@camstack/system 1.2.330 → 1.2.332

package/dist/{dist-Dp043AI0.mjs → dist-BEPK2RUO.mjs}

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import "node:crypto";
-//#region ../types/dist/event-category-C5xZWqz6.mjs
+//#region ../types/dist/event-category-BGmz_oxW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -533,6 +533,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
 	EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
+	/**
+	* A camera provider's RAW onboard motion push (D673): the `MotionOnMotionChanged`
+	* data shape without `triggeredBy`, built by `providerMotionEvent`. Its one
+	* consumer is the orchestrator's camera-sensors bridge, which re-emits the
+	* camera's EFFECTIVE onboard motion as `MotionOnMotionChanged` (a pass-through
+	* for a camera with no attached sensor). Providers must not emit
+	* `MotionOnMotionChanged` themselves; `scripts/check-onboard-motion-emitters.ts`
+	* keeps it so (camera-grid is a named, deferred exception).
+	*/
 	EventCategory["ProviderMotion"] = "provider.motion";
 	EventCategory["ProviderDetection"] = "provider.detection";
 	EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
@@ -701,7 +710,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-gU6hqv4_.mjs
+//#region ../types/dist/sleep-CDCONfkt.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -3512,7 +3521,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-Dq42XWp0.mjs
+//#region ../types/dist/composition-43aqsZQj.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -3961,13 +3970,12 @@ portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac
 * LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
 * valutatore puro del suo FRONTE.
 *
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
+* UNA tabella per tutti quelli che chiedono "questo device è ALTO?": il
+* trigger `RecordingTriggers.sensorDeviceIds` del recorder, i marker dei
+* sensori della post-analysis, il bridge camera-sensors dell'orchestratore e
+* le sorgenti di un campanello composto (`doorbellFeatureSources`, D671).
+* Una seconda copia divergerebbe alla prima cap aggiunta, e il sintomo — "il
+* sensore fa suonare il campanello ma non registra" — è esattamente D62.
 *
 * ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
 * due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
@@ -3994,53 +4002,6 @@ var SOURCE_CAP_ACTIVE_FIELD = {
 	tamper: "tampered"
 };
 /**
-* The same caps → the slice field carrying the ms-epoch timestamp of the
-* last transition. Every source cap MUST appear here (guarded by a spec):
-* without a transition timestamp the evaluator cannot tell a genuine rise
-* from a boot-time hydration when the FIRST slice it ever sees is already
-* active, and errs towards silence — swallowing the rise.
-*
-* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
-* provider derives them from `state.last_changed`, so they survive our own
-* restarts and correctly read as "hours ago" for a state that has been
-* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
-*/
-var SOURCE_CAP_CHANGED_AT_FIELD = {
-	contact: "lastChangedAt",
-	binary: "lastChangedAt",
-	switch: "lastChangedAt",
-	motion: "lastDetectedAt",
-	flood: "lastChangedAt",
-	gas: "lastChangedAt",
-	smoke: "lastChangedAt",
-	"carbon-monoxide": "lastChangedAt",
-	vibration: "lastChangedAt",
-	tamper: "lastChangedAt"
-};
-/** Cap names whose presence in a device's bindings qualify it as a source. */
-var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
-/** True when a cap is a recognised binary/switch source. */
-function isSourceCap(capName) {
-	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
-}
-/** Extract the "active" boolean a source cap's slice carries, or null when
-*  the cap is unknown or the field is missing / non-boolean. */
-function sliceActiveValue(capName, slice) {
-	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	return typeof raw === "boolean" ? raw : null;
-}
-/** Ms-epoch transition timestamp a source cap's slice carries, or null when
-*  it is absent, non-numeric or the zero "never observed" sentinel. */
-function sliceChangedAt(capName, slice) {
-	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
-	return raw;
-}
-/**
 * How recent a source's own transition timestamp must be for a FIRST
 * sighting that is already active to count as a genuine rise rather than a
 * hydration of long-standing state.
@@ -4066,65 +4027,6 @@ function evaluateSensorLevelEdge(input) {
 	};
 }
 /**
-* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
-* porta `prior`, `nowMs` e il proprio `startedAtMs`.
-*
-* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
-* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
-* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
-* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
-* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
-* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
-* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
-* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
-*/
-function evaluateSensorEdge(input) {
-	const value = sliceActiveValue(input.capName, input.slice);
-	if (value === null) return {
-		edge: "none",
-		value: null,
-		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
-	};
-	if (evaluateSensorLevelEdge({
-		level: value,
-		changedAt: sliceChangedAt(input.capName, input.slice),
-		priorLevel: input.prior,
-		startedAtMs: input.startedAtMs,
-		nowMs: input.nowMs,
-		firstSightingFreshnessMs: input.firstSightingFreshnessMs
-	}).kind === "rise") return {
-		edge: "rising",
-		value: true
-	};
-	if (input.prior === void 0) {
-		if (!value) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-inactive"
-		};
-		return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-stale-active"
-		};
-	}
-	if (input.prior === value) return {
-		edge: "none",
-		value,
-		reason: "no-change"
-	};
-	if (!value) return {
-		edge: "none",
-		value,
-		reason: "falling-edge"
-	};
-	return {
-		edge: "none",
-		value,
-		reason: "missing-timestamp"
-	};
-}
-/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -6370,7 +6272,7 @@ var RecordingTriggersSchema = z.object({
 	*
 	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
 	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
-	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+	* la stessa del campanello composto (D671). Ed è il FRONTE, non
 	* il livello: un contatto trovato già aperto al riavvio del runner non fa
 	* registrare.
 	*/
@@ -16056,8 +15958,8 @@ var deviceManagerCapability = {
 		* (`value` / `missing` / `failed`, see {@link WrapperActivationReadSchema}).
 		*
 		* The narrow read of the durable authority behind `getBindings`: a
-		* consumer that must know what the operator PERSISTED (virtual-doorbell,
-		* before it drops a press) asks this instead of pulling device-manager's
+		* consumer that must know what the operator PERSISTED (before it drops
+		* work on the strength of an unbind) asks this instead of pulling device-manager's
 		* whole addon store through `addonSettingsRaw.getGlobal` — which answered
 		* `{}` on every isolated-engine hub and so never worked (D675). It reads
 		* ONE row (the activation map, ~1.6 KB), never the ~625 KB store.
@@ -16347,120 +16249,14 @@ var deviceManagerCapability = {
 		}), z.record(z.string(), z.record(z.string(), z.unknown().nullable())))
 	}
 };
-/**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = z.object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: z.number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: z.number()
-});
-var DoorbellPressEventSchema = z.object({
-	deviceId: z.number(),
-	timestamp: z.number()
-});
-/**
-* The `doorbell-source` extension slot's editable value (D648): the camera's
-* virtual-doorbell trigger devices, exactly what the wrapper's
-* `doorbellSources` persists (as `{ deviceId }` records).
-*/
-var DoorbellSourceSlotValueSchema = z.object({ deviceIds: z.array(z.number().int().positive()) });
-/**
-* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
-* doorbell, owned by the `virtual-doorbell` wrapper over its
-* `doorbellSources` store (D648). A source rings when one of its
-* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
-* different authority (`deviceManager.setWrapperActive`, D62) — the slot
-* reports it, it never writes it.
-*/
-var DOORBELL_SOURCE_SLOT = {
-	id: "doorbell-source",
-	label: "Doorbell trigger devices",
-	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
-	shape: "association",
-	hostDeviceTypes: [DeviceType.Camera],
-	sourceCaps: SOURCE_CAPS,
-	cardinality: "many",
-	value: DoorbellSourceSlotValueSchema
-};
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	extensionSlots: [DOORBELL_SOURCE_SLOT],
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: {
-		data: DoorbellPressEventSchema,
-		fromState: {
-			field: "lastPressedAt",
-			on: "advance"
-		}
-	} },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-var ExtensionSlotIdSchema = z.enum(["doorbell-source", "linked-devices"]);
-var EXTENSION_SLOTS = {
-	"doorbell-source": {
-		descriptor: DOORBELL_SOURCE_SLOT,
-		declaringCap: "doorbell",
-		hostDeviceTypes: [DeviceType.Camera]
-	},
-	"linked-devices": {
-		descriptor: LINKED_DEVICES_SLOT,
-		declaringCap: "device-manager",
-		hostDeviceTypes: [DeviceType.Camera]
-	}
-};
+var ExtensionSlotIdSchema = z.enum(["linked-devices"]);
+var EXTENSION_SLOTS = { "linked-devices": {
+	descriptor: LINKED_DEVICES_SLOT,
+	declaringCap: "device-manager",
+	hostDeviceTypes: [DeviceType.Camera]
+} };
 /** A slot's editable value, discriminated on `slot`. */
-var ExtensionSlotValueSchema = z.discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: z.literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: z.literal("linked-devices") })]);
+var ExtensionSlotValueSchema = z.discriminatedUnion("slot", [LinkedDevicesSlotValueSchema.extend({ slot: z.literal("linked-devices") })]);
 /** Every device type at least one slot is offered on — `device-extension`'s `deviceTypes`. */
 var EXTENSION_HOST_DEVICE_TYPES = [DeviceType.Camera];
 var ExtensionSourceAvailabilitySchema = z.discriminatedUnion("state", [z.object({ state: z.literal("ok") }), z.object({
@@ -16498,10 +16294,11 @@ var ExtensionSlotSourceSchema = z.object({
 });
 /**
 * A DIFFERENT authority that gates whether the slot's sources do anything —
-* reported read-only, named, never written through this contract (D62). The
-* virtual doorbell's sources ring only while the wrapper is bound to the
-* camera, and that binding belongs to `deviceManager.setWrapperActive`.
-* `unknown` means the gate could not be read; it is not "inactive" (D315).
+* reported read-only, named, never written through this contract (D62) — e.g.
+* a slot whose sources act only while a wrapper is bound to the host, a
+* binding that belongs to `deviceManager.setWrapperActive`. No slot reports
+* one today (`linked-devices` answers `null`). `unknown` means the gate could
+* not be read; it is not "inactive" (D315).
 */
 var ExtensionSlotActivationSchema = z.object({
 	state: z.enum([
@@ -16518,7 +16315,7 @@ var ExtensionSlotStateSchema = z.object({
 	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
 	slotRef: z.string(),
 	slot: ExtensionSlotIdSchema,
-	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	/** Names the store written (D62), e.g. `device-manager:_linkedDeviceIds`. */
 	authority: z.string(),
 	activation: ExtensionSlotActivationSchema.nullable(),
 	value: ExtensionSlotValueSchema,
@@ -16712,8 +16509,8 @@ var deviceStateCapability = {
 		* Canonical cross-layer WRITE for one cap-keyed slice. Used by
 		* everyone who needs to publish runtime state for a device:
 		* device providers (via `BaseDevice.runtimeState.setCapState`
-		* which delegates here), system-scope addons (e.g. the pipeline
-		* runner writing the `motion` slice on phase transitions), and
+		* which delegates here), system-scope addons (e.g. the orchestrator
+		* writing a camera's effective `motion` slice, D696), and
 		* direct cap-router callers in tests.
 		*
 		* Behavior on the hub:
@@ -21599,6 +21396,37 @@ z.object({
 	firstAt: z.number(),
 	lastAt: z.number()
 });
+var NC_ALARM_TRIGGERED_MAX_SEC = 3600;
+var NcAlarmDelaySecSchema = z.number().int().min(0).max(600);
+var NcAlarmTriggeredSecSchema = z.number().int().min(0).max(NC_ALARM_TRIGGERED_MAX_SEC);
+var uniqueModes = (entries) => new Set(entries.map((e) => e.mode)).size === entries.length;
+/** One mode's OVERRIDES. An absent field inherits the global value (D697). */
+var NcAlarmModeDelaysSchema = z.object({
+	mode: AlarmArmModeSchema,
+	exitDelaySec: NcAlarmDelaySecSchema.optional(),
+	entryDelaySec: NcAlarmDelaySecSchema.optional(),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.optional()
+});
+var NcAlarmModeDelaysListSchema = z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
+/**
+* One mode's EDIT in a patch: a number sets the override, `null` removes it (the mode inherits
+* again), an absent field leaves it alone. Per field, so two editors changing two different
+* delays of one mode never undo each other.
+*/
+var NcAlarmModeDelaysEditSchema = z.object({
+	mode: AlarmArmModeSchema,
+	exitDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
+	entryDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional()
+});
+var NcAlarmModeDelaysEditListSchema = z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
+/** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
+var NcAlarmNonBlockingEditSchema = z.object({
+	mode: AlarmArmModeSchema,
+	deviceId: z.number().int().positive(),
+	/** true = on the list (may be open, does not block); false = off the list (blocks). */
+	nonBlocking: z.boolean()
+});
 /**
 * One arm mode's non-blocking list: devices that may be open when that mode
 * arms, without the arm being refused.
@@ -21612,10 +21440,10 @@ var NcAlarmNonBlockingSchema = z.object({
 * meaning a reader could agree on (union? the last one?), so they are refused
 * at the boundary rather than interpreted.
 */
-var NcAlarmNonBlockingListSchema = z.array(NcAlarmNonBlockingSchema).max(8).refine((lists) => new Set(lists.map((l) => l.mode)).size === lists.length, { message: "nonBlocking: at most one list per arm mode" });
+var NcAlarmNonBlockingListSchema = z.array(NcAlarmNonBlockingSchema).max(8).refine(uniqueModes, { message: "nonBlocking: at most one list per arm mode" });
 /**
-* The three durations the panel's state machine runs on, who hears about its
-* transitions, and which openings each mode tolerates.
+* The three durations — global, and per mode since D697 — the panel's state
+* machine runs on, who hears about its transitions, and which openings each mode tolerates.
 *
 * They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
 * `alarm-panel` is `deviceNative` and its other provider mirrors somebody
@@ -21625,15 +21453,15 @@ var NcAlarmNonBlockingListSchema = z.array(NcAlarmNonBlockingSchema).max(8).refi
 */
 var NcAlarmSettingsSchema = z.object({
 	/** Grace period between arming and the mode taking effect. 0 = immediate. */
-	exitDelaySec: z.number().int().min(0).max(600),
+	exitDelaySec: NcAlarmDelaySecSchema,
 	/** Grace period between a trigger and the alarm firing. 0 = immediate. */
-	entryDelaySec: z.number().int().min(0).max(600),
+	entryDelaySec: NcAlarmDelaySecSchema,
 	/**
 	* How long `triggered` lasts before the panel re-arms itself.
 	* **0 = until an operator disarms it** — the behaviour before this field
 	* existed, and therefore what an untouched install keeps doing.
 	*/
-	triggeredDurationSec: z.number().int().min(0).max(3600),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema,
 	/**
 	* Deprecated by D630 — every transition is announced. Parsed, never read;
 	* remove after one release. Optional so an older admin's patch (which still
@@ -21656,17 +21484,30 @@ var NcAlarmSettingsSchema = z.object({
 	* per mode is meaningful. Defaulted to `[]` so a blob stored before D630
 	* parses as "every opening blocks" — the behaviour it was written under.
 	*/
-	nonBlocking: NcAlarmNonBlockingListSchema.default([])
+	nonBlocking: NcAlarmNonBlockingListSchema.default([]),
+	/**
+	* Per arm mode, the delays that mode OVERRIDES (D697). A mode with no entry, or an entry
+	* without a field, uses the global value above — so `[]`, the default, is exactly the
+	* behaviour of a blob stored before this field existed. Read through `resolveModeDelays`.
+	*/
+	modeDelays: NcAlarmModeDelaysListSchema.default([])
 });
 /**
 * Every field optional — a tab edits one control at a time.
 *
-* `nonBlocking` is re-declared WITHOUT its default: `.partial()` does not
-* remove an inner `.default()`, so a patch that never named the field would
-* parse to `nonBlocking: []` and wipe every mode's list on an unrelated edit
-* (the same trap {@link NcRulePatchSchema} documents).
+* `nonBlocking` and `modeDelays` are re-declared WITHOUT their defaults:
+* `.partial()` does not remove an inner `.default()`, so a patch that never
+* named the field would parse to `[]` and wipe every mode's list on an
+* unrelated edit (the same trap {@link NcRulePatchSchema} documents). Here
+* `modeDelays` means EDITS, not the stored overrides.
 */
-var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({ nonBlocking: NcAlarmNonBlockingListSchema }).partial();
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({
+	nonBlocking: NcAlarmNonBlockingListSchema,
+	/** Per-mode, per-field edits — NOT the whole list (see NcAlarmModeDelaysEditSchema). */
+	modeDelays: NcAlarmModeDelaysEditListSchema,
+	/** ONE membership change; the panel applies it to the list it holds at its turn. */
+	nonBlockingEdit: NcAlarmNonBlockingEditSchema
+}).partial().refine((p) => p.nonBlocking === void 0 || p.nonBlockingEdit === void 0, { message: "nonBlocking and nonBlockingEdit are exclusive — send the whole lists or one edit" });
 /**
 * What one arm mode actually arms, DERIVED from the enabled rules gated on it.
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
@@ -21766,6 +21607,28 @@ var NcAlarmConfigSchema = z.object({
 	*/
 	live: NcAlarmLiveSchema.optional()
 });
+var NcAlarmSensorReadingSchema = z.enum([
+	"open",
+	"closed",
+	"unknown",
+	"not-opening"
+]);
+/** One device's state as the alarm reads it — the classifier the arm check uses. */
+var NcAlarmSensorStateSchema = z.object({
+	deviceId: z.number().int().positive(),
+	reading: NcAlarmSensorReadingSchema,
+	/** The word as read (`open`, `closed`, `unlocked`, `stopped`, …); null when unknown / not an opening. */
+	state: z.string().nullable(),
+	/** Why `unknown`: the read failed, or the slice holds no word its cap defines (a placeholder included). */
+	unknownWhy: z.enum(["read-failed", "unknown-word"]).nullable(),
+	/** The device manager's liveness as the centre mirrors it; null = not known. */
+	online: z.boolean().nullable()
+});
+var NcAlarmSensorsInputSchema = z.object({ deviceIds: z.array(z.number().int().positive()).max(500) });
+var NcAlarmSensorsSchema = z.object({
+	sensors: z.array(NcAlarmSensorStateSchema),
+	readAt: z.number().int().nonnegative()
+});
 /**
 * ONE rule's demand on ONE camera's clip ring.
 *
@@ -22007,8 +21870,9 @@ var notificationRulesCapability = {
 		*/
 		getAlarmConfig: method(z.object({}), NcAlarmConfigSchema, { auth: "admin" }),
 		/**
-		* Patch the settings (durations, recipients, per-mode non-blocking lists;
-		* `announceArm` is accepted and ignored — D630). Returns the WHOLE config,
+		* Patch the settings (durations — global and per mode —, recipients,
+		* per-mode non-blocking lists or one membership edit; `announceArm` is
+		* accepted and ignored — D630). Returns the WHOLE config,
 		* coverage and `live` included, so a
 		* client never has to guess what the server settled on — the panel clamps
 		* and normalises, and a form that re-rendered from its own input would
@@ -22017,7 +21881,15 @@ var notificationRulesCapability = {
 		setAlarmConfig: method(z.object({ patch: NcAlarmSettingsPatchSchema }), NcAlarmConfigSchema, {
 			kind: "mutation",
 			auth: "admin"
-		})
+		}),
+		/**
+		* The CURRENT state of each asked device as the alarm reads it (D697) — open, closed,
+		* unknown (why) or not an opening, plus liveness. Classified by the same table the arm
+		* check uses (`alarm-openings.ts`), so the editor and the arm can never disagree. The
+		* caller names the ids (the household openings it already holds); at most
+		* `NC_ALARM_SENSORS_MAX`.
+		*/
+		getAlarmSensors: method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" })
 	}
 };
 /**
@@ -22382,12 +22254,27 @@ var CameraSensorRefSchema = z.object({
 function cameraSensorRefKey(ref) {
 	return `${ref.addonId}/${ref.stableId}`;
 }
-/** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
-var CameraSensorsModeSchema = z.enum(["in-addition"]);
-var CameraSensorsConfigSchema = z.object({
-	mode: CameraSensorsModeSchema,
-	sensors: z.array(CameraSensorRefSchema).min(1).max(8)
-}).superRefine((value, ctx) => {
+/**
+* A sensor's mode (D673). `in-addition`: its motion is the camera's motion too.
+* `replace`: its motion is the camera's, and while one is READY the camera's
+* own motion no longer counts on its own. `confirm`: while one is READY the
+* camera's own motion counts only while a confirm sensor is active — with or
+* without a replace sensor (spec C2, the controller's ruling on Q1).
+*/
+var CameraSensorModeSchema = z.enum([
+	"in-addition",
+	"confirm",
+	"replace"
+]);
+/** A stored sensor with no mode — every CS-1 row — is in addition. */
+var DEFAULT_CAMERA_SENSOR_MODE = "in-addition";
+var CameraSensorEntrySchema = CameraSensorRefSchema.extend({ mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE) });
+/**
+* A camera's attached sensors. A CS-1 row carried an envelope
+* `mode: 'in-addition'`: `z.object` drops it on parse, and the PARSED value is
+* what the write stores (D672 rule 3), so it is never written again.
+*/
+var CameraSensorsConfigSchema = z.object({ sensors: z.array(CameraSensorEntrySchema).min(1).max(8) }).superRefine((value, ctx) => {
 	const seen = /* @__PURE__ */ new Set();
 	value.sensors.forEach((ref, index) => {
 		const key = cameraSensorRefKey(ref);
@@ -22399,39 +22286,41 @@ var CameraSensorsConfigSchema = z.object({
 		seen.add(key);
 	});
 });
-var RefFields = {
+/** Every attachment names its mode; an older orchestrator that does not is in addition. */
+var AttachmentFields = {
 	addonId: z.string(),
-	stableId: z.string()
+	stableId: z.string(),
+	mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE)
 };
 var CameraSensorAttachmentSchema = z.discriminatedUnion("state", [
 	z.object({
-		...RefFields,
+		...AttachmentFields,
 		state: z.literal("ready"),
 		deviceId: z.number(),
 		name: z.string(),
 		caps: z.array(z.string()).readonly()
 	}),
 	z.object({
-		...RefFields,
+		...AttachmentFields,
 		state: z.literal("offline"),
 		deviceId: z.number(),
 		name: z.string(),
 		reason: z.enum(["offline", "disabled"])
 	}),
 	z.object({
-		...RefFields,
+		...AttachmentFields,
 		state: z.literal("missing"),
 		reason: z.string()
 	}),
 	z.object({
-		...RefFields,
+		...AttachmentFields,
 		state: z.literal("unsupported"),
 		deviceId: z.number(),
 		name: z.string(),
 		reason: z.string()
 	}),
 	z.object({
-		...RefFields,
+		...AttachmentFields,
 		state: z.literal("unreadable"),
 		reason: z.string()
 	})
@@ -22444,17 +22333,49 @@ var CameraSensorAttachmentSchema = z.discriminatedUnion("state", [
 * say.
 */
 var CameraSensorsNotForwardedSchema = z.enum(["onboard-not-listed", "no-active-detection"]);
+/** Whether the camera's OWN motion counts on its own (D673 C2), from its READY sensors (C3). */
+var CameraOwnMotionSchema = z.enum([
+	"always",
+	"when-confirmed",
+	"never"
+]);
+/** Confirm / Replace cannot suppress this camera's motion: its provider still emits it directly (D673 C13). */
+var CameraSensorsNotEnforcedSchema = z.enum(["provider-not-split"]);
+/**
+* The camera's OWN onboard motion (D696): the raw input the bridge combines,
+* never the effective value. The camera's `motion` slice is the effective one,
+* so a view of the camera's own row reads this.
+* - `atMs`: when the bridge received the camera's last own edge.
+* - `detected`: evaluated WHEN THE STATUS IS ASKED — the last edge said `true`
+*   AND it is younger than the window the bridge counts the camera's own motion
+*   for (`motionCooldownMs`, floored at two sustain ticks). A camera that never
+*   sends a clear (heartbeats only) therefore reads `false` once no push came
+*   within the window; a status read is a snapshot, so a live view re-asks.
+* Absent = this orchestrator has not received the camera's own motion since it
+* started (unknown, never "quiet"), or an orchestrator older than D696.
+*/
+var CameraRawLevelSchema = z.object({
+	detected: z.boolean(),
+	atMs: z.number()
+});
 var CameraSensorsStatusSchema = z.discriminatedUnion("state", [
-	z.object({ state: z.literal("not-configured") }),
+	z.object({
+		state: z.literal("not-configured"),
+		cameraLevel: CameraRawLevelSchema.optional()
+	}),
 	z.object({
 		state: z.literal("unreadable"),
-		reason: z.string()
+		reason: z.string(),
+		cameraLevel: CameraRawLevelSchema.optional()
 	}),
 	z.object({
 		state: z.literal("configured"),
-		mode: CameraSensorsModeSchema,
+		cameraLevel: CameraRawLevelSchema.optional(),
 		sensors: z.array(CameraSensorAttachmentSchema).readonly(),
-		notForwarded: CameraSensorsNotForwardedSchema.optional()
+		/** Absent = an orchestrator older than CS-2: it does not say (D315). */
+		cameraMotion: CameraOwnMotionSchema.optional(),
+		notForwarded: CameraSensorsNotForwardedSchema.optional(),
+		notEnforced: CameraSensorsNotEnforcedSchema.optional()
 	})
 ]);
 Object.freeze({
@@ -26550,8 +26471,10 @@ var RunnerCameraConfigSchema = z.object({
 	* - `analyzer`: ML/frame-diff motion detection (motion-wasm or other
 	*   analyzer providers) running on decoded frames in this runner.
 	* - `onboard`: camera-native motion pushes (Reolink Baichuan, ONVIF
-	*   analytics). The provider emits ProviderMotion
-	*   events; the orchestrator forwards to `reportMotion`.
+	*   analytics). The provider emits its raw push as `ProviderMotion`
+	*   (D673); the orchestrator's camera-sensors bridge re-emits the camera's
+	*   effective motion as `MotionOnMotionChanged`, which is what reaches
+	*   `reportMotion`.
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
@@ -26728,7 +26651,15 @@ var RunnerLocalLoadSchema = z.object({
 		hasGpu: z.boolean(),
 		inferenceBackend: z.string().optional(),
 		cpuCores: z.number().optional()
-	})
+	}),
+	/**
+	* Who writes a camera's `motion` runtime slice (D696). `'orchestrator'`: this
+	* runner never writes it. ABSENT = a runner older than D696, which still
+	* writes the slice from its phase machine; the orchestrator does not write
+	* while any runner node is absent-or-unanswered, so one slice never has two
+	* writers.
+	*/
+	motionSliceWriter: z.literal("orchestrator").optional()
 });
 /**
 * Aggregate runtime metrics for the runner's whole local pool. Mirrors the
@@ -34052,6 +33983,70 @@ onStatusChanged: { data: z.object({
 	*  whether persisting is worth a SQLite commit. */
 	volatileStateFields: ["lastChangedAt"]
 };
+var DoorbellStatusSchema = z.object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: z.number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: z.number()
+});
+var DoorbellPressEventSchema = z.object({
+	deviceId: z.number(),
+	timestamp: z.number()
+});
+/**
+* Doorbell button cap. Two kinds of provider serve it, and to every consumer
+* they are the same cap:
+*
+*   - **Native** providers, registered per device by a driver addon through
+*     `ctx.registerNativeCap` — a `DeviceType.Button` accessory with
+*     `role: DeviceRole.Doorbell`, or the camera itself (Reolink registers at
+*     camera level). They emit `onPressed` on every firmware ring.
+*   - **A composed doorbell** (D670, D671): a camera's customization gives it
+*     the cap, its `lastPressedAt` rising from the sources the operator
+*     assigned in Customize → Doorbell, and the composer emits `onPressed`
+*     from that field's advance (`fromState`).
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent.
+*/
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: {
+		data: DoorbellPressEventSchema,
+		fromState: {
+			field: "lastPressedAt",
+			on: "advance"
+		}
+	} },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
 /**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -36462,11 +36457,11 @@ authKey: z.string().optional() }), z.object({
 /**
 * How long after a camera's last rising edge `pipeline-analytics` closes the
 * motion EPISODE row it kept open for it (D475) — "il delay della cap", in
-* the operator's words. One authority for the whole system: every provider
-* that seeds `autoClearAfterMs` on a `Camera` device writes this SAME
-* constant while `detected: true` (never its own number — Hikvision used to
-* seed its internal 3 s inactivity timer here, which is a different clock for
-* a different purpose), and `MotionEpisodeTracker` imports it directly rather
+* the operator's words. One authority for the whole system: the writer of a
+* `Camera` device's slice (the orchestrator, D696) writes this SAME constant
+* in `autoClearAfterMs` while `detected: true` (never a camera's own clock —
+* Hikvision used to seed its internal 3 s inactivity timer here, a different
+* clock for a different purpose), and `MotionEpisodeTracker` imports it directly rather
 * than reading the live cap value on the hot path. A `Sensor` device (HA
 * binary sensor, Homematic) gets a genuine push both ways and has no episode
 * to close on a timer, so it writes `null`, never this constant.
@@ -36477,9 +36472,9 @@ var MotionStatusSchema = z.object({
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: z.number().nullable(),
 	/**
-	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device,
-	* `null` while false and on every `Sensor` device (D475) — see that
-	* constant's doc for the one-authority rule.
+	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device (the
+	* orchestrator writes it, D696), `null` while false and on every `Sensor`
+	* device (D475) — see that constant's doc for the one-authority rule.
 	*
 	* ## Reading this field still arms nothing
 	*
@@ -36497,34 +36492,31 @@ var MotionStatusSchema = z.object({
 	* `addon-export-alexa/src/motion-clear-hold.ts` and
 	* `addon-export-hap`'s `RESET_DEBOUNCE_MS` both do.
 	*
-	* ## Who writes it
-	*
-	* - **Cameras** — the runner's phase machine, `active → watching` on
-	*   `cooldown_expired`, which then writes this slice with
-	*   `detected: false` (`handlePhaseChanged` in
-	*   `pipeline-runner/index.ts`). It produces the FALLING edge, which
-	*   matters most for the sources that only ever push a rising one:
-	*   Reolink emits `MotionOnMotionChanged { detected: true }` and never
-	*   a false.
-	* - **Sensors** (Home Assistant binary sensors, Homematic) — the
-	*   provider pushes the false itself, from the upstream system's own
-	*   state change. No phase machine is involved.
-	*
-	* ### The phase machine is CANONICAL, not sole — and that is a defect
-	*
-	* An earlier revision of this docblock (mine, 2026-09-12) claimed the
-	* phase machine is the sole writer for a camera. It is not.
-	* `hikvision-camera.ts:3464` and `amcrest-camera.ts:445` both call
-	* `setCapSlice(motionCapability, …)` on their own rising edge, and
-	* Hikvision's comment says why: it read THIS docblock, agreed the
-	* runner is canonical, and wrote anyway to avoid per-tick churn. So
-	* two authorities can disagree about one slice, which this repo
-	* forbids, and the doc said otherwise — which is worse than saying
-	* nothing, because it reads as verification.
-	*
-	* This predates D475 and is not fixed there: the fix touches every
-	* camera provider. Recorded in D475's Consequences. Do not restore the
-	* "sole writer" wording without also removing the other writers.
+	* ## Who writes it (D696)
+	*
+	* - **Cameras** — the orchestrator, and nothing else. It writes the camera's
+	*   EFFECTIVE motion (`addon-pipeline-orchestrator`
+	*   `camera-sensors/motion-slice.ts`), alongside the effective
+	*   `MotionOnMotionChanged` it emits or receives: the camera-sensors bridge
+	*   for a split camera, an unsplit emitter's direct event, the analyzer and
+	*   device activity, as the camera's `motionSources` counts them. A source
+	*   that never sends a clear falls one window after its last `true`.
+	*   `lastDetectedAt` moves only on an effective rise. No camera provider
+	*   writes this slice (not even a boot seed), and neither does the runner's
+	*   phase machine: its phase is "a session is attached" for every on-motion
+	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
+	*   A provider's `isDetected` answers from the hub's slice.
+	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
+	*   imports) — the provider pushes both edges itself, from the upstream
+	*   system's own state change. That is the sensor's own fact.
+	*
+	* `scripts/check-onboard-motion-emitters.ts` refuses any other writer of a
+	* `motion` slice; each sensor writer is a named exemption.
+	*
+	* This replaces the D475 §4 rule ("the phase machine is the sole writer").
+	* That rule was never true: Hikvision and Amcrest wrote the slice raw beside
+	* it, every provider seeded it at boot, and every session left it
+	* `detected: true` after its detach.
 	*/
 	autoClearAfterMs: z.number().nullable()
 });
@@ -36596,11 +36588,12 @@ onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
 	*/
 	runtimeState: MotionStatusSchema,
 	/**
-	* Runtime-state durability: **session** — every writer of this slice
+	* Runtime-state durability: **session** — the writer of this slice
 	* writes only on an EDGE, so a restored `detected: true` would stay
 	* frozen until the next one instead of being corrected. The next edge
-	* re-publishes the real state. (On who the writers are, and why there
-	* is more than one, see `autoClearAfterMs` above.)
+	* re-publishes the real state, and the orchestrator re-publishes every
+	* camera when it starts writing (D696; on who writes it, see
+	* `autoClearAfterMs` above).
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
@@ -39316,8 +39309,7 @@ var ptzAutotrackCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	/**
-	* Two kinds of provider behind one name, the same shape `snapshot` and
-	* `doorbell` use:
+	* Two kinds of provider behind one name, the same shape `snapshot` uses:
 	*
 	*  - **Native**: the camera's own firmware autotrack, registered per device by
 	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
@@ -39325,7 +39317,7 @@ var ptzAutotrackCapability = {
 	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
 	*    which follows a subject with `ptz.move` pulses driven by the detection
 	*    pipeline. `defaultActive: false` — the operator binds it per camera in
-	*    the bindings UI, exactly as `virtual-doorbell` is bound.
+	*    the bindings UI.
 	*
 	* The binding chooses WHICH implementation answers; `setEnabled` stays the
 	* one switch for the function either way. A camera never has both driving its
@@ -44697,72 +44689,6 @@ function evaluateCompositionField(input) {
 	}
 }
 /**
-* The doorbell of a camera as a customization (D671). ONE builder: the
-* virtual-doorbell migration and the admin UI's "Use as doorbell" preset both
-* call it, so a preset can never write a shape the migration would refuse as
-* "an unrelated existing block".
-*/
-/** A rise closer than this to the previous one is the same press (D671). */
-var DOORBELL_RISE_DEBOUNCE_MS = 2e3;
-/** Every source cap of `source` that `SOURCE_CAP_ACTIVE_FIELD` knows AND the device has bound. */
-function doorbellFeatureSources(source, boundCaps) {
-	return Object.keys(SOURCE_CAP_ACTIVE_FIELD).filter((cap) => Object.hasOwn(SOURCE_CAP_CHANGED_AT_FIELD, cap) && boundCaps.includes(cap)).toSorted().flatMap((cap) => {
-		const activeField = SOURCE_CAP_ACTIVE_FIELD[cap];
-		const changedAtField = SOURCE_CAP_CHANGED_AT_FIELD[cap];
-		return activeField === void 0 || changedAtField === void 0 ? [] : [{
-			source,
-			cap,
-			activeField,
-			changedAtField
-		}];
-	});
-}
-/** The D671 feature, byte for byte what the migration writes. Throws on zero sources. */
-function buildDoorbellCompositionFeature(input) {
-	const sources = [...input.sources].toSorted((a, b) => `${a.source.addonId}/${a.source.stableId}#${a.cap}`.localeCompare(`${b.source.addonId}/${b.source.stableId}#${b.cap}`));
-	if (sources.length === 0) throw new Error("doorbell composition needs at least one source");
-	const edgeBindings = {};
-	sources.forEach((entry, index) => {
-		edgeBindings[`active${index}`] = {
-			kind: "from",
-			source: entry.source,
-			cap: entry.cap,
-			fieldPath: entry.activeField
-		};
-		edgeBindings[`changed${index}`] = {
-			kind: "from",
-			source: entry.source,
-			cap: entry.cap,
-			fieldPath: entry.changedAtField
-		};
-	});
-	return {
-		kind: "fields",
-		cap: "doorbell",
-		enabled: input.enabled,
-		fields: {
-			lastPressedAt: {
-				kind: "expression",
-				expr: `latest(${sources.map((_, index) => `rose(active${index}, changed${index}, ${DOORBELL_RISE_DEBOUNCE_MS})`).join(", ")})`,
-				bindings: edgeBindings
-			},
-			pressCountSinceStart: {
-				kind: "expression",
-				expr: "count(lastPressedAt)",
-				bindings: { lastPressedAt: {
-					kind: "from",
-					source: {
-						addonId: input.camera.addonId,
-						stableId: input.camera.stableId
-					},
-					cap: "doorbell",
-					fieldPath: "lastPressedAt"
-				} }
-			}
-		}
-	};
-}
-/**
 * Runtime defaults -- used by ConfigManager.get() for backward compatibility
 * until Plan B wires all runtime settings to the system_settings SQL table.
 *
@@ -51336,6 +51262,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getAlarmSensors": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getClipRetentionAsks": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -55819,6 +55751,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"notificationRules.getAlarmSensors": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"notificationRules.setDeviceMuted": [{
 		name: "deviceId",
 		form: "single",
@@ -58054,6 +57991,7 @@ TimelapseRuleInputSchema.extend({
 	createdAt: z.number(),
 	updatedAt: z.number()
 });
+MotionOnMotionChangedDataSchema.omit({ triggeredBy: true });
 z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -58253,8 +58191,8 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 * So `entry.providerAddonId === this.ctx.id` is silently, permanently false
 * for a builtin — and only for a builtin, which is why it survives a green
 * suite whose fake supplies the bare id. That is exactly how camera 615's
-* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
-* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
+* virtual doorbell (retired since, D671) latched `unbound` for twelve hours on
+* 2026-08-07 while its binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
 *
 * Route every comparison between `ctx.id` and a registry/store addon id
 * through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
@@ -58266,10 +58204,6 @@ var ADDON_ID_PREFIX = "addon:";
 function bareAddonId(id) {
 	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
 }
-/** True when both ids name the same addon, prefixed or not. */
-function isSameAddonId(a, b) {
-	return bareAddonId(a) === bareAddonId(b);
-}
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 /**
@@ -58404,4 +58338,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { collectSecretConfigKeys as $, DEVICE_SETTINGS_CONTRIBUTION_METHODS as $n, motionCapability as $t, REDACTED_SECRET as A, vectorStoreCapability as An, foldSnapshotByFunction as At, UserRecordSchema as B, compositionItemFieldPath as Bn, legacyAutoLinkIds as Bt, LOG_LEVEL_RANK as C, storageProviderCapability as Cn, enumerateItemArrayFields as Ct, MINUTES_PER_DAY as D, validateComposition as Dn, expandContainer as Dt, METHOD_ACCESS_MAP as E, userManagementCapability as En, evictionPolicyOfLocation as Et, ScopedTokenSchema as F, buildFfmpegArgs as Fn, isLocationEnabled as Ft, authProviderCapability as G, isSourceCap as Gn, logDestinationCapability as Gt, addonSettingsCapability as H, compositionSourceKey as Hn, lifecycleJobSchema as Ht, StorageCleanupJobSchema as I, cloneStatefulExpressionMemory as In, isObjectInput as It, batteryCapability as J, DeviceRole as Jn, mayReadLocation as Jt, backupCapability as K, toExpressionValue as Kn, logLevelAtMost as Kt, StorageLocationModeSchema as L, composedDeviceRef as Ln, isSameAddonId as Lt, RecordingStatusSchema as M, COMPOSER_ADDON_ID as Mn, gbToBytes as Mt, STORAGE_ACCESS_FALLBACK as N, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as Nn, isArrayOutputSchema as Nt, MOTION_CLOSE_AFTER_MS as O, vectorDimFromBase64 as On, extractNestedAddonId as Ot, STREAM_PROFILE_META as P, SOURCE_CAPS as Pn, isCollectionArrayMethod as Pt, cameraGridLayoutCapability as Q, DATAPLANE_SECRET_HEADER as Qn, modeMayWrite as Qt, StorageLocationTypeSchema as R, composedDeviceStableId as Rn, isVoidInput as Rt, FieldClaimSchema as S, storageOccupancyCapability as Sn, EventCategory as Sr, enumerateInferenceDevices as St, LocationIconIdSchema as T, streamQualityLabel as Tn, evaluateCompositionField as Tt, addonWidgetsCapability as U, createStatefulExpressionMemory as Un, localNetworkCapability as Ut, addonPagesCapability as V, compositionSliceKey as Vn, legacyModeOf as Vt, alertsCapability as W, evaluateSensorEdge as Wn, locationIconKey as Wt, buildDoorbellCompositionFeature as X, errMsg as Xn, memoizePinnedFfmpeg as Xt, buildCapabilityLookup as Y, DeviceType as Yn, mayWriteToLocation as Yt, buildStreamParamsConfigSchema as Z, BaseAddon as Zn, metricsProviderCapability as Zt, DERIVED_CAMERA_SILENCED_CAP_NAMES as _, settingsStoreCapability as _n, readinessKey as _r, deviceManagerCapability as _t, BatteryStatusSchema as a, platformProbeCapability as an, asNumber as ar, coreBlockIdFromAddonId as at, FIRST_LEVEL_MACRO_CLASSES as b, storageCapability as bn, sleep as br, doorbellCapability as bt, COMPOSED_ITEM_FIXED_FIELDS as c, reducePoints as cn, emitDownForOwnedCaps as cr, createDeviceExtensionProvider as ct, CORE_BLOCK_ADDON_PREFIX as d, resolveLocationMode as dn, hydrateSchema as dr, declarationOwnerNodeId as dt, normalizeUnit as en, DEVICE_STATUS_METHOD as er, composerCapability as et, CoreBlockSchema as f, resolveMethodAuth as fn, isDeviceConfigCap as fr, decodeVectorBase64 as ft, DAY_NAMES as g, scoreRuntimes as gn, parseJsonUnknown as gr, deviceExtensionCapability as gt, DATABASE_SNAPSHOT_TIMEOUT_MS as h, scopesAllowDeviceCap as hn, parseJsonObject as hr, describeComposableCaps as ht, BaseDevice as i, planComposition as in, asJsonObject as ir, coreBlockComposition as it, RUNTIME_DEFAULTS as j, withLocationMode as jn, formatMinutes as jt, RECORDING_SOURCE_CAMSTACK_ADDON as k, vectorIndexDimConflictError as kn, filesystemBrowseCapability as kt, COMPOSER_RUNNER_ID as l, replacedFieldKeys as ln, emitReadiness as lr, dataStoreProviderCapability as lt, DATABASE_SNAPSHOT_SUFFIX as m, scopesAllowAddon as mn, nodePin as mr, deriveBatteryPresence as mt, AlertSchema as n, objectInputDeclaresRequiredDeviceId as nn, ReadinessTimeoutError as nr, compositionSourceRefs as nt, CAMERA_SWITCH_ORDER as o, procedureAuthKey as on, asString$1 as or, coreBlockSourceKind as ot, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as p, runtimeStatePolicyFor as pn, isEvent as pr, defineExtensionSlotProvider as pt, bareAddonId as q, DeviceFeature as qn, looseSchema as qt, ApiKeyRecordSchema as r, parseStreamParamsFormPatch as rn, WELL_KNOWN_TAB_MAP as rr, coreBlockAddonId as rt, CAP_NAMES_WITH_STATUS as s, ptzAutotrackCapability as sn, createEvent as sr, coreBlocksCapability as st, ALL_CAPABILITY_DEFINITIONS as t, objectInputDeclaresAddonId as tn, ReadinessRegistry as tr, compositionFieldKey as tt, CORE_BLOCKS_ADDON_ID as u, resolveBucketMs as un, expandCapMethods as ur, databaseSnapshotCapability as ut, DeclaredDevices as v, siteZoneKey as vn, resolveCapMount as vr, deviceStateCapability as vt, LegacyStorageLocationDefaultSchema as w, streamCatalogCapability as wn, enumerateSchemaFields as wt, FieldClaimModeSchema as x, storageMigrationCapability as xn, toNodeId as xr, doorbellFeatureSources as xt, DeviceStatusSchema as y, snapshotCapability as yn, scopeKey as yr, deviceStatusCapability as yt, StorageMigrationJobSchema as z, compositionFeatureEnabled as zn, kebabToCamel as zt };
+export { composerCapability as $, createEvent as $n, parseStreamParamsFormPatch as $t, REDACTED_SECRET as A, cloneStatefulExpressionMemory as An, isArrayOutputSchema as At, UserRecordSchema as B, DeviceRole as Bn, locationIconKey as Bt, LOG_LEVEL_RANK as C, validateComposition as Cn, evictionPolicyOfLocation as Ct, MINUTES_PER_DAY as D, withLocationMode as Dn, foldSnapshotByFunction as Dt, METHOD_ACCESS_MAP as E, vectorStoreCapability as En, filesystemBrowseCapability as Et, ScopedTokenSchema as F, compositionSliceKey as Fn, kebabToCamel as Ft, authProviderCapability as G, DEVICE_SETTINGS_CONTRIBUTION_METHODS as Gn, mayWriteToLocation as Gt, addonSettingsCapability as H, errMsg as Hn, logLevelAtMost as Ht, StorageCleanupJobSchema as I, compositionSourceKey as In, legacyAutoLinkIds as It, batteryCapability as J, ReadinessTimeoutError as Jn, modeMayWrite as Jt, backupCapability as K, DEVICE_STATUS_METHOD as Kn, memoizePinnedFfmpeg as Kt, StorageLocationModeSchema as L, createStatefulExpressionMemory as Ln, legacyModeOf as Lt, RecordingStatusSchema as M, composedDeviceStableId as Mn, isLocationEnabled as Mt, STORAGE_ACCESS_FALLBACK as N, compositionFeatureEnabled as Nn, isObjectInput as Nt, MOTION_CLOSE_AFTER_MS as O, COMPOSER_ADDON_ID as On, formatMinutes as Ot, STREAM_PROFILE_META as P, compositionItemFieldPath as Pn, isVoidInput as Pt, collectSecretConfigKeys as Q, asString$1 as Qn, objectInputDeclaresRequiredDeviceId as Qt, StorageLocationTypeSchema as R, toExpressionValue as Rn, lifecycleJobSchema as Rt, FieldClaimSchema as S, userManagementCapability as Sn, evaluateCompositionField as St, LocationIconIdSchema as T, vectorIndexDimConflictError as Tn, extractNestedAddonId as Tt, addonWidgetsCapability as U, BaseAddon as Un, looseSchema as Ut, addonPagesCapability as V, DeviceType as Vn, logDestinationCapability as Vt, alertsCapability as W, DATAPLANE_SECRET_HEADER as Wn, mayReadLocation as Wt, buildStreamParamsConfigSchema as X, asJsonObject as Xn, normalizeUnit as Xt, buildCapabilityLookup as Y, WELL_KNOWN_TAB_MAP as Yn, motionCapability as Yt, cameraGridLayoutCapability as Z, asNumber as Zn, objectInputDeclaresAddonId as Zt, DERIVED_CAMERA_SILENCED_CAP_NAMES as _, storageMigrationCapability as _n, deviceStateCapability as _t, BatteryStatusSchema as a, replacedFieldKeys as an, isEvent as ar, coreBlockSourceKind as at, FIRST_LEVEL_MACRO_CLASSES as b, streamCatalogCapability as bn, enumerateItemArrayFields as bt, COMPOSED_ITEM_FIXED_FIELDS as c, resolveMethodAuth as cn, parseJsonUnknown as cr, dataStoreProviderCapability as ct, CORE_BLOCK_ADDON_PREFIX as d, scopesAllowDeviceCap as dn, scopeKey as dr, decodeVectorBase64 as dt, planComposition as en, emitDownForOwnedCaps as er, compositionFieldKey as et, CoreBlockSchema as f, scoreRuntimes as fn, sleep as fr, defineExtensionSlotProvider as ft, DAY_NAMES as g, storageCapability as gn, deviceManagerCapability as gt, DATABASE_SNAPSHOT_TIMEOUT_MS as h, snapshotCapability as hn, deviceExtensionCapability as ht, BaseDevice as i, reducePoints as in, isDeviceConfigCap as ir, coreBlockIdFromAddonId as it, RUNTIME_DEFAULTS as j, composedDeviceRef as jn, isCollectionArrayMethod as jt, RECORDING_SOURCE_CAMSTACK_ADDON as k, buildFfmpegArgs as kn, gbToBytes as kt, COMPOSER_RUNNER_ID as l, runtimeStatePolicyFor as ln, readinessKey as lr, databaseSnapshotCapability as lt, DATABASE_SNAPSHOT_SUFFIX as m, siteZoneKey as mn, EventCategory as mr, describeComposableCaps as mt, AlertSchema as n, procedureAuthKey as nn, expandCapMethods as nr, coreBlockAddonId as nt, CAMERA_SWITCH_ORDER as o, resolveBucketMs as on, nodePin as or, coreBlocksCapability as ot, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as p, settingsStoreCapability as pn, toNodeId as pr, deriveBatteryPresence as pt, bareAddonId as q, ReadinessRegistry as qn, metricsProviderCapability as qt, ApiKeyRecordSchema as r, ptzAutotrackCapability as rn, hydrateSchema as rr, coreBlockComposition as rt, CAP_NAMES_WITH_STATUS as s, resolveLocationMode as sn, parseJsonObject as sr, createDeviceExtensionProvider as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tn, emitReadiness as tr, compositionSourceRefs as tt, CORE_BLOCKS_ADDON_ID as u, scopesAllowAddon as un, resolveCapMount as ur, declarationOwnerNodeId as ut, DeclaredDevices as v, storageOccupancyCapability as vn, deviceStatusCapability as vt, LegacyStorageLocationDefaultSchema as w, vectorDimFromBase64 as wn, expandContainer as wt, FieldClaimModeSchema as x, streamQualityLabel as xn, enumerateSchemaFields as xt, DeviceStatusSchema as y, storageProviderCapability as yn, enumerateInferenceDevices as yt, StorageMigrationJobSchema as z, DeviceFeature as zn, localNetworkCapability as zt };