@camstack/addon-provider-amcrest 0.2.121 → 0.2.122

package/dist/addon.mjs

@@ -5374,7 +5374,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-D_4W7xuQ.mjs
+//#region ../types/dist/sleep-DC-wdyeS.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6159,6 +6159,40 @@ var BaseAddon = class {
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
+	/**
+	* Whether ONE global key of this addon's store was written, read three-way
+	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* reports `value ?? default`, so "the operator chose the default" and "nobody
+	* chose" look the same, and a failed read looks like both. A `perNode` key is
+	* not supported here: its stored name is scoped.
+	*/
+	async readStoredGlobalKey(key) {
+		const read = this._ctx?.settings?.readAddonStoreResult;
+		if (read === void 0) return {
+			kind: "unreadable",
+			reason: "three-way-read-unavailable"
+		};
+		let result;
+		try {
+			result = await read.call(this._ctx?.settings);
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (result.kind === "failed") return {
+			kind: "unreadable",
+			reason: "store-read-failed",
+			error: result.error
+		};
+		if (result.kind === "missing" || !Object.prototype.hasOwnProperty.call(result.value, key)) return { kind: "absent" };
+		return {
+			kind: "present",
+			value: result.value[key]
+		};
+	}
 	async updateGlobalSettings(patch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
@@ -9405,6 +9439,43 @@ var LogChannelWindowSchema = object({
 	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
 	deviceIds: array(number().int()).readonly().nullable()
 });
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -9433,7 +9504,7 @@ var ModelFormatEntrySchema = object({
 	/** Multi-file payload (directory members or sibling files). */
 	files: array(string()).readonly().optional(),
 	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["node", "python"])).readonly().optional()
+	runtimes: array(_enum(["python"])).readonly().optional()
 });
 /**
 * Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
@@ -9494,6 +9565,48 @@ var ModelProviderIdSchema = _enum([
 	"scrypted",
 	"custom"
 ]);
+/**
+* The licence of a model, as a record rather than a bare SPDX string: a
+* permissive CODE licence routinely sits on top of restrictive WEIGHTS or
+* DATA, and the obligations (attribution, modification notices, source offers)
+* are per upstream. A persisted custom-model row written when this field was a
+* string still parses — the string is lifted into `{ weights }`.
+*
+* Every licence surface (the admin "Models and licenses" page,
+* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
+* these records by `scripts/gen-model-licenses.ts` (D661).
+*/
+var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
+	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
+	weights: string().min(1),
+	/** SPDX id of the upstream code that defines / trained the network. */
+	code: string().min(1).optional(),
+	/** Training data whose terms add obligations (attribution, non-commercial). */
+	data: object({
+		name: string().min(1),
+		terms: string().min(1),
+		url: string().url().optional()
+	}).optional(),
+	/** The project the weights come from. Required on built-in entries (guard). */
+	upstream: object({
+		name: string().min(1),
+		url: string().url()
+	}).optional(),
+	/** Where the licence text governing the weights is published. */
+	url: string().url().optional(),
+	/** Attribution the licence REQUIRES, verbatim. */
+	attribution: string().min(1).optional(),
+	/** What CamStack changed. Required when `hosting` is `camstack-hf` (guard). */
+	modifications: string().min(1).optional(),
+	/** Who serves the file a node downloads. */
+	hosting: _enum([
+		"camstack-hf",
+		"third-party",
+		"built-in"
+	]).optional(),
+	/** True when the weights or their data forbid commercial use. */
+	nonCommercial: boolean().optional()
+}));
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -9514,10 +9627,17 @@ var ModelCatalogEntrySchema = object({
 	inputChannels: number().int().positive().optional(),
 	labels: array(LabelDefinitionSchema).readonly(),
 	inputLayout: _enum(["nchw", "nhwc"]).optional(),
+	/**
+	* `'scrfd'` applies InsightFace's SCRFD input contract, `(x - 127.5) / 128`
+	* (upstream `insightface/model_zoo/scrfd.py`), instead of the historical
+	* plain `/255`. Measured against COCO GT: 188 → 196 faces found on the
+	* `scrfd-2.5g` catalog entry (2026-09-26 model-replacement spike, §2.4-2).
+	*/
 	inputNormalization: _enum([
 		"zero-one",
 		"imagenet",
-		"none"
+		"none",
+		"scrfd"
 	]).optional(),
 	/**
 	* The model already applies softmax IN-GRAPH — its raw output is a
@@ -9542,6 +9662,16 @@ var ModelCatalogEntrySchema = object({
 	*/
 	postprocessor: custom().optional(),
 	/**
+	* Per-MODEL default confidence floor. Absent ⇒ the step's
+	* `StepDefinition.defaultConfidence` applies. A score is a property of one
+	* model's output scale, not of the step slot it sits in: YuNet's
+	* `sqrt(cls·obj)` is not SCRFD's score, and inheriting SCRFD's 0.5 filled the
+	* face gallery with wheels and hands (D662, amends D645). An operator's
+	* explicit value still wins over it. Resolved in ONE place —
+	* `addon-pipeline/.../registry/effective-confidence.ts`.
+	*/
+	defaultConfidence: number().min(0).max(1).optional(),
+	/**
 	* When true, the executor produces a landmark-aligned crop (similarity warp
 	* onto the canonical template) before this step runs, instead of a plain
 	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
@@ -9575,11 +9705,11 @@ var ModelCatalogEntrySchema = object({
 		p95LatencyMs: record(string(), number()).optional()
 	}).optional(),
 	/**
-	* SPDX-ish license id of the model weights (e.g. `AGPL-3.0` for Ultralytics
-	* YOLO26, `GPL-3.0` for YOLOv9, `Apache-2.0` for D-FINE/RF-DETR). Matters for
-	* the retraining addon and any future commercial distribution.
+	* The model's licence record — see {@link ModelLicenseSchema}. Optional in
+	* the schema (a custom model's author may state none); REQUIRED and complete
+	* on every built-in catalog entry (`scripts/check-catalog-licence.ts`).
 	*/
-	license: string().optional(),
+	license: ModelLicenseSchema.optional(),
 	/**
 	* Variant-selector grouping. The UI groups models by `family` + `tier` and
 	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
@@ -9601,7 +9731,14 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -9619,7 +9756,8 @@ var ModelConvertMetadataSchema = object({
 	inputNormalization: _enum([
 		"zero-one",
 		"imagenet",
-		"none"
+		"none",
+		"scrfd"
 	]).optional(),
 	preprocessMode: _enum(["letterbox", "resize"]).optional(),
 	outputFormat: _enum([
@@ -9666,23 +9804,6 @@ var ExpressionEvalError = class extends Error {
 		this.name = "ExpressionEvalError";
 	}
 };
-/**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
 function asFiniteNumber(value, name, index) {
 	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
 	return value;
@@ -9698,6 +9819,10 @@ function finiteResult(value, name) {
 function allFiniteNumbers(args, name) {
 	return args.map((a, idx) => asFiniteNumber(a, name, idx));
 }
+function asBoolean$1(value, name, index) {
+	if (typeof value !== "boolean") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a boolean`);
+	return value;
+}
 var INF = Number.POSITIVE_INFINITY;
 var table = {
 	min: {
@@ -9798,6 +9923,40 @@ var table = {
 			if (from === to) return x;
 			throw new ExpressionEvalError("convert: unit conversion table not installed");
 		}
+	},
+	any: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean$1(a, "any", i)).some((b) => b)
+	},
+	all: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean$1(a, "all", i)).every((b) => b)
+	},
+	within: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args, hooks) => {
+			const windowMs = asFiniteNumber(args[1], "within", 1);
+			if (windowMs < 0) throw new ExpressionEvalError("within: the window must not be negative");
+			const at = args[0];
+			if (at === null) return false;
+			const ts = asFiniteNumber(at, "within", 0);
+			const now = hooks.now;
+			if (now === void 0 || !Number.isFinite(now)) throw new ExpressionEvalError("within: no clock was supplied to this evaluation");
+			const inside = now - ts <= windowMs;
+			if (inside) hooks.noteDeadline?.(ts + windowMs + 1);
+			return inside;
+		}
+	},
+	latest: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const present = args.flatMap((a, i) => a === null ? [] : [asFiniteNumber(a, "latest", i)]);
+			return present.length === 0 ? null : finiteResult(Math.max(...present), "latest");
+		}
 	}
 };
 Object.freeze(Object.assign(Object.create(null), table));
@@ -10412,7 +10571,7 @@ var AutomationActionSchema = discriminatedUnion("kind", [
 		code: string().min(1).max(2e4)
 	})
 ]);
-object({
+var AutomationRecipeSchema = object({
 	triggers: array(AutomationTriggerSchema),
 	conditions: AutomationConditionSchema.optional(),
 	actions: array(AutomationActionSchema)
@@ -10880,12 +11039,32 @@ var AudioClassificationLabelSchema = object({
 	originalClass: string().optional(),
 	score: number()
 });
+/**
+* Did the classifier RUN on this window? (D660)
+*
+* `classified` with no labels means the model heard nothing above the
+* camera's floor. `not-classified` means nobody listened — and until D660 the
+* two were the same shape (`classification` absent), so a window the global
+* busy gate threw away read downstream exactly like a quiet one (D393).
+*/
+var AudioClassifyOutcomeSchema = discriminatedUnion("state", [object({ state: literal("classified") }), object({
+	state: literal("not-classified"),
+	reason: _enum([
+		"superseded",
+		"error",
+		"timeout",
+		"disposed"
+	])
+})]);
 var AudioAnalysisResultSchema = object({
 	level: AudioLevelSchema,
+	/** Labels at or above the camera's floor. Absent = none — read `classifyOutcome` to know whether the model ran at all. */
 	classification: object({
 		labels: array(AudioClassificationLabelSchema).readonly(),
 		inferenceMs: number()
 	}).optional(),
+	/** Whether the classifier ran on this window (D660). */
+	classifyOutcome: AudioClassifyOutcomeSchema,
 	timestamp: number()
 });
 var AudioAnalysisSettingsSchema = object({
@@ -12545,6 +12724,195 @@ var cameraStreamsCapability = {
 	*/
 	durability: "session"
 };
+/** A composed device's stableId is this prefix plus the block id. */
+var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
+/** Longest snippet a `code` source may carry (slice 4). */
+var MAX_COMPOSITION_CODE_LENGTH = 2e4;
+var CompositionSourceRefSchema = object({
+	/** The owning addon; `stableId` is unique only within it. */
+	addonId: string().min(1),
+	stableId: string().min(1)
+});
+/** One field of one capability of one source device. */
+var CompositionFieldReadSchema = object({
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	/** Dotted path into the source cap's runtime-state slice. */
+	fieldPath: string().min(1)
+});
+/** `from`: copy one source field verbatim. It is also an expression's `from` binding. */
+var CompositionFromSourceSchema = CompositionFieldReadSchema.extend({ kind: literal("from") });
+var CompositionBindingSchema = discriminatedUnion("kind", [CompositionFromSourceSchema, object({
+	kind: literal("literal"),
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	])
+})]);
+/**
+* `expression`: a formula over named bindings, in the salvaged expression
+* engine. Validated at parse by the SAME function every other consumer runs,
+* so the editor and the store cannot disagree.
+*/
+var CompositionExpressionSourceSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), CompositionBindingSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/** `code`: RESERVED for slice 4 (own runner, one-way eject). */
+var CompositionCodeSourceSchema = object({
+	kind: literal("code"),
+	code: string().min(1).max(MAX_COMPOSITION_CODE_LENGTH)
+});
+var CompositionFieldSourceSchema = discriminatedUnion("kind", [
+	CompositionFromSourceSchema,
+	CompositionExpressionSourceSchema,
+	CompositionCodeSourceSchema
+]);
+var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
+	kind: literal("forward"),
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	method: string().min(1)
+}), CompositionCodeSourceSchema]);
+var CompositionFeatureSchema = discriminatedUnion("kind", [object({
+	kind: literal("fields"),
+	cap: string().min(1),
+	fields: record(string().min(1), CompositionFieldSourceSchema).refine((fields) => Object.keys(fields).length <= 32, { message: `at most 32 fields per capability` }),
+	/** RESERVED for slice 3; refused by the validator when non-empty. */
+	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
+}), object({
+	kind: literal("passthrough"),
+	cap: string().min(1),
+	source: CompositionSourceRefSchema
+})]);
+var CompositionSchema = object({
+	target: discriminatedUnion("kind", [object({
+		kind: literal("new"),
+		type: _enum(DeviceType),
+		role: _enum(DeviceRole).optional()
+	}), object({
+		kind: literal("existing"),
+		device: CompositionSourceRefSchema
+	})]),
+	features: array(CompositionFeatureSchema).min(1).max(16)
+}).superRefine((composition, ctx) => {
+	const seen = /* @__PURE__ */ new Set();
+	composition.features.forEach((feature, index) => {
+		if (seen.has(feature.cap)) ctx.addIssue({
+			code: "custom",
+			message: `capability \`${feature.cap}\` is composed twice — one feature per capability`,
+			path: [
+				"features",
+				index,
+				"cap"
+			]
+		});
+		seen.add(feature.cap);
+	});
+});
+/** One refusal, named (D391). `path` points into the composition, e.g. `features[0].fields.celsius`. */
+var CompositionProblemSchema = object({
+	code: _enum([
+		"reserved-variant",
+		"unknown-capability",
+		"not-composable",
+		"wrong-device-type",
+		"has-commands",
+		"unknown-field",
+		"nested-field",
+		"missing-field",
+		"kind-mismatch",
+		"may-be-null",
+		"source-missing",
+		"source-unreadable",
+		"source-capability-missing",
+		"source-field-unknown",
+		"expression-invalid",
+		"cycle",
+		"duplicate-target"
+	]),
+	path: string(),
+	message: string()
+});
+var CompositionFieldKindSchema = _enum([
+	"string",
+	"number",
+	"boolean",
+	"enum"
+]);
+/** How a field says "unavailable": `null` when its schema allows it, else the device goes offline (D393). */
+var CompositionUnavailableModeSchema = _enum(["null", "offline"]);
+/**
+* `derived` reads a source · `clock` reads only `now`, recomputed when a sibling
+* field of its cap changes value · `constant` reads nothing, computed once.
+*/
+var CompositionFieldRoleSchema = _enum([
+	"derived",
+	"clock",
+	"constant"
+]);
+var CompositionFieldPlanSchema = object({
+	cap: string(),
+	path: string(),
+	/** Index into `composition.features` this field's capability came from —
+	*  lets a source/cycle problem name its path as `features[N].fields.<path>`
+	*  (the same convention `planComposition`'s own problems already use). */
+	featureIndex: number().int().nonnegative(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	unavailable: CompositionUnavailableModeSchema,
+	role: CompositionFieldRoleSchema,
+	source: CompositionFieldSourceSchema,
+	reads: array(CompositionFieldReadSchema)
+});
+var CompositionValidationSchema = object({
+	ok: boolean(),
+	problems: array(CompositionProblemSchema),
+	fields: array(CompositionFieldPlanSchema)
+});
+/** Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts` (Task 11). */
+var CompositionRunStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"failed"
+]);
+var CompositionFieldStateKindSchema = _enum([
+	"fresh",
+	"stale",
+	"unavailable"
+]);
+var CompositionFieldStateSchema = object({
+	cap: string(),
+	path: string(),
+	state: CompositionFieldStateKindSchema,
+	/** `null` whenever `state === 'unavailable'`; never a plausible stand-in (D393). */
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	]),
+	reason: string().optional()
+});
+var CompositionBlockStateSchema = object({
+	blockId: string(),
+	deviceId: number().nullable(),
+	status: CompositionRunStatusSchema,
+	reason: string().optional(),
+	fields: array(CompositionFieldStateSchema)
+});
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -12571,6 +12939,30 @@ var CoreBlockInputSchema = object({
 	*/
 	integrationId: string().optional()
 });
+/**
+* What a block IS (D659). Absent means `code` — every row stored before this
+* union keeps working unchanged.
+*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
+*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
+*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+*/
+var CoreBlockSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("code") }),
+	object({
+		kind: literal("recipe"),
+		recipe: AutomationRecipeSchema
+	}),
+	object({
+		kind: literal("composition"),
+		composition: CompositionSchema
+	})
+]);
+/** The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7). */
+var CompositionBlockInputSchema = object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	composition: CompositionSchema
+});
 /** A stored block. */
 var CoreBlockSchema = CoreBlockInputSchema.extend({
 	id: string(),
@@ -12586,8 +12978,38 @@ var CoreBlockSchema = CoreBlockInputSchema.extend({
 	*/
 	lastError: string().optional(),
 	/** Ms epoch of the last state change. */
-	lastChangedAt: number()
+	lastChangedAt: number(),
+	/** What the block is. Absent means `code` (D659). */
+	source: CoreBlockSourceSchema.optional()
+});
+/** A stored composition block and what the composer says about it. */
+var CompositionViewSchema = object({
+	block: CoreBlockSchema,
+	state: discriminatedUnion("kind", [object({
+		kind: literal("answered"),
+		state: CompositionBlockStateSchema.nullable()
+	}), object({
+		kind: literal("unreachable"),
+		error: string()
+	})])
+});
+/**
+* A read of the stored compositions. `not-loaded` while the `core_blocks`
+* table has not been READ: an empty answer then would make "not yet known"
+* look like "none", and invite the operator to recreate what exists (D315).
+*/
+var CompositionsNotLoadedSchema = object({
+	state: literal("not-loaded"),
+	reason: string()
 });
+var CompositionListReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	views: array(CompositionViewSchema)
+}), CompositionsNotLoadedSchema]);
+var CompositionGetReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
 /** What a compile attempt produced. */
 var CoreBlockCompileResultSchema = object({
 	ok: boolean(),
@@ -12625,7 +13047,72 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), method(object({}), object({ libs: array(object({
 	filePath: string(),
 	content: string()
-})) }), { auth: "admin" });
+})) }), { auth: "admin" }), method(object({ block: CompositionBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	expectedUpdatedAt: number(),
+	block: CompositionBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
+	composition: CompositionSchema,
+	blockId: string().optional()
+}), CompositionValidationSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "view"
+});
+var ComposerBlockSchema = object({
+	id: string().min(1),
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	updatedAt: number(),
+	composition: CompositionSchema
+});
+/**
+* A stored composition row that no longer PARSES — a schema a release
+* tightened, a row written by a newer build. Sent by id so the composer keeps
+* its device as a placeholder and reports the block `failed` naming the parse
+* error. Leaving it out would read, twice, exactly like a delete (D49).
+*/
+var ComposerUnreadableBlockSchema = object({
+	id: string().min(1),
+	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
+	name: string().nullable(),
+	/** The parse error, in the operator's words. */
+	error: string()
+});
+method(object({
+	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
+	integrationId: string().nullable(),
+	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
+	storeLoaded: boolean(),
+	blocks: array(ComposerBlockSchema),
+	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
+	restartBlockIds: array(string()),
+	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
+	unreadableBlocks: array(ComposerUnreadableBlockSchema)
+}), object({
+	blocks: array(object({
+		blockId: string(),
+		status: CompositionRunStatusSchema,
+		reason: string().optional()
+	})),
+	/**
+	* False when the composer declared and withdrew NOTHING (store not loaded,
+	* integration unknown, its own rows unread or read empty once). An empty
+	* apply the caller owes is paid off only by one the composer acted on (D49).
+	*/
+	acted: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
 * custom detection models. Each provider (today: `addon-model-studio`)
@@ -14221,6 +14708,27 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*
+* `trackedDeviceIds` (D655) is the tracked-event opt-in, exactly what
+* `_linkedDeviceTrackedIds` persists: which linked devices materialize a
+* synthetic tracked event on the camera. A read always carries it AS STORED
+* (an absent key reads as `[]`, which is what the resolver makes of it —
+* NONE). On a write it is optional: absent leaves the opt-in untouched, so a
+* card built before D655 cannot erase it by saving the pick list. A present
+* list REPLACES the opt-in; each id must be a pick, a device the camera links
+* by structure (the row's `impliedSources`: tree children, a picked
+* container's child) or already stored — so what was read can always be
+* written back unchanged, and a NEW opt-in outside the linked set is refused.
+*/
+var LinkedDevicesSlotValueSchema = object({
+	deviceIds: array(number().int().positive()),
+	trackedDeviceIds: array(number().int().positive()).optional()
+});
+DeviceType.Camera;
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -14746,16 +15254,101 @@ var EmbeddingResultSchema = object({
 	embedding: array(number()),
 	inferenceMs: number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = _enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	crashes: number(),
+	windowMs: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = object({
+	modelId: string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: string(),
+	attempts: number(),
+	sinceMs: number(),
+	lastReason: string()
+});
 var EmbeddingInfoSchema = object({
 	modelId: string(),
 	embeddingDim: number(),
-	ready: boolean()
-});
+	ready: boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+_enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
 method(object({
 	crop: _instanceof(Uint8Array),
 	width: number(),
 	height: number()
-}), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
+}), EmbeddingResultSchema, { auth: "admin" }), method(object({
+	text: string(),
+	modelId: string().min(1).optional()
+}), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" }), method(object({ modelId: string().min(1).optional() }), object({
+	cleared: array(string()),
+	nodeId: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `failure-contribution` — the capability an addon reports its OWN losses
 * through, per camera, with the denominator attached. It stores nothing.
@@ -17438,6 +18031,9 @@ var NcSystemEventKindSchema = _enum([
 	"device-battery-normal",
 	"device-consumable-low",
 	"device-consumable-normal",
+	"device-tank-low",
+	"device-tank-full",
+	"device-tank-normal",
 	"stream-online",
 	"stream-offline",
 	"node-online",
@@ -17475,6 +18071,29 @@ var NC_LEGACY_SYSTEM_EVENT_KINDS = new Set([
 ]);
 NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
 /**
+* The panel's transitions, as ONE list.
+*
+* Named here rather than spelled out at each of the four sites that need them
+* (the emitter, the intake, the editor group, the combined-notification gate),
+* because a transition added to the enum and forgotten at one of them is an
+* alarm state nobody can be notified about. That is exactly what this list
+* failed to prevent while it held three: `alarm-arming` was the fourth.
+*
+* In LIFECYCLE order, which is the order an editor lists them in and the order
+* a person experiences them — not the order they were added.
+*/
+var NC_ALARM_SYSTEM_EVENT_KINDS = [
+	"alarm-arm-refused",
+	"alarm-check-failed",
+	"alarm-arming",
+	"alarm-armed",
+	"alarm-pending",
+	"alarm-triggered",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-disarmed"
+];
+/**
 * One coherent system-event condition. `kinds` is the required opt-in safety
 * gate; the remaining lists are optional narrowing filters relevant to the
 * selected kinds.
@@ -17508,7 +18127,22 @@ var NcSystemEventConditionSchema = object({
 	*/
 	excludeDeviceIds: array(number().int()).min(1).optional(),
 	nodeIds: array(string().min(1)).min(1).optional(),
-	packageNames: array(string().min(1)).min(1).optional()
+	packageNames: array(string().min(1)).min(1).optional(),
+	/**
+	* At or below this remaining-life %, a consumable is LOW for THIS rule
+	* (D642). Absent = {@link NC_CONSUMABLE_LOW_PERCENT_DEFAULT}; at most
+	* {@link NC_CONSUMABLE_LOW_PERCENT_MAX}, so every episode can recover. Scoped to the
+	* consumable kinds (`systemEventFilterApplies`) and to the device-events
+	* family; ignored on every other kind.
+	*
+	* It is a property of the RULE because the operator decided so: a rule at
+	* 25 must be told about a filter at 20 %, a rule at 10 must not. The hub
+	* keeps one episode per (threshold, device, item) — its own hysteresis, its
+	* own reminder — and a rule hears only the episode judged at ITS threshold,
+	* exactly as an occupancy rule hears only the edge of its own count. A
+	* provider's own `replace` verdict is low at every threshold.
+	*/
+	consumableLowPercent: number().int().min(1).max(95).optional()
 });
 /** Hard ceiling on a window (24h). A snooze that could not expire would be an
 *  outage the operator asked for once and forgot. */
@@ -17526,6 +18160,25 @@ var NcScheduleSchema = object({
 	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
 	invert: boolean().optional()
 });
+/**
+* How a system-event rule of the `device-events` or `system` family speaks
+* (D647): at once, per event (`instant`, the only behaviour before D647), or
+* as a STATE SUMMARY at the end of each window of `schedule`.
+*/
+var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
+/**
+* `summary`: the rule sends NOTHING per event. When a window of `schedule`
+* CLOSES, it sends one notification with the current state of its kinds
+* (low batteries, consumables to replace, devices offline, updates
+* available, ...), after its own filters. Nothing to report sends nothing.
+* The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
+* midnight crossing); the send time is each window's END. Refused on the
+* `alarm` family, which stays instant (`systemEventDeliveryProblems`).
+*/
+var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
+	mode: literal("summary"),
+	schedule: NcScheduleSchema
+})]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
 	/**
@@ -17651,6 +18304,16 @@ var NcCrossingSchema = _enum([
 	"exit",
 	"any"
 ]);
+/**
+* Which edge of a BOOLEAN sensor fires a device-event rule (D640).
+*  - `raised`  — the sensor went high: water detected, smoke, open, tampered.
+*  - `cleared` — it went back: dry, clear, closed.
+*  - absent    — both edges, which is what every rule authored before this did.
+*
+* There is no third member for "both": absence already says it, and a value
+* that means the same as absence is a second way to write one rule.
+*/
+var NcSensorTransitionSchema = _enum(["raised", "cleared"]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = object({
 	ids: array(string().min(1)).min(1),
@@ -17840,6 +18503,20 @@ var NcConditionsSchema = object({
 	scene: NcSceneConditionSchema.optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
+	/**
+	* Device EXCLUSION (D641) — "every device except these". Judged on the SAME
+	* subject ids {@link devices} is judged on (the camera, the sensor that
+	* fired, a linked set's sensor and row cameras), so a sensor fanned out per
+	* linked camera is excluded exactly where an include would have tested it.
+	* `min(1)`: an empty exclusion excludes nothing and is written as absent.
+	*
+	* Not for `system-event` rules — those carry their own
+	* `systemEvent.excludeDeviceIds` (D636), and the hub refuses this key there.
+	* Editors present the two lists as ONE field (All | Only these | All except
+	* these); the engine evaluates each independently, so a legacy rule
+	* carrying both still means "these, minus those".
+	*/
+	devicesExclude: array(number()).min(1).optional(),
 	/** Detector class names (any overlap with the record's class set). */
 	classes: array(string().min(1)).optional(),
 	/** Veto classes — any overlap fails the rule. */
@@ -17973,6 +18650,16 @@ var NcConditionsSchema = object({
 	*/
 	sensorKinds: array(string().min(1)).optional(),
 	/**
+	* DEVICE-EVENT only (D640). Fire on one edge of a boolean sensor —
+	* {@link NcSensorTransitionSchema}. Which field of the slice means "raised"
+	* is `@camstack/types` → `notification/sensor-raised.ts`. A reading the
+	* engine cannot place (a kind with no raise, an unreadable slice) PASSES:
+	* the condition fails open towards notifying, never towards silence. Editors
+	* offer it only when every chosen {@link sensorKinds} member has a raise
+	* (`sensorTransitionOffered`), and the hub refuses it on any other delivery.
+	*/
+	sensorTransition: NcSensorTransitionSchema.optional(),
+	/**
 	* PACKAGE-EVENT only. Which package phase fires the rule — `delivered`
 	* (a parked parcel appeared), `picked-up` (it departed), or `both`. Fails
 	* when the subject's phase does not match (a subject always carries a phase
@@ -18105,7 +18792,12 @@ var NcMediaPolicySchema = object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
@@ -18227,6 +18919,16 @@ var NcRuleInputSchema = object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
+	/**
+	* A `device-events` / `system` rule's delivery (D647): absent or `instant`
+	* is a notification per event; `summary` is one state summary per closed
+	* window of its schedule. `.optional()` and never defaulted: absent must
+	* keep meaning what every rule authored before D647 meant, with no
+	* migration. Top-level rather than inside `conditions.systemEvent`, so a
+	* client that does not know it (an older viewer re-sending `conditions`
+	* whole) leaves it standing through the store's patch merge.
+	*/
+	systemEventDelivery: NcSystemEventDeliverySchema.optional(),
 	/** May be empty when `targetUsers` addresses at least one user — the
 	*  "at least one addressee" invariant is enforced by the provider, because
 	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
@@ -18455,6 +19157,28 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	*/
 	disabledTargetIds: array(string()).default([])
 });
+/** One section of a previewed state summary. `unavailable` = its state could not be read. */
+var NcStateSummaryPreviewSectionSchema = object({
+	id: string(),
+	status: _enum(["read", "unavailable"]),
+	items: number().int().nonnegative(),
+	reason: string().optional()
+});
+/**
+* The summary a rule would send now. `empty` = nothing to report and every
+* section read: such a summary is NOT sent. `dropped` counts the open states
+* the rule's own filters (or a camera mute) left out, by reason.
+* `excludedGroups` names the kind groups selected that have no state to report
+* (backups & exports).
+*/
+var NcStateSummaryPreviewSchema = object({
+	empty: boolean(),
+	count: number().int().nonnegative(),
+	text: string(),
+	sections: array(NcStateSummaryPreviewSectionSchema),
+	dropped: record(string(), number().int().nonnegative()),
+	excludedGroups: array(string())
+});
 var NcTestResultSchema = object({
 	recordId: string(),
 	recordKind: _enum([
@@ -18472,9 +19196,29 @@ var NcTestResultSchema = object({
 	className: string().optional(),
 	label: string().optional()
 });
-/** The five rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts`
-*  is the same union; the template-vars spec pins the two together. */
+/** The rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts` is
+*  `z.infer` of this schema — one shape, no twin. `mixed` is DERIVED
+*  (a stored system rule whose kinds span families, D637) and never authored. */
 var NcRuleKindSchema = _enum([
+	"detection",
+	"sensor",
+	"occupancy",
+	"sound",
+	"device-events",
+	"system",
+	"alarm",
+	"mixed"
+]);
+/**
+* The kinds a SERVED template-variable descriptor may name: the five that
+* existed before D637, frozen. `getTemplateCatalog` ships `kinds` to every
+* installed viewer, and a viewer at `@camstack/types` 1.2.25x parses them with a
+* strict five-member enum — one `device-events` in one descriptor fails the
+* whole catalog parse. So the WIRE says `system`, and the MATCH widens it:
+* `templateVarKindApplies` reads a `system` descriptor as applying to every
+* system rule kind (`device-events`, `system`, `alarm`, `mixed`).
+*/
+var NcTemplateVarKindSchema = _enum([
 	"detection",
 	"sensor",
 	"occupancy",
@@ -18512,7 +19256,7 @@ var NcTemplateVarGroupSchema = _enum([
 *
 * `families` / `fields` / `kinds` / `deliveries` / `systemEventKinds` say WHERE
 * it has a value; absent = no restriction on that axis. `systemEventKinds` is
-* read only for a `system` rule. `dynamic` declares a FAMILY of names
+* read only for a system-event rule (any family, or `mixed`). `dynamic` declares a FAMILY of names
 * (`count_<class>`): the descriptor's `name` is the example member.
 */
 var NcTemplateVarDescriptorSchema = object({
@@ -18523,9 +19267,16 @@ var NcTemplateVarDescriptorSchema = object({
 	group: NcTemplateVarGroupSchema,
 	families: array(NcTemplateFamilySchema).min(1),
 	fields: array(NcTemplateFieldSchema).optional(),
-	kinds: array(NcRuleKindSchema).optional(),
+	kinds: array(NcTemplateVarKindSchema).optional(),
 	deliveries: array(NcDeliverySchema).optional(),
 	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	/**
+	* Which system-event DELIVERY has a value for it (D647). Absent = an
+	* instant row only when the descriptor names `systemEventKinds` (a
+	* per-event fact: a summary row has no single device), and both otherwise.
+	* `['summary']` marks the state-summary vocabulary (`{{summaryText}}`, ...).
+	*/
+	systemEventDeliveries: array(NcSystemEventDeliveryModeSchema).optional(),
 	dynamic: object({
 		prefix: literal("count_"),
 		from: literal("classes")
@@ -18538,7 +19289,9 @@ var NcTemplatePreviewInputSchema = object({
 		field: NcTemplateFieldSchema,
 		kind: NcRuleKindSchema.optional(),
 		delivery: NcDeliverySchema.optional(),
-		systemEventKinds: array(NcSystemEventKindSchema).optional()
+		systemEventKinds: array(NcSystemEventKindSchema).optional(),
+		/** The rule's system-event delivery (D647); absent = instant. */
+		systemEventDelivery: NcSystemEventDeliveryModeSchema.optional()
 	}),
 	template: object({
 		title: string().max(500).optional(),
@@ -18571,6 +19324,7 @@ var NcConditionDescriptorSchema = object({
 	/** Editor widget the UI renders — never hardcode per-condition forms. */
 	valueType: _enum([
 		"deviceIdList",
+		"deviceIdExcludeList",
 		"stringList",
 		"number01",
 		"number",
@@ -18581,6 +19335,7 @@ var NcConditionDescriptorSchema = object({
 		"plateMatcher",
 		"packagePhase",
 		"crossingSelect",
+		"sensorTransition",
 		"polygonDraw",
 		"occupancy",
 		"audio",
@@ -18731,6 +19486,28 @@ var NcHistoryFilterSchema = object({
 	limit: number().int().min(1).max(500).default(100)
 });
 /**
+* Every rule's last run, in one answer.
+*
+* A rule ABSENT from `runs` produced no delivery inside `horizonMs` — how far
+* back this answer looked, in ms before the hub's now. It is the outbox prune
+* window (7 days by default, operator-configurable), NARROWED when the read hit
+* its row bound: the answer never claims a window it did not read. `null` means
+* the operator keeps the outbox forever AND the read reached its end, so absent
+* means "never on record". A UI derives its "not in the last N days" from this
+* value, never from a constant — and only when the call ANSWERED (D315).
+*/
+var NcRuleLastRunsSchema = object({
+	runs: array(object({
+		ruleId: string(),
+		/** Fire time of the newest row (`createdAt`, epoch ms). */
+		lastAt: number(),
+		status: NcHistoryStatusSchema,
+		/** The camera/device of that row (a digest row files under its first camera). */
+		deviceId: number()
+	})),
+	horizonMs: number().nonnegative().nullable()
+});
+/**
 * What a snooze covers. Broader scopes win when several overlap, so one window
 * leaves ONE digest rather than a rule snooze and a whole-feed snooze both
 * summarising the same silence.
@@ -18911,6 +19688,14 @@ var NcAlarmModeCoverageSchema = object({
 	/** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
 	deviceIds: array(number().int()),
 	/**
+	* D641: the ids NOT covered although `allDevices` is true — every unscoped
+	* covering rule EXCLUDES them (`conditions.devicesExclude`) and no named rule
+	* covers them. Always `[]` when `allDevices` is false. Excluded by the rules,
+	* which is not the same as skipped by a switch: never in `skippedDevices`.
+	* Defaulted so an answer computed before this field parses as "none".
+	*/
+	allDevicesExcept: array(number().int()).default([]),
+	/**
 	* Devices this mode NAMES but cannot actually arm, each with the switch that
 	* excludes it.
 	*
@@ -19040,13 +19825,17 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), object({ results: array(NcTestResultSchema) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ rule: NcRuleInputSchema }), NcStateSummaryPreviewSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "view"
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
 })), method(object({}), object({ vars: array(NcTemplateVarDescriptorSchema) })), method(NcTemplatePreviewInputSchema, NcTemplatePreviewSchema, {
 	kind: "mutation",
 	access: "view"
-}), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+}), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({}), NcRuleLastRunsSchema, { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
 	kind: "mutation",
 	caller: "required"
 }), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
@@ -19386,645 +20175,129 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* Reference to the frame's retained NATIVE surface + the parent crop's placement
-* within the frame, so the executor can re-cut a leaf child ROI at native
-* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
-*/
-var NativeCropRefSchema = object({
-	/** Handle keying the retained native surface (node-pinned to its owner). */
-	handle: FrameHandleSchema,
-	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-	cropFrameSpace: object({
-		x: number(),
-		y: number(),
-		w: number(),
-		h: number()
-	})
-});
-object({
-	crop: object({
-		left: number(),
-		top: number(),
-		width: number().positive(),
-		height: number().positive()
-	}).optional(),
-	content: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}),
-	fit: _enum(["stretch", "contain"]),
-	format: _enum([
-		"rgb",
-		"gray",
-		"jpeg"
-	])
-});
-/**
-* Process-local frame identity. It is serializable so it can ride an in-process
-* capability call, but `registryId` deliberately prevents resolution in any
-* other process or execution group.
-*/
-var FrameRefSchema = object({
-	registryId: string().min(1),
-	id: string().min(1),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum(["rgb", "gray"]),
-	timestamp: number(),
-	capturedAt: number().optional()
-});
-var ModelFormatSchema$1 = _enum([
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-]);
-var PipelineSlotSchema = _enum([
-	"detector",
-	"cropper",
-	"classifier",
-	"refiner",
-	"audio-classifier"
-]);
-var PipelineEngineChoiceSchema = object({
-	runtime: _enum(["node", "python"]),
-	backend: string(),
-	format: ModelFormatSchema$1,
-	device: string().optional()
-});
-var AvailableEngineSchema = object({
-	engine: PipelineEngineChoiceSchema,
-	devices: array(object({
-		id: string(),
-		label: string(),
-		description: string().optional()
-	})).readonly(),
-	defaultDevice: string()
-});
-var PipelineDefaultStepSchema = lazy(() => object({
-	addonId: string(),
-	addonName: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineDefaultStepSchema).readonly(),
-	group: string().optional(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
-});
-var PipelineModelOptionSchema = object({
-	id: string(),
-	name: string(),
-	formats: record(string(), object({
-		downloaded: boolean(),
-		sizeMB: number()
-	})),
-	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
-});
-var ConfigFieldBridge = custom();
-var PipelineAddonSchemaSchema = object({
-	id: string(),
-	name: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	childSlots: array(PipelineSlotSchema).readonly(),
-	models: array(PipelineModelOptionSchema).readonly(),
-	defaultModelId: string(),
-	defaultModelIdByFormat: record(string(), string()).optional(),
-	enabledByDefault: boolean().optional(),
-	backfillIntoExistingOverrides: boolean().optional(),
-	defaultConfidence: number(),
-	group: string().optional(),
-	configSchema: array(ConfigFieldBridge).readonly().optional()
-});
-var PipelineSlotSchemaSchema = object({
-	id: PipelineSlotSchema,
-	label: string(),
-	priority: number(),
-	parentSlot: PipelineSlotSchema.nullable(),
-	addons: array(PipelineAddonSchemaSchema).readonly()
-});
-var PipelineSchemaSchema = object({
-	availableEngines: array(AvailableEngineSchema).readonly(),
-	selectedEngine: PipelineEngineChoiceSchema,
-	slots: array(PipelineSlotSchemaSchema).readonly()
-});
-var EngineProvisioningSchema = object({
-	runtimeId: _enum([
-		"onnx",
-		"openvino",
-		"coreml",
-		"edgetpu"
-	]).nullable(),
-	device: string().nullable(),
-	state: _enum([
-		"idle",
-		"installing",
-		"verifying",
-		"ready",
-		"failed"
-	]),
-	progress: number().optional(),
-	error: string().optional(),
-	nextRetryAt: number().optional(),
-	/**
-	* Gate A (config-correctness gate at engine change): human-readable
-	* config issues surfaced EAGERLY when the node's engine changes — model
-	* substitutions ("chose X, running Y") and zero-build steps ("no model
-	* has a <format> build"). Additive/optional: informational only, never
-	* enforced here — `assertEngineReady` (readiness) still gates inference.
-	* Absent/empty when the node-default tree resolves cleanly.
-	*/
-	configIssues: array(string()).optional()
-});
-var PipelineStepInputSchema = lazy(() => object({
-	addonId: string(),
-	modelId: string().optional(),
-	enabled: boolean().default(true),
-	children: array(PipelineStepInputSchema).optional(),
-	settings: record(string(), unknown()).optional(),
-	jumpDeviceKey: string().optional()
-}));
-var ModelSubstitutionSchema = object({
-	addonId: string(),
-	chosen: string(),
-	running: string(),
-	format: string()
-});
-var PipelineValidationIssueSchema = object({
-	addonId: string(),
-	kind: _enum(["unknown-addon", "no-format-build"]),
-	detail: string()
-});
-var PipelineValidationResultSchema = object({
-	ok: boolean(),
-	issues: array(PipelineValidationIssueSchema).readonly(),
-	substitutions: array(ModelSubstitutionSchema).readonly(),
-	/** The node's `currentEngine.format` this validation ran against. */
-	format: string()
-});
-var ReferenceImageEntrySchema = object({
-	filename: string(),
-	stepIds: array(string()).readonly().optional()
-});
-var ReferenceImageBodySchema = object({
-	base64: string(),
-	filename: string()
-});
-var ReferenceAudioEntrySchema = object({
-	filename: string(),
-	sizeKb: number()
-});
-var ReferenceAudioBodySchema = object({ base64: string() });
-var AudioBackendSchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	available: boolean(),
-	/**
-	* Raw classifier labels this backend can emit (e.g. YAMNet's
-	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
-	* the benchmark UI to populate the `enabledMicroClasses` filter
-	* specific to the selected backend without a separate fetch.
-	*/
-	rawLabels: array(string()).readonly().optional()
-});
-var AudioCapabilitiesSchema = object({
-	activeBackend: string(),
-	availableBackends: array(AudioBackendSchema).readonly(),
-	sampleRate: number(),
-	chunkDurationMs: number()
-});
-var DownloadModelResultSchema = object({
-	filePath: string(),
-	sizeMB: number(),
-	durationMs: number()
-});
-/**
-* Wrapper carrying a single test run's result. Replaces the legacy
-* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
-* canonical `AudioResult` from the Phase 6 output rework: one
-* `AudioDetection` per class above `minScore`, top-N candidates in
-* `debug.alternateLabels['audio-classifier']`, per-source timings in
-* `debug.stepTimings`. The outer `success`/`error` fields stay so the
-* benchmark UI can still report a clean failure when the classifier
-* cap isn't available.
-*/
-var AudioTestResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	frame: custom().optional()
-});
-var PipelineConfigBridge = custom();
-var ConfigUISchemaBridge = custom();
-var ConfigUISchemaNullableBridge = custom();
-var InferenceCapabilitiesBridge = custom();
-var ModelAvailabilityListBridge = custom();
-var PipelineRunResultBridge = custom();
-method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-}))), method(object({ steps: record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-})) }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({
-	success: literal(true),
-	clearedDevices: number()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
-	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
-	deviceKey: string(),
-	/**
-	* `failed` — the per-device restart budget is exhausted; no pool
-	* will be spawned until an operator re-arms it or the runner
-	* respawns. `backoff` — under budget, waiting out the backoff (or
-	* a cached pool observed dead and not yet condemned).
-	*/
-	state: _enum(["failed", "backoff"]),
-	/** Epoch ms of the death that produced this state. */
-	since: number(),
-	/** Pool deaths inside the current window. */
-	deaths: number(),
-	/** The last death's message. */
-	lastError: string()
-})).readonly() })), method(object({
-	nodeId: string(),
-	deviceKey: string()
-}), object({ rearmed: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frame: FrameInputSchema.optional(),
-	/**
-	* Process-local lazy frame. Valid only when caller and provider resolve
-	* in the same execution-group process; split/cross-node callers use
-	* `frame`/`image` inline compatibility instead.
-	*/
-	frameRef: FrameRefSchema.optional(),
-	/**
-	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-	* the decoded pixels live in. One more member of the one-of
-	* frame/frameHandle/image/imageBase64/referenceImage group.
-	*/
-	frameHandle: FrameHandleSchema.optional(),
-	imageBase64: string().optional(),
-	/**
-	* Binary JPEG bytes — preferred over `imageBase64` on internal
-	* hops (hub → forked worker via Moleculer MsgPack) because it
-	* skips the 33% base64 overhead + the per-call base64 decode on
-	* the detection-pipeline worker. Callers can pass either; exactly
-	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-	*/
-	image: _instanceof(Uint8Array).optional(),
-	referenceImage: string().optional(),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Execution plane. 'full' (default) runs the whole tree — benchmark,
-	* reference-image, and detail-subtree calls. 'frame' is the live
-	* per-frame dispatch: ONLY root-plane steps run; crop children
-	* (inputClasses ≠ null) are skipped and served per-track via
-	* pipelineRunner.runDetailSubtree (two-plane design).
-	*/
-	plane: _enum(["full", "frame"]).optional(),
-	/**
-	* Inference-device selector (Phase 2 multi-device). Format
-	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-	* Omitted ⇒ the runner's default device (current single-engine
-	* behaviour). Selects WHICH device pool of the node runs the call.
-	*/
-	deviceKey: string().optional(),
-	/**
-	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-	* when the parent crop was resolved from the frame's retained NATIVE
-	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-	* resolution from that surface — the SAME quality path faces already
-	* had — instead of the downscaled parent tile. `handle` keys the native
-	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
-	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-	* the executor's crop-normalized child ROI back into frame-normalized
-	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-	* (today's behaviour on the fallback path).
-	*/
-	nativeCropRef: NativeCropRefSchema.optional()
-}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frames: array(FrameInputSchema).min(1).max(255),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-	* the batch to the Python pool's bench preprocess cache
-	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-	* preprocessed ONCE and every later inference is a pure-inference cache
-	* hit — the sustained-throughput run measures inference, not
-	* decode+preprocess+infer. Omitted/0 for live frames (all different →
-	* full preprocess every call, correct). Fresh per sustained run;
-	* released via `uncacheFrame`.
-	*/
-	frameId: number().int().nonnegative().optional(),
-	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-	deviceKey: string().optional()
-}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
-	data: _instanceof(Uint8Array),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum([
-		"rgb",
-		"bgr",
-		"gray"
-	])
-}), object({
-	frameId: number(),
-	width: number(),
-	height: number()
-}), { kind: "mutation" }), method(object({
-	stepId: string(),
-	frameId: number().int()
-}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(_void(), object({
-	batchMode: string(),
-	windowMs: number(),
-	maxBatchSize: number(),
-	concurrency: number()
-})), method(_void(), array(object({
-	engineKey: string(),
-	engine: PipelineEngineChoiceSchema,
-	modelsLoaded: array(string()).readonly(),
-	inUseByCameras: array(number()).readonly(),
-	/**
-	* Origin of this resident factory.
-	*  - `runtime`       — main camera-serving engine (no idle TTL).
-	*  - `warm-override` — benchmark/test override held in the warm
-	*                      cache; auto-disposed after the idle TTL.
-	*  - `device-pool`   — a concurrent per-device pool (Phase 2
-	*                      multi-device, keyed by `deviceKey`) resolved
-	*                      via `resolveDeviceFactory`. Runs alongside the
-	*                      `runtime` engine on a DIFFERENT accelerator
-	*                      (NPU / iGPU / Coral) — this is how the
-	*                      Engines tab shows all pools running at once.
-	*/
-	kind: _enum([
-		"runtime",
-		"warm-override",
-		"device-pool"
-	]),
-	/** Native pid of the underlying Python pool (null when no pool). */
-	poolPid: number().nullable(),
-	/** ms since this factory was last used (null when not warm-tracked). */
-	idleMs: number().nullable(),
-	/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-	idleTtlMs: number().nullable()
-})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	engine: PipelineEngineChoiceSchema,
-	force: boolean().optional()
-}), object({
-	success: boolean(),
-	reason: string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
-	addonId: string(),
-	modelId: string(),
-	filename: string().optional(),
-	settings: record(string(), unknown()).optional()
-}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
-/**
-* Per-stage gating mode applied to the zones a rule references.
-*
-* - `include`: the rule contributes to a **whitelist** for its stage.
-*   When at least one `include` rule fires for a stage, only entities
-*   inside one of those zones pass that stage.
-* - `exclude`: the rule contributes to a **blacklist** for its stage.
-*   Entities inside one of those zones are dropped at that stage.
-*
-* `monitor`-style observation (count without filtering) is not a rule
-* mode — zones without any matching rule are observed naturally by
-* `zone-analytics` (live snapshot + history), so an "I just want to
-* count, not filter" use case needs no rule at all.
-*/
-var ZoneRuleModeEnum = _enum(["include", "exclude"]);
-/**
-* Per-consumer rule that references existing zones (geometry) and
-* defines how a specific pipeline stage should treat them. Each
-* consumer addon owns its own `ZoneRule[]` array in its per-device
-* settings:
-*
-* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
-* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
-* - future: notification rules, audio gating, etc.
-*
-* One rule applies to N zones (`zoneIds[]`) so the operator can
-* express "ignore motion in ALL of {garden, street}" with a single
-* rule. `classFilter` narrows the rule to specific object classes —
-* "drop person detections in the street, but keep cars" is one
-* `exclude` rule with `classFilter: ['person']`.
-*
-* `enabled` is a soft toggle — the operator can keep the rule
-* configured but inert without deleting it.
-*/
-var ZoneRuleSchema = object({
-	/** Stable rule id — survives edits, used by the UI for diffing. */
-	id: string(),
-	/** Optional human-readable label rendered in the rule editor. */
-	name: string().optional(),
-	/** Zones this rule targets. The rule's `mode` applies to ALL
-	*  listed zones (OR-set: a detection in any one of them counts).
-	*  At least one zone id required — a rule with no targets is a
-	*  configuration mistake and the form validator rejects it. */
-	zoneIds: array(string()).min(1).readonly(),
-	mode: ZoneRuleModeEnum,
-	/**
-	* Class names this rule applies to. Empty / undefined ⇒ rule
-	* applies to every class. Class strings match the `macroClass`
-	* field on detections (e.g. `person`, `car`, `dog`).
-	*/
-	classFilter: array(string()).readonly().optional(),
-	/**
-	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
-	* required to consider an entity "in the zone". Defaults to the
-	* consumer's stage default when omitted. Kept for back-compat with
-	* existing per-rule overrides; new operators pick the value via
-	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-	* set, the lower-level engine reads it as a 0–1 fraction.
-	*/
-	overlapThreshold: number().min(0).max(1).optional(),
-	/**
-	* Operator-friendly version of `overlapThreshold` — the percentage
-	* of the detection's bbox that must lie inside the zone for the
-	* rule to match. Documented default is 85%; the engine substitutes
-	* that when the field is omitted (kept optional so existing rules
-	* stored without it stay valid).
-	*
-	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-	* rule, the engine prefers `bboxInclusionPct` because it's the
-	* field exposed in the UI. Internally both feed the same gate.
-	*/
-	bboxInclusionPct: number().min(0).max(100).optional(),
-	/**
-	* When `true` and a detection has a segmentation mask, use the
-	* mask for overlap instead of the bbox. Detection-stage only;
-	* motion rules ignore this field.
-	*/
-	preferMask: boolean().optional(),
-	/**
-	* Soft-toggle: `false` disables the rule without deleting it.
-	* Defaults to `true` so operators creating a rule via the UI
-	* see it active immediately.
-	*/
-	enabled: boolean().default(true)
-});
-array(ZoneRuleSchema).readonly();
-/**
-* Zone — pure geometry + identity. NO filtering behaviour.
-*
-* Zones describe **where** in the frame the operator wants to flag
-* something; consumer-owned {@link ZoneRule} arrays describe **how**
-* each pipeline stage uses them. Splitting the two means a single
-* polygon "Driveway" can simultaneously back a motion-exclude rule,
-* a detection-include rule on `['car']`, and an occupancy aggregate
-* — without three duplicated polygons.
-*
-* Owned by the orchestrator addon (provider) and mirrored into the
-* `zones` device-state slice on every mutation. Consumers
-* (motion-wasm, pipeline-executor, analytics, admin UI) read either
-* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
-* mirror with `onChanged`).
-*
-* Coordinates are normalised fractions of the frame (0–1) so zones
-* survive resolution changes and stream profile switches.
-*
-* `kind` discriminates between full polygons (closed regions used
-* for intrusion / occupancy filters) and tripwires (open 2-point
-* line segments used for cross events). Onboard / firmware-reported
-* zones (Reolink, ONVIF) are out of scope for now — see the deferred
-* task list.
-*/
-var ZoneKindEnum = _enum(["polygon", "tripwire"]);
-/** Polygon vertex in fraction-of-frame coordinates (0–1). */
-var PolygonPointSchema = object({
-	x: number(),
-	y: number()
-});
-/** A camera detection zone — pure geometry/identity. */
-var ZoneSchema = object({
-	id: string(),
-	name: string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: string().default("#3b82f6")
-});
-/**
-* Zones capability — per-camera CRUD over polygon detection zones.
-*
-* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
-* to per-device settings and mirrors into the `zones` device-state
-* slice on every mutation, so downstream consumers can subscribe via
-* `dev.state.zones.onChanged`.
-*
-* The cap surface only handles geometry + identity; filtering
-* behaviour (per-class, include/exclude, threshold) lives in the
-* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
-* `capabilities/schemas/zone-rule.js`.
-*/
-var zonesCapability = {
-	name: "zones",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
-		addZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		removeZone: method(object({
-			deviceId: number(),
-			zoneId: string()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		updateZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	/**
-	* Runtime-state slice — the live zone catalogue mirrored by the
-	* orchestrator on every CRUD mutation. Consumers read via
-	* `device.state.zones.value` / `.watch(...)` without round-tripping
-	* the cap, and the codegen DeviceProxy auto-wires the reactive
-	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
-	* (e.g. zone groupings) can sit alongside the polygon list.
-	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
-	/**
-	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
+*/
+/**
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
+*/
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+Object.freeze(Object.fromEntries([{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}].map((s) => [s.stepId, s.defaultModelId])));
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -20596,6 +20869,22 @@ var TrackSchema = object({
 	* omit it. Render nothing when absent.
 	*/
 	previewMissReason: string().optional(),
+	/**
+	* The ROOT model that produced this track — the `FrameResult.rootModelId` of
+	* the frame it was BORN on (D646). What a later replay compares against, so
+	* "the original model" is named rather than assumed. A birth fact: never
+	* rewritten by a later frame. **Absent ≠ unknown-model**: a row from before
+	* the column, and a track the camera's own detector produced, carry none.
+	*/
+	modelId: string().optional(),
+	/**
+	* Size (px) of the detection frame this track's `positions[].bbox` live in —
+	* the frame it was born on, else the camera's latest analysis frame at
+	* persist time. Divide a position by these to normalise it. Absent when the
+	* size was never known.
+	*/
+	frameWidth: number().optional(),
+	frameHeight: number().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -20807,6 +21096,13 @@ var AudioEventSchema = object({
 		originalClass: string().optional(),
 		score: number()
 	}).optional(),
+	/**
+	* Whether the classifier RAN on the window behind this row (D660). Absent
+	* on rows written before D660 — unknown, NOT classified: until then a
+	* window the analyzer's busy gate threw away was stored exactly like one
+	* that heard nothing above the floor.
+	*/
+	classifyOutcome: AudioClassifyOutcomeSchema.optional(),
 	/** Populated by B5 (recording playback URL for this event). */
 	mediaUrl: string().optional()
 });
@@ -20825,7 +21121,8 @@ var MediaFileKindEnum = _enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row ON THE WIRE: what it is, how big it is, and WHERE ITS BYTES
@@ -21377,7 +21674,23 @@ var SearchObjectEventsInput = object({
 	until: number().optional(),
 	classFilter: string().optional(),
 	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: string().min(1).optional()
 });
 var TrackCascadeCountsSchema = object({
 	/** Persisted track roots deleted (authoritative). */
@@ -21502,7 +21815,15 @@ var RebuildObjectEmbeddingsInput = object({
 	* force is logged at start and finish so a deliberately slow pass reads
 	* differently from a stalled one.
 	*/
-	pacingMs: number().int().nonnegative().optional()
+	pacingMs: number().int().nonnegative().optional(),
+	/**
+	* Re-embed ONLY the tracks whose vector is ALREADY in the pinned model's
+	* space (D664) — the in-space skip inverted. It exists to redo vectors
+	* written from the wrong box, which a normal pass would skip as done
+	* forever. Requires `maxTracks`: a forced pass without a bound is refused
+	* (`force-requires-max-tracks`).
+	*/
+	force: boolean().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -21512,7 +21833,43 @@ var RebuildObjectEmbeddingsInput = object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var WipeObjectEmbeddingsResultSchema = object({
+	deleted: number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: array(string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*  - `force-requires-max-tracks` — `force: true` with no `maxTracks` (D664).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = _enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model",
+	"force-requires-max-tracks"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -21525,17 +21882,43 @@ var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
 var RebuildObjectEmbeddingsResultSchema = object({
 	started: boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
+	alreadyRunning: boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: string().optional(),
+	index: string().optional()
 });
 var RebuildStatusSchema = object({
 	running: boolean(),
 	scanned: number(),
 	rebuilt: number(),
-	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	/** Tracks whose key frame is gone — nothing to re-embed from. Pixels ONLY:
+	*  `missingEvent` is its own field since D664, never summed in. */
 	missingKeyFrame: number(),
-	/** Tracks with no usable detection box. */
+	/** Tracks with no object event at all (D664). */
+	missingEvent: number(),
+	/** Tracks with no box measured on the pixels to cut — see `boxSource.refused`. */
 	missingBbox: number(),
 	/**
+	* Which rule placed each judged track's box (D664): the key frame row's own
+	* `subjectBox`, `track.positions` at exactly its instant (older key frames),
+	* the event box (a key frame recovered from the recording, at the event's
+	* instant), or `refused` by name — the reasons are in the tagged log lines.
+	*/
+	boxSource: object({
+		subjectBox: number(),
+		positions: number(),
+		event: number(),
+		refused: number()
+	}),
+	/** Tracks skipped because their vector is already in the pinned space. */
+	alreadyInSpace: number(),
+	/** Whether the current / last pass was a `force` pass; `null` before any (D664). */
+	force: boolean().nullable(),
+	/** In-space tracks a `force` pass selected for re-embedding. */
+	forcedInSpace: number(),
+	/**
 	* Tracks an executing node REFUSED rather than broke on — an unreadable key
 	* frame, a step that threw. Separate from `failed` because the remedy is
 	* different, and because a whole camera silently contributing zero vectors
@@ -21559,7 +21942,11 @@ var RebuildStatusSchema = object({
 	startedAtMs: number().nullable(),
 	finishedAtMs: number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	error: string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -21602,24 +21989,6 @@ var MediaReclaimStatusSchema = object({
 	finishedAtMs: number().nullable(),
 	error: string().nullable()
 });
-var ReplayFrameInputSchema = object({
-	timestamp: number(),
-	frame: PipelineRunResultBridge
-});
-var RunReplayFrameProcessorResultSchema = object({ tracks: array(object({
-	className: string(),
-	firstSeenMs: number(),
-	lastSeenMs: number(),
-	/** Bbox of the track's FIRST matched detection, pixel-space in the clip's
-	*  frame — a representative box for the diff's `(className, window, IoU)`
-	*  pairing (`replay-diff.ts`). A replay does not need the full per-frame
-	*  trajectory production's `Track.positions` keeps. */
-	bbox: BoundingBoxSchema,
-	/** How many of the input frames this track matched a real detection on
-	*  (never a coasted/extrapolated frame) — the replay's own signal for "how
-	*  solid is this track", cheaper than re-deriving it from a trajectory. */
-	framesMatched: number().int()
-})).readonly() });
 /**
 * The long-term series a camera produces. A closed union so a typo cannot
 * invent one, and the ONE declaration of it — the addon's `AnalyticsLtsSeries`
@@ -21833,108 +22202,578 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ frameId: string() }), object({
-	base64: string(),
-	width: number().int(),
-	height: number().int()
+}), method(object({ frameId: string() }), object({
+	base64: string(),
+	width: number().int(),
+	height: number().int()
+}), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	subject: RetrainAssistSubjectSchema,
+	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+	nodeId: string().optional()
+}), RetrainAssistResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	annotations: array(RetrainAnnotationDraftSchema)
+}), array(RetrainAnnotationSchema).readonly(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	/** Which of the three event tables owns the row. */
+	ownerType: EventOwnerTypeSchema,
+	/** The event's rowid in that table (D474: an event id is a number). */
+	eventId: number().int(),
+	kind: MediaFileKindEnum.optional(),
+	deviceId: number()
+}), array(MediaFileSchema).readonly()), method(object({
+	trackId: string(),
+	kinds: array(MediaFileKindEnum).optional(),
+	deviceId: number()
+}), array(MediaFileSchema).readonly()), method(object({
+	trackId: string(),
+	deviceId: number()
+}), array(MediaFileInfoSchema).readonly()), method(object({
+	ownerType: EventOwnerTypeSchema,
+	eventId: number().int(),
+	deviceId: number()
+}), array(MediaFileInfoSchema).readonly()), method(object({
+	deviceId: number(),
+	ownerKind: MediaPresenceOwnerKindSchema,
+	ownerIds: array(string()).max(5e3)
+}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly(), { caller: "required" }), method(object({}), WipeObjectEmbeddingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), RebuildStatusSchema), object({
+	deviceId: number(),
+	timestamp: number(),
+	frameWidth: number(),
+	frameHeight: number(),
+	detections: array(OverlayDetectionSchema).readonly()
+}), object({
+	deviceId: number(),
+	trackId: string(),
+	className: string()
+}), object({
+	deviceId: number(),
+	trackId: string(),
+	className: string(),
+	durationMs: number()
+}), object({
+	deviceId: number(),
+	kind: EventKindSchema,
+	eventId: string(),
+	timestamp: number()
+});
+/**
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+*/
+var NativeCropRefSchema = object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
+	})
+});
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
+var ModelFormatSchema$1 = _enum([
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+]);
+var PipelineSlotSchema = _enum([
+	"detector",
+	"cropper",
+	"classifier",
+	"refiner",
+	"audio-classifier"
+]);
+var PipelineEngineChoiceSchema = object({
+	runtime: literal("python"),
+	backend: string(),
+	format: ModelFormatSchema$1,
+	device: string().optional()
+});
+/**
+* One pool's resolved provisioning (`getEffectiveTuning`). `numWorkers` is the
+* knob that lifts a saturated pool (`inference-devices.md`); `concurrency` is
+* per-worker in-flight requests. `deviceKey` echoes the pool asked about —
+* `null` for the node-default pool.
+*/
+var EffectiveTuningSchema = object({
+	deviceKey: string().nullable(),
+	runtime: string(),
+	batchMode: string(),
+	windowMs: number(),
+	maxBatchSize: number(),
+	concurrency: number(),
+	numWorkers: number()
+});
+var AvailableEngineSchema = object({
+	engine: PipelineEngineChoiceSchema,
+	devices: array(object({
+		id: string(),
+		label: string(),
+		description: string().optional()
+	})).readonly(),
+	defaultDevice: string()
+});
+var PipelineDefaultStepSchema = lazy(() => object({
+	addonId: string(),
+	addonName: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineDefaultStepSchema).readonly(),
+	group: string().optional(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateStepSchema = lazy(() => object({
+	addonId: string(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineTemplateStepSchema).readonly(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = object({
+	id: string(),
+	name: string(),
+	createdAt: string(),
+	updatedAt: string(),
+	engine: PipelineEngineChoiceSchema,
+	steps: array(PipelineTemplateStepSchema).readonly()
+});
+var PipelineModelOptionSchema = object({
+	id: string(),
+	name: string(),
+	formats: record(string(), object({
+		downloaded: boolean(),
+		sizeMB: number()
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional(),
+	defaultConfidence: number().optional()
+});
+var ConfigFieldBridge = custom();
+var PipelineAddonSchemaSchema = object({
+	id: string(),
+	name: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	childSlots: array(PipelineSlotSchema).readonly(),
+	models: array(PipelineModelOptionSchema).readonly(),
+	defaultModelId: string(),
+	defaultModelIdByFormat: record(string(), string()).optional(),
+	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
+	defaultConfidence: number(),
+	group: string().optional(),
+	configSchema: array(ConfigFieldBridge).readonly().optional()
+});
+var PipelineSlotSchemaSchema = object({
+	id: PipelineSlotSchema,
+	label: string(),
+	priority: number(),
+	parentSlot: PipelineSlotSchema.nullable(),
+	addons: array(PipelineAddonSchemaSchema).readonly()
+});
+var PipelineSchemaSchema = object({
+	availableEngines: array(AvailableEngineSchema).readonly(),
+	selectedEngine: PipelineEngineChoiceSchema,
+	slots: array(PipelineSlotSchemaSchema).readonly()
+});
+var EngineProvisioningSchema = object({
+	runtimeId: _enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"edgetpu"
+	]).nullable(),
+	device: string().nullable(),
+	state: _enum([
+		"idle",
+		"installing",
+		"verifying",
+		"ready",
+		"failed"
+	]),
+	progress: number().optional(),
+	error: string().optional(),
+	nextRetryAt: number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: array(string()).optional()
+});
+var PipelineStepInputSchema = lazy(() => object({
+	addonId: string(),
+	modelId: string().optional(),
+	enabled: boolean().default(true),
+	children: array(PipelineStepInputSchema).optional(),
+	settings: record(string(), unknown()).optional(),
+	jumpDeviceKey: string().optional()
+}));
+var ModelSubstitutionSchema = object({
+	addonId: string(),
+	chosen: string(),
+	running: string(),
+	format: string()
+});
+var PipelineValidationIssueSchema = object({
+	addonId: string(),
+	kind: _enum([
+		"unknown-addon",
+		"no-format-build",
+		"unknown-device"
+	]),
+	detail: string()
+});
+var PipelineValidationResultSchema = object({
+	ok: boolean(),
+	issues: array(PipelineValidationIssueSchema).readonly(),
+	substitutions: array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: string()
+});
+var ReferenceImageEntrySchema = object({
+	filename: string(),
+	stepIds: array(string()).readonly().optional()
+});
+var ReferenceImageBodySchema = object({
+	base64: string(),
+	filename: string()
+});
+var ReferenceAudioEntrySchema = object({
+	filename: string(),
+	sizeKb: number()
+});
+var ReferenceAudioBodySchema = object({ base64: string() });
+var AudioBackendSchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	available: boolean(),
+	/**
+	* Raw classifier labels this backend can emit (e.g. YAMNet's
+	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
+	* the benchmark UI to populate the `enabledMicroClasses` filter
+	* specific to the selected backend without a separate fetch.
+	*/
+	rawLabels: array(string()).readonly().optional()
+});
+var AudioCapabilitiesSchema = object({
+	activeBackend: string(),
+	availableBackends: array(AudioBackendSchema).readonly(),
+	sampleRate: number(),
+	chunkDurationMs: number()
+});
+var DownloadModelResultSchema = object({
+	filePath: string(),
+	sizeMB: number(),
+	durationMs: number()
+});
+/**
+* Wrapper carrying a single test run's result. Replaces the legacy
+* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
+* canonical `AudioResult` from the Phase 6 output rework: one
+* `AudioDetection` per class above `minScore`, top-N candidates in
+* `debug.alternateLabels['audio-classifier']`, per-source timings in
+* `debug.stepTimings`. The outer `success`/`error` fields stay so the
+* benchmark UI can still report a clean failure when the classifier
+* cap isn't available.
+*/
+var AudioTestResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	frame: custom().optional()
+});
+var PipelineConfigBridge = custom();
+var ConfigUISchemaBridge = custom();
+var ConfigUISchemaNullableBridge = custom();
+var InferenceCapabilitiesBridge = custom();
+var ModelAvailabilityListBridge = custom();
+var PipelineRunResultBridge = custom();
+method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+}))), method(object({ steps: record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+})) }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({
+	success: literal(true),
+	clearedDevices: number()
 }), {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackId: string(),
-	frameId: string(),
-	subject: RetrainAssistSubjectSchema,
-	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
-	nodeId: string().optional()
-}), RetrainAssistResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	source: DetectionSourceSchema,
-	zones: array(ZoneSchema).readonly().optional(),
-	detectionRules: array(ZoneRuleSchema).readonly().optional(),
-	zoneMembershipMinOverlap: number().min(0).max(1).optional(),
-	frames: array(ReplayFrameInputSchema).min(1)
-}), RunReplayFrameProcessorResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackId: string(),
-	frameId: string(),
-	annotations: array(RetrainAnnotationDraftSchema)
-}), array(RetrainAnnotationSchema).readonly(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackId: string()
-}), RetrainTransitionResultSchema, {
+}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
+	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
+	deviceKey: string(),
+	/**
+	* `failed` — the per-device restart budget is exhausted; no pool
+	* will be spawned until an operator re-arms it or the runner
+	* respawns. `backoff` — under budget, waiting out the backoff (or
+	* a cached pool observed dead and not yet condemned).
+	*/
+	state: _enum(["failed", "backoff"]),
+	/** Epoch ms of the death that produced this state. */
+	since: number(),
+	/** Pool deaths inside the current window. */
+	deaths: number(),
+	/** The last death's message. */
+	lastError: string()
+})).readonly() })), method(object({
+	nodeId: string(),
+	deviceKey: string()
+}), object({ rearmed: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackId: string()
-}), RetrainTransitionResultSchema, {
+}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({
+	steps: array(PipelineStepInputSchema),
+	deviceKey: string().optional()
+}), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
+	name: string(),
+	steps: array(PipelineTemplateStepSchema).readonly(),
+	engine: PipelineEngineChoiceSchema
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
+	id: string(),
+	name: string().optional(),
+	steps: array(PipelineTemplateStepSchema).readonly().optional()
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frame: FrameInputSchema.optional(),
+	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
+	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+	* the decoded pixels live in. One more member of the one-of
+	* frame/frameHandle/image/imageBase64/referenceImage group.
+	*/
+	frameHandle: FrameHandleSchema.optional(),
+	imageBase64: string().optional(),
+	/**
+	* Binary JPEG bytes — preferred over `imageBase64` on internal
+	* hops (hub → forked worker via Moleculer MsgPack) because it
+	* skips the 33% base64 overhead + the per-call base64 decode on
+	* the detection-pipeline worker. Callers can pass either; exactly
+	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
+	*/
+	image: _instanceof(Uint8Array).optional(),
+	referenceImage: string().optional(),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Execution plane. 'full' (default) runs the whole tree — benchmark,
+	* reference-image, and detail-subtree calls. 'frame' is the live
+	* per-frame dispatch: ONLY root-plane steps run; crop children
+	* (inputClasses ≠ null) are skipped and served per-track via
+	* pipelineRunner.runDetailSubtree (two-plane design).
+	*/
+	plane: _enum(["full", "frame"]).optional(),
+	/**
+	* Inference-device selector (Phase 2 multi-device). Format
+	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+	* Omitted ⇒ the runner's default device (current single-engine
+	* behaviour). Selects WHICH device pool of the node runs the call.
+	*/
+	deviceKey: string().optional(),
+	/**
+	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+	* when the parent crop was resolved from the frame's retained NATIVE
+	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+	* resolution from that surface — the SAME quality path faces already
+	* had — instead of the downscaled parent tile. `handle` keys the native
+	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+	* the executor's crop-normalized child ROI back into frame-normalized
+	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+	* (today's behaviour on the fallback path).
+	*/
+	nativeCropRef: NativeCropRefSchema.optional(),
+	/**
+	* Offline REPLAY of stored media for `deviceId` (D56, D646): the
+	* camera's zone gate and overrides apply as live, every executing
+	* step runs EXACTLY the model it names on the `deviceKey` pool it
+	* names or the call refuses (`model-not-servable` /
+	* `device-not-servable`), and nothing reaches the camera's live
+	* trace stream. Absent ⇒ unchanged behaviour.
+	*/
+	replay: literal(true).optional()
+}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
+	steps: array(PipelineStepInputSchema).min(1),
+	frames: array(FrameInputSchema).min(1).max(255),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+	* the batch to the Python pool's bench preprocess cache
+	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+	* preprocessed ONCE and every later inference is a pure-inference cache
+	* hit — the sustained-throughput run measures inference, not
+	* decode+preprocess+infer. Omitted/0 for live frames (all different →
+	* full preprocess every call, correct). Fresh per sustained run;
+	* released via `uncacheFrame`.
+	*/
+	frameId: number().int().nonnegative().optional(),
+	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+	deviceKey: string().optional()
+}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
+	data: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum([
+		"rgb",
+		"bgr",
+		"gray"
+	])
+}), object({
+	frameId: number(),
+	width: number(),
+	height: number()
+}), { kind: "mutation" }), method(object({
+	stepId: string(),
+	frameId: number().int(),
+	/**
+	* The model to time — REQUIRED (D658). Without it the pool answered the
+	* step's ACTIVE variant (the first loaded after boot), so a benchmark
+	* of model B silently timed model A. Callers pass the `rootModelId`
+	* their warmup `runPipeline` reported: the model that actually ran.
+	*/
+	modelId: string().min(1)
+}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(object({ deviceKey: string().optional() }), EffectiveTuningSchema), method(_void(), array(object({
+	engineKey: string(),
+	engine: PipelineEngineChoiceSchema,
+	modelsLoaded: array(string()).readonly(),
+	inUseByCameras: array(number()).readonly(),
+	/**
+	* Origin of this resident factory.
+	*  - `runtime`       — main camera-serving engine (no idle TTL).
+	*  - `device-pool`   — a concurrent per-device pool (Phase 2
+	*                      multi-device, keyed by `deviceKey`) resolved
+	*                      via `resolveDeviceFactory`. Runs alongside the
+	*                      `runtime` engine on a DIFFERENT accelerator
+	*                      (NPU / iGPU / Coral) — this is how the
+	*                      Engines tab shows all pools running at once.
+	*/
+	kind: _enum(["runtime", "device-pool"]),
+	/** Native pid of the underlying Python pool (null when no pool). */
+	poolPid: number().nullable(),
+	/** ms since this factory was last used (null when not warm-tracked). */
+	idleMs: number().nullable(),
+	/** Idle TTL after which the factory self-evicts (null when not applicable). */
+	idleTtlMs: number().nullable()
+})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
-	kind: "query",
-	auth: "admin"
 }), method(object({
-	/** Which of the three event tables owns the row. */
-	ownerType: EventOwnerTypeSchema,
-	/** The event's rowid in that table (D474: an event id is a number). */
-	eventId: number().int(),
-	kind: MediaFileKindEnum.optional(),
-	deviceId: number()
-}), array(MediaFileSchema).readonly()), method(object({
-	trackId: string(),
-	kinds: array(MediaFileKindEnum).optional(),
-	deviceId: number()
-}), array(MediaFileSchema).readonly()), method(object({
-	trackId: string(),
-	deviceId: number()
-}), array(MediaFileInfoSchema).readonly()), method(object({
-	ownerType: EventOwnerTypeSchema,
-	eventId: number().int(),
-	deviceId: number()
-}), array(MediaFileInfoSchema).readonly()), method(object({
-	deviceId: number(),
-	ownerKind: MediaPresenceOwnerKindSchema,
-	ownerIds: array(string()).max(5e3)
-}), array(string()).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+	engine: PipelineEngineChoiceSchema,
+	force: boolean().optional()
+}), object({
+	success: boolean(),
+	reason: string().optional()
+}), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), RebuildStatusSchema), object({
-	deviceId: number(),
-	timestamp: number(),
-	frameWidth: number(),
-	frameHeight: number(),
-	detections: array(OverlayDetectionSchema).readonly()
-}), object({
-	deviceId: number(),
-	trackId: string(),
-	className: string()
-}), object({
-	deviceId: number(),
-	trackId: string(),
-	className: string(),
-	durationMs: number()
-}), object({
-	deviceId: number(),
-	kind: EventKindSchema,
-	eventId: string(),
-	timestamp: number()
-});
+}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
+	addonId: string(),
+	modelId: string(),
+	filename: string().optional(),
+	settings: record(string(), unknown()).optional()
+}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -21960,6 +22799,106 @@ var CameraMetricsSchema = object({
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: number() });
 /**
+* Zone — pure geometry + identity. NO filtering behaviour.
+*
+* Zones describe **where** in the frame the operator wants to flag
+* something; consumer-owned {@link ZoneRule} arrays describe **how**
+* each pipeline stage uses them. Splitting the two means a single
+* polygon "Driveway" can simultaneously back a motion-exclude rule,
+* a detection-include rule on `['car']`, and an occupancy aggregate
+* — without three duplicated polygons.
+*
+* Owned by the orchestrator addon (provider) and mirrored into the
+* `zones` device-state slice on every mutation. Consumers
+* (motion-wasm, pipeline-executor, analytics, admin UI) read either
+* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
+* mirror with `onChanged`).
+*
+* Coordinates are normalised fractions of the frame (0–1) so zones
+* survive resolution changes and stream profile switches.
+*
+* `kind` discriminates between full polygons (closed regions used
+* for intrusion / occupancy filters) and tripwires (open 2-point
+* line segments used for cross events). Onboard / firmware-reported
+* zones (Reolink, ONVIF) are out of scope for now — see the deferred
+* task list.
+*/
+var ZoneKindEnum = _enum(["polygon", "tripwire"]);
+/** Polygon vertex in fraction-of-frame coordinates (0–1). */
+var PolygonPointSchema = object({
+	x: number(),
+	y: number()
+});
+/** A camera detection zone — pure geometry/identity. */
+var ZoneSchema = object({
+	id: string(),
+	name: string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: string().default("#3b82f6")
+});
+/**
+* Zones capability — per-camera CRUD over polygon detection zones.
+*
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
+*/
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
+		addZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: method(object({
+			deviceId: number(),
+			zoneId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+/**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
 * decode worker resolves it against the RETAINED native frame's real pixel dims,
 * so the caller supplies only the detection-res bbox divided by the detection
@@ -22146,7 +23085,17 @@ var DetailResultSchema = object({
 	/** Face short side (px) measured on the NATIVE crop surface. The `bbox`
 	*  above is detection-frame px (≈6× smaller on a 4K camera) — min-face-size
 	*  consumers MUST prefer this when present (2026-07-22 native-gate fix). */
-	nativeFaceShortSidePx: number().optional()
+	nativeFaceShortSidePx: number().optional(),
+	/**
+	* The five facial landmarks of a `face` detail, in the SAME frame space as
+	* `bbox` (D644). Additive and optional: post-analysis stores them beside the
+	* face's source frame so a future alignment can be re-derived exactly; a
+	* runner that predates the field sends none and the face is stored without.
+	*/
+	landmarks: array(object({
+		x: number(),
+		y: number()
+	})).optional()
 });
 /**
 * Why an executing node REFUSED a stateless step run (`runStatelessStep`).
@@ -22401,6 +23350,17 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 	hubHostnameOverride: string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = object({
+	modelId: string().optional(),
+	settings: record(string(), unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -22412,7 +23372,16 @@ var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal
 var RunnerInferenceDeviceSchema = object({
 	deviceKey: string(),
 	weight: number().positive().default(1),
-	maxSessions: number().int().positive().nullable().default(null)
+	maxSessions: number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: record(string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -23287,6 +24256,28 @@ var NodeInferenceDeviceSchema = object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("stored"),
+		modelId: string()
+	}),
+	object({
+		kind: literal("absent"),
+		defaultModelId: string()
+	}),
+	object({
+		kind: literal("unreadable"),
+		reason: _enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -23314,10 +24305,17 @@ method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({ migrated: number() }), {
+}), method(object({ deviceId: number() }), object({ deviceKey: string().nullable() })), method(_void(), object({
+	migrated: number(),
+	skipped: array(object({
+		deviceId: number(),
+		targetNodeId: string(),
+		reason: string()
+	})).default([])
+}), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
+}), method(_void(), array(PipelineAssignmentSchema).readonly()), method(object({ deviceId: number() }), PipelineAssignmentSchema.nullable()), method(_void(), array(AgentLoadSummarySchema).readonly()), method(object({ stepId: string() }), ClusterModelChoiceSchema), method(_void(), GlobalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(object({ nodeId: string() }), CapabilityBindingsSchema), method(object({
 	nodeId: string(),
 	capName: string(),
 	addonId: string()
@@ -23532,7 +24530,11 @@ function buildDescriptor(capName, kind) {
 		icon: legacyIcon(t.iconId)
 	};
 }
-Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
+/**
+* Sensor / control cap name → static event-kind descriptor. A linked device
+* contributes one entry per bound cap present in this map.
+*/
+var EVENT_KIND_BY_CAP = Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
 /**
 * server-management — per-NODE singleton capability for a node's ROOT
 * package lifecycle (runtime-updatable node packages).
@@ -26155,6 +27157,254 @@ var CLIP_PLAYBACK_OPTIONS = {
 	}
 };
 /**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+var DoorbellPressEventSchema = object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
+DeviceType.Camera, DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: array(ExtensionSlotSourceSchema).optional()
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -28180,12 +29430,20 @@ reset: method(object({
 	},
 	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: number() }),
 	/**
-	* Runtime-state durability: **session** — the authority is the appliance; the provider re-reads the whole item array on connect.
+	* Runtime-state durability: **restored** — nothing else holds the value
+	* (D642). A consumable can often be read only in a device's wake window (the
+	* Dreame mower's CMS counters answer only while it charges), so a restart
+	* that wiped the slice left the panel empty and the alerts blind until the
+	* next wake — 2026-09-26, mower 503 idle with `items: []`. A restored item is
+	* the previous observation, not a claim about now; the provider overwrites it
+	* the moment it reads the device again.
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "session"
+	durability: "restored",
+	/** Clocks, not content: a re-read that changed no item costs no commit. */
+	volatileStateFields: ["lastChangedAt", "lastFetchedAt"]
 };
 /**
 * Door / window / opening / garage / valve contact sensor. Boolean
@@ -28574,75 +29832,6 @@ onStatusChanged: { data: object({
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-var DoorbellPressEventSchema = object({
-	deviceId: number(),
-	timestamp: number()
-});
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: { data: DoorbellPressEventSchema } },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-/**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
 * states, weather conditions, contact-source channels, mode strings).
@@ -31746,7 +32935,30 @@ var RenameNodeResultSchema = object({
 	nodeId: string(),
 	name: string()
 });
-method(_void(), array(TopologyNodeSchema).readonly(), { auth: "admin" }), method(NodeAddonInputSchema, SuccessSchema, {
+/**
+* The cheap node list. A consumer's rule for a STORED node id (a rule's
+* `nodeIds`) that is missing from `nodes`, whatever `complete` says: render it
+* as a removable chip labelled unknown, never drop it (D49). Even a complete
+* list omits a node that joined and left between two history captures, so a
+* missing id means "not known to the hub", never "removed". Only the operator
+* removes it.
+*
+* `complete` changes only the WORDING: `false` = no history read has ever
+* answered, so the list may be missing offline nodes the hub does know (D315).
+*
+* `name` is the history row's name (≤ 30 s behind a rename), or the id when
+* the history has none.
+*/
+var NodeDirectorySchema = object({
+	nodes: array(object({
+		id: string(),
+		name: string(),
+		isHub: boolean(),
+		isOnline: boolean()
+	})).readonly(),
+	complete: boolean()
+});
+method(_void(), array(TopologyNodeSchema).readonly(), { auth: "admin" }), method(_void(), NodeDirectorySchema, { auth: "admin" }), method(NodeAddonInputSchema, SuccessSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(NodeAddonInputSchema, SuccessSchema, {
@@ -32685,7 +33897,7 @@ var HardwareInfoSchema = object({
 	coral: CoralInfoSchema.nullable().optional()
 });
 var PlatformScoreSchema = object({
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: _enum([
 		"onnx",
@@ -32722,7 +33934,7 @@ var ModelRequirementSchema = object({
 });
 var ResolvedInferenceConfigSchema = object({
 	modelId: string(),
-	runtime: _enum(["node", "python"]),
+	runtime: literal("python"),
 	backend: string(),
 	format: ModelFormatSchema,
 	reason: string()
@@ -35507,6 +36719,92 @@ var sceneMonitorCapability = {
 	durability: "session"
 };
 /**
+* Per-stage gating mode applied to the zones a rule references.
+*
+* - `include`: the rule contributes to a **whitelist** for its stage.
+*   When at least one `include` rule fires for a stage, only entities
+*   inside one of those zones pass that stage.
+* - `exclude`: the rule contributes to a **blacklist** for its stage.
+*   Entities inside one of those zones are dropped at that stage.
+*
+* `monitor`-style observation (count without filtering) is not a rule
+* mode — zones without any matching rule are observed naturally by
+* `zone-analytics` (live snapshot + history), so an "I just want to
+* count, not filter" use case needs no rule at all.
+*/
+var ZoneRuleModeEnum = _enum(["include", "exclude"]);
+/**
+* Per-consumer rule that references existing zones (geometry) and
+* defines how a specific pipeline stage should treat them. Each
+* consumer addon owns its own `ZoneRule[]` array in its per-device
+* settings:
+*
+* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
+* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
+* - future: notification rules, audio gating, etc.
+*
+* One rule applies to N zones (`zoneIds[]`) so the operator can
+* express "ignore motion in ALL of {garden, street}" with a single
+* rule. `classFilter` narrows the rule to specific object classes —
+* "drop person detections in the street, but keep cars" is one
+* `exclude` rule with `classFilter: ['person']`.
+*
+* `enabled` is a soft toggle — the operator can keep the rule
+* configured but inert without deleting it.
+*/
+var ZoneRuleSchema = object({
+	/** Stable rule id — survives edits, used by the UI for diffing. */
+	id: string(),
+	/** Optional human-readable label rendered in the rule editor. */
+	name: string().optional(),
+	/** Zones this rule targets. The rule's `mode` applies to ALL
+	*  listed zones (OR-set: a detection in any one of them counts).
+	*  At least one zone id required — a rule with no targets is a
+	*  configuration mistake and the form validator rejects it. */
+	zoneIds: array(string()).min(1).readonly(),
+	mode: ZoneRuleModeEnum,
+	/**
+	* Class names this rule applies to. Empty / undefined ⇒ rule
+	* applies to every class. Class strings match the `macroClass`
+	* field on detections (e.g. `person`, `car`, `dog`).
+	*/
+	classFilter: array(string()).readonly().optional(),
+	/**
+	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
+	* required to consider an entity "in the zone". Defaults to the
+	* consumer's stage default when omitted. Kept for back-compat with
+	* existing per-rule overrides; new operators pick the value via
+	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+	* set, the lower-level engine reads it as a 0–1 fraction.
+	*/
+	overlapThreshold: number().min(0).max(1).optional(),
+	/**
+	* Operator-friendly version of `overlapThreshold` — the percentage
+	* of the detection's bbox that must lie inside the zone for the
+	* rule to match. Documented default is 85%; the engine substitutes
+	* that when the field is omitted (kept optional so existing rules
+	* stored without it stay valid).
+	*
+	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+	* rule, the engine prefers `bboxInclusionPct` because it's the
+	* field exposed in the UI. Internally both feed the same gate.
+	*/
+	bboxInclusionPct: number().min(0).max(100).optional(),
+	/**
+	* When `true` and a detection has a segmentation mask, use the
+	* mask for overlap instead of the bbox. Detection-stage only;
+	* motion rules ignore this field.
+	*/
+	preferMask: boolean().optional(),
+	/**
+	* Soft-toggle: `false` disables the rule without deleting it.
+	* Defaults to `true` so operators creating a rule via the UI
+	* see it active immediately.
+	*/
+	enabled: boolean().default(true)
+});
+array(ZoneRuleSchema).readonly();
+/**
 * Script-runner cap. Models HA `script.*` entities on
 * `DeviceType.Script`. A Script is a pre-recorded action sequence
 * that can be invoked imperatively — optionally with a variables
@@ -37707,6 +39005,38 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	}
+});
+`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -41679,6 +43009,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"composer.applyBlocks": {
+		capName: "composer",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"composer.getStates": {
+		capName: "composer",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"connectionTest.describeTest": {
 		capName: "connection-test",
 		capScope: "system",
@@ -41739,6 +43081,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.createComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.delete": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -41751,6 +43099,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.getComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -41763,6 +43117,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listCompositions": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -41781,6 +43141,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.updateComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.validateComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"cover.close": {
 		capName: "cover",
 		capScope: "device",
@@ -42171,6 +43543,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42243,12 +43639,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.applyDeviceSettingsPatch": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.applyInitialMeta": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42351,12 +43741,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceLiveContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceLiveInfoAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42369,12 +43753,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceSettingsContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceStatusAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42879,24 +44257,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"doorbell.applyDeviceSettingsPatch": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
-	"doorbell.getDeviceLiveContribution": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
-	"doorbell.getDeviceSettingsContribution": {
-		capName: "doorbell",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"doorbell.getStatus": {
 		capName: "doorbell",
 		capScope: "device",
@@ -42921,6 +44281,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -44103,6 +45469,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodes.directory": {
+		capName: "nodes",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"nodes.executeQuery": {
 		capName: "nodes",
 		capScope: "system",
@@ -44271,6 +45643,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getRuleLastRuns": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getTemplateCatalog": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -44295,6 +45673,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewStateSummary": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.previewTemplate": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -44871,12 +46255,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.runReplayFrameProcessor": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45243,6 +46621,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -48068,6 +49452,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -48974,11 +50378,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"pipelineAnalytics.runReplayFrameProcessor": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"pipelineAnalytics.saveRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -49867,11 +51266,232 @@ var NC_AUDIO_DEFAULTS = {
 	samplingSeconds: 10
 };
 new Set(["devices", "classes"]);
+/**
+* WHICH narrowing filter speaks about WHICH system-event kind — one predicate,
+* consumed by the rule ENGINE and by every rule EDITOR.
+*
+* ── The failure this file exists for ───────────────────────────────────────
+* `NcSystemEventConditionSchema` carries four optional narrowing lists
+* (`deviceIds`, `deviceTypes`, `nodeIds`, `packageNames`) beside a required
+* `kinds` gate. They are not four filters over one vocabulary: each belongs to
+* a FAMILY of kinds and is meaningless outside it. A node going away has no
+* device type; a completed export has no package; `stream-offline` deliberately
+* carries no device type at all (a stream belongs to a camera by construction).
+*
+* The engine applied all four to every kind, so a filter from one family failed
+* a kind from another family CLOSED. The operator's live rule "Eventi di
+* sistema" selected eleven kinds and set `deviceTypes: ['camera']` — the only
+* way to say "only my cameras" about the two liveness kinds — and NINE of the
+* eleven silently stopped being deliverable. Four days of history contained
+* `device-online` and `device-offline` and nothing else, across a window in
+* which agents were restarted and addons were updated.
+*
+* Both editors already computed this scoping, to decide which filter boxes to
+* render; the cap's own docblock already promised it ("Narrow a `device-*` kind
+* to these device TYPES"). Only the engine disagreed, and it disagreed in the
+* destructive direction. So the rule is stated ONCE, here, and the engine and
+* the editors are readers of it rather than three independent authors.
+*
+* ── The direction ─────────────────────────────────────────────────────────
+* Out of family ⇒ the filter is IGNORED, never fail-closed. An editor that
+* hides a box has already told the operator this filter does not speak about
+* these kinds, so honouring it as an exclusion contradicts the only
+* explanation the operator was ever given. Inside its family the filter still
+* narrows, and still fails CLOSED on a subject that cannot produce the identity
+* it tests (a device the mirror cannot name is not evidence of a camera).
+*/
+/**
+* Every filter, for the callers that must cover all of them (guards, tests).
+*
+* `consumableLowPercent` (D642) is not a list but it is a filter in exactly
+* this sense: it belongs to a family of kinds (the consumable pair) and the
+* engine consults it only there. It differs in one way the readers must know —
+* its ABSENCE is not "no narrowing" but the default threshold, because a
+* consumable episode is always judged at SOME threshold.
+*/
+var NC_SYSTEM_EVENT_FILTER_KEYS = [
+	"deviceIds",
+	"deviceTypes",
+	"nodeIds",
+	"packageNames",
+	"consumableLowPercent"
+];
+new Map(Object.entries({
+	"device-online": "device-events",
+	"device-offline": "device-events",
+	"device-disabled": "device-events",
+	"device-enabled": "device-events",
+	"device-battery-low": "device-events",
+	"device-battery-normal": "device-events",
+	"device-consumable-low": "device-events",
+	"device-consumable-normal": "device-events",
+	"device-tank-low": "device-events",
+	"device-tank-full": "device-events",
+	"device-tank-normal": "device-events",
+	"stream-online": "device-events",
+	"stream-offline": "device-events",
+	"detection-blind": "device-events",
+	"node-online": "system",
+	"node-offline": "system",
+	"node-inference-unavailable": "system",
+	"addon-crash-loop": "system",
+	"addon-update-available": "system",
+	"addon-updated": "system",
+	"server-update-available": "system",
+	"server-updated": "system",
+	"wrapper-update-available": "system",
+	"backup-completed": "system",
+	"export-completed": "system",
+	"alarm-triggered": "alarm",
+	"alarm-armed": "alarm",
+	"alarm-disarmed": "alarm",
+	"alarm-arming": "alarm",
+	"alarm-arm-refused": "alarm",
+	"alarm-pending": "alarm",
+	"alarm-rearmed": "alarm",
+	"alarm-sensor-bypass": "alarm",
+	"alarm-check-failed": "alarm",
+	"camera-online": null,
+	"camera-offline": null,
+	"camera-disabled": null,
+	"camera-enabled": null
+}));
+[...NC_SYSTEM_EVENT_FILTER_KEYS];
+var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
+	{
+		id: "device-state",
+		family: "device-events",
+		label: "Device state",
+		kinds: [
+			"device-offline",
+			"device-online",
+			"device-disabled",
+			"device-enabled"
+		]
+	},
+	{
+		id: "streams",
+		family: "device-events",
+		label: "Streams",
+		kinds: ["stream-offline", "stream-online"]
+	},
+	{
+		id: "battery",
+		family: "device-events",
+		label: "Battery",
+		kinds: ["device-battery-low", "device-battery-normal"]
+	},
+	{
+		id: "consumables",
+		family: "device-events",
+		label: "Consumables",
+		kinds: ["device-consumable-low", "device-consumable-normal"]
+	},
+	{
+		id: "tanks",
+		family: "device-events",
+		label: "Tanks",
+		kinds: [
+			"device-tank-low",
+			"device-tank-full",
+			"device-tank-normal"
+		]
+	},
+	{
+		id: "detection-blind",
+		family: "device-events",
+		label: "Detecting nothing",
+		kinds: ["detection-blind"]
+	},
+	{
+		id: "nodes",
+		family: "system",
+		label: "Nodes",
+		kinds: [
+			"node-offline",
+			"node-online",
+			"node-inference-unavailable"
+		]
+	},
+	{
+		id: "addons",
+		family: "system",
+		label: "Addons",
+		kinds: [
+			"addon-crash-loop",
+			"addon-update-available",
+			"addon-updated"
+		]
+	},
+	{
+		id: "updates",
+		family: "system",
+		label: "Server & container updates",
+		kinds: [
+			"server-update-available",
+			"server-updated",
+			"wrapper-update-available"
+		]
+	},
+	{
+		id: "backups-exports",
+		family: "system",
+		label: "Backups & exports",
+		kinds: ["backup-completed", "export-completed"]
+	},
+	{
+		id: "alarm",
+		family: "alarm",
+		label: "Alarm",
+		kinds: NC_ALARM_SYSTEM_EVENT_KINDS
+	}
+];
+function systemEventKindsOfFamily(family) {
+	return NC_SYSTEM_EVENT_KIND_GROUP_SPECS.filter((g) => g.family === family).flatMap((g) => g.kinds);
+}
 NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
+/**
+* WHICH WAY A BOOLEAN SENSOR MOVED — read off the one slice a sensor event
+* persists (D640 "a sensor rule fires on the raise, the clear, or both").
+*
+* A device-event rule over a flood sensor notified on BOTH edges: water
+* detected, and back to dry. `NcConditions.sensorTransition` lets the rule
+* name one edge; this file answers, for one `SensorEvent`, which edge it is.
+*
+* NOT A SECOND TABLE. The "which boolean of this cap counts as HIGH" question
+* already has one answer, `SOURCE_CAP_ACTIVE_FIELD`
+* (`catalogs/sensor-active-state.ts`, the doorbell's and the recorder's edge
+* table), and a sensor event names its kind, not its cap. So the table here is
+* DERIVED: event kind → cap (`EVENT_KIND_BY_CAP`) → that cap's active field.
+* Only kinds whose taxonomy category is `sensor` take part — a switch has an
+* `on` boolean too, but "it triggers / it clears" is not a sentence about a
+* light, and offering it there would be a knob with a misleading label.
+* `presence` is a WORD (`home` / `not_home` / a zone), not a boolean, and is
+* absent from the source table, so it is absent here.
+*
+* `undefined` = never guessed: a kind with no raise (a doorbell press, a
+* button, a cover), or a slice whose field is missing or not a boolean. The
+* engine then does NOT filter — a flood alert must not go silent because one
+* read came back unreadable (the same stance as the alarm's `sensorEdgeOf`).
+*
+* Pure, RN-safe: the viewer imports the support rule from here.
+*/
+/** Event kind → the boolean field of its cap slice that means "raised". */
+var NC_SENSOR_RAISED_FIELD_BY_KIND = Object.freeze(Object.fromEntries(Object.entries(EVENT_KIND_BY_CAP).flatMap(([capName, descriptor]) => {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0 || descriptor.category !== "sensor") return [];
+	return [[descriptor.kind, field]];
+})));
+Object.freeze(Object.keys(NC_SENSOR_RAISED_FIELD_BY_KIND));
 var RULE_BODY_ONLY = ["body"];
 var RULE_TEXT = ["title", "body"];
 var BATTERY = ["device-battery-low", "device-battery-normal"];
 var CONSUMABLE = ["device-consumable-low", "device-consumable-normal"];
+var TANK = [
+	"device-tank-low",
+	"device-tank-full",
+	"device-tank-normal"
+];
 var UPDATES = [
 	"addon-update-available",
 	"server-update-available",
@@ -49897,12 +51517,189 @@ var DEVICE_EVENTS = [
 	"device-enabled",
 	...BATTERY,
 	...CONSUMABLE,
+	...TANK,
 	"stream-online",
 	"stream-offline",
 	"detection-blind",
 	...ALARM
 ];
-[...DEVICE_EVENTS], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_BODY_ONLY], [...RULE_TEXT], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...BATTERY, ...CONSUMABLE], [...RULE_TEXT], [...CONSUMABLE], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT];
+/** Every kind a summary may speak about — the two summarisable families. */
+var SUMMARISABLE = [...systemEventKindsOfFamily("device-events"), ...systemEventKindsOfFamily("system")];
+/** One per summary SECTION (`NC_STATE_SUMMARY_SECTIONS` in the notification
+*  centre): the section's lines, offered when one of its kinds is selected. */
+var STATE_SUMMARY_SECTION_VARS = [
+	{
+		name: "summaryDevices",
+		label: "Summary: devices offline / switched off",
+		example: "Garage — offline since 07:12",
+		kinds: [
+			"device-offline",
+			"device-online",
+			"device-disabled",
+			"device-enabled"
+		]
+	},
+	{
+		name: "summaryStreams",
+		label: "Summary: streams offline",
+		example: "Ingresso (high) — since 06:40",
+		kinds: ["stream-offline", "stream-online"]
+	},
+	{
+		name: "summaryBattery",
+		label: "Summary: low batteries",
+		example: "Sensore porta — 8 %",
+		kinds: BATTERY
+	},
+	{
+		name: "summaryConsumables",
+		label: "Summary: consumables",
+		example: "Robot — filter 10 %",
+		kinds: CONSUMABLE
+	},
+	{
+		name: "summaryTanks",
+		label: "Summary: tanks",
+		example: "Robot — clean water low",
+		kinds: TANK
+	},
+	{
+		name: "summaryDetection",
+		label: "Summary: cameras detecting nothing",
+		example: "Ingresso — since 05:10",
+		kinds: ["detection-blind"]
+	},
+	{
+		name: "summaryNodes",
+		label: "Summary: nodes",
+		example: "little-unraid — offline since 03:00",
+		kinds: [
+			"node-offline",
+			"node-online",
+			"node-inference-unavailable"
+		]
+	},
+	{
+		name: "summaryAddons",
+		label: "Summary: addons",
+		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: [
+			"addon-crash-loop",
+			"addon-update-available",
+			"addon-updated"
+		]
+	},
+	{
+		name: "summaryUpdates",
+		label: "Summary: server & container updates",
+		example: "server 1.2.377 → 1.2.378",
+		kinds: [
+			"server-update-available",
+			"server-updated",
+			"wrapper-update-available"
+		]
+	}
+];
+var STATE_SUMMARY_VARS = [
+	{
+		name: "summaryText",
+		label: "Summary: every section",
+		description: "One block per section with something to report, one line per item.",
+		example: "Batterie scariche: Sensore porta — 8 %",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	{
+		name: "summaryCount",
+		label: "Summary: items reported",
+		example: "3",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
+		name: v.name,
+		label: v.label,
+		example: v.example,
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...v.kinds],
+		systemEventDeliveries: ["summary"]
+	}))
+];
+[
+	[...DEVICE_EVENTS],
+	([...RULE_TEXT], [...COMBINED_ALARM]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
+	[...RULE_TEXT],
+	([...RULE_TEXT], [...COMBINED_ALARM]),
+	([...RULE_TEXT], [...PACKAGE_UPDATES]),
+	[...RULE_TEXT],
+	([...RULE_TEXT], [...COMBINED_ALARM]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_BODY_ONLY],
+	[...RULE_TEXT],
+	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...DEVICE_EVENTS]),
+	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
+	([...RULE_TEXT], [...CONSUMABLE]),
+	([...RULE_TEXT], [...TANK]),
+	[...RULE_TEXT],
+	([...RULE_TEXT], [...UPDATES]),
+	([...RULE_TEXT], [...UPDATES]),
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	([...RULE_TEXT], [...UPDATES]),
+	([...RULE_TEXT], [...PACKAGE_UPDATES]),
+	([...RULE_TEXT], [...PACKAGE_UPDATES]),
+	([...RULE_TEXT], [...UPDATES]),
+	([...RULE_TEXT], [...UPDATES]),
+	([...RULE_TEXT], [...PACKAGE_UPDATES]),
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
+	...STATE_SUMMARY_VARS
+];
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -50134,68 +51931,6 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
-Object.freeze(Object.fromEntries([{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}].map((s) => [s.stepId, s.defaultModelId])));
-string().min(1);
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-var ClusterSettingNumberSchema = number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -50439,6 +52174,232 @@ function buildAuthHeader(input) {
 	return `Digest ${parts.join(", ")}`;
 }
 //#endregion
+//#region src/event-stream-parts.ts
+var CRLF_CRLF = Buffer.from("\r\n\r\n", "latin1");
+var LF_LF = Buffer.from("\n\n", "latin1");
+var CLOSE_SUFFIX = "--";
+var CONTENT_LENGTH_RE = /^content-length\s*:\s*(\d+)\s*$/im;
+var HEARTBEAT_RE = /^(?:code=)?heartbeat(?:;|$)/i;
+/**
+* Carve every complete part out of `input`.
+*
+* `preambleConsumed` is per STREAM, not per call: RFC 1521's preamble is the
+* bytes before the first boundary, once. Discarding a leading fragment on every
+* call threw away every part on 2026-09-04 (see the pump test).
+*/
+function readCompleteParts(input, dashBoundary, preambleConsumed) {
+	const buf = Buffer.from(input.buffer, input.byteOffset, input.byteLength);
+	const marker = Buffer.from(dashBoundary, "latin1");
+	const items = [];
+	let pos = 0;
+	if (!preambleConsumed) {
+		const first = buf.indexOf(marker);
+		if (first < 0) return {
+			items,
+			rest: input,
+			preambleConsumed: false
+		};
+		pos = first;
+	}
+	for (;;) {
+		pos = skipLineBreaks(buf, pos);
+		const boundaryAt = buf.indexOf(marker, pos);
+		if (boundaryAt < 0) break;
+		if (boundaryAt > pos) {
+			items.push({
+				kind: "junk",
+				bytes: Buffer.from(buf.subarray(pos, boundaryAt))
+			});
+			pos = boundaryAt;
+		}
+		const part = readPartAt(buf, pos, marker);
+		if (part === null) break;
+		if (part.kind === "part") items.push({
+			kind: "part",
+			body: part.body
+		});
+		pos = part.next;
+	}
+	return {
+		items,
+		rest: Buffer.from(buf.subarray(pos)),
+		preambleConsumed: true
+	};
+}
+/** Read the part whose boundary starts at `at`, or null when it is not complete yet. */
+function readPartAt(buf, at, marker) {
+	const afterMarker = at + marker.length;
+	if (buf.length < afterMarker + 2) return null;
+	if (buf.toString("latin1", afterMarker, afterMarker + 2) === CLOSE_SUFFIX) return {
+		kind: "close",
+		next: afterMarker + 2
+	};
+	const nextMarker = buf.indexOf(marker, afterMarker);
+	const terminator = findHeaderTerminator(buf, afterMarker);
+	const headerEnd = terminator?.at ?? -1;
+	if (!(headerEnd >= 0 && (nextMarker < 0 || headerEnd < nextMarker))) {
+		if (nextMarker < 0) return null;
+		return {
+			kind: "part",
+			body: Buffer.from(buf.subarray(afterMarker, nextMarker)),
+			next: nextMarker
+		};
+	}
+	const bodyStart = headerEnd + (terminator?.length ?? 0);
+	const contentLength = parseContentLength(buf.toString("latin1", afterMarker, headerEnd));
+	if (contentLength === null) {
+		if (nextMarker < 0) return null;
+		return {
+			kind: "part",
+			body: Buffer.from(buf.subarray(bodyStart, nextMarker)),
+			next: nextMarker
+		};
+	}
+	const bodyEnd = bodyStart + contentLength;
+	if (nextMarker >= 0 && nextMarker < bodyEnd) return {
+		kind: "part",
+		body: Buffer.from(buf.subarray(bodyStart, nextMarker)),
+		next: nextMarker
+	};
+	if (buf.length < bodyEnd) return null;
+	return {
+		kind: "part",
+		body: Buffer.from(buf.subarray(bodyStart, bodyEnd)),
+		next: bodyEnd
+	};
+}
+/**
+* The blank line that ends a part's headers: CRLFCRLF by the spec, bare LFLF
+* from a firmware that writes Unix line ends. Accepting only CRLF would drop a
+* bare-LF part into the no-header branch, which waits for the next boundary —
+* the very lag D669 removes, back in silence.
+*/
+function findHeaderTerminator(buf, from) {
+	const crlf = buf.indexOf(CRLF_CRLF, from);
+	const lf = buf.indexOf(LF_LF, from);
+	if (crlf < 0 && lf < 0) return null;
+	if (lf < 0 || crlf >= 0 && crlf < lf) return {
+		at: crlf,
+		length: CRLF_CRLF.length
+	};
+	return {
+		at: lf,
+		length: LF_LF.length
+	};
+}
+function parseContentLength(headers) {
+	const m = CONTENT_LENGTH_RE.exec(headers);
+	if (!m) return null;
+	const n = Number.parseInt(m[1], 10);
+	return Number.isSafeInteger(n) ? n : null;
+}
+function skipLineBreaks(buf, from) {
+	let i = from;
+	while (i < buf.length && (buf[i] === 13 || buf[i] === 10)) i++;
+	return i;
+}
+function concatBytes(a, b) {
+	const out = new Uint8Array(a.byteLength + b.byteLength);
+	out.set(a, 0);
+	out.set(b, a.byteLength);
+	return out;
+}
+/**
+* A `heartbeat=N` keep-alive part: the bare body `Heartbeat` (or, on some
+* firmwares, `Code=Heartbeat`). It proves the stream is alive and is never an
+* event.
+*/
+function isHeartbeat(bodyText) {
+	return HEARTBEAT_RE.test(bodyText);
+}
+function classify(item, observedAt) {
+	if (item.kind === "junk") return {
+		kind: "unparsed",
+		reason: "block",
+		preview: Buffer.from(item.bytes).toString("utf8").slice(0, 160)
+	};
+	const bodyText = Buffer.from(item.body).toString("utf8").trim();
+	if (isHeartbeat(bodyText)) return { kind: "heartbeat" };
+	const event = parseAmcrestEventBody(bodyText, observedAt);
+	if (event === null) return {
+		kind: "unparsed",
+		reason: "body",
+		preview: bodyText.slice(0, 160)
+	};
+	return {
+		kind: "event",
+		event
+	};
+}
+/** Bytes kept from the END of the buffer when the cap trips — enough to hold a
+*  whole part plus the boundary that frames it. */
+var EVENT_STREAM_BUFFER_RETAIN_BYTES = 65536;
+/**
+* Pump the attach stream: every chunk is appended to the carry buffer and
+* every part it completes is delivered before the next chunk is awaited.
+*
+* `onBytes` names every chunk except one that carried nothing but complete
+* heartbeats — at `heartbeat=5` those would be twelve lines a minute of
+* nothing, and the stream's liveness is not what that line is for.
+*/
+async function pumpEventStream(stream, boundary, handlers) {
+	const dashBoundary = `--${boundary}`;
+	let buffered = new Uint8Array(0);
+	let preambleConsumed = false;
+	try {
+		for await (const chunk of stream) {
+			const value = chunk instanceof Uint8Array ? chunk : new Uint8Array(0);
+			if (value.byteLength === 0) continue;
+			const observedAt = Date.now();
+			const read = readCompleteParts(concatBytes(buffered, value), dashBoundary, preambleConsumed);
+			buffered = read.rest;
+			preambleConsumed = read.preambleConsumed;
+			if (buffered.byteLength > 1048576) {
+				handlers.onBufferOverflow?.(buffered.byteLength - EVENT_STREAM_BUFFER_RETAIN_BYTES, new TextDecoder().decode(buffered.slice(0, 120)));
+				buffered = buffered.slice(buffered.byteLength - EVENT_STREAM_BUFFER_RETAIN_BYTES);
+				preambleConsumed = false;
+			}
+			const deliveries = read.items.map((item) => classify(item, observedAt));
+			if (!(deliveries.length > 0 && buffered.byteLength === 0 && deliveries.every((d) => d.kind === "heartbeat"))) handlers.onBytes?.(value.byteLength, new TextDecoder().decode(value.slice(0, 120)));
+			for (const d of deliveries) if (d.kind === "event") handlers.onEvent(d.event);
+			else if (d.kind === "unparsed") handlers.onUnparsedBlock?.(d.reason, d.preview);
+		}
+	} finally {
+		stream.destroy();
+	}
+}
+/**
+* Parse a Dahua event block body. The salient line is a `;`-delimited
+* key=value list, e.g. `Code=VideoMotion;action=Start;index=0`. A
+* trailing multi-line `data={…}` JSON blob (present on some firmwares) is
+* ignored — motion needs only code/action/index. Returns null when no
+* `Code=` line is present.
+*
+* `observedAt` is when the chunk that COMPLETED the part arrived — with parts
+* delivered on completion, that is when the camera sent it.
+*/
+function parseAmcrestEventBody(body, observedAt) {
+	const codeLine = body.split(/\r?\n/).find((l) => l.includes("Code=")) ?? "";
+	if (!codeLine) return null;
+	const fields = /* @__PURE__ */ new Map();
+	for (const pair of codeLine.split(";")) {
+		const eq = pair.indexOf("=");
+		if (eq < 0) continue;
+		fields.set(pair.slice(0, eq).trim().toLowerCase(), pair.slice(eq + 1).trim());
+	}
+	const code = fields.get("code");
+	const action = fields.get("action");
+	if (!code || !action) return null;
+	const indexRaw = fields.get("index");
+	return {
+		observedAt,
+		code,
+		action,
+		index: indexRaw !== void 0 && /^\d+$/.test(indexRaw) ? Number.parseInt(indexRaw, 10) : null,
+		raw: body
+	};
+}
+//#endregion
 //#region src/amcrest-cgi-client.ts
 /**
 * Thin HTTP-Digest client for the Amcrest/Dahua CGI surface. One instance
@@ -50723,7 +52684,7 @@ var AmcrestCgiClient = class AmcrestCgiClient {
 	* as `setConfig`), e.g. `'[VideoMotion]'` or `'[All]'`.
 	*/
 	async openEventStream(codes, signal) {
-		const path = `/cgi-bin/eventManager.cgi?action=attach&codes=${codes}`;
+		const path = eventStreamPath(codes);
 		const first = await this.dialEventStream(path, signal);
 		if (first.res.statusCode !== 401) return first;
 		first.res.resume();
@@ -50855,6 +52816,10 @@ var AmcrestCgiClient = class AmcrestCgiClient {
 		}));
 	}
 };
+/** The attach path — `codes` unescaped, because Dahua requires the literal `[...]`. */
+function eventStreamPath(codes) {
+	return `/cgi-bin/eventManager.cgi?action=attach&codes=${codes}&heartbeat=5`;
+}
 /**
 * Subscribe to a camera's Dahua CGI event-manager attach stream. Returns
 * an `AbortController` — `controller.abort()` tears the subscription
@@ -50864,7 +52829,8 @@ var AmcrestCgiClient = class AmcrestCgiClient {
 * providers read the same way.
 *
 * Unlike Hikvision's XML alert stream, Dahua parts are `text/plain`
-* key=value blocks — `parseAmcrestEventBody` handles the projection.
+* key=value blocks, read and projected in `event-stream-parts.ts`. A part is
+* delivered when it is complete, never when the next one begins (D669).
 */
 function subscribeAmcrestEvents(client, codes, handlers) {
 	const controller = new AbortController();
@@ -50896,115 +52862,6 @@ function parseBoundary(contentType) {
 	const m = /boundary\s*=\s*"?([^";\s]+)"?/i.exec(contentType);
 	return m ? m[1].trim() : null;
 }
-async function pumpEventStream(stream, boundary, handlers) {
-	const dashBoundary = `--${boundary}`;
-	let bufferedBytes = new Uint8Array(0);
-	let preambleConsumed = false;
-	try {
-		for await (const chunk of stream) {
-			const value = chunk instanceof Uint8Array ? chunk : new Uint8Array(0);
-			if (value.byteLength === 0) continue;
-			handlers.onBytes?.(value.byteLength, new TextDecoder().decode(value.slice(0, 120)));
-			bufferedBytes = concatBytes(bufferedBytes, value);
-			const parts = splitOnBoundary(bufferedBytes, dashBoundary, preambleConsumed);
-			if (parts.blocks.length > 0 || parts.tail !== bufferedBytes) preambleConsumed = true;
-			bufferedBytes = parts.tail;
-			for (const block of parts.blocks) {
-				const parsed = parseMultipartBlock(block);
-				if (!parsed) {
-					handlers.onUnparsedBlock?.("block", new TextDecoder().decode(block).slice(0, 160));
-					continue;
-				}
-				const ev = parseAmcrestEventBody(parsed.bodyText);
-				if (!ev) {
-					handlers.onUnparsedBlock?.("body", parsed.bodyText.slice(0, 160));
-					continue;
-				}
-				handlers.onEvent(ev);
-			}
-		}
-	} finally {
-		stream.destroy();
-	}
-}
-function concatBytes(a, b) {
-	const out = new Uint8Array(a.byteLength + b.byteLength);
-	out.set(a, 0);
-	out.set(b, a.byteLength);
-	return out;
-}
-/**
-* Split the running buffer on the multipart boundary.
-*
-* `preambleConsumed` is NOT optional bookkeeping. RFC 1521 says the bytes before
-* the FIRST boundary are a preamble to discard — but that is true exactly once
-* per stream. This function used to `shift()` unconditionally on every pump
-* cycle, and from the second cycle on the leading fragment is not a preamble at
-* all: it is the body of the part the newly-arrived boundary just CLOSED. So
-* every completed block was thrown away as preamble, `blocks` came back empty
-* forever, and the caller's loop never ran — no event, and no dropped-block
-* warning either, because there was nothing in the array to warn about.
-*
-* Cost of that one line: this camera's onboard motion never reached the
-* pipeline. It streamed video fine, reported `enabled: true`, held an
-* ESTABLISHED socket, and delivered `--myboundary` chunks that were parsed into
-* nothing. Two hand-rolled probes against the same camera worked throughout —
-* because they regex the raw lines and never split on the boundary at all.
-*/
-function splitOnBoundary(buf, dashBoundary, preambleConsumed) {
-	const parts = Buffer.from(buf).toString("binary").split(dashBoundary);
-	if (parts.length <= 1) return {
-		blocks: [],
-		tail: buf
-	};
-	const tail = Buffer.from(parts.pop(), "binary");
-	if (!preambleConsumed) parts.shift();
-	return {
-		blocks: parts.filter((p) => p.length > 0 && !p.startsWith("--")).map((p) => Buffer.from(p, "binary")),
-		tail
-	};
-}
-function parseMultipartBlock(block) {
-	let start = 0;
-	while (start < block.length && (block[start] === 13 || block[start] === 10)) start++;
-	const headerEnd = findHeaderEnd(block, start);
-	const bodyStart = headerEnd < 0 ? start : headerEnd + 4;
-	const bodySlice = block.subarray(bodyStart);
-	return { bodyText: Buffer.from(bodySlice).toString("utf8").replace(/\r?\n--$/m, "").trim() };
-}
-function findHeaderEnd(buf, from) {
-	for (let i = from; i + 3 < buf.length; i++) if (buf[i] === 13 && buf[i + 1] === 10 && buf[i + 2] === 13 && buf[i + 3] === 10) return i;
-	return -1;
-}
-/**
-* Parse a Dahua event block body. The salient line is a `;`-delimited
-* key=value list, e.g. `Code=VideoMotion;action=Start;index=0`. A
-* trailing multi-line `data={…}` JSON blob (present on some firmwares) is
-* ignored — motion needs only code/action/index. Returns null when no
-* `Code=` line is present (e.g. an empty heartbeat frame).
-*/
-function parseAmcrestEventBody(body) {
-	const codeLine = body.split(/\r?\n/).find((l) => l.includes("Code=")) ?? "";
-	if (!codeLine) return null;
-	const fields = /* @__PURE__ */ new Map();
-	for (const pair of codeLine.split(";")) {
-		const eq = pair.indexOf("=");
-		if (eq < 0) continue;
-		fields.set(pair.slice(0, eq).trim().toLowerCase(), pair.slice(eq + 1).trim());
-	}
-	const code = fields.get("code");
-	const action = fields.get("action");
-	if (!code || !action) return null;
-	const indexRaw = fields.get("index");
-	const index = indexRaw !== void 0 && /^\d+$/.test(indexRaw) ? Number.parseInt(indexRaw, 10) : null;
-	return {
-		observedAt: Date.now(),
-		code,
-		action,
-		index,
-		raw: body
-	};
-}
 var DAY_NIGHT_NATIVE_TO_CAP = {
 	Brightness: "auto",
 	Color: "day",
@@ -52505,6 +54362,15 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 					}
 				});
 			},
+			onBufferOverflow: (droppedBytes, preview) => {
+				this.ctx.logger.warn("amcrest: event stream buffer hit its cap — discarded the head, resyncing on the next boundary", {
+					tags: { deviceId: this.id },
+					meta: {
+						droppedBytes,
+						preview
+					}
+				});
+			},
 			onUnparsedBlock: (reason, preview) => {
 				this.ctx.logger.warn("amcrest: event block dropped — could not be parsed", {
 					tags: { deviceId: this.id },