@camstack/addon-provider-homeassistant 1.2.41 → 1.2.43

package/dist/{dist-D1G6jUej.mjs → dist-Dbn3F-bB.mjs}

@@ -6581,6 +6581,65 @@ var ProfileRtspEntrySchema = object({
 	resolution: CamStreamResolutionSchema.optional()
 });
 /**
+* Per-call node pinning for `ctx.api` capability calls.
+*
+* A capability call normally resolves to its DEFAULT provider — a `singleton`
+* cap resolves to the hub, a device-scoped cap to the device's owning node. To
+* query a SPECIFIC node's provider instead (e.g. a remote agent's own
+* in-process `platform-probe` hardware, which the hub cannot probe), pin the
+* call to that node.
+*
+* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
+* method args), so capability method signatures stay `nodeId`-free — node
+* targeting is a property of the CALL, not of the method. The transport lifts
+* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
+* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
+* which classifies a pinned agent node as `agent-child-forward`
+* (`$agent-cap-fwd.forward` → the agent's in-process provider).
+*
+* Usage at a call site:
+*
+*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
+*/
+/** tRPC `op.context` key carrying a per-call node pin. */
+var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
+/**
+* Build the tRPC request options that pin a single capability call to `nodeId`.
+* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
+*/
+function nodePin(nodeId) {
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
+}
+/**
 * Output schema shared by the contribution + live methods.
 *
 * Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
@@ -6629,7 +6688,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -6653,7 +6712,7 @@ function event(data) {
 }
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
-method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
+method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -6974,7 +7033,7 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 }({});
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
-method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
+method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
 /**
 * device-ops — device-scoped cap that unifies the per-IDevice operations
 * previously routed through the `.device-ops` Moleculer bridge service.
@@ -7522,6 +7581,32 @@ var CameraSwitchIdSchema = _enum([
 	"notifications"
 ]);
 /**
+* Stable render order — broadest blast radius first, and a source before the
+* thing that consumes it. `device-audio` sits ABOVE `audio-analysis` because
+* turning the microphone off leaves the analyzer with nothing to analyse; the
+* reverse is not true.
+*
+* `privacy-mask` sits directly ABOVE `device-audio` because they are literal
+* siblings — one cap, one device plane, video then audio — and NOT above
+* `object-detection` despite feeding it: a mask blanks REGIONS, so its blast
+* radius is partial, and the "broadest first" rule does not rank a partial
+* control above a whole-function one.
+*
+* `broker-audio` sits directly BELOW `device-audio` by the same source-first
+* rule: the camera's microphone feeds the broker, so silencing the camera
+* leaves the broker's mute with nothing to suppress; the reverse is not true.
+*/
+var CAMERA_SWITCH_ORDER = [
+	"stream-broker",
+	"object-detection",
+	"privacy-mask",
+	"device-audio",
+	"broker-audio",
+	"audio-analysis",
+	"recording",
+	"notifications"
+];
+/**
 * WHERE the switch's state actually lives. A discriminated union rather than a
 * string so both the writer (the orchestrator's `setCameraSwitch`) and any
 * reader can exhaustively narrow — and so "the group added a parallel map" is
@@ -7719,24 +7804,6 @@ var RecordingRetentionSchema = object({
 	maxSizeGb: number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = _enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -7744,7 +7811,11 @@ var ScrubThumbnailPresetSchema = _enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -7767,14 +7838,7 @@ var RecordingConfigSchema = object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -7850,10 +7914,11 @@ var RelocateFootageInputSchema = object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
-var StorageMigrationMediaMoveInputSchema = object({
+var RelocateMediaInputSchema = object({
 	toLocationId: string(),
 	throttleMbps: number().min(1).max(1e3).optional()
-}).extend({ leaseId: string().min(1) });
+});
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes. `recordings`
 * encompasses the high and mid segment profiles; `recordingsLow` is low
 * segments; `eventMedia` is post-analysis blobs. */
@@ -8148,7 +8213,26 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
-var ClassMapDefinitionSchema = object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = object({
 	mapping: record(string(), _enum([
 		"person",
 		"vehicle",
@@ -8353,7 +8437,7 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8383,7 +8467,7 @@ var ModelConvertMetadataSchema = object({
 		"segmentation"
 	]),
 	faceAlignment: boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -9246,7 +9330,7 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-method(_void(), array(AddonPageDeclarationSchema).readonly());
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -9500,7 +9584,7 @@ var WidgetMetadataSchema = object({
 	defaultColumns: number().int().min(1).max(12).default(6),
 	defaultRows: number().int().min(1).max(12).default(1)
 });
-method(_void(), array(WidgetMetadataSchema).readonly());
+method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" });
 /**
 * `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
 * surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
@@ -11173,7 +11257,7 @@ var CustomModelDescriptorSchema = object({
 	stepId: string(),
 	entry: ModelCatalogEntrySchema
 });
-method(_void(), array(CustomModelDescriptorSchema).readonly());
+method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" });
 /**
 * Query filter for settings-store collections.
 */
@@ -11260,7 +11344,8 @@ method(object({
 }), _void(), { kind: "mutation" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
-	filter: QueryFilterSchema.optional()
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
 }), array(SettingsRecordSchema).readonly()), method(object({
 	namespace: string().optional(),
 	collection: string(),
@@ -11323,46 +11408,87 @@ var EngineInfoSchema = object({
 	kind: _enum(["relational", "vector"]),
 	displayName: string()
 });
-method(_void(), EngineInfoSchema), method(object({
+method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+	filter: QueryFilterSchema.optional(),
+	/**
+	* SQL-level column projection — MUST mirror `settings-store.query`.
+	*
+	* ⚠ An earlier version of this comment blamed Zod stripping, and that
+	* was wrong — corrected 2026-08-26 after the hop map
+	* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+	* There is **no Zod parse at all** between the door and the engine: the
+	* dispatcher forwards the payload verbatim and UDS carries it whole. A
+	* field declared here reaches `SqliteSettingsBackend` either way.
+	*
+	* What actually lost `columns` was the THIRD declaration of this shape:
+	* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+	* interface the engine destructures from. The field existed on both
+	* schemas and the engine still never read it, because nothing checks a
+	* registered provider against `InferProvider<cap>` —
+	* `ProviderRegistration.provider` is typed `object`.
+	*
+	* It is declared here anyway, and must stay in step with
+	* `settings-store.query`: a caller reading only the cap definitions has
+	* to be able to see that this call carries a projection.
+	* `data-door-schema-parity.spec.ts` keeps the two aligned.
+	*/
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11372,15 +11498,18 @@ method(_void(), EngineInfoSchema), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * shm ring usage stats for a `frameSink: 'shm'` decoder session —
 * exposed via `decoder.getShmStats` so downstream consumers can
@@ -12757,7 +12886,7 @@ method(object({
 	crop: _instanceof(Uint8Array),
 	width: number(),
 	height: number()
-}), EmbeddingResultSchema), method(object({ text: string() }), EmbeddingResultSchema), method(_void(), EmbeddingInfoSchema);
+}), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
 /**
 * filesystem-browse — per-node capability for browsing the node's local
 * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
@@ -13050,19 +13179,22 @@ method(LlmGenerateBaseInputSchema.extend({
 	runtime: ManagedRuntimeConfigSchema,
 	/** The managed profile's timeout, threaded by the hub provider. */
 	timeoutMs: number().int().positive().optional()
-}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
+}), LlmGenerateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
+}), method(object({}), LlmRuntimeStatusSchema, { auth: "admin" }), method(object({ model: ManagedModelRefSchema }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ file: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
+}), method(object({}), array(LlmNodeModelSchema), { auth: "admin" }), method(object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" });
 /**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
@@ -16592,1749 +16724,2009 @@ var oauthIntegrationCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — `getDescriptor` was reachable on the AppRouter
+	* by ANY authenticated session at the default `auth: 'protected'`. The
+	* real caller is `/api/oauth2/authorize` and `/api/oauth2/integrations`
+	* (`oauth2-routes.ts`), which resolve the provider directly off the
+	* capability registry — never through tRPC. `auth: 'admin'` closes the
+	* tRPC surface without touching that path.
+	*/
+getDescriptor: method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 /**
-* pipeline-analytics — device-scoped wrapper cap. Refines raw
-* per-frame detections emitted by the pipeline runner into tracked
-* objects, per-kind event collections (motion / object / audio), and
-* persisted media. Owns the post-detection domain end-to-end:
-*
-*   runner emits PipelineInferenceResult
-*     ↓ (event bus)
-*   pipeline-analytics subscriber
-*     ↓ SORT tracker + zone engine + state analyzer + event emitter
-*   → three DB collections (one per kind), one FS media tree, one
-*     unified event emitter (FrameTracked + TrackStarted/Ended +
-*     DetectionEvent on bus)
-*
-* Pure subscriber model. No `processFrame` cap method — the runner
-* already publishes the raw frame on the bus. The cap surface is
-* only QUERIES + per-device settings, bound on/off via
-* `device-manager.setWrapperActive`. `defaultActive: true` because
-* every camera with a detection pipeline wants its raw detections
-* refined; operators opt out per-device via BindingsTab when needed.
-*
-* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
-* (per-device surface) and `track-trail` caps — see P11 cleanup.
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
 */
-var TrackStateSchema = _enum([
-	"new",
-	"entered",
-	"left",
-	"moving",
-	"idle"
-]);
-var EventKindSchema = _enum([
-	"motion",
-	"object",
-	"audio"
-]);
+var NativeCropRefSchema = object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
+	})
+});
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
 /**
-* Spatial filter for `listTracks` — the rect + polygon variants of the shared
-* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
-* of the camera frame (top-left origin), matching the drawing-plane editor.
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
 */
-var TrackZoneFilterSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
-/** Closed icon vocabulary so clients render a known glyph per kind. */
-var EventKindIconSchema = _enum([
-	"motion",
-	"audio",
-	"person",
-	"vehicle",
-	"animal",
-	"door",
-	"pir",
-	"smoke",
-	"water",
-	"button",
-	"package",
-	"generic"
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
+var ModelFormatSchema$1 = _enum([
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
 ]);
-var EventKindCategorySchema = _enum([
-	"motion",
-	"audio",
-	"detection",
-	"sensor",
-	"control",
-	"custom",
-	"package"
+var PipelineSlotSchema = _enum([
+	"detector",
+	"cropper",
+	"classifier",
+	"refiner",
+	"audio-classifier"
 ]);
-/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
-var EventKindLevelSchema = _enum(["macro", "sub"]);
-var EventKindDescriptorSchema = object({
-	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
-	kind: string(),
-	/** i18n key resolved on the UI side; `label` is the English fallback. */
-	labelKey: string(),
-	/** English fallback label (kept for clients that don't translate). */
-	label: string(),
-	/** Hex color for timeline/legend rendering. */
-	color: string(),
-	/** Dictionary id → lucide component on the UI side. */
-	iconId: string(),
-	/** Legacy closed-vocab glyph — fallback for `iconId`. */
-	icon: EventKindIconSchema,
-	category: EventKindCategorySchema,
-	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
-	parentKind: string().nullable(),
-	/** Derived from `parentKind`, explicit for the client tree. */
-	level: EventKindLevelSchema,
-	/** Which cap + device contributes this kind. For built-ins the camera
-	*  itself; for sensor kinds the LINKED source device. */
-	source: object({
-		capName: string(),
-		deviceId: number()
-	})
+var PipelineEngineChoiceSchema = object({
+	runtime: _enum(["node", "python"]),
+	backend: string(),
+	format: ModelFormatSchema$1,
+	device: string().optional()
 });
-/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
-var EventKindsForDeviceSchema = object({
-	deviceId: number(),
-	kinds: array(EventKindDescriptorSchema).readonly()
+var AvailableEngineSchema = object({
+	engine: PipelineEngineChoiceSchema,
+	devices: array(object({
+		id: string(),
+		label: string(),
+		description: string().optional()
+	})).readonly(),
+	defaultDevice: string()
 });
-var SensorEventSchema = object({
+var PipelineDefaultStepSchema = lazy(() => object({
+	addonId: string(),
+	addonName: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineDefaultStepSchema).readonly(),
+	group: string().optional(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateStepSchema = lazy(() => object({
+	addonId: string(),
+	enabled: boolean(),
+	modelId: string(),
+	children: array(PipelineTemplateStepSchema).readonly(),
+	settings: record(string(), unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = object({
 	id: string(),
-	/** The CAMERA the event is attributed to (a sensor linked to N cameras
-	*  yields N rows, one per camera). */
-	deviceId: number(),
-	/** The linked sensor device whose state changed. */
-	sourceDeviceId: number(),
-	/** Event kind id — matches an `EventKindDescriptor.kind`. */
-	kind: string(),
-	/** Snapshot of the sensor cap's runtime-state slice at the change. */
-	value: record(string(), unknown()).nullable(),
-	timestamp: number()
-});
-var TrackPositionSchema = object({
-	x: number(),
-	y: number(),
-	timestamp: number(),
-	bbox: BoundingBoxSchema
+	name: string(),
+	createdAt: string(),
+	updatedAt: string(),
+	engine: PipelineEngineChoiceSchema,
+	steps: array(PipelineTemplateStepSchema).readonly()
 });
-var TrackSnapshotSchema = object({
-	timestamp: number(),
-	position: TrackPositionSchema,
-	/** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-	mediaKey: string()
+var PipelineModelOptionSchema = object({
+	id: string(),
+	name: string(),
+	formats: record(string(), object({
+		downloaded: boolean(),
+		sizeMB: number()
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
 });
-/**
-* Normalized 0..1 trajectory envelope (min/max over every position bbox,
-* divided by the track's detection-frame dims), computed at persist time.
-* Absent when the frame dims were unknown when the track was persisted
-* (legacy rows / dims-less sources) and on active (in-RAM) tracks.
-*/
-var TrackEnvelopeSchema = object({
-	minX: number(),
-	minY: number(),
-	maxX: number(),
-	maxY: number()
+var ConfigFieldBridge = custom();
+var PipelineAddonSchemaSchema = object({
+	id: string(),
+	name: string(),
+	slot: PipelineSlotSchema,
+	inputClasses: array(string()).readonly(),
+	outputClasses: array(string()).readonly(),
+	childSlots: array(PipelineSlotSchema).readonly(),
+	models: array(PipelineModelOptionSchema).readonly(),
+	defaultModelId: string(),
+	defaultModelIdByFormat: record(string(), string()).optional(),
+	enabledByDefault: boolean().optional(),
+	backfillIntoExistingOverrides: boolean().optional(),
+	defaultConfidence: number(),
+	group: string().optional(),
+	configSchema: array(ConfigFieldBridge).readonly().optional()
 });
-/**
-* Row projection for track list queries. `full` (default) returns the
-* complete Track including the frame-rate `positions[]` history and the
-* `snapshots[]` references — megabytes across a page of tracks. `slim`
-* keeps every scalar the list surfaces actually render (ids, class(es),
-* label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope, hasFace, hasEmbeddedFace, hasRider) and returns `positions` /
-* `snapshots` as EMPTY arrays — detail views re-fetch the full row via
-* `getTrack`. Mirrors the event-store `projection` convention
-* (`getObjectEvents` et al.).
-*/
-var TrackProjectionSchema = _enum(["full", "slim"]);
-/**
-* One audio-classification label heard on the track's camera while the
-* track was alive, aggregated per label. An "episode" is one persisted
-* audio event (the confident-classification path: score ≥ the device's
-* `classificationMinScore`, class-change-or-heartbeat coalesced) — NOT
-* one 32 ms inference chunk, so counts stay human-scaled.
-*/
-var TrackAudioLabelSchema = object({
+var PipelineSlotSchemaSchema = object({
+	id: PipelineSlotSchema,
 	label: string(),
-	/** Highest classification score observed across the label's episodes. */
-	peakScore: number(),
-	/** Number of coalesced audio-event episodes carrying this label. */
-	count: number(),
-	firstAt: number(),
-	lastAt: number()
+	priority: number(),
+	parentSlot: PipelineSlotSchema.nullable(),
+	addons: array(PipelineAddonSchemaSchema).readonly()
 });
-/**
-* How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
-* no positions, a single snapshot, and no bbox trajectory at all:
-*
-*  - `sensor` — a linked sensor/control device state change.
-*  - `audio` — an audio event on the camera itself that was anomalous for
-*    THAT camera, loud, and heard while nothing visual was happening (D62).
-*
-* The spatial subsystems (tracker association, occupancy count, re-id /
-* embedding, resurrection) MUST skip every synthetic source. Test for that
-* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
-* check silently readmits every source added after it was written.
-*/
-var TrackSourceSchema = _enum([
-	"pipeline",
-	"sensor",
-	"audio"
-]);
-/**
-* Where a track sits in the RETRAIN lifecycle (D81).
-*
-*  - `none` — never marked, or un-marked. Evictable.
-*  - `staging` — the operator wants this track as training material and has not
-*    finished with it. **This is the only state retention holds**: the track and
-*    everything it owns (object events, crops, keyframes, CLIP vector) survive
-*    the device's age window.
-*  - `trained` — the retrain page has taken what it needed. The frames it chose
-*    were COPIED into the retrain dataset at selection time, so the dataset no
-*    longer depends on the track's media and the track becomes EVICTABLE again.
-*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
-*    a deliberate action of the retrain page, not a side effect of a checkbox.
-*
-* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
-* the store's filter language has only positive equality and `whereIn` — no
-* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
-* would make the entire pre-column history immortal in one deploy.
-*/
-var RetrainStatusSchema = _enum([
-	"none",
-	"staging",
-	"trained"
-]);
-/**
-* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
-* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
-* so the two surfaces cannot drift.
-*
-* **Absent ≠ false.** A track that has never been touched omits the field; an
-* explicitly un-flagged track carries `false`. Legacy rows written before the
-* columns existed read as absent, and a consumer that needs a boolean should say
-* `flag === true`, not `flag !== false`.
-*
-* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
-* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
-* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
-* `trained` track reports `false` while refusing both writes. The boolean is
-* kept because three surfaces drive a toggle off it; anything that needs to tell
-* "never marked" from "already trained" must read `retrainStatus`.
-*
-* `debug` does NOT pin; it is attention, not durability.
-*
-* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
-* A favourited track is skipped by retention the same way `staging` is, but
-* it does not enter `none|staging|trained` and has no staging budget.
-*/
-var TrackFlagFields = {
-	/** Operator marked this track as training material — i.e. `retrainStatus` is
-	*  `'staging'`. */
-	markForTrain: boolean().optional(),
-	/** Operator marked this track for diagnostic attention. */
-	debug: boolean().optional(),
-	/** Operator favourited this track. Pins it against pruning. */
-	favourited: boolean().optional()
-};
-/**
-* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
-* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
-* write patch, and the status is not something the toggle sets — it is what the
-* toggle's boolean is derived from. Absent on an in-RAM track never touched;
-* always present on a persisted row (the column default materialises `'none'`).
-*/
-var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
-/**
-* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
-* one flag can never clear the other — the toggles are independent and are
-* driven from three surfaces that do not know about each other.
-*/
-var TrackFlagsPatchSchema = object(TrackFlagFields);
-/**
-* The resolved flag state after a write. Both fields are REQUIRED here (absent
-* collapses to `false`) so a caller can drive a toggle's checked state off the
-* mutation result without a re-fetch.
-*/
-var TrackFlagsSchema = object({
-	trackId: string(),
-	markForTrain: boolean(),
-	debug: boolean(),
-	favourited: boolean(),
-	/** The lifecycle state the boolean was derived from. Required here (unlike on
-	*  a track row) because this shape is only ever produced by the write body,
-	*  which always knows it — and a surface that has just written needs to render
-	*  `trained` without a re-fetch. */
-	retrainStatus: RetrainStatusSchema
+var PipelineSchemaSchema = object({
+	availableEngines: array(AvailableEngineSchema).readonly(),
+	selectedEngine: PipelineEngineChoiceSchema,
+	slots: array(PipelineSlotSchemaSchema).readonly()
 });
-union([literal(1), literal(2)]);
-/**
-* WHO decided a label, and when. Carried per tier so a value can be traced to
-* the step and model that produced it — which is what makes the write rule
-* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
-* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
-*
-* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
-* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
-* `migration:4g` for a value the 4g migration moved from the single-slot era —
-* that value has no provenance, and the write rule lets ANY properly-attributed
-* write of the same tier replace it regardless of score.
-*/
-var LabelAttributionSchema = object({
-	stepId: string(),
-	modelId: string().optional(),
-	decidedAt: number(),
+var EngineProvisioningSchema = object({
+	runtimeId: _enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"edgetpu"
+	]).nullable(),
+	device: string().nullable(),
+	state: _enum([
+		"idle",
+		"installing",
+		"verifying",
+		"ready",
+		"failed"
+	]),
+	progress: number().optional(),
+	error: string().optional(),
+	nextRetryAt: number().optional(),
 	/**
-	* The GALLERY id behind a recognised tier-2 label — a face-gallery
-	* `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
-	*
-	* The text alone is a DISPLAY NAME, and a display name is renameable: a
-	* notification rule authored on "Gianluca" stopped matching the moment the
-	* operator fixed the spelling in the gallery, and nothing said so. The id is
-	* the thing that does not move, so it is what a rule matches on
-	* (`NcConditions.identities`) and the text is what a human is shown.
-	*
-	* Absent when the label names no gallery row — a plate the OCR read but no
-	* vehicle claims, a sub-class, a species, any tier-1 value.
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
 	*/
-	identityId: string().optional()
+	configIssues: array(string()).optional()
 });
-/**
-* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
-* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
-* track and its events always answer the same question the same way.
-*
-* Two scalar columns, not an array: every consumer wants "the coarse one" or
-* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
-* is tier 2, and each carries its own score + attribution.
-*
-* **Reading it.** What a human should be shown is `subLabel ?? label` — the
-* finest thing known. Before 4g the single `label` column held the finest
-* value, so a consumer that has not been updated reads the tier-1 slot and
-* shows nothing on a species-only row; that is why the migration puts every
-* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
-* and why the read surfaces were changed in the same train.
-*
-* **Writing it.** The slots are independent, which is the whole point: a
-* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
-* migratorius`), so fineness cannot regress by construction. Within a tier the
-* higher score wins. One rule, one implementation — see
-* `pipeline/label-tier.ts` in addon-post-analysis.
-*/
-var TieredLabelFields = {
-	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
-	label: string().optional(),
-	/** Confidence of the tier-1 value, as reported by the deciding step. */
-	labelScore: number().optional(),
-	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
-	labelMeta: LabelAttributionSchema.optional(),
-	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
-	subLabel: string().optional(),
-	/** Confidence of the tier-2 value, as reported by the deciding step. */
-	subLabelScore: number().optional(),
-	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
-	subLabelMeta: LabelAttributionSchema.optional()
-};
-/** Per-camera slice of a training-export estimate. */
-var TrainingExportDeviceTotalsSchema = object({
-	deviceId: number(),
-	tracks: number().int(),
-	files: number().int(),
-	bytes: number().int()
+var PipelineStepInputSchema = lazy(() => object({
+	addonId: string(),
+	modelId: string().optional(),
+	enabled: boolean().default(true),
+	children: array(PipelineStepInputSchema).optional(),
+	settings: record(string(), unknown()).optional(),
+	jumpDeviceKey: string().optional()
+}));
+var ModelSubstitutionSchema = object({
+	addonId: string(),
+	chosen: string(),
+	running: string(),
+	format: string()
+});
+var PipelineValidationIssueSchema = object({
+	addonId: string(),
+	kind: _enum(["unknown-addon", "no-format-build"]),
+	detail: string()
+});
+var PipelineValidationResultSchema = object({
+	ok: boolean(),
+	issues: array(PipelineValidationIssueSchema).readonly(),
+	substitutions: array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: string()
+});
+var ReferenceImageEntrySchema = object({
+	filename: string(),
+	stepIds: array(string()).readonly().optional()
+});
+var ReferenceImageBodySchema = object({
+	base64: string(),
+	filename: string()
+});
+var ReferenceAudioEntrySchema = object({
+	filename: string(),
+	sizeKb: number()
+});
+var ReferenceAudioBodySchema = object({ base64: string() });
+var AudioBackendSchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	available: boolean(),
+	/**
+	* Raw classifier labels this backend can emit (e.g. YAMNet's
+	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
+	* the benchmark UI to populate the `enabledMicroClasses` filter
+	* specific to the selected backend without a separate fetch.
+	*/
+	rawLabels: array(string()).readonly().optional()
+});
+var AudioCapabilitiesSchema = object({
+	activeBackend: string(),
+	availableBackends: array(AudioBackendSchema).readonly(),
+	sampleRate: number(),
+	chunkDurationMs: number()
+});
+var DownloadModelResultSchema = object({
+	filePath: string(),
+	sizeMB: number(),
+	durationMs: number()
 });
 /**
-* What a training export WOULD contain. Computed from media index rows only —
-* no blob is read to produce this.
+* Wrapper carrying a single test run's result. Replaces the legacy
+* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
+* canonical `AudioResult` from the Phase 6 output rework: one
+* `AudioDetection` per class above `minScore`, top-N candidates in
+* `debug.alternateLabels['audio-classifier']`, per-source timings in
+* `debug.stepTimings`. The outer `success`/`error` fields stay so the
+* benchmark UI can still report a clean failure when the classifier
+* cap isn't available.
 */
-var TrainingExportSummarySchema = object({
-	generatedAt: number(),
-	trackCount: number().int(),
-	fileCount: number().int(),
-	byteCount: number().int(),
-	/** More marked tracks exist than a single pass carries. */
-	truncated: boolean(),
-	devices: array(TrainingExportDeviceTotalsSchema).readonly()
+var AudioTestResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	frame: custom().optional()
 });
-var TrackSchema = object({
-	trackId: string(),
-	deviceId: number(),
-	className: string(),
-	...TieredLabelFields,
-	producingDeviceName: string().optional(),
-	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
-	source: TrackSourceSchema.optional(),
-	firstSeen: number(),
-	lastSeen: number(),
-	/** Frame-rate position history (subject to maxPositionHistory cap). */
-	positions: array(TrackPositionSchema).readonly(),
-	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
-	*  saveThumbnails policy). */
-	snapshots: array(TrackSnapshotSchema).readonly(),
-	/** Deduplicated zones the track has entered at least once. Zone IDS. */
-	zonesVisited: array(string()).readonly(),
+var PipelineConfigBridge = custom();
+var ConfigUISchemaBridge = custom();
+var ConfigUISchemaNullableBridge = custom();
+var InferenceCapabilitiesBridge = custom();
+var ModelAvailabilityListBridge = custom();
+var PipelineRunResultBridge = custom();
+method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+}))), method(object({ steps: record(string(), object({
+	modelId: string(),
+	settings: record(string(), unknown()).readonly()
+})) }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({
+	success: literal(true),
+	clearedDevices: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), object({ unhealthy: array(object({
+	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
+	deviceKey: string(),
 	/**
-	* Human NAMES for {@link zonesVisited}, resolved at READ time against the
-	* `zones` capability.
-	*
-	* `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
-	* and no card can render — so every free-text search surface was structurally
-	* unable to answer "show me the tracks in Uscio", and did not fail loudly, it
-	* just returned nothing. Resolving here rather than in each client keeps ONE
-	* derivation and costs the clients no extra call (the `zones` cap is
-	* per-device, so a client-side resolve would be a per-camera fan-out on a
-	* surface built to avoid exactly that).
-	*
-	* Resolved, never invented: a zone deleted since the track was written has no
-	* name and is DROPPED, so this array can be shorter than `zonesVisited` — the
-	* two are not positionally aligned. Absent when the track visited no zone, or
-	* when the zone catalogue could not be read.
+	* `failed` — the per-device restart budget is exhausted; no pool
+	* will be spawned until an operator re-arms it or the runner
+	* respawns. `backoff` — under budget, waiting out the backoff (or
+	* a cached pool observed dead and not yet condemned).
 	*/
-	zoneNames: array(string()).readonly().optional(),
-	/** Deduplicated set of detector classes observed for this track over its
-	*  life (a track may be reclassified, e.g. person→vehicle). Absent on
-	*  legacy rows written before class accumulation shipped. */
-	classes: array(string()).readonly().optional(),
-	/** Cumulative normalized distance travelled (0..1 units = full frame width). */
-	totalDistance: number(),
-	state: TrackStateSchema,
-	active: boolean(),
-	/** Deterministic key-event importance score in [0,1] (server-computed at
-	*  track expiry, recomputed on late label). Absent on legacy rows written
-	*  before scoring shipped — consumers degrade to absence / compute-on-read. */
-	importance: number().optional(),
-	/** Id of the track's highest-confidence ObjectEvent (its representative
-	*  "best" frame). Absent when the track produced no object events. */
-	bestEventId: string().optional(),
-	/** Tag of the importance sub-signal that dominated the score
-	*  (identity|dwell|proximity|class|confidence|travel|zone). */
-	importanceReason: string().optional(),
-	/** Audio-classification labels heard on the camera during the track's
-	*  life (score ≥ device `classificationMinScore`), aggregated per label.
-	*  Absent on legacy rows / tracks with no confident audio. */
-	audioLabels: array(TrackAudioLabelSchema).readonly().optional(),
-	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
-	*  Populated from the persisted envelope columns on historical reads;
-	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-	envelope: TrackEnvelopeSchema.optional(),
+	state: _enum(["failed", "backoff"]),
+	/** Epoch ms of the death that produced this state. */
+	since: number(),
+	/** Pool deaths inside the current window. */
+	deaths: number(),
+	/** The last death's message. */
+	lastError: string()
+})).readonly() })), method(object({
+	nodeId: string(),
+	deviceKey: string()
+}), object({ rearmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
+	name: string(),
+	steps: array(PipelineTemplateStepSchema).readonly(),
+	engine: PipelineEngineChoiceSchema
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
+	id: string(),
+	name: string().optional(),
+	steps: array(PipelineTemplateStepSchema).readonly().optional()
+}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
+	addonId: string(),
+	modelId: string(),
+	format: ModelFormatSchema$1
+}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
+	engine: PipelineEngineChoiceSchema.optional(),
+	steps: array(PipelineStepInputSchema).min(1),
+	frame: FrameInputSchema.optional(),
 	/**
-	* A face DETECTOR found a face on this track — nothing more. It says the
-	* detail plane produced a `face` detail; it does NOT say the face was
-	* embedded, matched, above `minFacePx`, or that the recognizer was even
-	* enabled. Set once and never cleared.
-	*
-	* **This exists so "face present but not recognised" is expressible.** A
-	* recognised identity lands in `subLabel` (attributed to the face chain via
-	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
-	* and a track with no face at all were byte-identical on the wire and no
-	* surface could tell them apart. The read is `hasFace === true && subLabel
-	* === undefined`.
-	*
-	* **Absent ≠ false.** Every row written before the column existed omits it,
-	* and so does every server that predates the field — a consumer must test
-	* `=== true` and render nothing otherwise, never infer "no face".
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
 	*/
-	hasFace: boolean().optional(),
+	frameRef: FrameRefSchema.optional(),
 	/**
-	* This track has a face row IN THE GALLERY: a crop **and** an embedding — a
-	* face an operator could ASSIGN to an identity.
-	*
-	* The STRICT twin of {@link hasFace}, and the pair only earns its keep
-	* because the two disagree. `hasFace` is stamped at the TOP of the face
-	* branch, before every gate, and means no more than "a face detector produced
-	* a face detail". This one is stamped at the single moment the gallery row
-	* LANDS — after `FaceRecognizer.onTrackEnd` successfully persists it, i.e.
-	* past the embedding-magnitude verdict, the `minFacePx` detection gate, the
-	* candidate gate, the imageless-track drop (no crop was ever captured) and
-	* the crop-store drop. Everything between the detector and that insert can
-	* legitimately refuse the face, so a flag written any earlier promises the
-	* operator something to assign and delivers nothing.
-	*
-	* **Independent of recognition.** A face collected but never auto-matched is
-	* still assignable — it is in fact the face an operator most wants to reach —
-	* so this is NOT gated on `recognizedIdentityId`. Recognition lands in
-	* `subLabel`; this says only that the raw material exists.
-	*
-	* **Set once, never cleared.** A track that produced a gallery row produced
-	* one; deleting the row later is the gallery's business, not this flag's.
-	*
-	* **Absent ≠ false**, the same rule as {@link hasFace}: every row written
-	* before the column omits it, and so does every server that predates the
-	* field. A consumer must test `=== true` and render nothing otherwise —
-	* never infer "no assignable face".
+	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+	* the decoded pixels live in. One more member of the one-of
+	* frame/frameHandle/image/imageBase64/referenceImage group.
 	*/
-	hasEmbeddedFace: boolean().optional(),
+	frameHandle: FrameHandleSchema.optional(),
+	imageBase64: string().optional(),
 	/**
-	* This subject CONTAINS a folded rider — a person the rider-pairing step
-	* ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
-	* so the passage is tracked once and as a VEHICLE.
-	*
-	* It exists because the fold's record was dishonest. D34 and the code both
-	* said "the person is not lost — it is reported so both entities stay on the
-	* record"; in fact the pair went into a per-processor RAM field behind an
-	* accessor nobody called, and every durable surface said `vehicle`, full
-	* stop. This is the composition note that makes the row true.
-	*
-	* A COMPOSITION, never a class and never a label. "This vehicle contains a
-	* person" is not an answer to "what is this" — both label tiers would refuse
-	* a macro token anyway (D89), and correctly. Nothing here changes what the
-	* subject IS: a cyclist stays one vehicle track, occupancy still counts one,
-	* and a `person` rule still does not fire for someone cycling past.
-	*
-	* **Absent ≠ false**, exactly like {@link hasFace}: every row written before
-	* the column, and every hub that predates the field, omits it. Test
-	* `=== true` and render nothing otherwise — never infer "no rider".
+	* Binary JPEG bytes — preferred over `imageBase64` on internal
+	* hops (hub → forked worker via Moleculer MsgPack) because it
+	* skips the 33% base64 overhead + the per-call base64 decode on
+	* the detection-pipeline worker. Callers can pass either; exactly
+	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
 	*/
-	hasRider: boolean().optional(),
-	...TrackFlagFields,
-	...TrackRetrainFields
-});
-var BaseEventFields = {
-	id: string(),
-	deviceId: number(),
-	timestamp: number()
-};
-var MotionEventSchema = object({
-	...BaseEventFields,
-	kind: literal("motion"),
-	regionCount: number(),
-	/** Heavy JSON array — omitted in slim projection. */
-	regions: array(object({
-		bbox: BoundingBoxSchema,
-		pixelCount: number(),
-		intensity: number()
-	})).readonly().optional(),
-	/** Omitted in slim projection. */
-	frameWidth: number().optional(),
-	/** Omitted in slim projection. */
-	frameHeight: number().optional(),
-	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: string().optional()
-});
+	image: _instanceof(Uint8Array).optional(),
+	referenceImage: string().optional(),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Execution plane. 'full' (default) runs the whole tree — benchmark,
+	* reference-image, and detail-subtree calls. 'frame' is the live
+	* per-frame dispatch: ONLY root-plane steps run; crop children
+	* (inputClasses ≠ null) are skipped and served per-track via
+	* pipelineRunner.runDetailSubtree (two-plane design).
+	*/
+	plane: _enum(["full", "frame"]).optional(),
+	/**
+	* Inference-device selector (Phase 2 multi-device). Format
+	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+	* Omitted ⇒ the runner's default device (current single-engine
+	* behaviour). Selects WHICH device pool of the node runs the call.
+	*/
+	deviceKey: string().optional(),
+	/**
+	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+	* when the parent crop was resolved from the frame's retained NATIVE
+	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+	* resolution from that surface — the SAME quality path faces already
+	* had — instead of the downscaled parent tile. `handle` keys the native
+	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+	* the executor's crop-normalized child ROI back into frame-normalized
+	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+	* (today's behaviour on the fallback path).
+	*/
+	nativeCropRef: NativeCropRefSchema.optional()
+}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
+	engine: PipelineEngineChoiceSchema.optional(),
+	steps: array(PipelineStepInputSchema).min(1),
+	frames: array(FrameInputSchema).min(1).max(255),
+	deviceId: number().optional(),
+	sessionId: string().optional(),
+	/**
+	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+	* the batch to the Python pool's bench preprocess cache
+	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+	* preprocessed ONCE and every later inference is a pure-inference cache
+	* hit — the sustained-throughput run measures inference, not
+	* decode+preprocess+infer. Omitted/0 for live frames (all different →
+	* full preprocess every call, correct). Fresh per sustained run;
+	* released via `uncacheFrame`.
+	*/
+	frameId: number().int().nonnegative().optional(),
+	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+	deviceKey: string().optional()
+}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
+	data: _instanceof(Uint8Array),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum([
+		"rgb",
+		"bgr",
+		"gray"
+	])
+}), object({
+	frameId: number(),
+	width: number(),
+	height: number()
+}), { kind: "mutation" }), method(object({
+	stepId: string(),
+	frameId: number().int()
+}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(_void(), object({
+	batchMode: string(),
+	windowMs: number(),
+	maxBatchSize: number(),
+	concurrency: number()
+})), method(_void(), array(object({
+	engineKey: string(),
+	engine: PipelineEngineChoiceSchema,
+	modelsLoaded: array(string()).readonly(),
+	inUseByCameras: array(number()).readonly(),
+	/**
+	* Origin of this resident factory.
+	*  - `runtime`       — main camera-serving engine (no idle TTL).
+	*  - `warm-override` — benchmark/test override held in the warm
+	*                      cache; auto-disposed after the idle TTL.
+	*  - `device-pool`   — a concurrent per-device pool (Phase 2
+	*                      multi-device, keyed by `deviceKey`) resolved
+	*                      via `resolveDeviceFactory`. Runs alongside the
+	*                      `runtime` engine on a DIFFERENT accelerator
+	*                      (NPU / iGPU / Coral) — this is how the
+	*                      Engines tab shows all pools running at once.
+	*/
+	kind: _enum([
+		"runtime",
+		"warm-override",
+		"device-pool"
+	]),
+	/** Native pid of the underlying Python pool (null when no pool). */
+	poolPid: number().nullable(),
+	/** ms since this factory was last used (null when not warm-tracked). */
+	idleMs: number().nullable(),
+	/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
+	idleTtlMs: number().nullable()
+})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	engine: PipelineEngineChoiceSchema,
+	force: boolean().optional()
+}), object({
+	success: boolean(),
+	reason: string().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
+	addonId: string(),
+	modelId: string(),
+	filename: string().optional(),
+	settings: record(string(), unknown()).optional()
+}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
 /**
-* Which detection SOURCE produced an object event. `pipeline` = the ML
-* detection pipeline (decoded-frame inference); `onboard` = the camera's
-* native on-device AI. Both flow through the SAME analysis layers (zoning,
-* tracking, per-kind persistence) but stay distinguishable so consumers
-* (advanced-notifier, occupancy, …) can select which source(s) to act on.
-* Absent on legacy rows ⇒ treat as `pipeline`.
+* Per-stage gating mode applied to the zones a rule references.
+*
+* - `include`: the rule contributes to a **whitelist** for its stage.
+*   When at least one `include` rule fires for a stage, only entities
+*   inside one of those zones pass that stage.
+* - `exclude`: the rule contributes to a **blacklist** for its stage.
+*   Entities inside one of those zones are dropped at that stage.
+*
+* `monitor`-style observation (count without filtering) is not a rule
+* mode — zones without any matching rule are observed naturally by
+* `zone-analytics` (live snapshot + history), so an "I just want to
+* count, not filter" use case needs no rule at all.
 */
-var DetectionSourceSchema = _enum(["pipeline", "onboard"]);
+var ZoneRuleModeEnum = _enum(["include", "exclude"]);
 /**
-* The confirmed zone crossing that produced an object event. Present ONLY on
-* an event emitted BY a crossing (`zone.enter` / `zone.exit`); a movement-state
-* event (`object.entering` / `leaving` / `stationary` / `loitering`) and an
-* appearance event carry none, so a rule asking for a direction fails closed
-* on them.
+* Per-consumer rule that references existing zones (geometry) and
+* defines how a specific pipeline stage should treat them. Each
+* consumer addon owns its own `ZoneRule[]` array in its per-device
+* settings:
 *
-* Exactly ONE crossing per event: the emitter turns each confirmed crossing
-* into its own event, so a frame in which a track enters A while leaving B
-* produces two events with two directions — never one ambiguous row.
+* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
+* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
+* - future: notification rules, audio gating, etc.
 *
-* `zoneId` is load-bearing for an EXIT: the event's `zones` list is the
-* membership the box has NOW, and by definition it no longer contains the zone
-* that was just left. Without the id here, a zone-scoped rule could never match
-* the exit it asked for.
+* One rule applies to N zones (`zoneIds[]`) so the operator can
+* express "ignore motion in ALL of {garden, street}" with a single
+* rule. `classFilter` narrows the rule to specific object classes —
+* "drop person detections in the street, but keep cars" is one
+* `exclude` rule with `classFilter: ['person']`.
+*
+* `enabled` is a soft toggle — the operator can keep the rule
+* configured but inert without deleting it.
 */
-var ZoneCrossingSchema = object({
-	direction: _enum(["enter", "exit"]),
-	/** Admin zone id crossed. */
-	zoneId: string(),
-	/** Zone display name at crossing time (falls back to the id). */
-	zoneName: string().optional()
-});
-var ObjectEventSchema = object({
-	...BaseEventFields,
-	kind: literal("object"),
-	/** Detection source. Optional for backward-compat; absent ⇒ `pipeline`. */
-	source: DetectionSourceSchema.optional(),
-	/**
-	* Inference-frame id shared by every object event emitted from the SAME frame
-	* — the "scene/parent" key. Lets a consumer group co-occurring detections (e.g.
-	* 2 people + 1 dog) under one full frame, and link a track's frames over time
-	* (group by `trackId`, pick a representative `frameId` as the parent frame).
-	* Optional for backward-compat with pre-existing rows / the slim projection
-	* includes it (it is light). Absent on rows written before this field.
+var ZoneRuleSchema = object({
+	/** Stable rule id — survives edits, used by the UI for diffing. */
+	id: string(),
+	/** Optional human-readable label rendered in the rule editor. */
+	name: string().optional(),
+	/** Zones this rule targets. The rule's `mode` applies to ALL
+	*  listed zones (OR-set: a detection in any one of them counts).
+	*  At least one zone id required — a rule with no targets is a
+	*  configuration mistake and the form validator rejects it. */
+	zoneIds: array(string()).min(1).readonly(),
+	mode: ZoneRuleModeEnum,
+	/**
+	* Class names this rule applies to. Empty / undefined ⇒ rule
+	* applies to every class. Class strings match the `macroClass`
+	* field on detections (e.g. `person`, `car`, `dog`).
 	*/
-	frameId: string().optional(),
-	/** Omitted in slim projection. */
-	trackId: string().optional(),
-	className: string(),
-	...TieredLabelFields,
-	/** Omitted in slim projection. */
-	confidence: number().optional(),
-	/** Heavy JSON — omitted in slim projection. */
-	bbox: BoundingBoxSchema.optional(),
-	/** Heavy JSON — omitted in slim projection. */
-	zones: array(string()).readonly().optional(),
-	/** Omitted in slim projection. */
-	state: TrackStateSchema.optional(),
+	classFilter: array(string()).readonly().optional(),
 	/**
-	* The zone crossing this event IS, when it is one. Absent on every other
-	* event kind (movement state, appearance, package) — see
-	* {@link ZoneCrossingSchema}. Omitted in slim projection.
+	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
+	* required to consider an entity "in the zone". Defaults to the
+	* consumer's stage default when omitted. Kept for back-compat with
+	* existing per-rule overrides; new operators pick the value via
+	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+	* set, the lower-level engine reads it as a 0–1 fraction.
 	*/
-	zoneCrossing: ZoneCrossingSchema.optional(),
-	/** Detection-frame dimensions in pixels — let consumers normalize the
-	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
-	frameWidth: number().optional(),
-	frameHeight: number().optional(),
-	/** MediaStore key for the crop attached to this event (if any). */
-	mediaKey: string().optional(),
-	/** Design B: MediaStore key of the track's native-resolution key frame (the
-	*  best-detection full frame). Resolve via the event-media data-plane
-	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
-	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-	*  sources — consumers fall back to `mediaKey` (the tight crop). */
-	keyFrameMediaKey: string().optional(),
-	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: string().optional(),
-	/** The parent track's key-event importance [0,1], propagated to every object
-	*  event of the track (so an event row can be sorted by importance without a
-	*  track join). Absent on legacy rows / before the track was scored. */
-	importance: number().optional()
-});
-var AudioEventSchema = object({
-	...BaseEventFields,
-	kind: literal("audio"),
-	rms: number(),
-	dbfs: number(),
-	classification: object({
-		className: string(),
-		originalClass: string().optional(),
-		score: number()
-	}).optional(),
-	/** Populated by B5 (recording playback URL for this event). */
-	mediaUrl: string().optional()
-});
-var MediaFileKindEnum = _enum([
-	"crop",
-	"thumbnail",
-	"snapshot",
-	"firstFrame",
-	"lastFrame",
-	"fullFrame",
-	"fullFrameBoxed",
-	"faceCrop",
-	"plateCrop",
-	"keyFrame",
-	"keyFrameSmall",
-	"thumbnailSmall"
-]);
-var MediaFileSchema = object({
-	key: string(),
-	kind: MediaFileKindEnum,
-	base64: string(),
-	sizeBytes: number(),
-	timestamp: number()
+	overlapThreshold: number().min(0).max(1).optional(),
+	/**
+	* Operator-friendly version of `overlapThreshold` — the percentage
+	* of the detection's bbox that must lie inside the zone for the
+	* rule to match. Documented default is 85%; the engine substitutes
+	* that when the field is omitted (kept optional so existing rules
+	* stored without it stay valid).
+	*
+	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+	* rule, the engine prefers `bboxInclusionPct` because it's the
+	* field exposed in the UI. Internally both feed the same gate.
+	*/
+	bboxInclusionPct: number().min(0).max(100).optional(),
+	/**
+	* When `true` and a detection has a segmentation mask, use the
+	* mask for overlap instead of the bbox. Detection-stage only;
+	* motion rules ignore this field.
+	*/
+	preferMask: boolean().optional(),
+	/**
+	* Soft-toggle: `false` disables the rule without deleting it.
+	* Defaults to `true` so operators creating a rule via the UI
+	* see it active immediately.
+	*/
+	enabled: boolean().default(true)
 });
+array(ZoneRuleSchema).readonly();
 /**
-* One media row WITHOUT its bytes.
+* Zone — pure geometry + identity. NO filtering behaviour.
 *
-* A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
-* 140 s track), and a client that renders tiles from the media data plane needs
-* to know only WHAT EXISTS — the bytes then arrive per tile, lazily, over HTTP
-* with an immutable cache, instead of all at once inside a tRPC response that
-* blocks the whole view.
+* Zones describe **where** in the frame the operator wants to flag
+* something; consumer-owned {@link ZoneRule} arrays describe **how**
+* each pipeline stage uses them. Splitting the two means a single
+* polygon "Driveway" can simultaneously back a motion-exclude rule,
+* a detection-include rule on `['car']`, and an occupancy aggregate
+* — without three duplicated polygons.
 *
-* `sizeBytes` is carried because it is what lets a client decide between the
-* stored blob and a `?variant=thumb` rendering without fetching either.
-*/
-var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
-/**
-* The MACRO tier of an annotation — a CLOSED set.
+* Owned by the orchestrator addon (provider) and mirrored into the
+* `zones` device-state slice on every mutation. Consumers
+* (motion-wasm, pipeline-executor, analytics, admin UI) read either
+* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
+* mirror with `onChanged`).
 *
-* This is what the exported detector predicts, so a typo here is a new class
-* with one example in it. `label` and `subLabel` are open strings by contrast:
-* the whole point of the page is teaching the model things it does not know
-* yet, and constraining that vocabulary would make it useless.
+* Coordinates are normalised fractions of the frame (0–1) so zones
+* survive resolution changes and stream profile switches.
 *
-* A macro class is NEVER a label. The provider refuses a write whose `label` or
-* `subLabel` is one of these values, in any casing, because once `person`
-* exists in both tiers "every person box" stops being answerable without
-* knowing every string anyone ever typed — and the damage is retroactive.
+* `kind` discriminates between full polygons (closed regions used
+* for intrusion / occupancy filters) and tripwires (open 2-point
+* line segments used for cross events). Onboard / firmware-reported
+* zones (Reolink, ONVIF) are out of scope for now — see the deferred
+* task list.
 */
-var RetrainMacroClassSchema = _enum([
-	"person",
-	"vehicle",
-	"animal",
-	"package",
-	"face",
-	"plate"
-]);
-/** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
-var RetrainAnnotationKindSchema = _enum(["subject", "model_error"]);
-/** Did a human draw this box, or did the assist propose it? */
-var RetrainAnnotationSourceSchema = _enum(["operator", "assist"]);
-/** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
-var RetrainBboxSchema = object({
+var ZoneKindEnum = _enum(["polygon", "tripwire"]);
+/** Polygon vertex in fraction-of-frame coordinates (0–1). */
+var PolygonPointSchema = object({
 	x: number(),
-	y: number(),
-	w: number(),
-	h: number()
+	y: number()
+});
+/** A camera detection zone — pure geometry/identity. */
+var ZoneSchema = object({
+	id: string(),
+	name: string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: string().default("#3b82f6")
 });
 /**
-* One annotated subject.
+* Zones capability — per-camera CRUD over polygon detection zones.
 *
-* `bbox` is normalised against the full frame, ALWAYS. The per-model shapes
-* (letterboxed root / zone-cropped package / subject-cropped classifier) are
-* derived from it at export and never stored — storing them is how one feature
-* space ends up holding two crops of the same subject (D52).
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
 */
-var RetrainAnnotationSchema = object({
-	id: string(),
-	trackId: string(),
-	deviceId: number(),
-	/** The COPY in retrain storage — never the source track's media key. */
-	mediaKey: string(),
-	bbox: RetrainBboxSchema,
-	macroClass: RetrainMacroClassSchema,
-	label: string().optional(),
-	subLabel: string().optional(),
-	kind: RetrainAnnotationKindSchema,
-	source: RetrainAnnotationSourceSchema,
-	/** Which model proposed this box — or, on a `model_error`, drew the phantom. */
-	assistModelId: string().optional(),
-	assistScore: number().optional(),
-	exportedInBatch: string().optional(),
-	createdAt: number()
-});
-/** The write form — the server owns `id`, `createdAt` and the frame binding. */
-var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
-	id: true,
-	trackId: true,
-	deviceId: true,
-	mediaKey: true,
-	createdAt: true,
-	exportedInBatch: true
-});
-/** A track sitting in `staging`, with everything the worklist needs to rank it. */
-var RetrainTrackSchema = object({
-	trackId: string(),
-	deviceId: number(),
-	className: string(),
-	label: string().optional(),
-	firstSeen: number(),
-	lastSeen: number(),
-	/** How many frames the dataset already holds from this track. */
-	frameCount: number().int(),
-	/** How many subjects have been annotated on those frames. `0` with
-	*  `frameCount: 0` is exactly "staging, still to work". */
-	annotationCount: number().int()
-});
-/** A frame the picker may offer — an index row, no blob was read to produce it. */
-var RetrainFrameCandidateSchema = object({
-	mediaKey: string(),
-	kind: MediaFileKindEnum,
-	timestamp: number(),
-	sizeBytes: number().int(),
-	/** A copy of this original already exists — selecting it is free and cannot
-	*  fail, whatever became of the original. */
-	copied: boolean()
-});
-/** A frame the dataset OWNS: bytes copied at selection time. */
-var RetrainFrameSchema = object({
-	frameId: string(),
-	deviceId: number(),
-	trackId: string(),
-	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaKey: string(),
-	sourceKind: MediaFileKindEnum,
-	sizeBytes: number().int(),
-	width: number().int(),
-	height: number().int(),
-	copiedAt: number()
-});
-/** Why a copy-on-select could not be honoured — named, never a silent skip. */
-var RetrainCopyRefusalSchema = _enum([
-	"source-missing",
-	"unreadable-image",
-	"write-failed"
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
+		addZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: method(object({
+			deviceId: number(),
+			zoneId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+/**
+* pipeline-analytics — device-scoped wrapper cap. Refines raw
+* per-frame detections emitted by the pipeline runner into tracked
+* objects, per-kind event collections (motion / object / audio), and
+* persisted media. Owns the post-detection domain end-to-end:
+*
+*   runner emits PipelineInferenceResult
+*     ↓ (event bus)
+*   pipeline-analytics subscriber
+*     ↓ SORT tracker + zone engine + state analyzer + event emitter
+*   → three DB collections (one per kind), one FS media tree, one
+*     unified event emitter (FrameTracked + TrackStarted/Ended +
+*     DetectionEvent on bus)
+*
+* Pure subscriber model. No `processFrame` cap method — the runner
+* already publishes the raw frame on the bus. The cap surface is
+* only QUERIES + per-device settings, bound on/off via
+* `device-manager.setWrapperActive`. `defaultActive: true` because
+* every camera with a detection pipeline wants its raw detections
+* refined; operators opt out per-device via BindingsTab when needed.
+*
+* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
+* (per-device surface) and `track-trail` caps — see P11 cleanup.
+*/
+var TrackStateSchema = _enum([
+	"new",
+	"entered",
+	"left",
+	"moving",
+	"idle"
+]);
+var EventKindSchema = _enum([
+	"motion",
+	"object",
+	"audio"
 ]);
-var RetrainFrameSelectionSchema = object({
-	copied: array(RetrainFrameSchema).readonly(),
-	refused: array(object({
-		sourceMediaKey: string(),
-		reason: RetrainCopyRefusalSchema
-	})).readonly()
-});
-var RetrainFrameListSchema = object({
-	candidates: array(RetrainFrameCandidateSchema).readonly(),
-	copies: array(RetrainFrameSchema).readonly(),
-	/** What the page pre-selects — the native key frame when one survives. */
-	autoPickMediaKey: string().optional()
-});
-/** What the operator asked the assist to look for. */
-var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
-	kind: literal("package"),
-	zone: RetrainBboxSchema.optional()
-}), object({
-	kind: literal("objects"),
-	modelId: string(),
-	minScore: number().optional()
-})]);
 /**
-* The assist's answer — a discriminated union, because "the model saw nothing"
-* and "this node cannot run that model" lead to different next moves and a
-* nullable result cannot tell them apart.
+* Spatial filter for `listTracks` — the rect + polygon variants of the shared
+* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
+* of the camera frame (top-left origin), matching the drawing-plane editor.
 */
-var RetrainAssistResultSchema = discriminatedUnion("kind", [object({
-	kind: literal("proposed"),
-	modelId: string(),
-	stepId: string(),
-	minScore: number(),
-	/** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
-	proposals: array(RetrainAnnotationDraftSchema).readonly(),
-	/** Returned by the runner but removed by the threshold. */
-	belowThreshold: number().int()
-}), object({
-	kind: literal("refused"),
-	/** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
-	reason: string(),
-	detail: string().optional()
-})]);
-/** The outcome of a lifecycle move owned by the retrain page. */
-var RetrainTransitionResultSchema = object({
-	trackId: string(),
-	/** Where the track ended up, whatever happened. */
-	retrainStatus: RetrainStatusSchema,
-	/** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
-	changed: boolean(),
-	reason: _enum([
-		"unknown-track",
-		"no-frames-copied",
-		"not-staging",
-		"not-trained",
-		"unchanged"
-	]).optional()
+var TrackZoneFilterSchema = discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
+/** Closed icon vocabulary so clients render a known glyph per kind. */
+var EventKindIconSchema = _enum([
+	"motion",
+	"audio",
+	"person",
+	"vehicle",
+	"animal",
+	"door",
+	"pir",
+	"smoke",
+	"water",
+	"button",
+	"package",
+	"generic"
+]);
+var EventKindCategorySchema = _enum([
+	"motion",
+	"audio",
+	"detection",
+	"sensor",
+	"control",
+	"custom",
+	"package"
+]);
+/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
+var EventKindLevelSchema = _enum(["macro", "sub"]);
+var EventKindDescriptorSchema = object({
+	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
+	kind: string(),
+	/** i18n key resolved on the UI side; `label` is the English fallback. */
+	labelKey: string(),
+	/** English fallback label (kept for clients that don't translate). */
+	label: string(),
+	/** Hex color for timeline/legend rendering. */
+	color: string(),
+	/** Dictionary id → lucide component on the UI side. */
+	iconId: string(),
+	/** Legacy closed-vocab glyph — fallback for `iconId`. */
+	icon: EventKindIconSchema,
+	category: EventKindCategorySchema,
+	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+	parentKind: string().nullable(),
+	/** Derived from `parentKind`, explicit for the client tree. */
+	level: EventKindLevelSchema,
+	/** Which cap + device contributes this kind. For built-ins the camera
+	*  itself; for sensor kinds the LINKED source device. */
+	source: object({
+		capName: string(),
+		deviceId: number()
+	})
 });
-var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
-var MAX_EVENT_QUERY_LIMIT = 5e3;
-var DeviceEventQueryInput = object({
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
 	deviceId: number(),
-	since: number().optional(),
-	until: number().optional(),
-	limit: number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT),
-	/** `slim` drops heavy JSON fields (regions/bbox/zones) and carries an
-	*  optional `mediaUrl` (populated by B5). `full` (default) keeps today's
-	*  exact behaviour. Callers may omit this field — the store defaults to
-	*  `full` when not provided. */
-	projection: _enum(["full", "slim"]).optional()
-});
-var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: string().optional() });
-var RecentTracksQueryInput = object({
-	/** Devices to merge. An empty array yields `{ tracks: [], nextCursor: null }`. */
-	deviceIds: array(number()),
-	/** Window lower bound on `lastSeen` (inclusive). */
-	since: number().optional(),
-	/** Window upper bound on `lastSeen` (inclusive). */
-	until: number().optional(),
-	/** Page size. Default 200, max 1000. */
-	limit: number().int().min(1).max(1e3).default(200),
-	/** Opaque continuation cursor from a previous page's `nextCursor`.
-	*  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
-	cursor: string().optional(),
-	/** See {@link TrackProjectionSchema}. Default `full`. */
-	projection: TrackProjectionSchema.optional(),
-	/** Include stationary-promoted rows (parked objects). Default false: the
-	*  feed lists passages; parking records live on the stationary registry. */
-	includeStationary: boolean().optional()
-});
-var RecentTracksPageSchema = object({
-	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
-	tracks: array(TrackSchema).readonly(),
-	/** Cursor for the next page, or null when this page is the last. */
-	nextCursor: string().nullable()
+	kinds: array(EventKindDescriptorSchema).readonly()
 });
-var LIST_GROUPS_DEFAULT_LIMIT = 40;
-var LIST_GROUPS_MAX_LIMIT = 100;
-var AnalyticsGroupRecordSchema = object({
+var SensorEventSchema = object({
 	id: string(),
-	deviceId: number().int(),
-	openedAt: number().int(),
-	closedAt: number().int(),
-	timestamp: number().int(),
-	memberCount: number().int(),
-	memberTrackIds: array(string()).readonly(),
-	className: string(),
-	classes: array(string()).readonly(),
-	/** Relative event-media path, or null when the group has no picture yet. */
-	mediaUrl: string().nullable(),
-	singleton: boolean()
-});
-var AnalyticsGroupMemberSchema = object({
-	trackId: string(),
-	deviceId: number().int(),
-	className: string(),
-	firstSeen: number().int(),
-	lastSeen: number().int(),
-	mediaUrl: string().nullable()
-});
-var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: array(AnalyticsGroupMemberSchema).readonly() });
-var ListGroupsQueryInput = object({
-	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
-	deviceIds: array(number()),
-	/** Window lower bound on `closedAt` (inclusive). */
-	since: number().optional(),
-	/** Window upper bound on `openedAt` (inclusive). */
-	until: number().optional(),
-	limit: number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
-	/** Opaque continuation cursor from a previous page's `nextCursor`. */
-	cursor: string().optional()
-});
-var ListGroupsPageSchema = object({
-	groups: array(AnalyticsGroupRecordSchema).readonly(),
-	nextCursor: string().nullable()
-});
-var KeyEventQueryInput = object({
+	/** The CAMERA the event is attributed to (a sensor linked to N cameras
+	*  yields N rows, one per camera). */
 	deviceId: number(),
-	/** Window lower bound (track firstSeen ≥ since). */
-	since: number(),
-	/** Window upper bound (track firstSeen ≤ until). */
-	until: number(),
-	limit: number().int().min(1).max(200).default(50),
-	/** Drop tracks scoring below this importance. */
-	minImportance: number().min(0).max(1).optional(),
-	/** Restrict to a single class (e.g. 'person'). */
-	classFilter: string().optional()
+	/** The linked sensor device whose state changed. */
+	sourceDeviceId: number(),
+	/** Event kind id — matches an `EventKindDescriptor.kind`. */
+	kind: string(),
+	/** Snapshot of the sensor cap's runtime-state slice at the change. */
+	value: record(string(), unknown()).nullable(),
+	timestamp: number()
 });
-var KeyEventSchema = object({
-	/** The representative event id (the track's best ObjectEvent, else its trackId). */
-	id: string(),
-	trackId: string(),
-	/** Track start time (firstSeen). */
+var TrackPositionSchema = object({
+	x: number(),
+	y: number(),
 	timestamp: number(),
-	className: string(),
-	...TieredLabelFields,
-	importance: number(),
-	/** Highest-confidence ObjectEvent id for the track (empty when none). */
-	bestEventId: string(),
-	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: number().optional(),
-	...TrackFlagFields,
-	...TrackRetrainFields
-});
-object({
-	trackId: string(),
-	className: string(),
-	confidence: number(),
-	bbox: BoundingBoxSchema,
-	zones: array(string()).readonly(),
-	state: TrackStateSchema
-});
-var OverlayDetectionSchema = looseObject({
-	id: string(),
-	kind: _enum(["first-level", "detail"]),
-	macroClass: string(),
-	score: number(),
-	bbox: object({
-		x: number(),
-		y: number(),
-		width: number(),
-		height: number()
-	}),
-	labels: array(looseObject({
-		label: string(),
-		score: number()
-	})).readonly(),
-	parentId: string().optional()
-});
-var ScoredObjectEventSchema = ObjectEventSchema.extend({ score: number() });
-var SearchObjectEventsInput = object({
-	text: string(),
-	deviceId: number().optional(),
-	since: number().optional(),
-	until: number().optional(),
-	classFilter: string().optional(),
-	limit: number().default(50),
-	minScore: number().min(0).max(1).default(.2)
-});
-var TrackCascadeCountsSchema = object({
-	/** Persisted track roots deleted (authoritative). */
-	tracks: number().int(),
-	/** Object events removed with their tracks (best-effort; see note above). */
-	events: number().int(),
-	/** Track/face/plate-owned media removed (best-effort). Never identity media. */
-	media: number().int(),
-	/** Unassigned (non-enrolled) face reads removed (best-effort). */
-	faces: number().int(),
-	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
-	plates: number().int(),
-	/** Per-track CLIP search vectors removed (best-effort). */
-	embeddings: number().int(),
-	/** Group membership + group rows removed with their last member (best-effort). */
-	groups: number().int()
-});
-/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
-var DiskReconcileCountsSchema = object({
-	mediaDropped: number().int(),
-	tracks: number().int(),
-	events: number().int()
-});
-/** Event-store footprint for one camera. */
-var EventStoreDeviceFootprintSchema = object({
-	deviceId: number(),
-	/** Persisted event rows (motion + object + audio) for the camera. */
-	rows: number().int(),
-	/** Event-owned media bytes on disk for the camera. */
-	bytes: number().int()
+	bbox: BoundingBoxSchema
 });
-/** Aggregate event-store footprint: global totals + per-camera breakdown. */
-var EventStoreFootprintSchema = object({
-	totalRows: number().int(),
-	totalBytes: number().int(),
-	devices: array(EventStoreDeviceFootprintSchema).readonly()
+var TrackSnapshotSchema = object({
+	timestamp: number(),
+	position: TrackPositionSchema,
+	/** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
+	mediaKey: string()
 });
-/** Per-kind counts returned by the event-prune / device-delete mutations. */
-var EventPruneCountsSchema = object({
-	motion: number().int(),
-	object: number().int(),
-	audio: number().int()
+/**
+* Normalized 0..1 trajectory envelope (min/max over every position bbox,
+* divided by the track's detection-frame dims), computed at persist time.
+* Absent when the frame dims were unknown when the track was persisted
+* (legacy rows / dims-less sources) and on active (in-RAM) tracks.
+*/
+var TrackEnvelopeSchema = object({
+	minX: number(),
+	minY: number(),
+	maxX: number(),
+	maxY: number()
 });
 /**
-* Re-embed stored tracks from their key frames.
-*
-* The reason this is an operator-callable method and not a migration script:
-* every knob that decides what a vector MEANS — encoder model, crop margin,
-* squaring — is only changeable if the existing vectors can be regenerated.
-* Mixing feature spaces in one index makes cosine scores incomparable, and the
-* symptom is a quality regression with no visible cause.
+* Row projection for track list queries. `full` (default) returns the
+* complete Track including the frame-rate `positions[]` history and the
+* `snapshots[]` references — megabytes across a page of tracks. `slim`
+* keeps every scalar the list surfaces actually render (ids, class(es),
+* label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
+* zonesVisited, bestEventId, envelope, hasFace, hasEmbeddedFace, hasRider) and returns `positions` /
+* `snapshots` as EMPTY arrays — detail views re-fetch the full row via
+* `getTrack`. Mirrors the event-store `projection` convention
+* (`getObjectEvents` et al.).
 */
-var RebuildObjectEmbeddingsInput = object({
-	/** Restrict to one camera. Omit for the whole fleet. */
-	deviceId: number().optional(),
-	since: number().optional(),
-	until: number().optional(),
-	/** Stop after this many tracks; the result reports whether more remain. */
-	maxTracks: number().int().positive().optional(),
-	/**
-	* Run every embedding on THIS node instead of round-robining the fleet.
-	*
-	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
-	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
-	* calling it that would pin the rebuild REQUEST itself to that node — the
-	* rebuild orchestration lives on the hub, and only the per-track step runs
-	* remotely. This field is data; the per-track pin is applied inside.
-	*
-	* Absent ⇒ round-robin over every online node whose runner can serve the
-	* pinned model.
-	*/
-	executeOnNodeId: string().optional(),
-	/**
-	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
-	* run flat out.
-	*
-	* A rebuild is bulk maintenance on hub-main's single thread. Measured
-	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
-	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
-	* force is logged at start and finish so a deliberately slow pass reads
-	* differently from a stalled one.
-	*/
-	pacingMs: number().int().nonnegative().optional()
+var TrackProjectionSchema = _enum(["full", "slim"]);
+/**
+* One audio-classification label heard on the track's camera while the
+* track was alive, aggregated per label. An "episode" is one persisted
+* audio event (the confident-classification path: score ≥ the device's
+* `classificationMinScore`, class-change-or-heartbeat coalesced) — NOT
+* one 32 ms inference chunk, so counts stay human-scaled.
+*/
+var TrackAudioLabelSchema = object({
+	label: string(),
+	/** Highest classification score observed across the label's episodes. */
+	peakScore: number(),
+	/** Number of coalesced audio-event episodes carrying this label. */
+	count: number(),
+	firstAt: number(),
+	lastAt: number()
 });
 /**
-* Result of emptying the CLIP index.
+* How a track was produced. `pipeline` (default / absent) = the spatial
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
 *
-* The clean slate before a policy change: a new crop margin or encoder model
-* leaves two feature spaces in one index whose cosine scores are not
-* comparable, so wiping and rebuilding is the only way to be sure every vector
-* means the same thing.
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
 */
-var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+var TrackSourceSchema = _enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
 /**
-* Acknowledgement that a rebuild STARTED.
+* Where a track sits in the RETRAIN lifecycle (D81).
 *
-* The pass costs ~1s per track — 45 minutes for a 2,600-track fleet — so it
-* runs detached and this returns immediately. Waiting for it made the client
-* time out while the work carried on server-side, which is the worst of both:
-* no result and no way to know it was still going. Poll
-* `getObjectEmbeddingRebuildStatus` for progress.
-*/
-var RebuildObjectEmbeddingsResultSchema = object({
-	started: boolean(),
-	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: boolean()
-});
-var RebuildStatusSchema = object({
-	running: boolean(),
-	scanned: number(),
-	rebuilt: number(),
-	/** Tracks whose key frame is gone — nothing to re-embed from. */
-	missingKeyFrame: number(),
-	/** Tracks with no usable detection box. */
-	missingBbox: number(),
-	/**
-	* Tracks an executing node REFUSED rather than broke on — an unreadable key
-	* frame, a step that threw. Separate from `failed` because the remedy is
-	* different, and because a whole camera silently contributing zero vectors
-	* is the shape of failure a rebuild must never hide.
-	*/
-	notRunnable: number(),
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = _enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
+*
+* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
+* A favourited track is skipped by retention the same way `staging` is, but
+* it does not enter `none|staging|trained` and has no staging budget.
+*/
+var TrackFlagFields = {
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
+	markForTrain: boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: boolean().optional(),
+	/** Operator favourited this track. Pins it against pruning. */
+	favourited: boolean().optional()
+};
+/**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
+*/
+var TrackFlagsSchema = object({
+	trackId: string(),
+	markForTrain: boolean(),
+	debug: boolean(),
+	favourited: boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+union([literal(1), literal(2)]);
+/**
+* WHO decided a label, and when. Carried per tier so a value can be traced to
+* the step and model that produced it — which is what makes the write rule
+* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
+* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
+*
+* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
+* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
+* `migration:4g` for a value the 4g migration moved from the single-slot era —
+* that value has no provenance, and the write rule lets ANY properly-attributed
+* write of the same tier replace it regardless of score.
+*/
+var LabelAttributionSchema = object({
+	stepId: string(),
+	modelId: string().optional(),
+	decidedAt: number(),
 	/**
-	* The pass stopped because NO node could serve the pinned model.
+	* The GALLERY id behind a recognised tier-2 label — a face-gallery
+	* `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
 	*
-	* Distinct from `notRunnable` on purpose: that one says "this track was
-	* refused", this one says "the cluster cannot do this work at all" — every
-	* candidate node either lacks the `clip-embedding` step, lacks a build of the
-	* pinned model for its engine format, or dropped out. The remedy is a model /
-	* engine change, not a per-camera one. Non-zero here always comes with
-	* `complete: false`.
+	* The text alone is a DISPLAY NAME, and a display name is renameable: a
+	* notification rule authored on "Gianluca" stopped matching the moment the
+	* operator fixed the spelling in the gallery, and nothing said so. The id is
+	* the thing that does not move, so it is what a rule matches on
+	* (`NcConditions.identities`) and the text is what a human is shown.
+	*
+	* Absent when the label names no gallery row — a plate the OCR read but no
+	* vehicle claims, a sub-class, a species, any tier-1 value.
 	*/
-	noCapableNode: number(),
-	failed: number(),
-	/** Set once a pass ends: true only when EVERYTHING was covered. */
-	complete: boolean().nullable(),
-	startedAtMs: number().nullable(),
-	finishedAtMs: number().nullable(),
-	/** Present when the pass ended by throwing. */
-	error: string().nullable()
+	identityId: string().optional()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).readonly()), method(object({
-	deviceId: number(),
-	trackId: string()
-}), TrackSchema.nullable()), method(object({
-	deviceId: number(),
-	since: number().optional(),
-	until: number().optional(),
-	limit: number().optional(),
-	/** Spatial filter — only tracks whose trajectory intersects the zone
-	*  (normalized 0..1 rect or polygon). SQL-prefiltered on the persisted
-	*  envelope columns, then precisely tested per position. Tracks with
-	*  an unknown envelope (no frame dims at persist time) always match. */
-	zone: TrackZoneFilterSchema.optional(),
-	/** See {@link TrackProjectionSchema}. Default `full` (backward
-	*  compatible — omitting the field keeps today's exact behaviour). */
-	projection: TrackProjectionSchema.optional(),
-	/** Include stationary-promoted rows (parked objects handed to the
-	*  stationary registry). Default false: the timeline lists passages,
-	*  not parking records (operator decision, 2026-08-15). */
-	includeStationary: boolean().optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(ListGroupsQueryInput, ListGroupsPageSchema), method(object({
-	deviceId: number(),
-	groupId: string().min(1)
-}), AnalyticsGroupDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
-	deviceId: number(),
-	since: number().optional(),
-	until: number().optional(),
-	kinds: array(string()).optional(),
-	limit: number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT)
-}), array(SensorEventSchema).readonly()), method(KeyEventQueryInput, array(KeyEventSchema).readonly()), method(object({
-	deviceId: number(),
-	since: number(),
-	until: number(),
-	bucketMs: number().int().positive()
-}), array(object({
-	bucketStart: number(),
-	motion: number().int(),
-	object: number().int(),
-	audio: number().int()
-})).readonly()), method(object({
+/**
+* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
+* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
+* track and its events always answer the same question the same way.
+*
+* Two scalar columns, not an array: every consumer wants "the coarse one" or
+* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
+* is tier 2, and each carries its own score + attribution.
+*
+* **Reading it.** What a human should be shown is `subLabel ?? label` — the
+* finest thing known. Before 4g the single `label` column held the finest
+* value, so a consumer that has not been updated reads the tier-1 slot and
+* shows nothing on a species-only row; that is why the migration puts every
+* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
+* and why the read surfaces were changed in the same train.
+*
+* **Writing it.** The slots are independent, which is the whole point: a
+* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
+* migratorius`), so fineness cannot regress by construction. Within a tier the
+* higher score wins. One rule, one implementation — see
+* `pipeline/label-tier.ts` in addon-post-analysis.
+*/
+var TieredLabelFields = {
+	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
+	label: string().optional(),
+	/** Confidence of the tier-1 value, as reported by the deciding step. */
+	labelScore: number().optional(),
+	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
+	labelMeta: LabelAttributionSchema.optional(),
+	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
+	subLabel: string().optional(),
+	/** Confidence of the tier-2 value, as reported by the deciding step. */
+	subLabelScore: number().optional(),
+	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
+	subLabelMeta: LabelAttributionSchema.optional()
+};
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = object({
 	deviceId: number(),
-	cutoffMs: number()
-}), object({
-	motion: number().int(),
-	object: number().int(),
-	audio: number().int()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
+	tracks: number().int(),
+	files: number().int(),
+	bytes: number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = object({
+	generatedAt: number(),
+	trackCount: number().int(),
+	fileCount: number().int(),
+	byteCount: number().int(),
+	/** More marked tracks exist than a single pass carries. */
+	truncated: boolean(),
+	devices: array(TrainingExportDeviceTotalsSchema).readonly()
+});
+var TrackSchema = object({
+	trackId: string(),
 	deviceId: number(),
-	cutoffMs: number()
-}), TrackCascadeCountsSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number() }), TrackCascadeCountsSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number() }), DiskReconcileCountsSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackIds: array(string()).min(1)
-}), object({
-	deleted: number().int(),
-	failed: array(string()).readonly()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	/** Log/audit scope only — the trackId is globally unique on its own. */
-	deviceId: number(),
-	trackId: string(),
-	flags: TrackFlagsPatchSchema
-}), TrackFlagsSchema, { kind: "mutation" }), method(object({}), EventStoreFootprintSchema, {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	olderThanMs: number(),
-	reason: OpsLogReasonSchema.optional()
-}), EventPruneCountsSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number() }), EventPruneCountsSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(StorageMigrationLeaseInputSchema, object({ resumed: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(StorageMigrationLeaseInputSchema, object({ refreshed: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(StorageMigrationMediaMoveInputSchema, object({ jobId: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
-	kind: "query",
-	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), TrainingExportSummarySchema, {
-	kind: "query",
-	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
-	*  `deviceId`, deliberately: `deviceId` would make this device-bound and
-	*  route it at one camera's owner, and "every camera" would stop being
-	*  expressible at all. */
-	deviceIds: array(number()).optional(),
-	limit: number().int().min(1).max(500).optional()
-}), array(RetrainTrackSchema).readonly(), {
-	kind: "query",
-	auth: "admin"
-}), method(object({ trackId: string() }), RetrainFrameListSchema, {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackId: string(),
-	mediaKeys: array(string()).min(1)
-}), RetrainFrameSelectionSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
+	className: string(),
+	...TieredLabelFields,
+	producingDeviceName: string().optional(),
+	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
+	source: TrackSourceSchema.optional(),
+	firstSeen: number(),
+	lastSeen: number(),
+	/** Frame-rate position history (subject to maxPositionHistory cap). */
+	positions: array(TrackPositionSchema).readonly(),
+	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
+	*  saveThumbnails policy). */
+	snapshots: array(TrackSnapshotSchema).readonly(),
+	/** Deduplicated zones the track has entered at least once. Zone IDS. */
+	zonesVisited: array(string()).readonly(),
+	/**
+	* Human NAMES for {@link zonesVisited}, resolved at READ time against the
+	* `zones` capability.
+	*
+	* `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
+	* and no card can render — so every free-text search surface was structurally
+	* unable to answer "show me the tracks in Uscio", and did not fail loudly, it
+	* just returned nothing. Resolving here rather than in each client keeps ONE
+	* derivation and costs the clients no extra call (the `zones` cap is
+	* per-device, so a client-side resolve would be a per-camera fan-out on a
+	* surface built to avoid exactly that).
+	*
+	* Resolved, never invented: a zone deleted since the track was written has no
+	* name and is DROPPED, so this array can be shorter than `zonesVisited` — the
+	* two are not positionally aligned. Absent when the track visited no zone, or
+	* when the zone catalogue could not be read.
+	*/
+	zoneNames: array(string()).readonly().optional(),
+	/** Deduplicated set of detector classes observed for this track over its
+	*  life (a track may be reclassified, e.g. person→vehicle). Absent on
+	*  legacy rows written before class accumulation shipped. */
+	classes: array(string()).readonly().optional(),
+	/** Cumulative normalized distance travelled (0..1 units = full frame width). */
+	totalDistance: number(),
+	state: TrackStateSchema,
+	active: boolean(),
+	/** Deterministic key-event importance score in [0,1] (server-computed at
+	*  track expiry, recomputed on late label). Absent on legacy rows written
+	*  before scoring shipped — consumers degrade to absence / compute-on-read. */
+	importance: number().optional(),
+	/** Id of the track's highest-confidence ObjectEvent (its representative
+	*  "best" frame). Absent when the track produced no object events. */
+	bestEventId: string().optional(),
+	/** Tag of the importance sub-signal that dominated the score
+	*  (identity|dwell|proximity|class|confidence|travel|zone). */
+	importanceReason: string().optional(),
+	/** Audio-classification labels heard on the camera during the track's
+	*  life (score ≥ device `classificationMinScore`), aggregated per label.
+	*  Absent on legacy rows / tracks with no confident audio. */
+	audioLabels: array(TrackAudioLabelSchema).readonly().optional(),
+	/** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
+	*  Populated from the persisted envelope columns on historical reads;
+	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
+	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: boolean().optional(),
+	/**
+	* This track has a face row IN THE GALLERY: a crop **and** an embedding — a
+	* face an operator could ASSIGN to an identity.
+	*
+	* The STRICT twin of {@link hasFace}, and the pair only earns its keep
+	* because the two disagree. `hasFace` is stamped at the TOP of the face
+	* branch, before every gate, and means no more than "a face detector produced
+	* a face detail". This one is stamped at the single moment the gallery row
+	* LANDS — after `FaceRecognizer.onTrackEnd` successfully persists it, i.e.
+	* past the embedding-magnitude verdict, the `minFacePx` detection gate, the
+	* candidate gate, the imageless-track drop (no crop was ever captured) and
+	* the crop-store drop. Everything between the detector and that insert can
+	* legitimately refuse the face, so a flag written any earlier promises the
+	* operator something to assign and delivers nothing.
+	*
+	* **Independent of recognition.** A face collected but never auto-matched is
+	* still assignable — it is in fact the face an operator most wants to reach —
+	* so this is NOT gated on `recognizedIdentityId`. Recognition lands in
+	* `subLabel`; this says only that the raw material exists.
+	*
+	* **Set once, never cleared.** A track that produced a gallery row produced
+	* one; deleting the row later is the gallery's business, not this flag's.
+	*
+	* **Absent ≠ false**, the same rule as {@link hasFace}: every row written
+	* before the column omits it, and so does every server that predates the
+	* field. A consumer must test `=== true` and render nothing otherwise —
+	* never infer "no assignable face".
+	*/
+	hasEmbeddedFace: boolean().optional(),
+	/**
+	* This subject CONTAINS a folded rider — a person the rider-pairing step
+	* ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
+	* so the passage is tracked once and as a VEHICLE.
+	*
+	* It exists because the fold's record was dishonest. D34 and the code both
+	* said "the person is not lost — it is reported so both entities stay on the
+	* record"; in fact the pair went into a per-processor RAM field behind an
+	* accessor nobody called, and every durable surface said `vehicle`, full
+	* stop. This is the composition note that makes the row true.
+	*
+	* A COMPOSITION, never a class and never a label. "This vehicle contains a
+	* person" is not an answer to "what is this" — both label tiers would refuse
+	* a macro token anyway (D89), and correctly. Nothing here changes what the
+	* subject IS: a cyclist stays one vehicle track, occupancy still counts one,
+	* and a `person` rule still does not fire for someone cycling past.
+	*
+	* **Absent ≠ false**, exactly like {@link hasFace}: every row written before
+	* the column, and every hub that predates the field, omits it. Test
+	* `=== true` and render nothing otherwise — never infer "no rider".
+	*/
+	hasRider: boolean().optional(),
+	...TrackFlagFields,
+	...TrackRetrainFields
+});
+var BaseEventFields = {
+	id: string(),
 	deviceId: number(),
-	trackId: string(),
-	frameId: string()
-}), object({
-	removed: boolean(),
-	removedAnnotations: number().int()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ frameId: string() }), object({
+	timestamp: number()
+};
+var MotionEventSchema = object({
+	...BaseEventFields,
+	kind: literal("motion"),
+	regionCount: number(),
+	/** Heavy JSON array — omitted in slim projection. */
+	regions: array(object({
+		bbox: BoundingBoxSchema,
+		pixelCount: number(),
+		intensity: number()
+	})).readonly().optional(),
+	/** Omitted in slim projection. */
+	frameWidth: number().optional(),
+	/** Omitted in slim projection. */
+	frameHeight: number().optional(),
+	/** Populated by B5 (recording playback URL for this event). */
+	mediaUrl: string().optional()
+});
+/**
+* Which detection SOURCE produced an object event. `pipeline` = the ML
+* detection pipeline (decoded-frame inference); `onboard` = the camera's
+* native on-device AI. Both flow through the SAME analysis layers (zoning,
+* tracking, per-kind persistence) but stay distinguishable so consumers
+* (advanced-notifier, occupancy, …) can select which source(s) to act on.
+* Absent on legacy rows ⇒ treat as `pipeline`.
+*/
+var DetectionSourceSchema = _enum(["pipeline", "onboard"]);
+/**
+* The confirmed zone crossing that produced an object event. Present ONLY on
+* an event emitted BY a crossing (`zone.enter` / `zone.exit`); a movement-state
+* event (`object.entering` / `leaving` / `stationary` / `loitering`) and an
+* appearance event carry none, so a rule asking for a direction fails closed
+* on them.
+*
+* Exactly ONE crossing per event: the emitter turns each confirmed crossing
+* into its own event, so a frame in which a track enters A while leaving B
+* produces two events with two directions — never one ambiguous row.
+*
+* `zoneId` is load-bearing for an EXIT: the event's `zones` list is the
+* membership the box has NOW, and by definition it no longer contains the zone
+* that was just left. Without the id here, a zone-scoped rule could never match
+* the exit it asked for.
+*/
+var ZoneCrossingSchema = object({
+	direction: _enum(["enter", "exit"]),
+	/** Admin zone id crossed. */
+	zoneId: string(),
+	/** Zone display name at crossing time (falls back to the id). */
+	zoneName: string().optional()
+});
+var ObjectEventSchema = object({
+	...BaseEventFields,
+	kind: literal("object"),
+	/** Detection source. Optional for backward-compat; absent ⇒ `pipeline`. */
+	source: DetectionSourceSchema.optional(),
+	/**
+	* Inference-frame id shared by every object event emitted from the SAME frame
+	* — the "scene/parent" key. Lets a consumer group co-occurring detections (e.g.
+	* 2 people + 1 dog) under one full frame, and link a track's frames over time
+	* (group by `trackId`, pick a representative `frameId` as the parent frame).
+	* Optional for backward-compat with pre-existing rows / the slim projection
+	* includes it (it is light). Absent on rows written before this field.
+	*/
+	frameId: string().optional(),
+	/** Omitted in slim projection. */
+	trackId: string().optional(),
+	className: string(),
+	...TieredLabelFields,
+	/** Omitted in slim projection. */
+	confidence: number().optional(),
+	/** Heavy JSON — omitted in slim projection. */
+	bbox: BoundingBoxSchema.optional(),
+	/** Heavy JSON — omitted in slim projection. */
+	zones: array(string()).readonly().optional(),
+	/** Omitted in slim projection. */
+	state: TrackStateSchema.optional(),
+	/**
+	* The zone crossing this event IS, when it is one. Absent on every other
+	* event kind (movement state, appearance, package) — see
+	* {@link ZoneCrossingSchema}. Omitted in slim projection.
+	*/
+	zoneCrossing: ZoneCrossingSchema.optional(),
+	/** Detection-frame dimensions in pixels — let consumers normalize the
+	*  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
+	frameWidth: number().optional(),
+	frameHeight: number().optional(),
+	/** MediaStore key for the crop attached to this event (if any). */
+	mediaKey: string().optional(),
+	/** Design B: MediaStore key of the track's native-resolution key frame (the
+	*  best-detection full frame). Resolve via the event-media data-plane
+	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+	*  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
+	*  sources — consumers fall back to `mediaKey` (the tight crop). */
+	keyFrameMediaKey: string().optional(),
+	/** Populated by B5 (recording playback URL for this event). */
+	mediaUrl: string().optional(),
+	/** The parent track's key-event importance [0,1], propagated to every object
+	*  event of the track (so an event row can be sorted by importance without a
+	*  track join). Absent on legacy rows / before the track was scored. */
+	importance: number().optional()
+});
+var AudioEventSchema = object({
+	...BaseEventFields,
+	kind: literal("audio"),
+	rms: number(),
+	dbfs: number(),
+	classification: object({
+		className: string(),
+		originalClass: string().optional(),
+		score: number()
+	}).optional(),
+	/** Populated by B5 (recording playback URL for this event). */
+	mediaUrl: string().optional()
+});
+var MediaFileKindEnum = _enum([
+	"crop",
+	"thumbnail",
+	"snapshot",
+	"firstFrame",
+	"lastFrame",
+	"fullFrame",
+	"fullFrameBoxed",
+	"faceCrop",
+	"plateCrop",
+	"keyFrame",
+	"keyFrameSmall",
+	"thumbnailSmall"
+]);
+var MediaFileSchema = object({
+	key: string(),
+	kind: MediaFileKindEnum,
 	base64: string(),
-	width: number().int(),
-	height: number().int()
-}), {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackId: string(),
-	frameId: string(),
-	subject: RetrainAssistSubjectSchema,
-	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
-	nodeId: string().optional()
-}), RetrainAssistResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
+	sizeBytes: number(),
+	timestamp: number()
+});
+/**
+* One media row WITHOUT its bytes.
+*
+* A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
+* 140 s track), and a client that renders tiles from the media data plane needs
+* to know only WHAT EXISTS — the bytes then arrive per tile, lazily, over HTTP
+* with an immutable cache, instead of all at once inside a tRPC response that
+* blocks the whole view.
+*
+* `sizeBytes` is carried because it is what lets a client decide between the
+* stored blob and a `?variant=thumb` rendering without fetching either.
+*/
+var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
+/**
+* The MACRO tier of an annotation — a CLOSED set.
+*
+* This is what the exported detector predicts, so a typo here is a new class
+* with one example in it. `label` and `subLabel` are open strings by contrast:
+* the whole point of the page is teaching the model things it does not know
+* yet, and constraining that vocabulary would make it useless.
+*
+* A macro class is NEVER a label. The provider refuses a write whose `label` or
+* `subLabel` is one of these values, in any casing, because once `person`
+* exists in both tiers "every person box" stops being answerable without
+* knowing every string anyone ever typed — and the damage is retroactive.
+*/
+var RetrainMacroClassSchema = _enum([
+	"person",
+	"vehicle",
+	"animal",
+	"package",
+	"face",
+	"plate"
+]);
+/** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
+var RetrainAnnotationKindSchema = _enum(["subject", "model_error"]);
+/** Did a human draw this box, or did the assist propose it? */
+var RetrainAnnotationSourceSchema = _enum(["operator", "assist"]);
+/** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
+var RetrainBboxSchema = object({
+	x: number(),
+	y: number(),
+	w: number(),
+	h: number()
+});
+/**
+* One annotated subject.
+*
+* `bbox` is normalised against the full frame, ALWAYS. The per-model shapes
+* (letterboxed root / zone-cropped package / subject-cropped classifier) are
+* derived from it at export and never stored — storing them is how one feature
+* space ends up holding two crops of the same subject (D52).
+*/
+var RetrainAnnotationSchema = object({
+	id: string(),
 	trackId: string(),
-	frameId: string(),
-	annotations: array(RetrainAnnotationDraftSchema)
-}), array(RetrainAnnotationSchema).readonly(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	trackId: string()
-}), RetrainTransitionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
 	deviceId: number(),
-	trackId: string()
-}), RetrainTransitionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	eventId: string(),
-	kind: MediaFileKindEnum.optional(),
-	deviceId: number()
-}), array(MediaFileSchema).readonly()), method(object({
-	trackId: string(),
-	kinds: array(MediaFileKindEnum).optional(),
-	deviceId: number()
-}), array(MediaFileSchema).readonly()), method(object({
+	/** The COPY in retrain storage — never the source track's media key. */
+	mediaKey: string(),
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: string().optional(),
+	subLabel: string().optional(),
+	kind: RetrainAnnotationKindSchema,
+	source: RetrainAnnotationSourceSchema,
+	/** Which model proposed this box — or, on a `model_error`, drew the phantom. */
+	assistModelId: string().optional(),
+	assistScore: number().optional(),
+	exportedInBatch: string().optional(),
+	createdAt: number()
+});
+/** The write form — the server owns `id`, `createdAt` and the frame binding. */
+var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
+	id: true,
+	trackId: true,
+	deviceId: true,
+	mediaKey: true,
+	createdAt: true,
+	exportedInBatch: true
+});
+/** A track sitting in `staging`, with everything the worklist needs to rank it. */
+var RetrainTrackSchema = object({
 	trackId: string(),
-	deviceId: number()
-}), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), RebuildStatusSchema), object({
 	deviceId: number(),
+	className: string(),
+	label: string().optional(),
+	firstSeen: number(),
+	lastSeen: number(),
+	/** How many frames the dataset already holds from this track. */
+	frameCount: number().int(),
+	/** How many subjects have been annotated on those frames. `0` with
+	*  `frameCount: 0` is exactly "staging, still to work". */
+	annotationCount: number().int()
+});
+/** A frame the picker may offer — an index row, no blob was read to produce it. */
+var RetrainFrameCandidateSchema = object({
+	mediaKey: string(),
+	kind: MediaFileKindEnum,
 	timestamp: number(),
-	frameWidth: number(),
-	frameHeight: number(),
-	detections: array(OverlayDetectionSchema).readonly()
-}), object({
+	sizeBytes: number().int(),
+	/** A copy of this original already exists — selecting it is free and cannot
+	*  fail, whatever became of the original. */
+	copied: boolean()
+});
+/** A frame the dataset OWNS: bytes copied at selection time. */
+var RetrainFrameSchema = object({
+	frameId: string(),
 	deviceId: number(),
 	trackId: string(),
-	className: string()
+	/** Provenance only. It may already point at nothing — that is expected. */
+	sourceMediaKey: string(),
+	sourceKind: MediaFileKindEnum,
+	sizeBytes: number().int(),
+	width: number().int(),
+	height: number().int(),
+	copiedAt: number()
+});
+/** Why a copy-on-select could not be honoured — named, never a silent skip. */
+var RetrainCopyRefusalSchema = _enum([
+	"source-missing",
+	"unreadable-image",
+	"write-failed"
+]);
+var RetrainFrameSelectionSchema = object({
+	copied: array(RetrainFrameSchema).readonly(),
+	refused: array(object({
+		sourceMediaKey: string(),
+		reason: RetrainCopyRefusalSchema
+	})).readonly()
+});
+var RetrainFrameListSchema = object({
+	candidates: array(RetrainFrameCandidateSchema).readonly(),
+	copies: array(RetrainFrameSchema).readonly(),
+	/** What the page pre-selects — the native key frame when one survives. */
+	autoPickMediaKey: string().optional()
+});
+/** What the operator asked the assist to look for. */
+var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("package"),
+	zone: RetrainBboxSchema.optional()
 }), object({
-	deviceId: number(),
-	trackId: string(),
-	className: string(),
-	durationMs: number()
+	kind: literal("objects"),
+	modelId: string(),
+	minScore: number().optional()
+})]);
+/**
+* The assist's answer — a discriminated union, because "the model saw nothing"
+* and "this node cannot run that model" lead to different next moves and a
+* nullable result cannot tell them apart.
+*/
+var RetrainAssistResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("proposed"),
+	modelId: string(),
+	stepId: string(),
+	minScore: number(),
+	/** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
+	proposals: array(RetrainAnnotationDraftSchema).readonly(),
+	/** Returned by the runner but removed by the threshold. */
+	belowThreshold: number().int()
 }), object({
+	kind: literal("refused"),
+	/** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
+	reason: string(),
+	detail: string().optional()
+})]);
+/** The outcome of a lifecycle move owned by the retrain page. */
+var RetrainTransitionResultSchema = object({
+	trackId: string(),
+	/** Where the track ended up, whatever happened. */
+	retrainStatus: RetrainStatusSchema,
+	/** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
+	changed: boolean(),
+	reason: _enum([
+		"unknown-track",
+		"no-frames-copied",
+		"not-staging",
+		"not-trained",
+		"unchanged"
+	]).optional()
+});
+var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
+var MAX_EVENT_QUERY_LIMIT = 5e3;
+var DeviceEventQueryInput = object({
 	deviceId: number(),
-	kind: EventKindSchema,
-	eventId: string(),
-	timestamp: number()
+	since: number().optional(),
+	until: number().optional(),
+	limit: number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT),
+	/** `slim` drops heavy JSON fields (regions/bbox/zones) and carries an
+	*  optional `mediaUrl` (populated by B5). `full` (default) keeps today's
+	*  exact behaviour. Callers may omit this field — the store defaults to
+	*  `full` when not provided. */
+	projection: _enum(["full", "slim"]).optional()
 });
-/**
-* Reference to the frame's retained NATIVE surface + the parent crop's placement
-* within the frame, so the executor can re-cut a leaf child ROI at native
-* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
-*/
-var NativeCropRefSchema = object({
-	/** Handle keying the retained native surface (node-pinned to its owner). */
-	handle: FrameHandleSchema,
-	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-	cropFrameSpace: object({
-		x: number(),
-		y: number(),
-		w: number(),
-		h: number()
-	})
+var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: string().optional() });
+var RecentTracksQueryInput = object({
+	/** Devices to merge. An empty array yields `{ tracks: [], nextCursor: null }`. */
+	deviceIds: array(number()),
+	/** Window lower bound on `lastSeen` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `lastSeen` (inclusive). */
+	until: number().optional(),
+	/** Page size. Default 200, max 1000. */
+	limit: number().int().min(1).max(1e3).default(200),
+	/** Opaque continuation cursor from a previous page's `nextCursor`.
+	*  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
+	cursor: string().optional(),
+	/** See {@link TrackProjectionSchema}. Default `full`. */
+	projection: TrackProjectionSchema.optional(),
+	/** Include stationary-promoted rows (parked objects). Default false: the
+	*  feed lists passages; parking records live on the stationary registry. */
+	includeStationary: boolean().optional()
 });
-object({
-	crop: object({
-		left: number(),
-		top: number(),
-		width: number().positive(),
-		height: number().positive()
-	}).optional(),
-	content: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}),
-	fit: _enum(["stretch", "contain"]),
-	format: _enum([
-		"rgb",
-		"gray",
-		"jpeg"
-	])
+var RecentTracksPageSchema = object({
+	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
+	tracks: array(TrackSchema).readonly(),
+	/** Cursor for the next page, or null when this page is the last. */
+	nextCursor: string().nullable()
 });
-var FrameRefSchema = object({
-	registryId: string().min(1),
-	id: string().min(1),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum(["rgb", "gray"]),
-	timestamp: number(),
-	capturedAt: number().optional()
+var LIST_GROUPS_DEFAULT_LIMIT = 40;
+var LIST_GROUPS_MAX_LIMIT = 100;
+var AnalyticsGroupRecordSchema = object({
+	id: string(),
+	deviceId: number().int(),
+	openedAt: number().int(),
+	closedAt: number().int(),
+	timestamp: number().int(),
+	memberCount: number().int(),
+	memberTrackIds: array(string()).readonly(),
+	className: string(),
+	classes: array(string()).readonly(),
+	/** Relative event-media path, or null when the group has no picture yet. */
+	mediaUrl: string().nullable(),
+	singleton: boolean()
 });
-var ModelFormatSchema$1 = _enum([
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-]);
-var PipelineSlotSchema = _enum([
-	"detector",
-	"cropper",
-	"classifier",
-	"refiner",
-	"audio-classifier"
-]);
-var PipelineEngineChoiceSchema = object({
-	runtime: _enum(["node", "python"]),
-	backend: string(),
-	format: ModelFormatSchema$1,
-	device: string().optional()
+var AnalyticsGroupMemberSchema = object({
+	trackId: string(),
+	deviceId: number().int(),
+	className: string(),
+	firstSeen: number().int(),
+	lastSeen: number().int(),
+	mediaUrl: string().nullable()
 });
-var AvailableEngineSchema = object({
-	engine: PipelineEngineChoiceSchema,
-	devices: array(object({
-		id: string(),
-		label: string(),
-		description: string().optional()
-	})).readonly(),
-	defaultDevice: string()
+var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: array(AnalyticsGroupMemberSchema).readonly() });
+var ListGroupsQueryInput = object({
+	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+	deviceIds: array(number()),
+	/** Window lower bound on `closedAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `openedAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string().optional()
 });
-var PipelineDefaultStepSchema = lazy(() => object({
-	addonId: string(),
-	addonName: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineDefaultStepSchema).readonly(),
-	group: string().optional(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
+var ListGroupsPageSchema = object({
+	groups: array(AnalyticsGroupRecordSchema).readonly(),
+	nextCursor: string().nullable()
+});
+var KeyEventQueryInput = object({
+	deviceId: number(),
+	/** Window lower bound (track firstSeen ≥ since). */
+	since: number(),
+	/** Window upper bound (track firstSeen ≤ until). */
+	until: number(),
+	limit: number().int().min(1).max(200).default(50),
+	/** Drop tracks scoring below this importance. */
+	minImportance: number().min(0).max(1).optional(),
+	/** Restrict to a single class (e.g. 'person'). */
+	classFilter: string().optional()
 });
-var PipelineModelOptionSchema = object({
+var KeyEventSchema = object({
+	/** The representative event id (the track's best ObjectEvent, else its trackId). */
 	id: string(),
-	name: string(),
-	formats: record(string(), object({
-		downloaded: boolean(),
-		sizeMB: number()
-	})),
-	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
+	trackId: string(),
+	/** Track start time (firstSeen). */
+	timestamp: number(),
+	className: string(),
+	...TieredLabelFields,
+	importance: number(),
+	/** Highest-confidence ObjectEvent id for the track (empty when none). */
+	bestEventId: string(),
+	/** Track lifetime in ms (lastSeen - firstSeen). */
+	windowMs: number().optional(),
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
-var ConfigFieldBridge = custom();
-var PipelineAddonSchemaSchema = object({
-	id: string(),
-	name: string(),
-	slot: PipelineSlotSchema,
-	inputClasses: array(string()).readonly(),
-	outputClasses: array(string()).readonly(),
-	childSlots: array(PipelineSlotSchema).readonly(),
-	models: array(PipelineModelOptionSchema).readonly(),
-	defaultModelId: string(),
-	defaultModelIdByFormat: record(string(), string()).optional(),
-	enabledByDefault: boolean().optional(),
-	backfillIntoExistingOverrides: boolean().optional(),
-	defaultConfidence: number(),
-	group: string().optional(),
-	configSchema: array(ConfigFieldBridge).readonly().optional()
+object({
+	trackId: string(),
+	className: string(),
+	confidence: number(),
+	bbox: BoundingBoxSchema,
+	zones: array(string()).readonly(),
+	state: TrackStateSchema
 });
-var PipelineSlotSchemaSchema = object({
-	id: PipelineSlotSchema,
-	label: string(),
-	priority: number(),
-	parentSlot: PipelineSlotSchema.nullable(),
-	addons: array(PipelineAddonSchemaSchema).readonly()
+var OverlayDetectionSchema = looseObject({
+	id: string(),
+	kind: _enum(["first-level", "detail"]),
+	macroClass: string(),
+	score: number(),
+	bbox: object({
+		x: number(),
+		y: number(),
+		width: number(),
+		height: number()
+	}),
+	labels: array(looseObject({
+		label: string(),
+		score: number()
+	})).readonly(),
+	parentId: string().optional()
 });
-var PipelineSchemaSchema = object({
-	availableEngines: array(AvailableEngineSchema).readonly(),
-	selectedEngine: PipelineEngineChoiceSchema,
-	slots: array(PipelineSlotSchemaSchema).readonly()
+var ScoredObjectEventSchema = ObjectEventSchema.extend({ score: number() });
+var SearchObjectEventsInput = object({
+	text: string(),
+	deviceId: number().optional(),
+	since: number().optional(),
+	until: number().optional(),
+	classFilter: string().optional(),
+	limit: number().default(50),
+	minScore: number().min(0).max(1).default(.2)
 });
-var EngineProvisioningSchema = object({
-	runtimeId: _enum([
-		"onnx",
-		"openvino",
-		"coreml",
-		"edgetpu"
-	]).nullable(),
-	device: string().nullable(),
-	state: _enum([
-		"idle",
-		"installing",
-		"verifying",
-		"ready",
-		"failed"
-	]),
-	progress: number().optional(),
-	error: string().optional(),
-	nextRetryAt: number().optional(),
-	/**
-	* Gate A (config-correctness gate at engine change): human-readable
-	* config issues surfaced EAGERLY when the node's engine changes — model
-	* substitutions ("chose X, running Y") and zero-build steps ("no model
-	* has a <format> build"). Additive/optional: informational only, never
-	* enforced here — `assertEngineReady` (readiness) still gates inference.
-	* Absent/empty when the node-default tree resolves cleanly.
-	*/
-	configIssues: array(string()).optional()
+var TrackCascadeCountsSchema = object({
+	/** Persisted track roots deleted (authoritative). */
+	tracks: number().int(),
+	/** Object events removed with their tracks (best-effort; see note above). */
+	events: number().int(),
+	/** Track/face/plate-owned media removed (best-effort). Never identity media. */
+	media: number().int(),
+	/** Unassigned (non-enrolled) face reads removed (best-effort). */
+	faces: number().int(),
+	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
+	plates: number().int(),
+	/** Per-track CLIP search vectors removed (best-effort). */
+	embeddings: number().int(),
+	/** Group membership + group rows removed with their last member (best-effort). */
+	groups: number().int()
 });
-var PipelineStepInputSchema = lazy(() => object({
-	addonId: string(),
-	modelId: string().optional(),
-	enabled: boolean().default(true),
-	children: array(PipelineStepInputSchema).optional(),
-	settings: record(string(), unknown()).optional(),
-	jumpDeviceKey: string().optional()
-}));
-var ModelSubstitutionSchema = object({
-	addonId: string(),
-	chosen: string(),
-	running: string(),
-	format: string()
+/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
+var DiskReconcileCountsSchema = object({
+	mediaDropped: number().int(),
+	tracks: number().int(),
+	events: number().int()
 });
-var PipelineValidationIssueSchema = object({
-	addonId: string(),
-	kind: _enum(["unknown-addon", "no-format-build"]),
-	detail: string()
+/** Event-store footprint for one camera. */
+var EventStoreDeviceFootprintSchema = object({
+	deviceId: number(),
+	/** Persisted event rows (motion + object + audio) for the camera. */
+	rows: number().int(),
+	/** Event-owned media bytes on disk for the camera. */
+	bytes: number().int()
 });
-var PipelineValidationResultSchema = object({
-	ok: boolean(),
-	issues: array(PipelineValidationIssueSchema).readonly(),
-	substitutions: array(ModelSubstitutionSchema).readonly(),
-	/** The node's `currentEngine.format` this validation ran against. */
-	format: string()
+/** Aggregate event-store footprint: global totals + per-camera breakdown. */
+var EventStoreFootprintSchema = object({
+	totalRows: number().int(),
+	totalBytes: number().int(),
+	devices: array(EventStoreDeviceFootprintSchema).readonly()
 });
-var ReferenceImageEntrySchema = object({
-	filename: string(),
-	stepIds: array(string()).readonly().optional()
+/** Per-kind counts returned by the event-prune / device-delete mutations. */
+var EventPruneCountsSchema = object({
+	motion: number().int(),
+	object: number().int(),
+	audio: number().int()
 });
-var ReferenceImageBodySchema = object({
-	base64: string(),
-	filename: string()
+/**
+* Re-embed stored tracks from their key frames.
+*
+* The reason this is an operator-callable method and not a migration script:
+* every knob that decides what a vector MEANS — encoder model, crop margin,
+* squaring — is only changeable if the existing vectors can be regenerated.
+* Mixing feature spaces in one index makes cosine scores incomparable, and the
+* symptom is a quality regression with no visible cause.
+*/
+var RebuildObjectEmbeddingsInput = object({
+	/** Restrict to one camera. Omit for the whole fleet. */
+	deviceId: number().optional(),
+	since: number().optional(),
+	until: number().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: number().int().positive().optional(),
+	/**
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
+	*/
+	executeOnNodeId: string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: number().int().nonnegative().optional()
 });
-var ReferenceAudioEntrySchema = object({
-	filename: string(),
-	sizeKb: number()
+/**
+* Result of emptying the CLIP index.
+*
+* The clean slate before a policy change: a new crop margin or encoder model
+* leaves two feature spaces in one index whose cosine scores are not
+* comparable, so wiping and rebuilding is the only way to be sure every vector
+* means the same thing.
+*/
+var WipeObjectEmbeddingsResultSchema = object({ deleted: number() });
+/**
+* Acknowledgement that a rebuild STARTED.
+*
+* The pass costs ~1s per track — 45 minutes for a 2,600-track fleet — so it
+* runs detached and this returns immediately. Waiting for it made the client
+* time out while the work carried on server-side, which is the worst of both:
+* no result and no way to know it was still going. Poll
+* `getObjectEmbeddingRebuildStatus` for progress.
+*/
+var RebuildObjectEmbeddingsResultSchema = object({
+	started: boolean(),
+	/** True when a pass was already running; the new request is ignored. */
+	alreadyRunning: boolean()
 });
-var ReferenceAudioBodySchema = object({ base64: string() });
-var AudioBackendSchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	available: boolean(),
+var RebuildStatusSchema = object({
+	running: boolean(),
+	scanned: number(),
+	rebuilt: number(),
+	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	missingKeyFrame: number(),
+	/** Tracks with no usable detection box. */
+	missingBbox: number(),
+	/**
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
+	*/
+	notRunnable: number(),
 	/**
-	* Raw classifier labels this backend can emit (e.g. YAMNet's
-	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
-	* the benchmark UI to populate the `enabledMicroClasses` filter
-	* specific to the selected backend without a separate fetch.
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
 	*/
-	rawLabels: array(string()).readonly().optional()
-});
-var AudioCapabilitiesSchema = object({
-	activeBackend: string(),
-	availableBackends: array(AudioBackendSchema).readonly(),
-	sampleRate: number(),
-	chunkDurationMs: number()
-});
-var DownloadModelResultSchema = object({
-	filePath: string(),
-	sizeMB: number(),
-	durationMs: number()
+	noCapableNode: number(),
+	failed: number(),
+	/** Set once a pass ends: true only when EVERYTHING was covered. */
+	complete: boolean().nullable(),
+	startedAtMs: number().nullable(),
+	finishedAtMs: number().nullable(),
+	/** Present when the pass ended by throwing. */
+	error: string().nullable()
 });
-/**
-* Wrapper carrying a single test run's result. Replaces the legacy
-* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
-* canonical `AudioResult` from the Phase 6 output rework: one
-* `AudioDetection` per class above `minScore`, top-N candidates in
-* `debug.alternateLabels['audio-classifier']`, per-source timings in
-* `debug.stepTimings`. The outer `success`/`error` fields stay so the
-* benchmark UI can still report a clean failure when the classifier
-* cap isn't available.
-*/
-var AudioTestResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	frame: custom().optional()
+var ReplayFrameInputSchema = object({
+	timestamp: number(),
+	frame: PipelineRunResultBridge
 });
-var PipelineConfigBridge = custom();
-var ConfigUISchemaBridge = custom();
-var ConfigUISchemaNullableBridge = custom();
-var InferenceCapabilitiesBridge = custom();
-var ModelAvailabilityListBridge = custom();
-var PipelineRunResultBridge = custom();
-method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(PipelineEngineChoiceSchema, array(PipelineDefaultStepSchema)), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-}))), method(object({ steps: record(string(), object({
-	modelId: string(),
-	settings: record(string(), unknown()).readonly()
-})) }), object({ success: literal(true) }), {
+var RunReplayFrameProcessorResultSchema = object({ tracks: array(object({
+	className: string(),
+	firstSeenMs: number(),
+	lastSeenMs: number(),
+	/** Bbox of the track's FIRST matched detection, pixel-space in the clip's
+	*  frame — a representative box for the diff's `(className, window, IoU)`
+	*  pairing (`replay-diff.ts`). A replay does not need the full per-frame
+	*  trajectory production's `Track.positions` keeps. */
+	bbox: BoundingBoxSchema,
+	/** How many of the input frames this track matched a real detection on
+	*  (never a coasted/extrapolated frame) — the replay's own signal for "how
+	*  solid is this track", cheaper than re-deriving it from a trajectory. */
+	framesMatched: number().int()
+})).readonly() });
+DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).readonly()), method(object({
+	deviceId: number(),
+	trackId: string()
+}), TrackSchema.nullable()), method(object({
+	deviceId: number(),
+	since: number().optional(),
+	until: number().optional(),
+	limit: number().optional(),
+	/** Spatial filter — only tracks whose trajectory intersects the zone
+	*  (normalized 0..1 rect or polygon). SQL-prefiltered on the persisted
+	*  envelope columns, then precisely tested per position. Tracks with
+	*  an unknown envelope (no frame dims at persist time) always match. */
+	zone: TrackZoneFilterSchema.optional(),
+	/** See {@link TrackProjectionSchema}. Default `full` (backward
+	*  compatible — omitting the field keeps today's exact behaviour). */
+	projection: TrackProjectionSchema.optional(),
+	/** Include stationary-promoted rows (parked objects handed to the
+	*  stationary registry). Default false: the timeline lists passages,
+	*  not parking records (operator decision, 2026-08-15). */
+	includeStationary: boolean().optional()
+}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(ListGroupsQueryInput, ListGroupsPageSchema), method(object({
+	deviceId: number(),
+	groupId: string().min(1)
+}), AnalyticsGroupDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
+	deviceId: number(),
+	since: number().optional(),
+	until: number().optional(),
+	kinds: array(string()).optional(),
+	limit: number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT)
+}), array(SensorEventSchema).readonly()), method(KeyEventQueryInput, array(KeyEventSchema).readonly()), method(object({
+	deviceId: number(),
+	since: number(),
+	until: number(),
+	bucketMs: number().int().positive()
+}), array(object({
+	bucketStart: number(),
+	motion: number().int(),
+	object: number().int(),
+	audio: number().int()
+})).readonly()), method(object({
+	deviceId: number(),
+	cutoffMs: number()
+}), object({
+	motion: number().int(),
+	object: number().int(),
+	audio: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	cutoffMs: number()
+}), TrackCascadeCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), TrackCascadeCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), DiskReconcileCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackIds: array(string()).min(1)
+}), object({
+	deleted: number().int(),
+	failed: array(string()).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	/** Log/audit scope only — the trackId is globally unique on its own. */
+	deviceId: number(),
+	trackId: string(),
+	flags: TrackFlagsPatchSchema
+}), TrackFlagsSchema, { kind: "mutation" }), method(object({}), EventStoreFootprintSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	olderThanMs: number(),
+	reason: OpsLogReasonSchema.optional()
+}), EventPruneCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), EventPruneCountsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationLeaseInputSchema, object({ resumed: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationLeaseInputSchema, object({ refreshed: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationMediaMoveInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), TrainingExportSummarySchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
+	*  `deviceId`, deliberately: `deviceId` would make this device-bound and
+	*  route it at one camera's owner, and "every camera" would stop being
+	*  expressible at all. */
+	deviceIds: array(number()).optional(),
+	limit: number().int().min(1).max(500).optional()
+}), array(RetrainTrackSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ trackId: string() }), RetrainFrameListSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	mediaKeys: array(string()).min(1)
+}), RetrainFrameSelectionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string()
+}), object({
+	removed: boolean(),
+	removedAnnotations: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ frameId: string() }), object({
+	base64: string(),
+	width: number().int(),
+	height: number().int()
+}), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	subject: RetrainAssistSubjectSchema,
+	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+	nodeId: string().optional()
+}), RetrainAssistResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	source: DetectionSourceSchema,
+	zones: array(ZoneSchema).readonly().optional(),
+	detectionRules: array(ZoneRuleSchema).readonly().optional(),
+	zoneMembershipMinOverlap: number().min(0).max(1).optional(),
+	frames: array(ReplayFrameInputSchema).min(1)
+}), RunReplayFrameProcessorResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	annotations: array(RetrainAnnotationDraftSchema)
+}), array(RetrainAnnotationSchema).readonly(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ nodeId: string() }), object({
-	success: literal(true),
-	clearedDevices: number()
-}), {
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({ steps: array(PipelineStepInputSchema) }), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), DownloadModelResultSchema, { kind: "mutation" }), method(object({
-	addonId: string(),
-	modelId: string(),
-	format: ModelFormatSchema$1
-}), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frame: FrameInputSchema.optional(),
-	/**
-	* Process-local lazy frame. Valid only when caller and provider resolve
-	* in the same execution-group process; split/cross-node callers use
-	* `frame`/`image` inline compatibility instead.
-	*/
-	frameRef: FrameRefSchema.optional(),
-	/**
-	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-	* the decoded pixels live in. One more member of the one-of
-	* frame/frameHandle/image/imageBase64/referenceImage group.
-	*/
-	frameHandle: FrameHandleSchema.optional(),
-	imageBase64: string().optional(),
-	/**
-	* Binary JPEG bytes — preferred over `imageBase64` on internal
-	* hops (hub → forked worker via Moleculer MsgPack) because it
-	* skips the 33% base64 overhead + the per-call base64 decode on
-	* the detection-pipeline worker. Callers can pass either; exactly
-	* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-	*/
-	image: _instanceof(Uint8Array).optional(),
-	referenceImage: string().optional(),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Execution plane. 'full' (default) runs the whole tree — benchmark,
-	* reference-image, and detail-subtree calls. 'frame' is the live
-	* per-frame dispatch: ONLY root-plane steps run; crop children
-	* (inputClasses ≠ null) are skipped and served per-track via
-	* pipelineRunner.runDetailSubtree (two-plane design).
-	*/
-	plane: _enum(["full", "frame"]).optional(),
-	/**
-	* Inference-device selector (Phase 2 multi-device). Format
-	* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-	* Omitted ⇒ the runner's default device (current single-engine
-	* behaviour). Selects WHICH device pool of the node runs the call.
-	*/
-	deviceKey: string().optional(),
-	/**
-	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-	* when the parent crop was resolved from the frame's retained NATIVE
-	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-	* resolution from that surface — the SAME quality path faces already
-	* had — instead of the downscaled parent tile. `handle` keys the native
-	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
-	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-	* the executor's crop-normalized child ROI back into frame-normalized
-	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-	* (today's behaviour on the fallback path).
-	*/
-	nativeCropRef: NativeCropRefSchema.optional()
-}), PipelineRunResultBridge, { kind: "mutation" }), method(object({
-	engine: PipelineEngineChoiceSchema.optional(),
-	steps: array(PipelineStepInputSchema).min(1),
-	frames: array(FrameInputSchema).min(1).max(255),
-	deviceId: number().optional(),
-	sessionId: string().optional(),
-	/**
-	* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-	* the batch to the Python pool's bench preprocess cache
-	* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-	* preprocessed ONCE and every later inference is a pure-inference cache
-	* hit — the sustained-throughput run measures inference, not
-	* decode+preprocess+infer. Omitted/0 for live frames (all different →
-	* full preprocess every call, correct). Fresh per sustained run;
-	* released via `uncacheFrame`.
-	*/
-	frameId: number().int().nonnegative().optional(),
-	/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-	deviceKey: string().optional()
-}), object({ results: array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }), method(object({
-	data: _instanceof(Uint8Array),
-	width: number().int().positive(),
-	height: number().int().positive(),
-	format: _enum([
-		"rgb",
-		"bgr",
-		"gray"
-	])
-}), object({
-	frameId: number(),
-	width: number(),
-	height: number()
-}), { kind: "mutation" }), method(object({
-	stepId: string(),
-	frameId: number().int()
-}), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(_void(), object({
-	batchMode: string(),
-	windowMs: number(),
-	maxBatchSize: number(),
-	concurrency: number()
-})), method(_void(), array(object({
-	engineKey: string(),
-	engine: PipelineEngineChoiceSchema,
-	modelsLoaded: array(string()).readonly(),
-	inUseByCameras: array(number()).readonly(),
-	/**
-	* Origin of this resident factory.
-	*  - `runtime`       — main camera-serving engine (no idle TTL).
-	*  - `warm-override` — benchmark/test override held in the warm
-	*                      cache; auto-disposed after the idle TTL.
-	*  - `device-pool`   — a concurrent per-device pool (Phase 2
-	*                      multi-device, keyed by `deviceKey`) resolved
-	*                      via `resolveDeviceFactory`. Runs alongside the
-	*                      `runtime` engine on a DIFFERENT accelerator
-	*                      (NPU / iGPU / Coral) — this is how the
-	*                      Engines tab shows all pools running at once.
-	*/
-	kind: _enum([
-		"runtime",
-		"warm-override",
-		"device-pool"
-	]),
-	/** Native pid of the underlying Python pool (null when no pool). */
-	poolPid: number().nullable(),
-	/** ms since this factory was last used (null when not warm-tracked). */
-	idleMs: number().nullable(),
-	/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-	idleTtlMs: number().nullable()
-})).readonly()), method(object({ engine: PipelineEngineChoiceSchema }), object({ success: literal(true) }), {
-	kind: "mutation",
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
 	auth: "admin"
 }), method(object({
-	engine: PipelineEngineChoiceSchema,
-	force: boolean().optional()
-}), object({
-	success: boolean(),
-	reason: string().optional()
-}), {
+	eventId: string(),
+	kind: MediaFileKindEnum.optional(),
+	deviceId: number()
+}), array(MediaFileSchema).readonly()), method(object({
+	trackId: string(),
+	kinds: array(MediaFileKindEnum).optional(),
+	deviceId: number()
+}), array(MediaFileSchema).readonly()), method(object({
+	trackId: string(),
+	deviceId: number()
+}), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), method(object({}), WipeObjectEmbeddingsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(ReferenceImageEntrySchema).readonly()), method(object({ filename: string() }), ReferenceImageBodySchema.nullable()), method(_void(), array(ReferenceAudioEntrySchema).readonly()), method(object({ filename: string() }), ReferenceAudioBodySchema.nullable()), method(_void(), AudioCapabilitiesSchema), method(object({
-	addonId: string(),
-	modelId: string(),
-	filename: string().optional(),
-	settings: record(string(), unknown()).optional()
-}), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
+}), method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), RebuildStatusSchema), object({
+	deviceId: number(),
+	timestamp: number(),
+	frameWidth: number(),
+	frameHeight: number(),
+	detections: array(OverlayDetectionSchema).readonly()
+}), object({
+	deviceId: number(),
+	trackId: string(),
+	className: string()
+}), object({
+	deviceId: number(),
+	trackId: string(),
+	className: string(),
+	durationMs: number()
+}), object({
+	deviceId: number(),
+	kind: EventKindSchema,
+	eventId: string(),
+	timestamp: number()
+});
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -18346,119 +18738,19 @@ var CameraMetricsSchema = object({
 		"disabled",
 		"always-on",
 		"on-motion"
-	]),
-	configuredFps: number(),
-	actualFps: number(),
-	queueDepth: number(),
-	avgInferenceTimeMs: number(),
-	droppedFrames: number(),
-	phase: _enum([
-		"idle",
-		"watching",
-		"active"
-	])
-});
-var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: number() });
-/**
-* Zone — pure geometry + identity. NO filtering behaviour.
-*
-* Zones describe **where** in the frame the operator wants to flag
-* something; consumer-owned {@link ZoneRule} arrays describe **how**
-* each pipeline stage uses them. Splitting the two means a single
-* polygon "Driveway" can simultaneously back a motion-exclude rule,
-* a detection-include rule on `['car']`, and an occupancy aggregate
-* — without three duplicated polygons.
-*
-* Owned by the orchestrator addon (provider) and mirrored into the
-* `zones` device-state slice on every mutation. Consumers
-* (motion-wasm, pipeline-executor, analytics, admin UI) read either
-* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
-* mirror with `onChanged`).
-*
-* Coordinates are normalised fractions of the frame (0–1) so zones
-* survive resolution changes and stream profile switches.
-*
-* `kind` discriminates between full polygons (closed regions used
-* for intrusion / occupancy filters) and tripwires (open 2-point
-* line segments used for cross events). Onboard / firmware-reported
-* zones (Reolink, ONVIF) are out of scope for now — see the deferred
-* task list.
-*/
-var ZoneKindEnum = _enum(["polygon", "tripwire"]);
-/** Polygon vertex in fraction-of-frame coordinates (0–1). */
-var PolygonPointSchema = object({
-	x: number(),
-	y: number()
-});
-/** A camera detection zone — pure geometry/identity. */
-var ZoneSchema = object({
-	id: string(),
-	name: string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: string().default("#3b82f6")
+	]),
+	configuredFps: number(),
+	actualFps: number(),
+	queueDepth: number(),
+	avgInferenceTimeMs: number(),
+	droppedFrames: number(),
+	phase: _enum([
+		"idle",
+		"watching",
+		"active"
+	])
 });
-/**
-* Zones capability — per-camera CRUD over polygon detection zones.
-*
-* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
-* to per-device settings and mirrors into the `zones` device-state
-* slice on every mutation, so downstream consumers can subscribe via
-* `dev.state.zones.onChanged`.
-*
-* The cap surface only handles geometry + identity; filtering
-* behaviour (per-class, include/exclude, threshold) lives in the
-* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
-* `capabilities/schemas/zone-rule.js`.
-*/
-var zonesCapability = {
-	name: "zones",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
-		addZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		removeZone: method(object({
-			deviceId: number(),
-			zoneId: string()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		updateZone: method(object({
-			deviceId: number(),
-			zone: ZoneSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	/**
-	* Runtime-state slice — the live zone catalogue mirrored by the
-	* orchestrator on every CRUD mutation. Consumers read via
-	* `device.state.zones.value` / `.watch(...)` without round-tripping
-	* the cap, and the codegen DeviceProxy auto-wires the reactive
-	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
-	* (e.g. zone groupings) can sit alongside the polygon list.
-	*/
-	runtimeState: object({ zones: array(ZoneSchema).readonly() }),
-	/**
-	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
+var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: number() });
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
 * decode worker resolves it against the RETAINED native frame's real pixel dims,
@@ -20147,7 +20439,7 @@ method(object({
 	* linking rather than produce an eternal token.
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
-}), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
+}), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
 	displayName: string().min(1),
@@ -20242,10 +20534,13 @@ var EvictResultSchema = object({
 	/** True when the provider has nothing left it is willing to drop on this location. */
 	exhausted: boolean()
 });
-method(object({ locationId: string() }), EvictableUsageSchema), method(object({
+method(object({ locationId: string() }), EvictableUsageSchema, { auth: "admin" }), method(object({
 	locationId: string(),
 	targetBytes: number().int().positive()
-}), EvictResultSchema, { kind: "mutation" });
+}), EvictResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin" }), method(StorageMigrationInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -20305,26 +20600,50 @@ var ReadChunkInputSchema = object({
 	length: number()
 });
 var EndDownloadInputSchema = object({ downloadId: string() });
-method(_void(), ProviderInfoSchema), method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }), method(object({
+method(_void(), ProviderInfoSchema, { auth: "admin" }), method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), string()), method(object({
+}), string(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), _instanceof(Uint8Array)), method(object({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	prefix: string().optional()
-}), array(string()).readonly()), method(object({
+}), array(string()).readonly(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ location: StorageLocationSchema }), number().nullable(), { auth: "admin" }), method(BeginUploadInputSchema, BeginUploadResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(WriteChunkInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(FinalizeUploadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(AbortUploadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ReadChunkInputSchema, _instanceof(Uint8Array), { auth: "admin" }), method(EndDownloadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
 var ProfileSettingsSchemaBridge = unknown().nullable();
 var ProfileSettingsBagSchema = record(string(), unknown());
@@ -20582,7 +20901,8 @@ method(object({
 	access: "create"
 }), method(object({ userId: string().optional() }), object({ optionsJSON: record(string(), unknown()) }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({
 	/** Required — the user the assertion belongs to (verified). */
 	userId: string(),
@@ -20590,10 +20910,12 @@ method(object({
 	response: record(string(), unknown())
 }), object({ verified: boolean() }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({ 
 /** AuthenticationResponseJSON from the browser. */
 response: record(string(), unknown()) }), object({
@@ -20601,7 +20923,8 @@ response: record(string(), unknown()) }), object({
 	userId: string().nullable()
 }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }), method(object({
 	userId: string(),
 	credentialId: string()
@@ -20773,7 +21096,19 @@ var VectorStatsResultSchema = object({
 	/** False when the backend ranks approximately. */
 	exact: boolean()
 });
-method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
+method(VectorDeclareIndexInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" });
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -23315,7 +23650,27 @@ var MediaFileLiteSchema$1 = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
-method(_void(), array(IdentitySchema).readonly()), method(object({ name: string().min(1) }), IdentitySchema, {
+method(object({ 
+/**
+* Inline {@link IdentitySchema.coverBase64} on every row.
+*
+* Default `false`, the same inversion `listRecentFaces` and
+* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+* why the burden belongs on the caller that WANTS the bytes). Measured
+* on the live hub the same day: four identities cost 40,979 B with the
+* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+* four times and the viewer holds at `staleTime: 30_000`.
+*
+* Nothing loses its avatar: `coverMediaKey` is already on every row and
+* the `event-media` plane serves that key `immutable` with an ETag.
+*
+* **This is an INPUT field, so it does not reach the addon until the
+* next train** — the hub router validates cap inputs against its own
+* compiled Zod and strips a key it does not know. Until then the
+* provider sees `undefined`, which resolves to `false`: the cheap shape
+* is what ships, and the opt-in becomes reachable when the train lands.
+*/
+includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly()), method(object({ name: string().min(1) }), IdentitySchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -26205,8 +26560,10 @@ var PlateInfoSchema = object({
 	keyFrameMediaKey: string().optional(),
 	base64: string().optional(),
 	/**
-	* Same crop as a data-plane URL. `getPlateByTrack` returns this and
-	* never inlines JPEG; `listPlates` still inlines for the admin-ui.
+	* Same crop as a data-plane URL, always present when the plate has a stored
+	* crop. `getPlateByTrack` returns this and never inlines JPEG; `listPlates`
+	* and `searchPlates` inline the crop only when their `includeCrops` input is
+	* left at its `true` default.
 	*/
 	cropUrl: string().optional()
 });
@@ -26226,14 +26583,34 @@ var PlateClusterSchema = object({
 });
 method(object({
 	deviceId: number().int().optional(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/**
+	* Inline the base64 crop on every row. Default `true` — the existing
+	* behaviour, kept so no caller breaks.
+	*
+	* Set `false` once the caller renders {@link PlateInfo.cropUrl}.
+	* Measured on the live hub at the 500 rows the Plates view asks for:
+	* 879,403 B and 27.7 s with the crops inline, against a few KiB of
+	* metadata without them — and the browser then caches the images.
+	*
+	* This is the plate twin of `faceGallery.listRecentFaces`'s option;
+	* plates were the one gallery list left without it.
+	*
+	* **This is an INPUT field, so it does not reach the addon until the
+	* next train.** The hub router validates cap inputs against its own
+	* compiled Zod and strips a key it does not know. Until the train
+	* ships, sending `false` is harmless and keeps the crops inline.
+	*/
+	includeCrops: boolean().optional()
 }).optional(), array(PlateInfoSchema).readonly()), method(object({
 	deviceId: number().int(),
 	trackId: string()
 }), PlateInfoSchema.nullable()), method(object({ plateId: string() }), array(MediaFileLiteSchema).readonly()), method(object({
 	text: string().min(1),
 	maxDistance: number().int().min(0).optional(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/** See `listPlates.includeCrops`. Default `true`. */
+	includeCrops: boolean().optional()
 }), array(PlateInfoSchema).readonly()), method(object({
 	maxDistance: number().int().min(0).optional(),
 	minClusterSize: number().int().min(2).optional(),
@@ -26247,7 +26624,13 @@ method(object({
 }), method(object({ plateId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(VehicleSchema).readonly()), method(object({ name: string().min(1) }), VehicleSchema, {
+}), method(object({ 
+/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+*  INPUT field: stripped by the hub router until the train ships, which
+*  resolves to `false` and is exactly the intended default. */
+includeCrops: boolean().optional() }).optional(), array(VehicleSchema).readonly()), method(object({ name: string().min(1) }), VehicleSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -27768,92 +28151,6 @@ var sceneMonitorCapability = {
 	durability: "session"
 };
 /**
-* Per-stage gating mode applied to the zones a rule references.
-*
-* - `include`: the rule contributes to a **whitelist** for its stage.
-*   When at least one `include` rule fires for a stage, only entities
-*   inside one of those zones pass that stage.
-* - `exclude`: the rule contributes to a **blacklist** for its stage.
-*   Entities inside one of those zones are dropped at that stage.
-*
-* `monitor`-style observation (count without filtering) is not a rule
-* mode — zones without any matching rule are observed naturally by
-* `zone-analytics` (live snapshot + history), so an "I just want to
-* count, not filter" use case needs no rule at all.
-*/
-var ZoneRuleModeEnum = _enum(["include", "exclude"]);
-/**
-* Per-consumer rule that references existing zones (geometry) and
-* defines how a specific pipeline stage should treat them. Each
-* consumer addon owns its own `ZoneRule[]` array in its per-device
-* settings:
-*
-* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
-* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
-* - future: notification rules, audio gating, etc.
-*
-* One rule applies to N zones (`zoneIds[]`) so the operator can
-* express "ignore motion in ALL of {garden, street}" with a single
-* rule. `classFilter` narrows the rule to specific object classes —
-* "drop person detections in the street, but keep cars" is one
-* `exclude` rule with `classFilter: ['person']`.
-*
-* `enabled` is a soft toggle — the operator can keep the rule
-* configured but inert without deleting it.
-*/
-var ZoneRuleSchema = object({
-	/** Stable rule id — survives edits, used by the UI for diffing. */
-	id: string(),
-	/** Optional human-readable label rendered in the rule editor. */
-	name: string().optional(),
-	/** Zones this rule targets. The rule's `mode` applies to ALL
-	*  listed zones (OR-set: a detection in any one of them counts).
-	*  At least one zone id required — a rule with no targets is a
-	*  configuration mistake and the form validator rejects it. */
-	zoneIds: array(string()).min(1).readonly(),
-	mode: ZoneRuleModeEnum,
-	/**
-	* Class names this rule applies to. Empty / undefined ⇒ rule
-	* applies to every class. Class strings match the `macroClass`
-	* field on detections (e.g. `person`, `car`, `dog`).
-	*/
-	classFilter: array(string()).readonly().optional(),
-	/**
-	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
-	* required to consider an entity "in the zone". Defaults to the
-	* consumer's stage default when omitted. Kept for back-compat with
-	* existing per-rule overrides; new operators pick the value via
-	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-	* set, the lower-level engine reads it as a 0–1 fraction.
-	*/
-	overlapThreshold: number().min(0).max(1).optional(),
-	/**
-	* Operator-friendly version of `overlapThreshold` — the percentage
-	* of the detection's bbox that must lie inside the zone for the
-	* rule to match. Documented default is 85%; the engine substitutes
-	* that when the field is omitted (kept optional so existing rules
-	* stored without it stay valid).
-	*
-	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-	* rule, the engine prefers `bboxInclusionPct` because it's the
-	* field exposed in the UI. Internally both feed the same gate.
-	*/
-	bboxInclusionPct: number().min(0).max(100).optional(),
-	/**
-	* When `true` and a detection has a segmentation mask, use the
-	* mask for overlap instead of the bbox. Detection-stage only;
-	* motion rules ignore this field.
-	*/
-	preferMask: boolean().optional(),
-	/**
-	* Soft-toggle: `false` disables the rule without deleting it.
-	* Defaults to `true` so operators creating a rule via the UI
-	* see it active immediately.
-	*/
-	enabled: boolean().default(true)
-});
-array(ZoneRuleSchema).readonly();
-/**
 * Script-runner cap. Models HA `script.*` entities on
 * `DeviceType.Script`. A Script is a pre-recorded action sequence
 * that can be invoked imperatively — optionally with a variables
@@ -33508,6 +33805,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33682,6 +33985,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33760,6 +34069,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33772,6 +34087,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.runReplayFrameProcessor": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33904,6 +34225,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineExecutor.getInferenceDeviceHealth": {
+		capName: "pipeline-executor",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineExecutor.getOrchestratorConfigSchema": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -33976,6 +34303,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineExecutor.rearmInferenceDevice": {
+		capName: "pipeline-executor",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.runAudioTest": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -37224,6 +37557,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.runReplayFrameProcessor": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.saveRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -38624,4 +38962,4 @@ function bestLocationMatch(externalName, existing, threshold = .8) {
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { pressureSensorCapability as $, coverCapability as A, imageCapability as B, buttonCapability as C, record as Ct, connectivityCapability as D, url as Dt, colorCapability as E, unknown as Et, fanControlCapability as F, normalizeUnit as G, lockControlCapability as H, floodCapability as I, numericSensorCapability as J, notificationOutputCapability as K, gasCapability as L, deviceExportCapability as M, enumSensorCapability as N, contactCapability as O, EventCategory as Ot, eventEmitterCapability as P, presenceCapability as Q, humidifierCapability as R, buildAddonRouteProvider as S, object as St, climateControlCapability as T, union as Tt, mediaPlayerCapability as U, lawnMowerControlCapability as V, motionCapability as W, powerMeterCapability as X, oauthIntegrationCapability as Y, prepareNotification as Z, batteryCapability as _, _enum as _t, CameraSwitchIdSchema as a, updateCapability as at, brightnessCapability as b, literal as bt, HvacModeSchema as c, vibrationCapability as ct, accessoriesCapability as d, errMsg as dt, scriptRunnerCapability as et, addonRoutesCapability as f, BaseAddon as ft, automationControlCapability as g, createEvent as gt, ambientLightSensorCapability as h, DeviceType as ht, COCO_TO_MACRO as i, temperatureSensorCapability as it, deviceAdoptionCapability as j, controlCapability as k, MediaPlayerRepeatSchema as l, waterHeaterCapability as lt, alarmPanelCapability as m, DeviceRole as mt, BaseDevice as n, switchCapability as nt, EnumSensorDateTimeFormatSchema as o, vacuumControlCapability as ot, airQualitySensorCapability as p, DeviceFeature as pt, notifierCapability as q, BaseDeviceProvider as r, tamperCapability as rt, FanDirectionSchema as s, valveCapability as st, AlarmArmModeSchema as t, smokeCapability as tt, TargetSchema as u, weatherCapability as ut, bestLocationMatch as v, array as vt, carbonMonoxideCapability as w, string as wt, brokerCapability as x, number as xt, binaryCapability as y, discriminatedUnion as yt, humiditySensorCapability as z };
+export { presenceCapability as $, controlCapability as A, EventCategory as At, humiditySensorCapability as B, buildAddonRouteProvider as C, number as Ct, colorCapability as D, union as Dt, climateControlCapability as E, string as Et, eventEmitterCapability as F, motionCapability as G, lawnMowerControlCapability as H, fanControlCapability as I, notifierCapability as J, normalizeUnit as K, floodCapability as L, deviceAdoptionCapability as M, deviceExportCapability as N, connectivityCapability as O, unknown as Ot, enumSensorCapability as P, prepareNotification as Q, gasCapability as R, brokerCapability as S, literal as St, carbonMonoxideCapability as T, record as Tt, lockControlCapability as U, imageCapability as V, mediaPlayerCapability as W, oauthIntegrationCapability as X, numericSensorCapability as Y, powerMeterCapability as Z, automationControlCapability as _, createEvent as _t, COCO_TO_MACRO as a, temperatureSensorCapability as at, binaryCapability as b, array as bt, FanDirectionSchema as c, valveCapability as ct, TargetSchema as d, weatherCapability as dt, pressureSensorCapability as et, accessoriesCapability as f, errMsg as ft, ambientLightSensorCapability as g, DeviceType as gt, alarmPanelCapability as h, DeviceRole as ht, CAMERA_SWITCH_ORDER as i, tamperCapability as it, coverCapability as j, contactCapability as k, url as kt, HvacModeSchema as l, vibrationCapability as lt, airQualitySensorCapability as m, DeviceFeature as mt, BaseDevice as n, smokeCapability as nt, CameraSwitchIdSchema as o, updateCapability as ot, addonRoutesCapability as p, BaseAddon as pt, notificationOutputCapability as q, BaseDeviceProvider as r, switchCapability as rt, EnumSensorDateTimeFormatSchema as s, vacuumControlCapability as st, AlarmArmModeSchema as t, scriptRunnerCapability as tt, MediaPlayerRepeatSchema as u, waterHeaterCapability as ut, batteryCapability as v, nodePin as vt, buttonCapability as w, object as wt, brightnessCapability as x, discriminatedUnion as xt, bestLocationMatch as y, _enum as yt, humidifierCapability as z };