@camstack/addon-post-analysis 1.2.284 → 1.2.286

package/dist/{dist-C770IfQJ.mjs → clip-model-registry-D4mC2M7F.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DU7mu4wb.mjs
+//#region ../types/dist/sleep-BXv0ZcRa.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6145,6 +6145,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -7440,7 +7474,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 * can answer "may a rule actuate this?" without importing the schema barrel
 * (~144MB RSS per runner, D28).
 *
-* Coverage: 87 device-scoped capabilities.
+* Coverage: 88 device-scoped capabilities.
 */
 var DEVICE_SCOPED_CAPS = new Set([
 	"accessories",
@@ -7470,6 +7504,7 @@ var DEVICE_SCOPED_CAPS = new Set([
 	"detection-pipeline",
 	"device-admin-link",
 	"device-discovery",
+	"device-extension",
 	"device-ops",
 	"device-status",
 	"doorbell",
@@ -9996,6 +10031,60 @@ var FailureCounters = class {
 		this.counters.clear();
 	}
 };
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
+var CLIP_STRICTNESS_FACTOR = {
+	loose: 1,
+	balanced: 1.25,
+	strict: 1.5
+};
+/**
+* The cosine floor a search runs with.
+*
+* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
+* and silently rescaling it would make the same URL mean different things on
+* two installs. Everything else is relative to the model.
+*/
+function resolveClipSearchMinScore(meta, request) {
+	if (request.minScore !== void 0) return request.minScore;
+	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
+	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
+}
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10024,7 +10113,7 @@ var ModelFormatEntrySchema = object({
 	/** Multi-file payload (directory members or sibling files). */
 	files: array(string()).readonly().optional(),
 	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["node", "python"])).readonly().optional()
+	runtimes: array(_enum(["python"])).readonly().optional()
 });
 /**
 * Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
@@ -10199,7 +10288,14 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -14649,6 +14745,13 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*/
+var LinkedDevicesSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+DeviceType.Camera;
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -15174,11 +15277,128 @@ var EmbeddingResultSchema = object({
 	embedding: array(number()),
 	inferenceMs: number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = _enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	crashes: number(),
+	windowMs: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	attempts: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
 var EmbeddingInfoSchema = object({
 	modelId: string(),
 	embeddingDim: number(),
-	ready: boolean()
-});
+	ready: boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+var EmbeddingRefusalCodeSchema = _enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+function embeddingRefusalToken(code, on) {
+	return `[${code} model=${on.modelId} tower=${on.tower} node=${on.nodeId}]`;
+}
+/** The encoder's refusal for a crashed tower, carrying {@link EMBEDDING_MODEL_FAILED}. */
+function embeddingModelFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_MODEL_FAILED, row)} ${row.modelId} (${row.tower} tower) crashed ${String(row.crashes)} times in ${String(Math.round(row.windowMs / 1e3))}s on ${row.nodeId} — ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+/** The requirements refusal for THIS request, carrying {@link EMBEDDING_REQUIREMENTS_UNAVAILABLE}. */
+function embeddingRequirementsUnavailableError(on, reason) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_UNAVAILABLE, on)} ${on.modelId} (${on.tower} tower) on ${on.nodeId}: ${reason}`);
+}
+/** The terminal requirements refusal, carrying {@link EMBEDDING_REQUIREMENTS_FAILED}. */
+function embeddingRequirementsFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_FAILED, row)} ${row.modelId} (${row.tower} tower) on ${row.nodeId}: requirements can never be met — ${String(row.attempts)} attempts, last: ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+var EMBEDDING_REFUSAL_TOKEN = new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
+/** The refusal `err` (possibly re-wrapped by a transport) carries, or `null` for any other error. */
+function embeddingRefusalOf(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	const match = EMBEDDING_REFUSAL_TOKEN.exec(message);
+	if (match === null) return null;
+	const code = EmbeddingRefusalCodeSchema.safeParse(match[1]);
+	const tower = EmbeddingTowerSchema.safeParse(match[3]);
+	if (!code.success || !tower.success || match[2] === void 0 || match[4] === void 0) return null;
+	return {
+		code: code.data,
+		modelId: match[2],
+		tower: tower.data,
+		nodeId: match[4]
+	};
+}
+/**
+* ONE provider per node (`placement: any-node`), addressed like every global
+* collection: the codegen injects a `{ nodeId?, addonId? }` selector on the
+* void methods and lifts a top-level `nodeId` off the object ones. A call
+* that names no node is answered by the HUB's provider — never by a merge
+* across nodes, because no global collection fans out across nodes (only the
+* providers of one node are `concatCollection`-fanned). So a fleet view of
+* `failedModels` is one `getInfo({ nodeId })` per node, and every answer
+* names the node it came from (D649 round 4); a node that cannot be asked is
+* UNKNOWN to the reader, never "no failures" (D315).
+*/
 var embeddingEncoderCapability = {
 	name: "embedding-encoder",
 	scope: "system",
@@ -15197,8 +15417,30 @@ var embeddingEncoderCapability = {
 			width: number(),
 			height: number()
 		}), EmbeddingResultSchema, { auth: "admin" }),
-		encodeText: method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }),
-		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" })
+		/**
+		* `modelId` (a CLIP IMAGE model id, whose catalog `clip.textModelId` names
+		* the text tower) encodes in that model's space; absent, the cluster row's
+		* `clip-embedding` model — the space every writer is in (D649).
+		*/
+		encodeText: method(object({
+			text: string(),
+			modelId: string().min(1).optional()
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		/** Answers for ONE node — the `nodeId` selector's, else the hub's. */
+		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" }),
+		/**
+		* The operator's explicit clear of the `failed` state (one model, or all)
+		* on ONE node — pass `nodeId` for an agent; the result names the node it
+		* cleared. The only way out besides a model change: a crashing tower is
+		* not retried on a timer.
+		*/
+		resetFailedModels: method(object({ modelId: string().min(1).optional() }), object({
+			cleared: array(string()),
+			nodeId: string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -18095,6 +18337,25 @@ var NcScheduleSchema = object({
 	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
 	invert: boolean().optional()
 });
+/**
+* How a system-event rule of the `device-events` or `system` family speaks
+* (D647): at once, per event (`instant`, the only behaviour before D647), or
+* as a STATE SUMMARY at the end of each window of `schedule`.
+*/
+var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
+/**
+* `summary`: the rule sends NOTHING per event. When a window of `schedule`
+* CLOSES, it sends one notification with the current state of its kinds
+* (low batteries, consumables to replace, devices offline, updates
+* available, ...), after its own filters. Nothing to report sends nothing.
+* The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
+* midnight crossing); the send time is each window's END. Refused on the
+* `alarm` family, which stays instant (`systemEventDeliveryProblems`).
+*/
+var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
+	mode: literal("summary"),
+	schedule: NcScheduleSchema
+})]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
 	/**
@@ -18708,7 +18969,12 @@ var NcMediaPolicySchema = object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
@@ -18830,6 +19096,16 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
+	/**
+	* A `device-events` / `system` rule's delivery (D647): absent or `instant`
+	* is a notification per event; `summary` is one state summary per closed
+	* window of its schedule. `.optional()` and never defaulted: absent must
+	* keep meaning what every rule authored before D647 meant, with no
+	* migration. Top-level rather than inside `conditions.systemEvent`, so a
+	* client that does not know it (an older viewer re-sending `conditions`
+	* whole) leaves it standing through the store's patch merge.
+	*/
+	systemEventDelivery: NcSystemEventDeliverySchema.optional(),
 	/** May be empty when `targetUsers` addresses at least one user — the
 	*  "at least one addressee" invariant is enforced by the provider, because
 	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
@@ -19058,6 +19334,28 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	*/
 	disabledTargetIds: array(string()).default([])
 });
+/** One section of a previewed state summary. `unavailable` = its state could not be read. */
+var NcStateSummaryPreviewSectionSchema = object({
+	id: string(),
+	status: _enum(["read", "unavailable"]),
+	items: number().int().nonnegative(),
+	reason: string().optional()
+});
+/**
+* The summary a rule would send now. `empty` = nothing to report and every
+* section read: such a summary is NOT sent. `dropped` counts the open states
+* the rule's own filters (or a camera mute) left out, by reason.
+* `excludedGroups` names the kind groups selected that have no state to report
+* (backups & exports).
+*/
+var NcStateSummaryPreviewSchema = object({
+	empty: boolean(),
+	count: number().int().nonnegative(),
+	text: string(),
+	sections: array(NcStateSummaryPreviewSectionSchema),
+	dropped: record(string(), number().int().nonnegative()),
+	excludedGroups: array(string())
+});
 var NcTestResultSchema = object({
 	recordId: string(),
 	recordKind: _enum([
@@ -19149,6 +19447,13 @@ var NcTemplateVarDescriptorSchema = object({
 	kinds: array(NcTemplateVarKindSchema).optional(),
 	deliveries: array(NcDeliverySchema).optional(),
 	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	/**
+	* Which system-event DELIVERY has a value for it (D647). Absent = an
+	* instant row only when the descriptor names `systemEventKinds` (a
+	* per-event fact: a summary row has no single device), and both otherwise.
+	* `['summary']` marks the state-summary vocabulary (`{{summaryText}}`, ...).
+	*/
+	systemEventDeliveries: array(NcSystemEventDeliveryModeSchema).optional(),
 	dynamic: object({
 		prefix: literal("count_"),
 		from: literal("classes")
@@ -19161,7 +19466,9 @@ var NcTemplatePreviewInputSchema = object({
 		field: NcTemplateFieldSchema,
 		kind: NcRuleKindSchema.optional(),
 		delivery: NcDeliverySchema.optional(),
-		systemEventKinds: array(NcSystemEventKindSchema).optional()
+		systemEventKinds: array(NcSystemEventKindSchema).optional(),
+		/** The rule's system-event delivery (D647); absent = instant. */
+		systemEventDelivery: NcSystemEventDeliveryModeSchema.optional()
 	}),
 	template: object({
 		title: string().max(500).optional(),
@@ -20295,6 +20602,17 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* The STATE SUMMARY a system rule would send now (D647) — for a saved rule
+		* or an unsaved draft. Pure: sends nothing, stamps nothing. A MUTATION
+		* only for transport (a whole rule does not belong in a GET URL). Admin,
+		* like `testRule`: it names devices and nodes across the installation.
+		*/
+		previewStateSummary: method(object({ rule: NcRuleInputSchema }), NcStateSummaryPreviewSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "view"
+		}),
+		/**
 		* The machine-readable condition surface a rule editor renders from, plus
 		* the picker VOCABULARY those conditions draw on.
 		*
@@ -20739,786 +21057,342 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* Reference to the frame's retained NATIVE surface + the parent crop's placement
-* within the frame, so the executor can re-cut a leaf child ROI at native
-* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
 */
-var NativeCropRefSchema = object({
-	/** Handle keying the retained native surface (node-pinned to its owner). */
-	handle: FrameHandleSchema,
-	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-	cropFrameSpace: object({
-		x: number(),
-		y: number(),
-		w: number(),
-		h: number()
-	})
-});
-object({
-	crop: object({
-		left: number(),
-		top: number(),
-		width: number().positive(),
-		height: number().positive()
-	}).optional(),
-	content: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}),
-	fit: _enum(["stretch", "contain"]),
-	format: _enum([
-		"rgb",
-		"gray",
-		"jpeg"
-	])
-});
 /**
-* Process-local frame identity. It is serializable so it can ride an in-process
-* capability call, but `registryId` deliberately prevents resolution in any
-* other process or execution group.
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
 */
-var FrameRefSchema = object({
-	registryId: string().min(1),
-	id: string().min(1),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum(["rgb", "gray"]),
-	timestamp: number(),
-	capturedAt: number().optional()
-});
-var ModelFormatSchema$1 = _enum([
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+/**
+* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
+* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
+*/
+var CLUSTER_MODEL_SCOPED_STEPS = [{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}];
+/**
+* The settings key holding one step's cluster model choice.
+*
+* Step-qualified so the keys stay unique across the addon's whole schema, which
+* is what lets {@link pickClusterStepModels} walk every section instead of
+* trusting the section id.
+*/
+function clusterModelSettingKey(stepId) {
+	return `clusterModel:${stepId}`;
+}
+/** The cluster row when nobody has configured one — today's catalog defaults. */
+var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
+function interpretStoredClusterModel(raw) {
+	if (raw === void 0 || raw === null || raw === "") return { kind: "absent" };
+	if (typeof raw === "string") return {
+		kind: "chosen",
+		modelId: raw
+	};
+	return {
+		kind: "invalid",
+		value: raw
+	};
+}
+/**
+* Narrow a FLAT settings record to the cluster row.
+*
+* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
+* junk face model must not also discard a valid clip model. An `absent` or
+* `invalid` value ({@link interpretStoredClusterModel}) resolves to the step's
+* catalog default — never to a blank id, because a blank id downstream becomes
+* "substitute the format default", which is precisely the substitution this
+* scope exists to forbid.
+*/
+function readClusterStepModels(config) {
+	const out = {};
+	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
+		const read = interpretStoredClusterModel(config[clusterModelSettingKey(step.stepId)]);
+		out[step.stepId] = read.kind === "chosen" ? read.modelId : step.defaultModelId;
+	}
+	return out;
+}
+function isHydratedField$2(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+/**
+* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) is the defaults.
+*/
+function pickClusterStepModels(view) {
+	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
+	return readClusterStepModels(flattenHydratedView(view, clusterModelKeys()));
+}
+function clusterModelKeys() {
+	return new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
+}
+/** The `wanted` keys of a hydrated view as one flat record, every section walked. */
+function flattenHydratedView(view, wanted) {
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+	}
+	return flat;
+}
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
+/**
+* pipeline-analytics — device-scoped wrapper cap. Refines raw
+* per-frame detections emitted by the pipeline runner into tracked
+* objects, per-kind event collections (motion / object / audio), and
+* persisted media. Owns the post-detection domain end-to-end:
+*
+*   runner emits PipelineInferenceResult
+*     ↓ (event bus)
+*   pipeline-analytics subscriber
+*     ↓ SORT tracker + zone engine + state analyzer + event emitter
+*   → three DB collections (one per kind), one FS media tree, one
+*     unified event emitter (FrameTracked + TrackStarted/Ended +
+*     DetectionEvent on bus)
+*
+* Pure subscriber model. No `processFrame` cap method — the runner
+* already publishes the raw frame on the bus. The cap surface is
+* only QUERIES + per-device settings, bound on/off via
+* `device-manager.setWrapperActive`. `defaultActive: true` because
+* every camera with a detection pipeline wants its raw detections
+* refined; operators opt out per-device via BindingsTab when needed.
+*
+* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
+* (per-device surface) and `track-trail` caps — see P11 cleanup.
+*/
+var TrackStateSchema = _enum([
+	"new",
+	"entered",
+	"left",
+	"moving",
+	"idle"
 ]);
-var PipelineSlotSchema = _enum([
-	"detector",
-	"cropper",
-	"classifier",
-	"refiner",
-	"audio-classifier"
+var EventKindSchema = _enum([
+	"motion",
+	"object",
+	"audio"
 ]);
-var PipelineEngineChoiceSchema = object({
-	runtime: _enum(["node", "python"]),
-	backend: string(),
-	format: ModelFormatSchema$1,
-	device: string().optional()
-});
-var AvailableEngineSchema = object({
-	engine: PipelineEngineChoiceSchema,
-	devices: array(object({
-		id: string(),
-		label: string(),
-		description: string().optional()
-	})).readonly(),
-	defaultDevice: string()
-});
-var PipelineDefaultStepSchema = lazy(() => object({
-	addonId: string(),
-	addonName: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineDefaultStepSchema).readonly(),
-	group: string().optional(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
+/**
+* Spatial filter for `listTracks` — the rect + polygon variants of the shared
+* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
+* of the camera frame (top-left origin), matching the drawing-plane editor.
+*/
+var TrackZoneFilterSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
+/** Closed icon vocabulary so clients render a known glyph per kind. */
+var EventKindIconSchema = _enum([
+	"motion",
+	"audio",
+	"person",
+	"vehicle",
+	"animal",
+	"door",
+	"pir",
+	"smoke",
+	"water",
+	"button",
+	"package",
+	"generic"
+]);
+var EventKindCategorySchema = _enum([
+	"motion",
+	"audio",
+	"detection",
+	"sensor",
+	"control",
+	"custom",
+	"package"
+]);
+/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
+var EventKindLevelSchema = _enum(["macro", "sub"]);
+var EventKindDescriptorSchema = object({
+	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
+	kind: string(),
+	/** i18n key resolved on the UI side; `label` is the English fallback. */
+	labelKey: string(),
+	/** English fallback label (kept for clients that don't translate). */
+	label: string(),
+	/** Hex color for timeline/legend rendering. */
+	color: string(),
+	/** Dictionary id → lucide component on the UI side. */
+	iconId: string(),
+	/** Legacy closed-vocab glyph — fallback for `iconId`. */
+	icon: EventKindIconSchema,
+	category: EventKindCategorySchema,
+	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+	parentKind: string().nullable(),
+	/** Derived from `parentKind`, explicit for the client tree. */
+	level: EventKindLevelSchema,
+	/** Which cap + device contributes this kind. For built-ins the camera
+	*  itself; for sensor kinds the LINKED source device. */
+	source: object({
+		capName: string(),
+		deviceId: number()
+	})
 });
-var PipelineModelOptionSchema = object({
-	id: string(),
-	name: string(),
-	formats: record(string(), object({
-		downloaded: boolean(),
-		sizeMB: number()
-	})),
-	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
+	deviceId: number(),
+	kinds: array(EventKindDescriptorSchema).readonly()
 });
-var ConfigFieldBridge = custom();
-var PipelineAddonSchemaSchema = object({
+var SensorEventSchema = object({
 	id: string(),
-	name: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	childSlots: array(PipelineSlotSchema).readonly(),
-	models: array(PipelineModelOptionSchema).readonly(),
-	defaultModelId: string(),
-	defaultModelIdByFormat: record(string(), string()).optional(),
-	enabledByDefault: boolean().optional(),
-	backfillIntoExistingOverrides: boolean().optional(),
-	defaultConfidence: number(),
-	group: string().optional(),
-	configSchema: array(ConfigFieldBridge).readonly().optional()
+	/** The CAMERA the event is attributed to (a sensor linked to N cameras
+	*  yields N rows, one per camera). */
+	deviceId: number(),
+	/** The linked sensor device whose state changed. */
+	sourceDeviceId: number(),
+	/** Event kind id — matches an `EventKindDescriptor.kind`. */
+	kind: string(),
+	/** Snapshot of the sensor cap's runtime-state slice at the change. */
+	value: record(string(), unknown()).nullable(),
+	timestamp: number()
 });
-var PipelineSlotSchemaSchema = object({
-	id: PipelineSlotSchema,
-	label: string(),
-	priority: number(),
-	parentSlot: PipelineSlotSchema.nullable(),
-	addons: array(PipelineAddonSchemaSchema).readonly()
+/**
+* One stored sighting on a track's trajectory.
+*
+* The array these live in is returned in TIME order (D399) — it is APPENDED in
+* arrival order, and the two detector passes interleave, so a consumer must not
+* assume the two are the same on a row written by an older build.
+*/
+var TrackPositionSchema = object({
+	x: number(),
+	y: number(),
+	timestamp: number(),
+	bbox: BoundingBoxSchema,
+	/**
+	* Which detector pass measured this box (D399): `frame` is the full-frame
+	* pass on the analysis raster, `recovery` is the native-resolution
+	* small-subject second pass (D377/D378). Both write into one array, and until
+	* this field existed the only way to tell them apart was that full-frame boxes
+	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
+	* Absent on rows written before D399.
+	*/
+	source: _enum(["frame", "recovery"]).optional(),
+	/** Detection score of this box, so a position can be weighed and not only
+	*  plotted. Absent on rows written before D399. */
+	score: number().optional()
 });
-var PipelineSchemaSchema = object({
-	availableEngines: array(AvailableEngineSchema).readonly(),
-	selectedEngine: PipelineEngineChoiceSchema,
-	slots: array(PipelineSlotSchemaSchema).readonly()
-});
-var EngineProvisioningSchema = object({
-	runtimeId: _enum([
-		"onnx",
-		"openvino",
-		"coreml",
-		"edgetpu"
-	]).nullable(),
-	device: string().nullable(),
-	state: _enum([
-		"idle",
-		"installing",
-		"verifying",
-		"ready",
-		"failed"
-	]),
-	progress: number().optional(),
-	error: string().optional(),
-	nextRetryAt: number().optional(),
-	/**
-	* Gate A (config-correctness gate at engine change): human-readable
-	* config issues surfaced EAGERLY when the node's engine changes — model
-	* substitutions ("chose X, running Y") and zero-build steps ("no model
-	* has a <format> build"). Additive/optional: informational only, never
-	* enforced here — `assertEngineReady` (readiness) still gates inference.
-	* Absent/empty when the node-default tree resolves cleanly.
-	*/
-	configIssues: array(string()).optional()
-});
-var PipelineStepInputSchema = lazy(() => object({
-	addonId: string(),
-	modelId: string().optional(),
-	enabled: boolean().default(true),
-	children: array(PipelineStepInputSchema).optional(),
-	settings: record(string(), unknown()).optional(),
-	jumpDeviceKey: string().optional()
-}));
-var ModelSubstitutionSchema = object({
-	addonId: string(),
-	chosen: string(),
-	running: string(),
-	format: string()
-});
-var PipelineValidationIssueSchema = object({
-	addonId: string(),
-	kind: _enum(["unknown-addon", "no-format-build"]),
-	detail: string()
-});
-var PipelineValidationResultSchema = object({
-	ok: boolean(),
-	issues: array(PipelineValidationIssueSchema).readonly(),
-	substitutions: array(ModelSubstitutionSchema).readonly(),
-	/** The node's `currentEngine.format` this validation ran against. */
-	format: string()
-});
-var ReferenceImageEntrySchema = object({
-	filename: string(),
-	stepIds: array(string()).readonly().optional()
-});
-var ReferenceImageBodySchema = object({
-	base64: string(),
-	filename: string()
-});
-var ReferenceAudioEntrySchema = object({
-	filename: string(),
-	sizeKb: number()
-});
-var ReferenceAudioBodySchema = object({ base64: string() });
-var AudioBackendSchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	available: boolean(),
-	/**
-	* Raw classifier labels this backend can emit (e.g. YAMNet's
-	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
-	* the benchmark UI to populate the `enabledMicroClasses` filter
-	* specific to the selected backend without a separate fetch.
-	*/
-	rawLabels: array(string()).readonly().optional()
-});
-var AudioCapabilitiesSchema = object({
-	activeBackend: string(),
-	availableBackends: array(AudioBackendSchema).readonly(),
-	sampleRate: number(),
-	chunkDurationMs: number()
-});
-var DownloadModelResultSchema = object({
-	filePath: string(),
-	sizeMB: number(),
-	durationMs: number()
-});
-/**
-* Wrapper carrying a single test run's result. Replaces the legacy
-* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
-* canonical `AudioResult` from the Phase 6 output rework: one
-* `AudioDetection` per class above `minScore`, top-N candidates in
-* `debug.alternateLabels['audio-classifier']`, per-source timings in
-* `debug.stepTimings`. The outer `success`/`error` fields stay so the
-* benchmark UI can still report a clean failure when the classifier
-* cap isn't available.
-*/
-var AudioTestResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	frame: custom().optional()
-});
-var PipelineConfigBridge = custom();
-var ConfigUISchemaBridge = custom();
-var ConfigUISchemaNullableBridge = custom();
-var InferenceCapabilitiesBridge = custom();
-var ModelAvailabilityListBridge = custom();
-var PipelineRunResultBridge = custom();
-method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-}))), method(object({ steps: record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-})) }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({
-	success: literal(true),
-	clearedDevices: number()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
-	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
-	deviceKey: string(),
-	/**
-	* `failed` — the per-device restart budget is exhausted; no pool
-	* will be spawned until an operator re-arms it or the runner
-	* respawns. `backoff` — under budget, waiting out the backoff (or
-	* a cached pool observed dead and not yet condemned).
-	*/
-	state: _enum(["failed", "backoff"]),
-	/** Epoch ms of the death that produced this state. */
-	since: number(),
-	/** Pool deaths inside the current window. */
-	deaths: number(),
-	/** The last death's message. */
-	lastError: string()
-})).readonly() })), method(object({
-	nodeId: string(),
-	deviceKey: string()
-}), object({ rearmed: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frame: FrameInputSchema.optional(),
-	/**
-	* Process-local lazy frame. Valid only when caller and provider resolve
-	* in the same execution-group process; split/cross-node callers use
-	* `frame`/`image` inline compatibility instead.
-	*/
-	frameRef: FrameRefSchema.optional(),
-	/**
-	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-	* the decoded pixels live in. One more member of the one-of
-	* frame/frameHandle/image/imageBase64/referenceImage group.
-	*/
-	frameHandle: FrameHandleSchema.optional(),
-	imageBase64: string().optional(),
-	/**
-	* Binary JPEG bytes — preferred over `imageBase64` on internal
-	* hops (hub → forked worker via Moleculer MsgPack) because it
-	* skips the 33% base64 overhead + the per-call base64 decode on
-	* the detection-pipeline worker. Callers can pass either; exactly
-	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-	*/
-	image: _instanceof(Uint8Array).optional(),
-	referenceImage: string().optional(),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Execution plane. 'full' (default) runs the whole tree — benchmark,
-	* reference-image, and detail-subtree calls. 'frame' is the live
-	* per-frame dispatch: ONLY root-plane steps run; crop children
-	* (inputClasses ≠ null) are skipped and served per-track via
-	* pipelineRunner.runDetailSubtree (two-plane design).
-	*/
-	plane: _enum(["full", "frame"]).optional(),
-	/**
-	* Inference-device selector (Phase 2 multi-device). Format
-	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-	* Omitted ⇒ the runner's default device (current single-engine
-	* behaviour). Selects WHICH device pool of the node runs the call.
-	*/
-	deviceKey: string().optional(),
-	/**
-	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-	* when the parent crop was resolved from the frame's retained NATIVE
-	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-	* resolution from that surface — the SAME quality path faces already
-	* had — instead of the downscaled parent tile. `handle` keys the native
-	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
-	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-	* the executor's crop-normalized child ROI back into frame-normalized
-	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-	* (today's behaviour on the fallback path).
-	*/
-	nativeCropRef: NativeCropRefSchema.optional()
-}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frames: array(FrameInputSchema).min(1).max(255),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-	* the batch to the Python pool's bench preprocess cache
-	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-	* preprocessed ONCE and every later inference is a pure-inference cache
-	* hit — the sustained-throughput run measures inference, not
-	* decode+preprocess+infer. Omitted/0 for live frames (all different →
-	* full preprocess every call, correct). Fresh per sustained run;
-	* released via `uncacheFrame`.
-	*/
-	frameId: number().int().nonnegative().optional(),
-	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-	deviceKey: string().optional()
-}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
-	data: _instanceof(Uint8Array),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum([
-		"rgb",
-		"bgr",
-		"gray"
-	])
-}), object({
-	frameId: number(),
-	width: number(),
-	height: number()
-}), { kind: "mutation" }), method(object({
-	stepId: string(),
-	frameId: number().int()
-}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(_void(), object({
-	batchMode: string(),
-	windowMs: number(),
-	maxBatchSize: number(),
-	concurrency: number()
-})), method(_void(), array(object({
-	engineKey: string(),
-	engine: PipelineEngineChoiceSchema,
-	modelsLoaded: array(string()).readonly(),
-	inUseByCameras: array(number()).readonly(),
-	/**
-	* Origin of this resident factory.
-	*  - `runtime`       — main camera-serving engine (no idle TTL).
-	*  - `warm-override` — benchmark/test override held in the warm
-	*                      cache; auto-disposed after the idle TTL.
-	*  - `device-pool`   — a concurrent per-device pool (Phase 2
-	*                      multi-device, keyed by `deviceKey`) resolved
-	*                      via `resolveDeviceFactory`. Runs alongside the
-	*                      `runtime` engine on a DIFFERENT accelerator
-	*                      (NPU / iGPU / Coral) — this is how the
-	*                      Engines tab shows all pools running at once.
-	*/
-	kind: _enum([
-		"runtime",
-		"warm-override",
-		"device-pool"
-	]),
-	/** Native pid of the underlying Python pool (null when no pool). */
-	poolPid: number().nullable(),
-	/** ms since this factory was last used (null when not warm-tracked). */
-	idleMs: number().nullable(),
-	/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-	idleTtlMs: number().nullable()
-})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	engine: PipelineEngineChoiceSchema,
-	force: boolean().optional()
-}), object({
-	success: boolean(),
-	reason: string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
-	addonId: string(),
-	modelId: string(),
-	filename: string().optional(),
-	settings: record(string(), unknown()).optional()
-}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
-/**
-* Per-stage gating mode applied to the zones a rule references.
-*
-* - `include`: the rule contributes to a **whitelist** for its stage.
-*   When at least one `include` rule fires for a stage, only entities
-*   inside one of those zones pass that stage.
-* - `exclude`: the rule contributes to a **blacklist** for its stage.
-*   Entities inside one of those zones are dropped at that stage.
-*
-* `monitor`-style observation (count without filtering) is not a rule
-* mode — zones without any matching rule are observed naturally by
-* `zone-analytics` (live snapshot + history), so an "I just want to
-* count, not filter" use case needs no rule at all.
-*/
-var ZoneRuleModeEnum = _enum(["include", "exclude"]);
-/**
-* Per-consumer rule that references existing zones (geometry) and
-* defines how a specific pipeline stage should treat them. Each
-* consumer addon owns its own `ZoneRule[]` array in its per-device
-* settings:
-*
-* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
-* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
-* - future: notification rules, audio gating, etc.
-*
-* One rule applies to N zones (`zoneIds[]`) so the operator can
-* express "ignore motion in ALL of {garden, street}" with a single
-* rule. `classFilter` narrows the rule to specific object classes —
-* "drop person detections in the street, but keep cars" is one
-* `exclude` rule with `classFilter: ['person']`.
-*
-* `enabled` is a soft toggle — the operator can keep the rule
-* configured but inert without deleting it.
-*/
-var ZoneRuleSchema = object({
-	/** Stable rule id — survives edits, used by the UI for diffing. */
-	id: string(),
-	/** Optional human-readable label rendered in the rule editor. */
-	name: string().optional(),
-	/** Zones this rule targets. The rule's `mode` applies to ALL
-	*  listed zones (OR-set: a detection in any one of them counts).
-	*  At least one zone id required — a rule with no targets is a
-	*  configuration mistake and the form validator rejects it. */
-	zoneIds: array(string()).min(1).readonly(),
-	mode: ZoneRuleModeEnum,
-	/**
-	* Class names this rule applies to. Empty / undefined ⇒ rule
-	* applies to every class. Class strings match the `macroClass`
-	* field on detections (e.g. `person`, `car`, `dog`).
-	*/
-	classFilter: array(string()).readonly().optional(),
-	/**
-	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
-	* required to consider an entity "in the zone". Defaults to the
-	* consumer's stage default when omitted. Kept for back-compat with
-	* existing per-rule overrides; new operators pick the value via
-	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-	* set, the lower-level engine reads it as a 0–1 fraction.
-	*/
-	overlapThreshold: number().min(0).max(1).optional(),
-	/**
-	* Operator-friendly version of `overlapThreshold` — the percentage
-	* of the detection's bbox that must lie inside the zone for the
-	* rule to match. Documented default is 85%; the engine substitutes
-	* that when the field is omitted (kept optional so existing rules
-	* stored without it stay valid).
-	*
-	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-	* rule, the engine prefers `bboxInclusionPct` because it's the
-	* field exposed in the UI. Internally both feed the same gate.
-	*/
-	bboxInclusionPct: number().min(0).max(100).optional(),
-	/**
-	* When `true` and a detection has a segmentation mask, use the
-	* mask for overlap instead of the bbox. Detection-stage only;
-	* motion rules ignore this field.
-	*/
-	preferMask: boolean().optional(),
-	/**
-	* Soft-toggle: `false` disables the rule without deleting it.
-	* Defaults to `true` so operators creating a rule via the UI
-	* see it active immediately.
-	*/
-	enabled: boolean().default(true)
-});
-array(ZoneRuleSchema).readonly();
-/**
-* Zone — pure geometry + identity. NO filtering behaviour.
-*
-* Zones describe **where** in the frame the operator wants to flag
-* something; consumer-owned {@link ZoneRule} arrays describe **how**
-* each pipeline stage uses them. Splitting the two means a single
-* polygon "Driveway" can simultaneously back a motion-exclude rule,
-* a detection-include rule on `['car']`, and an occupancy aggregate
-* — without three duplicated polygons.
-*
-* Owned by the orchestrator addon (provider) and mirrored into the
-* `zones` device-state slice on every mutation. Consumers
-* (motion-wasm, pipeline-executor, analytics, admin UI) read either
-* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
-* mirror with `onChanged`).
-*
-* Coordinates are normalised fractions of the frame (0–1) so zones
-* survive resolution changes and stream profile switches.
-*
-* `kind` discriminates between full polygons (closed regions used
-* for intrusion / occupancy filters) and tripwires (open 2-point
-* line segments used for cross events). Onboard / firmware-reported
-* zones (Reolink, ONVIF) are out of scope for now — see the deferred
-* task list.
-*/
-var ZoneKindEnum = _enum(["polygon", "tripwire"]);
-/** Polygon vertex in fraction-of-frame coordinates (0–1). */
-var PolygonPointSchema = object({
-	x: number(),
-	y: number()
-});
-/** A camera detection zone — pure geometry/identity. */
-var ZoneSchema = object({
-	id: string(),
-	name: string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: string().default("#3b82f6")
-});
-/**
-* Zones capability — per-camera CRUD over polygon detection zones.
-*
-* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
-* to per-device settings and mirrors into the `zones` device-state
-* slice on every mutation, so downstream consumers can subscribe via
-* `dev.state.zones.onChanged`.
-*
-* The cap surface only handles geometry + identity; filtering
-* behaviour (per-class, include/exclude, threshold) lives in the
-* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
-* `capabilities/schemas/zone-rule.js`.
-*/
-var zonesCapability = {
-	name: "zones",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
-		addZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		removeZone: method(object({
-			deviceId: number(),
-			zoneId: string()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		updateZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	/**
-	* Runtime-state slice — the live zone catalogue mirrored by the
-	* orchestrator on every CRUD mutation. Consumers read via
-	* `device.state.zones.value` / `.watch(...)` without round-tripping
-	* the cap, and the codegen DeviceProxy auto-wires the reactive
-	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
-	* (e.g. zone groupings) can sit alongside the polygon list.
-	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
-	/**
-	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
-* pipeline-analytics — device-scoped wrapper cap. Refines raw
-* per-frame detections emitted by the pipeline runner into tracked
-* objects, per-kind event collections (motion / object / audio), and
-* persisted media. Owns the post-detection domain end-to-end:
-*
-*   runner emits PipelineInferenceResult
-*     ↓ (event bus)
-*   pipeline-analytics subscriber
-*     ↓ SORT tracker + zone engine + state analyzer + event emitter
-*   → three DB collections (one per kind), one FS media tree, one
-*     unified event emitter (FrameTracked + TrackStarted/Ended +
-*     DetectionEvent on bus)
-*
-* Pure subscriber model. No `processFrame` cap method — the runner
-* already publishes the raw frame on the bus. The cap surface is
-* only QUERIES + per-device settings, bound on/off via
-* `device-manager.setWrapperActive`. `defaultActive: true` because
-* every camera with a detection pipeline wants its raw detections
-* refined; operators opt out per-device via BindingsTab when needed.
-*
-* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
-* (per-device surface) and `track-trail` caps — see P11 cleanup.
-*/
-var TrackStateSchema = _enum([
-	"new",
-	"entered",
-	"left",
-	"moving",
-	"idle"
-]);
-var EventKindSchema = _enum([
-	"motion",
-	"object",
-	"audio"
-]);
-/**
-* Spatial filter for `listTracks` — the rect + polygon variants of the shared
-* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
-* of the camera frame (top-left origin), matching the drawing-plane editor.
-*/
-var TrackZoneFilterSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
-/** Closed icon vocabulary so clients render a known glyph per kind. */
-var EventKindIconSchema = _enum([
-	"motion",
-	"audio",
-	"person",
-	"vehicle",
-	"animal",
-	"door",
-	"pir",
-	"smoke",
-	"water",
-	"button",
-	"package",
-	"generic"
-]);
-var EventKindCategorySchema = _enum([
-	"motion",
-	"audio",
-	"detection",
-	"sensor",
-	"control",
-	"custom",
-	"package"
-]);
-/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
-var EventKindLevelSchema = _enum(["macro", "sub"]);
-var EventKindDescriptorSchema = object({
-	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
-	kind: string(),
-	/** i18n key resolved on the UI side; `label` is the English fallback. */
-	labelKey: string(),
-	/** English fallback label (kept for clients that don't translate). */
-	label: string(),
-	/** Hex color for timeline/legend rendering. */
-	color: string(),
-	/** Dictionary id → lucide component on the UI side. */
-	iconId: string(),
-	/** Legacy closed-vocab glyph — fallback for `iconId`. */
-	icon: EventKindIconSchema,
-	category: EventKindCategorySchema,
-	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
-	parentKind: string().nullable(),
-	/** Derived from `parentKind`, explicit for the client tree. */
-	level: EventKindLevelSchema,
-	/** Which cap + device contributes this kind. For built-ins the camera
-	*  itself; for sensor kinds the LINKED source device. */
-	source: object({
-		capName: string(),
-		deviceId: number()
-	})
-});
-/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
-var EventKindsForDeviceSchema = object({
-	deviceId: number(),
-	kinds: array(EventKindDescriptorSchema).readonly()
-});
-var SensorEventSchema = object({
-	id: string(),
-	/** The CAMERA the event is attributed to (a sensor linked to N cameras
-	*  yields N rows, one per camera). */
-	deviceId: number(),
-	/** The linked sensor device whose state changed. */
-	sourceDeviceId: number(),
-	/** Event kind id — matches an `EventKindDescriptor.kind`. */
-	kind: string(),
-	/** Snapshot of the sensor cap's runtime-state slice at the change. */
-	value: record(string(), unknown()).nullable(),
-	timestamp: number()
-});
-/**
-* One stored sighting on a track's trajectory.
-*
-* The array these live in is returned in TIME order (D399) — it is APPENDED in
-* arrival order, and the two detector passes interleave, so a consumer must not
-* assume the two are the same on a row written by an older build.
-*/
-var TrackPositionSchema = object({
-	x: number(),
-	y: number(),
-	timestamp: number(),
-	bbox: BoundingBoxSchema,
-	/**
-	* Which detector pass measured this box (D399): `frame` is the full-frame
-	* pass on the analysis raster, `recovery` is the native-resolution
-	* small-subject second pass (D377/D378). Both write into one array, and until
-	* this field existed the only way to tell them apart was that full-frame boxes
-	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
-	* Absent on rows written before D399.
-	*/
-	source: _enum(["frame", "recovery"]).optional(),
-	/** Detection score of this box, so a position can be weighed and not only
-	*  plotted. Absent on rows written before D399. */
-	score: number().optional()
-});
-var TrackSnapshotSchema = object({
-	timestamp: number(),
-	position: TrackPositionSchema,
-	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
-	mediaId: number().int()
+var TrackSnapshotSchema = object({
+	timestamp: number(),
+	position: TrackPositionSchema,
+	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+	mediaId: number().int()
 });
 /**
 * Normalized 0..1 trajectory envelope (min/max over every position bbox,
@@ -21949,6 +21823,22 @@ var TrackSchema = object({
 	* omit it. Render nothing when absent.
 	*/
 	previewMissReason: string().optional(),
+	/**
+	* The ROOT model that produced this track — the `FrameResult.rootModelId` of
+	* the frame it was BORN on (D646). What a later replay compares against, so
+	* "the original model" is named rather than assumed. A birth fact: never
+	* rewritten by a later frame. **Absent ≠ unknown-model**: a row from before
+	* the column, and a track the camera's own detector produced, carry none.
+	*/
+	modelId: string().optional(),
+	/**
+	* Size (px) of the detection frame this track's `positions[].bbox` live in —
+	* the frame it was born on, else the camera's latest analysis frame at
+	* persist time. Divide a position by these to normalise it. Absent when the
+	* size was never known.
+	*/
+	frameWidth: number().optional(),
+	frameHeight: number().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -22178,7 +22068,8 @@ var MediaFileKindEnum = _enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -22730,7 +22621,23 @@ var SearchObjectEventsInput = object({
 	until: number().optional(),
 	classFilter: string().optional(),
 	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: string().min(1).optional()
 });
 var TrackCascadeCountsSchema = object({
 	/** Persisted track roots deleted (authoritative). */
@@ -22865,7 +22772,41 @@ var RebuildObjectEmbeddingsInput = object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var WipeObjectEmbeddingsResultSchema = object({
+	deleted: number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: array(string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = _enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -22878,7 +22819,12 @@ var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
 var RebuildObjectEmbeddingsResultSchema = object({
 	started: boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
+	alreadyRunning: boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: string().optional(),
+	index: string().optional()
 });
 var RebuildStatusSchema = object({
 	running: boolean(),
@@ -22912,7 +22858,11 @@ var RebuildStatusSchema = object({
 	startedAtMs: number().nullable(),
 	finishedAtMs: number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	error: string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -22955,24 +22905,6 @@ var MediaReclaimStatusSchema = object({
 	finishedAtMs: number().nullable(),
 	error: string().nullable()
 });
-var ReplayFrameInputSchema = object({
-	timestamp: number(),
-	frame: PipelineRunResultBridge
-});
-var RunReplayFrameProcessorResultSchema = object({ tracks: array(object({
-	className: string(),
-	firstSeenMs: number(),
-	lastSeenMs: number(),
-	/** Bbox of the track's FIRST matched detection, pixel-space in the clip's
-	*  frame — a representative box for the diff's `(className, window, IoU)`
-	*  pairing (`replay-diff.ts`). A replay does not need the full per-frame
-	*  trajectory production's `Track.positions` keeps. */
-	bbox: BoundingBoxSchema,
-	/** How many of the input frames this track matched a real detection on
-	*  (never a coasted/extrapolated frame) — the replay's own signal for "how
-	*  solid is this track", cheaper than re-deriving it from a trajectory. */
-	framesMatched: number().int()
-})).readonly() });
 /**
 * The long-term series a camera produces. A closed union so a typo cannot
 * invent one, and the ONE declaration of it — the addon's `AnalyticsLtsSeries`
@@ -23699,32 +23631,6 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/**
-		* The FrameProcessor pass of a replay run — see the `Replay` section
-		* above this capability's definition for why this is not the
-		* `processFrame` method this file's header says pipeline-analytics does
-		* not have.
-		*
-		* Constructs a FRESH `FrameProcessor` for `(deviceId, source)`, feeds it
-		* `frames` IN THE ORDER GIVEN (the caller is responsible for time
-		* ordering — this method does not sort), and returns the tracks it
-		* produced. Zero persistence: no `TrackStore`, no event bus, no media
-		* capture. `zones` / `detectionRules` are the run's OWN zone set —
-		* typically the camera's real zones plus an ephemeral overlay
-		* (`addon-benchmark`'s `replay-plan.ts`), never read from or written to
-		* the `zones` capability by this method itself.
-		*/
-		runReplayFrameProcessor: method(object({
-			deviceId: number(),
-			source: DetectionSourceSchema,
-			zones: array(ZoneSchema).readonly().optional(),
-			detectionRules: array(ZoneRuleSchema).readonly().optional(),
-			zoneMembershipMinOverlap: number().min(0).max(1).optional(),
-			frames: array(ReplayFrameInputSchema).min(1)
-		}), RunReplayFrameProcessorResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Every annotation on a track, oldest first. */
 		listRetrainAnnotations: method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
 			kind: "query",
@@ -23915,7 +23821,7 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()),
+		searchObjectEvents: method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly(), { caller: "required" }),
 		wipeObjectEmbeddings: method(object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -23964,6 +23870,478 @@ var pipelineAnalyticsCapability = {
 		}) }
 	}
 };
+/**
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+*/
+var NativeCropRefSchema = object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
+	})
+});
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
+var ModelFormatSchema$1 = _enum([
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+]);
+var PipelineSlotSchema = _enum([
+	"detector",
+	"cropper",
+	"classifier",
+	"refiner",
+	"audio-classifier"
+]);
+var PipelineEngineChoiceSchema = object({
+	runtime: literal("python"),
+	backend: string(),
+	format: ModelFormatSchema$1,
+	device: string().optional()
+});
+/**
+* One pool's resolved provisioning (`getEffectiveTuning`). `numWorkers` is the
+* knob that lifts a saturated pool (`inference-devices.md`); `concurrency` is
+* per-worker in-flight requests. `deviceKey` echoes the pool asked about —
+* `null` for the node-default pool.
+*/
+var EffectiveTuningSchema = object({
+	deviceKey: string().nullable(),
+	runtime: string(),
+	batchMode: string(),
+	windowMs: number(),
+	maxBatchSize: number(),
+	concurrency: number(),
+	numWorkers: number()
+});
+var AvailableEngineSchema = object({
+	engine: PipelineEngineChoiceSchema,
+	devices: array(object({
+		id: string(),
+		label: string(),
+		description: string().optional()
+	})).readonly(),
+	defaultDevice: string()
+});
+var PipelineDefaultStepSchema = lazy(() => object({
+	addonId: string(),
+	addonName: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineDefaultStepSchema).readonly(),
+	group: string().optional(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateStepSchema = lazy(() => object({
+	addonId: string(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineTemplateStepSchema).readonly(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = object({
+	id: string(),
+	name: string(),
+	createdAt: string(),
+	updatedAt: string(),
+	engine: PipelineEngineChoiceSchema,
+	steps: array(PipelineTemplateStepSchema).readonly()
+});
+var PipelineModelOptionSchema = object({
+	id: string(),
+	name: string(),
+	formats: record(string(), object({
+		downloaded: boolean(),
+		sizeMB: number()
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
+});
+var ConfigFieldBridge = custom();
+var PipelineAddonSchemaSchema = object({
+	id: string(),
+	name: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	childSlots: array(PipelineSlotSchema).readonly(),
+	models: array(PipelineModelOptionSchema).readonly(),
+	defaultModelId: string(),
+	defaultModelIdByFormat: record(string(), string()).optional(),
+	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
+	defaultConfidence: number(),
+	group: string().optional(),
+	configSchema: array(ConfigFieldBridge).readonly().optional()
+});
+var PipelineSlotSchemaSchema = object({
+	id: PipelineSlotSchema,
+	label: string(),
+	priority: number(),
+	parentSlot: PipelineSlotSchema.nullable(),
+	addons: array(PipelineAddonSchemaSchema).readonly()
+});
+var PipelineSchemaSchema = object({
+	availableEngines: array(AvailableEngineSchema).readonly(),
+	selectedEngine: PipelineEngineChoiceSchema,
+	slots: array(PipelineSlotSchemaSchema).readonly()
+});
+var EngineProvisioningSchema = object({
+	runtimeId: _enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"edgetpu"
+	]).nullable(),
+	device: string().nullable(),
+	state: _enum([
+		"idle",
+		"installing",
+		"verifying",
+		"ready",
+		"failed"
+	]),
+	progress: number().optional(),
+	error: string().optional(),
+	nextRetryAt: number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: array(string()).optional()
+});
+var PipelineStepInputSchema = lazy(() => object({
+	addonId: string(),
+	modelId: string().optional(),
+	enabled: boolean().default(true),
+	children: array(PipelineStepInputSchema).optional(),
+	settings: record(string(), unknown()).optional(),
+	jumpDeviceKey: string().optional()
+}));
+var ModelSubstitutionSchema = object({
+	addonId: string(),
+	chosen: string(),
+	running: string(),
+	format: string()
+});
+var PipelineValidationIssueSchema = object({
+	addonId: string(),
+	kind: _enum([
+		"unknown-addon",
+		"no-format-build",
+		"unknown-device"
+	]),
+	detail: string()
+});
+var PipelineValidationResultSchema = object({
+	ok: boolean(),
+	issues: array(PipelineValidationIssueSchema).readonly(),
+	substitutions: array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: string()
+});
+var ReferenceImageEntrySchema = object({
+	filename: string(),
+	stepIds: array(string()).readonly().optional()
+});
+var ReferenceImageBodySchema = object({
+	base64: string(),
+	filename: string()
+});
+var ReferenceAudioEntrySchema = object({
+	filename: string(),
+	sizeKb: number()
+});
+var ReferenceAudioBodySchema = object({ base64: string() });
+var AudioBackendSchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	available: boolean(),
+	/**
+	* Raw classifier labels this backend can emit (e.g. YAMNet's
+	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
+	* the benchmark UI to populate the `enabledMicroClasses` filter
+	* specific to the selected backend without a separate fetch.
+	*/
+	rawLabels: array(string()).readonly().optional()
+});
+var AudioCapabilitiesSchema = object({
+	activeBackend: string(),
+	availableBackends: array(AudioBackendSchema).readonly(),
+	sampleRate: number(),
+	chunkDurationMs: number()
+});
+var DownloadModelResultSchema = object({
+	filePath: string(),
+	sizeMB: number(),
+	durationMs: number()
+});
+/**
+* Wrapper carrying a single test run's result. Replaces the legacy
+* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
+* canonical `AudioResult` from the Phase 6 output rework: one
+* `AudioDetection` per class above `minScore`, top-N candidates in
+* `debug.alternateLabels['audio-classifier']`, per-source timings in
+* `debug.stepTimings`. The outer `success`/`error` fields stay so the
+* benchmark UI can still report a clean failure when the classifier
+* cap isn't available.
+*/
+var AudioTestResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	frame: custom().optional()
+});
+var PipelineConfigBridge = custom();
+var ConfigUISchemaBridge = custom();
+var ConfigUISchemaNullableBridge = custom();
+var InferenceCapabilitiesBridge = custom();
+var ModelAvailabilityListBridge = custom();
+var PipelineRunResultBridge = custom();
+method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+}))), method(object({ steps: record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+})) }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({
+	success: literal(true),
+	clearedDevices: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
+	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
+	deviceKey: string(),
+	/**
+	* `failed` — the per-device restart budget is exhausted; no pool
+	* will be spawned until an operator re-arms it or the runner
+	* respawns. `backoff` — under budget, waiting out the backoff (or
+	* a cached pool observed dead and not yet condemned).
+	*/
+	state: _enum(["failed", "backoff"]),
+	/** Epoch ms of the death that produced this state. */
+	since: number(),
+	/** Pool deaths inside the current window. */
+	deaths: number(),
+	/** The last death's message. */
+	lastError: string()
+})).readonly() })), method(object({
+	nodeId: string(),
+	deviceKey: string()
+}), object({ rearmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({
+	steps: array(PipelineStepInputSchema),
+	deviceKey: string().optional()
+}), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
+	name: string(),
+	steps: array(PipelineTemplateStepSchema).readonly(),
+	engine: PipelineEngineChoiceSchema
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
+	id: string(),
+	name: string().optional(),
+	steps: array(PipelineTemplateStepSchema).readonly().optional()
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frame: FrameInputSchema.optional(),
+	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
+	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+	* the decoded pixels live in. One more member of the one-of
+	* frame/frameHandle/image/imageBase64/referenceImage group.
+	*/
+	frameHandle: FrameHandleSchema.optional(),
+	imageBase64: string().optional(),
+	/**
+	* Binary JPEG bytes — preferred over `imageBase64` on internal
+	* hops (hub → forked worker via Moleculer MsgPack) because it
+	* skips the 33% base64 overhead + the per-call base64 decode on
+	* the detection-pipeline worker. Callers can pass either; exactly
+	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
+	*/
+	image: _instanceof(Uint8Array).optional(),
+	referenceImage: string().optional(),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Execution plane. 'full' (default) runs the whole tree — benchmark,
+	* reference-image, and detail-subtree calls. 'frame' is the live
+	* per-frame dispatch: ONLY root-plane steps run; crop children
+	* (inputClasses ≠ null) are skipped and served per-track via
+	* pipelineRunner.runDetailSubtree (two-plane design).
+	*/
+	plane: _enum(["full", "frame"]).optional(),
+	/**
+	* Inference-device selector (Phase 2 multi-device). Format
+	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+	* Omitted ⇒ the runner's default device (current single-engine
+	* behaviour). Selects WHICH device pool of the node runs the call.
+	*/
+	deviceKey: string().optional(),
+	/**
+	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+	* when the parent crop was resolved from the frame's retained NATIVE
+	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+	* resolution from that surface — the SAME quality path faces already
+	* had — instead of the downscaled parent tile. `handle` keys the native
+	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+	* the executor's crop-normalized child ROI back into frame-normalized
+	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+	* (today's behaviour on the fallback path).
+	*/
+	nativeCropRef: NativeCropRefSchema.optional(),
+	/**
+	* Offline REPLAY of stored media for `deviceId` (D56, D646): the
+	* camera's zone gate and overrides apply as live, every executing
+	* step runs EXACTLY the model it names on the `deviceKey` pool it
+	* names or the call refuses (`model-not-servable` /
+	* `device-not-servable`), and nothing reaches the camera's live
+	* trace stream. Absent ⇒ unchanged behaviour.
+	*/
+	replay: literal(true).optional()
+}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frames: array(FrameInputSchema).min(1).max(255),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+	* the batch to the Python pool's bench preprocess cache
+	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+	* preprocessed ONCE and every later inference is a pure-inference cache
+	* hit — the sustained-throughput run measures inference, not
+	* decode+preprocess+infer. Omitted/0 for live frames (all different →
+	* full preprocess every call, correct). Fresh per sustained run;
+	* released via `uncacheFrame`.
+	*/
+	frameId: number().int().nonnegative().optional(),
+	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+	deviceKey: string().optional()
+}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
+	data: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum([
+		"rgb",
+		"bgr",
+		"gray"
+	])
+}), object({
+	frameId: number(),
+	width: number(),
+	height: number()
+}), { kind: "mutation" }), method(object({
+	stepId: string(),
+	frameId: number().int()
+}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(object({ deviceKey: string().optional() }), EffectiveTuningSchema), method(_void(), array(object({
+	engineKey: string(),
+	engine: PipelineEngineChoiceSchema,
+	modelsLoaded: array(string()).readonly(),
+	inUseByCameras: array(number()).readonly(),
+	/**
+	* Origin of this resident factory.
+	*  - `runtime`       — main camera-serving engine (no idle TTL).
+	*  - `device-pool`   — a concurrent per-device pool (Phase 2
+	*                      multi-device, keyed by `deviceKey`) resolved
+	*                      via `resolveDeviceFactory`. Runs alongside the
+	*                      `runtime` engine on a DIFFERENT accelerator
+	*                      (NPU / iGPU / Coral) — this is how the
+	*                      Engines tab shows all pools running at once.
+	*/
+	kind: _enum(["runtime", "device-pool"]),
+	/** Native pid of the underlying Python pool (null when no pool). */
+	poolPid: number().nullable(),
+	/** ms since this factory was last used (null when not warm-tracked). */
+	idleMs: number().nullable(),
+	/** Idle TTL after which the factory self-evicts (null when not applicable). */
+	idleTtlMs: number().nullable()
+})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	engine: PipelineEngineChoiceSchema,
+	force: boolean().optional()
+}), object({
+	success: boolean(),
+	reason: string().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
+	addonId: string(),
+	modelId: string(),
+	filename: string().optional(),
+	settings: record(string(), unknown()).optional()
+}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -23989,6 +24367,106 @@ var CameraMetricsSchema = object({
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: number() });
 /**
+* Zone — pure geometry + identity. NO filtering behaviour.
+*
+* Zones describe **where** in the frame the operator wants to flag
+* something; consumer-owned {@link ZoneRule} arrays describe **how**
+* each pipeline stage uses them. Splitting the two means a single
+* polygon "Driveway" can simultaneously back a motion-exclude rule,
+* a detection-include rule on `['car']`, and an occupancy aggregate
+* — without three duplicated polygons.
+*
+* Owned by the orchestrator addon (provider) and mirrored into the
+* `zones` device-state slice on every mutation. Consumers
+* (motion-wasm, pipeline-executor, analytics, admin UI) read either
+* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
+* mirror with `onChanged`).
+*
+* Coordinates are normalised fractions of the frame (0–1) so zones
+* survive resolution changes and stream profile switches.
+*
+* `kind` discriminates between full polygons (closed regions used
+* for intrusion / occupancy filters) and tripwires (open 2-point
+* line segments used for cross events). Onboard / firmware-reported
+* zones (Reolink, ONVIF) are out of scope for now — see the deferred
+* task list.
+*/
+var ZoneKindEnum = _enum(["polygon", "tripwire"]);
+/** Polygon vertex in fraction-of-frame coordinates (0–1). */
+var PolygonPointSchema = object({
+	x: number(),
+	y: number()
+});
+/** A camera detection zone — pure geometry/identity. */
+var ZoneSchema = object({
+	id: string(),
+	name: string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: string().default("#3b82f6")
+});
+/**
+* Zones capability — per-camera CRUD over polygon detection zones.
+*
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
+*/
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
+		addZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: method(object({
+			deviceId: number(),
+			zoneId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+/**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
 * decode worker resolves it against the RETAINED native frame's real pixel dims,
 * so the caller supplies only the detection-res bbox divided by the detection
@@ -24440,6 +24918,17 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = object({
+	modelId: string().optional(),
+	settings: record(string(), unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -24451,7 +24940,16 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 var RunnerInferenceDeviceSchema = object({
 	deviceKey: string(),
 	weight: number().positive().default(1),
-	maxSessions: number().int().positive().nullable().default(null)
+	maxSessions: number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: record(string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -25326,6 +25824,28 @@ var NodeInferenceDeviceSchema = object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("stored"),
+		modelId: string()
+	}),
+	object({
+		kind: literal("absent"),
+		defaultModelId: string()
+	}),
+	object({
+		kind: literal("unreadable"),
+		reason: _enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -25353,10 +25873,17 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({ migrated: number() }), {
+}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({
+	migrated: number(),
+	skipped: array(object({
+		deviceId: number(),
+		targetNodeId: string(),
+		reason: string()
+	})).default([])
+}), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
+}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(object({ stepId: string() }), ClusterModelChoiceSchema), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
 	nodeId: string(),
 	capName: string(),
 	addonId: string()
@@ -27072,6 +27599,20 @@ var VectorScanResultSchema = object({
 	*/
 	nextCursor: number().int().nonnegative().nullable()
 });
+/**
+* The ONE error code for "this index exists at another dimension; refusing to
+* redeclare it" (D649). It rides in the MESSAGE — an Error's own properties do
+* not survive the UDS/tRPC hop, its message does — and both sides go through
+* the helpers below, never a copied phrase: a consumer that must tell "this
+* index can never hold my vectors" from "the provider is unreachable" (a
+* delete counts the first as nothing-to-delete and the second as still
+* present) otherwise breaks silently the day the wording changes.
+*/
+var VECTOR_INDEX_DIM_CONFLICT = "vector-index-dim-conflict";
+/** True when `err` (possibly re-wrapped by a transport) is that refusal. */
+function isVectorIndexDimConflict(err) {
+	return (err instanceof Error ? err.message : String(err)).includes(`[${VECTOR_INDEX_DIM_CONFLICT}]`);
+}
 var VectorStatsInputSchema = object({ index: string() });
 var VectorStatsResultSchema = object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -27731,6 +28272,349 @@ DeviceType.Camera, method(object({
 	auth: "protected"
 });
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+var DoorbellPressEventSchema = object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	exposesDeviceSettings: true,
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema)
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -30180,75 +31064,6 @@ onStatusChanged: { data: object({
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-var DoorbellPressEventSchema = object({
-	deviceId: number(),
-	timestamp: number()
-});
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: { data: DoorbellPressEventSchema } },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
 * states, weather conditions, contact-source channels, mode strings).
@@ -34362,7 +35177,7 @@ var HardwareInfoSchema = object({
 	coral: CoralInfoSchema.nullable().optional()
 });
 var PlatformScoreSchema = object({
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: _enum([
 		"onnx",
@@ -34399,7 +35214,7 @@ var ModelRequirementSchema = object({
 });
 var ResolvedInferenceConfigSchema = object({
 	modelId: string(),
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: ModelFormatSchema,
 	reason: string()
@@ -36994,6 +37809,92 @@ var sceneMonitorCapability = {
 	durability: "session"
 };
 /**
+* Per-stage gating mode applied to the zones a rule references.
+*
+* - `include`: the rule contributes to a **whitelist** for its stage.
+*   When at least one `include` rule fires for a stage, only entities
+*   inside one of those zones pass that stage.
+* - `exclude`: the rule contributes to a **blacklist** for its stage.
+*   Entities inside one of those zones are dropped at that stage.
+*
+* `monitor`-style observation (count without filtering) is not a rule
+* mode — zones without any matching rule are observed naturally by
+* `zone-analytics` (live snapshot + history), so an "I just want to
+* count, not filter" use case needs no rule at all.
+*/
+var ZoneRuleModeEnum = _enum(["include", "exclude"]);
+/**
+* Per-consumer rule that references existing zones (geometry) and
+* defines how a specific pipeline stage should treat them. Each
+* consumer addon owns its own `ZoneRule[]` array in its per-device
+* settings:
+*
+* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
+* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
+* - future: notification rules, audio gating, etc.
+*
+* One rule applies to N zones (`zoneIds[]`) so the operator can
+* express "ignore motion in ALL of {garden, street}" with a single
+* rule. `classFilter` narrows the rule to specific object classes —
+* "drop person detections in the street, but keep cars" is one
+* `exclude` rule with `classFilter: ['person']`.
+*
+* `enabled` is a soft toggle — the operator can keep the rule
+* configured but inert without deleting it.
+*/
+var ZoneRuleSchema = object({
+	/** Stable rule id — survives edits, used by the UI for diffing. */
+	id: string(),
+	/** Optional human-readable label rendered in the rule editor. */
+	name: string().optional(),
+	/** Zones this rule targets. The rule's `mode` applies to ALL
+	*  listed zones (OR-set: a detection in any one of them counts).
+	*  At least one zone id required — a rule with no targets is a
+	*  configuration mistake and the form validator rejects it. */
+	zoneIds: array(string()).min(1).readonly(),
+	mode: ZoneRuleModeEnum,
+	/**
+	* Class names this rule applies to. Empty / undefined ⇒ rule
+	* applies to every class. Class strings match the `macroClass`
+	* field on detections (e.g. `person`, `car`, `dog`).
+	*/
+	classFilter: array(string()).readonly().optional(),
+	/**
+	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
+	* required to consider an entity "in the zone". Defaults to the
+	* consumer's stage default when omitted. Kept for back-compat with
+	* existing per-rule overrides; new operators pick the value via
+	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+	* set, the lower-level engine reads it as a 0–1 fraction.
+	*/
+	overlapThreshold: number().min(0).max(1).optional(),
+	/**
+	* Operator-friendly version of `overlapThreshold` — the percentage
+	* of the detection's bbox that must lie inside the zone for the
+	* rule to match. Documented default is 85%; the engine substitutes
+	* that when the field is omitted (kept optional so existing rules
+	* stored without it stay valid).
+	*
+	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+	* rule, the engine prefers `bboxInclusionPct` because it's the
+	* field exposed in the UI. Internally both feed the same gate.
+	*/
+	bboxInclusionPct: number().min(0).max(100).optional(),
+	/**
+	* When `true` and a detection has a segmentation mask, use the
+	* mask for overlap instead of the bbox. Detection-stage only;
+	* motion rules ignore this field.
+	*/
+	preferMask: boolean().optional(),
+	/**
+	* Soft-toggle: `false` disables the rule without deleting it.
+	* Defaults to `true` so operators creating a rule via the UI
+	* see it active immediately.
+	*/
+	enabled: boolean().default(true)
+});
+array(ZoneRuleSchema).readonly();
+/**
 * Script-runner cap. Models HA `script.*` entities on
 * `DeviceType.Script`. A Script is a pre-recorded action sequence
 * that can be invoked imperatively — optionally with a variables
@@ -39050,146 +39951,6 @@ function readDeviceStateFrom(runtimeState) {
 	}
 }
 /**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
-* The same caps → the slice field carrying the ms-epoch timestamp of the
-* last transition. Every source cap MUST appear here (guarded by a spec):
-* without a transition timestamp the evaluator cannot tell a genuine rise
-* from a boot-time hydration when the FIRST slice it ever sees is already
-* active, and errs towards silence — swallowing the rise.
-*
-* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
-* provider derives them from `state.last_changed`, so they survive our own
-* restarts and correctly read as "hours ago" for a state that has been
-* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
-*/
-var SOURCE_CAP_CHANGED_AT_FIELD = {
-	contact: "lastChangedAt",
-	binary: "lastChangedAt",
-	switch: "lastChangedAt",
-	motion: "lastDetectedAt",
-	flood: "lastChangedAt",
-	gas: "lastChangedAt",
-	smoke: "lastChangedAt",
-	"carbon-monoxide": "lastChangedAt",
-	vibration: "lastChangedAt",
-	tamper: "lastChangedAt"
-};
-/** True when a cap is a recognised binary/switch source. */
-function isSourceCap(capName) {
-	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
-}
-/** Extract the "active" boolean a source cap's slice carries, or null when
-*  the cap is unknown or the field is missing / non-boolean. */
-function sliceActiveValue(capName, slice) {
-	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	return typeof raw === "boolean" ? raw : null;
-}
-/** Ms-epoch transition timestamp a source cap's slice carries, or null when
-*  it is absent, non-numeric or the zero "never observed" sentinel. */
-function sliceChangedAt(capName, slice) {
-	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
-	return raw;
-}
-/**
-* How recent a source's own transition timestamp must be for a FIRST
-* sighting that is already active to count as a genuine rise rather than a
-* hydration of long-standing state.
-*/
-var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
-/**
-* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
-* porta `prior`, `nowMs` e il proprio `startedAtMs`.
-*
-* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
-* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
-* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
-* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
-* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
-* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
-* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
-* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
-*/
-function evaluateSensorEdge(input) {
-	const value = sliceActiveValue(input.capName, input.slice);
-	if (value === null) return {
-		edge: "none",
-		value: null,
-		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
-	};
-	if (input.prior === void 0) {
-		if (!value) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-inactive"
-		};
-		const changedAt = sliceChangedAt(input.capName, input.slice);
-		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
-		if (changedAt === null || changedAt < floor) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-stale-active"
-		};
-		return {
-			edge: "rising",
-			value: true
-		};
-	}
-	if (input.prior === value) return {
-		edge: "none",
-		value,
-		reason: "no-change"
-	};
-	if (!value) return {
-		edge: "none",
-		value,
-		reason: "falling-edge"
-	};
-	return {
-		edge: "rising",
-		value: true
-	};
-}
-/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -43029,6 +43790,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -43779,6 +44564,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -45165,6 +45956,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewStateSummary": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.previewTemplate": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -45741,12 +46538,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.runReplayFrameProcessor": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -46113,6 +46904,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -48938,6 +49735,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -49844,11 +50661,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"pipelineAnalytics.runReplayFrameProcessor": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"pipelineAnalytics.saveRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -50886,7 +51698,8 @@ var NC_SYSTEM_EVENT_FAMILY = {
 	"camera-disabled": null,
 	"camera-enabled": null
 };
-new Map(Object.entries(NC_SYSTEM_EVENT_FAMILY));
+/** Read by NAME, for kinds that arrive as plain strings (a newer hub, the viewer's mirror). */
+var FAMILY_BY_NAME = new Map(Object.entries(NC_SYSTEM_EVENT_FAMILY));
 var NC_SYSTEM_EVENT_CONDITION_FILTER_KEYS = [...NC_SYSTEM_EVENT_FILTER_KEYS, "excludeDeviceIds"];
 /**
 * The filters a family may carry. The base filters are the union of
@@ -50997,6 +51810,24 @@ function systemEventKindsOfFamily(family) {
 	return NC_SYSTEM_EVENT_KIND_GROUP_SPECS.filter((g) => g.family === family).flatMap((g) => g.kinds);
 }
 /**
+* One family, or `mixed`. Mixed covers kinds that span families, a legacy kind,
+* a kind this build does not know (it fails toward read-only and never toward
+* editable), and an empty selection (nothing to decide on).
+*/
+function systemEventFamilyOf(kindNames) {
+	const families = /* @__PURE__ */ new Set();
+	for (const name of kindNames) {
+		const family = FAMILY_BY_NAME.get(name);
+		if (family === void 0 || family === null) return { kind: "mixed" };
+		families.add(family);
+	}
+	const [only] = [...families];
+	return families.size === 1 && only !== void 0 ? {
+		kind: "family",
+		family: only
+	} : { kind: "mixed" };
+}
+/**
 * Why the hub refuses this condition on a new or updated rule. Empty = accepted.
 * Families are reported in `NC_SYSTEM_EVENT_FAMILIES` order, and filters in
 * `NC_SYSTEM_EVENT_CONDITION_FILTER_KEYS` order, so a refusal reads the same
@@ -51072,18 +51903,38 @@ var WEEKDAY_TO_DAY = {
 	Fri: 5,
 	Sat: 6
 };
-/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
-*  An invalid/unknown IANA name falls back to the host timezone. */
-function localDayMinute(atMs, timezone) {
-	const d = new Date(atMs);
-	if (timezone !== void 0) try {
-		const parts = new Intl.DateTimeFormat("en-US", {
+/**
+* One formatter per timezone, built once (D647 review I4). Constructing an
+* `Intl.DateTimeFormat` is the expensive part of this function, and a caller
+* that asks about many instants — a window scan — used to build one per
+* instant. `null` = an invalid IANA name (the host timezone is used).
+*/
+var FORMATTERS = /* @__PURE__ */ new Map();
+function formatterFor(timezone) {
+	const held = FORMATTERS.get(timezone);
+	if (held !== void 0) return held;
+	let made;
+	try {
+		made = new Intl.DateTimeFormat("en-US", {
 			timeZone: timezone,
 			weekday: "short",
 			hour: "numeric",
 			minute: "numeric",
 			hourCycle: "h23"
-		}).formatToParts(d);
+		});
+	} catch {
+		made = null;
+	}
+	FORMATTERS.set(timezone, made);
+	return made;
+}
+/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
+*  An invalid/unknown IANA name falls back to the host timezone. */
+function localDayMinute(atMs, timezone) {
+	const d = new Date(atMs);
+	const formatter = timezone !== void 0 ? formatterFor(timezone) : null;
+	if (formatter !== null) try {
+		const parts = formatter.formatToParts(d);
 		let weekday;
 		let hour;
 		let minute;
@@ -51223,6 +52074,119 @@ var DEVICE_EVENTS = [
 	"detection-blind",
 	...ALARM
 ];
+/** Every kind a summary may speak about — the two summarisable families. */
+var SUMMARISABLE = [...systemEventKindsOfFamily("device-events"), ...systemEventKindsOfFamily("system")];
+/** One per summary SECTION (`NC_STATE_SUMMARY_SECTIONS` in the notification
+*  centre): the section's lines, offered when one of its kinds is selected. */
+var STATE_SUMMARY_SECTION_VARS = [
+	{
+		name: "summaryDevices",
+		label: "Summary: devices offline / switched off",
+		example: "Garage — offline since 07:12",
+		kinds: [
+			"device-offline",
+			"device-online",
+			"device-disabled",
+			"device-enabled"
+		]
+	},
+	{
+		name: "summaryStreams",
+		label: "Summary: streams offline",
+		example: "Ingresso (high) — since 06:40",
+		kinds: ["stream-offline", "stream-online"]
+	},
+	{
+		name: "summaryBattery",
+		label: "Summary: low batteries",
+		example: "Sensore porta — 8 %",
+		kinds: BATTERY
+	},
+	{
+		name: "summaryConsumables",
+		label: "Summary: consumables",
+		example: "Robot — filter 10 %",
+		kinds: CONSUMABLE
+	},
+	{
+		name: "summaryTanks",
+		label: "Summary: tanks",
+		example: "Robot — clean water low",
+		kinds: TANK
+	},
+	{
+		name: "summaryDetection",
+		label: "Summary: cameras detecting nothing",
+		example: "Ingresso — since 05:10",
+		kinds: ["detection-blind"]
+	},
+	{
+		name: "summaryNodes",
+		label: "Summary: nodes",
+		example: "little-unraid — offline since 03:00",
+		kinds: [
+			"node-offline",
+			"node-online",
+			"node-inference-unavailable"
+		]
+	},
+	{
+		name: "summaryAddons",
+		label: "Summary: addons",
+		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: [
+			"addon-crash-loop",
+			"addon-update-available",
+			"addon-updated"
+		]
+	},
+	{
+		name: "summaryUpdates",
+		label: "Summary: server & container updates",
+		example: "server 1.2.377 → 1.2.378",
+		kinds: [
+			"server-update-available",
+			"server-updated",
+			"wrapper-update-available"
+		]
+	}
+];
+var STATE_SUMMARY_VARS = [
+	{
+		name: "summaryText",
+		label: "Summary: every section",
+		description: "One block per section with something to report, one line per item.",
+		example: "Batterie scariche: Sensore porta — 8 %",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	{
+		name: "summaryCount",
+		label: "Summary: items reported",
+		example: "3",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
+		name: v.name,
+		label: v.label,
+		example: v.example,
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...v.kinds],
+		systemEventDeliveries: ["summary"]
+	}))
+];
 var NC_TEMPLATE_VARS = [
 	{
 		name: "camera",
@@ -51473,7 +52437,8 @@ var NC_TEMPLATE_VARS = [
 		group: "system",
 		families: ["rule"],
 		fields: [...RULE_TEXT],
-		kinds: ["system"]
+		kinds: ["system"],
+		systemEventDeliveries: ["instant"]
 	},
 	{
 		name: "deviceName",
@@ -51916,7 +52881,8 @@ var NC_TEMPLATE_VARS = [
 		group: "digest",
 		families: ["summary"],
 		fields: [...RULE_TEXT]
-	}
+	},
+	...STATE_SUMMARY_VARS
 ];
 /**
 * System-event kinds the SERVED catalog holds back (D642): the kinds the hub
@@ -51945,11 +52911,32 @@ var NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS = [
 * rule an installed viewer can author, which is exactly true.
 */
 function servedTemplateVars() {
-	return NC_TEMPLATE_VARS.map((d) => d.systemEventKinds === void 0 ? d : {
+	return NC_TEMPLATE_VARS.filter((d) => !isHeldBackTemplateVar(d)).map((d) => d.systemEventKinds === void 0 ? d : {
 		...d,
 		systemEventKinds: d.systemEventKinds.filter((kind) => !NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS.includes(kind))
 	});
 }
+/**
+* Is this descriptor held back from the SERVED catalog as a whole (D647)?
+* A summary-only variable is: an installed viewer does not read the delivery
+* axis, and would offer it on every instant system rule. The admin, built
+* from the workspace, restores it from its own `NC_TEMPLATE_VARS`.
+*/
+function isHeldBackTemplateVar(d) {
+	return d.systemEventDeliveries !== void 0 && !d.systemEventDeliveries.includes("instant");
+}
+/**
+* Does a descriptor have a value on a system rule of this DELIVERY (D647)?
+* Read only for a system rule kind. An absent axis is `instant` for a
+* descriptor that names `systemEventKinds` (a per-event fact: a summary row
+* has no one device, node or package) and BOTH for one that does not
+* (`{{rule}}`, `{{time}}`).
+*/
+function templateVarDeliveryApplies(d, ctx) {
+	if (!isSystemRuleKind(ctx.kind)) return true;
+	const mode = ctx.systemEventDelivery ?? "instant";
+	return (d.systemEventDeliveries ?? (d.systemEventKinds !== void 0 ? ["instant"] : [mode])).includes(mode);
+}
 /** The caption fields see a fixed, smaller vocabulary (`timelapsePreviewText`,
 *  `summaryCaptionText`). Declared here rather than as `fields` on every
 *  descriptor so the whole rule stays in one line of code. */
@@ -52014,12 +53001,82 @@ function templateVarsFor(ctx) {
 		const allowed = CAPTION_VARS[ctx.field];
 		return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && allowed.includes(d.name) && d.dynamic === void 0);
 	}
-	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx));
+	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx) && templateVarDeliveryApplies(d, ctx));
 }
 /** True when `name` is supplied in `ctx`, dynamic families (`count_<class>`) included. */
 function isKnownTemplateVar(name, ctx) {
 	return templateVarsFor(ctx).some((d) => d.dynamic !== void 0 ? name.startsWith(d.dynamic.prefix) && name.length > d.dynamic.prefix.length : d.name === name);
 }
+/** The families a rule may summarise. The alarm is not one of them. */
+var NC_SYSTEM_EVENT_SUMMARY_FAMILIES = ["device-events", "system"];
+/** The summary's schedule, or `null` for any rule that is not a summary system rule. */
+function systemEventSummaryScheduleOf(rule) {
+	if (!isSystemDelivery(rule.delivery)) return null;
+	const delivery = rule.systemEventDelivery;
+	return delivery?.mode === "summary" ? delivery.schedule : null;
+}
+/** Absent and `instant` are the same answer: a notification per event. */
+function isSystemEventSummaryRule(rule) {
+	return systemEventSummaryScheduleOf(rule) !== null;
+}
+function actionsAreSet(actions) {
+	return (actions?.onTrigger?.length ?? 0) > 0 || (actions?.buttons?.length ?? 0) > 0;
+}
+/**
+* Why the hub refuses this rule's delivery. Empty = accepted. An instant rule
+* (absent or `{ mode: 'instant' }`) is never refused here.
+*
+* Beside a summary, two fields are refused because they would do nothing:
+* the rule's own `schedule` (the summary's schedule is the send time; a second
+* active-hours gate would silently empty it) and `actions` (a summary is not a
+* match, so nothing would ever run them).
+*/
+function systemEventDeliveryProblems(rule) {
+	if (rule.systemEventDelivery?.mode !== "summary") return [];
+	if (!isSystemDelivery(rule.delivery)) return [{
+		code: "not-a-system-rule",
+		delivery: rule.delivery
+	}];
+	const problems = [];
+	const verdict = systemEventFamilyOf(rule.conditions.systemEvent?.kinds ?? []);
+	const family = verdict.kind === "family" ? verdict.family : "mixed";
+	if (family === "mixed" || !NC_SYSTEM_EVENT_SUMMARY_FAMILIES.includes(family)) problems.push({
+		code: "family-not-summarisable",
+		family
+	});
+	const windows = rule.systemEventDelivery.schedule.windows;
+	if (windows.length === 0) problems.push({ code: "empty-schedule" });
+	windows.forEach((window, index) => {
+		if (window.days.length === 0 || window.startMinute === window.endMinute) problems.push({
+			code: "degenerate-window",
+			index
+		});
+	});
+	if (rule.schedule !== void 0) problems.push({ code: "schedule-beside-summary" });
+	if (actionsAreSet(rule.actions)) problems.push({ code: "actions-beside-summary" });
+	return problems;
+}
+function describeSystemEventDeliveryProblem(problem) {
+	switch (problem.code) {
+		case "not-a-system-rule": return `a '${problem.delivery}' rule has no summary delivery — only device-events and system rules do`;
+		case "family-not-summarisable": return problem.family === "alarm" ? "an alarm rule cannot be a scheduled summary — the alarm stays instant" : `a ${problem.family} rule cannot be a scheduled summary — only device-events and system rules`;
+		case "degenerate-window": return `send time ${String(problem.index + 1)} has no day, or starts and ends on the same minute — it never closes, so nothing would be sent`;
+		case "empty-schedule": return "a summary rule needs at least one send time — its schedule has no window";
+		case "schedule-beside-summary": return "a summary rule is sent on its summary schedule — remove the active-hours schedule";
+		case "actions-beside-summary": return "a summary rule never matches an event, so its actions would never run — remove them";
+	}
+}
+var SUMMARY_CONTENT_VAR = /\{\{\s*summary(?:Text|Devices|Streams|Battery|Consumables|Tanks|Detection|Nodes|Addons|Updates)\s*\}\}/;
+/**
+* Does a custom BODY carry the summary's content (`{{summaryText}}` or a
+* section variable)? A body that does not would send a summary with nothing
+* in it; the hub then appends `{{summaryText}}` and the admin warns (review
+* M3). An absent or blank body uses the hub's own wording, which does.
+*/
+function templateCarriesSummary(body) {
+	if (body === void 0 || body.trim().length === 0) return true;
+	return SUMMARY_CONTENT_VAR.test(body);
+}
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -52320,169 +53377,6 @@ function readTimelapseGeneratedAt(rule, deviceId) {
 	if (map !== void 0) return map[String(deviceId)] ?? 0;
 	return rule.lastGeneratedAt ?? 0;
 }
-/**
-* A model choice has a SCOPE, and a scope change has a workflow.
-*
-* ## The two scopes
-*
-* Almost every pipeline step's model is a **node** question: which build runs
-* fastest on THIS accelerator. Two nodes may legitimately answer differently —
-* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
-* are compared against nothing. They produce boxes, and a box is a box.
-*
-* Two steps are not like that. `face-embedding` and `clip-embedding` produce
-* **vectors that land in ONE shared index** (`identity_samples`,
-* `vec_object_clip`) and are ranked against each other by cosine similarity.
-* Cosine similarity between two encoders is not a weak signal, it is a
-* meaningless number — and nothing inside a vector can tell you it happened.
-* So for those two steps the model is a **cluster** question with exactly one
-* answer, stored in exactly one row.
-*
-* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
-* for the crop convention (`detail-crop.ts`), one level up: the crop decides
-* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
-* cluster-wide for the same reason and neither may become per-node.
-*
-* ## Why the registry lives here and not in the step catalog
-*
-* The scope itself is declared on the step, in
-* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
-* — that is where a new step declares what kind of choice its model is. But the
-* catalog lives inside `addon-pipeline`, and three packages that must NOT
-* import an addon need to know the set: the orchestrator (which renders and
-* stores the row), post-analysis (which pins the row for a re-embed pass) and
-* admin-ui (which mirrors it). So the set is mirrored here, and
-* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
-* A hand-copied key that stops matching is exactly how a setting silently stops
-* arriving while both sides still look correct.
-*
-* ## The defaults ARE today's behaviour
-*
-* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
-* of both steps. Declaring the scope therefore changes nothing on the day it
-* ships: the cluster row starts out saying what every node was already doing.
-* Changing it is legitimate — that is what the knob is for — but it invalidates
-* the stored vectors of that surface, and must be followed by a re-embed pass
-* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
-*/
-/**
-* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
-* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
-*/
-var CLUSTER_MODEL_SCOPED_STEPS = [{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}];
-/**
-* The settings key holding one step's cluster model choice.
-*
-* Step-qualified so the keys stay unique across the addon's whole schema, which
-* is what lets {@link pickClusterStepModels} walk every section instead of
-* trusting the section id.
-*/
-function clusterModelSettingKey(stepId) {
-	return `clusterModel:${stepId}`;
-}
-/** The cluster row when nobody has configured one — today's catalog defaults. */
-var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
-/** A stored choice is a non-empty model id, or it is not a choice. */
-var ChosenModelIdSchema = string().min(1);
-/**
-* Narrow a FLAT settings record to the cluster row.
-*
-* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
-* junk face model must not also discard a valid clip model. An absent, empty or
-* non-string value resolves to the step's catalog default — the historical
-* behaviour — never to a blank id, because a blank id downstream becomes
-* "substitute the format default", which is precisely the substitution this
-* scope exists to forbid.
-*/
-function readClusterStepModels(config) {
-	const out = {};
-	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
-		const parsed = ChosenModelIdSchema.safeParse(config[clusterModelSettingKey(step.stepId)]);
-		out[step.stepId] = parsed.success ? parsed.data : step.defaultModelId;
-	}
-	return out;
-}
-function isHydratedField$2(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the defaults. A `null` payload
-* (addon mid-boot) is the defaults.
-*/
-function pickClusterStepModels(view) {
-	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
-	const flat = {};
-	const wanted = new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
-		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readClusterStepModels(flat);
-}
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -53024,4 +53918,395 @@ function vectorDimFromBase64(encoded) {
 	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
 }
 //#endregion
-export { NcTemplateVarDescriptorSchema as $, sensorRaisedOf as $t, NC_DEFAULT_SNOOZE_MINUTES as A, unknown as An, failureContributionCapability as At, NcRuleInputSchema as B, mayWriteToLocation as Bt, MAX_BIRTH_DECISION_RECORDS as C, discriminatedUnion as Cn, deriveRecordingMode as Ct, NC_ALARM_SYSTEM_EVENT_KINDS as D, partialRecord as Dn, evaluateSensorEdge as Dt, MediaFileKindEnum as E, object as En, encodeVectorBase64 as Et, NC_TEMPLATE_VARS as F, isMediaOwnerType as Ft, NcScheduleSchema as G, pipelineAnalyticsCapability as Gt, NcRuleSchema as H, occupancyScope as Ht, NcAlarmConfigSchema as I, isScheduleActive as It, NcSnoozeSuppressedSchema as J, readTimelapseGeneratedAt as Jt, NcSnoozeInputSchema as K, plateGalleryCapability as Kt, NcAlarmSettingsPatchSchema as L, isSourceCap as Lt, NC_SNOOZE_MAX_MINUTES as M, isDetectionMacroClass as Mt, NC_TANK_SYSTEM_EVENT_KINDS as N, isEventOwnerType as Nt, NC_CONDITION_CATALOG as O, record as On, evictionPolicyOfLocation as Ot, NC_TAXONOMY as P, isKnownTemplateVar as Pt, NcTemplatePreviewSchema as Q, sceneMonitorCapability as Qt, NcConditionDescriptorSchema as R, isSystemDelivery as Rt, MAX_ARCHIVED_DEBUG_NOTES as S, boolean as Sn, cosineSimilarity as St, MOTION_CLOSE_AFTER_MS as T, number as Tn, embeddingEncoderCapability as Tt, NcRuleTargetSchema as U, parseProcStatus as Ut, NcRulePatchSchema as V, notificationRulesCapability as Vt, NcRuleUpdateInputSchema as W, pickClusterStepModels as Wt, NcTaxonomySchema as X, resolvePoolMemoryPolicy as Xt, NcSystemEventKindSchema as Y, resolveLocationMode as Yt, NcTemplatePreviewInputSchema as Z, ruleBelongsToAlarm as Zt, FIRST_LEVEL_MACRO_CLASSES as _, isDeviceScopedCap as _n, assertTimelapseCadences as _t, BirthDecisionRecordSchema as a, templateVarsFor as an, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as at, LabelAttributionSchema as b, _enum as bn, buildEventKindDescriptor as bt, CoverStateSchema as c, errMsg as cn, SCENE_DIVERGED as ct, DEFAULT_TIMELAPSE_PREVIEW_TEXT as d, CamProfileSchema as dn, TimelapseRuleInputSchema as dt, servedTemplateVars as en, OpsLogEntrySchema as et, DETECTION_MACRO_CLASSES as f, DeviceType as fn, TimelapseRulePatchSchema as ft, EVENT_OWNER_TYPES as g, hydrateSchema as gn, alarmPanelCapability as gt, EVENT_KIND_BY_CAP as h, defineCustomActions as hn, addonWidgetsSourceCapability as ht, BaseDevice as i, systemEventFilterApplies as in, RetrainStatusSchema as it, NC_SENSOR_TRANSITION_KINDS as j, EventCategory as jn, hfModelUrl as jt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as k, string as kn, faceGalleryCapability as kt, DEFAULT_EVENT_COLOR as l, canonicalHash as ln, SceneMonitorSchema as lt, DeclaredDevices as m, customAction as mn, TrackSourceSchema as mt, AlarmArmModeSchema as n, subKindsOf as nn, RECORDING_EXPORT_MAX_READ_BYTES as nt, CLUSTER_MODEL_SCOPED_STEPS as o, vectorDimFromBase64 as on, SCENE_DEFAULT_ANCHOR_THRESHOLD as ot, DETECTION_PIPELINE_CAP_NAME as p, createEvent as pn, TimelapseRuleSchema as pt, NcSnoozeSchema as q, readDeviceStateFrom as qt, ArchivedDebugNoteSchema as r, systemEventFamilyProblems as rn, RECORDING_SOURCE_CAMSTACK_ADDON as rt, COCO_TO_MACRO as s, zoneAnalyticsCapability as sn, SCENE_DEFAULT_UNCOVERED_POLICY as st, AUDIO_MACRO_LABELS as t, storageOccupancyCapability as tn, PoolMemoryWatchdog as tt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as u, BaseAddon as un, TIMELAPSE_DENSE_FLOOR_SEC as ut, FULL_IMAGE_BBOX as v, nodePin as vn, audioMetricsCapability as vt, MAX_BIRTH_LATENCY_PROXY_MS as w, literal as wn, describeSystemEventFamilyProblem as wt, LockStateSchema as x, array as xn, consumableLowPercentOf as xt, FailureCounters as y, sleep as yn, audioModeOf as yt, NcConditionsSchema as z, kebabToCamel as zt };
+//#region src/pipeline-analytics/cluster-model-pin.ts
+/**
+* Where a re-embed pass gets the model it pins.
+*
+* ## Why not `embeddingEncoder.getInfo`
+*
+* That is what the CLIP rebuild used, and it answers a subtly different
+* question: "which model is the encoder addon currently holding", not "which
+* model has the operator chosen for the cluster". The two agree until they do
+* not — an encoder mid-reload, a node that never picked up a change — and when
+* they disagree the pass writes a whole index in the wrong space with a status
+* line that looks fine. Since `face-embedding` and `clip-embedding` declare
+* `modelScope: 'cluster'`, there is now exactly one authority for each, and it
+* is a stored row rather than a live process's opinion.
+*
+* ## Why the read is not cached here
+*
+* A pass reads it ONCE, at the start, and pins that value for its whole run
+* (D54). A cache would only matter for a caller that re-read it mid-pass, which
+* is precisely the thing the pin exists to prevent — so there is nothing to
+* cache and the absence is deliberate.
+*
+* ## Why a failed read refuses instead of defaulting
+*
+* A pass that cannot name its model must not run. The previous CLIP path's
+* `?? 'unknown'` is the shipped version of the alternative: rows stamped with an
+* id nothing ran, in an index whose same-model gate then has nothing to reason
+* about.
+*/
+/** The addon whose GLOBAL settings hold the cluster row. */
+var CLUSTER_MODEL_OWNER_ADDON_ID = "pipeline-orchestrator";
+/** The step ids this module can pin — the same two the catalog declares. */
+var FACE_EMBEDDING_STEP_ID = "face-embedding";
+var CLIP_EMBEDDING_STEP_ID = "clip-embedding";
+/**
+* The cluster row, or `null` when it could not be read.
+*
+* `null` and not "the defaults": a caller that cannot distinguish "the operator
+* chose arcface" from "I could not ask" will run a pass on a guess. The one
+* production caller turns `null` into a refusal to start.
+*/
+async function readClusterModelRow(api, logger) {
+	try {
+		return pickClusterStepModels(await api.addonSettings.getGlobalSettings.query({ addonId: CLUSTER_MODEL_OWNER_ADDON_ID }));
+	} catch (err) {
+		logger.warn("cluster model row unreadable — a re-embed pass must not guess which encoder the operator chose", { meta: {
+			owner: CLUSTER_MODEL_OWNER_ADDON_ID,
+			error: err instanceof Error ? err.message : String(err)
+		} });
+		return null;
+	}
+}
+/**
+* Pin one cluster-scoped step's model for a whole pass.
+*
+* Returns `null` on an unreadable row OR an unknown step id — both mean the
+* caller must not start, and folding them together is safe because the caller's
+* move is identical: refuse, loudly.
+*/
+async function resolveClusterModelPin(api, stepId, logger) {
+	if (!CLUSTER_MODEL_SCOPED_STEPS.some((s) => s.stepId === stepId)) {
+		logger.warn("cluster model pin requested for a step that is not cluster-scoped", { meta: {
+			stepId,
+			clusterScoped: CLUSTER_MODEL_SCOPED_STEPS.map((s) => s.stepId)
+		} });
+		return null;
+	}
+	const row = await readClusterModelRow(api, logger);
+	if (row === null) return null;
+	const modelId = row[stepId];
+	return modelId !== void 0 && modelId !== "" ? modelId : null;
+}
+/**
+* The error texts a cap call carries when the provider or the router has no
+* such method: the kernel's `Capability "…" has no method "…"`, tRPC's
+* `No procedure found on path`, and the forked-child hop's
+* `method '…' not found on provider '…'` (child-cap-dispatch.ts). NOT `is not a function`: that is any
+* `TypeError` thrown INSIDE the owner while it answers, and reading it as
+* "the owner predates the method" would file a bug in the owner under a
+* rolling-release reason nobody investigates.
+*/
+var METHOD_UNAVAILABLE_FINGERPRINTS = [
+	/has no method/i,
+	/no procedure found/i,
+	/method not found/i,
+	/method '[^']*' not found on provider/i
+];
+/**
+* The pin read for a pass that REWRITES an index (D651 fix rounds 1–3).
+*
+* Asks the OWNER. The orchestrator owns `clusterModel:*` and answers from a
+* three-way read of its own store, once its boot has settled
+* (`pipelineOrchestrator.getClusterModelChoice`). Never the hydrated view,
+* which answers `value ?? default`, and never the owner's private store
+* layout. Silent on purpose: the callers log state CHANGES.
+*/
+async function readClusterModelPinStrict(api, stepId) {
+	const method = api.pipelineOrchestrator?.getClusterModelChoice;
+	if (method === void 0) return {
+		kind: "unknown",
+		reason: "method-unavailable"
+	};
+	let raw;
+	try {
+		raw = await method.query({ stepId });
+	} catch (err) {
+		const error = err instanceof Error ? err.message : String(err);
+		return METHOD_UNAVAILABLE_FINGERPRINTS.some((re) => re.test(error)) ? {
+			kind: "unknown",
+			reason: "method-unavailable",
+			error
+		} : {
+			kind: "unknown",
+			reason: "read-failed",
+			error
+		};
+	}
+	if (raw === void 0) return {
+		kind: "unknown",
+		reason: "method-unavailable"
+	};
+	const parsed = ClusterModelChoiceSchema.safeParse(raw);
+	if (!parsed.success) return {
+		kind: "unknown",
+		reason: "read-failed",
+		error: "unparseable owner answer"
+	};
+	const choice = parsed.data;
+	if (choice.kind === "stored") return {
+		kind: "known",
+		modelId: choice.modelId
+	};
+	if (choice.kind === "absent") return {
+		kind: "not-stored",
+		defaultModelId: choice.defaultModelId
+	};
+	return choice.error !== void 0 ? {
+		kind: "unknown",
+		reason: choice.reason,
+		error: choice.error
+	} : {
+		kind: "unknown",
+		reason: choice.reason
+	};
+}
+//#endregion
+//#region src/embedding-encoder/catalogs/embedding-models.ts
+var HF_REPO = "camstack/camstack-models";
+var hf = (path) => hfModelUrl(HF_REPO, path);
+/**
+* The text tower's tokenizer, in HF `tokenizers` format, hosted next to every
+* text-encoder onnx (`.../onnx/tokenizer.json`) and fetched as a sibling file so
+* it lands beside the model. Each model folder hosts ITS OWN (MobileCLIP: the
+* CLIP BPE, vocab 49408; SigLIP2: Gemma SentencePiece, 256k, lower-casing).
+*/
+var TOKENIZER_FILE = "tokenizer.json";
+/** SigLIP2's tokenizer — a DIFFERENT file name on purpose: see `ClipModelMeta.tokenizerFile`. */
+var SIGLIP2_TOKENIZER_FILE = "camstack-siglip2-b16-224-tokenizer.json";
+var ovFormat = (url, sizeMB) => {
+	const base = url.split("/").pop() ?? "";
+	const files = base.endsWith(".xml") ? [base.replace(/\.xml$/, ".bin")] : void 0;
+	return {
+		url,
+		sizeMB,
+		runtimes: ["python"],
+		...files ? { files } : {}
+	};
+};
+/**
+* Files inside an .mlpackage directory bundle.
+* Must be fetched alongside the package root when isDirectory is true.
+*/
+var MLPACKAGE_FILES = [
+	"Manifest.json",
+	"Data/com.apple.CoreML/model.mlmodel",
+	"Data/com.apple.CoreML/weights/weight.bin"
+];
+/**
+* The MobileCLIP feature-space contract (D649 — see `clip-model.ts` in
+* `@camstack/types`). S1 and S2 share the historical 512-d `object-clip` index,
+* separated by each row's `modelId`; the CLIP BPE window is 77 tokens padded
+* with 0; 0.2 is the floor the search always shipped with, measured to keep 96%
+* of matched COCO caption-image pairs on S1.
+*/
+var mobileclipMeta = (textModelId) => ({
+	textModelId,
+	embeddingDim: 512,
+	vectorIndex: "object-clip",
+	tokenizerFile: TOKENIZER_FILE,
+	contextLength: 77,
+	padId: 0,
+	searchMinScore: .2
+});
+/**
+* SigLIP2 B/16-224 (D649). 768-d, so its OWN index; a 64-token Gemma
+* SentencePiece window padded with 0 (the hosted `tokenizer.json` lower-cases,
+* see `scripts/build-siglip2-model.py`). The floor is SIGLIP2_SEARCH_MIN_SCORE.
+*/
+var SIGLIP2_META = {
+	textModelId: "siglip2-b16-224-text",
+	embeddingDim: 768,
+	vectorIndex: "object-clip-siglip2-b16-224",
+	tokenizerFile: SIGLIP2_TOKENIZER_FILE,
+	contextLength: 64,
+	padId: 0,
+	searchMinScore: .1
+};
+/**
+* NO onnx vision builds, deliberately (2026-08-21). The int8 ONNX vision
+* exports were measured misaligned with the text encoders (matched image↔text
+* cosine ≈ 0.01 vs ≈ 0.22 for the fp16 openvino/coreml builds) — see the
+* catalog note in `addon-pipeline/.../model-catalogs.ts`. The image-encode leg
+* that consumed them here (`embeddingEncoder.encode` → PythonRawTensorEngine)
+* is retired with them: its only caller discarded the vector, and its
+* `preprocessForClip` applied OpenAI mean/std that MobileCLIP never used.
+* S0 was retired the same day (measured worst of the family on fleet crops).
+*/
+var CLIP_IMAGE_MODELS = [
+	{
+		id: "mobileclip-s1",
+		name: "MobileCLIP S1",
+		description: "Apple MobileCLIP S1 — balanced vision encoder, 512-dim, 256×256 (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 256,
+			height: 256
+		},
+		labels: [],
+		inputNormalization: "none",
+		clip: mobileclipMeta("mobileclip-s1-text"),
+		formats: {
+			openvino: ovFormat(hf("clip/mobileclip-s1/openvino/camstack-mobileclip-s1-vision.xml"), 55),
+			coreml: {
+				url: hf("clip/mobileclip-s1/coreml/camstack-mobileclip-s1-vision.mlpackage"),
+				sizeMB: 65,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	},
+	{
+		id: "mobileclip-s2",
+		name: "MobileCLIP S2",
+		description: "Apple MobileCLIP S2 — high-accuracy vision encoder, 512-dim, 256×256 (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 256,
+			height: 256
+		},
+		labels: [],
+		inputNormalization: "none",
+		clip: mobileclipMeta("mobileclip-s2-text"),
+		formats: {
+			openvino: ovFormat(hf("clip/mobileclip-s2/openvino/camstack-mobileclip-s2-vision.xml"), 90),
+			coreml: {
+				url: hf("clip/mobileclip-s2/coreml/camstack-mobileclip-s2-vision.mlpackage"),
+				sizeMB: 110,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	},
+	{
+		id: "siglip2-b16-224",
+		name: "SigLIP2 B/16",
+		description: "Google SigLIP2 base, patch 16, 224×224 — Apache-2.0 vision encoder, 768-dim (fp16 OpenVINO/CoreML)",
+		inputSize: {
+			width: 224,
+			height: 224
+		},
+		labels: [],
+		inputNormalization: "none",
+		license: "Apache-2.0",
+		clip: SIGLIP2_META,
+		formats: {
+			openvino: ovFormat(hf("clip/siglip2/openvino/camstack-siglip2-b16-224-vision.xml"), 186),
+			coreml: {
+				url: hf("clip/siglip2/coreml/camstack-siglip2-b16-224-vision.mlpackage"),
+				sizeMB: 185,
+				isDirectory: true,
+				files: [...MLPACKAGE_FILES],
+				runtimes: ["python"]
+			}
+		}
+	}
+];
+/**
+* The int8 TEXT onnx encoders are healthy — unlike the retired int8 vision
+* exports. Verified 2026-08-21: the live search path (fp16 openvino vision
+* vectors ⋅ int8 onnx text queries) ranks correctly on the real index, and the
+* local cross-check aligns them with the fp16 vision space (cos ≈ 0.22 on
+* matched pairs).
+*/
+var CLIP_TEXT_MODELS = [
+	{
+		id: "mobileclip-s1-text",
+		name: "MobileCLIP S1 Text Encoder",
+		description: "Text encoder for MobileCLIP S1, 512-dim, int8 quantized (61 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		formats: {
+			onnx: {
+				url: hf("clip/mobileclip-s1/onnx/camstack-mobileclip-s1-text.onnx"),
+				sizeMB: 61,
+				files: [TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/mobileclip-s1/openvino/camstack-mobileclip-s1-text.xml"), 121)
+		}
+	},
+	{
+		id: "mobileclip-s2-text",
+		name: "MobileCLIP S2 Text Encoder",
+		description: "Text encoder for MobileCLIP S2, 512-dim, int8 quantized (61 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		formats: {
+			onnx: {
+				url: hf("clip/mobileclip-s2/onnx/camstack-mobileclip-s2-text.onnx"),
+				sizeMB: 61,
+				files: [TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/mobileclip-s2/openvino/camstack-mobileclip-s2-text.xml"), 121)
+		}
+	},
+	{
+		id: "siglip2-b16-224-text",
+		name: "SigLIP2 B/16 Text Encoder",
+		description: "Text encoder for SigLIP2 B/16, 768-dim, fp16 (565 MB)",
+		inputSize: {
+			width: 0,
+			height: 0
+		},
+		labels: [],
+		license: "Apache-2.0",
+		formats: {
+			onnx: {
+				url: hf("clip/siglip2/onnx/camstack-siglip2-b16-224-text.onnx"),
+				sizeMB: 565,
+				files: [SIGLIP2_TOKENIZER_FILE]
+			},
+			openvino: ovFormat(hf("clip/siglip2/openvino/camstack-siglip2-b16-224-text.xml"), 565)
+		}
+	}
+];
+//#endregion
+//#region src/shared/clip/clip-model-registry.ts
+/** The model in force when nobody has chosen — the cluster row's default. */
+var DEFAULT_CLIP_MODEL = "mobileclip-s1";
+/**
+* Build a registry from catalog entries. Throws when two models share an index
+* at different dimensions: that is a catalog defect, and the vector store would
+* refuse the second model's writes one at a time, forever, at runtime.
+*/
+function buildClipModelRegistry(entries) {
+	const models = /* @__PURE__ */ new Map();
+	const spaces = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const meta = entry.clip;
+		if (meta === void 0) continue;
+		models.set(entry.id, {
+			modelId: entry.id,
+			inputSize: entry.inputSize.width,
+			meta
+		});
+		const existing = spaces.get(meta.vectorIndex);
+		if (existing !== void 0 && existing.dim !== meta.embeddingDim) throw new Error(`CLIP index "${meta.vectorIndex}" declared at ${String(existing.dim)} dims by ${existing.modelIds.join(", ")} and at ${String(meta.embeddingDim)} by ${entry.id}`);
+		spaces.set(meta.vectorIndex, {
+			index: meta.vectorIndex,
+			dim: meta.embeddingDim,
+			modelIds: [...existing?.modelIds ?? [], entry.id]
+		});
+	}
+	const all = [...spaces.values()];
+	return {
+		resolve: (modelId) => models.get(modelId) ?? null,
+		spaceFor: (modelId) => {
+			const model = models.get(modelId);
+			return model === void 0 ? null : spaces.get(model.meta.vectorIndex) ?? null;
+		},
+		spaces: () => all
+	};
+}
+/** The built-in catalog's registry. */
+var BUILTIN_CLIP_MODELS = buildClipModelRegistry(CLIP_IMAGE_MODELS);
+//#endregion
+export { NcRuleSchema as $, EventCategory as $n, isSourceCap as $t, LabelAttributionSchema as A, canonicalHash as An, audioMetricsCapability as At, NC_DEFAULT_SNOOZE_MINUTES as B, normalizeNodeId as Bn, embeddingRefusalOf as Bt, EMBEDDING_REQUIREMENTS_FAILED as C, systemEventFilterApplies as Cn, TimelapseRuleInputSchema as Ct, FIRST_LEVEL_MACRO_CLASSES as D, vectorDimFromBase64 as Dn, addonWidgetsSourceCapability as Dt, EVENT_OWNER_TYPES as E, templateVarsFor as En, TrackSourceSchema as Et, MOTION_CLOSE_AFTER_MS as F, customAction as Fn, deriveRecordingMode as Ft, NC_TAXONOMY as G, discriminatedUnion as Gn, evictionPolicyOfLocation as Gt, NC_SNOOZE_MAX_MINUTES as H, _enum as Hn, embeddingRequirementsUnavailableError as Ht, MediaFileKindEnum as I, defineCustomActions as In, describeSystemEventDeliveryProblem as It, NcAlarmSettingsPatchSchema as J, object as Jn, isDetectionMacroClass as Jt, NC_TEMPLATE_VARS as K, literal as Kn, faceGalleryCapability as Kt, NC_ALARM_SYSTEM_EVENT_KINDS as L, hydrateSchema as Ln, describeSystemEventFamilyProblem as Lt, MAX_ARCHIVED_DEBUG_NOTES as M, CamProfileSchema as Mn, buildEventKindDescriptor as Mt, MAX_BIRTH_DECISION_RECORDS as N, DeviceType as Nn, consumableLowPercentOf as Nt, FULL_IMAGE_BBOX as O, zoneAnalyticsCapability as On, alarmPanelCapability as Ot, MAX_BIRTH_LATENCY_PROXY_MS as P, createEvent as Pn, cosineSimilarity as Pt, NcRulePatchSchema as Q, unknown as Qn, isScheduleActive as Qt, NC_CONDITION_CATALOG as R, isDeviceScopedCap as Rn, embeddingEncoderCapability as Rt, EMBEDDING_MODEL_FAILED as S, systemEventFamilyProblems as Sn, TIMELAPSE_DENSE_FLOOR_SEC as St, EVENT_KIND_BY_CAP as T, templateCarriesSummary as Tn, TimelapseRuleSchema as Tt, NC_SYSTEM_EVENT_KIND_GROUP_SPECS as U, array as Un, encodeVectorBase64 as Ut, NC_SENSOR_TRANSITION_KINDS as V, sleep as Vn, embeddingRequirementsFailedError as Vt, NC_TANK_SYSTEM_EVENT_KINDS as W, boolean as Wn, evaluateSensorEdge as Wt, NcConditionsSchema as X, record as Xn, isKnownTemplateVar as Xt, NcConditionDescriptorSchema as Y, partialRecord as Yn, isEventOwnerType as Yt, NcRuleInputSchema as Z, string as Zn, isMediaOwnerType as Zt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as _, sensorRaisedOf as _n, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as _t, CLIP_EMBEDDING_STEP_ID as a, notificationRulesCapability as an, NcSnoozeSuppressedSchema as at, DETECTION_PIPELINE_CAP_NAME as b, subKindsOf as bn, SCENE_DIVERGED as bt, resolveClusterModelPin as c, pipelineAnalyticsCapability as cn, NcTemplatePreviewInputSchema as ct, ArchivedDebugNoteSchema as d, readTimelapseGeneratedAt as dn, OpsLogEntrySchema as dt, isSystemDelivery as en, NcRuleTargetSchema as et, BaseDevice as f, resolveClipSearchMinScore as fn, PoolMemoryWatchdog as ft, DEFAULT_EVENT_COLOR as g, sceneMonitorCapability as gn, RetrainStatusSchema as gt, CoverStateSchema as h, ruleBelongsToAlarm as hn, RebuildObjectEmbeddingsRefusalSchema as ht, CLIP_TEXT_MODELS as i, mayWriteToLocation as in, NcSnoozeSchema as it, LockStateSchema as j, BaseAddon as jn, audioModeOf as jt, FailureCounters as k, errMsg as kn, assertTimelapseCadences as kt, AUDIO_MACRO_LABELS as l, plateGalleryCapability as ln, NcTemplatePreviewSchema as lt, COCO_TO_MACRO as m, resolvePoolMemoryPolicy as mn, RECORDING_SOURCE_CAMSTACK_ADDON as mt, DEFAULT_CLIP_MODEL as n, isVectorIndexDimConflict as nn, NcScheduleSchema as nt, FACE_EMBEDDING_STEP_ID as o, occupancyScope as on, NcSystemEventKindSchema as ot, BirthDecisionRecordSchema as p, resolveLocationMode as pn, RECORDING_EXPORT_MAX_READ_BYTES as pt, NcAlarmConfigSchema as q, number as qn, failureContributionCapability as qt, CLIP_IMAGE_MODELS as r, kebabToCamel as rn, NcSnoozeInputSchema as rt, readClusterModelPinStrict as s, parseProcStatus as sn, NcTaxonomySchema as st, BUILTIN_CLIP_MODELS as t, isSystemEventSummaryRule as tn, NcRuleUpdateInputSchema as tt, AlarmArmModeSchema as u, readDeviceStateFrom as un, NcTemplateVarDescriptorSchema as ut, DEFAULT_TIMELAPSE_PREVIEW_TEXT as v, servedTemplateVars as vn, SCENE_DEFAULT_ANCHOR_THRESHOLD as vt, EMBEDDING_REQUIREMENTS_UNAVAILABLE as w, systemEventSummaryScheduleOf as wn, TimelapseRulePatchSchema as wt, DeclaredDevices as x, systemEventDeliveryProblems as xn, SceneMonitorSchema as xt, DETECTION_MACRO_CLASSES as y, storageOccupancyCapability as yn, SCENE_DEFAULT_UNCOVERED_POLICY as yt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as z, nodePin as zn, embeddingModelFailedError as zt };