@camstack/addon-post-analysis 1.2.309 → 1.2.311

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-B3M4ZI17.js");
+const require_clip_model_registry = require("../clip-model-registry-X457TLXn.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -1396,11 +1396,85 @@ var NcAlarmExclusions = class {
 	}
 };
 //#endregion
+//#region src/notification-center/alarm/alarm-mode-delays.ts
+/**
+* The persisted per-mode delay overrides, read through a guard (D697).
+*
+* The panel's config schema keeps `mode` a plain string so a blob written by a later release
+* with a mode this one does not know cannot fail the whole config. This is where that string is
+* narrowed: an entry that cannot be trusted is dropped and REPORTED, never repaired. An entry of an unknown
+* mode is also handed back raw (`foreign`) so a write can keep it.
+*/
+function inBounds(value, max) {
+	return Number.isInteger(value) && value >= 0 && value <= max;
+}
+/** Read the persisted overrides through a guard, never a cast (like `nonBlockingFromPersisted`). */
+function modeDelaysFromPersisted(raw) {
+	const seen = /* @__PURE__ */ new Set();
+	const entries = [];
+	const dropped = [];
+	const foreign = [];
+	for (const item of raw) {
+		const mode = require_clip_model_registry.AlarmArmModeSchema.safeParse(item.mode);
+		if (!mode.success) {
+			dropped.push({
+				mode: item.mode,
+				why: "unknown-mode"
+			});
+			foreign.push(item);
+			continue;
+		}
+		if (seen.has(mode.data)) {
+			dropped.push({
+				mode: item.mode,
+				why: "duplicate-mode"
+			});
+			continue;
+		}
+		seen.add(mode.data);
+		const kept = { mode: mode.data };
+		const fields = [
+			{
+				field: "exitDelaySec",
+				max: require_clip_model_registry.NC_ALARM_DELAY_MAX_SEC
+			},
+			{
+				field: "entryDelaySec",
+				max: require_clip_model_registry.NC_ALARM_DELAY_MAX_SEC
+			},
+			{
+				field: "triggeredDurationSec",
+				max: require_clip_model_registry.NC_ALARM_TRIGGERED_MAX_SEC
+			}
+		];
+		for (const { field, max } of fields) {
+			const value = item[field];
+			if (value === void 0) continue;
+			if (!inBounds(value, max)) {
+				dropped.push({
+					mode: item.mode,
+					why: "out-of-bounds",
+					field
+				});
+				continue;
+			}
+			kept[field] = value;
+		}
+		if (kept.exitDelaySec !== void 0 || kept.entryDelaySec !== void 0 || kept.triggeredDurationSec !== void 0) entries.push(kept);
+	}
+	return {
+		entries,
+		dropped,
+		foreign
+	};
+}
+//#endregion
 //#region src/notification-center/alarm/alarm-state-machine.ts
 /**
-* Defaults an operator can change per panel. `home` has no exit delay on
-* purpose — nobody is leaving — but the shared value is applied to every mode
-* until per-mode delays are asked for.
+* The GLOBAL defaults an operator can change per panel — what a mode inherits
+* when it overrides nothing. A mode can override each of the three since D697
+* (`resolveModeDelays`): `home` has no exit delay on purpose — nobody is
+* leaving — and says so with its own entry, not by this shared value.
 *
 * `triggeredDurationSec: 0` = "sound until somebody disarms it". That is what
 * the panel did before the field existed, so an install that never opens the
@@ -1815,6 +1889,19 @@ var ncAlarmPanelSchema = require_clip_model_registry.object({
 	nonBlocking: require_clip_model_registry.array(require_clip_model_registry.object({
 		mode: require_clip_model_registry.string(),
 		deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int())
+	})).default([]),
+	/**
+	* Per arm mode, the delays that override the global ones (D697). Loose on purpose — `mode` is
+	* a string and the numbers are unbounded here — and read back through
+	* {@link modeDelaysFromPersisted}, never a cast: an entry this release cannot trust is dropped
+	* and logged at boot, never the whole config. A blob written before D697 has no key and
+	* parses to no overrides.
+	*/
+	modeDelays: require_clip_model_registry.array(require_clip_model_registry.object({
+		mode: require_clip_model_registry.string(),
+		exitDelaySec: require_clip_model_registry.number().optional(),
+		entryDelaySec: require_clip_model_registry.number().optional(),
+		triggeredDurationSec: require_clip_model_registry.number().optional()
 	})).default([])
 });
 /**
@@ -1885,7 +1972,6 @@ function machineFromPersisted(raw) {
 var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	features = [];
 	machine = DISARMED;
-	delays = DEFAULT_DELAYS;
 	ticker = null;
 	onPublish = null;
 	/**
@@ -1916,7 +2002,7 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	refusalSeq = 0;
 	constructor(ctx) {
 		super(ctx, ncAlarmPanelSchema, { type: require_clip_model_registry.DeviceType.AlarmPanel });
-		this.delays = this.readDelays();
+		this.logDroppedModeDelays();
 		this.restore();
 		this.registerAlarmCap();
 		this.publish();
@@ -1928,30 +2014,148 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			...this.readDelays(),
 			announceArm: this.config.get("announceArm"),
 			announceTargets: [...this.config.get("announceTargets")],
-			nonBlocking: nonBlockingFromPersisted(this.config.get("nonBlocking"))
+			nonBlocking: nonBlockingFromPersisted(this.config.get("nonBlocking")),
+			modeDelays: modeDelaysFromPersisted(this.config.get("modeDelays")).entries
 		};
 	}
 	/**
 	* Apply an editor's patch and return what the panel settled on.
 	*
 	* The new delays take effect on the NEXT transition, never retroactively: a
-	* machine already counting down keeps the instants it was given. Re-deriving
-	* `armedAt` from a delay the operator changed mid-exit would move the arm
-	* instant under somebody who is walking out of the door.
+	* machine already counting down keeps the instants it was given (the exit
+	* delay is read at arm, the entry delay and siren duration at trigger, and
+	* the machine stores the instants, not the durations). Re-deriving `armedAt`
+	* from a delay the operator changed mid-exit would move the arm instant under
+	* somebody who is walking out of the door.
+	*
+	* Two phases, so a refused patch writes NOTHING:
+	*  1. every refusal is checked first (a mode this panel does not offer, an
+	*     add to a full non-blocking list) — it logs why and throws;
+	*  2. every LIST write is CALLED before the first `await`. `DeviceConfig.set`
+	*     replaces its in-memory value synchronously, so a list computed after an
+	*     await could be based on a list another call has since replaced — and a
+	*     whole-list write (the deleted-device prune sends one, computed
+	*     synchronously before calling: `device-prune-runner.ts` `applyAlarm`)
+	*     would erase the membership edit that landed in between.
 	*/
 	async applySettings(patch) {
+		const edits = patch.modeDelays ?? [];
+		const membership = patch.nonBlockingEdit;
+		for (const edit of edits) this.refuseUnofferedMode(edit.mode);
+		if (membership !== void 0) {
+			this.refuseUnofferedMode(membership.mode, membership.deviceId);
+			const verdict = require_clip_model_registry.applyNonBlockingEdit(patch.nonBlocking !== void 0 ? patch.nonBlocking : nonBlockingFromPersisted(this.config.get("nonBlocking")), membership);
+			if (verdict.kind === "refused") {
+				this.ctx.logger.info("alarm settings refused", {
+					tags: { deviceId: membership.deviceId },
+					meta: {
+						panelId: this.id,
+						reason: "list-full",
+						mode: verdict.mode
+					}
+				});
+				throw new Error(`the ${verdict.mode} non-blocking list already holds ${verdict.max} devices — remove one first`);
+			}
+		}
+		const listWrites = [];
+		if (patch.nonBlocking !== void 0) listWrites.push(this.config.set("nonBlocking", patch.nonBlocking.map((l) => ({
+			mode: l.mode,
+			deviceIds: [...l.deviceIds]
+		}))));
+		let membershipChanged = null;
+		if (membership !== void 0) {
+			const result = require_clip_model_registry.applyNonBlockingEdit(nonBlockingFromPersisted(this.config.get("nonBlocking")), membership);
+			if (result.kind === "applied") {
+				membershipChanged = result.changed;
+				if (result.changed) listWrites.push(this.config.set("nonBlocking", result.lists.map((l) => ({
+					mode: l.mode,
+					deviceIds: [...l.deviceIds]
+				}))));
+			}
+		}
+		const persistedDelays = modeDelaysFromPersisted(this.config.get("modeDelays"));
+		const beforeDelays = persistedDelays.entries;
+		const afterDelays = edits.length > 0 ? require_clip_model_registry.applyModeDelaysEdits(beforeDelays, edits) : beforeDelays;
+		if (edits.length > 0) {
+			for (const drop of persistedDelays.dropped) {
+				if (drop.why === "unknown-mode") continue;
+				this.ctx.logger.info("alarm per-mode delay discarded on write", {
+					tags: { deviceId: this.id },
+					meta: {
+						mode: drop.mode,
+						why: drop.why,
+						field: drop.field
+					}
+				});
+			}
+			listWrites.push(this.config.set("modeDelays", [...afterDelays, ...persistedDelays.foreign]));
+		}
+		await Promise.all(listWrites);
+		this.logModeDelayChanges(beforeDelays, afterDelays, edits);
 		if (patch.exitDelaySec !== void 0) await this.config.set("exitDelaySec", patch.exitDelaySec);
 		if (patch.entryDelaySec !== void 0) await this.config.set("entryDelaySec", patch.entryDelaySec);
 		if (patch.triggeredDurationSec !== void 0) await this.config.set("triggeredDurationSec", patch.triggeredDurationSec);
 		if (patch.announceArm !== void 0) await this.config.set("announceArm", patch.announceArm);
 		if (patch.announceTargets !== void 0) await this.config.set("announceTargets", [...patch.announceTargets]);
-		if (patch.nonBlocking !== void 0) await this.config.set("nonBlocking", patch.nonBlocking.map((l) => ({
-			mode: l.mode,
-			deviceIds: [...l.deviceIds]
-		})));
-		this.delays = this.readDelays();
+		if (membership !== void 0 && membershipChanged !== null) this.ctx.logger.info("alarm non-blocking list changed", {
+			tags: { deviceId: membership.deviceId },
+			meta: {
+				panelId: this.id,
+				mode: membership.mode,
+				nonBlocking: membership.nonBlocking,
+				changed: membershipChanged
+			}
+		});
 		return this.settings();
 	}
+	/**
+	* Refuse a mode this panel does not offer — logged by reason, then thrown. A membership edit
+	* passes its SENSOR as `deviceId` (the tag); a per-mode delay edit defaults to the panel.
+	*/
+	refuseUnofferedMode(mode, deviceId = this.id) {
+		if (NC_ALARM_MODES.includes(mode)) return;
+		this.ctx.logger.info("alarm settings refused", {
+			tags: { deviceId },
+			meta: {
+				panelId: this.id,
+				reason: "mode-not-offered",
+				mode
+			}
+		});
+		throw new Error(`alarm mode '${mode}' is not offered by this panel`);
+	}
+	/** One INFO line per mode-delay field an edit really changed (`null` = inherit). */
+	logModeDelayChanges(before, after, edits) {
+		for (const edit of edits) {
+			const was = before.find((e) => e.mode === edit.mode);
+			const now = after.find((e) => e.mode === edit.mode);
+			for (const field of require_clip_model_registry.NC_ALARM_DELAY_FIELDS) {
+				const from = was?.[field] ?? null;
+				const to = now?.[field] ?? null;
+				if (from === to) continue;
+				this.ctx.logger.info("alarm mode delays changed", {
+					tags: { deviceId: this.id },
+					meta: {
+						mode: edit.mode,
+						field,
+						from,
+						to
+					}
+				});
+			}
+		}
+	}
+	/** One INFO line per persisted per-mode delay entry the guard refused to trust. */
+	logDroppedModeDelays() {
+		for (const drop of modeDelaysFromPersisted(this.config.get("modeDelays")).dropped) this.ctx.logger.info("alarm per-mode delay dropped at boot", {
+			tags: { deviceId: this.id },
+			meta: {
+				mode: drop.mode,
+				why: drop.why,
+				field: drop.field
+			}
+		});
+	}
 	/** Wire the state mirror and the transition notifications. See
 	*  {@link NcAlarmPublishHook}. */
 	setPublishHook(hook) {
@@ -2234,7 +2438,17 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			else this.exclusions.clear();
 			this.persist();
 		}
-		this.machine = arm(mode, this.delays, now);
+		const resolved = this.delaysFor(mode);
+		this.machine = arm(mode, resolved, now);
+		this.ctx.logger.info("alarm delays applied", {
+			tags: { deviceId: this.id },
+			meta: {
+				mode,
+				phase: "arm",
+				exitDelaySec: resolved.exitDelaySec,
+				source: resolved.source.exitDelaySec
+			}
+		});
 		this.attribution.clear();
 		this.publish(now);
 		for (const { device, why } of exclusions ?? []) this.ctx.logger.info("alarm armed with an open device excluded", {
@@ -2334,7 +2548,9 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 					this.announceIgnoredTrigger(source, now);
 					return;
 				}
-				const next = trigger(this.machine, this.delays, now);
+				const armed = armModeOf(this.machine.target, NC_ALARM_MODES);
+				const resolved = this.delaysFor(armed);
+				const next = trigger(this.machine, resolved, now);
 				if (next === this.machine) {
 					const state = stateAt(this.machine, now);
 					this.ctx.logger.info(ignoredTriggerMessage(state), {
@@ -2352,6 +2568,19 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 					}
 				});
 				this.machine = next;
+				this.ctx.logger.info("alarm delays applied", {
+					tags: { deviceId: this.id },
+					meta: {
+						mode: armed,
+						phase: "trigger",
+						entryDelaySec: resolved.entryDelaySec,
+						triggeredDurationSec: resolved.triggeredDurationSec,
+						source: {
+							entry: resolved.source.entryDelaySec,
+							siren: resolved.source.triggeredDurationSec
+						}
+					}
+				});
 				this.publish(now);
 			}
 		});
@@ -2487,7 +2716,32 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			});
 		}
 	}
-	/** The three durations, read from the persisted config. */
+	/** The global durations plus the per-mode overrides, read from the persisted config NOW. */
+	delaySettings() {
+		return {
+			...this.readDelays(),
+			modeDelays: modeDelaysFromPersisted(this.config.get("modeDelays")).entries
+		};
+	}
+	/**
+	* What `mode` runs on, read at the transition that uses it — never cached. `null` (no armed
+	* mode to look at) is the global values, every field `default`.
+	*/
+	delaysFor(mode) {
+		const settings = this.delaySettings();
+		if (mode === null) return {
+			exitDelaySec: settings.exitDelaySec,
+			entryDelaySec: settings.entryDelaySec,
+			triggeredDurationSec: settings.triggeredDurationSec,
+			source: {
+				exitDelaySec: "default",
+				entryDelaySec: "default",
+				triggeredDurationSec: "default"
+			}
+		};
+		return require_clip_model_registry.resolveModeDelays(settings, mode);
+	}
+	/** The three global durations, read from the persisted config. */
 	readDelays() {
 		return {
 			exitDelaySec: this.config.get("exitDelaySec"),
@@ -8353,6 +8607,79 @@ function sameWord(a, b) {
 	return a !== void 0 && a.trim().toLowerCase() === b.trim().toLowerCase();
 }
 //#endregion
+//#region src/notification-center/alarm/alarm-sensors.ts
+/**
+* One id's state as the table shows it — spec §3.4's hub table, nothing else.
+*
+* Built ON `classifyCoveredOpening`, the arm check's classifier: what is
+* unknown, open or skipped is decided there, and this only splits a skip into
+* `closed` / `not-opening` for the table. A later change to the classifier
+* therefore moves the table with the arm.
+*/
+function alarmSensorStateOf(deviceId, opening, online) {
+	const verdict = classifyCoveredOpening(opening);
+	switch (verdict.kind) {
+		case "unknown": return {
+			deviceId,
+			reading: "unknown",
+			state: null,
+			unknownWhy: verdict.why,
+			online
+		};
+		case "open": return {
+			deviceId,
+			reading: "open",
+			state: verdict.state,
+			unknownWhy: null,
+			online
+		};
+		case "skip": return opening?.kind === "reading" ? {
+			deviceId,
+			reading: "closed",
+			state: opening.state,
+			unknownWhy: null,
+			online
+		} : {
+			deviceId,
+			reading: "not-opening",
+			state: null,
+			unknownWhy: null,
+			online
+		};
+	}
+}
+/** The asked ids, de-duplicated and ascending. */
+function alarmSensorReadIds(ids) {
+	return [...new Set(ids)].toSorted((a, b) => a - b);
+}
+/**
+* The sensors read's health, logged on CHANGE only (the call is polled every
+* 5-15 s by every open tab). "Wholesale failure" = ids were asked and not one
+* was answered (the device manager is unreachable): WARN once when it starts,
+* ONE INFO when answers return. A partial answer is not a health change — those
+* ids already leave their own debug line and show as `unknown`.
+*/
+var NcAlarmSensorsReadLog = class {
+	failing = false;
+	next(asked, answered) {
+		const wholesale = asked > 0 && answered === 0;
+		if (wholesale === this.failing) return null;
+		this.failing = wholesale;
+		return wholesale ? {
+			level: "warn",
+			message: "alarm sensors read: no asked device answered — every row is unknown",
+			meta: { asked }
+		} : {
+			level: "info",
+			message: "alarm sensors read: devices answer again",
+			meta: {
+				asked,
+				answered
+			}
+		};
+	}
+};
+//#endregion
 //#region src/notification-center/alarm/alarm-live.ts
 /** Every covered id across all modes, ascending, once — what the one read asks for. */
 function alarmLiveReadIds(covered) {
@@ -17027,7 +17354,8 @@ var ncActions = require_clip_model_registry.defineCustomActions({
 	* `getStatus`; this one opens up once it filters to the caller's grants.
 	* The config pair is the admin's, as `getAlarmConfig` / `setAlarmConfig` are
 	* on the cap: it carries the delays, the recipients and the non-blocking
-	* lists.
+	* lists. `getAlarmSensors` is the admin's too: it names which of the asked
+	* devices are open.
 	*/
 	"nc.getAlarmStatus": require_clip_model_registry.customAction(require_clip_model_registry.object({}), NcAlarmStatusSchema, {
 		auth: "admin",
@@ -17068,6 +17396,10 @@ var ncActions = require_clip_model_registry.defineCustomActions({
 		auth: "admin",
 		caller: "required"
 	}),
+	"nc.getAlarmSensors": require_clip_model_registry.customAction(require_clip_model_registry.NcAlarmSensorsInputSchema, require_clip_model_registry.NcAlarmSensorsSchema, {
+		auth: "admin",
+		caller: "required"
+	}),
 	"nc.setAlarmConfig": require_clip_model_registry.customAction(require_clip_model_registry.object({ patch: require_clip_model_registry.NcAlarmSettingsPatchSchema }), require_clip_model_registry.NcAlarmConfigSchema, {
 		kind: "mutation",
 		auth: "admin",
@@ -17860,6 +18192,10 @@ function makeNcActionHandlers(deps) {
 			requireAdmin(caller);
 			return requireAlarm("nc.getAlarmConfig").getConfig();
 		},
+		"nc.getAlarmSensors": async (input, caller) => {
+			requireAdmin(caller);
+			return requireAlarm("nc.getAlarmSensors").getSensors(input);
+		},
 		"nc.setAlarmConfig": async (input, caller) => {
 			requireAdmin(caller);
 			return requireAlarm("nc.setAlarmConfig").setConfig(input.patch);
@@ -32694,7 +33030,8 @@ function consumablesSliceOf(event) {
 var NC_ALARM_SETTINGS_FALLBACK = {
 	...DEFAULT_DELAYS,
 	announceTargets: [],
-	nonBlocking: []
+	nonBlocking: [],
+	modeDelays: []
 };
 /**
 * How often the "matched NO rule" report may fire per device. Long enough that
@@ -33076,6 +33413,7 @@ var NotificationCenter = class NotificationCenter {
 	alarmPanel = null;
 	/** The live view's read, logged on change only — see `alarm-live-read-log.ts`. */
 	alarmLiveReadLog = new NcAlarmLiveReadLog();
+	alarmSensorsReadLog = new NcAlarmSensorsReadLog();
 	/**
 	* The words the panel answers the `deviceState` gate with — its state, plus
 	* the armed mode a `pending`/`triggered` belongs to (D630). Refreshed on
@@ -35394,6 +35732,7 @@ var NotificationCenter = class NotificationCenter {
 				return { success: true };
 			},
 			getAlarmConfig: async () => this.alarmConfig(),
+			getAlarmSensors: async (input) => this.alarmSensors(input),
 			setAlarmConfig: async ({ patch }) => this.setAlarmConfig(patch)
 		};
 	}
@@ -35621,6 +35960,7 @@ var NotificationCenter = class NotificationCenter {
 				});
 			},
 			getConfig: () => this.alarmConfig(),
+			getSensors: (input) => this.alarmSensors(input),
 			setConfig: (patch) => this.setAlarmConfig(patch)
 		};
 	}
@@ -35634,7 +35974,8 @@ var NotificationCenter = class NotificationCenter {
 				exitDelaySec: settings.exitDelaySec,
 				entryDelaySec: settings.entryDelaySec,
 				triggeredDurationSec: settings.triggeredDurationSec,
-				announceTargets: settings.announceTargets.length
+				announceTargets: settings.announceTargets.length,
+				modeDelays: settings.modeDelays.length
 			}
 		});
 		return this.alarmConfig();
@@ -35690,6 +36031,40 @@ var NotificationCenter = class NotificationCenter {
 			name: this.deviceNameFromDirectory()
 		});
 	}
+	/**
+	* The opening states of the asked ids, for the alarm editors' sensor table.
+	*
+	* A separate read from `getAlarmConfig` on purpose: that one is polled every
+	* 2–15 s and the household set needs a whole-fleet bindings pass, while the
+	* client already holds the ids. Cost: one `loadRuntimeState` RPC per id, 8 in
+	* flight (`readAlarmOpenings`); the client sends at most `NC_ALARM_SENSORS_MAX`
+	* ids per call and polls every 15 s, every 5 s only while a countdown or the
+	* siren runs. No log line per call (it is polled): one WARN/INFO per change of
+	* wholesale read health (`NcAlarmSensorsReadLog`); a per-id read failure keeps
+	* `readAlarmOpenings`' own debug line, and shows as `unknown` (D49).
+	*
+	* An id with no persisted device (removed) or whose provider never wrote an
+	* opening slice reads `not-opening`, exactly as the arm check sees it — NOT
+	* "verified not an opening". The client shows "Removed" from its fleet read.
+	*/
+	async alarmSensors(input) {
+		const read = this.deps.readDeviceOpenings;
+		if (read === void 0) throw new Error("the opening reader is not wired on this node");
+		const ids = alarmSensorReadIds(input.deviceIds);
+		const openings = await read(ids);
+		const line = this.alarmSensorsReadLog.next(ids.length, openings.size);
+		if (line !== null) {
+			const panelId = this.alarmPanel?.deviceId;
+			this.logger[line.level](line.message, {
+				...panelId === void 0 ? {} : { tags: { deviceId: panelId } },
+				meta: line.meta
+			});
+		}
+		return {
+			sensors: ids.map((id) => alarmSensorStateOf(id, openings.get(id), this.deviceDirectory.get(id)?.online ?? null)),
+			readAt: Date.now()
+		};
+	}
 	/** Settings + the DERIVED coverage + the live panel. Read together — see the cap doc. */
 	async alarmConfig() {
 		const panel = this.alarmPanel;
@@ -92239,8 +92614,8 @@ function buildAudioLabels(input) {
 * Mapped sensor/control caps that a CAMERA must NOT contribute for ITSELF.
 *
 * A sensor cap bound on a camera makes the camera both the source and the
-* subject — a doorbell wrapper on camera 615, a native Reolink doorbell, a
-* camera-side button. Those have no other route into the per-camera event
+* subject — a composed doorbell on camera 615 (D671), a native Reolink
+* doorbell, a camera-side button. Those have no other route into the per-camera event
 * substrate, so the camera includes itself.
 *
 * `motion` is the exception, and today the ONLY one: camera motion already
@@ -92509,8 +92884,8 @@ var LinkedCamerasCache = class {
 * THE camera-set derivation for a sensor-cap state change — one function, so
 * every consumer of a device-event attributes it to the same cameras.
 *
-* It is shared on purpose. The self-camera half (a doorbell wrapper bound on
-* camera 615 makes 615 both source and subject) was added to the history-row
+* It is shared on purpose. The self-camera half (a doorbell bound on camera
+* 615 makes 615 both source and subject) was added to the history-row
 * ingest on 2026-08-07 and NOT to the synthetic-track projection beside it,
 * which kept resolving `camerasFor` alone. The result: camera 615's real
 * doorbell press on 2026-08-08 06:59Z produced a `SensorEvent` row and no
@@ -92598,8 +92973,8 @@ function isSliceRecord(slice) {
 /**
 * One `DeviceStateChanged` → N history rows, one per camera the event belongs
 * to: the emitting device's LINKED cameras, plus the emitting device ITSELF
-* when it is a camera carrying the sensor cap (a doorbell wrapper bound on
-* camera 615 — see `SELF_CAMERA_EXCLUDED_CAPS` for the one cap that is not
+* when it is a camera carrying the sensor cap (a doorbell bound on camera
+* 615 — see `SELF_CAMERA_EXCLUDED_CAPS` for the one cap that is not
 * self-ingested). The EVENT_KIND_BY_CAP gate exits first so non-sensor cap
 * churn costs one map lookup. Returns the number of rows inserted (0 when
 * unmapped, or when no camera takes a row for the device — a non-camera
@@ -93691,9 +94066,10 @@ var MotionEventSnapshotCapturer = class {
 *
 * **What this fixes.** The projection used to resolve its cameras with
 * `camerasFor` alone — LINKED cameras only — while the history-row ingest
-* beside it had gained the self-camera half on 2026-08-07. A doorbell wrapper
-* is bound on the CAMERA (the virtual-doorbell builtin writes the `doorbell`
-* slice onto camera 615 itself), so `camerasFor(615)` answered `[]` and the
+* beside it had gained the self-camera half on 2026-08-07. A doorbell can be
+* served on the CAMERA itself (a composed doorbell, D671, writes the `doorbell`
+* slice onto camera 615; Reolink registers it at camera level), so
+* `camerasFor(615)` answered `[]` and the
 * projection returned on a `debug` line nobody runs at. Camera 615's real
 * press at 2026-08-08 06:59Z therefore produced a `SensorEvent` row, a HomeKit
 * ring, an Alexa post and a matched notification rule — and no track. Both
@@ -93841,16 +94217,17 @@ async function projectSensorMarkers(deps, data, timestamp) {
 * ## Why the predicate is imported and not written here
 *
 * `evaluateSensorEdge` (`@camstack/types`) is already THE edge predicate: the
-* virtual doorbell feeds it (`builtins/doorbell/trigger-engine.ts`) and so does
-* the recorder's sensor trigger (`addon-pipeline` `recorder/sensor-trigger.ts`).
+* recorder's sensor trigger feeds it (`addon-pipeline` `recorder/sensor-trigger.ts`)
+* and so does the orchestrator's camera-sensors bridge
+* (`addon-pipeline-orchestrator` `camera-sensors/source.ts`).
 * Post-analysis was the third consumer of the same bus event and the only one
 * that did not. A second predicate here would diverge on the first cap added —
 * the exact failure [D62](../../../../../docs/decisions/adr-0062.md) names.
 *
 * ## Where it deliberately differs from the other two
 *
-* The doorbell and the recorder want the RISING edge only. A timeline marker
-* is not a doorbell: a door CLOSING is an event an operator wants to see, and
+* The recorder and the camera-sensors bridge want the RISING edge only. A
+* timeline marker is not a doorbell: a door CLOSING is an event an operator wants to see, and
 * the taxonomy has one `contact` kind for both directions. So this gate accepts
 * `edge: 'rising'` **and** the `falling-edge` verdict, and rejects only the
 * verdicts that mean "nothing moved" — which is precisely the 30.