@camstack/addon-post-analysis 1.2.337 → 1.2.339

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-CML1YOOa.js");
+const require_clip_model_registry = require("../clip-model-registry-DlJT7zn4.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -1408,6 +1408,12 @@ async function readAlarmOpenings(ids, loadRuntime, logger) {
 function isPhase(value) {
 	return value === "open" || value === "closed";
 }
+/**
+* A change time that cannot be a move: `0` is a placeholder and `1` is the
+* "known value, unknown change time" convention providers stamp on a replay or
+* a recovery (`HM_SEEDED_CHANGED_AT`, `HA_SEEDED_CHANGED_AT`).
+*/
+var NO_CHANGE_TIME = 1;
 var NcAlarmExclusions = class {
 	entries = [];
 	/** Replace the whole set — one arm, one set of exclusions. */
@@ -1416,7 +1422,9 @@ var NcAlarmExclusions = class {
 			deviceId,
 			phase: "open",
 			at,
-			announced: false
+			announced: false,
+			moved: false,
+			lastMoveAt: 0
 		}));
 	}
 	/** Every excluded sensor, in the order it was excluded. */
@@ -1440,24 +1448,53 @@ var NcAlarmExclusions = class {
 	* An unreadable state changes nothing (D49): a failed read must never lift an
 	* exclusion the operator asked for, and must never swallow the close that
 	* would have.
+	*
+	* `changedAt` is the reading's OWN change time, when the caller has one (a
+	* sensor event's slice; the reconcile tick has none). It decides only whether
+	* an open in phase `open` really MOVED ({@link takeMoved}) — never a lift.
 	*/
-	observe(deviceId, reading, _at) {
+	observe(deviceId, reading, _at, changedAt) {
 		if (reading === void 0) return "unchanged";
 		const current = this.entries.find((e) => e.deviceId === deviceId);
 		if (current === void 0) return "unchanged";
 		if (reading === "secure") {
-			if (current.phase === "closed") return "unchanged";
-			this.entries = this.entries.map((e) => e.deviceId === deviceId ? {
-				...e,
-				phase: "closed"
-			} : e);
-			return "closed";
+			if (current.phase === "closed") return this.replace({
+				...current,
+				moved: false
+			}, "unchanged");
+			return this.replace({
+				...current,
+				phase: "closed",
+				moved: false
+			}, "closed");
+		}
+		if (current.phase === "open") {
+			const fresh = changedAt !== void 0 && Number.isFinite(changedAt) && changedAt > Math.max(current.at, current.lastMoveAt, NO_CHANGE_TIME);
+			const redelivered = current.moved && changedAt === current.lastMoveAt;
+			return this.replace({
+				...current,
+				moved: fresh || redelivered,
+				lastMoveAt: fresh ? changedAt : current.lastMoveAt
+			}, "unchanged");
 		}
-		if (current.phase === "open") return "unchanged";
 		this.entries = this.entries.filter((e) => e.deviceId !== deviceId);
 		return "rearmed";
 	}
 	/**
+	* Did the last reading of this sensor really move it (D735)? Consumed: the
+	* press it caused asks once, and a later press of the same reading is a
+	* duplicate. False for a sensor that is not excluded.
+	*/
+	takeMoved(deviceId) {
+		const current = this.entries.find((e) => e.deviceId === deviceId);
+		if (current === void 0 || !current.moved) return false;
+		this.replace({
+			...current,
+			moved: false
+		}, "unchanged");
+		return true;
+	}
+	/**
 	* Mark this sensor's ignored trigger as announced — true only the FIRST time
 	* in this arm (the caller then announces and persists), false for a repeat
 	* or for a sensor that is not excluded.
@@ -1480,6 +1517,11 @@ var NcAlarmExclusions = class {
 		this.entries = this.entries.filter((e) => e.deviceId !== deviceId);
 		return true;
 	}
+	/** Swap one entry for its next version — the set is replaced, never mutated. */
+	replace(next, change) {
+		this.entries = this.entries.map((e) => e.deviceId === next.deviceId ? next : e);
+		return change;
+	}
 	/** The arm this belongs to is over. */
 	clear() {
 		this.entries = [];
@@ -1511,7 +1553,9 @@ var NcAlarmExclusions = class {
 					deviceId: item,
 					phase: "open",
 					at: 0,
-					announced: false
+					announced: false,
+					moved: false,
+					lastMoveAt: 0
 				});
 				continue;
 			}
@@ -1525,7 +1569,9 @@ var NcAlarmExclusions = class {
 				deviceId,
 				phase,
 				at,
-				announced: rec["announced"] === true
+				announced: rec["announced"] === true,
+				moved: false,
+				lastMoveAt: 0
 			});
 		}
 		this.entries = out;
@@ -1616,7 +1662,8 @@ function modeDelaysFromPersisted(raw) {
 		}
 		if (item.notifyDuringEntryDelay !== void 0) kept.notifyDuringEntryDelay = item.notifyDuringEntryDelay;
 		if (item.notifySensorRewatched !== void 0) kept.notifySensorRewatched = item.notifySensorRewatched;
-		if (kept.notifyDuringEntryDelay !== void 0 || kept.notifySensorRewatched !== void 0 || kept.exitDelaySec !== void 0 || kept.entryDelaySec !== void 0 || kept.triggeredDurationSec !== void 0 || kept.postTriggeredAction !== void 0 || kept.schedule !== void 0) entries.push(kept);
+		if (item.notifySensorIgnored !== void 0) kept.notifySensorIgnored = item.notifySensorIgnored;
+		if (kept.notifyDuringEntryDelay !== void 0 || kept.notifySensorRewatched !== void 0 || kept.notifySensorIgnored !== void 0 || kept.exitDelaySec !== void 0 || kept.entryDelaySec !== void 0 || kept.triggeredDurationSec !== void 0 || kept.postTriggeredAction !== void 0 || kept.schedule !== void 0) entries.push(kept);
 	}
 	return {
 		entries,
@@ -1827,6 +1874,10 @@ function alarmPushDecision(phase, heard) {
 	switch (phase.kind) {
 		case "none":
 		case "triggers-now": return { verdict: { kind: "plain" } };
+		case "excluded": return { verdict: {
+			kind: "suppress",
+			reason: "alarm-sensor-excluded"
+		} };
 		case "triggered": return { verdict: { kind: "intrusion" } };
 		case "starts-entry-delay": return heard.pending ? { verdict: {
 			kind: "suppress",
@@ -1869,17 +1920,6 @@ function intrusionDeviceOf(ref) {
 //#endregion
 //#region src/notification-center/alarm/alarm-transitions.ts
 /**
-* How long a note handed to {@link NcAlarmAttribution.note} stays valid.
-*
-* The note is placed IMMEDIATELY before the `alarm-panel.trigger` call it
-* describes, in the same process, so the real gap is milliseconds. The bound
-* exists only so a sequence that failed before reaching its trigger step — or a
-* `wait` that outlived the incident — cannot leave an attribution lying around
-* for an unrelated manual trigger to pick up half an hour later.
-* Mis-attributing an alarm would put somebody else's photograph on it.
-*/
-var TRIGGER_ATTRIBUTION_TTL_MS = 3e4;
-/**
 * How many followers one incident keeps (D705). The mosaic tiles at most
 * `NC_GROUPED_MOSAIC_MAX_TILES` (6) and the sentence counts every member, so this
 * bounds RAM and the frozen row, not the picture: a camera that keeps matching for
@@ -1895,88 +1935,41 @@ function subjectKeyOf(ref) {
 * WHO the panel's current countdown belongs to.
 *
 * Small and separate because its whole content is a LIFETIME, and a lifetime
-* is what goes wrong: the note and the trigger are milliseconds apart, but the
-* trigger and the siren are up to `entryDelaySec` apart, and in between the
-* operator may disarm, re-arm, or press trigger by hand. Each of those must
-* drop the attribution, or tonight's alarm arrives carrying last night's
-* photograph.
+* is what goes wrong: the trigger and the siren are up to `entryDelaySec`
+* apart, and in between the operator may disarm, re-arm, or press trigger by
+* hand. Each of those must drop the attribution, or tonight's alarm arrives
+* carrying last night's photograph.
+*
+* It holds NO pending press. A rule press carries its source IN the call
+* (`NcAlarmPanelDevice.triggerFromRule`), synchronously, so there is nothing
+* to hand over and nothing to overwrite. The single "next trigger is this
+* rule's" slot this class used to hold was written before an awaited cap call
+* and read when the call landed; two matches 1 ms apart overwrote it, one press
+* landed with no source, skipped the exclusion check and sounded the siren off
+* an excluded contact (2026-10-07 02:32Z, D735).
 */
 var NcAlarmAttribution = class {
-	noted = null;
 	claimed = null;
 	/** The incident's other subjects (D705) — replaced, never mutated. */
 	followed = [];
-	/** "The next trigger is this rule's." Consumed by the trigger that follows:
-	*  {@link claim} when it is accepted, {@link follow} when an entry delay
-	*  already running refused it (D705), {@link dropPending} when an excluded
-	*  sensor made it. */
-	note(source, now) {
-		this.noted = {
-			source,
-			at: now
-		};
-	}
-	/**
-	* The note that has not been claimed yet — WITHOUT consuming it.
-	*
-	* The panel has to know which SENSOR is about to set the alarm off before it
-	* decides whether to accept the trigger at all (an excluded contact does
-	* not), and asking must not spend the note: a trigger that is accepted still
-	* needs it to build the combined notification. Expired reads as absent, on
-	* the same bound {@link claim} uses.
-	*/
-	pending(now) {
-		const noted = this.noted;
-		if (noted === null) return null;
-		if (now - noted.at > TRIGGER_ATTRIBUTION_TTL_MS) return null;
-		return noted.source;
-	}
-	/** Throw the un-claimed note away — the trigger it described was REFUSED, and
-	*  a note left behind would be inherited by the next real one. */
-	dropPending() {
-		this.noted = null;
-	}
 	/**
-	* Called by an ACCEPTED trigger, and by every accepted trigger — including
-	* one with no note, so a manual trigger clears whatever a rule left behind
-	* rather than inheriting it.
+	* Called by EVERY accepted trigger with the source that pressed it — `null`
+	* for a manual or external press, so it clears whatever a rule left behind
+	* rather than inheriting it. A new countdown is a new incident: nothing the
+	* last one collected rides it.
 	*/
-	claim(now) {
-		const noted = this.noted;
-		this.noted = null;
+	claim(source) {
+		this.claimed = source;
 		this.followed = [];
-		if (noted === null) {
-			this.claimed = null;
-			return {
-				source: null,
-				expired: null
-			};
-		}
-		if (now - noted.at > TRIGGER_ATTRIBUTION_TTL_MS) {
-			this.claimed = null;
-			return {
-				source: null,
-				expired: noted.source
-			};
-		}
-		this.claimed = noted.source;
-		return {
-			source: noted.source,
-			expired: null
-		};
 	}
 	/**
-	* A trigger the panel REFUSED because its entry delay is already running (D705):
-	* the note it left is another subject of the SAME incident. Consumed either way —
-	* a note left behind would be claimed by the next, unrelated incident.
+	* A rule press the panel REFUSED because its entry delay is already running
+	* (D705): its source is another subject of the SAME incident.
 	*
 	* Only an incident a rule started collects followers: the combined row is the
 	* source rule's, and promoting a follower to source would change the sentence.
 	*/
-	follow(now) {
-		const source = this.pending(now);
-		this.noted = null;
-		if (source === null) return { kind: "none" };
+	follow(source) {
 		const claimed = this.claimed;
 		if (claimed === null) return {
 			kind: "no-incident",
@@ -2230,7 +2223,8 @@ var ncAlarmPanelSchema = require_clip_model_registry.object({
 		schedule: require_clip_model_registry.unknown().optional(),
 		/** D706 — the mode's notification switches; absent = off. */
 		notifyDuringEntryDelay: require_clip_model_registry.boolean().optional(),
-		notifySensorRewatched: require_clip_model_registry.boolean().optional()
+		notifySensorRewatched: require_clip_model_registry.boolean().optional(),
+		notifySensorIgnored: require_clip_model_registry.boolean().optional()
 	})).default([]),
 	/**
 	* Active alarm configuration profile id. Empty / absent on a blob older than
@@ -2306,6 +2300,7 @@ function settingsBlobFromPersisted(raw) {
 		if (rec["schedule"] !== void 0) entry.schedule = rec["schedule"];
 		if (typeof rec["notifyDuringEntryDelay"] === "boolean") entry.notifyDuringEntryDelay = rec["notifyDuringEntryDelay"];
 		if (typeof rec["notifySensorRewatched"] === "boolean") entry.notifySensorRewatched = rec["notifySensorRewatched"];
+		if (typeof rec["notifySensorIgnored"] === "boolean") entry.notifySensorIgnored = rec["notifySensorIgnored"];
 		modeDelaysLoose.push(entry);
 	}
 	const truncatedTriggered = Math.max(0, Math.min(3600, Math.trunc(triggered)));
@@ -2882,21 +2877,26 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 		this.onPublish = hook;
 	}
 	/**
-	* "The next trigger is this rule's, about this subject."
+	* A RULE pressed the panel, and says which match it was — in the call itself.
 	*
 	* The join between a rule's notification and the alarm's. `alarm-panel.trigger`
 	* takes nothing but a device id — by design, since a Home Assistant panel
-	* provides the same cap — so the attribution cannot ride the cap call. It is
-	* handed over in-process instead, immediately before the actuation, and the
-	* panel stamps it onto the `alarm-triggered` event it eventually emits.
-	*
-	* The FIRST accepted trigger claims the note and owns the countdown; a rule
+	* provides the same cap — so a rule press on THIS panel never goes through the
+	* cap: the notification centre calls this method, in-process and
+	* synchronously, with the match that pressed it. The source is never parked
+	* anywhere for a later call to pick up: a single "next trigger is this rule's"
+	* slot, written before an awaited cap call and read when it landed, was
+	* overwritten by a second match 1 ms later, and the press that found it empty
+	* skipped the exclusion check and sounded the siren off an excluded contact
+	* (2026-10-07 02:32Z, D735).
+	*
+	* The FIRST accepted press claims the source and owns the countdown; a rule
 	* pressing again while the entry delay runs is refused as a trigger and its
-	* note becomes a FOLLOWER of the same incident (D705) — the triggered
+	* source becomes a FOLLOWER of the same incident (D705) — the triggered
 	* notification tiles the source and every follower as one mosaic.
 	*/
-	noteRuleTrigger(source, now = Date.now()) {
-		this.attribution.note(source, now);
+	triggerFromRule(source, now = Date.now()) {
+		return this.press(source, now);
 	}
 	/**
 	* Where the alarm stands for ONE rule match, read BEFORE that match presses the panel
@@ -2905,14 +2905,19 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	* sensor is ignored, a running countdown or a triggered alarm refuses the press, an armed
 	* panel starts the countdown (or fires at once when the mode's entry delay is 0).
 	*
-	* Two refinements make the answer exact rather than a guess:
-	*  - the subject that STARTED the countdown is still its starter on its later matches (a
-	*    person who stays in view is not "another intrusion during the delay");
-	*  - a note left by a press that has not landed yet (same evaluation, two rules) already
-	*    owns the countdown, so a second subject in that window is a follower.
+	* The subject that STARTED the countdown is still its starter on its later matches (a
+	* person who stays in view is not "another intrusion during the delay"). A rule press
+	* lands synchronously ({@link triggerFromRule}), so the machine this reads already holds
+	* every earlier press of the same evaluation — there is no press "in flight" to guess at.
+	*
+	* A match of a sensor the current arm EXCLUDES is `excluded`: its press will be ignored,
+	* and the rule's own push is not sent either (D735) — the panel's bypass logic speaks for it.
 	*/
 	classifyRuleMatch(ref, now = Date.now()) {
-		if (this.exclusions.blocks(intrusionDeviceOf(ref))) return { kind: "none" };
+		if (this.exclusions.blocks(intrusionDeviceOf(ref))) return {
+			kind: "excluded",
+			sensorDeviceId: intrusionDeviceOf(ref)
+		};
 		const mode = armModeOf(this.machine.target, NC_ALARM_MODES);
 		if (mode === null) return { kind: "none" };
 		const state = stateAt(this.machine, now);
@@ -2934,17 +2939,7 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			};
 		}
 		if (!isArmed(this.machine, now)) return { kind: "none" };
-		const immediate = this.delaysFor(mode).entryDelaySec === 0;
-		const inFlight = this.attribution.pending(now);
-		if (inFlight !== null && subjectKeyOf(inFlight) !== key) return immediate ? {
-			kind: "triggered",
-			mode
-		} : {
-			kind: "entry-delay",
-			mode,
-			notify: this.notifyPolicy(mode).notifyDuringEntryDelay
-		};
-		return immediate ? {
+		return this.delaysFor(mode).entryDelaySec === 0 ? {
 			kind: "triggers-now",
 			mode
 		} : {
@@ -3125,7 +3120,7 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	* sensor is already lifted when the rule it fires reaches the panel.
 	*/
 	observeOpening(deviceId, reading, now = Date.now(), options = {}) {
-		const change = this.exclusions.observe(deviceId, reading, now);
+		const change = this.exclusions.observe(deviceId, reading, now, options.changedAt);
 		if (change === "unchanged") return "unchanged";
 		this.persist();
 		if (change === "closed") return "closed";
@@ -3175,13 +3170,12 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			event: "lifted"
 		}, now);
 	}
-	/** Did THIS sensor start the running entry delay (landed, or a press about to land)? */
+	/** Did THIS sensor start the running entry delay? A rule press lands synchronously, so
+	*  a press of the evaluation that lifted it has already landed when this is asked. */
 	startsEntryDelay(deviceId, now) {
-		const state = stateAt(this.machine, now);
-		const sensorOf = (ref) => ref !== null ? intrusionDeviceOf(ref) : void 0;
-		if (state === "pending") return sensorOf(this.attribution.current()) === deviceId;
-		if (!isArmed(this.machine, now) || state === "triggered") return false;
-		return sensorOf(this.attribution.pending(now)) === deviceId;
+		if (stateAt(this.machine, now) !== "pending") return false;
+		const starter = this.attribution.current();
+		return starter !== null && intrusionDeviceOf(starter) === deviceId;
 	}
 	/**
 	* A DELETED device leaves the current arm's exclusions: it can never report
@@ -3407,64 +3401,78 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			},
 			disarm: async () => this.disarm(),
 			trigger: async () => {
-				const now = Date.now();
-				const pending = this.attribution.pending(now);
-				const source = pending !== null ? intrusionDeviceOf(pending) : void 0;
-				if (source !== void 0 && this.exclusions.blocks(source)) {
-					this.attribution.dropPending();
-					this.ctx.logger.info("alarm trigger ignored — the sensor was open when the alarm was armed", {
-						tags: { deviceId: source },
-						meta: {
-							panelDeviceId: this.id,
-							ruleId: pending?.ruleId,
-							rule: pending?.ruleName,
-							state: stateAt(this.machine, now)
-						}
-					});
-					this.announceIgnoredTrigger(source, now);
-					return;
+				this.press(null, Date.now());
+			}
+		});
+	}
+	/**
+	* THE ENTRY DELAY LIVES OR DIES HERE. The one body every press runs — a rule's
+	* ({@link triggerFromRule}, with its source) and a person's (the cap, `null`).
+	*
+	* It used to set `fired: true` outright, calling itself "a panic button", while
+	* the entry-delay transition sat in a method NO caller ever reached — so the
+	* panel shipped with `pending` unreachable. The doc comment describing the right
+	* design is precisely what made it look implemented.
+	*
+	* Synchronous, end to end: the source is a parameter, never a slot, so two
+	* presses cannot exchange their sources however close together they land.
+	*/
+	press(source, now) {
+		const sensor = source !== null ? intrusionDeviceOf(source) : void 0;
+		if (sensor !== void 0 && this.exclusions.blocks(sensor)) {
+			const moved = this.exclusions.takeMoved(sensor);
+			this.ctx.logger.info("alarm trigger ignored — the sensor was open when the alarm was armed", {
+				tags: { deviceId: sensor },
+				meta: {
+					panelDeviceId: this.id,
+					ruleId: source?.ruleId,
+					rule: source?.ruleName,
+					state: stateAt(this.machine, now),
+					moved
 				}
-				const armed = armModeOf(this.machine.target, NC_ALARM_MODES);
-				const resolved = this.delaysFor(armed);
-				const next = trigger(this.machine, resolved, now);
-				if (next === this.machine) {
-					const state = stateAt(this.machine, now);
-					this.ctx.logger.info(ignoredTriggerMessage(state), {
-						tags: { deviceId: this.id },
-						meta: { state }
-					});
-					if (state === "pending") {
-						this.reportFollow(this.attribution.follow(now));
-						return;
-					}
-					this.attribution.dropPending();
-					return;
+			});
+			this.announceIgnoredTrigger(sensor, now, moved);
+			return "ignored-excluded";
+		}
+		const armed = armModeOf(this.machine.target, NC_ALARM_MODES);
+		const resolved = this.delaysFor(armed);
+		const next = trigger(this.machine, resolved, now);
+		if (next === this.machine) {
+			const state = stateAt(this.machine, now);
+			this.ctx.logger.info(ignoredTriggerMessage(state), {
+				tags: { deviceId: this.id },
+				meta: {
+					state,
+					...source !== null ? {
+						ruleId: source.ruleId,
+						rule: source.ruleName
+					} : {}
 				}
-				const claim = this.attribution.claim(now);
-				if (claim.expired !== null) this.ctx.logger.info("alarm trigger attribution expired — plain alarm notification", {
-					tags: { deviceId: this.id },
-					meta: {
-						ruleId: claim.expired.ruleId,
-						rule: claim.expired.ruleName
-					}
-				});
-				this.machine = next;
-				this.ctx.logger.info("alarm delays applied", {
-					tags: { deviceId: this.id },
-					meta: {
-						mode: armed,
-						phase: "trigger",
-						entryDelaySec: resolved.entryDelaySec,
-						triggeredDurationSec: resolved.triggeredDurationSec,
-						source: {
-							entry: resolved.source.entryDelaySec,
-							siren: resolved.source.triggeredDurationSec
-						}
-					}
-				});
-				this.publish(now);
+			});
+			if (state === "pending" && source !== null) this.reportFollow(this.attribution.follow(source));
+			return "refused";
+		}
+		this.attribution.claim(source);
+		this.machine = next;
+		this.ctx.logger.info("alarm delays applied", {
+			tags: { deviceId: this.id },
+			meta: {
+				mode: armed,
+				phase: "trigger",
+				entryDelaySec: resolved.entryDelaySec,
+				triggeredDurationSec: resolved.triggeredDurationSec,
+				source: {
+					entry: resolved.source.entryDelaySec,
+					siren: resolved.source.triggeredDurationSec
+				},
+				...source !== null ? {
+					ruleId: source.ruleId,
+					rule: source.ruleName
+				} : { by: "manual" }
 			}
 		});
+		this.publish(now);
+		return "accepted";
 	}
 	status(now = Date.now()) {
 		return {
@@ -3545,7 +3553,6 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	* stated: the drop is work the operator would otherwise never see go missing.
 	*/
 	reportFollow(outcome) {
-		if (outcome.kind === "none") return;
 		const source = outcome.source;
 		const meta = {
 			panelDeviceId: this.id,
@@ -3574,13 +3581,15 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 		});
 	}
 	/**
-	* A dropped trigger is TOLD, not only logged — an intrusion the alarm
-	* deliberately did not act on is what the operator most needs to hear — but
-	* ONCE per sensor per arm (the mark rides the persisted exclusion), and only
-	* while the panel is armed: during the exit delay `trigger()` would have
-	* dropped it anyway, so the exclusion is not what ignored it.
+	* "Ignored" is TOLD only when the excluded sensor really MOVED while armed and the
+	* mode's `notifySensorIgnored` switch is on (D735, default off) — and then ONCE per
+	* sensor per arm (the mark rides the persisted exclusion), and only while the panel is
+	* armed: during the exit delay `trigger()` would have dropped it anyway, so the
+	* exclusion is not what ignored it. A contact that was open all along and was merely
+	* re-published (a provider reconnect, a Zigbee2MQTT restart) moved nothing, and four
+	* such pushes reached the operator in 60 ms on 2026-10-07. Every refusal is a line.
 	*/
-	announceIgnoredTrigger(deviceId, now) {
+	announceIgnoredTrigger(deviceId, now, moved) {
 		const state = stateAt(this.machine, now);
 		if (!isArmed(this.machine, now)) {
 			this.ctx.logger.debug("alarm bypass not announced — the panel is not armed yet", {
@@ -3602,6 +3611,29 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			});
 			return;
 		}
+		if (!moved) {
+			this.ctx.logger.debug("alarm bypass not announced — the sensor did not move since the arm", {
+				tags: { deviceId },
+				meta: {
+					panelDeviceId: this.id,
+					state,
+					reason: "not-moved"
+				}
+			});
+			return;
+		}
+		const mode = armModeOf(this.machine.target, NC_ALARM_MODES);
+		if (mode === null || !this.notifyPolicy(mode).notifySensorIgnored) {
+			this.ctx.logger.info("alarm \"ignored\" not notified — the mode does not notify it", {
+				tags: { deviceId },
+				meta: {
+					panelDeviceId: this.id,
+					mode,
+					reason: "ignored-notify-off"
+				}
+			});
+			return;
+		}
 		if (!this.exclusions.markAnnounced(deviceId)) {
 			this.ctx.logger.debug("alarm bypass already announced in this arm — repeat not sent", {
 				tags: { deviceId },
@@ -3759,7 +3791,7 @@ function ncAlarmPanelPort(panel) {
 		deleteProfile: (id) => panel.deleteProfile(id),
 		activateProfile: (id) => panel.activateProfile(id),
 		availableModes: () => NC_ALARM_MODES,
-		noteRuleTrigger: (source) => panel.noteRuleTrigger(source),
+		triggerFromRule: (source) => panel.triggerFromRule(source),
 		classifyRuleMatch: (source) => panel.classifyRuleMatch(source),
 		announceLifted: (deviceId, now) => panel.announceLifted(deviceId, now),
 		excludedDevices: () => panel.excludedDevices(),
@@ -4666,22 +4698,26 @@ var HUB_API_PORT = 4443;
 * preferred LAN interface priority `0`, so a public candidate has to sit below
 * zero to outrank it.
 */
-var PRIORITY_MARKED = -400;
+var PRIORITY_PUBLIC_ENDPOINT = -400;
 var PRIORITY_CONNECTED = -200;
 var PRIORITY_EXTERNAL_LIST = -100;
 /**
-* Build the ranked candidate list, in the operator's own order: the address
-* marked on the Network page, then the connected external ingress (tunnels),
-* then the LAN addresses. Every source is best-effort — one that throws
-* contributes nothing rather than costing the whole list.
+* Build the ranked candidate list for every link a notification carries
+* (buttons, attachments / media, admin links): the hub's PUBLIC ENDPOINT
+* (D734), then — only reached when that is unknown — the connected external
+* ingress (tunnels), then the LAN addresses. Every source is best-effort — one
+* that throws contributes nothing rather than costing the whole list.
+*
+* The notification-taps address is deliberately NOT an input: it decides only
+* where a tap opens, and its default (the app link) is no hub address.
 */
 async function collectArtifactEndpoints(sources) {
 	const out = [];
-	const marked = sources.markedBaseUrl;
-	if (marked !== void 0 && marked !== "" && !require_clip_model_registry.isAppLinkBase(marked)) out.push({
-		baseUrl: marked,
+	const publicEndpoint = sources.publicEndpoint;
+	if (publicEndpoint !== void 0 && publicEndpoint !== "" && !require_clip_model_registry.isAppLinkBase(publicEndpoint)) out.push({
+		baseUrl: publicEndpoint,
 		kind: "public",
-		priority: PRIORITY_MARKED
+		priority: PRIORITY_PUBLIC_ENDPOINT
 	});
 	try {
 		const connected = await sources.getConnected();
@@ -4916,6 +4952,49 @@ var NcArtifactPlane = class {
 	}
 };
 //#endregion
+//#region src/notification-center/link-endpoints.ts
+async function publicEndpointAddress(api, logger) {
+	try {
+		const { roles } = await api.localNetwork.getAddresses.query({});
+		return roles.publicEndpoint.resolved ?? void 0;
+	} catch (err) {
+		logger.warn("nc links: public endpoint unreadable — using the ingress ladder", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return;
+	}
+}
+/** The ranked base-URL candidates for a notification's non-tap links. */
+async function notificationLinkEndpoints(api, logger) {
+	return collectArtifactEndpoints({
+		publicEndpoint: await publicEndpointAddress(api, logger),
+		getConnected: async () => {
+			const status = await api.networkAccess.getStatus.query();
+			logger.debug("artifact base-url: connected ingress", { meta: {
+				connected: status.connected,
+				url: status.endpoint?.url ?? null,
+				protocol: status.endpoint?.protocol ?? null
+			} });
+			return status.connected && status.endpoint !== null ? {
+				url: status.endpoint.url,
+				protocol: status.endpoint.protocol
+			} : null;
+		},
+		listExternal: async () => {
+			return (await api.networkAccess.listEndpoints.query()).map((e) => ({
+				url: e.url,
+				protocol: e.protocol
+			}));
+		},
+		listLan: async (port) => {
+			return (await api.localNetwork.getConnectionEndpoints.query({ port })).endpoints.flatMap((e) => e.kind === "app-link" || e.kind === "custom" ? [] : [{
+				baseUrl: e.baseUrl,
+				kind: e.kind,
+				priority: e.priority
+			}]);
+		},
+		logger
+	});
+}
+//#endregion
 //#region src/notification-center/artifact-read-plane.ts
 /**
 * Parse a single-range `Range` header against a known length.
@@ -5372,158 +5451,6 @@ function mimeFromExtension(file) {
 	return "application/octet-stream";
 }
 //#endregion
-//#region src/notification-center/system-event-tap-url.ts
-/** The admin UI's own routes, as `packages/addon-admin-ui/src/App.tsx` declares them. */
-var ADMIN_ADDONS_PATH = "/system/addons";
-var ADMIN_CLUSTER_PATH = "/system/cluster";
-var ADMIN_DEVICES_PATH = "/devices";
-/**
-* The query parameter naming a node.
-*
-* One spelling for both admin pages, mirrored by `NODE_PARAM` in
-* `packages/addon-admin-ui/src/lib/node-url-selection.ts` and pinned across
-* the two packages by `scripts/check-notification-tap-targets.ts`.
-*/
-var NODE_PARAM = "node";
-/** The device page's top-level tab parameter, read by `DeviceDetail`. */
-var TAB_PARAM = "tab";
-/** The Stream Broker tab id — a `WELL_KNOWN_TABS` member, hoisted `top-tab`. */
-var STREAM_BROKER_TAB = "stream-broker";
-/** `DeviceType.Camera`. Spelled here rather than imported so this stays a pure
-*  string map with no device-model dependency; the guard pins it. */
-var CAMERA_DEVICE_TYPE = "camera";
-/** Kinds whose action is "go and apply an ADDON update". */
-var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
-/** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
-var NODE_UPDATE_KINDS = new Set(["server-update-available", "wrapper-update-available"]);
-/**
-* Kinds whose action is "go and look at this device's stream".
-*
-* BOTH DIRECTIONS. A recovery lands on the same page as the failure it undoes,
-* because "did it really come back, and what did it do while it was gone" is
-* an action and the page that answers it is the one the down-notification
-* already opened. On 2026-08-30 the operator's phone showed "Il dispositivo
-* Videocamera sala feste è online" with `tapAction.value: null` — the same
-* camera's `device-offline` an hour earlier opened the Stream Broker tab, and
-* the recovery opened nothing, purely because `device-online` had no entry
-* here.
-*
-* The legacy `camera-*` pair is here for the same reason both are still in the
-* enum: outbox and history rows enqueued before the rename carry them, and an
-* old row is exactly the one whose action has to keep working.
-*
-* Kinds NOT here are kinds whose DOWN direction has no action either
-* (`node-online`/`node-offline`, `device-enabled`/`device-disabled`) — a
-* recovery does not earn a destination its failure was never given.
-*/
-var DEVICE_STREAM_KINDS = new Set([
-	"device-offline",
-	"device-online",
-	"stream-offline",
-	"stream-online",
-	"camera-offline",
-	"camera-online"
-]);
-/**
-* Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
-*
-* A stream belongs to a camera and nothing else. The legacy `camera-*` pair is
-* too — that name is precisely the claim it made, and it is why the kind was
-* split into `device-*` + a `deviceTypes` condition.
-*/
-var CAMERA_BY_CONSTRUCTION_KINDS = new Set([
-	"stream-offline",
-	"stream-online",
-	"camera-offline",
-	"camera-online"
-]);
-/**
-* Where a per-section STATE SUMMARY row lands (D708). The row spans nodes, so
-* no `?node=`: the unscoped page is the honest one. A section absent here taps
-* through its kind, like any other row — a device section carries the system
-* placeholder device and gets no link, and the crash-looped addons have none
-* (their instant kind has none either).
-*
-* `nodes` is the one destination no kind gives: a node going offline has no
-* instant action, but "which nodes are in trouble" is answered by the
-* Cluster page, and the summary row is about all of them at once.
-*/
-var SUMMARY_SECTION_PATHS = {
-	nodes: ADMIN_CLUSTER_PATH,
-	"addon-updates": ADMIN_ADDONS_PATH,
-	updates: ADMIN_CLUSTER_PATH
-};
-function withParam(path, key, value) {
-	if (value === void 0 || value.length === 0) return path;
-	return `${path}?${key}=${encodeURIComponent(value)}`;
-}
-/**
-* The admin path (with its query) a system event taps through to, or `null`
-* when the kind has no action.
-*
-* Exported for the cross-package guard and for tests that want the path
-* without a base; the dispatcher goes through {@link systemEventTapUrl}.
-*/
-function systemEventTapPath(subject) {
-	const sectionPath = subject.summarySection !== void 0 ? SUMMARY_SECTION_PATHS[subject.summarySection] : void 0;
-	if (sectionPath !== void 0) return sectionPath;
-	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
-	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
-	if (DEVICE_STREAM_KINDS.has(subject.kind)) {
-		const deviceId = subject.deviceId;
-		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
-		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
-		return CAMERA_BY_CONSTRUCTION_KINDS.has(subject.kind) || subject.deviceType === CAMERA_DEVICE_TYPE ? withParam(devicePath, TAB_PARAM, STREAM_BROKER_TAB) : devicePath;
-	}
-	return null;
-}
-/** Full URL, or `null` when the kind has no action or no base is reachable. */
-function systemEventTapUrl(subject, baseUrl) {
-	if (baseUrl === null || baseUrl.length === 0) return null;
-	const path = systemEventTapPath(subject);
-	if (path === null) return null;
-	return `${baseUrl.replace(/\/+$/, "")}${path}`;
-}
-//#endregion
-//#region src/notification-center/default-tap-url.ts
-/**
-* The app-link choice from the flagged notification address — present when
-* the effective address is the app link. Reads the answer through
-* `viewerLinkBaseOf`, the same reading the Network page's preview uses.
-*/
-function ncAppLinkChoiceOf(endpoint) {
-	const base = require_clip_model_registry.viewerLinkBaseOf(endpoint);
-	return base.form === "app" ? { hubBaseUrl: base.hubBaseUrl } : null;
-}
-/**
-* The tap URL, or null. In the app form a camera link is minted even with no
-* `hub=` — the central page reaches the hub through the app's (or the
-* browser's) own stored hub (central-link design §5). The hub form and every
-* admin destination still need a base.
-*/
-function defaultTapUrl(input) {
-	const baseUrl = input.baseUrl === null || input.baseUrl.length === 0 ? null : input.baseUrl;
-	if (input.systemEvent !== void 0) return baseUrl === null ? null : systemEventTapUrl(input.systemEvent, baseUrl);
-	const destination = {
-		kind: "camera",
-		deviceId: input.deviceId,
-		atMs: input.timestampMs
-	};
-	return input.appLink !== void 0 ? require_clip_model_registry.buildViewerLink({
-		base: {
-			form: "app",
-			hubBaseUrl: input.appLink.hubBaseUrl
-		},
-		destination
-	}) : require_clip_model_registry.buildViewerLink({
-		base: {
-			form: "hub",
-			hubBaseUrl: baseUrl
-		},
-		destination
-	});
-}
-//#endregion
 //#region src/notification-center/prune-windows.ts
 /**
 * The operator-configurable prune windows, in days. One module, because the
@@ -14941,7 +14868,8 @@ var NcGroupMemberFateSchema = require_clip_model_registry.union([require_clip_mo
 	"already-existed",
 	"close-failed",
 	"alarm-entry-delay-started",
-	"alarm-entry-delay"
+	"alarm-entry-delay",
+	"alarm-sensor-excluded"
 ]), require_clip_model_registry.templateLiteral(["failed-condition:", require_clip_model_registry.string()])]);
 /** Read cap, so a client cannot ask for the whole ring in one call. */
 var MAX_QUERY_LIMIT = 200;
@@ -23060,6 +22988,143 @@ function withSummaryBody(rule, section) {
 	};
 }
 //#endregion
+//#region src/notification-center/system-event-tap-url.ts
+/** The admin UI's own routes, as `packages/addon-admin-ui/src/App.tsx` declares them. */
+var ADMIN_ADDONS_PATH = "/system/addons";
+var ADMIN_CLUSTER_PATH = "/system/cluster";
+var ADMIN_DEVICES_PATH = "/devices";
+/**
+* The query parameter naming a node.
+*
+* One spelling for both admin pages, mirrored by `NODE_PARAM` in
+* `packages/addon-admin-ui/src/lib/node-url-selection.ts` and pinned across
+* the two packages by `scripts/check-notification-tap-targets.ts`.
+*/
+var NODE_PARAM = "node";
+/** The device page's top-level tab parameter, read by `DeviceDetail`. */
+var TAB_PARAM = "tab";
+/** The Stream Broker tab id — a `WELL_KNOWN_TABS` member, hoisted `top-tab`. */
+var STREAM_BROKER_TAB = "stream-broker";
+/** `DeviceType.Camera`. Spelled here rather than imported so this stays a pure
+*  string map with no device-model dependency; the guard pins it. */
+var CAMERA_DEVICE_TYPE = "camera";
+/** Kinds whose action is "go and apply an ADDON update". */
+var ADDON_UPDATE_KINDS = new Set(["addon-update-available"]);
+/** Kinds whose action is "go and apply a NODE's own (`@camstack/server`) update". */
+var NODE_UPDATE_KINDS = new Set(["server-update-available", "wrapper-update-available"]);
+/**
+* Kinds whose action is "go and look at this device's stream".
+*
+* BOTH DIRECTIONS. A recovery lands on the same page as the failure it undoes,
+* because "did it really come back, and what did it do while it was gone" is
+* an action and the page that answers it is the one the down-notification
+* already opened. On 2026-08-30 the operator's phone showed "Il dispositivo
+* Videocamera sala feste è online" with `tapAction.value: null` — the same
+* camera's `device-offline` an hour earlier opened the Stream Broker tab, and
+* the recovery opened nothing, purely because `device-online` had no entry
+* here.
+*
+* The legacy `camera-*` pair is here for the same reason both are still in the
+* enum: outbox and history rows enqueued before the rename carry them, and an
+* old row is exactly the one whose action has to keep working.
+*
+* Kinds NOT here are kinds whose DOWN direction has no action either
+* (`node-online`/`node-offline`, `device-enabled`/`device-disabled`) — a
+* recovery does not earn a destination its failure was never given.
+*/
+var DEVICE_STREAM_KINDS = new Set([
+	"device-offline",
+	"device-online",
+	"stream-offline",
+	"stream-online",
+	"camera-offline",
+	"camera-online"
+]);
+/**
+* Kinds whose subject is a camera BY CONSTRUCTION, whatever the row says.
+*
+* A stream belongs to a camera and nothing else. The legacy `camera-*` pair is
+* too — that name is precisely the claim it made, and it is why the kind was
+* split into `device-*` + a `deviceTypes` condition.
+*/
+var CAMERA_BY_CONSTRUCTION_KINDS = new Set([
+	"stream-offline",
+	"stream-online",
+	"camera-offline",
+	"camera-online"
+]);
+/**
+* Where a per-section STATE SUMMARY row lands (D708). The row spans nodes, so
+* no `?node=`: the unscoped page is the honest one. A section absent here taps
+* through its kind, like any other row — a device section carries the system
+* placeholder device and gets no link, and the crash-looped addons have none
+* (their instant kind has none either).
+*
+* `nodes` is the one destination no kind gives: a node going offline has no
+* instant action, but "which nodes are in trouble" is answered by the
+* Cluster page, and the summary row is about all of them at once.
+*/
+var SUMMARY_SECTION_PATHS = {
+	nodes: ADMIN_CLUSTER_PATH,
+	"addon-updates": ADMIN_ADDONS_PATH,
+	updates: ADMIN_CLUSTER_PATH
+};
+function withParam(path, key, value) {
+	if (value === void 0 || value.length === 0) return path;
+	return `${path}?${key}=${encodeURIComponent(value)}`;
+}
+/**
+* The admin path (with its query) a system event taps through to, or `null`
+* when the kind has no action.
+*
+* Exported for the cross-package guard and for tests that want the path
+* without a base; the dispatcher goes through {@link systemEventTapUrl}.
+*/
+function systemEventTapPath(subject) {
+	const sectionPath = subject.summarySection !== void 0 ? SUMMARY_SECTION_PATHS[subject.summarySection] : void 0;
+	if (sectionPath !== void 0) return sectionPath;
+	if (ADDON_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_ADDONS_PATH, NODE_PARAM, subject.nodeId);
+	if (NODE_UPDATE_KINDS.has(subject.kind)) return withParam(ADMIN_CLUSTER_PATH, NODE_PARAM, subject.nodeId);
+	if (DEVICE_STREAM_KINDS.has(subject.kind)) {
+		const deviceId = subject.deviceId;
+		if (deviceId === void 0 || !Number.isInteger(deviceId) || deviceId <= 0) return null;
+		const devicePath = `${ADMIN_DEVICES_PATH}/${String(deviceId)}`;
+		return CAMERA_BY_CONSTRUCTION_KINDS.has(subject.kind) || subject.deviceType === CAMERA_DEVICE_TYPE ? withParam(devicePath, TAB_PARAM, STREAM_BROKER_TAB) : devicePath;
+	}
+	return null;
+}
+/** Full URL, or `null` when the kind has no action or no base is reachable. */
+function systemEventTapUrl(subject, baseUrl) {
+	if (baseUrl === null || baseUrl.length === 0) return null;
+	const path = systemEventTapPath(subject);
+	if (path === null) return null;
+	return `${baseUrl.replace(/\/+$/, "")}${path}`;
+}
+//#endregion
+//#region src/notification-center/default-tap-url.ts
+/**
+* The tap URL, or null. In the app form a camera link is minted even with no
+* `hub=` — the central page reaches the hub through the app's (or the
+* browser's) own stored hub (central-link design §5). The hub form and every
+* admin destination still need a base.
+*/
+function defaultTapUrl(input) {
+	const publicBaseUrl = input.publicBaseUrl === null || input.publicBaseUrl.length === 0 ? null : input.publicBaseUrl;
+	if (input.systemEvent !== void 0) return publicBaseUrl === null ? null : systemEventTapUrl(input.systemEvent, publicBaseUrl);
+	const destination = {
+		kind: "camera",
+		deviceId: input.deviceId,
+		atMs: input.timestampMs
+	};
+	return require_clip_model_registry.buildViewerLink({
+		base: input.tap ?? {
+			form: "hub",
+			hubBaseUrl: publicBaseUrl
+		},
+		destination
+	});
+}
+//#endregion
 //#region src/notification-center/footage-source.ts
 /**
 * Decide where this window must be cut from. Pure and total.
@@ -25557,20 +25622,19 @@ var NcDispatcher = class {
 	* repo keeps paying for.
 	*/
 	/**
-	* The app-link half of a viewer tap (D709), as a spreadable fragment. A
-	* failing read falls back to the hub form — the tap every notification had
-	* before D709, which still opens — and is logged, so a tap that lands on the
-	* hub instead of the app has a line saying why.
+	* The `notificationTaps` base of a camera tap (D734). A failing read is
+	* `null` — the tap then opens the hub viewer on the public endpoint — and is
+	* logged, so a tap that lands somewhere other than the flagged address has a
+	* line saying why.
 	*/
-	async resolveViewerAppLink() {
-		const read = this.deps.viewerAppLink;
-		if (read === void 0) return {};
+	async resolveTapBase() {
+		const read = this.deps.tapBase;
+		if (read === void 0) return null;
 		try {
-			const choice = await read();
-			return choice === null ? {} : { appLink: choice };
+			return await read();
 		} catch (err) {
-			this.deps.logger.warn("notification link address unreadable — tap uses the hub address", { meta: { error: err instanceof Error ? err.message : String(err) } });
-			return {};
+			this.deps.logger.warn("notification tap address unreadable — tap uses the public endpoint", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return null;
 		}
 	}
 	async mintActions(entry, target) {
@@ -25664,11 +25728,12 @@ var NcDispatcher = class {
 		const resolvedMedia = await this.withArtifactUrls(entry, resolved.attachments);
 		const attachments = [...resolvedMedia.attachments, ...frozenArtifactAttachments(entry)];
 		const params = pickParams(entry.payload.params);
-		const tapUrl = params.clickUrl === void 0 && this.deps.viewerUrlBase !== void 0 ? defaultTapUrl({
+		const publicUrlBase = this.deps.publicUrlBase;
+		const tapUrl = params.clickUrl === void 0 && publicUrlBase !== void 0 ? defaultTapUrl({
 			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
 			timestampMs: subject.timestamp,
-			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
-			...systemEvent === void 0 ? await this.resolveViewerAppLink() : {},
+			publicBaseUrl: await publicUrlBase().catch(() => null),
+			tap: systemEvent === void 0 ? await this.resolveTapBase() : null,
 			...systemEvent !== void 0 ? { systemEvent: {
 				kind: systemEvent.kind,
 				...systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {},
@@ -39831,7 +39896,8 @@ var NotificationCenter = class {
 				ruleAiStats: () => ruleAiAnalyst.stats()
 			} : {},
 			releaseCooldown: (input) => this.releaseCooldown(input),
-			...deps.dispatcher.viewerUrlBase !== void 0 ? { viewerUrlBase: deps.dispatcher.viewerUrlBase } : {}
+			...deps.dispatcher.publicUrlBase !== void 0 ? { publicUrlBase: deps.dispatcher.publicUrlBase } : {},
+			...deps.dispatcher.tapBase !== void 0 ? { tapBase: deps.dispatcher.tapBase } : {}
 		});
 		this.outbox = new NcOutbox({
 			store: deps.store,
@@ -40829,7 +40895,11 @@ var NotificationCenter = class {
 		if (panel === null) return "unchanged";
 		const opening = alarmOpeningFromSensorEvent(event.kind, event.value);
 		if (opening.kind !== "reading") return "unchanged";
-		return panel.observeOpening(event.sourceDeviceId, opening.reading, event.timestamp, { deferLiftAnnouncement: true });
+		const changedAt = event.value?.["lastChangedAt"];
+		return panel.observeOpening(event.sourceDeviceId, opening.reading, event.timestamp, {
+			deferLiftAnnouncement: true,
+			...typeof changedAt === "number" ? { changedAt } : {}
+		});
 	}
 	/**
 	* "Watched again", once the event that lifted the sensor has been EVALUATED (D706).
@@ -42316,23 +42386,50 @@ var NotificationCenter = class {
 		});
 	}
 	/**
-	* Arm the attribution for a `alarm-panel.trigger` this rule is about to make,
-	* then delegate.
+	* The one actuation seam of this centre — a rule's sequence step, a granted button.
+	*
+	* A press of THIS node's panel `trigger` never reaches the actuator: with a match
+	* (`origin`) it is {@link NcAlarmPanelPort.triggerFromRule}, synchronously, the source
+	* in the call. The join is HERE rather than in the runner: the runner actuates devices
+	* generically and must not learn what an alarm is, while this class holds the panel.
 	*
-	* The join point, and it is deliberately HERE rather than in the runner: the
-	* runner actuates devices generically and must not learn what an alarm is,
-	* while this class already holds the panel. The note is placed immediately
-	* before the call it describes, so the window it is valid for is the call
-	* itself.
+	* Without a match, the press has no sensor to check against the arm's exclusions, so
+	* while the arm EXCLUDES anything it is REFUSED (fail-closed, D735): an anonymous press
+	* from this seam is exactly what sounded the siren off an excluded contact on
+	* 2026-10-07. A person's manual trigger (the panel's cap, from the UI) does not come
+	* through here and is unaffected.
 	*/
 	async actuateWithAttribution(input) {
+		const panel = this.alarmPanel;
+		if (panel !== null && input.deviceId === panel.deviceId && input.cap === ALARM_PANEL_CAP && input.method === "trigger" && this.pressLocalPanel(panel, input.origin)) return;
 		const actuate = this.deps.actuate;
 		if (actuate === void 0) throw new Error("no actuator is wired on this node");
-		const panel = this.alarmPanel;
-		if (panel !== null && input.origin !== void 0 && input.deviceId === panel.deviceId && input.cap === ALARM_PANEL_CAP && input.method === "trigger") panel.noteRuleTrigger(input.origin);
 		await actuate(input);
 	}
 	/**
+	* A press of this node's panel from the actuation seam; true when it was handled here.
+	* With a source: the panel's rule press. Without one: refused while the arm excludes any
+	* sensor — an ERROR line and a throw, so the sequence step reports failed instead of
+	* looking done. Without one and nothing excluded: false, and the press takes the cap
+	* like any manual press (there is no sensor whose exclusion it could skip).
+	*/
+	pressLocalPanel(panel, origin) {
+		if (origin !== void 0) {
+			panel.triggerFromRule(origin);
+			return true;
+		}
+		const excluded = panel.excludedDevices();
+		if (excluded.length === 0) return false;
+		this.logger.error("alarm trigger REFUSED — a rule-action press carried no source while the arm excludes sensors", {
+			tags: { deviceId: panel.deviceId },
+			meta: {
+				excluded: excluded.join(","),
+				state: panel.currentState()
+			}
+		});
+		throw new Error("alarm trigger refused: no source, and the current arm excludes sensors");
+	}
+	/**
 	* Device names from the in-process directory — no I/O, so the arm sentence
 	* can be composed on the publish path.
 	*
@@ -43220,13 +43317,9 @@ var NotificationCenter = class {
 		}
 		const origin = fireRefFor(rule, subject, kind);
 		const phase = panel.classifyRuleMatch(origin);
-		this.actuateWithAttribution({
-			deviceId: panel.deviceId,
-			cap: ALARM_PANEL_CAP,
-			method: "trigger",
-			args: {},
-			origin
-		}).catch((err) => {
+		try {
+			panel.triggerFromRule(origin);
+		} catch (err) {
 			this.logger.warn("alarm panel auto-trigger failed", {
 				tags: { deviceId: subject.deviceId },
 				meta: {
@@ -43236,7 +43329,7 @@ var NotificationCenter = class {
 					error: err instanceof Error ? err.message : String(err)
 				}
 			});
-		});
+		}
 		return phase;
 	}
 	/**
@@ -101598,9 +101691,15 @@ async function projectSensorMarkers(deps, data, timestamp) {
 *
 *  - The RECOVERY family. The Zigbee entity flaps `off → unavailable → off`
 *    (03:22:37→03:23:28, 03:56:51→03:58:19, 04:40:05→04:45:45). The HA
-*    provider drops the `unavailable` push and writes the recovery, whose
-*    `entryOpen` is still `false` and whose `lastChangedAt` is HA's fresh
-*    `last_changed`. The mirror diffs, and emits.
+*    provider dropped the `unavailable` push and wrote the recovery, whose
+*    `entryOpen` was still `false` and whose `lastChangedAt` was HA's fresh
+*    `last_changed`. The mirror diffed, and emitted. Since D735 the provider
+*    keeps the change time of a value that did not change
+*    (`addon-provider-homeassistant` `ha-change-stamp.ts`), because this gate
+*    cannot fix the ACTIVE half: with its memory empty (a hub restart), a
+*    recovery `on` with a fresh stamp is indistinguishable here from an
+*    opening — that is how four excluded contacts pressed the armed panel on
+*    2026-10-07 02:32Z.
 *  - The COLD-SLICE family. `HaBinarySensorDevice`'s constructor writes
 *    `{ entryOpen: false, lastChangedAt: 0 }` on every device rebuild; the
 *    real state lands seconds later with a `lastChangedAt` hours old. Two
@@ -106690,51 +106789,17 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 			};
 		}
 	}
-	/** The operator's marked notification endpoint, or null (AUTO / unavailable). */
-	async markedNotificationEndpoint() {
-		try {
-			return (await this.ctx.api.localNetwork.getNotificationEndpoint.query()).baseUrl ?? void 0;
-		} catch {
-			return;
-		}
-	}
 	/**
-	* The ranked base-URL candidates a notification LINK may use.
+	* The ranked base-URL candidates a notification LINK may use — every link
+	* except the tap: the hub's public endpoint (D734, `link-endpoints.ts`).
 	*
-	* Shared by the artifact plane (media) and the action plane (buttons) — one
-	* resolver, because a second copy would drift and the two would start
-	* minting links on different hosts for the same notification.
+	* Shared by the artifact plane (media), the action plane (buttons) and the
+	* admin page a system event taps into — one resolver, because a second copy
+	* would drift and the planes would start minting links on different hosts
+	* for the same notification.
 	*/
 	async ncEndpoints() {
-		return collectArtifactEndpoints({
-			markedBaseUrl: await this.markedNotificationEndpoint(),
-			getConnected: async () => {
-				const status = await this.ctx.api.networkAccess.getStatus.query();
-				this.ctx.logger.debug("artifact base-url: connected ingress", { meta: {
-					connected: status.connected,
-					url: status.endpoint?.url ?? null,
-					protocol: status.endpoint?.protocol ?? null
-				} });
-				return status.connected && status.endpoint !== null ? {
-					url: status.endpoint.url,
-					protocol: status.endpoint.protocol
-				} : null;
-			},
-			listExternal: async () => {
-				return (await this.ctx.api.networkAccess.listEndpoints.query()).map((e) => ({
-					url: e.url,
-					protocol: e.protocol
-				}));
-			},
-			listLan: async (port) => {
-				return (await this.ctx.api.localNetwork.getConnectionEndpoints.query({ port })).endpoints.flatMap((e) => e.kind === "app-link" ? [] : [{
-					baseUrl: e.baseUrl,
-					kind: e.kind,
-					priority: e.priority
-				}]);
-			},
-			logger: this.ctx.logger
-		});
+		return notificationLinkEndpoints(this.ctx.api, this.ctx.logger);
 	}
 	/**
 	* Serve the NC ACTION plane: the public route a notification button lands on.
@@ -109320,8 +109385,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_clip_m
 					resolveFfmpeg: () => this.ctx.deps.ensureFfmpeg()
 				}), req),
 				publishArtifact: async (bytes, mime, deviceId) => await this.ncArtifactPlane?.publish(bytes, mime, deviceId) ?? null,
-				viewerUrlBase: async () => pickArtifactBaseUrl(await this.ncEndpoints()),
-				viewerAppLink: async () => ncAppLinkChoiceOf(await this.ctx.api.localNetwork.getNotificationEndpoint.query()),
+				publicUrlBase: async () => pickArtifactBaseUrl(await this.ncEndpoints()),
+				tapBase: async () => require_clip_model_registry.viewerLinkBaseOf(await this.ctx.api.localNetwork.getNotificationEndpoint.query()),
 				indexArtifact: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? {
 					url: null,
 					artifactId: null