@camstack/addon-post-analysis 1.2.69 → 1.2.71

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BF27UAVH.js");
+const require_dist = require("../dist-DjPaVd2L.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -344,6 +344,22 @@ function stateAt(m, now) {
 	if (m.armedAt !== void 0) return now >= m.armedAt ? m.target : "arming";
 	return m.target;
 }
+/**
+* The exit delay running at `now`, or `undefined` when none is.
+*
+* Gated on `stateAt`, not on `armedAt` alone: the instant survives on the
+* machine after the delay is over (until a settle drops it) and after a trigger
+* has opened a DIFFERENT countdown, and either would announce a countdown for a
+* panel that is already armed or already about to go off.
+*/
+function exitDelayAt(m, now) {
+	if (m.armedAt === void 0) return void 0;
+	if (stateAt(m, now) !== "arming") return void 0;
+	return {
+		target: m.target,
+		armedAt: m.armedAt
+	};
+}
 /** Whether the panel is armed enough for a trigger to matter. */
 function isArmed(m, now) {
 	const s = stateAt(m, now);
@@ -524,7 +540,29 @@ function skippedFor(deviceIds, skipProbe) {
 	return out;
 }
 /**
-* "Away armed — 3 cameras: Front door, Garage, Gate."
+* Whether this mode arms anything, and if not, which way it fails.
+*
+* An `allDevices` mode is never a gap: `skippedDevices` only ever probes the
+* ids a rule wrote down, so it cannot answer for a mode that covers every
+* camera on the hub, and reporting "all excluded" from a subset would be a
+* warning about protection that exists.
+*/
+function alarmCoverageGap(coverage) {
+	if (coverage.ruleCount === 0) return "uncovered";
+	if (coverage.allDevices) return null;
+	if (coverage.deviceIds.length === 0) return null;
+	if (coverage.skippedDevices.length < coverage.deviceIds.length) return null;
+	return "all-skipped";
+}
+/**
+* "Attivi: Cancello, Garage — Esclusi: Porta retro."
+*
+* A LIST, not a sentence. The mode is in the title and the body is one
+* `Label: names` line per device group, because this is read on a lock screen
+* and the question is always "which one" — the prose version ("3 dispositivi
+* attivi: …. Esclusi: ….") made the operator parse a paragraph to find a
+* window. Each variant still owns its own catalog key, so the Texts tab can
+* re-word "nothing is armed" without touching "these are armed".
 *
 * Names, not ids: this is read by a person standing at a door. An id that has
 * no name falls back to a NAMED, translated placeholder rather than being
@@ -532,14 +570,36 @@ function skippedFor(deviceIds, skipProbe) {
 * the one error this message must not make. (It used to hard-code the English
 * `Device <id>` into both languages.)
 *
-* Returns null when NO rule is gated on the mode. A notification saying "Night
-* armed" that is followed by nothing happening all night is worse than no
-* notification: it is a false assurance. The caller still logs the arm.
+* **Always a sentence.** It used to return null for a mode no rule is gated on,
+* on the grounds that "Night armed" followed by an unwatched night is a false
+* assurance — true, but the caller then emitted `alarm-armed` anyway with a
+* fallback body key that existed in NEITHER locale, so the operator received a
+* title and an empty line. Silence is not the third option here: SAYING that
+* the mode arms nothing is.
 */
-function buildArmAnnouncement(coverage, deviceName) {
-	if (coverage.ruleCount === 0) return null;
+function buildArmAnnouncement(coverage, deviceName, bypassed = []) {
 	const rules = `${coverage.ruleCount}`;
 	const mode = coverage.mode;
+	if (bypassed.length > 0) return armedWithBypass(coverage, bypassed, deviceName);
+	const gap = alarmCoverageGap(coverage);
+	if (gap === "uncovered") return {
+		bodyKey: "alarm.arm.body.uncovered",
+		textParams: { mode },
+		textCount: 0
+	};
+	if (gap === "all-skipped") {
+		const names = coverage.skippedDevices.map((s) => deviceName(s.deviceId));
+		return {
+			bodyKey: "alarm.arm.body.allSkipped",
+			textParams: {
+				rules,
+				mode,
+				devices: `${names.length}`,
+				names: names.join(", ")
+			},
+			textCount: names.length
+		};
+	}
 	if (coverage.allDevices) return {
 		bodyKey: "alarm.arm.body.allDevices",
 		textParams: {
@@ -556,8 +616,9 @@ function buildArmAnnouncement(coverage, deviceName) {
 		},
 		textCount: coverage.ruleCount
 	};
-	const names = coverage.deviceIds.map(deviceName);
-	return {
+	const skipped = new Set(coverage.skippedDevices.map((s) => s.deviceId));
+	const names = coverage.deviceIds.filter((id) => !skipped.has(id)).map(deviceName);
+	if (skipped.size === 0) return {
 		bodyKey: "alarm.arm.body.devices",
 		textParams: {
 			rules,
@@ -567,7 +628,336 @@ function buildArmAnnouncement(coverage, deviceName) {
 		},
 		textCount: names.length
 	};
+	return {
+		bodyKey: "alarm.arm.body.devicesSkipped",
+		textParams: {
+			rules,
+			mode,
+			devices: `${names.length}`,
+			names: names.join(", "),
+			skippedNames: coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ")
+		},
+		textCount: names.length
+	};
+}
+/**
+* "Attivi: 2 — Bypassati: Finestra veranda."
+*
+* The bypassed sensors are named and the armed ones are COUNTED, not listed:
+* this sentence's subject is the exception, and burying it under thirteen
+* camera names is how an operator stops reading the arm notification. The
+* count pluralises on what IS armed, like every other arm variant.
+*/
+function armedWithBypass(coverage, bypassed, deviceName) {
+	const skipped = new Set(coverage.skippedDevices.map((s) => s.deviceId));
+	const excluded = new Set(bypassed);
+	const armed = coverage.allDevices ? coverage.ruleCount : coverage.deviceIds.filter((id) => !skipped.has(id) && !excluded.has(id)).length;
+	return {
+		bodyKey: "alarm.arm.body.bypassed",
+		textParams: {
+			rules: `${coverage.ruleCount}`,
+			mode: coverage.mode,
+			devices: `${armed}`,
+			bypassedNames: bypassed.map(deviceName).join(", ")
+		},
+		textCount: armed
+	};
+}
+/**
+* "Aperti: Finestra veranda, Porta retro" + how to arm anyway.
+*
+* The one alarm sentence about something that did not happen, so it has to
+* carry both halves an operator needs to act: WHICH sensors are open, and that
+* pressing arm again arms without them. Naming them is the whole message — a
+* refusal that says only "cannot arm" is a panel the operator will conclude is
+* broken — so the names are the FIRST line and the retry hint is the second.
+*/
+function buildArmRefusedAnnouncement(mode, names, retrySeconds) {
+	return {
+		bodyKey: "alarm.armRefused.body",
+		textParams: {
+			mode,
+			devices: `${names.length}`,
+			names: names.join(", "),
+			seconds: `${retrySeconds}`
+		},
+		textCount: names.length
+	};
+}
+/**
+* The EXCEPTIONS to the same coverage, said 30 seconds earlier.
+*
+* The exit-delay sentence is deliberately SHORTER than the arm one — it is read
+* on the way out of a door — and it carries exactly one thing the arm sentence
+* cannot: the warning arrives while the operator can still disarm and fix it.
+* A mode that arms nothing is worth interrupting somebody for at second 0 and
+* merely worth recording at second 30.
+*
+* **It never repeats the device list.** The countdown lives in the TITLE
+* (`system.alarm-arming.title.<mode>` renders `{{seconds}}`), and the armed
+* list arrives thirty seconds later in the arm announcement — printing it
+* twice is the verbosity that made the operator stop reading both. So the body
+* is what is WRONG: what was bypassed, what is excluded, or that nothing is.
+*
+* `seconds` stays in the params because the title asks for it, and `textCount`
+* stays with it: a row enqueued before this deploy still pluralises on the
+* countdown it was written for.
+*/
+function buildArmingAnnouncement(coverage, seconds, deviceName, bypassed = []) {
+	const textParams = {
+		mode: coverage.mode,
+		seconds: `${seconds}`
+	};
+	if (bypassed.length > 0) return {
+		bodyKey: "alarm.arming.body.bypassed",
+		textParams: {
+			...textParams,
+			bypassedNames: bypassed.map(deviceName).join(", ")
+		},
+		textCount: seconds
+	};
+	const skippedNames = coverage.skippedDevices.map((s) => deviceName(s.deviceId)).join(", ");
+	const gap = alarmCoverageGap(coverage);
+	if (gap === "uncovered") return {
+		bodyKey: "alarm.arming.body.uncovered",
+		textParams,
+		textCount: seconds
+	};
+	if (gap === "all-skipped") return {
+		bodyKey: "alarm.arming.body.allSkipped",
+		textParams: {
+			...textParams,
+			names: skippedNames
+		},
+		textCount: seconds
+	};
+	if (coverage.skippedDevices.length > 0) return {
+		bodyKey: "alarm.arming.body.skipped",
+		textParams: {
+			...textParams,
+			names: skippedNames
+		},
+		textCount: coverage.skippedDevices.length
+	};
+	return {
+		bodyKey: "alarm.arming.body",
+		textParams,
+		textCount: seconds
+	};
 }
+//#endregion
+//#region src/notification-center/alarm/alarm-arm-guard.ts
+/**
+* How long a refusal stays confirmable.
+*
+* Long enough to read the notification and press again (the operator is
+* standing at the door, phone in hand); short enough that it cannot be the
+* state the panel is left in. Sixty seconds is also under the shortest exit
+* delay this panel ships with, so a bypass can never outlive the arm it
+* belongs to.
+*/
+var ARM_BYPASS_WINDOW_MS = 6e4;
+/** The taxonomy kind a door/window contact persists its events under. */
+var CONTACT_SENSOR_KIND = "contact";
+/**
+* The contact sensors a mode would arm, ascending and de-duplicated.
+*
+* A rule qualifies only when it is enabled, gated on THIS panel in THIS mode,
+* and about contacts (`sensorKinds` naming `contact`). Two exclusions are
+* deliberate and both are about refusing an arm the operator cannot fix:
+*
+*  - a rule that names CAMERAS (`Intrusione — Fuori casa` names thirteen) is
+*    not a contact rule, and a camera is never open;
+*  - a contact rule with NO device scope covers every contact on the hub, and
+*    blocking on a set the operator never wrote down produces a refusal naming
+*    devices they never associated with the alarm. The caller says so in a log
+*    line rather than inventing the list.
+*/
+function alarmBlockingCandidates(rules, panelDeviceId, mode) {
+	const wanted = armedStateFor(mode);
+	const ids = /* @__PURE__ */ new Set();
+	for (const rule of rules) {
+		if (!rule.enabled) continue;
+		const gate = rule.conditions.deviceState;
+		if (gate === void 0 || gate.deviceId !== panelDeviceId) continue;
+		if (!gate.states.includes(wanted)) continue;
+		const kinds = rule.conditions.sensorKinds;
+		if (kinds === void 0 || !kinds.includes(CONTACT_SENSOR_KIND)) continue;
+		const scope = rule.conditions.devices;
+		if (scope === void 0 || scope.length === 0) continue;
+		for (const id of scope) ids.add(id);
+	}
+	return [...ids].toSorted((a, b) => a - b);
+}
+/**
+* Every contact any mode of this panel could block on — the set whose state is
+* worth keeping mirrored.
+*
+* Read on the rule-reload tick, so the arm path has a recent answer even when
+* the targeted read at arm time fails, and so an excluded sensor's close can be
+* noticed on a hub where the sensor is linked to no camera (and therefore emits
+* no device event at all — the live installation on 2026-08-13).
+*/
+function alarmContactWatchList(rules, panelDeviceId, modes) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const mode of modes) for (const id of alarmBlockingCandidates(rules, panelDeviceId, mode)) ids.add(id);
+	return [...ids].toSorted((a, b) => a - b);
+}
+/**
+* Refuse, bypass or proceed — the whole decision, as one comparison.
+*
+* The bypass requires the SAME mode. "Arm home" refused and "arm away" pressed
+* is a different intent about a different set of sensors, and letting one
+* confirm the other would arm a mode around a window nobody was told about.
+*
+* The bypassed set is what is open NOW, not what was open at the refusal: a
+* window shut between the two presses is armed with everything else, which is
+* the entire point of having refused.
+*/
+function decideArm(input) {
+	const window = input.windowMs ?? 6e4;
+	if (input.openContacts.length === 0) return { kind: "clear" };
+	const previous = input.previous;
+	if (previous !== null && previous.mode === input.mode && input.at - previous.at <= window) return {
+		kind: "bypassed",
+		bypassed: input.openContacts
+	};
+	return {
+		kind: "refused",
+		blocking: input.openContacts,
+		retryUntil: input.at + window
+	};
+}
+/**
+* The error `alarmPanel.arm` throws when it refuses.
+*
+* A THROW and not a return value, and the reason is a train: the hub's
+* generated router validates this method's response against the HOST's copy of
+* the cap, which says `z.void()`. An addon that answered a structured refusal
+* would have it rejected by the router in front of it — so the refusal reaches
+* the caller as the one channel that already works across that boundary, and
+* the operator's PHONE gets the sentence (`alarm-arm-refused`, through the
+* ordinary outbox) rather than a UI error being the only trace.
+*
+* The message is deliberately actionable and English (an exception message is
+* a developer/API surface; the notification is the operator's).
+*/
+var NcAlarmArmRefusedError = class extends Error {
+	code = "alarm-arm-refused";
+	mode;
+	blocking;
+	retryUntil;
+	constructor(input) {
+		const names = input.blocking.map((c) => c.name).join(", ");
+		const seconds = Math.round((input.windowMs ?? 6e4) / 1e3);
+		super(`arm refused — open: ${names}. Arm ${input.mode} again within ${String(seconds)}s to arm with them excluded.`);
+		this.name = "NcAlarmArmRefusedError";
+		this.mode = input.mode;
+		this.blocking = input.blocking;
+		this.retryUntil = input.retryUntil;
+	}
+};
+//#endregion
+//#region src/notification-center/alarm/alarm-exclusions.ts
+function isPhase(value) {
+	return value === "open" || value === "closed";
+}
+var NcAlarmExclusions = class {
+	entries = [];
+	/** Replace the whole set — one arm, one set of exclusions. */
+	exclude(deviceIds, at) {
+		this.entries = [...new Set(deviceIds)].map((deviceId) => ({
+			deviceId,
+			phase: "open",
+			at
+		}));
+	}
+	/** Every excluded sensor, in the order it was excluded. */
+	list() {
+		return this.entries.map((e) => e.deviceId);
+	}
+	/** True while this sensor's events must not reach the panel. */
+	blocks(deviceId) {
+		return this.entries.some((e) => e.deviceId === deviceId);
+	}
+	/**
+	* Feed one contact reading, and say what it CHANGED.
+	*
+	* Three answers, not two, because the caller has to persist on both of the
+	* changes: the first `alarm-arm-refusal.spec.ts` run of this feature saved
+	* only the re-arm, so a hub redeployed between the close and the re-open came
+	* back with the sensor still in phase `open` — and the exclusion then needed
+	* a SECOND close to lift. A phase that lives only in RAM is half a durable
+	* exclusion.
+	*
+	* An unreadable state changes nothing (D49): a failed read must never lift an
+	* exclusion the operator asked for, and must never swallow the close that
+	* would have.
+	*/
+	observe(deviceId, reading, _at) {
+		if (reading === void 0) return "unchanged";
+		const current = this.entries.find((e) => e.deviceId === deviceId);
+		if (current === void 0) return "unchanged";
+		if (reading === "closed") {
+			if (current.phase === "closed") return "unchanged";
+			this.entries = this.entries.map((e) => e.deviceId === deviceId ? {
+				...e,
+				phase: "closed"
+			} : e);
+			return "closed";
+		}
+		if (current.phase === "open") return "unchanged";
+		this.entries = this.entries.filter((e) => e.deviceId !== deviceId);
+		return "rearmed";
+	}
+	/** The arm this belongs to is over. */
+	clear() {
+		this.entries = [];
+	}
+	/** What to persist. Plain data — it rides the panel's config blob. */
+	snapshot() {
+		return this.entries.map((e) => ({
+			deviceId: e.deviceId,
+			phase: e.phase,
+			at: e.at
+		}));
+	}
+	/**
+	* Rebuild from the persisted blob — a GUARD, never a cast.
+	*
+	* Anything unrecognised restores NOTHING, which is the failure that shows
+	* itself (a bypassed sensor that fires) rather than the one that hides (a
+	* sensor excluded forever by a blob nobody can read). A bare id with no phase
+	* restores as still-OPEN: it needs a close before it can re-arm, which is the
+	* half that cannot cause a false alarm.
+	*/
+	restore(raw) {
+		if (!Array.isArray(raw)) return;
+		const out = [];
+		for (const item of raw) {
+			if (typeof item === "number" && Number.isInteger(item)) {
+				out.push({
+					deviceId: item,
+					phase: "open",
+					at: 0
+				});
+				continue;
+			}
+			if (item === null || typeof item !== "object") continue;
+			const rec = { ...item };
+			const deviceId = rec["deviceId"];
+			if (typeof deviceId !== "number" || !Number.isInteger(deviceId)) continue;
+			const phase = isPhase(rec["phase"]) ? rec["phase"] : "open";
+			const at = typeof rec["at"] === "number" ? rec["at"] : 0;
+			out.push({
+				deviceId,
+				phase,
+				at
+			});
+		}
+		this.entries = out;
+	}
+};
 /**
 * WHO the panel's current countdown belongs to.
 *
@@ -591,6 +981,26 @@ var NcAlarmAttribution = class {
 		};
 	}
 	/**
+	* The note that has not been claimed yet — WITHOUT consuming it.
+	*
+	* The panel has to know which SENSOR is about to set the alarm off before it
+	* decides whether to accept the trigger at all (an excluded contact does
+	* not), and asking must not spend the note: a trigger that is accepted still
+	* needs it to build the combined notification. Expired reads as absent, on
+	* the same bound {@link claim} uses.
+	*/
+	pending(now) {
+		const noted = this.noted;
+		if (noted === null) return null;
+		if (now - noted.at > 3e4) return null;
+		return noted.source;
+	}
+	/** Throw the un-claimed note away — the trigger it described was REFUSED, and
+	*  a note left behind would be inherited by the next real one. */
+	dropPending() {
+		this.noted = null;
+	}
+	/**
 	* Called by an ACCEPTED trigger, and by every accepted trigger — including
 	* one with no note, so a manual trigger clears whatever a rule left behind
 	* rather than inheriting it.
@@ -645,6 +1055,7 @@ function alarmTransition(input) {
 		at,
 		...input.source !== void 0 ? { source: input.source } : {}
 	};
+	if (next === "arming") return armingTransition(previous, input);
 	if (shouldAnnounceArm(previous, next)) {
 		const mode = armModeOf(next, input.modes);
 		if (mode === null) return null;
@@ -664,6 +1075,29 @@ function alarmTransition(input) {
 	};
 	return null;
 }
+/**
+* The exit delay, as one notification at its START.
+*
+* Reached only from a state CHANGE into `arming`, so the once-a-second
+* re-publish is already excluded by the caller's `previous === next` guard —
+* the countdown is one notification, not thirty. Null when the panel did not
+* say what it is arming into, or named a mode it does not offer: both would
+* produce a message with no title and no number in it.
+*/
+function armingTransition(previous, input) {
+	const arming = input.arming;
+	if (arming === void 0) return null;
+	const mode = armModeOf(arming.target, input.modes);
+	if (mode === null) return null;
+	return {
+		kind: "alarm-arming",
+		state: "arming",
+		previous,
+		mode,
+		seconds: Math.max(0, Math.ceil((arming.armedAt - input.at) / 1e3)),
+		at: input.at
+	};
+}
 //#endregion
 //#region src/notification-center/alarm/alarm-panel-device.ts
 /**
@@ -710,7 +1144,17 @@ var ncAlarmPanelSchema = require_dist.object({
 	announceArm: require_dist.boolean().default(false),
 	/** Target ids that announcement goes to — see `NcAlarmSettingsSchema`. */
 	announceTargets: require_dist.array(require_dist.string()).default([]),
-	machine: require_dist.record(require_dist.string(), require_dist.unknown()).optional()
+	machine: require_dist.record(require_dist.string(), require_dist.unknown()).optional(),
+	/**
+	* Sensors the CURRENT arm is ignoring because they were open when the
+	* operator confirmed it, and how far each is through its two-phase lift.
+	*
+	* Persisted for the same reason the machine is: a deploy in the middle of an
+	* armed night would otherwise silently re-arm every sensor the operator
+	* agreed to leave out, and they would learn about it from the siren. Read
+	* back through a guard, never a cast — see `NcAlarmExclusions.restore`.
+	*/
+	exclusions: require_dist.array(require_dist.unknown()).default([])
 });
 /** `armed_home` and friends — the only targets a machine may settle into. */
 function isArmTarget(value) {
@@ -760,6 +1204,19 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 	lastPublished = null;
 	/** WHO the current countdown belongs to — see {@link NcAlarmAttribution}. */
 	attribution = new NcAlarmAttribution();
+	/** Sensors this arm is ignoring — see {@link NcAlarmExclusions}. */
+	exclusions = new NcAlarmExclusions();
+	/** Who answers "is anything open" — null until the centre wires itself in. */
+	armGuard = null;
+	/**
+	* The arm attempt that was REFUSED, and is therefore confirmable.
+	*
+	* In RAM and only in RAM, deliberately: it is a confirmation of something the
+	* operator read seconds ago, and a confirmation that survived a restart would
+	* let a process respawn arm the alarm around an open window nobody re-read.
+	* Losing it costs one extra press.
+	*/
+	lastRefusal = null;
 	constructor(ctx) {
 		super(ctx, ncAlarmPanelSchema, { type: ctx.deviceMeta.type });
 		this.delays = this.readDelays();
@@ -817,26 +1274,164 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 	currentState(now = Date.now()) {
 		return stateAt(this.machine, now);
 	}
+	/** Wire the open-contact check and the refusal announcement. */
+	setArmGuard(hook) {
+		this.armGuard = hook;
+	}
+	/**
+	* Sensors the current arm is ignoring — what the armed/arming sentence names
+	* as excluded, and the only place that list is published.
+	*/
+	excludedDevices() {
+		return this.exclusions.list();
+	}
+	/**
+	* One contact reading, from whoever saw it — the sensor's own event, or the
+	* centre's reconcile tick.
+	*
+	* The lift is two-phase (`alarm-exclusions.ts`), so this is safe to call with
+	* the same reading repeatedly, and an unreadable state changes nothing. Fed
+	* BEFORE the event that carried it is evaluated, so the open that re-arms a
+	* sensor is already lifted when the rule it fires reaches the panel.
+	*/
+	observeContact(deviceId, reading, now = Date.now()) {
+		const change = this.exclusions.observe(deviceId, reading, now);
+		if (change === "unchanged") return;
+		this.persist();
+		if (change === "closed") return;
+		this.ctx.logger.info("alarm exclusion lifted — the sensor closed and opened again", {
+			tags: { deviceId },
+			meta: {
+				panelDeviceId: this.id,
+				remaining: this.exclusions.list().length
+			}
+		});
+	}
 	/** Stop the countdown when the device goes away. The state itself is
 	*  persisted, so nothing is lost — only the announcements stop. */
 	stopCountdown() {
 		this.stopTicking();
 	}
+	/**
+	* Refuse the arm, bypass around it, or let it through — and leave the
+	* exclusions the arm will run with.
+	*
+	* Fail-OPEN by construction, in three places, and each one is a decision:
+	*
+	*  - no guard wired (an agent node, a boot pass before the centre exists) ⇒
+	*    arm. A panel that cannot ask must not refuse.
+	*  - the guard threw ⇒ arm, and SAY so. Refusing on a failed read would tell
+	*    the operator to go and shut a window that is already shut (the coverage
+	*    derivation makes the same choice: an unreadable authority answers
+	*    "unknown", never "excluded").
+	*  - nothing reads open ⇒ arm clean, and any exclusion a previous arm left
+	*    is dropped.
+	*
+	* The refusal throws. See {@link NcAlarmArmRefusedError} for why that is the
+	* channel rather than a return value.
+	*/
+	async applyArmGuard(mode, now) {
+		const guard = this.armGuard;
+		if (guard === null) return;
+		let openContacts;
+		try {
+			openContacts = await guard.openContacts(mode);
+		} catch (err) {
+			this.ctx.logger.warn("alarm arm guard could not read the contacts — arming anyway", {
+				tags: { deviceId: this.id },
+				meta: {
+					mode,
+					error: String(err)
+				}
+			});
+			return;
+		}
+		const verdict = decideArm({
+			mode,
+			openContacts,
+			previous: this.lastRefusal,
+			at: now
+		});
+		if (verdict.kind === "clear") {
+			this.lastRefusal = null;
+			if (this.exclusions.list().length > 0) {
+				this.exclusions.clear();
+				this.persist();
+			}
+			return;
+		}
+		if (verdict.kind === "bypassed") {
+			this.lastRefusal = null;
+			this.exclusions.exclude(verdict.bypassed.map((c) => c.deviceId), now);
+			this.persist();
+			for (const contact of verdict.bypassed) this.ctx.logger.info("alarm armed with an open sensor excluded", {
+				tags: { deviceId: contact.deviceId },
+				meta: {
+					panelDeviceId: this.id,
+					mode,
+					name: contact.name
+				}
+			});
+			return;
+		}
+		this.lastRefusal = {
+			mode,
+			at: now
+		};
+		for (const contact of verdict.blocking) this.ctx.logger.warn("alarm arm REFUSED — this sensor is open", {
+			tags: { deviceId: contact.deviceId },
+			meta: {
+				panelDeviceId: this.id,
+				mode,
+				name: contact.name
+			}
+		});
+		guard.announceRefusal({
+			mode,
+			blocking: verdict.blocking,
+			retrySeconds: Math.round(ARM_BYPASS_WINDOW_MS / 1e3),
+			at: now
+		});
+		throw new NcAlarmArmRefusedError({
+			mode,
+			blocking: verdict.blocking,
+			retryUntil: verdict.retryUntil
+		});
+	}
 	registerAlarmCap() {
 		this.ctx.registerNativeCap(require_dist.alarmPanelCapability, {
 			getStatus: async () => this.status(),
 			arm: async ({ mode }) => {
-				this.machine = arm(mode, this.delays, Date.now());
+				const now = Date.now();
+				await this.applyArmGuard(mode, now);
+				this.machine = arm(mode, this.delays, now);
 				this.attribution.clear();
-				this.publish();
+				this.publish(now);
 			},
 			disarm: async () => {
 				this.machine = disarm(Date.now());
 				this.attribution.clear();
+				this.exclusions.clear();
+				this.lastRefusal = null;
 				this.publish();
 			},
 			trigger: async () => {
 				const now = Date.now();
+				const pending = this.attribution.pending(now);
+				const source = pending?.sourceDeviceId;
+				if (source !== void 0 && this.exclusions.blocks(source)) {
+					this.attribution.dropPending();
+					this.ctx.logger.info("alarm trigger ignored — the sensor was open when the alarm was armed", {
+						tags: { deviceId: source },
+						meta: {
+							panelDeviceId: this.id,
+							ruleId: pending?.ruleId,
+							rule: pending?.ruleName,
+							state: stateAt(this.machine, now)
+						}
+					});
+					return;
+				}
 				const next = trigger(this.machine, this.delays, now);
 				if (next === this.machine) {
 					this.ctx.logger.info("alarm trigger ignored — the panel is not armed", {
@@ -896,12 +1491,14 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		const hook = this.onPublish;
 		if (hook === null) return;
 		const source = this.attribution.current();
+		const arming = exitDelayAt(this.machine, now);
 		const transition = alarmTransition({
 			previous,
 			next: state,
 			modes: NC_ALARM_MODES,
 			at: now,
-			...source !== null ? { source } : {}
+			...source !== null ? { source } : {},
+			...arming !== void 0 ? { arming } : {}
 		});
 		if (transition?.kind === "alarm-triggered") this.attribution.clear();
 		try {
@@ -939,11 +1536,14 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		this.ticker = null;
 	}
 	/** The machine rides the device's own config blob — it is small, and it must
-	*  survive a restart or the alarm disarms itself on every deploy. */
+	*  survive a restart or the alarm disarms itself on every deploy. The
+	*  exclusions ride with it, for the same reason and with the same lifetime. */
 	persist() {
 		this.config.set("machine", { ...this.machine });
+		this.config.set("exclusions", [...this.exclusions.snapshot()]);
 	}
 	restore() {
+		this.exclusions.restore(this.config.get("exclusions"));
 		const restored = machineFromPersisted(this.config.get("machine"));
 		if (restored === null) return;
 		this.machine = restored;
@@ -1719,10 +2319,15 @@ var MAX_ARM_BUTTONS = 3;
 *
 * | notification | buttons |
 * | --- | --- |
+* | `alarm-arming` | **Disarma**, destructive |
 * | `alarm-triggered` | **Disarma**, destructive |
 * | `alarm-armed` | **Disarma**, destructive |
 * | `alarm-disarmed` | **Arma …** per declared mode, max three |
 *
+* The `alarm-arming` row is the one that earns its keep: that notification
+* arrives at the START of the exit delay, so its Disarm is the only alarm
+* button an operator can press to cancel something rather than to undo it.
+*
 * `destructive` on the disarm is a RENDERING hint and never a gate (D47) — what
 * actually bounds it is the five-minute TTL the minter gives that grant
 * (`ALARM_DISARM_TTL_MS`). Both exist: the hint is for the person, the TTL is
@@ -3760,27 +4365,38 @@ var en_default = {
 	"snooze.scope.anyDevice": "A camera",
 	"snooze.scope.anyRule": "A rule",
 	"snooze.scope.rule": "“{{rule}}”",
-	"alarm.arm.body.allDevices": {
-		"one": "Every device is armed ({{rules}} rule).",
-		"other": "Every device is armed ({{rules}} rules)."
-	},
-	"alarm.arm.body.noDevices": {
-		"one": "{{rules}} rule, no device restriction.",
-		"other": "{{rules}} rules, no device restriction."
-	},
-	"alarm.arm.body.devices": {
-		"one": "{{devices}} device armed: {{names}}.",
-		"other": "{{devices}} devices armed: {{names}}."
-	},
+	"alarm.arm.body.allDevices": "Active: all devices",
+	"alarm.arm.body.noDevices": "Active: no device restriction",
+	"alarm.arm.body.devices": "Active: {{names}}",
+	"alarm.arm.body.devicesSkipped": "Active: {{names}}\nExcluded: {{skippedNames}}",
+	"alarm.arm.body.uncovered": "Active: none — no rule uses this mode",
+	"alarm.arm.body.allSkipped": "Active: none\nExcluded: {{names}}",
+	"alarm.arming.body": "No exclusions",
+	"alarm.arming.body.uncovered": "Active: none — no rule uses this mode",
+	"alarm.arming.body.allSkipped": "Active: none\nExcluded: {{names}}",
+	"alarm.arming.body.skipped": "Excluded: {{names}}",
+	"alarm.arm.body.bypassed": "Active: {{devices}}\nBypassed: {{bypassedNames}}",
+	"alarm.arming.body.bypassed": "Bypassed: {{bypassedNames}}",
+	"alarm.armRefused.body": "Open: {{names}}\nRepeat within {{seconds}}s to arm with bypass.",
 	"alarm.device.unnamed": "Device {{id}}",
-	"system.alarm-armed.title.home": "Home armed",
-	"system.alarm-armed.title.away": "Away armed",
-	"system.alarm-armed.title.night": "Night armed",
-	"system.alarm-disarmed.title": "Alarm disarmed",
-	"system.alarm-disarmed.body": "The alarm was disarmed",
+	"alarm.combined.title": "Alarm: {{deviceName}}",
+	"system.alarm-arm-refused.title.home": "Arming home refused",
+	"system.alarm-arm-refused.title.away": "Arming away refused",
+	"system.alarm-arm-refused.title.night": "Arming night refused",
+	"system.alarm-arm-refused.body": "Arming refused",
+	"system.alarm-arming.title.home": "Arming home — {{seconds}}s",
+	"system.alarm-arming.title.away": "Arming away — {{seconds}}s",
+	"system.alarm-arming.title.night": "Arming night — {{seconds}}s",
+	"system.alarm-arming.body": "Arming",
+	"system.alarm-armed.title.home": "Armed: home",
+	"system.alarm-armed.title.away": "Armed: away",
+	"system.alarm-armed.title.night": "Armed: night",
+	"system.alarm-armed.body": "Alarm armed",
+	"system.alarm-disarmed.title": "Disarmed",
+	"system.alarm-disarmed.body": "Alarm disarmed",
 	"system.alarm-triggered.title": "ALARM",
-	"system.alarm-triggered.body": "The alarm was triggered",
-	"system.alarm-triggered.body.rule": "The alarm was triggered by {{rule}} on {{deviceName}}",
+	"system.alarm-triggered.body": "Alarm triggered",
+	"system.alarm-triggered.body.rule": "Triggered by {{rule}} on {{deviceName}}",
 	"button.snooze.minutes": "Snooze {{minutes}} min",
 	"button.snooze.hours": {
 		"one": "Snooze {{hours}} hour",
@@ -3912,27 +4528,38 @@ var it_default = {
 	"snooze.scope.anyDevice": "Una camera",
 	"snooze.scope.anyRule": "Una regola",
 	"snooze.scope.rule": "“{{rule}}”",
-	"alarm.arm.body.allDevices": {
-		"one": "Ogni dispositivo è attivo ({{rules}} regola).",
-		"other": "Ogni dispositivo è attivo ({{rules}} regole)."
-	},
-	"alarm.arm.body.noDevices": {
-		"one": "{{rules}} regola, nessuna restrizione sui dispositivi.",
-		"other": "{{rules}} regole, nessuna restrizione sui dispositivi."
-	},
-	"alarm.arm.body.devices": {
-		"one": "{{devices}} dispositivo attivo: {{names}}.",
-		"other": "{{devices}} dispositivi attivi: {{names}}."
-	},
+	"alarm.arm.body.allDevices": "Attivi: tutti i dispositivi",
+	"alarm.arm.body.noDevices": "Attivi: nessuna restrizione",
+	"alarm.arm.body.devices": "Attivi: {{names}}",
+	"alarm.arm.body.devicesSkipped": "Attivi: {{names}}\nEsclusi: {{skippedNames}}",
+	"alarm.arm.body.uncovered": "Attivi: nessuno — nessuna regola usa questa modalità",
+	"alarm.arm.body.allSkipped": "Attivi: nessuno\nEsclusi: {{names}}",
+	"alarm.arming.body": "Nessuna esclusione",
+	"alarm.arming.body.uncovered": "Attivi: nessuno — nessuna regola usa questa modalità",
+	"alarm.arming.body.allSkipped": "Attivi: nessuno\nEsclusi: {{names}}",
+	"alarm.arming.body.skipped": "Esclusi: {{names}}",
+	"alarm.arm.body.bypassed": "Attivi: {{devices}}\nBypassati: {{bypassedNames}}",
+	"alarm.arming.body.bypassed": "Bypassati: {{bypassedNames}}",
+	"alarm.armRefused.body": "Aperti: {{names}}\nRipeti entro {{seconds}}s per inserire con bypass.",
 	"alarm.device.unnamed": "Dispositivo {{id}}",
-	"system.alarm-armed.title.home": "Casa attivato",
-	"system.alarm-armed.title.away": "Fuori attivato",
-	"system.alarm-armed.title.night": "Notte attivato",
-	"system.alarm-disarmed.title": "Allarme disattivato",
-	"system.alarm-disarmed.body": "L'allarme è stato disattivato",
+	"alarm.combined.title": "Allarme: {{deviceName}}",
+	"system.alarm-arm-refused.title.home": "Inserimento Casa rifiutato",
+	"system.alarm-arm-refused.title.away": "Inserimento Fuori rifiutato",
+	"system.alarm-arm-refused.title.night": "Inserimento Notte rifiutato",
+	"system.alarm-arm-refused.body": "Inserimento rifiutato",
+	"system.alarm-arming.title.home": "Inserimento Casa — {{seconds}}s",
+	"system.alarm-arming.title.away": "Inserimento Fuori — {{seconds}}s",
+	"system.alarm-arming.title.night": "Inserimento Notte — {{seconds}}s",
+	"system.alarm-arming.body": "Inserimento in corso",
+	"system.alarm-armed.title.home": "Inserito: Casa",
+	"system.alarm-armed.title.away": "Inserito: Fuori",
+	"system.alarm-armed.title.night": "Inserito: Notte",
+	"system.alarm-armed.body": "Allarme inserito",
+	"system.alarm-disarmed.title": "Disinserito",
+	"system.alarm-disarmed.body": "Allarme disinserito",
 	"system.alarm-triggered.title": "ALLARME",
-	"system.alarm-triggered.body": "L'allarme è scattato",
-	"system.alarm-triggered.body.rule": "L'allarme è scattato per {{rule}} su {{deviceName}}",
+	"system.alarm-triggered.body": "Allarme scattato",
+	"system.alarm-triggered.body.rule": "Scattato da {{rule}} su {{deviceName}}",
 	"button.snooze.minutes": "Silenzia {{minutes}} min",
 	"button.snooze.hours": {
 		"one": "Silenzia {{hours}} ora",
@@ -4651,7 +5278,8 @@ var NcDispatcher = class {
 		const systemEvent = subject.systemEvent;
 		const displayDeviceId = systemEvent?.deviceId ?? subject.deviceId;
 		const deviceName = systemEvent !== void 0 && systemEvent.deviceId === void 0 ? "system" : await this.deps.getDeviceName(displayDeviceId).catch(() => null) ?? `camera ${displayDeviceId}`;
-		const zoneLabels = systemEvent !== void 0 ? [] : await resolveZoneLabels(this.deps.getZoneNames, subject.deviceId, subject.zones);
+		const alarmSource = systemEvent?.alarmSource;
+		const zoneLabels = systemEvent === void 0 ? await resolveZoneLabels(this.deps.getZoneNames, subject.deviceId, subject.zones) : alarmSource?.zones !== void 0 && alarmSource.zones.length > 0 ? await resolveZoneLabels(this.deps.getZoneNames, alarmSource.deviceId, alarmSource.zones) : [];
 		const vars = buildTemplateVars(this.texts, entry, deviceName, zoneLabels);
 		const systemCount = systemEvent?.textCount !== void 0 ? { count: systemEvent.textCount } : {};
 		const title = this.renderText({
@@ -4994,6 +5622,10 @@ async function resolveZoneLabels(getZoneNames, deviceId, zoneIds) {
 		return [...zoneIds];
 	}
 }
+/** `{{confidence}}` as a whole percent, or empty when nothing measured one. */
+function percentOf(confidence) {
+	return confidence !== void 0 ? `${Math.round(confidence * 100)}%` : "";
+}
 /**
 * The variable map ONE render pass sees: scalars, then the composites built
 * from them, then the params a system-event row froze at intake.
@@ -5009,19 +5641,23 @@ function buildTemplateVars(texts, entry, deviceName, zoneLabels) {
 	const subject = entry.payload.subject;
 	const occupancy = subject.occupancy;
 	const systemEvent = subject.systemEvent;
+	const detection = systemEvent?.alarmSource?.className !== void 0 ? systemEvent.alarmSource : void 0;
 	return {
 		camera: deviceName,
-		class: subject.className,
-		label: subject.label ?? "",
+		class: detection?.className ?? subject.className,
+		label: detection?.label ?? subject.label ?? "",
 		zones: zoneLabels.join(", "),
-		subject: systemEvent?.subject ?? ncSubjectText(texts, {
+		subject: detection?.className !== void 0 ? ncSubjectText(texts, {
+			className: detection.className,
+			...detection.label !== void 0 ? { label: detection.label } : {}
+		}) : systemEvent?.subject ?? ncSubjectText(texts, {
 			className: subject.className,
 			...subject.label !== void 0 ? { label: subject.label } : {}
 		}),
 		inZones: ncInZonesText(texts, zoneLabels),
 		scope: occupancy?.zone ?? deviceName,
 		zone: occupancy?.zone ?? zoneLabels[0] ?? "",
-		confidence: subject.confidence !== void 0 ? `${Math.round(subject.confidence * 100)}%` : "",
+		confidence: percentOf(detection?.confidence ?? subject.confidence),
 		time: new Date(subject.timestamp).toLocaleTimeString(),
 		rule: entry.payload.ruleName,
 		count: occupancy !== void 0 ? `${occupancy.count}` : "",
@@ -5561,6 +6197,35 @@ function incomingFromSystemEvent(event, lookup) {
 	}
 }
 /**
+* The COMBINED row's two keys, or null when this transition is not one.
+*
+* A rule that trips the alarm produces ONE notification, and the operator has
+* to be able to read it: the title is the severity marker over the camera
+* (`alarm.combined.title`, shipped as `Alarm: {{deviceName}}` and re-wordable
+* per rule or in the Texts tab), and the body is `detection.body` — the exact
+* sentence that rule's ordinary notification would have carried, with its own
+* class, identity and zones.
+*
+* The alarm used to write its own prose here ("The alarm was triggered by
+* Person at gate on Ingresso"), which made the one notification that matters
+* the only one in the system that did not look like the rule's others: no
+* identity, no zone, a different subject. The prefix carries the severity; the
+* familiar line carries the meaning.
+*
+* **Gated on the detection vocabulary, not on the source.** `detection.body`
+* renders `{{subject}}`, and a fire ref with no class composes it from the
+* system event's dedup slot — "alarm:42 su Ingresso". A source without a class
+* therefore keeps the alarm's own sentence, which is also what every row
+* enqueued before this deploy carries.
+*/
+function combinedAlarmText(source) {
+	if (source?.className === void 0) return null;
+	return {
+		titleKey: "alarm.combined.title",
+		bodyKey: "detection.body"
+	};
+}
+/**
 * The panel's own transition, as a system-event subject.
 *
 * IN-PROCESS, not off the bus. The alarm and the Notification Center live in
@@ -5583,6 +6248,7 @@ function incomingFromAlarmTransition(input) {
 	const deviceId = source?.deviceId ?? panelDeviceId;
 	const identity = input.lookup(deviceId);
 	const kind = transition.kind;
+	const combined = combinedAlarmText(source);
 	return systemSubject({
 		facts: {
 			eventId: `alarm:${kind}:${String(transition.at)}`,
@@ -5598,17 +6264,18 @@ function incomingFromAlarmTransition(input) {
 		},
 		kind,
 		subject: `alarm:${String(panelDeviceId)}`,
-		titleKey: transition.mode !== void 0 ? `system.${kind}.title.${transition.mode}` : `system.${kind}.title`,
-		bodyKey: input.arm?.bodyKey ?? (source !== void 0 ? `system.${kind}.body.rule` : `system.${kind}.body`),
+		titleKey: combined !== null ? combined.titleKey : transition.mode !== void 0 ? `system.${kind}.title.${transition.mode}` : `system.${kind}.title`,
+		bodyKey: combined?.bodyKey ?? input.body?.bodyKey ?? (source !== void 0 ? `system.${kind}.body.rule` : `system.${kind}.body`),
 		textParams: {
 			...deviceTextParams(deviceId, identity),
 			...transition.mode !== void 0 ? { mode: transition.mode } : {},
 			...source !== void 0 ? { rule: source.ruleName } : {},
-			...input.arm?.textParams
+			...kind === "alarm-arming" ? { seconds: `${transition.seconds ?? 0}` } : {},
+			...input.body?.textParams
 		},
 		deviceId,
 		...identity !== void 0 ? { deviceType: identity.type } : {},
-		...input.arm !== void 0 ? { textCount: input.arm.textCount } : {},
+		...input.body !== void 0 ? { textCount: input.body.textCount } : {},
 		...source !== void 0 ? { alarmSource: source } : {}
 	});
 }
@@ -6195,6 +6862,16 @@ var OccupancyWatcher = class {
 	watched = /* @__PURE__ */ new Map();
 	/** Confirmed + pending state, keyed by the full {@link OccupancyKey}. */
 	states = /* @__PURE__ */ new Map();
+	/** Rows SEEDED since the last {@link takeSeededRows} — the durable
+	*  write-through queue (see that method). */
+	seeded = /* @__PURE__ */ new Map();
+	/** Keys already reported through `onImpossibleScope` (once-per-key gate).
+	*  Pruned with the watched set, so re-authoring a rule reports again. */
+	impossibleReported = /* @__PURE__ */ new Set();
+	deps;
+	constructor(deps = {}) {
+		this.deps = deps;
+	}
 	/**
 	* Replace the watched key set (rule-driven — recomputed on rule change).
 	* Each distinct `(zone, class, threshold)` is its OWN watched partial key
@@ -6225,6 +6902,8 @@ var OccupancyWatcher = class {
 			});
 		}
 		for (const key of [...this.states.keys()]) if (!this.watched.has(partialKeyOf(key))) this.states.delete(key);
+		for (const key of [...this.seeded.keys()]) if (!this.watched.has(partialKeyOf(key))) this.seeded.delete(key);
+		for (const key of [...this.impossibleReported]) if (!this.watched.has(partialKeyOf(key))) this.impossibleReported.delete(key);
 	}
 	/**
 	* Feed one camera snapshot at time `now`, returning the edges that COMMIT on
@@ -6237,9 +6916,12 @@ var OccupancyWatcher = class {
 			const resolved = resolveOccupancyScope(snapshot, spec);
 			if (resolved === null) continue;
 			const key = occupancyKey(deviceId, spec.zoneId, spec.className, spec.threshold);
+			this.reportImpossibleScope(deviceId, key, spec);
 			const existing = this.states.get(key);
 			if (existing === void 0) {
-				this.states.set(key, seedState(deviceId, spec, resolved, now));
+				const state = seedState(deviceId, spec, resolved, now);
+				this.states.set(key, state);
+				this.seeded.set(key, stateToRow(key, state, now));
 				continue;
 			}
 			const edge = step(existing, spec, resolved, now);
@@ -6247,6 +6929,38 @@ var OccupancyWatcher = class {
 		}
 		return edges;
 	}
+	/**
+	* Drain the rows seeded since the last call — the caller persists them
+	* through the SAME ledger the committed edges use.
+	*
+	* Drained rather than exposed because a seed is a ONE-TIME fact: re-offering
+	* it would turn a rare write into a per-frame one, which is the thing the
+	* edge-only write-through was designed to avoid. Missing a drain costs
+	* nothing worse than today's behaviour (a cold re-seed at the next boot), so
+	* the caller may fail the write without corrupting anything.
+	*/
+	takeSeededRows() {
+		const rows = [...this.seeded.values()];
+		this.seeded.clear();
+		return rows;
+	}
+	/** Fire `onImpossibleScope` the first time a key with an uncountable class
+	*  scope is evaluated. See {@link OccupancyImpossibleScope}. */
+	reportImpossibleScope(deviceId, key, spec) {
+		const report = this.deps.onImpossibleScope;
+		if (report === void 0) return;
+		const className = spec.className;
+		if (className === void 0 || require_dist.isDetectionMacroClass(className)) return;
+		if (this.impossibleReported.has(key)) return;
+		this.impossibleReported.add(key);
+		report({
+			deviceId,
+			key,
+			...spec.zoneId !== void 0 ? { zoneId: spec.zoneId } : {},
+			className,
+			threshold: spec.threshold
+		});
+	}
 	/** Reseed confirmed state from durable rows (boot). Only rows whose key is
 	*  currently WATCHED are restored — an orphaned durable row (its rule gone)
 	*  is dropped, keeping the RAM map bounded to the active set. Pending edges
@@ -6269,20 +6983,25 @@ var OccupancyWatcher = class {
 	/** Snapshot the CONFIRMED state for durable persistence (pending excluded). */
 	snapshotState() {
 		const rows = [];
-		for (const [key, state] of this.states) rows.push({
-			key,
-			deviceId: state.deviceId,
-			...state.zoneId !== void 0 ? { zoneId: state.zoneId } : {},
-			...state.className !== void 0 ? { className: state.className } : {},
-			threshold: state.threshold,
-			confirmedCount: state.confirmedCount,
-			occupied: state.occupied,
-			lastChangeAt: state.lastChangeAt,
-			updatedAt: state.lastChangeAt
-		});
+		for (const [key, state] of this.states) rows.push(stateToRow(key, state, state.lastChangeAt));
 		return rows;
 	}
 };
+/** The durable projection of one in-RAM state — the ONE place the persisted row
+*  shape is built, so a seeded row and a snapshotted one cannot differ. */
+function stateToRow(key, state, updatedAt) {
+	return {
+		key,
+		deviceId: state.deviceId,
+		...state.zoneId !== void 0 ? { zoneId: state.zoneId } : {},
+		...state.className !== void 0 ? { className: state.className } : {},
+		threshold: state.threshold,
+		confirmedCount: state.confirmedCount,
+		occupied: state.occupied,
+		lastChangeAt: state.lastChangeAt,
+		updatedAt
+	};
+}
 /**
 * The state a key starts from: WHAT THE FIRST SNAPSHOT SAID.
 *
@@ -6446,7 +7165,11 @@ function probeOccupancyNow(input) {
 * field for them would be a cross-package change for a sentence.
 */
 function occupancyProbeLabel(occupancy, probe, cooldownSec) {
-	if (probe.kind === "unavailable") return probe.reason === "no-snapshot" ? "no ZoneAnalytics snapshot for this camera — the condition fails closed until one arrives" : "that zone is not in the camera’s current snapshot — the condition fails closed (deleted zone?)";
+	const classNote = impossibleClassNote(occupancy.className);
+	if (probe.kind === "unavailable") {
+		const reason = probe.reason === "no-snapshot" ? "no ZoneAnalytics snapshot for this camera — the condition fails closed until one arrives" : "that zone is not in the camera’s current snapshot — the condition fails closed (deleted zone?)";
+		return classNote === null ? reason : `${classNote} · ${reason}`;
+	}
 	const where = probe.zoneName ?? (occupancy.zoneId === void 0 ? "whole frame" : occupancy.zoneId);
 	const what = occupancy.className ?? "objects";
 	const parts = [
@@ -6455,7 +7178,21 @@ function occupancyProbeLabel(occupancy, probe, cooldownSec) {
 		`fires on the transition, sustained ${String(occupancy.sustainSeconds)} s`
 	];
 	if (cooldownSec > 0) parts.push(`cooldown ${String(cooldownSec)} s`);
-	return parts.join(" · ");
+	return classNote === null ? parts.join(" · ") : `${classNote} · ${parts.join(" · ")}`;
+}
+/**
+* The one-clause warning for a class scope the snapshots can never key on, or
+* `null` when the scope is fine.
+*
+* The dry-run's whole job is to make "why does this rule never fire?" answerable
+* before the operator waits a night for it. A sub-type class produced the most
+* convincing wrong answer it can give — "0/1 car · not occupied now" — which is
+* pixel-identical to an empty parking space. `byClass` is MACRO-keyed, so that
+* counter is 0 structurally and no scene can change it.
+*/
+function impossibleClassNote(className) {
+	if (className === void 0 || require_dist.isDetectionMacroClass(className)) return null;
+	return `⚠ “${className}” is a sub-type, not a macro class: this counter is always 0 (use ${[...require_dist.DETECTION_MACRO_CLASSES].join(" / ")})`;
 }
 /**
 * The mechanics, declared once.
@@ -11767,7 +12504,7 @@ var NC_ALARM_ANNOUNCE_RULE_ID = "nc-alarm-announce";
 * notification that says the alarm was disarmed is worse than offering nothing.
 */
 function alarmButtonKind(kind) {
-	if (kind === "alarm-triggered" || kind === "alarm-armed" || kind === "alarm-disarmed") return kind;
+	if (kind === "alarm-triggered" || kind === "alarm-armed" || kind === "alarm-arming" || kind === "alarm-disarmed") return kind;
 	return null;
 }
 /**
@@ -11848,14 +12585,20 @@ function frozenOccupancy(rule, occ) {
 */
 function fireRefFor(rule, subject, kind) {
 	const hasEventMedia = kind === "object-event" || kind === "package-event";
+	const className = subject.classNames[0];
 	return {
 		ruleId: rule.id,
 		ruleName: rule.name,
 		deviceId: subject.deviceId,
+		...subject.sourceDeviceId !== void 0 ? { sourceDeviceId: subject.sourceDeviceId } : {},
 		recordId: subject.recordId,
 		...subject.trackId !== void 0 ? { trackId: subject.trackId } : {},
 		...hasEventMedia ? { eventId: subject.recordId } : {},
-		timestamp: subject.timestamp
+		timestamp: subject.timestamp,
+		...className !== void 0 ? { className } : {},
+		...subject.label !== void 0 ? { label: subject.label } : {},
+		zones: notificationZones(rule, subject),
+		...subject.confidence !== void 0 ? { confidence: subject.confidence } : {}
 	};
 }
 function notificationZones(rule, subject) {
@@ -11894,17 +12637,55 @@ function historyRecordKind(kind) {
 * showed a key while the phone showed a sentence would be a second vocabulary
 * to keep in step. A pre-catalog row falls back to the pair frozen on it.
 */
+/**
+* Cap-facing downgrade of a system-event kind — the SAME device as
+* {@link historyRecordKind}, and it exists for the same reason.
+*
+* This addon bundles its own `@camstack/types` (self-contained externals), so
+* it can emit a kind the enum in the RUNNING SERVER does not have. The history
+* router does not: it validates its output against the host's
+* `NcHistorySubjectSchema`, whose `kind` is a `z.enum`. One row carrying a kind
+* the host has never heard of therefore does not degrade — it fails the whole
+* `getHistory` call, for every row, exactly as the enum's own legacy-tail note
+* warns.
+*
+* `alarm-arming` is projected onto `alarm-armed`, its nearest member: same
+* panel, same lifecycle, adjacent instant. Nothing a person reads changes —
+* the row's title and body are resolved from the arming keys ("Inserimento
+* Fuori — attivo tra 30 secondi") — only the machine-facing word does.
+*
+* DELETE THIS when a `@camstack/server` closure carrying `alarm-arming` in
+* `NcSystemEventKindSchema` is installed everywhere this addon runs. Until
+* then it is what lets the exit-delay notification ship without a train.
+*/
+/**
+* The mirrored device-state word, narrowed to a contact reading.
+*
+* Anything that is not one of the two contact words is `undefined` — a device
+* whose slice the state table read as `on` / `armed_home` is not a contact, and
+* an exclusion must never be lifted by a word that belongs to another cap.
+*/
+function contactReadingOf(state) {
+	if (state === "open" || state === "closed") return state;
+}
+function historySystemEventKind(kind) {
+	if (kind === "alarm-arming") return "alarm-armed";
+	if (kind === "alarm-arm-refused") return "alarm-disarmed";
+	return kind;
+}
 function historySystemEvent(texts, systemEvent) {
 	const vars = systemEvent.textParams ?? {};
+	const count = systemEvent.textCount;
 	const resolve = (key, frozen) => {
 		if (key !== void 0 && texts.has(key)) return texts.text({
 			key,
-			vars
+			vars,
+			...count !== void 0 ? { count } : {}
 		});
 		return frozen ?? "";
 	};
 	return {
-		kind: systemEvent.kind,
+		kind: historySystemEventKind(systemEvent.kind),
 		subject: systemEvent.subject,
 		title: resolve(systemEvent.titleKey, systemEvent.title),
 		body: resolve(systemEvent.bodyKey, systemEvent.body),
@@ -11966,8 +12747,22 @@ var NotificationCenter = class NotificationCenter {
 	/** Debounced occupancy edge state machine (pure) + its durable confirmed
 	*  state. Fed in-process by {@link observeOccupancy} from ZoneAnalytics
 	*  snapshots; watched keys are recomputed from the enabled occupancy rules. */
-	occupancyWatcher = new OccupancyWatcher();
+	occupancyWatcher = new OccupancyWatcher({ onImpossibleScope: (scope) => {
+		this.logger.warn("occupancy key can never count — class is a sub-type, not a macro", {
+			tags: { deviceId: scope.deviceId },
+			meta: {
+				key: scope.key,
+				zoneId: scope.zoneId ?? "@frame",
+				className: scope.className,
+				threshold: scope.threshold,
+				macros: [...require_dist.DETECTION_MACRO_CLASSES].join(",")
+			}
+		});
+	} });
 	occupancyStore;
+	/** Rendered watched-occupancy-key set as last logged — the change gate for
+	*  {@link reportOccupancyWatch} (it runs on every rule-reload tick). */
+	lastOccupancyWatchReport = "";
 	/**
 	* The sustained-sound sampling-window matcher (pure). Fed in-process by
 	* {@link observeAudio} from the pipeline's audio inference frames; watched
@@ -12778,8 +13573,18 @@ var NotificationCenter = class NotificationCenter {
 	* before it.
 	*/
 	onSensorEventPersisted(event, markerTrackId) {
+		this.observeContactEvent(event);
 		this.consumeEvent(incomingFromSensorEvent(event, markerTrackId));
 	}
+	/** The contact reading a sensor row carries, handed to the panel. Nothing at
+	*  all for any other sensor kind — see {@link observeAlarmContacts}. */
+	observeContactEvent(event) {
+		const panel = this.alarmPanel;
+		if (panel === null || event.kind !== "contact") return;
+		const entryOpen = event.value?.["entryOpen"];
+		if (typeof entryOpen !== "boolean") return;
+		panel.observeContact(event.sourceDeviceId, entryOpen ? "open" : "closed", event.timestamp);
+	}
 	/**
 	* Called at the AUDIO-event persist site (`eventStore.insertAudio`), in the
 	* SAME moment as the durable insert. Feeds an `immediate` rule that OPTS IN
@@ -12826,7 +13631,20 @@ var NotificationCenter = class NotificationCenter {
 			});
 			return;
 		}
+		this.persistSeededOccupancy(now);
 		for (const edge of edges) {
+			this.logger.info("occupancy edge committed", {
+				tags: { deviceId: edge.deviceId },
+				meta: {
+					zoneId: edge.zoneId ?? "@frame",
+					zoneName: edge.zoneName ?? "",
+					className: edge.className ?? "@all",
+					threshold: edge.threshold,
+					count: edge.count,
+					previousCount: edge.previousCount,
+					occupied: edge.occupied
+				}
+			});
 			this.persistOccupancyEdge(edge, now);
 			this.onOccupancyEdge(edge);
 		}
@@ -13031,6 +13849,119 @@ var NotificationCenter = class NotificationCenter {
 	setAlarmPanel(panel) {
 		this.alarmPanel = panel;
 	}
+	/**
+	* What the panel asks before it arms — see {@link NcAlarmArmGuardHook}.
+	*
+	* Handed to the panel by the same wiring that hands it the publish hook: the
+	* panel owns the state machine, the centre owns the rules that say which
+	* contacts a mode covers, and neither can reach the other on its own.
+	*/
+	alarmArmGuard() {
+		return {
+			openContacts: (mode) => this.alarmOpenContacts(mode),
+			announceRefusal: (input) => this.announceArmRefused(input)
+		};
+	}
+	/**
+	* Which of the contacts this mode covers read OPEN, right now.
+	*
+	* A TARGETED read of at most the handful of sensors the mode names, not a
+	* refresh of the whole watched set: the arm is a person pressing a button and
+	* the answer has to be about this second, but it must not become a fan-out
+	* over every gated device on the hub.
+	*
+	* Three fail-open rules, and all three exist because refusing an arm on
+	* ignorance is worse than arming:
+	*
+	*  - a sensor the read could not answer for falls back to the mirrored state
+	*    (bounded staleness, the same contract the `deviceState` gate lives with);
+	*  - a sensor NEITHER can answer for is not blocking, and says so in a line;
+	*  - a mode whose contact rule names no devices blocks nothing, and says so —
+	*    an unscoped contact rule covers every contact on the hub, and a refusal
+	*    naming devices the operator never associated with the alarm is one they
+	*    cannot act on.
+	*/
+	async alarmOpenContacts(mode) {
+		const panel = this.alarmPanel;
+		if (panel === null) return [];
+		const candidates = alarmBlockingCandidates(this.rules.list(), panel.deviceId, mode);
+		if (candidates.length === 0) return [];
+		const fresh = await this.readContactStates(candidates);
+		const name = this.deviceNameFromDirectory();
+		const open = [];
+		const unknown = [];
+		for (const deviceId of candidates) {
+			const state = fresh.get(deviceId) ?? this.deviceStates.get(deviceId);
+			if (state === void 0) {
+				unknown.push(deviceId);
+				continue;
+			}
+			if (state === "open") open.push({
+				deviceId,
+				name: name(deviceId)
+			});
+		}
+		for (const deviceId of unknown) this.logger.info("alarm arm check: no contact state — the sensor cannot block this arm", {
+			tags: { deviceId },
+			meta: {
+				panelDeviceId: panel.deviceId,
+				mode
+			}
+		});
+		this.logger.info("alarm arm check", {
+			tags: { deviceId: panel.deviceId },
+			meta: {
+				mode,
+				candidates: candidates.length,
+				open: open.length,
+				unknown: unknown.length,
+				openIds: open.map((c) => c.deviceId).join(",")
+			}
+		});
+		return open;
+	}
+	/** One bounded read of the named contacts. Never throws — an unreadable
+	*  sensor is simply absent, exactly as `NcDeviceStateCache` contracts. */
+	async readContactStates(ids) {
+		const read = this.deps.readDeviceStates;
+		if (read === void 0) return /* @__PURE__ */ new Map();
+		try {
+			return await read(ids);
+		} catch (err) {
+			this.logger.warn("alarm arm check: contact read failed — falling back to the mirror", { meta: {
+				devices: ids.length,
+				error: String(err)
+			} });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/**
+	* The refusal, as an ordinary notification.
+	*
+	* Same path the arm announcement takes (D126: the alarm speaks through the
+	* ordinary notification path), so it is durable, retried, in history and
+	* worded in the reader's language at send time. It is the operator's ONLY
+	* copy: the thrown error reaches whoever called the cap, and when that caller
+	* is a notification button on a phone, nobody ever sees it.
+	*/
+	announceArmRefused(input) {
+		const panel = this.alarmPanel;
+		if (panel === null) return;
+		const text = buildArmRefusedAnnouncement(input.mode, input.blocking.map((c) => c.name), input.retrySeconds);
+		const transition = {
+			kind: "alarm-arm-refused",
+			state: "disarmed",
+			previous: "disarmed",
+			mode: input.mode,
+			at: input.at
+		};
+		const settings = panel.settings();
+		const targetIds = settings.announceArm ? settings.announceTargets : [];
+		this.scheduleAlarmTransition(panel, transition, {
+			text,
+			targetIds
+		});
+	}
 	/** Settings + the DERIVED coverage. Read together — see the cap doc. */
 	alarmConfig() {
 		const panel = this.alarmPanel;
@@ -13067,7 +13998,7 @@ var NotificationCenter = class NotificationCenter {
 		const identity = this.deviceDirectory.get(deviceId);
 		if (identity === void 0) return void 0;
 		if (identity.online === false) return "offline";
-		if (identity.detectionActive === false) return "detection-off";
+		if (identity.isCamera && identity.detectionActive === false) return "detection-off";
 	}
 	/**
 	* Everything the panel reports, on every publish.
@@ -13104,13 +14035,13 @@ var NotificationCenter = class NotificationCenter {
 	*    the combined notification: one row carrying the alarm's words and that
 	*    rule's pictures, instead of two pushes about one incident.
 	*/
-	scheduleAlarmTransition(panel, transition) {
-		const arm = transition.kind === "alarm-armed" && transition.mode !== void 0 ? this.armAnnouncement(panel, transition.mode) : null;
+	scheduleAlarmTransition(panel, transition, prepared) {
+		const arm = prepared ?? this.armAnnouncement(panel, transition);
 		const incoming = incomingFromAlarmTransition({
 			transition,
 			panelDeviceId: panel.deviceId,
 			lookup: this.deviceDirectory.lookup(),
-			...arm !== null ? { arm: arm.text } : {}
+			...arm !== null ? { body: arm.text } : {}
 		});
 		this.evalChain = this.evalChain.then(async () => {
 			try {
@@ -13131,31 +14062,45 @@ var NotificationCenter = class NotificationCenter {
 		});
 	}
 	/**
-	* The arm sentence and the targets it goes to, or null when this arm is not
-	* announced at all.
+	* The arm/arming sentence and the targets it goes to, or null when the
+	* transition is not one of those two.
+	*
+	* Both kinds compose from the SAME coverage — "what does this mode actually
+	* watch" — because they are the same answer given thirty seconds apart. The
+	* arming one is the useful one: it reaches the operator while the exit delay
+	* is still running, so a mode that protects nothing can still be fixed.
 	*
 	* Every way of NOT announcing produces a line: an announcement that silently
 	* did not arrive is indistinguishable from the alarm not having armed, which
-	* is the exact confusion this feature exists to remove. The loudest of them
-	* is the last — a mode nothing is gated on protects nothing, and saying
-	* "Away armed" there would be a false assurance.
-	*/
-	armAnnouncement(panel, mode) {
+	* is the exact confusion this feature exists to remove. A COVERAGE GAP no
+	* longer suppresses the sentence — it changes it. Suppressing it left the
+	* operator with a title and an empty line (the fallback body key existed in
+	* neither locale) and no way to learn that the mode was gated on by nothing.
+	*/
+	armAnnouncement(panel, transition) {
+		const kind = transition.kind;
+		if (kind !== "alarm-armed" && kind !== "alarm-arming") return null;
+		const mode = transition.mode;
+		if (mode === void 0) return null;
 		const settings = panel.settings();
 		const tags = { deviceId: panel.deviceId };
 		const coverage = this.coverageFor(panel).find((c) => c.mode === mode);
 		if (coverage === void 0) return null;
-		const text = buildArmAnnouncement(coverage, this.deviceNameFromDirectory());
-		if (text === null) {
-			this.logger.warn("alarm armed into a mode no enabled rule is gated on", {
-				tags,
-				meta: {
-					mode,
-					state: `armed_${mode}`
-				}
-			});
-			return null;
-		}
+		const name = this.deviceNameFromDirectory();
+		const bypassed = panel.excludedDevices();
+		const text = kind === "alarm-arming" ? buildArmingAnnouncement(coverage, transition.seconds ?? 0, name, bypassed) : buildArmAnnouncement(coverage, name, bypassed);
+		const gap = alarmCoverageGap(coverage);
+		if (gap !== null) this.logger.warn("alarm armed into a mode that watches nothing", {
+			tags,
+			meta: {
+				mode,
+				kind,
+				gap,
+				rules: coverage.ruleCount,
+				devices: coverage.deviceIds.length,
+				skipped: coverage.skippedDevices.length
+			}
+		});
 		if (!settings.announceArm) return {
 			text,
 			targetIds: []
@@ -13699,6 +14644,7 @@ var NotificationCenter = class NotificationCenter {
 		}
 		this.occupancyWatcher.setWatchedKeys(specs);
 		this.occupancyEnabled = specs.length > 0;
+		this.reportOccupancyWatch(specs);
 		const audioSpecs = [];
 		for (const rule of this.rules.listEnabled("immediate")) {
 			const audio = rule.conditions.audio;
@@ -13725,9 +14671,44 @@ var NotificationCenter = class NotificationCenter {
 			const devices = rule.conditions.devices;
 			if (zones !== void 0 && zones.ids.length > 0 && devices !== void 0) zoneScoped.push(...devices);
 		}
+		const panel = this.alarmPanel;
+		if (panel !== null) gated.push(...alarmContactWatchList(this.rules.list(), panel.deviceId, panel.availableModes()));
 		this.deviceStates.setWatched(gated);
 		this.zoneOwners.setWatched(zoneScoped);
 	}
+	/**
+	* Feed every excluded sensor's mirrored state back to the panel.
+	*
+	* The reconcile half of the two-phase lift. The EVENT half
+	* ({@link onSensorEventPersisted}) is the fast one, but it only exists for a
+	* sensor linked to a camera — the seven contacts on this hub are linked to
+	* none, so without this an exclusion would never lift at all and the sensor
+	* would stay out of the alarm until a disarm.
+	*/
+	observeAlarmContacts() {
+		const panel = this.alarmPanel;
+		if (panel === null) return;
+		const excluded = panel.excludedDevices();
+		if (excluded.length === 0) return;
+		const now = this.now();
+		for (const deviceId of excluded) panel.observeContact(deviceId, contactReadingOf(this.deviceStates.get(deviceId)), now);
+	}
+	/**
+	* Log the watched occupancy key set, on CHANGE only.
+	*
+	* Change-only because this runs on every rule-reload tick; a line per tick
+	* would be noise, and no line at all is how a rule that watches an
+	* impossible scope stays invisible for a day.
+	*/
+	reportOccupancyWatch(specs) {
+		const rendered = specs.map((s) => `${s.zoneId ?? "@frame"}|${s.className ?? "@all"}|t${String(s.threshold)}@${String(s.sustainSeconds)}s`).toSorted().join(",");
+		if (rendered === this.lastOccupancyWatchReport) return;
+		this.lastOccupancyWatchReport = rendered;
+		this.logger.info("occupancy watched keys", { meta: {
+			keys: specs.length,
+			specs: rendered.length > 0 ? rendered : "(none)"
+		} });
+	}
 	/** Boot reseed of confirmed occupancy edge-state (durability, constraint 4) —
 	*  hydrate the watcher from the store, then prune orphaned durable rows to the
 	*  active watched set. Runs AFTER {@link refreshOccupancyWatch} so hydrate
@@ -13790,6 +14771,7 @@ var NotificationCenter = class NotificationCenter {
 		await this.deviceStates.refresh();
 		await this.deviceDirectory.refresh();
 		await this.zoneOwners.refresh();
+		this.observeAlarmContacts();
 		await this.occupancyStore.pruneExcept(this.activeOccupancyKeys());
 	}
 	/**
@@ -13815,26 +14797,63 @@ var NotificationCenter = class NotificationCenter {
 	activeOccupancyKeys() {
 		return new Set(this.occupancyWatcher.snapshotState().map((r) => r.key));
 	}
+	/**
+	* Write-through the rows the watcher SEEDED on this observation — the initial
+	* level of a key that had neither a durable row nor RAM state.
+	*
+	* Same ledger, same best-effort contract as an edge: a failed write leaves
+	* exactly today's behaviour (a cold re-seed at the next boot), never a
+	* corrupt level. Drained, so a key is written once and not per frame.
+	*/
+	persistSeededOccupancy(now) {
+		const rows = this.occupancyWatcher.takeSeededRows();
+		for (const row of rows) {
+			this.logger.info("occupancy baseline seeded", {
+				tags: { deviceId: row.deviceId },
+				meta: {
+					key: row.key,
+					zoneId: row.zoneId ?? "@frame",
+					className: row.className ?? "@all",
+					threshold: row.threshold,
+					count: row.confirmedCount,
+					occupied: row.occupied
+				}
+			});
+			this.persistOccupancyRow(row, now);
+		}
+	}
 	/** Write-through the committed confirmed level for one edge (rare — only on a
 	*  boolean flip). Best-effort: a failed persist is logged, never thrown into
 	*  the frame path (the boot reseed + next edge recover). */
-	async persistOccupancyEdge(edge, now) {
+	persistOccupancyEdge(edge, now) {
+		return this.persistOccupancyRow({
+			key: occupancyKey(edge.deviceId, edge.zoneId, edge.className, edge.threshold),
+			deviceId: edge.deviceId,
+			...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
+			...edge.className !== void 0 ? { className: edge.className } : {},
+			threshold: edge.threshold,
+			confirmedCount: edge.count,
+			occupied: edge.occupied,
+			lastChangeAt: edge.timestamp,
+			updatedAt: now
+		}, now);
+	}
+	/** The ONE durable write for a confirmed occupancy level, whether it came from
+	*  a committed edge or a cold seed. Best-effort by contract — see the two
+	*  callers. */
+	async persistOccupancyRow(row, now) {
 		try {
 			await this.occupancyStore.persist({
-				key: occupancyKey(edge.deviceId, edge.zoneId, edge.className, edge.threshold),
-				deviceId: edge.deviceId,
-				...edge.zoneId !== void 0 ? { zoneId: edge.zoneId } : {},
-				...edge.className !== void 0 ? { className: edge.className } : {},
-				threshold: edge.threshold,
-				confirmedCount: edge.count,
-				occupied: edge.occupied,
-				lastChangeAt: edge.timestamp,
+				...row,
 				updatedAt: now
 			});
 		} catch (err) {
 			this.logger.debug("occupancy persist failed", {
-				tags: { deviceId: edge.deviceId },
-				meta: { error: String(err) }
+				tags: { deviceId: row.deviceId },
+				meta: {
+					key: row.key,
+					error: String(err)
+				}
 			});
 		}
 	}
@@ -35057,6 +36076,138 @@ var BindingCache = class {
 	}
 };
 //#endregion
+//#region src/pipeline-analytics/runtime/detection-coverage-cache.ts
+/**
+* DetectionCoverageCache — fleet-seeded, event-invalidated mirror of WHICH
+* devices carry a WRAPPED `detection-pipeline` binding. This is the alarm's
+* coverage authority ("Away armed, 12 cameras" is false if three of them are
+* offline or no longer wrapped), read by the notification centre's device
+* directory (`listDeviceIdentities`).
+*
+* WHY a mirror, not a per-tick sweep. The directory refreshes on the NC's 30 s
+* rule-reload tick. Answering "who still has detection?" with a fleet-wide
+* `getAllBindings` on EVERY tick cost 903 ms / 373 KB / ~505 `getBindings:
+* default wrappers skipped` log lines on the live hub (524 devices), forever —
+* ~3% of hub-main's main thread plus a permanent log-spam baseline. Same defect
+* and fix as `SystemMirror.refreshBinding` (639073e8): ONE fleet read to warm,
+* then per-device updates driven by `DeviceBindingsChanged` events. A wrapper
+* toggle emits that event carrying the device's id and `capName`
+* (`detection-pipeline`), so a single `getBindings(deviceId)` — 21 ms / 613 B —
+* keeps the mirror current without ever touching the fleet again.
+*
+* ── Destructive-direction discipline (D49) ──────────────────────────────────
+*
+* `detectionActive: false` reports a camera as UNCOVERED / switched-off (D62) —
+* the destructive answer, and the one an operator reads as "my alarm is not
+* watching that door". A transient `getBindings` blip must never flip a
+* known-covered camera to uncovered:
+*   • a failed refresh KEEPS the previous value (a read that throws changes
+*     nothing), and
+*   • a single read that would flip a known `true → false` is confirmed by a
+*     concordant SECOND read before it lands — an empty binding list is not
+*     proof the wrapper is gone.
+* A COLD mirror (seed not yet landed, or a seed that failed) answers `undefined`
+* for every id — and unknown never reports a camera as excluded from coverage.
+*/
+var DetectionCoverageCache = class {
+	api;
+	logger;
+	/** deviceId → "has a WRAPPED detection-pipeline binding". Absent = unknown. */
+	state = /* @__PURE__ */ new Map();
+	warm = false;
+	seeding = null;
+	constructor(deps) {
+		this.api = deps.api;
+		this.logger = deps.logger;
+	}
+	/** Has the ONE fleet seed ever landed? A cold mirror knows nothing. */
+	isWarm() {
+		return this.warm;
+	}
+	/** Do we have an answer for this id at all? (`false` ⇒ absent ⇒ unknown.) */
+	has(deviceId) {
+		return this.state.has(deviceId);
+	}
+	/** The coverage answer, or `undefined` when this id is unknown. No I/O. */
+	get(deviceId) {
+		return this.state.get(deviceId);
+	}
+	/**
+	* Seed the whole fleet ONCE with a single `getAllBindings`. Idempotent: a
+	* warm cache is a no-op, and concurrent callers coalesce onto one read. A
+	* failed seed leaves the mirror COLD so the next tick retries — during that
+	* window every id answers unknown, which never reports a camera as excluded.
+	*/
+	async ensureWarm() {
+		if (this.warm) return;
+		if (this.seeding) return this.seeding;
+		this.seeding = this.seed();
+		try {
+			await this.seeding;
+		} finally {
+			this.seeding = null;
+		}
+	}
+	async seed() {
+		try {
+			const rows = await this.api.deviceManager.getAllBindings.query({});
+			for (const row of rows) {
+				if (this.state.has(row.deviceId)) continue;
+				this.state.set(row.deviceId, hasWrappedDetection(row.entries));
+			}
+			this.warm = true;
+			this.logger.info("detection-coverage mirror warm", { meta: { devices: this.state.size } });
+		} catch (err) {
+			this.logger.warn("detection-coverage seed failed — coverage unknown until it lands", { meta: { error: String(err) } });
+		}
+	}
+	/**
+	* A `DeviceBindingsChanged` for the detection cap re-reads THAT ONE device
+	* (never the fleet). Fire-and-forget from the synchronous event handler.
+	*/
+	onBindingsChanged(event) {
+		if (event.capName !== "detection-pipeline") return Promise.resolve();
+		return this.refreshDevice(event.deviceId);
+	}
+	/** Drop a device the fleet no longer has (`device.unregistered`). */
+	forget(deviceId) {
+		this.state.delete(deviceId);
+	}
+	/** Return to cold — used on addon shutdown. */
+	clearAll() {
+		this.state.clear();
+		this.warm = false;
+		this.seeding = null;
+	}
+	async refreshDevice(deviceId) {
+		try {
+			const active = await this.readWrappedDetection(deviceId);
+			const prev = this.state.get(deviceId);
+			if (!active && prev === true) {
+				if (await this.readWrappedDetection(deviceId)) {
+					this.state.set(deviceId, true);
+					return;
+				}
+			}
+			this.state.set(deviceId, active);
+		} catch (err) {
+			this.logger.debug("detection-coverage refresh failed — keeping the previous value", {
+				tags: { deviceId },
+				meta: { error: String(err) }
+			});
+		}
+	}
+	async readWrappedDetection(deviceId) {
+		return hasWrappedDetection((await this.api.deviceManager.getBindings.query({ deviceId })).entries);
+	}
+};
+/** The one authority: a WRAPPED `detection-pipeline` binding is present. A
+*  native binding of the same cap is NOT coverage (D62: absence of the WRAPPED
+*  binding is how a deactivated wrapper is represented). */
+function hasWrappedDetection(entries) {
+	return entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped");
+}
+//#endregion
 //#region src/pipeline-analytics/runtime/capture-scheduler.ts
 /**
 * Kind-derived default priorities (0 = highest). Explicit `priority` wins.
@@ -39921,7 +41072,13 @@ var ZoneAnalyticsProvider = class {
 				meta: {
 					totalObjects: total,
 					byClass: snapshot.frame.byClass,
-					zones: snapshot.zones.length
+					zones: snapshot.zones.length,
+					zoneCounts: snapshot.zones.map((z) => ({
+						zoneId: z.zoneId,
+						zoneName: z.zoneName,
+						totalObjects: z.totalObjects,
+						byClass: z.byClass
+					}))
 				}
 			});
 			this.ctx.emitOccupancyChanged?.({
@@ -40433,6 +41590,12 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	*  path). Null on non-post-processing nodes or when disabled. */
 	embeddingDispatcher = null;
 	bindingCache = null;
+	/** Alarm-coverage mirror the NC device directory reads — WHICH devices carry
+	*  a wrapped `detection-pipeline` binding. Fleet-seeded ONCE, then per-device
+	*  updates off `DeviceBindingsChanged`, so the 30 s rule-reload tick stops
+	*  sweeping `getAllBindings` over the whole fleet. See
+	*  `runtime/detection-coverage-cache.ts`. */
+	detectionCoverage = null;
 	/** Per-device throttle for the inactive-binding frame-drop warn (5 min). */
 	inactiveBindingDropWarnAt = /* @__PURE__ */ new Map();
 	zoneAnalytics = null;
@@ -41223,9 +42386,12 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			settings: () => panel.settings(),
 			applySettings: (patch) => panel.applySettings(patch),
 			availableModes: () => NC_ALARM_MODES,
-			noteRuleTrigger: (source) => panel.noteRuleTrigger(source)
+			noteRuleTrigger: (source) => panel.noteRuleTrigger(source),
+			excludedDevices: () => panel.excludedDevices(),
+			observeContact: (deviceId, reading, now) => panel.observeContact(deviceId, reading, now)
 		});
 		panel.setPublishHook((report) => center.onAlarmPublish(report));
+		panel.setArmGuard(center.alarmArmGuard());
 		center.onAlarmPublish({
 			state: panel.currentState(),
 			transition: null
@@ -41613,6 +42779,10 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			api,
 			logger: logger.child("BindingCache")
 		});
+		this.detectionCoverage = new DetectionCoverageCache({
+			api,
+			logger: logger.child("DetectionCoverage")
+		});
 		const zoneAnalytics = new ZoneAnalyticsProvider({
 			logger: logger.child("ZoneAnalytics"),
 			onOccupancySample: (deviceId, count, at, zoneId) => this.lts?.note("occupancy", deviceId, count, at, zoneId ?? ""),
@@ -41694,17 +42864,15 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			},
 			listDeviceIdentities: async () => {
 				const all = await api.deviceManager.listAll.query({ projection: "slim" });
-				const detection = await api.deviceManager.getAllBindings.query({}).then((rows) => new Map(rows.map((row) => [row.deviceId, row.entries.some((e) => e.capName === "detection-pipeline" && e.kind === "wrapped")]))).catch((err) => {
-					this.ctx.logger.debug("bindings read failed — alarm coverage cannot report skips", { meta: { error: String(err) } });
-					return /* @__PURE__ */ new Map();
-				});
+				const coverage = this.detectionCoverage;
+				if (coverage) await coverage.ensureWarm();
 				return all.map((d) => ({
 					deviceId: d.id,
 					type: d.type,
 					name: d.name,
 					isCamera: d.isCamera,
 					online: d.online && !d.disabled,
-					...detection.has(d.id) ? { detectionActive: detection.get(d.id) === true } : {}
+					...coverage?.has(d.id) ? { detectionActive: coverage.get(d.id) === true } : {}
 				}));
 			},
 			readDeviceZoneIds: async (ids) => {
@@ -42412,6 +43580,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	*  `runtime/wire-subscriptions.ts`. */
 	handleBindingsChangedEvent(data) {
 		this.bindingCache?.onBindingsChanged(data);
+		this.detectionCoverage?.onBindingsChanged(data);
 		if (data.capName === "pipeline-analytics" && data.reason === "wrapper-deactivated") {
 			this.trackStore?.clearDevice(data.deviceId);
 			this.residents.closeDevice(data.deviceId);
@@ -42437,6 +43606,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		this.audioMarkers?.forgetDevice(deviceId);
 		this.settingsCaches.clearDevice(deviceId);
 		this.bindingCache?.invalidate(deviceId);
+		this.detectionCoverage?.forget(deviceId);
 		this.zoneAnalytics?.forgetDevice(deviceId);
 		this.audioMetrics?.forgetDevice(deviceId);
 		this.releaseProxy(deviceId);
@@ -42642,6 +43812,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		this.trackStore?.clearAll();
 		this.stationaryRegistry = null;
 		this.bindingCache?.clearAll();
+		this.detectionCoverage?.clearAll();
 		await this.eventMediaDataPlane?.dispose();
 		this.eventMediaDataPlane = null;
 		this.eventMediaBaseUrl = null;