@camstack/addon-provider-rtsp 1.2.116 → 1.2.118

package/dist/addon.mjs

@@ -1,5 +1,5 @@
 import net from "node:net";
-//#region ../types/dist/event-category-C5xZWqz6.mjs
+//#region ../types/dist/event-category-BGmz_oxW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -532,6 +532,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
 	EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
+	/**
+	* A camera provider's RAW onboard motion push (D673): the `MotionOnMotionChanged`
+	* data shape without `triggeredBy`, built by `providerMotionEvent`. Its one
+	* consumer is the orchestrator's camera-sensors bridge, which re-emits the
+	* camera's EFFECTIVE onboard motion as `MotionOnMotionChanged` (a pass-through
+	* for a camera with no attached sensor). Providers must not emit
+	* `MotionOnMotionChanged` themselves; `scripts/check-onboard-motion-emitters.ts`
+	* keeps it so (camera-grid is a named, deferred exception).
+	*/
 	EventCategory["ProviderMotion"] = "provider.motion";
 	EventCategory["ProviderDetection"] = "provider.detection";
 	EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
@@ -5370,7 +5379,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-gU6hqv4_.mjs
+//#region ../types/dist/sleep-CDCONfkt.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7413,7 +7422,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-Dq42XWp0.mjs
+//#region ../types/dist/composition-Bzr7GwgP.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -7467,21 +7476,20 @@ function portable(target) {
 }
 portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
 /**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
+* THE table "which boolean of this device type counts as HIGH", and the
+* pure evaluator of its EDGE.
 *
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
+* ONE table for everyone who asks "is this device HIGH?": the
+* recorder's `RecordingTriggers.sensorDeviceIds` trigger, the post-analysis
+* sensor markers, the orchestrator's camera-sensors bridge and
+* the sources of a composite doorbell (`doorbellFeatureSources`, D671).
+* A second copy would diverge at the first cap added, and the symptom — "the
+* sensor rings the doorbell but does not record" — is exactly D62.
 *
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+* ⚠ NOT `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), and the
+* two must not be unified: that one answers "what is the state WORD for a
+* rule" (and includes `presence`, `cover`, `alarm-panel`), this one "which
+* boolean's EDGE counts". Deliberately different vocabularies.
 */
 /**
 * Known binary / switch source caps → the boolean slice field whose
@@ -9122,22 +9130,22 @@ var CLASS_MAP_MACRO_TARGETS = [
 	"package"
 ];
 /**
-* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
-* un operatore può selezionare.
+* The FIRST-LEVEL macro classes: those an object detector emits and that
+* an operator can select.
 *
-* Sono le tre offerte dallo step `object-detection`
+* They are the three offered by the `object-detection` step
 * (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
-* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
-* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
-* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
-* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
+* `enabledMacroClasses`). `package` is in {@link CLASS_MAP_MACRO_TARGETS} and in
+* `MACRO_LABELS` — it is a true macro — but NOT here: it belongs to the step
+* `package-detection`, whose enablement is driven by zones, and offering the
+* same word twice has already made an operator turn on the COCO proxy
 * (suitcase/backpack/handbag) lasciando spento il detector dedicato.
 *
-* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
-* dello step e una seconda volta come union `FirstLevelMacro`
-* (`types/detection.ts`); una terza copia per il trigger di registrazione
-* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
-* successiva.
+* ONE list. Before today the same three were hand-written in the step's offer
+* and a second time as the union `FirstLevelMacro`
+* (`types/detection.ts`); a third copy for the recording trigger
+* (`RecordingTriggers.objectClasses`) would have made the later divergence
+* invisible.
 */
 var FIRST_LEVEL_MACRO_CLASSES = [
 	"person",
@@ -9202,17 +9210,17 @@ var RecordingStorageModeSchema = _enum([
 	"on-device-decision"
 ]);
 /**
-* Le macro classi che possono aprire una finestra di registrazione — le stesse
-* tre offerte dallo step `object-detection`, da UNA lista
+* The macro classes that can open a recording window — the same
+* three offered by the `object-detection` step, from ONE list
 * ({@link FIRST_LEVEL_MACRO_CLASSES}).
 */
 var RecordingObjectTriggerClassSchema = _enum(FIRST_LEVEL_MACRO_CLASSES);
 /**
-* True quando `values` non ripete un elemento.
+* True when `values` does not repeat an element.
 *
-* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
-* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
-* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+* A duplicate is not harmless: every entry of `objectClasses` / `sensorDeviceIds`
+* becomes a SOURCE in `bandTriggerSources`, and the same source twice
+* would count its windows twice in `segmentMissedByMs`.
 */
 var noDuplicates = (values) => new Set(values).size === values.length;
 /** Which detectors trigger an `events`-mode band. */
@@ -9220,34 +9228,34 @@ var RecordingTriggersSchema = object({
 	motion: boolean().optional(),
 	audioThresholdDbfs: number().optional(),
 	/**
-	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
-	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
-	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
-	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+	* The macro classes whose detection opens a window. ABSENT = the source
+	* is not listened to; an EMPTY array is rejected, because "events band, object
+	* trigger on, no class" is the same shape "enabled and records
+	* nothing, forever" that `eventsBandCanEverDemand` is written against.
 	*
-	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
-	* quelle che hanno attraversato `enabledMacroClasses`, i
-	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
-	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
-	* finestre — vedi `recorder/object-trigger.ts`.
+	* The signal read is ALREADY FILTERED: only `source: 'pipeline'` detections, i.e.
+	* those that went through `enabledMacroClasses`, the
+	* `minConfidence<Macro>` and the full-frame guard. The camera's onboard AI
+	* (`source: 'onboard'`) goes through none of those gates and does NOT open
+	* windows — see `recorder/object-trigger.ts`.
 	*/
 	objectClasses: array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
 	/**
-	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
-	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+	* The LINKED devices whose RISING EDGE opens a window. Absent = the source
+	* is not listened to; an empty array is rejected for the same reason as
 	* `objectClasses`.
 	*
-	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
-	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
-	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
-	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
-	* device (D12) — mai un elenco globale di cap.
+	* These are SOURCE device ids, not cameras: the band names them, so the
+	* hot path (`DeviceStateChanged`, at bus rate across the whole fleet)
+	* does no RPC. The OFFER from which the operator picks them is another question, and
+	* is resolved with `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+	* device (D12) — never a global list of caps.
 	*
-	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
-	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
-	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
-	* il livello: un contatto trovato già aperto al riavvio del runner non fa
-	* registrare.
+	* What "high" means depends on the device TYPE and is not decided here:
+	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) is THE table,
+	* the same one as the composite doorbell (D671). And it is the EDGE, not
+	* the level: a contact found already open at runner restart does not
+	* record.
 	*/
 	sensorDeviceIds: array(number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
@@ -10324,7 +10332,7 @@ var DecoderSessionConfigSchema = object({
 * - **VALUE** — at which level, for which scope, until when. That stays ONE
 *   thing: the logging settings document on the `system` cap. Two authorities
 *   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   `docs/design/plans/2026-08-26-per-component-logging.md` was written to
 *   remove; re-introducing it from the cure side would be grotesque.
 *
 * Nothing in this file reads a clock, an env var or a store. The registry is
@@ -11600,6 +11608,68 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
+* How long one snapshot may take end to end: the pinned copy of the whole
+* database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
+* disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
+* generous because a timeout fails the whole backup run.
+*/
+var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
+/**
+* The databases an owner snapshots — declared by the OWNER, so a caller never
+* guesses which file is live from what sits beside it (a cleanly closed
+* database has no sidecars and is just as owned). Paths are absolute on the
+* owner's host.
+*/
+var DatabaseSnapshotTargetsSchema = object({ databases: array(object({ livePath: string() })) });
+/** One b-tree table of the snapshot and the rows it holds. */
+var DatabaseSnapshotTableSchema = object({
+	name: string(),
+	rows: number().int().nonnegative()
+});
+/**
+* What the owner wrote. Every path is ABSOLUTE on the owner's host — the
+* caller pins the call to its own node, so it can read the file; a caller
+* that finds the path outside its own data root refuses it rather than
+* archiving something it cannot place.
+*/
+var DatabaseSnapshotResultSchema = object({
+	/** The live database the snapshot copies. Never to be copied as a file. */
+	livePath: string(),
+	/** The verified copy: `<livePath>` + {@link DATABASE_SNAPSHOT_SUFFIX}. */
+	snapshotPath: string(),
+	sizeBytes: number().int().nonnegative(),
+	pageCount: number().int().nonnegative(),
+	pageSize: number().int().positive(),
+	/**
+	* Every b-tree table with its row count. Read inside the SAME read
+	* transaction the copy was taken from, and found EQUAL on the copy — so
+	* this is the content of the snapshot, not an estimate of the source.
+	*/
+	tables: array(DatabaseSnapshotTableSchema),
+	/** Wall time of the pinned copy (row counts included). */
+	copyMs: number().nonnegative(),
+	/** Wall time of the checks on the copy (`integrity_check`, row counts). */
+	verifyMs: number().nonnegative(),
+	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
+	takenAt: number()
+});
+/**
+* A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
+* the same facts, with both paths relative to the archive root (the node's
+* data dir), because an archive outlives the host that made it.
+*/
+var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
+	/** Archive-relative path of the live database the archive does NOT carry. */
+	livePath: string(),
+	/** Archive-relative path of the verified copy it carries in its place. */
+	snapshotPath: string()
+});
+method(object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }), method(object({}), DatabaseSnapshotResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
+});
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -11710,7 +11780,12 @@ var ArchiveManifestSchema = object({
 	locations: array(string()),
 	entries: array(ArchiveEntrySchema),
 	totalBytes: number(),
-	totalFiles: number()
+	totalFiles: number(),
+	/**
+	* Live SQLite databases this archive carries as their OWNER's verified
+	* snapshot instead of as files (D693). Absent on archives made before.
+	*/
+	sqliteSnapshots: array(ArchiveSqliteSnapshotSchema).optional()
 });
 var LocationStatSchema = object({
 	name: string(),
@@ -11968,7 +12043,7 @@ var BrokerStatusEnum = _enum([
 	"unreachable",
 	"error"
 ]);
-var BrokerInfoSchema$1 = object({
+var BrokerInfoSchema = object({
 	/** Stable broker id. Persisted; survives addon restarts. */
 	id: string(),
 	/** Addon id of the provider that OWNS this broker.
@@ -12101,7 +12176,7 @@ var GetStateInputSchema = object({
 	*  HA:   entity_id (returns the cached entity state). */
 	key: string()
 });
-method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, BrokerInfoSchema$1.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
+method(ListInputSchema, array(BrokerInfoSchema)), method(GetInputSchema, BrokerInfoSchema.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(RemoveInputSchema, _void(), {
@@ -13236,242 +13311,6 @@ var CompositionBlockStateSchema = object({
 	reason: string().optional(),
 	fields: array(CompositionFieldStateSchema)
 });
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
-});
-`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
-/**
-* What a composition may BUILD on a device type (G2, D676): the caps a new
-* device of that type, or an existing one that lacks them, can be given. The
-* blockers are the validator's own refusal codes, and a spec compares this
-* listing with `planComposition` for every capability — the editor can never
-* offer a feature the save would refuse for the same reason.
-*/
-var ComposableFieldSchema = object({
-	path: string(),
-	kind: CompositionFieldKindSchema,
-	nullable: boolean(),
-	required: boolean(),
-	enumValues: array(string()).optional()
-});
-var ComposableCapabilitiesSchema = object({ caps: array(object({
-	cap: string(),
-	fields: array(ComposableFieldSchema),
-	/** Present for an item-array cap (`consumables.items`). */
-	itemArray: object({
-		path: string(),
-		keyField: string()
-	}).optional()
-})) });
-/** Where a block runs. The operator chooses — a block driving a device on an
-*  agent is the reason placement is not fixed to the hub. */
-var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
-/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. `degraded` is a
-*  composition on an existing device with a field handed back to the native
-*  provider while its source is unavailable (S1b, D663); the error names it. */
-var CoreBlockStatusSchema = _enum([
-	"stopped",
-	"starting",
-	"running",
-	"degraded",
-	"failed"
-]);
-/** Client-authored fields. */
-var CoreBlockInputSchema = object({
-	name: string().min(1).max(120),
-	/** TypeScript source. Compiled server-side before it is ever stored — a
-	*  block that does not compile is a fork failure the operator would meet
-	*  minutes later, in a log, instead of in the editor. */
-	code: string().max(2e5),
-	enabled: boolean(),
-	placement: CoreBlockPlacementSchema,
-	/**
-	* Integration the block's devices hang from. Absent = the system integration
-	* blocks share. A block may declare its own instead.
-	*/
-	integrationId: string().optional()
-});
-/**
-* What a block IS (D659). Absent means `code` — every row stored before this
-* union keeps working unchanged.
-*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
-*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
-*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
-*/
-var CoreBlockSourceSchema = discriminatedUnion("kind", [
-	object({ kind: literal("code") }),
-	object({
-		kind: literal("recipe"),
-		recipe: AutomationRecipeSchema
-	}),
-	object({
-		kind: literal("composition"),
-		composition: CompositionSchema
-	})
-]);
-/**
-* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
-*
-* `name`: REQUIRED for a `new` target — the block's name IS the device's name
-* (D659). ABSENT for an `existing` target — a customization has no name of its
-* own; the server derives one (`customizationBlockName`, D663) and refuses a
-* client-sent name by name.
-*/
-var CompositionBlockInputSchema = object({
-	name: string().min(1).max(120).optional(),
-	enabled: boolean(),
-	composition: CompositionSchema
-});
-/** A stored block. */
-var CoreBlockSchema = CoreBlockInputSchema.extend({
-	id: string(),
-	createdAt: number(),
-	updatedAt: number(),
-	/** Server-stamped author. */
-	createdBy: string(),
-	status: CoreBlockStatusSchema,
-	/**
-	* Why the block is not running, when it is not. The operator's ONLY window
-	* into a block that failed at load — a block that is silently absent is the
-	* failure mode this whole feature has to avoid.
-	*/
-	lastError: string().optional(),
-	/** Ms epoch of the last state change. */
-	lastChangedAt: number(),
-	/** What the block is. Absent means `code` (D659). */
-	source: CoreBlockSourceSchema.optional()
-});
-/** A stored composition block and what the composer says about it. */
-var CompositionViewSchema = object({
-	block: CoreBlockSchema,
-	state: discriminatedUnion("kind", [object({
-		kind: literal("answered"),
-		state: CompositionBlockStateSchema.nullable()
-	}), object({
-		kind: literal("unreachable"),
-		error: string()
-	})])
-});
-/**
-* A read of the stored compositions. `not-loaded` while the `core_blocks`
-* table has not been READ: an empty answer then would make "not yet known"
-* look like "none", and invite the operator to recreate what exists (D315).
-*/
-var CompositionsNotLoadedSchema = object({
-	state: literal("not-loaded"),
-	reason: string()
-});
-var CompositionListReadSchema = discriminatedUnion("state", [object({
-	state: literal("loaded"),
-	views: array(CompositionViewSchema)
-}), CompositionsNotLoadedSchema]);
-var CompositionGetReadSchema = discriminatedUnion("state", [object({
-	state: literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
-var CompositionCustomizationReadSchema = discriminatedUnion("state", [object({
-	state: literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** What a compile attempt produced. */
-var CoreBlockCompileResultSchema = object({
-	ok: boolean(),
-	/** Present when `ok` is false — the first error, in the author's words. */
-	error: string().optional(),
-	line: number().optional(),
-	column: number().optional()
-});
-method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({
-	blockId: string(),
-	block: CoreBlockInputSchema.partial()
-}), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({ blockId: string() }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	blockId: string(),
-	enabled: boolean()
-}), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ code: string() }), CoreBlockCompileResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), object({ libs: array(object({
-	filePath: string(),
-	content: string()
-})) }), { auth: "admin" }), method(object({ block: CompositionBlockInputSchema }), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({
-	blockId: string(),
-	expectedUpdatedAt: number(),
-	block: CompositionBlockInputSchema.partial()
-}), object({ block: CoreBlockSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
-	addonId: string().min(1),
-	stableId: string().min(1)
-}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({ deviceType: _enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }), method(object({
-	composition: CompositionSchema,
-	blockId: string().optional()
-}), CompositionValidationSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "view"
-});
 var ComposerBlockSchema = object({
 	id: string().min(1),
 	name: string().min(1).max(120),
@@ -13518,6 +13357,242 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = object({
+	path: string(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	enumValues: array(string()).optional()
+});
+var ComposableCapabilitiesSchema = object({ caps: array(object({
+	cap: string(),
+	fields: array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: object({
+		path: string(),
+		keyField: string()
+	}).optional()
+})) });
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
+var CoreBlockStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"degraded",
+	"failed"
+]);
+/** Client-authored fields. */
+var CoreBlockInputSchema = object({
+	name: string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: string().max(2e5),
+	enabled: boolean(),
+	placement: CoreBlockPlacementSchema,
+	/**
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
+	*/
+	integrationId: string().optional()
+});
+/**
+* What a block IS (D659). Absent means `code` — every row stored before this
+* union keeps working unchanged.
+*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
+*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
+*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+*/
+var CoreBlockSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("code") }),
+	object({
+		kind: literal("recipe"),
+		recipe: AutomationRecipeSchema
+	}),
+	object({
+		kind: literal("composition"),
+		composition: CompositionSchema
+	})
+]);
+/**
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
+*
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
+*/
+var CompositionBlockInputSchema = object({
+	name: string().min(1).max(120).optional(),
+	enabled: boolean(),
+	composition: CompositionSchema
+});
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
+	id: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	/** Server-stamped author. */
+	createdBy: string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: number(),
+	/** What the block is. Absent means `code` (D659). */
+	source: CoreBlockSourceSchema.optional()
+});
+/** A stored composition block and what the composer says about it. */
+var CompositionViewSchema = object({
+	block: CoreBlockSchema,
+	state: discriminatedUnion("kind", [object({
+		kind: literal("answered"),
+		state: CompositionBlockStateSchema.nullable()
+	}), object({
+		kind: literal("unreachable"),
+		error: string()
+	})])
+});
+/**
+* A read of the stored compositions. `not-loaded` while the `core_blocks`
+* table has not been READ: an empty answer then would make "not yet known"
+* look like "none", and invite the operator to recreate what exists (D315).
+*/
+var CompositionsNotLoadedSchema = object({
+	state: literal("not-loaded"),
+	reason: string()
+});
+var CompositionListReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	views: array(CompositionViewSchema)
+}), CompositionsNotLoadedSchema]);
+var CompositionGetReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = object({
+	ok: boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
+	error: string().optional(),
+	line: number().optional(),
+	column: number().optional()
+});
+method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	block: CoreBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	blockId: string(),
+	enabled: boolean()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ code: string() }), CoreBlockCompileResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ libs: array(object({
+	filePath: string(),
+	content: string()
+})) }), { auth: "admin" }), method(object({ block: CompositionBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	expectedUpdatedAt: number(),
+	block: CompositionBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
+	addonId: string().min(1),
+	stableId: string().min(1)
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({ deviceType: _enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }), method(object({
+	composition: CompositionSchema,
+	blockId: string().optional()
+}), CompositionValidationSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "view"
+});
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
 * custom detection models. Each provider (today: `addon-model-studio`)
@@ -13812,7 +13887,7 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	*
 	* ⚠ An earlier version of this comment blamed Zod stripping, and that
 	* was wrong — corrected 2026-08-26 after the hop map
-	* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+	* (`docs/design/2026-08-26-topic-hop-map.md`) traced the path.
 	* There is **no Zod parse at all** between the door and the engine: the
 	* dispatcher forwards the payload verbatim and UDS carries it whole. A
 	* field declared here reaches `SqliteSettingsBackend` either way.
@@ -14675,7 +14750,17 @@ var SiteZoneSchema = object({
 var ProviderStatusSchema = object({
 	connected: boolean(),
 	deviceCount: number(),
-	error: string().optional()
+	error: string().optional(),
+	/**
+	* `'orchestrator'`: this provider writes NO camera's `motion` runtime slice
+	* — the orchestrator is its only writer (D696). Set by `BaseDeviceProvider`,
+	* which every provider bundles, so only a provider BUILT from D696-amended
+	* code says it. ABSENT means an older provider that may still write it (raw
+	* VMD writes, a boot seed), and the orchestrator's provider gate keeps that
+	* provider's cameras unwritten (`camera-sensors/motion-slice-provider-gate.ts`)
+	* — the provider twin of the runner's `getLocalLoad().motionSliceWriter`.
+	*/
+	motionSliceWriter: literal("orchestrator").optional()
 });
 object({
 	externalId: string(),
@@ -15554,6 +15639,121 @@ method(object({
 	deviceIds: array(number()).readonly(),
 	caps: array(string()).readonly().optional()
 }), record(string(), record(string(), unknown().nullable())));
+var ExtensionSlotIdSchema = _enum(["linked-devices"]);
+DeviceType.Camera;
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+DeviceType.Camera;
+var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
+	state: literal("unreachable"),
+	reason: string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: string(),
+	label: string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (a source owned by another addon); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = _enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = object({
+	deviceId: number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62) — e.g.
+* a slot whose sources act only while a wrapper is bound to the host, a
+* binding that belongs to `deviceManager.setWrapperActive`. No slot reports
+* one today (`linked-devices` answers `null`). `unknown` means the gate could
+* not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = object({
+	state: _enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: string(),
+	detail: string().optional()
+});
+var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
+	state: literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `device-manager:_linkedDeviceIds`. */
+	authority: string(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: array(ExtensionSlotSourceSchema).optional()
+}), object({
+	state: literal("unreachable"),
+	addonId: string(),
+	reason: string()
+})]);
+var ExtensionCandidatesSchema = object({ candidates: array(object({
+	deviceId: number().int(),
+	name: string(),
+	type: string(),
+	location: string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: string().nullable()
+})) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS. A slot never adds a capability to its
+* host — that is a composition (D663) — so today's owners answer `none`.
+*/
+var ExtensionSetResultSchema = object({
+	applied: literal(true),
+	reload: _enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = object({
+	deviceId: number().int(),
+	slotRef: string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * Per-field ownership (D663). A composition may CLAIM fields of a native
 * cap's runtime-state slice on an existing device: `replace` overlays the
@@ -15777,7 +15977,7 @@ method(object({
 * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
 * ends in a log line, and a log line is the thing the operator asked to stop
 * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
-* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* ricontrolliamo tutti questi punti"* [can we instrument these errors in the meantime? That way next round we recheck all these points]. Reading them meant grepping Loki and
 * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
 * media blackout were both diagnosed. The counters stay; this is where they can
 * be READ.
@@ -17153,7 +17353,7 @@ var BrokerStatusSchema$1 = _enum([
 	"unreachable",
 	"tls-error"
 ]);
-var BrokerInfoSchema = object({
+var BrokerInfoSchema$1 = object({
 	id: string(),
 	name: string(),
 	url: string(),
@@ -17216,7 +17416,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+method(_void(), array(BrokerInfoSchema$1)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(IdInputSchema, _void(), {
@@ -18564,17 +18764,25 @@ var NcScheduleSchema = object({
 */
 var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
 /**
+* How a summary window is SENT (D698): `rule` (absent) = ONE notification with
+* every section; `section` = one notification per section with something to
+* say (an unavailable section included), each titled by its section.
+*/
+var NcStateSummarySplitSchema = _enum(["rule", "section"]);
+/**
 * `summary`: the rule sends NOTHING per event. When a window of `schedule`
 * CLOSES, it sends one notification with the current state of its kinds
 * (low batteries, consumables to replace, devices offline, updates
-* available, ...), after its own filters. Nothing to report sends nothing.
+* available, ...), after its own filters — or, with `split: 'section'`
+* (D698), one notification per section. Nothing to report sends nothing.
 * The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
 * midnight crossing); the send time is each window's END. Refused on the
 * `alarm` family, which stays instant (`systemEventDeliveryProblems`).
 */
 var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
 	mode: literal("summary"),
-	schedule: NcScheduleSchema
+	schedule: NcScheduleSchema,
+	split: NcStateSummarySplitSchema.optional()
 })]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
@@ -18714,8 +18922,14 @@ var NcSensorTransitionSchema = _enum(["raised", "cleared"]);
 /** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
 var NcZoneConditionSchema = object({
 	ids: array(string().min(1)).min(1),
-	/** Quantifier over `ids` — at least one / every one visited. */
-	match: _enum(["any", "all"]).default("any")
+	/**
+	* LEGACY quantifier over `ids`. Absent = `any` (at least one visited), which
+	* is what both editors mean and all they write since D690: "all of" was
+	* removed from the editors because on an immediate rule it asked one
+	* detection to stand in every zone at once. Still ACCEPTED, and `all` still
+	* evaluated, so a stored rule keeps parsing and meaning what it meant.
+	*/
+	match: _enum(["any", "all"]).optional()
 });
 /**
 * The P1 condition set — a flat AND of groups; absent group = pass;
@@ -19219,10 +19433,12 @@ var NcMediaPolicySchema = object({
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
 * notification suppresses.
-*  - `shared` (default, and the absent value) — one window for the whole
-*    rule/scope: a cat silences the next dog for `cooldownSec`.
-*  - `per-class` — an independent window per detected class, so cat→dog fires
-*    at once and cat→cat still waits.
+*  - `per-class` (default, and the absent value since 2026-10-01 — D36) — an
+*    independent window per detected class: cat→dog fires at once, cat→cat
+*    still waits.
+*  - `shared` — one window for the whole rule/scope: a cat silences the next
+*    dog for `cooldownSec`. Only written when an operator picks it; it is no
+*    longer what an unset rule means.
 *
 * AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
 * must not be swallowed by a bark's window (the precedent this generalizes —
@@ -19237,8 +19453,11 @@ var NcThrottleSchema = object({
 	/**
 	* Class granularity of the cooldown key. Optional rather than defaulted:
 	* a Zod default does NOT run on the addon→addon cap path, so a persisted
-	* rule authored before this field simply carries none — and the engine
-	* reads absent as `shared`, the pre-existing behaviour.
+	* rule authored before this field simply carries none. The engine used to
+	* read absent as `shared` (D36); since 2026-10-01 it reads absent as
+	* `per-class` — the operator's default — and only an explicit `shared`
+	* still means `shared`. See `cooldownKey` / `keysPerClass` in the rule
+	* engine, and D36's dated note.
 	*/
 	granularity: NcThrottleGranularitySchema.optional()
 });
@@ -19411,78 +19630,16 @@ var NcRuleInputSchema = object({
 	*/
 	confirm: NcConfirmSchema.optional(),
 	/**
-	* WAIT for face/plate recognition before saying anything.
-	*
-	* A notification's TEXT is frozen at enqueue and its media is re-resolved at
-	* send; the identity is neither. A face is confirmed after `confirmFrames`
-	* agreeing observations — p50 **11.4 s** after the track was first seen,
-	* measured on this hub — and an `immediate` rule enqueues on the first object
-	* event, seconds before that. So "Gianluca è arrivato" is unsayable on the
-	* immediate path, and no amount of media re-resolution fixes a sentence.
-	*
-	* Only two honest answers exist, and this flag picks between them. It has
-	* effect ONLY on a rule that declares a recognition scope
-	* ({@link NcConditions.identities} or {@link NcConditions.plates}) — on any
-	* other rule there is nothing to wait for and the flag is inert.
-	*
-	* | value | what happens |
-	* | --- | --- |
-	* | `true` | the rule stops firing on the object event and fires at TRACK CLOSE instead, once, with the name — later, and complete |
-	* | absent / `false` | it fires at once WITHOUT the name, and if recognition lands before the track closes a SECOND, "…is Gianluca" notification follows (one per track, per rule, per target) |
-	*
-	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
-	* on the addon cap path, and absent has to keep meaning exactly what every
-	* rule authored before this field meant.
-	*
-	* The cost of `true` is stated here because the editor states it too: a rule
-	* that waits also inherits track-close SEMANTICS — its `zones` condition
-	* tests every zone the track visited and a `crossing` condition can no longer
-	* be satisfied, because a closed track carries no crossing.
-	*/
-	waitForEnhancement: boolean().optional(),
-	/**
-	* GROUP a burst of subjects into ONE notification that grows.
-	*
-	* Seconds of quiet after the last matching subject before the burst is
-	* considered over. While it is open, the first subject enqueues immediately —
-	* **exactly as today, with no added latency** — and every real growth (a new
-	* subject, or a name confirmed on one already in it) REPLACES that
-	* notification with an updated one naming everybody. The push carries the
-	* group's own coalescing tag, so the phone replaces rather than stacks.
-	*
-	* `0` / absent = off, and off is today's behaviour byte for byte.
-	*
-	* ### Why an idle cutoff and not a window
-	*
-	* The measured seven-person arrival on device 590 spans 110 s with every
-	* internal gap under 30 s. A 12 s fixed window cuts it into three groups; an
-	* idle cutoff holds it as one and ends it when the arrival actually ends.
-	* 30 s is a widely shipped value for the same decision.
-	*
-	* ### What it replaces
-	*
-	* The blind cooldown, which collapses a burst by DISCARDING it. Measured on
-	* device 615 / *Persona su Uscio* over six days: 116 qualifying tracks → 74
-	* notifications, **44 (37.9%) suppressed outright**, 23 of them overlapping a
-	* track that did fire and 7 carrying a confirmed identity nobody heard about.
-	* A group collapses the same volume by MERGING, so the cooldown becomes a
-	* budget over GROUPS — which is what it always meant — and a growth is never
-	* throttled by the window its own first member spent.
-	*
-	* ### Interaction with {@link waitForEnhancement}
-	*
-	* They compose, and the order matters. `waitForEnhancement` defers the rule to
-	* TRACK CLOSE, so with both set the group is opened by the first member to
-	* CLOSE — already carrying its name — and grows as later members close. That
-	* is later, and complete. With grouping alone the group opens on the first
-	* object event and picks up names as they are confirmed, through the growth
-	* path. Neither combination fires twice for one subject.
-	*
-	* `.optional()` and deliberately NOT `.default()`: a Zod default does not run
-	* on the addon cap path, so absent must keep meaning what it meant before this
-	* field existed.
+	* IMMEDIATE GROUPED (D692): the first matching subject opens a window of this many
+	* seconds; the rule sends ONE message when the window closes — early, once every
+	* subject in it is final, never before {@link NC_GROUPING_MIN_SEC} — naming everybody
+	* the rule matched, with one mosaic tile per subject.
+	* Absent = plain immediate (one message per track, at the first match).
+	* Only an `immediate` DETECTION rule may carry it (`ruleGroupingApplies`, enforced on
+	* save by the hub's grouping guard). `.optional()`, never `.default()`: the addon cap
+	* path does not run Zod defaults.
 	*/
-	groupIdleSec: number().int().min(0).max(600).optional()
+	groupingSec: number().int().min(5).max(60).optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -19530,9 +19687,10 @@ var NcRuleClearableKeySchema = _enum([
 	"targetUsers",
 	"snoozeOptions",
 	"snoozeAllowGlobal",
-	"waitForEnhancement",
 	"actions",
 	"confirm",
+	"groupingSec",
+	"waitForEnhancement",
 	"groupIdleSec"
 ]);
 var NcRuleUpdateInputSchema = object({
@@ -19554,19 +19712,47 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	*/
 	disabledTargetIds: array(string()).default([])
 });
+/**
+* The state-summary SECTIONS (D647 / D698): the D637 kind groups that report a
+* still-true state. `backups-exports` and `alarm` are not sections — a completed
+* job is not an open state, and the alarm stays instant.
+*/
+var NcStateSummarySectionIdSchema = _enum([
+	"device-state",
+	"streams",
+	"battery",
+	"consumables",
+	"tanks",
+	"detection-blind",
+	"nodes",
+	"addons",
+	"updates"
+]);
 /** One section of a previewed state summary. `unavailable` = its state could not be read. */
 var NcStateSummaryPreviewSectionSchema = object({
-	id: string(),
+	id: NcStateSummarySectionIdSchema,
 	status: _enum(["read", "unavailable"]),
 	items: number().int().nonnegative(),
 	reason: string().optional()
 });
 /**
+* One notification a previewed summary would send (D698): the whole summary on
+* a `rule` split (no `section`), one section's on a `section` split.
+*/
+var NcStateSummaryPreviewRowSchema = object({
+	section: NcStateSummarySectionIdSchema.optional(),
+	/** The section's name on a per-section row; every reported section's, joined, on a combined one. */
+	title: string(),
+	text: string(),
+	count: number().int().nonnegative()
+});
+/**
 * The summary a rule would send now. `empty` = nothing to report and every
 * section read: such a summary is NOT sent. `dropped` counts the open states
 * the rule's own filters (or a camera mute) left out, by reason.
 * `excludedGroups` names the kind groups selected that have no state to report
-* (backups & exports).
+* (backups & exports). `split` and `rows` (D698) say how it would be sent —
+* optional, so an older hub's answer still parses.
 */
 var NcStateSummaryPreviewSchema = object({
 	empty: boolean(),
@@ -19574,7 +19760,9 @@ var NcStateSummaryPreviewSchema = object({
 	text: string(),
 	sections: array(NcStateSummaryPreviewSectionSchema),
 	dropped: record(string(), number().int().nonnegative()),
-	excludedGroups: array(string())
+	excludedGroups: array(string()),
+	split: NcStateSummarySplitSchema.optional(),
+	rows: array(NcStateSummaryPreviewRowSchema).optional()
 });
 var NcTestResultSchema = object({
 	recordId: string(),
@@ -19989,6 +20177,29 @@ object({
 	firstAt: number(),
 	lastAt: number()
 });
+var NC_ALARM_TRIGGERED_MAX_SEC = 3600;
+var NcAlarmDelaySecSchema = number().int().min(0).max(600);
+var NcAlarmTriggeredSecSchema = number().int().min(0).max(NC_ALARM_TRIGGERED_MAX_SEC);
+var uniqueModes = (entries) => new Set(entries.map((e) => e.mode)).size === entries.length;
+var NcAlarmModeDelaysListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	exitDelaySec: NcAlarmDelaySecSchema.optional(),
+	entryDelaySec: NcAlarmDelaySecSchema.optional(),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.optional()
+})).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
+var NcAlarmModeDelaysEditListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	exitDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
+	entryDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional()
+})).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
+/** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
+var NcAlarmNonBlockingEditSchema = object({
+	mode: AlarmArmModeSchema,
+	deviceId: number().int().positive(),
+	/** true = on the list (may be open, does not block); false = off the list (blocks). */
+	nonBlocking: boolean()
+});
 /**
 * The per-mode lists, at most one per mode. Two lists for one mode have no
 * meaning a reader could agree on (union? the last one?), so they are refused
@@ -19997,10 +20208,10 @@ object({
 var NcAlarmNonBlockingListSchema = array(object({
 	mode: AlarmArmModeSchema,
 	deviceIds: array(number().int()).max(200)
-})).max(8).refine((lists) => new Set(lists.map((l) => l.mode)).size === lists.length, { message: "nonBlocking: at most one list per arm mode" });
+})).max(8).refine(uniqueModes, { message: "nonBlocking: at most one list per arm mode" });
 /**
-* The three durations the panel's state machine runs on, who hears about its
-* transitions, and which openings each mode tolerates.
+* The three durations — global, and per mode since D697 — the panel's state
+* machine runs on, who hears about its transitions, and which openings each mode tolerates.
 *
 * They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
 * `alarm-panel` is `deviceNative` and its other provider mirrors somebody
@@ -20010,15 +20221,15 @@ var NcAlarmNonBlockingListSchema = array(object({
 */
 var NcAlarmSettingsSchema = object({
 	/** Grace period between arming and the mode taking effect. 0 = immediate. */
-	exitDelaySec: number().int().min(0).max(600),
+	exitDelaySec: NcAlarmDelaySecSchema,
 	/** Grace period between a trigger and the alarm firing. 0 = immediate. */
-	entryDelaySec: number().int().min(0).max(600),
+	entryDelaySec: NcAlarmDelaySecSchema,
 	/**
 	* How long `triggered` lasts before the panel re-arms itself.
 	* **0 = until an operator disarms it** — the behaviour before this field
 	* existed, and therefore what an untouched install keeps doing.
 	*/
-	triggeredDurationSec: number().int().min(0).max(3600),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema,
 	/**
 	* Deprecated by D630 — every transition is announced. Parsed, never read;
 	* remove after one release. Optional so an older admin's patch (which still
@@ -20041,17 +20252,30 @@ var NcAlarmSettingsSchema = object({
 	* per mode is meaningful. Defaulted to `[]` so a blob stored before D630
 	* parses as "every opening blocks" — the behaviour it was written under.
 	*/
-	nonBlocking: NcAlarmNonBlockingListSchema.default([])
+	nonBlocking: NcAlarmNonBlockingListSchema.default([]),
+	/**
+	* Per arm mode, the delays that mode OVERRIDES (D697). A mode with no entry, or an entry
+	* without a field, uses the global value above — so `[]`, the default, is exactly the
+	* behaviour of a blob stored before this field existed. Read through `resolveModeDelays`.
+	*/
+	modeDelays: NcAlarmModeDelaysListSchema.default([])
 });
 /**
 * Every field optional — a tab edits one control at a time.
 *
-* `nonBlocking` is re-declared WITHOUT its default: `.partial()` does not
-* remove an inner `.default()`, so a patch that never named the field would
-* parse to `nonBlocking: []` and wipe every mode's list on an unrelated edit
-* (the same trap {@link NcRulePatchSchema} documents).
+* `nonBlocking` and `modeDelays` are re-declared WITHOUT their defaults:
+* `.partial()` does not remove an inner `.default()`, so a patch that never
+* named the field would parse to `[]` and wipe every mode's list on an
+* unrelated edit (the same trap {@link NcRulePatchSchema} documents). Here
+* `modeDelays` means EDITS, not the stored overrides.
 */
-var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({ nonBlocking: NcAlarmNonBlockingListSchema }).partial();
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({
+	nonBlocking: NcAlarmNonBlockingListSchema,
+	/** Per-mode, per-field edits — NOT the whole list (see NcAlarmModeDelaysEditSchema). */
+	modeDelays: NcAlarmModeDelaysEditListSchema,
+	/** ONE membership change; the panel applies it to the list it holds at its turn. */
+	nonBlockingEdit: NcAlarmNonBlockingEditSchema
+}).partial().refine((p) => p.nonBlocking === void 0 || p.nonBlockingEdit === void 0, { message: "nonBlocking and nonBlockingEdit are exclusive — send the whole lists or one edit" });
 /**
 * What one arm mode actually arms, DERIVED from the enabled rules gated on it.
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
@@ -20151,6 +20375,28 @@ var NcAlarmConfigSchema = object({
 	*/
 	live: NcAlarmLiveSchema.optional()
 });
+var NcAlarmSensorReadingSchema = _enum([
+	"open",
+	"closed",
+	"unknown",
+	"not-opening"
+]);
+/** One device's state as the alarm reads it — the classifier the arm check uses. */
+var NcAlarmSensorStateSchema = object({
+	deviceId: number().int().positive(),
+	reading: NcAlarmSensorReadingSchema,
+	/** The word as read (`open`, `closed`, `unlocked`, `stopped`, …); null when unknown / not an opening. */
+	state: string().nullable(),
+	/** Why `unknown`: the read failed, or the slice holds no word its cap defines (a placeholder included). */
+	unknownWhy: _enum(["read-failed", "unknown-word"]).nullable(),
+	/** The device manager's liveness as the centre mirrors it; null = not known. */
+	online: boolean().nullable()
+});
+var NcAlarmSensorsInputSchema = object({ deviceIds: array(number().int().positive()).max(500) });
+var NcAlarmSensorsSchema = object({
+	sensors: array(NcAlarmSensorStateSchema),
+	readAt: number().int().nonnegative()
+});
 /**
 * ONE rule's demand on ONE camera's clip ring.
 *
@@ -20241,7 +20487,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), NcAlarmConfigSchema, { auth: "admin" }), method(object({ patch: NcAlarmSettingsPatchSchema }), NcAlarmConfigSchema, {
 	kind: "mutation",
 	auth: "admin"
-});
+}), method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -20588,12 +20834,26 @@ var CameraSensorRefSchema = object({
 function cameraSensorRefKey(ref) {
 	return `${ref.addonId}/${ref.stableId}`;
 }
-/** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
-var CameraSensorsModeSchema = _enum(["in-addition"]);
-var CameraSensorsConfigSchema = object({
-	mode: CameraSensorsModeSchema,
-	sensors: array(CameraSensorRefSchema).min(1).max(8)
-}).superRefine((value, ctx) => {
+/**
+* A sensor's mode (D673). `in-addition`: its motion is the camera's motion too.
+* `replace`: its motion is the camera's, and while one is READY the camera's
+* own motion no longer counts on its own. `confirm`: while one is READY the
+* camera's own motion counts only while a confirm sensor is active — with or
+* without a replace sensor (spec C2, the controller's ruling on Q1).
+*/
+var CameraSensorModeSchema = _enum([
+	"in-addition",
+	"confirm",
+	"replace"
+]);
+/** A stored sensor with no mode — every CS-1 row — is in addition. */
+var DEFAULT_CAMERA_SENSOR_MODE = "in-addition";
+/**
+* A camera's attached sensors. A CS-1 row carried an envelope
+* `mode: 'in-addition'`: `z.object` drops it on parse, and the PARSED value is
+* what the write stores (D672 rule 3), so it is never written again.
+*/
+var CameraSensorsConfigSchema = object({ sensors: array(CameraSensorRefSchema.extend({ mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE) })).min(1).max(8) }).superRefine((value, ctx) => {
 	const seen = /* @__PURE__ */ new Set();
 	value.sensors.forEach((ref, index) => {
 		const key = cameraSensorRefKey(ref);
@@ -20605,39 +20865,41 @@ var CameraSensorsConfigSchema = object({
 		seen.add(key);
 	});
 });
-var RefFields = {
+/** Every attachment names its mode; an older orchestrator that does not is in addition. */
+var AttachmentFields = {
 	addonId: string(),
-	stableId: string()
+	stableId: string(),
+	mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE)
 };
 var CameraSensorAttachmentSchema = discriminatedUnion("state", [
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("ready"),
 		deviceId: number(),
 		name: string(),
 		caps: array(string()).readonly()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("offline"),
 		deviceId: number(),
 		name: string(),
 		reason: _enum(["offline", "disabled"])
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("missing"),
 		reason: string()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("unsupported"),
 		deviceId: number(),
 		name: string(),
 		reason: string()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("unreadable"),
 		reason: string()
 	})
@@ -20650,17 +20912,49 @@ var CameraSensorAttachmentSchema = discriminatedUnion("state", [
 * say.
 */
 var CameraSensorsNotForwardedSchema = _enum(["onboard-not-listed", "no-active-detection"]);
+/** Whether the camera's OWN motion counts on its own (D673 C2), from its READY sensors (C3). */
+var CameraOwnMotionSchema = _enum([
+	"always",
+	"when-confirmed",
+	"never"
+]);
+/** Confirm / Replace cannot suppress this camera's motion: its provider still emits it directly (D673 C13). */
+var CameraSensorsNotEnforcedSchema = _enum(["provider-not-split"]);
+/**
+* The camera's OWN onboard motion (D696): the raw input the bridge combines,
+* never the effective value. The camera's `motion` slice is the effective one,
+* so a view of the camera's own row reads this.
+* - `atMs`: when the bridge received the camera's last own edge.
+* - `detected`: evaluated WHEN THE STATUS IS ASKED — the last edge said `true`
+*   AND it is younger than the window the bridge counts the camera's own motion
+*   for (`motionCooldownMs`, floored at two sustain ticks). A camera that never
+*   sends a clear (heartbeats only) therefore reads `false` once no push came
+*   within the window; a status read is a snapshot, so a live view re-asks.
+* Absent = this orchestrator has not received the camera's own motion since it
+* started (unknown, never "quiet"), or an orchestrator older than D696.
+*/
+var CameraRawLevelSchema = object({
+	detected: boolean(),
+	atMs: number()
+});
 var CameraSensorsStatusSchema = discriminatedUnion("state", [
-	object({ state: literal("not-configured") }),
+	object({
+		state: literal("not-configured"),
+		cameraLevel: CameraRawLevelSchema.optional()
+	}),
 	object({
 		state: literal("unreadable"),
-		reason: string()
+		reason: string(),
+		cameraLevel: CameraRawLevelSchema.optional()
 	}),
 	object({
 		state: literal("configured"),
-		mode: CameraSensorsModeSchema,
+		cameraLevel: CameraRawLevelSchema.optional(),
 		sensors: array(CameraSensorAttachmentSchema).readonly(),
-		notForwarded: CameraSensorsNotForwardedSchema.optional()
+		/** Absent = an orchestrator older than CS-2: it does not say (D315). */
+		cameraMotion: CameraOwnMotionSchema.optional(),
+		notForwarded: CameraSensorsNotForwardedSchema.optional(),
+		notEnforced: CameraSensorsNotEnforcedSchema.optional()
 	})
 ]);
 Object.freeze({
@@ -21345,14 +21639,14 @@ var TrackSchema = object({
 	* `derive-returned-null tile=standin`,
 	* `native-tile tile=native no-key-frame-at-close`, …) written at close and
 	* CLEARED by the late-keyFrame upgrade when a native tile lands after all.
-	* The operator-facing answer to "perché manca l'immagine?" on a track whose
+	* The operator-facing answer to "perché manca l'immagine?" [why is the image missing?] on a track whose
 	* tile is a face/plate stand-in, a raster crop, or an icon.
 	*
 	* **`no-key-frame-at-close` (D400).** The line used to be written ONLY when
 	* the TILE ranked below native, so a track whose thumbnail landed natively
 	* while its key frame missed carried no reason at all — three of the four
 	* `MISSING_KEYFRAME` tracks in the 2026-09-07 operator audit were exactly
-	* that shape, and their "niente ultimo" had no cause anywhere on the row.
+	* that shape, and their "niente ultimo" [no last frame] had no cause anywhere on the row.
 	* The key frame is the head of a cascade (`keyFrame ⇒ keyFrameSmall ⇒ the
 	* lastFrame copy source`), so its absence is now on this line whatever the
 	* tile ended up being.
@@ -21439,7 +21733,7 @@ var MotionEventSchema = object({
 	/**
 	* Ms offsets from `timestamp` (the episode's own first rising edge, so the
 	* first entry is always `0`) of every genuine off→on transition the
-	* episode saw — "ogni evento on si deve salvare" (D475). NOT one entry per
+	* episode saw — "ogni evento on si deve salvare" [every ON event must be saved] (D475). NOT one entry per
 	* push: a firmware source that keepalives at ~1 Hz for the whole burst
 	* (Reolink, Hikvision) produces exactly one edge; a source that reports an
 	* explicit `false` mid-episode and then resumes before the quiet window
@@ -21963,6 +22257,7 @@ var KeyEventSchema = object({
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
 	windowMs: number().optional(),
+	audioLabels: array(TrackAudioLabelSchema).readonly().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -22495,7 +22790,8 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	trackIds: array(string()).min(1)
 }), object({
 	deleted: number().int(),
-	failed: array(string()).readonly()
+	failed: array(string()).readonly(),
+	sparedMediaIds: array(number().int()).readonly().optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -23890,8 +24186,10 @@ var RunnerCameraConfigSchema = object({
 	* - `analyzer`: ML/frame-diff motion detection (motion-wasm or other
 	*   analyzer providers) running on decoded frames in this runner.
 	* - `onboard`: camera-native motion pushes (Reolink Baichuan, ONVIF
-	*   analytics). The provider emits ProviderMotion
-	*   events; the orchestrator forwards to `reportMotion`.
+	*   analytics). The provider emits its raw push as `ProviderMotion`
+	*   (D673); the orchestrator's camera-sensors bridge re-emits the camera's
+	*   effective motion as `MotionOnMotionChanged`, which is what reaches
+	*   `reportMotion`.
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
@@ -24068,7 +24366,15 @@ var RunnerLocalLoadSchema = object({
 		hasGpu: boolean(),
 		inferenceBackend: string().optional(),
 		cpuCores: number().optional()
-	})
+	}),
+	/**
+	* Who writes a camera's `motion` runtime slice (D696). `'orchestrator'`: this
+	* runner never writes it. ABSENT = a runner older than D696, which still
+	* writes the slice from its phase machine; the orchestrator does not write
+	* while any runner node is absent-or-unanswered, so one slice never has two
+	* writers.
+	*/
+	motionSliceWriter: literal("orchestrator").optional()
 });
 /**
 * Aggregate runtime metrics for the runner's whole local pool. Mirrors the
@@ -24724,7 +25030,42 @@ var SetCameraSensorsInputSchema = object({
 	/** `null` removes the attachment: the camera goes back to `not-configured`. */
 	config: CameraSensorsConfigSchema.nullable()
 });
-method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
+/**
+* Why an early occupancy look (D691) was not scheduled.
+*
+* - `unknown-camera` — no session was ever dispatched for it, so there is no
+*   node and no config to attach a burst with.
+* - `out-of-range` — the ask is negative or further out than the orchestrator
+*   will hold a timer for; the parked-object cadence is the answer there.
+* - `no-burst-producer` — this build has no burst producer at all.
+* - `already-looked` — this camera's ONE early look since its last session has
+*   been spent. A look's own burst can re-arm a flickering flip, and a look
+*   per arm would chain a burst every ~30 s forever (review H2); the next
+*   real session re-arms the budget.
+*/
+var OccupancyLookRefusalSchema = _enum([
+	"unknown-camera",
+	"out-of-range",
+	"no-burst-producer",
+	"already-looked"
+]);
+method(object({
+	deviceId: number().int().nonnegative(),
+	/** How long from NOW until the pending flip's sustain window ends. RELATIVE,
+	*  so the caller's clock and the orchestrator's never have to agree. */
+	afterMs: number().finite(),
+	/** Why, for the log. */
+	reason: string()
+}), object({
+	scheduled: boolean(),
+	/** When `scheduled`: how long until the burst is dialled. */
+	dueInMs: number().optional(),
+	/** When not `scheduled`: why. */
+	refusedBecause: OccupancyLookRefusalSchema.optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(StorageMigrationLeaseInputSchema, object({ paused: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(StorageMigrationLeaseInputSchema, object({ resumed: literal(true) }), {
@@ -26802,7 +27143,7 @@ var ClipPlaybackSchema = object({
 * **One authorised yes is one wake.** `next-natural` — take the clip the next
 * time the camera is awake for its own reasons — is deliberately not a member:
 * it was proposed, it is free on the battery, and the operator declined it on
-* 2026-09-20 (*"Quando un export viene richiesto si sveglia la camera."*,
+* 2026-09-20 (*"Quando un export viene richiesto si sveglia la camera."* [When an export is requested the camera wakes up],
 * D558 "Considered and not taken").
 */
 var ClipWakeSchema = _enum(["authorised"]);
@@ -27063,7 +27404,7 @@ DeviceType.Camera, method(object({
 	* It replaced `sources?: string[]`, a VIEW filter over source ids that
 	* assumed the answer was a fan-out over everything a camera has. The
 	* operator settled otherwise on 2026-09-20 — *"l'utilizzatore è uno
-	* solo"* — so the list is asked of one provider at a time and there is
+	* solo"* [there is only one user] — so the list is asked of one provider at a time and there is
 	* nothing to filter out of it.
 	*/
 	provider: string().min(1)
@@ -27191,219 +27532,6 @@ DeviceType.Camera, method(object({
 	auth: "protected"
 });
 /**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number()
-});
-var DoorbellPressEventSchema = object({
-	deviceId: number(),
-	timestamp: number()
-});
-/**
-* The `doorbell-source` extension slot's editable value (D648): the camera's
-* virtual-doorbell trigger devices, exactly what the wrapper's
-* `doorbellSources` persists (as `{ deviceId }` records).
-*/
-var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
-/**
-* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
-* doorbell, owned by the `virtual-doorbell` wrapper over its
-* `doorbellSources` store (D648). A source rings when one of its
-* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
-* different authority (`deviceManager.setWrapperActive`, D62) — the slot
-* reports it, it never writes it.
-*/
-var DOORBELL_SOURCE_SLOT = {
-	id: "doorbell-source",
-	label: "Doorbell trigger devices",
-	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
-	shape: "association",
-	hostDeviceTypes: [DeviceType.Camera],
-	sourceCaps: SOURCE_CAPS,
-	cardinality: "many",
-	value: DoorbellSourceSlotValueSchema
-};
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	extensionSlots: [DOORBELL_SOURCE_SLOT],
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: {
-		data: DoorbellPressEventSchema,
-		fromState: {
-			field: "lastPressedAt",
-			on: "advance"
-		}
-	} },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
-DeviceType.Camera, DeviceType.Camera;
-/** A slot's editable value, discriminated on `slot`. */
-var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
-DeviceType.Camera;
-var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
-	state: literal("unreachable"),
-	reason: string()
-})]);
-/** One provider of slots — the D554 source-listing row. */
-var ExtensionSourceSchema = object({
-	/** The routing prefix of every `slotRef` this provider serves. */
-	source: string(),
-	label: string(),
-	/** Stamped by the dispatcher from the registry (D557). */
-	addonId: string().optional(),
-	availability: ExtensionSourceAvailabilitySchema
-});
-/**
-* How one picked source stands. `missing` — no such device (deleted, or an id
-* that never existed); `foreign` — a device the slot's owner cannot read from
-* (a source owned by another addon); `unavailable` — it exists but is not a
-* valid source now (a container, which is never a pick). A source in any of
-* these states is SHOWN, never silently dropped or re-pointed.
-*/
-var ExtensionSourceHealthSchema = _enum([
-	"ok",
-	"missing",
-	"foreign",
-	"unavailable"
-]);
-var ExtensionSlotSourceSchema = object({
-	deviceId: number().int(),
-	/** The device's name, or null when it could not be resolved (`missing`). */
-	name: string().nullable(),
-	health: ExtensionSourceHealthSchema,
-	detail: string().optional()
-});
-/**
-* A DIFFERENT authority that gates whether the slot's sources do anything —
-* reported read-only, named, never written through this contract (D62). The
-* virtual doorbell's sources ring only while the wrapper is bound to the
-* camera, and that binding belongs to `deviceManager.setWrapperActive`.
-* `unknown` means the gate could not be read; it is not "inactive" (D315).
-*/
-var ExtensionSlotActivationSchema = object({
-	state: _enum([
-		"active",
-		"inactive",
-		"unknown"
-	]),
-	authority: string(),
-	detail: string().optional()
-});
-var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
-	state: literal("ok"),
-	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
-	slotRef: string(),
-	slot: ExtensionSlotIdSchema,
-	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
-	authority: string(),
-	activation: ExtensionSlotActivationSchema.nullable(),
-	value: ExtensionSlotValueSchema,
-	sources: array(ExtensionSlotSourceSchema),
-	/**
-	* Devices the owner links to the host ON ITS OWN, by structure, and that
-	* are therefore not in `value` (D655): a camera's device-tree children, and
-	* the child a picked container stands for (D356 — a container is never a
-	* pick, its children are). Read-only; the editor shows them and may offer
-	* per-device options on them (the linked-devices tracked-event opt-in).
-	* Absent when the owner links nothing beyond the picks, and from an owner
-	* older than D655.
-	*/
-	impliedSources: array(ExtensionSlotSourceSchema).optional()
-}), object({
-	state: literal("unreachable"),
-	addonId: string(),
-	reason: string()
-})]);
-var ExtensionCandidatesSchema = object({ candidates: array(object({
-	deviceId: number().int(),
-	name: string(),
-	type: string(),
-	location: string().nullable(),
-	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
-	parentName: string().nullable(),
-	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
-	suggested: boolean(),
-	/** Why it is suggested ("same location"), null when it is not. */
-	reason: string().nullable()
-})) });
-/**
-* What a write did. `none` — applied in place. `host` / `parent` — the owner
-* reloaded the host (or, for an accessory child, its parent) because the
-* write changed what the host REGISTERS. A slot never adds a capability to its
-* host — that is a composition (D663) — so today's owners answer `none`.
-*/
-var ExtensionSetResultSchema = object({
-	applied: literal(true),
-	reload: _enum([
-		"none",
-		"host",
-		"parent"
-	])
-});
-var ExtensionSlotRefInputSchema = object({
-	deviceId: number().int(),
-	slotRef: string().min(1)
-});
-var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
-method(object({ deviceId: number().int() }), array(ExtensionSourceSchema)), method(object({ deviceId: number().int() }), array(ExtensionSlotRowSchema)), method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema), method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Optional client-side hints sent at session creation to help the provider
 * pick the best native source. All fields optional — a viewer that knows
 * nothing still gets a sane default. (Relocated from the retired `webrtc`
@@ -29879,6 +30007,70 @@ onStatusChanged: { data: object({
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
 };
+var DoorbellStatusSchema = object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number()
+});
+var DoorbellPressEventSchema = object({
+	deviceId: number(),
+	timestamp: number()
+});
+/**
+* Doorbell button cap. Two kinds of provider serve it, and to every consumer
+* they are the same cap:
+*
+*   - **Native** providers, registered per device by a driver addon through
+*     `ctx.registerNativeCap` — a `DeviceType.Button` accessory with
+*     `role: DeviceRole.Doorbell`, or the camera itself (Reolink registers at
+*     camera level). They emit `onPressed` on every firmware ring.
+*   - **A composed doorbell** (D670, D671): a camera's customization gives it
+*     the cap, its `lastPressedAt` rising from the sources the operator
+*     assigned in Customize → Doorbell, and the composer emits `onPressed`
+*     from that field's advance (`fromState`).
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent.
+*/
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: {
+		data: DoorbellPressEventSchema,
+		fromState: {
+			field: "lastPressedAt",
+			on: "advance"
+		}
+	} },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
 /**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -32023,9 +32215,9 @@ var MotionStatusSchema = object({
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: number().nullable(),
 	/**
-	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device,
-	* `null` while false and on every `Sensor` device (D475) — see that
-	* constant's doc for the one-authority rule.
+	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device (the
+	* orchestrator writes it, D696), `null` while false and on every `Sensor`
+	* device (D475) — see that constant's doc for the one-authority rule.
 	*
 	* ## Reading this field still arms nothing
 	*
@@ -32043,34 +32235,31 @@ var MotionStatusSchema = object({
 	* `addon-export-alexa/src/motion-clear-hold.ts` and
 	* `addon-export-hap`'s `RESET_DEBOUNCE_MS` both do.
 	*
-	* ## Who writes it
-	*
-	* - **Cameras** — the runner's phase machine, `active → watching` on
-	*   `cooldown_expired`, which then writes this slice with
-	*   `detected: false` (`handlePhaseChanged` in
-	*   `pipeline-runner/index.ts`). It produces the FALLING edge, which
-	*   matters most for the sources that only ever push a rising one:
-	*   Reolink emits `MotionOnMotionChanged { detected: true }` and never
-	*   a false.
-	* - **Sensors** (Home Assistant binary sensors, Homematic) — the
-	*   provider pushes the false itself, from the upstream system's own
-	*   state change. No phase machine is involved.
-	*
-	* ### The phase machine is CANONICAL, not sole — and that is a defect
-	*
-	* An earlier revision of this docblock (mine, 2026-09-12) claimed the
-	* phase machine is the sole writer for a camera. It is not.
-	* `hikvision-camera.ts:3464` and `amcrest-camera.ts:445` both call
-	* `setCapSlice(motionCapability, …)` on their own rising edge, and
-	* Hikvision's comment says why: it read THIS docblock, agreed the
-	* runner is canonical, and wrote anyway to avoid per-tick churn. So
-	* two authorities can disagree about one slice, which this repo
-	* forbids, and the doc said otherwise — which is worse than saying
-	* nothing, because it reads as verification.
-	*
-	* This predates D475 and is not fixed there: the fix touches every
-	* camera provider. Recorded in D475's Consequences. Do not restore the
-	* "sole writer" wording without also removing the other writers.
+	* ## Who writes it (D696)
+	*
+	* - **Cameras** — the orchestrator, and nothing else. It writes the camera's
+	*   EFFECTIVE motion (`addon-pipeline-orchestrator`
+	*   `camera-sensors/motion-slice.ts`), alongside the effective
+	*   `MotionOnMotionChanged` it emits or receives: the camera-sensors bridge
+	*   for a split camera, an unsplit emitter's direct event, the analyzer and
+	*   device activity, as the camera's `motionSources` counts them. A source
+	*   that never sends a clear falls one window after its last `true`.
+	*   `lastDetectedAt` moves only on an effective rise. No camera provider
+	*   writes this slice (not even a boot seed), and neither does the runner's
+	*   phase machine: its phase is "a session is attached" for every on-motion
+	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
+	*   A provider's `isDetected` answers from the hub's slice.
+	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
+	*   imports) — the provider pushes both edges itself, from the upstream
+	*   system's own state change. That is the sensor's own fact.
+	*
+	* `scripts/check-onboard-motion-emitters.ts` refuses any other writer of a
+	* `motion` slice; each sensor writer is a named exemption.
+	*
+	* This replaces the D475 §4 rule ("the phase machine is the sole writer").
+	* That rule was never true: Hikvision and Amcrest wrote the slice raw beside
+	* it, every provider seeded it at boot, and every session left it
+	* `detected: true` after its detach.
 	*/
 	autoClearAfterMs: number().nullable()
 });
@@ -32142,11 +32331,12 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	*/
 	runtimeState: MotionStatusSchema,
 	/**
-	* Runtime-state durability: **session** — every writer of this slice
+	* Runtime-state durability: **session** — the writer of this slice
 	* writes only on an EDGE, so a restored `detected: true` would stay
 	* frozen until the next one instead of being corrected. The next edge
-	* re-publishes the real state. (On who the writers are, and why there
-	* is more than one, see `autoClearAfterMs` above.)
+	* re-publishes the real state, and the orchestrator re-publishes every
+	* camera when it starts writing (D696; on who writes it, see
+	* `autoClearAfterMs` above).
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
@@ -34529,8 +34719,7 @@ var ptzAutotrackCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	/**
-	* Two kinds of provider behind one name, the same shape `snapshot` and
-	* `doorbell` use:
+	* Two kinds of provider behind one name, the same shape `snapshot` uses:
 	*
 	*  - **Native**: the camera's own firmware autotrack, registered per device by
 	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
@@ -34538,7 +34727,7 @@ var ptzAutotrackCapability = {
 	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
 	*    which follows a subject with `ptz.move` pulses driven by the detection
 	*    pipeline. `defaultActive: false` — the operator binds it per camera in
-	*    the bindings UI, exactly as `virtual-doorbell` is bound.
+	*    the bindings UI.
 	*
 	* The binding chooses WHICH implementation answers; `setEnabled` stays the
 	* one switch for the function either way. A camera never has both driving its
@@ -35213,7 +35402,7 @@ var ReadGopBytesResultSchema = object({
 /**
 * A time WINDOW of one finalized segment, cut by byte range — the multi-GOP
 * twin of {@link ReadGopBytesResultSchema}'s single instant. Built for the
-* replay clip's `recording` source (`docs/design/plans/2026-08-26-replay-clip-su-pipeline.md`):
+* replay clip's `recording` source (`docs/design/plans/2026-08-26-clip-replay-on-pipeline.md`):
 * a replay needs several seconds of native pixels, not one frame.
 *
 * `ok.data` is standalone-demuxable, same as a GOP read. `ok.reachesRequestedEnd`
@@ -38577,6 +38766,7 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
+SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -39636,13 +39826,14 @@ var BaseDeviceProvider = class extends BaseAddon {
 	async getStatus() {
 		const all = await this.ctx.kernel.devices?.getAll() ?? [];
 		const summary = this.restoreFailureSummary();
-		if (summary === null) return {
+		const base = {
 			connected: true,
-			deviceCount: all.length
+			deviceCount: all.length,
+			motionSliceWriter: "orchestrator"
 		};
+		if (summary === null) return base;
 		return {
-			connected: true,
-			deviceCount: all.length,
+			...base,
 			error: summary
 		};
 	}
@@ -42672,6 +42863,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"databaseSnapshot.listDatabases": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"databaseSnapshot.writeSnapshot": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.aggregate": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -45132,6 +45335,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getAlarmSensors": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getClipRetentionAsks": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -46236,6 +46445,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineOrchestrator.requestOccupancyLook": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.resetNodePipelineDefaults": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -48704,6 +48919,11 @@ Object.freeze({
 	}
 });
 Object.freeze({
+	"accessories.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"accessories.setChildHidden": [{
 		name: "childDeviceId",
 		form: "single",
@@ -48723,6 +48943,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"airQualitySensor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"alarmPanel.arm": [{
 		name: "deviceId",
 		form: "single",
@@ -48733,11 +48958,36 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"alarmPanel.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"alarmPanel.trigger": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"ambientLightSensor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioAnalysis.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioAnalysis.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"audioAnalysis.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"audioAnalysis.resolveDeviceSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -48778,16 +49028,36 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"automationControl.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"automationControl.trigger": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"battery.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"battery.wakeForStream": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"binary.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"brightness.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"brightness.setBrightness": [{
 		name: "deviceId",
 		form: "single",
@@ -48803,6 +49073,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"cameraCredentials.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraGridLayout.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraGridLayout.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraGridLayout.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"cameraGridLayout.getLayout": [{
 		name: "deviceId",
 		form: "single",
@@ -48818,6 +49108,21 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"cameraPipelineConfig.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraPipelineConfig.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"cameraPipelineConfig.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"cameraStreams.getBrokerStreams": [{
 		name: "deviceId",
 		form: "single",
@@ -48843,6 +49148,16 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"carbonMonoxide.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"climateControl.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"climateControl.setFanMode": [{
 		name: "deviceId",
 		form: "single",
@@ -48883,16 +49198,41 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"color.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"color.setColor": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"connectivity.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"consumables.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"consumables.reset": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"contact.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"control.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"control.setValue": [{
 		name: "deviceId",
 		form: "single",
@@ -48903,6 +49243,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"cover.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"cover.open": [{
 		name: "deviceId",
 		form: "single",
@@ -48928,6 +49273,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"dayNight.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"dayNight.setSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -48938,11 +49288,31 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"detectionPipeline.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"detectionPipeline.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"detectionPipeline.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceAdminLink.getAdminLink": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"deviceAdoption.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceAdoption.release": [{
 		name: "camDeviceId",
 		form: "single",
@@ -48958,6 +49328,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceDiscovery.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceDiscovery.listDiscovered": [{
 		name: "deviceId",
 		form: "single",
@@ -48977,6 +49352,21 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExport.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExport.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExport.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceExtension.listCandidates": [{
 		name: "deviceId",
 		form: "single",
@@ -49325,6 +49715,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceStatus.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"doorbell.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"enumSensor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"eventEmitter.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"faceGallery.getFaceByTrack": [{
 		name: "deviceId",
 		form: "single",
@@ -49339,6 +49749,11 @@ Object.freeze({
 		form: "array",
 		optional: true
 	}],
+	"fanControl.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"fanControl.setDirection": [{
 		name: "deviceId",
 		form: "single",
@@ -49359,6 +49774,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"featureProbe.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"flood.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"gas.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"humidifier.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"humidifier.setMode": [{
 		name: "deviceId",
 		form: "single",
@@ -49374,11 +49809,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"humiditySensor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"image.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"imageSettings.getOptions": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"imageSettings.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"imageSettings.setSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -49389,6 +49839,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"intercom.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"intercom.handleAnswer": [{
 		name: "deviceId",
 		form: "single",
@@ -49419,6 +49874,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"lawnMowerControl.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"lawnMowerControl.pause": [{
 		name: "deviceId",
 		form: "single",
@@ -49429,6 +49889,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"lockControl.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"lockControl.lock": [{
 		name: "deviceId",
 		form: "single",
@@ -49444,6 +49909,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"mediaPlayer.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"mediaPlayer.next": [{
 		name: "deviceId",
 		form: "single",
@@ -49504,6 +49974,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"motion.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motion.isDetected": [{
 		name: "deviceId",
 		form: "single",
@@ -49514,11 +49989,31 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"motionDetection.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionDetection.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"motionDetection.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motionDetection.removeCamera": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"motionTrigger.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motionTrigger.setMotionTrigger": [{
 		name: "deviceId",
 		form: "single",
@@ -49529,6 +50024,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"motionZones.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motionZones.setZone": [{
 		name: "deviceId",
 		form: "single",
@@ -49539,6 +50039,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"nativeObjectDetection.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"nativeObjectDetection.setEnabled": [{
 		name: "deviceId",
 		form: "single",
@@ -49554,6 +50059,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"navigation.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"navigation.goToPoint": [{
 		name: "deviceId",
 		form: "single",
@@ -49599,6 +50109,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"networkLink.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"networkQuality.getDeviceStats": [{
 		name: "deviceId",
 		form: "single",
@@ -49609,6 +50124,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"notificationRules.getAlarmSensors": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"notificationRules.setDeviceMuted": [{
 		name: "deviceId",
 		form: "single",
@@ -49619,11 +50139,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"notifier.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"notifier.send": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"numericSensor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"osd.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"osd.setOverlay": [{
 		name: "deviceId",
 		form: "single",
@@ -49683,6 +50218,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"petFeeder.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"petFeeder.markFoodReplenished": [{
 		name: "deviceId",
 		form: "single",
@@ -49718,6 +50258,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.clearTrackRelation": [{
 		name: "deviceId",
 		form: "single",
@@ -49758,6 +50303,16 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineAnalytics.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.getEventDensity": [{
 		name: "deviceId",
 		form: "single",
@@ -49973,6 +50528,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineOrchestrator.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.assignAudio": [{
 		name: "deviceId",
 		form: "single",
@@ -50018,6 +50578,16 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pipelineOrchestrator.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.getPipelineAssignment": [{
 		name: "deviceId",
 		form: "single",
@@ -50028,6 +50598,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.requestOccupancyLook": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.resolvePipeline": [{
 		name: "deviceId",
 		form: "single",
@@ -50133,11 +50708,31 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"powerMeter.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"presence.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pressureSensor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"privacyMask.getOptions": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"privacyMask.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"privacyMask.setAudioEnabled": [{
 		name: "deviceId",
 		form: "single",
@@ -50188,6 +50783,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"ptz.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"ptz.goHome": [{
 		name: "deviceId",
 		form: "single",
@@ -50278,6 +50878,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recordingArchive.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recordingArchive.deleteFootprint": [{
 		name: "deviceId",
 		form: "single",
@@ -50298,6 +50903,21 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recordingArchive.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recordingArchive.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"recordingArchive.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recordingArchive.listOpsLog": [{
 		name: "deviceId",
 		form: "single",
@@ -50383,6 +51003,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"recordingOnboard.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"recordingOnboard.setSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -50413,6 +51038,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"sceneMonitor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"sceneMonitor.listScenes": [{
 		name: "deviceId",
 		form: "single",
@@ -50438,6 +51068,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"scriptRunner.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"scriptRunner.run": [{
 		name: "deviceId",
 		form: "single",
@@ -50448,11 +51083,31 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"smoke.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"snapshot.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"snapshot.getDebugState": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"snapshot.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"snapshot.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"snapshot.getSnapshot": [{
 		name: "deviceId",
 		form: "single",
@@ -50469,6 +51124,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"snapshot.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"snapshot.invalidateCache": [{
 		name: "deviceId",
 		form: "single",
@@ -50479,6 +51139,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"streamBroker.applyDeviceSettingsPatch": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"streamBroker.assignProfile": [{
 		name: "deviceId",
 		form: "single",
@@ -50494,6 +51159,16 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"streamBroker.getDeviceLiveContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"streamBroker.getDeviceSettingsContribution": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"streamBroker.getStreamWithCodec": [{
 		name: "deviceId",
 		form: "single",
@@ -50554,16 +51229,46 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"streamParams.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"streamParams.setProfile": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"switch.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"switch.setState": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"tamper.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"temperatureSensor.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"update.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"vacuumControl.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"vacuumControl.locate": [{
 		name: "deviceId",
 		form: "single",
@@ -50599,6 +51304,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"valve.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"valve.open": [{
 		name: "deviceId",
 		form: "single",
@@ -50614,6 +51324,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"vibration.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"videoclips.dialClipStream": [{
 		name: "deviceId",
 		form: "single",
@@ -50649,6 +51364,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"waterHeater.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"waterHeater.setAway": [{
 		name: "deviceId",
 		form: "single",
@@ -50664,6 +51384,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"weather.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"webrtcSession.addIceCandidate": [{
 		name: "deviceId",
 		form: "single",
@@ -51189,6 +51914,18 @@ var STATE_SUMMARY_VARS = [
 		systemEventKinds: [...SUMMARISABLE],
 		systemEventDeliveries: ["summary"]
 	},
+	{
+		name: "summarySection",
+		label: "Summary: this section",
+		description: "The section a per-section summary row is about (D698); on a summary sent as one message, every section it reports, comma-separated.",
+		example: "Batterie scariche",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
 	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
 		name: v.name,
 		label: v.label,
@@ -51265,6 +52002,37 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	...STATE_SUMMARY_VARS
 ];
+new Set([
+	"disarmed",
+	"armed_home",
+	"armed_away",
+	"armed_night",
+	"armed_vacation",
+	"armed_custom_bypass",
+	"arming",
+	"disarming",
+	"pending",
+	"triggered",
+	"open",
+	"opening",
+	"closing",
+	"closed",
+	"stopped",
+	"locked",
+	"unlocked",
+	"locking",
+	"unlocking",
+	"jammed",
+	"on",
+	"off",
+	"home",
+	"not_home",
+	"matched",
+	"diverged",
+	"unknown",
+	"latched",
+	"live"
+]);
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -51358,7 +52126,7 @@ var PreviewTextField = string().max(200);
 * Whether the notification's preview is a STILL or a short animation.
 *
 * The operator's ask, verbatim: *"inviato come gif o video (come per le altre
-* rule)"* — the other rules already offer an animated preview, and a ten-hour
+* rule)"* [sent as a gif or video (as for the other rules)] — the other rules already offer an animated preview, and a ten-hour
 * night reads better as three seconds of motion than as one frame of it. Both
 * modes get the SAME treatment (blurred frame, large centred title); `'gif'`
 * simply applies it to a dozen frames sampled across the render and assembles
@@ -51496,6 +52264,7 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
+MotionOnMotionChangedDataSchema.omit({ triggeredBy: true });
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.