@camstack/system 1.2.322 → 1.2.323

package/dist/{dist-DENeGKrn.mjs → dist-Bs6UyVGd.mjs}

@@ -11717,6 +11717,899 @@ var CompositionBlockStateSchema = z.object({
 	reason: z.string().optional(),
 	fields: z.array(CompositionFieldStateSchema)
 });
+function problem(code, path, message) {
+	return {
+		code,
+		path,
+		message
+	};
+}
+function refused(...problems) {
+	return {
+		problems,
+		fields: [],
+		features: [],
+		events: []
+	};
+}
+/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
+function compositionFieldAt(field) {
+	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
+	return `features[${field.featureIndex}].${inner}.${field.path}`;
+}
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
+var BUILTIN_RESULT_KINDS = Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+var KindInferenceError = class extends Error {};
+function kindOfValue(value) {
+	if (value === null) return "null";
+	if (typeof value === "number") return "number";
+	if (typeof value === "string") return "string";
+	return "boolean";
+}
+function only(kind) {
+	return new Set([kind]);
+}
+function union(...sets) {
+	return new Set(sets.flatMap((s) => [...s]));
+}
+function withoutNull(set) {
+	return new Set([...set].filter((k) => k !== "null"));
+}
+function binaryKinds(op, left, right) {
+	if (op === "+") {
+		const all = [...left, ...right];
+		if (all.every((k) => k === "string")) return only("string");
+		if (all.every((k) => k === "number")) return only("number");
+		return new Set(["number", "string"]);
+	}
+	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
+	return only("boolean");
+}
+/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
+function arityRange(builtin) {
+	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
+	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
+	return `${builtin.minArgs}–${builtin.maxArgs}`;
+}
+function callKinds(callee, args) {
+	const builtin = EXPRESSION_BUILTINS[callee];
+	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
+	const rule = BUILTIN_RESULT_KINDS[callee];
+	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
+	if (rule.kind === "fixed") return new Set(rule.result);
+	const nonNull = union(...args.map(withoutNull));
+	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
+}
+function kindsOf(node, bindings) {
+	switch (node.kind) {
+		case "literal": return only(kindOfValue(node.value));
+		case "identifier": {
+			if (node.name === "now") return only("number");
+			const bound = bindings.get(node.name);
+			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
+			return bound;
+		}
+		case "unary": return only(node.op === "!" ? "boolean" : "number");
+		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
+		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
+	}
+}
+function nodeContainsCall(node, callee) {
+	switch (node.kind) {
+		case "literal":
+		case "identifier": return false;
+		case "unary": return nodeContainsCall(node.operand, callee);
+		case "binary":
+		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
+		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
+		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
+	}
+}
+function expressionContainsBuiltinCall(expr, callee) {
+	const compiled = compileExpressionSafe(expr);
+	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
+}
+function inferExpressionKinds(input) {
+	const compiled = compileExpressionSafe(input.expr);
+	if (!compiled.ok) return {
+		ok: false,
+		error: compiled.error
+	};
+	try {
+		return {
+			ok: true,
+			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
+		};
+	} catch (err) {
+		if (err instanceof KindInferenceError) return {
+			ok: false,
+			error: err.message
+		};
+		throw err;
+	}
+}
+/**
+* The kind half of planning a composition field (D659): which kinds a source
+* can produce, whether they fit a target field, and the field's role.
+* Shared by the top-level planner (`validate-composition.ts`) and the item
+* planner (`composition-items.ts`). Internal to the composition module — NOT
+* in the barrel: these are planner internals, not a published contract.
+*/
+function readKinds(read, lookupCap) {
+	const def = lookupCap(read.cap);
+	const schema = def?.runtimeState ?? def?.status?.schema;
+	if (def === null || schema === void 0) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `no capability \`${read.cap}\` with state to read`
+	};
+	const field = describeStateField(schema, read.fieldPath);
+	if (field === null) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
+	};
+	const base = field.kind === "enum" ? "string" : field.kind;
+	return {
+		ok: true,
+		kinds: new Set(field.nullable ? [base, "null"] : [base])
+	};
+}
+function sourceKinds(source, lookupCap) {
+	if (source.kind === "from") return readKinds(source, lookupCap);
+	if (source.kind === "code") return {
+		ok: false,
+		code: "reserved-variant",
+		message: "code fields arrive in slice 4"
+	};
+	const bindingKinds = /* @__PURE__ */ new Map();
+	for (const [name, binding] of Object.entries(source.bindings)) {
+		if (binding.kind === "literal") {
+			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
+			continue;
+		}
+		const kinds = readKinds(binding, lookupCap);
+		if (!kinds.ok) return {
+			...kinds,
+			message: `binding \`${name}\`: ${kinds.message}`
+		};
+		bindingKinds.set(name, kinds.kinds);
+	}
+	const inferred = inferExpressionKinds({
+		expr: source.expr,
+		bindingKinds
+	});
+	return inferred.ok ? {
+		ok: true,
+		kinds: inferred.kinds
+	} : {
+		ok: false,
+		code: "expression-invalid",
+		message: inferred.error
+	};
+}
+function compatibility(cap, target, kinds, at) {
+	const allowed = target.kind === "enum" ? "string" : target.kind;
+	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
+	const problems = [];
+	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
+	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
+	return problems;
+}
+/**
+* A string a source produces WITHOUT reading any device — a field-level
+* `expression` source whose compiled AST is a bare string literal (`"red"`,
+* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
+* the kind level (a `from` read of an enum-typed source field, a computed
+* expression) is NOT checked against the target's `enumValues` here: the
+* kind inference already collapsed it to the coarse `'string'` kind, losing
+* whichever enum it actually came from, so membership can only be judged at
+* write time against the runtime-state schema. Known limitation — see the
+* fix report for Task 6 round 1.
+*/
+function literalStringValue(source) {
+	if (source.kind !== "expression") return null;
+	const compiled = compileExpressionSafe(source.expr);
+	if (!compiled.ok) return null;
+	const ast = compiled.parsed.ast;
+	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
+}
+/**
+* An enum target whose source is a save-time-KNOWN string literal outside its
+* `enumValues` is refused now rather than left to fail the write later. A
+* dynamic source (a `from` read, a non-literal expression) is left to
+* runtime — see {@link literalStringValue}.
+*/
+function enumLiteralProblem(cap, target, source, at) {
+	if (target.kind !== "enum" || target.enumValues === void 0) return null;
+	const value = literalStringValue(source);
+	if (value === null || target.enumValues.includes(value)) return null;
+	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
+	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
+}
+function roleOf(source) {
+	if (source.kind !== "expression") return "derived";
+	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
+	if (fieldReads(source).length > 0) return "derived";
+	const compiled = compileExpressionSafe(source.expr);
+	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
+}
+/**
+* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
+* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
+* own offline, and D393 forbids a stale number, so on an existing target a
+* field that READS a source never gets `offline`.
+*/
+function unavailableFor(tf, role, mode, cap, at) {
+	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
+		ok: true,
+		unavailable: "release"
+	};
+	if (mode === "new" || role !== "derived") return {
+		ok: true,
+		unavailable: tf.nullable ? "null" : "offline"
+	};
+	if (tf.nullable) return {
+		ok: true,
+		unavailable: "null"
+	};
+	if (tf.enumValues?.includes("unknown") === true) return {
+		ok: true,
+		unavailable: "unknown"
+	};
+	return {
+		ok: false,
+		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
+	};
+}
+/** Item fields the composer writes itself, with the value it writes. */
+var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
+function reservedItemFields(itemArray) {
+	return new Set([
+		itemArray.keyField,
+		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
+		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
+	]);
+}
+/** A required leaf under an optional parent is required only once something writes that parent. */
+function leafRequired(itemArray, path, written) {
+	const described = describeStateField(itemArray.itemSchema, path);
+	if (described === null || !described.required) return false;
+	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
+}
+function missingLeaves({ capName, itemArray, reserved }, item, at) {
+	const written = Object.keys(item.fields);
+	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
+		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
+		if (!leafRequired(itemArray, leaf.path, written)) return [];
+		const described = describeStateField(itemArray.itemSchema, leaf.path);
+		if (described === null || described.nullable) return [];
+		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
+	});
+}
+function planItemField(ctx, leaf) {
+	const { capName, itemArray, featureIndex, lookupCap } = ctx;
+	const { key, label, path, source } = leaf;
+	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
+	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
+	const tf = describeStateField(itemArray.itemSchema, path);
+	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: capName,
+		path,
+		item: {
+			arrayPath: itemArray.path,
+			key,
+			label
+		},
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(capName, tf, source, at);
+	return {
+		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
+	const at = `features[${featureIndex}].items`;
+	const itemArray = def.status?.itemArray;
+	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
+	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
+	const ctx = {
+		capName: def.name,
+		itemArray,
+		reserved: reservedItemFields(itemArray),
+		featureIndex,
+		lookupCap,
+		mode
+	};
+	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
+		problems: missingLeaves(ctx, item, `${at}.${key}`),
+		fields: [],
+		features: [],
+		events: []
+	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
+		key,
+		label: item.label,
+		path,
+		source
+	}))]);
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: [],
+		events: []
+	};
+}
+/**
+* The field graph across every composition, and the cycles in it (D659).
+*
+* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
+* edge points from a composed field to each field it reads. A cycle, direct or
+* through another composition, is refused at save by name (spec §2).
+*
+* The graph is built for ONE save: the CANDIDATE composition (the one being
+* validated) plus every STORED composition. The candidate replaces its own old
+* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
+* introduces or removes a cycle must never depend on array order. A DIFFERENT
+* block targeting the candidate's device is refused by name: one composition
+* per device (D663). Two different stored peers that (wrongly) target the same
+* device are corrupted state, not a cycle to resolve by picking one silently;
+* that is refused by name too (D391).
+*
+* A customization of an EXISTING device reads that device's NATIVE value for a
+* field it replaces or does not write ("Invert state" reads the `on` it
+* replaces): such a self-read is no edge, so it is never a cycle (D663).
+* Another composition reading that field reads the customizer's output.
+*
+* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
+* marks a node `done` after its first expansion) — not every elementary cycle
+* through a shared node, so the path it names may AVOID the candidate while
+* one through it goes unreported. What a save refuses is therefore decided per
+* strongly connected component (`findCandidateCycles`, C-1). A dotted
+* `fieldPath` is matched only as an exact string: a write to `state.value` and
+* a read of `state` would not connect (no nested field writes exist yet).
+*
+* An item leaf is its own node, `…#consumables.items[desiccant].status`
+* (`featureFieldEntries`), so two items sharing an inner path never merge. No
+* READ can name an array element (`describeStateField` never describes one),
+* so an item node is write-only: its edges to sources are what the check needs.
+*/
+/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
+var CompositionGraphError = class extends Error {};
+/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
+function writtenFields(peer) {
+	return new Set(peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
+}
+/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
+function readsComposedValue(peer, written, read) {
+	if (compositionSourceKey(read.source) !== compositionSourceKey(peer.target)) return true;
+	const field = `${read.cap}.${read.fieldPath}`;
+	return written.has(field) && peer.replaced?.has(field) !== true;
+}
+function peerEdges(peer) {
+	const written = writtenFields(peer);
+	return peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath, source }) => [compositionReadKey({
+		source: peer.target,
+		cap: feature.cap,
+		fieldPath
+	}), fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(compositionReadKey)]));
+}
+/**
+* Every peer that actually takes part in the graph: each stored peer minus the
+* candidate's own old version (same block id — the drop happens before any
+* edge is built, so its old edges never enter the map), plus the candidate
+* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
+* block targets the candidate's device, or two stored peers share a device.
+*/
+function resolvedPeers(candidate, stored) {
+	const candidateKey = compositionSourceKey(candidate.target);
+	const survivors = /* @__PURE__ */ new Map();
+	for (const peer of stored) {
+		if (peer.blockId === candidate.blockId) continue;
+		const key = compositionSourceKey(peer.target);
+		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
+		const clash = survivors.get(key);
+		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
+		survivors.set(key, peer);
+	}
+	return [...survivors.values(), candidate];
+}
+function compositionEdges(candidate, stored) {
+	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
+	return new Map(edges);
+}
+/** Tarjan's strongly connected components over every node of the graph (sources included). */
+function stronglyConnected(edges) {
+	const index = /* @__PURE__ */ new Map();
+	const low = /* @__PURE__ */ new Map();
+	const onStack = /* @__PURE__ */ new Set();
+	const stack = [];
+	const components = [];
+	const connect = (node) => {
+		index.set(node, index.size);
+		low.set(node, index.get(node) ?? 0);
+		stack.push(node);
+		onStack.add(node);
+		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
+			connect(next);
+			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
+		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
+		if (low.get(node) !== index.get(node)) return;
+		const component = [];
+		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
+			onStack.delete(member);
+			component.push(member);
+			if (member === node) break;
+		}
+		components.push(component);
+	};
+	for (const node of edges.keys()) if (!index.has(node)) connect(node);
+	return components;
+}
+/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
+function cycleThrough(start, component, edges) {
+	const parent = /* @__PURE__ */ new Map();
+	const queue = [start];
+	for (let head = 0; head < queue.length; head += 1) {
+		const node = queue[head];
+		if (node === void 0) break;
+		for (const next of edges.get(node) ?? []) {
+			if (next === start) {
+				const chain = [];
+				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
+				return [
+					start,
+					...chain.reverse(),
+					start
+				];
+			}
+			if (!component.has(next) || parent.has(next)) continue;
+			parent.set(next, node);
+			queue.push(next);
+		}
+	}
+	return [start, start];
+}
+/**
+* The cycles THIS save closes, decided per strongly connected component — never
+* per reported DFS path, which names one back-edge per revisit and can report a
+* component's cycle by a path that avoids the candidate while the one through it
+* goes unreported. A component refuses when it holds a candidate node and a
+* cycle (more than one node, or a self-loop). Components without a candidate
+* node are not this save's cycles.
+*/
+function findCandidateCycles(candidate, stored) {
+	const edges = compositionEdges(candidate, stored);
+	const prefix = `${compositionSourceKey(candidate.target)}#`;
+	return stronglyConnected(edges).flatMap((members) => {
+		const start = members.find((n) => n.startsWith(prefix));
+		if (start === void 0) return [];
+		const component = new Set(members);
+		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
+		if (members.length === 1 && !selfLoop) return [];
+		return [{
+			path: cycleThrough(start, component, edges),
+			component
+		}];
+	});
+}
+function buildCapabilityLookup(defs) {
+	const byName = new Map(defs.map((d) => [d.name, d]));
+	return (capName) => byName.get(capName) ?? null;
+}
+/** Caps every `BaseDevice` registers on itself; a second registration throws. */
+var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
+var PENDING_SELF = {
+	addonId: COMPOSER_ADDON_ID,
+	stableId: `${COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
+};
+function composableCap(feature, at, lookupCap) {
+	const def = lookupCap(feature.cap);
+	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
+	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
+	return {
+		def,
+		state,
+		fields: describeTopLevelStateFields(state)
+	};
+}
+/**
+* A capability BUILT by the composition (a new device, or one ADDED to an
+* existing device) must fit the device type, serve no command, and have every
+* required field. A REPLACE needs none of it: the cap is bound (a fact), the
+* native keeps serving its methods, and only the named fields are owned (D663).
+*/
+function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
+	const problems = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
+	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
+	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
+	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
+	for (const key of requiredTopLevelKeys(state)) {
+		if (key === itemArrayPath) continue;
+		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
+		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
+	}
+	return problems;
+}
+function planTopLevelField({ def, fields }, field, mode, lookupCap) {
+	const { featureIndex, path, source } = field;
+	const fieldAt = `features[${featureIndex}].fields.${path}`;
+	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
+	const tf = fields.get(path);
+	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: def.name,
+		path,
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
+	return {
+		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planFeature(feature, featureIndex, target, lookupCap) {
+	const at = `features[${featureIndex}]`;
+	const cap = composableCap(feature, at, lookupCap);
+	if ("code" in cap) return refused(cap);
+	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
+	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
+	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
+		featureIndex,
+		path,
+		source
+	}, target.mode, lookupCap));
+	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
+	const all = [...perField, ...items];
+	const fields = all.flatMap((result) => result.fields);
+	const featurePlan = {
+		featureIndex,
+		cap: cap.def.name,
+		mode: target.mode
+	};
+	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
+	return {
+		problems: [
+			...capProblems,
+			...all.flatMap((r) => r.problems),
+			...eventPlan.problems
+		],
+		fields,
+		features: [featurePlan],
+		events: eventPlan.events
+	};
+}
+/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
+function isNativeCap(target, cap) {
+	const owner = target.nativeCaps.get(cap);
+	return owner !== void 0 && owner !== "composer";
+}
+/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
+function planTargetOf(composition, target) {
+	if (composition.target.kind === "new") return {
+		kind: "new",
+		type: composition.target.type
+	};
+	const key = compositionSourceKey(composition.target.device);
+	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
+	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
+	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
+	return {
+		kind: "existing",
+		found: target
+	};
+}
+function featureTargetOf(target, cap) {
+	if (target.kind === "new") return {
+		mode: "new",
+		deviceType: target.type
+	};
+	return {
+		mode: isNativeCap(target.found, cap) ? "replace" : "add",
+		deviceType: target.found.type
+	};
+}
+/**
+* The static plan. `target` describes an EXISTING target device (one read);
+* it is ignored for a new one. On an existing target each feature REPLACES a
+* cap the device has natively, else ADDS it (D663).
+*/
+function planComposition(composition, lookupCap, target) {
+	const planTarget = planTargetOf(composition, target);
+	if ("code" in planTarget) return refused(planTarget);
+	const results = composition.features.map((feature, index) => {
+		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
+		return compositionFeatureEnabled(feature) ? result : {
+			problems: result.problems,
+			fields: [],
+			features: [],
+			events: []
+		};
+	});
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: results.flatMap((r) => r.features),
+		events: results.flatMap((r) => r.events)
+	};
+}
+function compositionSourceRefs(composition) {
+	const refs = composition.features.flatMap((f) => compositionFeatureEnabled(f) && f.kind === "fields" ? featureSources(f).flatMap(fieldReads).map((r) => r.source) : []);
+	return [...new Map(refs.map((r) => [compositionSourceKey(r), r])).values()];
+}
+/**
+* The candidate's device: the existing target itself, else `self`, else a
+* placeholder that cannot collide with a stored target. An existing target is
+* known even on create, so a second customization of it is refused on create too.
+*/
+function candidateSelf(composition, ctx, plan) {
+	return {
+		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
+		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
+		replaced: replacedFieldKeys(plan)
+	};
+}
+/**
+* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
+* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
+* derivation, so the graph reads both the same way.
+*/
+function replacedFieldKeys(plan) {
+	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
+	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
+}
+/**
+* A read of the candidate's own device. Its own composed output (a new device's
+* field, an ADDED field) is the slice-1 own-field rule; on an existing target
+* every other field — replaced, or not composed at all — is the NATIVE value,
+* valid when the device serves that cap natively (D663, rule 5).
+*/
+function selfReadProblems(read, at, fields, self) {
+	const readKey = `${read.cap}.${read.fieldPath}`;
+	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
+	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
+	if (isNativeCap(self.native, read.cap)) return [];
+	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
+}
+function sourceProblems(fields, ctx, self) {
+	const selfKey = compositionSourceKey(self.ref);
+	return fields.flatMap((field) => field.reads.flatMap((read) => {
+		const at = compositionFieldAt(field);
+		const key = compositionSourceKey(read.source);
+		if (key === selfKey) return selfReadProblems(read, at, fields, self);
+		const desc = ctx.sources.get(key);
+		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
+		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
+		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
+		return [];
+	}));
+}
+/**
+* A cycle's node keys are `compositionReadKey` strings:
+* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
+* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
+* back out so the refusal can point at that exact field, matching the
+* documented `features[N].fields.<path>` convention. A cap name has no `.`,
+* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
+* (`items[desiccant].status`) is matched through `compositionFieldKey`.
+*/
+function candidateFieldOfNode(nodeKey, candidateKey) {
+	const prefix = `${candidateKey}#`;
+	if (!nodeKey.startsWith(prefix)) return null;
+	const rest = nodeKey.slice(prefix.length);
+	const dot = rest.indexOf(".");
+	if (dot === -1) return null;
+	return {
+		cap: rest.slice(0, dot),
+		fieldPath: rest.slice(dot + 1)
+	};
+}
+/** The first node of a cycle's path that is one of THIS composition's own
+*  planned fields, as a documented-convention path; `'features'` when the
+*  cycle runs entirely through other stored compositions. */
+function cyclePath(nodePath, candidateKey, fields) {
+	for (const nodeKey of nodePath) {
+		const hit = candidateFieldOfNode(nodeKey, candidateKey);
+		if (hit === null) continue;
+		const hitKey = `${hit.cap}.${hit.fieldPath}`;
+		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
+		if (field !== void 0) return compositionFieldAt(field);
+	}
+	return "features";
+}
+/** The first unread device any of `nodes` belongs to; null when none does. */
+function unreadDeviceOf(nodes, unread) {
+	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
+		key,
+		error
+	};
+	return null;
+}
+/**
+* Cycle check runs against the CANDIDATE (this composition, as block
+* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
+* decided per strongly connected component (`findCandidateCycles`): a cyclic
+* component holding a candidate node refuses, with one representative cycle
+* through it; one without is not this save's cycle. A
+* stored composition of the same block is its old version; another block on
+* the same device, or two stored peers sharing a device, make
+* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
+* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
+*/
+function cycleProblems(composition, ctx, fields, self) {
+	const candidate = {
+		blockId: ctx.blockId ?? "(unsaved)",
+		target: self.ref,
+		composition,
+		replaced: self.replaced
+	};
+	const candidateKey = compositionSourceKey(candidate.target);
+	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
+	try {
+		return findCandidateCycles(candidate, ctx.peers).map((c) => {
+			const at = cyclePath(c.path, candidateKey, fields);
+			const through = unreadDeviceOf([...c.component], unread);
+			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
+		});
+	} catch (err) {
+		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
+		throw err;
+	}
+}
+function validateComposition(composition, ctx) {
+	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
+	const self = candidateSelf(composition, ctx, plan);
+	const cycles = cycleProblems(composition, ctx, plan.fields, self);
+	const problems = [
+		...plan.problems,
+		...sourceProblems(plan.fields, ctx, self),
+		...cycles
+	];
+	return {
+		ok: problems.length === 0,
+		problems,
+		fields: [...plan.fields],
+		features: [...plan.features],
+		events: [...plan.events]
+	};
+}
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = z.object({
+	path: z.string(),
+	kind: CompositionFieldKindSchema,
+	nullable: z.boolean(),
+	required: z.boolean(),
+	enumValues: z.array(z.string()).optional()
+});
+var ComposableCapabilitySchema = z.object({
+	cap: z.string(),
+	fields: z.array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: z.object({
+		path: z.string(),
+		keyField: z.string()
+	}).optional()
+});
+var ComposableCapabilitiesSchema = z.object({ caps: z.array(ComposableCapabilitySchema) });
+/** Why a cap cannot be BUILT (new device, or added to an existing one) on `deviceType`; [] = it can. */
+function builtCapabilityBlockers(def, deviceType) {
+	if (BASE_DEVICE_CAPS.has(def.name)) return ["not-composable"];
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return ["not-composable"];
+	const blockers = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) blockers.push("wrong-device-type");
+	if (Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).length > 0) blockers.push("has-commands");
+	const fields = describeTopLevelStateFields(state);
+	const itemArrayPath = def.status?.itemArray?.path ?? null;
+	if (requiredTopLevelKeys(state).some((key) => key !== itemArrayPath && !fields.has(key))) blockers.push("not-composable");
+	if (planCompositionEvents(def, {
+		featureIndex: 0,
+		cap: def.name,
+		mode: "new"
+	}, []).problems.some((p) => p.code === "not-composable") && !blockers.includes("not-composable")) blockers.push("not-composable");
+	return blockers;
+}
+/** Every cap with no blocker, sorted by name. */
+function describeComposableCaps(defs, deviceType) {
+	return defs.filter((def) => builtCapabilityBlockers(def, deviceType).length === 0).map((def) => {
+		const state = def.runtimeState;
+		const fields = state === void 0 ? [] : [...describeTopLevelStateFields(state).values()];
+		const itemArray = def.status?.itemArray;
+		return {
+			cap: def.name,
+			fields: fields.map((f) => ({
+				path: f.path,
+				kind: f.kind,
+				nullable: f.nullable,
+				required: f.required,
+				...f.enumValues === void 0 ? {} : { enumValues: [...f.enumValues] }
+			})),
+			...itemArray === void 0 ? {} : { itemArray: {
+				path: itemArray.path,
+				keyField: itemArray.keyField
+			} }
+		};
+	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
+}
 /**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
 * its own process.
@@ -12013,6 +12906,14 @@ var coreBlocksCapability = {
 			stableId: z.string().min(1)
 		}), CompositionCustomizationReadSchema, { auth: "admin" }),
 		/**
+		* The capabilities a composition may BUILD on a device of `deviceType`
+		* (a new device, or added to an existing one), with their fields — the
+		* editor's feature list and the presets' availability (G2, D676). Built
+		* from the validator's own blockers; a replace of a BOUND cap is not
+		* listed here (the device's bindings say what it has).
+		*/
+		listComposableCaps: method(z.object({ deviceType: z.enum(DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
+		/**
 		* Validate without saving — the same verdict the save reaches. A mutation
 		* for its body size; it writes nothing, so its access is `view`.
 		*/
@@ -20992,7 +21893,7 @@ function cameraSensorRefKey(ref) {
 }
 /** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
 var CameraSensorsModeSchema = z.enum(["in-addition"]);
-z.object({
+var CameraSensorsConfigSchema = z.object({
 	mode: CameraSensorsModeSchema,
 	sensors: z.array(CameraSensorRefSchema).min(1).max(8)
 }).superRefine((value, ctx) => {
@@ -26179,6 +27080,16 @@ var NodeInferenceDevicesSchema = z.object({
 * Strictly the control plane: never sees a frame, never calls inference,
 * never drains queues. The runner does that work locally on each agent.
 */
+/**
+* The input of `setCameraSensors` (G5, D676): the ONE typed write path of a
+* camera's attached sensors (D672). `config: null` removes the attachment —
+* the camera reads `not-configured` again, never `unreadable`.
+*/
+var SetCameraSensorsInputSchema = z.object({
+	deviceId: z.number().int().nonnegative(),
+	/** `null` removes the attachment: the camera goes back to `not-configured`. */
+	config: CameraSensorsConfigSchema.nullable()
+});
 var pipelineOrchestratorCapability = {
 	name: "pipeline-orchestrator",
 	scope: "system",
@@ -26644,6 +27555,18 @@ var pipelineOrchestratorCapability = {
 		*/
 		getCameraStatuses: method(z.object({ deviceIds: z.array(z.number()).optional() }), z.array(CameraStatusSchema).readonly()),
 		/**
+		* Attach sensors to a camera, or detach them with `config: null` (D672
+		* configuration, G5/D676). Written to the orchestrator's per-device store
+		* under the same key `applyDeviceSettingsPatch` writes, and announced as a
+		* settings change so the camera-sensors bridge refreshes. Refused by name
+		* — nothing written — for a device that cannot be read, does not exist,
+		* is not a camera, or names itself as its own sensor.
+		*/
+		setCameraSensors: method(SetCameraSensorsInputSchema, z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
 		* the addon process and returns immediately with the job snapshot — the
 		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
@@ -42641,978 +43564,736 @@ var WeatherStatusSchema = z.object({
 	/** Pressure unit string (e.g. `hPa` / `inHg`). Null when not provided. */
 	pressureUnit: z.string().nullable(),
 	/** Wind speed in the reported unit. Null when not provided. */
-	windSpeed: z.number().nullable(),
-	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
-	windSpeedUnit: z.string().nullable(),
-	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
-	windBearing: z.number().nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastFetchedAt: z.number()
-});
-var weatherCapability = {
-	name: "weather",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Weather],
-	methods: {},
-	status: {
-		schema: WeatherStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. The UI reads the
-	* current conditions directly from the slice on each weather push.
-	*/
-	runtimeState: WeatherStatusSchema,
-	/**
-	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-/**
-* Per-zone occupancy aggregation produced by the analytics frame
-* processor on every inference result. Covers the full combinatorial
-* matrix the operator UI needs: total objects everywhere, total
-* objects per zone, single class everywhere, single class per zone,
-* objects outside any zone.
-*
-* Counts are derived from the analytics tracker (tracked detections
-* with stable trackIds), not raw detector hits — this filters out
-* one-off detector flickers and gives counts that match what the user
-* sees on the live overlay.
-*
-* Overlap policy: a detection that intersects two zones counts in
-* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
-* `frame` aggregate de-duplicates trivially since it's frame-wide.
-* `unzoned` counts only detections that landed in zero zones.
-*/
-var PerScopeBreakdownSchema = z.object({
-	/** Total tracked objects in this scope (frame / zone / unzoned). */
-	totalObjects: z.number().int().nonnegative(),
-	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
-	byClass: z.record(z.string(), z.number().int().nonnegative()),
-	/**
-	* Of `totalObjects`, how many are STANDING — objects the census holds,
-	* present but not going anywhere (a parked car, a bin, a statue).
-	*
-	* The operator's question about a scene has two halves and they answer
-	* different things: "what is parked here" is stable for hours and must not
-	* flap, while "who is walking through" is the thing an alert is about. One
-	* number could only serve one of them, and `totalObjects` served the first
-	* badly — a passer-by moved it and every occupancy rule saw a change.
-	*
-	* `standing + transient === totalObjects`, always. The total keeps its old
-	* meaning exactly, so no rule written against it changes behaviour.
-	*
-	* ABSENT means UNKNOWN, never zero (D393): a snapshot from a node older than
-	* this field cannot say, and a reader that folds absence in as 0 reports "no
-	* parked objects here" about a camera whose lot is full.
-	*/
-	standingObjects: z.number().int().nonnegative().optional(),
-	/** Of `totalObjects`, how many are passing through. See `standingObjects` —
-	*  same absence rule. */
-	transientObjects: z.number().int().nonnegative().optional()
-});
-var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
-	zoneId: z.string(),
-	zoneName: z.string(),
-	/** TrackIds of objects currently inside this zone — for cross-reference
-	*  with the per-track detail panel and live overlay. */
-	trackIds: z.array(z.string()).readonly()
-});
-/**
-* A parked ("stationary") object surfaced alongside occupancy — an object that
-* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
-* told to forget it so it stops re-spawning tracks/events), but it IS still
-* physically present, so it keeps counting toward `frame` occupancy and is
-* listed here so the UI can show it in a dedicated "Stationary" section instead
-* of flooding the live event feed.
-*/
-var StationaryObjectSchema = z.object({
-	id: z.string(),
-	className: z.string(),
-	bbox: z.object({
-		x: z.number(),
-		y: z.number(),
-		w: z.number(),
-		h: z.number()
-	}),
-	frameWidth: z.number().int().nonnegative(),
-	frameHeight: z.number().int().nonnegative(),
-	/** When the source track was first seen. */
-	firstSeenAt: z.number().int(),
-	/** When the object was recognised as parked (promotion time). */
-	becameStationaryAt: z.number().int(),
-	/** Last frame a detection confirmed the object is still there. */
-	lastConfirmedAt: z.number().int(),
-	/** Enrichment label carried from the source track (identity / plate). */
-	label: z.string().optional(),
-	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaId: z.number().int().optional()
-});
-var CameraOccupancySnapshotSchema = z.object({
-	/** Frame timestamp of the inference result that produced this snapshot. */
-	ts: z.number().int(),
-	/** Frame width/height in pixels — let the UI normalize bbox coords. */
-	frameWidth: z.number().int().nonnegative(),
-	frameHeight: z.number().int().nonnegative(),
-	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
-	zones: z.array(ZoneScopeBreakdownSchema).readonly(),
-	/** Frame-wide aggregate (everywhere, regardless of zone membership).
-	*  INCLUDES currently-confirmed stationary objects (they are still present). */
-	frame: PerScopeBreakdownSchema,
-	/** Detections that landed outside every zone. Empty when no zones defined. */
-	unzoned: PerScopeBreakdownSchema,
-	/** Parked objects on this camera (additive — absent on legacy snapshots).
-	*  Surfaced separately so the UI shows them in a dedicated section rather
-	*  than as repeated tracks/events. */
-	stationaryObjects: z.array(StationaryObjectSchema).readonly().optional()
-});
-/**
-* One camera's row in a `getCurrentSnapshotBatch` answer.
-*
-* THREE outcomes, and the single-camera method could only express two of them
-* because `snapshot: null` was already spoken for:
-*
-*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
-*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
-*    yet: no frame since boot, and no parked-object registry to hydrate from.
-*  - `read: 'unreadable'`               — the owner could not answer for this
-*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
-*
-* Collapsing the last two is the failure this field exists to prevent: a
-* hydration that threw would otherwise render as an empty Stationary section,
-* which is a definite claim about a camera nobody could read.
-*/
-var CameraOccupancySnapshotForDeviceSchema = z.object({
-	deviceId: z.number(),
-	read: z.enum(["read", "unreadable"]),
-	snapshot: CameraOccupancySnapshotSchema.nullable()
-});
-/**
-* Time-series resolution. The history methods return one bucket per
-* step over the requested range. Smaller resolutions cost more
-* memory + bandwidth; bound to discrete steps so caller cannot ask
-* for arbitrary fractional buckets.
-*/
-var HistoryResolutionEnum = z.enum([
-	"minute",
-	"5min",
-	"hour"
-]);
-var HistoryRangeSchema = z.object({
-	/** Range start (epoch ms, inclusive). */
-	from: z.number().int(),
-	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
-	to: z.number().int(),
-	resolution: HistoryResolutionEnum
-});
-var HistoryPointSchema = z.object({
-	/** Bucket midpoint (epoch ms). */
-	ts: z.number().int(),
-	/** Object count averaged over the bucket (rounded to nearest integer). */
-	count: z.number().int().nonnegative()
-});
-/**
-* Zone Analytics capability — spatial occupancy aggregations over
-* tracked detections. Hosted by `addon-pipeline-analytics`.
-*
-* Live snapshot is mirrored into the `zone-occupancy` device-state
-* slice on every frame; the cap method `getCurrentSnapshot` is a
-* direct read for callers that don't want to subscribe.
-*
-* History methods are sourced from a 60-minute rolling in-memory
-* ring of frame-level samples (sub-second resolution). Queries
-* outside the ring window return empty arrays — durable storage
-* is a follow-up (Step 4b: persisted samples → SQL store).
-*
-* Every history method takes an optional `className` filter:
-* - omitted → bucket count includes ALL classes in scope
-* - present → bucket count restricted to that class
-*
-* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
-* triple covers the three spatial scopes (per-zone, frame-wide,
-* outside-any-zone). Crossing them with `className?` gives the full
-* combinatorial coverage the operator UI requested.
-*
-* ## ⚠️ The three history methods are DEPRECATED
-*
-* They are served from a 60-MINUTE in-memory ring. It dies with the process,
-* so after a restart they report nothing about a night that did happen, and any
-* window past an hour is silently clamped — a caller cannot tell a clamp from
-* an empty scene. The presets in the occupancy chart existed to hide that
-* horizon rather than to answer a question.
-*
-* Use `pipelineAnalytics.readLongTermSeries({ series: 'occupancy', scope })`
-* instead. Those rows are already written for every camera, ~60 bytes per
-* (camera, scope, 5-minute bucket), kept for a year, and survive a restart.
-* Spell the scope with `occupancyScope(zoneId?, className?)` — the same
-* function the writer uses, so the two cannot drift.
-*
-* The ring stays until these three go, and it is the only thing left reading
-* it. Do not add a fourth caller.
-*/
-var zoneAnalyticsCapability = {
-	name: "zone-analytics",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Latest computed occupancy snapshot for this camera. Null when
-		*  the analytics pipeline hasn't seen a frame for this device yet
-		*  (no inference result emitted since boot or since binding was
-		*  activated). */
-		getCurrentSnapshot: method(z.object({ deviceId: z.number() }), CameraOccupancySnapshotSchema.nullable()),
-		/**
-		* The same snapshot, for a SET of cameras, in one round trip.
-		*
-		* The Events page's Stationary section polls this every 15s for every
-		* selected camera. Fanned out client-side that is one query per camera to
-		* read a `Map.get` at the owner — the answer costs nothing, the round trip
-		* costs everything. Batched, N transports become one and the per-device
-		* work is unchanged.
-		*
-		* Every requested deviceId gets a row, tagged `read` — see
-		* {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
-		* not answer for is `'unreadable'`, never an empty reading.
-		*/
-		getCurrentSnapshotBatch: method(z.object({ deviceIds: z.array(z.number()).min(1).max(200) }), z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
-		/** Time-series object count inside one zone. `className` optional —
-		*  omit to count every class in the zone. */
-		getZoneHistory: method(z.object({
-			deviceId: z.number(),
-			zoneId: z.string(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
-		/** Time-series frame-wide object count (everywhere). */
-		getCameraHistory: method(z.object({
-			deviceId: z.number(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
-		/** Time-series count of objects outside every zone. */
-		getUnzonedHistory: method(z.object({
-			deviceId: z.number(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly())
-	},
-	/**
-	* Runtime-state slice — the latest occupancy snapshot mirrored by
-	* the analytics frame processor on every inference result. Consumers
-	* read via `device.state.zoneAnalytics.value` and stay in sync
-	* automatically; the explicit `getCurrentSnapshot` cap method is
-	* still useful for one-off polls without a subscription.
-	*/
-	runtimeState: CameraOccupancySnapshotSchema,
-	/**
-	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-/**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
-*
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
-*/
-var ZoneRuleStageEnum = z.enum([
-	"motion",
-	"detection",
-	"package"
-]);
-/**
-* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
-* arrays that decide how each pipeline stage uses the polygon zones.
-*
-* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
-* so the operator has a single hub-side source of truth for both
-* geometry and behaviour. Per-stage rules are stored under the
-* `zoneRules.<stage>` key in the orchestrator's per-device store and
-* mirrored to the device-state slice `<stage>-zone-rules` on every
-* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
-* subscribe to that slice and refresh their gating without
-* round-tripping the cap.
-*
-* Sets are bulk-replace — the operator UI sends the new rule list
-* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
-* naturally in the rule editor without per-rule mutation chatter.
-*/
-var zoneRulesCapability = {
-	name: "zone-rules",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Read the full rule list for a given stage (empty when no rules
-		*  are defined yet). */
-		listRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum
-		}), z.array(ZoneRuleSchema).readonly()),
-		/** Bulk-replace the rule list for one stage. The provider validates
-		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
-		*  thresholds in range) and rejects the whole patch if any entry
-		*  is invalid — partial writes are a configuration footgun. */
-		setRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum,
-			rules: z.array(ZoneRuleSchema).readonly()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
+	windSpeed: z.number().nullable(),
+	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
+	windSpeedUnit: z.string().nullable(),
+	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
+	windBearing: z.number().nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastFetchedAt: z.number()
+});
+var weatherCapability = {
+	name: "weather",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Weather],
+	methods: {},
+	status: {
+		schema: WeatherStatusSchema,
+		kind: "push"
 	},
 	/**
-	* Runtime-state slice — every stage mirrored together so consumers
-	* see one reactive handle (`device.state.zoneRules.value`) instead
-	* of one per stage. Bulk-replace mutations on any stage write the full
-	* `{motion, detection, package}` shape, so subscribers always get the
-	* complete current set. Consumers that only care about one stage
-	* just read the matching property.
-	*
-	* `package` backs the package-drop detector — a package zone is a
-	* `ZoneRule` on the `'package'` stage referencing drawn polygons
-	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
-	* The orchestrator provider writes this stage as a first-class slice
-	* (Phase 4): every mutation mirrors the full `{motion, detection,
-	* package}` shape, so consumers read the current package rules directly
-	* off `device.state.zoneRules.value.package`.
+	* Runtime-state slice — mirrored by the kernel. The UI reads the
+	* current conditions directly from the slice on each weather push.
 	*/
-	runtimeState: z.object({
-		motion: z.array(ZoneRuleSchema).readonly(),
-		detection: z.array(ZoneRuleSchema).readonly(),
-		package: z.array(ZoneRuleSchema).readonly()
-	}),
+	runtimeState: WeatherStatusSchema,
 	/**
-	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	* Runtime-state durability: **session** — a forecast is stale the moment the hub is down; the provider re-fetches on connect.
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored"
+	durability: "session"
 };
-function isValueOf(slot, value) {
-	return value.slot === slot;
-}
-/** Bind slot `slot` to its owner's functions. See the module docblock. */
-function defineExtensionSlotProvider(slot, impl) {
-	return {
-		slot,
-		list: async (deviceId) => {
-			const listing = await impl.list(deviceId);
-			if (listing === null) return null;
-			const value = listing.value;
-			return {
-				...listing,
-				value
-			};
-		},
-		set: async (deviceId, value) => {
-			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
-			return await impl.set(deviceId, value);
-		},
-		candidates: (deviceId) => impl.candidates(deviceId)
-	};
-}
-/** `<source>:<slotId>`. */
-function extensionSlotRef(source, slot) {
-	return `${source}:${slot}`;
-}
-/** Build the `device-extension` provider one owner registers. */
-function createDeviceExtensionProvider(options) {
-	const { source, label, slots, hostTypeOf, logger } = options;
-	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
-	const resolve = async (deviceId, slotRef) => {
-		const prefix = `${source}:`;
-		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
-		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
-		const hostType = await hostTypeOf(deviceId);
-		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
-		return slot;
-	};
-	return {
-		listSources: async () => [{
-			source,
-			label,
-			availability: { state: "ok" }
-		}],
-		listSlots: async (input) => {
-			const hostType = await hostTypeOf(input.deviceId);
-			const rows = [];
-			for (const slot of slots) {
-				if (!offered(slot.slot, hostType)) continue;
-				const listing = await slot.list(input.deviceId);
-				if (listing === null) continue;
-				rows.push({
-					state: "ok",
-					slotRef: extensionSlotRef(source, slot.slot),
-					slot: slot.slot,
-					authority: listing.authority,
-					activation: listing.activation,
-					value: listing.value,
-					sources: [...listing.sources],
-					...listing.impliedSources !== void 0 ? { impliedSources: [...listing.impliedSources] } : {}
-				});
-			}
-			return rows;
-		},
-		listCandidates: async (input) => {
-			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
-		},
-		setSlot: async (input) => {
-			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
-			logger.info("device-extension: slot written", {
-				tags: { deviceId: input.deviceId },
-				meta: {
-					slotRef: input.slotRef,
-					reload: result.reload
-				}
-			});
-			return result;
-		}
-	};
-}
 /**
-* The field graph across every composition, and the cycles in it (D659).
-*
-* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
-* edge points from a composed field to each field it reads. A cycle, direct or
-* through another composition, is refused at save by name (spec §2).
-*
-* The graph is built for ONE save: the CANDIDATE composition (the one being
-* validated) plus every STORED composition. The candidate replaces its own old
-* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
-* introduces or removes a cycle must never depend on array order. A DIFFERENT
-* block targeting the candidate's device is refused by name: one composition
-* per device (D663). Two different stored peers that (wrongly) target the same
-* device are corrupted state, not a cycle to resolve by picking one silently;
-* that is refused by name too (D391).
-*
-* A customization of an EXISTING device reads that device's NATIVE value for a
-* field it replaces or does not write ("Invert state" reads the `on` it
-* replaces): such a self-read is no edge, so it is never a cycle (D663).
-* Another composition reading that field reads the customizer's output.
+* Per-zone occupancy aggregation produced by the analytics frame
+* processor on every inference result. Covers the full combinatorial
+* matrix the operator UI needs: total objects everywhere, total
+* objects per zone, single class everywhere, single class per zone,
+* objects outside any zone.
 *
-* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
-* marks a node `done` after its first expansion) — not every elementary cycle
-* through a shared node, so the path it names may AVOID the candidate while
-* one through it goes unreported. What a save refuses is therefore decided per
-* strongly connected component (`findCandidateCycles`, C-1). A dotted
-* `fieldPath` is matched only as an exact string: a write to `state.value` and
-* a read of `state` would not connect (no nested field writes exist yet).
+* Counts are derived from the analytics tracker (tracked detections
+* with stable trackIds), not raw detector hits — this filters out
+* one-off detector flickers and gives counts that match what the user
+* sees on the live overlay.
 *
-* An item leaf is its own node, `…#consumables.items[desiccant].status`
-* (`featureFieldEntries`), so two items sharing an inner path never merge. No
-* READ can name an array element (`describeStateField` never describes one),
-* so an item node is write-only: its edges to sources are what the check needs.
-*/
-/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
-var CompositionGraphError = class extends Error {};
-/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
-function writtenFields(peer) {
-	return new Set(peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
-}
-/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
-function readsComposedValue(peer, written, read) {
-	if (compositionSourceKey(read.source) !== compositionSourceKey(peer.target)) return true;
-	const field = `${read.cap}.${read.fieldPath}`;
-	return written.has(field) && peer.replaced?.has(field) !== true;
-}
-function peerEdges(peer) {
-	const written = writtenFields(peer);
-	return peer.composition.features.flatMap((feature) => !compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : featureFieldEntries(feature).map(({ fieldPath, source }) => [compositionReadKey({
-		source: peer.target,
-		cap: feature.cap,
-		fieldPath
-	}), fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(compositionReadKey)]));
-}
-/**
-* Every peer that actually takes part in the graph: each stored peer minus the
-* candidate's own old version (same block id — the drop happens before any
-* edge is built, so its old edges never enter the map), plus the candidate
-* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
-* block targets the candidate's device, or two stored peers share a device.
+* Overlap policy: a detection that intersects two zones counts in
+* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
+* `frame` aggregate de-duplicates trivially since it's frame-wide.
+* `unzoned` counts only detections that landed in zero zones.
 */
-function resolvedPeers(candidate, stored) {
-	const candidateKey = compositionSourceKey(candidate.target);
-	const survivors = /* @__PURE__ */ new Map();
-	for (const peer of stored) {
-		if (peer.blockId === candidate.blockId) continue;
-		const key = compositionSourceKey(peer.target);
-		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
-		const clash = survivors.get(key);
-		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
-		survivors.set(key, peer);
-	}
-	return [...survivors.values(), candidate];
-}
-function compositionEdges(candidate, stored) {
-	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
-	return new Map(edges);
-}
-/** Tarjan's strongly connected components over every node of the graph (sources included). */
-function stronglyConnected(edges) {
-	const index = /* @__PURE__ */ new Map();
-	const low = /* @__PURE__ */ new Map();
-	const onStack = /* @__PURE__ */ new Set();
-	const stack = [];
-	const components = [];
-	const connect = (node) => {
-		index.set(node, index.size);
-		low.set(node, index.get(node) ?? 0);
-		stack.push(node);
-		onStack.add(node);
-		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
-			connect(next);
-			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
-		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
-		if (low.get(node) !== index.get(node)) return;
-		const component = [];
-		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
-			onStack.delete(member);
-			component.push(member);
-			if (member === node) break;
-		}
-		components.push(component);
-	};
-	for (const node of edges.keys()) if (!index.has(node)) connect(node);
-	return components;
-}
-/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
-function cycleThrough(start, component, edges) {
-	const parent = /* @__PURE__ */ new Map();
-	const queue = [start];
-	for (let head = 0; head < queue.length; head += 1) {
-		const node = queue[head];
-		if (node === void 0) break;
-		for (const next of edges.get(node) ?? []) {
-			if (next === start) {
-				const chain = [];
-				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
-				return [
-					start,
-					...chain.reverse(),
-					start
-				];
-			}
-			if (!component.has(next) || parent.has(next)) continue;
-			parent.set(next, node);
-			queue.push(next);
-		}
-	}
-	return [start, start];
-}
+var PerScopeBreakdownSchema = z.object({
+	/** Total tracked objects in this scope (frame / zone / unzoned). */
+	totalObjects: z.number().int().nonnegative(),
+	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
+	byClass: z.record(z.string(), z.number().int().nonnegative()),
+	/**
+	* Of `totalObjects`, how many are STANDING — objects the census holds,
+	* present but not going anywhere (a parked car, a bin, a statue).
+	*
+	* The operator's question about a scene has two halves and they answer
+	* different things: "what is parked here" is stable for hours and must not
+	* flap, while "who is walking through" is the thing an alert is about. One
+	* number could only serve one of them, and `totalObjects` served the first
+	* badly — a passer-by moved it and every occupancy rule saw a change.
+	*
+	* `standing + transient === totalObjects`, always. The total keeps its old
+	* meaning exactly, so no rule written against it changes behaviour.
+	*
+	* ABSENT means UNKNOWN, never zero (D393): a snapshot from a node older than
+	* this field cannot say, and a reader that folds absence in as 0 reports "no
+	* parked objects here" about a camera whose lot is full.
+	*/
+	standingObjects: z.number().int().nonnegative().optional(),
+	/** Of `totalObjects`, how many are passing through. See `standingObjects` —
+	*  same absence rule. */
+	transientObjects: z.number().int().nonnegative().optional()
+});
+var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
+	zoneId: z.string(),
+	zoneName: z.string(),
+	/** TrackIds of objects currently inside this zone — for cross-reference
+	*  with the per-track detail panel and live overlay. */
+	trackIds: z.array(z.string()).readonly()
+});
 /**
-* The cycles THIS save closes, decided per strongly connected component — never
-* per reported DFS path, which names one back-edge per revisit and can report a
-* component's cycle by a path that avoids the candidate while the one through it
-* goes unreported. A component refuses when it holds a candidate node and a
-* cycle (more than one node, or a self-loop). Components without a candidate
-* node are not this save's cycles.
+* A parked ("stationary") object surfaced alongside occupancy — an object that
+* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
+* told to forget it so it stops re-spawning tracks/events), but it IS still
+* physically present, so it keeps counting toward `frame` occupancy and is
+* listed here so the UI can show it in a dedicated "Stationary" section instead
+* of flooding the live event feed.
 */
-function findCandidateCycles(candidate, stored) {
-	const edges = compositionEdges(candidate, stored);
-	const prefix = `${compositionSourceKey(candidate.target)}#`;
-	return stronglyConnected(edges).flatMap((members) => {
-		const start = members.find((n) => n.startsWith(prefix));
-		if (start === void 0) return [];
-		const component = new Set(members);
-		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
-		if (members.length === 1 && !selfLoop) return [];
-		return [{
-			path: cycleThrough(start, component, edges),
-			component
-		}];
-	});
-}
-function problem(code, path, message) {
-	return {
-		code,
-		path,
-		message
-	};
-}
-function refused(...problems) {
-	return {
-		problems,
-		fields: [],
-		features: [],
-		events: []
-	};
-}
-/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
-function compositionFieldAt(field) {
-	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
-	return `features[${field.featureIndex}].${inner}.${field.path}`;
-}
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
-var BUILTIN_RESULT_KINDS = Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
-	},
-	count: NUMBER
+var StationaryObjectSchema = z.object({
+	id: z.string(),
+	className: z.string(),
+	bbox: z.object({
+		x: z.number(),
+		y: z.number(),
+		w: z.number(),
+		h: z.number()
+	}),
+	frameWidth: z.number().int().nonnegative(),
+	frameHeight: z.number().int().nonnegative(),
+	/** When the source track was first seen. */
+	firstSeenAt: z.number().int(),
+	/** When the object was recognised as parked (promotion time). */
+	becameStationaryAt: z.number().int(),
+	/** Last frame a detection confirmed the object is still there. */
+	lastConfirmedAt: z.number().int(),
+	/** Enrichment label carried from the source track (identity / plate). */
+	label: z.string().optional(),
+	/** Native-resolution key-frame media key for the parked object's best image. */
+	keyFrameMediaId: z.number().int().optional()
+});
+var CameraOccupancySnapshotSchema = z.object({
+	/** Frame timestamp of the inference result that produced this snapshot. */
+	ts: z.number().int(),
+	/** Frame width/height in pixels — let the UI normalize bbox coords. */
+	frameWidth: z.number().int().nonnegative(),
+	frameHeight: z.number().int().nonnegative(),
+	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
+	zones: z.array(ZoneScopeBreakdownSchema).readonly(),
+	/** Frame-wide aggregate (everywhere, regardless of zone membership).
+	*  INCLUDES currently-confirmed stationary objects (they are still present). */
+	frame: PerScopeBreakdownSchema,
+	/** Detections that landed outside every zone. Empty when no zones defined. */
+	unzoned: PerScopeBreakdownSchema,
+	/** Parked objects on this camera (additive — absent on legacy snapshots).
+	*  Surfaced separately so the UI shows them in a dedicated section rather
+	*  than as repeated tracks/events. */
+	stationaryObjects: z.array(StationaryObjectSchema).readonly().optional()
 });
-var KindInferenceError = class extends Error {};
-function kindOfValue(value) {
-	if (value === null) return "null";
-	if (typeof value === "number") return "number";
-	if (typeof value === "string") return "string";
-	return "boolean";
-}
-function only(kind) {
-	return new Set([kind]);
-}
-function union(...sets) {
-	return new Set(sets.flatMap((s) => [...s]));
-}
-function withoutNull(set) {
-	return new Set([...set].filter((k) => k !== "null"));
-}
-function binaryKinds(op, left, right) {
-	if (op === "+") {
-		const all = [...left, ...right];
-		if (all.every((k) => k === "string")) return only("string");
-		if (all.every((k) => k === "number")) return only("number");
-		return new Set(["number", "string"]);
-	}
-	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
-	return only("boolean");
-}
-/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
-function arityRange(builtin) {
-	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
-	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
-	return `${builtin.minArgs}–${builtin.maxArgs}`;
-}
-function callKinds(callee, args) {
-	const builtin = EXPRESSION_BUILTINS[callee];
-	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
-	const rule = BUILTIN_RESULT_KINDS[callee];
-	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
-	if (rule.kind === "fixed") return new Set(rule.result);
-	const nonNull = union(...args.map(withoutNull));
-	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
-}
-function kindsOf(node, bindings) {
-	switch (node.kind) {
-		case "literal": return only(kindOfValue(node.value));
-		case "identifier": {
-			if (node.name === "now") return only("number");
-			const bound = bindings.get(node.name);
-			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
-			return bound;
-		}
-		case "unary": return only(node.op === "!" ? "boolean" : "number");
-		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
-		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
-	}
-}
-function nodeContainsCall(node, callee) {
-	switch (node.kind) {
-		case "literal":
-		case "identifier": return false;
-		case "unary": return nodeContainsCall(node.operand, callee);
-		case "binary":
-		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
-		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
-		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
-	}
-}
-function expressionContainsBuiltinCall(expr, callee) {
-	const compiled = compileExpressionSafe(expr);
-	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
-}
-function inferExpressionKinds(input) {
-	const compiled = compileExpressionSafe(input.expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	try {
-		return {
-			ok: true,
-			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
-		};
-	} catch (err) {
-		if (err instanceof KindInferenceError) return {
-			ok: false,
-			error: err.message
-		};
-		throw err;
-	}
-}
 /**
-* The kind half of planning a composition field (D659): which kinds a source
-* can produce, whether they fit a target field, and the field's role.
-* Shared by the top-level planner (`validate-composition.ts`) and the item
-* planner (`composition-items.ts`). Internal to the composition module — NOT
-* in the barrel: these are planner internals, not a published contract.
+* One camera's row in a `getCurrentSnapshotBatch` answer.
+*
+* THREE outcomes, and the single-camera method could only express two of them
+* because `snapshot: null` was already spoken for:
+*
+*  - `read: 'read'`, `snapshot` present — the live occupancy reading.
+*  - `read: 'read'`, `snapshot: null`   — read, and this camera has no reading
+*    yet: no frame since boot, and no parked-object registry to hydrate from.
+*  - `read: 'unreadable'`               — the owner could not answer for this
+*    camera. `snapshot` is null, and it does NOT mean "nothing parked here".
+*
+* Collapsing the last two is the failure this field exists to prevent: a
+* hydration that threw would otherwise render as an empty Stationary section,
+* which is a definite claim about a camera nobody could read.
 */
-function readKinds(read, lookupCap) {
-	const def = lookupCap(read.cap);
-	const schema = def?.runtimeState ?? def?.status?.schema;
-	if (def === null || schema === void 0) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `no capability \`${read.cap}\` with state to read`
-	};
-	const field = describeStateField(schema, read.fieldPath);
-	if (field === null) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
-	};
-	const base = field.kind === "enum" ? "string" : field.kind;
-	return {
-		ok: true,
-		kinds: new Set(field.nullable ? [base, "null"] : [base])
-	};
-}
-function sourceKinds(source, lookupCap) {
-	if (source.kind === "from") return readKinds(source, lookupCap);
-	if (source.kind === "code") return {
-		ok: false,
-		code: "reserved-variant",
-		message: "code fields arrive in slice 4"
-	};
-	const bindingKinds = /* @__PURE__ */ new Map();
-	for (const [name, binding] of Object.entries(source.bindings)) {
-		if (binding.kind === "literal") {
-			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
-			continue;
-		}
-		const kinds = readKinds(binding, lookupCap);
-		if (!kinds.ok) return {
-			...kinds,
-			message: `binding \`${name}\`: ${kinds.message}`
-		};
-		bindingKinds.set(name, kinds.kinds);
-	}
-	const inferred = inferExpressionKinds({
-		expr: source.expr,
-		bindingKinds
-	});
-	return inferred.ok ? {
-		ok: true,
-		kinds: inferred.kinds
-	} : {
-		ok: false,
-		code: "expression-invalid",
-		message: inferred.error
-	};
-}
-function compatibility(cap, target, kinds, at) {
-	const allowed = target.kind === "enum" ? "string" : target.kind;
-	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
-	const problems = [];
-	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
-	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
-	return problems;
-}
+var CameraOccupancySnapshotForDeviceSchema = z.object({
+	deviceId: z.number(),
+	read: z.enum(["read", "unreadable"]),
+	snapshot: CameraOccupancySnapshotSchema.nullable()
+});
 /**
-* A string a source produces WITHOUT reading any device — a field-level
-* `expression` source whose compiled AST is a bare string literal (`"red"`,
-* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
-* the kind level (a `from` read of an enum-typed source field, a computed
-* expression) is NOT checked against the target's `enumValues` here: the
-* kind inference already collapsed it to the coarse `'string'` kind, losing
-* whichever enum it actually came from, so membership can only be judged at
-* write time against the runtime-state schema. Known limitation — see the
-* fix report for Task 6 round 1.
+* Time-series resolution. The history methods return one bucket per
+* step over the requested range. Smaller resolutions cost more
+* memory + bandwidth; bound to discrete steps so caller cannot ask
+* for arbitrary fractional buckets.
 */
-function literalStringValue(source) {
-	if (source.kind !== "expression") return null;
-	const compiled = compileExpressionSafe(source.expr);
-	if (!compiled.ok) return null;
-	const ast = compiled.parsed.ast;
-	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
-}
+var HistoryResolutionEnum = z.enum([
+	"minute",
+	"5min",
+	"hour"
+]);
+var HistoryRangeSchema = z.object({
+	/** Range start (epoch ms, inclusive). */
+	from: z.number().int(),
+	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
+	to: z.number().int(),
+	resolution: HistoryResolutionEnum
+});
+var HistoryPointSchema = z.object({
+	/** Bucket midpoint (epoch ms). */
+	ts: z.number().int(),
+	/** Object count averaged over the bucket (rounded to nearest integer). */
+	count: z.number().int().nonnegative()
+});
 /**
-* An enum target whose source is a save-time-KNOWN string literal outside its
-* `enumValues` is refused now rather than left to fail the write later. A
-* dynamic source (a `from` read, a non-literal expression) is left to
-* runtime — see {@link literalStringValue}.
+* Zone Analytics capability — spatial occupancy aggregations over
+* tracked detections. Hosted by `addon-pipeline-analytics`.
+*
+* Live snapshot is mirrored into the `zone-occupancy` device-state
+* slice on every frame; the cap method `getCurrentSnapshot` is a
+* direct read for callers that don't want to subscribe.
+*
+* History methods are sourced from a 60-minute rolling in-memory
+* ring of frame-level samples (sub-second resolution). Queries
+* outside the ring window return empty arrays — durable storage
+* is a follow-up (Step 4b: persisted samples → SQL store).
+*
+* Every history method takes an optional `className` filter:
+* - omitted → bucket count includes ALL classes in scope
+* - present → bucket count restricted to that class
+*
+* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
+* triple covers the three spatial scopes (per-zone, frame-wide,
+* outside-any-zone). Crossing them with `className?` gives the full
+* combinatorial coverage the operator UI requested.
+*
+* ## ⚠️ The three history methods are DEPRECATED
+*
+* They are served from a 60-MINUTE in-memory ring. It dies with the process,
+* so after a restart they report nothing about a night that did happen, and any
+* window past an hour is silently clamped — a caller cannot tell a clamp from
+* an empty scene. The presets in the occupancy chart existed to hide that
+* horizon rather than to answer a question.
+*
+* Use `pipelineAnalytics.readLongTermSeries({ series: 'occupancy', scope })`
+* instead. Those rows are already written for every camera, ~60 bytes per
+* (camera, scope, 5-minute bucket), kept for a year, and survive a restart.
+* Spell the scope with `occupancyScope(zoneId?, className?)` — the same
+* function the writer uses, so the two cannot drift.
+*
+* The ring stays until these three go, and it is the only thing left reading
+* it. Do not add a fourth caller.
 */
-function enumLiteralProblem(cap, target, source, at) {
-	if (target.kind !== "enum" || target.enumValues === void 0) return null;
-	const value = literalStringValue(source);
-	if (value === null || target.enumValues.includes(value)) return null;
-	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
-	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
-}
-function roleOf(source) {
-	if (source.kind !== "expression") return "derived";
-	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
-	if (fieldReads(source).length > 0) return "derived";
-	const compiled = compileExpressionSafe(source.expr);
-	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
-}
+var zoneAnalyticsCapability = {
+	name: "zone-analytics",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Latest computed occupancy snapshot for this camera. Null when
+		*  the analytics pipeline hasn't seen a frame for this device yet
+		*  (no inference result emitted since boot or since binding was
+		*  activated). */
+		getCurrentSnapshot: method(z.object({ deviceId: z.number() }), CameraOccupancySnapshotSchema.nullable()),
+		/**
+		* The same snapshot, for a SET of cameras, in one round trip.
+		*
+		* The Events page's Stationary section polls this every 15s for every
+		* selected camera. Fanned out client-side that is one query per camera to
+		* read a `Map.get` at the owner — the answer costs nothing, the round trip
+		* costs everything. Batched, N transports become one and the per-device
+		* work is unchanged.
+		*
+		* Every requested deviceId gets a row, tagged `read` — see
+		* {@link CameraOccupancySnapshotForDeviceSchema}. A camera the owner could
+		* not answer for is `'unreadable'`, never an empty reading.
+		*/
+		getCurrentSnapshotBatch: method(z.object({ deviceIds: z.array(z.number()).min(1).max(200) }), z.array(CameraOccupancySnapshotForDeviceSchema).readonly()),
+		/** Time-series object count inside one zone. `className` optional —
+		*  omit to count every class in the zone. */
+		getZoneHistory: method(z.object({
+			deviceId: z.number(),
+			zoneId: z.string(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
+		/** Time-series frame-wide object count (everywhere). */
+		getCameraHistory: method(z.object({
+			deviceId: z.number(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
+		/** Time-series count of objects outside every zone. */
+		getUnzonedHistory: method(z.object({
+			deviceId: z.number(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly())
+	},
+	/**
+	* Runtime-state slice — the latest occupancy snapshot mirrored by
+	* the analytics frame processor on every inference result. Consumers
+	* read via `device.state.zoneAnalytics.value` and stay in sync
+	* automatically; the explicit `getCurrentSnapshot` cap method is
+	* still useful for one-off polls without a subscription.
+	*/
+	runtimeState: CameraOccupancySnapshotSchema,
+	/**
+	* Runtime-state durability: **session** — per-frame analytics; with `audio-metrics` it is ~90 % of the offered write rate. Re-derived on the next frame.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
+};
 /**
-* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
-* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
-* own offline, and D393 forbids a stale number, so on an existing target a
-* field that READS a source never gets `offline`.
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
 */
-function unavailableFor(tf, role, mode, cap, at) {
-	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
-		ok: true,
-		unavailable: "release"
-	};
-	if (mode === "new" || role !== "derived") return {
-		ok: true,
-		unavailable: tf.nullable ? "null" : "offline"
-	};
-	if (tf.nullable) return {
-		ok: true,
-		unavailable: "null"
-	};
-	if (tf.enumValues?.includes("unknown") === true) return {
-		ok: true,
-		unavailable: "unknown"
-	};
-	return {
-		ok: false,
-		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
-	};
-}
-/** Item fields the composer writes itself, with the value it writes. */
-var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
-function reservedItemFields(itemArray) {
-	return new Set([
-		itemArray.keyField,
-		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
-		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
-	]);
-}
-/** A required leaf under an optional parent is required only once something writes that parent. */
-function leafRequired(itemArray, path, written) {
-	const described = describeStateField(itemArray.itemSchema, path);
-	if (described === null || !described.required) return false;
-	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
-}
-function missingLeaves({ capName, itemArray, reserved }, item, at) {
-	const written = Object.keys(item.fields);
-	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
-		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
-		if (!leafRequired(itemArray, leaf.path, written)) return [];
-		const described = describeStateField(itemArray.itemSchema, leaf.path);
-		if (described === null || described.nullable) return [];
-		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
-	});
+var ZoneRuleStageEnum = z.enum([
+	"motion",
+	"detection",
+	"package"
+]);
+/**
+* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
+* arrays that decide how each pipeline stage uses the polygon zones.
+*
+* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
+* so the operator has a single hub-side source of truth for both
+* geometry and behaviour. Per-stage rules are stored under the
+* `zoneRules.<stage>` key in the orchestrator's per-device store and
+* mirrored to the device-state slice `<stage>-zone-rules` on every
+* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
+* subscribe to that slice and refresh their gating without
+* round-tripping the cap.
+*
+* Sets are bulk-replace — the operator UI sends the new rule list
+* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
+* naturally in the rule editor without per-rule mutation chatter.
+*/
+var zoneRulesCapability = {
+	name: "zone-rules",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Read the full rule list for a given stage (empty when no rules
+		*  are defined yet). */
+		listRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum
+		}), z.array(ZoneRuleSchema).readonly()),
+		/** Bulk-replace the rule list for one stage. The provider validates
+		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+		*  thresholds in range) and rejects the whole patch if any entry
+		*  is invalid — partial writes are a configuration footgun. */
+		setRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum,
+			rules: z.array(ZoneRuleSchema).readonly()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — every stage mirrored together so consumers
+	* see one reactive handle (`device.state.zoneRules.value`) instead
+	* of one per stage. Bulk-replace mutations on any stage write the full
+	* `{motion, detection, package}` shape, so subscribers always get the
+	* complete current set. Consumers that only care about one stage
+	* just read the matching property.
+	*
+	* `package` backs the package-drop detector — a package zone is a
+	* `ZoneRule` on the `'package'` stage referencing drawn polygons
+	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+	* The orchestrator provider writes this stage as a first-class slice
+	* (Phase 4): every mutation mirrors the full `{motion, detection,
+	* package}` shape, so consumers read the current package rules directly
+	* off `device.state.zoneRules.value.package`.
+	*/
+	runtimeState: z.object({
+		motion: z.array(ZoneRuleSchema).readonly(),
+		detection: z.array(ZoneRuleSchema).readonly(),
+		package: z.array(ZoneRuleSchema).readonly()
+	}),
+	/**
+	* Runtime-state durability: **restored** — operator intent, mutation-only, same argument as `zones`.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+function isValueOf(slot, value) {
+	return value.slot === slot;
 }
-function planItemField(ctx, leaf) {
-	const { capName, itemArray, featureIndex, lookupCap } = ctx;
-	const { key, label, path, source } = leaf;
-	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
-	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
-	const tf = describeStateField(itemArray.itemSchema, path);
-	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: capName,
-		path,
-		item: {
-			arrayPath: itemArray.path,
-			key,
-			label
-		},
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(capName, tf, source, at);
+/** Bind slot `slot` to its owner's functions. See the module docblock. */
+function defineExtensionSlotProvider(slot, impl) {
 	return {
-		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
+		slot,
+		list: async (deviceId) => {
+			const listing = await impl.list(deviceId);
+			if (listing === null) return null;
+			const value = listing.value;
+			return {
+				...listing,
+				value
+			};
+		},
+		set: async (deviceId, value) => {
+			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
+			return await impl.set(deviceId, value);
+		},
+		candidates: (deviceId) => impl.candidates(deviceId)
 	};
 }
-function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
-	const at = `features[${featureIndex}].items`;
-	const itemArray = def.status?.itemArray;
-	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
-	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
-	const ctx = {
-		capName: def.name,
-		itemArray,
-		reserved: reservedItemFields(itemArray),
-		featureIndex,
-		lookupCap,
-		mode
+/** `<source>:<slotId>`. */
+function extensionSlotRef(source, slot) {
+	return `${source}:${slot}`;
+}
+/** Build the `device-extension` provider one owner registers. */
+function createDeviceExtensionProvider(options) {
+	const { source, label, slots, hostTypeOf, logger } = options;
+	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
+	const resolve = async (deviceId, slotRef) => {
+		const prefix = `${source}:`;
+		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
+		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
+		const hostType = await hostTypeOf(deviceId);
+		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
+		return slot;
 	};
-	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
-		problems: missingLeaves(ctx, item, `${at}.${key}`),
-		fields: [],
-		features: [],
-		events: []
-	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
-		key,
-		label: item.label,
-		path,
-		source
-	}))]);
 	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: [],
-		events: []
+		listSources: async () => [{
+			source,
+			label,
+			availability: { state: "ok" }
+		}],
+		listSlots: async (input) => {
+			const hostType = await hostTypeOf(input.deviceId);
+			const rows = [];
+			for (const slot of slots) {
+				if (!offered(slot.slot, hostType)) continue;
+				const listing = await slot.list(input.deviceId);
+				if (listing === null) continue;
+				rows.push({
+					state: "ok",
+					slotRef: extensionSlotRef(source, slot.slot),
+					slot: slot.slot,
+					authority: listing.authority,
+					activation: listing.activation,
+					value: listing.value,
+					sources: [...listing.sources],
+					...listing.impliedSources !== void 0 ? { impliedSources: [...listing.impliedSources] } : {}
+				});
+			}
+			return rows;
+		},
+		listCandidates: async (input) => {
+			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
+		},
+		setSlot: async (input) => {
+			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
+			logger.info("device-extension: slot written", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					slotRef: input.slotRef,
+					reload: result.reload
+				}
+			});
+			return result;
+		}
 	};
 }
+/**
+* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
+* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
+* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
+* decimals). K derives from `°C = K − 273.15`.
+*/
+var UNIT_TABLE = {
+	"°C": {
+		dimension: "temperature",
+		factor: 1,
+		offset: 0
+	},
+	"°F": {
+		dimension: "temperature",
+		factor: 5 / 9,
+		offset: -160 / 9
+	},
+	K: {
+		dimension: "temperature",
+		factor: 1,
+		offset: -273.15
+	},
+	hPa: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	kPa: {
+		dimension: "pressure",
+		factor: 10,
+		offset: 0
+	},
+	Pa: {
+		dimension: "pressure",
+		factor: .01,
+		offset: 0
+	},
+	mbar: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	bar: {
+		dimension: "pressure",
+		factor: 1e3,
+		offset: 0
+	},
+	inHg: {
+		dimension: "pressure",
+		factor: 33.8639,
+		offset: 0
+	},
+	mmHg: {
+		dimension: "pressure",
+		factor: 1.33322,
+		offset: 0
+	},
+	psi: {
+		dimension: "pressure",
+		factor: 68.9476,
+		offset: 0
+	},
+	"m/s": {
+		dimension: "speed",
+		factor: 1,
+		offset: 0
+	},
+	"km/h": {
+		dimension: "speed",
+		factor: 1 / 3.6,
+		offset: 0
+	},
+	mph: {
+		dimension: "speed",
+		factor: .44704,
+		offset: 0
+	},
+	kn: {
+		dimension: "speed",
+		factor: .514444,
+		offset: 0
+	},
+	"mm/h": {
+		dimension: "precipitation-rate",
+		factor: 1,
+		offset: 0
+	},
+	"in/h": {
+		dimension: "precipitation-rate",
+		factor: 25.4,
+		offset: 0
+	},
+	m: {
+		dimension: "length",
+		factor: 1,
+		offset: 0
+	},
+	mm: {
+		dimension: "length",
+		factor: .001,
+		offset: 0
+	},
+	cm: {
+		dimension: "length",
+		factor: .01,
+		offset: 0
+	},
+	km: {
+		dimension: "length",
+		factor: 1e3,
+		offset: 0
+	},
+	in: {
+		dimension: "length",
+		factor: .0254,
+		offset: 0
+	},
+	ft: {
+		dimension: "length",
+		factor: .3048,
+		offset: 0
+	},
+	mi: {
+		dimension: "length",
+		factor: 1609.344,
+		offset: 0
+	},
+	lx: {
+		dimension: "illuminance",
+		factor: 1,
+		offset: 0
+	},
+	"W/m²": {
+		dimension: "irradiance",
+		factor: 1,
+		offset: 0
+	},
+	W: {
+		dimension: "power",
+		factor: 1,
+		offset: 0
+	},
+	kW: {
+		dimension: "power",
+		factor: 1e3,
+		offset: 0
+	},
+	VA: {
+		dimension: "apparent-power",
+		factor: 1,
+		offset: 0
+	},
+	Wh: {
+		dimension: "energy",
+		factor: 1,
+		offset: 0
+	},
+	kWh: {
+		dimension: "energy",
+		factor: 1e3,
+		offset: 0
+	},
+	MWh: {
+		dimension: "energy",
+		factor: 1e6,
+		offset: 0
+	},
+	V: {
+		dimension: "voltage",
+		factor: 1,
+		offset: 0
+	},
+	mV: {
+		dimension: "voltage",
+		factor: .001,
+		offset: 0
+	},
+	A: {
+		dimension: "current",
+		factor: 1,
+		offset: 0
+	},
+	mA: {
+		dimension: "current",
+		factor: .001,
+		offset: 0
+	},
+	ppm: {
+		dimension: "concentration-volume",
+		factor: 1,
+		offset: 0
+	},
+	ppb: {
+		dimension: "concentration-volume",
+		factor: .001,
+		offset: 0
+	},
+	"µg/m³": {
+		dimension: "concentration-mass",
+		factor: 1,
+		offset: 0
+	},
+	"mg/m³": {
+		dimension: "concentration-mass",
+		factor: 1e3,
+		offset: 0
+	},
+	kg: {
+		dimension: "mass",
+		factor: 1,
+		offset: 0
+	},
+	g: {
+		dimension: "mass",
+		factor: .001,
+		offset: 0
+	},
+	lb: {
+		dimension: "mass",
+		factor: .453592,
+		offset: 0
+	},
+	oz: {
+		dimension: "mass",
+		factor: .0283495,
+		offset: 0
+	},
+	"%": {
+		dimension: "percentage",
+		factor: 1,
+		offset: 0
+	}
+};
+/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
+function specFor(unit) {
+	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
+}
+/** Value in `spec`'s unit → its dimension's canonical unit. */
+function toCanonical(value, spec) {
+	return value * spec.factor + spec.offset;
+}
+/** Canonical-unit value → the unit described by `spec`. */
+function fromCanonical(canonical, spec) {
+	return (canonical - spec.offset) / spec.factor;
+}
+/**
+* Graceful variant for the render path: returns the converted value, or
+* `undefined` when the conversion is refused (unknown unit / cross-dimension).
+* Never throws — a render caller falls back to the raw value + source unit.
+*/
+function tryConvertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) return void 0;
+	const toSpec = specFor(to);
+	if (!toSpec) return void 0;
+	if (fromSpec.dimension !== toSpec.dimension) return void 0;
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+}
+/**
+* One composed field, evaluated from what its sources say NOW (D659).
+*
+* Pure. The composer calls it on every source change, and the slice-5 editor
+* will call it for its live preview, so both see the same answer.
+*
+* The rules (spec §2):
+*  - a source that is offline or unreadable keeps its last value and is marked
+*    STALE; the field is stale and keeps computing (D49);
+*  - a source that is GONE makes the field UNAVAILABLE, `fatal`, and never a
+*    plausible number (D393);
+*  - a source that is unavailable but NOT gone (e.g. a cap unregistered at
+*    runtime, R7b) makes the field UNAVAILABLE, non-fatal, `value: null`: it
+*    may come back on its own, no block failure is raised for it;
+*  - an expression that fails on a value makes the field unavailable for that
+*    value, and NOT fatal: the next value may compute.
+*
+* `confirmed` (D663, D49): whether a NON-fatal unavailability is an ANSWER — a
+* cap the provider unregistered and a re-read agreed, a field the source
+* reported without, an expression that failed on a value — or only the
+* absence of one (a failed read, a first or empty read, a source not tracked
+* yet). Only a confirmed unavailability may hand a `release`-mode field back
+* to the native provider; an unconfirmed one holds it on its last value.
+* Absent means NOT confirmed. Fatal is always confirmed.
+*
+* When an expression has more than one unavailable binding, a FATAL one always
+* wins the outcome, regardless of position: every binding is scanned before
+* the field is judged, so an earlier non-fatal binding (e.g. a cap that is
+* momentarily unregistered) can never hide a later fatal one (a deleted
+* source) behind an early return.
+*/
 function describeRead(read) {
 	return `${compositionSourceKey(read.source)} ${read.cap}.${read.fieldPath}`;
 }
@@ -43679,7 +44360,10 @@ function expressionOutcome(source, read, now, stateful) {
 	}
 	const deadlines = [];
 	const result = evaluateExpressionSource(source.expr, values, now, {
-		hooks: { noteDeadline: (at) => deadlines.push(at) },
+		hooks: {
+			noteDeadline: (at) => deadlines.push(at),
+			convert: (value, from, to) => tryConvertUnit(value, normalizeUnit(from) ?? from, normalizeUnit(to) ?? to) ?? null
+		},
 		...stateful === void 0 ? {} : { invokeStateful: (invocation) => evaluateStatefulExpressionCall(stateful.callPathPrefix === void 0 ? invocation : {
 			...invocation,
 			path: `${stateful.callPathPrefix}@${invocation.path}`
@@ -43717,301 +44401,70 @@ function evaluateCompositionField(input) {
 		};
 	}
 }
-function buildCapabilityLookup(defs) {
-	const byName = new Map(defs.map((d) => [d.name, d]));
-	return (capName) => byName.get(capName) ?? null;
-}
-/** Caps every `BaseDevice` registers on itself; a second registration throws. */
-var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
-var PENDING_SELF = {
-	addonId: COMPOSER_ADDON_ID,
-	stableId: `${COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
-};
-function composableCap(feature, at, lookupCap) {
-	const def = lookupCap(feature.cap);
-	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
-	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
-	const state = def.runtimeState;
-	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
-	return {
-		def,
-		state,
-		fields: describeTopLevelStateFields(state)
-	};
-}
 /**
-* A capability BUILT by the composition (a new device, or one ADDED to an
-* existing device) must fit the device type, serve no command, and have every
-* required field. A REPLACE needs none of it: the cap is bound (a fact), the
-* native keeps serving its methods, and only the named fields are owned (D663).
+* The doorbell of a camera as a customization (D671). ONE builder: the
+* virtual-doorbell migration and the admin UI's "Use as doorbell" preset both
+* call it, so a preset can never write a shape the migration would refuse as
+* "an unrelated existing block".
 */
-function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
-	const problems = [];
-	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
-	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
-	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
-	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
-	for (const key of requiredTopLevelKeys(state)) {
-		if (key === itemArrayPath) continue;
-		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
-		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
-	}
-	return problems;
-}
-function planTopLevelField({ def, fields }, field, mode, lookupCap) {
-	const { featureIndex, path, source } = field;
-	const fieldAt = `features[${featureIndex}].fields.${path}`;
-	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
-	const tf = fields.get(path);
-	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: def.name,
-		path,
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
-	return {
-		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
-	};
-}
-function planFeature(feature, featureIndex, target, lookupCap) {
-	const at = `features[${featureIndex}]`;
-	const cap = composableCap(feature, at, lookupCap);
-	if ("code" in cap) return refused(cap);
-	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
-	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
-	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
-		featureIndex,
-		path,
-		source
-	}, target.mode, lookupCap));
-	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
-	const all = [...perField, ...items];
-	const fields = all.flatMap((result) => result.fields);
-	const featurePlan = {
-		featureIndex,
-		cap: cap.def.name,
-		mode: target.mode
-	};
-	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
-	return {
-		problems: [
-			...capProblems,
-			...all.flatMap((r) => r.problems),
-			...eventPlan.problems
-		],
-		fields,
-		features: [featurePlan],
-		events: eventPlan.events
-	};
-}
-/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
-function isNativeCap(target, cap) {
-	const owner = target.nativeCaps.get(cap);
-	return owner !== void 0 && owner !== "composer";
-}
-/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
-function planTargetOf(composition, target) {
-	if (composition.target.kind === "new") return {
-		kind: "new",
-		type: composition.target.type
-	};
-	const key = compositionSourceKey(composition.target.device);
-	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
-	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
-	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
-	return {
-		kind: "existing",
-		found: target
-	};
-}
-function featureTargetOf(target, cap) {
-	if (target.kind === "new") return {
-		mode: "new",
-		deviceType: target.type
-	};
-	return {
-		mode: isNativeCap(target.found, cap) ? "replace" : "add",
-		deviceType: target.found.type
-	};
+/** A rise closer than this to the previous one is the same press (D671). */
+var DOORBELL_RISE_DEBOUNCE_MS = 2e3;
+/** Every source cap of `source` that `SOURCE_CAP_ACTIVE_FIELD` knows AND the device has bound. */
+function doorbellFeatureSources(source, boundCaps) {
+	return Object.keys(SOURCE_CAP_ACTIVE_FIELD).filter((cap) => Object.hasOwn(SOURCE_CAP_CHANGED_AT_FIELD, cap) && boundCaps.includes(cap)).toSorted().flatMap((cap) => {
+		const activeField = SOURCE_CAP_ACTIVE_FIELD[cap];
+		const changedAtField = SOURCE_CAP_CHANGED_AT_FIELD[cap];
+		return activeField === void 0 || changedAtField === void 0 ? [] : [{
+			source,
+			cap,
+			activeField,
+			changedAtField
+		}];
+	});
 }
-/**
-* The static plan. `target` describes an EXISTING target device (one read);
-* it is ignored for a new one. On an existing target each feature REPLACES a
-* cap the device has natively, else ADDS it (D663).
-*/
-function planComposition(composition, lookupCap, target) {
-	const planTarget = planTargetOf(composition, target);
-	if ("code" in planTarget) return refused(planTarget);
-	const results = composition.features.map((feature, index) => {
-		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
-		return compositionFeatureEnabled(feature) ? result : {
-			problems: result.problems,
-			fields: [],
-			features: [],
-			events: []
+/** The D671 feature, byte for byte what the migration writes. Throws on zero sources. */
+function buildDoorbellCompositionFeature(input) {
+	const sources = [...input.sources].toSorted((a, b) => `${a.source.addonId}/${a.source.stableId}#${a.cap}`.localeCompare(`${b.source.addonId}/${b.source.stableId}#${b.cap}`));
+	if (sources.length === 0) throw new Error("doorbell composition needs at least one source");
+	const edgeBindings = {};
+	sources.forEach((entry, index) => {
+		edgeBindings[`active${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.activeField
+		};
+		edgeBindings[`changed${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.changedAtField
 		};
 	});
 	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: results.flatMap((r) => r.features),
-		events: results.flatMap((r) => r.events)
-	};
-}
-function compositionSourceRefs(composition) {
-	const refs = composition.features.flatMap((f) => compositionFeatureEnabled(f) && f.kind === "fields" ? featureSources(f).flatMap(fieldReads).map((r) => r.source) : []);
-	return [...new Map(refs.map((r) => [compositionSourceKey(r), r])).values()];
-}
-/**
-* The candidate's device: the existing target itself, else `self`, else a
-* placeholder that cannot collide with a stored target. An existing target is
-* known even on create, so a second customization of it is refused on create too.
-*/
-function candidateSelf(composition, ctx, plan) {
-	return {
-		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
-		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
-		replaced: replacedFieldKeys(plan)
-	};
-}
-/**
-* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
-* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
-* derivation, so the graph reads both the same way.
-*/
-function replacedFieldKeys(plan) {
-	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
-	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
-}
-/**
-* A read of the candidate's own device. Its own composed output (a new device's
-* field, an ADDED field) is the slice-1 own-field rule; on an existing target
-* every other field — replaced, or not composed at all — is the NATIVE value,
-* valid when the device serves that cap natively (D663, rule 5).
-*/
-function selfReadProblems(read, at, fields, self) {
-	const readKey = `${read.cap}.${read.fieldPath}`;
-	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
-	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
-	if (isNativeCap(self.native, read.cap)) return [];
-	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
-}
-function sourceProblems(fields, ctx, self) {
-	const selfKey = compositionSourceKey(self.ref);
-	return fields.flatMap((field) => field.reads.flatMap((read) => {
-		const at = compositionFieldAt(field);
-		const key = compositionSourceKey(read.source);
-		if (key === selfKey) return selfReadProblems(read, at, fields, self);
-		const desc = ctx.sources.get(key);
-		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
-		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
-		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
-		return [];
-	}));
-}
-/**
-* A cycle's node keys are `compositionReadKey` strings:
-* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
-* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
-* back out so the refusal can point at that exact field, matching the
-* documented `features[N].fields.<path>` convention. A cap name has no `.`,
-* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
-* (`items[desiccant].status`) is matched through `compositionFieldKey`.
-*/
-function candidateFieldOfNode(nodeKey, candidateKey) {
-	const prefix = `${candidateKey}#`;
-	if (!nodeKey.startsWith(prefix)) return null;
-	const rest = nodeKey.slice(prefix.length);
-	const dot = rest.indexOf(".");
-	if (dot === -1) return null;
-	return {
-		cap: rest.slice(0, dot),
-		fieldPath: rest.slice(dot + 1)
-	};
-}
-/** The first node of a cycle's path that is one of THIS composition's own
-*  planned fields, as a documented-convention path; `'features'` when the
-*  cycle runs entirely through other stored compositions. */
-function cyclePath(nodePath, candidateKey, fields) {
-	for (const nodeKey of nodePath) {
-		const hit = candidateFieldOfNode(nodeKey, candidateKey);
-		if (hit === null) continue;
-		const hitKey = `${hit.cap}.${hit.fieldPath}`;
-		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
-		if (field !== void 0) return compositionFieldAt(field);
-	}
-	return "features";
-}
-/** The first unread device any of `nodes` belongs to; null when none does. */
-function unreadDeviceOf(nodes, unread) {
-	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
-		key,
-		error
-	};
-	return null;
-}
-/**
-* Cycle check runs against the CANDIDATE (this composition, as block
-* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
-* decided per strongly connected component (`findCandidateCycles`): a cyclic
-* component holding a candidate node refuses, with one representative cycle
-* through it; one without is not this save's cycle. A
-* stored composition of the same block is its old version; another block on
-* the same device, or two stored peers sharing a device, make
-* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
-* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
-*/
-function cycleProblems(composition, ctx, fields, self) {
-	const candidate = {
-		blockId: ctx.blockId ?? "(unsaved)",
-		target: self.ref,
-		composition,
-		replaced: self.replaced
-	};
-	const candidateKey = compositionSourceKey(candidate.target);
-	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
-	try {
-		return findCandidateCycles(candidate, ctx.peers).map((c) => {
-			const at = cyclePath(c.path, candidateKey, fields);
-			const through = unreadDeviceOf([...c.component], unread);
-			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
-		});
-	} catch (err) {
-		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
-		throw err;
-	}
-}
-function validateComposition(composition, ctx) {
-	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
-	const self = candidateSelf(composition, ctx, plan);
-	const cycles = cycleProblems(composition, ctx, plan.fields, self);
-	const problems = [
-		...plan.problems,
-		...sourceProblems(plan.fields, ctx, self),
-		...cycles
-	];
-	return {
-		ok: problems.length === 0,
-		problems,
-		fields: [...plan.fields],
-		features: [...plan.features],
-		events: [...plan.events]
+		kind: "fields",
+		cap: "doorbell",
+		enabled: input.enabled,
+		fields: {
+			lastPressedAt: {
+				kind: "expression",
+				expr: `latest(${sources.map((_, index) => `rose(active${index}, changed${index}, ${DOORBELL_RISE_DEBOUNCE_MS})`).join(", ")})`,
+				bindings: edgeBindings
+			},
+			pressCountSinceStart: {
+				kind: "expression",
+				expr: "count(lastPressedAt)",
+				bindings: { lastPressedAt: {
+					kind: "from",
+					source: {
+						addonId: input.camera.addonId,
+						stableId: input.camera.stableId
+					},
+					cap: "doorbell",
+					fieldPath: "lastPressedAt"
+				} }
+			}
+		}
 	};
 }
 /**
@@ -48031,6 +48484,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listComposableCaps": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.listCompositions": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -51715,6 +52174,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSensors": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -55425,6 +55890,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraSensors": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepOverride": [{
 		name: "deviceId",
 		form: "single",
@@ -57528,4 +57998,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { coreBlockAddonId as $, asJsonObject as $n, procedureAuthKey as $t, STORAGE_ACCESS_FALLBACK as A, buildFfmpegArgs as An, isSameAddonId as At, addonWidgetsCapability as B, isSourceCap as Bn, looseSchema as Bt, METHOD_ACCESS_MAP as C, vectorStoreCapability as Cn, foldSnapshotByFunction as Ct, REDACTED_SECRET as D, SOURCE_CAPS as Dn, isCollectionArrayMethod as Dt, RECORDING_SOURCE_CAMSTACK_ADDON as E, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as En, isArrayOutputSchema as Et, StorageLocationTypeSchema as F, compositionItemFieldPath as Fn, lifecycleJobSchema as Ft, batteryCapability as G, errMsg as Gn, modeMayWrite as Gt, authProviderCapability as H, DeviceFeature as Hn, mayWriteToLocation as Ht, StorageMigrationJobSchema as I, compositionSliceKey as In, localNetworkCapability as It, cameraGridLayoutCapability as J, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Jn, objectInputDeclaresAddonId as Jt, buildCapabilityLookup as K, BaseAddon as Kn, motionCapability as Kt, UserRecordSchema as L, compositionSourceKey as Ln, locationIconKey as Lt, ScopedTokenSchema as M, composedDeviceRef as Mn, kebabToCamel as Mt, StorageCleanupJobSchema as N, composedDeviceStableId as Nn, legacyAutoLinkIds as Nt, RUNTIME_DEFAULTS as O, SOURCE_CAP_ACTIVE_FIELD as On, isLocationEnabled as Ot, StorageLocationModeSchema as P, compositionFeatureEnabled as Pn, legacyModeOf as Pt, compositionSourceRefs as Q, WELL_KNOWN_TAB_MAP as Qn, platformProbeCapability as Qt, addonPagesCapability as R, createStatefulExpressionMemory as Rn, logDestinationCapability as Rt, LocationIconIdSchema as S, vectorIndexDimConflictError as Sn, filesystemBrowseCapability as St, MOTION_CLOSE_AFTER_MS as T, COMPOSER_ADDON_ID as Tn, gbToBytes as Tt, backupCapability as U, DeviceRole as Un, memoizePinnedFfmpeg as Ut, alertsCapability as V, toExpressionValue as Vn, mayReadLocation as Vt, bareAddonId as W, DeviceType as Wn, metricsProviderCapability as Wt, composerCapability as X, ReadinessRegistry as Xn, parseStreamParamsFormPatch as Xt, collectSecretConfigKeys as Y, DEVICE_STATUS_METHOD as Yn, objectInputDeclaresRequiredDeviceId as Yt, compositionFieldKey as Z, ReadinessTimeoutError as Zn, planComposition as Zt, FIRST_LEVEL_MACRO_CLASSES as _, streamCatalogCapability as _n, enumerateSchemaFields as _t, BatteryStatusSchema as a, resolveMethodAuth as an, expandCapMethods as ar, dataStoreProviderCapability as at, LOG_LEVEL_RANK as b, validateComposition as bn, expandContainer as bt, COMPOSED_ITEM_FIXED_FIELDS as c, scopesAllowDeviceCap as cn, isEvent as cr, defineExtensionSlotProvider as ct, CORE_BLOCK_ADDON_PREFIX as d, siteZoneKey as dn, parseJsonUnknown as dr, deviceManagerCapability as dt, ptzAutotrackCapability as en, asNumber as er, coreBlockComposition as et, CoreBlockSchema as f, snapshotCapability as fn, readinessKey as fr, deviceStateCapability as ft, DeviceStatusSchema as g, storageProviderCapability as gn, EventCategory as gr, enumerateItemArrayFields as gt, DeclaredDevices as h, storageOccupancyCapability as hn, sleep as hr, enumerateInferenceDevices as ht, BaseDevice as i, resolveLocationMode as in, emitReadiness as ir, createDeviceExtensionProvider as it, STREAM_PROFILE_META as j, cloneStatefulExpressionMemory as jn, isVoidInput as jt, RecordingStatusSchema as k, SOURCE_CAP_CHANGED_AT_FIELD as kn, isObjectInput as kt, COMPOSER_RUNNER_ID as l, scoreRuntimes as ln, nodePin as lr, deriveBatteryPresence as lt, DERIVED_CAMERA_SILENCED_CAP_NAMES as m, storageMigrationCapability as mn, scopeKey as mr, doorbellCapability as mt, AlertSchema as n, replacedFieldKeys as nn, createEvent as nr, coreBlockSourceKind as nt, CAMERA_SWITCH_ORDER as o, runtimeStatePolicyFor as on, hydrateSchema as or, declarationOwnerNodeId as ot, DAY_NAMES as p, storageCapability as pn, resolveCapMount as pr, deviceStatusCapability as pt, buildStreamParamsConfigSchema as q, DATAPLANE_SECRET_HEADER as qn, normalizeUnit as qt, ApiKeyRecordSchema as r, resolveBucketMs as rn, emitDownForOwnedCaps as rr, coreBlocksCapability as rt, CAP_NAMES_WITH_STATUS as s, scopesAllowAddon as sn, isDeviceConfigCap as sr, decodeVectorBase64 as st, ALL_CAPABILITY_DEFINITIONS as t, reducePoints as tn, asString$1 as tr, coreBlockIdFromAddonId as tt, CORE_BLOCKS_ADDON_ID as u, settingsStoreCapability as un, parseJsonObject as ur, deviceExtensionCapability as ut, FieldClaimModeSchema as v, streamQualityLabel as vn, evaluateCompositionField as vt, MINUTES_PER_DAY as w, withLocationMode as wn, formatMinutes as wt, LegacyStorageLocationDefaultSchema as x, vectorDimFromBase64 as xn, extractNestedAddonId as xt, FieldClaimSchema as y, userManagementCapability as yn, evictionPolicyOfLocation as yt, addonSettingsCapability as z, evaluateSensorEdge as zn, logLevelAtMost as zt };
+export { compositionSourceRefs as $, WELL_KNOWN_TAB_MAP as $n, parseStreamParamsFormPatch as $t, STORAGE_ACCESS_FALLBACK as A, SOURCE_CAPS as An, isCollectionArrayMethod as At, addonWidgetsCapability as B, evaluateSensorEdge as Bn, locationIconKey as Bt, METHOD_ACCESS_MAP as C, validateComposition as Cn, expandContainer as Ct, REDACTED_SECRET as D, withLocationMode as Dn, formatMinutes as Dt, RECORDING_SOURCE_CAMSTACK_ADDON as E, vectorStoreCapability as En, foldSnapshotByFunction as Et, StorageLocationTypeSchema as F, compositionFeatureEnabled as Fn, kebabToCamel as Ft, batteryCapability as G, DeviceType as Gn, mayWriteToLocation as Gt, authProviderCapability as H, toExpressionValue as Hn, logLevelAtMost as Ht, StorageMigrationJobSchema as I, compositionItemFieldPath as In, legacyAutoLinkIds as It, buildStreamParamsConfigSchema as J, DATAPLANE_SECRET_HEADER as Jn, modeMayWrite as Jt, buildCapabilityLookup as K, errMsg as Kn, memoizePinnedFfmpeg as Kt, UserRecordSchema as L, compositionSliceKey as Ln, legacyModeOf as Lt, ScopedTokenSchema as M, cloneStatefulExpressionMemory as Mn, isObjectInput as Mt, StorageCleanupJobSchema as N, composedDeviceRef as Nn, isSameAddonId as Nt, RUNTIME_DEFAULTS as O, COMPOSER_ADDON_ID as On, gbToBytes as Ot, StorageLocationModeSchema as P, composedDeviceStableId as Pn, isVoidInput as Pt, compositionFieldKey as Q, ReadinessTimeoutError as Qn, objectInputDeclaresRequiredDeviceId as Qt, addonPagesCapability as R, compositionSourceKey as Rn, lifecycleJobSchema as Rt, LocationIconIdSchema as S, userManagementCapability as Sn, evictionPolicyOfLocation as St, MOTION_CLOSE_AFTER_MS as T, vectorIndexDimConflictError as Tn, filesystemBrowseCapability as Tt, backupCapability as U, DeviceFeature as Un, looseSchema as Ut, alertsCapability as V, isSourceCap as Vn, logDestinationCapability as Vt, bareAddonId as W, DeviceRole as Wn, mayReadLocation as Wt, collectSecretConfigKeys as X, DEVICE_STATUS_METHOD as Xn, normalizeUnit as Xt, cameraGridLayoutCapability as Y, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Yn, motionCapability as Yt, composerCapability as Z, ReadinessRegistry as Zn, objectInputDeclaresAddonId as Zt, FIRST_LEVEL_MACRO_CLASSES as _, storageMigrationCapability as _n, EventCategory as _r, doorbellFeatureSources as _t, BatteryStatusSchema as a, replacedFieldKeys as an, emitReadiness as ar, createDeviceExtensionProvider as at, LOG_LEVEL_RANK as b, streamCatalogCapability as bn, enumerateSchemaFields as bt, COMPOSED_ITEM_FIXED_FIELDS as c, resolveMethodAuth as cn, isDeviceConfigCap as cr, decodeVectorBase64 as ct, CORE_BLOCK_ADDON_PREFIX as d, scopesAllowDeviceCap as dn, parseJsonObject as dr, describeComposableCaps as dt, planComposition as en, asJsonObject as er, coreBlockAddonId as et, CoreBlockSchema as f, scoreRuntimes as fn, parseJsonUnknown as fr, deviceExtensionCapability as ft, DeviceStatusSchema as g, storageCapability as gn, sleep as gr, doorbellCapability as gt, DeclaredDevices as h, snapshotCapability as hn, scopeKey as hr, deviceStatusCapability as ht, BaseDevice as i, reducePoints as in, emitDownForOwnedCaps as ir, coreBlocksCapability as it, STREAM_PROFILE_META as j, buildFfmpegArgs as jn, isLocationEnabled as jt, RecordingStatusSchema as k, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as kn, isArrayOutputSchema as kt, COMPOSER_RUNNER_ID as l, runtimeStatePolicyFor as ln, isEvent as lr, defineExtensionSlotProvider as lt, DERIVED_CAMERA_SILENCED_CAP_NAMES as m, siteZoneKey as mn, resolveCapMount as mr, deviceStateCapability as mt, AlertSchema as n, procedureAuthKey as nn, asString$1 as nr, coreBlockIdFromAddonId as nt, CAMERA_SWITCH_ORDER as o, resolveBucketMs as on, expandCapMethods as or, dataStoreProviderCapability as ot, DAY_NAMES as p, settingsStoreCapability as pn, readinessKey as pr, deviceManagerCapability as pt, buildDoorbellCompositionFeature as q, BaseAddon as qn, metricsProviderCapability as qt, ApiKeyRecordSchema as r, ptzAutotrackCapability as rn, createEvent as rr, coreBlockSourceKind as rt, CAP_NAMES_WITH_STATUS as s, resolveLocationMode as sn, hydrateSchema as sr, declarationOwnerNodeId as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tn, asNumber as tr, coreBlockComposition as tt, CORE_BLOCKS_ADDON_ID as u, scopesAllowAddon as un, nodePin as ur, deriveBatteryPresence as ut, FieldClaimModeSchema as v, storageOccupancyCapability as vn, enumerateInferenceDevices as vt, MINUTES_PER_DAY as w, vectorDimFromBase64 as wn, extractNestedAddonId as wt, LegacyStorageLocationDefaultSchema as x, streamQualityLabel as xn, evaluateCompositionField as xt, FieldClaimSchema as y, storageProviderCapability as yn, enumerateItemArrayFields as yt, addonSettingsCapability as z, createStatefulExpressionMemory as zn, localNetworkCapability as zt };