@camstack/addon-post-analysis 1.2.291 → 1.2.293

package/dist/{clip-model-registry-CTY5co6P.js → clip-model-registry-BAuTHS_s.js}

@@ -30,7 +30,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 let node_crypto = require("node:crypto");
-//#region ../types/dist/event-category-BVDXG4tB.mjs
+//#region ../types/dist/event-category-C5xZWqz6.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -394,6 +394,16 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* The NATIVE shadow of a cap a composition has claimed fields of moved
+	* (D663). Payload: `{ deviceId, capName, native }` — what the provider
+	* wrote, BEFORE the owned fields are overlaid. Owner-only (D224): it is for
+	* the composer's native self-reads, and the public event routers refuse it
+	* (`isOwnerOnlyEventCategory`) so no consumer surface ever shows a second
+	* truth beside the merged `DeviceStateChanged.slice`. Emitted only under a
+	* `replace` claim, one per native write of that cap.
+	*/
+	EventCategory["DeviceNativeShadowChanged"] = "device.native-shadow-changed";
+	/**
 	* Frame occupancy for a camera CHANGED — a tracked object was gained or
 	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
 	*
@@ -5391,7 +5401,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DC-wdyeS.mjs
+//#region ../types/dist/sleep-jkRQgtSc.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7092,324 +7102,6 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
-var DeviceType = /* @__PURE__ */ function(DeviceType) {
-	DeviceType["Camera"] = "camera";
-	DeviceType["Hub"] = "hub";
-	DeviceType["Light"] = "light";
-	DeviceType["Siren"] = "siren";
-	DeviceType["Switch"] = "switch";
-	DeviceType["Sensor"] = "sensor";
-	DeviceType["Thermostat"] = "thermostat";
-	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
-	*  `climate-control` cap surface with `Thermostat` but renders a
-	*  dedicated AC-appropriate control UI (mode chips, fan speed,
-	*  independent vertical/horizontal swing). Sources: native Gree, and
-	*  reusable by other AC integrations. */
-	DeviceType["Climate"] = "climate";
-	DeviceType["Button"] = "button";
-	/** Generic stateless event emitter — carries a device's EXACT declared
-	*  event vocabulary verbatim (no normalization). Installed with the
-	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
-	*  HA bus events (e.g. `zha_event`, generic). */
-	DeviceType["EventEmitter"] = "event-emitter";
-	/** Firmware/software update entity — current vs available version,
-	*  updatable flag, update state, and an install action. Installed with
-	*  the `update` cap. Sources: Homematic firmware-update channels (and
-	*  reusable by other providers, e.g. HA `update.*` entities). */
-	DeviceType["Update"] = "update";
-	DeviceType["Generic"] = "generic";
-	/** Generic notification delivery target (HA `notify.<service>`, future
-	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
-	*  endpoint; the `notifier` cap defines the send surface. */
-	DeviceType["Notifier"] = "notifier";
-	/** Pre-recorded action sequence with optional parameters
-	*  (HA `script.*`). Runnable via `script-runner` cap. */
-	DeviceType["Script"] = "script";
-	/** Automation rule (HA `automation.*`) — enable/disable + manual
-	*  trigger surface exposed via `automation-control` cap. */
-	DeviceType["Automation"] = "automation";
-	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
-	DeviceType["Lock"] = "lock";
-	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
-	*  `valve.*`). `cover` cap with sub-roles for variant. */
-	DeviceType["Cover"] = "cover";
-	/** Pipe / water / gas valve with open/close/stop and optional
-	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
-	*  modelled on the same open/closed lifecycle. */
-	DeviceType["Valve"] = "valve";
-	/** Humidifier / dehumidifier with on/off + target humidity + mode
-	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
-	*  modelled on the same target / mode lifecycle. */
-	DeviceType["Humidifier"] = "humidifier";
-	/** Water heater / boiler with target temperature + operation mode +
-	*  away mode (HA `water_heater.*`). `water-heater` cap — a
-	*  climate-family actuator. */
-	DeviceType["WaterHeater"] = "water-heater";
-	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
-	DeviceType["Fan"] = "fan";
-	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
-	*  the camera surface — those use `Camera`. `media-player` cap. */
-	DeviceType["MediaPlayer"] = "media-player";
-	/** Security panel / alarm system (HA `alarm_control_panel.*`).
-	*  `alarm-panel` cap. */
-	DeviceType["AlarmPanel"] = "alarm-panel";
-	/** Generic user-settable input (HA `number` / `input_number` / `select`
-	*  / `input_select` / `text` / `input_text` / `input_datetime`).
-	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
-	*  TextControl / DateTimeControl. */
-	DeviceType["Control"] = "control";
-	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
-	*  `presence` cap. */
-	DeviceType["Presence"] = "presence";
-	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
-	*  `weather` cap. */
-	DeviceType["Weather"] = "weather";
-	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
-	DeviceType["Vacuum"] = "vacuum";
-	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
-	*  `lawn-mower-control` cap. */
-	DeviceType["LawnMower"] = "lawn-mower";
-	/** Physical HA device group — parent container for entity-children
-	*  adopted from a single HA device entry. Not renderable as a
-	*  standalone device; exists only to anchor child entities. */
-	DeviceType["Container"] = "container";
-	/** Single still-image entity (HA `image.*`). Read-only display of an
-	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
-	DeviceType["Image"] = "image";
-	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
-	*  level, battery, desiccant life, feeding state and manual-feed /
-	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
-	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
-	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
-	*  integrations sharing the same food/desiccant/hopper surface. */
-	DeviceType["PetFeeder"] = "pet-feeder";
-	return DeviceType;
-}({});
-var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
-	DeviceFeature["BatteryOperated"] = "battery-operated";
-	DeviceFeature["Rebootable"] = "rebootable";
-	/**
-	* Device supports an on-demand re-sync of its derived spec with its
-	* upstream source — drives the generic Re-sync button. The owning
-	* provider implements the action via the `device-adoption.resync` cap.
-	*/
-	DeviceFeature["Resyncable"] = "resyncable";
-	DeviceFeature["NativeSnapshot"] = "native-snapshot";
-	DeviceFeature["DoorbellButton"] = "doorbell-button";
-	DeviceFeature["TwoWayAudio"] = "two-way-audio";
-	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
-	/**
-	* Camera supports the on-firmware autotrack subsystem (subject-
-	* following). Distinct from `PanTiltZoom` because not every PTZ
-	* camera ships autotrack — the admin UI uses this flag to gate
-	* the autotrack toggle / settings card without re-deriving from
-	* the cap registry. Mirrors `ptz-autotrack` cap registration:
-	* driver sets this feature when probe confirms the firmware
-	* surface, and registers the cap in the same code path.
-	*/
-	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
-	/**
-	* Accessory exposes a "trigger on motion" toggle — the parent camera's
-	* motion detection automatically activates this device. Mirrors
-	* `motion-trigger` cap registration: drivers set this feature in the
-	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
-	*
-	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
-	* fast scalar without binding fetch), notifier rules, and `listAll`
-	* filters that want "all devices with on-motion behaviour".
-	*/
-	DeviceFeature["MotionTrigger"] = "motion-trigger";
-	/** Light supports rgb-triplet color via `color` cap. */
-	DeviceFeature["LightColorRgb"] = "light-color-rgb";
-	/** Light supports HSV color via `color` cap. */
-	DeviceFeature["LightColorHsv"] = "light-color-hsv";
-	/** Light supports color-temperature (mired) via `color` cap. */
-	DeviceFeature["LightColorMired"] = "light-color-mired";
-	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
-	*  targetHigh). Gates the range slider UI. */
-	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
-	/** Thermostat exposes target humidity and/or current humidity
-	*  readings. Gates the humidity controls. */
-	DeviceFeature["ClimateHumidity"] = "climate-humidity";
-	/** Thermostat exposes a fan-mode selector. */
-	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
-	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
-	DeviceFeature["ClimatePreset"] = "climate-preset";
-	/** Thermostat exposes a vertical louver swing toggle. Gates the
-	*  vertical-swing switch in the climate UI. Independent of horizontal. */
-	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
-	/** Thermostat exposes a horizontal louver swing toggle. Gates the
-	*  horizontal-swing switch in the climate UI. Independent of vertical. */
-	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
-	/** Cover exposes intermediate position control (0..100). Gates the
-	*  position slider UI. */
-	DeviceFeature["CoverPositionable"] = "cover-positionable";
-	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
-	DeviceFeature["CoverTilt"] = "cover-tilt";
-	/** Valve exposes intermediate position control (0..100). Gates the
-	*  position slider / drag surface UI. */
-	DeviceFeature["ValvePositionable"] = "valve-positionable";
-	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
-	DeviceFeature["FanSpeed"] = "fan-speed";
-	/** Fan exposes a preset mode selector. */
-	DeviceFeature["FanPreset"] = "fan-preset";
-	/** Fan exposes blade direction (forward/reverse) — typical of
-	*  ceiling fans. */
-	DeviceFeature["FanDirection"] = "fan-direction";
-	/** Fan exposes an oscillation toggle. */
-	DeviceFeature["FanOscillating"] = "fan-oscillating";
-	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
-	*  field on the UI lock-controls panel. */
-	DeviceFeature["LockPinRequired"] = "lock-pin-required";
-	/** Lock supports a latch-release ("open door") action distinct from
-	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
-	*  `supported_features`. Gates the Open Door button in the UI. */
-	DeviceFeature["LockOpen"] = "lock-open";
-	/** Media player exposes a seek-to-position surface. */
-	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
-	/** Media player exposes a volume-level setter. */
-	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
-	/** Media player exposes a mute toggle distinct from volume=0. */
-	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
-	/** Media player exposes a shuffle toggle. */
-	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
-	/** Media player exposes a repeat mode (off / all / one). */
-	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
-	/** Media player exposes a source / input selector. */
-	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
-	/** Media player exposes a play-arbitrary-media surface (URL / id). */
-	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
-	/** Media player exposes next-track. */
-	DeviceFeature["MediaPlayerNext"] = "media-player-next";
-	/** Media player exposes previous-track. */
-	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
-	/** Media player exposes stop distinct from pause. */
-	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
-	/** Alarm panel requires a PIN code on arm/disarm. */
-	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
-	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
-	*  addition to a textual location. */
-	DeviceFeature["PresenceGps"] = "presence-gps";
-	/** Notifier accepts an inline / URL image attachment. */
-	DeviceFeature["NotifierImage"] = "notifier-image";
-	/** Notifier accepts a priority hint (high/normal/low). */
-	DeviceFeature["NotifierPriority"] = "notifier-priority";
-	/** Notifier accepts a free-form `data` payload for platform-specific
-	*  fields. */
-	DeviceFeature["NotifierData"] = "notifier-data";
-	/** Notifier supports interactive action buttons / callbacks. */
-	DeviceFeature["NotifierActions"] = "notifier-actions";
-	/** Notifier supports per-call recipient targeting (multi-user). */
-	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
-	/** Script runner accepts a variables map on each run invocation. */
-	DeviceFeature["ScriptVariables"] = "script-variables";
-	/** Automation `trigger` accepts a skipCondition flag — fires the
-	*  automation's actions while bypassing its condition block. */
-	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
-	/** Robot vacuum exposes a live cleaning map (image child). Gates the
-	*  map tile in the vacuum UI. */
-	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
-	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
-	*  switches group. */
-	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
-	/** Robot mower exposes a live mowing map (SVG image child). Gates the
-	*  mower map tile. */
-	DeviceFeature["MowerHasMap"] = "mower-has-map";
-	/** Robot mower exposes targeted mowing (all-area / zones / edges /
-	*  spots) — gates the Mow action + map selectors. */
-	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
-	return DeviceFeature;
-}({});
-/**
-* Semantic role a device plays within its parent. Populated by driver
-* addons when creating accessory devices (Reolink siren/floodlight/
-* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
-* admin UI to pick icons, labels, and widgets — a `Switch` with
-* `role: Floodlight` renders as a bulb with a brightness slider,
-* whereas a `Switch` with `role: Siren` renders as a klaxon.
-*
-* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
-* sqlite as a nullable TEXT column — old rows keep working unchanged.
-*/
-var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
-	DeviceRole["Siren"] = "siren";
-	DeviceRole["Floodlight"] = "floodlight";
-	DeviceRole["Spotlight"] = "spotlight";
-	DeviceRole["PirSensor"] = "pir-sensor";
-	DeviceRole["Chime"] = "chime";
-	DeviceRole["Autotrack"] = "autotrack";
-	DeviceRole["Nightvision"] = "nightvision";
-	DeviceRole["PrivacyMask"] = "privacy-mask";
-	DeviceRole["Doorbell"] = "doorbell";
-	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
-	*  real Switch device for UI rendering / export adapters. */
-	DeviceRole["BinaryHelper"] = "binary-helper";
-	/** Generic motion / occupancy / moving event source. Distinct from
-	*  the camera accessory PirSensor role: that one is a camera child;
-	*  this is a standalone HA / 3rd-party motion sensor. */
-	DeviceRole["MotionSensor"] = "motion-sensor";
-	DeviceRole["ContactSensor"] = "contact-sensor";
-	DeviceRole["LeakSensor"] = "leak-sensor";
-	DeviceRole["SmokeSensor"] = "smoke-sensor";
-	DeviceRole["COSensor"] = "co-sensor";
-	DeviceRole["GasSensor"] = "gas-sensor";
-	DeviceRole["TamperSensor"] = "tamper-sensor";
-	DeviceRole["VibrationSensor"] = "vibration-sensor";
-	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
-	DeviceRole["SoundSensor"] = "sound-sensor";
-	/** Fallback for `binary_sensor` without a known `device_class`. */
-	DeviceRole["BinarySensor"] = "binary-sensor";
-	DeviceRole["TemperatureSensor"] = "temperature-sensor";
-	DeviceRole["HumiditySensor"] = "humidity-sensor";
-	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
-	DeviceRole["PressureSensor"] = "pressure-sensor";
-	/** Wind speed or direction (weather-station `wind-sensor` cap). */
-	DeviceRole["WindSensor"] = "wind-sensor";
-	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
-	DeviceRole["RainSensor"] = "rain-sensor";
-	/** UV index (weather-station `uv-sensor` cap). */
-	DeviceRole["UvSensor"] = "uv-sensor";
-	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
-	*  Distinct from AmbientLightSensor (lux). */
-	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
-	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
-	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
-	DeviceRole["PowerSensor"] = "power-sensor";
-	DeviceRole["EnergySensor"] = "energy-sensor";
-	DeviceRole["VoltageSensor"] = "voltage-sensor";
-	DeviceRole["CurrentSensor"] = "current-sensor";
-	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
-	/** Battery level (numeric % via `sensor` OR low-bool via
-	*  `binary_sensor` — the cap distinguishes via the value type). */
-	DeviceRole["BatterySensor"] = "battery-sensor";
-	/** Fallback for `sensor` numeric without a known `device_class`. */
-	DeviceRole["NumericSensor"] = "numeric-sensor";
-	/** String / enum state (HA `sensor` with `state_class: enum` or
-	*  `attributes.options`). */
-	DeviceRole["EnumSensor"] = "enum-sensor";
-	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
-	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
-	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
-	DeviceRole["DateTimeSensor"] = "datetime-sensor";
-	/** Last-resort fallback when nothing else matches. */
-	DeviceRole["GenericSensor"] = "generic-sensor";
-	DeviceRole["NumericControl"] = "numeric-control";
-	DeviceRole["SelectControl"] = "select-control";
-	DeviceRole["TextControl"] = "text-control";
-	DeviceRole["DateTimeControl"] = "datetime-control";
-	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
-	*  rich features (image, priority, channel routing). */
-	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
-	/** Chat / messaging service (HA `notify.telegram_*`,
-	*  `notify.discord_*`, etc.). */
-	DeviceRole["MessagingNotifier"] = "messaging-notifier";
-	/** Email-based delivery (HA `notify.smtp`, etc.). */
-	DeviceRole["EmailNotifier"] = "email-notifier";
-	/** Fallback when the notifier service name doesn't match a known
-	*  pattern. */
-	DeviceRole["GenericNotifier"] = "generic-notifier";
-	return DeviceRole;
-}({});
 /**
 * Identity — preserves literal types for downstream inference.
 *
@@ -7634,7 +7326,337 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/canonical-hash-CPK2Dy60.mjs
+//#region ../types/dist/err-msg-DX6i_MY4.mjs
+var DeviceType = /* @__PURE__ */ function(DeviceType) {
+	DeviceType["Camera"] = "camera";
+	DeviceType["Hub"] = "hub";
+	DeviceType["Light"] = "light";
+	DeviceType["Siren"] = "siren";
+	DeviceType["Switch"] = "switch";
+	DeviceType["Sensor"] = "sensor";
+	DeviceType["Thermostat"] = "thermostat";
+	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
+	*  `climate-control` cap surface with `Thermostat` but renders a
+	*  dedicated AC-appropriate control UI (mode chips, fan speed,
+	*  independent vertical/horizontal swing). Sources: native Gree, and
+	*  reusable by other AC integrations. */
+	DeviceType["Climate"] = "climate";
+	DeviceType["Button"] = "button";
+	/** Generic stateless event emitter — carries a device's EXACT declared
+	*  event vocabulary verbatim (no normalization). Installed with the
+	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
+	*  HA bus events (e.g. `zha_event`, generic). */
+	DeviceType["EventEmitter"] = "event-emitter";
+	/** Firmware/software update entity — current vs available version,
+	*  updatable flag, update state, and an install action. Installed with
+	*  the `update` cap. Sources: Homematic firmware-update channels (and
+	*  reusable by other providers, e.g. HA `update.*` entities). */
+	DeviceType["Update"] = "update";
+	DeviceType["Generic"] = "generic";
+	/** Generic notification delivery target (HA `notify.<service>`, future
+	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
+	*  endpoint; the `notifier` cap defines the send surface. */
+	DeviceType["Notifier"] = "notifier";
+	/** Pre-recorded action sequence with optional parameters
+	*  (HA `script.*`). Runnable via `script-runner` cap. */
+	DeviceType["Script"] = "script";
+	/** Automation rule (HA `automation.*`) — enable/disable + manual
+	*  trigger surface exposed via `automation-control` cap. */
+	DeviceType["Automation"] = "automation";
+	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
+	DeviceType["Lock"] = "lock";
+	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
+	*  `valve.*`). `cover` cap with sub-roles for variant. */
+	DeviceType["Cover"] = "cover";
+	/** Pipe / water / gas valve with open/close/stop and optional
+	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
+	*  modelled on the same open/closed lifecycle. */
+	DeviceType["Valve"] = "valve";
+	/** Humidifier / dehumidifier with on/off + target humidity + mode
+	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
+	*  modelled on the same target / mode lifecycle. */
+	DeviceType["Humidifier"] = "humidifier";
+	/** Water heater / boiler with target temperature + operation mode +
+	*  away mode (HA `water_heater.*`). `water-heater` cap — a
+	*  climate-family actuator. */
+	DeviceType["WaterHeater"] = "water-heater";
+	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
+	DeviceType["Fan"] = "fan";
+	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
+	*  the camera surface — those use `Camera`. `media-player` cap. */
+	DeviceType["MediaPlayer"] = "media-player";
+	/** Security panel / alarm system (HA `alarm_control_panel.*`).
+	*  `alarm-panel` cap. */
+	DeviceType["AlarmPanel"] = "alarm-panel";
+	/** Generic user-settable input (HA `number` / `input_number` / `select`
+	*  / `input_select` / `text` / `input_text` / `input_datetime`).
+	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
+	*  TextControl / DateTimeControl. */
+	DeviceType["Control"] = "control";
+	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
+	*  `presence` cap. */
+	DeviceType["Presence"] = "presence";
+	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
+	*  `weather` cap. */
+	DeviceType["Weather"] = "weather";
+	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
+	DeviceType["Vacuum"] = "vacuum";
+	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
+	*  `lawn-mower-control` cap. */
+	DeviceType["LawnMower"] = "lawn-mower";
+	/** Physical HA device group — parent container for entity-children
+	*  adopted from a single HA device entry. Not renderable as a
+	*  standalone device; exists only to anchor child entities. */
+	DeviceType["Container"] = "container";
+	/** Single still-image entity (HA `image.*`). Read-only display of an
+	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
+	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
+	return DeviceType;
+}({});
+var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
+	DeviceFeature["BatteryOperated"] = "battery-operated";
+	DeviceFeature["Rebootable"] = "rebootable";
+	/**
+	* Device supports an on-demand re-sync of its derived spec with its
+	* upstream source — drives the generic Re-sync button. The owning
+	* provider implements the action via the `device-adoption.resync` cap.
+	*/
+	DeviceFeature["Resyncable"] = "resyncable";
+	DeviceFeature["NativeSnapshot"] = "native-snapshot";
+	DeviceFeature["DoorbellButton"] = "doorbell-button";
+	DeviceFeature["TwoWayAudio"] = "two-way-audio";
+	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
+	/**
+	* Camera supports the on-firmware autotrack subsystem (subject-
+	* following). Distinct from `PanTiltZoom` because not every PTZ
+	* camera ships autotrack — the admin UI uses this flag to gate
+	* the autotrack toggle / settings card without re-deriving from
+	* the cap registry. Mirrors `ptz-autotrack` cap registration:
+	* driver sets this feature when probe confirms the firmware
+	* surface, and registers the cap in the same code path.
+	*/
+	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
+	/**
+	* Accessory exposes a "trigger on motion" toggle — the parent camera's
+	* motion detection automatically activates this device. Mirrors
+	* `motion-trigger` cap registration: drivers set this feature in the
+	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
+	*
+	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
+	* fast scalar without binding fetch), notifier rules, and `listAll`
+	* filters that want "all devices with on-motion behaviour".
+	*/
+	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/** Light supports rgb-triplet color via `color` cap. */
+	DeviceFeature["LightColorRgb"] = "light-color-rgb";
+	/** Light supports HSV color via `color` cap. */
+	DeviceFeature["LightColorHsv"] = "light-color-hsv";
+	/** Light supports color-temperature (mired) via `color` cap. */
+	DeviceFeature["LightColorMired"] = "light-color-mired";
+	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
+	*  targetHigh). Gates the range slider UI. */
+	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
+	/** Thermostat exposes target humidity and/or current humidity
+	*  readings. Gates the humidity controls. */
+	DeviceFeature["ClimateHumidity"] = "climate-humidity";
+	/** Thermostat exposes a fan-mode selector. */
+	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
+	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
+	DeviceFeature["ClimatePreset"] = "climate-preset";
+	/** Thermostat exposes a vertical louver swing toggle. Gates the
+	*  vertical-swing switch in the climate UI. Independent of horizontal. */
+	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
+	/** Thermostat exposes a horizontal louver swing toggle. Gates the
+	*  horizontal-swing switch in the climate UI. Independent of vertical. */
+	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
+	/** Cover exposes intermediate position control (0..100). Gates the
+	*  position slider UI. */
+	DeviceFeature["CoverPositionable"] = "cover-positionable";
+	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
+	DeviceFeature["CoverTilt"] = "cover-tilt";
+	/** Valve exposes intermediate position control (0..100). Gates the
+	*  position slider / drag surface UI. */
+	DeviceFeature["ValvePositionable"] = "valve-positionable";
+	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
+	DeviceFeature["FanSpeed"] = "fan-speed";
+	/** Fan exposes a preset mode selector. */
+	DeviceFeature["FanPreset"] = "fan-preset";
+	/** Fan exposes blade direction (forward/reverse) — typical of
+	*  ceiling fans. */
+	DeviceFeature["FanDirection"] = "fan-direction";
+	/** Fan exposes an oscillation toggle. */
+	DeviceFeature["FanOscillating"] = "fan-oscillating";
+	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
+	*  field on the UI lock-controls panel. */
+	DeviceFeature["LockPinRequired"] = "lock-pin-required";
+	/** Lock supports a latch-release ("open door") action distinct from
+	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
+	*  `supported_features`. Gates the Open Door button in the UI. */
+	DeviceFeature["LockOpen"] = "lock-open";
+	/** Media player exposes a seek-to-position surface. */
+	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
+	/** Media player exposes a volume-level setter. */
+	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
+	/** Media player exposes a mute toggle distinct from volume=0. */
+	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
+	/** Media player exposes a shuffle toggle. */
+	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
+	/** Media player exposes a repeat mode (off / all / one). */
+	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
+	/** Media player exposes a source / input selector. */
+	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
+	/** Media player exposes a play-arbitrary-media surface (URL / id). */
+	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
+	/** Media player exposes next-track. */
+	DeviceFeature["MediaPlayerNext"] = "media-player-next";
+	/** Media player exposes previous-track. */
+	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
+	/** Media player exposes stop distinct from pause. */
+	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
+	/** Alarm panel requires a PIN code on arm/disarm. */
+	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
+	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
+	*  addition to a textual location. */
+	DeviceFeature["PresenceGps"] = "presence-gps";
+	/** Notifier accepts an inline / URL image attachment. */
+	DeviceFeature["NotifierImage"] = "notifier-image";
+	/** Notifier accepts a priority hint (high/normal/low). */
+	DeviceFeature["NotifierPriority"] = "notifier-priority";
+	/** Notifier accepts a free-form `data` payload for platform-specific
+	*  fields. */
+	DeviceFeature["NotifierData"] = "notifier-data";
+	/** Notifier supports interactive action buttons / callbacks. */
+	DeviceFeature["NotifierActions"] = "notifier-actions";
+	/** Notifier supports per-call recipient targeting (multi-user). */
+	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
+	/** Script runner accepts a variables map on each run invocation. */
+	DeviceFeature["ScriptVariables"] = "script-variables";
+	/** Automation `trigger` accepts a skipCondition flag — fires the
+	*  automation's actions while bypassing its condition block. */
+	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
+	/** Robot vacuum exposes a live cleaning map (image child). Gates the
+	*  map tile in the vacuum UI. */
+	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
+	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
+	*  switches group. */
+	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
+	/** Robot mower exposes a live mowing map (SVG image child). Gates the
+	*  mower map tile. */
+	DeviceFeature["MowerHasMap"] = "mower-has-map";
+	/** Robot mower exposes targeted mowing (all-area / zones / edges /
+	*  spots) — gates the Mow action + map selectors. */
+	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
+	return DeviceFeature;
+}({});
+/**
+* Semantic role a device plays within its parent. Populated by driver
+* addons when creating accessory devices (Reolink siren/floodlight/
+* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
+* admin UI to pick icons, labels, and widgets — a `Switch` with
+* `role: Floodlight` renders as a bulb with a brightness slider,
+* whereas a `Switch` with `role: Siren` renders as a klaxon.
+*
+* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
+* sqlite as a nullable TEXT column — old rows keep working unchanged.
+*/
+var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
+	DeviceRole["Siren"] = "siren";
+	DeviceRole["Floodlight"] = "floodlight";
+	DeviceRole["Spotlight"] = "spotlight";
+	DeviceRole["PirSensor"] = "pir-sensor";
+	DeviceRole["Chime"] = "chime";
+	DeviceRole["Autotrack"] = "autotrack";
+	DeviceRole["Nightvision"] = "nightvision";
+	DeviceRole["PrivacyMask"] = "privacy-mask";
+	DeviceRole["Doorbell"] = "doorbell";
+	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
+	*  real Switch device for UI rendering / export adapters. */
+	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** Generic motion / occupancy / moving event source. Distinct from
+	*  the camera accessory PirSensor role: that one is a camera child;
+	*  this is a standalone HA / 3rd-party motion sensor. */
+	DeviceRole["MotionSensor"] = "motion-sensor";
+	DeviceRole["ContactSensor"] = "contact-sensor";
+	DeviceRole["LeakSensor"] = "leak-sensor";
+	DeviceRole["SmokeSensor"] = "smoke-sensor";
+	DeviceRole["COSensor"] = "co-sensor";
+	DeviceRole["GasSensor"] = "gas-sensor";
+	DeviceRole["TamperSensor"] = "tamper-sensor";
+	DeviceRole["VibrationSensor"] = "vibration-sensor";
+	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
+	DeviceRole["SoundSensor"] = "sound-sensor";
+	/** Fallback for `binary_sensor` without a known `device_class`. */
+	DeviceRole["BinarySensor"] = "binary-sensor";
+	DeviceRole["TemperatureSensor"] = "temperature-sensor";
+	DeviceRole["HumiditySensor"] = "humidity-sensor";
+	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
+	DeviceRole["PressureSensor"] = "pressure-sensor";
+	/** Wind speed or direction (weather-station `wind-sensor` cap). */
+	DeviceRole["WindSensor"] = "wind-sensor";
+	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
+	DeviceRole["RainSensor"] = "rain-sensor";
+	/** UV index (weather-station `uv-sensor` cap). */
+	DeviceRole["UvSensor"] = "uv-sensor";
+	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
+	*  Distinct from AmbientLightSensor (lux). */
+	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
+	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
+	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
+	DeviceRole["PowerSensor"] = "power-sensor";
+	DeviceRole["EnergySensor"] = "energy-sensor";
+	DeviceRole["VoltageSensor"] = "voltage-sensor";
+	DeviceRole["CurrentSensor"] = "current-sensor";
+	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
+	/** Battery level (numeric % via `sensor` OR low-bool via
+	*  `binary_sensor` — the cap distinguishes via the value type). */
+	DeviceRole["BatterySensor"] = "battery-sensor";
+	/** Fallback for `sensor` numeric without a known `device_class`. */
+	DeviceRole["NumericSensor"] = "numeric-sensor";
+	/** String / enum state (HA `sensor` with `state_class: enum` or
+	*  `attributes.options`). */
+	DeviceRole["EnumSensor"] = "enum-sensor";
+	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
+	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
+	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
+	DeviceRole["DateTimeSensor"] = "datetime-sensor";
+	/** Last-resort fallback when nothing else matches. */
+	DeviceRole["GenericSensor"] = "generic-sensor";
+	DeviceRole["NumericControl"] = "numeric-control";
+	DeviceRole["SelectControl"] = "select-control";
+	DeviceRole["TextControl"] = "text-control";
+	DeviceRole["DateTimeControl"] = "datetime-control";
+	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
+	*  rich features (image, priority, channel routing). */
+	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
+	/** Chat / messaging service (HA `notify.telegram_*`,
+	*  `notify.discord_*`, etc.). */
+	DeviceRole["MessagingNotifier"] = "messaging-notifier";
+	/** Email-based delivery (HA `notify.smtp`, etc.). */
+	DeviceRole["EmailNotifier"] = "email-notifier";
+	/** Fallback when the notifier service name doesn't match a known
+	*  pattern. */
+	DeviceRole["GenericNotifier"] = "generic-notifier";
+	return DeviceRole;
+}({});
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
+//#endregion
+//#region ../types/dist/composition-CPFIlFfw.mjs
 /**
 * Deterministic SHA-256 hash of an arbitrary serialisable value. The
 * canonical form sorts object keys alphabetically at every depth so two
@@ -7666,162 +7688,899 @@ function replaceWithSortedKeys(_key, value) {
 	}
 	return value;
 }
-//#endregion
-//#region ../types/dist/err-msg-IQTHeDzc.mjs
 /**
-import { errMsg } from '@camstack/types'
-* Extract a human-readable message from an unknown error value.
-* Replaces the ubiquitous `errMsg(err)` pattern.
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
 */
-function errMsg(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	return String(err);
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
 }
-var OWNER_TYPES = new Set([
-	"track",
-	"summary",
-	"face",
-	"identity",
-	"plate",
-	"vehicle",
-	"scene",
-	"motion",
-	"object",
-	"audio",
-	"mosaic"
-]);
-/**
-* Is this string a declared media owner type?
-*
-* Exported because the `event-media` plane's path parser needs it (D482): a
-* path segment is an arbitrary string until something narrows it, and a
-* hand-written list at the door would drift from {@link MEDIA_OWNER_TYPES} the
-* day an owner kind is added — the failure this module's own docblock already
-* records for `vehicle` and `scene`.
-*/
-function isMediaOwnerType(value) {
-	return OWNER_TYPES.has(value);
+function asString(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
 }
-/**
-* The owner types that are event tables, in the order the event-media resolver
-* should consider them. Exported so a consumer asking "is this key an event?"
-* does not re-spell the list and drift from it.
-*/
-var EVENT_OWNER_TYPES = [
-	"motion",
-	"object",
-	"audio"
-];
-/**
-* The same list as a Zod enum, for the cap inputs that must NAME the table
-* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
-* `(table, id)`).
-*
-* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
-* table would otherwise be accepted by the codec and refused at the door, with
-* nothing failing until a caller asked.
-*/
-var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
-/** The same list as a Zod enum, for the cap input that carries it. */
-var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
-var EVENT_OWNER_TYPE_SET = new Set(EVENT_OWNER_TYPES);
-/** True when this key's owner is one of the three event tables. */
-function isEventOwnerType(ownerType) {
-	return EVENT_OWNER_TYPE_SET.has(ownerType);
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
 }
-var EncodeProfileSchema = object({
-	video: object({
-		codec: _enum([
-			"h264",
-			"h265",
-			"copy"
-		]),
-		profile: _enum([
-			"baseline",
-			"main",
-			"high"
-		]).optional(),
-		/**
-		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
-		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
-		* it, or it ships a stream that does not match its own advertisement — the
-		* defect class that kept HomeKit black for a year and that Alexa carried
-		* silently. Optional because a browser negotiates the level itself.
-		*/
-		level: string().optional(),
-		width: number().int().positive().optional(),
-		height: number().int().positive().optional(),
-		fps: number().positive().optional(),
-		bitrateKbps: number().int().positive().optional(),
-		gopFrames: number().int().positive().optional(),
-		bf: number().int().min(0).optional(),
-		preset: _enum([
-			"ultrafast",
-			"superfast",
-			"veryfast",
-			"faster",
-			"fast",
-			"medium"
-		]).optional(),
-		tune: _enum([
-			"zerolatency",
-			"film",
-			"animation"
-		]).optional(),
-		/**
-		* ONE slice per access unit.
-		*
-		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
-		* the encoder as five NAL slices that share one RTP timestamp and carry one
-		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
-		* frame-end per frame: the first pictures render and the video then freezes
-		* for good while the audio, on its own plane, plays on. Measured on this hub
-		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
-		*
-		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
-		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
-		* consumers meaning the same thing spelled differently would stop sharing one
-		* child. Absent means "whatever the encoder does" — today's behaviour.
-		*/
-		singleSlicePerFrame: boolean().optional()
-	}),
-	audio: union([literal("passthrough"), object({
-		codec: _enum([
-			"opus",
-			"aac",
-			"pcmu",
-			"pcma",
-			"copy"
-		]),
-		bitrateKbps: number().int().positive().optional(),
-		sampleRateHz: number().int().positive().optional(),
-		channels: union([literal(1), literal(2)]).optional()
-	})]),
-	/**
-	* ffmpeg input-side args, inserted between the fixed global flags
-	* (`-hide_banner -loglevel error`) and `-i pipe:0`. Free-text array
-	* — the widget surfaces a textarea + suggestion chips for the most-
-	* used demuxer/format options.
-	*/
-	inputArgs: array(string()).optional(),
-	/**
-	* ffmpeg output-side args, inserted between the encode block and
-	* the final `-f <muxer> pipe:1`. Use for muxer options, bitstream
-	* filters, codec-specific overrides. Free-text array.
-	*/
-	outputArgs: array(string()).optional()
-});
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+function asBoolean(value, name, index) {
+	if (typeof value !== "boolean") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a boolean`);
+	return value;
+}
+/** A plain decimal (optional sign, fraction, exponent) — never hex, never `Infinity`, never a unit suffix. */
+var DECIMAL = /^[+-]?(\d+(\.\d*)?|\.\d+)([eE][+-]?\d+)?$/;
 /**
-* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
-* Baseline because it is the one profile every consumer in this repo decodes
-* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+* `number(x)`: a finite number, or a string that IS one, as a number; every
+* other value — `''`, `'unavailable'`, a boolean, null — is `null`
+* (unavailable, never 0: D393). The one bridge from a string-valued source (an
+* HA sensor with a unit and no device_class is an `enum-sensor`) to a number.
 */
-var BASE_LIVE_EGRESS_PROFILE = {
-	video: {
-		codec: "h264",
-		profile: "baseline",
-		level: "3.1",
+function toNumberOrNull(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : null;
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!DECIMAL.test(trimmed)) return null;
+	const parsed = Number(trimmed);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString(args[1], "convert", 1).trim();
+			const to = asString(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	},
+	any: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean(a, "any", i)).some((b) => b)
+	},
+	all: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean(a, "all", i)).every((b) => b)
+	},
+	within: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args, hooks) => {
+			const windowMs = asFiniteNumber(args[1], "within", 1);
+			if (windowMs < 0) throw new ExpressionEvalError("within: the window must not be negative");
+			const at = args[0];
+			if (at === null) return false;
+			const ts = asFiniteNumber(at, "within", 0);
+			const now = hooks.now;
+			if (now === void 0 || !Number.isFinite(now)) throw new ExpressionEvalError("within: no clock was supplied to this evaluation");
+			const inside = now - ts <= windowMs;
+			if (inside) hooks.noteDeadline?.(ts + windowMs + 1);
+			return inside;
+		}
+	},
+	number: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => toNumberOrNull(args[0])
+	},
+	latest: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const present = args.flatMap((a, i) => a === null ? [] : [asFiniteNumber(a, "latest", i)]);
+			return present.length === 0 ? null : finiteResult(Math.max(...present), "latest");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/** A composed device's stableId is this prefix plus the block id. */
+var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
+/** Longest snippet a `code` source may carry (slice 4). */
+var MAX_COMPOSITION_CODE_LENGTH = 2e4;
+var CompositionSourceRefSchema = object({
+	/** The owning addon; `stableId` is unique only within it. */
+	addonId: string().min(1),
+	stableId: string().min(1)
+});
+/** One field of one capability of one source device. */
+var CompositionFieldReadSchema = object({
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	/** Dotted path into the source cap's runtime-state slice. */
+	fieldPath: string().min(1)
+});
+/** `from`: copy one source field verbatim. It is also an expression's `from` binding. */
+var CompositionFromSourceSchema = CompositionFieldReadSchema.extend({ kind: literal("from") });
+var CompositionBindingSchema = discriminatedUnion("kind", [CompositionFromSourceSchema, object({
+	kind: literal("literal"),
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	])
+})]);
+/**
+* `expression`: a formula over named bindings, in the salvaged expression
+* engine. Validated at parse by the SAME function every other consumer runs,
+* so the editor and the store cannot disagree.
+*/
+var CompositionExpressionSourceSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), CompositionBindingSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/** `code`: RESERVED for slice 4 (own runner, one-way eject). */
+var CompositionCodeSourceSchema = object({
+	kind: literal("code"),
+	code: string().min(1).max(MAX_COMPOSITION_CODE_LENGTH)
+});
+var CompositionFieldSourceSchema = discriminatedUnion("kind", [
+	CompositionFromSourceSchema,
+	CompositionExpressionSourceSchema,
+	CompositionCodeSourceSchema
+]);
+var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
+	kind: literal("forward"),
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	method: string().min(1)
+}), CompositionCodeSourceSchema]);
+/** An item key inside an item-array cap (`consumables.items[<key>]`). */
+var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
+/**
+* One item of an item-array cap (D663), addressed through the cap's
+* `status.itemArray` descriptor. `fields` are paths INSIDE the item, nested
+* allowed (`remaining.value`); the key and label come from the entry itself.
+*/
+var CompositionItemEntrySchema = object({
+	label: string().min(1).max(80),
+	fields: record(string().min(1), CompositionFieldSourceSchema)
+});
+var CompositionFeatureSchema = discriminatedUnion("kind", [object({
+	kind: literal("fields"),
+	cap: string().min(1),
+	fields: record(string().min(1), CompositionFieldSourceSchema).refine((fields) => Object.keys(fields).length <= 32, { message: `at most 32 fields per capability` }),
+	/**
+	* Items of the cap's item array, keyed by item key (D663). Naming `items`
+	* owns the WHOLE array field: the composed value holds exactly these items.
+	*/
+	items: record(string().regex(COMPOSITION_ITEM_KEY_RE), CompositionItemEntrySchema).refine((items) => Object.keys(items).length <= 16, { message: `at most 16 items` }).optional(),
+	/** RESERVED for slice 3; refused by the validator when non-empty. */
+	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
+}), object({
+	kind: literal("passthrough"),
+	cap: string().min(1),
+	source: CompositionSourceRefSchema
+})]);
+var CompositionSchema = object({
+	target: discriminatedUnion("kind", [object({
+		kind: literal("new"),
+		type: _enum(DeviceType),
+		role: _enum(DeviceRole).optional()
+	}), object({
+		kind: literal("existing"),
+		device: CompositionSourceRefSchema
+	})]),
+	features: array(CompositionFeatureSchema).min(1).max(16)
+}).superRefine((composition, ctx) => {
+	const seen = /* @__PURE__ */ new Set();
+	composition.features.forEach((feature, index) => {
+		if (seen.has(feature.cap)) ctx.addIssue({
+			code: "custom",
+			message: `capability \`${feature.cap}\` is composed twice — one feature per capability`,
+			path: [
+				"features",
+				index,
+				"cap"
+			]
+		});
+		seen.add(feature.cap);
+	});
+});
+var OWNER_TYPES = new Set([
+	"track",
+	"summary",
+	"face",
+	"identity",
+	"plate",
+	"vehicle",
+	"scene",
+	"motion",
+	"object",
+	"audio",
+	"mosaic"
+]);
+/**
+* Is this string a declared media owner type?
+*
+* Exported because the `event-media` plane's path parser needs it (D482): a
+* path segment is an arbitrary string until something narrows it, and a
+* hand-written list at the door would drift from {@link MEDIA_OWNER_TYPES} the
+* day an owner kind is added — the failure this module's own docblock already
+* records for `vehicle` and `scene`.
+*/
+function isMediaOwnerType(value) {
+	return OWNER_TYPES.has(value);
+}
+/**
+* The owner types that are event tables, in the order the event-media resolver
+* should consider them. Exported so a consumer asking "is this key an event?"
+* does not re-spell the list and drift from it.
+*/
+var EVENT_OWNER_TYPES = [
+	"motion",
+	"object",
+	"audio"
+];
+/**
+* The same list as a Zod enum, for the cap inputs that must NAME the table
+* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
+* `(table, id)`).
+*
+* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
+* table would otherwise be accepted by the codec and refused at the door, with
+* nothing failing until a caller asked.
+*/
+var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
+var EVENT_OWNER_TYPE_SET = new Set(EVENT_OWNER_TYPES);
+/** True when this key's owner is one of the three event tables. */
+function isEventOwnerType(ownerType) {
+	return EVENT_OWNER_TYPE_SET.has(ownerType);
+}
+var EncodeProfileSchema = object({
+	video: object({
+		codec: _enum([
+			"h264",
+			"h265",
+			"copy"
+		]),
+		profile: _enum([
+			"baseline",
+			"main",
+			"high"
+		]).optional(),
+		/**
+		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+		* it, or it ships a stream that does not match its own advertisement — the
+		* defect class that kept HomeKit black for a year and that Alexa carried
+		* silently. Optional because a browser negotiates the level itself.
+		*/
+		level: string().optional(),
+		width: number().int().positive().optional(),
+		height: number().int().positive().optional(),
+		fps: number().positive().optional(),
+		bitrateKbps: number().int().positive().optional(),
+		gopFrames: number().int().positive().optional(),
+		bf: number().int().min(0).optional(),
+		preset: _enum([
+			"ultrafast",
+			"superfast",
+			"veryfast",
+			"faster",
+			"fast",
+			"medium"
+		]).optional(),
+		tune: _enum([
+			"zerolatency",
+			"film",
+			"animation"
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
+	}),
+	audio: union([literal("passthrough"), object({
+		codec: _enum([
+			"opus",
+			"aac",
+			"pcmu",
+			"pcma",
+			"copy"
+		]),
+		bitrateKbps: number().int().positive().optional(),
+		sampleRateHz: number().int().positive().optional(),
+		channels: union([literal(1), literal(2)]).optional()
+	})]),
+	/**
+	* ffmpeg input-side args, inserted between the fixed global flags
+	* (`-hide_banner -loglevel error`) and `-i pipe:0`. Free-text array
+	* — the widget surfaces a textarea + suggestion chips for the most-
+	* used demuxer/format options.
+	*/
+	inputArgs: array(string()).optional(),
+	/**
+	* ffmpeg output-side args, inserted between the encode block and
+	* the final `-f <muxer> pipe:1`. Use for muxer options, bitstream
+	* filters, codec-specific overrides. Free-text array.
+	*/
+	outputArgs: array(string()).optional()
+});
+/**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
 		width: 1280,
 		height: 720,
 		fps: 25,
@@ -9539,1504 +10298,888 @@ function isStorageLocationMode(value) {
 /** May this location be written to? */
 function mayWriteToLocation(location) {
 	return modeMayWrite(resolveLocationMode(location));
-}
-/** What eviction may do to this location. */
-function evictionPolicyOfLocation(location) {
-	return evictionPolicyForMode(resolveLocationMode(location));
-}
-/**
-* `StorageLocationType` — an addon-declared id that identifies the *kind* of
-* storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
-* so the persisted record schema and the consumer-facing cap can both consume it
-* without forming a circular import. The `storage` cap re-exports it
-* verbatim for back-compat.
-*
-* This Zod schema is the **authoritative source** for `StorageLocationType`.
-* The TS alias in `./storage.ts` re-exports `z.infer<typeof
-* StorageLocationTypeSchema>` so the wire surface (cap) and the legacy
-* `IStorageProvider` interface stay in lockstep.
-*
-* The type is now an **open string** (not a closed enum) — addons declare
-* their own location kinds via `StorageLocationDeclaration.id`. The regex
-* enforces a safe id format: lowercase-start, alphanumeric + hyphens.
-*/
-var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
-/**
-* Persisted record for a storage location instance. Operators can register
-* multiple instances for multi-cardinality types (e.g. two `backups`
-* locations with different `providerId`s). Cardinality is now declared per
-* location via `StorageLocationDeclaration.cardinality` — the static
-* `STORAGE_LOCATION_CARDINALITY` map has been removed.
-*
-* `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The seed names its first instance `<type>:default` — a NAME, not a flag.
-* There is no default location any more (D383): `enabled` is the whole write
-* model, and a bare type ref resolves to the sole location of the type, or —
-* transitionally, only while legacy NULL-stamped rows exist — to the row whose
-* slug is `default`.
-*
-* `isSystem` is a legacy persisted flag. Seed still creates the initial
-* `<type>:default` locations; the flag is no longer a lock, a badge, or a
-* prune selector. New writes leave it false. Deletion is gated on uniqueness
-* / last-enabled, not on this bit.
-*/
-var StorageLocationSchema = object({
-	id: string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
-	type: string(),
-	displayName: string().min(1),
-	providerId: string().min(1),
-	config: record(string(), unknown()),
-	/**
-	* Cluster node this location physically lives on. REQUIRED for node-local
-	* providers (filesystem — the path exists on one node's disk), null/absent
-	* for node-agnostic providers (S3/SFTP/WebDAV, reachable from any node).
-	* `'hub'` is the hub node. Validated against the provider's `nodeLocal`
-	* flag at upsert time, not here (the schema is provider-agnostic).
-	*/
-	nodeId: string().optional(),
-	isSystem: boolean().default(false),
-	/**
-	* THE write switch, and the only one (D383). `enabled: true` means every
-	* consumer that chooses a write target for this type may write here, and all
-	* enabled locations of a type are used TOGETHER; `false` means read-only —
-	* still read, still played back, still age-swept, still drained, never
-	* written.
-	*
-	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
-	* stored" on an update and "born inert unless it is the first location of its
-	* type" on a create. On a PERSISTED row absence is legacy and it means
-	* enabled — {@link isLocationEnabled} is the one place that says so, and the
-	* orchestrator stamps every flagless row `true` once at hydrate so absence
-	* stops existing rather than being re-derived on every read.
-	*/
-	enabled: boolean().optional(),
-	/**
-	* THE state of this location (D385), and the only authority on what may be
-	* written, read or evicted here. Interpreted in exactly one place —
-	* `storage-location-mode.ts` — which also folds the legacy
-	* `enabled` / `config.readOnly` pair into a mode so an old row is never
-	* ambiguous.
-	*
-	* OPTIONAL only for the wire and for rows written before D385: absence is
-	* resolved by `resolveLocationMode`, and the orchestrator stamps every
-	* unstamped row ONCE at hydrate so absence stops existing rather than being
-	* re-derived on every read. `enabled` survives one release as a DERIVED
-	* mirror (`mode === 'active'`); `withLocationMode` is the only writer of
-	* either, so the two cannot disagree.
-	*/
-	mode: StorageLocationModeSchema.optional(),
-	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
-	*  for node-local locations it can reach) — never persisted, absent when the
-	*  volume is remote/unreachable. The single capacity truth every UI reads. */
-	capacity: object({
-		totalBytes: number(),
-		availableBytes: number()
-	}).nullable().optional(),
-	/**
-	* How much of that volume CamStack ITSELF holds on this location (D388) —
-	* COMPUTED at read time from the `storage-occupancy` providers' own figures,
-	* never persisted, never a filesystem walk.
-	*
-	* **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
-	* location yet — nobody stores here, the owning addon is down, or the first
-	* refresh has not completed. A UI must omit the segment rather than draw it
-	* at zero, which would claim we occupy nothing (D315). It is an OBJECT and
-	* not a bare number precisely so that a `?? 0` on the consuming side has to
-	* be spelled out loud instead of appearing by accident.
-	*
-	* `measuredAtMs` is the OLDEST contributing measurement, so it is honest
-	* about the whole figure rather than about its freshest part.
-	*/
-	owned: object({
-		bytes: number().int().nonnegative(),
-		measuredAtMs: number().int().nonnegative()
-	}).optional(),
-	createdAt: number(),
-	updatedAt: number()
-});
-object({ isDefault: boolean().optional() });
-/**
-* How far a `drain` has got (D386) — the read a UI renders, and nothing more.
-*
-* `estimatedEmptyAtMs` is derived from the growth the ratchet has actually
-* OBSERVED and is `null` when it has observed none. Never a fabricated date: a
-* drain with no observed growth has no honest ETA, and inventing one is how an
-* operator learns not to believe the screen.
-*/
-var StorageDrainProgressSchema = object({
-	locationId: string(),
-	startedAtMs: number(),
-	startBytes: number(),
-	bytesRemaining: number(),
-	drained: boolean(),
-	estimatedEmptyAtMs: number().nullable()
-});
-/**
-* Reference accepted by consumer-facing `api.storage.*` calls.
-* Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
-*    (transitionally, the `<type>:default`-slugged row when several exist)
-*  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
-*
-* The orchestrator's `resolveRef(ref)` handles both cases.
-*/
-var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
-/**
-* `StorageLocationDeclaration` — a single storage-location entry declared by
-* an addon in its `package.json` under `camstack.storageLocations`.
-*
-* Design intent:
-* - **Addon declares its needs** — each addon describes the logical storage
-*   slots it requires (e.g. `recordings`, `recordingsLow`) without caring
-*   about the physical path.
-* - **Kernel aggregates** — at boot the kernel collects declarations from all
-*   installed addons, deduplicates by `id`, and exposes the union via the
-*   storage-locations settings surface.
-* - **Orchestrator seeds** — for every declared `id` the orchestrator ensures
-*   at least one instance named `<id>:default` is present, using
-*   `defaultsTo` to inherit the resolved root from another location when the
-*   declaration is a derivative slot (e.g. `recordingsLow` defaults to
-*   `recordings`).
-* - **ids are global** — `id` values are shared across the entire deployment;
-*   two addons declaring the same `id` must agree on `cardinality` (validated
-*   at kernel aggregation time, not here).
-*/
-/**
-* `StorageAccess` — how the service that DECLARED a storage-location kind
-* actually reaches the bytes. It is the constraint that decides which
-* `storage-provider`s may back a location of that kind.
-*
-* - `'local-path'` — the service asks `storage.resolve` for a path string and
-*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
-*   post-analysis media roots). Only a provider that serves a genuine local
-*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
-*   remote provider's `resolve` returns a path on the REMOTE host, and
-*   `fs.readdir` of it on this node either fails or — far worse — succeeds
-*   against a same-named local directory that is something else entirely.
-*
-* - `'cap-mediated'` — every byte travels through the `storage` cap
-*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
-*   service never sees a path, so any provider can back it. `backups` is the
-*   one kind that qualifies today.
-*
-* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
-* an EMERGENT property of how the recorder happened to be written. Nothing
-* refused the configuration; the first write simply went somewhere wrong, and
-* a recording write that goes wrong surfaces as a silent black window rather
-* than an error (the read path does not `stat`). This turns that accident into
-* a declared, enforced, testable refusal.
-*/
-var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
-var StorageLocationDeclarationSchema = object({
-	/**
-	* Global location identifier, e.g. `recordings` or `recordingsLow`.
-	* Must start with a lowercase letter and may contain letters, digits, and
-	* hyphens.
-	*/
-	id: string().regex(/^[a-z][a-zA-Z0-9-]*$/, { message: "id must start with a lowercase letter and contain only letters, digits, or hyphens" }),
-	/** Human-readable name shown in the admin UI. */
-	displayName: string().min(1, { message: "displayName must not be empty" }),
-	/** Optional longer explanation of what data this location stores. */
-	description: string().optional(),
-	/**
-	* `single` — exactly one instance of this location is allowed system-wide
-	* (e.g. `logs`, `models`). The operator can edit it but not add more.
-	* `multi`  — the operator may register several instances (e.g. a second
-	* `recordings` on a NAS for disk tiering); one is the default at any time.
-	*/
-	cardinality: _enum(["single", "multi"]),
-	/**
-	* HOW the declaring service reaches the bytes — and therefore WHICH
-	* providers may back a location of this kind. See {@link StorageAccessSchema}
-	* and {@link STORAGE_ACCESS_FALLBACK}.
-	*
-	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
-	* can only over-restrict (refuse a remote provider for a kind that might
-	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
-	* permissive direction and is therefore never inferred — a repo guard
-	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
-	* reached by omission.
-	*/
-	access: StorageAccessSchema.optional(),
-	/**
-	* When set, the default instance for this location inherits its resolved
-	* root from the named location's default instance. Useful for derivative
-	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
-	* configure the primary location.
-	*/
-	defaultsTo: string().optional(),
-	/**
-	* Which node root the seeded `<id>:default` instance is placed under on a
-	* FRESH install:
-	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (logs, models).
-	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
-	*   env is set, else falls back to the data root. Right for bulky, hot media
-	*   (recordings, event media) that should stay off the appData disk.
-	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
-	*   `/backups` in the image) so archives live on their own mount rather than
-	*   filling the appData disk. Falls back to the data root when unset.
-	*
-	* Only affects the seeded default's `basePath`; operators can repoint any
-	* location afterwards, and a `defaultsTo` slot inherits its parent's root
-	* regardless of this field. Absent (the common case) is treated as `'data'`.
-	*/
-	defaultRoot: _enum([
-		"data",
-		"media",
-		"backup"
-	]).optional()
-});
-var DecoderStatsSchema = object({
-	inputFps: number(),
-	outputFps: number(),
-	avgDecodeTimeMs: number(),
-	droppedFrames: number(),
-	/**
-	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
-	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
-	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
-	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
-	*/
-	lagMs: number().optional(),
-	effectiveFps: number().optional(),
-	adaptiveFps: number().optional()
-});
-var DecoderSessionConfigSchema = object({
-	codec: string(),
-	maxFps: number().default(0),
-	outputFormat: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]).default("jpeg"),
-	scale: number().default(1),
-	width: number().optional(),
-	height: number().optional(),
-	/**
-	* Identifier of the camera this decoder session serves. Optional
-	* because the cap is generic (any caller could request decode), but
-	* stream-broker passes it so decoder logs include `deviceId` for
-	* per-camera filtering when diagnosing failures (e.g. node-av
-	* sendPacket errors on a single hung camera).
-	*/
-	deviceId: number().int().nonnegative().optional(),
-	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
-	*/
-	tag: string().optional(),
-	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
-	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
-	*/
-	frameSink: _enum(["callback", "shm"]).default("callback"),
-	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
-	*/
-	debug: boolean().optional()
-});
-/**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
+}
+/** What eviction may do to this location. */
+function evictionPolicyOfLocation(location) {
+	return evictionPolicyForMode(resolveLocationMode(location));
+}
 /**
-* Distinct (device, family, variant) counters one instance will hold.
+* `StorageLocationType` — an addon-declared id that identifies the *kind* of
+* storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
+* so the persisted record schema and the consumer-facing cap can both consume it
+* without forming a circular import. The `storage` cap re-exports it
+* verbatim for back-compat.
 *
-* A large fleet x the handful of families any single addon reports, with
-* slack. At ~200 B per counter this is a ~100 KB ceiling on a process that
-* already declares an RSS budget in the gigabytes.
-*/
-var MAX_KEYS = 1024;
-/**
-* Where reasons past {@link MAX_REASONS_PER_KEY} go.
+* This Zod schema is the **authoritative source** for `StorageLocationType`.
+* The TS alias in `./storage.ts` re-exports `z.infer<typeof
+* StorageLocationTypeSchema>` so the wire surface (cap) and the legacy
+* `IStorageProvider` interface stay in lockstep.
 *
-* They are FOLDED, never dropped: `attempts - succeeded` must always equal the
-* sum of the reason counts, or the ratio stops adding up.
+* The type is now an **open string** (not a closed enum) — addons declare
+* their own location kinds via `StorageLocationDeclaration.id`. The regex
+* enforces a safe id format: lowercase-start, alphanumeric + hyphens.
 */
-var OVERFLOW_REASON = "other";
-/** `deviceId` + `family` + optional `variant`, flattened into the map key. */
-function counterKey(deviceId, family, variant) {
-	return variant === void 0 ? `${deviceId}${family}` : `${deviceId}${family}${variant}`;
-}
+var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 /**
-* A bounded set of per-camera, cumulative failure counters.
+* Persisted record for a storage location instance. Operators can register
+* multiple instances for multi-cardinality types (e.g. two `backups`
+* locations with different `providerId`s). Cardinality is now declared per
+* location via `StorageLocationDeclaration.cardinality` — the static
+* `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
-* One instance per contributing subsystem. `note` is O(1) and allocation-free
-* on the steady path; `snapshot` reads without mutating anything.
+* `id` is a stable namespaced string of the form `<type>:<slug>`.
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
+*
+* `isSystem` is a legacy persisted flag. Seed still creates the initial
+* `<type>:default` locations; the flag is no longer a lock, a badge, or a
+* prune selector. New writes leave it false. Deletion is gated on uniqueness
+* / last-enabled, not on this bit.
 */
-var FailureCounters = class {
-	maxKeys;
-	maxReasons;
-	counters = /* @__PURE__ */ new Map();
-	refused = 0;
-	constructor(maxKeys = MAX_KEYS, maxReasons = 16) {
-		this.maxKeys = maxKeys;
-		this.maxReasons = maxReasons;
-	}
+var StorageLocationSchema = object({
+	id: string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
+	type: string(),
+	displayName: string().min(1),
+	providerId: string().min(1),
+	config: record(string(), unknown()),
 	/**
-	* Counters refused because {@link MAX_KEYS} was already held.
-	*
-	* Cumulative for the life of the instance: a bound that bit is a fact about
-	* the deployment, and a surface that hid it would under-report a fleet
-	* precisely when the fleet got large enough to matter.
+	* Cluster node this location physically lives on. REQUIRED for node-local
+	* providers (filesystem — the path exists on one node's disk), null/absent
+	* for node-agnostic providers (S3/SFTP/WebDAV, reachable from any node).
+	* `'hub'` is the hub node. Validated against the provider's `nodeLocal`
+	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
-	get keysRefused() {
-		return this.refused;
-	}
-	/** Counters currently held. */
-	get size() {
-		return this.counters.size;
-	}
+	nodeId: string().optional(),
+	isSystem: boolean().default(false),
 	/**
-	* Fold one observation in.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* A non-positive or non-integer `deviceId` is REFUSED rather than bucketed:
-	* see the module docblock — an entry that cannot name its camera is worse
-	* than no entry.
-	*/
-	note(observation, nowMs) {
-		if (!Number.isInteger(observation.deviceId) || observation.deviceId <= 0) return;
-		const key = counterKey(observation.deviceId, observation.family, observation.variant);
-		let counter = this.counters.get(key);
-		if (counter === void 0) {
-			if (this.counters.size >= this.maxKeys) {
-				this.refused += 1;
-				return;
-			}
-			counter = {
-				deviceId: observation.deviceId,
-				family: observation.family,
-				variant: observation.variant,
-				sinceMs: nowMs,
-				attempts: 0,
-				succeeded: 0,
-				reasons: /* @__PURE__ */ new Map()
-			};
-			this.counters.set(key, counter);
-		}
-		counter.attempts += 1;
-		if (observation.reason === void 0) {
-			counter.succeeded += 1;
-			return;
-		}
-		const reason = counter.reasons.has(observation.reason) || counter.reasons.size < this.maxReasons ? observation.reason : OVERFLOW_REASON;
-		counter.reasons.set(reason, (counter.reasons.get(reason) ?? 0) + 1);
-	}
-	/** Read every counter. Never mutates — see the module docblock. */
-	snapshot(nowMs) {
-		const out = [];
-		for (const counter of this.counters.values()) out.push({
-			deviceId: counter.deviceId,
-			family: counter.family,
-			...counter.variant !== void 0 ? { variant: counter.variant } : {},
-			sinceMs: counter.sinceMs,
-			atMs: nowMs,
-			attempts: counter.attempts,
-			succeeded: counter.succeeded,
-			reasons: [...counter.reasons.entries()].map(([reason, count]) => ({
-				reason,
-				count
-			})).toSorted((a, b) => b.count - a.count)
-		});
-		return out;
-	}
-	/** Drop everything (host disposal). */
-	clear() {
-		this.counters.clear();
-	}
-};
-var ClipModelMetaSchema = object({
-	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
-	textModelId: string().min(1),
-	/** Output dimension of BOTH towers. A vector of any other length is refused. */
-	embeddingDim: number().int().positive(),
-	/**
-	* The `vector-store` index this model's vectors live in. ONE feature space
-	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
-	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	enabled: boolean().optional(),
 	/**
-	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
-	* must be unique per tokenizer: every model's siblings land in ONE flat
-	* models directory, so two different tokenizers under the same name would
-	* silently overwrite each other (whichever model downloaded last wins, and
-	* the other one tokenises with the wrong vocabulary).
+	* THE state of this location (D385), and the only authority on what may be
+	* written, read or evicted here. Interpreted in exactly one place —
+	* `storage-location-mode.ts` — which also folds the legacy
+	* `enabled` / `config.readOnly` pair into a mode so an old row is never
+	* ambiguous.
+	*
+	* OPTIONAL only for the wire and for rows written before D385: absence is
+	* resolved by `resolveLocationMode`, and the orchestrator stamps every
+	* unstamped row ONCE at hydrate so absence stops existing rather than being
+	* re-derived on every read. `enabled` survives one release as a DERIVED
+	* mirror (`mode === 'active'`); `withLocationMode` is the only writer of
+	* either, so the two cannot disagree.
 	*/
-	tokenizerFile: string().min(1),
-	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
-	contextLength: number().int().positive(),
-	/** Id the tokenizer pads with. */
-	padId: number().int().nonnegative(),
+	mode: StorageLocationModeSchema.optional(),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: object({
+		totalBytes: number(),
+		availableBytes: number()
+	}).nullable().optional(),
 	/**
-	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
-	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
-	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	* How much of that volume CamStack ITSELF holds on this location (D388) —
+	* COMPUTED at read time from the `storage-occupancy` providers' own figures,
+	* never persisted, never a filesystem walk.
+	*
+	* **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
+	* location yet — nobody stores here, the owning addon is down, or the first
+	* refresh has not completed. A UI must omit the segment rather than draw it
+	* at zero, which would claim we occupy nothing (D315). It is an OBJECT and
+	* not a bare number precisely so that a `?? 0` on the consuming side has to
+	* be spelled out loud instead of appearing by accident.
+	*
+	* `measuredAtMs` is the OLDEST contributing measurement, so it is honest
+	* about the whole figure rather than about its freshest part.
 	*/
-	searchMinScore: number().min(0).max(1)
+	owned: object({
+		bytes: number().int().nonnegative(),
+		measuredAtMs: number().int().nonnegative()
+	}).optional(),
+	createdAt: number(),
+	updatedAt: number()
 });
-var ClipSearchStrictnessSchema = _enum([
-	"loose",
-	"balanced",
-	"strict"
-]);
-var CLIP_STRICTNESS_FACTOR = {
-	loose: 1,
-	balanced: 1.25,
-	strict: 1.5
-};
-/**
-* The cosine floor a search runs with.
-*
-* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
-* and silently rescaling it would make the same URL mean different things on
-* two installs. Everything else is relative to the model.
-*/
-function resolveClipSearchMinScore(meta, request) {
-	if (request.minScore !== void 0) return request.minScore;
-	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
-	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
-}
-var MODEL_FORMATS = [
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-];
+object({ isDefault: boolean().optional() });
 /**
-* Multi-file format payload.
+* How far a `drain` has got (D386) — the read a UI renders, and nothing more.
 *
-* - Directory formats (`isDirectory: true`, e.g. `.mlpackage`): files
-*   relative to the directory root — the downloader fetches each from
-*   `{url}/{file}` into `{modelDir}/{file}`. If omitted, it probes the
-*   HuggingFace API (slower).
-* - Single-file formats (no `isDirectory`, e.g. OpenVINO IR): sibling
-*   files fetched from the SAME remote directory as `url` and stored flat
-*   alongside the main file — e.g. `['camstack-yolov9t.bin']` for the IR
-*   weights next to `camstack-yolov9t.xml`.
-*/
-var ModelFormatEntrySchema = object({
-	url: string(),
-	sizeMB: number(),
-	/** Whether this format is a directory bundle (e.g., .mlpackage) rather than a single file */
-	isDirectory: boolean().optional(),
-	/** Multi-file payload (directory members or sibling files). */
-	files: array(string()).readonly().optional(),
-	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["python"])).readonly().optional()
-});
-/**
-* Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
-* The downloader fetches from `url` and saves to `{modelsDir}/{filename}`.
+* `estimatedEmptyAtMs` is derived from the growth the ratchet has actually
+* OBSERVED and is `null` when it has observed none. Never a fabricated date: a
+* drain with no observed growth has no honest ETA, and inventing one is how an
+* operator learns not to believe the screen.
 */
-var ModelExtraFileSchema = object({
-	url: string(),
-	filename: string(),
-	sizeMB: number()
+var StorageDrainProgressSchema = object({
+	locationId: string(),
+	startedAtMs: number(),
+	startBytes: number(),
+	bytesRemaining: number(),
+	drained: boolean(),
+	estimatedEmptyAtMs: number().nullable()
 });
 /**
-* Per-format payload map. Modelled as an explicit object (one optional key
-* per `ModelFormat`) rather than `z.record(enum, …)` — zod v4's enum-keyed
-* record requires every key, but a catalog entry only ships a subset of
-* formats.
+* Reference accepted by consumer-facing `api.storage.*` calls.
+* Either:
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
+*  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
+*
+* The orchestrator's `resolveRef(ref)` handles both cases.
 */
-var ModelFormatsSchema = object({
-	onnx: ModelFormatEntrySchema.optional(),
-	coreml: ModelFormatEntrySchema.optional(),
-	openvino: ModelFormatEntrySchema.optional(),
-	tflite: ModelFormatEntrySchema.optional(),
-	pt: ModelFormatEntrySchema.optional(),
-	gguf: ModelFormatEntrySchema.optional()
-});
+var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
 /**
-* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
-* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
-* grouped Family→Tier→Variant picker renders identically in the config UI and
-* in the pipeline/device steppers. The flat `id` stays the source of truth for
-* resolution/download/persistence; this is a presentation overlay resolved back
-* to an `id`.
+* `StorageLocationDeclaration` — a single storage-location entry declared by
+* an addon in its `package.json` under `camstack.storageLocations`.
+*
+* Design intent:
+* - **Addon declares its needs** — each addon describes the logical storage
+*   slots it requires (e.g. `recordings`, `recordingsLow`) without caring
+*   about the physical path.
+* - **Kernel aggregates** — at boot the kernel collects declarations from all
+*   installed addons, deduplicates by `id`, and exposes the union via the
+*   storage-locations settings surface.
+* - **Orchestrator seeds** — for every declared `id` the orchestrator ensures
+*   at least one instance named `<id>:default` is present, using
+*   `defaultsTo` to inherit the resolved root from another location when the
+*   declaration is a derivative slot (e.g. `recordingsLow` defaults to
+*   `recordings`).
+* - **ids are global** — `id` values are shared across the entire deployment;
+*   two addons declaring the same `id` must agree on `cardinality` (validated
+*   at kernel aggregation time, not here).
 */
-var ModelVariantGroupSchema = object({
-	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
-	family: string(),
-	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
-	tier: string(),
-	/** Quantization axis. Omit ⇒ the fp32 base build. */
-	precision: _enum(["fp32", "int8"]).optional(),
-	/**
-	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
-	* future performance variants plug into.
-	*/
-	optimization: _enum(["standard", "fast"]).optional(),
-	/**
-	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
-	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
-	* cheap latency lever — especially on Apple ANE and the Intel N100 — at a
-	* small-object accuracy cost. Mirrors the model's `inputSize` but lifted onto
-	* the group so the selector can offer it as a variant axis.
-	*/
-	resolution: number().int().positive().optional()
-});
-var ModelProviderIdSchema = _enum([
-	"camstack",
-	"frigate",
-	"scrypted",
-	"custom"
-]);
 /**
-* The licence of a model, as a record rather than a bare SPDX string: a
-* permissive CODE licence routinely sits on top of restrictive WEIGHTS or
-* DATA, and the obligations (attribution, modification notices, source offers)
-* are per upstream. A persisted custom-model row written when this field was a
-* string still parses — the string is lifted into `{ weights }`.
+* `StorageAccess` — how the service that DECLARED a storage-location kind
+* actually reaches the bytes. It is the constraint that decides which
+* `storage-provider`s may back a location of that kind.
 *
-* Every licence surface (the admin "Models and licenses" page,
-* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
-* these records by `scripts/gen-model-licenses.ts` (D661).
+* - `'local-path'` — the service asks `storage.resolve` for a path string and
+*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
+*   post-analysis media roots). Only a provider that serves a genuine local
+*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
+*   remote provider's `resolve` returns a path on the REMOTE host, and
+*   `fs.readdir` of it on this node either fails or — far worse — succeeds
+*   against a same-named local directory that is something else entirely.
+*
+* - `'cap-mediated'` — every byte travels through the `storage` cap
+*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
+*   service never sees a path, so any provider can back it. `backups` is the
+*   one kind that qualifies today.
+*
+* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
+* an EMERGENT property of how the recorder happened to be written. Nothing
+* refused the configuration; the first write simply went somewhere wrong, and
+* a recording write that goes wrong surfaces as a silent black window rather
+* than an error (the read path does not `stat`). This turns that accident into
+* a declared, enforced, testable refusal.
 */
-var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
-	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
-	weights: string().min(1),
-	/** SPDX id of the upstream code that defines / trained the network. */
-	code: string().min(1).optional(),
-	/** Training data whose terms add obligations (attribution, non-commercial). */
-	data: object({
-		name: string().min(1),
-		terms: string().min(1),
-		url: string().url().optional()
-	}).optional(),
-	/** The project the weights come from. Required on built-in entries (guard). */
-	upstream: object({
-		name: string().min(1),
-		url: string().url()
-	}).optional(),
-	/** Where the licence text governing the weights is published. */
-	url: string().url().optional(),
-	/** Attribution the licence REQUIRES, verbatim. */
-	attribution: string().min(1).optional(),
-	/** What CamStack changed. Required when `hosting` is `camstack-hf` (guard). */
-	modifications: string().min(1).optional(),
-	/** Who serves the file a node downloads. */
-	hosting: _enum([
-		"camstack-hf",
-		"third-party",
-		"built-in"
-	]).optional(),
-	/** True when the weights or their data forbid commercial use. */
-	nonCommercial: boolean().optional()
-}));
-var ModelCatalogEntrySchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	formats: ModelFormatsSchema,
-	inputSize: object({
-		width: number(),
-		height: number()
-	}),
-	/**
-	* Channel count of the model input tensor. Omit ⇒ 3 (RGB), the default for
-	* every detector / classifier / embedder. Set to 1 for a grayscale CTC text
-	* recognizer (EasyOCR VGG plate-OCR: input `[N,1,H,W]`) so the preprocess
-	* feeds a single-channel, EasyOCR-normalized tensor instead of the default
-	* 3-channel RGB one. Threaded through `PoolModelConfig.inputChannels` to the
-	* Python inference pool.
-	*/
-	inputChannels: number().int().positive().optional(),
-	labels: array(LabelDefinitionSchema).readonly(),
-	inputLayout: _enum(["nchw", "nhwc"]).optional(),
-	/**
-	* `'scrfd'` applies InsightFace's SCRFD input contract, `(x - 127.5) / 128`
-	* (upstream `insightface/model_zoo/scrfd.py`), instead of the historical
-	* plain `/255`. Measured against COCO GT: 188 → 196 faces found on the
-	* `scrfd-2.5g` catalog entry (2026-09-26 model-replacement spike, §2.4-2).
-	*/
-	inputNormalization: _enum([
-		"zero-one",
-		"imagenet",
-		"none",
-		"scrfd"
-	]).optional(),
-	/**
-	* The model already applies softmax IN-GRAPH — its raw output is a
-	* probability distribution, not logits. When set, the `softmax`
-	* postprocessor must NOT re-apply softmax: re-softmaxing an already-normalised
-	* probability vector collapses it toward uniform (top-1 score craters far
-	* below its true value, making every confidence gate meaningless). Absent ⇒
-	* the output is raw logits and the postprocessor applies softmax (the normal
-	* case). Set on the Google AIY Birds `bird-classifier` (softmax baked into the
-	* TF graph). Threaded to the Python pool via `PoolModelConfig.outputProbabilities`.
-	*/
-	outputProbabilities: boolean().optional(),
-	preprocessMode: _enum(["letterbox", "resize"]).optional(),
-	/**
-	* Per-MODEL postprocessor override. Absent ⇒ the step's own
-	* `StepDefinition.postprocessor` applies (the normal case — every model in a
-	* step shares its decode). Set it when a step hosts models with DIFFERENT raw
-	* output layouts under one slot: e.g. object-detection is `'yolo'` by default,
-	* but a Coral SSD MobileNet build emits the `TFLite_Detection_PostProcess`
-	* 4-tensor layout and needs `'ssd'`. Threaded into `PoolModelConfig.postprocessor`
-	* by the engine factory (`modelEntry.postprocessor ?? def.postprocessor`).
-	*/
-	postprocessor: custom().optional(),
+var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
+var StorageLocationDeclarationSchema = object({
 	/**
-	* Per-MODEL default confidence floor. Absent ⇒ the step's
-	* `StepDefinition.defaultConfidence` applies. A score is a property of one
-	* model's output scale, not of the step slot it sits in: YuNet's
-	* `sqrt(cls·obj)` is not SCRFD's score, and inheriting SCRFD's 0.5 filled the
-	* face gallery with wheels and hands (D662, amends D645). An operator's
-	* explicit value still wins over it. Resolved in ONE place —
-	* `addon-pipeline/.../registry/effective-confidence.ts`.
+	* Global location identifier, e.g. `recordings` or `recordingsLow`.
+	* Must start with a lowercase letter and may contain letters, digits, and
+	* hyphens.
 	*/
-	defaultConfidence: number().min(0).max(1).optional(),
+	id: string().regex(/^[a-z][a-zA-Z0-9-]*$/, { message: "id must start with a lowercase letter and contain only letters, digits, or hyphens" }),
+	/** Human-readable name shown in the admin UI. */
+	displayName: string().min(1, { message: "displayName must not be empty" }),
+	/** Optional longer explanation of what data this location stores. */
+	description: string().optional(),
 	/**
-	* When true, the executor produces a landmark-aligned crop (similarity warp
-	* onto the canonical template) before this step runs, instead of a plain
-	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
-	* their embeddings are only discriminative on an aligned input. The face
-	* detector that produced the parent detail must emit 5 landmarks.
+	* `single` — exactly one instance of this location is allowed system-wide
+	* (e.g. `logs`, `models`). The operator can edit it but not add more.
+	* `multi`  — the operator may register several instances (e.g. a second
+	* `recordings` on a NAS for disk tiering); one is the default at any time.
 	*/
-	faceAlignment: boolean().optional(),
+	cardinality: _enum(["single", "multi"]),
 	/**
-	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
-	* Downloaded into the same modelsDir alongside the model file.
+	* HOW the declaring service reaches the bytes — and therefore WHICH
+	* providers may back a location of this kind. See {@link StorageAccessSchema}
+	* and {@link STORAGE_ACCESS_FALLBACK}.
+	*
+	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+	* can only over-restrict (refuse a remote provider for a kind that might
+	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+	* permissive direction and is therefore never inferred — a repo guard
+	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+	* reached by omission.
 	*/
-	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
+	access: StorageAccessSchema.optional(),
 	/**
-	* LEGACY entry — retained in the catalog so a persisted operator selection
-	* still RESOLVES (and can be re-activated), but hidden from the selectable
-	* model list and excluded from the auto format-default pick. Set on the
-	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
-	* the active lineup stays the coherent curated ladder without deleting a
-	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
-	* an explicit legacy id that has a build for the node's format.
+	* When set, the default instance for this location inherits its resolved
+	* root from the named location's default instance. Useful for derivative
+	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
+	* configure the primary location.
 	*/
-	legacy: boolean().optional(),
+	defaultsTo: string().optional(),
 	/**
-	* Measured quality/latency metadata — populated from the benchmark addon on
-	* the real node classes. Absent = not yet measured (most entries today; the
-	* catalog historically carried only `sizeMB`, a poor cross-architecture
-	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
+	* Which node root the seeded `<id>:default` instance is placed under on a
+	* FRESH install:
+	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
+	*   the appData volume. Right for small/durable data (logs, models).
+	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
+	*   env is set, else falls back to the data root. Right for bulky, hot media
+	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
+	*
+	* Only affects the seeded default's `basePath`; operators can repoint any
+	* location afterwards, and a `defaultsTo` slot inherits its parent's root
+	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	metrics: object({
-		map50: number().optional(),
-		p95LatencyMs: record(string(), number()).optional()
-	}).optional(),
+	defaultRoot: _enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
+});
+var DecoderStatsSchema = object({
+	inputFps: number(),
+	outputFps: number(),
+	avgDecodeTimeMs: number(),
+	droppedFrames: number(),
 	/**
-	* The model's licence record — see {@link ModelLicenseSchema}. Optional in
-	* the schema (a custom model's author may state none); REQUIRED and complete
-	* on every built-in catalog entry (`scripts/check-catalog-licence.ts`).
+	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
+	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
+	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
+	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
 	*/
-	license: ModelLicenseSchema.optional(),
+	lagMs: number().optional(),
+	effectiveFps: number().optional(),
+	adaptiveFps: number().optional()
+});
+var DecoderSessionConfigSchema = object({
+	codec: string(),
+	maxFps: number().default(0),
+	outputFormat: _enum([
+		"jpeg",
+		"rgb",
+		"bgr",
+		"yuv420",
+		"gray"
+	]).default("jpeg"),
+	scale: number().default(1),
+	width: number().optional(),
+	height: number().optional(),
 	/**
-	* Variant-selector grouping. The UI groups models by `family` + `tier` and
-	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
-	* of a family's sizes and quantizations collapse into one grouped picker
-	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
-	* (legacy / custom models) — never shown in the grouped selector. The flat
-	* `id` stays the source of truth for resolution/download/persistence; grouping
-	* is a presentation overlay resolved back to an `id`.
+	* Identifier of the camera this decoder session serves. Optional
+	* because the cap is generic (any caller could request decode), but
+	* stream-broker passes it so decoder logs include `deviceId` for
+	* per-camera filtering when diagnosing failures (e.g. node-av
+	* sendPacket errors on a single hung camera).
 	*/
-	group: ModelVariantGroupSchema.optional(),
+	deviceId: number().int().nonnegative().optional(),
 	/**
-	* Catalog source for the pipeline stepper's provider-first picker. Absent on
-	* built-in CamStack entries (treated as `camstack`) and on registry rows
-	* persisted before this field existed (`inferModelProvider` fills those).
+	* Free-form tag for log scoping. Stream-broker uses
+	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
+	* on every line so `grep tag=broker:5/high` filters one camera
+	* profile cleanly.
 	*/
-	provider: ModelProviderIdSchema.optional(),
+	tag: string().optional(),
 	/**
-	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
-	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
-	* labels already ARE the CamStack macros (Scrypted identity map).
+	* Where the session delivers decoded frames (Phase 5 / D9):
+	*
+	* - `'callback'` (default) — the legacy pixel path: decoded frames are
+	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
+	* - `'shm'` — the shared-memory frame plane: decoded frames are written
+	*   into an OS shared-memory ring and drained as zero-pixel
+	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
+	*   other — `pullFrames` returns nothing for an `'shm'` session and
+	*   `pullHandles` returns nothing for a `'callback'` session.
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional(),
+	frameSink: _enum(["callback", "shm"]).default("callback"),
 	/**
-	* The model's CLIP feature-space contract (text encoder, dimension, vector
-	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
-	* CLIP image encoder; its absence is what "not a CLIP model" means to the
-	* embedding encoder and the semantic-search store (D649).
+	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
+	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
+	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
+	* stream-broker's `streamingDebug` gate — off by default so production logs
+	* stay quiet and the emit path pays zero per-frame cost when disabled.
 	*/
-	clip: ClipModelMetaSchema.optional()
-});
-var ConvertTargetSchema = discriminatedUnion("format", [object({
-	format: literal("openvino"),
-	precisions: array(_enum(["fp16", "int8"])).min(1).readonly()
-}), object({ format: literal("coreml") })]);
-var ModelConvertMetadataSchema = object({
-	id: string().regex(/^[a-zA-Z0-9._-]+$/),
-	name: string(),
-	labels: array(LabelDefinitionSchema).readonly(),
-	inputSize: object({
-		width: number(),
-		height: number()
-	}),
-	inputLayout: _enum(["nchw", "nhwc"]).optional(),
-	inputNormalization: _enum([
-		"zero-one",
-		"imagenet",
-		"none",
-		"scrfd"
-	]).optional(),
-	preprocessMode: _enum(["letterbox", "resize"]).optional(),
-	outputFormat: _enum([
-		"yolo",
-		"ssd",
-		"embedding",
-		"classification",
-		"ocr",
-		"segmentation"
-	]),
-	faceAlignment: boolean().optional(),
-	classMap: DetectionCatalogClassMapSchema.optional()
-});
-var ConvertResultSchema = object({
-	entry: ModelCatalogEntrySchema,
-	artifacts: array(object({
-		format: _enum(MODEL_FORMATS),
-		precision: _enum(["fp16", "int8"]).optional(),
-		sizeMB: number(),
-		validated: boolean(),
-		files: array(string()).readonly()
-	})).readonly()
+	debug: boolean().optional()
 });
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-function asBoolean$1(value, name, index) {
-	if (typeof value !== "boolean") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a boolean`);
-	return value;
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	},
-	any: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => args.map((a, i) => asBoolean$1(a, "any", i)).some((b) => b)
-	},
-	all: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => args.map((a, i) => asBoolean$1(a, "all", i)).every((b) => b)
-	},
-	within: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args, hooks) => {
-			const windowMs = asFiniteNumber(args[1], "within", 1);
-			if (windowMs < 0) throw new ExpressionEvalError("within: the window must not be negative");
-			const at = args[0];
-			if (at === null) return false;
-			const ts = asFiniteNumber(at, "within", 0);
-			const now = hooks.now;
-			if (now === void 0 || !Number.isFinite(now)) throw new ExpressionEvalError("within: no clock was supplied to this evaluation");
-			const inside = now - ts <= windowMs;
-			if (inside) hooks.noteDeadline?.(ts + windowMs + 1);
-			return inside;
-		}
-	},
-	latest: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const present = args.flatMap((a, i) => a === null ? [] : [asFiniteNumber(a, "latest", i)]);
-			return present.length === 0 ? null : finiteResult(Math.max(...present), "latest");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Resource-bound constants for the safe expression engine.
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
 *
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
-*/
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
 /**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
+* The level a channel writes at once armed.
 *
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
 *
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
 */
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* Distinct (device, family, variant) counters one instance will hold.
+*
+* A large fleet x the handful of families any single addon reports, with
+* slack. At ~200 B per counter this is a ~100 KB ceiling on a process that
+* already declares an RSS budget in the gigabytes.
+*/
+var MAX_KEYS = 1024;
+/**
+* Where reasons past {@link MAX_REASONS_PER_KEY} go.
+*
+* They are FOLDED, never dropped: `attempts - succeeded` must always equal the
+* sum of the reason counts, or the ratio stops adding up.
+*/
+var OVERFLOW_REASON = "other";
+/** `deviceId` + `family` + optional `variant`, flattened into the map key. */
+function counterKey(deviceId, family, variant) {
+	return variant === void 0 ? `${deviceId}${family}` : `${deviceId}${family}${variant}`;
 }
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
+/**
+* A bounded set of per-camera, cumulative failure counters.
+*
+* One instance per contributing subsystem. `note` is O(1) and allocation-free
+* on the steady path; `snapshot` reads without mutating anything.
+*/
+var FailureCounters = class {
+	maxKeys;
+	maxReasons;
+	counters = /* @__PURE__ */ new Map();
+	refused = 0;
+	constructor(maxKeys = MAX_KEYS, maxReasons = 16) {
+		this.maxKeys = maxKeys;
+		this.maxReasons = maxReasons;
 	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	/**
+	* Counters refused because {@link MAX_KEYS} was already held.
+	*
+	* Cumulative for the life of the instance: a bound that bit is a fact about
+	* the deployment, and a surface that hid it would under-report a fleet
+	* precisely when the fleet got large enough to matter.
+	*/
+	get keysRefused() {
+		return this.refused;
 	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
+	/** Counters currently held. */
+	get size() {
+		return this.counters.size;
 	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
+	/**
+	* Fold one observation in.
+	*
+	* A non-positive or non-integer `deviceId` is REFUSED rather than bucketed:
+	* see the module docblock — an entry that cannot name its camera is worse
+	* than no entry.
+	*/
+	note(observation, nowMs) {
+		if (!Number.isInteger(observation.deviceId) || observation.deviceId <= 0) return;
+		const key = counterKey(observation.deviceId, observation.family, observation.variant);
+		let counter = this.counters.get(key);
+		if (counter === void 0) {
+			if (this.counters.size >= this.maxKeys) {
+				this.refused += 1;
+				return;
+			}
+			counter = {
+				deviceId: observation.deviceId,
+				family: observation.family,
+				variant: observation.variant,
+				sinceMs: nowMs,
+				attempts: 0,
+				succeeded: 0,
+				reasons: /* @__PURE__ */ new Map()
 			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+			this.counters.set(key, counter);
 		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
+		counter.attempts += 1;
+		if (observation.reason === void 0) {
+			counter.succeeded += 1;
+			return;
 		}
-		return this.parsePrimary();
+		const reason = counter.reasons.has(observation.reason) || counter.reasons.size < this.maxReasons ? observation.reason : OVERFLOW_REASON;
+		counter.reasons.set(reason, (counter.reasons.get(reason) ?? 0) + 1);
 	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
+	/** Read every counter. Never mutates — see the module docblock. */
+	snapshot(nowMs) {
+		const out = [];
+		for (const counter of this.counters.values()) out.push({
+			deviceId: counter.deviceId,
+			family: counter.family,
+			...counter.variant !== void 0 ? { variant: counter.variant } : {},
+			sinceMs: counter.sinceMs,
+			atMs: nowMs,
+			attempts: counter.attempts,
+			succeeded: counter.succeeded,
+			reasons: [...counter.reasons.entries()].map(([reason, count]) => ({
+				reason,
+				count
+			})).toSorted((a, b) => b.count - a.count)
+		});
+		return out;
 	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
+	/** Drop everything (host disposal). */
+	clear() {
+		this.counters.clear();
 	}
 };
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
+var CLIP_STRICTNESS_FACTOR = {
+	loose: 1,
+	balanced: 1.25,
+	strict: 1.5
+};
+/**
+* The cosine floor a search runs with.
+*
+* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
+* and silently rescaling it would make the same URL mean different things on
+* two installs. Everything else is relative to the model.
+*/
+function resolveClipSearchMinScore(meta, request) {
+	if (request.minScore !== void 0) return request.minScore;
+	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
+	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
 }
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
+/**
+* Multi-file format payload.
+*
+* - Directory formats (`isDirectory: true`, e.g. `.mlpackage`): files
+*   relative to the directory root — the downloader fetches each from
+*   `{url}/{file}` into `{modelDir}/{file}`. If omitted, it probes the
+*   HuggingFace API (slower).
+* - Single-file formats (no `isDirectory`, e.g. OpenVINO IR): sibling
+*   files fetched from the SAME remote directory as `url` and stored flat
+*   alongside the main file — e.g. `['camstack-yolov9t.bin']` for the IR
+*   weights next to `camstack-yolov9t.xml`.
+*/
+var ModelFormatEntrySchema = object({
+	url: string(),
+	sizeMB: number(),
+	/** Whether this format is a directory bundle (e.g., .mlpackage) rather than a single file */
+	isDirectory: boolean().optional(),
+	/** Multi-file payload (directory members or sibling files). */
+	files: array(string()).readonly().optional(),
+	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
+	runtimes: array(_enum(["python"])).readonly().optional()
+});
+/**
+* Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
+* The downloader fetches from `url` and saves to `{modelsDir}/{filename}`.
+*/
+var ModelExtraFileSchema = object({
+	url: string(),
+	filename: string(),
+	sizeMB: number()
+});
+/**
+* Per-format payload map. Modelled as an explicit object (one optional key
+* per `ModelFormat`) rather than `z.record(enum, …)` — zod v4's enum-keyed
+* record requires every key, but a catalog entry only ships a subset of
+* formats.
+*/
+var ModelFormatsSchema = object({
+	onnx: ModelFormatEntrySchema.optional(),
+	coreml: ModelFormatEntrySchema.optional(),
+	openvino: ModelFormatEntrySchema.optional(),
+	tflite: ModelFormatEntrySchema.optional(),
+	pt: ModelFormatEntrySchema.optional(),
+	gguf: ModelFormatEntrySchema.optional()
+});
+/**
+* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
+* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
+* grouped Family→Tier→Variant picker renders identically in the config UI and
+* in the pipeline/device steppers. The flat `id` stays the source of truth for
+* resolution/download/persistence; this is a presentation overlay resolved back
+* to an `id`.
+*/
+var ModelVariantGroupSchema = object({
+	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
+	family: string(),
+	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
+	tier: string(),
+	/** Quantization axis. Omit ⇒ the fp32 base build. */
+	precision: _enum(["fp32", "int8"]).optional(),
+	/**
+	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
+	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
+	* future performance variants plug into.
+	*/
+	optimization: _enum(["standard", "fast"]).optional(),
+	/**
+	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
+	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
+	* cheap latency lever — especially on Apple ANE and the Intel N100 — at a
+	* small-object accuracy cost. Mirrors the model's `inputSize` but lifted onto
+	* the group so the selector can offer it as a variant axis.
+	*/
+	resolution: number().int().positive().optional()
+});
+var ModelProviderIdSchema = _enum([
+	"camstack",
+	"frigate",
+	"scrypted",
+	"custom"
+]);
 /**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
+* The licence of a model, as a record rather than a bare SPDX string: a
+* permissive CODE licence routinely sits on top of restrictive WEIGHTS or
+* DATA, and the obligations (attribution, modification notices, source offers)
+* are per upstream. A persisted custom-model row written when this field was a
+* string still parses — the string is lifted into `{ weights }`.
 *
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
+* Every licence surface (the admin "Models and licenses" page,
+* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
+* these records by `scripts/gen-model-licenses.ts` (D661).
 */
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
+var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
+	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
+	weights: string().min(1),
+	/** SPDX id of the upstream code that defines / trained the network. */
+	code: string().min(1).optional(),
+	/** Training data whose terms add obligations (attribution, non-commercial). */
+	data: object({
+		name: string().min(1),
+		terms: string().min(1),
+		url: string().url().optional()
+	}).optional(),
+	/** The project the weights come from. Required on built-in entries (guard). */
+	upstream: object({
+		name: string().min(1),
+		url: string().url()
+	}).optional(),
+	/** Where the licence text governing the weights is published. */
+	url: string().url().optional(),
+	/** Attribution the licence REQUIRES, verbatim. */
+	attribution: string().min(1).optional(),
+	/** What CamStack changed. Required when `hosting` is `camstack-hf` (guard). */
+	modifications: string().min(1).optional(),
+	/** Who serves the file a node downloads. */
+	hosting: _enum([
+		"camstack-hf",
+		"third-party",
+		"built-in"
+	]).optional(),
+	/** True when the weights or their data forbid commercial use. */
+	nonCommercial: boolean().optional()
+}));
+var ModelCatalogEntrySchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	formats: ModelFormatsSchema,
+	inputSize: object({
+		width: number(),
+		height: number()
+	}),
+	/**
+	* Channel count of the model input tensor. Omit ⇒ 3 (RGB), the default for
+	* every detector / classifier / embedder. Set to 1 for a grayscale CTC text
+	* recognizer (EasyOCR VGG plate-OCR: input `[N,1,H,W]`) so the preprocess
+	* feeds a single-channel, EasyOCR-normalized tensor instead of the default
+	* 3-channel RGB one. Threaded through `PoolModelConfig.inputChannels` to the
+	* Python inference pool.
+	*/
+	inputChannels: number().int().positive().optional(),
+	labels: array(LabelDefinitionSchema).readonly(),
+	inputLayout: _enum(["nchw", "nhwc"]).optional(),
+	/**
+	* `'scrfd'` applies InsightFace's SCRFD input contract, `(x - 127.5) / 128`
+	* (upstream `insightface/model_zoo/scrfd.py`), instead of the historical
+	* plain `/255`. Measured against COCO GT: 188 → 196 faces found on the
+	* `scrfd-2.5g` catalog entry (2026-09-26 model-replacement spike, §2.4-2).
+	*/
+	inputNormalization: _enum([
+		"zero-one",
+		"imagenet",
+		"none",
+		"scrfd"
+	]).optional(),
+	/**
+	* The model already applies softmax IN-GRAPH — its raw output is a
+	* probability distribution, not logits. When set, the `softmax`
+	* postprocessor must NOT re-apply softmax: re-softmaxing an already-normalised
+	* probability vector collapses it toward uniform (top-1 score craters far
+	* below its true value, making every confidence gate meaningless). Absent ⇒
+	* the output is raw logits and the postprocessor applies softmax (the normal
+	* case). Set on the Google AIY Birds `bird-classifier` (softmax baked into the
+	* TF graph). Threaded to the Python pool via `PoolModelConfig.outputProbabilities`.
+	*/
+	outputProbabilities: boolean().optional(),
+	preprocessMode: _enum(["letterbox", "resize"]).optional(),
+	/**
+	* Per-MODEL postprocessor override. Absent ⇒ the step's own
+	* `StepDefinition.postprocessor` applies (the normal case — every model in a
+	* step shares its decode). Set it when a step hosts models with DIFFERENT raw
+	* output layouts under one slot: e.g. object-detection is `'yolo'` by default,
+	* but a Coral SSD MobileNet build emits the `TFLite_Detection_PostProcess`
+	* 4-tensor layout and needs `'ssd'`. Threaded into `PoolModelConfig.postprocessor`
+	* by the engine factory (`modelEntry.postprocessor ?? def.postprocessor`).
+	*/
+	postprocessor: custom().optional(),
+	/**
+	* Per-MODEL default confidence floor. Absent ⇒ the step's
+	* `StepDefinition.defaultConfidence` applies. A score is a property of one
+	* model's output scale, not of the step slot it sits in: YuNet's
+	* `sqrt(cls·obj)` is not SCRFD's score, and inheriting SCRFD's 0.5 filled the
+	* face gallery with wheels and hands (D662, amends D645). An operator's
+	* explicit value still wins over it. Resolved in ONE place —
+	* `addon-pipeline/.../registry/effective-confidence.ts`.
+	*/
+	defaultConfidence: number().min(0).max(1).optional(),
+	/**
+	* When true, the executor produces a landmark-aligned crop (similarity warp
+	* onto the canonical template) before this step runs, instead of a plain
+	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
+	* their embeddings are only discriminative on an aligned input. The face
+	* detector that produced the parent detail must emit 5 landmarks.
+	*/
+	faceAlignment: boolean().optional(),
+	/**
+	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
+	* Downloaded into the same modelsDir alongside the model file.
+	*/
+	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
+	/**
+	* LEGACY entry — retained in the catalog so a persisted operator selection
+	* still RESOLVES (and can be re-activated), but hidden from the selectable
+	* model list and excluded from the auto format-default pick. Set on the
+	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
+	* the active lineup stays the coherent curated ladder without deleting a
+	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
+	* an explicit legacy id that has a build for the node's format.
+	*/
+	legacy: boolean().optional(),
+	/**
+	* Measured quality/latency metadata — populated from the benchmark addon on
+	* the real node classes. Absent = not yet measured (most entries today; the
+	* catalog historically carried only `sizeMB`, a poor cross-architecture
+	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
+	*/
+	metrics: object({
+		map50: number().optional(),
+		p95LatencyMs: record(string(), number()).optional()
+	}).optional(),
+	/**
+	* The model's licence record — see {@link ModelLicenseSchema}. Optional in
+	* the schema (a custom model's author may state none); REQUIRED and complete
+	* on every built-in catalog entry (`scripts/check-catalog-licence.ts`).
+	*/
+	license: ModelLicenseSchema.optional(),
+	/**
+	* Variant-selector grouping. The UI groups models by `family` + `tier` and
+	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
+	* of a family's sizes and quantizations collapse into one grouped picker
+	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
+	* (legacy / custom models) — never shown in the grouped selector. The flat
+	* `id` stays the source of truth for resolution/download/persistence; grouping
+	* is a presentation overlay resolved back to an `id`.
+	*/
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Catalog source for the pipeline stepper's provider-first picker. Absent on
+	* built-in CamStack entries (treated as `camstack`) and on registry rows
+	* persisted before this field existed (`inferModelProvider` fills those).
+	*/
+	provider: ModelProviderIdSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
+});
+var ConvertTargetSchema = discriminatedUnion("format", [object({
+	format: literal("openvino"),
+	precisions: array(_enum(["fp16", "int8"])).min(1).readonly()
+}), object({ format: literal("coreml") })]);
+var ModelConvertMetadataSchema = object({
+	id: string().regex(/^[a-zA-Z0-9._-]+$/),
+	name: string(),
+	labels: array(LabelDefinitionSchema).readonly(),
+	inputSize: object({
+		width: number(),
+		height: number()
+	}),
+	inputLayout: _enum(["nchw", "nhwc"]).optional(),
+	inputNormalization: _enum([
+		"zero-one",
+		"imagenet",
+		"none",
+		"scrfd"
+	]).optional(),
+	preprocessMode: _enum(["letterbox", "resize"]).optional(),
+	outputFormat: _enum([
+		"yolo",
+		"ssd",
+		"embedding",
+		"classification",
+		"ocr",
+		"segmentation"
+	]),
+	faceAlignment: boolean().optional(),
+	classMap: DetectionCatalogClassMapSchema.optional()
+});
+var ConvertResultSchema = object({
+	entry: ModelCatalogEntrySchema,
+	artifacts: array(object({
+		format: _enum(MODEL_FORMATS),
+		precision: _enum(["fp16", "int8"]).optional(),
+		sizeMB: number(),
+		validated: boolean(),
+		files: array(string()).readonly()
+	})).readonly()
+});
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -13387,102 +13530,6 @@ var cameraStreamsCapability = {
 function kebabToCamel(s) {
 	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 }
-/** A composed device's stableId is this prefix plus the block id. */
-var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
-/** Longest snippet a `code` source may carry (slice 4). */
-var MAX_COMPOSITION_CODE_LENGTH = 2e4;
-var CompositionSourceRefSchema = object({
-	/** The owning addon; `stableId` is unique only within it. */
-	addonId: string().min(1),
-	stableId: string().min(1)
-});
-/** One field of one capability of one source device. */
-var CompositionFieldReadSchema = object({
-	source: CompositionSourceRefSchema,
-	cap: string().min(1),
-	/** Dotted path into the source cap's runtime-state slice. */
-	fieldPath: string().min(1)
-});
-/** `from`: copy one source field verbatim. It is also an expression's `from` binding. */
-var CompositionFromSourceSchema = CompositionFieldReadSchema.extend({ kind: literal("from") });
-var CompositionBindingSchema = discriminatedUnion("kind", [CompositionFromSourceSchema, object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-})]);
-/**
-* `expression`: a formula over named bindings, in the salvaged expression
-* engine. Validated at parse by the SAME function every other consumer runs,
-* so the editor and the store cannot disagree.
-*/
-var CompositionExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), CompositionBindingSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-/** `code`: RESERVED for slice 4 (own runner, one-way eject). */
-var CompositionCodeSourceSchema = object({
-	kind: literal("code"),
-	code: string().min(1).max(MAX_COMPOSITION_CODE_LENGTH)
-});
-var CompositionFieldSourceSchema = discriminatedUnion("kind", [
-	CompositionFromSourceSchema,
-	CompositionExpressionSourceSchema,
-	CompositionCodeSourceSchema
-]);
-var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
-	kind: literal("forward"),
-	source: CompositionSourceRefSchema,
-	cap: string().min(1),
-	method: string().min(1)
-}), CompositionCodeSourceSchema]);
-var CompositionFeatureSchema = discriminatedUnion("kind", [object({
-	kind: literal("fields"),
-	cap: string().min(1),
-	fields: record(string().min(1), CompositionFieldSourceSchema).refine((fields) => Object.keys(fields).length <= 32, { message: `at most 32 fields per capability` }),
-	/** RESERVED for slice 3; refused by the validator when non-empty. */
-	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
-}), object({
-	kind: literal("passthrough"),
-	cap: string().min(1),
-	source: CompositionSourceRefSchema
-})]);
-var CompositionSchema = object({
-	target: discriminatedUnion("kind", [object({
-		kind: literal("new"),
-		type: _enum(DeviceType),
-		role: _enum(DeviceRole).optional()
-	}), object({
-		kind: literal("existing"),
-		device: CompositionSourceRefSchema
-	})]),
-	features: array(CompositionFeatureSchema).min(1).max(16)
-}).superRefine((composition, ctx) => {
-	const seen = /* @__PURE__ */ new Set();
-	composition.features.forEach((feature, index) => {
-		if (seen.has(feature.cap)) ctx.addIssue({
-			code: "custom",
-			message: `capability \`${feature.cap}\` is composed twice — one feature per capability`,
-			path: [
-				"features",
-				index,
-				"cap"
-			]
-		});
-		seen.add(feature.cap);
-	});
-});
 /** One refusal, named (D391). `path` points into the composition, e.g. `features[0].fields.celsius`. */
 var CompositionProblemSchema = object({
 	code: _enum([
@@ -13502,7 +13549,12 @@ var CompositionProblemSchema = object({
 		"source-field-unknown",
 		"expression-invalid",
 		"cycle",
-		"duplicate-target"
+		"duplicate-target",
+		"not-item-array",
+		"item-field-reserved",
+		"target-missing",
+		"target-unreadable",
+		"not-replaceable"
 	]),
 	path: string(),
 	message: string()
@@ -13513,8 +13565,18 @@ var CompositionFieldKindSchema = _enum([
 	"boolean",
 	"enum"
 ]);
-/** How a field says "unavailable": `null` when its schema allows it, else the device goes offline (D393). */
-var CompositionUnavailableModeSchema = _enum(["null", "offline"]);
+/**
+* How a field says "unavailable" (D393, D663): `null` when its schema allows it;
+* `unknown` — the enum's own word — for an ADDED field that has one; `release`
+* for a REPLACED field of an existing device, whose claim is released so the
+* native provider's reading shows again; else the (composed) device goes offline.
+*/
+var CompositionUnavailableModeSchema = _enum([
+	"null",
+	"offline",
+	"unknown",
+	"release"
+]);
 /**
 * `derived` reads a source · `clock` reads only `now`, recomputed when a sibling
 * field of its cap changes value · `constant` reads nothing, computed once.
@@ -13524,9 +13586,17 @@ var CompositionFieldRoleSchema = _enum([
 	"clock",
 	"constant"
 ]);
+/** The item a planned field belongs to; its `path` is then the dotted path INSIDE the item. */
+var CompositionFieldItemSchema = object({
+	arrayPath: string(),
+	key: string(),
+	label: string()
+});
 var CompositionFieldPlanSchema = object({
 	cap: string(),
+	/** Top-level field, or — when `item` is set — the dotted path inside that item. */
 	path: string(),
+	item: CompositionFieldItemSchema.optional(),
 	/** Index into `composition.features` this field's capability came from —
 	*  lets a source/cycle problem name its path as `features[N].fields.<path>`
 	*  (the same convention `planComposition`'s own problems already use). */
@@ -13539,16 +13609,37 @@ var CompositionFieldPlanSchema = object({
 	source: CompositionFieldSourceSchema,
 	reads: array(CompositionFieldReadSchema)
 });
+/**
+* What a feature does to its target (D663): `new` builds a capability on a new
+* device; on an existing device it `add`s a capability the device lacks, or
+* `replace`s named fields of one it has natively.
+*/
+var CompositionFeatureModeSchema = _enum([
+	"new",
+	"add",
+	"replace"
+]);
+var CompositionFeaturePlanSchema = object({
+	featureIndex: number().int().nonnegative(),
+	cap: string(),
+	mode: CompositionFeatureModeSchema
+});
 var CompositionValidationSchema = object({
 	ok: boolean(),
 	problems: array(CompositionProblemSchema),
-	fields: array(CompositionFieldPlanSchema)
+	fields: array(CompositionFieldPlanSchema),
+	features: array(CompositionFeaturePlanSchema)
 });
-/** Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts` (Task 11). */
+/**
+* Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts`. `degraded`:
+* running, but a replaced field is released to the native provider while its
+* source is unavailable (ruling S1b, D663) — the reason names each such field.
+*/
 var CompositionRunStatusSchema = _enum([
 	"stopped",
 	"starting",
 	"running",
+	"degraded",
 	"failed"
 ]);
 var CompositionFieldStateKindSchema = _enum([
@@ -13559,6 +13650,8 @@ var CompositionFieldStateKindSchema = _enum([
 var CompositionFieldStateSchema = object({
 	cap: string(),
 	path: string(),
+	/** Same as the plan's: two items' `status` are told apart by it. */
+	item: CompositionFieldItemSchema.optional(),
 	state: CompositionFieldStateKindSchema,
 	/** `null` whenever `state === 'unavailable'`; never a plausible stand-in (D393). */
 	value: union([
@@ -13580,11 +13673,14 @@ var CompositionBlockStateSchema = object({
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
 /** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. */
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
 var CoreBlockStatusSchema = _enum([
 	"stopped",
 	"starting",
 	"running",
+	"degraded",
 	"failed"
 ]);
 /** Client-authored fields. */
@@ -13620,9 +13716,16 @@ var CoreBlockSourceSchema = discriminatedUnion("kind", [
 		composition: CompositionSchema
 	})
 ]);
-/** The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7). */
+/**
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
+*
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
+*/
 var CompositionBlockInputSchema = object({
-	name: string().min(1).max(120),
+	name: string().min(1).max(120).optional(),
 	enabled: boolean(),
 	composition: CompositionSchema
 });
@@ -13673,6 +13776,11 @@ var CompositionGetReadSchema = discriminatedUnion("state", [object({
 	state: literal("loaded"),
 	view: CompositionViewSchema.nullable()
 }), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
 /** What a compile attempt produced. */
 var CoreBlockCompileResultSchema = object({
 	ok: boolean(),
@@ -13723,6 +13831,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	auth: "admin",
 	caller: "required"
 }), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
+	addonId: string().min(1),
+	stableId: string().min(1)
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({
 	composition: CompositionSchema,
 	blockId: string().optional()
 }), CompositionValidationSchema, {
@@ -15700,6 +15811,52 @@ method(object({
 	deviceIds: array(number()).readonly(),
 	caps: array(string()).readonly().optional()
 }), record(string(), record(string(), unknown().nullable())));
+/**
+* Per-field ownership (D663). A composition may CLAIM fields of a native
+* cap's runtime-state slice on an existing device: `replace` overlays the
+* claimed fields on the native slice, `add` builds a slice the device does
+* not natively have. Declared here — once — so the hub mirror (Task 5) and
+* the claim methods (Task 6) share one union.
+*/
+var FieldClaimModeSchema = _enum(["replace", "add"]);
+/** What a claim, patch or release answers. A refusal always names its reason. */
+var ClaimOutcomeSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	changed: boolean()
+}), object({
+	ok: literal(false),
+	code: _enum([
+		"owned-by-other",
+		"not-claimed",
+		"field-not-claimed",
+		"invalid-slice",
+		"unknown-device",
+		"row-unreadable",
+		"migration-in-flight"
+	]),
+	message: string()
+})]);
+/** One claim as `listClaims` reports it. `fields` is the PLANNED set, explicit (ruling S5). */
+var FieldClaimSchema = object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	mode: FieldClaimModeSchema,
+	fields: array(string().min(1)).min(1)
+});
+/**
+* What `listClaims` answers. The claims INDEX is a listing projection loaded
+* from the settings store at boot; until a load has succeeded it is
+* `not-loaded`, never `[]` — an unanswered question must not look like an
+* empty answer (D315).
+*/
+var ClaimsListingSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	claims: array(FieldClaimSchema)
+}), object({
+	state: literal("not-loaded"),
+	reason: string()
+})]);
 method(object({ deviceId: number() }), record(string(), record(string(), unknown()))), method(object({
 	deviceId: number(),
 	capName: string()
@@ -15707,7 +15864,35 @@ method(object({ deviceId: number() }), record(string(), record(string(), unknown
 	deviceId: number(),
 	capName: string(),
 	slice: record(string(), unknown())
-}), _void(), { kind: "mutation" }), object({
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	mode: FieldClaimModeSchema,
+	fields: array(string().min(1)).min(1),
+	values: record(string(), unknown())
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	values: record(string(), unknown())
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1)
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ownerPrefix: string().optional() }), ClaimsListingSchema, { auth: "admin" }), method(object({
+	deviceId: number(),
+	capName: string()
+}), record(string(), unknown()).nullable(), { auth: "admin" }), object({
 	deviceId: number(),
 	capName: string(),
 	slice: record(string(), unknown())
@@ -29019,7 +29204,7 @@ var ExtensionSourceSchema = object({
 /**
 * How one picked source stands. `missing` — no such device (deleted, or an id
 * that never existed); `foreign` — a device the slot's owner cannot read from
-* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* (a source owned by another addon); `unavailable` — it exists but is not a
 * valid source now (a container, which is never a pick). A source in any of
 * these states is SHOWN, never silently dropped or re-pointed.
 */
@@ -29059,10 +29244,6 @@ var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
 	slot: ExtensionSlotIdSchema,
 	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
 	authority: string(),
-	/** graft: its switch. association: null — removing every source is "off". */
-	enabled: boolean().nullable(),
-	/** graft: the cap registered on the host. association: null. */
-	projects: string().nullable(),
 	activation: ExtensionSlotActivationSchema.nullable(),
 	value: ExtensionSlotValueSchema,
 	sources: array(ExtensionSlotSourceSchema),
@@ -29096,7 +29277,8 @@ var ExtensionCandidatesSchema = object({ candidates: array(object({
 /**
 * What a write did. `none` — applied in place. `host` / `parent` — the owner
 * reloaded the host (or, for an accessory child, its parent) because the
-* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+* write changed what the host REGISTERS. A slot never adds a capability to its
+* host — that is a composition (D663) — so today's owners answer `none`.
 */
 var ExtensionSetResultSchema = object({
 	applied: literal(true),
@@ -30304,7 +30486,9 @@ var batteryCapability = {
 		DeviceType.Camera,
 		DeviceType.Sensor,
 		DeviceType.Button,
-		DeviceType.Switch
+		DeviceType.Switch,
+		DeviceType.PetFeeder,
+		DeviceType.Container
 	],
 	methods: { 
 	/**
@@ -30331,6 +30515,19 @@ wakeForStream: method(object({
 		awoke: boolean(),
 		durationMs: number()
 	}), { kind: "mutation" }) },
+	/**
+	* A composed provider (battery ADDED to a pet feeder or container that has
+	* no wake surface) answers `wakeForStream` with the same "unavailable"
+	* result the contract already defines above: "Returns `awoke: false` when
+	* … the cap surface is unavailable." (D663).
+	*/
+	composedMethods: { wakeForStream: {
+		kind: "answer",
+		value: {
+			awoke: false,
+			durationMs: 0
+		}
+	} },
 	events: { 
 	/**
 	* Emitted whenever the cached status changes (firmware push OR
@@ -30346,7 +30543,7 @@ onStatusChanged: { data: object({
 		schema: BatteryStatusSchema,
 		kind: "push",
 		empty: {
-			percentage: 0,
+			percentage: null,
 			charging: "unknown",
 			sleeping: false,
 			lastUpdated: 0
@@ -31071,6 +31268,19 @@ var connectivityCapability = {
 * provider populates it by guessing (no HA inference). The UI renders a
 * "No consumables reported" placeholder when `items` is empty.
 */
+/** Units a remaining-life counter is reported in. Closed: the panel renders
+*  each. */
+var ConsumableRemainingUnitSchema = _enum([
+	"days",
+	"hours",
+	"cycles"
+]);
+/** Remaining life as a COUNT, not a percentage (the PetKit desiccant reports
+*  days). `value` null = unknown (D393). */
+var ConsumableRemainingSchema = object({
+	value: number().min(0).nullable(),
+	unit: ConsumableRemainingUnitSchema
+});
 /** A single consumable item. Either a continuous `level` (remaining
 *  life %) or a discrete `status` may be known — both may be null when a
 *  provider only knows the item exists. `level` and `status` are not
@@ -31087,7 +31297,10 @@ var ConsumableItemSchema = object({
 	/** Ms epoch of the last replace, when known. */
 	lastResetAt: number().nullable(),
 	/** Whether `reset()` is meaningful for this item. */
-	resettable: boolean()
+	resettable: boolean(),
+	/** Remaining life as a count (days/hours/cycles), when a provider reports
+	*  it that way instead of — or alongside — `level`. Absent = not reported. */
+	remaining: ConsumableRemainingSchema.optional()
 });
 var ConsumablesStatusSchema = object({
 	items: array(ConsumableItemSchema),
@@ -31117,6 +31330,16 @@ reset: method(object({
 		kind: "mutation",
 		auth: "admin"
 	}) },
+	/**
+	* A composed consumable (item added to a device with no native consumables
+	* provider) refuses `reset` by name: "Only meaningful when the item's
+	* `resettable` is true" — a composed item is never resettable until
+	* commands (`forward`) arrive in slice 3 (D663).
+	*/
+	composedMethods: { reset: {
+		kind: "refuse",
+		reason: "a composed consumable is not resettable until commands (forward) arrive — slice 3"
+	} },
 	status: {
 		schema: ConsumablesStatusSchema,
 		kind: "push",
@@ -40427,6 +40650,10 @@ Object.freeze({
 	latest: {
 		kind: "fixed",
 		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
 	}
 });
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
@@ -40626,38 +40853,31 @@ var DeviceConfig = class DeviceConfig {
 		}));
 	}
 };
-/**
-* Concrete implementation. Routes every successful write through
-* `writer(capName, slice)` — the kernel hooks this up to
-* `device-state.setCapSlice`, the canonical cross-layer write
-* entrypoint, which handles disk persistence (debounced on the hub)
-* and mirror updates.
-*
-* Schema validation runs in-process before the writer is called —
-* the round-trip should never carry an invalid slice. `flush()`
-* awaits any in-flight writer promises so shutdown is lossless.
-*
-* `initial` is the persisted blob loaded at boot. Slices for caps
-* whose schema hasn't been installed yet are kept in-memory verbatim
-* and validated when the cap registers later.
-*/
 var DeviceRuntimeState = class DeviceRuntimeState {
 	writer;
+	onWriteFailed;
 	/** In-flight writer promises tracked so `flush()` can await them. */
 	pendingWrites = /* @__PURE__ */ new Set();
+	/**
+	* Caps whose last write the hub refused. The equality gate in
+	* `applyCapWrite` is bypassed for these, so the SAME value is re-sent on the
+	* next write instead of being swallowed forever; a landing write clears it.
+	*/
+	failedWrites = /* @__PURE__ */ new Set();
 	/** Per-cap committed slice — after schema validation when known. */
 	slices;
 	/** Per-cap registered schema (set by `installCapSchema`). */
 	schemas = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
 	capListeners = /* @__PURE__ */ new Map();
-	constructor(initial, writer) {
+	constructor(initial, writer, onWriteFailed) {
 		this.writer = writer;
+		this.onWriteFailed = onWriteFailed;
 		this.slices = /* @__PURE__ */ new Map();
 		for (const [k, v] of Object.entries(initial)) if (v && typeof v === "object" && !Array.isArray(v)) this.slices.set(k, { ...v });
 	}
-	static fromInitial(initial, writer) {
-		return new DeviceRuntimeState(initial, writer);
+	static fromInitial(initial, writer, onWriteFailed) {
+		return new DeviceRuntimeState(initial, writer, onWriteFailed);
 	}
 	installCapSchema(capName, schema) {
 		const existing = this.schemas.get(capName);
@@ -40701,10 +40921,15 @@ var DeviceRuntimeState = class DeviceRuntimeState {
 			...value
 		} : { ...value };
 		const parsed = schema.parse(next);
-		if (shallowEqual(current, parsed)) return;
+		if (shallowEqual(current, parsed) && !this.failedWrites.has(capName)) return;
 		this.slices.set(capName, parsed);
 		this.fireListeners([capName]);
-		const writePromise = this.writer(capName, { ...parsed }).catch(() => {});
+		const writePromise = this.writer(capName, { ...parsed }).then(() => {
+			this.failedWrites.delete(capName);
+		}).catch((err) => {
+			this.failedWrites.add(capName);
+			this.onWriteFailed?.(capName, err instanceof Error ? err.message : String(err));
+		});
 		this.pendingWrites.add(writePromise);
 		writePromise.finally(() => {
 			this.pendingWrites.delete(writePromise);
@@ -40981,7 +41206,16 @@ var BaseDevice = class {
 			});
 		};
 		const initial = ctx.initialRuntimeState ?? {};
-		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer);
+		const onWriteFailed = (cap, error) => {
+			ctx.logger.warn("runtime-state write refused by the hub — the slice is not mirrored; it is re-sent on the next write", {
+				tags: { deviceId: ctx.id },
+				meta: {
+					cap,
+					error
+				}
+			});
+		};
+		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer, onWriteFailed);
 		ctx.bindRuntimeState?.(this.runtimeState);
 		ctx.registerNativeCap?.(deviceStatusCapability, {});
 		const seed = {
@@ -43927,6 +44161,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.getCustomization": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -45049,6 +45289,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceState.claimFields": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.getAllSnapshots": {
 		capName: "device-state",
 		capScope: "system",
@@ -45061,12 +45307,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceState.getNativeCapSlice": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceState.getSnapshot": {
 		capName: "device-state",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"deviceState.listClaims": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceState.patchOwnedFields": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceState.releaseClaim": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.setCapSlice": {
 		capName: "device-state",
 		capScope: "system",
@@ -50582,16 +50852,36 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceState.claimFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.getCapSlice": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"deviceState.getNativeCapSlice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.getSnapshot": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"deviceState.patchOwnedFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.releaseClaim": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.setCapSlice": [{
 		name: "deviceId",
 		form: "single",