: number().int()
-})).readonly() });
 /**
 * The long-term series a camera produces. A closed union so a typo cannot
 * invent one, and the ONE declaration of it — the addon's `AnalyticsLtsSeries`
@@ -23699,32 +23128,6 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/**
-		* The FrameProcessor pass of a replay run — see the `Replay` section
-		* above this capability's definition for why this is not the
-		* `processFrame` method this file's header says pipeline-analytics does
-		* not have.
-		*
-		* Constructs a FRESH `FrameProcessor` for `(deviceId, source)`, feeds it
-		* `frames` IN THE ORDER GIVEN (the caller is responsible for time
-		* ordering — this method does not sort), and returns the tracks it
-		* produced. Zero persistence: no `TrackStore`, no event bus, no media
-		* capture. `zones` / `detectionRules` are the run's OWN zone set —
-		* typically the camera's real zones plus an ephemeral overlay
-		* (`addon-benchmark`'s `replay-plan.ts`), never read from or written to
-		* the `zones` capability by this method itself.
-		*/
-		runReplayFrameProcessor: method(object({
-			deviceId: number(),
-			source: DetectionSourceSchema,
-			zones: array(ZoneSchema).readonly().optional(),
-			detectionRules: array(ZoneRuleSchema).readonly().optional(),
-			zoneMembershipMinOverlap: number().min(0).max(1).optional(),
-			frames: array(ReplayFrameInputSchema).min(1)
-		}), RunReplayFrameProcessorResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Every annotation on a track, oldest first. */
 		listRetrainAnnotations: method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
 			kind: "query",
@@ -23964,6 +23367,478 @@ var pipelineAnalyticsCapability = {
 		}) }
 	}
 };
+/**
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+*/
+var NativeCropRefSchema = object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
+	})
+});
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
+var ModelFormatSchema$1 = _enum([
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+]);
+var PipelineSlotSchema = _enum([
+	"detector",
+	"cropper",
+	"classifier",
+	"refiner",
+	"audio-classifier"
+]);
+var PipelineEngineChoiceSchema = object({
+	runtime: literal("python"),
+	backend: string(),
+	format: ModelFormatSchema$1,
+	device: string().optional()
+});
+/**
+* One pool's resolved provisioning (`getEffectiveTuning`). `numWorkers` is the
+* knob that lifts a saturated pool (`inference-devices.md`); `concurrency` is
+* per-worker in-flight requests. `deviceKey` echoes the pool asked about —
+* `null` for the node-default pool.
+*/
+var EffectiveTuningSchema = object({
+	deviceKey: string().nullable(),
+	runtime: string(),
+	batchMode: string(),
+	windowMs: number(),
+	maxBatchSize: number(),
+	concurrency: number(),
+	numWorkers: number()
+});
+var AvailableEngineSchema = object({
+	engine: PipelineEngineChoiceSchema,
+	devices: array(object({
+		id: string(),
+		label: string(),
+		description: string().optional()
+	})).readonly(),
+	defaultDevice: string()
+});
+var PipelineDefaultStepSchema = lazy(() => object({
+	addonId: string(),
+	addonName: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineDefaultStepSchema).readonly(),
+	group: string().optional(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateStepSchema = lazy(() => object({
+	addonId: string(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineTemplateStepSchema).readonly(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = object({
+	id: string(),
+	name: string(),
+	createdAt: string(),
+	updatedAt: string(),
+	engine: PipelineEngineChoiceSchema,
+	steps: array(PipelineTemplateStepSchema).readonly()
+});
+var PipelineModelOptionSchema = object({
+	id: string(),
+	name: string(),
+	formats: record(string(), object({
+		downloaded: boolean(),
+		sizeMB: number()
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
+});
+var ConfigFieldBridge = custom();
+var PipelineAddonSchemaSchema = object({
+	id: string(),
+	name: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	childSlots: array(PipelineSlotSchema).readonly(),
+	models: array(PipelineModelOptionSchema).readonly(),
+	defaultModelId: string(),
+	defaultModelIdByFormat: record(string(), string()).optional(),
+	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
+	defaultConfidence: number(),
+	group: string().optional(),
+	configSchema: array(ConfigFieldBridge).readonly().optional()
+});
+var PipelineSlotSchemaSchema = object({
+	id: PipelineSlotSchema,
+	label: string(),
+	priority: number(),
+	parentSlot: PipelineSlotSchema.nullable(),
+	addons: array(PipelineAddonSchemaSchema).readonly()
+});
+var PipelineSchemaSchema = object({
+	availableEngines: array(AvailableEngineSchema).readonly(),
+	selectedEngine: PipelineEngineChoiceSchema,
+	slots: array(PipelineSlotSchemaSchema).readonly()
+});
+var EngineProvisioningSchema = object({
+	runtimeId: _enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"edgetpu"
+	]).nullable(),
+	device: string().nullable(),
+	state: _enum([
+		"idle",
+		"installing",
+		"verifying",
+		"ready",
+		"failed"
+	]),
+	progress: number().optional(),
+	error: string().optional(),
+	nextRetryAt: number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: array(string()).optional()
+});
+var PipelineStepInputSchema = lazy(() => object({
+	addonId: string(),
+	modelId: string().optional(),
+	enabled: boolean().default(true),
+	children: array(PipelineStepInputSchema).optional(),
+	settings: record(string(), unknown()).optional(),
+	jumpDeviceKey: string().optional()
+}));
+var ModelSubstitutionSchema = object({
+	addonId: string(),
+	chosen: string(),
+	running: string(),
+	format: string()
+});
+var PipelineValidationIssueSchema = object({
+	addonId: string(),
+	kind: _enum([
+		"unknown-addon",
+		"no-format-build",
+		"unknown-device"
+	]),
+	detail: string()
+});
+var PipelineValidationResultSchema = object({
+	ok: boolean(),
+	issues: array(PipelineValidationIssueSchema).readonly(),
+	substitutions: array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: string()
+});
+var ReferenceImageEntrySchema = object({
+	filename: string(),
+	stepIds: array(string()).readonly().optional()
+});
+var ReferenceImageBodySchema = object({
+	base64: string(),
+	filename: string()
+});
+var ReferenceAudioEntrySchema = object({
+	filename: string(),
+	sizeKb: number()
+});
+var ReferenceAudioBodySchema = object({ base64: string() });
+var AudioBackendSchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	available: boolean(),
+	/**
+	* Raw classifier labels this backend can emit (e.g. YAMNet's
+	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
+	* the benchmark UI to populate the `enabledMicroClasses` filter
+	* specific to the selected backend without a separate fetch.
+	*/
+	rawLabels: array(string()).readonly().optional()
+});
+var AudioCapabilitiesSchema = object({
+	activeBackend: string(),
+	availableBackends: array(AudioBackendSchema).readonly(),
+	sampleRate: number(),
+	chunkDurationMs: number()
+});
+var DownloadModelResultSchema = object({
+	filePath: string(),
+	sizeMB: number(),
+	durationMs: number()
+});
+/**
+* Wrapper carrying a single test run's result. Replaces the legacy
+* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
+* canonical `AudioResult` from the Phase 6 output rework: one
+* `AudioDetection` per class above `minScore`, top-N candidates in
+* `debug.alternateLabels['audio-classifier']`, per-source timings in
+* `debug.stepTimings`. The outer `success`/`error` fields stay so the
+* benchmark UI can still report a clean failure when the classifier
+* cap isn't available.
+*/
+var AudioTestResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	frame: custom().optional()
+});
+var PipelineConfigBridge = custom();
+var ConfigUISchemaBridge = custom();
+var ConfigUISchemaNullableBridge = custom();
+var InferenceCapabilitiesBridge = custom();
+var ModelAvailabilityListBridge = custom();
+var PipelineRunResultBridge = custom();
+method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+}))), method(object({ steps: record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+})) }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({
+	success: literal(true),
+	clearedDevices: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
+	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
+	deviceKey: string(),
+	/**
+	* `failed` — the per-device restart budget is exhausted; no pool
+	* will be spawned until an operator re-arms it or the runner
+	* respawns. `backoff` — under budget, waiting out the backoff (or
+	* a cached pool observed dead and not yet condemned).
+	*/
+	state: _enum(["failed", "backoff"]),
+	/** Epoch ms of the death that produced this state. */
+	since: number(),
+	/** Pool deaths inside the current window. */
+	deaths: number(),
+	/** The last death's message. */
+	lastError: string()
+})).readonly() })), method(object({
+	nodeId: string(),
+	deviceKey: string()
+}), object({ rearmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({
+	steps: array(PipelineStepInputSchema),
+	deviceKey: string().optional()
+}), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
+	name: string(),
+	steps: array(PipelineTemplateStepSchema).readonly(),
+	engine: PipelineEngineChoiceSchema
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
+	id: string(),
+	name: string().optional(),
+	steps: array(PipelineTemplateStepSchema).readonly().optional()
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frame: FrameInputSchema.optional(),
+	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
+	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+	* the decoded pixels live in. One more member of the one-of
+	* frame/frameHandle/image/imageBase64/referenceImage group.
+	*/
+	frameHandle: FrameHandleSchema.optional(),
+	imageBase64: string().optional(),
+	/**
+	* Binary JPEG bytes — preferred over `imageBase64` on internal
+	* hops (hub → forked worker via Moleculer MsgPack) because it
+	* skips the 33% base64 overhead + the per-call base64 decode on
+	* the detection-pipeline worker. Callers can pass either; exactly
+	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
+	*/
+	image: _instanceof(Uint8Array).optional(),
+	referenceImage: string().optional(),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Execution plane. 'full' (default) runs the whole tree — benchmark,
+	* reference-image, and detail-subtree calls. 'frame' is the live
+	* per-frame dispatch: ONLY root-plane steps run; crop children
+	* (inputClasses ≠ null) are skipped and served per-track via
+	* pipelineRunner.runDetailSubtree (two-plane design).
+	*/
+	plane: _enum(["full", "frame"]).optional(),
+	/**
+	* Inference-device selector (Phase 2 multi-device). Format
+	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+	* Omitted ⇒ the runner's default device (current single-engine
+	* behaviour). Selects WHICH device pool of the node runs the call.
+	*/
+	deviceKey: string().optional(),
+	/**
+	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+	* when the parent crop was resolved from the frame's retained NATIVE
+	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+	* resolution from that surface — the SAME quality path faces already
+	* had — instead of the downscaled parent tile. `handle` keys the native
+	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+	* the executor's crop-normalized child ROI back into frame-normalized
+	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+	* (today's behaviour on the fallback path).
+	*/
+	nativeCropRef: NativeCropRefSchema.optional(),
+	/**
+	* Offline REPLAY of stored media for `deviceId` (D56, D646): the
+	* camera's zone gate and overrides apply as live, every executing
+	* step runs EXACTLY the model it names on the `deviceKey` pool it
+	* names or the call refuses (`model-not-servable` /
+	* `device-not-servable`), and nothing reaches the camera's live
+	* trace stream. Absent ⇒ unchanged behaviour.
+	*/
+	replay: literal(true).optional()
+}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frames: array(FrameInputSchema).min(1).max(255),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+	* the batch to the Python pool's bench preprocess cache
+	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+	* preprocessed ONCE and every later inference is a pure-inference cache
+	* hit — the sustained-throughput run measures inference, not
+	* decode+preprocess+infer. Omitted/0 for live frames (all different →
+	* full preprocess every call, correct). Fresh per sustained run;
+	* released via `uncacheFrame`.
+	*/
+	frameId: number().int().nonnegative().optional(),
+	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+	deviceKey: string().optional()
+}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
+	data: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum([
+		"rgb",
+		"bgr",
+		"gray"
+	])
+}), object({
+	frameId: number(),
+	width: number(),
+	height: number()
+}), { kind: "mutation" }), method(object({
+	stepId: string(),
+	frameId: number().int()
+}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(object({ deviceKey: string().optional() }), EffectiveTuningSchema), method(_void(), array(object({
+	engineKey: string(),
+	engine: PipelineEngineChoiceSchema,
+	modelsLoaded: array(string()).readonly(),
+	inUseByCameras: array(number()).readonly(),
+	/**
+	* Origin of this resident factory.
+	*  - `runtime`       — main camera-serving engine (no idle TTL).
+	*  - `device-pool`   — a concurrent per-device pool (Phase 2
+	*                      multi-device, keyed by `deviceKey`) resolved
+	*                      via `resolveDeviceFactory`. Runs alongside the
+	*                      `runtime` engine on a DIFFERENT accelerator
+	*                      (NPU / iGPU / Coral) — this is how the
+	*                      Engines tab shows all pools running at once.
+	*/
+	kind: _enum(["runtime", "device-pool"]),
+	/** Native pid of the underlying Python pool (null when no pool). */
+	poolPid: number().nullable(),
+	/** ms since this factory was last used (null when not warm-tracked). */
+	idleMs: number().nullable(),
+	/** Idle TTL after which the factory self-evicts (null when not applicable). */
+	idleTtlMs: number().nullable()
+})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	engine: PipelineEngineChoiceSchema,
+	force: boolean().optional()
+}), object({
+	success: boolean(),
+	reason: string().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
+	addonId: string(),
+	modelId: string(),
+	filename: string().optional(),
+	settings: record(string(), unknown()).optional()
+}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -23989,6 +23864,106 @@ var CameraMetricsSchema = object({
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: number() });
 /**
+* Zone — pure geometry + identity. NO filtering behaviour.
+*
+* Zones describe **where** in the frame the operator wants to flag
+* something; consumer-owned {@link ZoneRule} arrays describe **how**
+* each pipeline stage uses them. Splitting the two means a single
+* polygon "Driveway" can simultaneously back a motion-exclude rule,
+* a detection-include rule on `['car']`, and an occupancy aggregate
+* — without three duplicated polygons.
+*
+* Owned by the orchestrator addon (provider) and mirrored into the
+* `zones` device-state slice on every mutation. Consumers
+* (motion-wasm, pipeline-executor, analytics, admin UI) read either
+* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
+* mirror with `onChanged`).
+*
+* Coordinates are normalised fractions of the frame (0–1) so zones
+* survive resolution changes and stream profile switches.
+*
+* `kind` discriminates between full polygons (closed regions used
+* for intrusion / occupancy filters) and tripwires (open 2-point
+* line segments used for cross events). Onboard / firmware-reported
+* zones (Reolink, ONVIF) are out of scope for now — see the deferred
+* task list.
+*/
+var ZoneKindEnum = _enum(["polygon", "tripwire"]);
+/** Polygon vertex in fraction-of-frame coordinates (0–1). */
+var PolygonPointSchema = object({
+	x: number(),
+	y: number()
+});
+/** A camera detection zone — pure geometry/identity. */
+var ZoneSchema = object({
+	id: string(),
+	name: string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: string().default("#3b82f6")
+});
+/**
+* Zones capability — per-camera CRUD over polygon detection zones.
+*
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
+*/
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
+		addZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: method(object({
+			deviceId: number(),
+			zoneId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+/**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
 * decode worker resolves it against the RETAINED native frame's real pixel dims,
 * so the caller supplies only the detection-res bbox divided by the detection
@@ -34362,7 +34337,7 @@ var HardwareInfoSchema = object({
 	coral: CoralInfoSchema.nullable().optional()
 });
 var PlatformScoreSchema = object({
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: _enum([
 		"onnx",
@@ -34399,7 +34374,7 @@ var ModelRequirementSchema = object({
 });
 var ResolvedInferenceConfigSchema = object({
 	modelId: string(),
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: ModelFormatSchema,
 	reason: string()
@@ -36994,6 +36969,92 @@ var sceneMonitorCapability = {
 	durability: "session"
 };
 /**
+* Per-stage gating mode applied to the zones a rule references.
+*
+* - `include`: the rule contributes to a **whitelist** for its stage.
+*   When at least one `include` rule fires for a stage, only entities
+*   inside one of those zones pass that stage.
+* - `exclude`: the rule contributes to a **blacklist** for its stage.
+*   Entities inside one of those zones are dropped at that stage.
+*
+* `monitor`-style observation (count without filtering) is not a rule
+* mode — zones without any matching rule are observed naturally by
+* `zone-analytics` (live snapshot + history), so an "I just want to
+* count, not filter" use case needs no rule at all.
+*/
+var ZoneRuleModeEnum = _enum(["include", "exclude"]);
+/**
+* Per-consumer rule that references existing zones (geometry) and
+* defines how a specific pipeline stage should treat them. Each
+* consumer addon owns its own `ZoneRule[]` array in its per-device
+* settings:
+*
+* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
+* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
+* - future: notification rules, audio gating, etc.
+*
+* One rule applies to N zones (`zoneIds[]`) so the operator can
+* express "ignore motion in ALL of {garden, street}" with a single
+* rule. `classFilter` narrows the rule to specific object classes —
+* "drop person detections in the street, but keep cars" is one
+* `exclude` rule with `classFilter: ['person']`.
+*
+* `enabled` is a soft toggle — the operator can keep the rule
+* configured but inert without deleting it.
+*/
+var ZoneRuleSchema = object({
+	/** Stable rule id — survives edits, used by the UI for diffing. */
+	id: string(),
+	/** Optional human-readable label rendered in the rule editor. */
+	name: string().optional(),
+	/** Zones this rule targets. The rule's `mode` applies to ALL
+	*  listed zones (OR-set: a detection in any one of them counts).
+	*  At least one zone id required — a rule with no targets is a
+	*  configuration mistake and the form validator rejects it. */
+	zoneIds: array(string()).min(1).readonly(),
+	mode: ZoneRuleModeEnum,
+	/**
+	* Class names this rule applies to. Empty / undefined ⇒ rule
+	* applies to every class. Class strings match the `macroClass`
+	* field on detections (e.g. `person`, `car`, `dog`).
+	*/
+	classFilter: array(string()).readonly().optional(),
+	/**
+	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
+	* required to consider an entity "in the zone". Defaults to the
+	* consumer's stage default when omitted. Kept for back-compat with
+	* existing per-rule overrides; new operators pick the value via
+	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+	* set, the lower-level engine reads it as a 0–1 fraction.
+	*/
+	overlapThreshold: number().min(0).max(1).optional(),
+	/**
+	* Operator-friendly version of `overlapThreshold` — the percentage
+	* of the detection's bbox that must lie inside the zone for the
+	* rule to match. Documented default is 85%; the engine substitutes
+	* that when the field is omitted (kept optional so existing rules
+	* stored without it stay valid).
+	*
+	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+	* rule, the engine prefers `bboxInclusionPct` because it's the
+	* field exposed in the UI. Internally both feed the same gate.
+	*/
+	bboxInclusionPct: number().min(0).max(100).optional(),
+	/**
+	* When `true` and a detection has a segmentation mask, use the
+	* mask for overlap instead of the bbox. Detection-stage only;
+	* motion rules ignore this field.
+	*/
+	preferMask: boolean().optional(),
+	/**
+	* Soft-toggle: `false` disables the rule without deleting it.
+	* Defaults to `true` so operators creating a rule via the UI
+	* see it active immediately.
+	*/
+	enabled: boolean().default(true)
+});
+array(ZoneRuleSchema).readonly();
+/**
 * Script-runner cap. Models HA `script.*` entities on
 * `DeviceType.Script`. A Script is a pre-recorded action sequence
 * that can be invoked imperatively — optionally with a variables
@@ -45165,6 +45226,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewStateSummary": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.previewTemplate": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -45741,12 +45808,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.runReplayFrameProcessor": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -49844,11 +49905,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"pipelineAnalytics.runReplayFrameProcessor": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"pipelineAnalytics.saveRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -50886,7 +50942,8 @@ var NC_SYSTEM_EVENT_FAMILY = {
 	"camera-disabled": null,
 	"camera-enabled": null
 };
-new Map(Object.entries(NC_SYSTEM_EVENT_FAMILY));
+/** Read by NAME, for kinds that arrive as plain strings (a newer hub, the viewer's mirror). */
+var FAMILY_BY_NAME = new Map(Object.entries(NC_SYSTEM_EVENT_FAMILY));
 var NC_SYSTEM_EVENT_CONDITION_FILTER_KEYS = [...NC_SYSTEM_EVENT_FILTER_KEYS, "excludeDeviceIds"];
 /**
 * The filters a family may carry. The base filters are the union of
@@ -50997,6 +51054,24 @@ function systemEventKindsOfFamily(family) {
 	return NC_SYSTEM_EVENT_KIND_GROUP_SPECS.filter((g) => g.family === family).flatMap((g) => g.kinds);
 }
 /**
+* One family, or `mixed`. Mixed covers kinds that span families, a legacy kind,
+* a kind this build does not know (it fails toward read-only and never toward
+* editable), and an empty selection (nothing to decide on).
+*/
+function systemEventFamilyOf(kindNames) {
+	const families = /* @__PURE__ */ new Set();
+	for (const name of kindNames) {
+		const family = FAMILY_BY_NAME.get(name);
+		if (family === void 0 || family === null) return { kind: "mixed" };
+		families.add(family);
+	}
+	const [only] = [...families];
+	return families.size === 1 && only !== void 0 ? {
+		kind: "family",
+		family: only
+	} : { kind: "mixed" };
+}
+/**
 * Why the hub refuses this condition on a new or updated rule. Empty = accepted.
 * Families are reported in `NC_SYSTEM_EVENT_FAMILIES` order, and filters in
 * `NC_SYSTEM_EVENT_CONDITION_FILTER_KEYS` order, so a refusal reads the same
@@ -51072,18 +51147,38 @@ var WEEKDAY_TO_DAY = {
 	Fri: 5,
 	Sat: 6
 };
-/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
-*  An invalid/unknown IANA name falls back to the host timezone. */
-function localDayMinute(atMs, timezone) {
-	const d = new Date(atMs);
-	if (timezone !== void 0) try {
-		const parts = new Intl.DateTimeFormat("en-US", {
+/**
+* One formatter per timezone, built once (D647 review I4). Constructing an
+* `Intl.DateTimeFormat` is the expensive part of this function, and a caller
+* that asks about many instants — a window scan — used to build one per
+* instant. `null` = an invalid IANA name (the host timezone is used).
+*/
+var FORMATTERS = /* @__PURE__ */ new Map();
+function formatterFor(timezone) {
+	const held = FORMATTERS.get(timezone);
+	if (held !== void 0) return held;
+	let made;
+	try {
+		made = new Intl.DateTimeFormat("en-US", {
 			timeZone: timezone,
 			weekday: "short",
 			hour: "numeric",
 			minute: "numeric",
 			hourCycle: "h23"
-		}).formatToParts(d);
+		});
+	} catch {
+		made = null;
+	}
+	FORMATTERS.set(timezone, made);
+	return made;
+}
+/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
+*  An invalid/unknown IANA name falls back to the host timezone. */
+function localDayMinute(atMs, timezone) {
+	const d = new Date(atMs);
+	const formatter = timezone !== void 0 ? formatterFor(timezone) : null;
+	if (formatter !== null) try {
+		const parts = formatter.formatToParts(d);
 		let weekday;
 		let hour;
 		let minute;
@@ -51223,6 +51318,119 @@ var DEVICE_EVENTS = [
 	"detection-blind",
 	...ALARM
 ];
+/** Every kind a summary may speak about — the two summarisable families. */
+var SUMMARISABLE = [...systemEventKindsOfFamily("device-events"), ...systemEventKindsOfFamily("system")];
+/** One per summary SECTION (`NC_STATE_SUMMARY_SECTIONS` in the notification
+*  centre): the section's lines, offered when one of its kinds is selected. */
+var STATE_SUMMARY_SECTION_VARS = [
+	{
+		name: "summaryDevices",
+		label: "Summary: devices offline / switched off",
+		example: "Garage — offline since 07:12",
+		kinds: [
+			"device-offline",
+			"device-online",
+			"device-disabled",
+			"device-enabled"
+		]
+	},
+	{
+		name: "summaryStreams",
+		label: "Summary: streams offline",
+		example: "Ingresso (high) — since 06:40",
+		kinds: ["stream-offline", "stream-online"]
+	},
+	{
+		name: "summaryBattery",
+		label: "Summary: low batteries",
+		example: "Sensore porta — 8 %",
+		kinds: BATTERY
+	},
+	{
+		name: "summaryConsumables",
+		label: "Summary: consumables",
+		example: "Robot — filter 10 %",
+		kinds: CONSUMABLE
+	},
+	{
+		name: "summaryTanks",
+		label: "Summary: tanks",
+		example: "Robot — clean water low",
+		kinds: TANK
+	},
+	{
+		name: "summaryDetection",
+		label: "Summary: cameras detecting nothing",
+		example: "Ingresso — since 05:10",
+		kinds: ["detection-blind"]
+	},
+	{
+		name: "summaryNodes",
+		label: "Summary: nodes",
+		example: "little-unraid — offline since 03:00",
+		kinds: [
+			"node-offline",
+			"node-online",
+			"node-inference-unavailable"
+		]
+	},
+	{
+		name: "summaryAddons",
+		label: "Summary: addons",
+		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: [
+			"addon-crash-loop",
+			"addon-update-available",
+			"addon-updated"
+		]
+	},
+	{
+		name: "summaryUpdates",
+		label: "Summary: server & container updates",
+		example: "server 1.2.377 → 1.2.378",
+		kinds: [
+			"server-update-available",
+			"server-updated",
+			"wrapper-update-available"
+		]
+	}
+];
+var STATE_SUMMARY_VARS = [
+	{
+		name: "summaryText",
+		label: "Summary: every section",
+		description: "One block per section with something to report, one line per item.",
+		example: "Batterie scariche: Sensore porta — 8 %",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	{
+		name: "summaryCount",
+		label: "Summary: items reported",
+		example: "3",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
+		name: v.name,
+		label: v.label,
+		example: v.example,
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...v.kinds],
+		systemEventDeliveries: ["summary"]
+	}))
+];
 var NC_TEMPLATE_VARS = [
 	{
 		name: "camera",
@@ -51473,7 +51681,8 @@ var NC_TEMPLATE_VARS = [
 		group: "system",
 		families: ["rule"],
 		fields: [...RULE_TEXT],
-		kinds: ["system"]
+		kinds: ["system"],
+		systemEventDeliveries: ["instant"]
 	},
 	{
 		name: "deviceName",
@@ -51916,7 +52125,8 @@ var NC_TEMPLATE_VARS = [
 		group: "digest",
 		families: ["summary"],
 		fields: [...RULE_TEXT]
-	}
+	},
+	...STATE_SUMMARY_VARS
 ];
 /**
 * System-event kinds the SERVED catalog holds back (D642): the kinds the hub
@@ -51945,11 +52155,32 @@ var NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS = [
 * rule an installed viewer can author, which is exactly true.
 */
 function servedTemplateVars() {
-	return NC_TEMPLATE_VARS.map((d) => d.systemEventKinds === void 0 ? d : {
+	return NC_TEMPLATE_VARS.filter((d) => !isHeldBackTemplateVar(d)).map((d) => d.systemEventKinds === void 0 ? d : {
 		...d,
 		systemEventKinds: d.systemEventKinds.filter((kind) => !NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS.includes(kind))
 	});
 }
+/**
+* Is this descriptor held back from the SERVED catalog as a whole (D647)?
+* A summary-only variable is: an installed viewer does not read the delivery
+* axis, and would offer it on every instant system rule. The admin, built
+* from the workspace, restores it from its own `NC_TEMPLATE_VARS`.
+*/
+function isHeldBackTemplateVar(d) {
+	return d.systemEventDeliveries !== void 0 && !d.systemEventDeliveries.includes("instant");
+}
+/**
+* Does a descriptor have a value on a system rule of this DELIVERY (D647)?
+* Read only for a system rule kind. An absent axis is `instant` for a
+* descriptor that names `systemEventKinds` (a per-event fact: a summary row
+* has no one device, node or package) and BOTH for one that does not
+* (`{{rule}}`, `{{time}}`).
+*/
+function templateVarDeliveryApplies(d, ctx) {
+	if (!isSystemRuleKind(ctx.kind)) return true;
+	const mode = ctx.systemEventDelivery ?? "instant";
+	return (d.systemEventDeliveries ?? (d.systemEventKinds !== void 0 ? ["instant"] : [mode])).includes(mode);
+}
 /** The caption fields see a fixed, smaller vocabulary (`timelapsePreviewText`,
 *  `summaryCaptionText`). Declared here rather than as `fields` on every
 *  descriptor so the whole rule stays in one line of code. */
@@ -52014,12 +52245,82 @@ function templateVarsFor(ctx) {
 		const allowed = CAPTION_VARS[ctx.field];
 		return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && allowed.includes(d.name) && d.dynamic === void 0);
 	}
-	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx));
+	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx) && templateVarDeliveryApplies(d, ctx));
 }
 /** True when `name` is supplied in `ctx`, dynamic families (`count_<class>`) included. */
 function isKnownTemplateVar(name, ctx) {
 	return templateVarsFor(ctx).some((d) => d.dynamic !== void 0 ? name.startsWith(d.dynamic.prefix) && name.length > d.dynamic.prefix.length : d.name === name);
 }
+/** The families a rule may summarise. The alarm is not one of them. */
+var NC_SYSTEM_EVENT_SUMMARY_FAMILIES = ["device-events", "system"];
+/** The summary's schedule, or `null` for any rule that is not a summary system rule. */
+function systemEventSummaryScheduleOf(rule) {
+	if (!isSystemDelivery(rule.delivery)) return null;
+	const delivery = rule.systemEventDelivery;
+	return delivery?.mode === "summary" ? delivery.schedule : null;
+}
+/** Absent and `instant` are the same answer: a notification per event. */
+function isSystemEventSummaryRule(rule) {
+	return systemEventSummaryScheduleOf(rule) !== null;
+}
+function actionsAreSet(actions) {
+	return (actions?.onTrigger?.length ?? 0) > 0 || (actions?.buttons?.length ?? 0) > 0;
+}
+/**
+* Why the hub refuses this rule's delivery. Empty = accepted. An instant rule
+* (absent or `{ mode: 'instant' }`) is never refused here.
+*
+* Beside a summary, two fields are refused because they would do nothing:
+* the rule's own `schedule` (the summary's schedule is the send time; a second
+* active-hours gate would silently empty it) and `actions` (a summary is not a
+* match, so nothing would ever run them).
+*/
+function systemEventDeliveryProblems(rule) {
+	if (rule.systemEventDelivery?.mode !== "summary") return [];
+	if (!isSystemDelivery(rule.delivery)) return [{
+		code: "not-a-system-rule",
+		delivery: rule.delivery
+	}];
+	const problems = [];
+	const verdict = systemEventFamilyOf(rule.conditions.systemEvent?.kinds ?? []);
+	const family = verdict.kind === "family" ? verdict.family : "mixed";
+	if (family === "mixed" || !NC_SYSTEM_EVENT_SUMMARY_FAMILIES.includes(family)) problems.push({
+		code: "family-not-summarisable",
+		family
+	});
+	const windows = rule.systemEventDelivery.schedule.windows;
+	if (windows.length === 0) problems.push({ code: "empty-schedule" });
+	windows.forEach((window, index) => {
+		if (window.days.length === 0 || window.startMinute === window.endMinute) problems.push({
+			code: "degenerate-window",
+			index
+		});
+	});
+	if (rule.schedule !== void 0) problems.push({ code: "schedule-beside-summary" });
+	if (actionsAreSet(rule.actions)) problems.push({ code: "actions-beside-summary" });
+	return problems;
+}
+function describeSystemEventDeliveryProblem(problem) {
+	switch (problem.code) {
+		case "not-a-system-rule": return `a '${problem.delivery}' rule has no summary delivery — only device-events and system rules do`;
+		case "family-not-summarisable": return problem.family === "alarm" ? "an alarm rule cannot be a scheduled summary — the alarm stays instant" : `a ${problem.family} rule cannot be a scheduled summary — only device-events and system rules`;
+		case "degenerate-window": return `send time ${String(problem.index + 1)} has no day, or starts and ends on the same minute — it never closes, so nothing would be sent`;
+		case "empty-schedule": return "a summary rule needs at least one send time — its schedule has no window";
+		case "schedule-beside-summary": return "a summary rule is sent on its summary schedule — remove the active-hours schedule";
+		case "actions-beside-summary": return "a summary rule never matches an event, so its actions would never run — remove them";
+	}
+}
+var SUMMARY_CONTENT_VAR = /\{\{\s*summary(?:Text|Devices|Streams|Battery|Consumables|Tanks|Detection|Nodes|Addons|Updates)\s*\}\}/;
+/**
+* Does a custom BODY carry the summary's content (`{{summaryText}}` or a
+* section variable)? A body that does not would send a summary with nothing
+* in it; the hub then appends `{{summaryText}}` and the admin warns (review
+* M3). An absent or blank body uses the hub's own wording, which does.
+*/
+function templateCarriesSummary(body) {
+	if (body === void 0 || body.trim().length === 0) return true;
+	return SUMMARY_CONTENT_VAR.test(body);
+}
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -53024,4 +53325,4 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
-export { NcTemplateVarDescriptorSchema as $, sensorRaisedOf as $t, NC_DEFAULT_SNOOZE_MINUTES as A, unknown as An, failureContributionCapability as At, NcRuleInputSchema as B, mayWriteToLocation as Bt, MAX_BIRTH_DECISION_RECORDS as C, discriminatedUnion as Cn, deriveRecordingMode as Ct, NC_ALARM_SYSTEM_EVENT_KINDS as D, partialRecord as Dn, evaluateSensorEdge as Dt, MediaFileKindEnum as E, object as En, encodeVectorBase64 as Et, NC_TEMPLATE_VARS as F, isMediaOwnerType as Ft, NcScheduleSchema as G, pipelineAnalyticsCapability as Gt, NcRuleSchema as H, occupancyScope as Ht, NcAlarmConfigSchema as I, isScheduleActive as It, NcSnoozeSuppressedSchema as J, readTimelapseGeneratedAt as Jt, NcSnoozeInputSchema as K, plateGalleryCapability as Kt, NcAlarmSettingsPatchSchema as L, isSourceCap as Lt, NC_SNOOZE_MAX_MINUTES as M, isDetectionMacroClass as Mt, NC_TANK_SYSTEM_EVENT_KINDS as N, isEventOwnerType as Nt, NC_CONDITION_CATALOG as O, record as On, evictionPolicyOfLocation as Ot, NC_TAXONOMY as P, isKnownTemplateVar as Pt, NcTemplatePreviewSchema as Q, sceneMonitorCapability as Qt, NcConditionDescriptorSchema as R, isSystemDelivery as Rt, MAX_ARCHIVED_DEBUG_NOTES as S, boolean as Sn, cosineSimilarity as St, MOTION_CLOSE_AFTER_MS as T, number as Tn, embeddingEncoderCapability as Tt, NcRuleTargetSchema as U, parseProcStatus as Ut, NcRulePatchSchema as V, notificationRulesCapability as Vt, NcRuleUpdateInputSchema as W, pickClusterStepModels as Wt, NcTaxonomySchema as X, resolvePoolMemoryPolicy as Xt, NcSystemEventKindSchema as Y, resolveLocationMode as Yt, NcTemplatePreviewInputSchema as Z, ruleBelongsToAlarm as Zt, FIRST_LEVEL_MACRO_CLASSES as _, isDeviceScopedCap as _n, assertTimelapseCadences as _t, BirthDecisionRecordSchema as a, templateVarsFor as an, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as at, LabelAttributionSchema as b, _enum as bn, buildEventKindDescriptor as bt, CoverStateSchema as c, errMsg as cn, SCENE_DIVERGED as ct, DEFAULT_TIMELAPSE_PREVIEW_TEXT as d, CamProfileSchema as dn, TimelapseRuleInputSchema as dt, servedTemplateVars as en, OpsLogEntrySchema as et, DETECTION_MACRO_CLASSES as f, DeviceType as fn, TimelapseRulePatchSchema as ft, EVENT_OWNER_TYPES as g, hydrateSchema as gn, alarmPanelCapability as gt, EVENT_KIND_BY_CAP as h, defineCustomActions as hn, addonWidgetsSourceCapability as ht, BaseDevice as i, systemEventFilterApplies as in, RetrainStatusSchema as it, NC_SENSOR_TRANSITION_KINDS as j, EventCategory as jn, hfModelUrl as jt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as k, string as kn, faceGalleryCapability as kt, DEFAULT_EVENT_COLOR as l, canonicalHash as ln, SceneMonitorSchema as lt, DeclaredDevices as m, customAction as mn, TrackSourceSchema as mt, AlarmArmModeSchema as n, subKindsOf as nn, RECORDING_EXPORT_MAX_READ_BYTES as nt, CLUSTER_MODEL_SCOPED_STEPS as o, vectorDimFromBase64 as on, SCENE_DEFAULT_ANCHOR_THRESHOLD as ot, DETECTION_PIPELINE_CAP_NAME as p, createEvent as pn, TimelapseRuleSchema as pt, NcSnoozeSchema as q, readDeviceStateFrom as qt, ArchivedDebugNoteSchema as r, systemEventFamilyProblems as rn, RECORDING_SOURCE_CAMSTACK_ADDON as rt, COCO_TO_MACRO as s, zoneAnalyticsCapability as sn, SCENE_DEFAULT_UNCOVERED_POLICY as st, AUDIO_MACRO_LABELS as t, storageOccupancyCapability as tn, PoolMemoryWatchdog as tt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as u, BaseAddon as un, TIMELAPSE_DENSE_FLOOR_SEC as ut, FULL_IMAGE_BBOX as v, nodePin as vn, audioMetricsCapability as vt, MAX_BIRTH_LATENCY_PROXY_MS as w, literal as wn, describeSystemEventFamilyProblem as wt, LockStateSchema as x, array as xn, consumableLowPercentOf as xt, FailureCounters as y, sleep as yn, audioModeOf as yt, NcConditionsSchema as z, kebabToCamel as zt };
+export { NcTemplatePreviewSchema as $, resolvePoolMemoryPolicy as $t, NC_DEFAULT_SNOOZE_MINUTES as A, literal as An, evictionPolicyOfLocation as At, NcConditionsSchema as B, isSystemDelivery as Bt, MAX_BIRTH_DECISION_RECORDS as C, isDeviceScopedCap as Cn, cosineSimilarity as Ct, NC_ALARM_SYSTEM_EVENT_KINDS as D, array as Dn, embeddingEncoderCapability as Dt, MediaFileKindEnum as E, _enum as En, describeSystemEventFamilyProblem as Et, NC_TAXONOMY as F, string as Fn, isEventOwnerType as Ft, NcRuleUpdateInputSchema as G, occupancyScope as Gt, NcRulePatchSchema as H, kebabToCamel as Ht, NC_TEMPLATE_VARS as I, unknown as In, isKnownTemplateVar as It, NcSnoozeSchema as J, pipelineAnalyticsCapability as Jt, NcScheduleSchema as K, parseProcStatus as Kt, NcAlarmConfigSchema as L, EventCategory as Ln, isMediaOwnerType as Lt, NC_SNOOZE_MAX_MINUTES as M, object as Mn, failureContributionCapability as Mt, NC_SYSTEM_EVENT_KIND_GROUP_SPECS as N, partialRecord as Nn, hfModelUrl as Nt, NC_CONDITION_CATALOG as O, boolean as On, encodeVectorBase64 as Ot, NC_TANK_SYSTEM_EVENT_KINDS as P, record as Pn, isDetectionMacroClass as Pt, NcTemplatePreviewInputSchema as Q, resolveLocationMode as Qt, NcAlarmSettingsPatchSchema as R, isScheduleActive as Rt, MAX_ARCHIVED_DEBUG_NOTES as S, hydrateSchema as Sn, consumableLowPercentOf as St, MOTION_CLOSE_AFTER_MS as T, sleep as Tn, describeSystemEventDeliveryProblem as Tt, NcRuleSchema as U, mayWriteToLocation as Ut, NcRuleInputSchema as V, isSystemEventSummaryRule as Vt, NcRuleTargetSchema as W, notificationRulesCapability as Wt, NcSystemEventKindSchema as X, readDeviceStateFrom as Xt, NcSnoozeSuppressedSchema as Y, plateGalleryCapability as Yt, NcTaxonomySchema as Z, readTimelapseGeneratedAt as Zt, FIRST_LEVEL_MACRO_CLASSES as _, CamProfileSchema as _n, alarmPanelCapability as _t, BirthDecisionRecordSchema as a, subKindsOf as an, RetrainStatusSchema as at, LabelAttributionSchema as b, customAction as bn, audioModeOf as bt, CoverStateSchema as c, systemEventFilterApplies as cn, SCENE_DEFAULT_UNCOVERED_POLICY as ct, DEFAULT_TIMELAPSE_PREVIEW_TEXT as d, templateVarsFor as dn, TIMELAPSE_DENSE_FLOOR_SEC as dt, ruleBelongsToAlarm as en, NcTemplateVarDescriptorSchema as et, DETECTION_MACRO_CLASSES as f, vectorDimFromBase64 as fn, TimelapseRuleInputSchema as ft, EVENT_OWNER_TYPES as g, BaseAddon as gn, addonWidgetsSourceCapability as gt, EVENT_KIND_BY_CAP as h, canonicalHash as hn, TrackSourceSchema as ht, BaseDevice as i, storageOccupancyCapability as in, RECORDING_SOURCE_CAMSTACK_ADDON as it, NC_SENSOR_TRANSITION_KINDS as j, number as jn, faceGalleryCapability as jt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as k, discriminatedUnion as kn, evaluateSensorEdge as kt, DEFAULT_EVENT_COLOR as l, systemEventSummaryScheduleOf as ln, SCENE_DIVERGED as lt, DeclaredDevices as m, errMsg as mn, TimelapseRuleSchema as mt, AlarmArmModeSchema as n, sensorRaisedOf as nn, PoolMemoryWatchdog as nt, CLUSTER_MODEL_SCOPED_STEPS as o, systemEventDeliveryProblems as on, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as ot, DETECTION_PIPELINE_CAP_NAME as p, zoneAnalyticsCapability as pn, TimelapseRulePatchSchema as pt, NcSnoozeInputSchema as q, pickClusterStepModels as qt, ArchivedDebugNoteSchema as r, servedTemplateVars as rn, RECORDING_EXPORT_MAX_READ_BYTES as rt, COCO_TO_MACRO as s, systemEventFamilyProblems as sn, SCENE_DEFAULT_ANCHOR_THRESHOLD as st, AUDIO_MACRO_LABELS as t, sceneMonitorCapability as tn, OpsLogEntrySchema as tt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as u, templateCarriesSummary as un, SceneMonitorSchema as ut, FULL_IMAGE_BBOX as v, DeviceType as vn, assertTimelapseCadences as vt, MAX_BIRTH_LATENCY_PROXY_MS as w, nodePin as wn, deriveRecordingMode as wt, LockStateSchema as x, defineCustomActions as xn, buildEventKindDescriptor as xt, FailureCounters as y, createEvent as yn, audioMetricsCapability as yt, NcConditionDescriptorSchema as z, isSourceCap as zt };