@camstack/addon-provider-homeassistant 1.2.10 → 1.2.12

package/dist/addon.mjs

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
-//#region ../types/dist/event-category-Bz24uP1U.mjs
+//#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -60,6 +60,26 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonRetryScheduled"] = "addon.retry-scheduled";
 	/**
+	* A liveness invariant of this node is false — it has no devices, every
+	* camera is offline, or a camera that was recording has stopped producing
+	* segments. Emitted by the `liveness-monitor` builtin, once per fault (the
+	* `findingId` is stable across ticks), only after its boot grace period.
+	* AlertCenter raises a persistent operator-visible alert.
+	*
+	* It exists because on 2026-08-03 the hub ran four hours with zero devices
+	* and zero recordings while every surface stayed quiet.
+	*
+	* Payload: `{ findingId, severity, title, message, deviceId? }`.
+	*/
+	EventCategory["SystemLivenessFailed"] = "system.liveness-failed";
+	/**
+	* A previously reported liveness fault is true again. AlertCenter dismisses
+	* the matching `SystemLivenessFailed` alert.
+	*
+	* Payload: `{ findingId }`.
+	*/
+	EventCategory["SystemLivenessRecovered"] = "system.liveness-recovered";
+	/**
 	* Monitor is attempting to reload a failed addon NOW. UI uses this
 	* to show a spinner during the retry attempt. Same transient nature
 	* as AddonRetryScheduled.
@@ -7443,14 +7463,7 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
-	/**
-	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
-	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
-	* cache that eviction reclaims with the footage. Absent/false = no strips
-	* are written and scrub reads exact keyframes at every velocity.
-	*/
-	stripsEnabled: boolean().optional()
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
@@ -7512,7 +7525,7 @@ var OpsLogQueryInputSchema = object({
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
-* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* One shape shared by the recorder's `relocateFootage` (segments) and
 * pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
 * page renders both movers with one component. Jobs are in-RAM (a restart
 * forgets them — re-running is safe by construction: copy-if-absent, delete
@@ -7534,7 +7547,7 @@ var RelocateJobSchema = object({
 	toLocationId: string(),
 	/** Scoped device, or null = every device. */
 	deviceId: number().nullable(),
-	/** What the job moves (owner-addon specific: segments/strips or media). */
+	/** What the job moves (owner-addon specific: segments or media). */
 	entities: array(string()),
 	filesMoved: number().int(),
 	bytesMoved: number().int(),
@@ -7548,7 +7561,7 @@ var RelocateFootageInputSchema = object({
 	deviceId: number().optional(),
 	fromLocationId: string(),
 	toLocationId: string(),
-	entities: array(_enum(["segments", "strips"])).optional(),
+	entities: array(_enum(["segments"])).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: number().min(1).max(1e3).optional()
@@ -9453,8 +9466,11 @@ function prepareNotification(caps, n) {
 		});
 	}
 	const inActions = n.actions ?? [];
-	const actions = inActions.slice(0, Math.max(0, caps.actions));
-	if (inActions.length > actions.length) dropped.push("actions");
+	const kept = inActions.slice(0, Math.max(0, caps.actions));
+	if (inActions.length > kept.length) dropped.push("actions");
+	const iconsSupported = caps.actionIcons === true;
+	if (!iconsSupported && kept.some((a) => a.icon !== void 0)) dropped.push("actionIcons");
+	const actions = iconsSupported ? kept : kept.map(({ icon: _icon, ...rest }) => rest);
 	let clickUrl = null;
 	if (n.clickUrl !== void 0) if (caps.clickUrl) clickUrl = n.clickUrl;
 	else dropped.push("clickUrl");
@@ -9553,6 +9569,290 @@ var MaskGridDimsSchema = object({
 	height: number()
 });
 /**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"disarm",
+	"light",
+	"alert"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$1,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(object({}), array(TargetKindSchema)),
+		listTargets: method(object({}), array(TargetSchema)),
+		discoverTargets: method(object({
+			kind: string(),
+			config: record(string(), unknown()).optional()
+		}), array(DiscoveredTargetSchema)),
+		send: method(object({
+			targetId: string(),
+			notification: NotificationSchema
+		}), SendResultSchema, { kind: "mutation" }),
+		testTarget: method(object({
+			targetId: string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, { kind: "mutation" }),
+		upsertTarget: method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
+		deleteTarget: method(object({ targetId: string() }), _void(), { kind: "mutation" }),
+		setTargetEnabled: method(object({
+			targetId: string(),
+			enabled: boolean()
+		}), _void(), { kind: "mutation" })
+	}
+};
+/**
 * notification-rules — the Notification Center rule surface (P1 core).
 *
 * Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
@@ -9682,7 +9982,115 @@ var NcZoneConditionSchema = object({
 * The P1 condition set — a flat AND of groups; absent group = pass;
 * membership lists are OR within the list (spec §2.3).
 */
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = discriminatedUnion("kind", [object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+}), object({
+	kind: literal("cap"),
+	deviceId: number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: record(string(), unknown()).optional()
+})]);
+/**
+* A named, ordered run of steps with its own throttle.
+*
+* `minDelaySec` exists because a noisy rule otherwise hammers a physical
+* actuator — the rule's own cooldown governs NOTIFICATIONS, which is a
+* different budget from "how often may this gate actually open".
+*/
+var NcRuleActionSequenceSchema = object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	minDelaySec: number().int().min(0).max(86400).optional(),
+	actions: array(NcRuleActionSchema).min(1)
+});
+/**
+* One button carried by the notification, running a named sequence on tap.
+*
+* **Read this before adding a button that does something physical.** The tap
+* arrives over a link that travelled through third-party infrastructure — ntfy,
+* a push relay, whatever forwarded the message — and the callback's ONLY
+* authority is the token in that link: single-use, short-lived, bound to this
+* one action of this one notification. It does not identify who tapped.
+* Whoever holds the notification can run the button, once, inside the window.
+* That is the operator's explicit choice (2026-08-05), and `destructive` is a
+* rendering hint, not a second gate. [D47](decisions/adr-0047.md).
+*/
+var NcRuleNotificationButtonSchema = object({
+	/** Stable id — travels in the callback and identifies the button in logs. */
+	id: string().min(1).max(64),
+	label: string().min(1).max(40),
+	/** Name of a sequence in `onTrigger`. The dispatcher drops a button whose
+	*  sequence does not exist rather than minting a token for nothing. */
+	sequence: string().min(1).max(120),
+	icon: NotificationActionIconSchema.optional(),
+	destructive: boolean().optional()
+});
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = object({
+	/** Runs when the rule MATCHES. */
+	onTrigger: array(NcRuleActionSequenceSchema).optional(),
+	/**
+	* Buttons the NOTIFICATION carries, each running one of this rule's
+	* sequences when tapped.
+	*
+	* Deliberately a REFERENCE to a sequence rather than a second place to
+	* author steps. A button that could define its own actions would be a
+	* parallel actuation vocabulary — the executor's device-scope check, the
+	* stop-at-first-failure rule and the per-sequence throttle all live on
+	* sequences, and a second authoring surface would drift from every one of
+	* them.
+	*
+	* A sequence reachable ONLY by a button simply appears in `onTrigger` with
+	* `enabled: false`: it is then authored, throttled and validated like the
+	* rest, and nothing runs it automatically.
+	*/
+	buttons: array(NcRuleNotificationButtonSchema).max(8).optional()
+});
 var NcConditionsSchema = object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: object({
+		deviceId: number().int(),
+		/** Any of these matches. */
+		states: array(string().min(1)).min(1)
+	}).optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -9883,6 +10291,14 @@ var NcMediaPolicySchema = object({
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
+	* Playback rate of the attached gif / clip. Absent = 2x.
+	*
+	* A notification clip is GLANCED at on a lock screen, not watched: at real
+	* time an eight-second passage is eight seconds of the recipient's attention
+	* and twice the bytes. 1 is real time for the operator who wants it.
+	*/
+	clipSpeed: number().min(1).max(8).optional(),
+	/**
 	* Which stream profile the footage is cut from. Absent = the CHEAPEST
 	* assigned profile: a notification is watched on a phone, so the 4K
 	* rendition would burn CPU to produce a file the client downscales anyway.
@@ -9954,7 +10370,30 @@ var NcRuleInputSchema = object({
 	* behaviour, visible to all, read-only in the viewer). Present = personal
 	* rule owned by this userId. Server-stamped; never trusted from a client.
 	*/
-	ownerUserId: string().optional()
+	ownerUserId: string().optional(),
+	/**
+	* May a non-admin snooze this rule for EVERYONE, not just themselves?
+	*
+	* A snooze is personal by default — it silences the person who set it. This
+	* opts THIS rule into the "the gardener is here all afternoon" case, where
+	* silencing the camera for the whole household is legitimate. It silences
+	* other people, so it is off unless a rule deliberately allows it.
+	*
+	* `.optional()`, deliberately NOT `.default()`: a Zod default does not run on
+	* the addon cap path (three production failures in one day), so absent is
+	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
+	* by this flag — see the scope rules on that function.
+	*/
+	snoozeAllowGlobal: boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -10025,7 +10464,8 @@ var NcConditionDescriptorSchema = object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: _enum([
 		"in",
@@ -10039,7 +10479,28 @@ var NcConditionDescriptorSchema = object({
 	/** Which delivery kinds the condition applies to. */
 	appliesTo: array(NcDeliverySchema),
 	phase: string(),
-	description: string().optional()
+	description: string().optional(),
+	/**
+	* The CHOICES for a single-choice widget (`sourceSelect`, `crossingSelect`,
+	* `packagePhase`, …), served with the descriptor.
+	*
+	* Before this the descriptor said which widget to render and not what to put
+	* in it, so every option list lived in three places: this file's enums, the
+	* admin's `NC_*_OPTIONS` and the viewer's `NC_*_VALUES`. That triple mirror
+	* is the drift that emptied the viewer's rule editor on 2026-08-04 — the app
+	* mirrors the cap by hand, so it is only ever as current as its last build.
+	*
+	* With the options on the wire, a condition of an EXISTING `valueType` costs
+	* zero client changes. Clients keep a local fallback for an older hub that
+	* does not send them; absent here is "use your own list", not "no choices".
+	*/
+	options: array(object({
+		/** Written to the rule verbatim. `''` means the ABSENT state. */
+		value: string(),
+		label: string(),
+		/** What THIS choice matches — shown one at a time, under the control. */
+		hint: string().optional()
+	})).readonly().optional()
 });
 /**
 * The delivery lifecycle status of a history row — a straight read of the
@@ -10124,6 +10585,74 @@ var NcHistoryFilterSchema = object({
 	until: number().optional(),
 	limit: number().int().min(1).max(500).default(100)
 });
+/**
+* What a snooze covers. Broader scopes win when several overlap, so one window
+* leaves ONE digest rather than a rule snooze and a whole-feed snooze both
+* summarising the same silence.
+*/
+var NcSnoozeScopeSchema = _enum([
+	"rule",
+	"device",
+	"all"
+]);
+/**
+* Client-authored snooze. The server stamps `userId`, `startedAt` and
+* `expiresAt` — a DURATION is sent rather than an instant so a client with a
+* skewed clock cannot author a window that is already over, or never ends.
+*/
+var NcSnoozeInputSchema = object({
+	scope: NcSnoozeScopeSchema,
+	/** Required when `scope: 'rule'` — a scoped snooze with no id matches
+	*  NOTHING rather than degrading to "everything". */
+	ruleId: string().optional(),
+	/** Required when `scope: 'device'`. */
+	deviceId: number().int().optional(),
+	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Silence this for EVERY recipient, not just the caller. Permission is
+	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
+	* broader scopes). Absent = personal.
+	*/
+	global: boolean().optional(),
+	/**
+	* Deliver a summary of what was suppressed when the window ends. Absent =
+	* ON: someone silencing a nuisance camera wants it off, someone silencing a
+	* SECURITY camera wants to know what they missed, and choosing "off" for
+	* everybody is how a snooze becomes an outage. Resolved to a concrete
+	* boolean by the server at create time — never left to a Zod default, which
+	* does not run on the addon cap path.
+	*/
+	summary: boolean().optional()
+});
+/** A persisted snooze window. */
+var NcSnoozeSchema = object({
+	id: string(),
+	/** Who set it. Also who it silences, unless `global`. */
+	userId: string(),
+	scope: NcSnoozeScopeSchema,
+	ruleId: string().optional(),
+	deviceId: number().int().optional(),
+	startedAt: number(),
+	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
+	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
+	expiresAt: number(),
+	global: boolean(),
+	summary: boolean(),
+	/** When the end-of-window digest went out. Absent = not sent (yet, or the
+	*  window has not closed, or `summary` is false). */
+	digestSentAt: number().optional()
+});
+object({
+	snoozeId: string(),
+	targetId: string(),
+	ruleId: string(),
+	ruleName: string(),
+	deviceId: number().int(),
+	/** How many notifications this snooze hid for that pair. */
+	count: number().int(),
+	firstAt: number(),
+	lastAt: number()
+});
 method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
@@ -10153,7 +10682,13 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+	kind: "mutation",
+	caller: "required"
+}), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	caller: "required"
+});
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -11173,7 +11708,15 @@ method(object({
 	format: _enum(["gif", "mp4"]).default("gif"),
 	maxWidth: number().int().min(120).max(1920).default(480),
 	/** GIF only — MP4 keeps the source cadence. */
-	fps: number().int().min(1).max(15).default(5)
+	fps: number().int().min(1).max(15).default(5),
+	/**
+	* Playback rate. A notification clip is GLANCED at on a lock screen,
+	* not watched, so 2x is the default: the recipient sees the whole
+	* passage in half the time and the GIF is half the bytes. `1` is real
+	* time. Applies to MP4 as well — the operator set a speed, not a GIF
+	* speed.
+	*/
+	speed: number().min(1).max(8).default(2)
 }), object({
 	base64: string(),
 	mime: string(),
@@ -18511,6 +19054,210 @@ method(object({ codec: string() }), boolean()), method(_void(), object({
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional()
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
+/**
+* What one engine says about itself. The orchestrator uses `kind` to pick
+* a registrant for a collection; `engineId` is what a log line names when
+* a call is routed or refused.
+*/
+var EngineInfoSchema = object({
+	engineId: string(),
+	/**
+	* `relational` — rows, columns, indexes, the surface `settings-store`
+	* has always described. `vector` — an embedding store answering
+	* similarity queries. A registrant declares exactly one; an engine that
+	* does both registers twice, because "both" would make the routing
+	* decision ambiguous at exactly the point it must not be.
+	*/
+	kind: _enum(["relational", "vector"]),
+	displayName: string()
+});
+method(_void(), EngineInfoSchema), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
 DeviceType.Camera;
 /**
 * `device-adoption` — generic discovery + adoption surface,
@@ -19206,7 +19953,20 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({ addonId: string().optional() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({
+	addonId: string().optional(),
+	/**
+	* `slim` omits `config` (returned `{}`), `metadata` (null) and the
+	* `sourceInfo` derived from config — and skips the per-device settings
+	* read that produces them. Everything identifying a device (id, name,
+	* type, online, features, isCamera, parent/link ids) is unchanged.
+	* Do not use it for dispatch routing, which needs `sourceInfo`.
+	*/
+	projection: _enum(["full", "slim"]).optional(),
+	/** Return only camera devices. Filtering server-side instead of
+	*  shipping 293 rows to find 12. */
+	isCamera: boolean().optional()
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
 	mode: DeviceLinkModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -19645,14 +20405,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -20183,241 +20943,102 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
 /**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. */
+var CoreBlockStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"failed"
 ]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
+/** Client-authored fields. */
+var CoreBlockInputSchema = object({
+	name: string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: string().max(2e5),
+	enabled: boolean(),
+	placement: CoreBlockPlacementSchema,
 	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
 	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: boolean(),
-	caps: TargetKindCapsSchema
+	integrationId: string().optional()
 });
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
 	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
+	createdAt: number(),
+	updatedAt: number(),
+	/** Server-stamped author. */
+	createdBy: string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: number()
 });
-var SendResultSchema = object({
-	success: boolean(),
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = object({
+	ok: boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
 	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
+	line: number().optional(),
+	column: number().optional()
 });
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: method(object({}), array(TargetKindSchema)),
-		listTargets: method(object({}), array(TargetSchema)),
-		discoverTargets: method(object({
-			kind: string(),
-			config: record(string(), unknown()).optional()
-		}), array(DiscoveredTargetSchema)),
-		send: method(object({
-			targetId: string(),
-			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
-		testTarget: method(object({
-			targetId: string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: method(object({ targetId: string() }), _void(), { kind: "mutation" }),
-		setTargetEnabled: method(object({
-			targetId: string(),
-			enabled: boolean()
-		}), _void(), { kind: "mutation" })
-	}
-};
+method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	block: CoreBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	blockId: string(),
+	enabled: boolean()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ code: string() }), CoreBlockCompileResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ libs: array(object({
+	filePath: string(),
+	content: string()
+})) }), { auth: "admin" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -20665,6 +21286,11 @@ var EventKindDescriptorSchema = object({
 		deviceId: number()
 	})
 });
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
+	deviceId: number(),
+	kinds: array(EventKindDescriptorSchema).readonly()
+});
 var SensorEventSchema = object({
 	id: string(),
 	/** The CAMERA the event is attributed to (a sensor linked to N cameras
@@ -20921,6 +21547,19 @@ var MediaFileSchema = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
+/**
+* One media row WITHOUT its bytes.
+*
+* A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
+* 140 s track), and a client that renders tiles from the media data plane needs
+* to know only WHAT EXISTS — the bytes then arrive per tile, lazily, over HTTP
+* with an immutable cache, instead of all at once inside a tRPC response that
+* blocks the whole view.
+*
+* `sizeBytes` is carried because it is what lets a client decide between the
+* stored blob and a `?variant=thumb` rendering without fetching either.
+*/
+var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = object({
@@ -21070,7 +21709,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number().optional(),
 	until: number().optional(),
@@ -21144,7 +21783,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -21774,6 +22413,28 @@ var ServerUpdateStateSchema = _enum([
 	"pending-restart",
 	"awaiting-confirmation"
 ]);
+var ImageContractSchema = object({
+	state: _enum([
+		"in-sync",
+		"behind-patch",
+		"behind-series",
+		"ahead",
+		"unknown"
+	]),
+	/** The baked seed closure version — the image/app-bundle fingerprint. */
+	seedVersion: string().nullable(),
+	/** Best-known version the deployment contract delivers today. */
+	contractVersion: string().nullable(),
+	/**
+	* Where `contractVersion` came from: a real registry check (`registry`), or
+	* the node's own running version (`running` — a node can never run code
+	* newer than the newest release, so `seed < running` proves image staleness
+	* even before any registry check has run).
+	*/
+	contractSource: _enum(["registry", "running"]).nullable(),
+	/** One operator-grade sentence: this node runs image X; the contract says Y. */
+	message: string()
+});
 var ServerRollbackInfoSchema = object({
 	/** The version that failed (or was manually rolled back). */
 	fromVersion: string(),
@@ -21810,7 +22471,12 @@ var ServerPackageStatusSchema = object({
 	* versions are being IGNORED. Surfaced as a warning in the UI.
 	*/
 	stateFileCorrupt: boolean(),
-	lastCheckedAtMs: number().nullable()
+	lastCheckedAtMs: number().nullable(),
+	/**
+	* Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
+	* version skew: an older provider's payload simply omits it.
+	*/
+	imageContract: ImageContractSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -21845,101 +22511,6 @@ version: string().optional() }), ServerUpdateActionResultSchema, {
 	auth: "admin"
 });
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
-/**
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
@@ -25891,6 +26462,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.compile": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.create": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.delete": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"coreBlocks.get": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.getTypeDefs": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.list": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.setEnabled": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.update": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"cover.close": {
 		capName: "cover",
 		capScope: "device",
@@ -25927,6 +26546,84 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.count": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.declareCollection": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.delete": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.deleteWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.get": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.getEngineInfo": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.histogram": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.insert": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.isEmpty": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.query": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.set": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.update": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.updateWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -27721,12 +28418,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.cancelSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.createRule": {
 		capName: "notification-rules",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.deleteRule": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -27757,6 +28466,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listSnoozes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -27961,6 +28676,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventKindsBatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -27973,6 +28694,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listTrackMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29005,6 +29732,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"settingsStore.deleteWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"settingsStore.get": {
 		capName: "settings-store",
 		capScope: "system",
@@ -29047,6 +29780,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.updateWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",
@@ -30431,11 +31170,18 @@ var HaBaseChildDevice = class HaBaseChildDevice extends BaseDevice {
 	async onActivate() {
 		await super.onActivate();
 		await this.refreshFeatures();
-		await this.subscribeBrokerEntity();
-		this.deviceLogger.info("HA entity ready", { meta: {
+		if (await this.subscribeBrokerEntity()) {
+			this.deviceLogger.info("HA entity ready", { meta: {
+				entityId: this.entityId,
+				type: this.ctx.deviceMeta.type,
+				...this.features.length > 0 ? { features: [...this.features] } : {}
+			} });
+			return;
+		}
+		this.deviceLogger.warn("HA entity registered but NOT subscribed — it will receive nothing", { meta: {
 			entityId: this.entityId,
-			type: this.ctx.deviceMeta.type,
-			...this.features.length > 0 ? { features: [...this.features] } : {}
+			brokerId: this.brokerId,
+			type: this.ctx.deviceMeta.type
 		} });
 	}
 	async removeDevice() {
@@ -30539,6 +31285,8 @@ var HaBaseChildDevice = class HaBaseChildDevice extends BaseDevice {
 	* already-attached handler and `handleStatePush` fires with the real
 	* current state (seeding the cap-state slice at construction time).
 	*/
+	/** True when the entity is genuinely subscribed. The caller uses it to
+	*  decide whether "ready" is an honest thing to log. */
 	async subscribeBrokerEntity() {
 		try {
 			const result = await this.ctx.api.broker.subscribe.mutate({
@@ -30546,12 +31294,14 @@ var HaBaseChildDevice = class HaBaseChildDevice extends BaseDevice {
 				filter: { entityIds: [this.entityId] }
 			});
 			this.brokerSubscriptionId = result.subscriptionId;
+			return true;
 		} catch (err) {
 			this.deviceLogger.warn("ha-child failed to register broker subscription", { meta: {
 				entityId: this.entityId,
 				brokerId: this.brokerId,
 				error: errMsg(err)
 			} });
+			return false;
 		}
 	}
 	attachEventBusListener() {
@@ -36531,7 +37281,7 @@ function createHaIconRouteProvider() {
 /** The single kind this provider contributes to the shared catalog. */
 var HA_NOTIFICATION_KIND = "homeassistant";
 /** addonId-namespaced settings-store collection holding HA notify targets. */
-var HA_TARGETS_COLLECTION = "ha-notification-targets";
+var HA_TARGETS_COLLECTION = "provider-homeassistant:ha-notification-targets";
 function haConfigSchema() {
 	return { sections: [{
 		id: "connection",
@@ -36575,6 +37325,7 @@ function homeassistantTargetKind(addonId) {
 				max: 1
 			},
 			actions: 3,
+			actionIcons: true,
 			levels: [
 				{
 					id: "default",
@@ -36630,6 +37381,21 @@ function applyLevel(data, level) {
 	}
 	data["push"] = push;
 }
+var HA_ACTION_ICONS = {
+	acknowledge: "mdi:check",
+	dismiss: "mdi:close",
+	silence: "mdi:bell-off",
+	view: "mdi:eye",
+	play: "mdi:play",
+	open: "mdi:door-open",
+	close: "mdi:door-closed",
+	lock: "mdi:lock",
+	unlock: "mdi:lock-open",
+	arm: "mdi:shield-check",
+	disarm: "mdi:shield-off",
+	light: "mdi:lightbulb",
+	alert: "mdi:alert"
+};
 /**
 * Build the `notify.<service>` `service_data` from a prepared (degraded)
 * notification. PURE — no WS, unit-testable in isolation.
@@ -36646,7 +37412,8 @@ function buildNotifyServiceData(prepared) {
 	if (prepared.actions.length > 0) data["actions"] = prepared.actions.map((a) => ({
 		action: a.id,
 		title: a.label,
-		...a.url !== void 0 ? { uri: a.url } : {}
+		...a.url !== void 0 ? { uri: a.url } : {},
+		...a.icon !== void 0 ? { icon: HA_ACTION_ICONS[a.icon] } : {}
 	}));
 	if (prepared.clickUrl !== null) {
 		data["url"] = prepared.clickUrl;
@@ -36990,6 +37757,19 @@ async function reconcileBroker(brokerId, deps) {
 * whose integration no longer exists should be cleaned up. Brokers with no
 * integrationId were created manually and are never auto-removed.
 */
+/**
+* Brokers whose spawning integration is gone.
+*
+* **The caller REPORTS these; it does not delete them.** This function used to
+* drive a delete, and on 2026-08-05 that erased the operator's Home Assistant
+* broker — host and token — when `integrations.list` returned an empty array
+* during a hub restart: nothing "survived", so everything was an orphan. A
+* broker cannot be rebuilt from an integration record, so the loss was
+* permanent and the doorbell simply stopped existing.
+*
+* Kept as a pure query because naming an orphan is useful; acting on one
+* automatically is not.
+*/
 function computeBrokerCleanup(brokers, survivingIntegrationIds) {
 	return brokers.filter((b) => b.integrationId !== void 0 && !survivingIntegrationIds.has(b.integrationId)).map((b) => b.id);
 }
@@ -37577,15 +38357,15 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			}
 			const linkedBrokers = linkBrokersToIntegrations(this.config.brokers, integrationsWithBrokerId);
 			if (linkedBrokers.some((b, i) => b !== this.config.brokers[i])) await this.updateGlobalSettings({ brokers: linkedBrokers });
-			const toRemove = computeBrokerCleanup(this.config.brokers, survivingIntegrationIds);
-			if (toRemove.length === 0) return;
-			for (const id of toRemove) await this.requireRegistry().removeEntry(id);
-			const nextBrokers = this.config.brokers.filter((b) => !toRemove.includes(b.id));
-			await this.updateGlobalSettings({ brokers: nextBrokers });
+			const orphans = computeBrokerCleanup(this.config.brokers, survivingIntegrationIds);
 			this.ctx.logger.info("integration→broker reconcile", { meta: {
-				brokerCount: nextBrokers.length,
+				brokerCount: this.config.brokers.length,
 				integrationCount: haIntegrations.length,
-				removed: toRemove.length
+				orphans: orphans.length
+			} });
+			if (orphans.length > 0) this.ctx.logger.warn("broker entries have no surviving integration — KEPT", { meta: {
+				brokerIds: orphans,
+				integrationCount: haIntegrations.length
 			} });
 		} catch (err) {
 			this.ctx.logger.warn("integration→broker reconcile failed", { meta: { error: errMsg(err) } });