@camstack/addon-post-analysis 1.2.284 → 1.2.286

package/dist/{dist-Bpx5JMso.js → clip-model-registry-CY0FGcpQ.js}

@@ -5391,7 +5391,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DU7mu4wb.mjs
+//#region ../types/dist/sleep-BXv0ZcRa.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6176,6 +6176,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -7471,7 +7505,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 * can answer "may a rule actuate this?" without importing the schema barrel
 * (~144MB RSS per runner, D28).
 *
-* Coverage: 87 device-scoped capabilities.
+* Coverage: 88 device-scoped capabilities.
 */
 var DEVICE_SCOPED_CAPS = new Set([
 	"accessories",
@@ -7501,6 +7535,7 @@ var DEVICE_SCOPED_CAPS = new Set([
 	"detection-pipeline",
 	"device-admin-link",
 	"device-discovery",
+	"device-extension",
 	"device-ops",
 	"device-status",
 	"doorbell",
@@ -10027,6 +10062,60 @@ var FailureCounters = class {
 		this.counters.clear();
 	}
 };
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
+var CLIP_STRICTNESS_FACTOR = {
+	loose: 1,
+	balanced: 1.25,
+	strict: 1.5
+};
+/**
+* The cosine floor a search runs with.
+*
+* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
+* and silently rescaling it would make the same URL mean different things on
+* two installs. Everything else is relative to the model.
+*/
+function resolveClipSearchMinScore(meta, request) {
+	if (request.minScore !== void 0) return request.minScore;
+	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
+	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
+}
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10055,7 +10144,7 @@ var ModelFormatEntrySchema = object({
 	/** Multi-file payload (directory members or sibling files). */
 	files: array(string()).readonly().optional(),
 	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["node", "python"])).readonly().optional()
+	runtimes: array(_enum(["python"])).readonly().optional()
 });
 /**
 * Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
@@ -10230,7 +10319,14 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -14680,6 +14776,13 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*/
+var LinkedDevicesSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+DeviceType.Camera;
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -15205,11 +15308,128 @@ var EmbeddingResultSchema = object({
 	embedding: array(number()),
 	inferenceMs: number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = _enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	crashes: number(),
+	windowMs: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	attempts: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
 var EmbeddingInfoSchema = object({
 	modelId: string(),
 	embeddingDim: number(),
-	ready: boolean()
-});
+	ready: boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+var EmbeddingRefusalCodeSchema = _enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+function embeddingRefusalToken(code, on) {
+	return `[${code} model=${on.modelId} tower=${on.tower} node=${on.nodeId}]`;
+}
+/** The encoder's refusal for a crashed tower, carrying {@link EMBEDDING_MODEL_FAILED}. */
+function embeddingModelFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_MODEL_FAILED, row)} ${row.modelId} (${row.tower} tower) crashed ${String(row.crashes)} times in ${String(Math.round(row.windowMs / 1e3))}s on ${row.nodeId} — ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+/** The requirements refusal for THIS request, carrying {@link EMBEDDING_REQUIREMENTS_UNAVAILABLE}. */
+function embeddingRequirementsUnavailableError(on, reason) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_UNAVAILABLE, on)} ${on.modelId} (${on.tower} tower) on ${on.nodeId}: ${reason}`);
+}
+/** The terminal requirements refusal, carrying {@link EMBEDDING_REQUIREMENTS_FAILED}. */
+function embeddingRequirementsFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_FAILED, row)} ${row.modelId} (${row.tower} tower) on ${row.nodeId}: requirements can never be met — ${String(row.attempts)} attempts, last: ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+var EMBEDDING_REFUSAL_TOKEN = new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
+/** The refusal `err` (possibly re-wrapped by a transport) carries, or `null` for any other error. */
+function embeddingRefusalOf(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	const match = EMBEDDING_REFUSAL_TOKEN.exec(message);
+	if (match === null) return null;
+	const code = EmbeddingRefusalCodeSchema.safeParse(match[1]);
+	const tower = EmbeddingTowerSchema.safeParse(match[3]);
+	if (!code.success || !tower.success || match[2] === void 0 || match[4] === void 0) return null;
+	return {
+		code: code.data,
+		modelId: match[2],
+		tower: tower.data,
+		nodeId: match[4]
+	};
+}
+/**
+* ONE provider per node (`placement: any-node`), addressed like every global
+* collection: the codegen injects a `{ nodeId?, addonId? }` selector on the
+* void methods and lifts a top-level `nodeId` off the object ones. A call
+* that names no node is answered by the HUB's provider — never by a merge
+* across nodes, because no global collection fans out across nodes (only the
+* providers of one node are `concatCollection`-fanned). So a fleet view of
+* `failedModels` is one `getInfo({ nodeId })` per node, and every answer
+* names the node it came from (D649 round 4); a node that cannot be asked is
+* UNKNOWN to the reader, never "no failures" (D315).
+*/
 var embeddingEncoderCapability = {
 	name: "embedding-encoder",
 	scope: "system",
@@ -15228,8 +15448,30 @@ var embeddingEncoderCapability = {
 			width: number(),
 			height: number()
 		}), EmbeddingResultSchema, { auth: "admin" }),
-		encodeText: method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }),
-		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" })
+		/**
+		* `modelId` (a CLIP IMAGE model id, whose catalog `clip.textModelId` names
+		* the text tower) encodes in that model's space; absent, the cluster row's
+		* `clip-embedding` model — the space every writer is in (D649).
+		*/
+		encodeText: method(object({
+			text: string(),
+			modelId: string().min(1).optional()
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		/** Answers for ONE node — the `nodeId` selector's, else the hub's. */
+		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" }),
+		/**
+		* The operator's explicit clear of the `failed` state (one model, or all)
+		* on ONE node — pass `nodeId` for an agent; the result names the node it
+		* cleared. The only way out besides a model change: a crashing tower is
+		* not retried on a timer.
+		*/
+		resetFailedModels: method(object({ modelId: string().min(1).optional() }), object({
+			cleared: array(string()),
+			nodeId: string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -18126,6 +18368,25 @@ var NcScheduleSchema = object({
 	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
 	invert: boolean().optional()
 });
+/**
+* How a system-event rule of the `device-events` or `system` family speaks
+* (D647): at once, per event (`instant`, the only behaviour before D647), or
+* as a STATE SUMMARY at the end of each window of `schedule`.
+*/
+var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
+/**
+* `summary`: the rule sends NOTHING per event. When a window of `schedule`
+* CLOSES, it sends one notification with the current state of its kinds
+* (low batteries, consumables to replace, devices offline, updates
+* available, ...), after its own filters. Nothing to report sends nothing.
+* The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
+* midnight crossing); the send time is each window's END. Refused on the
+* `alarm` family, which stays instant (`systemEventDeliveryProblems`).
+*/
+var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
+	mode: literal("summary"),
+	schedule: NcScheduleSchema
+})]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
 	/**
@@ -18739,7 +19000,12 @@ var NcMediaPolicySchema = object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
@@ -18861,6 +19127,16 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
+	/**
+	* A `device-events` / `system` rule's delivery (D647): absent or `instant`
+	* is a notification per event; `summary` is one state summary per closed
+	* window of its schedule. `.optional()` and never defaulted: absent must
+	* keep meaning what every rule authored before D647 meant, with no
+	* migration. Top-level rather than inside `conditions.systemEvent`, so a
+	* client that does not know it (an older viewer re-sending `conditions`
+	* whole) leaves it standing through the store's patch merge.
+	*/
+	systemEventDelivery: NcSystemEventDeliverySchema.optional(),
 	/** May be empty when `targetUsers` addresses at least one user — the
 	*  "at least one addressee" invariant is enforced by the provider, because
 	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
@@ -19089,6 +19365,28 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	*/
 	disabledTargetIds: array(string()).default([])
 });
+/** One section of a previewed state summary. `unavailable` = its state could not be read. */
+var NcStateSummaryPreviewSectionSchema = object({
+	id: string(),
+	status: _enum(["read", "unavailable"]),
+	items: number().int().nonnegative(),
+	reason: string().optional()
+});
+/**
+* The summary a rule would send now. `empty` = nothing to report and every
+* section read: such a summary is NOT sent. `dropped` counts the open states
+* the rule's own filters (or a camera mute) left out, by reason.
+* `excludedGroups` names the kind groups selected that have no state to report
+* (backups & exports).
+*/
+var NcStateSummaryPreviewSchema = object({
+	empty: boolean(),
+	count: number().int().nonnegative(),
+	text: string(),
+	sections: array(NcStateSummaryPreviewSectionSchema),
+	dropped: record(string(), number().int().nonnegative()),
+	excludedGroups: array(string())
+});
 var NcTestResultSchema = object({
 	recordId: string(),
 	recordKind: _enum([
@@ -19180,6 +19478,13 @@ var NcTemplateVarDescriptorSchema = object({
 	kinds: array(NcTemplateVarKindSchema).optional(),
 	deliveries: array(NcDeliverySchema).optional(),
 	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	/**
+	* Which system-event DELIVERY has a value for it (D647). Absent = an
+	* instant row only when the descriptor names `systemEventKinds` (a
+	* per-event fact: a summary row has no single device), and both otherwise.
+	* `['summary']` marks the state-summary vocabulary (`{{summaryText}}`, ...).
+	*/
+	systemEventDeliveries: array(NcSystemEventDeliveryModeSchema).optional(),
 	dynamic: object({
 		prefix: literal("count_"),
 		from: literal("classes")
@@ -19192,7 +19497,9 @@ var NcTemplatePreviewInputSchema = object({
 		field: NcTemplateFieldSchema,
 		kind: NcRuleKindSchema.optional(),
 		delivery: NcDeliverySchema.optional(),
-		systemEventKinds: array(NcSystemEventKindSchema).optional()
+		systemEventKinds: array(NcSystemEventKindSchema).optional(),
+		/** The rule's system-event delivery (D647); absent = instant. */
+		systemEventDelivery: NcSystemEventDeliveryModeSchema.optional()
 	}),
 	template: object({
 		title: string().max(500).optional(),
@@ -20326,6 +20633,17 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* The STATE SUMMARY a system rule would send now (D647) — for a saved rule
+		* or an unsaved draft. Pure: sends nothing, stamps nothing. A MUTATION
+		* only for transport (a whole rule does not belong in a GET URL). Admin,
+		* like `testRule`: it names devices and nodes across the installation.
+		*/
+		previewStateSummary: method(object({ rule: NcRuleInputSchema }), NcStateSummaryPreviewSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "view"
+		}),
+		/**
 		* The machine-readable condition surface a rule editor renders from, plus
 		* the picker VOCABULARY those conditions draw on.
 		*
@@ -20770,786 +21088,342 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* Reference to the frame's retained NATIVE surface + the parent crop's placement
-* within the frame, so the executor can re-cut a leaf child ROI at native
-* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
 */
-var NativeCropRefSchema = object({
-	/** Handle keying the retained native surface (node-pinned to its owner). */
-	handle: FrameHandleSchema,
-	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-	cropFrameSpace: object({
-		x: number(),
-		y: number(),
-		w: number(),
-		h: number()
-	})
-});
-object({
-	crop: object({
-		left: number(),
-		top: number(),
-		width: number().positive(),
-		height: number().positive()
-	}).optional(),
-	content: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}),
-	fit: _enum(["stretch", "contain"]),
-	format: _enum([
-		"rgb",
-		"gray",
-		"jpeg"
-	])
-});
 /**
-* Process-local frame identity. It is serializable so it can ride an in-process
-* capability call, but `registryId` deliberately prevents resolution in any
-* other process or execution group.
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
 */
-var FrameRefSchema = object({
-	registryId: string().min(1),
-	id: string().min(1),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum(["rgb", "gray"]),
-	timestamp: number(),
-	capturedAt: number().optional()
-});
-var ModelFormatSchema$1 = _enum([
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+/**
+* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
+* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
+*/
+var CLUSTER_MODEL_SCOPED_STEPS = [{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}];
+/**
+* The settings key holding one step's cluster model choice.
+*
+* Step-qualified so the keys stay unique across the addon's whole schema, which
+* is what lets {@link pickClusterStepModels} walk every section instead of
+* trusting the section id.
+*/
+function clusterModelSettingKey(stepId) {
+	return `clusterModel:${stepId}`;
+}
+/** The cluster row when nobody has configured one — today's catalog defaults. */
+var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
+function interpretStoredClusterModel(raw) {
+	if (raw === void 0 || raw === null || raw === "") return { kind: "absent" };
+	if (typeof raw === "string") return {
+		kind: "chosen",
+		modelId: raw
+	};
+	return {
+		kind: "invalid",
+		value: raw
+	};
+}
+/**
+* Narrow a FLAT settings record to the cluster row.
+*
+* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
+* junk face model must not also discard a valid clip model. An `absent` or
+* `invalid` value ({@link interpretStoredClusterModel}) resolves to the step's
+* catalog default — never to a blank id, because a blank id downstream becomes
+* "substitute the format default", which is precisely the substitution this
+* scope exists to forbid.
+*/
+function readClusterStepModels(config) {
+	const out = {};
+	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
+		const read = interpretStoredClusterModel(config[clusterModelSettingKey(step.stepId)]);
+		out[step.stepId] = read.kind === "chosen" ? read.modelId : step.defaultModelId;
+	}
+	return out;
+}
+function isHydratedField$2(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+/**
+* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) is the defaults.
+*/
+function pickClusterStepModels(view) {
+	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
+	return readClusterStepModels(flattenHydratedView(view, clusterModelKeys()));
+}
+function clusterModelKeys() {
+	return new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
+}
+/** The `wanted` keys of a hydrated view as one flat record, every section walked. */
+function flattenHydratedView(view, wanted) {
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+	}
+	return flat;
+}
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
+/**
+* pipeline-analytics — device-scoped wrapper cap. Refines raw
+* per-frame detections emitted by the pipeline runner into tracked
+* objects, per-kind event collections (motion / object / audio), and
+* persisted media. Owns the post-detection domain end-to-end:
+*
+*   runner emits PipelineInferenceResult
+*     ↓ (event bus)
+*   pipeline-analytics subscriber
+*     ↓ SORT tracker + zone engine + state analyzer + event emitter
+*   → three DB collections (one per kind), one FS media tree, one
+*     unified event emitter (FrameTracked + TrackStarted/Ended +
+*     DetectionEvent on bus)
+*
+* Pure subscriber model. No `processFrame` cap method — the runner
+* already publishes the raw frame on the bus. The cap surface is
+* only QUERIES + per-device settings, bound on/off via
+* `device-manager.setWrapperActive`. `defaultActive: true` because
+* every camera with a detection pipeline wants its raw detections
+* refined; operators opt out per-device via BindingsTab when needed.
+*
+* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
+* (per-device surface) and `track-trail` caps — see P11 cleanup.
+*/
+var TrackStateSchema = _enum([
+	"new",
+	"entered",
+	"left",
+	"moving",
+	"idle"
 ]);
-var PipelineSlotSchema = _enum([
-	"detector",
-	"cropper",
-	"classifier",
-	"refiner",
-	"audio-classifier"
+var EventKindSchema = _enum([
+	"motion",
+	"object",
+	"audio"
 ]);
-var PipelineEngineChoiceSchema = object({
-	runtime: _enum(["node", "python"]),
-	backend: string(),
-	format: ModelFormatSchema$1,
-	device: string().optional()
-});
-var AvailableEngineSchema = object({
-	engine: PipelineEngineChoiceSchema,
-	devices: array(object({
-		id: string(),
-		label: string(),
-		description: string().optional()
-	})).readonly(),
-	defaultDevice: string()
-});
-var PipelineDefaultStepSchema = lazy(() => object({
-	addonId: string(),
-	addonName: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineDefaultStepSchema).readonly(),
-	group: string().optional(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
+/**
+* Spatial filter for `listTracks` — the rect + polygon variants of the shared
+* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
+* of the camera frame (top-left origin), matching the drawing-plane editor.
+*/
+var TrackZoneFilterSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
+/** Closed icon vocabulary so clients render a known glyph per kind. */
+var EventKindIconSchema = _enum([
+	"motion",
+	"audio",
+	"person",
+	"vehicle",
+	"animal",
+	"door",
+	"pir",
+	"smoke",
+	"water",
+	"button",
+	"package",
+	"generic"
+]);
+var EventKindCategorySchema = _enum([
+	"motion",
+	"audio",
+	"detection",
+	"sensor",
+	"control",
+	"custom",
+	"package"
+]);
+/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
+var EventKindLevelSchema = _enum(["macro", "sub"]);
+var EventKindDescriptorSchema = object({
+	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
+	kind: string(),
+	/** i18n key resolved on the UI side; `label` is the English fallback. */
+	labelKey: string(),
+	/** English fallback label (kept for clients that don't translate). */
+	label: string(),
+	/** Hex color for timeline/legend rendering. */
+	color: string(),
+	/** Dictionary id → lucide component on the UI side. */
+	iconId: string(),
+	/** Legacy closed-vocab glyph — fallback for `iconId`. */
+	icon: EventKindIconSchema,
+	category: EventKindCategorySchema,
+	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+	parentKind: string().nullable(),
+	/** Derived from `parentKind`, explicit for the client tree. */
+	level: EventKindLevelSchema,
+	/** Which cap + device contributes this kind. For built-ins the camera
+	*  itself; for sensor kinds the LINKED source device. */
+	source: object({
+		capName: string(),
+		deviceId: number()
+	})
 });
-var PipelineModelOptionSchema = object({
-	id: string(),
-	name: string(),
-	formats: record(string(), object({
-		downloaded: boolean(),
-		sizeMB: number()
-	})),
-	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
+	deviceId: number(),
+	kinds: array(EventKindDescriptorSchema).readonly()
 });
-var ConfigFieldBridge = custom();
-var PipelineAddonSchemaSchema = object({
+var SensorEventSchema = object({
 	id: string(),
-	name: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	childSlots: array(PipelineSlotSchema).readonly(),
-	models: array(PipelineModelOptionSchema).readonly(),
-	defaultModelId: string(),
-	defaultModelIdByFormat: record(string(), string()).optional(),
-	enabledByDefault: boolean().optional(),
-	backfillIntoExistingOverrides: boolean().optional(),
-	defaultConfidence: number(),
-	group: string().optional(),
-	configSchema: array(ConfigFieldBridge).readonly().optional()
+	/** The CAMERA the event is attributed to (a sensor linked to N cameras
+	*  yields N rows, one per camera). */
+	deviceId: number(),
+	/** The linked sensor device whose state changed. */
+	sourceDeviceId: number(),
+	/** Event kind id — matches an `EventKindDescriptor.kind`. */
+	kind: string(),
+	/** Snapshot of the sensor cap's runtime-state slice at the change. */
+	value: record(string(), unknown()).nullable(),
+	timestamp: number()
 });
-var PipelineSlotSchemaSchema = object({
-	id: PipelineSlotSchema,
-	label: string(),
-	priority: number(),
-	parentSlot: PipelineSlotSchema.nullable(),
-	addons: array(PipelineAddonSchemaSchema).readonly()
+/**
+* One stored sighting on a track's trajectory.
+*
+* The array these live in is returned in TIME order (D399) — it is APPENDED in
+* arrival order, and the two detector passes interleave, so a consumer must not
+* assume the two are the same on a row written by an older build.
+*/
+var TrackPositionSchema = object({
+	x: number(),
+	y: number(),
+	timestamp: number(),
+	bbox: BoundingBoxSchema,
+	/**
+	* Which detector pass measured this box (D399): `frame` is the full-frame
+	* pass on the analysis raster, `recovery` is the native-resolution
+	* small-subject second pass (D377/D378). Both write into one array, and until
+	* this field existed the only way to tell them apart was that full-frame boxes
+	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
+	* Absent on rows written before D399.
+	*/
+	source: _enum(["frame", "recovery"]).optional(),
+	/** Detection score of this box, so a position can be weighed and not only
+	*  plotted. Absent on rows written before D399. */
+	score: number().optional()
 });
-var PipelineSchemaSchema = object({
-	availableEngines: array(AvailableEngineSchema).readonly(),
-	selectedEngine: PipelineEngineChoiceSchema,
-	slots: array(PipelineSlotSchemaSchema).readonly()
-});
-var EngineProvisioningSchema = object({
-	runtimeId: _enum([
-		"onnx",
-		"openvino",
-		"coreml",
-		"edgetpu"
-	]).nullable(),
-	device: string().nullable(),
-	state: _enum([
-		"idle",
-		"installing",
-		"verifying",
-		"ready",
-		"failed"
-	]),
-	progress: number().optional(),
-	error: string().optional(),
-	nextRetryAt: number().optional(),
-	/**
-	* Gate A (config-correctness gate at engine change): human-readable
-	* config issues surfaced EAGERLY when the node's engine changes — model
-	* substitutions ("chose X, running Y") and zero-build steps ("no model
-	* has a <format> build"). Additive/optional: informational only, never
-	* enforced here — `assertEngineReady` (readiness) still gates inference.
-	* Absent/empty when the node-default tree resolves cleanly.
-	*/
-	configIssues: array(string()).optional()
-});
-var PipelineStepInputSchema = lazy(() => object({
-	addonId: string(),
-	modelId: string().optional(),
-	enabled: boolean().default(true),
-	children: array(PipelineStepInputSchema).optional(),
-	settings: record(string(), unknown()).optional(),
-	jumpDeviceKey: string().optional()
-}));
-var ModelSubstitutionSchema = object({
-	addonId: string(),
-	chosen: string(),
-	running: string(),
-	format: string()
-});
-var PipelineValidationIssueSchema = object({
-	addonId: string(),
-	kind: _enum(["unknown-addon", "no-format-build"]),
-	detail: string()
-});
-var PipelineValidationResultSchema = object({
-	ok: boolean(),
-	issues: array(PipelineValidationIssueSchema).readonly(),
-	substitutions: array(ModelSubstitutionSchema).readonly(),
-	/** The node's `currentEngine.format` this validation ran against. */
-	format: string()
-});
-var ReferenceImageEntrySchema = object({
-	filename: string(),
-	stepIds: array(string()).readonly().optional()
-});
-var ReferenceImageBodySchema = object({
-	base64: string(),
-	filename: string()
-});
-var ReferenceAudioEntrySchema = object({
-	filename: string(),
-	sizeKb: number()
-});
-var ReferenceAudioBodySchema = object({ base64: string() });
-var AudioBackendSchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	available: boolean(),
-	/**
-	* Raw classifier labels this backend can emit (e.g. YAMNet's
-	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
-	* the benchmark UI to populate the `enabledMicroClasses` filter
-	* specific to the selected backend without a separate fetch.
-	*/
-	rawLabels: array(string()).readonly().optional()
-});
-var AudioCapabilitiesSchema = object({
-	activeBackend: string(),
-	availableBackends: array(AudioBackendSchema).readonly(),
-	sampleRate: number(),
-	chunkDurationMs: number()
-});
-var DownloadModelResultSchema = object({
-	filePath: string(),
-	sizeMB: number(),
-	durationMs: number()
-});
-/**
-* Wrapper carrying a single test run's result. Replaces the legacy
-* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
-* canonical `AudioResult` from the Phase 6 output rework: one
-* `AudioDetection` per class above `minScore`, top-N candidates in
-* `debug.alternateLabels['audio-classifier']`, per-source timings in
-* `debug.stepTimings`. The outer `success`/`error` fields stay so the
-* benchmark UI can still report a clean failure when the classifier
-* cap isn't available.
-*/
-var AudioTestResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	frame: custom().optional()
-});
-var PipelineConfigBridge = custom();
-var ConfigUISchemaBridge = custom();
-var ConfigUISchemaNullableBridge = custom();
-var InferenceCapabilitiesBridge = custom();
-var ModelAvailabilityListBridge = custom();
-var PipelineRunResultBridge = custom();
-method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-}))), method(object({ steps: record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-})) }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({
-	success: literal(true),
-	clearedDevices: number()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
-	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
-	deviceKey: string(),
-	/**
-	* `failed` — the per-device restart budget is exhausted; no pool
-	* will be spawned until an operator re-arms it or the runner
-	* respawns. `backoff` — under budget, waiting out the backoff (or
-	* a cached pool observed dead and not yet condemned).
-	*/
-	state: _enum(["failed", "backoff"]),
-	/** Epoch ms of the death that produced this state. */
-	since: number(),
-	/** Pool deaths inside the current window. */
-	deaths: number(),
-	/** The last death's message. */
-	lastError: string()
-})).readonly() })), method(object({
-	nodeId: string(),
-	deviceKey: string()
-}), object({ rearmed: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frame: FrameInputSchema.optional(),
-	/**
-	* Process-local lazy frame. Valid only when caller and provider resolve
-	* in the same execution-group process; split/cross-node callers use
-	* `frame`/`image` inline compatibility instead.
-	*/
-	frameRef: FrameRefSchema.optional(),
-	/**
-	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-	* the decoded pixels live in. One more member of the one-of
-	* frame/frameHandle/image/imageBase64/referenceImage group.
-	*/
-	frameHandle: FrameHandleSchema.optional(),
-	imageBase64: string().optional(),
-	/**
-	* Binary JPEG bytes — preferred over `imageBase64` on internal
-	* hops (hub → forked worker via Moleculer MsgPack) because it
-	* skips the 33% base64 overhead + the per-call base64 decode on
-	* the detection-pipeline worker. Callers can pass either; exactly
-	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-	*/
-	image: _instanceof(Uint8Array).optional(),
-	referenceImage: string().optional(),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Execution plane. 'full' (default) runs the whole tree — benchmark,
-	* reference-image, and detail-subtree calls. 'frame' is the live
-	* per-frame dispatch: ONLY root-plane steps run; crop children
-	* (inputClasses ≠ null) are skipped and served per-track via
-	* pipelineRunner.runDetailSubtree (two-plane design).
-	*/
-	plane: _enum(["full", "frame"]).optional(),
-	/**
-	* Inference-device selector (Phase 2 multi-device). Format
-	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-	* Omitted ⇒ the runner's default device (current single-engine
-	* behaviour). Selects WHICH device pool of the node runs the call.
-	*/
-	deviceKey: string().optional(),
-	/**
-	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-	* when the parent crop was resolved from the frame's retained NATIVE
-	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-	* resolution from that surface — the SAME quality path faces already
-	* had — instead of the downscaled parent tile. `handle` keys the native
-	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
-	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-	* the executor's crop-normalized child ROI back into frame-normalized
-	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-	* (today's behaviour on the fallback path).
-	*/
-	nativeCropRef: NativeCropRefSchema.optional()
-}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frames: array(FrameInputSchema).min(1).max(255),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-	* the batch to the Python pool's bench preprocess cache
-	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-	* preprocessed ONCE and every later inference is a pure-inference cache
-	* hit — the sustained-throughput run measures inference, not
-	* decode+preprocess+infer. Omitted/0 for live frames (all different →
-	* full preprocess every call, correct). Fresh per sustained run;
-	* released via `uncacheFrame`.
-	*/
-	frameId: number().int().nonnegative().optional(),
-	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-	deviceKey: string().optional()
-}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
-	data: _instanceof(Uint8Array),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum([
-		"rgb",
-		"bgr",
-		"gray"
-	])
-}), object({
-	frameId: number(),
-	width: number(),
-	height: number()
-}), { kind: "mutation" }), method(object({
-	stepId: string(),
-	frameId: number().int()
-}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(_void(), object({
-	batchMode: string(),
-	windowMs: number(),
-	maxBatchSize: number(),
-	concurrency: number()
-})), method(_void(), array(object({
-	engineKey: string(),
-	engine: PipelineEngineChoiceSchema,
-	modelsLoaded: array(string()).readonly(),
-	inUseByCameras: array(number()).readonly(),
-	/**
-	* Origin of this resident factory.
-	*  - `runtime`       — main camera-serving engine (no idle TTL).
-	*  - `warm-override` — benchmark/test override held in the warm
-	*                      cache; auto-disposed after the idle TTL.
-	*  - `device-pool`   — a concurrent per-device pool (Phase 2
-	*                      multi-device, keyed by `deviceKey`) resolved
-	*                      via `resolveDeviceFactory`. Runs alongside the
-	*                      `runtime` engine on a DIFFERENT accelerator
-	*                      (NPU / iGPU / Coral) — this is how the
-	*                      Engines tab shows all pools running at once.
-	*/
-	kind: _enum([
-		"runtime",
-		"warm-override",
-		"device-pool"
-	]),
-	/** Native pid of the underlying Python pool (null when no pool). */
-	poolPid: number().nullable(),
-	/** ms since this factory was last used (null when not warm-tracked). */
-	idleMs: number().nullable(),
-	/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-	idleTtlMs: number().nullable()
-})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	engine: PipelineEngineChoiceSchema,
-	force: boolean().optional()
-}), object({
-	success: boolean(),
-	reason: string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
-	addonId: string(),
-	modelId: string(),
-	filename: string().optional(),
-	settings: record(string(), unknown()).optional()
-}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
-/**
-* Per-stage gating mode applied to the zones a rule references.
-*
-* - `include`: the rule contributes to a **whitelist** for its stage.
-*   When at least one `include` rule fires for a stage, only entities
-*   inside one of those zones pass that stage.
-* - `exclude`: the rule contributes to a **blacklist** for its stage.
-*   Entities inside one of those zones are dropped at that stage.
-*
-* `monitor`-style observation (count without filtering) is not a rule
-* mode — zones without any matching rule are observed naturally by
-* `zone-analytics` (live snapshot + history), so an "I just want to
-* count, not filter" use case needs no rule at all.
-*/
-var ZoneRuleModeEnum = _enum(["include", "exclude"]);
-/**
-* Per-consumer rule that references existing zones (geometry) and
-* defines how a specific pipeline stage should treat them. Each
-* consumer addon owns its own `ZoneRule[]` array in its per-device
-* settings:
-*
-* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
-* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
-* - future: notification rules, audio gating, etc.
-*
-* One rule applies to N zones (`zoneIds[]`) so the operator can
-* express "ignore motion in ALL of {garden, street}" with a single
-* rule. `classFilter` narrows the rule to specific object classes —
-* "drop person detections in the street, but keep cars" is one
-* `exclude` rule with `classFilter: ['person']`.
-*
-* `enabled` is a soft toggle — the operator can keep the rule
-* configured but inert without deleting it.
-*/
-var ZoneRuleSchema = object({
-	/** Stable rule id — survives edits, used by the UI for diffing. */
-	id: string(),
-	/** Optional human-readable label rendered in the rule editor. */
-	name: string().optional(),
-	/** Zones this rule targets. The rule's `mode` applies to ALL
-	*  listed zones (OR-set: a detection in any one of them counts).
-	*  At least one zone id required — a rule with no targets is a
-	*  configuration mistake and the form validator rejects it. */
-	zoneIds: array(string()).min(1).readonly(),
-	mode: ZoneRuleModeEnum,
-	/**
-	* Class names this rule applies to. Empty / undefined ⇒ rule
-	* applies to every class. Class strings match the `macroClass`
-	* field on detections (e.g. `person`, `car`, `dog`).
-	*/
-	classFilter: array(string()).readonly().optional(),
-	/**
-	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
-	* required to consider an entity "in the zone". Defaults to the
-	* consumer's stage default when omitted. Kept for back-compat with
-	* existing per-rule overrides; new operators pick the value via
-	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-	* set, the lower-level engine reads it as a 0–1 fraction.
-	*/
-	overlapThreshold: number().min(0).max(1).optional(),
-	/**
-	* Operator-friendly version of `overlapThreshold` — the percentage
-	* of the detection's bbox that must lie inside the zone for the
-	* rule to match. Documented default is 85%; the engine substitutes
-	* that when the field is omitted (kept optional so existing rules
-	* stored without it stay valid).
-	*
-	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-	* rule, the engine prefers `bboxInclusionPct` because it's the
-	* field exposed in the UI. Internally both feed the same gate.
-	*/
-	bboxInclusionPct: number().min(0).max(100).optional(),
-	/**
-	* When `true` and a detection has a segmentation mask, use the
-	* mask for overlap instead of the bbox. Detection-stage only;
-	* motion rules ignore this field.
-	*/
-	preferMask: boolean().optional(),
-	/**
-	* Soft-toggle: `false` disables the rule without deleting it.
-	* Defaults to `true` so operators creating a rule via the UI
-	* see it active immediately.
-	*/
-	enabled: boolean().default(true)
-});
-array(ZoneRuleSchema).readonly();
-/**
-* Zone — pure geometry + identity. NO filtering behaviour.
-*
-* Zones describe **where** in the frame the operator wants to flag
-* something; consumer-owned {@link ZoneRule} arrays describe **how**
-* each pipeline stage uses them. Splitting the two means a single
-* polygon "Driveway" can simultaneously back a motion-exclude rule,
-* a detection-include rule on `['car']`, and an occupancy aggregate
-* — without three duplicated polygons.
-*
-* Owned by the orchestrator addon (provider) and mirrored into the
-* `zones` device-state slice on every mutation. Consumers
-* (motion-wasm, pipeline-executor, analytics, admin UI) read either
-* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
-* mirror with `onChanged`).
-*
-* Coordinates are normalised fractions of the frame (0–1) so zones
-* survive resolution changes and stream profile switches.
-*
-* `kind` discriminates between full polygons (closed regions used
-* for intrusion / occupancy filters) and tripwires (open 2-point
-* line segments used for cross events). Onboard / firmware-reported
-* zones (Reolink, ONVIF) are out of scope for now — see the deferred
-* task list.
-*/
-var ZoneKindEnum = _enum(["polygon", "tripwire"]);
-/** Polygon vertex in fraction-of-frame coordinates (0–1). */
-var PolygonPointSchema = object({
-	x: number(),
-	y: number()
-});
-/** A camera detection zone — pure geometry/identity. */
-var ZoneSchema = object({
-	id: string(),
-	name: string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: string().default("#3b82f6")
-});
-/**
-* Zones capability — per-camera CRUD over polygon detection zones.
-*
-* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
-* to per-device settings and mirrors into the `zones` device-state
-* slice on every mutation, so downstream consumers can subscribe via
-* `dev.state.zones.onChanged`.
-*
-* The cap surface only handles geometry + identity; filtering
-* behaviour (per-class, include/exclude, threshold) lives in the
-* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
-* `capabilities/schemas/zone-rule.js`.
-*/
-var zonesCapability = {
-	name: "zones",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
-		addZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		removeZone: method(object({
-			deviceId: number(),
-			zoneId: string()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		updateZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	/**
-	* Runtime-state slice — the live zone catalogue mirrored by the
-	* orchestrator on every CRUD mutation. Consumers read via
-	* `device.state.zones.value` / `.watch(...)` without round-tripping
-	* the cap, and the codegen DeviceProxy auto-wires the reactive
-	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
-	* (e.g. zone groupings) can sit alongside the polygon list.
-	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
-	/**
-	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
-* pipeline-analytics — device-scoped wrapper cap. Refines raw
-* per-frame detections emitted by the pipeline runner into tracked
-* objects, per-kind event collections (motion / object / audio), and
-* persisted media. Owns the post-detection domain end-to-end:
-*
-*   runner emits PipelineInferenceResult
-*     ↓ (event bus)
-*   pipeline-analytics subscriber
-*     ↓ SORT tracker + zone engine + state analyzer + event emitter
-*   → three DB collections (one per kind), one FS media tree, one
-*     unified event emitter (FrameTracked + TrackStarted/Ended +
-*     DetectionEvent on bus)
-*
-* Pure subscriber model. No `processFrame` cap method — the runner
-* already publishes the raw frame on the bus. The cap surface is
-* only QUERIES + per-device settings, bound on/off via
-* `device-manager.setWrapperActive`. `defaultActive: true` because
-* every camera with a detection pipeline wants its raw detections
-* refined; operators opt out per-device via BindingsTab when needed.
-*
-* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
-* (per-device surface) and `track-trail` caps — see P11 cleanup.
-*/
-var TrackStateSchema = _enum([
-	"new",
-	"entered",
-	"left",
-	"moving",
-	"idle"
-]);
-var EventKindSchema = _enum([
-	"motion",
-	"object",
-	"audio"
-]);
-/**
-* Spatial filter for `listTracks` — the rect + polygon variants of the shared
-* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
-* of the camera frame (top-left origin), matching the drawing-plane editor.
-*/
-var TrackZoneFilterSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
-/** Closed icon vocabulary so clients render a known glyph per kind. */
-var EventKindIconSchema = _enum([
-	"motion",
-	"audio",
-	"person",
-	"vehicle",
-	"animal",
-	"door",
-	"pir",
-	"smoke",
-	"water",
-	"button",
-	"package",
-	"generic"
-]);
-var EventKindCategorySchema = _enum([
-	"motion",
-	"audio",
-	"detection",
-	"sensor",
-	"control",
-	"custom",
-	"package"
-]);
-/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
-var EventKindLevelSchema = _enum(["macro", "sub"]);
-var EventKindDescriptorSchema = object({
-	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
-	kind: string(),
-	/** i18n key resolved on the UI side; `label` is the English fallback. */
-	labelKey: string(),
-	/** English fallback label (kept for clients that don't translate). */
-	label: string(),
-	/** Hex color for timeline/legend rendering. */
-	color: string(),
-	/** Dictionary id → lucide component on the UI side. */
-	iconId: string(),
-	/** Legacy closed-vocab glyph — fallback for `iconId`. */
-	icon: EventKindIconSchema,
-	category: EventKindCategorySchema,
-	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
-	parentKind: string().nullable(),
-	/** Derived from `parentKind`, explicit for the client tree. */
-	level: EventKindLevelSchema,
-	/** Which cap + device contributes this kind. For built-ins the camera
-	*  itself; for sensor kinds the LINKED source device. */
-	source: object({
-		capName: string(),
-		deviceId: number()
-	})
-});
-/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
-var EventKindsForDeviceSchema = object({
-	deviceId: number(),
-	kinds: array(EventKindDescriptorSchema).readonly()
-});
-var SensorEventSchema = object({
-	id: string(),
-	/** The CAMERA the event is attributed to (a sensor linked to N cameras
-	*  yields N rows, one per camera). */
-	deviceId: number(),
-	/** The linked sensor device whose state changed. */
-	sourceDeviceId: number(),
-	/** Event kind id — matches an `EventKindDescriptor.kind`. */
-	kind: string(),
-	/** Snapshot of the sensor cap's runtime-state slice at the change. */
-	value: record(string(), unknown()).nullable(),
-	timestamp: number()
-});
-/**
-* One stored sighting on a track's trajectory.
-*
-* The array these live in is returned in TIME order (D399) — it is APPENDED in
-* arrival order, and the two detector passes interleave, so a consumer must not
-* assume the two are the same on a row written by an older build.
-*/
-var TrackPositionSchema = object({
-	x: number(),
-	y: number(),
-	timestamp: number(),
-	bbox: BoundingBoxSchema,
-	/**
-	* Which detector pass measured this box (D399): `frame` is the full-frame
-	* pass on the analysis raster, `recovery` is the native-resolution
-	* small-subject second pass (D377/D378). Both write into one array, and until
-	* this field existed the only way to tell them apart was that full-frame boxes
-	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
-	* Absent on rows written before D399.
-	*/
-	source: _enum(["frame", "recovery"]).optional(),
-	/** Detection score of this box, so a position can be weighed and not only
-	*  plotted. Absent on rows written before D399. */
-	score: number().optional()
-});
-var TrackSnapshotSchema = object({
-	timestamp: number(),
-	position: TrackPositionSchema,
-	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
-	mediaId: number().int()
+var TrackSnapshotSchema = object({
+	timestamp: number(),
+	position: TrackPositionSchema,
+	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+	mediaId: number().int()
 });
 /**
 * Normalized 0..1 trajectory envelope (min/max over every position bbox,
@@ -21980,6 +21854,22 @@ var TrackSchema = object({
 	* omit it. Render nothing when absent.
 	*/
 	previewMissReason: string().optional(),
+	/**
+	* The ROOT model that produced this track — the `FrameResult.rootModelId` of
+	* the frame it was BORN on (D646). What a later replay compares against, so
+	* "the original model" is named rather than assumed. A birth fact: never
+	* rewritten by a later frame. **Absent ≠ unknown-model**: a row from before
+	* the column, and a track the camera's own detector produced, carry none.
+	*/
+	modelId: string().optional(),
+	/**
+	* Size (px) of the detection frame this track's `positions[].bbox` live in —
+	* the frame it was born on, else the camera's latest analysis frame at
+	* persist time. Divide a position by these to normalise it. Absent when the
+	* size was never known.
+	*/
+	frameWidth: number().optional(),
+	frameHeight: number().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -22209,7 +22099,8 @@ var MediaFileKindEnum = _enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -22761,7 +22652,23 @@ var SearchObjectEventsInput = object({
 	until: number().optional(),
 	classFilter: string().optional(),
 	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: string().min(1).optional()
 });
 var TrackCascadeCountsSchema = object({
 	/** Persisted track roots deleted (authoritative). */
@@ -22896,7 +22803,41 @@ var RebuildObjectEmbeddingsInput = object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var WipeObjectEmbeddingsResultSchema = object({
+	deleted: number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: array(string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = _enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -22909,7 +22850,12 @@ var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
 var RebuildObjectEmbeddingsResultSchema = object({
 	started: boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
+	alreadyRunning: boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: string().optional(),
+	index: string().optional()
 });
 var RebuildStatusSchema = object({
 	running: boolean(),
@@ -22943,7 +22889,11 @@ var RebuildStatusSchema = object({
 	startedAtMs: number().nullable(),
 	finishedAtMs: number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	error: string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -22986,24 +22936,6 @@ var MediaReclaimStatusSchema = object({
 	finishedAtMs: number().nullable(),
 	error: string().nullable()
 });
-var ReplayFrameInputSchema = object({
-	timestamp: number(),
-	frame: PipelineRunResultBridge
-});
-var RunReplayFrameProcessorResultSchema = object({ tracks: array(object({
-	className: string(),
-	firstSeenMs: number(),
-	lastSeenMs: number(),
-	/** Bbox of the track's FIRST matched detection, pixel-space in the clip's
-	*  frame — a representative box for the diff's `(className, window, IoU)`
-	*  pairing (`replay-diff.ts`). A replay does not need the full per-frame
-	*  trajectory production's `Track.positions` keeps. */
-	bbox: BoundingBoxSchema,
-	/** How many of the input frames this track matched a real detection on
-	*  (never a coasted/extrapolated frame) — the replay's own signal for "how
-	*  solid is this track", cheaper than re-deriving it from a trajectory. */
-	framesMatched: number().int()
-})).readonly() });
 /**
 * The long-term series a camera produces. A closed union so a typo cannot
 * invent one, and the ONE declaration of it — the addon's `AnalyticsLtsSeries`
@@ -23730,32 +23662,6 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/**
-		* The FrameProcessor pass of a replay run — see the `Replay` section
-		* above this capability's definition for why this is not the
-		* `processFrame` method this file's header says pipeline-analytics does
-		* not have.
-		*
-		* Constructs a FRESH `FrameProcessor` for `(deviceId, source)`, feeds it
-		* `frames` IN THE ORDER GIVEN (the caller is responsible for time
-		* ordering — this method does not sort), and returns the tracks it
-		* produced. Zero persistence: no `TrackStore`, no event bus, no media
-		* capture. `zones` / `detectionRules` are the run's OWN zone set —
-		* typically the camera's real zones plus an ephemeral overlay
-		* (`addon-benchmark`'s `replay-plan.ts`), never read from or written to
-		* the `zones` capability by this method itself.
-		*/
-		runReplayFrameProcessor: method(object({
-			deviceId: number(),
-			source: DetectionSourceSchema,
-			zones: array(ZoneSchema).readonly().optional(),
-			detectionRules: array(ZoneRuleSchema).readonly().optional(),
-			zoneMembershipMinOverlap: number().min(0).max(1).optional(),
-			frames: array(ReplayFrameInputSchema).min(1)
-		}), RunReplayFrameProcessorResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Every annotation on a track, oldest first. */
 		listRetrainAnnotations: method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
 			kind: "query",
@@ -23946,7 +23852,7 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()),
+		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly(), { caller: "required" }),
 		wipeObjectEmbeddings: method(object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -23995,6 +23901,478 @@ var pipelineAnalyticsCapability = {
 		}) }
 	}
 };
+/**
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+*/
+var NativeCropRefSchema = object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
+	})
+});
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
+var ModelFormatSchema$1 = _enum([
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+]);
+var PipelineSlotSchema = _enum([
+	"detector",
+	"cropper",
+	"classifier",
+	"refiner",
+	"audio-classifier"
+]);
+var PipelineEngineChoiceSchema = object({
+	runtime: literal("python"),
+	backend: string(),
+	format: ModelFormatSchema$1,
+	device: string().optional()
+});
+/**
+* One pool's resolved provisioning (`getEffectiveTuning`). `numWorkers` is the
+* knob that lifts a saturated pool (`inference-devices.md`); `concurrency` is
+* per-worker in-flight requests. `deviceKey` echoes the pool asked about —
+* `null` for the node-default pool.
+*/
+var EffectiveTuningSchema = object({
+	deviceKey: string().nullable(),
+	runtime: string(),
+	batchMode: string(),
+	windowMs: number(),
+	maxBatchSize: number(),
+	concurrency: number(),
+	numWorkers: number()
+});
+var AvailableEngineSchema = object({
+	engine: PipelineEngineChoiceSchema,
+	devices: array(object({
+		id: string(),
+		label: string(),
+		description: string().optional()
+	})).readonly(),
+	defaultDevice: string()
+});
+var PipelineDefaultStepSchema = lazy(() => object({
+	addonId: string(),
+	addonName: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineDefaultStepSchema).readonly(),
+	group: string().optional(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateStepSchema = lazy(() => object({
+	addonId: string(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineTemplateStepSchema).readonly(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = object({
+	id: string(),
+	name: string(),
+	createdAt: string(),
+	updatedAt: string(),
+	engine: PipelineEngineChoiceSchema,
+	steps: array(PipelineTemplateStepSchema).readonly()
+});
+var PipelineModelOptionSchema = object({
+	id: string(),
+	name: string(),
+	formats: record(string(), object({
+		downloaded: boolean(),
+		sizeMB: number()
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
+});
+var ConfigFieldBridge = custom();
+var PipelineAddonSchemaSchema = object({
+	id: string(),
+	name: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	childSlots: array(PipelineSlotSchema).readonly(),
+	models: array(PipelineModelOptionSchema).readonly(),
+	defaultModelId: string(),
+	defaultModelIdByFormat: record(string(), string()).optional(),
+	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
+	defaultConfidence: number(),
+	group: string().optional(),
+	configSchema: array(ConfigFieldBridge).readonly().optional()
+});
+var PipelineSlotSchemaSchema = object({
+	id: PipelineSlotSchema,
+	label: string(),
+	priority: number(),
+	parentSlot: PipelineSlotSchema.nullable(),
+	addons: array(PipelineAddonSchemaSchema).readonly()
+});
+var PipelineSchemaSchema = object({
+	availableEngines: array(AvailableEngineSchema).readonly(),
+	selectedEngine: PipelineEngineChoiceSchema,
+	slots: array(PipelineSlotSchemaSchema).readonly()
+});
+var EngineProvisioningSchema = object({
+	runtimeId: _enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"edgetpu"
+	]).nullable(),
+	device: string().nullable(),
+	state: _enum([
+		"idle",
+		"installing",
+		"verifying",
+		"ready",
+		"failed"
+	]),
+	progress: number().optional(),
+	error: string().optional(),
+	nextRetryAt: number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: array(string()).optional()
+});
+var PipelineStepInputSchema = lazy(() => object({
+	addonId: string(),
+	modelId: string().optional(),
+	enabled: boolean().default(true),
+	children: array(PipelineStepInputSchema).optional(),
+	settings: record(string(), unknown()).optional(),
+	jumpDeviceKey: string().optional()
+}));
+var ModelSubstitutionSchema = object({
+	addonId: string(),
+	chosen: string(),
+	running: string(),
+	format: string()
+});
+var PipelineValidationIssueSchema = object({
+	addonId: string(),
+	kind: _enum([
+		"unknown-addon",
+		"no-format-build",
+		"unknown-device"
+	]),
+	detail: string()
+});
+var PipelineValidationResultSchema = object({
+	ok: boolean(),
+	issues: array(PipelineValidationIssueSchema).readonly(),
+	substitutions: array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: string()
+});
+var ReferenceImageEntrySchema = object({
+	filename: string(),
+	stepIds: array(string()).readonly().optional()
+});
+var ReferenceImageBodySchema = object({
+	base64: string(),
+	filename: string()
+});
+var ReferenceAudioEntrySchema = object({
+	filename: string(),
+	sizeKb: number()
+});
+var ReferenceAudioBodySchema = object({ base64: string() });
+var AudioBackendSchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	available: boolean(),
+	/**
+	* Raw classifier labels this backend can emit (e.g. YAMNet's
+	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
+	* the benchmark UI to populate the `enabledMicroClasses` filter
+	* specific to the selected backend without a separate fetch.
+	*/
+	rawLabels: array(string()).readonly().optional()
+});
+var AudioCapabilitiesSchema = object({
+	activeBackend: string(),
+	availableBackends: array(AudioBackendSchema).readonly(),
+	sampleRate: number(),
+	chunkDurationMs: number()
+});
+var DownloadModelResultSchema = object({
+	filePath: string(),
+	sizeMB: number(),
+	durationMs: number()
+});
+/**
+* Wrapper carrying a single test run's result. Replaces the legacy
+* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
+* canonical `AudioResult` from the Phase 6 output rework: one
+* `AudioDetection` per class above `minScore`, top-N candidates in
+* `debug.alternateLabels['audio-classifier']`, per-source timings in
+* `debug.stepTimings`. The outer `success`/`error` fields stay so the
+* benchmark UI can still report a clean failure when the classifier
+* cap isn't available.
+*/
+var AudioTestResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	frame: custom().optional()
+});
+var PipelineConfigBridge = custom();
+var ConfigUISchemaBridge = custom();
+var ConfigUISchemaNullableBridge = custom();
+var InferenceCapabilitiesBridge = custom();
+var ModelAvailabilityListBridge = custom();
+var PipelineRunResultBridge = custom();
+method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+}))), method(object({ steps: record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+})) }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({
+	success: literal(true),
+	clearedDevices: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
+	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
+	deviceKey: string(),
+	/**
+	* `failed` — the per-device restart budget is exhausted; no pool
+	* will be spawned until an operator re-arms it or the runner
+	* respawns. `backoff` — under budget, waiting out the backoff (or
+	* a cached pool observed dead and not yet condemned).
+	*/
+	state: _enum(["failed", "backoff"]),
+	/** Epoch ms of the death that produced this state. */
+	since: number(),
+	/** Pool deaths inside the current window. */
+	deaths: number(),
+	/** The last death's message. */
+	lastError: string()
+})).readonly() })), method(object({
+	nodeId: string(),
+	deviceKey: string()
+}), object({ rearmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({
+	steps: array(PipelineStepInputSchema),
+	deviceKey: string().optional()
+}), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
+	name: string(),
+	steps: array(PipelineTemplateStepSchema).readonly(),
+	engine: PipelineEngineChoiceSchema
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
+	id: string(),
+	name: string().optional(),
+	steps: array(PipelineTemplateStepSchema).readonly().optional()
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frame: FrameInputSchema.optional(),
+	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
+	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+	* the decoded pixels live in. One more member of the one-of
+	* frame/frameHandle/image/imageBase64/referenceImage group.
+	*/
+	frameHandle: FrameHandleSchema.optional(),
+	imageBase64: string().optional(),
+	/**
+	* Binary JPEG bytes — preferred over `imageBase64` on internal
+	* hops (hub → forked worker via Moleculer MsgPack) because it
+	* skips the 33% base64 overhead + the per-call base64 decode on
+	* the detection-pipeline worker. Callers can pass either; exactly
+	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
+	*/
+	image: _instanceof(Uint8Array).optional(),
+	referenceImage: string().optional(),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Execution plane. 'full' (default) runs the whole tree — benchmark,
+	* reference-image, and detail-subtree calls. 'frame' is the live
+	* per-frame dispatch: ONLY root-plane steps run; crop children
+	* (inputClasses ≠ null) are skipped and served per-track via
+	* pipelineRunner.runDetailSubtree (two-plane design).
+	*/
+	plane: _enum(["full", "frame"]).optional(),
+	/**
+	* Inference-device selector (Phase 2 multi-device). Format
+	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+	* Omitted ⇒ the runner's default device (current single-engine
+	* behaviour). Selects WHICH device pool of the node runs the call.
+	*/
+	deviceKey: string().optional(),
+	/**
+	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+	* when the parent crop was resolved from the frame's retained NATIVE
+	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+	* resolution from that surface — the SAME quality path faces already
+	* had — instead of the downscaled parent tile. `handle` keys the native
+	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+	* the executor's crop-normalized child ROI back into frame-normalized
+	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+	* (today's behaviour on the fallback path).
+	*/
+	nativeCropRef: NativeCropRefSchema.optional(),
+	/**
+	* Offline REPLAY of stored media for `deviceId` (D56, D646): the
+	* camera's zone gate and overrides apply as live, every executing
+	* step runs EXACTLY the model it names on the `deviceKey` pool it
+	* names or the call refuses (`model-not-servable` /
+	* `device-not-servable`), and nothing reaches the camera's live
+	* trace stream. Absent ⇒ unchanged behaviour.
+	*/
+	replay: literal(true).optional()
+}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frames: array(FrameInputSchema).min(1).max(255),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+	* the batch to the Python pool's bench preprocess cache
+	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+	* preprocessed ONCE and every later inference is a pure-inference cache
+	* hit — the sustained-throughput run measures inference, not
+	* decode+preprocess+infer. Omitted/0 for live frames (all different →
+	* full preprocess every call, correct). Fresh per sustained run;
+	* released via `uncacheFrame`.
+	*/
+	frameId: number().int().nonnegative().optional(),
+	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+	deviceKey: string().optional()
+}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
+	data: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum([
+		"rgb",
+		"bgr",
+		"gray"
+	])
+}), object({
+	frameId: number(),
+	width: number(),
+	height: number()
+}), { kind: "mutation" }), method(object({
+	stepId: string(),
+	frameId: number().int()
+}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(object({ deviceKey: string().optional() }), EffectiveTuningSchema), method(_void(), array(object({
+	engineKey: string(),
+	engine: PipelineEngineChoiceSchema,
+	modelsLoaded: array(string()).readonly(),
+	inUseByCameras: array(number()).readonly(),
+	/**
+	* Origin of this resident factory.
+	*  - `runtime`       — main camera-serving engine (no idle TTL).
+	*  - `device-pool`   — a concurrent per-device pool (Phase 2
+	*                      multi-device, keyed by `deviceKey`) resolved
+	*                      via `resolveDeviceFactory`. Runs alongside the
+	*                      `runtime` engine on a DIFFERENT accelerator
+	*                      (NPU / iGPU / Coral) — this is how the
+	*                      Engines tab shows all pools running at once.
+	*/
+	kind: _enum(["runtime", "device-pool"]),
+	/** Native pid of the underlying Python pool (null when no pool). */
+	poolPid: number().nullable(),
+	/** ms since this factory was last used (null when not warm-tracked). */
+	idleMs: number().nullable(),
+	/** Idle TTL after which the factory self-evicts (null when not applicable). */
+	idleTtlMs: number().nullable()
+})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	engine: PipelineEngineChoiceSchema,
+	force: boolean().optional()
+}), object({
+	success: boolean(),
+	reason: string().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
+	addonId: string(),
+	modelId: string(),
+	filename: string().optional(),
+	settings: record(string(), unknown()).optional()
+}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -24020,6 +24398,106 @@ var CameraMetricsSchema = object({
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: number() });
 /**
+* Zone — pure geometry + identity. NO filtering behaviour.
+*
+* Zones describe **where** in the frame the operator wants to flag
+* something; consumer-owned {@link ZoneRule} arrays describe **how**
+* each pipeline stage uses them. Splitting the two means a single
+* polygon "Driveway" can simultaneously back a motion-exclude rule,
+* a detection-include rule on `['car']`, and an occupancy aggregate
+* — without three duplicated polygons.
+*
+* Owned by the orchestrator addon (provider) and mirrored into the
+* `zones` device-state slice on every mutation. Consumers
+* (motion-wasm, pipeline-executor, analytics, admin UI) read either
+* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
+* mirror with `onChanged`).
+*
+* Coordinates are normalised fractions of the frame (0–1) so zones
+* survive resolution changes and stream profile switches.
+*
+* `kind` discriminates between full polygons (closed regions used
+* for intrusion / occupancy filters) and tripwires (open 2-point
+* line segments used for cross events). Onboard / firmware-reported
+* zones (Reolink, ONVIF) are out of scope for now — see the deferred
+* task list.
+*/
+var ZoneKindEnum = _enum(["polygon", "tripwire"]);
+/** Polygon vertex in fraction-of-frame coordinates (0–1). */
+var PolygonPointSchema = object({
+	x: number(),
+	y: number()
+});
+/** A camera detection zone — pure geometry/identity. */
+var ZoneSchema = object({
+	id: string(),
+	name: string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: string().default("#3b82f6")
+});
+/**
+* Zones capability — per-camera CRUD over polygon detection zones.
+*
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
+*/
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
+		addZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: method(object({
+			deviceId: number(),
+			zoneId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+/**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
 * decode worker resolves it against the RETAINED native frame's real pixel dims,
 * so the caller supplies only the detection-res bbox divided by the detection
@@ -24471,6 +24949,17 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = object({
+	modelId: string().optional(),
+	settings: record(string(), unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -24482,7 +24971,16 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 var RunnerInferenceDeviceSchema = object({
 	deviceKey: string(),
 	weight: number().positive().default(1),
-	maxSessions: number().int().positive().nullable().default(null)
+	maxSessions: number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: record(string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -25357,6 +25855,28 @@ var NodeInferenceDeviceSchema = object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("stored"),
+		modelId: string()
+	}),
+	object({
+		kind: literal("absent"),
+		defaultModelId: string()
+	}),
+	object({
+		kind: literal("unreadable"),
+		reason: _enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -25384,10 +25904,17 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({ migrated: number() }), {
+}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({
+	migrated: number(),
+	skipped: array(object({
+		deviceId: number(),
+		targetNodeId: string(),
+		reason: string()
+	})).default([])
+}), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
+}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(object({ stepId: string() }), ClusterModelChoiceSchema), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
 	nodeId: string(),
 	capName: string(),
 	addonId: string()
@@ -27103,6 +27630,20 @@ var VectorScanResultSchema = object({
 	*/
 	nextCursor: number().int().nonnegative().nullable()
 });
+/**
+* The ONE error code for "this index exists at another dimension; refusing to
+* redeclare it" (D649). It rides in the MESSAGE — an Error's own properties do
+* not survive the UDS/tRPC hop, its message does — and both sides go through
+* the helpers below, never a copied phrase: a consumer that must tell "this
+* index can never hold my vectors" from "the provider is unreachable" (a
+* delete counts the first as nothing-to-delete and the second as still
+* present) otherwise breaks silently the day the wording changes.
+*/
+var VECTOR_INDEX_DIM_CONFLICT = "vector-index-dim-conflict";
+/** True when `err` (possibly re-wrapped by a transport) is that refusal. */
+function isVectorIndexDimConflict(err) {
+	return (err instanceof Error ? err.message : String(err)).includes(`[${VECTOR_INDEX_DIM_CONFLICT}]`);
+}
 var VectorStatsInputSchema = object({ index: string() });
 var VectorStatsResultSchema = object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -27762,6 +28303,349 @@ DeviceType.Camera, method(object({
 	auth: "protected"
 });
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+var DoorbellPressEventSchema = object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	exposesDeviceSettings: true,
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema)
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -30211,75 +31095,6 @@ onStatusChanged: { data: object({
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-var DoorbellPressEventSchema = object({
-	deviceId: number(),
-	timestamp: number()
-});
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: { data: DoorbellPressEventSchema } },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
 * states, weather conditions, contact-source channels, mode strings).
@@ -34393,7 +35208,7 @@ var HardwareInfoSchema = object({
 	coral: CoralInfoSchema.nullable().optional()
 });
 var PlatformScoreSchema = object({
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: _enum([
 		"onnx",
@@ -34430,7 +35245,7 @@ var ModelRequirementSchema = object({
 });
 var ResolvedInferenceConfigSchema = object({
 	modelId: string(),
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: ModelFormatSchema,
 	reason: string()
@@ -37025,6 +37840,92 @@ var sceneMonitorCapability = {
 	durability: "session"
 };
 /**
+* Per-stage gating mode applied to the zones a rule references.
+*
+* - `include`: the rule contributes to a **whitelist** for its stage.
+*   When at least one `include` rule fires for a stage, only entities
+*   inside one of those zones pass that stage.
+* - `exclude`: the rule contributes to a **blacklist** for its stage.
+*   Entities inside one of those zones are dropped at that stage.
+*
+* `monitor`-style observation (count without filtering) is not a rule
+* mode — zones without any matching rule are observed naturally by
+* `zone-analytics` (live snapshot + history), so an "I just want to
+* count, not filter" use case needs no rule at all.
+*/
+var ZoneRuleModeEnum = _enum(["include", "exclude"]);
+/**
+* Per-consumer rule that references existing zones (geometry) and
+* defines how a specific pipeline stage should treat them. Each
+* consumer addon owns its own `ZoneRule[]` array in its per-device
+* settings:
+*
+* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
+* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
+* - future: notification rules, audio gating, etc.
+*
+* One rule applies to N zones (`zoneIds[]`) so the operator can
+* express "ignore motion in ALL of {garden, street}" with a single
+* rule. `classFilter` narrows the rule to specific object classes —
+* "drop person detections in the street, but keep cars" is one
+* `exclude` rule with `classFilter: ['person']`.
+*
+* `enabled` is a soft toggle — the operator can keep the rule
+* configured but inert without deleting it.
+*/
+var ZoneRuleSchema = object({
+	/** Stable rule id — survives edits, used by the UI for diffing. */
+	id: string(),
+	/** Optional human-readable label rendered in the rule editor. */
+	name: string().optional(),
+	/** Zones this rule targets. The rule's `mode` applies to ALL
+	*  listed zones (OR-set: a detection in any one of them counts).
+	*  At least one zone id required — a rule with no targets is a
+	*  configuration mistake and the form validator rejects it. */
+	zoneIds: array(string()).min(1).readonly(),
+	mode: ZoneRuleModeEnum,
+	/**
+	* Class names this rule applies to. Empty / undefined ⇒ rule
+	* applies to every class. Class strings match the `macroClass`
+	* field on detections (e.g. `person`, `car`, `dog`).
+	*/
+	classFilter: array(string()).readonly().optional(),
+	/**
+	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
+	* required to consider an entity "in the zone". Defaults to the
+	* consumer's stage default when omitted. Kept for back-compat with
+	* existing per-rule overrides; new operators pick the value via
+	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+	* set, the lower-level engine reads it as a 0–1 fraction.
+	*/
+	overlapThreshold: number().min(0).max(1).optional(),
+	/**
+	* Operator-friendly version of `overlapThreshold` — the percentage
+	* of the detection's bbox that must lie inside the zone for the
+	* rule to match. Documented default is 85%; the engine substitutes
+	* that when the field is omitted (kept optional so existing rules
+	* stored without it stay valid).
+	*
+	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+	* rule, the engine prefers `bboxInclusionPct` because it's the
+	* field exposed in the UI. Internally both feed the same gate.
+	*/
+	bboxInclusionPct: number().min(0).max(100).optional(),
+	/**
+	* When `true` and a detection has a segmentation mask, use the
+	* mask for overlap instead of the bbox. Detection-stage only;
+	* motion rules ignore this field.
+	*/
+	preferMask: boolean().optional(),
+	/**
+	* Soft-toggle: `false` disables the rule without deleting it.
+	* Defaults to `true` so operators creating a rule via the UI
+	* see it active immediately.
+	*/
+	enabled: boolean().default(true)
+});
+array(ZoneRuleSchema).readonly();
+/**
 * Script-runner cap. Models HA `script.*` entities on
 * `DeviceType.Script`. A Script is a pre-recorded action sequence
 * that can be invoked imperatively — optionally with a variables
@@ -39081,146 +39982,6 @@ function readDeviceStateFrom(runtimeState) {
 	}
 }
 /**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
-* The same caps → the slice field carrying the ms-epoch timestamp of the
-* last transition. Every source cap MUST appear here (guarded by a spec):
-* without a transition timestamp the evaluator cannot tell a genuine rise
-* from a boot-time hydration when the FIRST slice it ever sees is already
-* active, and errs towards silence — swallowing the rise.
-*
-* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
-* provider derives them from `state.last_changed`, so they survive our own
-* restarts and correctly read as "hours ago" for a state that has been
-* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
-*/
-var SOURCE_CAP_CHANGED_AT_FIELD = {
-	contact: "lastChangedAt",
-	binary: "lastChangedAt",
-	switch: "lastChangedAt",
-	motion: "lastDetectedAt",
-	flood: "lastChangedAt",
-	gas: "lastChangedAt",
-	smoke: "lastChangedAt",
-	"carbon-monoxide": "lastChangedAt",
-	vibration: "lastChangedAt",
-	tamper: "lastChangedAt"
-};
-/** True when a cap is a recognised binary/switch source. */
-function isSourceCap(capName) {
-	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
-}
-/** Extract the "active" boolean a source cap's slice carries, or null when
-*  the cap is unknown or the field is missing / non-boolean. */
-function sliceActiveValue(capName, slice) {
-	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	return typeof raw === "boolean" ? raw : null;
-}
-/** Ms-epoch transition timestamp a source cap's slice carries, or null when
-*  it is absent, non-numeric or the zero "never observed" sentinel. */
-function sliceChangedAt(capName, slice) {
-	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
-	return raw;
-}
-/**
-* How recent a source's own transition timestamp must be for a FIRST
-* sighting that is already active to count as a genuine rise rather than a
-* hydration of long-standing state.
-*/
-var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
-/**
-* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
-* porta `prior`, `nowMs` e il proprio `startedAtMs`.
-*
-* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
-* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
-* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
-* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
-* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
-* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
-* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
-* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
-*/
-function evaluateSensorEdge(input) {
-	const value = sliceActiveValue(input.capName, input.slice);
-	if (value === null) return {
-		edge: "none",
-		value: null,
-		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
-	};
-	if (input.prior === void 0) {
-		if (!value) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-inactive"
-		};
-		const changedAt = sliceChangedAt(input.capName, input.slice);
-		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
-		if (changedAt === null || changedAt < floor) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-stale-active"
-		};
-		return {
-			edge: "rising",
-			value: true
-		};
-	}
-	if (input.prior === value) return {
-		edge: "none",
-		value,
-		reason: "no-change"
-	};
-	if (!value) return {
-		edge: "none",
-		value,
-		reason: "falling-edge"
-	};
-	return {
-		edge: "rising",
-		value: true
-	};
-}
-/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -43060,6 +43821,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -43810,6 +44595,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -45196,6 +45987,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewStateSummary": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.previewTemplate": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -45772,12 +46569,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.runReplayFrameProcessor": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -46144,6 +46935,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -48969,6 +49766,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -49875,11 +50692,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"pipelineAnalytics.runReplayFrameProcessor": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"pipelineAnalytics.saveRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -50917,7 +51729,8 @@ var NC_SYSTEM_EVENT_FAMILY = {
 	"camera-disabled": null,
 	"camera-enabled": null
 };
-new Map(Object.entries(NC_SYSTEM_EVENT_FAMILY));
+/** Read by NAME, for kinds that arrive as plain strings (a newer hub, the viewer's mirror). */
+var FAMILY_BY_NAME = new Map(Object.entries(NC_SYSTEM_EVENT_FAMILY));
 var NC_SYSTEM_EVENT_CONDITION_FILTER_KEYS = [...NC_SYSTEM_EVENT_FILTER_KEYS, "excludeDeviceIds"];
 /**
 * The filters a family may carry. The base filters are the union of
@@ -51028,6 +51841,24 @@ function systemEventKindsOfFamily(family) {
 	return NC_SYSTEM_EVENT_KIND_GROUP_SPECS.filter((g) => g.family === family).flatMap((g) => g.kinds);
 }
 /**
+* One family, or `mixed`. Mixed covers kinds that span families, a legacy kind,
+* a kind this build does not know (it fails toward read-only and never toward
+* editable), and an empty selection (nothing to decide on).
+*/
+function systemEventFamilyOf(kindNames) {
+	const families = /* @__PURE__ */ new Set();
+	for (const name of kindNames) {
+		const family = FAMILY_BY_NAME.get(name);
+		if (family === void 0 || family === null) return { kind: "mixed" };
+		families.add(family);
+	}
+	const [only] = [...families];
+	return families.size === 1 && only !== void 0 ? {
+		kind: "family",
+		family: only
+	} : { kind: "mixed" };
+}
+/**
 * Why the hub refuses this condition on a new or updated rule. Empty = accepted.
 * Families are reported in `NC_SYSTEM_EVENT_FAMILIES` order, and filters in
 * `NC_SYSTEM_EVENT_CONDITION_FILTER_KEYS` order, so a refusal reads the same
@@ -51103,18 +51934,38 @@ var WEEKDAY_TO_DAY = {
 	Fri: 5,
 	Sat: 6
 };
-/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
-*  An invalid/unknown IANA name falls back to the host timezone. */
-function localDayMinute(atMs, timezone) {
-	const d = new Date(atMs);
-	if (timezone !== void 0) try {
-		const parts = new Intl.DateTimeFormat("en-US", {
+/**
+* One formatter per timezone, built once (D647 review I4). Constructing an
+* `Intl.DateTimeFormat` is the expensive part of this function, and a caller
+* that asks about many instants — a window scan — used to build one per
+* instant. `null` = an invalid IANA name (the host timezone is used).
+*/
+var FORMATTERS = /* @__PURE__ */ new Map();
+function formatterFor(timezone) {
+	const held = FORMATTERS.get(timezone);
+	if (held !== void 0) return held;
+	let made;
+	try {
+		made = new Intl.DateTimeFormat("en-US", {
 			timeZone: timezone,
 			weekday: "short",
 			hour: "numeric",
 			minute: "numeric",
 			hourCycle: "h23"
-		}).formatToParts(d);
+		});
+	} catch {
+		made = null;
+	}
+	FORMATTERS.set(timezone, made);
+	return made;
+}
+/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
+*  An invalid/unknown IANA name falls back to the host timezone. */
+function localDayMinute(atMs, timezone) {
+	const d = new Date(atMs);
+	const formatter = timezone !== void 0 ? formatterFor(timezone) : null;
+	if (formatter !== null) try {
+		const parts = formatter.formatToParts(d);
 		let weekday;
 		let hour;
 		let minute;
@@ -51254,6 +52105,119 @@ var DEVICE_EVENTS = [
 	"detection-blind",
 	...ALARM
 ];
+/** Every kind a summary may speak about — the two summarisable families. */
+var SUMMARISABLE = [...systemEventKindsOfFamily("device-events"), ...systemEventKindsOfFamily("system")];
+/** One per summary SECTION (`NC_STATE_SUMMARY_SECTIONS` in the notification
+*  centre): the section's lines, offered when one of its kinds is selected. */
+var STATE_SUMMARY_SECTION_VARS = [
+	{
+		name: "summaryDevices",
+		label: "Summary: devices offline / switched off",
+		example: "Garage — offline since 07:12",
+		kinds: [
+			"device-offline",
+			"device-online",
+			"device-disabled",
+			"device-enabled"
+		]
+	},
+	{
+		name: "summaryStreams",
+		label: "Summary: streams offline",
+		example: "Ingresso (high) — since 06:40",
+		kinds: ["stream-offline", "stream-online"]
+	},
+	{
+		name: "summaryBattery",
+		label: "Summary: low batteries",
+		example: "Sensore porta — 8 %",
+		kinds: BATTERY
+	},
+	{
+		name: "summaryConsumables",
+		label: "Summary: consumables",
+		example: "Robot — filter 10 %",
+		kinds: CONSUMABLE
+	},
+	{
+		name: "summaryTanks",
+		label: "Summary: tanks",
+		example: "Robot — clean water low",
+		kinds: TANK
+	},
+	{
+		name: "summaryDetection",
+		label: "Summary: cameras detecting nothing",
+		example: "Ingresso — since 05:10",
+		kinds: ["detection-blind"]
+	},
+	{
+		name: "summaryNodes",
+		label: "Summary: nodes",
+		example: "little-unraid — offline since 03:00",
+		kinds: [
+			"node-offline",
+			"node-online",
+			"node-inference-unavailable"
+		]
+	},
+	{
+		name: "summaryAddons",
+		label: "Summary: addons",
+		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: [
+			"addon-crash-loop",
+			"addon-update-available",
+			"addon-updated"
+		]
+	},
+	{
+		name: "summaryUpdates",
+		label: "Summary: server & container updates",
+		example: "server 1.2.377 → 1.2.378",
+		kinds: [
+			"server-update-available",
+			"server-updated",
+			"wrapper-update-available"
+		]
+	}
+];
+var STATE_SUMMARY_VARS = [
+	{
+		name: "summaryText",
+		label: "Summary: every section",
+		description: "One block per section with something to report, one line per item.",
+		example: "Batterie scariche: Sensore porta — 8 %",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	{
+		name: "summaryCount",
+		label: "Summary: items reported",
+		example: "3",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
+		name: v.name,
+		label: v.label,
+		example: v.example,
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...v.kinds],
+		systemEventDeliveries: ["summary"]
+	}))
+];
 var NC_TEMPLATE_VARS = [
 	{
 		name: "camera",
@@ -51504,7 +52468,8 @@ var NC_TEMPLATE_VARS = [
 		group: "system",
 		families: ["rule"],
 		fields: [...RULE_TEXT],
-		kinds: ["system"]
+		kinds: ["system"],
+		systemEventDeliveries: ["instant"]
 	},
 	{
 		name: "deviceName",
@@ -51947,7 +52912,8 @@ var NC_TEMPLATE_VARS = [
 		group: "digest",
 		families: ["summary"],
 		fields: [...RULE_TEXT]
-	}
+	},
+	...STATE_SUMMARY_VARS
 ];
 /**
 * System-event kinds the SERVED catalog holds back (D642): the kinds the hub
@@ -51976,11 +52942,32 @@ var NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS = [
 * rule an installed viewer can author, which is exactly true.
 */
 function servedTemplateVars() {
-	return NC_TEMPLATE_VARS.map((d) => d.systemEventKinds === void 0 ? d : {
+	return NC_TEMPLATE_VARS.filter((d) => !isHeldBackTemplateVar(d)).map((d) => d.systemEventKinds === void 0 ? d : {
 		...d,
 		systemEventKinds: d.systemEventKinds.filter((kind) => !NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS.includes(kind))
 	});
 }
+/**
+* Is this descriptor held back from the SERVED catalog as a whole (D647)?
+* A summary-only variable is: an installed viewer does not read the delivery
+* axis, and would offer it on every instant system rule. The admin, built
+* from the workspace, restores it from its own `NC_TEMPLATE_VARS`.
+*/
+function isHeldBackTemplateVar(d) {
+	return d.systemEventDeliveries !== void 0 && !d.systemEventDeliveries.includes("instant");
+}
+/**
+* Does a descriptor have a value on a system rule of this DELIVERY (D647)?
+* Read only for a system rule kind. An absent axis is `instant` for a
+* descriptor that names `systemEventKinds` (a per-event fact: a summary row
+* has no one device, node or package) and BOTH for one that does not
+* (`{{rule}}`, `{{time}}`).
+*/
+function templateVarDeliveryApplies(d, ctx) {
+	if (!isSystemRuleKind(ctx.kind)) return true;
+	const mode = ctx.systemEventDelivery ?? "instant";
+	return (d.systemEventDeliveries ?? (d.systemEventKinds !== void 0 ? ["instant"] : [mode])).includes(mode);
+}
 /** The caption fields see a fixed, smaller vocabulary (`timelapsePreviewText`,
 *  `summaryCaptionText`). Declared here rather than as `fields` on every
 *  descriptor so the whole rule stays in one line of code. */
@@ -52045,12 +53032,82 @@ function templateVarsFor(ctx) {
 		const allowed = CAPTION_VARS[ctx.field];
 		return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && allowed.includes(d.name) && d.dynamic === void 0);
 	}
-	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx));
+	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx) && templateVarDeliveryApplies(d, ctx));
 }
 /** True when `name` is supplied in `ctx`, dynamic families (`count_<class>`) included. */
 function isKnownTemplateVar(name, ctx) {
 	return templateVarsFor(ctx).some((d) => d.dynamic !== void 0 ? name.startsWith(d.dynamic.prefix) && name.length > d.dynamic.prefix.length : d.name === name);
 }
+/** The families a rule may summarise. The alarm is not one of them. */
+var NC_SYSTEM_EVENT_SUMMARY_FAMILIES = ["device-events", "system"];
+/** The summary's schedule, or `null` for any rule that is not a summary system rule. */
+function systemEventSummaryScheduleOf(rule) {
+	if (!isSystemDelivery(rule.delivery)) return null;
+	const delivery = rule.systemEventDelivery;
+	return delivery?.mode === "summary" ? delivery.schedule : null;
+}
+/** Absent and `instant` are the same answer: a notification per event. */
+function isSystemEventSummaryRule(rule) {
+	return systemEventSummaryScheduleOf(rule) !== null;
+}
+function actionsAreSet(actions) {
+	return (actions?.onTrigger?.length ?? 0) > 0 || (actions?.buttons?.length ?? 0) > 0;
+}
+/**
+* Why the hub refuses this rule's delivery. Empty = accepted. An instant rule
+* (absent or `{ mode: 'instant' }`) is never refused here.
+*
+* Beside a summary, two fields are refused because they would do nothing:
+* the rule's own `schedule` (the summary's schedule is the send time; a second
+* active-hours gate would silently empty it) and `actions` (a summary is not a
+* match, so nothing would ever run them).
+*/
+function systemEventDeliveryProblems(rule) {
+	if (rule.systemEventDelivery?.mode !== "summary") return [];
+	if (!isSystemDelivery(rule.delivery)) return [{
+		code: "not-a-system-rule",
+		delivery: rule.delivery
+	}];
+	const problems = [];
+	const verdict = systemEventFamilyOf(rule.conditions.systemEvent?.kinds ?? []);
+	const family = verdict.kind === "family" ? verdict.family : "mixed";
+	if (family === "mixed" || !NC_SYSTEM_EVENT_SUMMARY_FAMILIES.includes(family)) problems.push({
+		code: "family-not-summarisable",
+		family
+	});
+	const windows = rule.systemEventDelivery.schedule.windows;
+	if (windows.length === 0) problems.push({ code: "empty-schedule" });
+	windows.forEach((window, index) => {
+		if (window.days.length === 0 || window.startMinute === window.endMinute) problems.push({
+			code: "degenerate-window",
+			index
+		});
+	});
+	if (rule.schedule !== void 0) problems.push({ code: "schedule-beside-summary" });
+	if (actionsAreSet(rule.actions)) problems.push({ code: "actions-beside-summary" });
+	return problems;
+}
+function describeSystemEventDeliveryProblem(problem) {
+	switch (problem.code) {
+		case "not-a-system-rule": return `a '${problem.delivery}' rule has no summary delivery — only device-events and system rules do`;
+		case "family-not-summarisable": return problem.family === "alarm" ? "an alarm rule cannot be a scheduled summary — the alarm stays instant" : `a ${problem.family} rule cannot be a scheduled summary — only device-events and system rules`;
+		case "degenerate-window": return `send time ${String(problem.index + 1)} has no day, or starts and ends on the same minute — it never closes, so nothing would be sent`;
+		case "empty-schedule": return "a summary rule needs at least one send time — its schedule has no window";
+		case "schedule-beside-summary": return "a summary rule is sent on its summary schedule — remove the active-hours schedule";
+		case "actions-beside-summary": return "a summary rule never matches an event, so its actions would never run — remove them";
+	}
+}
+var SUMMARY_CONTENT_VAR = /\{\{\s*summary(?:Text|Devices|Streams|Battery|Consumables|Tanks|Detection|Nodes|Addons|Updates)\s*\}\}/;
+/**
+* Does a custom BODY carry the summary's content (`{{summaryText}}` or a
+* section variable)? A body that does not would send a summary with nothing
+* in it; the hub then appends `{{summaryText}}` and the admin warns (review
+* M3). An absent or blank body uses the hub's own wording, which does.
+*/
+function templateCarriesSummary(body) {
+	if (body === void 0 || body.trim().length === 0) return true;
+	return SUMMARY_CONTENT_VAR.test(body);
+}
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -52351,169 +53408,6 @@ function readTimelapseGeneratedAt(rule, deviceId) {
 	if (map !== void 0) return map[String(deviceId)] ?? 0;
 	return rule.lastGeneratedAt ?? 0;
 }
-/**
-* A model choice has a SCOPE, and a scope change has a workflow.
-*
-* ## The two scopes
-*
-* Almost every pipeline step's model is a **node** question: which build runs
-* fastest on THIS accelerator. Two nodes may legitimately answer differently —
-* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
-* are compared against nothing. They produce boxes, and a box is a box.
-*
-* Two steps are not like that. `face-embedding` and `clip-embedding` produce
-* **vectors that land in ONE shared index** (`identity_samples`,
-* `vec_object_clip`) and are ranked against each other by cosine similarity.
-* Cosine similarity between two encoders is not a weak signal, it is a
-* meaningless number — and nothing inside a vector can tell you it happened.
-* So for those two steps the model is a **cluster** question with exactly one
-* answer, stored in exactly one row.
-*
-* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
-* for the crop convention (`detail-crop.ts`), one level up: the crop decides
-* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
-* cluster-wide for the same reason and neither may become per-node.
-*
-* ## Why the registry lives here and not in the step catalog
-*
-* The scope itself is declared on the step, in
-* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
-* — that is where a new step declares what kind of choice its model is. But the
-* catalog lives inside `addon-pipeline`, and three packages that must NOT
-* import an addon need to know the set: the orchestrator (which renders and
-* stores the row), post-analysis (which pins the row for a re-embed pass) and
-* admin-ui (which mirrors it). So the set is mirrored here, and
-* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
-* A hand-copied key that stops matching is exactly how a setting silently stops
-* arriving while both sides still look correct.
-*
-* ## The defaults ARE today's behaviour
-*
-* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
-* of both steps. Declaring the scope therefore changes nothing on the day it
-* ships: the cluster row starts out saying what every node was already doing.
-* Changing it is legitimate — that is what the knob is for — but it invalidates
-* the stored vectors of that surface, and must be followed by a re-embed pass
-* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
-*/
-/**
-* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
-* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
-*/
-var CLUSTER_MODEL_SCOPED_STEPS = [{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}];
-/**
-* The settings key holding one step's cluster model choice.
-*
-* Step-qualified so the keys stay unique across the addon's whole schema, which
-* is what lets {@link pickClusterStepModels} walk every section instead of
-* trusting the section id.
-*/
-function clusterModelSettingKey(stepId) {
-	return `clusterModel:${stepId}`;
-}
-/** The cluster row when nobody has configured one — today's catalog defaults. */
-var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
-/** A stored choice is a non-empty model id, or it is not a choice. */
-var ChosenModelIdSchema = string().min(1);
-/**
-* Narrow a FLAT settings record to the cluster row.
-*
-* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
-* junk face model must not also discard a valid clip model. An absent, empty or
-* non-string value resolves to the step's catalog default — the historical
-* behaviour — never to a blank id, because a blank id downstream becomes
-* "substitute the format default", which is precisely the substitution this
-* scope exists to forbid.
-*/
-function readClusterStepModels(config) {
-	const out = {};
-	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
-		const parsed = ChosenModelIdSchema.safeParse(config[clusterModelSettingKey(step.stepId)]);
-		out[step.stepId] = parsed.success ? parsed.data : step.defaultModelId;
-	}
-	return out;
-}
-function isHydratedField$2(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the defaults. A `null` payload
-* (addon mid-boot) is the defaults.
-*/
-function pickClusterStepModels(view) {
-	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
-	const flat = {};
-	const wanted = new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
-		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readClusterStepModels(flat);
-}
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -53055,6 +53949,397 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
+//#region src/pipeline-analytics/cluster-model-pin.ts
+/**
+* Where a re-embed pass gets the model it pins.
+*
+* ## Why not `embeddingEncoder.getInfo`
+*
+* That is what the CLIP rebuild used, and it answers a subtly different
+* question: "which model is the encoder addon currently holding", not "which
+* model has the operator chosen for the cluster". The two agree until they do
+* not — an encoder mid-reload, a node that never picked up a change — and when
+* they disagree the pass writes a whole index in the wrong space with a status
+* line that looks fine. Since `face-embedding` and `clip-embedding` declare
+* `modelScope: 'cluster'`, there is now exactly one authority for each, and it
+* is a stored row rather than a live process's opinion.
+*
+* ## Why the read is not cached here
+*
+* A pass reads it ONCE, at the start, and pins that value for its whole run
+* (D54). A cache would only matter for a caller that re-read it mid-pass, which
+* is precisely the thing the pin exists to prevent — so there is nothing to
+* cache and the absence is deliberate.
+*
+* ## Why a failed read refuses instead of defaulting
+*
+* A pass that cannot name its model must not run. The previous CLIP path's
+* `?? 'unknown'` is the shipped version of the alternative: rows stamped with an
+* id nothing ran, in an index whose same-model gate then has nothing to reason
+* about.
+*/
+/** The addon whose GLOBAL settings hold the cluster row. */
+var CLUSTER_MODEL_OWNER_ADDON_ID = "pipeline-orchestrator";
+/** The step ids this module can pin — the same two the catalog declares. */
+var FACE_EMBEDDING_STEP_ID = "face-embedding";
+var CLIP_EMBEDDING_STEP_ID = "clip-embedding";
+/**
+* The cluster row, or `null` when it could not be read.
+*
+* `null` and not "the defaults": a caller that cannot distinguish "the operator
+* chose arcface" from "I could not ask" will run a pass on a guess. The one
+* production caller turns `null` into a refusal to start.
+*/
+async function readClusterModelRow(api, logger) {
+	try {
+		return pickClusterStepModels(await api.addonSettings.getGlobalSettings.query({ addonId: CLUSTER_MODEL_OWNER_ADDON_ID }));
+	} catch (err) {
+		logger.warn("cluster model row unreadable — a re-embed pass must not guess which encoder the operator chose", { meta: {
+			owner: CLUSTER_MODEL_OWNER_ADDON_ID,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+		return null;
+	}
+}
+/**
+* Pin one cluster-scoped step's model for a whole pass.
+*
+* Returns `null` on an unreadable row OR an unknown step id — both mean the
+* caller must not start, and folding them together is safe because the caller's
+* move is identical: refuse, loudly.
+*/
+async function resolveClusterModelPin(api, stepId, logger) {
+	if (!CLUSTER_MODEL_SCOPED_STEPS.some((s) => s.stepId === stepId)) {
+		logger.warn("cluster model pin requested for a step that is not cluster-scoped", { meta: {
+			stepId,
+			clusterScoped: CLUSTER_MODEL_SCOPED_STEPS.map((s) => s.stepId)
+		} });
+		return null;
+	}
+	const row = await readClusterModelRow(api, logger);
+	if (row === null) return null;
+	const modelId = row[stepId];
+	return modelId !== void 0 && modelId !== "" ? modelId : null;
+}
+/**
+* The error texts a cap call carries when the provider or the router has no
+* such method: the kernel's `Capability "…" has no method "…"`, tRPC's
+* `No procedure found on path`, and the forked-child hop's
+* `method '…' not found on provider '…'` (child-cap-dispatch.ts). NOT `is not a function`: that is any
+* `TypeError` thrown INSIDE the owner while it answers, and reading it as
+* "the owner predates the method" would file a bug in the owner under a
+* rolling-release reason nobody investigates.
+*/
+var METHOD_UNAVAILABLE_FINGERPRINTS = [
+	/has no method/i,
+	/no procedure found/i,
+	/method not found/i,
+	/method '[^']*' not found on provider/i
+];
+/**
+* The pin read for a pass that REWRITES an index (D651 fix rounds 1–3).
+*
+* Asks the OWNER. The orchestrator owns `clusterModel:*` and answers from a
+* three-way read of its own store, once its boot has settled
+* (`pipelineOrchestrator.getClusterModelChoice`). Never the hydrated view,
+* which answers `value ?? default`, and never the owner's private store
+* layout. Silent on purpose: the callers log state CHANGES.
+*/
+async function readClusterModelPinStrict(api, stepId) {
+	const method = api.pipelineOrchestrator?.getClusterModelChoice;
+	if (method === void 0) return {
+		kind: "unknown",
+		reason: "method-unavailable"
+	};
+	let raw;
+	try {
+		raw = await method.query({ stepId });
+	} catch (err) {
+		const error = err instanceof Error ? err.message : String(err);
+		return METHOD_UNAVAILABLE_FINGERPRINTS.some((re) => re.test(error)) ? {
+			kind: "unknown",
+			reason: "method-unavailable",
+			error
+		} : {
+			kind: "unknown",
+			reason: "read-failed",
+			error
+		};
+	}
+	if (raw === void 0) return {
+		kind: "unknown",
+		reason: "method-unavailable"
+	};
+	const parsed = ClusterModelChoiceSchema.safeParse(raw);
+	if (!parsed.success) return {
+		kind: "unknown",
+		reason: "read-failed",
+		error: "unparseable owner answer"
+	};
+	const choice = parsed.data;
+	if (choice.kind === "stored") return {
+		kind: "known",
+		modelId: choice.modelId
+	};
+	if (choice.kind === "absent") return {
+		kind: "not-stored",
+		defaultModelId: choice.defaultModelId
+	};
+	return choice.error !== void 0 ? {
+		kind: "unknown",
+		reason: choice.reason,
+		error: choice.error
+	} : {
+		kind: "unknown",
+		reason: choice.reason
+	};
+}
+//#endregion
+//#region src/embedding-encoder/catalogs/embedding-models.ts
+var HF_REPO = "camstack/camstack-models";
+var hf = (path) => hfModelUrl(HF_REPO, path);
+/**
+* The text tower's tokenizer, in HF `tokenizers` format, hosted next to every
+* text-encoder onnx (`.../onnx/tokenizer.json`) and fetched as a sibling file so
+* it lands beside the model. Each model folder hosts ITS OWN (MobileCLIP: the
+* CLIP BPE, vocab 49408; SigLIP2: Gemma SentencePiece, 256k, lower-casing).
+*/
+var TOKENIZER_FILE = "tokenizer.json";
+/** SigLIP2's tokenizer — a DIFFERENT file name on purpose: see `ClipModelMeta.tokenizerFile`. */
+var SIGLIP2_TOKENIZER_FILE = "camstack-siglip2-b16-224-tokenizer.json";
+var ovFormat = (url, sizeMB) => {
+	const base = url.split("/").pop() ?? "";
+	const files = base.endsWith(".xml") ? [base.replace(/\.xml$/, ".bin")] : void 0;
+	return {
+		url,
+		sizeMB,
+		runtimes: ["python"],
+		...files ? { files } : {}
+	};
+};
+/**
+* Files inside an .mlpackage directory bundle.
+* Must be fetched alongside the package root when isDirectory is true.
+*/
+var MLPACKAGE_FILES = [
+	"Manifest.json",
+	"Data/com.apple.CoreML/model.mlmodel",
+	"Data/com.apple.CoreML/weights/weight.bin"
+];
+/**
+* The MobileCLIP feature-space contract (D649 — see `clip-model.ts` in
+* `@camstack/types`). S1 and S2 share the historical 512-d `object-clip` index,
+* separated by each row's `modelId`; the CLIP BPE window is 77 tokens padded
+* with 0; 0.2 is the floor the search always shipped with, measured to keep 96%
+* of matched COCO caption-image pairs on S1.
+*/
+var mobileclipMeta = (textModelId) => ({
+	textModelId,
+	embeddingDim: 512,
+	vectorIndex: "object-clip",
+	tokenizerFile: TOKENIZER_FILE,
+	contextLength: 77,
+	padId: 0,
+	searchMinScore: .2
+});
+/**
+* SigLIP2 B/16-224 (D649). 768-d, so its OWN index; a 64-token Gemma
+* SentencePiece window padded with 0 (the hosted `tokenizer.json` lower-cases,
+* see `scripts/build-siglip2-model.py`). The floor is SIGLIP2_SEARCH_MIN_SCORE.
+*/
+var SIGLIP2_META = {
+	textModelId: "siglip2-b16-224-text",
+	embeddingDim: 768,
+	vectorIndex: "object-clip-siglip2-b16-224",
+	tokenizerFile: SIGLIP2_TOKENIZER_FILE,
+	contextLength: 64,
+	padId: 0,
+	searchMinScore: .1
+};
+/**
+* NO onnx vision builds, deliberately (2026-08-21). The int8 ONNX vision
+* exports were measured misaligned with the text encoders (matched image↔text
+* cosine ≈ 0.01 vs ≈ 0.22 for the fp16 openvino/coreml builds) — see the
+* catalog note in `addon-pipeline/.../model-catalogs.ts`. The image-encode leg
+* that consumed them here (`embeddingEncoder.encode` → PythonRawTensorEngine)
+* is retired with them: its only caller discarded the vector, and its
+* `preprocessForClip` applied OpenAI mean/std that MobileCLIP never used.
+* S0 was retired the same day (measured worst of the family on fleet crops).
+*/
+var CLIP_IMAGE_MODELS = [
+	{
+		id: "mobileclip-s1",
+		name: "MobileCLIP S1",
+		description: "Apple MobileCLIP S1 — balanced vision encoder, 512-dim, 256×256 (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 256,
+			height: 256
+		},
+		labels: [],
+		inputNormalization: "none",
+		clip: mobileclipMeta("mobileclip-s1-text"),
+		formats: {
+			openvino: ovFormat(hf("clip/mobileclip-s1/openvino/camstack-mobileclip-s1-vision.xml"), 55),
+			coreml: {
+				url: hf("clip/mobileclip-s1/coreml/camstack-mobileclip-s1-vision.mlpackage"),
+				sizeMB: 65,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	},
+	{
+		id: "mobileclip-s2",
+		name: "MobileCLIP S2",
+		description: "Apple MobileCLIP S2 — high-accuracy vision encoder, 512-dim, 256×256 (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 256,
+			height: 256
+		},
+		labels: [],
+		inputNormalization: "none",
+		clip: mobileclipMeta("mobileclip-s2-text"),
+		formats: {
+			openvino: ovFormat(hf("clip/mobileclip-s2/openvino/camstack-mobileclip-s2-vision.xml"), 90),
+			coreml: {
+				url: hf("clip/mobileclip-s2/coreml/camstack-mobileclip-s2-vision.mlpackage"),
+				sizeMB: 110,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	},
+	{
+		id: "siglip2-b16-224",
+		name: "SigLIP2 B/16",
+		description: "Google SigLIP2 base, patch 16, 224×224 — Apache-2.0 vision encoder, 768-dim (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 224,
+			height: 224
+		},
+		labels: [],
+		inputNormalization: "none",
+		license: "Apache-2.0",
+		clip: SIGLIP2_META,
+		formats: {
+			openvino: ovFormat(hf("clip/siglip2/openvino/camstack-siglip2-b16-224-vision.xml"), 186),
+			coreml: {
+				url: hf("clip/siglip2/coreml/camstack-siglip2-b16-224-vision.mlpackage"),
+				sizeMB: 185,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	}
+];
+/**
+* The int8 TEXT onnx encoders are healthy — unlike the retired int8 vision
+* exports. Verified 2026-08-21: the live search path (fp16 openvino vision
+* vectors ⋅ int8 onnx text queries) ranks correctly on the real index, and the
+* local cross-check aligns them with the fp16 vision space (cos ≈ 0.22 on
+* matched pairs).
+*/
+var CLIP_TEXT_MODELS = [
+	{
+		id: "mobileclip-s1-text",
+		name: "MobileCLIP S1 Text Encoder",
+		description: "Text encoder for MobileCLIP S1, 512-dim, int8 quantized (61 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		formats: {
+			onnx: {
+				url: hf("clip/mobileclip-s1/onnx/camstack-mobileclip-s1-text.onnx"),
+				sizeMB: 61,
+				files: [TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/mobileclip-s1/openvino/camstack-mobileclip-s1-text.xml"), 121)
+		}
+	},
+	{
+		id: "mobileclip-s2-text",
+		name: "MobileCLIP S2 Text Encoder",
+		description: "Text encoder for MobileCLIP S2, 512-dim, int8 quantized (61 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		formats: {
+			onnx: {
+				url: hf("clip/mobileclip-s2/onnx/camstack-mobileclip-s2-text.onnx"),
+				sizeMB: 61,
+				files: [TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/mobileclip-s2/openvino/camstack-mobileclip-s2-text.xml"), 121)
+		}
+	},
+	{
+		id: "siglip2-b16-224-text",
+		name: "SigLIP2 B/16 Text Encoder",
+		description: "Text encoder for SigLIP2 B/16, 768-dim, fp16 (565 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		license: "Apache-2.0",
+		formats: {
+			onnx: {
+				url: hf("clip/siglip2/onnx/camstack-siglip2-b16-224-text.onnx"),
+				sizeMB: 565,
+				files: [SIGLIP2_TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/siglip2/openvino/camstack-siglip2-b16-224-text.xml"), 565)
+		}
+	}
+];
+//#endregion
+//#region src/shared/clip/clip-model-registry.ts
+/** The model in force when nobody has chosen — the cluster row's default. */
+var DEFAULT_CLIP_MODEL = "mobileclip-s1";
+/**
+* Build a registry from catalog entries. Throws when two models share an index
+* at different dimensions: that is a catalog defect, and the vector store would
+* refuse the second model's writes one at a time, forever, at runtime.
+*/
+function buildClipModelRegistry(entries) {
+	const models = /* @__PURE__ */ new Map();
+	const spaces = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const meta = entry.clip;
+		if (meta === void 0) continue;
+		models.set(entry.id, {
+			modelId: entry.id,
+			inputSize: entry.inputSize.width,
+			meta
+		});
+		const existing = spaces.get(meta.vectorIndex);
+		if (existing !== void 0 && existing.dim !== meta.embeddingDim) throw new Error(`CLIP index "${meta.vectorIndex}" declared at ${String(existing.dim)} dims by ${existing.modelIds.join(", ")} and at ${String(meta.embeddingDim)} by ${entry.id}`);
+		spaces.set(meta.vectorIndex, {
+			index: meta.vectorIndex,
+			dim: meta.embeddingDim,
+			modelIds: [...existing?.modelIds ?? [], entry.id]
+		});
+	}
+	const all = [...spaces.values()];
+	return {
+		resolve: (modelId) => models.get(modelId) ?? null,
+		spaceFor: (modelId) => {
+			const model = models.get(modelId);
+			return model === void 0 ? null : spaces.get(model.meta.vectorIndex) ?? null;
+		},
+		spaces: () => all
+	};
+}
+/** The built-in catalog's registry. */
+var BUILTIN_CLIP_MODELS = buildClipModelRegistry(CLIP_IMAGE_MODELS);
+//#endregion
 Object.defineProperty(exports, "AUDIO_MACRO_LABELS", {
 	enumerable: true,
 	get: function() {
@@ -53073,6 +54358,12 @@ Object.defineProperty(exports, "ArchivedDebugNoteSchema", {
 		return ArchivedDebugNoteSchema;
 	}
 });
+Object.defineProperty(exports, "BUILTIN_CLIP_MODELS", {
+	enumerable: true,
+	get: function() {
+		return BUILTIN_CLIP_MODELS;
+	}
+});
 Object.defineProperty(exports, "BaseAddon", {
 	enumerable: true,
 	get: function() {
@@ -53091,10 +54382,22 @@ Object.defineProperty(exports, "BirthDecisionRecordSchema", {
 		return BirthDecisionRecordSchema;
 	}
 });
-Object.defineProperty(exports, "CLUSTER_MODEL_SCOPED_STEPS", {
+Object.defineProperty(exports, "CLIP_EMBEDDING_STEP_ID", {
 	enumerable: true,
 	get: function() {
-		return CLUSTER_MODEL_SCOPED_STEPS;
+		return CLIP_EMBEDDING_STEP_ID;
+	}
+});
+Object.defineProperty(exports, "CLIP_IMAGE_MODELS", {
+	enumerable: true,
+	get: function() {
+		return CLIP_IMAGE_MODELS;
+	}
+});
+Object.defineProperty(exports, "CLIP_TEXT_MODELS", {
+	enumerable: true,
+	get: function() {
+		return CLIP_TEXT_MODELS;
 	}
 });
 Object.defineProperty(exports, "COCO_TO_MACRO", {
@@ -53115,6 +54418,12 @@ Object.defineProperty(exports, "CoverStateSchema", {
 		return CoverStateSchema;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_CLIP_MODEL", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_CLIP_MODEL;
+	}
+});
 Object.defineProperty(exports, "DEFAULT_EVENT_COLOR", {
 	enumerable: true,
 	get: function() {
@@ -53157,6 +54466,24 @@ Object.defineProperty(exports, "DeviceType", {
 		return DeviceType;
 	}
 });
+Object.defineProperty(exports, "EMBEDDING_MODEL_FAILED", {
+	enumerable: true,
+	get: function() {
+		return EMBEDDING_MODEL_FAILED;
+	}
+});
+Object.defineProperty(exports, "EMBEDDING_REQUIREMENTS_FAILED", {
+	enumerable: true,
+	get: function() {
+		return EMBEDDING_REQUIREMENTS_FAILED;
+	}
+});
+Object.defineProperty(exports, "EMBEDDING_REQUIREMENTS_UNAVAILABLE", {
+	enumerable: true,
+	get: function() {
+		return EMBEDDING_REQUIREMENTS_UNAVAILABLE;
+	}
+});
 Object.defineProperty(exports, "EVENT_KIND_BY_CAP", {
 	enumerable: true,
 	get: function() {
@@ -53175,6 +54502,12 @@ Object.defineProperty(exports, "EventCategory", {
 		return EventCategory;
 	}
 });
+Object.defineProperty(exports, "FACE_EMBEDDING_STEP_ID", {
+	enumerable: true,
+	get: function() {
+		return FACE_EMBEDDING_STEP_ID;
+	}
+});
 Object.defineProperty(exports, "FIRST_LEVEL_MACRO_CLASSES", {
 	enumerable: true,
 	get: function() {
@@ -53271,6 +54604,12 @@ Object.defineProperty(exports, "NC_SNOOZE_MAX_MINUTES", {
 		return NC_SNOOZE_MAX_MINUTES;
 	}
 });
+Object.defineProperty(exports, "NC_SYSTEM_EVENT_KIND_GROUP_SPECS", {
+	enumerable: true,
+	get: function() {
+		return NC_SYSTEM_EVENT_KIND_GROUP_SPECS;
+	}
+});
 Object.defineProperty(exports, "NC_TANK_SYSTEM_EVENT_KINDS", {
 	enumerable: true,
 	get: function() {
@@ -53421,6 +54760,12 @@ Object.defineProperty(exports, "RECORDING_SOURCE_CAMSTACK_ADDON", {
 		return RECORDING_SOURCE_CAMSTACK_ADDON;
 	}
 });
+Object.defineProperty(exports, "RebuildObjectEmbeddingsRefusalSchema", {
+	enumerable: true,
+	get: function() {
+		return RebuildObjectEmbeddingsRefusalSchema;
+	}
+});
 Object.defineProperty(exports, "RetrainStatusSchema", {
 	enumerable: true,
 	get: function() {
@@ -53595,6 +54940,12 @@ Object.defineProperty(exports, "deriveRecordingMode", {
 		return deriveRecordingMode;
 	}
 });
+Object.defineProperty(exports, "describeSystemEventDeliveryProblem", {
+	enumerable: true,
+	get: function() {
+		return describeSystemEventDeliveryProblem;
+	}
+});
 Object.defineProperty(exports, "describeSystemEventFamilyProblem", {
 	enumerable: true,
 	get: function() {
@@ -53613,6 +54964,30 @@ Object.defineProperty(exports, "embeddingEncoderCapability", {
 		return embeddingEncoderCapability;
 	}
 });
+Object.defineProperty(exports, "embeddingModelFailedError", {
+	enumerable: true,
+	get: function() {
+		return embeddingModelFailedError;
+	}
+});
+Object.defineProperty(exports, "embeddingRefusalOf", {
+	enumerable: true,
+	get: function() {
+		return embeddingRefusalOf;
+	}
+});
+Object.defineProperty(exports, "embeddingRequirementsFailedError", {
+	enumerable: true,
+	get: function() {
+		return embeddingRequirementsFailedError;
+	}
+});
+Object.defineProperty(exports, "embeddingRequirementsUnavailableError", {
+	enumerable: true,
+	get: function() {
+		return embeddingRequirementsUnavailableError;
+	}
+});
 Object.defineProperty(exports, "encodeVectorBase64", {
 	enumerable: true,
 	get: function() {
@@ -53649,12 +55024,6 @@ Object.defineProperty(exports, "failureContributionCapability", {
 		return failureContributionCapability;
 	}
 });
-Object.defineProperty(exports, "hfModelUrl", {
-	enumerable: true,
-	get: function() {
-		return hfModelUrl;
-	}
-});
 Object.defineProperty(exports, "hydrateSchema", {
 	enumerable: true,
 	get: function() {
@@ -53709,6 +55078,18 @@ Object.defineProperty(exports, "isSystemDelivery", {
 		return isSystemDelivery;
 	}
 });
+Object.defineProperty(exports, "isSystemEventSummaryRule", {
+	enumerable: true,
+	get: function() {
+		return isSystemEventSummaryRule;
+	}
+});
+Object.defineProperty(exports, "isVectorIndexDimConflict", {
+	enumerable: true,
+	get: function() {
+		return isVectorIndexDimConflict;
+	}
+});
 Object.defineProperty(exports, "kebabToCamel", {
 	enumerable: true,
 	get: function() {
@@ -53733,6 +55114,12 @@ Object.defineProperty(exports, "nodePin", {
 		return nodePin;
 	}
 });
+Object.defineProperty(exports, "normalizeNodeId", {
+	enumerable: true,
+	get: function() {
+		return normalizeNodeId;
+	}
+});
 Object.defineProperty(exports, "notificationRulesCapability", {
 	enumerable: true,
 	get: function() {
@@ -53769,12 +55156,6 @@ Object.defineProperty(exports, "partialRecord", {
 		return partialRecord;
 	}
 });
-Object.defineProperty(exports, "pickClusterStepModels", {
-	enumerable: true,
-	get: function() {
-		return pickClusterStepModels;
-	}
-});
 Object.defineProperty(exports, "pipelineAnalyticsCapability", {
 	enumerable: true,
 	get: function() {
@@ -53787,6 +55168,12 @@ Object.defineProperty(exports, "plateGalleryCapability", {
 		return plateGalleryCapability;
 	}
 });
+Object.defineProperty(exports, "readClusterModelPinStrict", {
+	enumerable: true,
+	get: function() {
+		return readClusterModelPinStrict;
+	}
+});
 Object.defineProperty(exports, "readDeviceStateFrom", {
 	enumerable: true,
 	get: function() {
@@ -53805,6 +55192,18 @@ Object.defineProperty(exports, "record", {
 		return record;
 	}
 });
+Object.defineProperty(exports, "resolveClipSearchMinScore", {
+	enumerable: true,
+	get: function() {
+		return resolveClipSearchMinScore;
+	}
+});
+Object.defineProperty(exports, "resolveClusterModelPin", {
+	enumerable: true,
+	get: function() {
+		return resolveClusterModelPin;
+	}
+});
 Object.defineProperty(exports, "resolveLocationMode", {
 	enumerable: true,
 	get: function() {
@@ -53865,6 +55264,12 @@ Object.defineProperty(exports, "subKindsOf", {
 		return subKindsOf;
 	}
 });
+Object.defineProperty(exports, "systemEventDeliveryProblems", {
+	enumerable: true,
+	get: function() {
+		return systemEventDeliveryProblems;
+	}
+});
 Object.defineProperty(exports, "systemEventFamilyProblems", {
 	enumerable: true,
 	get: function() {
@@ -53877,6 +55282,18 @@ Object.defineProperty(exports, "systemEventFilterApplies", {
 		return systemEventFilterApplies;
 	}
 });
+Object.defineProperty(exports, "systemEventSummaryScheduleOf", {
+	enumerable: true,
+	get: function() {
+		return systemEventSummaryScheduleOf;
+	}
+});
+Object.defineProperty(exports, "templateCarriesSummary", {
+	enumerable: true,
+	get: function() {
+		return templateCarriesSummary;
+	}
+});
 Object.defineProperty(exports, "templateVarsFor", {
 	enumerable: true,
 	get: function() {