@camstack/types 1.2.109 → 1.2.111

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-EY0GNjV9.js");
-const require_sleep = require("./sleep-BJTBu5cu.js");
+const require_sleep = require("./sleep-BCRrMlni.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -2286,7 +2286,26 @@ var CLASS_MAP_MACRO_TARGETS = [
 	"animal",
 	"package"
 ];
-var ClassMapDefinitionSchema = zod.z.object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = zod.z.object({
 	mapping: zod.z.record(zod.z.string(), zod.z.enum(CLASS_MAP_MACRO_TARGETS)),
 	preserveOriginal: zod.z.boolean()
 });
@@ -2658,7 +2677,7 @@ var ModelCatalogEntrySchema = zod.z.object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = zod.z.discriminatedUnion("format", [zod.z.object({
 	format: zod.z.literal("openvino"),
@@ -2688,7 +2707,7 @@ var ModelConvertMetadataSchema = zod.z.object({
 		"segmentation"
 	]),
 	faceAlignment: zod.z.boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertArtifactSchema = zod.z.object({
 	format: zod.z.enum(MODEL_FORMATS),
@@ -14774,373 +14793,1208 @@ var oauthIntegrationCapability = {
 getDescriptor: require_sleep.method(zod.z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 //#endregion
-//#region src/capabilities/pipeline-analytics.cap.ts
+//#region src/capabilities/pipeline-executor.cap.ts
 /**
-* pipeline-analytics — device-scoped wrapper cap. Refines raw
-* per-frame detections emitted by the pipeline runner into tracked
-* objects, per-kind event collections (motion / object / audio), and
-* persisted media. Owns the post-detection domain end-to-end:
-*
-*   runner emits PipelineInferenceResult
-*     ↓ (event bus)
-*   pipeline-analytics subscriber
-*     ↓ SORT tracker + zone engine + state analyzer + event emitter
-*   → three DB collections (one per kind), one FS media tree, one
-*     unified event emitter (FrameTracked + TrackStarted/Ended +
-*     DetectionEvent on bus)
-*
-* Pure subscriber model. No `processFrame` cap method — the runner
-* already publishes the raw frame on the bus. The cap surface is
-* only QUERIES + per-device settings, bound on/off via
-* `device-manager.setWrapperActive`. `defaultActive: true` because
-* every camera with a detection pipeline wants its raw detections
-* refined; operators opt out per-device via BindingsTab when needed.
-*
-* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
-* (per-device surface) and `track-trail` caps — see P11 cleanup.
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
 */
-var TrackStateSchema = zod.z.enum([
-	"new",
-	"entered",
-	"left",
-	"moving",
-	"idle"
-]);
-var EventKindSchema = zod.z.enum([
-	"motion",
-	"object",
-	"audio"
-]);
+var NativeCropRefSchema = zod.z.object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: require_sleep.FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: zod.z.object({
+		x: zod.z.number(),
+		y: zod.z.number(),
+		w: zod.z.number(),
+		h: zod.z.number()
+	})
+});
+zod.z.object({
+	crop: zod.z.object({
+		left: zod.z.number(),
+		top: zod.z.number(),
+		width: zod.z.number().positive(),
+		height: zod.z.number().positive()
+	}).optional(),
+	content: zod.z.object({
+		width: zod.z.number().int().positive(),
+		height: zod.z.number().int().positive()
+	}),
+	fit: zod.z.enum(["stretch", "contain"]),
+	format: zod.z.enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
 /**
-* Spatial filter for `listTracks` — the rect + polygon variants of the shared
-* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
-* of the camera frame (top-left origin), matching the drawing-plane editor.
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
 */
-var TrackZoneFilterSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
-/** Closed icon vocabulary so clients render a known glyph per kind. */
-var EventKindIconSchema = zod.z.enum([
-	"motion",
-	"audio",
-	"person",
-	"vehicle",
-	"animal",
-	"door",
-	"pir",
-	"smoke",
-	"water",
-	"button",
-	"package",
-	"generic"
+var FrameRefSchema = zod.z.object({
+	registryId: zod.z.string().min(1),
+	id: zod.z.string().min(1),
+	width: zod.z.number().int().positive(),
+	height: zod.z.number().int().positive(),
+	format: zod.z.enum(["rgb", "gray"]),
+	timestamp: zod.z.number(),
+	capturedAt: zod.z.number().optional()
+});
+var ModelFormatSchema$1 = zod.z.enum([
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
 ]);
-var EventKindCategorySchema = zod.z.enum([
-	"motion",
-	"audio",
-	"detection",
-	"sensor",
-	"control",
-	"custom",
-	"package"
+var PipelineSlotSchema = zod.z.enum([
+	"detector",
+	"cropper",
+	"classifier",
+	"refiner",
+	"audio-classifier"
 ]);
-/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
-var EventKindLevelSchema = zod.z.enum(["macro", "sub"]);
-var EventKindDescriptorSchema = zod.z.object({
-	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
-	kind: zod.z.string(),
-	/** i18n key resolved on the UI side; `label` is the English fallback. */
-	labelKey: zod.z.string(),
-	/** English fallback label (kept for clients that don't translate). */
+var PipelineEngineChoiceSchema = zod.z.object({
+	runtime: zod.z.enum(["node", "python"]),
+	backend: zod.z.string(),
+	format: ModelFormatSchema$1,
+	device: zod.z.string().optional()
+});
+var EngineDeviceInfoSchema = zod.z.object({
+	id: zod.z.string(),
 	label: zod.z.string(),
-	/** Hex color for timeline/legend rendering. */
-	color: zod.z.string(),
-	/** Dictionary id → lucide component on the UI side. */
-	iconId: zod.z.string(),
-	/** Legacy closed-vocab glyph — fallback for `iconId`. */
-	icon: EventKindIconSchema,
-	category: EventKindCategorySchema,
-	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
-	parentKind: zod.z.string().nullable(),
-	/** Derived from `parentKind`, explicit for the client tree. */
-	level: EventKindLevelSchema,
-	/** Which cap + device contributes this kind. For built-ins the camera
-	*  itself; for sensor kinds the LINKED source device. */
-	source: zod.z.object({
-		capName: zod.z.string(),
-		deviceId: zod.z.number()
-	})
+	description: zod.z.string().optional()
 });
-/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
-var EventKindsForDeviceSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	kinds: zod.z.array(EventKindDescriptorSchema).readonly()
+var AvailableEngineSchema = zod.z.object({
+	engine: PipelineEngineChoiceSchema,
+	devices: zod.z.array(EngineDeviceInfoSchema).readonly(),
+	defaultDevice: zod.z.string()
 });
-var SensorEventSchema = zod.z.object({
+var PipelineDefaultStepSchema = zod.z.lazy(() => zod.z.object({
+	addonId: zod.z.string(),
+	addonName: zod.z.string(),
+	slot: PipelineSlotSchema,
+	inputClasses: zod.z.array(zod.z.string()).readonly(),
+	outputClasses: zod.z.array(zod.z.string()).readonly(),
+	enabled: zod.z.boolean(),
+	modelId: zod.z.string(),
+	children: zod.z.array(PipelineDefaultStepSchema).readonly(),
+	group: zod.z.string().optional(),
+	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+}));
+var PipelineTemplateStepSchema = zod.z.lazy(() => zod.z.object({
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	modelId: zod.z.string(),
+	children: zod.z.array(PipelineTemplateStepSchema).readonly(),
+	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = zod.z.object({
 	id: zod.z.string(),
-	/** The CAMERA the event is attributed to (a sensor linked to N cameras
-	*  yields N rows, one per camera). */
-	deviceId: zod.z.number(),
-	/** The linked sensor device whose state changed. */
-	sourceDeviceId: zod.z.number(),
-	/** Event kind id — matches an `EventKindDescriptor.kind`. */
-	kind: zod.z.string(),
-	/** Snapshot of the sensor cap's runtime-state slice at the change. */
-	value: zod.z.record(zod.z.string(), zod.z.unknown()).nullable(),
-	timestamp: zod.z.number()
-});
-var TrackPositionSchema = zod.z.object({
-	x: zod.z.number(),
-	y: zod.z.number(),
-	timestamp: zod.z.number(),
-	bbox: BoundingBoxSchema
+	name: zod.z.string(),
+	createdAt: zod.z.string(),
+	updatedAt: zod.z.string(),
+	engine: PipelineEngineChoiceSchema,
+	steps: zod.z.array(PipelineTemplateStepSchema).readonly()
 });
-var TrackSnapshotSchema = zod.z.object({
-	timestamp: zod.z.number(),
-	position: TrackPositionSchema,
-	/** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-	mediaKey: zod.z.string()
+var PipelineModelOptionSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	formats: zod.z.record(zod.z.string(), zod.z.object({
+		downloaded: zod.z.boolean(),
+		sizeMB: zod.z.number()
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: zod.z.boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
 });
-/**
-* Normalized 0..1 trajectory envelope (min/max over every position bbox,
-* divided by the track's detection-frame dims), computed at persist time.
-* Absent when the frame dims were unknown when the track was persisted
-* (legacy rows / dims-less sources) and on active (in-RAM) tracks.
-*/
-var TrackEnvelopeSchema = zod.z.object({
-	minX: zod.z.number(),
-	minY: zod.z.number(),
-	maxX: zod.z.number(),
-	maxY: zod.z.number()
+var ConfigFieldBridge = zod.z.custom();
+var PipelineAddonSchemaSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	slot: PipelineSlotSchema,
+	inputClasses: zod.z.array(zod.z.string()).readonly(),
+	outputClasses: zod.z.array(zod.z.string()).readonly(),
+	childSlots: zod.z.array(PipelineSlotSchema).readonly(),
+	models: zod.z.array(PipelineModelOptionSchema).readonly(),
+	defaultModelId: zod.z.string(),
+	defaultModelIdByFormat: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+	enabledByDefault: zod.z.boolean().optional(),
+	backfillIntoExistingOverrides: zod.z.boolean().optional(),
+	defaultConfidence: zod.z.number(),
+	group: zod.z.string().optional(),
+	configSchema: zod.z.array(ConfigFieldBridge).readonly().optional()
 });
-/**
-* Row projection for track list queries. `full` (default) returns the
-* complete Track including the frame-rate `positions[]` history and the
-* `snapshots[]` references — megabytes across a page of tracks. `slim`
-* keeps every scalar the list surfaces actually render (ids, class(es),
-* label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope, hasFace, hasEmbeddedFace, hasRider) and returns `positions` /
-* `snapshots` as EMPTY arrays — detail views re-fetch the full row via
-* `getTrack`. Mirrors the event-store `projection` convention
-* (`getObjectEvents` et al.).
-*/
-var TrackProjectionSchema = zod.z.enum(["full", "slim"]);
-/**
-* One audio-classification label heard on the track's camera while the
-* track was alive, aggregated per label. An "episode" is one persisted
-* audio event (the confident-classification path: score ≥ the device's
-* `classificationMinScore`, class-change-or-heartbeat coalesced) — NOT
-* one 32 ms inference chunk, so counts stay human-scaled.
-*/
-var TrackAudioLabelSchema = zod.z.object({
+var PipelineSlotSchemaSchema = zod.z.object({
+	id: PipelineSlotSchema,
 	label: zod.z.string(),
-	/** Highest classification score observed across the label's episodes. */
-	peakScore: zod.z.number(),
-	/** Number of coalesced audio-event episodes carrying this label. */
-	count: zod.z.number(),
-	firstAt: zod.z.number(),
-	lastAt: zod.z.number()
+	priority: zod.z.number(),
+	parentSlot: PipelineSlotSchema.nullable(),
+	addons: zod.z.array(PipelineAddonSchemaSchema).readonly()
+});
+var PipelineSchemaSchema = zod.z.object({
+	availableEngines: zod.z.array(AvailableEngineSchema).readonly(),
+	selectedEngine: PipelineEngineChoiceSchema,
+	slots: zod.z.array(PipelineSlotSchemaSchema).readonly()
+});
+var EngineProvisioningSchema = zod.z.object({
+	runtimeId: zod.z.enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"edgetpu"
+	]).nullable(),
+	device: zod.z.string().nullable(),
+	state: zod.z.enum([
+		"idle",
+		"installing",
+		"verifying",
+		"ready",
+		"failed"
+	]),
+	progress: zod.z.number().optional(),
+	error: zod.z.string().optional(),
+	nextRetryAt: zod.z.number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: zod.z.array(zod.z.string()).optional()
+});
+var PipelineStepInputSchema = zod.z.lazy(() => zod.z.object({
+	addonId: zod.z.string(),
+	modelId: zod.z.string().optional(),
+	enabled: zod.z.boolean().default(true),
+	children: zod.z.array(PipelineStepInputSchema).optional(),
+	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	jumpDeviceKey: zod.z.string().optional()
+}));
+var ModelSubstitutionSchema = zod.z.object({
+	addonId: zod.z.string(),
+	chosen: zod.z.string(),
+	running: zod.z.string(),
+	format: zod.z.string()
+});
+var PipelineValidationIssueSchema = zod.z.object({
+	addonId: zod.z.string(),
+	kind: zod.z.enum(["unknown-addon", "no-format-build"]),
+	detail: zod.z.string()
+});
+var PipelineValidationResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	issues: zod.z.array(PipelineValidationIssueSchema).readonly(),
+	substitutions: zod.z.array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: zod.z.string()
+});
+var ReferenceImageEntrySchema = zod.z.object({
+	filename: zod.z.string(),
+	stepIds: zod.z.array(zod.z.string()).readonly().optional()
+});
+var ReferenceImageBodySchema = zod.z.object({
+	base64: zod.z.string(),
+	filename: zod.z.string()
+});
+var ReferenceAudioEntrySchema = zod.z.object({
+	filename: zod.z.string(),
+	sizeKb: zod.z.number()
+});
+var ReferenceAudioBodySchema = zod.z.object({ base64: zod.z.string() });
+var AudioBackendSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	description: zod.z.string(),
+	available: zod.z.boolean(),
+	/**
+	* Raw classifier labels this backend can emit (e.g. YAMNet's
+	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
+	* the benchmark UI to populate the `enabledMicroClasses` filter
+	* specific to the selected backend without a separate fetch.
+	*/
+	rawLabels: zod.z.array(zod.z.string()).readonly().optional()
+});
+var AudioCapabilitiesSchema = zod.z.object({
+	activeBackend: zod.z.string(),
+	availableBackends: zod.z.array(AudioBackendSchema).readonly(),
+	sampleRate: zod.z.number(),
+	chunkDurationMs: zod.z.number()
+});
+var DownloadModelResultSchema = zod.z.object({
+	filePath: zod.z.string(),
+	sizeMB: zod.z.number(),
+	durationMs: zod.z.number()
 });
 /**
-* How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
-* no positions, a single snapshot, and no bbox trajectory at all:
-*
-*  - `sensor` — a linked sensor/control device state change.
-*  - `audio` — an audio event on the camera itself that was anomalous for
-*    THAT camera, loud, and heard while nothing visual was happening (D62).
-*
-* The spatial subsystems (tracker association, occupancy count, re-id /
-* embedding, resurrection) MUST skip every synthetic source. Test for that
-* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
-* check silently readmits every source added after it was written.
-*/
-var TrackSourceSchema = zod.z.enum([
-	"pipeline",
-	"sensor",
-	"audio"
-]);
-/**
-* Where a track sits in the RETRAIN lifecycle (D81).
-*
-*  - `none` — never marked, or un-marked. Evictable.
-*  - `staging` — the operator wants this track as training material and has not
-*    finished with it. **This is the only state retention holds**: the track and
-*    everything it owns (object events, crops, keyframes, CLIP vector) survive
-*    the device's age window.
-*  - `trained` — the retrain page has taken what it needed. The frames it chose
-*    were COPIED into the retrain dataset at selection time, so the dataset no
-*    longer depends on the track's media and the track becomes EVICTABLE again.
-*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
-*    a deliberate action of the retrain page, not a side effect of a checkbox.
-*
-* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
-* the store's filter language has only positive equality and `whereIn` — no
-* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
-* would make the entire pre-column history immortal in one deploy.
-*/
-var RetrainStatusSchema = zod.z.enum([
-	"none",
-	"staging",
-	"trained"
-]);
-/**
-* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
-* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
-* so the two surfaces cannot drift.
-*
-* **Absent ≠ false.** A track that has never been touched omits the field; an
-* explicitly un-flagged track carries `false`. Legacy rows written before the
-* columns existed read as absent, and a consumer that needs a boolean should say
-* `flag === true`, not `flag !== false`.
-*
-* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
-* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
-* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
-* `trained` track reports `false` while refusing both writes. The boolean is
-* kept because three surfaces drive a toggle off it; anything that needs to tell
-* "never marked" from "already trained" must read `retrainStatus`.
-*
-* `debug` does NOT pin; it is attention, not durability.
-*
-* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
-* A favourited track is skipped by retention the same way `staging` is, but
-* it does not enter `none|staging|trained` and has no staging budget.
-*/
-var TrackFlagFields = {
-	/** Operator marked this track as training material — i.e. `retrainStatus` is
-	*  `'staging'`. */
-	markForTrain: zod.z.boolean().optional(),
-	/** Operator marked this track for diagnostic attention. */
-	debug: zod.z.boolean().optional(),
-	/** Operator favourited this track. Pins it against pruning. */
-	favourited: zod.z.boolean().optional()
-};
-/**
-* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
-* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
-* write patch, and the status is not something the toggle sets — it is what the
-* toggle's boolean is derived from. Absent on an in-RAM track never touched;
-* always present on a persisted row (the column default materialises `'none'`).
-*/
-var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
-/**
-* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
-* one flag can never clear the other — the toggles are independent and are
-* driven from three surfaces that do not know about each other.
-*/
-var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
-/**
-* The resolved flag state after a write. Both fields are REQUIRED here (absent
-* collapses to `false`) so a caller can drive a toggle's checked state off the
-* mutation result without a re-fetch.
+* Wrapper carrying a single test run's result. Replaces the legacy
+* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
+* canonical `AudioResult` from the Phase 6 output rework: one
+* `AudioDetection` per class above `minScore`, top-N candidates in
+* `debug.alternateLabels['audio-classifier']`, per-source timings in
+* `debug.stepTimings`. The outer `success`/`error` fields stay so the
+* benchmark UI can still report a clean failure when the classifier
+* cap isn't available.
 */
-var TrackFlagsSchema = zod.z.object({
-	trackId: zod.z.string(),
-	markForTrain: zod.z.boolean(),
-	debug: zod.z.boolean(),
-	favourited: zod.z.boolean(),
-	/** The lifecycle state the boolean was derived from. Required here (unlike on
-	*  a track row) because this shape is only ever produced by the write body,
-	*  which always knows it — and a surface that has just written needs to render
-	*  `trained` without a re-fetch. */
-	retrainStatus: RetrainStatusSchema
+var AudioTestResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	error: zod.z.string().optional(),
+	frame: zod.z.custom().optional()
 });
+var PipelineConfigBridge = zod.z.custom();
+var ConfigUISchemaBridge = zod.z.custom();
+var ConfigUISchemaNullableBridge = zod.z.custom();
+var InferenceCapabilitiesBridge = zod.z.custom();
+var ModelAvailabilityListBridge = zod.z.custom();
+var PipelineRunResultBridge = zod.z.custom();
 /**
-* WHICH tier a label occupies. The slot a label lands in is DECLARED by the
-* step that produced it (`StepDefinition.labelTier`), never inferred from the
-* text or the step's name.
+* Pipeline executor — detection engine + configuration + inference API.
 *
-*  - `1` — a SUB-CLASS: finer than the macro class, still a taxonomy token.
-*    `animal-type` (`dog`, `bird`), `vehicle-type` (`van`), and the root
-*    detector's own raw class when it is finer than the macro it maps to.
-*  - `2` — an INSTANCE: the finest thing said about this subject.
-*    `species` (`Turdus migratorius`), `identity` (`Alice`), `plate-text`.
+* Merged from: pipeline-executor, pipeline-config, inference, detection-config.
+* Implemented by the detection-pipeline addon.
 *
-* The macro class itself (`person`, `vehicle`, `animal`, `package`, `face`,
-* `plate`, `audio`) is NOT a tier — it is `className`, and a macro token
-* offered for either label slot is refused (2026-08-07 rule; the refusal is
-* logged as `label tier collapse refused`).
+* Per-device surface (DeviceSettingsContribution + the "is detection
+* enabled for this camera?" toggle) lives on the paired
+* `detection-pipeline` cap (device-scoped, singleton, wrapper
+* defaultActive) — same split pattern used by stream-broker /
+* camera-streams and audio-analyzer / audio-analysis.
 */
-var LabelTierSchema = zod.z.union([zod.z.literal(1), zod.z.literal(2)]);
-/**
-* WHO decided a label, and when. Carried per tier so a value can be traced to
-* the step and model that produced it — which is what makes the write rule
-* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
-* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
+var pipelineExecutorCapability = {
+	name: "pipeline-executor",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		getAvailableEngines: require_sleep.method(zod.z.void(), zod.z.array(PipelineEngineChoiceSchema)),
+		getSelectedEngine: require_sleep.method(zod.z.void(), PipelineEngineChoiceSchema),
+		getDefaultSteps: require_sleep.method(PipelineEngineChoiceSchema, zod.z.array(PipelineDefaultStepSchema)),
+		/**
+		* Per-node detection-engine provisioning snapshot. Returns the live
+		* state of the lazy runtime-provisioning machine on `nodeId`
+		* (idle / installing / verifying / ready / failed). The UI pairs this
+		* one-shot query with the `pipeline.engine-provisioning` live event
+		* (emitted on every transition) to drive a per-node "engine ready?"
+		* indicator without polling. Phase 2.
+		*/
+		getEngineProvisioning: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), EngineProvisioningSchema),
+		getVideoPipelineSteps: require_sleep.method(zod.z.void(), zod.z.record(zod.z.string(), zod.z.object({
+			modelId: zod.z.string(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
+		}))),
+		setVideoPipelineSteps: require_sleep.method(zod.z.object({ steps: zod.z.record(zod.z.string(), zod.z.object({
+			modelId: zod.z.string(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
+		})) }), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Clear THIS node's executor-side PER-DEVICE settings stores (the
+		* per-camera step overrides the object-detection root reads via
+		* `applyDeviceOverridesToTree`). `nodeId` is the ROUTING key — the
+		* generated cap-router strips it (default `nodeIdMode: 'routing'`) and
+		* dispatches to that node, so the provider method runs ON the target
+		* node and receives no `nodeId`.
+		*
+		* This is the slimmed executor leg of the orchestrator's
+		* `resetNodePipelineDefaults` flow (which owns the real reset: node
+		* addonDefaults pins + per-camera orchestrator overrides). The legacy
+		* `resetToDefault` — which reset a persisted global step-tree seed
+		* nothing in the live per-camera path read — was removed together with
+		* that seed.
+		*/
+		clearDeviceOverrides: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.object({
+			success: zod.z.literal(true),
+			clearedDevices: zod.z.number()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Which of THIS node's inference devices the executor currently refuses,
+		* and why. `nodeId` is the ROUTING key (stripped by the generated router).
+		*
+		* The channel that did not exist. Pool health was known only inside the
+		* detection addon and was an input to no routing decision anywhere: the
+		* per-dispatch capability gate is keyed on model FORMAT and so can never
+		* separate `openvino:gpu` from `openvino:npu`, and the orchestrator's live
+		* eligibility probe (`platformProbe.getCapabilities`) answers about
+		* HARDWARE — which was present throughout. So when the hub's `openvino:gpu`
+		* Python worker was SIGABRT'd by the Intel GPU plugin on 2026-08-25, the
+		* balancer went on handing that dead pool cameras by rotation for 31 hours:
+		* ~370 000 `PoolWorker[w0]: not initialized` lines, every frame lost.
+		*
+		* Read semantics the caller depends on, and which the provider guarantees:
+		* this is a synchronous read of in-memory state. It never probes hardware,
+		* never spawns a pool and never throws — an EMPTY `unhealthy` means "asked,
+		* nothing is refused", which is what re-admits a device. A read that FAILS
+		* (node offline, version skew) must therefore be distinguishable from an
+		* empty answer, and it is: it rejects.
+		*/
+		getInferenceDeviceHealth: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.object({ unhealthy: zod.z.array(zod.z.object({
+			/** `<backend>:<device>`, e.g. `openvino:gpu`. */
+			deviceKey: zod.z.string(),
+			/**
+			* `failed` — the per-device restart budget is exhausted; no pool
+			* will be spawned until an operator re-arms it or the runner
+			* respawns. `backoff` — under budget, waiting out the backoff (or
+			* a cached pool observed dead and not yet condemned).
+			*/
+			state: zod.z.enum(["failed", "backoff"]),
+			/** Epoch ms of the death that produced this state. */
+			since: zod.z.number(),
+			/** Pool deaths inside the current window. */
+			deaths: zod.z.number(),
+			/** The last death's message. */
+			lastError: zod.z.string()
+		})).readonly() })),
+		/**
+		* Re-arm a terminally `failed` inference device on `nodeId`: forget its
+		* restart budget so the next dispatch builds a fresh pool.
+		*
+		* The terminal state is deliberate (the abort it bounds is deterministic —
+		* an automatic probation would just respawn Python forever, more slowly),
+		* and a terminal state an operator cannot leave is a silent fault. This is
+		* the way out. `rearmed:false` means there was nothing to forget.
+		*/
+		rearmInferenceDevice: require_sleep.method(zod.z.object({
+			nodeId: zod.z.string(),
+			deviceKey: zod.z.string()
+		}), zod.z.object({ rearmed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getSchema: require_sleep.method(zod.z.void(), PipelineSchemaSchema),
+		getGlobalSteps: require_sleep.method(zod.z.void(), zod.z.array(PipelineDefaultStepSchema).readonly().nullable()),
+		getGlobalPipelineConfig: require_sleep.method(zod.z.void(), PipelineConfigBridge),
+		getOrchestratorConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaBridge),
+		/**
+		* Gate B (pre-init config-correctness gate). PURE COMPUTE against this
+		* node's `currentEngine.format` — resolves `steps` the same way the
+		* runtime dispatch path would, and reports what WOULD happen without
+		* touching any node-global state. Called by the orchestrator at attach
+		* time (`attachOn`), node-pinned to the TARGET node, so config problems
+		* surface BEFORE `pipelineRunner.attachCamera` rather than at the first
+		* per-frame resolve. `ok` is false iff `issues` is non-empty (both
+		* `unknown-addon` and `no-format-build` are HARD issues); `substitutions`
+		* is informational (a degraded-but-loadable model swap) and never
+		* affects `ok`. Never throws.
+		*/
+		validatePipeline: require_sleep.method(zod.z.object({ steps: zod.z.array(PipelineStepInputSchema) }), PipelineValidationResultSchema),
+		listTemplates: require_sleep.method(zod.z.void(), zod.z.array(PipelineTemplateSchema$1).readonly()),
+		saveTemplate: require_sleep.method(zod.z.object({
+			name: zod.z.string(),
+			steps: zod.z.array(PipelineTemplateStepSchema).readonly(),
+			engine: PipelineEngineChoiceSchema
+		}), PipelineTemplateSchema$1, { kind: "mutation" }),
+		updateTemplate: require_sleep.method(zod.z.object({
+			id: zod.z.string(),
+			name: zod.z.string().optional(),
+			steps: zod.z.array(PipelineTemplateStepSchema).readonly().optional()
+		}), PipelineTemplateSchema$1, { kind: "mutation" }),
+		deleteTemplate: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
+		getCapabilities: require_sleep.method(zod.z.void(), InferenceCapabilitiesBridge),
+		getAddonModels: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), ModelAvailabilityListBridge),
+		downloadModel: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			modelId: zod.z.string(),
+			format: ModelFormatSchema$1
+		}), DownloadModelResultSchema, { kind: "mutation" }),
+		deleteModel: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			modelId: zod.z.string(),
+			format: ModelFormatSchema$1
+		}), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }),
+		/**
+		* Stateless single-frame execution. Callers (runner, benchmark) pass
+		* the complete `engine` + `steps` tree; the executor holds no state
+		* about cameras or saved pipelines.
+		*
+		* `engine` is optional during the migration window to preserve the
+		* legacy call shape used by existing benchmark code; once all
+		* callers pass it explicitly we make it required.
+		*
+		* Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
+		* `referenceImage` must be provided:
+		*  - `frame`: runtime dispatch path (runner → decoded broker frame).
+		*    Carries the raw buffer, dimensions, and format; the executor
+		*    uses it directly without base64 round-tripping.
+		*  - `frameHandle` (CB5): a zero-pixel shm `FrameHandle` for the SAME
+		*    decoded frame. Both runner and executor are hub-local processes
+		*    sharing `/dev/shm`, so the executor maps the named segment and
+		*    reads the pixels back zero-copy — eliminating the ~1.2MB
+		*    re-serialisation over UDS/MsgPack the `frame` path pays per call.
+		*    High-risk: the FrameRing is a latest-wins seqlock with no
+		*    refcount, so a recycled slot yields a null read; the executor
+		*    then degrades to an empty result and the runner ships pixels via
+		*    `frame` as the fallback (queue-depth gated on the runner side).
+		*  - `imageBase64`: one-shot test path (benchmark ImageTab).
+		*  - `referenceImage`: named file from the reference-image store.
+		*/
+		runPipeline: require_sleep.method(zod.z.object({
+			engine: PipelineEngineChoiceSchema.optional(),
+			steps: zod.z.array(PipelineStepInputSchema).min(1),
+			frame: FrameInputSchema.optional(),
+			/**
+			* Process-local lazy frame. Valid only when caller and provider resolve
+			* in the same execution-group process; split/cross-node callers use
+			* `frame`/`image` inline compatibility instead.
+			*/
+			frameRef: FrameRefSchema.optional(),
+			/**
+			* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+			* the decoded pixels live in. One more member of the one-of
+			* frame/frameHandle/image/imageBase64/referenceImage group.
+			*/
+			frameHandle: require_sleep.FrameHandleSchema.optional(),
+			imageBase64: zod.z.string().optional(),
+			/**
+			* Binary JPEG bytes — preferred over `imageBase64` on internal
+			* hops (hub → forked worker via Moleculer MsgPack) because it
+			* skips the 33% base64 overhead + the per-call base64 decode on
+			* the detection-pipeline worker. Callers can pass either; exactly
+			* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
+			*/
+			image: zod.z.instanceof(Uint8Array).optional(),
+			referenceImage: zod.z.string().optional(),
+			deviceId: zod.z.number().optional(),
+			sessionId: zod.z.string().optional(),
+			/**
+			* Execution plane. 'full' (default) runs the whole tree — benchmark,
+			* reference-image, and detail-subtree calls. 'frame' is the live
+			* per-frame dispatch: ONLY root-plane steps run; crop children
+			* (inputClasses ≠ null) are skipped and served per-track via
+			* pipelineRunner.runDetailSubtree (two-plane design).
+			*/
+			plane: zod.z.enum(["full", "frame"]).optional(),
+			/**
+			* Inference-device selector (Phase 2 multi-device). Format
+			* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+			* Omitted ⇒ the runner's default device (current single-engine
+			* behaviour). Selects WHICH device pool of the node runs the call.
+			*/
+			deviceKey: zod.z.string().optional(),
+			/**
+			* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+			* when the parent crop was resolved from the frame's retained NATIVE
+			* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+			* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+			* resolution from that surface — the SAME quality path faces already
+			* had — instead of the downscaled parent tile. `handle` keys the native
+			* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+			* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+			* the executor's crop-normalized child ROI back into frame-normalized
+			* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+			* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+			* (today's behaviour on the fallback path).
+			*/
+			nativeCropRef: NativeCropRefSchema.optional()
+		}), PipelineRunResultBridge, { kind: "mutation" }),
+		/**
+		* Batched run — N raw frames packed into one cap call. The provider
+		* routes the batch through `SharedInferencePool.inferBatch`
+		* (`MSG_INFER_BATCH = 0x03`) so the IPC framing and JSON response
+		* envelope cost is amortised N:1 vs N concurrent `runPipeline`
+		* calls. Single root step + uniform model assumed; trees with crop
+		* children fall back to sequential execution.
+		*
+		* Used by `scripts/bench-batch-style.mts` for batch benchmarking —
+		* N frames in one call to amortise per-call IPC overhead.
+		*/
+		runPipelineBatch: require_sleep.method(zod.z.object({
+			engine: PipelineEngineChoiceSchema.optional(),
+			steps: zod.z.array(PipelineStepInputSchema).min(1),
+			frames: zod.z.array(FrameInputSchema).min(1).max(255),
+			deviceId: zod.z.number().optional(),
+			sessionId: zod.z.string().optional(),
+			/**
+			* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+			* the batch to the Python pool's bench preprocess cache
+			* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+			* preprocessed ONCE and every later inference is a pure-inference cache
+			* hit — the sustained-throughput run measures inference, not
+			* decode+preprocess+infer. Omitted/0 for live frames (all different →
+			* full preprocess every call, correct). Fresh per sustained run;
+			* released via `uncacheFrame`.
+			*/
+			frameId: zod.z.number().int().nonnegative().optional(),
+			/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+			deviceKey: zod.z.string().optional()
+		}), zod.z.object({ results: zod.z.array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
+		/**
+		* Cache a raw frame inside the Python inference pool's memory.
+		* Returns a numeric `frameId` that `inferCached` references —
+		* subsequent calls send only 5 bytes through the pipe instead of
+		* 1.2MB raw data, eliminating the pipe transfer bottleneck.
+		*/
+		cacheFrameInPool: require_sleep.method(zod.z.object({
+			data: zod.z.instanceof(Uint8Array),
+			width: zod.z.number().int().positive(),
+			height: zod.z.number().int().positive(),
+			format: zod.z.enum([
+				"rgb",
+				"bgr",
+				"gray"
+			])
+		}), zod.z.object({
+			frameId: zod.z.number(),
+			width: zod.z.number(),
+			height: zod.z.number()
+		}), { kind: "mutation" }),
+		/**
+		* Run inference on a previously cached frame. Sends only 5 bytes
+		* (model_idx + frameId) through the IPC pipe — eliminates the
+		* ~35ms per-call overhead of transferring 1.2MB raw data.
+		*/
+		inferCached: require_sleep.method(zod.z.object({
+			stepId: zod.z.string(),
+			frameId: zod.z.number().int()
+		}), zod.z.record(zod.z.string(), zod.z.unknown()), { kind: "mutation" }),
+		/**
+		* Release a cached frame from the Python pool's memory.
+		*/
+		uncacheFrame: require_sleep.method(zod.z.object({ frameId: zod.z.number().int() }), zod.z.void(), { kind: "mutation" }),
+		/** Returns the effective pool tuning (resolved from user overrides + backend defaults). */
+		getEffectiveTuning: require_sleep.method(zod.z.void(), zod.z.object({
+			batchMode: zod.z.string(),
+			windowMs: zod.z.number(),
+			maxBatchSize: zod.z.number(),
+			concurrency: zod.z.number()
+		})),
+		/**
+		* List every EngineFactory currently loaded in this executor's RAM,
+		* with the models resident and a coarse "in use" marker derived from
+		* ongoing inference activity. Used by the Pipeline page Engines tab.
+		*/
+		listLoadedEngines: require_sleep.method(zod.z.void(), zod.z.array(zod.z.object({
+			engineKey: zod.z.string(),
+			engine: PipelineEngineChoiceSchema,
+			modelsLoaded: zod.z.array(zod.z.string()).readonly(),
+			inUseByCameras: zod.z.array(zod.z.number()).readonly(),
+			/**
+			* Origin of this resident factory.
+			*  - `runtime`       — main camera-serving engine (no idle TTL).
+			*  - `warm-override` — benchmark/test override held in the warm
+			*                      cache; auto-disposed after the idle TTL.
+			*  - `device-pool`   — a concurrent per-device pool (Phase 2
+			*                      multi-device, keyed by `deviceKey`) resolved
+			*                      via `resolveDeviceFactory`. Runs alongside the
+			*                      `runtime` engine on a DIFFERENT accelerator
+			*                      (NPU / iGPU / Coral) — this is how the
+			*                      Engines tab shows all pools running at once.
+			*/
+			kind: zod.z.enum([
+				"runtime",
+				"warm-override",
+				"device-pool"
+			]),
+			/** Native pid of the underlying Python pool (null when no pool). */
+			poolPid: zod.z.number().nullable(),
+			/** ms since this factory was last used (null when not warm-tracked). */
+			idleMs: zod.z.number().nullable(),
+			/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
+			idleTtlMs: zod.z.number().nullable()
+		})).readonly()),
+		/** Warm up an engine without running a frame. No-op if already loaded. */
+		spinEngine: require_sleep.method(zod.z.object({ engine: PipelineEngineChoiceSchema }), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Unload an engine from RAM. `force:true` unloads even when cameras
+		* are actively using it (they re-spin on next frame). Default is
+		* gated — returns `{success:false, reason}` when in use.
+		*/
+		killEngine: require_sleep.method(zod.z.object({
+			engine: PipelineEngineChoiceSchema,
+			force: zod.z.boolean().optional()
+		}), zod.z.object({
+			success: zod.z.boolean(),
+			reason: zod.z.string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		listReferenceImages: require_sleep.method(zod.z.void(), zod.z.array(ReferenceImageEntrySchema).readonly()),
+		getReferenceImage: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceImageBodySchema.nullable()),
+		getReferenceAudioFiles: require_sleep.method(zod.z.void(), zod.z.array(ReferenceAudioEntrySchema).readonly()),
+		getReferenceAudio: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceAudioBodySchema.nullable()),
+		getAudioCapabilities: require_sleep.method(zod.z.void(), AudioCapabilitiesSchema),
+		runAudioTest: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			modelId: zod.z.string(),
+			filename: zod.z.string().optional(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		}), AudioTestResultSchema, { kind: "mutation" }),
+		getDetectionConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaNullableBridge)
+	}
+};
+//#endregion
+//#region src/capabilities/schemas/zone-rule.ts
+/**
+* Per-stage gating mode applied to the zones a rule references.
 *
-* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
-* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
-* `migration:4g` for a value the 4g migration moved from the single-slot era —
-* that value has no provenance, and the write rule lets ANY properly-attributed
-* write of the same tier replace it regardless of score.
+* - `include`: the rule contributes to a **whitelist** for its stage.
+*   When at least one `include` rule fires for a stage, only entities
+*   inside one of those zones pass that stage.
+* - `exclude`: the rule contributes to a **blacklist** for its stage.
+*   Entities inside one of those zones are dropped at that stage.
+*
+* `monitor`-style observation (count without filtering) is not a rule
+* mode — zones without any matching rule are observed naturally by
+* `zone-analytics` (live snapshot + history), so an "I just want to
+* count, not filter" use case needs no rule at all.
 */
-var LabelAttributionSchema = zod.z.object({
-	stepId: zod.z.string(),
-	modelId: zod.z.string().optional(),
-	decidedAt: zod.z.number(),
+var ZoneRuleModeEnum = zod.z.enum(["include", "exclude"]);
+/**
+* Per-consumer rule that references existing zones (geometry) and
+* defines how a specific pipeline stage should treat them. Each
+* consumer addon owns its own `ZoneRule[]` array in its per-device
+* settings:
+*
+* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
+* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
+* - future: notification rules, audio gating, etc.
+*
+* One rule applies to N zones (`zoneIds[]`) so the operator can
+* express "ignore motion in ALL of {garden, street}" with a single
+* rule. `classFilter` narrows the rule to specific object classes —
+* "drop person detections in the street, but keep cars" is one
+* `exclude` rule with `classFilter: ['person']`.
+*
+* `enabled` is a soft toggle — the operator can keep the rule
+* configured but inert without deleting it.
+*/
+var ZoneRuleSchema = zod.z.object({
+	/** Stable rule id — survives edits, used by the UI for diffing. */
+	id: zod.z.string(),
+	/** Optional human-readable label rendered in the rule editor. */
+	name: zod.z.string().optional(),
+	/** Zones this rule targets. The rule's `mode` applies to ALL
+	*  listed zones (OR-set: a detection in any one of them counts).
+	*  At least one zone id required — a rule with no targets is a
+	*  configuration mistake and the form validator rejects it. */
+	zoneIds: zod.z.array(zod.z.string()).min(1).readonly(),
+	mode: ZoneRuleModeEnum,
 	/**
-	* The GALLERY id behind a recognised tier-2 label — a face-gallery
-	* `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
-	*
-	* The text alone is a DISPLAY NAME, and a display name is renameable: a
-	* notification rule authored on "Gianluca" stopped matching the moment the
-	* operator fixed the spelling in the gallery, and nothing said so. The id is
-	* the thing that does not move, so it is what a rule matches on
-	* (`NcConditions.identities`) and the text is what a human is shown.
+	* Class names this rule applies to. Empty / undefined ⇒ rule
+	* applies to every class. Class strings match the `macroClass`
+	* field on detections (e.g. `person`, `car`, `dog`).
+	*/
+	classFilter: zod.z.array(zod.z.string()).readonly().optional(),
+	/**
+	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
+	* required to consider an entity "in the zone". Defaults to the
+	* consumer's stage default when omitted. Kept for back-compat with
+	* existing per-rule overrides; new operators pick the value via
+	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+	* set, the lower-level engine reads it as a 0–1 fraction.
+	*/
+	overlapThreshold: zod.z.number().min(0).max(1).optional(),
+	/**
+	* Operator-friendly version of `overlapThreshold` — the percentage
+	* of the detection's bbox that must lie inside the zone for the
+	* rule to match. Documented default is 85%; the engine substitutes
+	* that when the field is omitted (kept optional so existing rules
+	* stored without it stay valid).
 	*
-	* Absent when the label names no gallery row — a plate the OCR read but no
-	* vehicle claims, a sub-class, a species, any tier-1 value.
+	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+	* rule, the engine prefers `bboxInclusionPct` because it's the
+	* field exposed in the UI. Internally both feed the same gate.
 	*/
-	identityId: zod.z.string().optional()
+	bboxInclusionPct: zod.z.number().min(0).max(100).optional(),
+	/**
+	* When `true` and a detection has a segmentation mask, use the
+	* mask for overlap instead of the bbox. Detection-stage only;
+	* motion rules ignore this field.
+	*/
+	preferMask: zod.z.boolean().optional(),
+	/**
+	* Soft-toggle: `false` disables the rule without deleting it.
+	* Defaults to `true` so operators creating a rule via the UI
+	* see it active immediately.
+	*/
+	enabled: zod.z.boolean().default(true)
 });
 /**
-* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
-* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
-* track and its events always answer the same question the same way.
+* Convenience array schema — used by addon device-settings
+* contributions and runtime payloads (e.g. `RunnerCameraConfig`).
+*/
+var ZoneRulesArraySchema = zod.z.array(ZoneRuleSchema).readonly();
+//#endregion
+//#region src/capabilities/zones.cap.ts
+/**
+* Zone — pure geometry + identity. NO filtering behaviour.
 *
-* Two scalar columns, not an array: every consumer wants "the coarse one" or
-* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
-* is tier 2, and each carries its own score + attribution.
+* Zones describe **where** in the frame the operator wants to flag
+* something; consumer-owned {@link ZoneRule} arrays describe **how**
+* each pipeline stage uses them. Splitting the two means a single
+* polygon "Driveway" can simultaneously back a motion-exclude rule,
+* a detection-include rule on `['car']`, and an occupancy aggregate
+* — without three duplicated polygons.
 *
-* **Reading it.** What a human should be shown is `subLabel ?? label` — the
-* finest thing known. Before 4g the single `label` column held the finest
-* value, so a consumer that has not been updated reads the tier-1 slot and
-* shows nothing on a species-only row; that is why the migration puts every
-* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
-* and why the read surfaces were changed in the same train.
+* Owned by the orchestrator addon (provider) and mirrored into the
+* `zones` device-state slice on every mutation. Consumers
+* (motion-wasm, pipeline-executor, analytics, admin UI) read either
+* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
+* mirror with `onChanged`).
 *
-* **Writing it.** The slots are independent, which is the whole point: a
-* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
-* migratorius`), so fineness cannot regress by construction. Within a tier the
-* higher score wins. One rule, one implementation — see
-* `pipeline/label-tier.ts` in addon-post-analysis.
+* Coordinates are normalised fractions of the frame (0–1) so zones
+* survive resolution changes and stream profile switches.
+*
+* `kind` discriminates between full polygons (closed regions used
+* for intrusion / occupancy filters) and tripwires (open 2-point
+* line segments used for cross events). Onboard / firmware-reported
+* zones (Reolink, ONVIF) are out of scope for now — see the deferred
+* task list.
 */
-var TieredLabelFields = {
-	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
-	label: zod.z.string().optional(),
-	/** Confidence of the tier-1 value, as reported by the deciding step. */
-	labelScore: zod.z.number().optional(),
-	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
-	labelMeta: LabelAttributionSchema.optional(),
-	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
-	subLabel: zod.z.string().optional(),
-	/** Confidence of the tier-2 value, as reported by the deciding step. */
-	subLabelScore: zod.z.number().optional(),
-	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
-	subLabelMeta: LabelAttributionSchema.optional()
-};
-/** Per-camera slice of a training-export estimate. */
-var TrainingExportDeviceTotalsSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	tracks: zod.z.number().int(),
-	files: zod.z.number().int(),
-	bytes: zod.z.number().int()
+var ZoneKindEnum = zod.z.enum(["polygon", "tripwire"]);
+/** Polygon vertex in fraction-of-frame coordinates (0–1). */
+var PolygonPointSchema = zod.z.object({
+	x: zod.z.number(),
+	y: zod.z.number()
 });
-/**
-* What a training export WOULD contain. Computed from media index rows only —
-* no blob is read to produce this.
-*/
-var TrainingExportSummarySchema = zod.z.object({
-	generatedAt: zod.z.number(),
-	trackCount: zod.z.number().int(),
+/** A camera detection zone — pure geometry/identity. */
+var ZoneSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: zod.z.array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: zod.z.string().default("#3b82f6")
+});
+/**
+* Zones capability — per-camera CRUD over polygon detection zones.
+*
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
+*/
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [require_sleep.DeviceType.Camera],
+	methods: {
+		listZones: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(ZoneSchema).readonly()),
+		addZone: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			zone: ZoneSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			zoneId: zod.z.string()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			zone: ZoneSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+//#endregion
+//#region src/capabilities/pipeline-analytics.cap.ts
+/**
+* pipeline-analytics — device-scoped wrapper cap. Refines raw
+* per-frame detections emitted by the pipeline runner into tracked
+* objects, per-kind event collections (motion / object / audio), and
+* persisted media. Owns the post-detection domain end-to-end:
+*
+*   runner emits PipelineInferenceResult
+*     ↓ (event bus)
+*   pipeline-analytics subscriber
+*     ↓ SORT tracker + zone engine + state analyzer + event emitter
+*   → three DB collections (one per kind), one FS media tree, one
+*     unified event emitter (FrameTracked + TrackStarted/Ended +
+*     DetectionEvent on bus)
+*
+* Pure subscriber model. No `processFrame` cap method — the runner
+* already publishes the raw frame on the bus. The cap surface is
+* only QUERIES + per-device settings, bound on/off via
+* `device-manager.setWrapperActive`. `defaultActive: true` because
+* every camera with a detection pipeline wants its raw detections
+* refined; operators opt out per-device via BindingsTab when needed.
+*
+* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
+* (per-device surface) and `track-trail` caps — see P11 cleanup.
+*/
+var TrackStateSchema = zod.z.enum([
+	"new",
+	"entered",
+	"left",
+	"moving",
+	"idle"
+]);
+var EventKindSchema = zod.z.enum([
+	"motion",
+	"object",
+	"audio"
+]);
+/**
+* Spatial filter for `listTracks` — the rect + polygon variants of the shared
+* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
+* of the camera frame (top-left origin), matching the drawing-plane editor.
+*/
+var TrackZoneFilterSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
+/** Closed icon vocabulary so clients render a known glyph per kind. */
+var EventKindIconSchema = zod.z.enum([
+	"motion",
+	"audio",
+	"person",
+	"vehicle",
+	"animal",
+	"door",
+	"pir",
+	"smoke",
+	"water",
+	"button",
+	"package",
+	"generic"
+]);
+var EventKindCategorySchema = zod.z.enum([
+	"motion",
+	"audio",
+	"detection",
+	"sensor",
+	"control",
+	"custom",
+	"package"
+]);
+/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
+var EventKindLevelSchema = zod.z.enum(["macro", "sub"]);
+var EventKindDescriptorSchema = zod.z.object({
+	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
+	kind: zod.z.string(),
+	/** i18n key resolved on the UI side; `label` is the English fallback. */
+	labelKey: zod.z.string(),
+	/** English fallback label (kept for clients that don't translate). */
+	label: zod.z.string(),
+	/** Hex color for timeline/legend rendering. */
+	color: zod.z.string(),
+	/** Dictionary id → lucide component on the UI side. */
+	iconId: zod.z.string(),
+	/** Legacy closed-vocab glyph — fallback for `iconId`. */
+	icon: EventKindIconSchema,
+	category: EventKindCategorySchema,
+	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+	parentKind: zod.z.string().nullable(),
+	/** Derived from `parentKind`, explicit for the client tree. */
+	level: EventKindLevelSchema,
+	/** Which cap + device contributes this kind. For built-ins the camera
+	*  itself; for sensor kinds the LINKED source device. */
+	source: zod.z.object({
+		capName: zod.z.string(),
+		deviceId: zod.z.number()
+	})
+});
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	kinds: zod.z.array(EventKindDescriptorSchema).readonly()
+});
+var SensorEventSchema = zod.z.object({
+	id: zod.z.string(),
+	/** The CAMERA the event is attributed to (a sensor linked to N cameras
+	*  yields N rows, one per camera). */
+	deviceId: zod.z.number(),
+	/** The linked sensor device whose state changed. */
+	sourceDeviceId: zod.z.number(),
+	/** Event kind id — matches an `EventKindDescriptor.kind`. */
+	kind: zod.z.string(),
+	/** Snapshot of the sensor cap's runtime-state slice at the change. */
+	value: zod.z.record(zod.z.string(), zod.z.unknown()).nullable(),
+	timestamp: zod.z.number()
+});
+var TrackPositionSchema = zod.z.object({
+	x: zod.z.number(),
+	y: zod.z.number(),
+	timestamp: zod.z.number(),
+	bbox: BoundingBoxSchema
+});
+var TrackSnapshotSchema = zod.z.object({
+	timestamp: zod.z.number(),
+	position: TrackPositionSchema,
+	/** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
+	mediaKey: zod.z.string()
+});
+/**
+* Normalized 0..1 trajectory envelope (min/max over every position bbox,
+* divided by the track's detection-frame dims), computed at persist time.
+* Absent when the frame dims were unknown when the track was persisted
+* (legacy rows / dims-less sources) and on active (in-RAM) tracks.
+*/
+var TrackEnvelopeSchema = zod.z.object({
+	minX: zod.z.number(),
+	minY: zod.z.number(),
+	maxX: zod.z.number(),
+	maxY: zod.z.number()
+});
+/**
+* Row projection for track list queries. `full` (default) returns the
+* complete Track including the frame-rate `positions[]` history and the
+* `snapshots[]` references — megabytes across a page of tracks. `slim`
+* keeps every scalar the list surfaces actually render (ids, class(es),
+* label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
+* zonesVisited, bestEventId, envelope, hasFace, hasEmbeddedFace, hasRider) and returns `positions` /
+* `snapshots` as EMPTY arrays — detail views re-fetch the full row via
+* `getTrack`. Mirrors the event-store `projection` convention
+* (`getObjectEvents` et al.).
+*/
+var TrackProjectionSchema = zod.z.enum(["full", "slim"]);
+/**
+* One audio-classification label heard on the track's camera while the
+* track was alive, aggregated per label. An "episode" is one persisted
+* audio event (the confident-classification path: score ≥ the device's
+* `classificationMinScore`, class-change-or-heartbeat coalesced) — NOT
+* one 32 ms inference chunk, so counts stay human-scaled.
+*/
+var TrackAudioLabelSchema = zod.z.object({
+	label: zod.z.string(),
+	/** Highest classification score observed across the label's episodes. */
+	peakScore: zod.z.number(),
+	/** Number of coalesced audio-event episodes carrying this label. */
+	count: zod.z.number(),
+	firstAt: zod.z.number(),
+	lastAt: zod.z.number()
+});
+/**
+* How a track was produced. `pipeline` (default / absent) = the spatial
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
+*
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists `pipeline` — a `!== 'sensor'`
+* check silently readmits every source added after it was written.
+*/
+var TrackSourceSchema = zod.z.enum([
+	"pipeline",
+	"sensor",
+	"audio"
+]);
+/**
+* Where a track sits in the RETRAIN lifecycle (D81).
+*
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = zod.z.enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
+* Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
+* by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
+* so the two surfaces cannot drift.
+*
+* **Absent ≠ false.** A track that has never been touched omits the field; an
+* explicitly un-flagged track carries `false`. Legacy rows written before the
+* columns existed read as absent, and a consumer that needs a boolean should say
+* `flag === true`, not `flag !== false`.
+*
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
+*
+* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
+* A favourited track is skipped by retention the same way `staging` is, but
+* it does not enter `none|staging|trained` and has no staging budget.
+*/
+var TrackFlagFields = {
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
+	markForTrain: zod.z.boolean().optional(),
+	/** Operator marked this track for diagnostic attention. */
+	debug: zod.z.boolean().optional(),
+	/** Operator favourited this track. Pins it against pruning. */
+	favourited: zod.z.boolean().optional()
+};
+/**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
+* The write half: a PARTIAL patch. An omitted key is left untouched, so setting
+* one flag can never clear the other — the toggles are independent and are
+* driven from three surfaces that do not know about each other.
+*/
+var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
+/**
+* The resolved flag state after a write. Both fields are REQUIRED here (absent
+* collapses to `false`) so a caller can drive a toggle's checked state off the
+* mutation result without a re-fetch.
+*/
+var TrackFlagsSchema = zod.z.object({
+	trackId: zod.z.string(),
+	markForTrain: zod.z.boolean(),
+	debug: zod.z.boolean(),
+	favourited: zod.z.boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+/**
+* WHICH tier a label occupies. The slot a label lands in is DECLARED by the
+* step that produced it (`StepDefinition.labelTier`), never inferred from the
+* text or the step's name.
+*
+*  - `1` — a SUB-CLASS: finer than the macro class, still a taxonomy token.
+*    `animal-type` (`dog`, `bird`), `vehicle-type` (`van`), and the root
+*    detector's own raw class when it is finer than the macro it maps to.
+*  - `2` — an INSTANCE: the finest thing said about this subject.
+*    `species` (`Turdus migratorius`), `identity` (`Alice`), `plate-text`.
+*
+* The macro class itself (`person`, `vehicle`, `animal`, `package`, `face`,
+* `plate`, `audio`) is NOT a tier — it is `className`, and a macro token
+* offered for either label slot is refused (2026-08-07 rule; the refusal is
+* logged as `label tier collapse refused`).
+*/
+var LabelTierSchema = zod.z.union([zod.z.literal(1), zod.z.literal(2)]);
+/**
+* WHO decided a label, and when. Carried per tier so a value can be traced to
+* the step and model that produced it — which is what makes the write rule
+* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
+* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
+*
+* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
+* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
+* `migration:4g` for a value the 4g migration moved from the single-slot era —
+* that value has no provenance, and the write rule lets ANY properly-attributed
+* write of the same tier replace it regardless of score.
+*/
+var LabelAttributionSchema = zod.z.object({
+	stepId: zod.z.string(),
+	modelId: zod.z.string().optional(),
+	decidedAt: zod.z.number(),
+	/**
+	* The GALLERY id behind a recognised tier-2 label — a face-gallery
+	* `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
+	*
+	* The text alone is a DISPLAY NAME, and a display name is renameable: a
+	* notification rule authored on "Gianluca" stopped matching the moment the
+	* operator fixed the spelling in the gallery, and nothing said so. The id is
+	* the thing that does not move, so it is what a rule matches on
+	* (`NcConditions.identities`) and the text is what a human is shown.
+	*
+	* Absent when the label names no gallery row — a plate the OCR read but no
+	* vehicle claims, a sub-class, a species, any tier-1 value.
+	*/
+	identityId: zod.z.string().optional()
+});
+/**
+* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
+* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
+* track and its events always answer the same question the same way.
+*
+* Two scalar columns, not an array: every consumer wants "the coarse one" or
+* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
+* is tier 2, and each carries its own score + attribution.
+*
+* **Reading it.** What a human should be shown is `subLabel ?? label` — the
+* finest thing known. Before 4g the single `label` column held the finest
+* value, so a consumer that has not been updated reads the tier-1 slot and
+* shows nothing on a species-only row; that is why the migration puts every
+* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
+* and why the read surfaces were changed in the same train.
+*
+* **Writing it.** The slots are independent, which is the whole point: a
+* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
+* migratorius`), so fineness cannot regress by construction. Within a tier the
+* higher score wins. One rule, one implementation — see
+* `pipeline/label-tier.ts` in addon-post-analysis.
+*/
+var TieredLabelFields = {
+	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
+	label: zod.z.string().optional(),
+	/** Confidence of the tier-1 value, as reported by the deciding step. */
+	labelScore: zod.z.number().optional(),
+	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
+	labelMeta: LabelAttributionSchema.optional(),
+	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
+	subLabel: zod.z.string().optional(),
+	/** Confidence of the tier-2 value, as reported by the deciding step. */
+	subLabelScore: zod.z.number().optional(),
+	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
+	subLabelMeta: LabelAttributionSchema.optional()
+};
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	tracks: zod.z.number().int(),
+	files: zod.z.number().int(),
+	bytes: zod.z.number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = zod.z.object({
+	generatedAt: zod.z.number(),
+	trackCount: zod.z.number().int(),
 	fileCount: zod.z.number().int(),
 	byteCount: zod.z.number().int(),
 	/** More marked tracks exist than a single pass carries. */
@@ -15618,1489 +16472,975 @@ var DeviceEventQueryInput = zod.z.object({
 	*  optional `mediaUrl` (populated by B5). `full` (default) keeps today's
 	*  exact behaviour. Callers may omit this field — the store defaults to
 	*  `full` when not provided. */
-	projection: zod.z.enum(["full", "slim"]).optional()
-});
-var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: zod.z.string().optional() });
-var RecentTracksQueryInput = zod.z.object({
-	/** Devices to merge. An empty array yields `{ tracks: [], nextCursor: null }`. */
-	deviceIds: zod.z.array(zod.z.number()),
-	/** Window lower bound on `lastSeen` (inclusive). */
-	since: zod.z.number().optional(),
-	/** Window upper bound on `lastSeen` (inclusive). */
-	until: zod.z.number().optional(),
-	/** Page size. Default 200, max 1000. */
-	limit: zod.z.number().int().min(1).max(1e3).default(200),
-	/** Opaque continuation cursor from a previous page's `nextCursor`.
-	*  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
-	cursor: zod.z.string().optional(),
-	/** See {@link TrackProjectionSchema}. Default `full`. */
-	projection: TrackProjectionSchema.optional(),
-	/** Include stationary-promoted rows (parked objects). Default false: the
-	*  feed lists passages; parking records live on the stationary registry. */
-	includeStationary: zod.z.boolean().optional()
-});
-var RecentTracksPageSchema = zod.z.object({
-	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
-	tracks: zod.z.array(TrackSchema).readonly(),
-	/** Cursor for the next page, or null when this page is the last. */
-	nextCursor: zod.z.string().nullable()
-});
-var LIST_GROUPS_DEFAULT_LIMIT = 40;
-var LIST_GROUPS_MAX_LIMIT = 100;
-var AnalyticsGroupRecordSchema = zod.z.object({
-	id: zod.z.string(),
-	deviceId: zod.z.number().int(),
-	openedAt: zod.z.number().int(),
-	closedAt: zod.z.number().int(),
-	timestamp: zod.z.number().int(),
-	memberCount: zod.z.number().int(),
-	memberTrackIds: zod.z.array(zod.z.string()).readonly(),
-	className: zod.z.string(),
-	classes: zod.z.array(zod.z.string()).readonly(),
-	/** Relative event-media path, or null when the group has no picture yet. */
-	mediaUrl: zod.z.string().nullable(),
-	singleton: zod.z.boolean()
-});
-var AnalyticsGroupMemberSchema = zod.z.object({
-	trackId: zod.z.string(),
-	deviceId: zod.z.number().int(),
-	className: zod.z.string(),
-	firstSeen: zod.z.number().int(),
-	lastSeen: zod.z.number().int(),
-	mediaUrl: zod.z.string().nullable()
-});
-var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: zod.z.array(AnalyticsGroupMemberSchema).readonly() });
-var ListGroupsQueryInput = zod.z.object({
-	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
-	deviceIds: zod.z.array(zod.z.number()),
-	/** Window lower bound on `closedAt` (inclusive). */
-	since: zod.z.number().optional(),
-	/** Window upper bound on `openedAt` (inclusive). */
-	until: zod.z.number().optional(),
-	limit: zod.z.number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
-	/** Opaque continuation cursor from a previous page's `nextCursor`. */
-	cursor: zod.z.string().optional()
-});
-var ListGroupsPageSchema = zod.z.object({
-	groups: zod.z.array(AnalyticsGroupRecordSchema).readonly(),
-	nextCursor: zod.z.string().nullable()
-});
-var KeyEventQueryInput = zod.z.object({
-	deviceId: zod.z.number(),
-	/** Window lower bound (track firstSeen ≥ since). */
-	since: zod.z.number(),
-	/** Window upper bound (track firstSeen ≤ until). */
-	until: zod.z.number(),
-	limit: zod.z.number().int().min(1).max(200).default(50),
-	/** Drop tracks scoring below this importance. */
-	minImportance: zod.z.number().min(0).max(1).optional(),
-	/** Restrict to a single class (e.g. 'person'). */
-	classFilter: zod.z.string().optional()
-});
-var KeyEventSchema = zod.z.object({
-	/** The representative event id (the track's best ObjectEvent, else its trackId). */
-	id: zod.z.string(),
-	trackId: zod.z.string(),
-	/** Track start time (firstSeen). */
-	timestamp: zod.z.number(),
-	className: zod.z.string(),
-	...TieredLabelFields,
-	importance: zod.z.number(),
-	/** Highest-confidence ObjectEvent id for the track (empty when none). */
-	bestEventId: zod.z.string(),
-	/** Track lifetime in ms (lastSeen - firstSeen). */
-	windowMs: zod.z.number().optional(),
-	...TrackFlagFields,
-	...TrackRetrainFields
-});
-var TrackedDetectionSchema = zod.z.object({
-	trackId: zod.z.string(),
-	className: zod.z.string(),
-	confidence: zod.z.number(),
-	bbox: BoundingBoxSchema,
-	zones: zod.z.array(zod.z.string()).readonly(),
-	state: TrackStateSchema
-});
-var OverlayDetectionSchema = zod.z.looseObject({
-	id: zod.z.string(),
-	kind: zod.z.enum(["first-level", "detail"]),
-	macroClass: zod.z.string(),
-	score: zod.z.number(),
-	bbox: zod.z.object({
-		x: zod.z.number(),
-		y: zod.z.number(),
-		width: zod.z.number(),
-		height: zod.z.number()
-	}),
-	labels: zod.z.array(zod.z.looseObject({
-		label: zod.z.string(),
-		score: zod.z.number()
-	})).readonly(),
-	parentId: zod.z.string().optional()
-});
-var ScoredObjectEventSchema = ObjectEventSchema.extend({ score: zod.z.number() });
-var SearchObjectEventsInput = zod.z.object({
-	text: zod.z.string(),
-	deviceId: zod.z.number().optional(),
-	since: zod.z.number().optional(),
-	until: zod.z.number().optional(),
-	classFilter: zod.z.string().optional(),
-	limit: zod.z.number().default(50),
-	minScore: zod.z.number().min(0).max(1).default(.2)
-});
-var TrackCascadeCountsSchema = zod.z.object({
-	/** Persisted track roots deleted (authoritative). */
-	tracks: zod.z.number().int(),
-	/** Object events removed with their tracks (best-effort; see note above). */
-	events: zod.z.number().int(),
-	/** Track/face/plate-owned media removed (best-effort). Never identity media. */
-	media: zod.z.number().int(),
-	/** Unassigned (non-enrolled) face reads removed (best-effort). */
-	faces: zod.z.number().int(),
-	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
-	plates: zod.z.number().int(),
-	/** Per-track CLIP search vectors removed (best-effort). */
-	embeddings: zod.z.number().int(),
-	/** Group membership + group rows removed with their last member (best-effort). */
-	groups: zod.z.number().int()
-});
-/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
-var DiskReconcileCountsSchema = zod.z.object({
-	mediaDropped: zod.z.number().int(),
-	tracks: zod.z.number().int(),
-	events: zod.z.number().int()
-});
-/** Event-store footprint for one camera. */
-var EventStoreDeviceFootprintSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	/** Persisted event rows (motion + object + audio) for the camera. */
-	rows: zod.z.number().int(),
-	/** Event-owned media bytes on disk for the camera. */
-	bytes: zod.z.number().int()
-});
-/** Aggregate event-store footprint: global totals + per-camera breakdown. */
-var EventStoreFootprintSchema = zod.z.object({
-	totalRows: zod.z.number().int(),
-	totalBytes: zod.z.number().int(),
-	devices: zod.z.array(EventStoreDeviceFootprintSchema).readonly()
-});
-/** Per-kind counts returned by the event-prune / device-delete mutations. */
-var EventPruneCountsSchema = zod.z.object({
-	motion: zod.z.number().int(),
-	object: zod.z.number().int(),
-	audio: zod.z.number().int()
-});
-/**
-* Re-embed stored tracks from their key frames.
-*
-* The reason this is an operator-callable method and not a migration script:
-* every knob that decides what a vector MEANS — encoder model, crop margin,
-* squaring — is only changeable if the existing vectors can be regenerated.
-* Mixing feature spaces in one index makes cosine scores incomparable, and the
-* symptom is a quality regression with no visible cause.
-*/
-var RebuildObjectEmbeddingsInput = zod.z.object({
-	/** Restrict to one camera. Omit for the whole fleet. */
-	deviceId: zod.z.number().optional(),
-	since: zod.z.number().optional(),
-	until: zod.z.number().optional(),
-	/** Stop after this many tracks; the result reports whether more remain. */
-	maxTracks: zod.z.number().int().positive().optional(),
-	/**
-	* Run every embedding on THIS node instead of round-robining the fleet.
-	*
-	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
-	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
-	* calling it that would pin the rebuild REQUEST itself to that node — the
-	* rebuild orchestration lives on the hub, and only the per-track step runs
-	* remotely. This field is data; the per-track pin is applied inside.
-	*
-	* Absent ⇒ round-robin over every online node whose runner can serve the
-	* pinned model.
-	*/
-	executeOnNodeId: zod.z.string().optional(),
-	/**
-	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
-	* run flat out.
-	*
-	* A rebuild is bulk maintenance on hub-main's single thread. Measured
-	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
-	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
-	* force is logged at start and finish so a deliberately slow pass reads
-	* differently from a stalled one.
-	*/
-	pacingMs: zod.z.number().int().nonnegative().optional()
-});
-/**
-* Result of emptying the CLIP index.
-*
-* The clean slate before a policy change: a new crop margin or encoder model
-* leaves two feature spaces in one index whose cosine scores are not
-* comparable, so wiping and rebuilding is the only way to be sure every vector
-* means the same thing.
-*/
-var WipeObjectEmbeddingsResultSchema = zod.z.object({ deleted: zod.z.number() });
-/**
-* Acknowledgement that a rebuild STARTED.
-*
-* The pass costs ~1s per track — 45 minutes for a 2,600-track fleet — so it
-* runs detached and this returns immediately. Waiting for it made the client
-* time out while the work carried on server-side, which is the worst of both:
-* no result and no way to know it was still going. Poll
-* `getObjectEmbeddingRebuildStatus` for progress.
-*/
-var RebuildObjectEmbeddingsResultSchema = zod.z.object({
-	started: zod.z.boolean(),
-	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: zod.z.boolean()
-});
-var RebuildStatusSchema = zod.z.object({
-	running: zod.z.boolean(),
-	scanned: zod.z.number(),
-	rebuilt: zod.z.number(),
-	/** Tracks whose key frame is gone — nothing to re-embed from. */
-	missingKeyFrame: zod.z.number(),
-	/** Tracks with no usable detection box. */
-	missingBbox: zod.z.number(),
-	/**
-	* Tracks an executing node REFUSED rather than broke on — an unreadable key
-	* frame, a step that threw. Separate from `failed` because the remedy is
-	* different, and because a whole camera silently contributing zero vectors
-	* is the shape of failure a rebuild must never hide.
-	*/
-	notRunnable: zod.z.number(),
-	/**
-	* The pass stopped because NO node could serve the pinned model.
-	*
-	* Distinct from `notRunnable` on purpose: that one says "this track was
-	* refused", this one says "the cluster cannot do this work at all" — every
-	* candidate node either lacks the `clip-embedding` step, lacks a build of the
-	* pinned model for its engine format, or dropped out. The remedy is a model /
-	* engine change, not a per-camera one. Non-zero here always comes with
-	* `complete: false`.
-	*/
-	noCapableNode: zod.z.number(),
-	failed: zod.z.number(),
-	/** Set once a pass ends: true only when EVERYTHING was covered. */
-	complete: zod.z.boolean().nullable(),
-	startedAtMs: zod.z.number().nullable(),
-	finishedAtMs: zod.z.number().nullable(),
-	/** Present when the pass ended by throwing. */
-	error: zod.z.string().nullable()
-});
-var pipelineAnalyticsCapability = {
-	name: "pipeline-analytics",
-	scope: "device",
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: true,
-	deviceTypes: [require_sleep.DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {
-		getActiveTracks: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(TrackSchema).readonly()),
-		getTrack: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string()
-		}), TrackSchema.nullable()),
-		/** Historical completed tracks for a device. Queried from the
-		*  persisted `pipeline-analytics:tracks` collection; active tracks
-		*  still in RAM are not included. */
-		listTracks: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			since: zod.z.number().optional(),
-			until: zod.z.number().optional(),
-			limit: zod.z.number().optional(),
-			/** Spatial filter — only tracks whose trajectory intersects the zone
-			*  (normalized 0..1 rect or polygon). SQL-prefiltered on the persisted
-			*  envelope columns, then precisely tested per position. Tracks with
-			*  an unknown envelope (no frame dims at persist time) always match. */
-			zone: TrackZoneFilterSchema.optional(),
-			/** See {@link TrackProjectionSchema}. Default `full` (backward
-			*  compatible — omitting the field keeps today's exact behaviour). */
-			projection: TrackProjectionSchema.optional(),
-			/** Include stationary-promoted rows (parked objects handed to the
-			*  stationary registry). Default false: the timeline lists passages,
-			*  not parking records (operator decision, 2026-08-15). */
-			includeStationary: zod.z.boolean().optional()
-		}), zod.z.array(TrackSchema).readonly()),
-		/**
-		* Batched cluster-wide track listing — ONE call for the events page /
-		* reel first paint instead of a per-camera `listTracks` fan-out. Merges
-		* the persisted completed tracks of every requested device, sorted by
-		* `lastSeen` DESC with a stable (lastSeen, trackId) cursor. Per-device
-		* indexed pages (`idx_tracks_device_lastSeen`) are k-way merged
-		* provider-side; `projection: 'slim'` drops the heavy `positions[]` /
-		* `snapshots[]` JSON (returned as empty arrays). Active in-RAM tracks
-		* are not included (same contract as `listTracks`).
-		*/
-		listRecentTracks: require_sleep.method(RecentTracksQueryInput, RecentTracksPageSchema),
-		/**
-		* Batched co-moving group listing — the Groups feed. Same merge/cursor
-		* contract as {@link listRecentTracks}. A group is a sealed partition of
-		* one session; `getGroup` is the detail with members.
-		*/
-		listGroups: require_sleep.method(ListGroupsQueryInput, ListGroupsPageSchema),
-		getGroup: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			groupId: zod.z.string().min(1)
-		}), AnalyticsGroupDetailSchema.nullable()),
-		clearTracks: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getMotionEvents: require_sleep.method(DeviceEventQueryInput, zod.z.array(MotionEventSchema).readonly()),
-		getObjectEvents: require_sleep.method(ObjectEventQueryInput, zod.z.array(ObjectEventSchema).readonly()),
-		getAudioEvents: require_sleep.method(DeviceEventQueryInput, zod.z.array(AudioEventSchema).readonly()),
-		/**
-		* Every event kind the device can produce: built-ins (motion + audio),
-		* detection classes actually observed for the device (from the track
-		* history), and sensor kinds contributed by LINKED devices (resolved via
-		* `device-manager.getLinkedDevices`, mapped through `EVENT_KIND_BY_CAP`).
-		*/
-		listEventKinds: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(EventKindDescriptorSchema).readonly()),
-		/**
-		* The same answer for many cameras in ONE call.
-		*
-		* `listEventKinds` is the slowest per-device query on the hub — measured
-		* at ~100 ms against 6-11 ms for its neighbours — because composing it
-		* costs a `getCameraStatus`, a `getLinkedDevices` and one `getBindings`
-		* per linked device. The viewer asks for it once per camera at first
-		* paint, so twelve cameras paid twelve of those round-trips on top of the
-		* per-camera cost.
-		*
-		* Batched, the camera statuses come from ONE `getCameraStatuses` instead
-		* of N, and the per-device composition runs concurrently.
-		*
-		* Per-device rather than pre-merged on purpose: a caller that renders one
-		* camera's lanes needs to know WHICH camera a kind came from, and merging
-		* is three lines the caller can do. `listEventKinds` stays for
-		* single-device callers.
-		*/
-		listEventKindsBatch: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(EventKindsForDeviceSchema).readonly()),
-		/**
-		* Sensor-event history for a camera: state changes of LINKED sensor
-		* devices, attributed to the camera at ingest time (one row per linked
-		* camera). Mirrors `getAudioEvents` query semantics; `kinds` narrows to
-		* a kind subset.
-		*/
-		getSensorEvents: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			since: zod.z.number().optional(),
-			until: zod.z.number().optional(),
-			kinds: zod.z.array(zod.z.string()).optional(),
-			limit: zod.z.number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT)
-		}), zod.z.array(SensorEventSchema).readonly()),
-		/**
-		* Importance-ranked highlights for a device+window. Queries completed
-		* tracks by (deviceId, firstSeen ∈ [since,until]), scores each (or reuses
-		* the persisted score), filters by minImportance/classFilter, orders by
-		* importance desc, and returns up to `limit` compact key events mapped to
-		* each track's best event. Legacy tracks lacking a persisted score are
-		* scored on-read (no write). Degrades to `[]` on error.
-		*/
-		getKeyEvents: require_sleep.method(KeyEventQueryInput, zod.z.array(KeyEventSchema).readonly()),
-		/** Server-side bucketed event counts for the 24-hour timeline.
-		*  Returns one entry per non-empty bucket; empty buckets are omitted. */
-		getEventDensity: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			since: zod.z.number(),
-			until: zod.z.number(),
-			bucketMs: zod.z.number().int().positive()
-		}), zod.z.array(zod.z.object({
-			bucketStart: zod.z.number(),
-			motion: zod.z.number().int(),
-			object: zod.z.number().int(),
-			audio: zod.z.number().int()
-		})).readonly()),
-		/**
-		* @deprecated Prefer `pruneTracksBefore` — the track is the ROOT of the
-		* analytics model and retention must cascade from it (design §5.1). This
-		* event-only prune leaves orphaned tracks/faces/plates/embeddings behind.
-		* Retained as a compat shim for the Phase-B3 recorder orchestration caller,
-		* which prunes events to keep history aligned with available footage and
-		* reads the per-kind counts. Delete all events (motion + object + audio)
-		* for the given device older than `cutoffMs` (exclusive) + their thumbnails
-		* in lockstep; returns per-kind deleted counts.
-		*/
-		pruneEventsBefore: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			cutoffMs: zod.z.number()
-		}), zod.z.object({
-			motion: zod.z.number().int(),
-			object: zod.z.number().int(),
-			audio: zod.z.number().int()
-		}), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Track-centric retention entry point (design §5.1). Selects every
-		* persisted track for the device whose `lastSeen < cutoffMs` (paged) and
-		* runs the extensible whole-track deletion cascade (design §3): object
-		* events + their media, track/face/plate-owned media, unassigned face
-		* reads, per-track CLIP embeddings, then the track root LAST. ENROLLED
-		* (assigned) faces/plates and `ownerKind:'identity'` media are exempt —
-		* the durable matching gallery always persists. Fires the per-track
-		* live-state cleanup so a pruned track can't linger in dispatch/overlay
-		* state. Returns per-family deleted counts (`tracks` authoritative).
-		*
-		* Replaces `pruneEventsBefore` as the correct time-based retention prune.
-		*/
-		pruneTracksBefore: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			cutoffMs: zod.z.number()
-		}), TrackCascadeCountsSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Operator "clean slate" for a device (design §5.3): prune EVERY track for
-		* the device via the same cascade as `pruneTracksBefore` with `cutoffMs =
-		* now`. One call per device — no client-side track enumeration. Enrolled
-		* gallery + identity media are exempt (design §4). Returns per-family
-		* deleted counts.
-		*/
-		wipeAllAnalytics: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), TrackCascadeCountsSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Disk-wins reconcile for one camera. Drops media index rows whose blobs
-		* are gone, then cascades tracks (including favourited and staging) that
-		* have no remaining files. Enrolled identity/vehicle/scene media is never
-		* probed. Trackless motion/audio events with no remaining file are dropped,
-		* including snapshot-less rows.
-		*/
-		reconcileFromDisk: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), DiskReconcileCountsSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Delete whole tracks (object events) by id for the given device,
-		* cascading their media in lockstep. Returns the number of tracks
-		* actually deleted plus the ids that could not be removed.
-		*
-		* Operator-driven from the DI Events page (batch delete). Routes through
-		* the same widened track-deletion cascade (design §5.2).
-		*/
-		deleteTracks: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackIds: zod.z.array(zod.z.string()).min(1)
-		}), zod.z.object({
-			deleted: zod.z.number().int(),
-			failed: zod.z.array(zod.z.string()).readonly()
-		}), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Set the per-track operator flags (`markForTrain`, `debug`, `favourited`) on ONE track.
-		* The patch is PARTIAL — an omitted key is left untouched — because the
-		* three surfaces that write it (admin Events grid, viewer track detail,
-		* viewer cluster detail) each own one toggle and must not clobber the other.
-		*
-		* Writes the track ROW: `markForTrain`/`debug` are per-TRACK state, so they
-		* live where `label` and `importance` live, not in any per-device settings
-		* store. Updates the in-RAM active track too, so a flag set on a live track
-		* survives its expiry-time persist.
-		*
-		* `auth: 'protected'` (the default), NOT `admin`: the viewer is an
-		* authenticated non-admin surface and two of the three call sites are
-		* there. The note that used to sit here said to revisit this the day a flag
-		* gained an effect that costs storage, and D81 is that day — `markForTrain`
-		* now pins. It STAYS protected, and the reason is that the alternative
-		* makes the feature pointless: marking a track is something you do while
-		* looking at it, on the surface you were already looking at it on, and that
-		* surface is the viewer. What the storage cost gets instead is a BOUND — a
-		* per-device pin budget enforced in the body, refusing a new pin past the
-		* limit while always allowing un-marking. `deleteTracks` next door is still
-		* admin, because destroying evidence and preserving it are not symmetric.
-		*
-		* `markForTrain` writes the retrain LIFECYCLE, not a boolean column: `true`
-		* is `none → staging`, `false` is `staging → none`. A track already
-		* `trained` refuses BOTH — its frames are copies inside the retrain dataset
-		* and re-staging it from a generic toggle is how the same material gets
-		* annotated twice under two ground truths. Returning a trained track to
-		* staging is a deliberate action of the retrain page, which is also the only
-		* thing that produces `trained` in the first place.
-		*
-		* Returns the RESOLVED state of both flags (absent → `false`) plus the
-		* `retrainStatus` they were derived from, so a caller can drive its toggle
-		* — and render a `trained` badge — without a re-fetch. Rejects an unknown
-		* track, a new staging mark on a device already holding its full budget, and
-		* any `markForTrain` write against a trained track.
-		*/
-		setTrackFlags: require_sleep.method(zod.z.object({
-			/** Log/audit scope only — the trackId is globally unique on its own. */
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			flags: TrackFlagsPatchSchema
-		}), TrackFlagsSchema, { kind: "mutation" }),
-		/**
-		* Durable event-store footprint for the management UI: event rows
-		* (motion + object + audio) counted per camera + total, plus the
-		* event-owned media bytes on disk per camera + total. Stat/count-based,
-		* computed on demand.
-		*/
-		getEventStoreFootprint: require_sleep.method(zod.z.object({}), EventStoreFootprintSchema, {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* Cluster-wide prune of events older than `olderThanMs` (exclusive) across
-		* every camera, deleting each event's media in lockstep. Logged to the
-		* events ops-log with `reason` (default `'retention'`). Returns the summed
-		* per-kind deleted counts.
-		*/
-		pruneEvents: require_sleep.method(zod.z.object({
-			olderThanMs: zod.z.number(),
-			reason: OpsLogReasonSchema.optional()
-		}), EventPruneCountsSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Manually delete EVERY event (motion + object + audio) for one camera and
-		* its event-owned media in lockstep. Logged to the events ops-log as
-		* `op:'manual-delete', reason:'manual'`. Destructive — the admin UI guards
-		* it behind a confirm.
-		*/
-		deleteDeviceEvents: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), EventPruneCountsSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** The events ops-log rows (newest-first), optionally scoped to one camera.
-		*  Backed by a declared pipeline-analytics SQLite collection. */
-		/** Internal migration-participant lease. It drains active MediaStore
-		* writes and refuses new ones without changing analytics bindings. */
-		pauseForStorageMigration: require_sleep.method(StorageMigrationLeaseInputSchema, zod.z.object({ paused: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		resumeForStorageMigration: require_sleep.method(StorageMigrationLeaseInputSchema, zod.z.object({ resumed: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Drops cached location roots after the storage coordinator repoints a
-		* default so future event-media writes use the new root. */
-		refreshStorageLocationsForMigration: require_sleep.method(StorageMigrationLeaseInputSchema, zod.z.object({ refreshed: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		startStorageMigrationMove: require_sleep.method(StorageMigrationMediaMoveInputSchema, zod.z.object({ jobId: zod.z.string() }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getStorageMigrationMoveStatus: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), RelocateJobSchema.nullable(), { auth: "admin" }),
-		cancelStorageMigrationMove: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		listOpsLog: require_sleep.method(OpsLogQueryInputSchema, zod.z.array(OpsLogEntrySchema).readonly(), {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* The CHEAP QUESTION, asked before any media moves: how big is the dataset
-		* the marked (`markForTrain`) tracks would produce?
-		*
-		* Answered from media INDEX rows only — key, kind, size, timestamp — so it
-		* costs ~2 KB of reads per track and no blob reads at all. The measured harm
-		* behind D56 was a bulk pass that read and base64'd every blob a track owned
-		* before deciding anything, taking hub-main to 82 s busy out of 120; an
-		* export is that same I/O shape, so it inherits the same discipline: know
-		* the size, then decide.
-		*
-		* `truncated` reports that more marked tracks exist than one pass carries.
-		* Empty `deviceIds` ⇒ every device that has marked tracks.
-		*/
-		getTrainingExportSummary: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), TrainingExportSummarySchema, {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* Where to download the dataset archive.
-		*
-		* The BYTES do not come back through this cap — they come from the returned
-		* data-plane URL, which streams a tar built entry by entry. A multi-gigabyte
-		* archive base64'd through a unary RPC envelope would be held whole in
-		* memory twice on a hub this repo has already OOM'd once (D9/D18 are the
-		* same lesson about frames). `getDownloadUrl` on `recordingExport` is the
-		* precedent, and this follows it deliberately.
-		*
-		* The archive contains a `manifest.json` FIRST, then the stored media
-		* VERBATIM under `tracks/<deviceId>/<trackId>/…`. No crop is derived and no
-		* model is run: a training set's pixels must be the pixels the pipeline saw.
-		*/
-		getTrainingExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* The staging worklist for one camera, or for every camera that has one.
-		*
-		* Fetched ON DEMAND, over the staging set only — the page never scans
-		* history, because making the working set small is the entire purpose of
-		* the mark. Each row carries how many frames the dataset already holds from
-		* the track and how many subjects were annotated on them, so
-		* `frameCount: 0` reads as "still to work" without a second call per track.
-		*
-		* `auth: 'admin'`, unlike the viewer-level mark itself: marking a track is
-		* curation you do while looking at it, but building the training set the
-		* fleet's models are fine-tuned on is not.
-		*/
-		listRetrainStaging: require_sleep.method(zod.z.object({
-			/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
-			*  `deviceId`, deliberately: `deviceId` would make this device-bound and
-			*  route it at one camera's owner, and "every camera" would stop being
-			*  expressible at all. */
-			deviceIds: zod.z.array(zod.z.number()).optional(),
-			limit: zod.z.number().int().min(1).max(500).optional()
-		}), zod.z.array(RetrainTrackSchema).readonly(), {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* What a track can contribute, and what it already has.
-		*
-		* `candidates` are the track's whole, unannotated frames — index rows only,
-		* so this is cheap. `copies` are the frames already inside the dataset, and
-		* a candidate whose copy exists is marked `copied: true`: selecting it again
-		* is free and CANNOT fail, whatever became of the original.
-		*
-		* A crop, a thumbnail and `fullFrameBoxed` are never candidates. The last
-		* one matters most: it has the model's own rectangle burned into the pixels,
-		* and a detector trained on it learns to find a green line.
-		*/
-		listRetrainFrames: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), RetrainFrameListSchema, {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* COPY-ON-SELECT — the write that makes `trained` safe to evict.
-		*
-		* Selecting a frame copies its bytes into retrain storage immediately: not
-		* a reference, not a lease. Once the copy exists the dataset no longer
-		* depends on the track's media, which is exactly what lets D81 hand a
-		* `trained` track back to retention.
-		*
-		* The order inside is load-bearing and is pinned by a test: an EXISTING
-		* copy is returned without touching the source, so an original that
-		* evaporated blocks the selection of THAT ORIGINAL and never the copy
-		* already taken. Every refusal comes back named — a dropped selection is
-		* never silent, on the wire or in the log.
-		*/
-		selectRetrainFrames: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			mediaKeys: zod.z.array(zod.z.string()).min(1)
-		}), RetrainFrameSelectionSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Un-select a frame: its annotations go first, then the copy and its blob.
-		*  Deliberately destructive and deliberately explicit — it is the only way
-		*  a frame leaves the dataset before export. */
-		deselectRetrainFrame: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			frameId: zod.z.string()
-		}), zod.z.object({
-			removed: zod.z.boolean(),
-			removedAnnotations: zod.z.number().int()
-		}), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* The pixels of ONE copied frame, base64.
-		*
-		* Through the cap rather than a data plane because it is genuinely one
-		* frame at a time, on demand, at human speed — the shape D9/D18 permit
-		* (what they forbid is frames crossing a boundary at frame RATE). The
-		* annotation canvas needs the image and its exact dimensions in the same
-		* answer: a canvas that places a normalised box against a size it guessed
-		* draws every box in the wrong place.
-		*/
-		getRetrainFrameImage: require_sleep.method(zod.z.object({ frameId: zod.z.string() }), zod.z.object({
-			base64: zod.z.string(),
-			width: zod.z.number().int(),
-			height: zod.z.number().int()
-		}), {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* Ask the pipeline what it sees, as a PROPOSAL.
-		*
-		* Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
-		* every box comes back as a draft with `source: 'assist'` plus the model and
-		* score that produced it. The operator confirms, edits, adds and deletes;
-		* nothing is stored until `saveRetrainAnnotations`.
-		*
-		* For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
-		* never the whole frame, where a package detector at that threshold proposes
-		* furniture. A package request with no zone is REFUSED rather than widened,
-		* because the silent widening would look like a bad model for as long as
-		* nobody checked which rectangle it ran on.
-		*/
-		proposeRetrainAnnotations: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			frameId: zod.z.string(),
-			subject: RetrainAssistSubjectSchema,
-			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
-			nodeId: zod.z.string().optional()
-		}), RetrainAssistResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Every annotation on a track, oldest first. */
-		listRetrainAnnotations: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
-			kind: "query",
-			auth: "admin"
-		}),
-		/**
-		* Replace EVERY annotation on one frame with the supplied set.
-		*
-		* Whole-frame replacement, not per-box upsert: the unit of ground truth is
-		* the frame, and "the operator deleted a box" must be the same durable
-		* outcome as "the operator never drew it". A per-box patch would let a frame
-		* keep a box the operator removed on a surface that only knew about the
-		* boxes it sent.
-		*
-		* Refuses a macro class typed into `label` or `subLabel` — the tiers are
-		* separate and the guard is at the WRITE, because a mixed taxonomy cannot
-		* be un-mixed by reading it.
-		*/
-		saveRetrainAnnotations: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			frameId: zod.z.string(),
-			annotations: zod.z.array(RetrainAnnotationDraftSchema)
-		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Finish with a track: `staging → trained`. **The only writer of that
-		* state** — D81 shipped the column with it deliberately unreachable.
-		*
-		* Refuses a track the dataset holds no copies from. `trained` un-pins the
-		* track's media, so completing without a copy is a delete order for material
-		* nothing ever extracted anything from; that refusal IS the safety argument
-		* of D81, expressed as a precondition.
-		*/
-		completeRetrainTrack: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string()
-		}), RetrainTransitionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* The deliberate return: `trained → staging`, for the rare case.
-		*
-		* The generic `setTrackFlags` toggle refuses this in both directions by
-		* design (D81) — re-staging from a checkbox is how the same material gets
-		* annotated twice under two ground truths. Doing it here means the operator
-		* is looking at the annotations that already exist while they decide, and
-		* those annotations are LEFT ALONE: "put this back" must not be a
-		* destructive act wearing a navigational name.
-		*/
-		restageRetrainTrack: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string()
-		}), RetrainTransitionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Where to download the ANNOTATED dataset.
-		*
-		* The sibling of `getTrainingExportUrl` and deliberately not the same
-		* archive: that one streams a marked track's stored media verbatim, this one
-		* streams the retrain COPIES plus an `annotations.json` carrying, for every
-		* subject, the canonical full-frame box AND the geometry derived for each
-		* model shape (letterboxed root / zone-cropped package / subject-cropped
-		* classifier). Derived at export, never stored — one box in, three shapes
-		* out, so two crops of the same subject can never end up in one feature
-		* space (D52).
-		*/
-		getRetrainExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
-			kind: "query",
-			auth: "admin"
-		}),
-		getEventMedia: require_sleep.method(zod.z.object({
-			eventId: zod.z.string(),
-			kind: MediaFileKindEnum.optional(),
-			deviceId: zod.z.number()
-		}), zod.z.array(MediaFileSchema).readonly()),
-		/** All media rows owned by a track. `kinds` narrows to a kind subset so a
-		*  client can fetch the SMALL display variants on open and pull the
-		*  multi-MB native variants only on demand (mirrors `getEventMedia.kind`).
-		*  Absent ⇒ every kind (back-compat). */
-		getTrackMedia: require_sleep.method(zod.z.object({
-			trackId: zod.z.string(),
-			kinds: zod.z.array(MediaFileKindEnum).optional(),
-			deviceId: zod.z.number()
-		}), zod.z.array(MediaFileSchema).readonly()),
-		/**
-		* What media a track HAS, without any of it.
-		*
-		* The detail view needs the shape of a track's media to build its strip —
-		* which kinds exist, in what order, at what size — and then wants each tile
-		* fetched as an image, not as base64 inside this response. Measured: the
-		* full `getTrackMedia` is 5.3-7.7 MB and blocks the view; this manifest is
-		* ~2 KB.
-		*
-		* It also restores a fact a `kinds` filter destroys: filtering
-		* `getTrackMedia` drops whole ROWS, taking `kind` and `sizeBytes` with
-		* them, so a client that fetched only the small variants could no longer
-		* tell a full-resolution variant existed — and the affordance that opens it
-		* would silently disappear.
-		*/
-		listTrackMedia: require_sleep.method(zod.z.object({
-			trackId: zod.z.string(),
-			deviceId: zod.z.number()
-		}), zod.z.array(MediaFileInfoSchema).readonly()),
-		/**
-		* Search object events by text query using CLIP cosine similarity.
-		* Encodes `text` via the `embedding-encoder` cap, queries the
-		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
-		* embeddings by cosine similarity, and joins winners to their
-		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
-		* `minScore`, sorted descending by score.
-		*/
-		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly()),
-		wipeObjectEmbeddings: require_sleep.method(zod.z.object({}), WipeObjectEmbeddingsResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		rebuildObjectEmbeddings: require_sleep.method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getObjectEmbeddingRebuildStatus: require_sleep.method(zod.z.object({}), RebuildStatusSchema)
-	},
-	events: {
-		/**
-		* Enriched frame emitted after refinement — the live-overlay source of
-		* truth (two-plane re-injection). Carries the frame's detections in the
-		* `ObjectDetection` wire shape: first-level roots (with track info +
-		* enrichment labels) plus synthesized `kind:'detail'` face/plate entries
-		* re-projected from per-track detail state, so stream overlays render
-		* boxes + recognized names without querying full Track state.
-		*/
-		onFrameTracked: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			timestamp: zod.z.number(),
-			frameWidth: zod.z.number(),
-			frameHeight: zod.z.number(),
-			detections: zod.z.array(OverlayDetectionSchema).readonly()
-		}) },
-		/** Track entered active state (first-seen). */
-		onTrackStarted: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			className: zod.z.string()
-		}) },
-		/** Track expired (TTL reached after last detection). */
-		onTrackEnded: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			className: zod.z.string(),
-			durationMs: zod.z.number()
-		}) },
-		/** Canonical "something happened at device X" event, per-kind. */
-		onDetectionEvent: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			kind: EventKindSchema,
-			eventId: zod.z.string(),
-			timestamp: zod.z.number()
-		}) }
-	}
-};
-//#endregion
-//#region src/capabilities/pipeline-executor.cap.ts
-/**
-* Reference to the frame's retained NATIVE surface + the parent crop's placement
-* within the frame, so the executor can re-cut a leaf child ROI at native
-* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
-*/
-var NativeCropRefSchema = zod.z.object({
-	/** Handle keying the retained native surface (node-pinned to its owner). */
-	handle: require_sleep.FrameHandleSchema,
-	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-	cropFrameSpace: zod.z.object({
-		x: zod.z.number(),
-		y: zod.z.number(),
-		w: zod.z.number(),
-		h: zod.z.number()
-	})
-});
-zod.z.object({
-	crop: zod.z.object({
-		left: zod.z.number(),
-		top: zod.z.number(),
-		width: zod.z.number().positive(),
-		height: zod.z.number().positive()
-	}).optional(),
-	content: zod.z.object({
-		width: zod.z.number().int().positive(),
-		height: zod.z.number().int().positive()
-	}),
-	fit: zod.z.enum(["stretch", "contain"]),
-	format: zod.z.enum([
-		"rgb",
-		"gray",
-		"jpeg"
-	])
-});
-var FrameRefSchema = zod.z.object({
-	registryId: zod.z.string().min(1),
-	id: zod.z.string().min(1),
-	width: zod.z.number().int().positive(),
-	height: zod.z.number().int().positive(),
-	format: zod.z.enum(["rgb", "gray"]),
-	timestamp: zod.z.number(),
-	capturedAt: zod.z.number().optional()
-});
-var ModelFormatSchema$1 = zod.z.enum([
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-]);
-var PipelineSlotSchema = zod.z.enum([
-	"detector",
-	"cropper",
-	"classifier",
-	"refiner",
-	"audio-classifier"
-]);
-var PipelineEngineChoiceSchema = zod.z.object({
-	runtime: zod.z.enum(["node", "python"]),
-	backend: zod.z.string(),
-	format: ModelFormatSchema$1,
-	device: zod.z.string().optional()
-});
-var EngineDeviceInfoSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	description: zod.z.string().optional()
+	projection: zod.z.enum(["full", "slim"]).optional()
 });
-var AvailableEngineSchema = zod.z.object({
-	engine: PipelineEngineChoiceSchema,
-	devices: zod.z.array(EngineDeviceInfoSchema).readonly(),
-	defaultDevice: zod.z.string()
+var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: zod.z.string().optional() });
+var RecentTracksQueryInput = zod.z.object({
+	/** Devices to merge. An empty array yields `{ tracks: [], nextCursor: null }`. */
+	deviceIds: zod.z.array(zod.z.number()),
+	/** Window lower bound on `lastSeen` (inclusive). */
+	since: zod.z.number().optional(),
+	/** Window upper bound on `lastSeen` (inclusive). */
+	until: zod.z.number().optional(),
+	/** Page size. Default 200, max 1000. */
+	limit: zod.z.number().int().min(1).max(1e3).default(200),
+	/** Opaque continuation cursor from a previous page's `nextCursor`.
+	*  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
+	cursor: zod.z.string().optional(),
+	/** See {@link TrackProjectionSchema}. Default `full`. */
+	projection: TrackProjectionSchema.optional(),
+	/** Include stationary-promoted rows (parked objects). Default false: the
+	*  feed lists passages; parking records live on the stationary registry. */
+	includeStationary: zod.z.boolean().optional()
 });
-var PipelineDefaultStepSchema = zod.z.lazy(() => zod.z.object({
-	addonId: zod.z.string(),
-	addonName: zod.z.string(),
-	slot: PipelineSlotSchema,
-	inputClasses: zod.z.array(zod.z.string()).readonly(),
-	outputClasses: zod.z.array(zod.z.string()).readonly(),
-	enabled: zod.z.boolean(),
-	modelId: zod.z.string(),
-	children: zod.z.array(PipelineDefaultStepSchema).readonly(),
-	group: zod.z.string().optional(),
-	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-}));
-var PipelineTemplateStepSchema = zod.z.lazy(() => zod.z.object({
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	modelId: zod.z.string(),
-	children: zod.z.array(PipelineTemplateStepSchema).readonly(),
-	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	createdAt: zod.z.string(),
-	updatedAt: zod.z.string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: zod.z.array(PipelineTemplateStepSchema).readonly()
+var RecentTracksPageSchema = zod.z.object({
+	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
+	tracks: zod.z.array(TrackSchema).readonly(),
+	/** Cursor for the next page, or null when this page is the last. */
+	nextCursor: zod.z.string().nullable()
 });
-var PipelineModelOptionSchema = zod.z.object({
+var LIST_GROUPS_DEFAULT_LIMIT = 40;
+var LIST_GROUPS_MAX_LIMIT = 100;
+var AnalyticsGroupRecordSchema = zod.z.object({
 	id: zod.z.string(),
-	name: zod.z.string(),
-	formats: zod.z.record(zod.z.string(), zod.z.object({
-		downloaded: zod.z.boolean(),
-		sizeMB: zod.z.number()
-	})),
-	group: ModelVariantGroupSchema.optional(),
-	legacy: zod.z.boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
+	deviceId: zod.z.number().int(),
+	openedAt: zod.z.number().int(),
+	closedAt: zod.z.number().int(),
+	timestamp: zod.z.number().int(),
+	memberCount: zod.z.number().int(),
+	memberTrackIds: zod.z.array(zod.z.string()).readonly(),
+	className: zod.z.string(),
+	classes: zod.z.array(zod.z.string()).readonly(),
+	/** Relative event-media path, or null when the group has no picture yet. */
+	mediaUrl: zod.z.string().nullable(),
+	singleton: zod.z.boolean()
 });
-var ConfigFieldBridge = zod.z.custom();
-var PipelineAddonSchemaSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	slot: PipelineSlotSchema,
-	inputClasses: zod.z.array(zod.z.string()).readonly(),
-	outputClasses: zod.z.array(zod.z.string()).readonly(),
-	childSlots: zod.z.array(PipelineSlotSchema).readonly(),
-	models: zod.z.array(PipelineModelOptionSchema).readonly(),
-	defaultModelId: zod.z.string(),
-	defaultModelIdByFormat: zod.z.record(zod.z.string(), zod.z.string()).optional(),
-	enabledByDefault: zod.z.boolean().optional(),
-	backfillIntoExistingOverrides: zod.z.boolean().optional(),
-	defaultConfidence: zod.z.number(),
-	group: zod.z.string().optional(),
-	configSchema: zod.z.array(ConfigFieldBridge).readonly().optional()
+var AnalyticsGroupMemberSchema = zod.z.object({
+	trackId: zod.z.string(),
+	deviceId: zod.z.number().int(),
+	className: zod.z.string(),
+	firstSeen: zod.z.number().int(),
+	lastSeen: zod.z.number().int(),
+	mediaUrl: zod.z.string().nullable()
 });
-var PipelineSlotSchemaSchema = zod.z.object({
-	id: PipelineSlotSchema,
-	label: zod.z.string(),
-	priority: zod.z.number(),
-	parentSlot: PipelineSlotSchema.nullable(),
-	addons: zod.z.array(PipelineAddonSchemaSchema).readonly()
+var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: zod.z.array(AnalyticsGroupMemberSchema).readonly() });
+var ListGroupsQueryInput = zod.z.object({
+	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+	deviceIds: zod.z.array(zod.z.number()),
+	/** Window lower bound on `closedAt` (inclusive). */
+	since: zod.z.number().optional(),
+	/** Window upper bound on `openedAt` (inclusive). */
+	until: zod.z.number().optional(),
+	limit: zod.z.number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: zod.z.string().optional()
 });
-var PipelineSchemaSchema = zod.z.object({
-	availableEngines: zod.z.array(AvailableEngineSchema).readonly(),
-	selectedEngine: PipelineEngineChoiceSchema,
-	slots: zod.z.array(PipelineSlotSchemaSchema).readonly()
+var ListGroupsPageSchema = zod.z.object({
+	groups: zod.z.array(AnalyticsGroupRecordSchema).readonly(),
+	nextCursor: zod.z.string().nullable()
 });
-var EngineProvisioningSchema = zod.z.object({
-	runtimeId: zod.z.enum([
-		"onnx",
-		"openvino",
-		"coreml",
-		"edgetpu"
-	]).nullable(),
-	device: zod.z.string().nullable(),
-	state: zod.z.enum([
-		"idle",
-		"installing",
-		"verifying",
-		"ready",
-		"failed"
-	]),
-	progress: zod.z.number().optional(),
-	error: zod.z.string().optional(),
-	nextRetryAt: zod.z.number().optional(),
-	/**
-	* Gate A (config-correctness gate at engine change): human-readable
-	* config issues surfaced EAGERLY when the node's engine changes — model
-	* substitutions ("chose X, running Y") and zero-build steps ("no model
-	* has a <format> build"). Additive/optional: informational only, never
-	* enforced here — `assertEngineReady` (readiness) still gates inference.
-	* Absent/empty when the node-default tree resolves cleanly.
-	*/
-	configIssues: zod.z.array(zod.z.string()).optional()
+var KeyEventQueryInput = zod.z.object({
+	deviceId: zod.z.number(),
+	/** Window lower bound (track firstSeen ≥ since). */
+	since: zod.z.number(),
+	/** Window upper bound (track firstSeen ≤ until). */
+	until: zod.z.number(),
+	limit: zod.z.number().int().min(1).max(200).default(50),
+	/** Drop tracks scoring below this importance. */
+	minImportance: zod.z.number().min(0).max(1).optional(),
+	/** Restrict to a single class (e.g. 'person'). */
+	classFilter: zod.z.string().optional()
 });
-var PipelineStepInputSchema = zod.z.lazy(() => zod.z.object({
-	addonId: zod.z.string(),
-	modelId: zod.z.string().optional(),
-	enabled: zod.z.boolean().default(true),
-	children: zod.z.array(PipelineStepInputSchema).optional(),
-	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	jumpDeviceKey: zod.z.string().optional()
-}));
-var ModelSubstitutionSchema = zod.z.object({
-	addonId: zod.z.string(),
-	chosen: zod.z.string(),
-	running: zod.z.string(),
-	format: zod.z.string()
+var KeyEventSchema = zod.z.object({
+	/** The representative event id (the track's best ObjectEvent, else its trackId). */
+	id: zod.z.string(),
+	trackId: zod.z.string(),
+	/** Track start time (firstSeen). */
+	timestamp: zod.z.number(),
+	className: zod.z.string(),
+	...TieredLabelFields,
+	importance: zod.z.number(),
+	/** Highest-confidence ObjectEvent id for the track (empty when none). */
+	bestEventId: zod.z.string(),
+	/** Track lifetime in ms (lastSeen - firstSeen). */
+	windowMs: zod.z.number().optional(),
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
-var PipelineValidationIssueSchema = zod.z.object({
-	addonId: zod.z.string(),
-	kind: zod.z.enum(["unknown-addon", "no-format-build"]),
-	detail: zod.z.string()
+var TrackedDetectionSchema = zod.z.object({
+	trackId: zod.z.string(),
+	className: zod.z.string(),
+	confidence: zod.z.number(),
+	bbox: BoundingBoxSchema,
+	zones: zod.z.array(zod.z.string()).readonly(),
+	state: TrackStateSchema
 });
-var PipelineValidationResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	issues: zod.z.array(PipelineValidationIssueSchema).readonly(),
-	substitutions: zod.z.array(ModelSubstitutionSchema).readonly(),
-	/** The node's `currentEngine.format` this validation ran against. */
-	format: zod.z.string()
+var OverlayDetectionSchema = zod.z.looseObject({
+	id: zod.z.string(),
+	kind: zod.z.enum(["first-level", "detail"]),
+	macroClass: zod.z.string(),
+	score: zod.z.number(),
+	bbox: zod.z.object({
+		x: zod.z.number(),
+		y: zod.z.number(),
+		width: zod.z.number(),
+		height: zod.z.number()
+	}),
+	labels: zod.z.array(zod.z.looseObject({
+		label: zod.z.string(),
+		score: zod.z.number()
+	})).readonly(),
+	parentId: zod.z.string().optional()
 });
-var ReferenceImageEntrySchema = zod.z.object({
-	filename: zod.z.string(),
-	stepIds: zod.z.array(zod.z.string()).readonly().optional()
+var ScoredObjectEventSchema = ObjectEventSchema.extend({ score: zod.z.number() });
+var SearchObjectEventsInput = zod.z.object({
+	text: zod.z.string(),
+	deviceId: zod.z.number().optional(),
+	since: zod.z.number().optional(),
+	until: zod.z.number().optional(),
+	classFilter: zod.z.string().optional(),
+	limit: zod.z.number().default(50),
+	minScore: zod.z.number().min(0).max(1).default(.2)
 });
-var ReferenceImageBodySchema = zod.z.object({
-	base64: zod.z.string(),
-	filename: zod.z.string()
+var TrackCascadeCountsSchema = zod.z.object({
+	/** Persisted track roots deleted (authoritative). */
+	tracks: zod.z.number().int(),
+	/** Object events removed with their tracks (best-effort; see note above). */
+	events: zod.z.number().int(),
+	/** Track/face/plate-owned media removed (best-effort). Never identity media. */
+	media: zod.z.number().int(),
+	/** Unassigned (non-enrolled) face reads removed (best-effort). */
+	faces: zod.z.number().int(),
+	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
+	plates: zod.z.number().int(),
+	/** Per-track CLIP search vectors removed (best-effort). */
+	embeddings: zod.z.number().int(),
+	/** Group membership + group rows removed with their last member (best-effort). */
+	groups: zod.z.number().int()
 });
-var ReferenceAudioEntrySchema = zod.z.object({
-	filename: zod.z.string(),
-	sizeKb: zod.z.number()
+/** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
+var DiskReconcileCountsSchema = zod.z.object({
+	mediaDropped: zod.z.number().int(),
+	tracks: zod.z.number().int(),
+	events: zod.z.number().int()
 });
-var ReferenceAudioBodySchema = zod.z.object({ base64: zod.z.string() });
-var AudioBackendSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	description: zod.z.string(),
-	available: zod.z.boolean(),
-	/**
-	* Raw classifier labels this backend can emit (e.g. YAMNet's
-	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
-	* the benchmark UI to populate the `enabledMicroClasses` filter
-	* specific to the selected backend without a separate fetch.
-	*/
-	rawLabels: zod.z.array(zod.z.string()).readonly().optional()
+/** Event-store footprint for one camera. */
+var EventStoreDeviceFootprintSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	/** Persisted event rows (motion + object + audio) for the camera. */
+	rows: zod.z.number().int(),
+	/** Event-owned media bytes on disk for the camera. */
+	bytes: zod.z.number().int()
 });
-var AudioCapabilitiesSchema = zod.z.object({
-	activeBackend: zod.z.string(),
-	availableBackends: zod.z.array(AudioBackendSchema).readonly(),
-	sampleRate: zod.z.number(),
-	chunkDurationMs: zod.z.number()
+/** Aggregate event-store footprint: global totals + per-camera breakdown. */
+var EventStoreFootprintSchema = zod.z.object({
+	totalRows: zod.z.number().int(),
+	totalBytes: zod.z.number().int(),
+	devices: zod.z.array(EventStoreDeviceFootprintSchema).readonly()
 });
-var DownloadModelResultSchema = zod.z.object({
-	filePath: zod.z.string(),
-	sizeMB: zod.z.number(),
-	durationMs: zod.z.number()
+/** Per-kind counts returned by the event-prune / device-delete mutations. */
+var EventPruneCountsSchema = zod.z.object({
+	motion: zod.z.number().int(),
+	object: zod.z.number().int(),
+	audio: zod.z.number().int()
 });
 /**
-* Wrapper carrying a single test run's result. Replaces the legacy
-* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
-* canonical `AudioResult` from the Phase 6 output rework: one
-* `AudioDetection` per class above `minScore`, top-N candidates in
-* `debug.alternateLabels['audio-classifier']`, per-source timings in
-* `debug.stepTimings`. The outer `success`/`error` fields stay so the
-* benchmark UI can still report a clean failure when the classifier
-* cap isn't available.
+* Re-embed stored tracks from their key frames.
+*
+* The reason this is an operator-callable method and not a migration script:
+* every knob that decides what a vector MEANS — encoder model, crop margin,
+* squaring — is only changeable if the existing vectors can be regenerated.
+* Mixing feature spaces in one index makes cosine scores incomparable, and the
+* symptom is a quality regression with no visible cause.
 */
-var AudioTestResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	frame: zod.z.custom().optional()
+var RebuildObjectEmbeddingsInput = zod.z.object({
+	/** Restrict to one camera. Omit for the whole fleet. */
+	deviceId: zod.z.number().optional(),
+	since: zod.z.number().optional(),
+	until: zod.z.number().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: zod.z.number().int().positive().optional(),
+	/**
+	* Run every embedding on THIS node instead of round-robining the fleet.
+	*
+	* Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+	* field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+	* calling it that would pin the rebuild REQUEST itself to that node — the
+	* rebuild orchestration lives on the hub, and only the per-track step runs
+	* remotely. This field is data; the per-track pin is applied inside.
+	*
+	* Absent ⇒ round-robin over every online node whose runner can serve the
+	* pinned model.
+	*/
+	executeOnNodeId: zod.z.string().optional(),
+	/**
+	* Milliseconds to wait between tracks; omit for the built-in default, `0` to
+	* run flat out.
+	*
+	* A rebuild is bulk maintenance on hub-main's single thread. Measured
+	* 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+	* pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+	* force is logged at start and finish so a deliberately slow pass reads
+	* differently from a stalled one.
+	*/
+	pacingMs: zod.z.number().int().nonnegative().optional()
 });
-var PipelineConfigBridge = zod.z.custom();
-var ConfigUISchemaBridge = zod.z.custom();
-var ConfigUISchemaNullableBridge = zod.z.custom();
-var InferenceCapabilitiesBridge = zod.z.custom();
-var ModelAvailabilityListBridge = zod.z.custom();
-var PipelineRunResultBridge = zod.z.custom();
 /**
-* Pipeline executor — detection engine + configuration + inference API.
+* Result of emptying the CLIP index.
 *
-* Merged from: pipeline-executor, pipeline-config, inference, detection-config.
-* Implemented by the detection-pipeline addon.
+* The clean slate before a policy change: a new crop margin or encoder model
+* leaves two feature spaces in one index whose cosine scores are not
+* comparable, so wiping and rebuilding is the only way to be sure every vector
+* means the same thing.
+*/
+var WipeObjectEmbeddingsResultSchema = zod.z.object({ deleted: zod.z.number() });
+/**
+* Acknowledgement that a rebuild STARTED.
 *
-* Per-device surface (DeviceSettingsContribution + the "is detection
-* enabled for this camera?" toggle) lives on the paired
-* `detection-pipeline` cap (device-scoped, singleton, wrapper
-* defaultActive) — same split pattern used by stream-broker /
-* camera-streams and audio-analyzer / audio-analysis.
+* The pass costs ~1s per track — 45 minutes for a 2,600-track fleet — so it
+* runs detached and this returns immediately. Waiting for it made the client
+* time out while the work carried on server-side, which is the worst of both:
+* no result and no way to know it was still going. Poll
+* `getObjectEmbeddingRebuildStatus` for progress.
 */
-var pipelineExecutorCapability = {
-	name: "pipeline-executor",
-	scope: "system",
+var RebuildObjectEmbeddingsResultSchema = zod.z.object({
+	started: zod.z.boolean(),
+	/** True when a pass was already running; the new request is ignored. */
+	alreadyRunning: zod.z.boolean()
+});
+var RebuildStatusSchema = zod.z.object({
+	running: zod.z.boolean(),
+	scanned: zod.z.number(),
+	rebuilt: zod.z.number(),
+	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	missingKeyFrame: zod.z.number(),
+	/** Tracks with no usable detection box. */
+	missingBbox: zod.z.number(),
+	/**
+	* Tracks an executing node REFUSED rather than broke on — an unreadable key
+	* frame, a step that threw. Separate from `failed` because the remedy is
+	* different, and because a whole camera silently contributing zero vectors
+	* is the shape of failure a rebuild must never hide.
+	*/
+	notRunnable: zod.z.number(),
+	/**
+	* The pass stopped because NO node could serve the pinned model.
+	*
+	* Distinct from `notRunnable` on purpose: that one says "this track was
+	* refused", this one says "the cluster cannot do this work at all" — every
+	* candidate node either lacks the `clip-embedding` step, lacks a build of the
+	* pinned model for its engine format, or dropped out. The remedy is a model /
+	* engine change, not a per-camera one. Non-zero here always comes with
+	* `complete: false`.
+	*/
+	noCapableNode: zod.z.number(),
+	failed: zod.z.number(),
+	/** Set once a pass ends: true only when EVERYTHING was covered. */
+	complete: zod.z.boolean().nullable(),
+	startedAtMs: zod.z.number().nullable(),
+	finishedAtMs: zod.z.number().nullable(),
+	/** Present when the pass ended by throwing. */
+	error: zod.z.string().nullable()
+});
+var ReplayFrameInputSchema = zod.z.object({
+	timestamp: zod.z.number(),
+	frame: PipelineRunResultBridge
+});
+var ReplayTrackSchema = zod.z.object({
+	className: zod.z.string(),
+	firstSeenMs: zod.z.number(),
+	lastSeenMs: zod.z.number(),
+	/** Bbox of the track's FIRST matched detection, pixel-space in the clip's
+	*  frame — a representative box for the diff's `(className, window, IoU)`
+	*  pairing (`replay-diff.ts`). A replay does not need the full per-frame
+	*  trajectory production's `Track.positions` keeps. */
+	bbox: BoundingBoxSchema,
+	/** How many of the input frames this track matched a real detection on
+	*  (never a coasted/extrapolated frame) — the replay's own signal for "how
+	*  solid is this track", cheaper than re-deriving it from a trajectory. */
+	framesMatched: zod.z.number().int()
+});
+var RunReplayFrameProcessorResultSchema = zod.z.object({ tracks: zod.z.array(ReplayTrackSchema).readonly() });
+var pipelineAnalyticsCapability = {
+	name: "pipeline-analytics",
+	scope: "device",
 	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: [require_sleep.DeviceType.Camera],
+	exposesDeviceSettings: true,
 	methods: {
-		getAvailableEngines: require_sleep.method(zod.z.void(), zod.z.array(PipelineEngineChoiceSchema)),
-		getSelectedEngine: require_sleep.method(zod.z.void(), PipelineEngineChoiceSchema),
-		getDefaultSteps: require_sleep.method(PipelineEngineChoiceSchema, zod.z.array(PipelineDefaultStepSchema)),
+		getActiveTracks: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(TrackSchema).readonly()),
+		getTrack: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), TrackSchema.nullable()),
+		/** Historical completed tracks for a device. Queried from the
+		*  persisted `pipeline-analytics:tracks` collection; active tracks
+		*  still in RAM are not included. */
+		listTracks: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			since: zod.z.number().optional(),
+			until: zod.z.number().optional(),
+			limit: zod.z.number().optional(),
+			/** Spatial filter — only tracks whose trajectory intersects the zone
+			*  (normalized 0..1 rect or polygon). SQL-prefiltered on the persisted
+			*  envelope columns, then precisely tested per position. Tracks with
+			*  an unknown envelope (no frame dims at persist time) always match. */
+			zone: TrackZoneFilterSchema.optional(),
+			/** See {@link TrackProjectionSchema}. Default `full` (backward
+			*  compatible — omitting the field keeps today's exact behaviour). */
+			projection: TrackProjectionSchema.optional(),
+			/** Include stationary-promoted rows (parked objects handed to the
+			*  stationary registry). Default false: the timeline lists passages,
+			*  not parking records (operator decision, 2026-08-15). */
+			includeStationary: zod.z.boolean().optional()
+		}), zod.z.array(TrackSchema).readonly()),
+		/**
+		* Batched cluster-wide track listing — ONE call for the events page /
+		* reel first paint instead of a per-camera `listTracks` fan-out. Merges
+		* the persisted completed tracks of every requested device, sorted by
+		* `lastSeen` DESC with a stable (lastSeen, trackId) cursor. Per-device
+		* indexed pages (`idx_tracks_device_lastSeen`) are k-way merged
+		* provider-side; `projection: 'slim'` drops the heavy `positions[]` /
+		* `snapshots[]` JSON (returned as empty arrays). Active in-RAM tracks
+		* are not included (same contract as `listTracks`).
+		*/
+		listRecentTracks: require_sleep.method(RecentTracksQueryInput, RecentTracksPageSchema),
+		/**
+		* Batched co-moving group listing — the Groups feed. Same merge/cursor
+		* contract as {@link listRecentTracks}. A group is a sealed partition of
+		* one session; `getGroup` is the detail with members.
+		*/
+		listGroups: require_sleep.method(ListGroupsQueryInput, ListGroupsPageSchema),
+		getGroup: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			groupId: zod.z.string().min(1)
+		}), AnalyticsGroupDetailSchema.nullable()),
+		clearTracks: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getMotionEvents: require_sleep.method(DeviceEventQueryInput, zod.z.array(MotionEventSchema).readonly()),
+		getObjectEvents: require_sleep.method(ObjectEventQueryInput, zod.z.array(ObjectEventSchema).readonly()),
+		getAudioEvents: require_sleep.method(DeviceEventQueryInput, zod.z.array(AudioEventSchema).readonly()),
+		/**
+		* Every event kind the device can produce: built-ins (motion + audio),
+		* detection classes actually observed for the device (from the track
+		* history), and sensor kinds contributed by LINKED devices (resolved via
+		* `device-manager.getLinkedDevices`, mapped through `EVENT_KIND_BY_CAP`).
+		*/
+		listEventKinds: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(EventKindDescriptorSchema).readonly()),
+		/**
+		* The same answer for many cameras in ONE call.
+		*
+		* `listEventKinds` is the slowest per-device query on the hub — measured
+		* at ~100 ms against 6-11 ms for its neighbours — because composing it
+		* costs a `getCameraStatus`, a `getLinkedDevices` and one `getBindings`
+		* per linked device. The viewer asks for it once per camera at first
+		* paint, so twelve cameras paid twelve of those round-trips on top of the
+		* per-camera cost.
+		*
+		* Batched, the camera statuses come from ONE `getCameraStatuses` instead
+		* of N, and the per-device composition runs concurrently.
+		*
+		* Per-device rather than pre-merged on purpose: a caller that renders one
+		* camera's lanes needs to know WHICH camera a kind came from, and merging
+		* is three lines the caller can do. `listEventKinds` stays for
+		* single-device callers.
+		*/
+		listEventKindsBatch: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).min(1).max(200) }), zod.z.array(EventKindsForDeviceSchema).readonly()),
 		/**
-		* Per-node detection-engine provisioning snapshot. Returns the live
-		* state of the lazy runtime-provisioning machine on `nodeId`
-		* (idle / installing / verifying / ready / failed). The UI pairs this
-		* one-shot query with the `pipeline.engine-provisioning` live event
-		* (emitted on every transition) to drive a per-node "engine ready?"
-		* indicator without polling. Phase 2.
+		* Sensor-event history for a camera: state changes of LINKED sensor
+		* devices, attributed to the camera at ingest time (one row per linked
+		* camera). Mirrors `getAudioEvents` query semantics; `kinds` narrows to
+		* a kind subset.
 		*/
-		getEngineProvisioning: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), EngineProvisioningSchema),
-		getVideoPipelineSteps: require_sleep.method(zod.z.void(), zod.z.record(zod.z.string(), zod.z.object({
-			modelId: zod.z.string(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
-		}))),
-		setVideoPipelineSteps: require_sleep.method(zod.z.object({ steps: zod.z.record(zod.z.string(), zod.z.object({
-			modelId: zod.z.string(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
-		})) }), zod.z.object({ success: zod.z.literal(true) }), {
+		getSensorEvents: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			since: zod.z.number().optional(),
+			until: zod.z.number().optional(),
+			kinds: zod.z.array(zod.z.string()).optional(),
+			limit: zod.z.number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT)
+		}), zod.z.array(SensorEventSchema).readonly()),
+		/**
+		* Importance-ranked highlights for a device+window. Queries completed
+		* tracks by (deviceId, firstSeen ∈ [since,until]), scores each (or reuses
+		* the persisted score), filters by minImportance/classFilter, orders by
+		* importance desc, and returns up to `limit` compact key events mapped to
+		* each track's best event. Legacy tracks lacking a persisted score are
+		* scored on-read (no write). Degrades to `[]` on error.
+		*/
+		getKeyEvents: require_sleep.method(KeyEventQueryInput, zod.z.array(KeyEventSchema).readonly()),
+		/** Server-side bucketed event counts for the 24-hour timeline.
+		*  Returns one entry per non-empty bucket; empty buckets are omitted. */
+		getEventDensity: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			since: zod.z.number(),
+			until: zod.z.number(),
+			bucketMs: zod.z.number().int().positive()
+		}), zod.z.array(zod.z.object({
+			bucketStart: zod.z.number(),
+			motion: zod.z.number().int(),
+			object: zod.z.number().int(),
+			audio: zod.z.number().int()
+		})).readonly()),
+		/**
+		* @deprecated Prefer `pruneTracksBefore` — the track is the ROOT of the
+		* analytics model and retention must cascade from it (design §5.1). This
+		* event-only prune leaves orphaned tracks/faces/plates/embeddings behind.
+		* Retained as a compat shim for the Phase-B3 recorder orchestration caller,
+		* which prunes events to keep history aligned with available footage and
+		* reads the per-kind counts. Delete all events (motion + object + audio)
+		* for the given device older than `cutoffMs` (exclusive) + their thumbnails
+		* in lockstep; returns per-kind deleted counts.
+		*/
+		pruneEventsBefore: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			cutoffMs: zod.z.number()
+		}), zod.z.object({
+			motion: zod.z.number().int(),
+			object: zod.z.number().int(),
+			audio: zod.z.number().int()
+		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Clear THIS node's executor-side PER-DEVICE settings stores (the
-		* per-camera step overrides the object-detection root reads via
-		* `applyDeviceOverridesToTree`). `nodeId` is the ROUTING key — the
-		* generated cap-router strips it (default `nodeIdMode: 'routing'`) and
-		* dispatches to that node, so the provider method runs ON the target
-		* node and receives no `nodeId`.
+		* Track-centric retention entry point (design §5.1). Selects every
+		* persisted track for the device whose `lastSeen < cutoffMs` (paged) and
+		* runs the extensible whole-track deletion cascade (design §3): object
+		* events + their media, track/face/plate-owned media, unassigned face
+		* reads, per-track CLIP embeddings, then the track root LAST. ENROLLED
+		* (assigned) faces/plates and `ownerKind:'identity'` media are exempt —
+		* the durable matching gallery always persists. Fires the per-track
+		* live-state cleanup so a pruned track can't linger in dispatch/overlay
+		* state. Returns per-family deleted counts (`tracks` authoritative).
 		*
-		* This is the slimmed executor leg of the orchestrator's
-		* `resetNodePipelineDefaults` flow (which owns the real reset: node
-		* addonDefaults pins + per-camera orchestrator overrides). The legacy
-		* `resetToDefault` — which reset a persisted global step-tree seed
-		* nothing in the live per-camera path read — was removed together with
-		* that seed.
+		* Replaces `pruneEventsBefore` as the correct time-based retention prune.
 		*/
-		clearDeviceOverrides: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.object({
-			success: zod.z.literal(true),
-			clearedDevices: zod.z.number()
+		pruneTracksBefore: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			cutoffMs: zod.z.number()
+		}), TrackCascadeCountsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Operator "clean slate" for a device (design §5.3): prune EVERY track for
+		* the device via the same cascade as `pruneTracksBefore` with `cutoffMs =
+		* now`. One call per device — no client-side track enumeration. Enrolled
+		* gallery + identity media are exempt (design §4). Returns per-family
+		* deleted counts.
+		*/
+		wipeAllAnalytics: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), TrackCascadeCountsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Disk-wins reconcile for one camera. Drops media index rows whose blobs
+		* are gone, then cascades tracks (including favourited and staging) that
+		* have no remaining files. Enrolled identity/vehicle/scene media is never
+		* probed. Trackless motion/audio events with no remaining file are dropped,
+		* including snapshot-less rows.
+		*/
+		reconcileFromDisk: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), DiskReconcileCountsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete whole tracks (object events) by id for the given device,
+		* cascading their media in lockstep. Returns the number of tracks
+		* actually deleted plus the ids that could not be removed.
+		*
+		* Operator-driven from the DI Events page (batch delete). Routes through
+		* the same widened track-deletion cascade (design §5.2).
+		*/
+		deleteTracks: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackIds: zod.z.array(zod.z.string()).min(1)
+		}), zod.z.object({
+			deleted: zod.z.number().int(),
+			failed: zod.z.array(zod.z.string()).readonly()
 		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		getSchema: require_sleep.method(zod.z.void(), PipelineSchemaSchema),
-		getGlobalSteps: require_sleep.method(zod.z.void(), zod.z.array(PipelineDefaultStepSchema).readonly().nullable()),
-		getGlobalPipelineConfig: require_sleep.method(zod.z.void(), PipelineConfigBridge),
-		getOrchestratorConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaBridge),
 		/**
-		* Gate B (pre-init config-correctness gate). PURE COMPUTE against this
-		* node's `currentEngine.format` — resolves `steps` the same way the
-		* runtime dispatch path would, and reports what WOULD happen without
-		* touching any node-global state. Called by the orchestrator at attach
-		* time (`attachOn`), node-pinned to the TARGET node, so config problems
-		* surface BEFORE `pipelineRunner.attachCamera` rather than at the first
-		* per-frame resolve. `ok` is false iff `issues` is non-empty (both
-		* `unknown-addon` and `no-format-build` are HARD issues); `substitutions`
-		* is informational (a degraded-but-loadable model swap) and never
-		* affects `ok`. Never throws.
+		* Set the per-track operator flags (`markForTrain`, `debug`, `favourited`) on ONE track.
+		* The patch is PARTIAL — an omitted key is left untouched — because the
+		* three surfaces that write it (admin Events grid, viewer track detail,
+		* viewer cluster detail) each own one toggle and must not clobber the other.
+		*
+		* Writes the track ROW: `markForTrain`/`debug` are per-TRACK state, so they
+		* live where `label` and `importance` live, not in any per-device settings
+		* store. Updates the in-RAM active track too, so a flag set on a live track
+		* survives its expiry-time persist.
+		*
+		* `auth: 'protected'` (the default), NOT `admin`: the viewer is an
+		* authenticated non-admin surface and two of the three call sites are
+		* there. The note that used to sit here said to revisit this the day a flag
+		* gained an effect that costs storage, and D81 is that day — `markForTrain`
+		* now pins. It STAYS protected, and the reason is that the alternative
+		* makes the feature pointless: marking a track is something you do while
+		* looking at it, on the surface you were already looking at it on, and that
+		* surface is the viewer. What the storage cost gets instead is a BOUND — a
+		* per-device pin budget enforced in the body, refusing a new pin past the
+		* limit while always allowing un-marking. `deleteTracks` next door is still
+		* admin, because destroying evidence and preserving it are not symmetric.
+		*
+		* `markForTrain` writes the retrain LIFECYCLE, not a boolean column: `true`
+		* is `none → staging`, `false` is `staging → none`. A track already
+		* `trained` refuses BOTH — its frames are copies inside the retrain dataset
+		* and re-staging it from a generic toggle is how the same material gets
+		* annotated twice under two ground truths. Returning a trained track to
+		* staging is a deliberate action of the retrain page, which is also the only
+		* thing that produces `trained` in the first place.
+		*
+		* Returns the RESOLVED state of both flags (absent → `false`) plus the
+		* `retrainStatus` they were derived from, so a caller can drive its toggle
+		* — and render a `trained` badge — without a re-fetch. Rejects an unknown
+		* track, a new staging mark on a device already holding its full budget, and
+		* any `markForTrain` write against a trained track.
 		*/
-		validatePipeline: require_sleep.method(zod.z.object({ steps: zod.z.array(PipelineStepInputSchema) }), PipelineValidationResultSchema),
-		listTemplates: require_sleep.method(zod.z.void(), zod.z.array(PipelineTemplateSchema$1).readonly()),
-		saveTemplate: require_sleep.method(zod.z.object({
-			name: zod.z.string(),
-			steps: zod.z.array(PipelineTemplateStepSchema).readonly(),
-			engine: PipelineEngineChoiceSchema
-		}), PipelineTemplateSchema$1, { kind: "mutation" }),
-		updateTemplate: require_sleep.method(zod.z.object({
-			id: zod.z.string(),
-			name: zod.z.string().optional(),
-			steps: zod.z.array(PipelineTemplateStepSchema).readonly().optional()
-		}), PipelineTemplateSchema$1, { kind: "mutation" }),
-		deleteTemplate: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
-		getCapabilities: require_sleep.method(zod.z.void(), InferenceCapabilitiesBridge),
-		getAddonModels: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), ModelAvailabilityListBridge),
-		downloadModel: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			modelId: zod.z.string(),
-			format: ModelFormatSchema$1
-		}), DownloadModelResultSchema, { kind: "mutation" }),
-		deleteModel: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			modelId: zod.z.string(),
-			format: ModelFormatSchema$1
-		}), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }),
+		setTrackFlags: require_sleep.method(zod.z.object({
+			/** Log/audit scope only — the trackId is globally unique on its own. */
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			flags: TrackFlagsPatchSchema
+		}), TrackFlagsSchema, { kind: "mutation" }),
 		/**
-		* Stateless single-frame execution. Callers (runner, benchmark) pass
-		* the complete `engine` + `steps` tree; the executor holds no state
-		* about cameras or saved pipelines.
+		* Durable event-store footprint for the management UI: event rows
+		* (motion + object + audio) counted per camera + total, plus the
+		* event-owned media bytes on disk per camera + total. Stat/count-based,
+		* computed on demand.
+		*/
+		getEventStoreFootprint: require_sleep.method(zod.z.object({}), EventStoreFootprintSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Cluster-wide prune of events older than `olderThanMs` (exclusive) across
+		* every camera, deleting each event's media in lockstep. Logged to the
+		* events ops-log with `reason` (default `'retention'`). Returns the summed
+		* per-kind deleted counts.
+		*/
+		pruneEvents: require_sleep.method(zod.z.object({
+			olderThanMs: zod.z.number(),
+			reason: OpsLogReasonSchema.optional()
+		}), EventPruneCountsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Manually delete EVERY event (motion + object + audio) for one camera and
+		* its event-owned media in lockstep. Logged to the events ops-log as
+		* `op:'manual-delete', reason:'manual'`. Destructive — the admin UI guards
+		* it behind a confirm.
+		*/
+		deleteDeviceEvents: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), EventPruneCountsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The events ops-log rows (newest-first), optionally scoped to one camera.
+		*  Backed by a declared pipeline-analytics SQLite collection. */
+		/** Internal migration-participant lease. It drains active MediaStore
+		* writes and refuses new ones without changing analytics bindings. */
+		pauseForStorageMigration: require_sleep.method(StorageMigrationLeaseInputSchema, zod.z.object({ paused: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		resumeForStorageMigration: require_sleep.method(StorageMigrationLeaseInputSchema, zod.z.object({ resumed: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Drops cached location roots after the storage coordinator repoints a
+		* default so future event-media writes use the new root. */
+		refreshStorageLocationsForMigration: require_sleep.method(StorageMigrationLeaseInputSchema, zod.z.object({ refreshed: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		startStorageMigrationMove: require_sleep.method(StorageMigrationMediaMoveInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getStorageMigrationMoveStatus: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), RelocateJobSchema.nullable(), { auth: "admin" }),
+		cancelStorageMigrationMove: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Moves event media between locations — the OPERATOR's mover, without the
+		* coordinator's lease. Twin of `recording.relocateFootage`: the same
+		* engine the lease-gated coordinated migration uses
+		* (`startStorageMigrationMove`), armable in the background and WITHOUT
+		* pausing anything. Exists because `eventMedia` was the only storage
+		* class whose only move path went through the recorder's global pause.
+		*/
+		relocateMedia: require_sleep.method(RelocateMediaInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every relocate job this addon knows about, newest first (in RAM: the
+		*  move is resumable, so a lost list costs nothing but the display). */
+		listRelocateMediaJobs: require_sleep.method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Cancel a running or queued relocate job. */
+		cancelRelocateMedia: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		listOpsLog: require_sleep.method(OpsLogQueryInputSchema, zod.z.array(OpsLogEntrySchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* The CHEAP QUESTION, asked before any media moves: how big is the dataset
+		* the marked (`markForTrain`) tracks would produce?
 		*
-		* `engine` is optional during the migration window to preserve the
-		* legacy call shape used by existing benchmark code; once all
-		* callers pass it explicitly we make it required.
+		* Answered from media INDEX rows only — key, kind, size, timestamp — so it
+		* costs ~2 KB of reads per track and no blob reads at all. The measured harm
+		* behind D56 was a bulk pass that read and base64'd every blob a track owned
+		* before deciding anything, taking hub-main to 82 s busy out of 120; an
+		* export is that same I/O shape, so it inherits the same discipline: know
+		* the size, then decide.
 		*
-		* Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
-		* `referenceImage` must be provided:
-		*  - `frame`: runtime dispatch path (runner → decoded broker frame).
-		*    Carries the raw buffer, dimensions, and format; the executor
-		*    uses it directly without base64 round-tripping.
-		*  - `frameHandle` (CB5): a zero-pixel shm `FrameHandle` for the SAME
-		*    decoded frame. Both runner and executor are hub-local processes
-		*    sharing `/dev/shm`, so the executor maps the named segment and
-		*    reads the pixels back zero-copy — eliminating the ~1.2MB
-		*    re-serialisation over UDS/MsgPack the `frame` path pays per call.
-		*    High-risk: the FrameRing is a latest-wins seqlock with no
-		*    refcount, so a recycled slot yields a null read; the executor
-		*    then degrades to an empty result and the runner ships pixels via
-		*    `frame` as the fallback (queue-depth gated on the runner side).
-		*  - `imageBase64`: one-shot test path (benchmark ImageTab).
-		*  - `referenceImage`: named file from the reference-image store.
+		* `truncated` reports that more marked tracks exist than one pass carries.
+		* Empty `deviceIds` ⇒ every device that has marked tracks.
 		*/
-		runPipeline: require_sleep.method(zod.z.object({
-			engine: PipelineEngineChoiceSchema.optional(),
-			steps: zod.z.array(PipelineStepInputSchema).min(1),
-			frame: FrameInputSchema.optional(),
-			/**
-			* Process-local lazy frame. Valid only when caller and provider resolve
-			* in the same execution-group process; split/cross-node callers use
-			* `frame`/`image` inline compatibility instead.
-			*/
-			frameRef: FrameRefSchema.optional(),
-			/**
-			* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-			* the decoded pixels live in. One more member of the one-of
-			* frame/frameHandle/image/imageBase64/referenceImage group.
-			*/
-			frameHandle: require_sleep.FrameHandleSchema.optional(),
-			imageBase64: zod.z.string().optional(),
-			/**
-			* Binary JPEG bytes — preferred over `imageBase64` on internal
-			* hops (hub → forked worker via Moleculer MsgPack) because it
-			* skips the 33% base64 overhead + the per-call base64 decode on
-			* the detection-pipeline worker. Callers can pass either; exactly
-			* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-			*/
-			image: zod.z.instanceof(Uint8Array).optional(),
-			referenceImage: zod.z.string().optional(),
-			deviceId: zod.z.number().optional(),
-			sessionId: zod.z.string().optional(),
-			/**
-			* Execution plane. 'full' (default) runs the whole tree — benchmark,
-			* reference-image, and detail-subtree calls. 'frame' is the live
-			* per-frame dispatch: ONLY root-plane steps run; crop children
-			* (inputClasses ≠ null) are skipped and served per-track via
-			* pipelineRunner.runDetailSubtree (two-plane design).
-			*/
-			plane: zod.z.enum(["full", "frame"]).optional(),
-			/**
-			* Inference-device selector (Phase 2 multi-device). Format
-			* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-			* Omitted ⇒ the runner's default device (current single-engine
-			* behaviour). Selects WHICH device pool of the node runs the call.
-			*/
-			deviceKey: zod.z.string().optional(),
-			/**
-			* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-			* when the parent crop was resolved from the frame's retained NATIVE
-			* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-			* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-			* resolution from that surface — the SAME quality path faces already
-			* had — instead of the downscaled parent tile. `handle` keys the native
-			* surface (node-pinned to its owner); `cropFrameSpace` is the parent
-			* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-			* the executor's crop-normalized child ROI back into frame-normalized
-			* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-			* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-			* (today's behaviour on the fallback path).
-			*/
-			nativeCropRef: NativeCropRefSchema.optional()
-		}), PipelineRunResultBridge, { kind: "mutation" }),
+		getTrainingExportSummary: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), TrainingExportSummarySchema, {
+			kind: "query",
+			auth: "admin"
+		}),
 		/**
-		* Batched run — N raw frames packed into one cap call. The provider
-		* routes the batch through `SharedInferencePool.inferBatch`
-		* (`MSG_INFER_BATCH = 0x03`) so the IPC framing and JSON response
-		* envelope cost is amortised N:1 vs N concurrent `runPipeline`
-		* calls. Single root step + uniform model assumed; trees with crop
-		* children fall back to sequential execution.
+		* Where to download the dataset archive.
+		*
+		* The BYTES do not come back through this cap — they come from the returned
+		* data-plane URL, which streams a tar built entry by entry. A multi-gigabyte
+		* archive base64'd through a unary RPC envelope would be held whole in
+		* memory twice on a hub this repo has already OOM'd once (D9/D18 are the
+		* same lesson about frames). `getDownloadUrl` on `recordingExport` is the
+		* precedent, and this follows it deliberately.
+		*
+		* The archive contains a `manifest.json` FIRST, then the stored media
+		* VERBATIM under `tracks/<deviceId>/<trackId>/…`. No crop is derived and no
+		* model is run: a training set's pixels must be the pixels the pipeline saw.
+		*/
+		getTrainingExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* The staging worklist for one camera, or for every camera that has one.
+		*
+		* Fetched ON DEMAND, over the staging set only — the page never scans
+		* history, because making the working set small is the entire purpose of
+		* the mark. Each row carries how many frames the dataset already holds from
+		* the track and how many subjects were annotated on them, so
+		* `frameCount: 0` reads as "still to work" without a second call per track.
+		*
+		* `auth: 'admin'`, unlike the viewer-level mark itself: marking a track is
+		* curation you do while looking at it, but building the training set the
+		* fleet's models are fine-tuned on is not.
+		*/
+		listRetrainStaging: require_sleep.method(zod.z.object({
+			/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
+			*  `deviceId`, deliberately: `deviceId` would make this device-bound and
+			*  route it at one camera's owner, and "every camera" would stop being
+			*  expressible at all. */
+			deviceIds: zod.z.array(zod.z.number()).optional(),
+			limit: zod.z.number().int().min(1).max(500).optional()
+		}), zod.z.array(RetrainTrackSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* What a track can contribute, and what it already has.
+		*
+		* `candidates` are the track's whole, unannotated frames — index rows only,
+		* so this is cheap. `copies` are the frames already inside the dataset, and
+		* a candidate whose copy exists is marked `copied: true`: selecting it again
+		* is free and CANNOT fail, whatever became of the original.
+		*
+		* A crop, a thumbnail and `fullFrameBoxed` are never candidates. The last
+		* one matters most: it has the model's own rectangle burned into the pixels,
+		* and a detector trained on it learns to find a green line.
+		*/
+		listRetrainFrames: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), RetrainFrameListSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* COPY-ON-SELECT — the write that makes `trained` safe to evict.
+		*
+		* Selecting a frame copies its bytes into retrain storage immediately: not
+		* a reference, not a lease. Once the copy exists the dataset no longer
+		* depends on the track's media, which is exactly what lets D81 hand a
+		* `trained` track back to retention.
+		*
+		* The order inside is load-bearing and is pinned by a test: an EXISTING
+		* copy is returned without touching the source, so an original that
+		* evaporated blocks the selection of THAT ORIGINAL and never the copy
+		* already taken. Every refusal comes back named — a dropped selection is
+		* never silent, on the wire or in the log.
+		*/
+		selectRetrainFrames: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			mediaKeys: zod.z.array(zod.z.string()).min(1)
+		}), RetrainFrameSelectionSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Un-select a frame: its annotations go first, then the copy and its blob.
+		*  Deliberately destructive and deliberately explicit — it is the only way
+		*  a frame leaves the dataset before export. */
+		deselectRetrainFrame: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string()
+		}), zod.z.object({
+			removed: zod.z.boolean(),
+			removedAnnotations: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The pixels of ONE copied frame, base64.
+		*
+		* Through the cap rather than a data plane because it is genuinely one
+		* frame at a time, on demand, at human speed — the shape D9/D18 permit
+		* (what they forbid is frames crossing a boundary at frame RATE). The
+		* annotation canvas needs the image and its exact dimensions in the same
+		* answer: a canvas that places a normalised box against a size it guessed
+		* draws every box in the wrong place.
+		*/
+		getRetrainFrameImage: require_sleep.method(zod.z.object({ frameId: zod.z.string() }), zod.z.object({
+			base64: zod.z.string(),
+			width: zod.z.number().int(),
+			height: zod.z.number().int()
+		}), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Ask the pipeline what it sees, as a PROPOSAL.
+		*
+		* Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
+		* every box comes back as a draft with `source: 'assist'` plus the model and
+		* score that produced it. The operator confirms, edits, adds and deletes;
+		* nothing is stored until `saveRetrainAnnotations`.
 		*
-		* Used by `scripts/bench-batch-style.mts` for batch benchmarking —
-		* N frames in one call to amortise per-call IPC overhead.
+		* For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
+		* never the whole frame, where a package detector at that threshold proposes
+		* furniture. A package request with no zone is REFUSED rather than widened,
+		* because the silent widening would look like a bad model for as long as
+		* nobody checked which rectangle it ran on.
 		*/
-		runPipelineBatch: require_sleep.method(zod.z.object({
-			engine: PipelineEngineChoiceSchema.optional(),
-			steps: zod.z.array(PipelineStepInputSchema).min(1),
-			frames: zod.z.array(FrameInputSchema).min(1).max(255),
-			deviceId: zod.z.number().optional(),
-			sessionId: zod.z.string().optional(),
-			/**
-			* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-			* the batch to the Python pool's bench preprocess cache
-			* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-			* preprocessed ONCE and every later inference is a pure-inference cache
-			* hit — the sustained-throughput run measures inference, not
-			* decode+preprocess+infer. Omitted/0 for live frames (all different →
-			* full preprocess every call, correct). Fresh per sustained run;
-			* released via `uncacheFrame`.
-			*/
-			frameId: zod.z.number().int().nonnegative().optional(),
-			/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-			deviceKey: zod.z.string().optional()
-		}), zod.z.object({ results: zod.z.array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
+		proposeRetrainAnnotations: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			subject: RetrainAssistSubjectSchema,
+			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+			nodeId: zod.z.string().optional()
+		}), RetrainAssistResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
-		* Cache a raw frame inside the Python inference pool's memory.
-		* Returns a numeric `frameId` that `inferCached` references —
-		* subsequent calls send only 5 bytes through the pipe instead of
-		* 1.2MB raw data, eliminating the pipe transfer bottleneck.
+		* The FrameProcessor pass of a replay run — see the `Replay` section
+		* above this capability's definition for why this is not the
+		* `processFrame` method this file's header says pipeline-analytics does
+		* not have.
+		*
+		* Constructs a FRESH `FrameProcessor` for `(deviceId, source)`, feeds it
+		* `frames` IN THE ORDER GIVEN (the caller is responsible for time
+		* ordering — this method does not sort), and returns the tracks it
+		* produced. Zero persistence: no `TrackStore`, no event bus, no media
+		* capture. `zones` / `detectionRules` are the run's OWN zone set —
+		* typically the camera's real zones plus an ephemeral overlay
+		* (`addon-benchmark`'s `replay-plan.ts`), never read from or written to
+		* the `zones` capability by this method itself.
 		*/
-		cacheFrameInPool: require_sleep.method(zod.z.object({
-			data: zod.z.instanceof(Uint8Array),
-			width: zod.z.number().int().positive(),
-			height: zod.z.number().int().positive(),
-			format: zod.z.enum([
-				"rgb",
-				"bgr",
-				"gray"
-			])
-		}), zod.z.object({
-			frameId: zod.z.number(),
-			width: zod.z.number(),
-			height: zod.z.number()
-		}), { kind: "mutation" }),
+		runReplayFrameProcessor: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			source: DetectionSourceSchema,
+			zones: zod.z.array(ZoneSchema).readonly().optional(),
+			detectionRules: zod.z.array(ZoneRuleSchema).readonly().optional(),
+			zoneMembershipMinOverlap: zod.z.number().min(0).max(1).optional(),
+			frames: zod.z.array(ReplayFrameInputSchema).min(1)
+		}), RunReplayFrameProcessorResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every annotation on a track, oldest first. */
+		listRetrainAnnotations: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
 		/**
-		* Run inference on a previously cached frame. Sends only 5 bytes
-		* (model_idx + frameId) through the IPC pipe — eliminates the
-		* ~35ms per-call overhead of transferring 1.2MB raw data.
+		* Replace EVERY annotation on one frame with the supplied set.
+		*
+		* Whole-frame replacement, not per-box upsert: the unit of ground truth is
+		* the frame, and "the operator deleted a box" must be the same durable
+		* outcome as "the operator never drew it". A per-box patch would let a frame
+		* keep a box the operator removed on a surface that only knew about the
+		* boxes it sent.
+		*
+		* Refuses a macro class typed into `label` or `subLabel` — the tiers are
+		* separate and the guard is at the WRITE, because a mixed taxonomy cannot
+		* be un-mixed by reading it.
 		*/
-		inferCached: require_sleep.method(zod.z.object({
-			stepId: zod.z.string(),
-			frameId: zod.z.number().int()
-		}), zod.z.record(zod.z.string(), zod.z.unknown()), { kind: "mutation" }),
+		saveRetrainAnnotations: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			annotations: zod.z.array(RetrainAnnotationDraftSchema)
+		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
-		* Release a cached frame from the Python pool's memory.
+		* Finish with a track: `staging → trained`. **The only writer of that
+		* state** — D81 shipped the column with it deliberately unreachable.
+		*
+		* Refuses a track the dataset holds no copies from. `trained` un-pins the
+		* track's media, so completing without a copy is a delete order for material
+		* nothing ever extracted anything from; that refusal IS the safety argument
+		* of D81, expressed as a precondition.
 		*/
-		uncacheFrame: require_sleep.method(zod.z.object({ frameId: zod.z.number().int() }), zod.z.void(), { kind: "mutation" }),
-		/** Returns the effective pool tuning (resolved from user overrides + backend defaults). */
-		getEffectiveTuning: require_sleep.method(zod.z.void(), zod.z.object({
-			batchMode: zod.z.string(),
-			windowMs: zod.z.number(),
-			maxBatchSize: zod.z.number(),
-			concurrency: zod.z.number()
-		})),
+		completeRetrainTrack: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
-		* List every EngineFactory currently loaded in this executor's RAM,
-		* with the models resident and a coarse "in use" marker derived from
-		* ongoing inference activity. Used by the Pipeline page Engines tab.
+		* The deliberate return: `trained → staging`, for the rare case.
+		*
+		* The generic `setTrackFlags` toggle refuses this in both directions by
+		* design (D81) — re-staging from a checkbox is how the same material gets
+		* annotated twice under two ground truths. Doing it here means the operator
+		* is looking at the annotations that already exist while they decide, and
+		* those annotations are LEFT ALONE: "put this back" must not be a
+		* destructive act wearing a navigational name.
 		*/
-		listLoadedEngines: require_sleep.method(zod.z.void(), zod.z.array(zod.z.object({
-			engineKey: zod.z.string(),
-			engine: PipelineEngineChoiceSchema,
-			modelsLoaded: zod.z.array(zod.z.string()).readonly(),
-			inUseByCameras: zod.z.array(zod.z.number()).readonly(),
-			/**
-			* Origin of this resident factory.
-			*  - `runtime`       — main camera-serving engine (no idle TTL).
-			*  - `warm-override` — benchmark/test override held in the warm
-			*                      cache; auto-disposed after the idle TTL.
-			*  - `device-pool`   — a concurrent per-device pool (Phase 2
-			*                      multi-device, keyed by `deviceKey`) resolved
-			*                      via `resolveDeviceFactory`. Runs alongside the
-			*                      `runtime` engine on a DIFFERENT accelerator
-			*                      (NPU / iGPU / Coral) — this is how the
-			*                      Engines tab shows all pools running at once.
-			*/
-			kind: zod.z.enum([
-				"runtime",
-				"warm-override",
-				"device-pool"
-			]),
-			/** Native pid of the underlying Python pool (null when no pool). */
-			poolPid: zod.z.number().nullable(),
-			/** ms since this factory was last used (null when not warm-tracked). */
-			idleMs: zod.z.number().nullable(),
-			/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-			idleTtlMs: zod.z.number().nullable()
-		})).readonly()),
-		/** Warm up an engine without running a frame. No-op if already loaded. */
-		spinEngine: require_sleep.method(zod.z.object({ engine: PipelineEngineChoiceSchema }), zod.z.object({ success: zod.z.literal(true) }), {
+		restageRetrainTrack: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Unload an engine from RAM. `force:true` unloads even when cameras
-		* are actively using it (they re-spin on next frame). Default is
-		* gated — returns `{success:false, reason}` when in use.
+		* Where to download the ANNOTATED dataset.
+		*
+		* The sibling of `getTrainingExportUrl` and deliberately not the same
+		* archive: that one streams a marked track's stored media verbatim, this one
+		* streams the retrain COPIES plus an `annotations.json` carrying, for every
+		* subject, the canonical full-frame box AND the geometry derived for each
+		* model shape (letterboxed root / zone-cropped package / subject-cropped
+		* classifier). Derived at export, never stored — one box in, three shapes
+		* out, so two crops of the same subject can never end up in one feature
+		* space (D52).
 		*/
-		killEngine: require_sleep.method(zod.z.object({
-			engine: PipelineEngineChoiceSchema,
-			force: zod.z.boolean().optional()
-		}), zod.z.object({
-			success: zod.z.boolean(),
-			reason: zod.z.string().optional()
-		}), {
+		getRetrainExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
+		getEventMedia: require_sleep.method(zod.z.object({
+			eventId: zod.z.string(),
+			kind: MediaFileKindEnum.optional(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileSchema).readonly()),
+		/** All media rows owned by a track. `kinds` narrows to a kind subset so a
+		*  client can fetch the SMALL display variants on open and pull the
+		*  multi-MB native variants only on demand (mirrors `getEventMedia.kind`).
+		*  Absent ⇒ every kind (back-compat). */
+		getTrackMedia: require_sleep.method(zod.z.object({
+			trackId: zod.z.string(),
+			kinds: zod.z.array(MediaFileKindEnum).optional(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileSchema).readonly()),
+		/**
+		* What media a track HAS, without any of it.
+		*
+		* The detail view needs the shape of a track's media to build its strip —
+		* which kinds exist, in what order, at what size — and then wants each tile
+		* fetched as an image, not as base64 inside this response. Measured: the
+		* full `getTrackMedia` is 5.3-7.7 MB and blocks the view; this manifest is
+		* ~2 KB.
+		*
+		* It also restores a fact a `kinds` filter destroys: filtering
+		* `getTrackMedia` drops whole ROWS, taking `kind` and `sizeBytes` with
+		* them, so a client that fetched only the small variants could no longer
+		* tell a full-resolution variant existed — and the affordance that opens it
+		* would silently disappear.
+		*/
+		listTrackMedia: require_sleep.method(zod.z.object({
+			trackId: zod.z.string(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileInfoSchema).readonly()),
+		/**
+		* Search object events by text query using CLIP cosine similarity.
+		* Encodes `text` via the `embedding-encoder` cap, queries the
+		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
+		* embeddings by cosine similarity, and joins winners to their
+		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
+		* `minScore`, sorted descending by score.
+		*/
+		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly()),
+		wipeObjectEmbeddings: require_sleep.method(zod.z.object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listReferenceImages: require_sleep.method(zod.z.void(), zod.z.array(ReferenceImageEntrySchema).readonly()),
-		getReferenceImage: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceImageBodySchema.nullable()),
-		getReferenceAudioFiles: require_sleep.method(zod.z.void(), zod.z.array(ReferenceAudioEntrySchema).readonly()),
-		getReferenceAudio: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceAudioBodySchema.nullable()),
-		getAudioCapabilities: require_sleep.method(zod.z.void(), AudioCapabilitiesSchema),
-		runAudioTest: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			modelId: zod.z.string(),
-			filename: zod.z.string().optional(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-		}), AudioTestResultSchema, { kind: "mutation" }),
-		getDetectionConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaNullableBridge)
+		rebuildObjectEmbeddings: require_sleep.method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getObjectEmbeddingRebuildStatus: require_sleep.method(zod.z.object({}), RebuildStatusSchema)
+	},
+	events: {
+		/**
+		* Enriched frame emitted after refinement — the live-overlay source of
+		* truth (two-plane re-injection). Carries the frame's detections in the
+		* `ObjectDetection` wire shape: first-level roots (with track info +
+		* enrichment labels) plus synthesized `kind:'detail'` face/plate entries
+		* re-projected from per-track detail state, so stream overlays render
+		* boxes + recognized names without querying full Track state.
+		*/
+		onFrameTracked: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			timestamp: zod.z.number(),
+			frameWidth: zod.z.number(),
+			frameHeight: zod.z.number(),
+			detections: zod.z.array(OverlayDetectionSchema).readonly()
+		}) },
+		/** Track entered active state (first-seen). */
+		onTrackStarted: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			className: zod.z.string()
+		}) },
+		/** Track expired (TTL reached after last detection). */
+		onTrackEnded: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			className: zod.z.string(),
+			durationMs: zod.z.number()
+		}) },
+		/** Canonical "something happened at device X" event, per-kind. */
+		onDetectionEvent: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			kind: EventKindSchema,
+			eventId: zod.z.string(),
+			timestamp: zod.z.number()
+		}) }
 	}
 };
 //#endregion
@@ -17131,108 +17471,6 @@ var CameraMetricsSchema = zod.z.object({
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: zod.z.number() });
 //#endregion
-//#region src/capabilities/zones.cap.ts
-/**
-* Zone — pure geometry + identity. NO filtering behaviour.
-*
-* Zones describe **where** in the frame the operator wants to flag
-* something; consumer-owned {@link ZoneRule} arrays describe **how**
-* each pipeline stage uses them. Splitting the two means a single
-* polygon "Driveway" can simultaneously back a motion-exclude rule,
-* a detection-include rule on `['car']`, and an occupancy aggregate
-* — without three duplicated polygons.
-*
-* Owned by the orchestrator addon (provider) and mirrored into the
-* `zones` device-state slice on every mutation. Consumers
-* (motion-wasm, pipeline-executor, analytics, admin UI) read either
-* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
-* mirror with `onChanged`).
-*
-* Coordinates are normalised fractions of the frame (0–1) so zones
-* survive resolution changes and stream profile switches.
-*
-* `kind` discriminates between full polygons (closed regions used
-* for intrusion / occupancy filters) and tripwires (open 2-point
-* line segments used for cross events). Onboard / firmware-reported
-* zones (Reolink, ONVIF) are out of scope for now — see the deferred
-* task list.
-*/
-var ZoneKindEnum = zod.z.enum(["polygon", "tripwire"]);
-/** Polygon vertex in fraction-of-frame coordinates (0–1). */
-var PolygonPointSchema = zod.z.object({
-	x: zod.z.number(),
-	y: zod.z.number()
-});
-/** A camera detection zone — pure geometry/identity. */
-var ZoneSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: zod.z.array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: zod.z.string().default("#3b82f6")
-});
-/**
-* Zones capability — per-camera CRUD over polygon detection zones.
-*
-* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
-* to per-device settings and mirrors into the `zones` device-state
-* slice on every mutation, so downstream consumers can subscribe via
-* `dev.state.zones.onChanged`.
-*
-* The cap surface only handles geometry + identity; filtering
-* behaviour (per-class, include/exclude, threshold) lives in the
-* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
-* `capabilities/schemas/zone-rule.js`.
-*/
-var zonesCapability = {
-	name: "zones",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [require_sleep.DeviceType.Camera],
-	methods: {
-		listZones: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(ZoneSchema).readonly()),
-		addZone: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			zone: ZoneSchema
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		removeZone: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			zoneId: zod.z.string()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		updateZone: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			zone: ZoneSchema
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	/**
-	* Runtime-state slice — the live zone catalogue mirrored by the
-	* orchestrator on every CRUD mutation. Consumers read via
-	* `device.state.zones.value` / `.watch(...)` without round-tripping
-	* the cap, and the codegen DeviceProxy auto-wires the reactive
-	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
-	* (e.g. zone groupings) can sit alongside the polygon list.
-	*/
-	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
-	/**
-	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-//#endregion
 //#region src/capabilities/pipeline-runner.cap.ts
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -29164,98 +29402,6 @@ var sceneMonitorCapability = {
 	durability: "session"
 };
 //#endregion
-//#region src/capabilities/schemas/zone-rule.ts
-/**
-* Per-stage gating mode applied to the zones a rule references.
-*
-* - `include`: the rule contributes to a **whitelist** for its stage.
-*   When at least one `include` rule fires for a stage, only entities
-*   inside one of those zones pass that stage.
-* - `exclude`: the rule contributes to a **blacklist** for its stage.
-*   Entities inside one of those zones are dropped at that stage.
-*
-* `monitor`-style observation (count without filtering) is not a rule
-* mode — zones without any matching rule are observed naturally by
-* `zone-analytics` (live snapshot + history), so an "I just want to
-* count, not filter" use case needs no rule at all.
-*/
-var ZoneRuleModeEnum = zod.z.enum(["include", "exclude"]);
-/**
-* Per-consumer rule that references existing zones (geometry) and
-* defines how a specific pipeline stage should treat them. Each
-* consumer addon owns its own `ZoneRule[]` array in its per-device
-* settings:
-*
-* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
-* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
-* - future: notification rules, audio gating, etc.
-*
-* One rule applies to N zones (`zoneIds[]`) so the operator can
-* express "ignore motion in ALL of {garden, street}" with a single
-* rule. `classFilter` narrows the rule to specific object classes —
-* "drop person detections in the street, but keep cars" is one
-* `exclude` rule with `classFilter: ['person']`.
-*
-* `enabled` is a soft toggle — the operator can keep the rule
-* configured but inert without deleting it.
-*/
-var ZoneRuleSchema = zod.z.object({
-	/** Stable rule id — survives edits, used by the UI for diffing. */
-	id: zod.z.string(),
-	/** Optional human-readable label rendered in the rule editor. */
-	name: zod.z.string().optional(),
-	/** Zones this rule targets. The rule's `mode` applies to ALL
-	*  listed zones (OR-set: a detection in any one of them counts).
-	*  At least one zone id required — a rule with no targets is a
-	*  configuration mistake and the form validator rejects it. */
-	zoneIds: zod.z.array(zod.z.string()).min(1).readonly(),
-	mode: ZoneRuleModeEnum,
-	/**
-	* Class names this rule applies to. Empty / undefined ⇒ rule
-	* applies to every class. Class strings match the `macroClass`
-	* field on detections (e.g. `person`, `car`, `dog`).
-	*/
-	classFilter: zod.z.array(zod.z.string()).readonly().optional(),
-	/**
-	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
-	* required to consider an entity "in the zone". Defaults to the
-	* consumer's stage default when omitted. Kept for back-compat with
-	* existing per-rule overrides; new operators pick the value via
-	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-	* set, the lower-level engine reads it as a 0–1 fraction.
-	*/
-	overlapThreshold: zod.z.number().min(0).max(1).optional(),
-	/**
-	* Operator-friendly version of `overlapThreshold` — the percentage
-	* of the detection's bbox that must lie inside the zone for the
-	* rule to match. Documented default is 85%; the engine substitutes
-	* that when the field is omitted (kept optional so existing rules
-	* stored without it stay valid).
-	*
-	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-	* rule, the engine prefers `bboxInclusionPct` because it's the
-	* field exposed in the UI. Internally both feed the same gate.
-	*/
-	bboxInclusionPct: zod.z.number().min(0).max(100).optional(),
-	/**
-	* When `true` and a detection has a segmentation mask, use the
-	* mask for overlap instead of the bbox. Detection-stage only;
-	* motion rules ignore this field.
-	*/
-	preferMask: zod.z.boolean().optional(),
-	/**
-	* Soft-toggle: `false` disables the rule without deleting it.
-	* Defaults to `true` so operators creating a rule via the UI
-	* see it active immediately.
-	*/
-	enabled: zod.z.boolean().default(true)
-});
-/**
-* Convenience array schema — used by addon device-settings
-* contributions and runtime payloads (e.g. `RunnerCameraConfig`).
-*/
-var ZoneRulesArraySchema = zod.z.array(ZoneRuleSchema).readonly();
-//#endregion
 //#region src/capabilities/script-runner.cap.ts
 /**
 * Script-runner cap. Models HA `script.*` entities on
@@ -38127,6 +38273,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -38301,6 +38453,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -38379,6 +38537,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -38391,6 +38555,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.runReplayFrameProcessor": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -38523,6 +38693,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineExecutor.getInferenceDeviceHealth": {
+		capName: "pipeline-executor",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineExecutor.getOrchestratorConfigSchema": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -38595,6 +38771,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineExecutor.rearmInferenceDevice": {
+		capName: "pipeline-executor",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.runAudioTest": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -42100,6 +42282,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.runReplayFrameProcessor": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.saveRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -43723,6 +43910,8 @@ function createSystemProxy(api) {
 			getVideoPipelineSteps: (input) => dispatch("pipelineExecutor", "getVideoPipelineSteps", "query", input),
 			setVideoPipelineSteps: (input) => dispatch("pipelineExecutor", "setVideoPipelineSteps", "mutation", input),
 			clearDeviceOverrides: (input) => dispatch("pipelineExecutor", "clearDeviceOverrides", "mutation", input),
+			getInferenceDeviceHealth: (input) => dispatch("pipelineExecutor", "getInferenceDeviceHealth", "query", input),
+			rearmInferenceDevice: (input) => dispatch("pipelineExecutor", "rearmInferenceDevice", "mutation", input),
 			getSchema: (input) => dispatch("pipelineExecutor", "getSchema", "query", input),
 			getGlobalSteps: (input) => dispatch("pipelineExecutor", "getGlobalSteps", "query", input),
 			getGlobalPipelineConfig: (input) => dispatch("pipelineExecutor", "getGlobalPipelineConfig", "query", input),
@@ -48034,7 +48223,6 @@ exports.CapScopeSchema = CapScopeSchema;
 exports.CapabilityBindingsSchema = CapabilityBindingsSchema;
 exports.CarbonMonoxideStatusSchema = CarbonMonoxideStatusSchema;
 exports.ChargingStatus = require_sleep.ChargingStatus;
-exports.ClassMapDefinitionSchema = ClassMapDefinitionSchema;
 exports.ClientNetworkStatsSchema = ClientNetworkStatsSchema;
 exports.ClimateControlStatusSchema = ClimateControlStatusSchema;
 exports.ClipPlaybackSchema = ClipPlaybackSchema;
@@ -48120,6 +48308,7 @@ exports.DecoderSessionConfigSchema = DecoderSessionConfigSchema;
 exports.DecoderStatsSchema = DecoderStatsSchema;
 exports.DeleteIntegrationResultSchema = DeleteIntegrationResultSchema;
 exports.DetailCropConventionSchema = DetailCropConventionSchema;
+exports.DetectionCatalogClassMapSchema = DetectionCatalogClassMapSchema;
 exports.DetectionSourceSchema = DetectionSourceSchema;
 exports.DeviceCodeSeveritySchema = DeviceCodeSeveritySchema;
 exports.DeviceConfig = DeviceConfig;