@camstack/addon-post-analysis 1.2.292 → 1.2.293

package/dist/{clip-model-registry-Cudz--Ql.mjs → clip-model-registry-D2zqXamW.mjs}

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-//#region ../types/dist/event-category-BVDXG4tB.mjs
+//#region ../types/dist/event-category-C5xZWqz6.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -363,6 +363,16 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* The NATIVE shadow of a cap a composition has claimed fields of moved
+	* (D663). Payload: `{ deviceId, capName, native }` — what the provider
+	* wrote, BEFORE the owned fields are overlaid. Owner-only (D224): it is for
+	* the composer's native self-reads, and the public event routers refuse it
+	* (`isOwnerOnlyEventCategory`) so no consumer surface ever shows a second
+	* truth beside the merged `DeviceStateChanged.slice`. Emitted only under a
+	* `replace` claim, one per native write of that cap.
+	*/
+	EventCategory["DeviceNativeShadowChanged"] = "device.native-shadow-changed";
+	/**
 	* Frame occupancy for a camera CHANGED — a tracked object was gained or
 	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
 	*
@@ -5360,7 +5370,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DC-wdyeS.mjs
+//#region ../types/dist/sleep-jkRQgtSc.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7061,324 +7071,6 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
-var DeviceType = /* @__PURE__ */ function(DeviceType) {
-	DeviceType["Camera"] = "camera";
-	DeviceType["Hub"] = "hub";
-	DeviceType["Light"] = "light";
-	DeviceType["Siren"] = "siren";
-	DeviceType["Switch"] = "switch";
-	DeviceType["Sensor"] = "sensor";
-	DeviceType["Thermostat"] = "thermostat";
-	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
-	*  `climate-control` cap surface with `Thermostat` but renders a
-	*  dedicated AC-appropriate control UI (mode chips, fan speed,
-	*  independent vertical/horizontal swing). Sources: native Gree, and
-	*  reusable by other AC integrations. */
-	DeviceType["Climate"] = "climate";
-	DeviceType["Button"] = "button";
-	/** Generic stateless event emitter — carries a device's EXACT declared
-	*  event vocabulary verbatim (no normalization). Installed with the
-	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
-	*  HA bus events (e.g. `zha_event`, generic). */
-	DeviceType["EventEmitter"] = "event-emitter";
-	/** Firmware/software update entity — current vs available version,
-	*  updatable flag, update state, and an install action. Installed with
-	*  the `update` cap. Sources: Homematic firmware-update channels (and
-	*  reusable by other providers, e.g. HA `update.*` entities). */
-	DeviceType["Update"] = "update";
-	DeviceType["Generic"] = "generic";
-	/** Generic notification delivery target (HA `notify.<service>`, future
-	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
-	*  endpoint; the `notifier` cap defines the send surface. */
-	DeviceType["Notifier"] = "notifier";
-	/** Pre-recorded action sequence with optional parameters
-	*  (HA `script.*`). Runnable via `script-runner` cap. */
-	DeviceType["Script"] = "script";
-	/** Automation rule (HA `automation.*`) — enable/disable + manual
-	*  trigger surface exposed via `automation-control` cap. */
-	DeviceType["Automation"] = "automation";
-	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
-	DeviceType["Lock"] = "lock";
-	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
-	*  `valve.*`). `cover` cap with sub-roles for variant. */
-	DeviceType["Cover"] = "cover";
-	/** Pipe / water / gas valve with open/close/stop and optional
-	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
-	*  modelled on the same open/closed lifecycle. */
-	DeviceType["Valve"] = "valve";
-	/** Humidifier / dehumidifier with on/off + target humidity + mode
-	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
-	*  modelled on the same target / mode lifecycle. */
-	DeviceType["Humidifier"] = "humidifier";
-	/** Water heater / boiler with target temperature + operation mode +
-	*  away mode (HA `water_heater.*`). `water-heater` cap — a
-	*  climate-family actuator. */
-	DeviceType["WaterHeater"] = "water-heater";
-	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
-	DeviceType["Fan"] = "fan";
-	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
-	*  the camera surface — those use `Camera`. `media-player` cap. */
-	DeviceType["MediaPlayer"] = "media-player";
-	/** Security panel / alarm system (HA `alarm_control_panel.*`).
-	*  `alarm-panel` cap. */
-	DeviceType["AlarmPanel"] = "alarm-panel";
-	/** Generic user-settable input (HA `number` / `input_number` / `select`
-	*  / `input_select` / `text` / `input_text` / `input_datetime`).
-	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
-	*  TextControl / DateTimeControl. */
-	DeviceType["Control"] = "control";
-	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
-	*  `presence` cap. */
-	DeviceType["Presence"] = "presence";
-	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
-	*  `weather` cap. */
-	DeviceType["Weather"] = "weather";
-	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
-	DeviceType["Vacuum"] = "vacuum";
-	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
-	*  `lawn-mower-control` cap. */
-	DeviceType["LawnMower"] = "lawn-mower";
-	/** Physical HA device group — parent container for entity-children
-	*  adopted from a single HA device entry. Not renderable as a
-	*  standalone device; exists only to anchor child entities. */
-	DeviceType["Container"] = "container";
-	/** Single still-image entity (HA `image.*`). Read-only display of an
-	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
-	DeviceType["Image"] = "image";
-	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
-	*  level, battery, desiccant life, feeding state and manual-feed /
-	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
-	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
-	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
-	*  integrations sharing the same food/desiccant/hopper surface. */
-	DeviceType["PetFeeder"] = "pet-feeder";
-	return DeviceType;
-}({});
-var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
-	DeviceFeature["BatteryOperated"] = "battery-operated";
-	DeviceFeature["Rebootable"] = "rebootable";
-	/**
-	* Device supports an on-demand re-sync of its derived spec with its
-	* upstream source — drives the generic Re-sync button. The owning
-	* provider implements the action via the `device-adoption.resync` cap.
-	*/
-	DeviceFeature["Resyncable"] = "resyncable";
-	DeviceFeature["NativeSnapshot"] = "native-snapshot";
-	DeviceFeature["DoorbellButton"] = "doorbell-button";
-	DeviceFeature["TwoWayAudio"] = "two-way-audio";
-	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
-	/**
-	* Camera supports the on-firmware autotrack subsystem (subject-
-	* following). Distinct from `PanTiltZoom` because not every PTZ
-	* camera ships autotrack — the admin UI uses this flag to gate
-	* the autotrack toggle / settings card without re-deriving from
-	* the cap registry. Mirrors `ptz-autotrack` cap registration:
-	* driver sets this feature when probe confirms the firmware
-	* surface, and registers the cap in the same code path.
-	*/
-	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
-	/**
-	* Accessory exposes a "trigger on motion" toggle — the parent camera's
-	* motion detection automatically activates this device. Mirrors
-	* `motion-trigger` cap registration: drivers set this feature in the
-	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
-	*
-	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
-	* fast scalar without binding fetch), notifier rules, and `listAll`
-	* filters that want "all devices with on-motion behaviour".
-	*/
-	DeviceFeature["MotionTrigger"] = "motion-trigger";
-	/** Light supports rgb-triplet color via `color` cap. */
-	DeviceFeature["LightColorRgb"] = "light-color-rgb";
-	/** Light supports HSV color via `color` cap. */
-	DeviceFeature["LightColorHsv"] = "light-color-hsv";
-	/** Light supports color-temperature (mired) via `color` cap. */
-	DeviceFeature["LightColorMired"] = "light-color-mired";
-	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
-	*  targetHigh). Gates the range slider UI. */
-	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
-	/** Thermostat exposes target humidity and/or current humidity
-	*  readings. Gates the humidity controls. */
-	DeviceFeature["ClimateHumidity"] = "climate-humidity";
-	/** Thermostat exposes a fan-mode selector. */
-	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
-	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
-	DeviceFeature["ClimatePreset"] = "climate-preset";
-	/** Thermostat exposes a vertical louver swing toggle. Gates the
-	*  vertical-swing switch in the climate UI. Independent of horizontal. */
-	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
-	/** Thermostat exposes a horizontal louver swing toggle. Gates the
-	*  horizontal-swing switch in the climate UI. Independent of vertical. */
-	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
-	/** Cover exposes intermediate position control (0..100). Gates the
-	*  position slider UI. */
-	DeviceFeature["CoverPositionable"] = "cover-positionable";
-	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
-	DeviceFeature["CoverTilt"] = "cover-tilt";
-	/** Valve exposes intermediate position control (0..100). Gates the
-	*  position slider / drag surface UI. */
-	DeviceFeature["ValvePositionable"] = "valve-positionable";
-	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
-	DeviceFeature["FanSpeed"] = "fan-speed";
-	/** Fan exposes a preset mode selector. */
-	DeviceFeature["FanPreset"] = "fan-preset";
-	/** Fan exposes blade direction (forward/reverse) — typical of
-	*  ceiling fans. */
-	DeviceFeature["FanDirection"] = "fan-direction";
-	/** Fan exposes an oscillation toggle. */
-	DeviceFeature["FanOscillating"] = "fan-oscillating";
-	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
-	*  field on the UI lock-controls panel. */
-	DeviceFeature["LockPinRequired"] = "lock-pin-required";
-	/** Lock supports a latch-release ("open door") action distinct from
-	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
-	*  `supported_features`. Gates the Open Door button in the UI. */
-	DeviceFeature["LockOpen"] = "lock-open";
-	/** Media player exposes a seek-to-position surface. */
-	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
-	/** Media player exposes a volume-level setter. */
-	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
-	/** Media player exposes a mute toggle distinct from volume=0. */
-	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
-	/** Media player exposes a shuffle toggle. */
-	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
-	/** Media player exposes a repeat mode (off / all / one). */
-	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
-	/** Media player exposes a source / input selector. */
-	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
-	/** Media player exposes a play-arbitrary-media surface (URL / id). */
-	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
-	/** Media player exposes next-track. */
-	DeviceFeature["MediaPlayerNext"] = "media-player-next";
-	/** Media player exposes previous-track. */
-	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
-	/** Media player exposes stop distinct from pause. */
-	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
-	/** Alarm panel requires a PIN code on arm/disarm. */
-	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
-	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
-	*  addition to a textual location. */
-	DeviceFeature["PresenceGps"] = "presence-gps";
-	/** Notifier accepts an inline / URL image attachment. */
-	DeviceFeature["NotifierImage"] = "notifier-image";
-	/** Notifier accepts a priority hint (high/normal/low). */
-	DeviceFeature["NotifierPriority"] = "notifier-priority";
-	/** Notifier accepts a free-form `data` payload for platform-specific
-	*  fields. */
-	DeviceFeature["NotifierData"] = "notifier-data";
-	/** Notifier supports interactive action buttons / callbacks. */
-	DeviceFeature["NotifierActions"] = "notifier-actions";
-	/** Notifier supports per-call recipient targeting (multi-user). */
-	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
-	/** Script runner accepts a variables map on each run invocation. */
-	DeviceFeature["ScriptVariables"] = "script-variables";
-	/** Automation `trigger` accepts a skipCondition flag — fires the
-	*  automation's actions while bypassing its condition block. */
-	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
-	/** Robot vacuum exposes a live cleaning map (image child). Gates the
-	*  map tile in the vacuum UI. */
-	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
-	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
-	*  switches group. */
-	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
-	/** Robot mower exposes a live mowing map (SVG image child). Gates the
-	*  mower map tile. */
-	DeviceFeature["MowerHasMap"] = "mower-has-map";
-	/** Robot mower exposes targeted mowing (all-area / zones / edges /
-	*  spots) — gates the Mow action + map selectors. */
-	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
-	return DeviceFeature;
-}({});
-/**
-* Semantic role a device plays within its parent. Populated by driver
-* addons when creating accessory devices (Reolink siren/floodlight/
-* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
-* admin UI to pick icons, labels, and widgets — a `Switch` with
-* `role: Floodlight` renders as a bulb with a brightness slider,
-* whereas a `Switch` with `role: Siren` renders as a klaxon.
-*
-* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
-* sqlite as a nullable TEXT column — old rows keep working unchanged.
-*/
-var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
-	DeviceRole["Siren"] = "siren";
-	DeviceRole["Floodlight"] = "floodlight";
-	DeviceRole["Spotlight"] = "spotlight";
-	DeviceRole["PirSensor"] = "pir-sensor";
-	DeviceRole["Chime"] = "chime";
-	DeviceRole["Autotrack"] = "autotrack";
-	DeviceRole["Nightvision"] = "nightvision";
-	DeviceRole["PrivacyMask"] = "privacy-mask";
-	DeviceRole["Doorbell"] = "doorbell";
-	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
-	*  real Switch device for UI rendering / export adapters. */
-	DeviceRole["BinaryHelper"] = "binary-helper";
-	/** Generic motion / occupancy / moving event source. Distinct from
-	*  the camera accessory PirSensor role: that one is a camera child;
-	*  this is a standalone HA / 3rd-party motion sensor. */
-	DeviceRole["MotionSensor"] = "motion-sensor";
-	DeviceRole["ContactSensor"] = "contact-sensor";
-	DeviceRole["LeakSensor"] = "leak-sensor";
-	DeviceRole["SmokeSensor"] = "smoke-sensor";
-	DeviceRole["COSensor"] = "co-sensor";
-	DeviceRole["GasSensor"] = "gas-sensor";
-	DeviceRole["TamperSensor"] = "tamper-sensor";
-	DeviceRole["VibrationSensor"] = "vibration-sensor";
-	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
-	DeviceRole["SoundSensor"] = "sound-sensor";
-	/** Fallback for `binary_sensor` without a known `device_class`. */
-	DeviceRole["BinarySensor"] = "binary-sensor";
-	DeviceRole["TemperatureSensor"] = "temperature-sensor";
-	DeviceRole["HumiditySensor"] = "humidity-sensor";
-	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
-	DeviceRole["PressureSensor"] = "pressure-sensor";
-	/** Wind speed or direction (weather-station `wind-sensor` cap). */
-	DeviceRole["WindSensor"] = "wind-sensor";
-	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
-	DeviceRole["RainSensor"] = "rain-sensor";
-	/** UV index (weather-station `uv-sensor` cap). */
-	DeviceRole["UvSensor"] = "uv-sensor";
-	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
-	*  Distinct from AmbientLightSensor (lux). */
-	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
-	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
-	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
-	DeviceRole["PowerSensor"] = "power-sensor";
-	DeviceRole["EnergySensor"] = "energy-sensor";
-	DeviceRole["VoltageSensor"] = "voltage-sensor";
-	DeviceRole["CurrentSensor"] = "current-sensor";
-	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
-	/** Battery level (numeric % via `sensor` OR low-bool via
-	*  `binary_sensor` — the cap distinguishes via the value type). */
-	DeviceRole["BatterySensor"] = "battery-sensor";
-	/** Fallback for `sensor` numeric without a known `device_class`. */
-	DeviceRole["NumericSensor"] = "numeric-sensor";
-	/** String / enum state (HA `sensor` with `state_class: enum` or
-	*  `attributes.options`). */
-	DeviceRole["EnumSensor"] = "enum-sensor";
-	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
-	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
-	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
-	DeviceRole["DateTimeSensor"] = "datetime-sensor";
-	/** Last-resort fallback when nothing else matches. */
-	DeviceRole["GenericSensor"] = "generic-sensor";
-	DeviceRole["NumericControl"] = "numeric-control";
-	DeviceRole["SelectControl"] = "select-control";
-	DeviceRole["TextControl"] = "text-control";
-	DeviceRole["DateTimeControl"] = "datetime-control";
-	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
-	*  rich features (image, priority, channel routing). */
-	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
-	/** Chat / messaging service (HA `notify.telegram_*`,
-	*  `notify.discord_*`, etc.). */
-	DeviceRole["MessagingNotifier"] = "messaging-notifier";
-	/** Email-based delivery (HA `notify.smtp`, etc.). */
-	DeviceRole["EmailNotifier"] = "email-notifier";
-	/** Fallback when the notifier service name doesn't match a known
-	*  pattern. */
-	DeviceRole["GenericNotifier"] = "generic-notifier";
-	return DeviceRole;
-}({});
 /**
 * Identity — preserves literal types for downstream inference.
 *
@@ -7603,7 +7295,337 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/canonical-hash-CPK2Dy60.mjs
+//#region ../types/dist/err-msg-DX6i_MY4.mjs
+var DeviceType = /* @__PURE__ */ function(DeviceType) {
+	DeviceType["Camera"] = "camera";
+	DeviceType["Hub"] = "hub";
+	DeviceType["Light"] = "light";
+	DeviceType["Siren"] = "siren";
+	DeviceType["Switch"] = "switch";
+	DeviceType["Sensor"] = "sensor";
+	DeviceType["Thermostat"] = "thermostat";
+	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
+	*  `climate-control` cap surface with `Thermostat` but renders a
+	*  dedicated AC-appropriate control UI (mode chips, fan speed,
+	*  independent vertical/horizontal swing). Sources: native Gree, and
+	*  reusable by other AC integrations. */
+	DeviceType["Climate"] = "climate";
+	DeviceType["Button"] = "button";
+	/** Generic stateless event emitter — carries a device's EXACT declared
+	*  event vocabulary verbatim (no normalization). Installed with the
+	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
+	*  HA bus events (e.g. `zha_event`, generic). */
+	DeviceType["EventEmitter"] = "event-emitter";
+	/** Firmware/software update entity — current vs available version,
+	*  updatable flag, update state, and an install action. Installed with
+	*  the `update` cap. Sources: Homematic firmware-update channels (and
+	*  reusable by other providers, e.g. HA `update.*` entities). */
+	DeviceType["Update"] = "update";
+	DeviceType["Generic"] = "generic";
+	/** Generic notification delivery target (HA `notify.<service>`, future
+	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
+	*  endpoint; the `notifier` cap defines the send surface. */
+	DeviceType["Notifier"] = "notifier";
+	/** Pre-recorded action sequence with optional parameters
+	*  (HA `script.*`). Runnable via `script-runner` cap. */
+	DeviceType["Script"] = "script";
+	/** Automation rule (HA `automation.*`) — enable/disable + manual
+	*  trigger surface exposed via `automation-control` cap. */
+	DeviceType["Automation"] = "automation";
+	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
+	DeviceType["Lock"] = "lock";
+	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
+	*  `valve.*`). `cover` cap with sub-roles for variant. */
+	DeviceType["Cover"] = "cover";
+	/** Pipe / water / gas valve with open/close/stop and optional
+	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
+	*  modelled on the same open/closed lifecycle. */
+	DeviceType["Valve"] = "valve";
+	/** Humidifier / dehumidifier with on/off + target humidity + mode
+	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
+	*  modelled on the same target / mode lifecycle. */
+	DeviceType["Humidifier"] = "humidifier";
+	/** Water heater / boiler with target temperature + operation mode +
+	*  away mode (HA `water_heater.*`). `water-heater` cap — a
+	*  climate-family actuator. */
+	DeviceType["WaterHeater"] = "water-heater";
+	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
+	DeviceType["Fan"] = "fan";
+	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
+	*  the camera surface — those use `Camera`. `media-player` cap. */
+	DeviceType["MediaPlayer"] = "media-player";
+	/** Security panel / alarm system (HA `alarm_control_panel.*`).
+	*  `alarm-panel` cap. */
+	DeviceType["AlarmPanel"] = "alarm-panel";
+	/** Generic user-settable input (HA `number` / `input_number` / `select`
+	*  / `input_select` / `text` / `input_text` / `input_datetime`).
+	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
+	*  TextControl / DateTimeControl. */
+	DeviceType["Control"] = "control";
+	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
+	*  `presence` cap. */
+	DeviceType["Presence"] = "presence";
+	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
+	*  `weather` cap. */
+	DeviceType["Weather"] = "weather";
+	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
+	DeviceType["Vacuum"] = "vacuum";
+	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
+	*  `lawn-mower-control` cap. */
+	DeviceType["LawnMower"] = "lawn-mower";
+	/** Physical HA device group — parent container for entity-children
+	*  adopted from a single HA device entry. Not renderable as a
+	*  standalone device; exists only to anchor child entities. */
+	DeviceType["Container"] = "container";
+	/** Single still-image entity (HA `image.*`). Read-only display of an
+	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
+	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
+	return DeviceType;
+}({});
+var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
+	DeviceFeature["BatteryOperated"] = "battery-operated";
+	DeviceFeature["Rebootable"] = "rebootable";
+	/**
+	* Device supports an on-demand re-sync of its derived spec with its
+	* upstream source — drives the generic Re-sync button. The owning
+	* provider implements the action via the `device-adoption.resync` cap.
+	*/
+	DeviceFeature["Resyncable"] = "resyncable";
+	DeviceFeature["NativeSnapshot"] = "native-snapshot";
+	DeviceFeature["DoorbellButton"] = "doorbell-button";
+	DeviceFeature["TwoWayAudio"] = "two-way-audio";
+	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
+	/**
+	* Camera supports the on-firmware autotrack subsystem (subject-
+	* following). Distinct from `PanTiltZoom` because not every PTZ
+	* camera ships autotrack — the admin UI uses this flag to gate
+	* the autotrack toggle / settings card without re-deriving from
+	* the cap registry. Mirrors `ptz-autotrack` cap registration:
+	* driver sets this feature when probe confirms the firmware
+	* surface, and registers the cap in the same code path.
+	*/
+	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
+	/**
+	* Accessory exposes a "trigger on motion" toggle — the parent camera's
+	* motion detection automatically activates this device. Mirrors
+	* `motion-trigger` cap registration: drivers set this feature in the
+	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
+	*
+	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
+	* fast scalar without binding fetch), notifier rules, and `listAll`
+	* filters that want "all devices with on-motion behaviour".
+	*/
+	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/** Light supports rgb-triplet color via `color` cap. */
+	DeviceFeature["LightColorRgb"] = "light-color-rgb";
+	/** Light supports HSV color via `color` cap. */
+	DeviceFeature["LightColorHsv"] = "light-color-hsv";
+	/** Light supports color-temperature (mired) via `color` cap. */
+	DeviceFeature["LightColorMired"] = "light-color-mired";
+	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
+	*  targetHigh). Gates the range slider UI. */
+	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
+	/** Thermostat exposes target humidity and/or current humidity
+	*  readings. Gates the humidity controls. */
+	DeviceFeature["ClimateHumidity"] = "climate-humidity";
+	/** Thermostat exposes a fan-mode selector. */
+	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
+	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
+	DeviceFeature["ClimatePreset"] = "climate-preset";
+	/** Thermostat exposes a vertical louver swing toggle. Gates the
+	*  vertical-swing switch in the climate UI. Independent of horizontal. */
+	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
+	/** Thermostat exposes a horizontal louver swing toggle. Gates the
+	*  horizontal-swing switch in the climate UI. Independent of vertical. */
+	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
+	/** Cover exposes intermediate position control (0..100). Gates the
+	*  position slider UI. */
+	DeviceFeature["CoverPositionable"] = "cover-positionable";
+	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
+	DeviceFeature["CoverTilt"] = "cover-tilt";
+	/** Valve exposes intermediate position control (0..100). Gates the
+	*  position slider / drag surface UI. */
+	DeviceFeature["ValvePositionable"] = "valve-positionable";
+	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
+	DeviceFeature["FanSpeed"] = "fan-speed";
+	/** Fan exposes a preset mode selector. */
+	DeviceFeature["FanPreset"] = "fan-preset";
+	/** Fan exposes blade direction (forward/reverse) — typical of
+	*  ceiling fans. */
+	DeviceFeature["FanDirection"] = "fan-direction";
+	/** Fan exposes an oscillation toggle. */
+	DeviceFeature["FanOscillating"] = "fan-oscillating";
+	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
+	*  field on the UI lock-controls panel. */
+	DeviceFeature["LockPinRequired"] = "lock-pin-required";
+	/** Lock supports a latch-release ("open door") action distinct from
+	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
+	*  `supported_features`. Gates the Open Door button in the UI. */
+	DeviceFeature["LockOpen"] = "lock-open";
+	/** Media player exposes a seek-to-position surface. */
+	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
+	/** Media player exposes a volume-level setter. */
+	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
+	/** Media player exposes a mute toggle distinct from volume=0. */
+	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
+	/** Media player exposes a shuffle toggle. */
+	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
+	/** Media player exposes a repeat mode (off / all / one). */
+	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
+	/** Media player exposes a source / input selector. */
+	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
+	/** Media player exposes a play-arbitrary-media surface (URL / id). */
+	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
+	/** Media player exposes next-track. */
+	DeviceFeature["MediaPlayerNext"] = "media-player-next";
+	/** Media player exposes previous-track. */
+	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
+	/** Media player exposes stop distinct from pause. */
+	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
+	/** Alarm panel requires a PIN code on arm/disarm. */
+	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
+	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
+	*  addition to a textual location. */
+	DeviceFeature["PresenceGps"] = "presence-gps";
+	/** Notifier accepts an inline / URL image attachment. */
+	DeviceFeature["NotifierImage"] = "notifier-image";
+	/** Notifier accepts a priority hint (high/normal/low). */
+	DeviceFeature["NotifierPriority"] = "notifier-priority";
+	/** Notifier accepts a free-form `data` payload for platform-specific
+	*  fields. */
+	DeviceFeature["NotifierData"] = "notifier-data";
+	/** Notifier supports interactive action buttons / callbacks. */
+	DeviceFeature["NotifierActions"] = "notifier-actions";
+	/** Notifier supports per-call recipient targeting (multi-user). */
+	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
+	/** Script runner accepts a variables map on each run invocation. */
+	DeviceFeature["ScriptVariables"] = "script-variables";
+	/** Automation `trigger` accepts a skipCondition flag — fires the
+	*  automation's actions while bypassing its condition block. */
+	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
+	/** Robot vacuum exposes a live cleaning map (image child). Gates the
+	*  map tile in the vacuum UI. */
+	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
+	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
+	*  switches group. */
+	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
+	/** Robot mower exposes a live mowing map (SVG image child). Gates the
+	*  mower map tile. */
+	DeviceFeature["MowerHasMap"] = "mower-has-map";
+	/** Robot mower exposes targeted mowing (all-area / zones / edges /
+	*  spots) — gates the Mow action + map selectors. */
+	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
+	return DeviceFeature;
+}({});
+/**
+* Semantic role a device plays within its parent. Populated by driver
+* addons when creating accessory devices (Reolink siren/floodlight/
+* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
+* admin UI to pick icons, labels, and widgets — a `Switch` with
+* `role: Floodlight` renders as a bulb with a brightness slider,
+* whereas a `Switch` with `role: Siren` renders as a klaxon.
+*
+* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
+* sqlite as a nullable TEXT column — old rows keep working unchanged.
+*/
+var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
+	DeviceRole["Siren"] = "siren";
+	DeviceRole["Floodlight"] = "floodlight";
+	DeviceRole["Spotlight"] = "spotlight";
+	DeviceRole["PirSensor"] = "pir-sensor";
+	DeviceRole["Chime"] = "chime";
+	DeviceRole["Autotrack"] = "autotrack";
+	DeviceRole["Nightvision"] = "nightvision";
+	DeviceRole["PrivacyMask"] = "privacy-mask";
+	DeviceRole["Doorbell"] = "doorbell";
+	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
+	*  real Switch device for UI rendering / export adapters. */
+	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** Generic motion / occupancy / moving event source. Distinct from
+	*  the camera accessory PirSensor role: that one is a camera child;
+	*  this is a standalone HA / 3rd-party motion sensor. */
+	DeviceRole["MotionSensor"] = "motion-sensor";
+	DeviceRole["ContactSensor"] = "contact-sensor";
+	DeviceRole["LeakSensor"] = "leak-sensor";
+	DeviceRole["SmokeSensor"] = "smoke-sensor";
+	DeviceRole["COSensor"] = "co-sensor";
+	DeviceRole["GasSensor"] = "gas-sensor";
+	DeviceRole["TamperSensor"] = "tamper-sensor";
+	DeviceRole["VibrationSensor"] = "vibration-sensor";
+	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
+	DeviceRole["SoundSensor"] = "sound-sensor";
+	/** Fallback for `binary_sensor` without a known `device_class`. */
+	DeviceRole["BinarySensor"] = "binary-sensor";
+	DeviceRole["TemperatureSensor"] = "temperature-sensor";
+	DeviceRole["HumiditySensor"] = "humidity-sensor";
+	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
+	DeviceRole["PressureSensor"] = "pressure-sensor";
+	/** Wind speed or direction (weather-station `wind-sensor` cap). */
+	DeviceRole["WindSensor"] = "wind-sensor";
+	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
+	DeviceRole["RainSensor"] = "rain-sensor";
+	/** UV index (weather-station `uv-sensor` cap). */
+	DeviceRole["UvSensor"] = "uv-sensor";
+	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
+	*  Distinct from AmbientLightSensor (lux). */
+	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
+	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
+	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
+	DeviceRole["PowerSensor"] = "power-sensor";
+	DeviceRole["EnergySensor"] = "energy-sensor";
+	DeviceRole["VoltageSensor"] = "voltage-sensor";
+	DeviceRole["CurrentSensor"] = "current-sensor";
+	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
+	/** Battery level (numeric % via `sensor` OR low-bool via
+	*  `binary_sensor` — the cap distinguishes via the value type). */
+	DeviceRole["BatterySensor"] = "battery-sensor";
+	/** Fallback for `sensor` numeric without a known `device_class`. */
+	DeviceRole["NumericSensor"] = "numeric-sensor";
+	/** String / enum state (HA `sensor` with `state_class: enum` or
+	*  `attributes.options`). */
+	DeviceRole["EnumSensor"] = "enum-sensor";
+	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
+	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
+	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
+	DeviceRole["DateTimeSensor"] = "datetime-sensor";
+	/** Last-resort fallback when nothing else matches. */
+	DeviceRole["GenericSensor"] = "generic-sensor";
+	DeviceRole["NumericControl"] = "numeric-control";
+	DeviceRole["SelectControl"] = "select-control";
+	DeviceRole["TextControl"] = "text-control";
+	DeviceRole["DateTimeControl"] = "datetime-control";
+	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
+	*  rich features (image, priority, channel routing). */
+	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
+	/** Chat / messaging service (HA `notify.telegram_*`,
+	*  `notify.discord_*`, etc.). */
+	DeviceRole["MessagingNotifier"] = "messaging-notifier";
+	/** Email-based delivery (HA `notify.smtp`, etc.). */
+	DeviceRole["EmailNotifier"] = "email-notifier";
+	/** Fallback when the notifier service name doesn't match a known
+	*  pattern. */
+	DeviceRole["GenericNotifier"] = "generic-notifier";
+	return DeviceRole;
+}({});
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
+//#endregion
+//#region ../types/dist/composition-CPFIlFfw.mjs
 /**
 * Deterministic SHA-256 hash of an arbitrary serialisable value. The
 * canonical form sorts object keys alphabetically at every depth so two
@@ -7635,162 +7657,899 @@ function replaceWithSortedKeys(_key, value) {
 	}
 	return value;
 }
-//#endregion
-//#region ../types/dist/err-msg-IQTHeDzc.mjs
 /**
-import { errMsg } from '@camstack/types'
-* Extract a human-readable message from an unknown error value.
-* Replaces the ubiquitous `errMsg(err)` pattern.
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
 */
-function errMsg(err) {
-	if (err instanceof Error) return err.message;
-	if (typeof err === "string") return err;
-	return String(err);
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
 }
-var OWNER_TYPES = new Set([
-	"track",
-	"summary",
-	"face",
-	"identity",
-	"plate",
-	"vehicle",
-	"scene",
-	"motion",
-	"object",
-	"audio",
-	"mosaic"
-]);
-/**
-* Is this string a declared media owner type?
-*
-* Exported because the `event-media` plane's path parser needs it (D482): a
-* path segment is an arbitrary string until something narrows it, and a
-* hand-written list at the door would drift from {@link MEDIA_OWNER_TYPES} the
-* day an owner kind is added — the failure this module's own docblock already
-* records for `vehicle` and `scene`.
-*/
-function isMediaOwnerType(value) {
-	return OWNER_TYPES.has(value);
+function asString(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
 }
-/**
-* The owner types that are event tables, in the order the event-media resolver
-* should consider them. Exported so a consumer asking "is this key an event?"
-* does not re-spell the list and drift from it.
-*/
-var EVENT_OWNER_TYPES = [
-	"motion",
-	"object",
-	"audio"
-];
-/**
-* The same list as a Zod enum, for the cap inputs that must NAME the table
-* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
-* `(table, id)`).
-*
-* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
-* table would otherwise be accepted by the codec and refused at the door, with
-* nothing failing until a caller asked.
-*/
-var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
-/** The same list as a Zod enum, for the cap input that carries it. */
-var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
-var EVENT_OWNER_TYPE_SET = new Set(EVENT_OWNER_TYPES);
-/** True when this key's owner is one of the three event tables. */
-function isEventOwnerType(ownerType) {
-	return EVENT_OWNER_TYPE_SET.has(ownerType);
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
 }
-var EncodeProfileSchema = object({
-	video: object({
-		codec: _enum([
-			"h264",
-			"h265",
-			"copy"
-		]),
-		profile: _enum([
-			"baseline",
-			"main",
-			"high"
-		]).optional(),
-		/**
-		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
-		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
-		* it, or it ships a stream that does not match its own advertisement — the
-		* defect class that kept HomeKit black for a year and that Alexa carried
-		* silently. Optional because a browser negotiates the level itself.
-		*/
-		level: string().optional(),
-		width: number().int().positive().optional(),
-		height: number().int().positive().optional(),
-		fps: number().positive().optional(),
-		bitrateKbps: number().int().positive().optional(),
-		gopFrames: number().int().positive().optional(),
-		bf: number().int().min(0).optional(),
-		preset: _enum([
-			"ultrafast",
-			"superfast",
-			"veryfast",
-			"faster",
-			"fast",
-			"medium"
-		]).optional(),
-		tune: _enum([
-			"zerolatency",
-			"film",
-			"animation"
-		]).optional(),
-		/**
-		* ONE slice per access unit.
-		*
-		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
-		* the encoder as five NAL slices that share one RTP timestamp and carry one
-		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
-		* frame-end per frame: the first pictures render and the video then freezes
-		* for good while the audio, on its own plane, plays on. Measured on this hub
-		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
-		*
-		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
-		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
-		* consumers meaning the same thing spelled differently would stop sharing one
-		* child. Absent means "whatever the encoder does" — today's behaviour.
-		*/
-		singleSlicePerFrame: boolean().optional()
-	}),
-	audio: union([literal("passthrough"), object({
-		codec: _enum([
-			"opus",
-			"aac",
-			"pcmu",
-			"pcma",
-			"copy"
-		]),
-		bitrateKbps: number().int().positive().optional(),
-		sampleRateHz: number().int().positive().optional(),
-		channels: union([literal(1), literal(2)]).optional()
-	})]),
-	/**
-	* ffmpeg input-side args, inserted between the fixed global flags
-	* (`-hide_banner -loglevel error`) and `-i pipe:0`. Free-text array
-	* — the widget surfaces a textarea + suggestion chips for the most-
-	* used demuxer/format options.
-	*/
-	inputArgs: array(string()).optional(),
-	/**
-	* ffmpeg output-side args, inserted between the encode block and
-	* the final `-f <muxer> pipe:1`. Use for muxer options, bitstream
-	* filters, codec-specific overrides. Free-text array.
-	*/
-	outputArgs: array(string()).optional()
-});
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+function asBoolean(value, name, index) {
+	if (typeof value !== "boolean") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a boolean`);
+	return value;
+}
+/** A plain decimal (optional sign, fraction, exponent) — never hex, never `Infinity`, never a unit suffix. */
+var DECIMAL = /^[+-]?(\d+(\.\d*)?|\.\d+)([eE][+-]?\d+)?$/;
 /**
-* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
-* Baseline because it is the one profile every consumer in this repo decodes
-* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+* `number(x)`: a finite number, or a string that IS one, as a number; every
+* other value — `''`, `'unavailable'`, a boolean, null — is `null`
+* (unavailable, never 0: D393). The one bridge from a string-valued source (an
+* HA sensor with a unit and no device_class is an `enum-sensor`) to a number.
 */
-var BASE_LIVE_EGRESS_PROFILE = {
-	video: {
-		codec: "h264",
-		profile: "baseline",
-		level: "3.1",
+function toNumberOrNull(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : null;
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!DECIMAL.test(trimmed)) return null;
+	const parsed = Number(trimmed);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString(args[1], "convert", 1).trim();
+			const to = asString(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	},
+	any: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean(a, "any", i)).some((b) => b)
+	},
+	all: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean(a, "all", i)).every((b) => b)
+	},
+	within: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args, hooks) => {
+			const windowMs = asFiniteNumber(args[1], "within", 1);
+			if (windowMs < 0) throw new ExpressionEvalError("within: the window must not be negative");
+			const at = args[0];
+			if (at === null) return false;
+			const ts = asFiniteNumber(at, "within", 0);
+			const now = hooks.now;
+			if (now === void 0 || !Number.isFinite(now)) throw new ExpressionEvalError("within: no clock was supplied to this evaluation");
+			const inside = now - ts <= windowMs;
+			if (inside) hooks.noteDeadline?.(ts + windowMs + 1);
+			return inside;
+		}
+	},
+	number: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => toNumberOrNull(args[0])
+	},
+	latest: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const present = args.flatMap((a, i) => a === null ? [] : [asFiniteNumber(a, "latest", i)]);
+			return present.length === 0 ? null : finiteResult(Math.max(...present), "latest");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/** A composed device's stableId is this prefix plus the block id. */
+var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
+/** Longest snippet a `code` source may carry (slice 4). */
+var MAX_COMPOSITION_CODE_LENGTH = 2e4;
+var CompositionSourceRefSchema = object({
+	/** The owning addon; `stableId` is unique only within it. */
+	addonId: string().min(1),
+	stableId: string().min(1)
+});
+/** One field of one capability of one source device. */
+var CompositionFieldReadSchema = object({
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	/** Dotted path into the source cap's runtime-state slice. */
+	fieldPath: string().min(1)
+});
+/** `from`: copy one source field verbatim. It is also an expression's `from` binding. */
+var CompositionFromSourceSchema = CompositionFieldReadSchema.extend({ kind: literal("from") });
+var CompositionBindingSchema = discriminatedUnion("kind", [CompositionFromSourceSchema, object({
+	kind: literal("literal"),
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	])
+})]);
+/**
+* `expression`: a formula over named bindings, in the salvaged expression
+* engine. Validated at parse by the SAME function every other consumer runs,
+* so the editor and the store cannot disagree.
+*/
+var CompositionExpressionSourceSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), CompositionBindingSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/** `code`: RESERVED for slice 4 (own runner, one-way eject). */
+var CompositionCodeSourceSchema = object({
+	kind: literal("code"),
+	code: string().min(1).max(MAX_COMPOSITION_CODE_LENGTH)
+});
+var CompositionFieldSourceSchema = discriminatedUnion("kind", [
+	CompositionFromSourceSchema,
+	CompositionExpressionSourceSchema,
+	CompositionCodeSourceSchema
+]);
+var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
+	kind: literal("forward"),
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	method: string().min(1)
+}), CompositionCodeSourceSchema]);
+/** An item key inside an item-array cap (`consumables.items[<key>]`). */
+var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
+/**
+* One item of an item-array cap (D663), addressed through the cap's
+* `status.itemArray` descriptor. `fields` are paths INSIDE the item, nested
+* allowed (`remaining.value`); the key and label come from the entry itself.
+*/
+var CompositionItemEntrySchema = object({
+	label: string().min(1).max(80),
+	fields: record(string().min(1), CompositionFieldSourceSchema)
+});
+var CompositionFeatureSchema = discriminatedUnion("kind", [object({
+	kind: literal("fields"),
+	cap: string().min(1),
+	fields: record(string().min(1), CompositionFieldSourceSchema).refine((fields) => Object.keys(fields).length <= 32, { message: `at most 32 fields per capability` }),
+	/**
+	* Items of the cap's item array, keyed by item key (D663). Naming `items`
+	* owns the WHOLE array field: the composed value holds exactly these items.
+	*/
+	items: record(string().regex(COMPOSITION_ITEM_KEY_RE), CompositionItemEntrySchema).refine((items) => Object.keys(items).length <= 16, { message: `at most 16 items` }).optional(),
+	/** RESERVED for slice 3; refused by the validator when non-empty. */
+	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
+}), object({
+	kind: literal("passthrough"),
+	cap: string().min(1),
+	source: CompositionSourceRefSchema
+})]);
+var CompositionSchema = object({
+	target: discriminatedUnion("kind", [object({
+		kind: literal("new"),
+		type: _enum(DeviceType),
+		role: _enum(DeviceRole).optional()
+	}), object({
+		kind: literal("existing"),
+		device: CompositionSourceRefSchema
+	})]),
+	features: array(CompositionFeatureSchema).min(1).max(16)
+}).superRefine((composition, ctx) => {
+	const seen = /* @__PURE__ */ new Set();
+	composition.features.forEach((feature, index) => {
+		if (seen.has(feature.cap)) ctx.addIssue({
+			code: "custom",
+			message: `capability \`${feature.cap}\` is composed twice — one feature per capability`,
+			path: [
+				"features",
+				index,
+				"cap"
+			]
+		});
+		seen.add(feature.cap);
+	});
+});
+var OWNER_TYPES = new Set([
+	"track",
+	"summary",
+	"face",
+	"identity",
+	"plate",
+	"vehicle",
+	"scene",
+	"motion",
+	"object",
+	"audio",
+	"mosaic"
+]);
+/**
+* Is this string a declared media owner type?
+*
+* Exported because the `event-media` plane's path parser needs it (D482): a
+* path segment is an arbitrary string until something narrows it, and a
+* hand-written list at the door would drift from {@link MEDIA_OWNER_TYPES} the
+* day an owner kind is added — the failure this module's own docblock already
+* records for `vehicle` and `scene`.
+*/
+function isMediaOwnerType(value) {
+	return OWNER_TYPES.has(value);
+}
+/**
+* The owner types that are event tables, in the order the event-media resolver
+* should consider them. Exported so a consumer asking "is this key an event?"
+* does not re-spell the list and drift from it.
+*/
+var EVENT_OWNER_TYPES = [
+	"motion",
+	"object",
+	"audio"
+];
+/**
+* The same list as a Zod enum, for the cap inputs that must NAME the table
+* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
+* `(table, id)`).
+*
+* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
+* table would otherwise be accepted by the codec and refused at the door, with
+* nothing failing until a caller asked.
+*/
+var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
+var EVENT_OWNER_TYPE_SET = new Set(EVENT_OWNER_TYPES);
+/** True when this key's owner is one of the three event tables. */
+function isEventOwnerType(ownerType) {
+	return EVENT_OWNER_TYPE_SET.has(ownerType);
+}
+var EncodeProfileSchema = object({
+	video: object({
+		codec: _enum([
+			"h264",
+			"h265",
+			"copy"
+		]),
+		profile: _enum([
+			"baseline",
+			"main",
+			"high"
+		]).optional(),
+		/**
+		* `-level`, e.g. `'3.1'`. A consumer that ADVERTISES a level in its SDP
+		* (`profile-level-id=42e01f` is Baseline 3.1) must constrain the encoder to
+		* it, or it ships a stream that does not match its own advertisement — the
+		* defect class that kept HomeKit black for a year and that Alexa carried
+		* silently. Optional because a browser negotiates the level itself.
+		*/
+		level: string().optional(),
+		width: number().int().positive().optional(),
+		height: number().int().positive().optional(),
+		fps: number().positive().optional(),
+		bitrateKbps: number().int().positive().optional(),
+		gopFrames: number().int().positive().optional(),
+		bf: number().int().min(0).optional(),
+		preset: _enum([
+			"ultrafast",
+			"superfast",
+			"veryfast",
+			"faster",
+			"fast",
+			"medium"
+		]).optional(),
+		tune: _enum([
+			"zerolatency",
+			"film",
+			"animation"
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
+	}),
+	audio: union([literal("passthrough"), object({
+		codec: _enum([
+			"opus",
+			"aac",
+			"pcmu",
+			"pcma",
+			"copy"
+		]),
+		bitrateKbps: number().int().positive().optional(),
+		sampleRateHz: number().int().positive().optional(),
+		channels: union([literal(1), literal(2)]).optional()
+	})]),
+	/**
+	* ffmpeg input-side args, inserted between the fixed global flags
+	* (`-hide_banner -loglevel error`) and `-i pipe:0`. Free-text array
+	* — the widget surfaces a textarea + suggestion chips for the most-
+	* used demuxer/format options.
+	*/
+	inputArgs: array(string()).optional(),
+	/**
+	* ffmpeg output-side args, inserted between the encode block and
+	* the final `-f <muxer> pipe:1`. Use for muxer options, bitstream
+	* filters, codec-specific overrides. Free-text array.
+	*/
+	outputArgs: array(string()).optional()
+});
+/**
+* The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
+* Baseline because it is the one profile every consumer in this repo decodes
+* (Echo, iOS, an old browser); 3.1 because that is what the SDPs advertise.
+*/
+var BASE_LIVE_EGRESS_PROFILE = {
+	video: {
+		codec: "h264",
+		profile: "baseline",
+		level: "3.1",
 		width: 1280,
 		height: 720,
 		fps: 25,
@@ -9508,1504 +10267,888 @@ function isStorageLocationMode(value) {
 /** May this location be written to? */
 function mayWriteToLocation(location) {
 	return modeMayWrite(resolveLocationMode(location));
-}
-/** What eviction may do to this location. */
-function evictionPolicyOfLocation(location) {
-	return evictionPolicyForMode(resolveLocationMode(location));
-}
-/**
-* `StorageLocationType` — an addon-declared id that identifies the *kind* of
-* storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
-* so the persisted record schema and the consumer-facing cap can both consume it
-* without forming a circular import. The `storage` cap re-exports it
-* verbatim for back-compat.
-*
-* This Zod schema is the **authoritative source** for `StorageLocationType`.
-* The TS alias in `./storage.ts` re-exports `z.infer<typeof
-* StorageLocationTypeSchema>` so the wire surface (cap) and the legacy
-* `IStorageProvider` interface stay in lockstep.
-*
-* The type is now an **open string** (not a closed enum) — addons declare
-* their own location kinds via `StorageLocationDeclaration.id`. The regex
-* enforces a safe id format: lowercase-start, alphanumeric + hyphens.
-*/
-var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
-/**
-* Persisted record for a storage location instance. Operators can register
-* multiple instances for multi-cardinality types (e.g. two `backups`
-* locations with different `providerId`s). Cardinality is now declared per
-* location via `StorageLocationDeclaration.cardinality` — the static
-* `STORAGE_LOCATION_CARDINALITY` map has been removed.
-*
-* `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The seed names its first instance `<type>:default` — a NAME, not a flag.
-* There is no default location any more (D383): `enabled` is the whole write
-* model, and a bare type ref resolves to the sole location of the type, or —
-* transitionally, only while legacy NULL-stamped rows exist — to the row whose
-* slug is `default`.
-*
-* `isSystem` is a legacy persisted flag. Seed still creates the initial
-* `<type>:default` locations; the flag is no longer a lock, a badge, or a
-* prune selector. New writes leave it false. Deletion is gated on uniqueness
-* / last-enabled, not on this bit.
-*/
-var StorageLocationSchema = object({
-	id: string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
-	type: string(),
-	displayName: string().min(1),
-	providerId: string().min(1),
-	config: record(string(), unknown()),
-	/**
-	* Cluster node this location physically lives on. REQUIRED for node-local
-	* providers (filesystem — the path exists on one node's disk), null/absent
-	* for node-agnostic providers (S3/SFTP/WebDAV, reachable from any node).
-	* `'hub'` is the hub node. Validated against the provider's `nodeLocal`
-	* flag at upsert time, not here (the schema is provider-agnostic).
-	*/
-	nodeId: string().optional(),
-	isSystem: boolean().default(false),
-	/**
-	* THE write switch, and the only one (D383). `enabled: true` means every
-	* consumer that chooses a write target for this type may write here, and all
-	* enabled locations of a type are used TOGETHER; `false` means read-only —
-	* still read, still played back, still age-swept, still drained, never
-	* written.
-	*
-	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
-	* stored" on an update and "born inert unless it is the first location of its
-	* type" on a create. On a PERSISTED row absence is legacy and it means
-	* enabled — {@link isLocationEnabled} is the one place that says so, and the
-	* orchestrator stamps every flagless row `true` once at hydrate so absence
-	* stops existing rather than being re-derived on every read.
-	*/
-	enabled: boolean().optional(),
-	/**
-	* THE state of this location (D385), and the only authority on what may be
-	* written, read or evicted here. Interpreted in exactly one place —
-	* `storage-location-mode.ts` — which also folds the legacy
-	* `enabled` / `config.readOnly` pair into a mode so an old row is never
-	* ambiguous.
-	*
-	* OPTIONAL only for the wire and for rows written before D385: absence is
-	* resolved by `resolveLocationMode`, and the orchestrator stamps every
-	* unstamped row ONCE at hydrate so absence stops existing rather than being
-	* re-derived on every read. `enabled` survives one release as a DERIVED
-	* mirror (`mode === 'active'`); `withLocationMode` is the only writer of
-	* either, so the two cannot disagree.
-	*/
-	mode: StorageLocationModeSchema.optional(),
-	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
-	*  for node-local locations it can reach) — never persisted, absent when the
-	*  volume is remote/unreachable. The single capacity truth every UI reads. */
-	capacity: object({
-		totalBytes: number(),
-		availableBytes: number()
-	}).nullable().optional(),
-	/**
-	* How much of that volume CamStack ITSELF holds on this location (D388) —
-	* COMPUTED at read time from the `storage-occupancy` providers' own figures,
-	* never persisted, never a filesystem walk.
-	*
-	* **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
-	* location yet — nobody stores here, the owning addon is down, or the first
-	* refresh has not completed. A UI must omit the segment rather than draw it
-	* at zero, which would claim we occupy nothing (D315). It is an OBJECT and
-	* not a bare number precisely so that a `?? 0` on the consuming side has to
-	* be spelled out loud instead of appearing by accident.
-	*
-	* `measuredAtMs` is the OLDEST contributing measurement, so it is honest
-	* about the whole figure rather than about its freshest part.
-	*/
-	owned: object({
-		bytes: number().int().nonnegative(),
-		measuredAtMs: number().int().nonnegative()
-	}).optional(),
-	createdAt: number(),
-	updatedAt: number()
-});
-object({ isDefault: boolean().optional() });
-/**
-* How far a `drain` has got (D386) — the read a UI renders, and nothing more.
-*
-* `estimatedEmptyAtMs` is derived from the growth the ratchet has actually
-* OBSERVED and is `null` when it has observed none. Never a fabricated date: a
-* drain with no observed growth has no honest ETA, and inventing one is how an
-* operator learns not to believe the screen.
-*/
-var StorageDrainProgressSchema = object({
-	locationId: string(),
-	startedAtMs: number(),
-	startBytes: number(),
-	bytesRemaining: number(),
-	drained: boolean(),
-	estimatedEmptyAtMs: number().nullable()
-});
-/**
-* Reference accepted by consumer-facing `api.storage.*` calls.
-* Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
-*    (transitionally, the `<type>:default`-slugged row when several exist)
-*  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
-*
-* The orchestrator's `resolveRef(ref)` handles both cases.
-*/
-var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
-/**
-* `StorageLocationDeclaration` — a single storage-location entry declared by
-* an addon in its `package.json` under `camstack.storageLocations`.
-*
-* Design intent:
-* - **Addon declares its needs** — each addon describes the logical storage
-*   slots it requires (e.g. `recordings`, `recordingsLow`) without caring
-*   about the physical path.
-* - **Kernel aggregates** — at boot the kernel collects declarations from all
-*   installed addons, deduplicates by `id`, and exposes the union via the
-*   storage-locations settings surface.
-* - **Orchestrator seeds** — for every declared `id` the orchestrator ensures
-*   at least one instance named `<id>:default` is present, using
-*   `defaultsTo` to inherit the resolved root from another location when the
-*   declaration is a derivative slot (e.g. `recordingsLow` defaults to
-*   `recordings`).
-* - **ids are global** — `id` values are shared across the entire deployment;
-*   two addons declaring the same `id` must agree on `cardinality` (validated
-*   at kernel aggregation time, not here).
-*/
-/**
-* `StorageAccess` — how the service that DECLARED a storage-location kind
-* actually reaches the bytes. It is the constraint that decides which
-* `storage-provider`s may back a location of that kind.
-*
-* - `'local-path'` — the service asks `storage.resolve` for a path string and
-*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
-*   post-analysis media roots). Only a provider that serves a genuine local
-*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
-*   remote provider's `resolve` returns a path on the REMOTE host, and
-*   `fs.readdir` of it on this node either fails or — far worse — succeeds
-*   against a same-named local directory that is something else entirely.
-*
-* - `'cap-mediated'` — every byte travels through the `storage` cap
-*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
-*   service never sees a path, so any provider can back it. `backups` is the
-*   one kind that qualifies today.
-*
-* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
-* an EMERGENT property of how the recorder happened to be written. Nothing
-* refused the configuration; the first write simply went somewhere wrong, and
-* a recording write that goes wrong surfaces as a silent black window rather
-* than an error (the read path does not `stat`). This turns that accident into
-* a declared, enforced, testable refusal.
-*/
-var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
-var StorageLocationDeclarationSchema = object({
-	/**
-	* Global location identifier, e.g. `recordings` or `recordingsLow`.
-	* Must start with a lowercase letter and may contain letters, digits, and
-	* hyphens.
-	*/
-	id: string().regex(/^[a-z][a-zA-Z0-9-]*$/, { message: "id must start with a lowercase letter and contain only letters, digits, or hyphens" }),
-	/** Human-readable name shown in the admin UI. */
-	displayName: string().min(1, { message: "displayName must not be empty" }),
-	/** Optional longer explanation of what data this location stores. */
-	description: string().optional(),
-	/**
-	* `single` — exactly one instance of this location is allowed system-wide
-	* (e.g. `logs`, `models`). The operator can edit it but not add more.
-	* `multi`  — the operator may register several instances (e.g. a second
-	* `recordings` on a NAS for disk tiering); one is the default at any time.
-	*/
-	cardinality: _enum(["single", "multi"]),
-	/**
-	* HOW the declaring service reaches the bytes — and therefore WHICH
-	* providers may back a location of this kind. See {@link StorageAccessSchema}
-	* and {@link STORAGE_ACCESS_FALLBACK}.
-	*
-	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
-	* can only over-restrict (refuse a remote provider for a kind that might
-	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
-	* permissive direction and is therefore never inferred — a repo guard
-	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
-	* reached by omission.
-	*/
-	access: StorageAccessSchema.optional(),
-	/**
-	* When set, the default instance for this location inherits its resolved
-	* root from the named location's default instance. Useful for derivative
-	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
-	* configure the primary location.
-	*/
-	defaultsTo: string().optional(),
-	/**
-	* Which node root the seeded `<id>:default` instance is placed under on a
-	* FRESH install:
-	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (logs, models).
-	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
-	*   env is set, else falls back to the data root. Right for bulky, hot media
-	*   (recordings, event media) that should stay off the appData disk.
-	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
-	*   `/backups` in the image) so archives live on their own mount rather than
-	*   filling the appData disk. Falls back to the data root when unset.
-	*
-	* Only affects the seeded default's `basePath`; operators can repoint any
-	* location afterwards, and a `defaultsTo` slot inherits its parent's root
-	* regardless of this field. Absent (the common case) is treated as `'data'`.
-	*/
-	defaultRoot: _enum([
-		"data",
-		"media",
-		"backup"
-	]).optional()
-});
-var DecoderStatsSchema = object({
-	inputFps: number(),
-	outputFps: number(),
-	avgDecodeTimeMs: number(),
-	droppedFrames: number(),
-	/**
-	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
-	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
-	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
-	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
-	*/
-	lagMs: number().optional(),
-	effectiveFps: number().optional(),
-	adaptiveFps: number().optional()
-});
-var DecoderSessionConfigSchema = object({
-	codec: string(),
-	maxFps: number().default(0),
-	outputFormat: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]).default("jpeg"),
-	scale: number().default(1),
-	width: number().optional(),
-	height: number().optional(),
-	/**
-	* Identifier of the camera this decoder session serves. Optional
-	* because the cap is generic (any caller could request decode), but
-	* stream-broker passes it so decoder logs include `deviceId` for
-	* per-camera filtering when diagnosing failures (e.g. node-av
-	* sendPacket errors on a single hung camera).
-	*/
-	deviceId: number().int().nonnegative().optional(),
-	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
-	*/
-	tag: string().optional(),
-	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
-	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
-	*/
-	frameSink: _enum(["callback", "shm"]).default("callback"),
-	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
-	*/
-	debug: boolean().optional()
-});
-/**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
+}
+/** What eviction may do to this location. */
+function evictionPolicyOfLocation(location) {
+	return evictionPolicyForMode(resolveLocationMode(location));
+}
 /**
-* Distinct (device, family, variant) counters one instance will hold.
+* `StorageLocationType` — an addon-declared id that identifies the *kind* of
+* storage a location serves. Defined here (not in `capabilities/storage.cap.ts`)
+* so the persisted record schema and the consumer-facing cap can both consume it
+* without forming a circular import. The `storage` cap re-exports it
+* verbatim for back-compat.
 *
-* A large fleet x the handful of families any single addon reports, with
-* slack. At ~200 B per counter this is a ~100 KB ceiling on a process that
-* already declares an RSS budget in the gigabytes.
-*/
-var MAX_KEYS = 1024;
-/**
-* Where reasons past {@link MAX_REASONS_PER_KEY} go.
+* This Zod schema is the **authoritative source** for `StorageLocationType`.
+* The TS alias in `./storage.ts` re-exports `z.infer<typeof
+* StorageLocationTypeSchema>` so the wire surface (cap) and the legacy
+* `IStorageProvider` interface stay in lockstep.
 *
-* They are FOLDED, never dropped: `attempts - succeeded` must always equal the
-* sum of the reason counts, or the ratio stops adding up.
+* The type is now an **open string** (not a closed enum) — addons declare
+* their own location kinds via `StorageLocationDeclaration.id`. The regex
+* enforces a safe id format: lowercase-start, alphanumeric + hyphens.
 */
-var OVERFLOW_REASON = "other";
-/** `deviceId` + `family` + optional `variant`, flattened into the map key. */
-function counterKey(deviceId, family, variant) {
-	return variant === void 0 ? `${deviceId}${family}` : `${deviceId}${family}${variant}`;
-}
+var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 /**
-* A bounded set of per-camera, cumulative failure counters.
+* Persisted record for a storage location instance. Operators can register
+* multiple instances for multi-cardinality types (e.g. two `backups`
+* locations with different `providerId`s). Cardinality is now declared per
+* location via `StorageLocationDeclaration.cardinality` — the static
+* `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
-* One instance per contributing subsystem. `note` is O(1) and allocation-free
-* on the steady path; `snapshot` reads without mutating anything.
+* `id` is a stable namespaced string of the form `<type>:<slug>`.
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
+*
+* `isSystem` is a legacy persisted flag. Seed still creates the initial
+* `<type>:default` locations; the flag is no longer a lock, a badge, or a
+* prune selector. New writes leave it false. Deletion is gated on uniqueness
+* / last-enabled, not on this bit.
 */
-var FailureCounters = class {
-	maxKeys;
-	maxReasons;
-	counters = /* @__PURE__ */ new Map();
-	refused = 0;
-	constructor(maxKeys = MAX_KEYS, maxReasons = 16) {
-		this.maxKeys = maxKeys;
-		this.maxReasons = maxReasons;
-	}
+var StorageLocationSchema = object({
+	id: string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
+	type: string(),
+	displayName: string().min(1),
+	providerId: string().min(1),
+	config: record(string(), unknown()),
 	/**
-	* Counters refused because {@link MAX_KEYS} was already held.
-	*
-	* Cumulative for the life of the instance: a bound that bit is a fact about
-	* the deployment, and a surface that hid it would under-report a fleet
-	* precisely when the fleet got large enough to matter.
+	* Cluster node this location physically lives on. REQUIRED for node-local
+	* providers (filesystem — the path exists on one node's disk), null/absent
+	* for node-agnostic providers (S3/SFTP/WebDAV, reachable from any node).
+	* `'hub'` is the hub node. Validated against the provider's `nodeLocal`
+	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
-	get keysRefused() {
-		return this.refused;
-	}
-	/** Counters currently held. */
-	get size() {
-		return this.counters.size;
-	}
+	nodeId: string().optional(),
+	isSystem: boolean().default(false),
 	/**
-	* Fold one observation in.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* A non-positive or non-integer `deviceId` is REFUSED rather than bucketed:
-	* see the module docblock — an entry that cannot name its camera is worse
-	* than no entry.
-	*/
-	note(observation, nowMs) {
-		if (!Number.isInteger(observation.deviceId) || observation.deviceId <= 0) return;
-		const key = counterKey(observation.deviceId, observation.family, observation.variant);
-		let counter = this.counters.get(key);
-		if (counter === void 0) {
-			if (this.counters.size >= this.maxKeys) {
-				this.refused += 1;
-				return;
-			}
-			counter = {
-				deviceId: observation.deviceId,
-				family: observation.family,
-				variant: observation.variant,
-				sinceMs: nowMs,
-				attempts: 0,
-				succeeded: 0,
-				reasons: /* @__PURE__ */ new Map()
-			};
-			this.counters.set(key, counter);
-		}
-		counter.attempts += 1;
-		if (observation.reason === void 0) {
-			counter.succeeded += 1;
-			return;
-		}
-		const reason = counter.reasons.has(observation.reason) || counter.reasons.size < this.maxReasons ? observation.reason : OVERFLOW_REASON;
-		counter.reasons.set(reason, (counter.reasons.get(reason) ?? 0) + 1);
-	}
-	/** Read every counter. Never mutates — see the module docblock. */
-	snapshot(nowMs) {
-		const out = [];
-		for (const counter of this.counters.values()) out.push({
-			deviceId: counter.deviceId,
-			family: counter.family,
-			...counter.variant !== void 0 ? { variant: counter.variant } : {},
-			sinceMs: counter.sinceMs,
-			atMs: nowMs,
-			attempts: counter.attempts,
-			succeeded: counter.succeeded,
-			reasons: [...counter.reasons.entries()].map(([reason, count]) => ({
-				reason,
-				count
-			})).toSorted((a, b) => b.count - a.count)
-		});
-		return out;
-	}
-	/** Drop everything (host disposal). */
-	clear() {
-		this.counters.clear();
-	}
-};
-var ClipModelMetaSchema = object({
-	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
-	textModelId: string().min(1),
-	/** Output dimension of BOTH towers. A vector of any other length is refused. */
-	embeddingDim: number().int().positive(),
-	/**
-	* The `vector-store` index this model's vectors live in. ONE feature space
-	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
-	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	enabled: boolean().optional(),
 	/**
-	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
-	* must be unique per tokenizer: every model's siblings land in ONE flat
-	* models directory, so two different tokenizers under the same name would
-	* silently overwrite each other (whichever model downloaded last wins, and
-	* the other one tokenises with the wrong vocabulary).
+	* THE state of this location (D385), and the only authority on what may be
+	* written, read or evicted here. Interpreted in exactly one place —
+	* `storage-location-mode.ts` — which also folds the legacy
+	* `enabled` / `config.readOnly` pair into a mode so an old row is never
+	* ambiguous.
+	*
+	* OPTIONAL only for the wire and for rows written before D385: absence is
+	* resolved by `resolveLocationMode`, and the orchestrator stamps every
+	* unstamped row ONCE at hydrate so absence stops existing rather than being
+	* re-derived on every read. `enabled` survives one release as a DERIVED
+	* mirror (`mode === 'active'`); `withLocationMode` is the only writer of
+	* either, so the two cannot disagree.
 	*/
-	tokenizerFile: string().min(1),
-	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
-	contextLength: number().int().positive(),
-	/** Id the tokenizer pads with. */
-	padId: number().int().nonnegative(),
+	mode: StorageLocationModeSchema.optional(),
+	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
+	*  for node-local locations it can reach) — never persisted, absent when the
+	*  volume is remote/unreachable. The single capacity truth every UI reads. */
+	capacity: object({
+		totalBytes: number(),
+		availableBytes: number()
+	}).nullable().optional(),
 	/**
-	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
-	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
-	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	* How much of that volume CamStack ITSELF holds on this location (D388) —
+	* COMPUTED at read time from the `storage-occupancy` providers' own figures,
+	* never persisted, never a filesystem walk.
+	*
+	* **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
+	* location yet — nobody stores here, the owning addon is down, or the first
+	* refresh has not completed. A UI must omit the segment rather than draw it
+	* at zero, which would claim we occupy nothing (D315). It is an OBJECT and
+	* not a bare number precisely so that a `?? 0` on the consuming side has to
+	* be spelled out loud instead of appearing by accident.
+	*
+	* `measuredAtMs` is the OLDEST contributing measurement, so it is honest
+	* about the whole figure rather than about its freshest part.
 	*/
-	searchMinScore: number().min(0).max(1)
+	owned: object({
+		bytes: number().int().nonnegative(),
+		measuredAtMs: number().int().nonnegative()
+	}).optional(),
+	createdAt: number(),
+	updatedAt: number()
 });
-var ClipSearchStrictnessSchema = _enum([
-	"loose",
-	"balanced",
-	"strict"
-]);
-var CLIP_STRICTNESS_FACTOR = {
-	loose: 1,
-	balanced: 1.25,
-	strict: 1.5
-};
-/**
-* The cosine floor a search runs with.
-*
-* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
-* and silently rescaling it would make the same URL mean different things on
-* two installs. Everything else is relative to the model.
-*/
-function resolveClipSearchMinScore(meta, request) {
-	if (request.minScore !== void 0) return request.minScore;
-	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
-	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
-}
-var MODEL_FORMATS = [
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-];
+object({ isDefault: boolean().optional() });
 /**
-* Multi-file format payload.
+* How far a `drain` has got (D386) — the read a UI renders, and nothing more.
 *
-* - Directory formats (`isDirectory: true`, e.g. `.mlpackage`): files
-*   relative to the directory root — the downloader fetches each from
-*   `{url}/{file}` into `{modelDir}/{file}`. If omitted, it probes the
-*   HuggingFace API (slower).
-* - Single-file formats (no `isDirectory`, e.g. OpenVINO IR): sibling
-*   files fetched from the SAME remote directory as `url` and stored flat
-*   alongside the main file — e.g. `['camstack-yolov9t.bin']` for the IR
-*   weights next to `camstack-yolov9t.xml`.
-*/
-var ModelFormatEntrySchema = object({
-	url: string(),
-	sizeMB: number(),
-	/** Whether this format is a directory bundle (e.g., .mlpackage) rather than a single file */
-	isDirectory: boolean().optional(),
-	/** Multi-file payload (directory members or sibling files). */
-	files: array(string()).readonly().optional(),
-	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["python"])).readonly().optional()
-});
-/**
-* Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
-* The downloader fetches from `url` and saves to `{modelsDir}/{filename}`.
+* `estimatedEmptyAtMs` is derived from the growth the ratchet has actually
+* OBSERVED and is `null` when it has observed none. Never a fabricated date: a
+* drain with no observed growth has no honest ETA, and inventing one is how an
+* operator learns not to believe the screen.
 */
-var ModelExtraFileSchema = object({
-	url: string(),
-	filename: string(),
-	sizeMB: number()
+var StorageDrainProgressSchema = object({
+	locationId: string(),
+	startedAtMs: number(),
+	startBytes: number(),
+	bytesRemaining: number(),
+	drained: boolean(),
+	estimatedEmptyAtMs: number().nullable()
 });
 /**
-* Per-format payload map. Modelled as an explicit object (one optional key
-* per `ModelFormat`) rather than `z.record(enum, …)` — zod v4's enum-keyed
-* record requires every key, but a catalog entry only ships a subset of
-* formats.
+* Reference accepted by consumer-facing `api.storage.*` calls.
+* Either:
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
+*  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
+*
+* The orchestrator's `resolveRef(ref)` handles both cases.
 */
-var ModelFormatsSchema = object({
-	onnx: ModelFormatEntrySchema.optional(),
-	coreml: ModelFormatEntrySchema.optional(),
-	openvino: ModelFormatEntrySchema.optional(),
-	tflite: ModelFormatEntrySchema.optional(),
-	pt: ModelFormatEntrySchema.optional(),
-	gguf: ModelFormatEntrySchema.optional()
-});
+var StorageLocationRefSchema = union([StorageLocationTypeSchema, string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
 /**
-* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
-* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
-* grouped Family→Tier→Variant picker renders identically in the config UI and
-* in the pipeline/device steppers. The flat `id` stays the source of truth for
-* resolution/download/persistence; this is a presentation overlay resolved back
-* to an `id`.
+* `StorageLocationDeclaration` — a single storage-location entry declared by
+* an addon in its `package.json` under `camstack.storageLocations`.
+*
+* Design intent:
+* - **Addon declares its needs** — each addon describes the logical storage
+*   slots it requires (e.g. `recordings`, `recordingsLow`) without caring
+*   about the physical path.
+* - **Kernel aggregates** — at boot the kernel collects declarations from all
+*   installed addons, deduplicates by `id`, and exposes the union via the
+*   storage-locations settings surface.
+* - **Orchestrator seeds** — for every declared `id` the orchestrator ensures
+*   at least one instance named `<id>:default` is present, using
+*   `defaultsTo` to inherit the resolved root from another location when the
+*   declaration is a derivative slot (e.g. `recordingsLow` defaults to
+*   `recordings`).
+* - **ids are global** — `id` values are shared across the entire deployment;
+*   two addons declaring the same `id` must agree on `cardinality` (validated
+*   at kernel aggregation time, not here).
 */
-var ModelVariantGroupSchema = object({
-	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
-	family: string(),
-	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
-	tier: string(),
-	/** Quantization axis. Omit ⇒ the fp32 base build. */
-	precision: _enum(["fp32", "int8"]).optional(),
-	/**
-	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
-	* future performance variants plug into.
-	*/
-	optimization: _enum(["standard", "fast"]).optional(),
-	/**
-	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
-	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
-	* cheap latency lever — especially on Apple ANE and the Intel N100 — at a
-	* small-object accuracy cost. Mirrors the model's `inputSize` but lifted onto
-	* the group so the selector can offer it as a variant axis.
-	*/
-	resolution: number().int().positive().optional()
-});
-var ModelProviderIdSchema = _enum([
-	"camstack",
-	"frigate",
-	"scrypted",
-	"custom"
-]);
 /**
-* The licence of a model, as a record rather than a bare SPDX string: a
-* permissive CODE licence routinely sits on top of restrictive WEIGHTS or
-* DATA, and the obligations (attribution, modification notices, source offers)
-* are per upstream. A persisted custom-model row written when this field was a
-* string still parses — the string is lifted into `{ weights }`.
+* `StorageAccess` — how the service that DECLARED a storage-location kind
+* actually reaches the bytes. It is the constraint that decides which
+* `storage-provider`s may back a location of that kind.
 *
-* Every licence surface (the admin "Models and licenses" page,
-* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
-* these records by `scripts/gen-model-licenses.ts` (D661).
+* - `'local-path'` — the service asks `storage.resolve` for a path string and
+*   then does its own `node:fs` I/O on it (the recorder's segment writer, the
+*   post-analysis media roots). Only a provider that serves a genuine local
+*   filesystem (`getProviderInfo().nodeLocal === true`) can satisfy that: a
+*   remote provider's `resolve` returns a path on the REMOTE host, and
+*   `fs.readdir` of it on this node either fails or — far worse — succeeds
+*   against a same-named local directory that is something else entirely.
+*
+* - `'cap-mediated'` — every byte travels through the `storage` cap
+*   (`read`/`write`, or `beginUpload`/`writeChunk`/`finalizeUpload`). The
+*   service never sees a path, so any provider can back it. `backups` is the
+*   one kind that qualifies today.
+*
+* Before this existed, `recordings` was unreachable by SFTP/S3/WebDAV only as
+* an EMERGENT property of how the recorder happened to be written. Nothing
+* refused the configuration; the first write simply went somewhere wrong, and
+* a recording write that goes wrong surfaces as a silent black window rather
+* than an error (the read path does not `stat`). This turns that accident into
+* a declared, enforced, testable refusal.
 */
-var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
-	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
-	weights: string().min(1),
-	/** SPDX id of the upstream code that defines / trained the network. */
-	code: string().min(1).optional(),
-	/** Training data whose terms add obligations (attribution, non-commercial). */
-	data: object({
-		name: string().min(1),
-		terms: string().min(1),
-		url: string().url().optional()
-	}).optional(),
-	/** The project the weights come from. Required on built-in entries (guard). */
-	upstream: object({
-		name: string().min(1),
-		url: string().url()
-	}).optional(),
-	/** Where the licence text governing the weights is published. */
-	url: string().url().optional(),
-	/** Attribution the licence REQUIRES, verbatim. */
-	attribution: string().min(1).optional(),
-	/** What CamStack changed. Required when `hosting` is `camstack-hf` (guard). */
-	modifications: string().min(1).optional(),
-	/** Who serves the file a node downloads. */
-	hosting: _enum([
-		"camstack-hf",
-		"third-party",
-		"built-in"
-	]).optional(),
-	/** True when the weights or their data forbid commercial use. */
-	nonCommercial: boolean().optional()
-}));
-var ModelCatalogEntrySchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	formats: ModelFormatsSchema,
-	inputSize: object({
-		width: number(),
-		height: number()
-	}),
-	/**
-	* Channel count of the model input tensor. Omit ⇒ 3 (RGB), the default for
-	* every detector / classifier / embedder. Set to 1 for a grayscale CTC text
-	* recognizer (EasyOCR VGG plate-OCR: input `[N,1,H,W]`) so the preprocess
-	* feeds a single-channel, EasyOCR-normalized tensor instead of the default
-	* 3-channel RGB one. Threaded through `PoolModelConfig.inputChannels` to the
-	* Python inference pool.
-	*/
-	inputChannels: number().int().positive().optional(),
-	labels: array(LabelDefinitionSchema).readonly(),
-	inputLayout: _enum(["nchw", "nhwc"]).optional(),
-	/**
-	* `'scrfd'` applies InsightFace's SCRFD input contract, `(x - 127.5) / 128`
-	* (upstream `insightface/model_zoo/scrfd.py`), instead of the historical
-	* plain `/255`. Measured against COCO GT: 188 → 196 faces found on the
-	* `scrfd-2.5g` catalog entry (2026-09-26 model-replacement spike, §2.4-2).
-	*/
-	inputNormalization: _enum([
-		"zero-one",
-		"imagenet",
-		"none",
-		"scrfd"
-	]).optional(),
-	/**
-	* The model already applies softmax IN-GRAPH — its raw output is a
-	* probability distribution, not logits. When set, the `softmax`
-	* postprocessor must NOT re-apply softmax: re-softmaxing an already-normalised
-	* probability vector collapses it toward uniform (top-1 score craters far
-	* below its true value, making every confidence gate meaningless). Absent ⇒
-	* the output is raw logits and the postprocessor applies softmax (the normal
-	* case). Set on the Google AIY Birds `bird-classifier` (softmax baked into the
-	* TF graph). Threaded to the Python pool via `PoolModelConfig.outputProbabilities`.
-	*/
-	outputProbabilities: boolean().optional(),
-	preprocessMode: _enum(["letterbox", "resize"]).optional(),
-	/**
-	* Per-MODEL postprocessor override. Absent ⇒ the step's own
-	* `StepDefinition.postprocessor` applies (the normal case — every model in a
-	* step shares its decode). Set it when a step hosts models with DIFFERENT raw
-	* output layouts under one slot: e.g. object-detection is `'yolo'` by default,
-	* but a Coral SSD MobileNet build emits the `TFLite_Detection_PostProcess`
-	* 4-tensor layout and needs `'ssd'`. Threaded into `PoolModelConfig.postprocessor`
-	* by the engine factory (`modelEntry.postprocessor ?? def.postprocessor`).
-	*/
-	postprocessor: custom().optional(),
+var StorageAccessSchema = _enum(["local-path", "cap-mediated"]);
+var StorageLocationDeclarationSchema = object({
 	/**
-	* Per-MODEL default confidence floor. Absent ⇒ the step's
-	* `StepDefinition.defaultConfidence` applies. A score is a property of one
-	* model's output scale, not of the step slot it sits in: YuNet's
-	* `sqrt(cls·obj)` is not SCRFD's score, and inheriting SCRFD's 0.5 filled the
-	* face gallery with wheels and hands (D662, amends D645). An operator's
-	* explicit value still wins over it. Resolved in ONE place —
-	* `addon-pipeline/.../registry/effective-confidence.ts`.
+	* Global location identifier, e.g. `recordings` or `recordingsLow`.
+	* Must start with a lowercase letter and may contain letters, digits, and
+	* hyphens.
 	*/
-	defaultConfidence: number().min(0).max(1).optional(),
+	id: string().regex(/^[a-z][a-zA-Z0-9-]*$/, { message: "id must start with a lowercase letter and contain only letters, digits, or hyphens" }),
+	/** Human-readable name shown in the admin UI. */
+	displayName: string().min(1, { message: "displayName must not be empty" }),
+	/** Optional longer explanation of what data this location stores. */
+	description: string().optional(),
 	/**
-	* When true, the executor produces a landmark-aligned crop (similarity warp
-	* onto the canonical template) before this step runs, instead of a plain
-	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
-	* their embeddings are only discriminative on an aligned input. The face
-	* detector that produced the parent detail must emit 5 landmarks.
+	* `single` — exactly one instance of this location is allowed system-wide
+	* (e.g. `logs`, `models`). The operator can edit it but not add more.
+	* `multi`  — the operator may register several instances (e.g. a second
+	* `recordings` on a NAS for disk tiering); one is the default at any time.
 	*/
-	faceAlignment: boolean().optional(),
+	cardinality: _enum(["single", "multi"]),
 	/**
-	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
-	* Downloaded into the same modelsDir alongside the model file.
+	* HOW the declaring service reaches the bytes — and therefore WHICH
+	* providers may back a location of this kind. See {@link StorageAccessSchema}
+	* and {@link STORAGE_ACCESS_FALLBACK}.
+	*
+	* Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+	* can only over-restrict (refuse a remote provider for a kind that might
+	* have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+	* permissive direction and is therefore never inferred — a repo guard
+	* (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+	* reached by omission.
 	*/
-	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
+	access: StorageAccessSchema.optional(),
 	/**
-	* LEGACY entry — retained in the catalog so a persisted operator selection
-	* still RESOLVES (and can be re-activated), but hidden from the selectable
-	* model list and excluded from the auto format-default pick. Set on the
-	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
-	* the active lineup stays the coherent curated ladder without deleting a
-	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
-	* an explicit legacy id that has a build for the node's format.
+	* When set, the default instance for this location inherits its resolved
+	* root from the named location's default instance. Useful for derivative
+	* slots (e.g. `recordingsLow` → `recordings`) so operators only need to
+	* configure the primary location.
 	*/
-	legacy: boolean().optional(),
+	defaultsTo: string().optional(),
 	/**
-	* Measured quality/latency metadata — populated from the benchmark addon on
-	* the real node classes. Absent = not yet measured (most entries today; the
-	* catalog historically carried only `sizeMB`, a poor cross-architecture
-	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
+	* Which node root the seeded `<id>:default` instance is placed under on a
+	* FRESH install:
+	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
+	*   the appData volume. Right for small/durable data (logs, models).
+	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
+	*   env is set, else falls back to the data root. Right for bulky, hot media
+	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
+	*
+	* Only affects the seeded default's `basePath`; operators can repoint any
+	* location afterwards, and a `defaultsTo` slot inherits its parent's root
+	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	metrics: object({
-		map50: number().optional(),
-		p95LatencyMs: record(string(), number()).optional()
-	}).optional(),
+	defaultRoot: _enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
+});
+var DecoderStatsSchema = object({
+	inputFps: number(),
+	outputFps: number(),
+	avgDecodeTimeMs: number(),
+	droppedFrames: number(),
 	/**
-	* The model's licence record — see {@link ModelLicenseSchema}. Optional in
-	* the schema (a custom model's author may state none); REQUIRED and complete
-	* on every built-in catalog entry (`scripts/check-catalog-licence.ts`).
+	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
+	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
+	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
+	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
 	*/
-	license: ModelLicenseSchema.optional(),
+	lagMs: number().optional(),
+	effectiveFps: number().optional(),
+	adaptiveFps: number().optional()
+});
+var DecoderSessionConfigSchema = object({
+	codec: string(),
+	maxFps: number().default(0),
+	outputFormat: _enum([
+		"jpeg",
+		"rgb",
+		"bgr",
+		"yuv420",
+		"gray"
+	]).default("jpeg"),
+	scale: number().default(1),
+	width: number().optional(),
+	height: number().optional(),
 	/**
-	* Variant-selector grouping. The UI groups models by `family` + `tier` and
-	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
-	* of a family's sizes and quantizations collapse into one grouped picker
-	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
-	* (legacy / custom models) — never shown in the grouped selector. The flat
-	* `id` stays the source of truth for resolution/download/persistence; grouping
-	* is a presentation overlay resolved back to an `id`.
+	* Identifier of the camera this decoder session serves. Optional
+	* because the cap is generic (any caller could request decode), but
+	* stream-broker passes it so decoder logs include `deviceId` for
+	* per-camera filtering when diagnosing failures (e.g. node-av
+	* sendPacket errors on a single hung camera).
 	*/
-	group: ModelVariantGroupSchema.optional(),
+	deviceId: number().int().nonnegative().optional(),
 	/**
-	* Catalog source for the pipeline stepper's provider-first picker. Absent on
-	* built-in CamStack entries (treated as `camstack`) and on registry rows
-	* persisted before this field existed (`inferModelProvider` fills those).
+	* Free-form tag for log scoping. Stream-broker uses
+	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
+	* on every line so `grep tag=broker:5/high` filters one camera
+	* profile cleanly.
 	*/
-	provider: ModelProviderIdSchema.optional(),
+	tag: string().optional(),
 	/**
-	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
-	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
-	* labels already ARE the CamStack macros (Scrypted identity map).
+	* Where the session delivers decoded frames (Phase 5 / D9):
+	*
+	* - `'callback'` (default) — the legacy pixel path: decoded frames are
+	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
+	* - `'shm'` — the shared-memory frame plane: decoded frames are written
+	*   into an OS shared-memory ring and drained as zero-pixel
+	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
+	*   other — `pullFrames` returns nothing for an `'shm'` session and
+	*   `pullHandles` returns nothing for a `'callback'` session.
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional(),
+	frameSink: _enum(["callback", "shm"]).default("callback"),
 	/**
-	* The model's CLIP feature-space contract (text encoder, dimension, vector
-	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
-	* CLIP image encoder; its absence is what "not a CLIP model" means to the
-	* embedding encoder and the semantic-search store (D649).
+	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
+	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
+	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
+	* stream-broker's `streamingDebug` gate — off by default so production logs
+	* stay quiet and the emit path pays zero per-frame cost when disabled.
 	*/
-	clip: ClipModelMetaSchema.optional()
-});
-var ConvertTargetSchema = discriminatedUnion("format", [object({
-	format: literal("openvino"),
-	precisions: array(_enum(["fp16", "int8"])).min(1).readonly()
-}), object({ format: literal("coreml") })]);
-var ModelConvertMetadataSchema = object({
-	id: string().regex(/^[a-zA-Z0-9._-]+$/),
-	name: string(),
-	labels: array(LabelDefinitionSchema).readonly(),
-	inputSize: object({
-		width: number(),
-		height: number()
-	}),
-	inputLayout: _enum(["nchw", "nhwc"]).optional(),
-	inputNormalization: _enum([
-		"zero-one",
-		"imagenet",
-		"none",
-		"scrfd"
-	]).optional(),
-	preprocessMode: _enum(["letterbox", "resize"]).optional(),
-	outputFormat: _enum([
-		"yolo",
-		"ssd",
-		"embedding",
-		"classification",
-		"ocr",
-		"segmentation"
-	]),
-	faceAlignment: boolean().optional(),
-	classMap: DetectionCatalogClassMapSchema.optional()
-});
-var ConvertResultSchema = object({
-	entry: ModelCatalogEntrySchema,
-	artifacts: array(object({
-		format: _enum(MODEL_FORMATS),
-		precision: _enum(["fp16", "int8"]).optional(),
-		sizeMB: number(),
-		validated: boolean(),
-		files: array(string()).readonly()
-	})).readonly()
+	debug: boolean().optional()
 });
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-function asBoolean$1(value, name, index) {
-	if (typeof value !== "boolean") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a boolean`);
-	return value;
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	},
-	any: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => args.map((a, i) => asBoolean$1(a, "any", i)).some((b) => b)
-	},
-	all: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => args.map((a, i) => asBoolean$1(a, "all", i)).every((b) => b)
-	},
-	within: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args, hooks) => {
-			const windowMs = asFiniteNumber(args[1], "within", 1);
-			if (windowMs < 0) throw new ExpressionEvalError("within: the window must not be negative");
-			const at = args[0];
-			if (at === null) return false;
-			const ts = asFiniteNumber(at, "within", 0);
-			const now = hooks.now;
-			if (now === void 0 || !Number.isFinite(now)) throw new ExpressionEvalError("within: no clock was supplied to this evaluation");
-			const inside = now - ts <= windowMs;
-			if (inside) hooks.noteDeadline?.(ts + windowMs + 1);
-			return inside;
-		}
-	},
-	latest: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const present = args.flatMap((a, i) => a === null ? [] : [asFiniteNumber(a, "latest", i)]);
-			return present.length === 0 ? null : finiteResult(Math.max(...present), "latest");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Resource-bound constants for the safe expression engine.
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
 *
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
-*/
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
 /**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
+* The level a channel writes at once armed.
 *
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
 *
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
 */
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+/**
+* Distinct (device, family, variant) counters one instance will hold.
+*
+* A large fleet x the handful of families any single addon reports, with
+* slack. At ~200 B per counter this is a ~100 KB ceiling on a process that
+* already declares an RSS budget in the gigabytes.
+*/
+var MAX_KEYS = 1024;
+/**
+* Where reasons past {@link MAX_REASONS_PER_KEY} go.
+*
+* They are FOLDED, never dropped: `attempts - succeeded` must always equal the
+* sum of the reason counts, or the ratio stops adding up.
+*/
+var OVERFLOW_REASON = "other";
+/** `deviceId` + `family` + optional `variant`, flattened into the map key. */
+function counterKey(deviceId, family, variant) {
+	return variant === void 0 ? `${deviceId}${family}` : `${deviceId}${family}${variant}`;
 }
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
+/**
+* A bounded set of per-camera, cumulative failure counters.
+*
+* One instance per contributing subsystem. `note` is O(1) and allocation-free
+* on the steady path; `snapshot` reads without mutating anything.
+*/
+var FailureCounters = class {
+	maxKeys;
+	maxReasons;
+	counters = /* @__PURE__ */ new Map();
+	refused = 0;
+	constructor(maxKeys = MAX_KEYS, maxReasons = 16) {
+		this.maxKeys = maxKeys;
+		this.maxReasons = maxReasons;
 	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	/**
+	* Counters refused because {@link MAX_KEYS} was already held.
+	*
+	* Cumulative for the life of the instance: a bound that bit is a fact about
+	* the deployment, and a surface that hid it would under-report a fleet
+	* precisely when the fleet got large enough to matter.
+	*/
+	get keysRefused() {
+		return this.refused;
 	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
+	/** Counters currently held. */
+	get size() {
+		return this.counters.size;
 	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
+	/**
+	* Fold one observation in.
+	*
+	* A non-positive or non-integer `deviceId` is REFUSED rather than bucketed:
+	* see the module docblock — an entry that cannot name its camera is worse
+	* than no entry.
+	*/
+	note(observation, nowMs) {
+		if (!Number.isInteger(observation.deviceId) || observation.deviceId <= 0) return;
+		const key = counterKey(observation.deviceId, observation.family, observation.variant);
+		let counter = this.counters.get(key);
+		if (counter === void 0) {
+			if (this.counters.size >= this.maxKeys) {
+				this.refused += 1;
+				return;
+			}
+			counter = {
+				deviceId: observation.deviceId,
+				family: observation.family,
+				variant: observation.variant,
+				sinceMs: nowMs,
+				attempts: 0,
+				succeeded: 0,
+				reasons: /* @__PURE__ */ new Map()
 			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+			this.counters.set(key, counter);
 		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
+		counter.attempts += 1;
+		if (observation.reason === void 0) {
+			counter.succeeded += 1;
+			return;
 		}
-		return this.parsePrimary();
+		const reason = counter.reasons.has(observation.reason) || counter.reasons.size < this.maxReasons ? observation.reason : OVERFLOW_REASON;
+		counter.reasons.set(reason, (counter.reasons.get(reason) ?? 0) + 1);
 	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
+	/** Read every counter. Never mutates — see the module docblock. */
+	snapshot(nowMs) {
+		const out = [];
+		for (const counter of this.counters.values()) out.push({
+			deviceId: counter.deviceId,
+			family: counter.family,
+			...counter.variant !== void 0 ? { variant: counter.variant } : {},
+			sinceMs: counter.sinceMs,
+			atMs: nowMs,
+			attempts: counter.attempts,
+			succeeded: counter.succeeded,
+			reasons: [...counter.reasons.entries()].map(([reason, count]) => ({
+				reason,
+				count
+			})).toSorted((a, b) => b.count - a.count)
+		});
+		return out;
 	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
+	/** Drop everything (host disposal). */
+	clear() {
+		this.counters.clear();
 	}
 };
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
+var CLIP_STRICTNESS_FACTOR = {
+	loose: 1,
+	balanced: 1.25,
+	strict: 1.5
+};
+/**
+* The cosine floor a search runs with.
+*
+* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
+* and silently rescaling it would make the same URL mean different things on
+* two installs. Everything else is relative to the model.
+*/
+function resolveClipSearchMinScore(meta, request) {
+	if (request.minScore !== void 0) return request.minScore;
+	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
+	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
 }
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
+/**
+* Multi-file format payload.
+*
+* - Directory formats (`isDirectory: true`, e.g. `.mlpackage`): files
+*   relative to the directory root — the downloader fetches each from
+*   `{url}/{file}` into `{modelDir}/{file}`. If omitted, it probes the
+*   HuggingFace API (slower).
+* - Single-file formats (no `isDirectory`, e.g. OpenVINO IR): sibling
+*   files fetched from the SAME remote directory as `url` and stored flat
+*   alongside the main file — e.g. `['camstack-yolov9t.bin']` for the IR
+*   weights next to `camstack-yolov9t.xml`.
+*/
+var ModelFormatEntrySchema = object({
+	url: string(),
+	sizeMB: number(),
+	/** Whether this format is a directory bundle (e.g., .mlpackage) rather than a single file */
+	isDirectory: boolean().optional(),
+	/** Multi-file payload (directory members or sibling files). */
+	files: array(string()).readonly().optional(),
+	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
+	runtimes: array(_enum(["python"])).readonly().optional()
+});
+/**
+* Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
+* The downloader fetches from `url` and saves to `{modelsDir}/{filename}`.
+*/
+var ModelExtraFileSchema = object({
+	url: string(),
+	filename: string(),
+	sizeMB: number()
+});
+/**
+* Per-format payload map. Modelled as an explicit object (one optional key
+* per `ModelFormat`) rather than `z.record(enum, …)` — zod v4's enum-keyed
+* record requires every key, but a catalog entry only ships a subset of
+* formats.
+*/
+var ModelFormatsSchema = object({
+	onnx: ModelFormatEntrySchema.optional(),
+	coreml: ModelFormatEntrySchema.optional(),
+	openvino: ModelFormatEntrySchema.optional(),
+	tflite: ModelFormatEntrySchema.optional(),
+	pt: ModelFormatEntrySchema.optional(),
+	gguf: ModelFormatEntrySchema.optional()
+});
+/**
+* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
+* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
+* grouped Family→Tier→Variant picker renders identically in the config UI and
+* in the pipeline/device steppers. The flat `id` stays the source of truth for
+* resolution/download/persistence; this is a presentation overlay resolved back
+* to an `id`.
+*/
+var ModelVariantGroupSchema = object({
+	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
+	family: string(),
+	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
+	tier: string(),
+	/** Quantization axis. Omit ⇒ the fp32 base build. */
+	precision: _enum(["fp32", "int8"]).optional(),
+	/**
+	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
+	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
+	* future performance variants plug into.
+	*/
+	optimization: _enum(["standard", "fast"]).optional(),
+	/**
+	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
+	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
+	* cheap latency lever — especially on Apple ANE and the Intel N100 — at a
+	* small-object accuracy cost. Mirrors the model's `inputSize` but lifted onto
+	* the group so the selector can offer it as a variant axis.
+	*/
+	resolution: number().int().positive().optional()
+});
+var ModelProviderIdSchema = _enum([
+	"camstack",
+	"frigate",
+	"scrypted",
+	"custom"
+]);
 /**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
+* The licence of a model, as a record rather than a bare SPDX string: a
+* permissive CODE licence routinely sits on top of restrictive WEIGHTS or
+* DATA, and the obligations (attribution, modification notices, source offers)
+* are per upstream. A persisted custom-model row written when this field was a
+* string still parses — the string is lifted into `{ weights }`.
 *
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
+* Every licence surface (the admin "Models and licenses" page,
+* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
+* these records by `scripts/gen-model-licenses.ts` (D661).
 */
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
+var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
+	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
+	weights: string().min(1),
+	/** SPDX id of the upstream code that defines / trained the network. */
+	code: string().min(1).optional(),
+	/** Training data whose terms add obligations (attribution, non-commercial). */
+	data: object({
+		name: string().min(1),
+		terms: string().min(1),
+		url: string().url().optional()
+	}).optional(),
+	/** The project the weights come from. Required on built-in entries (guard). */
+	upstream: object({
+		name: string().min(1),
+		url: string().url()
+	}).optional(),
+	/** Where the licence text governing the weights is published. */
+	url: string().url().optional(),
+	/** Attribution the licence REQUIRES, verbatim. */
+	attribution: string().min(1).optional(),
+	/** What CamStack changed. Required when `hosting` is `camstack-hf` (guard). */
+	modifications: string().min(1).optional(),
+	/** Who serves the file a node downloads. */
+	hosting: _enum([
+		"camstack-hf",
+		"third-party",
+		"built-in"
+	]).optional(),
+	/** True when the weights or their data forbid commercial use. */
+	nonCommercial: boolean().optional()
+}));
+var ModelCatalogEntrySchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	formats: ModelFormatsSchema,
+	inputSize: object({
+		width: number(),
+		height: number()
+	}),
+	/**
+	* Channel count of the model input tensor. Omit ⇒ 3 (RGB), the default for
+	* every detector / classifier / embedder. Set to 1 for a grayscale CTC text
+	* recognizer (EasyOCR VGG plate-OCR: input `[N,1,H,W]`) so the preprocess
+	* feeds a single-channel, EasyOCR-normalized tensor instead of the default
+	* 3-channel RGB one. Threaded through `PoolModelConfig.inputChannels` to the
+	* Python inference pool.
+	*/
+	inputChannels: number().int().positive().optional(),
+	labels: array(LabelDefinitionSchema).readonly(),
+	inputLayout: _enum(["nchw", "nhwc"]).optional(),
+	/**
+	* `'scrfd'` applies InsightFace's SCRFD input contract, `(x - 127.5) / 128`
+	* (upstream `insightface/model_zoo/scrfd.py`), instead of the historical
+	* plain `/255`. Measured against COCO GT: 188 → 196 faces found on the
+	* `scrfd-2.5g` catalog entry (2026-09-26 model-replacement spike, §2.4-2).
+	*/
+	inputNormalization: _enum([
+		"zero-one",
+		"imagenet",
+		"none",
+		"scrfd"
+	]).optional(),
+	/**
+	* The model already applies softmax IN-GRAPH — its raw output is a
+	* probability distribution, not logits. When set, the `softmax`
+	* postprocessor must NOT re-apply softmax: re-softmaxing an already-normalised
+	* probability vector collapses it toward uniform (top-1 score craters far
+	* below its true value, making every confidence gate meaningless). Absent ⇒
+	* the output is raw logits and the postprocessor applies softmax (the normal
+	* case). Set on the Google AIY Birds `bird-classifier` (softmax baked into the
+	* TF graph). Threaded to the Python pool via `PoolModelConfig.outputProbabilities`.
+	*/
+	outputProbabilities: boolean().optional(),
+	preprocessMode: _enum(["letterbox", "resize"]).optional(),
+	/**
+	* Per-MODEL postprocessor override. Absent ⇒ the step's own
+	* `StepDefinition.postprocessor` applies (the normal case — every model in a
+	* step shares its decode). Set it when a step hosts models with DIFFERENT raw
+	* output layouts under one slot: e.g. object-detection is `'yolo'` by default,
+	* but a Coral SSD MobileNet build emits the `TFLite_Detection_PostProcess`
+	* 4-tensor layout and needs `'ssd'`. Threaded into `PoolModelConfig.postprocessor`
+	* by the engine factory (`modelEntry.postprocessor ?? def.postprocessor`).
+	*/
+	postprocessor: custom().optional(),
+	/**
+	* Per-MODEL default confidence floor. Absent ⇒ the step's
+	* `StepDefinition.defaultConfidence` applies. A score is a property of one
+	* model's output scale, not of the step slot it sits in: YuNet's
+	* `sqrt(cls·obj)` is not SCRFD's score, and inheriting SCRFD's 0.5 filled the
+	* face gallery with wheels and hands (D662, amends D645). An operator's
+	* explicit value still wins over it. Resolved in ONE place —
+	* `addon-pipeline/.../registry/effective-confidence.ts`.
+	*/
+	defaultConfidence: number().min(0).max(1).optional(),
+	/**
+	* When true, the executor produces a landmark-aligned crop (similarity warp
+	* onto the canonical template) before this step runs, instead of a plain
+	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
+	* their embeddings are only discriminative on an aligned input. The face
+	* detector that produced the parent detail must emit 5 landmarks.
+	*/
+	faceAlignment: boolean().optional(),
+	/**
+	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
+	* Downloaded into the same modelsDir alongside the model file.
+	*/
+	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
+	/**
+	* LEGACY entry — retained in the catalog so a persisted operator selection
+	* still RESOLVES (and can be re-activated), but hidden from the selectable
+	* model list and excluded from the auto format-default pick. Set on the
+	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
+	* the active lineup stays the coherent curated ladder without deleting a
+	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
+	* an explicit legacy id that has a build for the node's format.
+	*/
+	legacy: boolean().optional(),
+	/**
+	* Measured quality/latency metadata — populated from the benchmark addon on
+	* the real node classes. Absent = not yet measured (most entries today; the
+	* catalog historically carried only `sizeMB`, a poor cross-architecture
+	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
+	*/
+	metrics: object({
+		map50: number().optional(),
+		p95LatencyMs: record(string(), number()).optional()
+	}).optional(),
+	/**
+	* The model's licence record — see {@link ModelLicenseSchema}. Optional in
+	* the schema (a custom model's author may state none); REQUIRED and complete
+	* on every built-in catalog entry (`scripts/check-catalog-licence.ts`).
+	*/
+	license: ModelLicenseSchema.optional(),
+	/**
+	* Variant-selector grouping. The UI groups models by `family` + `tier` and
+	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
+	* of a family's sizes and quantizations collapse into one grouped picker
+	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
+	* (legacy / custom models) — never shown in the grouped selector. The flat
+	* `id` stays the source of truth for resolution/download/persistence; grouping
+	* is a presentation overlay resolved back to an `id`.
+	*/
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Catalog source for the pipeline stepper's provider-first picker. Absent on
+	* built-in CamStack entries (treated as `camstack`) and on registry rows
+	* persisted before this field existed (`inferModelProvider` fills those).
+	*/
+	provider: ModelProviderIdSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
+});
+var ConvertTargetSchema = discriminatedUnion("format", [object({
+	format: literal("openvino"),
+	precisions: array(_enum(["fp16", "int8"])).min(1).readonly()
+}), object({ format: literal("coreml") })]);
+var ModelConvertMetadataSchema = object({
+	id: string().regex(/^[a-zA-Z0-9._-]+$/),
+	name: string(),
+	labels: array(LabelDefinitionSchema).readonly(),
+	inputSize: object({
+		width: number(),
+		height: number()
+	}),
+	inputLayout: _enum(["nchw", "nhwc"]).optional(),
+	inputNormalization: _enum([
+		"zero-one",
+		"imagenet",
+		"none",
+		"scrfd"
+	]).optional(),
+	preprocessMode: _enum(["letterbox", "resize"]).optional(),
+	outputFormat: _enum([
+		"yolo",
+		"ssd",
+		"embedding",
+		"classification",
+		"ocr",
+		"segmentation"
+	]),
+	faceAlignment: boolean().optional(),
+	classMap: DetectionCatalogClassMapSchema.optional()
+});
+var ConvertResultSchema = object({
+	entry: ModelCatalogEntrySchema,
+	artifacts: array(object({
+		format: _enum(MODEL_FORMATS),
+		precision: _enum(["fp16", "int8"]).optional(),
+		sizeMB: number(),
+		validated: boolean(),
+		files: array(string()).readonly()
+	})).readonly()
+});
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -13356,102 +13499,6 @@ var cameraStreamsCapability = {
 function kebabToCamel(s) {
 	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 }
-/** A composed device's stableId is this prefix plus the block id. */
-var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
-/** Longest snippet a `code` source may carry (slice 4). */
-var MAX_COMPOSITION_CODE_LENGTH = 2e4;
-var CompositionSourceRefSchema = object({
-	/** The owning addon; `stableId` is unique only within it. */
-	addonId: string().min(1),
-	stableId: string().min(1)
-});
-/** One field of one capability of one source device. */
-var CompositionFieldReadSchema = object({
-	source: CompositionSourceRefSchema,
-	cap: string().min(1),
-	/** Dotted path into the source cap's runtime-state slice. */
-	fieldPath: string().min(1)
-});
-/** `from`: copy one source field verbatim. It is also an expression's `from` binding. */
-var CompositionFromSourceSchema = CompositionFieldReadSchema.extend({ kind: literal("from") });
-var CompositionBindingSchema = discriminatedUnion("kind", [CompositionFromSourceSchema, object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-})]);
-/**
-* `expression`: a formula over named bindings, in the salvaged expression
-* engine. Validated at parse by the SAME function every other consumer runs,
-* so the editor and the store cannot disagree.
-*/
-var CompositionExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), CompositionBindingSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-/** `code`: RESERVED for slice 4 (own runner, one-way eject). */
-var CompositionCodeSourceSchema = object({
-	kind: literal("code"),
-	code: string().min(1).max(MAX_COMPOSITION_CODE_LENGTH)
-});
-var CompositionFieldSourceSchema = discriminatedUnion("kind", [
-	CompositionFromSourceSchema,
-	CompositionExpressionSourceSchema,
-	CompositionCodeSourceSchema
-]);
-var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
-	kind: literal("forward"),
-	source: CompositionSourceRefSchema,
-	cap: string().min(1),
-	method: string().min(1)
-}), CompositionCodeSourceSchema]);
-var CompositionFeatureSchema = discriminatedUnion("kind", [object({
-	kind: literal("fields"),
-	cap: string().min(1),
-	fields: record(string().min(1), CompositionFieldSourceSchema).refine((fields) => Object.keys(fields).length <= 32, { message: `at most 32 fields per capability` }),
-	/** RESERVED for slice 3; refused by the validator when non-empty. */
-	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
-}), object({
-	kind: literal("passthrough"),
-	cap: string().min(1),
-	source: CompositionSourceRefSchema
-})]);
-var CompositionSchema = object({
-	target: discriminatedUnion("kind", [object({
-		kind: literal("new"),
-		type: _enum(DeviceType),
-		role: _enum(DeviceRole).optional()
-	}), object({
-		kind: literal("existing"),
-		device: CompositionSourceRefSchema
-	})]),
-	features: array(CompositionFeatureSchema).min(1).max(16)
-}).superRefine((composition, ctx) => {
-	const seen = /* @__PURE__ */ new Set();
-	composition.features.forEach((feature, index) => {
-		if (seen.has(feature.cap)) ctx.addIssue({
-			code: "custom",
-			message: `capability \`${feature.cap}\` is composed twice — one feature per capability`,
-			path: [
-				"features",
-				index,
-				"cap"
-			]
-		});
-		seen.add(feature.cap);
-	});
-});
 /** One refusal, named (D391). `path` points into the composition, e.g. `features[0].fields.celsius`. */
 var CompositionProblemSchema = object({
 	code: _enum([
@@ -13471,7 +13518,12 @@ var CompositionProblemSchema = object({
 		"source-field-unknown",
 		"expression-invalid",
 		"cycle",
-		"duplicate-target"
+		"duplicate-target",
+		"not-item-array",
+		"item-field-reserved",
+		"target-missing",
+		"target-unreadable",
+		"not-replaceable"
 	]),
 	path: string(),
 	message: string()
@@ -13482,8 +13534,18 @@ var CompositionFieldKindSchema = _enum([
 	"boolean",
 	"enum"
 ]);
-/** How a field says "unavailable": `null` when its schema allows it, else the device goes offline (D393). */
-var CompositionUnavailableModeSchema = _enum(["null", "offline"]);
+/**
+* How a field says "unavailable" (D393, D663): `null` when its schema allows it;
+* `unknown` — the enum's own word — for an ADDED field that has one; `release`
+* for a REPLACED field of an existing device, whose claim is released so the
+* native provider's reading shows again; else the (composed) device goes offline.
+*/
+var CompositionUnavailableModeSchema = _enum([
+	"null",
+	"offline",
+	"unknown",
+	"release"
+]);
 /**
 * `derived` reads a source · `clock` reads only `now`, recomputed when a sibling
 * field of its cap changes value · `constant` reads nothing, computed once.
@@ -13493,9 +13555,17 @@ var CompositionFieldRoleSchema = _enum([
 	"clock",
 	"constant"
 ]);
+/** The item a planned field belongs to; its `path` is then the dotted path INSIDE the item. */
+var CompositionFieldItemSchema = object({
+	arrayPath: string(),
+	key: string(),
+	label: string()
+});
 var CompositionFieldPlanSchema = object({
 	cap: string(),
+	/** Top-level field, or — when `item` is set — the dotted path inside that item. */
 	path: string(),
+	item: CompositionFieldItemSchema.optional(),
 	/** Index into `composition.features` this field's capability came from —
 	*  lets a source/cycle problem name its path as `features[N].fields.<path>`
 	*  (the same convention `planComposition`'s own problems already use). */
@@ -13508,16 +13578,37 @@ var CompositionFieldPlanSchema = object({
 	source: CompositionFieldSourceSchema,
 	reads: array(CompositionFieldReadSchema)
 });
+/**
+* What a feature does to its target (D663): `new` builds a capability on a new
+* device; on an existing device it `add`s a capability the device lacks, or
+* `replace`s named fields of one it has natively.
+*/
+var CompositionFeatureModeSchema = _enum([
+	"new",
+	"add",
+	"replace"
+]);
+var CompositionFeaturePlanSchema = object({
+	featureIndex: number().int().nonnegative(),
+	cap: string(),
+	mode: CompositionFeatureModeSchema
+});
 var CompositionValidationSchema = object({
 	ok: boolean(),
 	problems: array(CompositionProblemSchema),
-	fields: array(CompositionFieldPlanSchema)
+	fields: array(CompositionFieldPlanSchema),
+	features: array(CompositionFeaturePlanSchema)
 });
-/** Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts` (Task 11). */
+/**
+* Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts`. `degraded`:
+* running, but a replaced field is released to the native provider while its
+* source is unavailable (ruling S1b, D663) — the reason names each such field.
+*/
 var CompositionRunStatusSchema = _enum([
 	"stopped",
 	"starting",
 	"running",
+	"degraded",
 	"failed"
 ]);
 var CompositionFieldStateKindSchema = _enum([
@@ -13528,6 +13619,8 @@ var CompositionFieldStateKindSchema = _enum([
 var CompositionFieldStateSchema = object({
 	cap: string(),
 	path: string(),
+	/** Same as the plan's: two items' `status` are told apart by it. */
+	item: CompositionFieldItemSchema.optional(),
 	state: CompositionFieldStateKindSchema,
 	/** `null` whenever `state === 'unavailable'`; never a plausible stand-in (D393). */
 	value: union([
@@ -13549,11 +13642,14 @@ var CompositionBlockStateSchema = object({
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
 /** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. */
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
 var CoreBlockStatusSchema = _enum([
 	"stopped",
 	"starting",
 	"running",
+	"degraded",
 	"failed"
 ]);
 /** Client-authored fields. */
@@ -13589,9 +13685,16 @@ var CoreBlockSourceSchema = discriminatedUnion("kind", [
 		composition: CompositionSchema
 	})
 ]);
-/** The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7). */
+/**
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
+*
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
+*/
 var CompositionBlockInputSchema = object({
-	name: string().min(1).max(120),
+	name: string().min(1).max(120).optional(),
 	enabled: boolean(),
 	composition: CompositionSchema
 });
@@ -13642,6 +13745,11 @@ var CompositionGetReadSchema = discriminatedUnion("state", [object({
 	state: literal("loaded"),
 	view: CompositionViewSchema.nullable()
 }), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
 /** What a compile attempt produced. */
 var CoreBlockCompileResultSchema = object({
 	ok: boolean(),
@@ -13692,6 +13800,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	auth: "admin",
 	caller: "required"
 }), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
+	addonId: string().min(1),
+	stableId: string().min(1)
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({
 	composition: CompositionSchema,
 	blockId: string().optional()
 }), CompositionValidationSchema, {
@@ -15669,6 +15780,52 @@ method(object({
 	deviceIds: array(number()).readonly(),
 	caps: array(string()).readonly().optional()
 }), record(string(), record(string(), unknown().nullable())));
+/**
+* Per-field ownership (D663). A composition may CLAIM fields of a native
+* cap's runtime-state slice on an existing device: `replace` overlays the
+* claimed fields on the native slice, `add` builds a slice the device does
+* not natively have. Declared here — once — so the hub mirror (Task 5) and
+* the claim methods (Task 6) share one union.
+*/
+var FieldClaimModeSchema = _enum(["replace", "add"]);
+/** What a claim, patch or release answers. A refusal always names its reason. */
+var ClaimOutcomeSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	changed: boolean()
+}), object({
+	ok: literal(false),
+	code: _enum([
+		"owned-by-other",
+		"not-claimed",
+		"field-not-claimed",
+		"invalid-slice",
+		"unknown-device",
+		"row-unreadable",
+		"migration-in-flight"
+	]),
+	message: string()
+})]);
+/** One claim as `listClaims` reports it. `fields` is the PLANNED set, explicit (ruling S5). */
+var FieldClaimSchema = object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	mode: FieldClaimModeSchema,
+	fields: array(string().min(1)).min(1)
+});
+/**
+* What `listClaims` answers. The claims INDEX is a listing projection loaded
+* from the settings store at boot; until a load has succeeded it is
+* `not-loaded`, never `[]` — an unanswered question must not look like an
+* empty answer (D315).
+*/
+var ClaimsListingSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	claims: array(FieldClaimSchema)
+}), object({
+	state: literal("not-loaded"),
+	reason: string()
+})]);
 method(object({ deviceId: number() }), record(string(), record(string(), unknown()))), method(object({
 	deviceId: number(),
 	capName: string()
@@ -15676,7 +15833,35 @@ method(object({ deviceId: number() }), record(string(), record(string(), unknown
 	deviceId: number(),
 	capName: string(),
 	slice: record(string(), unknown())
-}), _void(), { kind: "mutation" }), object({
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	mode: FieldClaimModeSchema,
+	fields: array(string().min(1)).min(1),
+	values: record(string(), unknown())
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	values: record(string(), unknown())
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1)
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ownerPrefix: string().optional() }), ClaimsListingSchema, { auth: "admin" }), method(object({
+	deviceId: number(),
+	capName: string()
+}), record(string(), unknown()).nullable(), { auth: "admin" }), object({
 	deviceId: number(),
 	capName: string(),
 	slice: record(string(), unknown())
@@ -28988,7 +29173,7 @@ var ExtensionSourceSchema = object({
 /**
 * How one picked source stands. `missing` — no such device (deleted, or an id
 * that never existed); `foreign` — a device the slot's owner cannot read from
-* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* (a source owned by another addon); `unavailable` — it exists but is not a
 * valid source now (a container, which is never a pick). A source in any of
 * these states is SHOWN, never silently dropped or re-pointed.
 */
@@ -29028,10 +29213,6 @@ var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
 	slot: ExtensionSlotIdSchema,
 	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
 	authority: string(),
-	/** graft: its switch. association: null — removing every source is "off". */
-	enabled: boolean().nullable(),
-	/** graft: the cap registered on the host. association: null. */
-	projects: string().nullable(),
 	activation: ExtensionSlotActivationSchema.nullable(),
 	value: ExtensionSlotValueSchema,
 	sources: array(ExtensionSlotSourceSchema),
@@ -29065,7 +29246,8 @@ var ExtensionCandidatesSchema = object({ candidates: array(object({
 /**
 * What a write did. `none` — applied in place. `host` / `parent` — the owner
 * reloaded the host (or, for an accessory child, its parent) because the
-* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+* write changed what the host REGISTERS. A slot never adds a capability to its
+* host — that is a composition (D663) — so today's owners answer `none`.
 */
 var ExtensionSetResultSchema = object({
 	applied: literal(true),
@@ -30273,7 +30455,9 @@ var batteryCapability = {
 		DeviceType.Camera,
 		DeviceType.Sensor,
 		DeviceType.Button,
-		DeviceType.Switch
+		DeviceType.Switch,
+		DeviceType.PetFeeder,
+		DeviceType.Container
 	],
 	methods: { 
 	/**
@@ -30300,6 +30484,19 @@ wakeForStream: method(object({
 		awoke: boolean(),
 		durationMs: number()
 	}), { kind: "mutation" }) },
+	/**
+	* A composed provider (battery ADDED to a pet feeder or container that has
+	* no wake surface) answers `wakeForStream` with the same "unavailable"
+	* result the contract already defines above: "Returns `awoke: false` when
+	* … the cap surface is unavailable." (D663).
+	*/
+	composedMethods: { wakeForStream: {
+		kind: "answer",
+		value: {
+			awoke: false,
+			durationMs: 0
+		}
+	} },
 	events: { 
 	/**
 	* Emitted whenever the cached status changes (firmware push OR
@@ -30315,7 +30512,7 @@ onStatusChanged: { data: object({
 		schema: BatteryStatusSchema,
 		kind: "push",
 		empty: {
-			percentage: 0,
+			percentage: null,
 			charging: "unknown",
 			sleeping: false,
 			lastUpdated: 0
@@ -31040,6 +31237,19 @@ var connectivityCapability = {
 * provider populates it by guessing (no HA inference). The UI renders a
 * "No consumables reported" placeholder when `items` is empty.
 */
+/** Units a remaining-life counter is reported in. Closed: the panel renders
+*  each. */
+var ConsumableRemainingUnitSchema = _enum([
+	"days",
+	"hours",
+	"cycles"
+]);
+/** Remaining life as a COUNT, not a percentage (the PetKit desiccant reports
+*  days). `value` null = unknown (D393). */
+var ConsumableRemainingSchema = object({
+	value: number().min(0).nullable(),
+	unit: ConsumableRemainingUnitSchema
+});
 /** A single consumable item. Either a continuous `level` (remaining
 *  life %) or a discrete `status` may be known — both may be null when a
 *  provider only knows the item exists. `level` and `status` are not
@@ -31056,7 +31266,10 @@ var ConsumableItemSchema = object({
 	/** Ms epoch of the last replace, when known. */
 	lastResetAt: number().nullable(),
 	/** Whether `reset()` is meaningful for this item. */
-	resettable: boolean()
+	resettable: boolean(),
+	/** Remaining life as a count (days/hours/cycles), when a provider reports
+	*  it that way instead of — or alongside — `level`. Absent = not reported. */
+	remaining: ConsumableRemainingSchema.optional()
 });
 var ConsumablesStatusSchema = object({
 	items: array(ConsumableItemSchema),
@@ -31086,6 +31299,16 @@ reset: method(object({
 		kind: "mutation",
 		auth: "admin"
 	}) },
+	/**
+	* A composed consumable (item added to a device with no native consumables
+	* provider) refuses `reset` by name: "Only meaningful when the item's
+	* `resettable` is true" — a composed item is never resettable until
+	* commands (`forward`) arrive in slice 3 (D663).
+	*/
+	composedMethods: { reset: {
+		kind: "refuse",
+		reason: "a composed consumable is not resettable until commands (forward) arrive — slice 3"
+	} },
 	status: {
 		schema: ConsumablesStatusSchema,
 		kind: "push",
@@ -40396,6 +40619,10 @@ Object.freeze({
 	latest: {
 		kind: "fixed",
 		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
 	}
 });
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
@@ -40595,38 +40822,31 @@ var DeviceConfig = class DeviceConfig {
 		}));
 	}
 };
-/**
-* Concrete implementation. Routes every successful write through
-* `writer(capName, slice)` — the kernel hooks this up to
-* `device-state.setCapSlice`, the canonical cross-layer write
-* entrypoint, which handles disk persistence (debounced on the hub)
-* and mirror updates.
-*
-* Schema validation runs in-process before the writer is called —
-* the round-trip should never carry an invalid slice. `flush()`
-* awaits any in-flight writer promises so shutdown is lossless.
-*
-* `initial` is the persisted blob loaded at boot. Slices for caps
-* whose schema hasn't been installed yet are kept in-memory verbatim
-* and validated when the cap registers later.
-*/
 var DeviceRuntimeState = class DeviceRuntimeState {
 	writer;
+	onWriteFailed;
 	/** In-flight writer promises tracked so `flush()` can await them. */
 	pendingWrites = /* @__PURE__ */ new Set();
+	/**
+	* Caps whose last write the hub refused. The equality gate in
+	* `applyCapWrite` is bypassed for these, so the SAME value is re-sent on the
+	* next write instead of being swallowed forever; a landing write clears it.
+	*/
+	failedWrites = /* @__PURE__ */ new Set();
 	/** Per-cap committed slice — after schema validation when known. */
 	slices;
 	/** Per-cap registered schema (set by `installCapSchema`). */
 	schemas = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
 	capListeners = /* @__PURE__ */ new Map();
-	constructor(initial, writer) {
+	constructor(initial, writer, onWriteFailed) {
 		this.writer = writer;
+		this.onWriteFailed = onWriteFailed;
 		this.slices = /* @__PURE__ */ new Map();
 		for (const [k, v] of Object.entries(initial)) if (v && typeof v === "object" && !Array.isArray(v)) this.slices.set(k, { ...v });
 	}
-	static fromInitial(initial, writer) {
-		return new DeviceRuntimeState(initial, writer);
+	static fromInitial(initial, writer, onWriteFailed) {
+		return new DeviceRuntimeState(initial, writer, onWriteFailed);
 	}
 	installCapSchema(capName, schema) {
 		const existing = this.schemas.get(capName);
@@ -40670,10 +40890,15 @@ var DeviceRuntimeState = class DeviceRuntimeState {
 			...value
 		} : { ...value };
 		const parsed = schema.parse(next);
-		if (shallowEqual(current, parsed)) return;
+		if (shallowEqual(current, parsed) && !this.failedWrites.has(capName)) return;
 		this.slices.set(capName, parsed);
 		this.fireListeners([capName]);
-		const writePromise = this.writer(capName, { ...parsed }).catch(() => {});
+		const writePromise = this.writer(capName, { ...parsed }).then(() => {
+			this.failedWrites.delete(capName);
+		}).catch((err) => {
+			this.failedWrites.add(capName);
+			this.onWriteFailed?.(capName, err instanceof Error ? err.message : String(err));
+		});
 		this.pendingWrites.add(writePromise);
 		writePromise.finally(() => {
 			this.pendingWrites.delete(writePromise);
@@ -40950,7 +41175,16 @@ var BaseDevice = class {
 			});
 		};
 		const initial = ctx.initialRuntimeState ?? {};
-		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer);
+		const onWriteFailed = (cap, error) => {
+			ctx.logger.warn("runtime-state write refused by the hub — the slice is not mirrored; it is re-sent on the next write", {
+				tags: { deviceId: ctx.id },
+				meta: {
+					cap,
+					error
+				}
+			});
+		};
+		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer, onWriteFailed);
 		ctx.bindRuntimeState?.(this.runtimeState);
 		ctx.registerNativeCap?.(deviceStatusCapability, {});
 		const seed = {
@@ -43896,6 +44130,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.getCustomization": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -45018,6 +45258,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceState.claimFields": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.getAllSnapshots": {
 		capName: "device-state",
 		capScope: "system",
@@ -45030,12 +45276,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceState.getNativeCapSlice": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceState.getSnapshot": {
 		capName: "device-state",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"deviceState.listClaims": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceState.patchOwnedFields": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceState.releaseClaim": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.setCapSlice": {
 		capName: "device-state",
 		capScope: "system",
@@ -50551,16 +50821,36 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceState.claimFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.getCapSlice": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"deviceState.getNativeCapSlice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.getSnapshot": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"deviceState.patchOwnedFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.releaseClaim": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.setCapSlice": [{
 		name: "deviceId",
 		form: "single",
@@ -54858,4 +55148,4 @@ function buildClipModelRegistry(entries) {
 /** The built-in catalog's registry. */
 var BUILTIN_CLIP_MODELS = buildClipModelRegistry(CLIP_IMAGE_MODELS);
 //#endregion
-export { NcRuleSchema as $, EventCategory as $n, isSourceCap as $t, LabelAttributionSchema as A, canonicalHash as An, audioMetricsCapability as At, NC_DEFAULT_SNOOZE_MINUTES as B, normalizeNodeId as Bn, embeddingRefusalOf as Bt, EMBEDDING_REQUIREMENTS_FAILED as C, systemEventFilterApplies as Cn, TimelapseRuleInputSchema as Ct, FIRST_LEVEL_MACRO_CLASSES as D, vectorDimFromBase64 as Dn, addonWidgetsSourceCapability as Dt, EVENT_OWNER_TYPES as E, templateVarsFor as En, TrackSourceSchema as Et, MOTION_CLOSE_AFTER_MS as F, customAction as Fn, deriveRecordingMode as Ft, NC_TAXONOMY as G, discriminatedUnion as Gn, evictionPolicyOfLocation as Gt, NC_SNOOZE_MAX_MINUTES as H, _enum as Hn, embeddingRequirementsUnavailableError as Ht, MediaFileKindEnum as I, defineCustomActions as In, describeSystemEventDeliveryProblem as It, NcAlarmSettingsPatchSchema as J, object as Jn, isDetectionMacroClass as Jt, NC_TEMPLATE_VARS as K, literal as Kn, faceGalleryCapability as Kt, NC_ALARM_SYSTEM_EVENT_KINDS as L, hydrateSchema as Ln, describeSystemEventFamilyProblem as Lt, MAX_ARCHIVED_DEBUG_NOTES as M, CamProfileSchema as Mn, buildEventKindDescriptor as Mt, MAX_BIRTH_DECISION_RECORDS as N, DeviceType as Nn, consumableLowPercentOf as Nt, FULL_IMAGE_BBOX as O, zoneAnalyticsCapability as On, alarmPanelCapability as Ot, MAX_BIRTH_LATENCY_PROXY_MS as P, createEvent as Pn, cosineSimilarity as Pt, NcRulePatchSchema as Q, unknown as Qn, isScheduleActive as Qt, NC_CONDITION_CATALOG as R, isDeviceScopedCap as Rn, embeddingEncoderCapability as Rt, EMBEDDING_MODEL_FAILED as S, systemEventFamilyProblems as Sn, TIMELAPSE_DENSE_FLOOR_SEC as St, EVENT_KIND_BY_CAP as T, templateCarriesSummary as Tn, TimelapseRuleSchema as Tt, NC_SYSTEM_EVENT_KIND_GROUP_SPECS as U, array as Un, encodeVectorBase64 as Ut, NC_SENSOR_TRANSITION_KINDS as V, sleep as Vn, embeddingRequirementsFailedError as Vt, NC_TANK_SYSTEM_EVENT_KINDS as W, boolean as Wn, evaluateSensorEdge as Wt, NcConditionsSchema as X, record as Xn, isKnownTemplateVar as Xt, NcConditionDescriptorSchema as Y, partialRecord as Yn, isEventOwnerType as Yt, NcRuleInputSchema as Z, string as Zn, isMediaOwnerType as Zt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as _, sensorRaisedOf as _n, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as _t, CLIP_EMBEDDING_STEP_ID as a, notificationRulesCapability as an, NcSnoozeSuppressedSchema as at, DETECTION_PIPELINE_CAP_NAME as b, subKindsOf as bn, SCENE_DIVERGED as bt, resolveClusterModelPin as c, pipelineAnalyticsCapability as cn, NcTemplatePreviewInputSchema as ct, ArchivedDebugNoteSchema as d, readTimelapseGeneratedAt as dn, OpsLogEntrySchema as dt, isSystemDelivery as en, NcRuleTargetSchema as et, BaseDevice as f, resolveClipSearchMinScore as fn, PoolMemoryWatchdog as ft, DEFAULT_EVENT_COLOR as g, sceneMonitorCapability as gn, RetrainStatusSchema as gt, CoverStateSchema as h, ruleBelongsToAlarm as hn, RebuildObjectEmbeddingsRefusalSchema as ht, CLIP_TEXT_MODELS as i, mayWriteToLocation as in, NcSnoozeSchema as it, LockStateSchema as j, BaseAddon as jn, audioModeOf as jt, FailureCounters as k, errMsg as kn, assertTimelapseCadences as kt, AUDIO_MACRO_LABELS as l, plateGalleryCapability as ln, NcTemplatePreviewSchema as lt, COCO_TO_MACRO as m, resolvePoolMemoryPolicy as mn, RECORDING_SOURCE_CAMSTACK_ADDON as mt, DEFAULT_CLIP_MODEL as n, isVectorIndexDimConflict as nn, NcScheduleSchema as nt, FACE_EMBEDDING_STEP_ID as o, occupancyScope as on, NcSystemEventKindSchema as ot, BirthDecisionRecordSchema as p, resolveLocationMode as pn, RECORDING_EXPORT_MAX_READ_BYTES as pt, NcAlarmConfigSchema as q, number as qn, failureContributionCapability as qt, CLIP_IMAGE_MODELS as r, kebabToCamel as rn, NcSnoozeInputSchema as rt, readClusterModelPinStrict as s, parseProcStatus as sn, NcTaxonomySchema as st, BUILTIN_CLIP_MODELS as t, isSystemEventSummaryRule as tn, NcRuleUpdateInputSchema as tt, AlarmArmModeSchema as u, readDeviceStateFrom as un, NcTemplateVarDescriptorSchema as ut, DEFAULT_TIMELAPSE_PREVIEW_TEXT as v, servedTemplateVars as vn, SCENE_DEFAULT_ANCHOR_THRESHOLD as vt, EMBEDDING_REQUIREMENTS_UNAVAILABLE as w, systemEventSummaryScheduleOf as wn, TimelapseRulePatchSchema as wt, DeclaredDevices as x, systemEventDeliveryProblems as xn, SceneMonitorSchema as xt, DETECTION_MACRO_CLASSES as y, storageOccupancyCapability as yn, SCENE_DEFAULT_UNCOVERED_POLICY as yt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as z, nodePin as zn, embeddingModelFailedError as zt };
+export { NcRuleSchema as $, EventCategory as $n, isSourceCap as $t, LabelAttributionSchema as A, DeviceType as An, audioMetricsCapability as At, NC_DEFAULT_SNOOZE_MINUTES as B, normalizeNodeId as Bn, embeddingRefusalOf as Bt, EMBEDDING_REQUIREMENTS_FAILED as C, systemEventFilterApplies as Cn, TimelapseRuleInputSchema as Ct, FIRST_LEVEL_MACRO_CLASSES as D, vectorDimFromBase64 as Dn, addonWidgetsSourceCapability as Dt, EVENT_OWNER_TYPES as E, templateVarsFor as En, TrackSourceSchema as Et, MOTION_CLOSE_AFTER_MS as F, customAction as Fn, deriveRecordingMode as Ft, NC_TAXONOMY as G, discriminatedUnion as Gn, evictionPolicyOfLocation as Gt, NC_SNOOZE_MAX_MINUTES as H, _enum as Hn, embeddingRequirementsUnavailableError as Ht, MediaFileKindEnum as I, defineCustomActions as In, describeSystemEventDeliveryProblem as It, NcAlarmSettingsPatchSchema as J, object as Jn, isDetectionMacroClass as Jt, NC_TEMPLATE_VARS as K, literal as Kn, faceGalleryCapability as Kt, NC_ALARM_SYSTEM_EVENT_KINDS as L, hydrateSchema as Ln, describeSystemEventFamilyProblem as Lt, MAX_ARCHIVED_DEBUG_NOTES as M, BaseAddon as Mn, buildEventKindDescriptor as Mt, MAX_BIRTH_DECISION_RECORDS as N, CamProfileSchema as Nn, consumableLowPercentOf as Nt, FULL_IMAGE_BBOX as O, zoneAnalyticsCapability as On, alarmPanelCapability as Ot, MAX_BIRTH_LATENCY_PROXY_MS as P, createEvent as Pn, cosineSimilarity as Pt, NcRulePatchSchema as Q, unknown as Qn, isScheduleActive as Qt, NC_CONDITION_CATALOG as R, isDeviceScopedCap as Rn, embeddingEncoderCapability as Rt, EMBEDDING_MODEL_FAILED as S, systemEventFamilyProblems as Sn, TIMELAPSE_DENSE_FLOOR_SEC as St, EVENT_KIND_BY_CAP as T, templateCarriesSummary as Tn, TimelapseRuleSchema as Tt, NC_SYSTEM_EVENT_KIND_GROUP_SPECS as U, array as Un, encodeVectorBase64 as Ut, NC_SENSOR_TRANSITION_KINDS as V, sleep as Vn, embeddingRequirementsFailedError as Vt, NC_TANK_SYSTEM_EVENT_KINDS as W, boolean as Wn, evaluateSensorEdge as Wt, NcConditionsSchema as X, record as Xn, isKnownTemplateVar as Xt, NcConditionDescriptorSchema as Y, partialRecord as Yn, isEventOwnerType as Yt, NcRuleInputSchema as Z, string as Zn, isMediaOwnerType as Zt, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as _, sensorRaisedOf as _n, SCENE_CONFIRM_DEFAULT_TIMEOUT_MS as _t, CLIP_EMBEDDING_STEP_ID as a, notificationRulesCapability as an, NcSnoozeSuppressedSchema as at, DETECTION_PIPELINE_CAP_NAME as b, subKindsOf as bn, SCENE_DIVERGED as bt, resolveClusterModelPin as c, pipelineAnalyticsCapability as cn, NcTemplatePreviewInputSchema as ct, ArchivedDebugNoteSchema as d, readTimelapseGeneratedAt as dn, OpsLogEntrySchema as dt, isSystemDelivery as en, NcRuleTargetSchema as et, BaseDevice as f, resolveClipSearchMinScore as fn, PoolMemoryWatchdog as ft, DEFAULT_EVENT_COLOR as g, sceneMonitorCapability as gn, RetrainStatusSchema as gt, CoverStateSchema as h, ruleBelongsToAlarm as hn, RebuildObjectEmbeddingsRefusalSchema as ht, CLIP_TEXT_MODELS as i, mayWriteToLocation as in, NcSnoozeSchema as it, LockStateSchema as j, errMsg as jn, audioModeOf as jt, FailureCounters as k, canonicalHash as kn, assertTimelapseCadences as kt, AUDIO_MACRO_LABELS as l, plateGalleryCapability as ln, NcTemplatePreviewSchema as lt, COCO_TO_MACRO as m, resolvePoolMemoryPolicy as mn, RECORDING_SOURCE_CAMSTACK_ADDON as mt, DEFAULT_CLIP_MODEL as n, isVectorIndexDimConflict as nn, NcScheduleSchema as nt, FACE_EMBEDDING_STEP_ID as o, occupancyScope as on, NcSystemEventKindSchema as ot, BirthDecisionRecordSchema as p, resolveLocationMode as pn, RECORDING_EXPORT_MAX_READ_BYTES as pt, NcAlarmConfigSchema as q, number as qn, failureContributionCapability as qt, CLIP_IMAGE_MODELS as r, kebabToCamel as rn, NcSnoozeInputSchema as rt, readClusterModelPinStrict as s, parseProcStatus as sn, NcTaxonomySchema as st, BUILTIN_CLIP_MODELS as t, isSystemEventSummaryRule as tn, NcRuleUpdateInputSchema as tt, AlarmArmModeSchema as u, readDeviceStateFrom as un, NcTemplateVarDescriptorSchema as ut, DEFAULT_TIMELAPSE_PREVIEW_TEXT as v, servedTemplateVars as vn, SCENE_DEFAULT_ANCHOR_THRESHOLD as vt, EMBEDDING_REQUIREMENTS_UNAVAILABLE as w, systemEventSummaryScheduleOf as wn, TimelapseRulePatchSchema as wt, DeclaredDevices as x, systemEventDeliveryProblems as xn, SceneMonitorSchema as xt, DETECTION_MACRO_CLASSES as y, storageOccupancyCapability as yn, SCENE_DEFAULT_UNCOVERED_POLICY as yt, NC_CONSUMABLE_SYSTEM_EVENT_KINDS as z, nodePin as zn, embeddingModelFailedError as zt };