@camstack/system 1.2.321 → 1.2.323

package/dist/{dist-BVHQ6TX1.mjs → dist-Bs6UyVGd.mjs}

@@ -3512,7 +3512,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-BK-GTFYb.mjs
+//#region ../types/dist/composition-Dq42XWp0.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -3906,6 +3906,58 @@ function buildFfmpegArgs(inv) {
 	];
 }
 /**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
+/**
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
 * valutatore puro del suo FRONTE.
 *
@@ -5359,6 +5411,26 @@ var BASE_LIVE_EGRESS_PROFILE = {
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /**
+* Memoize `ensure` on SUCCESS only.
+*
+* A failure is not remembered: the next caller asks again, so a node whose
+* first download failed (no network at boot) recovers on the next spawn that
+* needs it — with no timer and no retry loop, because the ask is driven by
+* work that actually wants the binary.
+*/
+function memoizePinnedFfmpeg(ensure) {
+	let pending = null;
+	return () => {
+		if (pending !== null) return pending;
+		const attempt = ensure();
+		pending = attempt;
+		attempt.catch(() => {
+			if (pending === attempt) pending = null;
+		});
+		return attempt;
+	};
+}
+/**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
 * node. Produced by the backend `WiringHealthService` and surfaced via
@@ -11645,263 +11717,1156 @@ var CompositionBlockStateSchema = z.object({
 	reason: z.string().optional(),
 	fields: z.array(CompositionFieldStateSchema)
 });
+function problem(code, path, message) {
+	return {
+		code,
+		path,
+		message
+	};
+}
+function refused(...problems) {
+	return {
+		problems,
+		fields: [],
+		features: [],
+		events: []
+	};
+}
+/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
+function compositionFieldAt(field) {
+	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
+	return `features[${field.featureIndex}].${inner}.${field.path}`;
+}
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
+var BUILTIN_RESULT_KINDS = Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+var KindInferenceError = class extends Error {};
+function kindOfValue(value) {
+	if (value === null) return "null";
+	if (typeof value === "number") return "number";
+	if (typeof value === "string") return "string";
+	return "boolean";
+}
+function only(kind) {
+	return new Set([kind]);
+}
+function union(...sets) {
+	return new Set(sets.flatMap((s) => [...s]));
+}
+function withoutNull(set) {
+	return new Set([...set].filter((k) => k !== "null"));
+}
+function binaryKinds(op, left, right) {
+	if (op === "+") {
+		const all = [...left, ...right];
+		if (all.every((k) => k === "string")) return only("string");
+		if (all.every((k) => k === "number")) return only("number");
+		return new Set(["number", "string"]);
+	}
+	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
+	return only("boolean");
+}
+/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
+function arityRange(builtin) {
+	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
+	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
+	return `${builtin.minArgs}–${builtin.maxArgs}`;
+}
+function callKinds(callee, args) {
+	const builtin = EXPRESSION_BUILTINS[callee];
+	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
+	const rule = BUILTIN_RESULT_KINDS[callee];
+	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
+	if (rule.kind === "fixed") return new Set(rule.result);
+	const nonNull = union(...args.map(withoutNull));
+	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
+}
+function kindsOf(node, bindings) {
+	switch (node.kind) {
+		case "literal": return only(kindOfValue(node.value));
+		case "identifier": {
+			if (node.name === "now") return only("number");
+			const bound = bindings.get(node.name);
+			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
+			return bound;
+		}
+		case "unary": return only(node.op === "!" ? "boolean" : "number");
+		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
+		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
+	}
+}
+function nodeContainsCall(node, callee) {
+	switch (node.kind) {
+		case "literal":
+		case "identifier": return false;
+		case "unary": return nodeContainsCall(node.operand, callee);
+		case "binary":
+		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
+		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
+		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
+	}
+}
+function expressionContainsBuiltinCall(expr, callee) {
+	const compiled = compileExpressionSafe(expr);
+	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
+}
+function inferExpressionKinds(input) {
+	const compiled = compileExpressionSafe(input.expr);
+	if (!compiled.ok) return {
+		ok: false,
+		error: compiled.error
+	};
+	try {
+		return {
+			ok: true,
+			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
+		};
+	} catch (err) {
+		if (err instanceof KindInferenceError) return {
+			ok: false,
+			error: err.message
+		};
+		throw err;
+	}
+}
 /**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
-/**
-* Prefix for a block's generated addon id AND its runner id — one addon, one
-* process, so the two are the same string (D2).
-*
-* It lives on the CONTRACT rather than beside the code that materialises the
-* package, because it is not an implementation detail: the operator surface
-* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
-* with no cap and no store of its own. Two copies of this string is one copy
-* too many — a drift would show as a logs pane that is simply always empty.
-*/
-var CORE_BLOCK_ADDON_PREFIX = "core-block-";
-/**
-* The builtin's own addon id — and, because of that, the OWNER of the
-* integration every block's devices hang from.
-*
-* A block cannot own one. Every integration read is gated on the installed-addon
-* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
-* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
-* null forever while the write succeeds — one invisible, undeletable row per
-* start. `core-blocks` IS installed, so it reconciles one shared integration and
-* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
-*
-* Exported from the contract, next to the runner prefix and for the same reason:
-* a block reads it as
-* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
-* so a second copy of the string is a block that silently declares into nowhere.
+* The kind half of planning a composition field (D659): which kinds a source
+* can produce, whether they fit a target field, and the field's role.
+* Shared by the top-level planner (`validate-composition.ts`) and the item
+* planner (`composition-items.ts`). Internal to the composition module — NOT
+* in the barrel: these are planner internals, not a published contract.
 */
-var CORE_BLOCKS_ADDON_ID = "core-blocks";
-/** The addon/runner id a block's process runs under. */
-function coreBlockAddonId(blockId) {
-	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+function readKinds(read, lookupCap) {
+	const def = lookupCap(read.cap);
+	const schema = def?.runtimeState ?? def?.status?.schema;
+	if (def === null || schema === void 0) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `no capability \`${read.cap}\` with state to read`
+	};
+	const field = describeStateField(schema, read.fieldPath);
+	if (field === null) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
+	};
+	const base = field.kind === "enum" ? "string" : field.kind;
+	return {
+		ok: true,
+		kinds: new Set(field.nullable ? [base, "null"] : [base])
+	};
 }
-/** The block id behind a generated addon/runner id, or null when the id belongs
-*  to something else. The inverse of {@link coreBlockAddonId}. */
-function coreBlockIdFromAddonId(addonId) {
-	if (!addonId.startsWith("core-block-")) return null;
-	const rest = addonId.slice(11);
-	return rest.length > 0 ? rest : null;
+function sourceKinds(source, lookupCap) {
+	if (source.kind === "from") return readKinds(source, lookupCap);
+	if (source.kind === "code") return {
+		ok: false,
+		code: "reserved-variant",
+		message: "code fields arrive in slice 4"
+	};
+	const bindingKinds = /* @__PURE__ */ new Map();
+	for (const [name, binding] of Object.entries(source.bindings)) {
+		if (binding.kind === "literal") {
+			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
+			continue;
+		}
+		const kinds = readKinds(binding, lookupCap);
+		if (!kinds.ok) return {
+			...kinds,
+			message: `binding \`${name}\`: ${kinds.message}`
+		};
+		bindingKinds.set(name, kinds.kinds);
+	}
+	const inferred = inferExpressionKinds({
+		expr: source.expr,
+		bindingKinds
+	});
+	return inferred.ok ? {
+		ok: true,
+		kinds: inferred.kinds
+	} : {
+		ok: false,
+		code: "expression-invalid",
+		message: inferred.error
+	};
+}
+function compatibility(cap, target, kinds, at) {
+	const allowed = target.kind === "enum" ? "string" : target.kind;
+	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
+	const problems = [];
+	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
+	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
+	return problems;
 }
-/** Where a block runs. The operator chooses — a block driving a device on an
-*  agent is the reason placement is not fixed to the hub. */
-var CoreBlockPlacementSchema = z.union([z.literal("hub"), z.string().min(1)]);
-/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. `degraded` is a
-*  composition on an existing device with a field handed back to the native
-*  provider while its source is unavailable (S1b, D663); the error names it. */
-var CoreBlockStatusSchema = z.enum([
-	"stopped",
-	"starting",
-	"running",
-	"degraded",
-	"failed"
-]);
-/** Client-authored fields. */
-var CoreBlockInputSchema = z.object({
-	name: z.string().min(1).max(120),
-	/** TypeScript source. Compiled server-side before it is ever stored — a
-	*  block that does not compile is a fork failure the operator would meet
-	*  minutes later, in a log, instead of in the editor. */
-	code: z.string().max(2e5),
-	enabled: z.boolean(),
-	placement: CoreBlockPlacementSchema,
-	/**
-	* Integration the block's devices hang from. Absent = the system integration
-	* blocks share. A block may declare its own instead.
-	*/
-	integrationId: z.string().optional()
-});
 /**
-* What a block IS (D659). Absent means `code` — every row stored before this
-* union keeps working unchanged.
-*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
-*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
-*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+* A string a source produces WITHOUT reading any device — a field-level
+* `expression` source whose compiled AST is a bare string literal (`"red"`,
+* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
+* the kind level (a `from` read of an enum-typed source field, a computed
+* expression) is NOT checked against the target's `enumValues` here: the
+* kind inference already collapsed it to the coarse `'string'` kind, losing
+* whichever enum it actually came from, so membership can only be judged at
+* write time against the runtime-state schema. Known limitation — see the
+* fix report for Task 6 round 1.
 */
-var CoreBlockSourceSchema = z.discriminatedUnion("kind", [
-	z.object({ kind: z.literal("code") }),
-	z.object({
-		kind: z.literal("recipe"),
-		recipe: AutomationRecipeSchema
-	}),
-	z.object({
-		kind: z.literal("composition"),
-		composition: CompositionSchema
-	})
-]);
+function literalStringValue(source) {
+	if (source.kind !== "expression") return null;
+	const compiled = compileExpressionSafe(source.expr);
+	if (!compiled.ok) return null;
+	const ast = compiled.parsed.ast;
+	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
+}
 /**
-* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
-*
-* `name`: REQUIRED for a `new` target — the block's name IS the device's name
-* (D659). ABSENT for an `existing` target — a customization has no name of its
-* own; the server derives one (`customizationBlockName`, D663) and refuses a
-* client-sent name by name.
+* An enum target whose source is a save-time-KNOWN string literal outside its
+* `enumValues` is refused now rather than left to fail the write later. A
+* dynamic source (a `from` read, a non-literal expression) is left to
+* runtime — see {@link literalStringValue}.
 */
-var CompositionBlockInputSchema = z.object({
-	name: z.string().min(1).max(120).optional(),
-	enabled: z.boolean(),
-	composition: CompositionSchema
-});
-/** A stored block. */
-var CoreBlockSchema = CoreBlockInputSchema.extend({
-	id: z.string(),
-	createdAt: z.number(),
-	updatedAt: z.number(),
-	/** Server-stamped author. */
-	createdBy: z.string(),
-	status: CoreBlockStatusSchema,
-	/**
-	* Why the block is not running, when it is not. The operator's ONLY window
-	* into a block that failed at load — a block that is silently absent is the
-	* failure mode this whole feature has to avoid.
-	*/
-	lastError: z.string().optional(),
-	/** Ms epoch of the last state change. */
-	lastChangedAt: z.number(),
-	/** What the block is. Absent means `code` (D659). */
-	source: CoreBlockSourceSchema.optional()
-});
-function coreBlockSourceKind(block) {
-	return block.source?.kind ?? "code";
+function enumLiteralProblem(cap, target, source, at) {
+	if (target.kind !== "enum" || target.enumValues === void 0) return null;
+	const value = literalStringValue(source);
+	if (value === null || target.enumValues.includes(value)) return null;
+	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
+	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
 }
-function coreBlockComposition(block) {
-	return block.source?.kind === "composition" ? block.source.composition : null;
+function roleOf(source) {
+	if (source.kind !== "expression") return "derived";
+	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
+	if (fieldReads(source).length > 0) return "derived";
+	const compiled = compileExpressionSafe(source.expr);
+	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
 }
-/** What the composer said, or that it could not be asked. Unknown never looks like absent (D315). */
-var CompositionStateReadSchema = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("answered"),
-	state: CompositionBlockStateSchema.nullable()
-}), z.object({
-	kind: z.literal("unreachable"),
-	error: z.string()
-})]);
-/** A stored composition block and what the composer says about it. */
-var CompositionViewSchema = z.object({
-	block: CoreBlockSchema,
-	state: CompositionStateReadSchema
-});
 /**
-* A read of the stored compositions. `not-loaded` while the `core_blocks`
-* table has not been READ: an empty answer then would make "not yet known"
-* look like "none", and invite the operator to recreate what exists (D315).
+* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
+* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
+* own offline, and D393 forbids a stale number, so on an existing target a
+* field that READS a source never gets `offline`.
 */
-var CompositionsNotLoadedSchema = z.object({
-	state: z.literal("not-loaded"),
-	reason: z.string()
-});
-var CompositionListReadSchema = z.discriminatedUnion("state", [z.object({
-	state: z.literal("loaded"),
-	views: z.array(CompositionViewSchema)
-}), CompositionsNotLoadedSchema]);
-var CompositionGetReadSchema = z.discriminatedUnion("state", [z.object({
-	state: z.literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
-var CompositionCustomizationReadSchema = z.discriminatedUnion("state", [z.object({
-	state: z.literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** What a compile attempt produced. */
-var CoreBlockCompileResultSchema = z.object({
-	ok: z.boolean(),
-	/** Present when `ok` is false — the first error, in the author's words. */
-	error: z.string().optional(),
-	line: z.number().optional(),
-	column: z.number().optional()
-});
-var coreBlocksCapability = {
-	name: "core-blocks",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		list: method(z.object({}), z.object({ blocks: z.array(CoreBlockSchema) }), { auth: "admin" }),
-		get: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
-		/**
-		* Create a block. The code is COMPILED first: storing source that does not
-		* compile turns an editor error into a fork failure the operator meets
-		* minutes later in a log.
-		*/
-		create: method(z.object({ block: CoreBlockInputSchema }), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		update: method(z.object({
-			blockId: z.string(),
-			block: CoreBlockInputSchema.partial()
-		}), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		delete: method(z.object({ blockId: z.string() }), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setEnabled: method(z.object({
-			blockId: z.string(),
-			enabled: z.boolean()
-		}), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Stop this block's runner and let the supervisor bring it back.
-		*
-		* **It stores nothing.** There is no "restart requested" flag and no second
-		* lifecycle field: the supervisor already stops and respawns a runner when
-		* the code hash changes, and this exposes that same path deliberately
-		* (D62 — a switch writes the authority that already owned the function).
-		* The next reconcile pass remains the authority, so a restart that lost a
-		* race is corrected within one pass rather than leaving a stale flag behind.
-		*
-		* Refused for a DISABLED block: nothing would come back, and a button that
-		* silently does nothing is worse than one that says why.
-		*/
-		restart: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Type-check without saving — what the editor calls as the author types, so
-		* the compiler's verdict is the same one the server will reach.
-		*/
-		compile: method(z.object({ code: z.string() }), CoreBlockCompileResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* The declaration files the editor type-checks against.
-		*
-		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
-		* bundling it would roughly double the admin remote. Served rather than
-		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
-		* would drift and the editor would confidently autocomplete methods that
-		* do not exist.
-		*/
-		getTypeDefs: method(z.object({}), z.object({ libs: z.array(z.object({
+function unavailableFor(tf, role, mode, cap, at) {
+	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
+		ok: true,
+		unavailable: "release"
+	};
+	if (mode === "new" || role !== "derived") return {
+		ok: true,
+		unavailable: tf.nullable ? "null" : "offline"
+	};
+	if (tf.nullable) return {
+		ok: true,
+		unavailable: "null"
+	};
+	if (tf.enumValues?.includes("unknown") === true) return {
+		ok: true,
+		unavailable: "unknown"
+	};
+	return {
+		ok: false,
+		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
+	};
+}
+/** Item fields the composer writes itself, with the value it writes. */
+var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
+function reservedItemFields(itemArray) {
+	return new Set([
+		itemArray.keyField,
+		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
+		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
+	]);
+}
+/** A required leaf under an optional parent is required only once something writes that parent. */
+function leafRequired(itemArray, path, written) {
+	const described = describeStateField(itemArray.itemSchema, path);
+	if (described === null || !described.required) return false;
+	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
+}
+function missingLeaves({ capName, itemArray, reserved }, item, at) {
+	const written = Object.keys(item.fields);
+	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
+		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
+		if (!leafRequired(itemArray, leaf.path, written)) return [];
+		const described = describeStateField(itemArray.itemSchema, leaf.path);
+		if (described === null || described.nullable) return [];
+		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
+	});
+}
+function planItemField(ctx, leaf) {
+	const { capName, itemArray, featureIndex, lookupCap } = ctx;
+	const { key, label, path, source } = leaf;
+	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
+	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
+	const tf = describeStateField(itemArray.itemSchema, path);
+	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: capName,
+		path,
+		item: {
+			arrayPath: itemArray.path,
+			key,
+			label
+		},
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(capName, tf, source, at);
+	return {
+		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
+	const at = `features[${featureIndex}].items`;
+	const itemArray = def.status?.itemArray;
+	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
+	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
+	const ctx = {
+		capName: def.name,
+		itemArray,
+		reserved: reservedItemFields(itemArray),
+		featureIndex,
+		lookupCap,
+		mode
+	};
+	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
+		problems: missingLeaves(ctx, item, `${at}.${key}`),
+		fields: [],
+		features: [],
+		events: []
+	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
+		key,
+		label: item.label,
+		path,
+		source
+	}))]);
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: [],
+		events: []
+	};
+}
+/**
+* The field graph across every composition, and the cycles in it (D659).
+*
+* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
+* edge points from a composed field to each field it reads. A cycle, direct or
+* through another composition, is refused at save by name (spec §2).
+*
+* The graph is built for ONE save: the CANDIDATE composition (the one being
+* validated) plus every STORED composition. The candidate replaces its own old
+* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
+* introduces or removes a cycle must never depend on array order. A DIFFERENT
+* block targeting the candidate's device is refused by name: one composition
+* per device (D663). Two different stored peers that (wrongly) target the same
+* device are corrupted state, not a cycle to resolve by picking one silently;
+* that is refused by name too (D391).
+*
+* A customization of an EXISTING device reads that device's NATIVE value for a
+* field it replaces or does not write ("Invert state" reads the `on` it
+* replaces): such a self-read is no edge, so it is never a cycle (D663).
+* Another composition reading that field reads the customizer's output.
+*
+* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
+* marks a node `done` after its first expansion) — not every elementary cycle
+* through a shared node, so the path it names may AVOID the candidate while
+* one through it goes unreported. What a save refuses is therefore decided per
+* strongly connected component (`findCandidateCycles`, C-1). A dotted
+* `fieldPath` is matched only as an exact string: a write to `state.value` and
+* a read of `state` would not connect (no nested field writes exist yet).
+*
+* An item leaf is its own node, `…#consumables.items[desiccant].status`
+* (`featureFieldEntries`), so two items sharing an inner path never merge. No
+* READ can name an array element (`describeStateField` never describes one),
+* so an item node is write-only: its edges to sources are what the check needs.
+*/
+/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
+var CompositionGraphError = class extends Error {};
+/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
+function writtenFields(peer) {
+	return new Set(peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
+}
+/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
+function readsComposedValue(peer, written, read) {
+	if (compositionSourceKey(read.source) !== compositionSourceKey(peer.target)) return true;
+	const field = `${read.cap}.${read.fieldPath}`;
+	return written.has(field) && peer.replaced?.has(field) !== true;
+}
+function peerEdges(peer) {
+	const written = writtenFields(peer);
+	return peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath, source }) => [compositionReadKey({
+		source: peer.target,
+		cap: feature.cap,
+		fieldPath
+	}), fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(compositionReadKey)]));
+}
+/**
+* Every peer that actually takes part in the graph: each stored peer minus the
+* candidate's own old version (same block id — the drop happens before any
+* edge is built, so its old edges never enter the map), plus the candidate
+* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
+* block targets the candidate's device, or two stored peers share a device.
+*/
+function resolvedPeers(candidate, stored) {
+	const candidateKey = compositionSourceKey(candidate.target);
+	const survivors = /* @__PURE__ */ new Map();
+	for (const peer of stored) {
+		if (peer.blockId === candidate.blockId) continue;
+		const key = compositionSourceKey(peer.target);
+		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
+		const clash = survivors.get(key);
+		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
+		survivors.set(key, peer);
+	}
+	return [...survivors.values(), candidate];
+}
+function compositionEdges(candidate, stored) {
+	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
+	return new Map(edges);
+}
+/** Tarjan's strongly connected components over every node of the graph (sources included). */
+function stronglyConnected(edges) {
+	const index = /* @__PURE__ */ new Map();
+	const low = /* @__PURE__ */ new Map();
+	const onStack = /* @__PURE__ */ new Set();
+	const stack = [];
+	const components = [];
+	const connect = (node) => {
+		index.set(node, index.size);
+		low.set(node, index.get(node) ?? 0);
+		stack.push(node);
+		onStack.add(node);
+		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
+			connect(next);
+			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
+		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
+		if (low.get(node) !== index.get(node)) return;
+		const component = [];
+		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
+			onStack.delete(member);
+			component.push(member);
+			if (member === node) break;
+		}
+		components.push(component);
+	};
+	for (const node of edges.keys()) if (!index.has(node)) connect(node);
+	return components;
+}
+/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
+function cycleThrough(start, component, edges) {
+	const parent = /* @__PURE__ */ new Map();
+	const queue = [start];
+	for (let head = 0; head < queue.length; head += 1) {
+		const node = queue[head];
+		if (node === void 0) break;
+		for (const next of edges.get(node) ?? []) {
+			if (next === start) {
+				const chain = [];
+				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
+				return [
+					start,
+					...chain.reverse(),
+					start
+				];
+			}
+			if (!component.has(next) || parent.has(next)) continue;
+			parent.set(next, node);
+			queue.push(next);
+		}
+	}
+	return [start, start];
+}
+/**
+* The cycles THIS save closes, decided per strongly connected component — never
+* per reported DFS path, which names one back-edge per revisit and can report a
+* component's cycle by a path that avoids the candidate while the one through it
+* goes unreported. A component refuses when it holds a candidate node and a
+* cycle (more than one node, or a self-loop). Components without a candidate
+* node are not this save's cycles.
+*/
+function findCandidateCycles(candidate, stored) {
+	const edges = compositionEdges(candidate, stored);
+	const prefix = `${compositionSourceKey(candidate.target)}#`;
+	return stronglyConnected(edges).flatMap((members) => {
+		const start = members.find((n) => n.startsWith(prefix));
+		if (start === void 0) return [];
+		const component = new Set(members);
+		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
+		if (members.length === 1 && !selfLoop) return [];
+		return [{
+			path: cycleThrough(start, component, edges),
+			component
+		}];
+	});
+}
+function buildCapabilityLookup(defs) {
+	const byName = new Map(defs.map((d) => [d.name, d]));
+	return (capName) => byName.get(capName) ?? null;
+}
+/** Caps every `BaseDevice` registers on itself; a second registration throws. */
+var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
+var PENDING_SELF = {
+	addonId: COMPOSER_ADDON_ID,
+	stableId: `${COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
+};
+function composableCap(feature, at, lookupCap) {
+	const def = lookupCap(feature.cap);
+	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
+	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
+	return {
+		def,
+		state,
+		fields: describeTopLevelStateFields(state)
+	};
+}
+/**
+* A capability BUILT by the composition (a new device, or one ADDED to an
+* existing device) must fit the device type, serve no command, and have every
+* required field. A REPLACE needs none of it: the cap is bound (a fact), the
+* native keeps serving its methods, and only the named fields are owned (D663).
+*/
+function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
+	const problems = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
+	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
+	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
+	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
+	for (const key of requiredTopLevelKeys(state)) {
+		if (key === itemArrayPath) continue;
+		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
+		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
+	}
+	return problems;
+}
+function planTopLevelField({ def, fields }, field, mode, lookupCap) {
+	const { featureIndex, path, source } = field;
+	const fieldAt = `features[${featureIndex}].fields.${path}`;
+	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
+	const tf = fields.get(path);
+	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: def.name,
+		path,
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
+	return {
+		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planFeature(feature, featureIndex, target, lookupCap) {
+	const at = `features[${featureIndex}]`;
+	const cap = composableCap(feature, at, lookupCap);
+	if ("code" in cap) return refused(cap);
+	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
+	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
+	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
+		featureIndex,
+		path,
+		source
+	}, target.mode, lookupCap));
+	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
+	const all = [...perField, ...items];
+	const fields = all.flatMap((result) => result.fields);
+	const featurePlan = {
+		featureIndex,
+		cap: cap.def.name,
+		mode: target.mode
+	};
+	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
+	return {
+		problems: [
+			...capProblems,
+			...all.flatMap((r) => r.problems),
+			...eventPlan.problems
+		],
+		fields,
+		features: [featurePlan],
+		events: eventPlan.events
+	};
+}
+/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
+function isNativeCap(target, cap) {
+	const owner = target.nativeCaps.get(cap);
+	return owner !== void 0 && owner !== "composer";
+}
+/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
+function planTargetOf(composition, target) {
+	if (composition.target.kind === "new") return {
+		kind: "new",
+		type: composition.target.type
+	};
+	const key = compositionSourceKey(composition.target.device);
+	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
+	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
+	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
+	return {
+		kind: "existing",
+		found: target
+	};
+}
+function featureTargetOf(target, cap) {
+	if (target.kind === "new") return {
+		mode: "new",
+		deviceType: target.type
+	};
+	return {
+		mode: isNativeCap(target.found, cap) ? "replace" : "add",
+		deviceType: target.found.type
+	};
+}
+/**
+* The static plan. `target` describes an EXISTING target device (one read);
+* it is ignored for a new one. On an existing target each feature REPLACES a
+* cap the device has natively, else ADDS it (D663).
+*/
+function planComposition(composition, lookupCap, target) {
+	const planTarget = planTargetOf(composition, target);
+	if ("code" in planTarget) return refused(planTarget);
+	const results = composition.features.map((feature, index) => {
+		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
+		return compositionFeatureEnabled(feature) ? result : {
+			problems: result.problems,
+			fields: [],
+			features: [],
+			events: []
+		};
+	});
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: results.flatMap((r) => r.features),
+		events: results.flatMap((r) => r.events)
+	};
+}
+function compositionSourceRefs(composition) {
+	const refs = composition.features.flatMap((f) => compositionFeatureEnabled(f) && f.kind === "fields" ? featureSources(f).flatMap(fieldReads).map((r) => r.source) : []);
+	return [...new Map(refs.map((r) => [compositionSourceKey(r), r])).values()];
+}
+/**
+* The candidate's device: the existing target itself, else `self`, else a
+* placeholder that cannot collide with a stored target. An existing target is
+* known even on create, so a second customization of it is refused on create too.
+*/
+function candidateSelf(composition, ctx, plan) {
+	return {
+		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
+		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
+		replaced: replacedFieldKeys(plan)
+	};
+}
+/**
+* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
+* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
+* derivation, so the graph reads both the same way.
+*/
+function replacedFieldKeys(plan) {
+	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
+	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
+}
+/**
+* A read of the candidate's own device. Its own composed output (a new device's
+* field, an ADDED field) is the slice-1 own-field rule; on an existing target
+* every other field — replaced, or not composed at all — is the NATIVE value,
+* valid when the device serves that cap natively (D663, rule 5).
+*/
+function selfReadProblems(read, at, fields, self) {
+	const readKey = `${read.cap}.${read.fieldPath}`;
+	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
+	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
+	if (isNativeCap(self.native, read.cap)) return [];
+	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
+}
+function sourceProblems(fields, ctx, self) {
+	const selfKey = compositionSourceKey(self.ref);
+	return fields.flatMap((field) => field.reads.flatMap((read) => {
+		const at = compositionFieldAt(field);
+		const key = compositionSourceKey(read.source);
+		if (key === selfKey) return selfReadProblems(read, at, fields, self);
+		const desc = ctx.sources.get(key);
+		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
+		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
+		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
+		return [];
+	}));
+}
+/**
+* A cycle's node keys are `compositionReadKey` strings:
+* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
+* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
+* back out so the refusal can point at that exact field, matching the
+* documented `features[N].fields.<path>` convention. A cap name has no `.`,
+* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
+* (`items[desiccant].status`) is matched through `compositionFieldKey`.
+*/
+function candidateFieldOfNode(nodeKey, candidateKey) {
+	const prefix = `${candidateKey}#`;
+	if (!nodeKey.startsWith(prefix)) return null;
+	const rest = nodeKey.slice(prefix.length);
+	const dot = rest.indexOf(".");
+	if (dot === -1) return null;
+	return {
+		cap: rest.slice(0, dot),
+		fieldPath: rest.slice(dot + 1)
+	};
+}
+/** The first node of a cycle's path that is one of THIS composition's own
+*  planned fields, as a documented-convention path; `'features'` when the
+*  cycle runs entirely through other stored compositions. */
+function cyclePath(nodePath, candidateKey, fields) {
+	for (const nodeKey of nodePath) {
+		const hit = candidateFieldOfNode(nodeKey, candidateKey);
+		if (hit === null) continue;
+		const hitKey = `${hit.cap}.${hit.fieldPath}`;
+		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
+		if (field !== void 0) return compositionFieldAt(field);
+	}
+	return "features";
+}
+/** The first unread device any of `nodes` belongs to; null when none does. */
+function unreadDeviceOf(nodes, unread) {
+	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
+		key,
+		error
+	};
+	return null;
+}
+/**
+* Cycle check runs against the CANDIDATE (this composition, as block
+* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
+* decided per strongly connected component (`findCandidateCycles`): a cyclic
+* component holding a candidate node refuses, with one representative cycle
+* through it; one without is not this save's cycle. A
+* stored composition of the same block is its old version; another block on
+* the same device, or two stored peers sharing a device, make
+* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
+* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
+*/
+function cycleProblems(composition, ctx, fields, self) {
+	const candidate = {
+		blockId: ctx.blockId ?? "(unsaved)",
+		target: self.ref,
+		composition,
+		replaced: self.replaced
+	};
+	const candidateKey = compositionSourceKey(candidate.target);
+	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
+	try {
+		return findCandidateCycles(candidate, ctx.peers).map((c) => {
+			const at = cyclePath(c.path, candidateKey, fields);
+			const through = unreadDeviceOf([...c.component], unread);
+			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
+		});
+	} catch (err) {
+		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
+		throw err;
+	}
+}
+function validateComposition(composition, ctx) {
+	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
+	const self = candidateSelf(composition, ctx, plan);
+	const cycles = cycleProblems(composition, ctx, plan.fields, self);
+	const problems = [
+		...plan.problems,
+		...sourceProblems(plan.fields, ctx, self),
+		...cycles
+	];
+	return {
+		ok: problems.length === 0,
+		problems,
+		fields: [...plan.fields],
+		features: [...plan.features],
+		events: [...plan.events]
+	};
+}
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = z.object({
+	path: z.string(),
+	kind: CompositionFieldKindSchema,
+	nullable: z.boolean(),
+	required: z.boolean(),
+	enumValues: z.array(z.string()).optional()
+});
+var ComposableCapabilitySchema = z.object({
+	cap: z.string(),
+	fields: z.array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: z.object({
+		path: z.string(),
+		keyField: z.string()
+	}).optional()
+});
+var ComposableCapabilitiesSchema = z.object({ caps: z.array(ComposableCapabilitySchema) });
+/** Why a cap cannot be BUILT (new device, or added to an existing one) on `deviceType`; [] = it can. */
+function builtCapabilityBlockers(def, deviceType) {
+	if (BASE_DEVICE_CAPS.has(def.name)) return ["not-composable"];
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return ["not-composable"];
+	const blockers = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) blockers.push("wrong-device-type");
+	if (Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).length > 0) blockers.push("has-commands");
+	const fields = describeTopLevelStateFields(state);
+	const itemArrayPath = def.status?.itemArray?.path ?? null;
+	if (requiredTopLevelKeys(state).some((key) => key !== itemArrayPath && !fields.has(key))) blockers.push("not-composable");
+	if (planCompositionEvents(def, {
+		featureIndex: 0,
+		cap: def.name,
+		mode: "new"
+	}, []).problems.some((p) => p.code === "not-composable") && !blockers.includes("not-composable")) blockers.push("not-composable");
+	return blockers;
+}
+/** Every cap with no blocker, sorted by name. */
+function describeComposableCaps(defs, deviceType) {
+	return defs.filter((def) => builtCapabilityBlockers(def, deviceType).length === 0).map((def) => {
+		const state = def.runtimeState;
+		const fields = state === void 0 ? [] : [...describeTopLevelStateFields(state).values()];
+		const itemArray = def.status?.itemArray;
+		return {
+			cap: def.name,
+			fields: fields.map((f) => ({
+				path: f.path,
+				kind: f.kind,
+				nullable: f.nullable,
+				required: f.required,
+				...f.enumValues === void 0 ? {} : { enumValues: [...f.enumValues] }
+			})),
+			...itemArray === void 0 ? {} : { itemArray: {
+				path: itemArray.path,
+				keyField: itemArray.keyField
+			} }
+		};
+	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
+}
+/**
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/**
+* Prefix for a block's generated addon id AND its runner id — one addon, one
+* process, so the two are the same string (D2).
+*
+* It lives on the CONTRACT rather than beside the code that materialises the
+* package, because it is not an implementation detail: the operator surface
+* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
+* with no cap and no store of its own. Two copies of this string is one copy
+* too many — a drift would show as a logs pane that is simply always empty.
+*/
+var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/**
+* The builtin's own addon id — and, because of that, the OWNER of the
+* integration every block's devices hang from.
+*
+* A block cannot own one. Every integration read is gated on the installed-addon
+* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
+* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
+* null forever while the write succeeds — one invisible, undeletable row per
+* start. `core-blocks` IS installed, so it reconciles one shared integration and
+* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
+*
+* Exported from the contract, next to the runner prefix and for the same reason:
+* a block reads it as
+* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
+* so a second copy of the string is a block that silently declares into nowhere.
+*/
+var CORE_BLOCKS_ADDON_ID = "core-blocks";
+/** The addon/runner id a block's process runs under. */
+function coreBlockAddonId(blockId) {
+	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+}
+/** The block id behind a generated addon/runner id, or null when the id belongs
+*  to something else. The inverse of {@link coreBlockAddonId}. */
+function coreBlockIdFromAddonId(addonId) {
+	if (!addonId.startsWith("core-block-")) return null;
+	const rest = addonId.slice(11);
+	return rest.length > 0 ? rest : null;
+}
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = z.union([z.literal("hub"), z.string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
+var CoreBlockStatusSchema = z.enum([
+	"stopped",
+	"starting",
+	"running",
+	"degraded",
+	"failed"
+]);
+/** Client-authored fields. */
+var CoreBlockInputSchema = z.object({
+	name: z.string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: z.string().max(2e5),
+	enabled: z.boolean(),
+	placement: CoreBlockPlacementSchema,
+	/**
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
+	*/
+	integrationId: z.string().optional()
+});
+/**
+* What a block IS (D659). Absent means `code` — every row stored before this
+* union keeps working unchanged.
+*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
+*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
+*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+*/
+var CoreBlockSourceSchema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("code") }),
+	z.object({
+		kind: z.literal("recipe"),
+		recipe: AutomationRecipeSchema
+	}),
+	z.object({
+		kind: z.literal("composition"),
+		composition: CompositionSchema
+	})
+]);
+/**
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
+*
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
+*/
+var CompositionBlockInputSchema = z.object({
+	name: z.string().min(1).max(120).optional(),
+	enabled: z.boolean(),
+	composition: CompositionSchema
+});
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
+	id: z.string(),
+	createdAt: z.number(),
+	updatedAt: z.number(),
+	/** Server-stamped author. */
+	createdBy: z.string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: z.string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: z.number(),
+	/** What the block is. Absent means `code` (D659). */
+	source: CoreBlockSourceSchema.optional()
+});
+function coreBlockSourceKind(block) {
+	return block.source?.kind ?? "code";
+}
+function coreBlockComposition(block) {
+	return block.source?.kind === "composition" ? block.source.composition : null;
+}
+/** What the composer said, or that it could not be asked. Unknown never looks like absent (D315). */
+var CompositionStateReadSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("answered"),
+	state: CompositionBlockStateSchema.nullable()
+}), z.object({
+	kind: z.literal("unreachable"),
+	error: z.string()
+})]);
+/** A stored composition block and what the composer says about it. */
+var CompositionViewSchema = z.object({
+	block: CoreBlockSchema,
+	state: CompositionStateReadSchema
+});
+/**
+* A read of the stored compositions. `not-loaded` while the `core_blocks`
+* table has not been READ: an empty answer then would make "not yet known"
+* look like "none", and invite the operator to recreate what exists (D315).
+*/
+var CompositionsNotLoadedSchema = z.object({
+	state: z.literal("not-loaded"),
+	reason: z.string()
+});
+var CompositionListReadSchema = z.discriminatedUnion("state", [z.object({
+	state: z.literal("loaded"),
+	views: z.array(CompositionViewSchema)
+}), CompositionsNotLoadedSchema]);
+var CompositionGetReadSchema = z.discriminatedUnion("state", [z.object({
+	state: z.literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = z.discriminatedUnion("state", [z.object({
+	state: z.literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = z.object({
+	ok: z.boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
+	error: z.string().optional(),
+	line: z.number().optional(),
+	column: z.number().optional()
+});
+var coreBlocksCapability = {
+	name: "core-blocks",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		list: method(z.object({}), z.object({ blocks: z.array(CoreBlockSchema) }), { auth: "admin" }),
+		get: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
+		/**
+		* Create a block. The code is COMPILED first: storing source that does not
+		* compile turns an editor error into a fork failure the operator meets
+		* minutes later in a log.
+		*/
+		create: method(z.object({ block: CoreBlockInputSchema }), z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		update: method(z.object({
+			blockId: z.string(),
+			block: CoreBlockInputSchema.partial()
+		}), z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		delete: method(z.object({ blockId: z.string() }), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setEnabled: method(z.object({
+			blockId: z.string(),
+			enabled: z.boolean()
+		}), z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stop this block's runner and let the supervisor bring it back.
+		*
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
+		*
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
+		*/
+		restart: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Type-check without saving — what the editor calls as the author types, so
+		* the compiler's verdict is the same one the server will reach.
+		*/
+		compile: method(z.object({ code: z.string() }), CoreBlockCompileResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The declaration files the editor type-checks against.
+		*
+		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
+		* bundling it would roughly double the admin remote. Served rather than
+		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
+		* would drift and the editor would confidently autocomplete methods that
+		* do not exist.
+		*/
+		getTypeDefs: method(z.object({}), z.object({ libs: z.array(z.object({
 			filePath: z.string(),
 			content: z.string()
 		})) }), { auth: "admin" }),
@@ -11941,6 +12906,14 @@ var coreBlocksCapability = {
 			stableId: z.string().min(1)
 		}), CompositionCustomizationReadSchema, { auth: "admin" }),
 		/**
+		* The capabilities a composition may BUILD on a device of `deviceType`
+		* (a new device, or added to an existing one), with their fields — the
+		* editor's feature list and the presets' availability (G2, D676). Built
+		* from the validator's own blockers; a replace of a BOUND cap is not
+		* listed here (the device's bindings say what it has).
+		*/
+		listComposableCaps: method(z.object({ deviceType: z.enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
+		/**
 		* Validate without saving — the same verdict the save reaches. A mutation
 		* for its body size; it writes nothing, so its access is `view`.
 		*/
@@ -20920,7 +21893,7 @@ function cameraSensorRefKey(ref) {
 }
 /** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
 var CameraSensorsModeSchema = z.enum(["in-addition"]);
-z.object({
+var CameraSensorsConfigSchema = z.object({
 	mode: CameraSensorsModeSchema,
 	sensors: z.array(CameraSensorRefSchema).min(1).max(8)
 }).superRefine((value, ctx) => {
@@ -26107,6 +27080,16 @@ var NodeInferenceDevicesSchema = z.object({
 * Strictly the control plane: never sees a frame, never calls inference,
 * never drains queues. The runner does that work locally on each agent.
 */
+/**
+* The input of `setCameraSensors` (G5, D676): the ONE typed write path of a
+* camera's attached sensors (D672). `config: null` removes the attachment —
+* the camera reads `not-configured` again, never `unreadable`.
+*/
+var SetCameraSensorsInputSchema = z.object({
+	deviceId: z.number().int().nonnegative(),
+	/** `null` removes the attachment: the camera goes back to `not-configured`. */
+	config: CameraSensorsConfigSchema.nullable()
+});
 var pipelineOrchestratorCapability = {
 	name: "pipeline-orchestrator",
 	scope: "system",
@@ -26572,6 +27555,18 @@ var pipelineOrchestratorCapability = {
 		*/
 		getCameraStatuses: method(z.object({ deviceIds: z.array(z.number()).optional() }), z.array(CameraStatusSchema).readonly()),
 		/**
+		* Attach sensors to a camera, or detach them with `config: null` (D672
+		* configuration, G5/D676). Written to the orchestrator's per-device store
+		* under the same key `applyDeviceSettingsPatch` writes, and announced as a
+		* settings change so the camera-sensors bridge refreshes. Refused by name
+		* — nothing written — for a device that cannot be read, does not exist,
+		* is not a camera, or names itself as its own sensor.
+		*/
+		setCameraSensors: method(SetCameraSensorsInputSchema, z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
 		* the addon process and returns immediately with the job snapshot — the
 		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
@@ -42569,978 +43564,736 @@ var WeatherStatusSchema = z.object({
 	/** Pressure unit string (e.g. `hPa` / `inHg`). Null when not provided. */
 	pressureUnit: z.string().nullable(),
 	/** Wind speed in the reported unit. Null when not provided. */
-	windSpeed: z.number().nullable(),
-	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
-	windSpeedUnit: z.string().nullable(),
-	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
-	windBearing: z.number().nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastFetchedAt: z.number()
-});
-var weatherCapability = {
-	name: "weather",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Weather],
-	methods: {},
-	status: {
-		schema: WeatherStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. The UI reads the
-	* current conditions directly from the slice on each weather push.
-	*/
-	runtimeState: WeatherStatusSchema,
-	/**
-	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-/**
-* Per-zone occupancy aggregation produced by the analytics frame
-* processor on every inference result. Covers the full combinatorial
-* matrix the operator UI needs: total objects everywhere, total
-* objects per zone, single class everywhere, single class per zone,
-* objects outside any zone.
-*
-* Counts are derived from the analytics tracker (tracked detections
-* with stable trackIds), not raw detector hits — this filters out
-* one-off detector flickers and gives counts that match what the user
-* sees on the live overlay.
-*
-* Overlap policy: a detection that intersects two zones counts in
-* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
-* `frame` aggregate de-duplicates trivially since it's frame-wide.
-* `unzoned` counts only detections that landed in zero zones.
-*/
-var PerScopeBreakdownSchema = z.object({
-	/** Total tracked objects in this scope (frame / zone / unzoned). */
-	totalObjects: z.number().int().nonnegative(),
-	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
-	byClass: z.record(z.string(), z.number().int().nonnegative()),
-	/**
-	* Of `totalObjects`, how many are STANDING — objects the census holds,
-	* present but not going anywhere (a parked car, a bin, a statue).
-	*
-	* The operator's question about a scene has two halves and they answer
-	* different things: "what is parked here" is stable for hours and must not
-	* flap, while "who is walking through" is the thing an alert is about. One
-	* number could only serve one of them, and `totalObjects` served the first
-	* badly — a passer-by moved it and every occupancy rule saw a change.
-	*
-	* `standing + transient === totalObjects`, always. The total keeps its old
-	* meaning exactly, so no rule written against it changes behaviour.
-	*
-	* ABSENT means UNKNOWN, never zero (D393): a snapshot from a node older than
-	* this field cannot say, and a reader that folds absence in as 0 reports "no
-	* parked objects here" about a camera whose lot is full.
-	*/
-	standingObjects: z.number().int().nonnegative().optional(),
-	/** Of `totalObjects`, how many are passing through. See `standingObjects` —
-	*  same absence rule. */
-	transientObjects: z.number().int().nonnegative().optional()
-});
-var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
-	zoneId: z.string(),
-	zoneName: z.string(),
-	/** TrackIds of objects currently inside this zone — for cross-reference
-	*  with the per-track detail panel and live overlay. */
-	trackIds: z.array(z.string()).readonly()
-});
-/**
-* A parked ("stationary") object surfaced alongside occupancy — an object that
-* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
-* told to forget it so it stops re-spawning tracks/events), but it IS still
-* physically present, so it keeps counting toward `frame` occupancy and is
-* listed here so the UI can show it in a dedicated "Stationary" section instead
-* of flooding the live event feed.
-*/
-var StationaryObjectSchema = z.object({
-	id: z.string(),
-	className: z.string(),
-	bbox: z.object({
-		x: z.number(),
-		y: z.number(),
-		w: z.number(),
-		h: z.number()
-	}),
-	frameWidth: z.number().int().nonnegative(),
-	frameHeight: z.number().int().nonnegative(),
-	/** When the source track was first seen. */
-	firstSeenAt: z.number().int(),
-	/** When the object was recognised as parked (promotion time). */
-	becameStationaryAt: z.number().int(),
-	/** Last frame a detection confirmed the object is still there. */
-	lastConfirmedAt: z.number().int(),
-	/** Enrichment label carried from the source track (identity / plate). */
-	label: z.string().optional(),
-	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaId: z.number().int().optional()
-});
-var CameraOccupancySnapshotSchema = z.object({
-	/** Frame timestamp of the inference result that produced this snapshot. */
-	ts: z.number().int(),
-	/** Frame width/height in pixels — let the UI normalize bbox coords. */
-	frameWidth: z.number().int().nonnegative(),
-	frameHeight: z.number().int().nonnegative(),
-	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
-	zones: z.array(ZoneScopeBreakdownSchema).readonly(),
-	/** Frame-wide aggregate (everywhere, regardless of zone membership).
-	*  INCLUDES currently-confirmed stationary objects (they are still present). */
-	frame: PerScopeBreakdownSchema,
-	/** Detections that landed outside every zone. Empty when no zones defined. */
-	unzoned: PerScopeBreakdownSchema,
-	/** Parked objects on this camera (additive — absent on legacy snapshots).
-	*  Surfaced separately so the UI shows them in a dedicated section rather
-	*  than as repeated tracks/events. */
-	stationaryObjects: z.array(StationaryObjectSchema).readonly().optional()
-});
-/**
-* One camera's row in a `getCurrentSnapshotBatch` answer.
-*
-* THREE outcomes, and the single-camera method could only express two of them
-* because `snapshot: null` was already spoken for:
-*
-*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
-*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
-*    yet: no frame since boot, and no parked-object registry to hydrate from.
-*  - `read: 'unreadable'`               — the owner could not answer for this
-*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
-*
-* Collapsing the last two is the failure this field exists to prevent: a
-* hydration that threw would otherwise render as an empty Stationary section,
-* which is a definite claim about a camera nobody could read.
-*/
-var CameraOccupancySnapshotForDeviceSchema = z.object({
-	deviceId: z.number(),
-	read: z.enum(["read", "unreadable"]),
-	snapshot: CameraOccupancySnapshotSchema.nullable()
-});
-/**
-* Time-series resolution. The history methods return one bucket per
-* step over the requested range. Smaller resolutions cost more
-* memory + bandwidth; bound to discrete steps so caller cannot ask
-* for arbitrary fractional buckets.
-*/
-var HistoryResolutionEnum = z.enum([
-	"minute",
-	"5min",
-	"hour"
-]);
-var HistoryRangeSchema = z.object({
-	/** Range start (epoch ms, inclusive). */
-	from: z.number().int(),
-	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
-	to: z.number().int(),
-	resolution: HistoryResolutionEnum
-});
-var HistoryPointSchema = z.object({
-	/** Bucket midpoint (epoch ms). */
-	ts: z.number().int(),
-	/** Object count averaged over the bucket (rounded to nearest integer). */
-	count: z.number().int().nonnegative()
-});
-/**
-* Zone Analytics capability — spatial occupancy aggregations over
-* tracked detections. Hosted by `addon-pipeline-analytics`.
-*
-* Live snapshot is mirrored into the `zone-occupancy` device-state
-* slice on every frame; the cap method `getCurrentSnapshot` is a
-* direct read for callers that don't want to subscribe.
-*
-* History methods are sourced from a 60-minute rolling in-memory
-* ring of frame-level samples (sub-second resolution). Queries
-* outside the ring window return empty arrays — durable storage
-* is a follow-up (Step 4b: persisted samples → SQL store).
-*
-* Every history method takes an optional `className` filter:
-* - omitted → bucket count includes ALL classes in scope
-* - present → bucket count restricted to that class
-*
-* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
-* triple covers the three spatial scopes (per-zone, frame-wide,
-* outside-any-zone). Crossing them with `className?` gives the full
-* combinatorial coverage the operator UI requested.
-*
-* ## ⚠️ The three history methods are DEPRECATED
-*
-* They are served from a 60-MINUTE in-memory ring. It dies with the process,
-* so after a restart they report nothing about a night that did happen, and any
-* window past an hour is silently clamped — a caller cannot tell a clamp from
-* an empty scene. The presets in the occupancy chart existed to hide that
-* horizon rather than to answer a question.
-*
-* Use `pipelineAnalytics.readLongTermSeries({ series: 'occupancy', scope })`
-* instead. Those rows are already written for every camera, ~60 bytes per
-* (camera, scope, 5-minute bucket), kept for a year, and survive a restart.
-* Spell the scope with `occupancyScope(zoneId?, className?)` — the same
-* function the writer uses, so the two cannot drift.
-*
-* The ring stays until these three go, and it is the only thing left reading
-* it. Do not add a fourth caller.
-*/
-var zoneAnalyticsCapability = {
-	name: "zone-analytics",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Latest computed occupancy snapshot for this camera. Null when
-		*  the analytics pipeline hasn't seen a frame for this device yet
-		*  (no inference result emitted since boot or since binding was
-		*  activated). */
-		getCurrentSnapshot: method(z.object({ deviceId: z.number() }), CameraOccupancySnapshotSchema.nullable()),
-		/**
-		* The same snapshot, for a SET of cameras, in one round trip.
-		*
-		* The Events page's Stationary section polls this every 15s for every
-		* selected camera. Fanned out client-side that is one query per camera to
-		* read a `Map.get` at the owner — the answer costs nothing, the round trip
-		* costs everything. Batched, N transports become one and the per-device
-		* work is unchanged.
-		*
-		* Every requested deviceId gets a row, tagged `read` — see
-		* {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
-		* not answer for is `'unreadable'`, never an empty reading.
-		*/
-		getCurrentSnapshotBatch: method(z.object({ deviceIds: z.array(z.number()).min(1).max(200) }), z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
-		/** Time-series object count inside one zone. `className` optional —
-		*  omit to count every class in the zone. */
-		getZoneHistory: method(z.object({
-			deviceId: z.number(),
-			zoneId: z.string(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
-		/** Time-series frame-wide object count (everywhere). */
-		getCameraHistory: method(z.object({
-			deviceId: z.number(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
-		/** Time-series count of objects outside every zone. */
-		getUnzonedHistory: method(z.object({
-			deviceId: z.number(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly())
-	},
-	/**
-	* Runtime-state slice — the latest occupancy snapshot mirrored by
-	* the analytics frame processor on every inference result. Consumers
-	* read via `device.state.zoneAnalytics.value` and stay in sync
-	* automatically; the explicit `getCurrentSnapshot` cap method is
-	* still useful for one-off polls without a subscription.
-	*/
-	runtimeState: CameraOccupancySnapshotSchema,
-	/**
-	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-/**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
-*
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
-*/
-var ZoneRuleStageEnum = z.enum([
-	"motion",
-	"detection",
-	"package"
-]);
-/**
-* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
-* arrays that decide how each pipeline stage uses the polygon zones.
-*
-* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
-* so the operator has a single hub-side source of truth for both
-* geometry and behaviour. Per-stage rules are stored under the
-* `zoneRules.<stage>` key in the orchestrator's per-device store and
-* mirrored to the device-state slice `<stage>-zone-rules` on every
-* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
-* subscribe to that slice and refresh their gating without
-* round-tripping the cap.
-*
-* Sets are bulk-replace — the operator UI sends the new rule list
-* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
-* naturally in the rule editor without per-rule mutation chatter.
-*/
-var zoneRulesCapability = {
-	name: "zone-rules",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Read the full rule list for a given stage (empty when no rules
-		*  are defined yet). */
-		listRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum
-		}), z.array(ZoneRuleSchema).readonly()),
-		/** Bulk-replace the rule list for one stage. The provider validates
-		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
-		*  thresholds in range) and rejects the whole patch if any entry
-		*  is invalid — partial writes are a configuration footgun. */
-		setRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum,
-			rules: z.array(ZoneRuleSchema).readonly()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
+	windSpeed: z.number().nullable(),
+	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
+	windSpeedUnit: z.string().nullable(),
+	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
+	windBearing: z.number().nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastFetchedAt: z.number()
+});
+var weatherCapability = {
+	name: "weather",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Weather],
+	methods: {},
+	status: {
+		schema: WeatherStatusSchema,
+		kind: "push"
 	},
 	/**
-	* Runtime-state slice — every stage mirrored together so consumers
-	* see one reactive handle (`device.state.zoneRules.value`) instead
-	* of one per stage. Bulk-replace mutations on any stage write the full
-	* `{motion, detection, package}` shape, so subscribers always get the
-	* complete current set. Consumers that only care about one stage
-	* just read the matching property.
-	*
-	* `package` backs the package-drop detector — a package zone is a
-	* `ZoneRule` on the `'package'` stage referencing drawn polygons
-	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
-	* The orchestrator provider writes this stage as a first-class slice
-	* (Phase 4): every mutation mirrors the full `{motion, detection,
-	* package}` shape, so consumers read the current package rules directly
-	* off `device.state.zoneRules.value.package`.
+	* Runtime-state slice — mirrored by the kernel. The UI reads the
+	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: z.object({
-		motion: z.array(ZoneRuleSchema).readonly(),
-		detection: z.array(ZoneRuleSchema).readonly(),
-		package: z.array(ZoneRuleSchema).readonly()
-	}),
+	runtimeState: WeatherStatusSchema,
 	/**
-	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "session"
 };
-function isValueOf(slot, value) {
-	return value.slot === slot;
-}
-/** Bind slot `slot` to its owner's functions. See the module docblock. */
-function defineExtensionSlotProvider(slot, impl) {
-	return {
-		slot,
-		list: async (deviceId) => {
-			const listing = await impl.list(deviceId);
-			if (listing === null) return null;
-			const value = listing.value;
-			return {
-				...listing,
-				value
-			};
-		},
-		set: async (deviceId, value) => {
-			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
-			return await impl.set(deviceId, value);
-		},
-		candidates: (deviceId) => impl.candidates(deviceId)
-	};
-}
-/** `<source>:<slotId>`. */
-function extensionSlotRef(source, slot) {
-	return `${source}:${slot}`;
-}
-/** Build the `device-extension` provider one owner registers. */
-function createDeviceExtensionProvider(options) {
-	const { source, label, slots, hostTypeOf, logger } = options;
-	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
-	const resolve = async (deviceId, slotRef) => {
-		const prefix = `${source}:`;
-		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
-		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
-		const hostType = await hostTypeOf(deviceId);
-		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
-		return slot;
-	};
-	return {
-		listSources: async () => [{
-			source,
-			label,
-			availability: { state: "ok" }
-		}],
-		listSlots: async (input) => {
-			const hostType = await hostTypeOf(input.deviceId);
-			const rows = [];
-			for (const slot of slots) {
-				if (!offered(slot.slot, hostType)) continue;
-				const listing = await slot.list(input.deviceId);
-				if (listing === null) continue;
-				rows.push({
-					state: "ok",
-					slotRef: extensionSlotRef(source, slot.slot),
-					slot: slot.slot,
-					authority: listing.authority,
-					activation: listing.activation,
-					value: listing.value,
-					sources: [...listing.sources],
-					...listing.impliedSources !== void 0 ? { impliedSources: [...listing.impliedSources] } : {}
-				});
-			}
-			return rows;
-		},
-		listCandidates: async (input) => {
-			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
-		},
-		setSlot: async (input) => {
-			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
-			logger.info("device-extension: slot written", {
-				tags: { deviceId: input.deviceId },
-				meta: {
-					slotRef: input.slotRef,
-					reload: result.reload
-				}
-			});
-			return result;
-		}
-	};
-}
 /**
-* The field graph across every composition, and the cycles in it (D659).
-*
-* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
-* edge points from a composed field to each field it reads. A cycle, direct or
-* through another composition, is refused at save by name (spec §2).
-*
-* The graph is built for ONE save: the CANDIDATE composition (the one being
-* validated) plus every STORED composition. The candidate replaces its own old
-* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
-* introduces or removes a cycle must never depend on array order. A DIFFERENT
-* block targeting the candidate's device is refused by name: one composition
-* per device (D663). Two different stored peers that (wrongly) target the same
-* device are corrupted state, not a cycle to resolve by picking one silently;
-* that is refused by name too (D391).
-*
-* A customization of an EXISTING device reads that device's NATIVE value for a
-* field it replaces or does not write ("Invert state" reads the `on` it
-* replaces): such a self-read is no edge, so it is never a cycle (D663).
-* Another composition reading that field reads the customizer's output.
+* Per-zone occupancy aggregation produced by the analytics frame
+* processor on every inference result. Covers the full combinatorial
+* matrix the operator UI needs: total objects everywhere, total
+* objects per zone, single class everywhere, single class per zone,
+* objects outside any zone.
 *
-* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
-* marks a node `done` after its first expansion) — not every elementary cycle
-* through a shared node, so the path it names may AVOID the candidate while
-* one through it goes unreported. What a save refuses is therefore decided per
-* strongly connected component (`findCandidateCycles`, C-1). A dotted
-* `fieldPath` is matched only as an exact string: a write to `state.value` and
-* a read of `state` would not connect (no nested field writes exist yet).
+* Counts are derived from the analytics tracker (tracked detections
+* with stable trackIds), not raw detector hits — this filters out
+* one-off detector flickers and gives counts that match what the user
+* sees on the live overlay.
 *
-* An item leaf is its own node, `…#consumables.items[desiccant].status`
-* (`featureFieldEntries`), so two items sharing an inner path never merge. No
-* READ can name an array element (`describeStateField` never describes one),
-* so an item node is write-only: its edges to sources are what the check needs.
-*/
-/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
-var CompositionGraphError = class extends Error {};
-/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
-function writtenFields(peer) {
-	return new Set(peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
-}
-/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
-function readsComposedValue(peer, written, read) {
-	if (compositionSourceKey(read.source) !== compositionSourceKey(peer.target)) return true;
-	const field = `${read.cap}.${read.fieldPath}`;
-	return written.has(field) && peer.replaced?.has(field) !== true;
-}
-function peerEdges(peer) {
-	const written = writtenFields(peer);
-	return peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath, source }) => [compositionReadKey({
-		source: peer.target,
-		cap: feature.cap,
-		fieldPath
-	}), fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(compositionReadKey)]));
-}
-/**
-* Every peer that actually takes part in the graph: each stored peer minus the
-* candidate's own old version (same block id — the drop happens before any
-* edge is built, so its old edges never enter the map), plus the candidate
-* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
-* block targets the candidate's device, or two stored peers share a device.
+* Overlap policy: a detection that intersects two zones counts in
+* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
+* `frame` aggregate de-duplicates trivially since it's frame-wide.
+* `unzoned` counts only detections that landed in zero zones.
 */
-function resolvedPeers(candidate, stored) {
-	const candidateKey = compositionSourceKey(candidate.target);
-	const survivors = /* @__PURE__ */ new Map();
-	for (const peer of stored) {
-		if (peer.blockId === candidate.blockId) continue;
-		const key = compositionSourceKey(peer.target);
-		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
-		const clash = survivors.get(key);
-		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
-		survivors.set(key, peer);
-	}
-	return [...survivors.values(), candidate];
-}
-function compositionEdges(candidate, stored) {
-	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
-	return new Map(edges);
-}
-/** Tarjan's strongly connected components over every node of the graph (sources included). */
-function stronglyConnected(edges) {
-	const index = /* @__PURE__ */ new Map();
-	const low = /* @__PURE__ */ new Map();
-	const onStack = /* @__PURE__ */ new Set();
-	const stack = [];
-	const components = [];
-	const connect = (node) => {
-		index.set(node, index.size);
-		low.set(node, index.get(node) ?? 0);
-		stack.push(node);
-		onStack.add(node);
-		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
-			connect(next);
-			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
-		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
-		if (low.get(node) !== index.get(node)) return;
-		const component = [];
-		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
-			onStack.delete(member);
-			component.push(member);
-			if (member === node) break;
-		}
-		components.push(component);
-	};
-	for (const node of edges.keys()) if (!index.has(node)) connect(node);
-	return components;
-}
-/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
-function cycleThrough(start, component, edges) {
-	const parent = /* @__PURE__ */ new Map();
-	const queue = [start];
-	for (let head = 0; head < queue.length; head += 1) {
-		const node = queue[head];
-		if (node === void 0) break;
-		for (const next of edges.get(node) ?? []) {
-			if (next === start) {
-				const chain = [];
-				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
-				return [
-					start,
-					...chain.reverse(),
-					start
-				];
-			}
-			if (!component.has(next) || parent.has(next)) continue;
-			parent.set(next, node);
-			queue.push(next);
-		}
-	}
-	return [start, start];
-}
+var PerScopeBreakdownSchema = z.object({
+	/** Total tracked objects in this scope (frame / zone / unzoned). */
+	totalObjects: z.number().int().nonnegative(),
+	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
+	byClass: z.record(z.string(), z.number().int().nonnegative()),
+	/**
+	* Of `totalObjects`, how many are STANDING — objects the census holds,
+	* present but not going anywhere (a parked car, a bin, a statue).
+	*
+	* The operator's question about a scene has two halves and they answer
+	* different things: "what is parked here" is stable for hours and must not
+	* flap, while "who is walking through" is the thing an alert is about. One
+	* number could only serve one of them, and `totalObjects` served the first
+	* badly — a passer-by moved it and every occupancy rule saw a change.
+	*
+	* `standing + transient === totalObjects`, always. The total keeps its old
+	* meaning exactly, so no rule written against it changes behaviour.
+	*
+	* ABSENT means UNKNOWN, never zero (D393): a snapshot from a node older than
+	* this field cannot say, and a reader that folds absence in as 0 reports "no
+	* parked objects here" about a camera whose lot is full.
+	*/
+	standingObjects: z.number().int().nonnegative().optional(),
+	/** Of `totalObjects`, how many are passing through. See `standingObjects` —
+	*  same absence rule. */
+	transientObjects: z.number().int().nonnegative().optional()
+});
+var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
+	zoneId: z.string(),
+	zoneName: z.string(),
+	/** TrackIds of objects currently inside this zone — for cross-reference
+	*  with the per-track detail panel and live overlay. */
+	trackIds: z.array(z.string()).readonly()
+});
 /**
-* The cycles THIS save closes, decided per strongly connected component — never
-* per reported DFS path, which names one back-edge per revisit and can report a
-* component's cycle by a path that avoids the candidate while the one through it
-* goes unreported. A component refuses when it holds a candidate node and a
-* cycle (more than one node, or a self-loop). Components without a candidate
-* node are not this save's cycles.
+* A parked ("stationary") object surfaced alongside occupancy — an object that
+* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
+* told to forget it so it stops re-spawning tracks/events), but it IS still
+* physically present, so it keeps counting toward `frame` occupancy and is
+* listed here so the UI can show it in a dedicated "Stationary" section instead
+* of flooding the live event feed.
 */
-function findCandidateCycles(candidate, stored) {
-	const edges = compositionEdges(candidate, stored);
-	const prefix = `${compositionSourceKey(candidate.target)}#`;
-	return stronglyConnected(edges).flatMap((members) => {
-		const start = members.find((n) => n.startsWith(prefix));
-		if (start === void 0) return [];
-		const component = new Set(members);
-		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
-		if (members.length === 1 && !selfLoop) return [];
-		return [{
-			path: cycleThrough(start, component, edges),
-			component
-		}];
-	});
-}
-function problem(code, path, message) {
-	return {
-		code,
-		path,
-		message
-	};
-}
-function refused(...problems) {
-	return {
-		problems,
-		fields: [],
-		features: [],
-		events: []
-	};
-}
-/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
-function compositionFieldAt(field) {
-	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
-	return `features[${field.featureIndex}].${inner}.${field.path}`;
-}
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
-var BUILTIN_RESULT_KINDS = Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
+var StationaryObjectSchema = z.object({
+	id: z.string(),
+	className: z.string(),
+	bbox: z.object({
+		x: z.number(),
+		y: z.number(),
+		w: z.number(),
+		h: z.number()
+	}),
+	frameWidth: z.number().int().nonnegative(),
+	frameHeight: z.number().int().nonnegative(),
+	/** When the source track was first seen. */
+	firstSeenAt: z.number().int(),
+	/** When the object was recognised as parked (promotion time). */
+	becameStationaryAt: z.number().int(),
+	/** Last frame a detection confirmed the object is still there. */
+	lastConfirmedAt: z.number().int(),
+	/** Enrichment label carried from the source track (identity / plate). */
+	label: z.string().optional(),
+	/** Native-resolution key-frame media key for the parked object's best image. */
+	keyFrameMediaId: z.number().int().optional()
+});
+var CameraOccupancySnapshotSchema = z.object({
+	/** Frame timestamp of the inference result that produced this snapshot. */
+	ts: z.number().int(),
+	/** Frame width/height in pixels — let the UI normalize bbox coords. */
+	frameWidth: z.number().int().nonnegative(),
+	frameHeight: z.number().int().nonnegative(),
+	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
+	zones: z.array(ZoneScopeBreakdownSchema).readonly(),
+	/** Frame-wide aggregate (everywhere, regardless of zone membership).
+	*  INCLUDES currently-confirmed stationary objects (they are still present). */
+	frame: PerScopeBreakdownSchema,
+	/** Detections that landed outside every zone. Empty when no zones defined. */
+	unzoned: PerScopeBreakdownSchema,
+	/** Parked objects on this camera (additive — absent on legacy snapshots).
+	*  Surfaced separately so the UI shows them in a dedicated section rather
+	*  than as repeated tracks/events. */
+	stationaryObjects: z.array(StationaryObjectSchema).readonly().optional()
 });
-var KindInferenceError = class extends Error {};
-function kindOfValue(value) {
-	if (value === null) return "null";
-	if (typeof value === "number") return "number";
-	if (typeof value === "string") return "string";
-	return "boolean";
-}
-function only(kind) {
-	return new Set([kind]);
-}
-function union(...sets) {
-	return new Set(sets.flatMap((s) => [...s]));
-}
-function withoutNull(set) {
-	return new Set([...set].filter((k) => k !== "null"));
-}
-function binaryKinds(op, left, right) {
-	if (op === "+") {
-		const all = [...left, ...right];
-		if (all.every((k) => k === "string")) return only("string");
-		if (all.every((k) => k === "number")) return only("number");
-		return new Set(["number", "string"]);
-	}
-	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
-	return only("boolean");
-}
-/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
-function arityRange(builtin) {
-	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
-	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
-	return `${builtin.minArgs}–${builtin.maxArgs}`;
-}
-function callKinds(callee, args) {
-	const builtin = EXPRESSION_BUILTINS[callee];
-	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
-	const rule = BUILTIN_RESULT_KINDS[callee];
-	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
-	if (rule.kind === "fixed") return new Set(rule.result);
-	const nonNull = union(...args.map(withoutNull));
-	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
-}
-function kindsOf(node, bindings) {
-	switch (node.kind) {
-		case "literal": return only(kindOfValue(node.value));
-		case "identifier": {
-			if (node.name === "now") return only("number");
-			const bound = bindings.get(node.name);
-			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
-			return bound;
-		}
-		case "unary": return only(node.op === "!" ? "boolean" : "number");
-		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
-		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
-	}
-}
-function nodeContainsCall(node, callee) {
-	switch (node.kind) {
-		case "literal":
-		case "identifier": return false;
-		case "unary": return nodeContainsCall(node.operand, callee);
-		case "binary":
-		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
-		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
-		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
-	}
-}
-function expressionContainsBuiltinCall(expr, callee) {
-	const compiled = compileExpressionSafe(expr);
-	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
-}
-function inferExpressionKinds(input) {
-	const compiled = compileExpressionSafe(input.expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	try {
-		return {
-			ok: true,
-			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
-		};
-	} catch (err) {
-		if (err instanceof KindInferenceError) return {
-			ok: false,
-			error: err.message
-		};
-		throw err;
-	}
-}
 /**
-* The kind half of planning a composition field (D659): which kinds a source
-* can produce, whether they fit a target field, and the field's role.
-* Shared by the top-level planner (`validate-composition.ts`) and the item
-* planner (`composition-items.ts`). Internal to the composition module — NOT
-* in the barrel: these are planner internals, not a published contract.
+* One camera's row in a `getCurrentSnapshotBatch` answer.
+*
+* THREE outcomes, and the single-camera method could only express two of them
+* because `snapshot: null` was already spoken for:
+*
+*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
+*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
+*    yet: no frame since boot, and no parked-object registry to hydrate from.
+*  - `read: 'unreadable'`               — the owner could not answer for this
+*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
+*
+* Collapsing the last two is the failure this field exists to prevent: a
+* hydration that threw would otherwise render as an empty Stationary section,
+* which is a definite claim about a camera nobody could read.
 */
-function readKinds(read, lookupCap) {
-	const def = lookupCap(read.cap);
-	const schema = def?.runtimeState ?? def?.status?.schema;
-	if (def === null || schema === void 0) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `no capability \`${read.cap}\` with state to read`
-	};
-	const field = describeStateField(schema, read.fieldPath);
-	if (field === null) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
-	};
-	const base = field.kind === "enum" ? "string" : field.kind;
-	return {
-		ok: true,
-		kinds: new Set(field.nullable ? [base, "null"] : [base])
-	};
-}
-function sourceKinds(source, lookupCap) {
-	if (source.kind === "from") return readKinds(source, lookupCap);
-	if (source.kind === "code") return {
-		ok: false,
-		code: "reserved-variant",
-		message: "code fields arrive in slice 4"
-	};
-	const bindingKinds = /* @__PURE__ */ new Map();
-	for (const [name, binding] of Object.entries(source.bindings)) {
-		if (binding.kind === "literal") {
-			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
-			continue;
-		}
-		const kinds = readKinds(binding, lookupCap);
-		if (!kinds.ok) return {
-			...kinds,
-			message: `binding \`${name}\`: ${kinds.message}`
-		};
-		bindingKinds.set(name, kinds.kinds);
-	}
-	const inferred = inferExpressionKinds({
-		expr: source.expr,
-		bindingKinds
-	});
-	return inferred.ok ? {
-		ok: true,
-		kinds: inferred.kinds
-	} : {
-		ok: false,
-		code: "expression-invalid",
-		message: inferred.error
-	};
-}
-function compatibility(cap, target, kinds, at) {
-	const allowed = target.kind === "enum" ? "string" : target.kind;
-	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
-	const problems = [];
-	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
-	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
-	return problems;
-}
+var CameraOccupancySnapshotForDeviceSchema = z.object({
+	deviceId: z.number(),
+	read: z.enum(["read", "unreadable"]),
+	snapshot: CameraOccupancySnapshotSchema.nullable()
+});
 /**
-* A string a source produces WITHOUT reading any device — a field-level
-* `expression` source whose compiled AST is a bare string literal (`"red"`,
-* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
-* the kind level (a `from` read of an enum-typed source field, a computed
-* expression) is NOT checked against the target's `enumValues` here: the
-* kind inference already collapsed it to the coarse `'string'` kind, losing
-* whichever enum it actually came from, so membership can only be judged at
-* write time against the runtime-state schema. Known limitation — see the
-* fix report for Task 6 round 1.
+* Time-series resolution. The history methods return one bucket per
+* step over the requested range. Smaller resolutions cost more
+* memory + bandwidth; bound to discrete steps so caller cannot ask
+* for arbitrary fractional buckets.
 */
-function literalStringValue(source) {
-	if (source.kind !== "expression") return null;
-	const compiled = compileExpressionSafe(source.expr);
-	if (!compiled.ok) return null;
-	const ast = compiled.parsed.ast;
-	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
-}
+var HistoryResolutionEnum = z.enum([
+	"minute",
+	"5min",
+	"hour"
+]);
+var HistoryRangeSchema = z.object({
+	/** Range start (epoch ms, inclusive). */
+	from: z.number().int(),
+	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
+	to: z.number().int(),
+	resolution: HistoryResolutionEnum
+});
+var HistoryPointSchema = z.object({
+	/** Bucket midpoint (epoch ms). */
+	ts: z.number().int(),
+	/** Object count averaged over the bucket (rounded to nearest integer). */
+	count: z.number().int().nonnegative()
+});
 /**
-* An enum target whose source is a save-time-KNOWN string literal outside its
-* `enumValues` is refused now rather than left to fail the write later. A
-* dynamic source (a `from` read, a non-literal expression) is left to
-* runtime — see {@link literalStringValue}.
+* Zone Analytics capability — spatial occupancy aggregations over
+* tracked detections. Hosted by `addon-pipeline-analytics`.
+*
+* Live snapshot is mirrored into the `zone-occupancy` device-state
+* slice on every frame; the cap method `getCurrentSnapshot` is a
+* direct read for callers that don't want to subscribe.
+*
+* History methods are sourced from a 60-minute rolling in-memory
+* ring of frame-level samples (sub-second resolution). Queries
+* outside the ring window return empty arrays — durable storage
+* is a follow-up (Step 4b: persisted samples → SQL store).
+*
+* Every history method takes an optional `className` filter:
+* - omitted → bucket count includes ALL classes in scope
+* - present → bucket count restricted to that class
+*
+* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
+* triple covers the three spatial scopes (per-zone, frame-wide,
+* outside-any-zone). Crossing them with `className?` gives the full
+* combinatorial coverage the operator UI requested.
+*
+* ## ⚠️ The three history methods are DEPRECATED
+*
+* They are served from a 60-MINUTE in-memory ring. It dies with the process,
+* so after a restart they report nothing about a night that did happen, and any
+* window past an hour is silently clamped — a caller cannot tell a clamp from
+* an empty scene. The presets in the occupancy chart existed to hide that
+* horizon rather than to answer a question.
+*
+* Use `pipelineAnalytics.readLongTermSeries({ series: 'occupancy', scope })`
+* instead. Those rows are already written for every camera, ~60 bytes per
+* (camera, scope, 5-minute bucket), kept for a year, and survive a restart.
+* Spell the scope with `occupancyScope(zoneId?, className?)` — the same
+* function the writer uses, so the two cannot drift.
+*
+* The ring stays until these three go, and it is the only thing left reading
+* it. Do not add a fourth caller.
 */
-function enumLiteralProblem(cap, target, source, at) {
-	if (target.kind !== "enum" || target.enumValues === void 0) return null;
-	const value = literalStringValue(source);
-	if (value === null || target.enumValues.includes(value)) return null;
-	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
-	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
-}
-function roleOf(source) {
-	if (source.kind !== "expression") return "derived";
-	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
-	if (fieldReads(source).length > 0) return "derived";
-	const compiled = compileExpressionSafe(source.expr);
-	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
-}
+var zoneAnalyticsCapability = {
+	name: "zone-analytics",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Latest computed occupancy snapshot for this camera. Null when
+		*  the analytics pipeline hasn't seen a frame for this device yet
+		*  (no inference result emitted since boot or since binding was
+		*  activated). */
+		getCurrentSnapshot: method(z.object({ deviceId: z.number() }), CameraOccupancySnapshotSchema.nullable()),
+		/**
+		* The same snapshot, for a SET of cameras, in one round trip.
+		*
+		* The Events page's Stationary section polls this every 15s for every
+		* selected camera. Fanned out client-side that is one query per camera to
+		* read a `Map.get` at the owner — the answer costs nothing, the round trip
+		* costs everything. Batched, N transports become one and the per-device
+		* work is unchanged.
+		*
+		* Every requested deviceId gets a row, tagged `read` — see
+		* {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
+		* not answer for is `'unreadable'`, never an empty reading.
+		*/
+		getCurrentSnapshotBatch: method(z.object({ deviceIds: z.array(z.number()).min(1).max(200) }), z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
+		/** Time-series object count inside one zone. `className` optional —
+		*  omit to count every class in the zone. */
+		getZoneHistory: method(z.object({
+			deviceId: z.number(),
+			zoneId: z.string(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
+		/** Time-series frame-wide object count (everywhere). */
+		getCameraHistory: method(z.object({
+			deviceId: z.number(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
+		/** Time-series count of objects outside every zone. */
+		getUnzonedHistory: method(z.object({
+			deviceId: z.number(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly())
+	},
+	/**
+	* Runtime-state slice — the latest occupancy snapshot mirrored by
+	* the analytics frame processor on every inference result. Consumers
+	* read via `device.state.zoneAnalytics.value` and stay in sync
+	* automatically; the explicit `getCurrentSnapshot` cap method is
+	* still useful for one-off polls without a subscription.
+	*/
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
+};
 /**
-* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
-* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
-* own offline, and D393 forbids a stale number, so on an existing target a
-* field that READS a source never gets `offline`.
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
 */
-function unavailableFor(tf, role, mode, cap, at) {
-	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
-		ok: true,
-		unavailable: "release"
-	};
-	if (mode === "new" || role !== "derived") return {
-		ok: true,
-		unavailable: tf.nullable ? "null" : "offline"
-	};
-	if (tf.nullable) return {
-		ok: true,
-		unavailable: "null"
-	};
-	if (tf.enumValues?.includes("unknown") === true) return {
-		ok: true,
-		unavailable: "unknown"
-	};
-	return {
-		ok: false,
-		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
-	};
-}
-/** Item fields the composer writes itself, with the value it writes. */
-var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
-function reservedItemFields(itemArray) {
-	return new Set([
-		itemArray.keyField,
-		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
-		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
-	]);
-}
-/** A required leaf under an optional parent is required only once something writes that parent. */
-function leafRequired(itemArray, path, written) {
-	const described = describeStateField(itemArray.itemSchema, path);
-	if (described === null || !described.required) return false;
-	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
-}
-function missingLeaves({ capName, itemArray, reserved }, item, at) {
-	const written = Object.keys(item.fields);
-	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
-		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
-		if (!leafRequired(itemArray, leaf.path, written)) return [];
-		const described = describeStateField(itemArray.itemSchema, leaf.path);
-		if (described === null || described.nullable) return [];
-		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
-	});
+var ZoneRuleStageEnum = z.enum([
+	"motion",
+	"detection",
+	"package"
+]);
+/**
+* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
+* arrays that decide how each pipeline stage uses the polygon zones.
+*
+* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
+* so the operator has a single hub-side source of truth for both
+* geometry and behaviour. Per-stage rules are stored under the
+* `zoneRules.<stage>` key in the orchestrator's per-device store and
+* mirrored to the device-state slice `<stage>-zone-rules` on every
+* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
+* subscribe to that slice and refresh their gating without
+* round-tripping the cap.
+*
+* Sets are bulk-replace — the operator UI sends the new rule list
+* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
+* naturally in the rule editor without per-rule mutation chatter.
+*/
+var zoneRulesCapability = {
+	name: "zone-rules",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Read the full rule list for a given stage (empty when no rules
+		*  are defined yet). */
+		listRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum
+		}), z.array(ZoneRuleSchema).readonly()),
+		/** Bulk-replace the rule list for one stage. The provider validates
+		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+		*  thresholds in range) and rejects the whole patch if any entry
+		*  is invalid — partial writes are a configuration footgun. */
+		setRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum,
+			rules: z.array(ZoneRuleSchema).readonly()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — every stage mirrored together so consumers
+	* see one reactive handle (`device.state.zoneRules.value`) instead
+	* of one per stage. Bulk-replace mutations on any stage write the full
+	* `{motion, detection, package}` shape, so subscribers always get the
+	* complete current set. Consumers that only care about one stage
+	* just read the matching property.
+	*
+	* `package` backs the package-drop detector — a package zone is a
+	* `ZoneRule` on the `'package'` stage referencing drawn polygons
+	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+	* The orchestrator provider writes this stage as a first-class slice
+	* (Phase 4): every mutation mirrors the full `{motion, detection,
+	* package}` shape, so consumers read the current package rules directly
+	* off `device.state.zoneRules.value.package`.
+	*/
+	runtimeState: z.object({
+		motion: z.array(ZoneRuleSchema).readonly(),
+		detection: z.array(ZoneRuleSchema).readonly(),
+		package: z.array(ZoneRuleSchema).readonly()
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+function isValueOf(slot, value) {
+	return value.slot === slot;
 }
-function planItemField(ctx, leaf) {
-	const { capName, itemArray, featureIndex, lookupCap } = ctx;
-	const { key, label, path, source } = leaf;
-	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
-	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
-	const tf = describeStateField(itemArray.itemSchema, path);
-	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: capName,
-		path,
-		item: {
-			arrayPath: itemArray.path,
-			key,
-			label
-		},
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(capName, tf, source, at);
+/** Bind slot `slot` to its owner's functions. See the module docblock. */
+function defineExtensionSlotProvider(slot, impl) {
 	return {
-		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
+		slot,
+		list: async (deviceId) => {
+			const listing = await impl.list(deviceId);
+			if (listing === null) return null;
+			const value = listing.value;
+			return {
+				...listing,
+				value
+			};
+		},
+		set: async (deviceId, value) => {
+			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
+			return await impl.set(deviceId, value);
+		},
+		candidates: (deviceId) => impl.candidates(deviceId)
 	};
 }
-function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
-	const at = `features[${featureIndex}].items`;
-	const itemArray = def.status?.itemArray;
-	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
-	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
-	const ctx = {
-		capName: def.name,
-		itemArray,
-		reserved: reservedItemFields(itemArray),
-		featureIndex,
-		lookupCap,
-		mode
+/** `<source>:<slotId>`. */
+function extensionSlotRef(source, slot) {
+	return `${source}:${slot}`;
+}
+/** Build the `device-extension` provider one owner registers. */
+function createDeviceExtensionProvider(options) {
+	const { source, label, slots, hostTypeOf, logger } = options;
+	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
+	const resolve = async (deviceId, slotRef) => {
+		const prefix = `${source}:`;
+		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
+		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
+		const hostType = await hostTypeOf(deviceId);
+		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
+		return slot;
 	};
-	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
-		problems: missingLeaves(ctx, item, `${at}.${key}`),
-		fields: [],
-		features: [],
-		events: []
-	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
-		key,
-		label: item.label,
-		path,
-		source
-	}))]);
 	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: [],
-		events: []
+		listSources: async () => [{
+			source,
+			label,
+			availability: { state: "ok" }
+		}],
+		listSlots: async (input) => {
+			const hostType = await hostTypeOf(input.deviceId);
+			const rows = [];
+			for (const slot of slots) {
+				if (!offered(slot.slot, hostType)) continue;
+				const listing = await slot.list(input.deviceId);
+				if (listing === null) continue;
+				rows.push({
+					state: "ok",
+					slotRef: extensionSlotRef(source, slot.slot),
+					slot: slot.slot,
+					authority: listing.authority,
+					activation: listing.activation,
+					value: listing.value,
+					sources: [...listing.sources],
+					...listing.impliedSources !== void 0 ? { impliedSources: [...listing.impliedSources] } : {}
+				});
+			}
+			return rows;
+		},
+		listCandidates: async (input) => {
+			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
+		},
+		setSlot: async (input) => {
+			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
+			logger.info("device-extension: slot written", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					slotRef: input.slotRef,
+					reload: result.reload
+				}
+			});
+			return result;
+		}
 	};
 }
+/**
+* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
+* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
+* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
+* decimals). K derives from `°C = K − 273.15`.
+*/
+var UNIT_TABLE = {
+	"°C": {
+		dimension: "temperature",
+		factor: 1,
+		offset: 0
+	},
+	"°F": {
+		dimension: "temperature",
+		factor: 5 / 9,
+		offset: -160 / 9
+	},
+	K: {
+		dimension: "temperature",
+		factor: 1,
+		offset: -273.15
+	},
+	hPa: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	kPa: {
+		dimension: "pressure",
+		factor: 10,
+		offset: 0
+	},
+	Pa: {
+		dimension: "pressure",
+		factor: .01,
+		offset: 0
+	},
+	mbar: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	bar: {
+		dimension: "pressure",
+		factor: 1e3,
+		offset: 0
+	},
+	inHg: {
+		dimension: "pressure",
+		factor: 33.8639,
+		offset: 0
+	},
+	mmHg: {
+		dimension: "pressure",
+		factor: 1.33322,
+		offset: 0
+	},
+	psi: {
+		dimension: "pressure",
+		factor: 68.9476,
+		offset: 0
+	},
+	"m/s": {
+		dimension: "speed",
+		factor: 1,
+		offset: 0
+	},
+	"km/h": {
+		dimension: "speed",
+		factor: 1 / 3.6,
+		offset: 0
+	},
+	mph: {
+		dimension: "speed",
+		factor: .44704,
+		offset: 0
+	},
+	kn: {
+		dimension: "speed",
+		factor: .514444,
+		offset: 0
+	},
+	"mm/h": {
+		dimension: "precipitation-rate",
+		factor: 1,
+		offset: 0
+	},
+	"in/h": {
+		dimension: "precipitation-rate",
+		factor: 25.4,
+		offset: 0
+	},
+	m: {
+		dimension: "length",
+		factor: 1,
+		offset: 0
+	},
+	mm: {
+		dimension: "length",
+		factor: .001,
+		offset: 0
+	},
+	cm: {
+		dimension: "length",
+		factor: .01,
+		offset: 0
+	},
+	km: {
+		dimension: "length",
+		factor: 1e3,
+		offset: 0
+	},
+	in: {
+		dimension: "length",
+		factor: .0254,
+		offset: 0
+	},
+	ft: {
+		dimension: "length",
+		factor: .3048,
+		offset: 0
+	},
+	mi: {
+		dimension: "length",
+		factor: 1609.344,
+		offset: 0
+	},
+	lx: {
+		dimension: "illuminance",
+		factor: 1,
+		offset: 0
+	},
+	"W/m²": {
+		dimension: "irradiance",
+		factor: 1,
+		offset: 0
+	},
+	W: {
+		dimension: "power",
+		factor: 1,
+		offset: 0
+	},
+	kW: {
+		dimension: "power",
+		factor: 1e3,
+		offset: 0
+	},
+	VA: {
+		dimension: "apparent-power",
+		factor: 1,
+		offset: 0
+	},
+	Wh: {
+		dimension: "energy",
+		factor: 1,
+		offset: 0
+	},
+	kWh: {
+		dimension: "energy",
+		factor: 1e3,
+		offset: 0
+	},
+	MWh: {
+		dimension: "energy",
+		factor: 1e6,
+		offset: 0
+	},
+	V: {
+		dimension: "voltage",
+		factor: 1,
+		offset: 0
+	},
+	mV: {
+		dimension: "voltage",
+		factor: .001,
+		offset: 0
+	},
+	A: {
+		dimension: "current",
+		factor: 1,
+		offset: 0
+	},
+	mA: {
+		dimension: "current",
+		factor: .001,
+		offset: 0
+	},
+	ppm: {
+		dimension: "concentration-volume",
+		factor: 1,
+		offset: 0
+	},
+	ppb: {
+		dimension: "concentration-volume",
+		factor: .001,
+		offset: 0
+	},
+	"µg/m³": {
+		dimension: "concentration-mass",
+		factor: 1,
+		offset: 0
+	},
+	"mg/m³": {
+		dimension: "concentration-mass",
+		factor: 1e3,
+		offset: 0
+	},
+	kg: {
+		dimension: "mass",
+		factor: 1,
+		offset: 0
+	},
+	g: {
+		dimension: "mass",
+		factor: .001,
+		offset: 0
+	},
+	lb: {
+		dimension: "mass",
+		factor: .453592,
+		offset: 0
+	},
+	oz: {
+		dimension: "mass",
+		factor: .0283495,
+		offset: 0
+	},
+	"%": {
+		dimension: "percentage",
+		factor: 1,
+		offset: 0
+	}
+};
+/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
+function specFor(unit) {
+	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
+}
+/** Value in `spec`'s unit → its dimension's canonical unit. */
+function toCanonical(value, spec) {
+	return value * spec.factor + spec.offset;
+}
+/** Canonical-unit value → the unit described by `spec`. */
+function fromCanonical(canonical, spec) {
+	return (canonical - spec.offset) / spec.factor;
+}
+/**
+* Graceful variant for the render path: returns the converted value, or
+* `undefined` when the conversion is refused (unknown unit / cross-dimension).
+* Never throws — a render caller falls back to the raw value + source unit.
+*/
+function tryConvertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) return void 0;
+	const toSpec = specFor(to);
+	if (!toSpec) return void 0;
+	if (fromSpec.dimension !== toSpec.dimension) return void 0;
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+}
+/**
+* One composed field, evaluated from what its sources say NOW (D659).
+*
+* Pure. The composer calls it on every source change, and the slice-5 editor
+* will call it for its live preview, so both see the same answer.
+*
+* The rules (spec §2):
+*  - a source that is offline or unreadable keeps its last value and is marked
+*    STALE; the field is stale and keeps computing (D49);
+*  - a source that is GONE makes the field UNAVAILABLE, `fatal`, and never a
+*    plausible number (D393);
+*  - a source that is unavailable but NOT gone (e.g. a cap unregistered at
+*    runtime, R7b) makes the field UNAVAILABLE, non-fatal, `value: null`: it
+*    may come back on its own, no block failure is raised for it;
+*  - an expression that fails on a value makes the field unavailable for that
+*    value, and NOT fatal: the next value may compute.
+*
+* `confirmed` (D663, D49): whether a NON-fatal unavailability is an ANSWER — a
+* cap the provider unregistered and a re-read agreed, a field the source
+* reported without, an expression that failed on a value — or only the
+* absence of one (a failed read, a first or empty read, a source not tracked
+* yet). Only a confirmed unavailability may hand a `release`-mode field back
+* to the native provider; an unconfirmed one holds it on its last value.
+* Absent means NOT confirmed. Fatal is always confirmed.
+*
+* When an expression has more than one unavailable binding, a FATAL one always
+* wins the outcome, regardless of position: every binding is scanned before
+* the field is judged, so an earlier non-fatal binding (e.g. a cap that is
+* momentarily unregistered) can never hide a later fatal one (a deleted
+* source) behind an early return.
+*/
 function describeRead(read) {
 	return `${compositionSourceKey(read.source)} ${read.cap}.${read.fieldPath}`;
 }
@@ -43607,7 +44360,10 @@ function expressionOutcome(source, read, now, stateful) {
 	}
 	const deadlines = [];
 	const result = evaluateExpressionSource(source.expr, values, now, {
-		hooks: { noteDeadline: (at) => deadlines.push(at) },
+		hooks: {
+			noteDeadline: (at) => deadlines.push(at),
+			convert: (value, from, to) => tryConvertUnit(value, normalizeUnit(from) ?? from, normalizeUnit(to) ?? to) ?? null
+		},
 		...stateful === void 0 ? {} : { invokeStateful: (invocation) => evaluateStatefulExpressionCall(stateful.callPathPrefix === void 0 ? invocation : {
 			...invocation,
 			path: `${stateful.callPathPrefix}@${invocation.path}`
@@ -43645,301 +44401,70 @@ function evaluateCompositionField(input) {
 		};
 	}
 }
-function buildCapabilityLookup(defs) {
-	const byName = new Map(defs.map((d) => [d.name, d]));
-	return (capName) => byName.get(capName) ?? null;
-}
-/** Caps every `BaseDevice` registers on itself; a second registration throws. */
-var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
-var PENDING_SELF = {
-	addonId: COMPOSER_ADDON_ID,
-	stableId: `${COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
-};
-function composableCap(feature, at, lookupCap) {
-	const def = lookupCap(feature.cap);
-	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
-	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
-	const state = def.runtimeState;
-	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
-	return {
-		def,
-		state,
-		fields: describeTopLevelStateFields(state)
-	};
-}
 /**
-* A capability BUILT by the composition (a new device, or one ADDED to an
-* existing device) must fit the device type, serve no command, and have every
-* required field. A REPLACE needs none of it: the cap is bound (a fact), the
-* native keeps serving its methods, and only the named fields are owned (D663).
+* The doorbell of a camera as a customization (D671). ONE builder: the
+* virtual-doorbell migration and the admin UI's "Use as doorbell" preset both
+* call it, so a preset can never write a shape the migration would refuse as
+* "an unrelated existing block".
 */
-function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
-	const problems = [];
-	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
-	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
-	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
-	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
-	for (const key of requiredTopLevelKeys(state)) {
-		if (key === itemArrayPath) continue;
-		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
-		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
-	}
-	return problems;
-}
-function planTopLevelField({ def, fields }, field, mode, lookupCap) {
-	const { featureIndex, path, source } = field;
-	const fieldAt = `features[${featureIndex}].fields.${path}`;
-	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
-	const tf = fields.get(path);
-	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: def.name,
-		path,
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
-	return {
-		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
-	};
-}
-function planFeature(feature, featureIndex, target, lookupCap) {
-	const at = `features[${featureIndex}]`;
-	const cap = composableCap(feature, at, lookupCap);
-	if ("code" in cap) return refused(cap);
-	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
-	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
-	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
-		featureIndex,
-		path,
-		source
-	}, target.mode, lookupCap));
-	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
-	const all = [...perField, ...items];
-	const fields = all.flatMap((result) => result.fields);
-	const featurePlan = {
-		featureIndex,
-		cap: cap.def.name,
-		mode: target.mode
-	};
-	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
-	return {
-		problems: [
-			...capProblems,
-			...all.flatMap((r) => r.problems),
-			...eventPlan.problems
-		],
-		fields,
-		features: [featurePlan],
-		events: eventPlan.events
-	};
-}
-/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
-function isNativeCap(target, cap) {
-	const owner = target.nativeCaps.get(cap);
-	return owner !== void 0 && owner !== "composer";
-}
-/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
-function planTargetOf(composition, target) {
-	if (composition.target.kind === "new") return {
-		kind: "new",
-		type: composition.target.type
-	};
-	const key = compositionSourceKey(composition.target.device);
-	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
-	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
-	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
-	return {
-		kind: "existing",
-		found: target
-	};
-}
-function featureTargetOf(target, cap) {
-	if (target.kind === "new") return {
-		mode: "new",
-		deviceType: target.type
-	};
-	return {
-		mode: isNativeCap(target.found, cap) ? "replace" : "add",
-		deviceType: target.found.type
-	};
+/** A rise closer than this to the previous one is the same press (D671). */
+var DOORBELL_RISE_DEBOUNCE_MS = 2e3;
+/** Every source cap of `source` that `SOURCE_CAP_ACTIVE_FIELD` knows AND the device has bound. */
+function doorbellFeatureSources(source, boundCaps) {
+	return Object.keys(SOURCE_CAP_ACTIVE_FIELD).filter((cap) => Object.hasOwn(SOURCE_CAP_CHANGED_AT_FIELD, cap) && boundCaps.includes(cap)).toSorted().flatMap((cap) => {
+		const activeField = SOURCE_CAP_ACTIVE_FIELD[cap];
+		const changedAtField = SOURCE_CAP_CHANGED_AT_FIELD[cap];
+		return activeField === void 0 || changedAtField === void 0 ? [] : [{
+			source,
+			cap,
+			activeField,
+			changedAtField
+		}];
+	});
 }
-/**
-* The static plan. `target` describes an EXISTING target device (one read);
-* it is ignored for a new one. On an existing target each feature REPLACES a
-* cap the device has natively, else ADDS it (D663).
-*/
-function planComposition(composition, lookupCap, target) {
-	const planTarget = planTargetOf(composition, target);
-	if ("code" in planTarget) return refused(planTarget);
-	const results = composition.features.map((feature, index) => {
-		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
-		return compositionFeatureEnabled(feature) ? result : {
-			problems: result.problems,
-			fields: [],
-			features: [],
-			events: []
+/** The D671 feature, byte for byte what the migration writes. Throws on zero sources. */
+function buildDoorbellCompositionFeature(input) {
+	const sources = [...input.sources].toSorted((a, b) => `${a.source.addonId}/${a.source.stableId}#${a.cap}`.localeCompare(`${b.source.addonId}/${b.source.stableId}#${b.cap}`));
+	if (sources.length === 0) throw new Error("doorbell composition needs at least one source");
+	const edgeBindings = {};
+	sources.forEach((entry, index) => {
+		edgeBindings[`active${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.activeField
+		};
+		edgeBindings[`changed${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.changedAtField
 		};
 	});
 	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: results.flatMap((r) => r.features),
-		events: results.flatMap((r) => r.events)
-	};
-}
-function compositionSourceRefs(composition) {
-	const refs = composition.features.flatMap((f) => compositionFeatureEnabled(f) && f.kind === "fields" ? featureSources(f).flatMap(fieldReads).map((r) => r.source) : []);
-	return [...new Map(refs.map((r) => [compositionSourceKey(r), r])).values()];
-}
-/**
-* The candidate's device: the existing target itself, else `self`, else a
-* placeholder that cannot collide with a stored target. An existing target is
-* known even on create, so a second customization of it is refused on create too.
-*/
-function candidateSelf(composition, ctx, plan) {
-	return {
-		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
-		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
-		replaced: replacedFieldKeys(plan)
-	};
-}
-/**
-* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
-* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
-* derivation, so the graph reads both the same way.
-*/
-function replacedFieldKeys(plan) {
-	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
-	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
-}
-/**
-* A read of the candidate's own device. Its own composed output (a new device's
-* field, an ADDED field) is the slice-1 own-field rule; on an existing target
-* every other field — replaced, or not composed at all — is the NATIVE value,
-* valid when the device serves that cap natively (D663, rule 5).
-*/
-function selfReadProblems(read, at, fields, self) {
-	const readKey = `${read.cap}.${read.fieldPath}`;
-	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
-	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
-	if (isNativeCap(self.native, read.cap)) return [];
-	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
-}
-function sourceProblems(fields, ctx, self) {
-	const selfKey = compositionSourceKey(self.ref);
-	return fields.flatMap((field) => field.reads.flatMap((read) => {
-		const at = compositionFieldAt(field);
-		const key = compositionSourceKey(read.source);
-		if (key === selfKey) return selfReadProblems(read, at, fields, self);
-		const desc = ctx.sources.get(key);
-		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
-		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
-		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
-		return [];
-	}));
-}
-/**
-* A cycle's node keys are `compositionReadKey` strings:
-* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
-* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
-* back out so the refusal can point at that exact field, matching the
-* documented `features[N].fields.<path>` convention. A cap name has no `.`,
-* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
-* (`items[desiccant].status`) is matched through `compositionFieldKey`.
-*/
-function candidateFieldOfNode(nodeKey, candidateKey) {
-	const prefix = `${candidateKey}#`;
-	if (!nodeKey.startsWith(prefix)) return null;
-	const rest = nodeKey.slice(prefix.length);
-	const dot = rest.indexOf(".");
-	if (dot === -1) return null;
-	return {
-		cap: rest.slice(0, dot),
-		fieldPath: rest.slice(dot + 1)
-	};
-}
-/** The first node of a cycle's path that is one of THIS composition's own
-*  planned fields, as a documented-convention path; `'features'` when the
-*  cycle runs entirely through other stored compositions. */
-function cyclePath(nodePath, candidateKey, fields) {
-	for (const nodeKey of nodePath) {
-		const hit = candidateFieldOfNode(nodeKey, candidateKey);
-		if (hit === null) continue;
-		const hitKey = `${hit.cap}.${hit.fieldPath}`;
-		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
-		if (field !== void 0) return compositionFieldAt(field);
-	}
-	return "features";
-}
-/** The first unread device any of `nodes` belongs to; null when none does. */
-function unreadDeviceOf(nodes, unread) {
-	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
-		key,
-		error
-	};
-	return null;
-}
-/**
-* Cycle check runs against the CANDIDATE (this composition, as block
-* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
-* decided per strongly connected component (`findCandidateCycles`): a cyclic
-* component holding a candidate node refuses, with one representative cycle
-* through it; one without is not this save's cycle. A
-* stored composition of the same block is its old version; another block on
-* the same device, or two stored peers sharing a device, make
-* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
-* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
-*/
-function cycleProblems(composition, ctx, fields, self) {
-	const candidate = {
-		blockId: ctx.blockId ?? "(unsaved)",
-		target: self.ref,
-		composition,
-		replaced: self.replaced
-	};
-	const candidateKey = compositionSourceKey(candidate.target);
-	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
-	try {
-		return findCandidateCycles(candidate, ctx.peers).map((c) => {
-			const at = cyclePath(c.path, candidateKey, fields);
-			const through = unreadDeviceOf([...c.component], unread);
-			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
-		});
-	} catch (err) {
-		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
-		throw err;
-	}
-}
-function validateComposition(composition, ctx) {
-	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
-	const self = candidateSelf(composition, ctx, plan);
-	const cycles = cycleProblems(composition, ctx, plan.fields, self);
-	const problems = [
-		...plan.problems,
-		...sourceProblems(plan.fields, ctx, self),
-		...cycles
-	];
-	return {
-		ok: problems.length === 0,
-		problems,
-		fields: [...plan.fields],
-		features: [...plan.features],
-		events: [...plan.events]
+		kind: "fields",
+		cap: "doorbell",
+		enabled: input.enabled,
+		fields: {
+			lastPressedAt: {
+				kind: "expression",
+				expr: `latest(${sources.map((_, index) => `rose(active${index}, changed${index}, ${DOORBELL_RISE_DEBOUNCE_MS})`).join(", ")})`,
+				bindings: edgeBindings
+			},
+			pressCountSinceStart: {
+				kind: "expression",
+				expr: "count(lastPressedAt)",
+				bindings: { lastPressedAt: {
+					kind: "from",
+					source: {
+						addonId: input.camera.addonId,
+						stableId: input.camera.stableId
+					},
+					cap: "doorbell",
+					fieldPath: "lastPressedAt"
+				} }
+			}
+		}
 	};
 }
 /**
@@ -43974,7 +44499,6 @@ var RUNTIME_DEFAULTS = {
 		models: "camstack-data/models"
 	},
 	providers: [],
-	"ffmpeg.binaryPath": "ffmpeg",
 	"ffmpeg.hwAccel": "auto",
 	"ffmpeg.threadCount": 0,
 	"auth.tokenExpiry": "30d"
@@ -47960,6 +48484,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listComposableCaps": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.listCompositions": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -51644,6 +52174,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSensors": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -55354,6 +55890,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraSensors": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepOverride": [{
 		name: "deviceId",
 		form: "single",
@@ -57457,4 +57998,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { coreBlockAddonId as $, asNumber as $n, ptzAutotrackCapability as $t, STORAGE_ACCESS_FALLBACK as A, cloneStatefulExpressionMemory as An, isSameAddonId as At, addonWidgetsCapability as B, toExpressionValue as Bn, looseSchema as Bt, METHOD_ACCESS_MAP as C, withLocationMode as Cn, foldSnapshotByFunction as Ct, REDACTED_SECRET as D, SOURCE_CAP_ACTIVE_FIELD as Dn, isCollectionArrayMethod as Dt, RECORDING_SOURCE_CAMSTACK_ADDON as E, SOURCE_CAPS as En, isArrayOutputSchema as Et, StorageLocationTypeSchema as F, compositionSliceKey as Fn, lifecycleJobSchema as Ft, batteryCapability as G, BaseAddon as Gn, motionCapability as Gt, authProviderCapability as H, DeviceRole as Hn, mayWriteToLocation as Ht, StorageMigrationJobSchema as I, compositionSourceKey as In, localNetworkCapability as It, cameraGridLayoutCapability as J, DEVICE_STATUS_METHOD as Jn, objectInputDeclaresRequiredDeviceId as Jt, buildCapabilityLookup as K, DATAPLANE_SECRET_HEADER as Kn, normalizeUnit as Kt, UserRecordSchema as L, createStatefulExpressionMemory as Ln, locationIconKey as Lt, ScopedTokenSchema as M, composedDeviceStableId as Mn, kebabToCamel as Mt, StorageCleanupJobSchema as N, compositionFeatureEnabled as Nn, legacyAutoLinkIds as Nt, RUNTIME_DEFAULTS as O, SOURCE_CAP_CHANGED_AT_FIELD as On, isLocationEnabled as Ot, StorageLocationModeSchema as P, compositionItemFieldPath as Pn, legacyModeOf as Pt, compositionSourceRefs as Q, asJsonObject as Qn, procedureAuthKey as Qt, addonPagesCapability as R, evaluateSensorEdge as Rn, logDestinationCapability as Rt, LocationIconIdSchema as S, vectorStoreCapability as Sn, filesystemBrowseCapability as St, MOTION_CLOSE_AFTER_MS as T, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as Tn, gbToBytes as Tt, backupCapability as U, DeviceType as Un, metricsProviderCapability as Ut, alertsCapability as V, DeviceFeature as Vn, mayReadLocation as Vt, bareAddonId as W, errMsg as Wn, modeMayWrite as Wt, composerCapability as X, ReadinessTimeoutError as Xn, planComposition as Xt, collectSecretConfigKeys as Y, ReadinessRegistry as Yn, parseStreamParamsFormPatch as Yt, compositionFieldKey as Z, WELL_KNOWN_TAB_MAP as Zn, platformProbeCapability as Zt, FIRST_LEVEL_MACRO_CLASSES as _, streamQualityLabel as _n, enumerateSchemaFields as _t, BatteryStatusSchema as a, runtimeStatePolicyFor as an, hydrateSchema as ar, dataStoreProviderCapability as at, LOG_LEVEL_RANK as b, vectorDimFromBase64 as bn, expandContainer as bt, COMPOSED_ITEM_FIXED_FIELDS as c, scoreRuntimes as cn, nodePin as cr, defineExtensionSlotProvider as ct, CORE_BLOCK_ADDON_PREFIX as d, snapshotCapability as dn, readinessKey as dr, deviceManagerCapability as dt, reducePoints as en, asString$1 as er, coreBlockComposition as et, CoreBlockSchema as f, storageCapability as fn, resolveCapMount as fr, deviceStateCapability as ft, DeviceStatusSchema as g, streamCatalogCapability as gn, enumerateItemArrayFields as gt, DeclaredDevices as h, storageProviderCapability as hn, EventCategory as hr, enumerateInferenceDevices as ht, BaseDevice as i, resolveMethodAuth as in, expandCapMethods as ir, createDeviceExtensionProvider as it, STREAM_PROFILE_META as j, composedDeviceRef as jn, isVoidInput as jt, RecordingStatusSchema as k, buildFfmpegArgs as kn, isObjectInput as kt, COMPOSER_RUNNER_ID as l, settingsStoreCapability as ln, parseJsonObject as lr, deriveBatteryPresence as lt, DERIVED_CAMERA_SILENCED_CAP_NAMES as m, storageOccupancyCapability as mn, sleep as mr, doorbellCapability as mt, AlertSchema as n, resolveBucketMs as nn, emitDownForOwnedCaps as nr, coreBlockSourceKind as nt, CAMERA_SWITCH_ORDER as o, scopesAllowAddon as on, isDeviceConfigCap as or, declarationOwnerNodeId as ot, DAY_NAMES as p, storageMigrationCapability as pn, scopeKey as pr, deviceStatusCapability as pt, buildStreamParamsConfigSchema as q, DEVICE_SETTINGS_CONTRIBUTION_METHODS as qn, objectInputDeclaresAddonId as qt, ApiKeyRecordSchema as r, resolveLocationMode as rn, emitReadiness as rr, coreBlocksCapability as rt, CAP_NAMES_WITH_STATUS as s, scopesAllowDeviceCap as sn, isEvent as sr, decodeVectorBase64 as st, ALL_CAPABILITY_DEFINITIONS as t, replacedFieldKeys as tn, createEvent as tr, coreBlockIdFromAddonId as tt, CORE_BLOCKS_ADDON_ID as u, siteZoneKey as un, parseJsonUnknown as ur, deviceExtensionCapability as ut, FieldClaimModeSchema as v, userManagementCapability as vn, evaluateCompositionField as vt, MINUTES_PER_DAY as w, COMPOSER_ADDON_ID as wn, formatMinutes as wt, LegacyStorageLocationDefaultSchema as x, vectorIndexDimConflictError as xn, extractNestedAddonId as xt, FieldClaimSchema as y, validateComposition as yn, evictionPolicyOfLocation as yt, addonSettingsCapability as z, isSourceCap as zn, logLevelAtMost as zt };
+export { compositionSourceRefs as $, WELL_KNOWN_TAB_MAP as $n, parseStreamParamsFormPatch as $t, STORAGE_ACCESS_FALLBACK as A, SOURCE_CAPS as An, isCollectionArrayMethod as At, addonWidgetsCapability as B, evaluateSensorEdge as Bn, locationIconKey as Bt, METHOD_ACCESS_MAP as C, validateComposition as Cn, expandContainer as Ct, REDACTED_SECRET as D, withLocationMode as Dn, formatMinutes as Dt, RECORDING_SOURCE_CAMSTACK_ADDON as E, vectorStoreCapability as En, foldSnapshotByFunction as Et, StorageLocationTypeSchema as F, compositionFeatureEnabled as Fn, kebabToCamel as Ft, batteryCapability as G, DeviceType as Gn, mayWriteToLocation as Gt, authProviderCapability as H, toExpressionValue as Hn, logLevelAtMost as Ht, StorageMigrationJobSchema as I, compositionItemFieldPath as In, legacyAutoLinkIds as It, buildStreamParamsConfigSchema as J, DATAPLANE_SECRET_HEADER as Jn, modeMayWrite as Jt, buildCapabilityLookup as K, errMsg as Kn, memoizePinnedFfmpeg as Kt, UserRecordSchema as L, compositionSliceKey as Ln, legacyModeOf as Lt, ScopedTokenSchema as M, cloneStatefulExpressionMemory as Mn, isObjectInput as Mt, StorageCleanupJobSchema as N, composedDeviceRef as Nn, isSameAddonId as Nt, RUNTIME_DEFAULTS as O, COMPOSER_ADDON_ID as On, gbToBytes as Ot, StorageLocationModeSchema as P, composedDeviceStableId as Pn, isVoidInput as Pt, compositionFieldKey as Q, ReadinessTimeoutError as Qn, objectInputDeclaresRequiredDeviceId as Qt, addonPagesCapability as R, compositionSourceKey as Rn, lifecycleJobSchema as Rt, LocationIconIdSchema as S, userManagementCapability as Sn, evictionPolicyOfLocation as St, MOTION_CLOSE_AFTER_MS as T, vectorIndexDimConflictError as Tn, filesystemBrowseCapability as Tt, backupCapability as U, DeviceFeature as Un, looseSchema as Ut, alertsCapability as V, isSourceCap as Vn, logDestinationCapability as Vt, bareAddonId as W, DeviceRole as Wn, mayReadLocation as Wt, collectSecretConfigKeys as X, DEVICE_STATUS_METHOD as Xn, normalizeUnit as Xt, cameraGridLayoutCapability as Y, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Yn, motionCapability as Yt, composerCapability as Z, ReadinessRegistry as Zn, objectInputDeclaresAddonId as Zt, FIRST_LEVEL_MACRO_CLASSES as _, storageMigrationCapability as _n, EventCategory as _r, doorbellFeatureSources as _t, BatteryStatusSchema as a, replacedFieldKeys as an, emitReadiness as ar, createDeviceExtensionProvider as at, LOG_LEVEL_RANK as b, streamCatalogCapability as bn, enumerateSchemaFields as bt, COMPOSED_ITEM_FIXED_FIELDS as c, resolveMethodAuth as cn, isDeviceConfigCap as cr, decodeVectorBase64 as ct, CORE_BLOCK_ADDON_PREFIX as d, scopesAllowDeviceCap as dn, parseJsonObject as dr, describeComposableCaps as dt, planComposition as en, asJsonObject as er, coreBlockAddonId as et, CoreBlockSchema as f, scoreRuntimes as fn, parseJsonUnknown as fr, deviceExtensionCapability as ft, DeviceStatusSchema as g, storageCapability as gn, sleep as gr, doorbellCapability as gt, DeclaredDevices as h, snapshotCapability as hn, scopeKey as hr, deviceStatusCapability as ht, BaseDevice as i, reducePoints as in, emitDownForOwnedCaps as ir, coreBlocksCapability as it, STREAM_PROFILE_META as j, buildFfmpegArgs as jn, isLocationEnabled as jt, RecordingStatusSchema as k, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as kn, isArrayOutputSchema as kt, COMPOSER_RUNNER_ID as l, runtimeStatePolicyFor as ln, isEvent as lr, defineExtensionSlotProvider as lt, DERIVED_CAMERA_SILENCED_CAP_NAMES as m, siteZoneKey as mn, resolveCapMount as mr, deviceStateCapability as mt, AlertSchema as n, procedureAuthKey as nn, asString$1 as nr, coreBlockIdFromAddonId as nt, CAMERA_SWITCH_ORDER as o, resolveBucketMs as on, expandCapMethods as or, dataStoreProviderCapability as ot, DAY_NAMES as p, settingsStoreCapability as pn, readinessKey as pr, deviceManagerCapability as pt, buildDoorbellCompositionFeature as q, BaseAddon as qn, metricsProviderCapability as qt, ApiKeyRecordSchema as r, ptzAutotrackCapability as rn, createEvent as rr, coreBlockSourceKind as rt, CAP_NAMES_WITH_STATUS as s, resolveLocationMode as sn, hydrateSchema as sr, declarationOwnerNodeId as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tn, asNumber as tr, coreBlockComposition as tt, CORE_BLOCKS_ADDON_ID as u, scopesAllowAddon as un, nodePin as ur, deriveBatteryPresence as ut, FieldClaimModeSchema as v, storageOccupancyCapability as vn, enumerateInferenceDevices as vt, MINUTES_PER_DAY as w, vectorDimFromBase64 as wn, extractNestedAddonId as wt, LegacyStorageLocationDefaultSchema as x, streamQualityLabel as xn, evaluateCompositionField as xt, FieldClaimSchema as y, storageProviderCapability as yn, enumerateItemArrayFields as yt, addonSettingsCapability as z, createStatefulExpressionMemory as zn, localNetworkCapability as zt };