@camstack/addon-provider-homeassistant 1.2.29 → 1.2.30

package/dist/{dist-D_VrlKNr.mjs → dist-CzZXxFrl.mjs}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-Cv9dO26A.mjs
+//#region ../types/dist/event-category-Bxo5yJjt.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -205,6 +205,33 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["PipelineCameraAssigned"] = "pipeline.camera-assigned";
 	EventCategory["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
 	/**
+	* A node the orchestrator would otherwise place cameras on has NO usable
+	* inference device: the operator enabled one or more accelerators there and
+	* the live probe reports every one of them unavailable. Emitted once per
+	* TRANSITION into that state (never per dispatch), and the node is dropped
+	* from the placement candidate set for as long as it holds.
+	*
+	* This exists because the state was previously invisible: little-unraid
+	* absorbed 283k inference errors in a day while still being handed cameras,
+	* and nothing in the system said so.
+	*
+	* A node with no accelerators configured at all is NOT this — its devices
+	* are `disabled`, not `unavailable`, and the runner's default CPU pool
+	* serves it exactly as before.
+	*/
+	EventCategory["PipelineNodeInferenceUnavailable"] = "pipeline.node-inference-unavailable";
+	/**
+	* A camera has an OPEN detection session and has produced no detection at
+	* all for longer than the blind threshold — the camera is being decoded and
+	* inferred and is returning nothing. Emitted once per transition into blind,
+	* per camera.
+	*
+	* The failure it reports: a 1h43 detection blackout on the entrance camera
+	* that nobody noticed, because "a camera that detects nothing" and "a quiet
+	* camera" produce byte-identical silence.
+	*/
+	EventCategory["PipelineDetectionBlind"] = "pipeline.detection-blind";
+	/**
 	* Per-camera pipeline config was mutated by the orchestrator
 	* (3-level settings change via `setAgentAddonDefaults` /
 	* `setCameraStepToggle` / `setCameraPipelineForAgent` or a
@@ -12701,6 +12728,17 @@ var LlmImageSchema = object({
 	bytes: _instanceof(Uint8Array),
 	mimeType: string()
 });
+/**
+* Retry policy. `enabled: false` is NOT the same as `maxAttempts: 1` in intent —
+* the flag is what a consumer table flips, the count is what the operator tunes.
+* A retry doubles the wall time of a call, so the two gates that run inside a
+* notification's budget keep it off (see `CONSUMER_RETRY_POLICY` in addon-ai).
+*/
+var LlmRetryPolicySchema = object({
+	enabled: boolean().default(false),
+	/** Total attempts INCLUDING the first. 1 = no retry. */
+	maxAttempts: number().int().min(1).max(5).default(1)
+});
 var LlmGenerateBaseInputSchema = object({
 	/** Collection routing (the notification-output posture). */
 	addonId: string().optional(),
@@ -12715,7 +12753,28 @@ var LlmGenerateBaseInputSchema = object({
 	jsonSchema: record(string(), unknown()).optional(),
 	/** Per-call override of the profile default. */
 	maxTokens: number().int().positive().optional(),
-	temperature: number().optional()
+	temperature: number().optional(),
+	/** Per-call override of the profile default (nucleus sampling). */
+	topP: number().min(0).max(1).optional(),
+	/** Per-call override of the profile default (top-k sampling). */
+	topK: number().int().positive().optional(),
+	/** Per-call override of `profile.timeoutMs` — the total generation bound. */
+	timeoutMs: number().int().positive().optional(),
+	/** Per-call override; beats both the consumer table and the profile. */
+	retry: LlmRetryPolicySchema.optional(),
+	/**
+	* Caller-minted id that makes this generation CANCELLABLE.
+	*
+	* Without it a caller that stops waiting cannot stop the work: the gates race
+	* the call against 8 s and free their own slot when the timer wins, while the
+	* generation upstream keeps running to `profile.timeoutMs` — 60 s by default,
+	* on a single-threaded local model. The per-camera bound then counts WAITS,
+	* not generations, and the real load is unbounded.
+	*
+	* `AbortSignal` cannot cross a process boundary; an id can. Pass one here and
+	* `llm.cancel({ requestId })` tears the socket down.
+	*/
+	requestId: string().optional()
 });
 /**
 * `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
@@ -12754,8 +12813,49 @@ var ManagedRuntimeConfigSchema = object({
 	gpuLayers: number().int().default(0),
 	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
 	threads: number().int().optional(),
-	/** Concurrent slots. */
+	/** Concurrent slots (`--parallel`). */
 	parallel: number().int().default(1),
+	/** Logical batch size (`-b`). Larger = faster prompt ingest, more RAM. */
+	batchSize: number().int().positive().optional(),
+	/** Physical batch / micro-batch (`-ub`). */
+	ubatchSize: number().int().positive().optional(),
+	/**
+	* `--flash-attn`. Cuts KV-cache memory on the backends that implement it and
+	* is a no-op elsewhere, so it is offered rather than assumed.
+	*/
+	flashAttention: boolean().default(false),
+	/**
+	* `--mlock`. Pins the weights in RAM so the OS cannot page them out mid
+	* inference. Costs the full model size in resident memory — which is exactly
+	* what the RAM budget is counting.
+	*/
+	mlock: boolean().default(false),
+	/**
+	* `--no-mmap`. Reads the whole GGUF up front instead of mapping it. Slower to
+	* start, but avoids the page-fault stalls a network or spinning-disk model
+	* store produces on every first token.
+	*/
+	noMmap: boolean().default(false),
+	/** `--cache-type-k` / `--cache-type-v` — quantising the KV cache is the
+	*  cheapest way to fit a longer context in the same RAM. */
+	cacheTypeK: _enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
+	cacheTypeV: _enum([
+		"f32",
+		"f16",
+		"q8_0",
+		"q5_1",
+		"q5_0",
+		"q4_1",
+		"q4_0"
+	]).optional(),
 	/** Else lazy: first generate boots it. */
 	autoStart: boolean().default(false),
 	/** 0 = never; frees RAM after quiet periods. */
@@ -12843,10 +12943,44 @@ var LlmProfileSchema = object({
 	baseUrl: string().optional(),
 	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
 	apiKey: string().optional(),
+	/** Vision on/off. A vision call against a `false` profile is REFUSED, never
+	*  degraded to text — that shipped once and produced a confident answer to a
+	*  question about a picture nobody sent. */
 	supportsVision: boolean(),
 	temperature: number().min(0).max(2).optional(),
+	/** Nucleus sampling. Every wire we speak has it. */
+	topP: number().min(0).max(1).optional(),
+	/** Top-k sampling. Carried only by the wires that have it — NEITHER OpenAI
+	*  wire does, and the client drops it there (measured: the request body gets
+	*  `top_p` and no `top_k`). The profile editor hides the field wherever it
+	*  would change nothing; `KINDS_WITH_TOP_K` is the single owner of that list. */
+	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
+	/** Prompt context window. Advisory for cloud kinds (they enforce their own);
+	*  for `managed-local` it is the llama.cpp `--ctx-size` the runtime starts
+	*  the model with, so it is the one field that changes a PROCESS. */
+	contextLength: number().int().positive().optional(),
+	/** Default system prompt. A caller's `system` REPLACES it (never appends —
+	*  two system prompts fighting is worse than either alone). */
+	systemPrompt: string().optional(),
+	/** Total generation bound — the only one a unary call has. */
 	timeoutMs: number().int().positive().default(6e4),
+	/** Wait for response headers only. */
+	connectTimeoutMs: number().int().positive().default(1e4),
+	/** Accepted, but no output yet — a cold GPU load lives here. */
+	firstTokenTimeoutMs: number().int().positive().default(12e4),
+	/** Output started then stopped. */
+	idleTimeoutMs: number().int().positive().default(6e4),
+	/** Profile-level default. The per-consumer table and a per-call override
+	*  both beat it — see `resolveRetryPolicy`. */
+	retry: LlmRetryPolicySchema.default({
+		enabled: false,
+		maxAttempts: 1
+	}),
+	/** Whether this profile may use tools. The tool-call plumbing rides the
+	*  library; the REGISTRY of callable tools is ours and is empty in v1, so a
+	*  `true` here buys the wiring, not behaviour, until tools are registered. */
+	toolsEnabled: boolean().default(false),
 	extraHeaders: record(string(), string()).optional(),
 	/** kind === 'managed-local' only (spec §4). */
 	runtime: ManagedRuntimeConfigSchema.optional()
@@ -12908,7 +13042,10 @@ var ProfileRefInputSchema = object({
 	addonId: string(),
 	profileId: string()
 });
-method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
+method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({
+	addonId: string().optional(),
+	requestId: string()
+}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(ProfileRefInputSchema, _void(), {
@@ -14590,6 +14727,8 @@ var NcSystemEventKindSchema = _enum([
 	"stream-offline",
 	"node-online",
 	"node-offline",
+	"node-inference-unavailable",
+	"detection-blind",
 	"addon-update-available",
 	"server-update-available",
 	"alarm-triggered",
@@ -14651,7 +14790,16 @@ var NcScheduleSchema = object({
 });
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
-	values: array(string().min(1)).min(1),
+	/**
+	* Plate texts (or gallery vehicle names) to match. EMPTY = **any plate the
+	* pipeline could read** — the plate half of "no selection = no narrowing",
+	* and the switch that says this rule is about vehicles that were IDENTIFIED
+	* rather than merely seen. A subject carrying no plate still fails.
+	*
+	* The `.min(1)` this used to carry made that state unauthorable; nothing has
+	* ever persisted an empty list, so widening it cannot change an existing rule.
+	*/
+	values: array(string().min(1)),
 	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
 	maxDistance: number().int().min(0).max(3).default(1)
 });
@@ -14685,28 +14833,36 @@ var NcOccupancyConditionSchema = object({
 /**
 * Audio condition (IMMEDIATE trigger) — a rule on SOUND, not on a picture.
 *
-* Operator-approved vocabulary (2026-08-12, option A — the same one the
-* reference notifier uses, so an operator moving between them re-uses what
-* they already know): a rule matches when, over a sampling window of
-* `samplingSeconds`, at least `hitPercent`% of the audio samples in that
-* window are HITS. A sample is a hit when it satisfies BOTH present filters:
-*
-*  - `dbThreshold` — its level is at or above this many dBFS (see
-*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale);
-*  - `labels` — the classifier put at least one of these labels on it.
-*
-* Both are OPTIONAL and independent, which is the point of the shape: a
-* loudness rule ("something loud at 3am") needs no model to be right, and a
-* label rule ("a dog barked") needs no threshold. **Fail-closed when NEITHER
-* is given** — a window in which every sample is trivially a hit would fire on
-* silence, so the engine refuses such a condition rather than notifying on
-* nothing (the schema cannot express "at least one of" without becoming a
-* ZodEffects the cap path would have to special-case).
-*
-* `hitPercent` is over the samples the window actually HOLDS, and the window
-* must be FULL before it can match — a window that has been open for two
-* seconds of its ten is 100% of nothing, and firing on it would make
-* `samplingSeconds` decorative.
+* **TWO EXCLUSIVE MODES** (operator decision 2026-08-14, D157). Which one a
+* rule is in is not a stored field — it is WHICH FILTER the rule carries, so
+* there is no second switch that can disagree with the first and every rule
+* authored before the decision migrates for free (`audioModeOf`):
+*
+*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
+*    classifier labels with one of them. No window, no percentage:
+*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
+*    `throttle` cooldown is the only brake. The per-label confidence floor is
+*    the analyzer's (`classificationMinScore`, per device) — a label only
+*    reaches this condition if the classifier was already confident enough.
+*  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
+*    the condition: at least `hitPercent`% of the samples over
+*    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
+*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale). The window
+*    must be FULL before it can match — a window open for two of its ten
+*    seconds is 100% of nothing.
+*
+* **Why label mode has no window.** It had one, and it never fired: the
+* analyzer emits ~1 audio frame per second but YAMNet only LABELS one to three
+* of them per episode, even through continuous crying. The measured maximum
+* `hitPercent` over the whole live history was 40 — under the shipped default
+* of 60, so a label rule could not fire at all, ever. A percentage of frames is
+* the wrong question to ask of a sparse classifier.
+*
+* **Fail-closed when NEITHER is given** — every sample would be a trivial hit
+* and the rule would fire on silence. The schema cannot express "exactly one
+* of" without becoming a ZodEffects the cap path would have to special-case, so
+* the exclusivity is enforced where every editor writes (`patchAudio`) and a
+* legacy rule carrying both resolves to LABEL (the mode that fires).
 *
 * Labels are the audio macro classes (`AUDIO_MACRO_LABELS` / the NC taxonomy's
 * `audio-*` ids). Both spellings are accepted — the matcher normalizes the
@@ -14714,13 +14870,13 @@ var NcOccupancyConditionSchema = object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = object({
-	/** Audio macro labels; absent = any sound (level-only rule). */
+	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
 	labels: array(string().min(1)).min(1).optional(),
-	/** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: number().min(-96).max(0).optional(),
-	/** Percentage of the window's samples that must be hits (1–100). */
+	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: number().int().min(1).max(100).default(60),
-	/** Length of the sampling window in seconds. */
+	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
 	samplingSeconds: number().int().min(1).max(300).default(10)
 });
 /**
@@ -14890,18 +15046,47 @@ var NcConditionsSchema = object({
 	*/
 	labelEquals: array(string().min(1)).optional(),
 	/**
-	* Identity matcher. P1 boundary: matched against the record's collapsed
-	* `label` (the identity display name propagated by the face pipeline) —
-	* identity-ID matching rides in P2 when identity ids reach the record.
+	* KNOWN FACES — the rule's identity scope, and the switch that says the rule
+	* is about recognised people at all.
+	*
+	* Three states, and the empty one is the point:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the rule does not care who it is; an unrecognised person matches |
+	* | `[]` | **only known faces** — any identity in the gallery, nobody in particular |
+	* | a list | only these identities |
+	*
+	* `[]` is the repo-wide "no selection = no narrowing" reading (an absent
+	* `devices` list is every device), applied one level down: the operator has
+	* turned the face scope ON and narrowed it to nothing, which is every known
+	* face. No second field states the same thing — a switch that can disagree
+	* with the list under it is worse than no switch (D62).
+	*
+	* MEMBERS ARE FACE-GALLERY `Identity.id`s (uuid), not display names. A name is
+	* renameable, and a rule authored on "Gianluca" went silently dark the moment
+	* the operator fixed the spelling. The id reaches the record on
+	* `LabelAttribution.identityId`; the name is what the editor shows and what
+	* `{{label}}` renders.
+	*
+	* Rules written before this carry NAMES, and are resolved to ids lazily at
+	* load (`NcRuleStore.load`) against the live gallery — a name nothing answers
+	* for is left as it stands and reported, never dropped. The engine also
+	* accepts a display-name hit as a compatibility leg, so a rule whose
+	* migration could not resolve keeps matching exactly what it matched before.
 	*/
 	identities: array(string().min(1)).optional(),
-	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	/**
+	* KNOWN PLATES / VEHICLES — the plate mirror of {@link identities}, including
+	* the empty-list reading: `values: []` is "any plate the OCR could read",
+	* a non-empty list is those plates (fuzzily). See {@link NcPlateMatcherSchema}.
+	*/
 	plates: NcPlateMatcherSchema.optional(),
 	/**
-	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
-	* Same P1 boundary: matched against the record's collapsed `label` (the
-	* identity display name). A record with NO label passes (nothing to
-	* exclude), unlike the include variant which fails on an absent label.
+	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics, and
+	* the same id members and the same lazy name→id migration. A record with NO
+	* identity passes (nothing to exclude), unlike the include variant which
+	* fails on an unrecognised subject. An EMPTY list excludes nobody.
 	*/
 	identitiesExclude: array(string().min(1)).optional(),
 	/**
@@ -15293,7 +15478,80 @@ var NcRuleInputSchema = object({
 	* a rule that predates the gate must keep delivering byte-for-byte as it
 	* did, and absent is the only way to say that without a migration.
 	*/
-	confirm: NcConfirmSchema.optional()
+	confirm: NcConfirmSchema.optional(),
+	/**
+	* WAIT for face/plate recognition before saying anything.
+	*
+	* A notification's TEXT is frozen at enqueue and its media is re-resolved at
+	* send; the identity is neither. A face is confirmed after `confirmFrames`
+	* agreeing observations — p50 **11.4 s** after the track was first seen,
+	* measured on this hub — and an `immediate` rule enqueues on the first object
+	* event, seconds before that. So "Gianluca è arrivato" is unsayable on the
+	* immediate path, and no amount of media re-resolution fixes a sentence.
+	*
+	* Only two honest answers exist, and this flag picks between them. It has
+	* effect ONLY on a rule that declares a recognition scope
+	* ({@link NcConditions.identities} or {@link NcConditions.plates}) — on any
+	* other rule there is nothing to wait for and the flag is inert.
+	*
+	* | value | what happens |
+	* | --- | --- |
+	* | `true` | the rule stops firing on the object event and fires at TRACK CLOSE instead, once, with the name — later, and complete |
+	* | absent / `false` | it fires at once WITHOUT the name, and if recognition lands before the track closes a SECOND, "…is Gianluca" notification follows (one per track, per rule, per target) |
+	*
+	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
+	* on the addon cap path, and absent has to keep meaning exactly what every
+	* rule authored before this field meant.
+	*
+	* The cost of `true` is stated here because the editor states it too: a rule
+	* that waits also inherits track-close SEMANTICS — its `zones` condition
+	* tests every zone the track visited and a `crossing` condition can no longer
+	* be satisfied, because a closed track carries no crossing.
+	*/
+	waitForEnhancement: boolean().optional(),
+	/**
+	* GROUP a burst of subjects into ONE notification that grows.
+	*
+	* Seconds of quiet after the last matching subject before the burst is
+	* considered over. While it is open, the first subject enqueues immediately —
+	* **exactly as today, with no added latency** — and every real growth (a new
+	* subject, or a name confirmed on one already in it) REPLACES that
+	* notification with an updated one naming everybody. The push carries the
+	* group's own coalescing tag, so the phone replaces rather than stacks.
+	*
+	* `0` / absent = off, and off is today's behaviour byte for byte.
+	*
+	* ### Why an idle cutoff and not a window
+	*
+	* The measured seven-person arrival on device 590 spans 110 s with every
+	* internal gap under 30 s. A 12 s fixed window cuts it into three groups; an
+	* idle cutoff holds it as one and ends it when the arrival actually ends.
+	* 30 is Frigate's shipped value for the same decision.
+	*
+	* ### What it replaces
+	*
+	* The blind cooldown, which collapses a burst by DISCARDING it. Measured on
+	* device 615 / *Persona su Uscio* over six days: 116 qualifying tracks → 74
+	* notifications, **44 (37.9%) suppressed outright**, 23 of them overlapping a
+	* track that did fire and 7 carrying a confirmed identity nobody heard about.
+	* A group collapses the same volume by MERGING, so the cooldown becomes a
+	* budget over GROUPS — which is what it always meant — and a growth is never
+	* throttled by the window its own first member spent.
+	*
+	* ### Interaction with {@link waitForEnhancement}
+	*
+	* They compose, and the order matters. `waitForEnhancement` defers the rule to
+	* TRACK CLOSE, so with both set the group is opened by the first member to
+	* CLOSE — already carrying its name — and grows as later members close. That
+	* is later, and complete. With grouping alone the group opens on the first
+	* object event and picks up names as they are confirmed, through the growth
+	* path. Neither combination fires twice for one subject.
+	*
+	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
+	* on the addon cap path, so absent must keep meaning what it meant before this
+	* field existed.
+	*/
+	groupIdleSec: number().int().min(0).max(600).optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -16225,7 +16483,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace, hasRider) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -16361,7 +16619,21 @@ union([literal(1), literal(2)]);
 var LabelAttributionSchema = object({
 	stepId: string(),
 	modelId: string().optional(),
-	decidedAt: number()
+	decidedAt: number(),
+	/**
+	* The GALLERY id behind a recognised tier-2 label — a face-gallery
+	* `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
+	*
+	* The text alone is a DISPLAY NAME, and a display name is renameable: a
+	* notification rule authored on "Gianluca" stopped matching the moment the
+	* operator fixed the spelling in the gallery, and nothing said so. The id is
+	* the thing that does not move, so it is what a rule matches on
+	* (`NcConditions.identities`) and the text is what a human is shown.
+	*
+	* Absent when the label names no gallery row — a plate the OCR read but no
+	* vehicle claims, a sub-class, a species, any tier-1 value.
+	*/
+	identityId: string().optional()
 });
 /**
 * The TIERED label model (roadmap 4g), spread into `TrackSchema` and
@@ -16498,6 +16770,28 @@ var TrackSchema = object({
 	* `=== true` and render nothing otherwise, never infer "no face".
 	*/
 	hasFace: boolean().optional(),
+	/**
+	* This subject CONTAINS a folded rider — a person the rider-pairing step
+	* ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
+	* so the passage is tracked once and as a VEHICLE.
+	*
+	* It exists because the fold's record was dishonest. D34 and the code both
+	* said "the person is not lost — it is reported so both entities stay on the
+	* record"; in fact the pair went into a per-processor RAM field behind an
+	* accessor nobody called, and every durable surface said `vehicle`, full
+	* stop. This is the composition note that makes the row true.
+	*
+	* A COMPOSITION, never a class and never a label. "This vehicle contains a
+	* person" is not an answer to "what is this" — both label tiers would refuse
+	* a macro token anyway (D89), and correctly. Nothing here changes what the
+	* subject IS: a cyclist stays one vehicle track, occupancy still counts one,
+	* and a `person` rule still does not fire for someone cycling past.
+	*
+	* **Absent ≠ false**, exactly like {@link hasFace}: every row written before
+	* the column, and every hub that predates the field, omits it. Test
+	* `=== true` and render nothing otherwise — never infer "no rider".
+	*/
+	hasRider: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -26361,14 +26655,50 @@ method(object({
 * thing except the comparator: `similarity` (CLIP cosine at the same ROI coords
 * vs condition-tagged references) and `llm` (vision-LLM judgment over the crop).
 *
-* D14 device-config archetype (`deviceConfig.ui.kind:'widget'`) — the framework
-* derives the device-detail contribution; the provider carries NO hand-written
-* settings-contribution methods. `status.kind:'push'` — the engine pushes on
-* every hysteresis flip / availability change; consumers never poll.
-*/
-/** Extensible condition tag. Seeded 'day' | 'night'; open by design so more can
-*  be added without a wire break (matching falls back to any-condition refs). */
+* **No `deviceConfig`, deliberately.** This shipped as the D14 widget archetype,
+* which put a "Scenes" tab on one camera's detail page. That is the wrong shape
+* for the thing: a scene is a standing question about the property ("is the bin
+* still out"), and the operator's question is "which of my scenes have tripped",
+* across every camera at once — not "what does camera 617 think". Buried one
+* camera deep it also could not be found. The surface is now a top-level admin
+* page (`/scenes`, `pages/Scenes.tsx`) that lists every scene on every camera and
+* picks the camera inside the create flow, the same shape Events and Faces have.
+*
+* The consequence to keep in mind: `host/scene-monitor-editor` is gone from
+* `HOST_WIDGETS` too. `scripts/check-host-widget-resolves.ts` asserts BOTH
+* directions, so a registration nobody declares fails exactly as loudly as a
+* declaration nobody registers. The editor is imported directly by the page.
+*
+* `status.kind:'push'` — the engine pushes on every hysteresis flip /
+* availability change; consumers never poll.
+*/
+/** Extensible condition tag. Seeded 'day' | 'ir' (the two variants the operator
+*  captures) plus 'night' | 'dawn' | 'dusk' from the resolver's sun-times band.
+*  Open by design so more can be added without a wire break.
+*
+*  Matching does NOT fall back across conditions: cross-condition cosines are
+*  not comparable, so "I have never seen this scene in this light" is reported
+*  as `unknown`, never guessed. A day reference scored against an IR frame
+*  collapses the cosine and would latch a false alarm every single night. */
 var SceneConditionSchema = string();
+/** `matched` = the baseline is what we see; `diverged` = it demonstrably is not;
+*  `unknown` = we cannot judge (no reference for this condition, encoder model
+*  changed, view shifted, no snapshot). `unknown` is a real value, not a null,
+*  and never counts toward hysteresis in either direction. */
+var SceneVerdictSchema = _enum([
+	"matched",
+	"diverged",
+	"unknown"
+]);
+/** Why a scene cannot judge. Named, because this feature's failure mode is
+*  silence that reads as "nothing has happened". */
+var SceneUnavailableSchema = _enum([
+	"no-reference-for-condition",
+	"view-shifted",
+	"no-vision-profile",
+	"encoder-model-changed",
+	"no-snapshot"
+]);
 /** One captured reference — condition-tagged, model-version-gated. `embedding`
 *  is `number[]` (Float32Array does NOT survive MsgPack/UDS). */
 var SceneReferenceSchema = object({
@@ -26376,7 +26706,14 @@ var SceneReferenceSchema = object({
 	modelId: string(),
 	condition: SceneConditionSchema,
 	capturedAt: number(),
-	thumbnailMediaId: string().optional()
+	thumbnailMediaId: string().optional(),
+	/** Whole-frame (downscaled) embedding captured alongside the ROI crop. The
+	*  anti-view-shift anchor: a bumped camera, a PTZ preset or a re-aim makes the
+	*  normalized rect frame a different piece of world, and the scene would
+	*  diverge forever with a perfectly plausible cosine. Checked LAZILY, only
+	*  when hysteresis is about to flip — one extra encode per candidate
+	*  transition, not per poll. */
+	anchorEmbedding: array(number()).optional()
 });
 var SceneMonitorStateSchema = object({
 	id: string(),
@@ -26398,6 +26735,25 @@ var SceneCheckSchema = discriminatedUnion("mode", [object({
 	profileId: string().optional(),
 	hysteresisCount: number().int().positive()
 })]);
+var SCENE_DEFAULT_ANCHOR_THRESHOLD = .85;
+/**
+* Vision-model adjudication of a candidate flip. Field names deliberately
+* mirror `NcConfirmSchema` so an operator meets one vocabulary, not two.
+*
+* `onTimeout` defaults to **'hold'**, the OPPOSITE of `NcConfirmGate`'s
+* fail-open: a notification suppressed is the worse error there, but a vision
+* model that timed out has not told us the bin is gone, and a latch is a
+* stateful claim that costs the operator a trip to reset.
+*/
+var SceneConfirmSchema = object({
+	enabled: boolean().default(false),
+	prompt: string().min(1).max(1e3),
+	profileId: string().optional(),
+	timeoutMs: number().int().min(1e3).max(2e4).default(8e3),
+	maxImagePx: number().int().min(64).max(2048).default(448),
+	/** What a timeout / unavailable model means for the PENDING flip. */
+	onTimeout: _enum(["flip", "hold"]).default("hold")
+});
 var SceneMonitorSchema = object({
 	id: string(),
 	label: string(),
@@ -26416,7 +26772,41 @@ var SceneMonitorSchema = object({
 	lastConfidence: number().nullable(),
 	currentCondition: SceneConditionSchema.nullable(),
 	availability: _enum(["ok", "unavailable"]),
-	unavailableReason: string().nullable()
+	unavailableReason: string().nullable(),
+	/** Which state is "the initial screen". `null` until the first capture. */
+	baselineStateId: string().nullable(),
+	/** Which boolean drives notification rules and any export. */
+	emit: _enum(["latched", "live"]).default("latched"),
+	/** Live: does the region match the baseline RIGHT NOW. */
+	verdict: SceneVerdictSchema,
+	/** Has it been `diverged` at least once since `armedAt` — the operator's boolean. */
+	latched: boolean(),
+	/** Last reset (or creation). */
+	armedAt: number(),
+	divergedAt: number().nullable(),
+	restoredAt: number().nullable(),
+	/** A check is only COUNTED when the device has been quiet this long. Motion
+	*  during the window DISCARDS the observation — a car pulling up in front of
+	*  the bin must not be able to spend hysteresis credit. */
+	quietSeconds: number().int().min(0).max(3600).default(60),
+	/** An observation only advances the pending count when it is at least this
+	*  far from the previously counted one, so N agreeing checks span real time
+	*  rather than N adjacent polls inside one occlusion. */
+	minObservationSpacingSec: number().int().min(0).max(3600).default(120),
+	/** Vision-model adjudication of a candidate flip. Similarity primary only. */
+	confirm: SceneConfirmSchema.optional(),
+	/** Whole-frame anchor cosine below which a flip is REFUSED as `view-shifted`. */
+	anchorThreshold: number().min(0).max(1).default(SCENE_DEFAULT_ANCHOR_THRESHOLD),
+	/** Clear the latch on its own when the scene matches again? Default false —
+	*  `restoredAt` and the `scene-restored` edge are recorded regardless, so an
+	*  automation can react to the bin coming back without the operator's own
+	*  alarm silently clearing itself. */
+	autoRestore: boolean().default(false),
+	/** Named cause when `verdict === 'unknown'`. */
+	unavailable: SceneUnavailableSchema.nullable(),
+	/** Conditions that have at least one comparable reference — the coverage line
+	*  ("day ✓ · ir ✓ · dusk ✗") that turns a silent fallback into a visible fact. */
+	coveredConditions: array(SceneConditionSchema)
 });
 var SceneMonitorStatusSchema = object({
 	monitors: array(SceneMonitorSchema),
@@ -26429,12 +26819,6 @@ var sceneMonitorCapability = {
 	kind: "wrapper",
 	defaultActive: true,
 	deviceTypes: [DeviceType.Camera],
-	deviceConfig: { ui: {
-		kind: "widget",
-		widgetId: "host/scene-monitor-editor",
-		tab: "scenes",
-		label: "Scenes"
-	} },
 	methods: {
 		listScenes: method(object({ deviceId: number() }), SceneMonitorStatusSchema),
 		createScene: method(object({
@@ -26465,7 +26849,14 @@ var sceneMonitorCapability = {
 					"both"
 				]).optional(),
 				checkIntervalSec: number().optional(),
-				check: SceneCheckSchema.optional()
+				check: SceneCheckSchema.optional(),
+				emit: _enum(["latched", "live"]).optional(),
+				quietSeconds: number().int().min(0).max(3600).optional(),
+				minObservationSpacingSec: number().int().min(0).max(3600).optional(),
+				anchorThreshold: number().min(0).max(1).optional(),
+				autoRestore: boolean().optional(),
+				/** `null` clears the vision-model adjudicator. */
+				confirm: SceneConfirmSchema.nullable().optional()
 			})
 		}), _void(), {
 			kind: "mutation",
@@ -26506,6 +26897,26 @@ var sceneMonitorCapability = {
 		}), _void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Clear the latch, re-arm, and — by default — RE-CAPTURE the baseline for
+		* the CURRENT condition. The bin never goes back in exactly the same spot;
+		* "reset" in the operator's head means *this is the new normal*, and
+		* re-capture is what makes the feature self-healing against slow drift
+		* instead of failing silently weeks later.
+		*
+		* Reachable from three surfaces on this one mutation: the scene card, a
+		* notification button (an `onTrigger` sequence with a `kind:'cap'` step —
+		* no new Notification-Center code at all), and tRPC for scripts.
+		*/
+		resetScene: method(object({
+			deviceId: number(),
+			monitorId: string(),
+			/** Defaults to TRUE at the provider seam — see `SCENE_RESET_RECAPTURES`. */
+			recapture: boolean().optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	status: {
@@ -26996,12 +27407,64 @@ var NetworkAddressSchema = object({
 	family: string(),
 	internal: boolean()
 });
+/**
+* Provenance of the site coordinates, and the whole reason this is not just two
+* numbers.
+*
+*   - `operator-set` — a human typed it, or accepted a detection. Authoritative;
+*     nothing overwrites it.
+*   - `derived-from-ip` — the hub geolocated its own public IP once, because a
+*     default that is right to a few kilometres beats the coarse UTC clock split
+*     the sun-times consumers otherwise fall back to.
+*
+* The UI shows which one it is. An operator who cannot tell a guess from their
+* own input will eventually trust the guess.
+*/
+var SiteLocationSourceSchema = _enum(["operator-set", "derived-from-ip"]);
+/**
+* The read shape: the location plus the honest state of the one-shot derivation.
+*
+* `derivationAttemptedAt` is what makes the "one call, ever" contract
+* inspectable. When it is set and `location` is null, the geo-IP lookup ran and
+* failed; the hub will NOT try again on its own — the fallback is declared
+* (consumers degrade to their own last resort) and the operator either types the
+* coordinates or presses detect.
+*/
+var SiteLocationStatusSchema = object({
+	location: object({
+		/** WGS84 decimal degrees. */
+		latitude: number().min(-90).max(90),
+		longitude: number().min(-180).max(180),
+		source: SiteLocationSourceSchema,
+		/** Epoch ms the value was last written. */
+		updatedAt: number(),
+		/**
+		* Human-readable place the geo-IP service reported ("Napoli, IT"). Display
+		* only — never parsed, never matched on. Absent for an operator-typed value.
+		*/
+		label: string().optional()
+	}).nullable(),
+	derivationAttemptedAt: number().nullable(),
+	/** Why the last derivation failed, for the UI to show instead of a shrug. */
+	derivationError: string().nullable()
+});
+/** `null` clears the location and re-arms nothing — the derivation stays spent. */
+var SetSiteLocationInputSchema = object({
+	latitude: number().min(-90).max(90),
+	longitude: number().min(-180).max(180)
+}).nullable();
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), SiteLocationStatusSchema), method(SetSiteLocationInputSchema, SiteLocationStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), SiteLocationStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * Tamper / case-open detection sensor. Drives Home Assistant
@@ -31137,6 +31600,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"llm.cancel": {
+		capName: "llm",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llm.deleteModel": {
 		capName: "llm",
 		capScope: "system",
@@ -33387,6 +33856,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"sceneMonitor.resetScene": {
+		capName: "scene-monitor",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"sceneMonitor.updateScene": {
 		capName: "scene-monitor",
 		capScope: "device",
@@ -34065,6 +34540,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.detectSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.featureFlags": {
 		capName: "system",
 		capScope: "system",
@@ -34083,6 +34564,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.getSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.health": {
 		capName: "system",
 		capScope: "system",
@@ -34107,6 +34594,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.setSiteLocation": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.adoptLegacyMonitor": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -36069,6 +36562,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"sceneMonitor.resetScene": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"sceneMonitor.updateScene": [{
 		name: "deviceId",
 		form: "single",