@camstack/system 1.2.321 → 1.2.323

package/dist/{dist-BMDYmNV3.js → dist-Bup0sTZb.js}

@@ -3512,7 +3512,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-BK-GTFYb.mjs
+//#region ../types/dist/composition-Dq42XWp0.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -3906,6 +3906,58 @@ function buildFfmpegArgs(inv) {
 	];
 }
 /**
+* The ffmpeg build every CamStack node downloads, per platform and arch.
+*
+* ## Why a download, on every node, including the container
+*
+* The version of ffmpeg used to be CODE: baked into the image, changeable only
+* by rebuilding and rolling it. Now it is DATA — this file states the release,
+* and a node that boots with a different one downloads it. Changing ffmpeg is a
+* framework bump, not an image rebuild.
+*
+* It also settles the licence question by removing it. FFmpeg's licence is
+* chosen at compile time: the core is LGPL 2.1+, `--enable-gpl` makes it GPL
+* (for x264/x265), `--enable-version3` makes that v3, and `--enable-nonfree`
+* makes the result undistributable. These are GPL v3 builds, and we do not
+* distribute them: the user's own node fetches the archive from the project
+* that publishes it, so we convey no GPL work and inherit none of the
+* obligations that come with conveying one. That is the whole reason the image
+* no longer installs ffmpeg at all — not a technical preference.
+*
+* ## Why jellyfin-ffmpeg
+*
+* One vendor covering linux-amd64, linux-arm64, darwin-arm64 and darwin-x64
+* from one release, with the widest hardware surface of anything maintained:
+* VAAPI, QSV, NVENC/NVDEC, AMF, Vulkan, OpenCL and DRM on amd64, plus Rockchip
+* MPP on arm64. It reaches the vendor libraries through dlopen trampolines,
+* so the binary is not linked against a driver stack it may not find.
+*
+* **What it still needs from the host, measured 2026-09-19.** On the Unraid
+* HOST, which has no libva, `-vaapi_device` aborts the process outright —
+* `implib-gen: libva-drm.so.2: failed to load library ... Assertion '0 &&
+* "Assertion in generated code"' failed`. Inside our container, which installs
+* libva plus the iHD driver, the same command encodes: verified end to end with
+* `testsrc → format=nv12,hwupload → h264_vaapi`. So the image drops ffmpeg and
+* KEEPS the Intel media stack; the drivers are the part a binary cannot bring.
+*
+* ## Why each artifact carries a checksum and a claim
+*
+* The download is now the only source, so `sha256` is verified before anything
+* is extracted — jellyfin publishes no checksums on its release assets, so
+* these are ours, taken at the version bump. And `expectedHwaccels` is what the
+* build is supposed to be able to do: a binary that probes short of its own
+* claim is a source that changed under us, which is precisely what went
+* unnoticed for months when a static build turned out to carry no VAAPI at all
+* (D536).
+*/
+/** The pinned jellyfin-ffmpeg release. Changing this is the version change. */
+var FFMPEG_RELEASE = "8.1.2-5";
+var BASE = `https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v${FFMPEG_RELEASE}`;
+function portable(target) {
+	return `${BASE}/jellyfin-ffmpeg_${FFMPEG_RELEASE}_portable_${target}-gpl.tar.xz`;
+}
+portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
+/**
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
 * valutatore puro del suo FRONTE.
 *
@@ -5359,6 +5411,26 @@ var BASE_LIVE_EGRESS_PROFILE = {
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /**
+* Memoize `ensure` on SUCCESS only.
+*
+* A failure is not remembered: the next caller asks again, so a node whose
+* first download failed (no network at boot) recovers on the next spawn that
+* needs it — with no timer and no retry loop, because the ask is driven by
+* work that actually wants the binary.
+*/
+function memoizePinnedFfmpeg(ensure) {
+	let pending = null;
+	return () => {
+		if (pending !== null) return pending;
+		const attempt = ensure();
+		pending = attempt;
+		attempt.catch(() => {
+			if (pending === attempt) pending = null;
+		});
+		return attempt;
+	};
+}
+/**
 * Deep wiring healthcheck — snapshot of active reachability probes across
 * every declared capability + widget of every installed plugin, on every
 * node. Produced by the backend `WiringHealthService` and surfaced via
@@ -11645,263 +11717,1156 @@ var CompositionBlockStateSchema = zod.z.object({
 	reason: zod.z.string().optional(),
 	fields: zod.z.array(CompositionFieldStateSchema)
 });
+function problem(code, path, message) {
+	return {
+		code,
+		path,
+		message
+	};
+}
+function refused(...problems) {
+	return {
+		problems,
+		fields: [],
+		features: [],
+		events: []
+	};
+}
+/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
+function compositionFieldAt(field) {
+	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
+	return `features[${field.featureIndex}].${inner}.${field.path}`;
+}
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
+var BUILTIN_RESULT_KINDS = Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+var KindInferenceError = class extends Error {};
+function kindOfValue(value) {
+	if (value === null) return "null";
+	if (typeof value === "number") return "number";
+	if (typeof value === "string") return "string";
+	return "boolean";
+}
+function only(kind) {
+	return new Set([kind]);
+}
+function union(...sets) {
+	return new Set(sets.flatMap((s) => [...s]));
+}
+function withoutNull(set) {
+	return new Set([...set].filter((k) => k !== "null"));
+}
+function binaryKinds(op, left, right) {
+	if (op === "+") {
+		const all = [...left, ...right];
+		if (all.every((k) => k === "string")) return only("string");
+		if (all.every((k) => k === "number")) return only("number");
+		return new Set(["number", "string"]);
+	}
+	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
+	return only("boolean");
+}
+/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
+function arityRange(builtin) {
+	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
+	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
+	return `${builtin.minArgs}–${builtin.maxArgs}`;
+}
+function callKinds(callee, args) {
+	const builtin = EXPRESSION_BUILTINS[callee];
+	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
+	const rule = BUILTIN_RESULT_KINDS[callee];
+	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
+	if (rule.kind === "fixed") return new Set(rule.result);
+	const nonNull = union(...args.map(withoutNull));
+	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
+}
+function kindsOf(node, bindings) {
+	switch (node.kind) {
+		case "literal": return only(kindOfValue(node.value));
+		case "identifier": {
+			if (node.name === "now") return only("number");
+			const bound = bindings.get(node.name);
+			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
+			return bound;
+		}
+		case "unary": return only(node.op === "!" ? "boolean" : "number");
+		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
+		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
+	}
+}
+function nodeContainsCall(node, callee) {
+	switch (node.kind) {
+		case "literal":
+		case "identifier": return false;
+		case "unary": return nodeContainsCall(node.operand, callee);
+		case "binary":
+		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
+		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
+		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
+	}
+}
+function expressionContainsBuiltinCall(expr, callee) {
+	const compiled = compileExpressionSafe(expr);
+	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
+}
+function inferExpressionKinds(input) {
+	const compiled = compileExpressionSafe(input.expr);
+	if (!compiled.ok) return {
+		ok: false,
+		error: compiled.error
+	};
+	try {
+		return {
+			ok: true,
+			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
+		};
+	} catch (err) {
+		if (err instanceof KindInferenceError) return {
+			ok: false,
+			error: err.message
+		};
+		throw err;
+	}
+}
 /**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
-/**
-* Prefix for a block's generated addon id AND its runner id — one addon, one
-* process, so the two are the same string (D2).
-*
-* It lives on the CONTRACT rather than beside the code that materialises the
-* package, because it is not an implementation detail: the operator surface
-* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
-* with no cap and no store of its own. Two copies of this string is one copy
-* too many — a drift would show as a logs pane that is simply always empty.
-*/
-var CORE_BLOCK_ADDON_PREFIX = "core-block-";
-/**
-* The builtin's own addon id — and, because of that, the OWNER of the
-* integration every block's devices hang from.
-*
-* A block cannot own one. Every integration read is gated on the installed-addon
-* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
-* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
-* null forever while the write succeeds — one invisible, undeletable row per
-* start. `core-blocks` IS installed, so it reconciles one shared integration and
-* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
-*
-* Exported from the contract, next to the runner prefix and for the same reason:
-* a block reads it as
-* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
-* so a second copy of the string is a block that silently declares into nowhere.
+* The kind half of planning a composition field (D659): which kinds a source
+* can produce, whether they fit a target field, and the field's role.
+* Shared by the top-level planner (`validate-composition.ts`) and the item
+* planner (`composition-items.ts`). Internal to the composition module — NOT
+* in the barrel: these are planner internals, not a published contract.
 */
-var CORE_BLOCKS_ADDON_ID = "core-blocks";
-/** The addon/runner id a block's process runs under. */
-function coreBlockAddonId(blockId) {
-	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+function readKinds(read, lookupCap) {
+	const def = lookupCap(read.cap);
+	const schema = def?.runtimeState ?? def?.status?.schema;
+	if (def === null || schema === void 0) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `no capability \`${read.cap}\` with state to read`
+	};
+	const field = describeStateField(schema, read.fieldPath);
+	if (field === null) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
+	};
+	const base = field.kind === "enum" ? "string" : field.kind;
+	return {
+		ok: true,
+		kinds: new Set(field.nullable ? [base, "null"] : [base])
+	};
 }
-/** The block id behind a generated addon/runner id, or null when the id belongs
-*  to something else. The inverse of {@link coreBlockAddonId}. */
-function coreBlockIdFromAddonId(addonId) {
-	if (!addonId.startsWith("core-block-")) return null;
-	const rest = addonId.slice(11);
-	return rest.length > 0 ? rest : null;
+function sourceKinds(source, lookupCap) {
+	if (source.kind === "from") return readKinds(source, lookupCap);
+	if (source.kind === "code") return {
+		ok: false,
+		code: "reserved-variant",
+		message: "code fields arrive in slice 4"
+	};
+	const bindingKinds = /* @__PURE__ */ new Map();
+	for (const [name, binding] of Object.entries(source.bindings)) {
+		if (binding.kind === "literal") {
+			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
+			continue;
+		}
+		const kinds = readKinds(binding, lookupCap);
+		if (!kinds.ok) return {
+			...kinds,
+			message: `binding \`${name}\`: ${kinds.message}`
+		};
+		bindingKinds.set(name, kinds.kinds);
+	}
+	const inferred = inferExpressionKinds({
+		expr: source.expr,
+		bindingKinds
+	});
+	return inferred.ok ? {
+		ok: true,
+		kinds: inferred.kinds
+	} : {
+		ok: false,
+		code: "expression-invalid",
+		message: inferred.error
+	};
+}
+function compatibility(cap, target, kinds, at) {
+	const allowed = target.kind === "enum" ? "string" : target.kind;
+	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
+	const problems = [];
+	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
+	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
+	return problems;
 }
-/** Where a block runs. The operator chooses — a block driving a device on an
-*  agent is the reason placement is not fixed to the hub. */
-var CoreBlockPlacementSchema = zod.z.union([zod.z.literal("hub"), zod.z.string().min(1)]);
-/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. `degraded` is a
-*  composition on an existing device with a field handed back to the native
-*  provider while its source is unavailable (S1b, D663); the error names it. */
-var CoreBlockStatusSchema = zod.z.enum([
-	"stopped",
-	"starting",
-	"running",
-	"degraded",
-	"failed"
-]);
-/** Client-authored fields. */
-var CoreBlockInputSchema = zod.z.object({
-	name: zod.z.string().min(1).max(120),
-	/** TypeScript source. Compiled server-side before it is ever stored — a
-	*  block that does not compile is a fork failure the operator would meet
-	*  minutes later, in a log, instead of in the editor. */
-	code: zod.z.string().max(2e5),
-	enabled: zod.z.boolean(),
-	placement: CoreBlockPlacementSchema,
-	/**
-	* Integration the block's devices hang from. Absent = the system integration
-	* blocks share. A block may declare its own instead.
-	*/
-	integrationId: zod.z.string().optional()
-});
 /**
-* What a block IS (D659). Absent means `code` — every row stored before this
-* union keeps working unchanged.
-*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
-*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
-*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+* A string a source produces WITHOUT reading any device — a field-level
+* `expression` source whose compiled AST is a bare string literal (`"red"`,
+* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
+* the kind level (a `from` read of an enum-typed source field, a computed
+* expression) is NOT checked against the target's `enumValues` here: the
+* kind inference already collapsed it to the coarse `'string'` kind, losing
+* whichever enum it actually came from, so membership can only be judged at
+* write time against the runtime-state schema. Known limitation — see the
+* fix report for Task 6 round 1.
 */
-var CoreBlockSourceSchema = zod.z.discriminatedUnion("kind", [
-	zod.z.object({ kind: zod.z.literal("code") }),
-	zod.z.object({
-		kind: zod.z.literal("recipe"),
-		recipe: AutomationRecipeSchema
-	}),
-	zod.z.object({
-		kind: zod.z.literal("composition"),
-		composition: CompositionSchema
-	})
-]);
+function literalStringValue(source) {
+	if (source.kind !== "expression") return null;
+	const compiled = compileExpressionSafe(source.expr);
+	if (!compiled.ok) return null;
+	const ast = compiled.parsed.ast;
+	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
+}
 /**
-* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
-*
-* `name`: REQUIRED for a `new` target — the block's name IS the device's name
-* (D659). ABSENT for an `existing` target — a customization has no name of its
-* own; the server derives one (`customizationBlockName`, D663) and refuses a
-* client-sent name by name.
+* An enum target whose source is a save-time-KNOWN string literal outside its
+* `enumValues` is refused now rather than left to fail the write later. A
+* dynamic source (a `from` read, a non-literal expression) is left to
+* runtime — see {@link literalStringValue}.
 */
-var CompositionBlockInputSchema = zod.z.object({
-	name: zod.z.string().min(1).max(120).optional(),
-	enabled: zod.z.boolean(),
-	composition: CompositionSchema
-});
-/** A stored block. */
-var CoreBlockSchema = CoreBlockInputSchema.extend({
-	id: zod.z.string(),
-	createdAt: zod.z.number(),
-	updatedAt: zod.z.number(),
-	/** Server-stamped author. */
-	createdBy: zod.z.string(),
-	status: CoreBlockStatusSchema,
-	/**
-	* Why the block is not running, when it is not. The operator's ONLY window
-	* into a block that failed at load — a block that is silently absent is the
-	* failure mode this whole feature has to avoid.
-	*/
-	lastError: zod.z.string().optional(),
-	/** Ms epoch of the last state change. */
-	lastChangedAt: zod.z.number(),
-	/** What the block is. Absent means `code` (D659). */
-	source: CoreBlockSourceSchema.optional()
-});
-function coreBlockSourceKind(block) {
-	return block.source?.kind ?? "code";
+function enumLiteralProblem(cap, target, source, at) {
+	if (target.kind !== "enum" || target.enumValues === void 0) return null;
+	const value = literalStringValue(source);
+	if (value === null || target.enumValues.includes(value)) return null;
+	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
+	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
 }
-function coreBlockComposition(block) {
-	return block.source?.kind === "composition" ? block.source.composition : null;
+function roleOf(source) {
+	if (source.kind !== "expression") return "derived";
+	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
+	if (fieldReads(source).length > 0) return "derived";
+	const compiled = compileExpressionSafe(source.expr);
+	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
 }
-/** What the composer said, or that it could not be asked. Unknown never looks like absent (D315). */
-var CompositionStateReadSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
-	kind: zod.z.literal("answered"),
-	state: CompositionBlockStateSchema.nullable()
-}), zod.z.object({
-	kind: zod.z.literal("unreachable"),
-	error: zod.z.string()
-})]);
-/** A stored composition block and what the composer says about it. */
-var CompositionViewSchema = zod.z.object({
-	block: CoreBlockSchema,
-	state: CompositionStateReadSchema
-});
 /**
-* A read of the stored compositions. `not-loaded` while the `core_blocks`
-* table has not been READ: an empty answer then would make "not yet known"
-* look like "none", and invite the operator to recreate what exists (D315).
+* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
+* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
+* own offline, and D393 forbids a stale number, so on an existing target a
+* field that READS a source never gets `offline`.
 */
-var CompositionsNotLoadedSchema = zod.z.object({
-	state: zod.z.literal("not-loaded"),
-	reason: zod.z.string()
-});
-var CompositionListReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
-	state: zod.z.literal("loaded"),
-	views: zod.z.array(CompositionViewSchema)
-}), CompositionsNotLoadedSchema]);
-var CompositionGetReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
-	state: zod.z.literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
-var CompositionCustomizationReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
-	state: zod.z.literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** What a compile attempt produced. */
-var CoreBlockCompileResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	/** Present when `ok` is false — the first error, in the author's words. */
-	error: zod.z.string().optional(),
-	line: zod.z.number().optional(),
-	column: zod.z.number().optional()
-});
-var coreBlocksCapability = {
-	name: "core-blocks",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		list: method(zod.z.object({}), zod.z.object({ blocks: zod.z.array(CoreBlockSchema) }), { auth: "admin" }),
-		get: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
-		/**
-		* Create a block. The code is COMPILED first: storing source that does not
-		* compile turns an editor error into a fork failure the operator meets
-		* minutes later in a log.
-		*/
-		create: method(zod.z.object({ block: CoreBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		update: method(zod.z.object({
-			blockId: zod.z.string(),
-			block: CoreBlockInputSchema.partial()
-		}), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		delete: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setEnabled: method(zod.z.object({
-			blockId: zod.z.string(),
-			enabled: zod.z.boolean()
-		}), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Stop this block's runner and let the supervisor bring it back.
-		*
-		* **It stores nothing.** There is no "restart requested" flag and no second
-		* lifecycle field: the supervisor already stops and respawns a runner when
-		* the code hash changes, and this exposes that same path deliberately
-		* (D62 — a switch writes the authority that already owned the function).
-		* The next reconcile pass remains the authority, so a restart that lost a
-		* race is corrected within one pass rather than leaving a stale flag behind.
-		*
-		* Refused for a DISABLED block: nothing would come back, and a button that
-		* silently does nothing is worse than one that says why.
-		*/
-		restart: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Type-check without saving — what the editor calls as the author types, so
-		* the compiler's verdict is the same one the server will reach.
-		*/
-		compile: method(zod.z.object({ code: zod.z.string() }), CoreBlockCompileResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* The declaration files the editor type-checks against.
-		*
-		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
-		* bundling it would roughly double the admin remote. Served rather than
-		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
-		* would drift and the editor would confidently autocomplete methods that
-		* do not exist.
-		*/
-		getTypeDefs: method(zod.z.object({}), zod.z.object({ libs: zod.z.array(zod.z.object({
+function unavailableFor(tf, role, mode, cap, at) {
+	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
+		ok: true,
+		unavailable: "release"
+	};
+	if (mode === "new" || role !== "derived") return {
+		ok: true,
+		unavailable: tf.nullable ? "null" : "offline"
+	};
+	if (tf.nullable) return {
+		ok: true,
+		unavailable: "null"
+	};
+	if (tf.enumValues?.includes("unknown") === true) return {
+		ok: true,
+		unavailable: "unknown"
+	};
+	return {
+		ok: false,
+		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
+	};
+}
+/** Item fields the composer writes itself, with the value it writes. */
+var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
+function reservedItemFields(itemArray) {
+	return new Set([
+		itemArray.keyField,
+		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
+		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
+	]);
+}
+/** A required leaf under an optional parent is required only once something writes that parent. */
+function leafRequired(itemArray, path, written) {
+	const described = describeStateField(itemArray.itemSchema, path);
+	if (described === null || !described.required) return false;
+	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
+}
+function missingLeaves({ capName, itemArray, reserved }, item, at) {
+	const written = Object.keys(item.fields);
+	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
+		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
+		if (!leafRequired(itemArray, leaf.path, written)) return [];
+		const described = describeStateField(itemArray.itemSchema, leaf.path);
+		if (described === null || described.nullable) return [];
+		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
+	});
+}
+function planItemField(ctx, leaf) {
+	const { capName, itemArray, featureIndex, lookupCap } = ctx;
+	const { key, label, path, source } = leaf;
+	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
+	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
+	const tf = describeStateField(itemArray.itemSchema, path);
+	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: capName,
+		path,
+		item: {
+			arrayPath: itemArray.path,
+			key,
+			label
+		},
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(capName, tf, source, at);
+	return {
+		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
+	const at = `features[${featureIndex}].items`;
+	const itemArray = def.status?.itemArray;
+	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
+	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
+	const ctx = {
+		capName: def.name,
+		itemArray,
+		reserved: reservedItemFields(itemArray),
+		featureIndex,
+		lookupCap,
+		mode
+	};
+	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
+		problems: missingLeaves(ctx, item, `${at}.${key}`),
+		fields: [],
+		features: [],
+		events: []
+	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
+		key,
+		label: item.label,
+		path,
+		source
+	}))]);
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: [],
+		events: []
+	};
+}
+/**
+* The field graph across every composition, and the cycles in it (D659).
+*
+* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
+* edge points from a composed field to each field it reads. A cycle, direct or
+* through another composition, is refused at save by name (spec §2).
+*
+* The graph is built for ONE save: the CANDIDATE composition (the one being
+* validated) plus every STORED composition. The candidate replaces its own old
+* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
+* introduces or removes a cycle must never depend on array order. A DIFFERENT
+* block targeting the candidate's device is refused by name: one composition
+* per device (D663). Two different stored peers that (wrongly) target the same
+* device are corrupted state, not a cycle to resolve by picking one silently;
+* that is refused by name too (D391).
+*
+* A customization of an EXISTING device reads that device's NATIVE value for a
+* field it replaces or does not write ("Invert state" reads the `on` it
+* replaces): such a self-read is no edge, so it is never a cycle (D663).
+* Another composition reading that field reads the customizer's output.
+*
+* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
+* marks a node `done` after its first expansion) — not every elementary cycle
+* through a shared node, so the path it names may AVOID the candidate while
+* one through it goes unreported. What a save refuses is therefore decided per
+* strongly connected component (`findCandidateCycles`, C-1). A dotted
+* `fieldPath` is matched only as an exact string: a write to `state.value` and
+* a read of `state` would not connect (no nested field writes exist yet).
+*
+* An item leaf is its own node, `…#consumables.items[desiccant].status`
+* (`featureFieldEntries`), so two items sharing an inner path never merge. No
+* READ can name an array element (`describeStateField` never describes one),
+* so an item node is write-only: its edges to sources are what the check needs.
+*/
+/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
+var CompositionGraphError = class extends Error {};
+/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
+function writtenFields(peer) {
+	return new Set(peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
+}
+/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
+function readsComposedValue(peer, written, read) {
+	if (compositionSourceKey(read.source) !== compositionSourceKey(peer.target)) return true;
+	const field = `${read.cap}.${read.fieldPath}`;
+	return written.has(field) && peer.replaced?.has(field) !== true;
+}
+function peerEdges(peer) {
+	const written = writtenFields(peer);
+	return peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath, source }) => [compositionReadKey({
+		source: peer.target,
+		cap: feature.cap,
+		fieldPath
+	}), fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(compositionReadKey)]));
+}
+/**
+* Every peer that actually takes part in the graph: each stored peer minus the
+* candidate's own old version (same block id — the drop happens before any
+* edge is built, so its old edges never enter the map), plus the candidate
+* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
+* block targets the candidate's device, or two stored peers share a device.
+*/
+function resolvedPeers(candidate, stored) {
+	const candidateKey = compositionSourceKey(candidate.target);
+	const survivors = /* @__PURE__ */ new Map();
+	for (const peer of stored) {
+		if (peer.blockId === candidate.blockId) continue;
+		const key = compositionSourceKey(peer.target);
+		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
+		const clash = survivors.get(key);
+		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
+		survivors.set(key, peer);
+	}
+	return [...survivors.values(), candidate];
+}
+function compositionEdges(candidate, stored) {
+	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
+	return new Map(edges);
+}
+/** Tarjan's strongly connected components over every node of the graph (sources included). */
+function stronglyConnected(edges) {
+	const index = /* @__PURE__ */ new Map();
+	const low = /* @__PURE__ */ new Map();
+	const onStack = /* @__PURE__ */ new Set();
+	const stack = [];
+	const components = [];
+	const connect = (node) => {
+		index.set(node, index.size);
+		low.set(node, index.get(node) ?? 0);
+		stack.push(node);
+		onStack.add(node);
+		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
+			connect(next);
+			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
+		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
+		if (low.get(node) !== index.get(node)) return;
+		const component = [];
+		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
+			onStack.delete(member);
+			component.push(member);
+			if (member === node) break;
+		}
+		components.push(component);
+	};
+	for (const node of edges.keys()) if (!index.has(node)) connect(node);
+	return components;
+}
+/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
+function cycleThrough(start, component, edges) {
+	const parent = /* @__PURE__ */ new Map();
+	const queue = [start];
+	for (let head = 0; head < queue.length; head += 1) {
+		const node = queue[head];
+		if (node === void 0) break;
+		for (const next of edges.get(node) ?? []) {
+			if (next === start) {
+				const chain = [];
+				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
+				return [
+					start,
+					...chain.reverse(),
+					start
+				];
+			}
+			if (!component.has(next) || parent.has(next)) continue;
+			parent.set(next, node);
+			queue.push(next);
+		}
+	}
+	return [start, start];
+}
+/**
+* The cycles THIS save closes, decided per strongly connected component — never
+* per reported DFS path, which names one back-edge per revisit and can report a
+* component's cycle by a path that avoids the candidate while the one through it
+* goes unreported. A component refuses when it holds a candidate node and a
+* cycle (more than one node, or a self-loop). Components without a candidate
+* node are not this save's cycles.
+*/
+function findCandidateCycles(candidate, stored) {
+	const edges = compositionEdges(candidate, stored);
+	const prefix = `${compositionSourceKey(candidate.target)}#`;
+	return stronglyConnected(edges).flatMap((members) => {
+		const start = members.find((n) => n.startsWith(prefix));
+		if (start === void 0) return [];
+		const component = new Set(members);
+		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
+		if (members.length === 1 && !selfLoop) return [];
+		return [{
+			path: cycleThrough(start, component, edges),
+			component
+		}];
+	});
+}
+function buildCapabilityLookup(defs) {
+	const byName = new Map(defs.map((d) => [d.name, d]));
+	return (capName) => byName.get(capName) ?? null;
+}
+/** Caps every `BaseDevice` registers on itself; a second registration throws. */
+var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
+var PENDING_SELF = {
+	addonId: COMPOSER_ADDON_ID,
+	stableId: `${COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
+};
+function composableCap(feature, at, lookupCap) {
+	const def = lookupCap(feature.cap);
+	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
+	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
+	return {
+		def,
+		state,
+		fields: describeTopLevelStateFields(state)
+	};
+}
+/**
+* A capability BUILT by the composition (a new device, or one ADDED to an
+* existing device) must fit the device type, serve no command, and have every
+* required field. A REPLACE needs none of it: the cap is bound (a fact), the
+* native keeps serving its methods, and only the named fields are owned (D663).
+*/
+function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
+	const problems = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
+	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
+	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
+	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
+	for (const key of requiredTopLevelKeys(state)) {
+		if (key === itemArrayPath) continue;
+		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
+		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
+	}
+	return problems;
+}
+function planTopLevelField({ def, fields }, field, mode, lookupCap) {
+	const { featureIndex, path, source } = field;
+	const fieldAt = `features[${featureIndex}].fields.${path}`;
+	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
+	const tf = fields.get(path);
+	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: def.name,
+		path,
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
+	return {
+		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planFeature(feature, featureIndex, target, lookupCap) {
+	const at = `features[${featureIndex}]`;
+	const cap = composableCap(feature, at, lookupCap);
+	if ("code" in cap) return refused(cap);
+	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
+	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
+	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
+		featureIndex,
+		path,
+		source
+	}, target.mode, lookupCap));
+	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
+	const all = [...perField, ...items];
+	const fields = all.flatMap((result) => result.fields);
+	const featurePlan = {
+		featureIndex,
+		cap: cap.def.name,
+		mode: target.mode
+	};
+	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
+	return {
+		problems: [
+			...capProblems,
+			...all.flatMap((r) => r.problems),
+			...eventPlan.problems
+		],
+		fields,
+		features: [featurePlan],
+		events: eventPlan.events
+	};
+}
+/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
+function isNativeCap(target, cap) {
+	const owner = target.nativeCaps.get(cap);
+	return owner !== void 0 && owner !== "composer";
+}
+/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
+function planTargetOf(composition, target) {
+	if (composition.target.kind === "new") return {
+		kind: "new",
+		type: composition.target.type
+	};
+	const key = compositionSourceKey(composition.target.device);
+	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
+	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
+	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
+	return {
+		kind: "existing",
+		found: target
+	};
+}
+function featureTargetOf(target, cap) {
+	if (target.kind === "new") return {
+		mode: "new",
+		deviceType: target.type
+	};
+	return {
+		mode: isNativeCap(target.found, cap) ? "replace" : "add",
+		deviceType: target.found.type
+	};
+}
+/**
+* The static plan. `target` describes an EXISTING target device (one read);
+* it is ignored for a new one. On an existing target each feature REPLACES a
+* cap the device has natively, else ADDS it (D663).
+*/
+function planComposition(composition, lookupCap, target) {
+	const planTarget = planTargetOf(composition, target);
+	if ("code" in planTarget) return refused(planTarget);
+	const results = composition.features.map((feature, index) => {
+		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
+		return compositionFeatureEnabled(feature) ? result : {
+			problems: result.problems,
+			fields: [],
+			features: [],
+			events: []
+		};
+	});
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: results.flatMap((r) => r.features),
+		events: results.flatMap((r) => r.events)
+	};
+}
+function compositionSourceRefs(composition) {
+	const refs = composition.features.flatMap((f) => compositionFeatureEnabled(f) && f.kind === "fields" ? featureSources(f).flatMap(fieldReads).map((r) => r.source) : []);
+	return [...new Map(refs.map((r) => [compositionSourceKey(r), r])).values()];
+}
+/**
+* The candidate's device: the existing target itself, else `self`, else a
+* placeholder that cannot collide with a stored target. An existing target is
+* known even on create, so a second customization of it is refused on create too.
+*/
+function candidateSelf(composition, ctx, plan) {
+	return {
+		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
+		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
+		replaced: replacedFieldKeys(plan)
+	};
+}
+/**
+* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
+* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
+* derivation, so the graph reads both the same way.
+*/
+function replacedFieldKeys(plan) {
+	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
+	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
+}
+/**
+* A read of the candidate's own device. Its own composed output (a new device's
+* field, an ADDED field) is the slice-1 own-field rule; on an existing target
+* every other field — replaced, or not composed at all — is the NATIVE value,
+* valid when the device serves that cap natively (D663, rule 5).
+*/
+function selfReadProblems(read, at, fields, self) {
+	const readKey = `${read.cap}.${read.fieldPath}`;
+	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
+	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
+	if (isNativeCap(self.native, read.cap)) return [];
+	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
+}
+function sourceProblems(fields, ctx, self) {
+	const selfKey = compositionSourceKey(self.ref);
+	return fields.flatMap((field) => field.reads.flatMap((read) => {
+		const at = compositionFieldAt(field);
+		const key = compositionSourceKey(read.source);
+		if (key === selfKey) return selfReadProblems(read, at, fields, self);
+		const desc = ctx.sources.get(key);
+		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
+		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
+		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
+		return [];
+	}));
+}
+/**
+* A cycle's node keys are `compositionReadKey` strings:
+* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
+* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
+* back out so the refusal can point at that exact field, matching the
+* documented `features[N].fields.<path>` convention. A cap name has no `.`,
+* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
+* (`items[desiccant].status`) is matched through `compositionFieldKey`.
+*/
+function candidateFieldOfNode(nodeKey, candidateKey) {
+	const prefix = `${candidateKey}#`;
+	if (!nodeKey.startsWith(prefix)) return null;
+	const rest = nodeKey.slice(prefix.length);
+	const dot = rest.indexOf(".");
+	if (dot === -1) return null;
+	return {
+		cap: rest.slice(0, dot),
+		fieldPath: rest.slice(dot + 1)
+	};
+}
+/** The first node of a cycle's path that is one of THIS composition's own
+*  planned fields, as a documented-convention path; `'features'` when the
+*  cycle runs entirely through other stored compositions. */
+function cyclePath(nodePath, candidateKey, fields) {
+	for (const nodeKey of nodePath) {
+		const hit = candidateFieldOfNode(nodeKey, candidateKey);
+		if (hit === null) continue;
+		const hitKey = `${hit.cap}.${hit.fieldPath}`;
+		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
+		if (field !== void 0) return compositionFieldAt(field);
+	}
+	return "features";
+}
+/** The first unread device any of `nodes` belongs to; null when none does. */
+function unreadDeviceOf(nodes, unread) {
+	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
+		key,
+		error
+	};
+	return null;
+}
+/**
+* Cycle check runs against the CANDIDATE (this composition, as block
+* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
+* decided per strongly connected component (`findCandidateCycles`): a cyclic
+* component holding a candidate node refuses, with one representative cycle
+* through it; one without is not this save's cycle. A
+* stored composition of the same block is its old version; another block on
+* the same device, or two stored peers sharing a device, make
+* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
+* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
+*/
+function cycleProblems(composition, ctx, fields, self) {
+	const candidate = {
+		blockId: ctx.blockId ?? "(unsaved)",
+		target: self.ref,
+		composition,
+		replaced: self.replaced
+	};
+	const candidateKey = compositionSourceKey(candidate.target);
+	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
+	try {
+		return findCandidateCycles(candidate, ctx.peers).map((c) => {
+			const at = cyclePath(c.path, candidateKey, fields);
+			const through = unreadDeviceOf([...c.component], unread);
+			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
+		});
+	} catch (err) {
+		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
+		throw err;
+	}
+}
+function validateComposition(composition, ctx) {
+	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
+	const self = candidateSelf(composition, ctx, plan);
+	const cycles = cycleProblems(composition, ctx, plan.fields, self);
+	const problems = [
+		...plan.problems,
+		...sourceProblems(plan.fields, ctx, self),
+		...cycles
+	];
+	return {
+		ok: problems.length === 0,
+		problems,
+		fields: [...plan.fields],
+		features: [...plan.features],
+		events: [...plan.events]
+	};
+}
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = zod.z.object({
+	path: zod.z.string(),
+	kind: CompositionFieldKindSchema,
+	nullable: zod.z.boolean(),
+	required: zod.z.boolean(),
+	enumValues: zod.z.array(zod.z.string()).optional()
+});
+var ComposableCapabilitySchema = zod.z.object({
+	cap: zod.z.string(),
+	fields: zod.z.array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: zod.z.object({
+		path: zod.z.string(),
+		keyField: zod.z.string()
+	}).optional()
+});
+var ComposableCapabilitiesSchema = zod.z.object({ caps: zod.z.array(ComposableCapabilitySchema) });
+/** Why a cap cannot be BUILT (new device, or added to an existing one) on `deviceType`; [] = it can. */
+function builtCapabilityBlockers(def, deviceType) {
+	if (BASE_DEVICE_CAPS.has(def.name)) return ["not-composable"];
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return ["not-composable"];
+	const blockers = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) blockers.push("wrong-device-type");
+	if (Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).length > 0) blockers.push("has-commands");
+	const fields = describeTopLevelStateFields(state);
+	const itemArrayPath = def.status?.itemArray?.path ?? null;
+	if (requiredTopLevelKeys(state).some((key) => key !== itemArrayPath && !fields.has(key))) blockers.push("not-composable");
+	if (planCompositionEvents(def, {
+		featureIndex: 0,
+		cap: def.name,
+		mode: "new"
+	}, []).problems.some((p) => p.code === "not-composable") && !blockers.includes("not-composable")) blockers.push("not-composable");
+	return blockers;
+}
+/** Every cap with no blocker, sorted by name. */
+function describeComposableCaps(defs, deviceType) {
+	return defs.filter((def) => builtCapabilityBlockers(def, deviceType).length === 0).map((def) => {
+		const state = def.runtimeState;
+		const fields = state === void 0 ? [] : [...describeTopLevelStateFields(state).values()];
+		const itemArray = def.status?.itemArray;
+		return {
+			cap: def.name,
+			fields: fields.map((f) => ({
+				path: f.path,
+				kind: f.kind,
+				nullable: f.nullable,
+				required: f.required,
+				...f.enumValues === void 0 ? {} : { enumValues: [...f.enumValues] }
+			})),
+			...itemArray === void 0 ? {} : { itemArray: {
+				path: itemArray.path,
+				keyField: itemArray.keyField
+			} }
+		};
+	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
+}
+/**
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/**
+* Prefix for a block's generated addon id AND its runner id — one addon, one
+* process, so the two are the same string (D2).
+*
+* It lives on the CONTRACT rather than beside the code that materialises the
+* package, because it is not an implementation detail: the operator surface
+* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
+* with no cap and no store of its own. Two copies of this string is one copy
+* too many — a drift would show as a logs pane that is simply always empty.
+*/
+var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/**
+* The builtin's own addon id — and, because of that, the OWNER of the
+* integration every block's devices hang from.
+*
+* A block cannot own one. Every integration read is gated on the installed-addon
+* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
+* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
+* null forever while the write succeeds — one invisible, undeletable row per
+* start. `core-blocks` IS installed, so it reconciles one shared integration and
+* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
+*
+* Exported from the contract, next to the runner prefix and for the same reason:
+* a block reads it as
+* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
+* so a second copy of the string is a block that silently declares into nowhere.
+*/
+var CORE_BLOCKS_ADDON_ID = "core-blocks";
+/** The addon/runner id a block's process runs under. */
+function coreBlockAddonId(blockId) {
+	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+}
+/** The block id behind a generated addon/runner id, or null when the id belongs
+*  to something else. The inverse of {@link coreBlockAddonId}. */
+function coreBlockIdFromAddonId(addonId) {
+	if (!addonId.startsWith("core-block-")) return null;
+	const rest = addonId.slice(11);
+	return rest.length > 0 ? rest : null;
+}
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = zod.z.union([zod.z.literal("hub"), zod.z.string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
+var CoreBlockStatusSchema = zod.z.enum([
+	"stopped",
+	"starting",
+	"running",
+	"degraded",
+	"failed"
+]);
+/** Client-authored fields. */
+var CoreBlockInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: zod.z.string().max(2e5),
+	enabled: zod.z.boolean(),
+	placement: CoreBlockPlacementSchema,
+	/**
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
+	*/
+	integrationId: zod.z.string().optional()
+});
+/**
+* What a block IS (D659). Absent means `code` — every row stored before this
+* union keeps working unchanged.
+*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
+*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
+*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+*/
+var CoreBlockSourceSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({ kind: zod.z.literal("code") }),
+	zod.z.object({
+		kind: zod.z.literal("recipe"),
+		recipe: AutomationRecipeSchema
+	}),
+	zod.z.object({
+		kind: zod.z.literal("composition"),
+		composition: CompositionSchema
+	})
+]);
+/**
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
+*
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
+*/
+var CompositionBlockInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(120).optional(),
+	enabled: zod.z.boolean(),
+	composition: CompositionSchema
+});
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
+	id: zod.z.string(),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number(),
+	/** Server-stamped author. */
+	createdBy: zod.z.string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: zod.z.string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: zod.z.number(),
+	/** What the block is. Absent means `code` (D659). */
+	source: CoreBlockSourceSchema.optional()
+});
+function coreBlockSourceKind(block) {
+	return block.source?.kind ?? "code";
+}
+function coreBlockComposition(block) {
+	return block.source?.kind === "composition" ? block.source.composition : null;
+}
+/** What the composer said, or that it could not be asked. Unknown never looks like absent (D315). */
+var CompositionStateReadSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("answered"),
+	state: CompositionBlockStateSchema.nullable()
+}), zod.z.object({
+	kind: zod.z.literal("unreachable"),
+	error: zod.z.string()
+})]);
+/** A stored composition block and what the composer says about it. */
+var CompositionViewSchema = zod.z.object({
+	block: CoreBlockSchema,
+	state: CompositionStateReadSchema
+});
+/**
+* A read of the stored compositions. `not-loaded` while the `core_blocks`
+* table has not been READ: an empty answer then would make "not yet known"
+* look like "none", and invite the operator to recreate what exists (D315).
+*/
+var CompositionsNotLoadedSchema = zod.z.object({
+	state: zod.z.literal("not-loaded"),
+	reason: zod.z.string()
+});
+var CompositionListReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("loaded"),
+	views: zod.z.array(CompositionViewSchema)
+}), CompositionsNotLoadedSchema]);
+var CompositionGetReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
+	error: zod.z.string().optional(),
+	line: zod.z.number().optional(),
+	column: zod.z.number().optional()
+});
+var coreBlocksCapability = {
+	name: "core-blocks",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		list: method(zod.z.object({}), zod.z.object({ blocks: zod.z.array(CoreBlockSchema) }), { auth: "admin" }),
+		get: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
+		/**
+		* Create a block. The code is COMPILED first: storing source that does not
+		* compile turns an editor error into a fork failure the operator meets
+		* minutes later in a log.
+		*/
+		create: method(zod.z.object({ block: CoreBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		update: method(zod.z.object({
+			blockId: zod.z.string(),
+			block: CoreBlockInputSchema.partial()
+		}), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		delete: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setEnabled: method(zod.z.object({
+			blockId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stop this block's runner and let the supervisor bring it back.
+		*
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
+		*
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
+		*/
+		restart: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Type-check without saving — what the editor calls as the author types, so
+		* the compiler's verdict is the same one the server will reach.
+		*/
+		compile: method(zod.z.object({ code: zod.z.string() }), CoreBlockCompileResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The declaration files the editor type-checks against.
+		*
+		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
+		* bundling it would roughly double the admin remote. Served rather than
+		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
+		* would drift and the editor would confidently autocomplete methods that
+		* do not exist.
+		*/
+		getTypeDefs: method(zod.z.object({}), zod.z.object({ libs: zod.z.array(zod.z.object({
 			filePath: zod.z.string(),
 			content: zod.z.string()
 		})) }), { auth: "admin" }),
@@ -11941,6 +12906,14 @@ var coreBlocksCapability = {
 			stableId: zod.z.string().min(1)
 		}), CompositionCustomizationReadSchema, { auth: "admin" }),
 		/**
+		* The capabilities a composition may BUILD on a device of `deviceType`
+		* (a new device, or added to an existing one), with their fields — the
+		* editor's feature list and the presets' availability (G2, D676). Built
+		* from the validator's own blockers; a replace of a BOUND cap is not
+		* listed here (the device's bindings say what it has).
+		*/
+		listComposableCaps: method(zod.z.object({ deviceType: zod.z.enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
+		/**
 		* Validate without saving — the same verdict the save reaches. A mutation
 		* for its body size; it writes nothing, so its access is `view`.
 		*/
@@ -20920,7 +21893,7 @@ function cameraSensorRefKey(ref) {
 }
 /** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
 var CameraSensorsModeSchema = zod.z.enum(["in-addition"]);
-zod.z.object({
+var CameraSensorsConfigSchema = zod.z.object({
 	mode: CameraSensorsModeSchema,
 	sensors: zod.z.array(CameraSensorRefSchema).min(1).max(8)
 }).superRefine((value, ctx) => {
@@ -26107,6 +27080,16 @@ var NodeInferenceDevicesSchema = zod.z.object({
 * Strictly the control plane: never sees a frame, never calls inference,
 * never drains queues. The runner does that work locally on each agent.
 */
+/**
+* The input of `setCameraSensors` (G5, D676): the ONE typed write path of a
+* camera's attached sensors (D672). `config: null` removes the attachment —
+* the camera reads `not-configured` again, never `unreadable`.
+*/
+var SetCameraSensorsInputSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	/** `null` removes the attachment: the camera goes back to `not-configured`. */
+	config: CameraSensorsConfigSchema.nullable()
+});
 var pipelineOrchestratorCapability = {
 	name: "pipeline-orchestrator",
 	scope: "system",
@@ -26572,6 +27555,18 @@ var pipelineOrchestratorCapability = {
 		*/
 		getCameraStatuses: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.array(CameraStatusSchema).readonly()),
 		/**
+		* Attach sensors to a camera, or detach them with `config: null` (D672
+		* configuration, G5/D676). Written to the orchestrator's per-device store
+		* under the same key `applyDeviceSettingsPatch` writes, and announced as a
+		* settings change so the camera-sensors bridge refreshes. Refused by name
+		* — nothing written — for a device that cannot be read, does not exist,
+		* is not a camera, or names itself as its own sensor.
+		*/
+		setCameraSensors: method(SetCameraSensorsInputSchema, zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
 		* the addon process and returns immediately with the job snapshot — the
 		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
@@ -42569,978 +43564,736 @@ var WeatherStatusSchema = zod.z.object({
 	/** Pressure unit string (e.g. `hPa` / `inHg`). Null when not provided. */
 	pressureUnit: zod.z.string().nullable(),
 	/** Wind speed in the reported unit. Null when not provided. */
-	windSpeed: zod.z.number().nullable(),
-	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
-	windSpeedUnit: zod.z.string().nullable(),
-	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
-	windBearing: zod.z.number().nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastFetchedAt: zod.z.number()
-});
-var weatherCapability = {
-	name: "weather",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Weather],
-	methods: {},
-	status: {
-		schema: WeatherStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. The UI reads the
-	* current conditions directly from the slice on each weather push.
-	*/
-	runtimeState: WeatherStatusSchema,
-	/**
-	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-/**
-* Per-zone occupancy aggregation produced by the analytics frame
-* processor on every inference result. Covers the full combinatorial
-* matrix the operator UI needs: total objects everywhere, total
-* objects per zone, single class everywhere, single class per zone,
-* objects outside any zone.
-*
-* Counts are derived from the analytics tracker (tracked detections
-* with stable trackIds), not raw detector hits — this filters out
-* one-off detector flickers and gives counts that match what the user
-* sees on the live overlay.
-*
-* Overlap policy: a detection that intersects two zones counts in
-* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
-* `frame` aggregate de-duplicates trivially since it's frame-wide.
-* `unzoned` counts only detections that landed in zero zones.
-*/
-var PerScopeBreakdownSchema = zod.z.object({
-	/** Total tracked objects in this scope (frame / zone / unzoned). */
-	totalObjects: zod.z.number().int().nonnegative(),
-	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
-	byClass: zod.z.record(zod.z.string(), zod.z.number().int().nonnegative()),
-	/**
-	* Of `totalObjects`, how many are STANDING — objects the census holds,
-	* present but not going anywhere (a parked car, a bin, a statue).
-	*
-	* The operator's question about a scene has two halves and they answer
-	* different things: "what is parked here" is stable for hours and must not
-	* flap, while "who is walking through" is the thing an alert is about. One
-	* number could only serve one of them, and `totalObjects` served the first
-	* badly — a passer-by moved it and every occupancy rule saw a change.
-	*
-	* `standing + transient === totalObjects`, always. The total keeps its old
-	* meaning exactly, so no rule written against it changes behaviour.
-	*
-	* ABSENT means UNKNOWN, never zero (D393): a snapshot from a node older than
-	* this field cannot say, and a reader that folds absence in as 0 reports "no
-	* parked objects here" about a camera whose lot is full.
-	*/
-	standingObjects: zod.z.number().int().nonnegative().optional(),
-	/** Of `totalObjects`, how many are passing through. See `standingObjects` —
-	*  same absence rule. */
-	transientObjects: zod.z.number().int().nonnegative().optional()
-});
-var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
-	zoneId: zod.z.string(),
-	zoneName: zod.z.string(),
-	/** TrackIds of objects currently inside this zone — for cross-reference
-	*  with the per-track detail panel and live overlay. */
-	trackIds: zod.z.array(zod.z.string()).readonly()
-});
-/**
-* A parked ("stationary") object surfaced alongside occupancy — an object that
-* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
-* told to forget it so it stops re-spawning tracks/events), but it IS still
-* physically present, so it keeps counting toward `frame` occupancy and is
-* listed here so the UI can show it in a dedicated "Stationary" section instead
-* of flooding the live event feed.
-*/
-var StationaryObjectSchema = zod.z.object({
-	id: zod.z.string(),
-	className: zod.z.string(),
-	bbox: zod.z.object({
-		x: zod.z.number(),
-		y: zod.z.number(),
-		w: zod.z.number(),
-		h: zod.z.number()
-	}),
-	frameWidth: zod.z.number().int().nonnegative(),
-	frameHeight: zod.z.number().int().nonnegative(),
-	/** When the source track was first seen. */
-	firstSeenAt: zod.z.number().int(),
-	/** When the object was recognised as parked (promotion time). */
-	becameStationaryAt: zod.z.number().int(),
-	/** Last frame a detection confirmed the object is still there. */
-	lastConfirmedAt: zod.z.number().int(),
-	/** Enrichment label carried from the source track (identity / plate). */
-	label: zod.z.string().optional(),
-	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaId: zod.z.number().int().optional()
-});
-var CameraOccupancySnapshotSchema = zod.z.object({
-	/** Frame timestamp of the inference result that produced this snapshot. */
-	ts: zod.z.number().int(),
-	/** Frame width/height in pixels — let the UI normalize bbox coords. */
-	frameWidth: zod.z.number().int().nonnegative(),
-	frameHeight: zod.z.number().int().nonnegative(),
-	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
-	zones: zod.z.array(ZoneScopeBreakdownSchema).readonly(),
-	/** Frame-wide aggregate (everywhere, regardless of zone membership).
-	*  INCLUDES currently-confirmed stationary objects (they are still present). */
-	frame: PerScopeBreakdownSchema,
-	/** Detections that landed outside every zone. Empty when no zones defined. */
-	unzoned: PerScopeBreakdownSchema,
-	/** Parked objects on this camera (additive — absent on legacy snapshots).
-	*  Surfaced separately so the UI shows them in a dedicated section rather
-	*  than as repeated tracks/events. */
-	stationaryObjects: zod.z.array(StationaryObjectSchema).readonly().optional()
-});
-/**
-* One camera's row in a `getCurrentSnapshotBatch` answer.
-*
-* THREE outcomes, and the single-camera method could only express two of them
-* because `snapshot: null` was already spoken for:
-*
-*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
-*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
-*    yet: no frame since boot, and no parked-object registry to hydrate from.
-*  - `read: 'unreadable'`               — the owner could not answer for this
-*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
-*
-* Collapsing the last two is the failure this field exists to prevent: a
-* hydration that threw would otherwise render as an empty Stationary section,
-* which is a definite claim about a camera nobody could read.
-*/
-var CameraOccupancySnapshotForDeviceSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	read: zod.z.enum(["read", "unreadable"]),
-	snapshot: CameraOccupancySnapshotSchema.nullable()
-});
-/**
-* Time-series resolution. The history methods return one bucket per
-* step over the requested range. Smaller resolutions cost more
-* memory + bandwidth; bound to discrete steps so caller cannot ask
-* for arbitrary fractional buckets.
-*/
-var HistoryResolutionEnum = zod.z.enum([
-	"minute",
-	"5min",
-	"hour"
-]);
-var HistoryRangeSchema = zod.z.object({
-	/** Range start (epoch ms, inclusive). */
-	from: zod.z.number().int(),
-	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
-	to: zod.z.number().int(),
-	resolution: HistoryResolutionEnum
-});
-var HistoryPointSchema = zod.z.object({
-	/** Bucket midpoint (epoch ms). */
-	ts: zod.z.number().int(),
-	/** Object count averaged over the bucket (rounded to nearest integer). */
-	count: zod.z.number().int().nonnegative()
-});
-/**
-* Zone Analytics capability — spatial occupancy aggregations over
-* tracked detections. Hosted by `addon-pipeline-analytics`.
-*
-* Live snapshot is mirrored into the `zone-occupancy` device-state
-* slice on every frame; the cap method `getCurrentSnapshot` is a
-* direct read for callers that don't want to subscribe.
-*
-* History methods are sourced from a 60-minute rolling in-memory
-* ring of frame-level samples (sub-second resolution). Queries
-* outside the ring window return empty arrays — durable storage
-* is a follow-up (Step 4b: persisted samples → SQL store).
-*
-* Every history method takes an optional `className` filter:
-* - omitted → bucket count includes ALL classes in scope
-* - present → bucket count restricted to that class
-*
-* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
-* triple covers the three spatial scopes (per-zone, frame-wide,
-* outside-any-zone). Crossing them with `className?` gives the full
-* combinatorial coverage the operator UI requested.
-*
-* ## ⚠️ The three history methods are DEPRECATED
-*
-* They are served from a 60-MINUTE in-memory ring. It dies with the process,
-* so after a restart they report nothing about a night that did happen, and any
-* window past an hour is silently clamped — a caller cannot tell a clamp from
-* an empty scene. The presets in the occupancy chart existed to hide that
-* horizon rather than to answer a question.
-*
-* Use `pipelineAnalytics.readLongTermSeries({ series: 'occupancy', scope })`
-* instead. Those rows are already written for every camera, ~60 bytes per
-* (camera, scope, 5-minute bucket), kept for a year, and survive a restart.
-* Spell the scope with `occupancyScope(zoneId?, className?)` — the same
-* function the writer uses, so the two cannot drift.
-*
-* The ring stays until these three go, and it is the only thing left reading
-* it. Do not add a fourth caller.
-*/
-var zoneAnalyticsCapability = {
-	name: "zone-analytics",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Latest computed occupancy snapshot for this camera. Null when
-		*  the analytics pipeline hasn't seen a frame for this device yet
-		*  (no inference result emitted since boot or since binding was
-		*  activated). */
-		getCurrentSnapshot: method(zod.z.object({ deviceId: zod.z.number() }), CameraOccupancySnapshotSchema.nullable()),
-		/**
-		* The same snapshot, for a SET of cameras, in one round trip.
-		*
-		* The Events page's Stationary section polls this every 15s for every
-		* selected camera. Fanned out client-side that is one query per camera to
-		* read a `Map.get` at the owner — the answer costs nothing, the round trip
-		* costs everything. Batched, N transports become one and the per-device
-		* work is unchanged.
-		*
-		* Every requested deviceId gets a row, tagged `read` — see
-		* {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
-		* not answer for is `'unreadable'`, never an empty reading.
-		*/
-		getCurrentSnapshotBatch: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
-		/** Time-series object count inside one zone. `className` optional —
-		*  omit to count every class in the zone. */
-		getZoneHistory: method(zod.z.object({
-			deviceId: zod.z.number(),
-			zoneId: zod.z.string(),
-			className: zod.z.string().optional()
-		}).extend(HistoryRangeSchema.shape), zod.z.array(HistoryPointSchema).readonly()),
-		/** Time-series frame-wide object count (everywhere). */
-		getCameraHistory: method(zod.z.object({
-			deviceId: zod.z.number(),
-			className: zod.z.string().optional()
-		}).extend(HistoryRangeSchema.shape), zod.z.array(HistoryPointSchema).readonly()),
-		/** Time-series count of objects outside every zone. */
-		getUnzonedHistory: method(zod.z.object({
-			deviceId: zod.z.number(),
-			className: zod.z.string().optional()
-		}).extend(HistoryRangeSchema.shape), zod.z.array(HistoryPointSchema).readonly())
-	},
-	/**
-	* Runtime-state slice — the latest occupancy snapshot mirrored by
-	* the analytics frame processor on every inference result. Consumers
-	* read via `device.state.zoneAnalytics.value` and stay in sync
-	* automatically; the explicit `getCurrentSnapshot` cap method is
-	* still useful for one-off polls without a subscription.
-	*/
-	runtimeState: CameraOccupancySnapshotSchema,
-	/**
-	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-/**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
-*
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
-*/
-var ZoneRuleStageEnum = zod.z.enum([
-	"motion",
-	"detection",
-	"package"
-]);
-/**
-* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
-* arrays that decide how each pipeline stage uses the polygon zones.
-*
-* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
-* so the operator has a single hub-side source of truth for both
-* geometry and behaviour. Per-stage rules are stored under the
-* `zoneRules.<stage>` key in the orchestrator's per-device store and
-* mirrored to the device-state slice `<stage>-zone-rules` on every
-* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
-* subscribe to that slice and refresh their gating without
-* round-tripping the cap.
-*
-* Sets are bulk-replace — the operator UI sends the new rule list
-* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
-* naturally in the rule editor without per-rule mutation chatter.
-*/
-var zoneRulesCapability = {
-	name: "zone-rules",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Read the full rule list for a given stage (empty when no rules
-		*  are defined yet). */
-		listRules: method(zod.z.object({
-			deviceId: zod.z.number(),
-			stage: ZoneRuleStageEnum
-		}), zod.z.array(ZoneRuleSchema).readonly()),
-		/** Bulk-replace the rule list for one stage. The provider validates
-		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
-		*  thresholds in range) and rejects the whole patch if any entry
-		*  is invalid — partial writes are a configuration footgun. */
-		setRules: method(zod.z.object({
-			deviceId: zod.z.number(),
-			stage: ZoneRuleStageEnum,
-			rules: zod.z.array(ZoneRuleSchema).readonly()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
+	windSpeed: zod.z.number().nullable(),
+	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
+	windSpeedUnit: zod.z.string().nullable(),
+	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
+	windBearing: zod.z.number().nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastFetchedAt: zod.z.number()
+});
+var weatherCapability = {
+	name: "weather",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Weather],
+	methods: {},
+	status: {
+		schema: WeatherStatusSchema,
+		kind: "push"
 	},
 	/**
-	* Runtime-state slice — every stage mirrored together so consumers
-	* see one reactive handle (`device.state.zoneRules.value`) instead
-	* of one per stage. Bulk-replace mutations on any stage write the full
-	* `{motion, detection, package}` shape, so subscribers always get the
-	* complete current set. Consumers that only care about one stage
-	* just read the matching property.
-	*
-	* `package` backs the package-drop detector — a package zone is a
-	* `ZoneRule` on the `'package'` stage referencing drawn polygons
-	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
-	* The orchestrator provider writes this stage as a first-class slice
-	* (Phase 4): every mutation mirrors the full `{motion, detection,
-	* package}` shape, so consumers read the current package rules directly
-	* off `device.state.zoneRules.value.package`.
+	* Runtime-state slice — mirrored by the kernel. The UI reads the
+	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: zod.z.object({
-		motion: zod.z.array(ZoneRuleSchema).readonly(),
-		detection: zod.z.array(ZoneRuleSchema).readonly(),
-		package: zod.z.array(ZoneRuleSchema).readonly()
-	}),
+	runtimeState: WeatherStatusSchema,
 	/**
-	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "session"
 };
-function isValueOf(slot, value) {
-	return value.slot === slot;
-}
-/** Bind slot `slot` to its owner's functions. See the module docblock. */
-function defineExtensionSlotProvider(slot, impl) {
-	return {
-		slot,
-		list: async (deviceId) => {
-			const listing = await impl.list(deviceId);
-			if (listing === null) return null;
-			const value = listing.value;
-			return {
-				...listing,
-				value
-			};
-		},
-		set: async (deviceId, value) => {
-			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
-			return await impl.set(deviceId, value);
-		},
-		candidates: (deviceId) => impl.candidates(deviceId)
-	};
-}
-/** `<source>:<slotId>`. */
-function extensionSlotRef(source, slot) {
-	return `${source}:${slot}`;
-}
-/** Build the `device-extension` provider one owner registers. */
-function createDeviceExtensionProvider(options) {
-	const { source, label, slots, hostTypeOf, logger } = options;
-	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
-	const resolve = async (deviceId, slotRef) => {
-		const prefix = `${source}:`;
-		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
-		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
-		const hostType = await hostTypeOf(deviceId);
-		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
-		return slot;
-	};
-	return {
-		listSources: async () => [{
-			source,
-			label,
-			availability: { state: "ok" }
-		}],
-		listSlots: async (input) => {
-			const hostType = await hostTypeOf(input.deviceId);
-			const rows = [];
-			for (const slot of slots) {
-				if (!offered(slot.slot, hostType)) continue;
-				const listing = await slot.list(input.deviceId);
-				if (listing === null) continue;
-				rows.push({
-					state: "ok",
-					slotRef: extensionSlotRef(source, slot.slot),
-					slot: slot.slot,
-					authority: listing.authority,
-					activation: listing.activation,
-					value: listing.value,
-					sources: [...listing.sources],
-					...listing.impliedSources !== void 0 ? { impliedSources: [...listing.impliedSources] } : {}
-				});
-			}
-			return rows;
-		},
-		listCandidates: async (input) => {
-			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
-		},
-		setSlot: async (input) => {
-			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
-			logger.info("device-extension: slot written", {
-				tags: { deviceId: input.deviceId },
-				meta: {
-					slotRef: input.slotRef,
-					reload: result.reload
-				}
-			});
-			return result;
-		}
-	};
-}
 /**
-* The field graph across every composition, and the cycles in it (D659).
-*
-* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
-* edge points from a composed field to each field it reads. A cycle, direct or
-* through another composition, is refused at save by name (spec §2).
-*
-* The graph is built for ONE save: the CANDIDATE composition (the one being
-* validated) plus every STORED composition. The candidate replaces its own old
-* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
-* introduces or removes a cycle must never depend on array order. A DIFFERENT
-* block targeting the candidate's device is refused by name: one composition
-* per device (D663). Two different stored peers that (wrongly) target the same
-* device are corrupted state, not a cycle to resolve by picking one silently;
-* that is refused by name too (D391).
-*
-* A customization of an EXISTING device reads that device's NATIVE value for a
-* field it replaces or does not write ("Invert state" reads the `on` it
-* replaces): such a self-read is no edge, so it is never a cycle (D663).
-* Another composition reading that field reads the customizer's output.
+* Per-zone occupancy aggregation produced by the analytics frame
+* processor on every inference result. Covers the full combinatorial
+* matrix the operator UI needs: total objects everywhere, total
+* objects per zone, single class everywhere, single class per zone,
+* objects outside any zone.
 *
-* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
-* marks a node `done` after its first expansion) — not every elementary cycle
-* through a shared node, so the path it names may AVOID the candidate while
-* one through it goes unreported. What a save refuses is therefore decided per
-* strongly connected component (`findCandidateCycles`, C-1). A dotted
-* `fieldPath` is matched only as an exact string: a write to `state.value` and
-* a read of `state` would not connect (no nested field writes exist yet).
+* Counts are derived from the analytics tracker (tracked detections
+* with stable trackIds), not raw detector hits — this filters out
+* one-off detector flickers and gives counts that match what the user
+* sees on the live overlay.
 *
-* An item leaf is its own node, `…#consumables.items[desiccant].status`
-* (`featureFieldEntries`), so two items sharing an inner path never merge. No
-* READ can name an array element (`describeStateField` never describes one),
-* so an item node is write-only: its edges to sources are what the check needs.
-*/
-/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
-var CompositionGraphError = class extends Error {};
-/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
-function writtenFields(peer) {
-	return new Set(peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
-}
-/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
-function readsComposedValue(peer, written, read) {
-	if (compositionSourceKey(read.source) !== compositionSourceKey(peer.target)) return true;
-	const field = `${read.cap}.${read.fieldPath}`;
-	return written.has(field) && peer.replaced?.has(field) !== true;
-}
-function peerEdges(peer) {
-	const written = writtenFields(peer);
-	return peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath, source }) => [compositionReadKey({
-		source: peer.target,
-		cap: feature.cap,
-		fieldPath
-	}), fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(compositionReadKey)]));
-}
-/**
-* Every peer that actually takes part in the graph: each stored peer minus the
-* candidate's own old version (same block id — the drop happens before any
-* edge is built, so its old edges never enter the map), plus the candidate
-* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
-* block targets the candidate's device, or two stored peers share a device.
+* Overlap policy: a detection that intersects two zones counts in
+* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
+* `frame` aggregate de-duplicates trivially since it's frame-wide.
+* `unzoned` counts only detections that landed in zero zones.
 */
-function resolvedPeers(candidate, stored) {
-	const candidateKey = compositionSourceKey(candidate.target);
-	const survivors = /* @__PURE__ */ new Map();
-	for (const peer of stored) {
-		if (peer.blockId === candidate.blockId) continue;
-		const key = compositionSourceKey(peer.target);
-		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
-		const clash = survivors.get(key);
-		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
-		survivors.set(key, peer);
-	}
-	return [...survivors.values(), candidate];
-}
-function compositionEdges(candidate, stored) {
-	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
-	return new Map(edges);
-}
-/** Tarjan's strongly connected components over every node of the graph (sources included). */
-function stronglyConnected(edges) {
-	const index = /* @__PURE__ */ new Map();
-	const low = /* @__PURE__ */ new Map();
-	const onStack = /* @__PURE__ */ new Set();
-	const stack = [];
-	const components = [];
-	const connect = (node) => {
-		index.set(node, index.size);
-		low.set(node, index.get(node) ?? 0);
-		stack.push(node);
-		onStack.add(node);
-		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
-			connect(next);
-			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
-		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
-		if (low.get(node) !== index.get(node)) return;
-		const component = [];
-		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
-			onStack.delete(member);
-			component.push(member);
-			if (member === node) break;
-		}
-		components.push(component);
-	};
-	for (const node of edges.keys()) if (!index.has(node)) connect(node);
-	return components;
-}
-/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
-function cycleThrough(start, component, edges) {
-	const parent = /* @__PURE__ */ new Map();
-	const queue = [start];
-	for (let head = 0; head < queue.length; head += 1) {
-		const node = queue[head];
-		if (node === void 0) break;
-		for (const next of edges.get(node) ?? []) {
-			if (next === start) {
-				const chain = [];
-				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
-				return [
-					start,
-					...chain.reverse(),
-					start
-				];
-			}
-			if (!component.has(next) || parent.has(next)) continue;
-			parent.set(next, node);
-			queue.push(next);
-		}
-	}
-	return [start, start];
-}
+var PerScopeBreakdownSchema = zod.z.object({
+	/** Total tracked objects in this scope (frame / zone / unzoned). */
+	totalObjects: zod.z.number().int().nonnegative(),
+	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
+	byClass: zod.z.record(zod.z.string(), zod.z.number().int().nonnegative()),
+	/**
+	* Of `totalObjects`, how many are STANDING — objects the census holds,
+	* present but not going anywhere (a parked car, a bin, a statue).
+	*
+	* The operator's question about a scene has two halves and they answer
+	* different things: "what is parked here" is stable for hours and must not
+	* flap, while "who is walking through" is the thing an alert is about. One
+	* number could only serve one of them, and `totalObjects` served the first
+	* badly — a passer-by moved it and every occupancy rule saw a change.
+	*
+	* `standing + transient === totalObjects`, always. The total keeps its old
+	* meaning exactly, so no rule written against it changes behaviour.
+	*
+	* ABSENT means UNKNOWN, never zero (D393): a snapshot from a node older than
+	* this field cannot say, and a reader that folds absence in as 0 reports "no
+	* parked objects here" about a camera whose lot is full.
+	*/
+	standingObjects: zod.z.number().int().nonnegative().optional(),
+	/** Of `totalObjects`, how many are passing through. See `standingObjects` —
+	*  same absence rule. */
+	transientObjects: zod.z.number().int().nonnegative().optional()
+});
+var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
+	zoneId: zod.z.string(),
+	zoneName: zod.z.string(),
+	/** TrackIds of objects currently inside this zone — for cross-reference
+	*  with the per-track detail panel and live overlay. */
+	trackIds: zod.z.array(zod.z.string()).readonly()
+});
 /**
-* The cycles THIS save closes, decided per strongly connected component — never
-* per reported DFS path, which names one back-edge per revisit and can report a
-* component's cycle by a path that avoids the candidate while the one through it
-* goes unreported. A component refuses when it holds a candidate node and a
-* cycle (more than one node, or a self-loop). Components without a candidate
-* node are not this save's cycles.
+* A parked ("stationary") object surfaced alongside occupancy — an object that
+* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
+* told to forget it so it stops re-spawning tracks/events), but it IS still
+* physically present, so it keeps counting toward `frame` occupancy and is
+* listed here so the UI can show it in a dedicated "Stationary" section instead
+* of flooding the live event feed.
 */
-function findCandidateCycles(candidate, stored) {
-	const edges = compositionEdges(candidate, stored);
-	const prefix = `${compositionSourceKey(candidate.target)}#`;
-	return stronglyConnected(edges).flatMap((members) => {
-		const start = members.find((n) => n.startsWith(prefix));
-		if (start === void 0) return [];
-		const component = new Set(members);
-		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
-		if (members.length === 1 && !selfLoop) return [];
-		return [{
-			path: cycleThrough(start, component, edges),
-			component
-		}];
-	});
-}
-function problem(code, path, message) {
-	return {
-		code,
-		path,
-		message
-	};
-}
-function refused(...problems) {
-	return {
-		problems,
-		fields: [],
-		features: [],
-		events: []
-	};
-}
-/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
-function compositionFieldAt(field) {
-	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
-	return `features[${field.featureIndex}].${inner}.${field.path}`;
-}
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
-var BUILTIN_RESULT_KINDS = Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
+var StationaryObjectSchema = zod.z.object({
+	id: zod.z.string(),
+	className: zod.z.string(),
+	bbox: zod.z.object({
+		x: zod.z.number(),
+		y: zod.z.number(),
+		w: zod.z.number(),
+		h: zod.z.number()
+	}),
+	frameWidth: zod.z.number().int().nonnegative(),
+	frameHeight: zod.z.number().int().nonnegative(),
+	/** When the source track was first seen. */
+	firstSeenAt: zod.z.number().int(),
+	/** When the object was recognised as parked (promotion time). */
+	becameStationaryAt: zod.z.number().int(),
+	/** Last frame a detection confirmed the object is still there. */
+	lastConfirmedAt: zod.z.number().int(),
+	/** Enrichment label carried from the source track (identity / plate). */
+	label: zod.z.string().optional(),
+	/** Native-resolution key-frame media key for the parked object's best image. */
+	keyFrameMediaId: zod.z.number().int().optional()
+});
+var CameraOccupancySnapshotSchema = zod.z.object({
+	/** Frame timestamp of the inference result that produced this snapshot. */
+	ts: zod.z.number().int(),
+	/** Frame width/height in pixels — let the UI normalize bbox coords. */
+	frameWidth: zod.z.number().int().nonnegative(),
+	frameHeight: zod.z.number().int().nonnegative(),
+	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
+	zones: zod.z.array(ZoneScopeBreakdownSchema).readonly(),
+	/** Frame-wide aggregate (everywhere, regardless of zone membership).
+	*  INCLUDES currently-confirmed stationary objects (they are still present). */
+	frame: PerScopeBreakdownSchema,
+	/** Detections that landed outside every zone. Empty when no zones defined. */
+	unzoned: PerScopeBreakdownSchema,
+	/** Parked objects on this camera (additive — absent on legacy snapshots).
+	*  Surfaced separately so the UI shows them in a dedicated section rather
+	*  than as repeated tracks/events. */
+	stationaryObjects: zod.z.array(StationaryObjectSchema).readonly().optional()
 });
-var KindInferenceError = class extends Error {};
-function kindOfValue(value) {
-	if (value === null) return "null";
-	if (typeof value === "number") return "number";
-	if (typeof value === "string") return "string";
-	return "boolean";
-}
-function only(kind) {
-	return new Set([kind]);
-}
-function union(...sets) {
-	return new Set(sets.flatMap((s) => [...s]));
-}
-function withoutNull(set) {
-	return new Set([...set].filter((k) => k !== "null"));
-}
-function binaryKinds(op, left, right) {
-	if (op === "+") {
-		const all = [...left, ...right];
-		if (all.every((k) => k === "string")) return only("string");
-		if (all.every((k) => k === "number")) return only("number");
-		return new Set(["number", "string"]);
-	}
-	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
-	return only("boolean");
-}
-/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
-function arityRange(builtin) {
-	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
-	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
-	return `${builtin.minArgs}–${builtin.maxArgs}`;
-}
-function callKinds(callee, args) {
-	const builtin = EXPRESSION_BUILTINS[callee];
-	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
-	const rule = BUILTIN_RESULT_KINDS[callee];
-	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
-	if (rule.kind === "fixed") return new Set(rule.result);
-	const nonNull = union(...args.map(withoutNull));
-	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
-}
-function kindsOf(node, bindings) {
-	switch (node.kind) {
-		case "literal": return only(kindOfValue(node.value));
-		case "identifier": {
-			if (node.name === "now") return only("number");
-			const bound = bindings.get(node.name);
-			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
-			return bound;
-		}
-		case "unary": return only(node.op === "!" ? "boolean" : "number");
-		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
-		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
-	}
-}
-function nodeContainsCall(node, callee) {
-	switch (node.kind) {
-		case "literal":
-		case "identifier": return false;
-		case "unary": return nodeContainsCall(node.operand, callee);
-		case "binary":
-		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
-		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
-		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
-	}
-}
-function expressionContainsBuiltinCall(expr, callee) {
-	const compiled = compileExpressionSafe(expr);
-	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
-}
-function inferExpressionKinds(input) {
-	const compiled = compileExpressionSafe(input.expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	try {
-		return {
-			ok: true,
-			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
-		};
-	} catch (err) {
-		if (err instanceof KindInferenceError) return {
-			ok: false,
-			error: err.message
-		};
-		throw err;
-	}
-}
 /**
-* The kind half of planning a composition field (D659): which kinds a source
-* can produce, whether they fit a target field, and the field's role.
-* Shared by the top-level planner (`validate-composition.ts`) and the item
-* planner (`composition-items.ts`). Internal to the composition module — NOT
-* in the barrel: these are planner internals, not a published contract.
+* One camera's row in a `getCurrentSnapshotBatch` answer.
+*
+* THREE outcomes, and the single-camera method could only express two of them
+* because `snapshot: null` was already spoken for:
+*
+*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
+*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
+*    yet: no frame since boot, and no parked-object registry to hydrate from.
+*  - `read: 'unreadable'`               — the owner could not answer for this
+*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
+*
+* Collapsing the last two is the failure this field exists to prevent: a
+* hydration that threw would otherwise render as an empty Stationary section,
+* which is a definite claim about a camera nobody could read.
 */
-function readKinds(read, lookupCap) {
-	const def = lookupCap(read.cap);
-	const schema = def?.runtimeState ?? def?.status?.schema;
-	if (def === null || schema === void 0) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `no capability \`${read.cap}\` with state to read`
-	};
-	const field = describeStateField(schema, read.fieldPath);
-	if (field === null) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
-	};
-	const base = field.kind === "enum" ? "string" : field.kind;
-	return {
-		ok: true,
-		kinds: new Set(field.nullable ? [base, "null"] : [base])
-	};
-}
-function sourceKinds(source, lookupCap) {
-	if (source.kind === "from") return readKinds(source, lookupCap);
-	if (source.kind === "code") return {
-		ok: false,
-		code: "reserved-variant",
-		message: "code fields arrive in slice 4"
-	};
-	const bindingKinds = /* @__PURE__ */ new Map();
-	for (const [name, binding] of Object.entries(source.bindings)) {
-		if (binding.kind === "literal") {
-			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
-			continue;
-		}
-		const kinds = readKinds(binding, lookupCap);
-		if (!kinds.ok) return {
-			...kinds,
-			message: `binding \`${name}\`: ${kinds.message}`
-		};
-		bindingKinds.set(name, kinds.kinds);
-	}
-	const inferred = inferExpressionKinds({
-		expr: source.expr,
-		bindingKinds
-	});
-	return inferred.ok ? {
-		ok: true,
-		kinds: inferred.kinds
-	} : {
-		ok: false,
-		code: "expression-invalid",
-		message: inferred.error
-	};
-}
-function compatibility(cap, target, kinds, at) {
-	const allowed = target.kind === "enum" ? "string" : target.kind;
-	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
-	const problems = [];
-	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
-	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
-	return problems;
-}
+var CameraOccupancySnapshotForDeviceSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	read: zod.z.enum(["read", "unreadable"]),
+	snapshot: CameraOccupancySnapshotSchema.nullable()
+});
 /**
-* A string a source produces WITHOUT reading any device — a field-level
-* `expression` source whose compiled AST is a bare string literal (`"red"`,
-* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
-* the kind level (a `from` read of an enum-typed source field, a computed
-* expression) is NOT checked against the target's `enumValues` here: the
-* kind inference already collapsed it to the coarse `'string'` kind, losing
-* whichever enum it actually came from, so membership can only be judged at
-* write time against the runtime-state schema. Known limitation — see the
-* fix report for Task 6 round 1.
+* Time-series resolution. The history methods return one bucket per
+* step over the requested range. Smaller resolutions cost more
+* memory + bandwidth; bound to discrete steps so caller cannot ask
+* for arbitrary fractional buckets.
 */
-function literalStringValue(source) {
-	if (source.kind !== "expression") return null;
-	const compiled = compileExpressionSafe(source.expr);
-	if (!compiled.ok) return null;
-	const ast = compiled.parsed.ast;
-	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
-}
+var HistoryResolutionEnum = zod.z.enum([
+	"minute",
+	"5min",
+	"hour"
+]);
+var HistoryRangeSchema = zod.z.object({
+	/** Range start (epoch ms, inclusive). */
+	from: zod.z.number().int(),
+	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
+	to: zod.z.number().int(),
+	resolution: HistoryResolutionEnum
+});
+var HistoryPointSchema = zod.z.object({
+	/** Bucket midpoint (epoch ms). */
+	ts: zod.z.number().int(),
+	/** Object count averaged over the bucket (rounded to nearest integer). */
+	count: zod.z.number().int().nonnegative()
+});
 /**
-* An enum target whose source is a save-time-KNOWN string literal outside its
-* `enumValues` is refused now rather than left to fail the write later. A
-* dynamic source (a `from` read, a non-literal expression) is left to
-* runtime — see {@link literalStringValue}.
+* Zone Analytics capability — spatial occupancy aggregations over
+* tracked detections. Hosted by `addon-pipeline-analytics`.
+*
+* Live snapshot is mirrored into the `zone-occupancy` device-state
+* slice on every frame; the cap method `getCurrentSnapshot` is a
+* direct read for callers that don't want to subscribe.
+*
+* History methods are sourced from a 60-minute rolling in-memory
+* ring of frame-level samples (sub-second resolution). Queries
+* outside the ring window return empty arrays — durable storage
+* is a follow-up (Step 4b: persisted samples → SQL store).
+*
+* Every history method takes an optional `className` filter:
+* - omitted → bucket count includes ALL classes in scope
+* - present → bucket count restricted to that class
+*
+* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
+* triple covers the three spatial scopes (per-zone, frame-wide,
+* outside-any-zone). Crossing them with `className?` gives the full
+* combinatorial coverage the operator UI requested.
+*
+* ## ⚠️ The three history methods are DEPRECATED
+*
+* They are served from a 60-MINUTE in-memory ring. It dies with the process,
+* so after a restart they report nothing about a night that did happen, and any
+* window past an hour is silently clamped — a caller cannot tell a clamp from
+* an empty scene. The presets in the occupancy chart existed to hide that
+* horizon rather than to answer a question.
+*
+* Use `pipelineAnalytics.readLongTermSeries({ series: 'occupancy', scope })`
+* instead. Those rows are already written for every camera, ~60 bytes per
+* (camera, scope, 5-minute bucket), kept for a year, and survive a restart.
+* Spell the scope with `occupancyScope(zoneId?, className?)` — the same
+* function the writer uses, so the two cannot drift.
+*
+* The ring stays until these three go, and it is the only thing left reading
+* it. Do not add a fourth caller.
 */
-function enumLiteralProblem(cap, target, source, at) {
-	if (target.kind !== "enum" || target.enumValues === void 0) return null;
-	const value = literalStringValue(source);
-	if (value === null || target.enumValues.includes(value)) return null;
-	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
-	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
-}
-function roleOf(source) {
-	if (source.kind !== "expression") return "derived";
-	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
-	if (fieldReads(source).length > 0) return "derived";
-	const compiled = compileExpressionSafe(source.expr);
-	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
-}
+var zoneAnalyticsCapability = {
+	name: "zone-analytics",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Latest computed occupancy snapshot for this camera. Null when
+		*  the analytics pipeline hasn't seen a frame for this device yet
+		*  (no inference result emitted since boot or since binding was
+		*  activated). */
+		getCurrentSnapshot: method(zod.z.object({ deviceId: zod.z.number() }), CameraOccupancySnapshotSchema.nullable()),
+		/**
+		* The same snapshot, for a SET of cameras, in one round trip.
+		*
+		* The Events page's Stationary section polls this every 15s for every
+		* selected camera. Fanned out client-side that is one query per camera to
+		* read a `Map.get` at the owner — the answer costs nothing, the round trip
+		* costs everything. Batched, N transports become one and the per-device
+		* work is unchanged.
+		*
+		* Every requested deviceId gets a row, tagged `read` — see
+		* {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
+		* not answer for is `'unreadable'`, never an empty reading.
+		*/
+		getCurrentSnapshotBatch: method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
+		/** Time-series object count inside one zone. `className` optional —
+		*  omit to count every class in the zone. */
+		getZoneHistory: method(zod.z.object({
+			deviceId: zod.z.number(),
+			zoneId: zod.z.string(),
+			className: zod.z.string().optional()
+		}).extend(HistoryRangeSchema.shape), zod.z.array(HistoryPointSchema).readonly()),
+		/** Time-series frame-wide object count (everywhere). */
+		getCameraHistory: method(zod.z.object({
+			deviceId: zod.z.number(),
+			className: zod.z.string().optional()
+		}).extend(HistoryRangeSchema.shape), zod.z.array(HistoryPointSchema).readonly()),
+		/** Time-series count of objects outside every zone. */
+		getUnzonedHistory: method(zod.z.object({
+			deviceId: zod.z.number(),
+			className: zod.z.string().optional()
+		}).extend(HistoryRangeSchema.shape), zod.z.array(HistoryPointSchema).readonly())
+	},
+	/**
+	* Runtime-state slice — the latest occupancy snapshot mirrored by
+	* the analytics frame processor on every inference result. Consumers
+	* read via `device.state.zoneAnalytics.value` and stay in sync
+	* automatically; the explicit `getCurrentSnapshot` cap method is
+	* still useful for one-off polls without a subscription.
+	*/
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
+};
 /**
-* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
-* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
-* own offline, and D393 forbids a stale number, so on an existing target a
-* field that READS a source never gets `offline`.
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
 */
-function unavailableFor(tf, role, mode, cap, at) {
-	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
-		ok: true,
-		unavailable: "release"
-	};
-	if (mode === "new" || role !== "derived") return {
-		ok: true,
-		unavailable: tf.nullable ? "null" : "offline"
-	};
-	if (tf.nullable) return {
-		ok: true,
-		unavailable: "null"
-	};
-	if (tf.enumValues?.includes("unknown") === true) return {
-		ok: true,
-		unavailable: "unknown"
-	};
-	return {
-		ok: false,
-		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
-	};
-}
-/** Item fields the composer writes itself, with the value it writes. */
-var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
-function reservedItemFields(itemArray) {
-	return new Set([
-		itemArray.keyField,
-		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
-		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
-	]);
-}
-/** A required leaf under an optional parent is required only once something writes that parent. */
-function leafRequired(itemArray, path, written) {
-	const described = describeStateField(itemArray.itemSchema, path);
-	if (described === null || !described.required) return false;
-	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
-}
-function missingLeaves({ capName, itemArray, reserved }, item, at) {
-	const written = Object.keys(item.fields);
-	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
-		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
-		if (!leafRequired(itemArray, leaf.path, written)) return [];
-		const described = describeStateField(itemArray.itemSchema, leaf.path);
-		if (described === null || described.nullable) return [];
-		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
-	});
+var ZoneRuleStageEnum = zod.z.enum([
+	"motion",
+	"detection",
+	"package"
+]);
+/**
+* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
+* arrays that decide how each pipeline stage uses the polygon zones.
+*
+* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
+* so the operator has a single hub-side source of truth for both
+* geometry and behaviour. Per-stage rules are stored under the
+* `zoneRules.<stage>` key in the orchestrator's per-device store and
+* mirrored to the device-state slice `<stage>-zone-rules` on every
+* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
+* subscribe to that slice and refresh their gating without
+* round-tripping the cap.
+*
+* Sets are bulk-replace — the operator UI sends the new rule list
+* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
+* naturally in the rule editor without per-rule mutation chatter.
+*/
+var zoneRulesCapability = {
+	name: "zone-rules",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Read the full rule list for a given stage (empty when no rules
+		*  are defined yet). */
+		listRules: method(zod.z.object({
+			deviceId: zod.z.number(),
+			stage: ZoneRuleStageEnum
+		}), zod.z.array(ZoneRuleSchema).readonly()),
+		/** Bulk-replace the rule list for one stage. The provider validates
+		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+		*  thresholds in range) and rejects the whole patch if any entry
+		*  is invalid — partial writes are a configuration footgun. */
+		setRules: method(zod.z.object({
+			deviceId: zod.z.number(),
+			stage: ZoneRuleStageEnum,
+			rules: zod.z.array(ZoneRuleSchema).readonly()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — every stage mirrored together so consumers
+	* see one reactive handle (`device.state.zoneRules.value`) instead
+	* of one per stage. Bulk-replace mutations on any stage write the full
+	* `{motion, detection, package}` shape, so subscribers always get the
+	* complete current set. Consumers that only care about one stage
+	* just read the matching property.
+	*
+	* `package` backs the package-drop detector — a package zone is a
+	* `ZoneRule` on the `'package'` stage referencing drawn polygons
+	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+	* The orchestrator provider writes this stage as a first-class slice
+	* (Phase 4): every mutation mirrors the full `{motion, detection,
+	* package}` shape, so consumers read the current package rules directly
+	* off `device.state.zoneRules.value.package`.
+	*/
+	runtimeState: zod.z.object({
+		motion: zod.z.array(ZoneRuleSchema).readonly(),
+		detection: zod.z.array(ZoneRuleSchema).readonly(),
+		package: zod.z.array(ZoneRuleSchema).readonly()
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+function isValueOf(slot, value) {
+	return value.slot === slot;
 }
-function planItemField(ctx, leaf) {
-	const { capName, itemArray, featureIndex, lookupCap } = ctx;
-	const { key, label, path, source } = leaf;
-	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
-	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
-	const tf = describeStateField(itemArray.itemSchema, path);
-	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: capName,
-		path,
-		item: {
-			arrayPath: itemArray.path,
-			key,
-			label
-		},
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(capName, tf, source, at);
+/** Bind slot `slot` to its owner's functions. See the module docblock. */
+function defineExtensionSlotProvider(slot, impl) {
 	return {
-		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
+		slot,
+		list: async (deviceId) => {
+			const listing = await impl.list(deviceId);
+			if (listing === null) return null;
+			const value = listing.value;
+			return {
+				...listing,
+				value
+			};
+		},
+		set: async (deviceId, value) => {
+			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
+			return await impl.set(deviceId, value);
+		},
+		candidates: (deviceId) => impl.candidates(deviceId)
 	};
 }
-function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
-	const at = `features[${featureIndex}].items`;
-	const itemArray = def.status?.itemArray;
-	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
-	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
-	const ctx = {
-		capName: def.name,
-		itemArray,
-		reserved: reservedItemFields(itemArray),
-		featureIndex,
-		lookupCap,
-		mode
+/** `<source>:<slotId>`. */
+function extensionSlotRef(source, slot) {
+	return `${source}:${slot}`;
+}
+/** Build the `device-extension` provider one owner registers. */
+function createDeviceExtensionProvider(options) {
+	const { source, label, slots, hostTypeOf, logger } = options;
+	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
+	const resolve = async (deviceId, slotRef) => {
+		const prefix = `${source}:`;
+		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
+		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
+		const hostType = await hostTypeOf(deviceId);
+		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
+		return slot;
 	};
-	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
-		problems: missingLeaves(ctx, item, `${at}.${key}`),
-		fields: [],
-		features: [],
-		events: []
-	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
-		key,
-		label: item.label,
-		path,
-		source
-	}))]);
 	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: [],
-		events: []
+		listSources: async () => [{
+			source,
+			label,
+			availability: { state: "ok" }
+		}],
+		listSlots: async (input) => {
+			const hostType = await hostTypeOf(input.deviceId);
+			const rows = [];
+			for (const slot of slots) {
+				if (!offered(slot.slot, hostType)) continue;
+				const listing = await slot.list(input.deviceId);
+				if (listing === null) continue;
+				rows.push({
+					state: "ok",
+					slotRef: extensionSlotRef(source, slot.slot),
+					slot: slot.slot,
+					authority: listing.authority,
+					activation: listing.activation,
+					value: listing.value,
+					sources: [...listing.sources],
+					...listing.impliedSources !== void 0 ? { impliedSources: [...listing.impliedSources] } : {}
+				});
+			}
+			return rows;
+		},
+		listCandidates: async (input) => {
+			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
+		},
+		setSlot: async (input) => {
+			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
+			logger.info("device-extension: slot written", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					slotRef: input.slotRef,
+					reload: result.reload
+				}
+			});
+			return result;
+		}
 	};
 }
+/**
+* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
+* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
+* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
+* decimals). K derives from `°C = K − 273.15`.
+*/
+var UNIT_TABLE = {
+	"°C": {
+		dimension: "temperature",
+		factor: 1,
+		offset: 0
+	},
+	"°F": {
+		dimension: "temperature",
+		factor: 5 / 9,
+		offset: -160 / 9
+	},
+	K: {
+		dimension: "temperature",
+		factor: 1,
+		offset: -273.15
+	},
+	hPa: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	kPa: {
+		dimension: "pressure",
+		factor: 10,
+		offset: 0
+	},
+	Pa: {
+		dimension: "pressure",
+		factor: .01,
+		offset: 0
+	},
+	mbar: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	bar: {
+		dimension: "pressure",
+		factor: 1e3,
+		offset: 0
+	},
+	inHg: {
+		dimension: "pressure",
+		factor: 33.8639,
+		offset: 0
+	},
+	mmHg: {
+		dimension: "pressure",
+		factor: 1.33322,
+		offset: 0
+	},
+	psi: {
+		dimension: "pressure",
+		factor: 68.9476,
+		offset: 0
+	},
+	"m/s": {
+		dimension: "speed",
+		factor: 1,
+		offset: 0
+	},
+	"km/h": {
+		dimension: "speed",
+		factor: 1 / 3.6,
+		offset: 0
+	},
+	mph: {
+		dimension: "speed",
+		factor: .44704,
+		offset: 0
+	},
+	kn: {
+		dimension: "speed",
+		factor: .514444,
+		offset: 0
+	},
+	"mm/h": {
+		dimension: "precipitation-rate",
+		factor: 1,
+		offset: 0
+	},
+	"in/h": {
+		dimension: "precipitation-rate",
+		factor: 25.4,
+		offset: 0
+	},
+	m: {
+		dimension: "length",
+		factor: 1,
+		offset: 0
+	},
+	mm: {
+		dimension: "length",
+		factor: .001,
+		offset: 0
+	},
+	cm: {
+		dimension: "length",
+		factor: .01,
+		offset: 0
+	},
+	km: {
+		dimension: "length",
+		factor: 1e3,
+		offset: 0
+	},
+	in: {
+		dimension: "length",
+		factor: .0254,
+		offset: 0
+	},
+	ft: {
+		dimension: "length",
+		factor: .3048,
+		offset: 0
+	},
+	mi: {
+		dimension: "length",
+		factor: 1609.344,
+		offset: 0
+	},
+	lx: {
+		dimension: "illuminance",
+		factor: 1,
+		offset: 0
+	},
+	"W/m²": {
+		dimension: "irradiance",
+		factor: 1,
+		offset: 0
+	},
+	W: {
+		dimension: "power",
+		factor: 1,
+		offset: 0
+	},
+	kW: {
+		dimension: "power",
+		factor: 1e3,
+		offset: 0
+	},
+	VA: {
+		dimension: "apparent-power",
+		factor: 1,
+		offset: 0
+	},
+	Wh: {
+		dimension: "energy",
+		factor: 1,
+		offset: 0
+	},
+	kWh: {
+		dimension: "energy",
+		factor: 1e3,
+		offset: 0
+	},
+	MWh: {
+		dimension: "energy",
+		factor: 1e6,
+		offset: 0
+	},
+	V: {
+		dimension: "voltage",
+		factor: 1,
+		offset: 0
+	},
+	mV: {
+		dimension: "voltage",
+		factor: .001,
+		offset: 0
+	},
+	A: {
+		dimension: "current",
+		factor: 1,
+		offset: 0
+	},
+	mA: {
+		dimension: "current",
+		factor: .001,
+		offset: 0
+	},
+	ppm: {
+		dimension: "concentration-volume",
+		factor: 1,
+		offset: 0
+	},
+	ppb: {
+		dimension: "concentration-volume",
+		factor: .001,
+		offset: 0
+	},
+	"µg/m³": {
+		dimension: "concentration-mass",
+		factor: 1,
+		offset: 0
+	},
+	"mg/m³": {
+		dimension: "concentration-mass",
+		factor: 1e3,
+		offset: 0
+	},
+	kg: {
+		dimension: "mass",
+		factor: 1,
+		offset: 0
+	},
+	g: {
+		dimension: "mass",
+		factor: .001,
+		offset: 0
+	},
+	lb: {
+		dimension: "mass",
+		factor: .453592,
+		offset: 0
+	},
+	oz: {
+		dimension: "mass",
+		factor: .0283495,
+		offset: 0
+	},
+	"%": {
+		dimension: "percentage",
+		factor: 1,
+		offset: 0
+	}
+};
+/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
+function specFor(unit) {
+	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
+}
+/** Value in `spec`'s unit → its dimension's canonical unit. */
+function toCanonical(value, spec) {
+	return value * spec.factor + spec.offset;
+}
+/** Canonical-unit value → the unit described by `spec`. */
+function fromCanonical(canonical, spec) {
+	return (canonical - spec.offset) / spec.factor;
+}
+/**
+* Graceful variant for the render path: returns the converted value, or
+* `undefined` when the conversion is refused (unknown unit / cross-dimension).
+* Never throws — a render caller falls back to the raw value + source unit.
+*/
+function tryConvertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) return void 0;
+	const toSpec = specFor(to);
+	if (!toSpec) return void 0;
+	if (fromSpec.dimension !== toSpec.dimension) return void 0;
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+}
+/**
+* One composed field, evaluated from what its sources say NOW (D659).
+*
+* Pure. The composer calls it on every source change, and the slice-5 editor
+* will call it for its live preview, so both see the same answer.
+*
+* The rules (spec §2):
+*  - a source that is offline or unreadable keeps its last value and is marked
+*    STALE; the field is stale and keeps computing (D49);
+*  - a source that is GONE makes the field UNAVAILABLE, `fatal`, and never a
+*    plausible number (D393);
+*  - a source that is unavailable but NOT gone (e.g. a cap unregistered at
+*    runtime, R7b) makes the field UNAVAILABLE, non-fatal, `value: null`: it
+*    may come back on its own, no block failure is raised for it;
+*  - an expression that fails on a value makes the field unavailable for that
+*    value, and NOT fatal: the next value may compute.
+*
+* `confirmed` (D663, D49): whether a NON-fatal unavailability is an ANSWER — a
+* cap the provider unregistered and a re-read agreed, a field the source
+* reported without, an expression that failed on a value — or only the
+* absence of one (a failed read, a first or empty read, a source not tracked
+* yet). Only a confirmed unavailability may hand a `release`-mode field back
+* to the native provider; an unconfirmed one holds it on its last value.
+* Absent means NOT confirmed. Fatal is always confirmed.
+*
+* When an expression has more than one unavailable binding, a FATAL one always
+* wins the outcome, regardless of position: every binding is scanned before
+* the field is judged, so an earlier non-fatal binding (e.g. a cap that is
+* momentarily unregistered) can never hide a later fatal one (a deleted
+* source) behind an early return.
+*/
 function describeRead(read) {
 	return `${compositionSourceKey(read.source)} ${read.cap}.${read.fieldPath}`;
 }
@@ -43607,7 +44360,10 @@ function expressionOutcome(source, read, now, stateful) {
 	}
 	const deadlines = [];
 	const result = evaluateExpressionSource(source.expr, values, now, {
-		hooks: { noteDeadline: (at) => deadlines.push(at) },
+		hooks: {
+			noteDeadline: (at) => deadlines.push(at),
+			convert: (value, from, to) => tryConvertUnit(value, normalizeUnit(from) ?? from, normalizeUnit(to) ?? to) ?? null
+		},
 		...stateful === void 0 ? {} : { invokeStateful: (invocation) => evaluateStatefulExpressionCall(stateful.callPathPrefix === void 0 ? invocation : {
 			...invocation,
 			path: `${stateful.callPathPrefix}@${invocation.path}`
@@ -43645,301 +44401,70 @@ function evaluateCompositionField(input) {
 		};
 	}
 }
-function buildCapabilityLookup(defs) {
-	const byName = new Map(defs.map((d) => [d.name, d]));
-	return (capName) => byName.get(capName) ?? null;
-}
-/** Caps every `BaseDevice` registers on itself; a second registration throws. */
-var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
-var PENDING_SELF = {
-	addonId: COMPOSER_ADDON_ID,
-	stableId: `${COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
-};
-function composableCap(feature, at, lookupCap) {
-	const def = lookupCap(feature.cap);
-	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
-	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
-	const state = def.runtimeState;
-	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
-	return {
-		def,
-		state,
-		fields: describeTopLevelStateFields(state)
-	};
-}
 /**
-* A capability BUILT by the composition (a new device, or one ADDED to an
-* existing device) must fit the device type, serve no command, and have every
-* required field. A REPLACE needs none of it: the cap is bound (a fact), the
-* native keeps serving its methods, and only the named fields are owned (D663).
+* The doorbell of a camera as a customization (D671). ONE builder: the
+* virtual-doorbell migration and the admin UI's "Use as doorbell" preset both
+* call it, so a preset can never write a shape the migration would refuse as
+* "an unrelated existing block".
 */
-function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
-	const problems = [];
-	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
-	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
-	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
-	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
-	for (const key of requiredTopLevelKeys(state)) {
-		if (key === itemArrayPath) continue;
-		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
-		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
-	}
-	return problems;
-}
-function planTopLevelField({ def, fields }, field, mode, lookupCap) {
-	const { featureIndex, path, source } = field;
-	const fieldAt = `features[${featureIndex}].fields.${path}`;
-	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
-	const tf = fields.get(path);
-	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: def.name,
-		path,
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
-	return {
-		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
-	};
-}
-function planFeature(feature, featureIndex, target, lookupCap) {
-	const at = `features[${featureIndex}]`;
-	const cap = composableCap(feature, at, lookupCap);
-	if ("code" in cap) return refused(cap);
-	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
-	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
-	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
-		featureIndex,
-		path,
-		source
-	}, target.mode, lookupCap));
-	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
-	const all = [...perField, ...items];
-	const fields = all.flatMap((result) => result.fields);
-	const featurePlan = {
-		featureIndex,
-		cap: cap.def.name,
-		mode: target.mode
-	};
-	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
-	return {
-		problems: [
-			...capProblems,
-			...all.flatMap((r) => r.problems),
-			...eventPlan.problems
-		],
-		fields,
-		features: [featurePlan],
-		events: eventPlan.events
-	};
-}
-/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
-function isNativeCap(target, cap) {
-	const owner = target.nativeCaps.get(cap);
-	return owner !== void 0 && owner !== "composer";
-}
-/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
-function planTargetOf(composition, target) {
-	if (composition.target.kind === "new") return {
-		kind: "new",
-		type: composition.target.type
-	};
-	const key = compositionSourceKey(composition.target.device);
-	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
-	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
-	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
-	return {
-		kind: "existing",
-		found: target
-	};
-}
-function featureTargetOf(target, cap) {
-	if (target.kind === "new") return {
-		mode: "new",
-		deviceType: target.type
-	};
-	return {
-		mode: isNativeCap(target.found, cap) ? "replace" : "add",
-		deviceType: target.found.type
-	};
+/** A rise closer than this to the previous one is the same press (D671). */
+var DOORBELL_RISE_DEBOUNCE_MS = 2e3;
+/** Every source cap of `source` that `SOURCE_CAP_ACTIVE_FIELD` knows AND the device has bound. */
+function doorbellFeatureSources(source, boundCaps) {
+	return Object.keys(SOURCE_CAP_ACTIVE_FIELD).filter((cap) => Object.hasOwn(SOURCE_CAP_CHANGED_AT_FIELD, cap) && boundCaps.includes(cap)).toSorted().flatMap((cap) => {
+		const activeField = SOURCE_CAP_ACTIVE_FIELD[cap];
+		const changedAtField = SOURCE_CAP_CHANGED_AT_FIELD[cap];
+		return activeField === void 0 || changedAtField === void 0 ? [] : [{
+			source,
+			cap,
+			activeField,
+			changedAtField
+		}];
+	});
 }
-/**
-* The static plan. `target` describes an EXISTING target device (one read);
-* it is ignored for a new one. On an existing target each feature REPLACES a
-* cap the device has natively, else ADDS it (D663).
-*/
-function planComposition(composition, lookupCap, target) {
-	const planTarget = planTargetOf(composition, target);
-	if ("code" in planTarget) return refused(planTarget);
-	const results = composition.features.map((feature, index) => {
-		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
-		return compositionFeatureEnabled(feature) ? result : {
-			problems: result.problems,
-			fields: [],
-			features: [],
-			events: []
+/** The D671 feature, byte for byte what the migration writes. Throws on zero sources. */
+function buildDoorbellCompositionFeature(input) {
+	const sources = [...input.sources].toSorted((a, b) => `${a.source.addonId}/${a.source.stableId}#${a.cap}`.localeCompare(`${b.source.addonId}/${b.source.stableId}#${b.cap}`));
+	if (sources.length === 0) throw new Error("doorbell composition needs at least one source");
+	const edgeBindings = {};
+	sources.forEach((entry, index) => {
+		edgeBindings[`active${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.activeField
+		};
+		edgeBindings[`changed${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.changedAtField
 		};
 	});
 	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: results.flatMap((r) => r.features),
-		events: results.flatMap((r) => r.events)
-	};
-}
-function compositionSourceRefs(composition) {
-	const refs = composition.features.flatMap((f) => compositionFeatureEnabled(f) && f.kind === "fields" ? featureSources(f).flatMap(fieldReads).map((r) => r.source) : []);
-	return [...new Map(refs.map((r) => [compositionSourceKey(r), r])).values()];
-}
-/**
-* The candidate's device: the existing target itself, else `self`, else a
-* placeholder that cannot collide with a stored target. An existing target is
-* known even on create, so a second customization of it is refused on create too.
-*/
-function candidateSelf(composition, ctx, plan) {
-	return {
-		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
-		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
-		replaced: replacedFieldKeys(plan)
-	};
-}
-/**
-* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
-* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
-* derivation, so the graph reads both the same way.
-*/
-function replacedFieldKeys(plan) {
-	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
-	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
-}
-/**
-* A read of the candidate's own device. Its own composed output (a new device's
-* field, an ADDED field) is the slice-1 own-field rule; on an existing target
-* every other field — replaced, or not composed at all — is the NATIVE value,
-* valid when the device serves that cap natively (D663, rule 5).
-*/
-function selfReadProblems(read, at, fields, self) {
-	const readKey = `${read.cap}.${read.fieldPath}`;
-	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
-	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
-	if (isNativeCap(self.native, read.cap)) return [];
-	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
-}
-function sourceProblems(fields, ctx, self) {
-	const selfKey = compositionSourceKey(self.ref);
-	return fields.flatMap((field) => field.reads.flatMap((read) => {
-		const at = compositionFieldAt(field);
-		const key = compositionSourceKey(read.source);
-		if (key === selfKey) return selfReadProblems(read, at, fields, self);
-		const desc = ctx.sources.get(key);
-		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
-		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
-		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
-		return [];
-	}));
-}
-/**
-* A cycle's node keys are `compositionReadKey` strings:
-* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
-* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
-* back out so the refusal can point at that exact field, matching the
-* documented `features[N].fields.<path>` convention. A cap name has no `.`,
-* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
-* (`items[desiccant].status`) is matched through `compositionFieldKey`.
-*/
-function candidateFieldOfNode(nodeKey, candidateKey) {
-	const prefix = `${candidateKey}#`;
-	if (!nodeKey.startsWith(prefix)) return null;
-	const rest = nodeKey.slice(prefix.length);
-	const dot = rest.indexOf(".");
-	if (dot === -1) return null;
-	return {
-		cap: rest.slice(0, dot),
-		fieldPath: rest.slice(dot + 1)
-	};
-}
-/** The first node of a cycle's path that is one of THIS composition's own
-*  planned fields, as a documented-convention path; `'features'` when the
-*  cycle runs entirely through other stored compositions. */
-function cyclePath(nodePath, candidateKey, fields) {
-	for (const nodeKey of nodePath) {
-		const hit = candidateFieldOfNode(nodeKey, candidateKey);
-		if (hit === null) continue;
-		const hitKey = `${hit.cap}.${hit.fieldPath}`;
-		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
-		if (field !== void 0) return compositionFieldAt(field);
-	}
-	return "features";
-}
-/** The first unread device any of `nodes` belongs to; null when none does. */
-function unreadDeviceOf(nodes, unread) {
-	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
-		key,
-		error
-	};
-	return null;
-}
-/**
-* Cycle check runs against the CANDIDATE (this composition, as block
-* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
-* decided per strongly connected component (`findCandidateCycles`): a cyclic
-* component holding a candidate node refuses, with one representative cycle
-* through it; one without is not this save's cycle. A
-* stored composition of the same block is its old version; another block on
-* the same device, or two stored peers sharing a device, make
-* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
-* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
-*/
-function cycleProblems(composition, ctx, fields, self) {
-	const candidate = {
-		blockId: ctx.blockId ?? "(unsaved)",
-		target: self.ref,
-		composition,
-		replaced: self.replaced
-	};
-	const candidateKey = compositionSourceKey(candidate.target);
-	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
-	try {
-		return findCandidateCycles(candidate, ctx.peers).map((c) => {
-			const at = cyclePath(c.path, candidateKey, fields);
-			const through = unreadDeviceOf([...c.component], unread);
-			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
-		});
-	} catch (err) {
-		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
-		throw err;
-	}
-}
-function validateComposition(composition, ctx) {
-	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
-	const self = candidateSelf(composition, ctx, plan);
-	const cycles = cycleProblems(composition, ctx, plan.fields, self);
-	const problems = [
-		...plan.problems,
-		...sourceProblems(plan.fields, ctx, self),
-		...cycles
-	];
-	return {
-		ok: problems.length === 0,
-		problems,
-		fields: [...plan.fields],
-		features: [...plan.features],
-		events: [...plan.events]
+		kind: "fields",
+		cap: "doorbell",
+		enabled: input.enabled,
+		fields: {
+			lastPressedAt: {
+				kind: "expression",
+				expr: `latest(${sources.map((_, index) => `rose(active${index}, changed${index}, ${DOORBELL_RISE_DEBOUNCE_MS})`).join(", ")})`,
+				bindings: edgeBindings
+			},
+			pressCountSinceStart: {
+				kind: "expression",
+				expr: "count(lastPressedAt)",
+				bindings: { lastPressedAt: {
+					kind: "from",
+					source: {
+						addonId: input.camera.addonId,
+						stableId: input.camera.stableId
+					},
+					cap: "doorbell",
+					fieldPath: "lastPressedAt"
+				} }
+			}
+		}
 	};
 }
 /**
@@ -43974,7 +44499,6 @@ var RUNTIME_DEFAULTS = {
 		models: "camstack-data/models"
 	},
 	providers: [],
-	"ffmpeg.binaryPath": "ffmpeg",
 	"ffmpeg.hwAccel": "auto",
 	"ffmpeg.threadCount": 0,
 	"auth.tokenExpiry": "30d"
@@ -47960,6 +48484,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listComposableCaps": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.listCompositions": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -51644,6 +52174,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSensors": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -55354,6 +55890,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraSensors": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepOverride": [{
 		name: "deviceId",
 		form: "single",
@@ -57709,18 +58250,6 @@ Object.defineProperty(exports, "SOURCE_CAPS", {
 		return SOURCE_CAPS;
 	}
 });
-Object.defineProperty(exports, "SOURCE_CAP_ACTIVE_FIELD", {
-	enumerable: true,
-	get: function() {
-		return SOURCE_CAP_ACTIVE_FIELD;
-	}
-});
-Object.defineProperty(exports, "SOURCE_CAP_CHANGED_AT_FIELD", {
-	enumerable: true,
-	get: function() {
-		return SOURCE_CAP_CHANGED_AT_FIELD;
-	}
-});
 Object.defineProperty(exports, "STORAGE_ACCESS_FALLBACK", {
 	enumerable: true,
 	get: function() {
@@ -57847,6 +58376,12 @@ Object.defineProperty(exports, "buildCapabilityLookup", {
 		return buildCapabilityLookup;
 	}
 });
+Object.defineProperty(exports, "buildDoorbellCompositionFeature", {
+	enumerable: true,
+	get: function() {
+		return buildDoorbellCompositionFeature;
+	}
+});
 Object.defineProperty(exports, "buildFfmpegArgs", {
 	enumerable: true,
 	get: function() {
@@ -58009,6 +58544,12 @@ Object.defineProperty(exports, "deriveBatteryPresence", {
 		return deriveBatteryPresence;
 	}
 });
+Object.defineProperty(exports, "describeComposableCaps", {
+	enumerable: true,
+	get: function() {
+		return describeComposableCaps;
+	}
+});
 Object.defineProperty(exports, "deviceExtensionCapability", {
 	enumerable: true,
 	get: function() {
@@ -58039,6 +58580,12 @@ Object.defineProperty(exports, "doorbellCapability", {
 		return doorbellCapability;
 	}
 });
+Object.defineProperty(exports, "doorbellFeatureSources", {
+	enumerable: true,
+	get: function() {
+		return doorbellFeatureSources;
+	}
+});
 Object.defineProperty(exports, "emitDownForOwnedCaps", {
 	enumerable: true,
 	get: function() {
@@ -58261,6 +58808,12 @@ Object.defineProperty(exports, "mayWriteToLocation", {
 		return mayWriteToLocation;
 	}
 });
+Object.defineProperty(exports, "memoizePinnedFfmpeg", {
+	enumerable: true,
+	get: function() {
+		return memoizePinnedFfmpeg;
+	}
+});
 Object.defineProperty(exports, "metricsProviderCapability", {
 	enumerable: true,
 	get: function() {