@camstack/types 1.2.112 → 1.2.114

package/dist/index.js

@@ -1436,6 +1436,76 @@ var OPS_LOG_RING_DEFAULT_MAX = 500;
 /** Default page size for a `listOpsLog` query when the caller omits `limit`. */
 var OPS_LOG_DEFAULT_LIMIT = 200;
 //#endregion
+//#region src/types/labels.ts
+var LabelDefinitionSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	category: zod.z.string().optional(),
+	description: zod.z.string().optional(),
+	icon: zod.z.string().optional()
+});
+/** Detection-macro targets a catalog `classMap` may resolve to. */
+var CLASS_MAP_MACRO_TARGETS = [
+	"person",
+	"vehicle",
+	"animal",
+	"package"
+];
+/**
+* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
+* un operatore può selezionare.
+*
+* Sono le tre offerte dallo step `object-detection`
+* (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
+* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
+* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
+* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
+* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
+* (suitcase/backpack/handbag) lasciando spento il detector dedicato.
+*
+* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
+* dello step e una seconda volta come union `FirstLevelMacro`
+* (`types/detection.ts`); una terza copia per il trigger di registrazione
+* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
+* successiva.
+*/
+var FIRST_LEVEL_MACRO_CLASSES = [
+	"person",
+	"vehicle",
+	"animal"
+];
+/**
+* True quando `value` è una macro di primo livello. Type guard, non cast: un
+* `className` che arriva dal bus è una stringa qualunque finché non passa di
+* qui.
+*/
+function isFirstLevelMacroClass(value) {
+	return FIRST_LEVEL_MACRO_CLASSES.some((macro) => macro === value);
+}
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = zod.z.object({
+	mapping: zod.z.record(zod.z.string(), zod.z.enum(CLASS_MAP_MACRO_TARGETS)),
+	preserveOriginal: zod.z.boolean()
+});
+//#endregion
 //#region src/interfaces/recording-config.ts
 /**
 * THE canonical event-clip pad: the time window a single-timestamp analytics
@@ -1478,10 +1548,64 @@ var RecordingStorageModeSchema = zod.z.enum([
 	"events",
 	"continuous"
 ]);
+/**
+* Le macro classi che possono aprire una finestra di registrazione — le stesse
+* tre offerte dallo step `object-detection`, da UNA lista
+* ({@link FIRST_LEVEL_MACRO_CLASSES}).
+*/
+var RecordingObjectTriggerClassSchema = zod.z.enum(FIRST_LEVEL_MACRO_CLASSES);
+/**
+* True quando `values` non ripete un elemento.
+*
+* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
+* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
+* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+*/
+var noDuplicates = (values) => new Set(values).size === values.length;
+/**
+* Quanti device sorgente una singola banda può ascoltare.
+*
+* Non è un gusto: ogni sorgente è una CHIAVE nel `TriggerState` del recorder, e
+* il limite per chiave (`MAX_TRIGGER_WINDOWS = 32`) senza un limite sulle
+* chiavi lascerebbe crescere la mappa con l'inventario dell'operatore. 16
+* sensori su UNA camera è già oltre qualunque installazione osservata.
+*/
+var MAX_SENSOR_TRIGGER_DEVICES = 16;
 /** Which detectors trigger an `events`-mode band. */
 var RecordingTriggersSchema = zod.z.object({
 	motion: zod.z.boolean().optional(),
-	audioThresholdDbfs: zod.z.number().optional()
+	audioThresholdDbfs: zod.z.number().optional(),
+	/**
+	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
+	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
+	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
+	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+	*
+	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
+	* quelle che hanno attraversato `enabledMacroClasses`, i
+	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
+	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
+	* finestre — vedi `recorder/object-trigger.ts`.
+	*/
+	objectClasses: zod.z.array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
+	/**
+	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
+	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+	* `objectClasses`.
+	*
+	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
+	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
+	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
+	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+	* device (D12) — mai un elenco globale di cap.
+	*
+	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
+	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
+	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
+	* il livello: un contatto trovato già aperto al riavvio del runner non fa
+	* registrare.
+	*/
+	sensorDeviceIds: zod.z.array(zod.z.number().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
 /**
 * Mode of a single recording band — the recorder per-band vocabulary.
@@ -2271,45 +2395,6 @@ function pickClosestResolution(entries, target) {
 	return bestAbove?.entry ?? bestBelow?.entry;
 }
 //#endregion
-//#region src/types/labels.ts
-var LabelDefinitionSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	category: zod.z.string().optional(),
-	description: zod.z.string().optional(),
-	icon: zod.z.string().optional()
-});
-/** Detection-macro targets a catalog `classMap` may resolve to. */
-var CLASS_MAP_MACRO_TARGETS = [
-	"person",
-	"vehicle",
-	"animal",
-	"package"
-];
-/**
-* Wire schema for a per-model CATALOG classMap override
-* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
-* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
-* detection pipeline executor actually routes.
-*
-* This is deliberately a DIFFERENT, narrower shape than the general-purpose
-* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
-* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
-* enum) — the two used to share the name `ClassMapDefinition`/
-* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
-* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
-* are not: it is two different concepts colliding on a name. Keep this type
-* under its own name rather than reusing `ClassMapDefinition` — reusing it
-* would either narrow every `ClassMapDefinition` consumer to the four
-* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
-* schema exists for (see the "rejects a classMap whose target is not a
-* detection macro" test in `model-catalog-schema.test.ts`).
-*/
-var DetectionCatalogClassMapSchema = zod.z.object({
-	mapping: zod.z.record(zod.z.string(), zod.z.enum(CLASS_MAP_MACRO_TARGETS)),
-	preserveOriginal: zod.z.boolean()
-});
-//#endregion
 //#region src/types/model-variant-groups.ts
 var FORMAT_KEYS = [
 	"onnx",
@@ -21651,7 +21736,7 @@ var lifecycleJobSchema = zod.z.object({
 * `useAddonsOnAddonLogs`, etc. flow through the same codegen pipeline
 * as every other cap.
 */
-var LogLevelSchema$1 = zod.z.enum([
+var LogLevelSchema$2 = zod.z.enum([
 	"debug",
 	"info",
 	"warn",
@@ -21878,7 +21963,7 @@ var addonsCapability = {
 		getLogs: require_sleep.method(zod.z.object({
 			addonId: zod.z.string(),
 			limit: zod.z.number().min(1).max(500).default(100),
-			level: LogLevelSchema$1.optional()
+			level: LogLevelSchema$2.optional()
 		}), zod.z.array(LogQueryEntrySchema)),
 		listPackages: require_sleep.method(zod.z.void(), zod.z.array(InstalledPackageSchema).readonly()),
 		installPackage: require_sleep.method(zod.z.object({
@@ -22116,7 +22201,7 @@ var addonsCapability = {
 		}),
 		onAddonLogs: require_sleep.method(zod.z.object({
 			addonId: zod.z.string(),
-			level: LogLevelSchema$1.optional()
+			level: LogLevelSchema$2.optional()
 		}), LogStreamEntrySchema, { kind: "subscription" })
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -24062,6 +24147,35 @@ var FaceFilterEnum = zod.z.enum([
 	"identified",
 	"all"
 ]);
+/**
+* What a `listRecentFaces` page is ORDERED BY.
+*
+*  - `timestamp` — when the face was seen. The historical (and default) order.
+*  - `suggestionConfidence` — {@link FaceInfo.suggestedMatchScore}, the peak
+*    cosine of the face's SUGGESTED identity. This is the "review by certainty"
+*    order: it puts the suggestions an operator can confirm with one tap at the
+*    top, and it is the reason this enum exists — a client that ranked a capped
+*    page client-side was ranking the newest N, never the most certain N.
+*
+* A row with NO suggestion (`suggestedMatchScore` absent — a legacy row, an
+* auto-assigned face, or a face below the suggestion band) has no certainty to
+* compare. Under `suggestionConfidence` it sorts **LAST, in BOTH directions**
+* — flipping the direction reorders the rows that HAVE a certainty and never
+* floods the page with the ones that do not. `addon-post-analysis`'s
+* `store/face-sort.ts` is the single implementation, tiebreaks newest-first
+* then by faceId, and is what makes this a total order instead of the
+* backend's NULL-collation accident.
+*/
+var FaceSortFieldEnum = zod.z.enum(["timestamp", "suggestionConfidence"]);
+var FaceSortDirectionEnum = zod.z.enum(["asc", "desc"]);
+/** One suggested group of look-alike UNASSIGNED faces. Ids only — an embedding
+*  never leaves the server. */
+var FaceClusterSchema = zod.z.object({
+	faceIds: zod.z.array(zod.z.string()).readonly(),
+	representativeFaceId: zod.z.string(),
+	size: zod.z.number().int(),
+	cohesion: zod.z.number()
+});
 var MediaFileLiteSchema$1 = zod.z.object({
 	key: zod.z.string(),
 	kind: zod.z.string(),
@@ -24119,24 +24233,72 @@ includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(IdentitySche
 			auth: "admin"
 		}),
 		listRecentFaces: require_sleep.method(zod.z.object({
-			/** Restrict to one camera. Absent keeps the cluster-wide gallery view. */
+			/**
+			* Restrict to ONE camera. Absent keeps the cluster-wide gallery view.
+			*
+			* The legacy single-camera form, kept verbatim for every caller that
+			* already sends it. A caller that wants a SET sends {@link deviceIds}
+			* instead — never both: `deviceIds` is the authority whenever it is
+			* present, and this field is then ignored rather than unioned, so
+			* there is exactly one answer to "which cameras did I ask for".
+			*/
 			deviceId: zod.z.number().int().optional(),
+			/**
+			* Restrict to a SET of cameras — the review UI's camera filter, which
+			* until now had to fetch the cluster-wide page and drop rows in the
+			* client (so the `limit` it asked for was spent on cameras it was
+			* about to discard).
+			*
+			* An **empty array reads NOTHING** — `[]` is an empty page, never
+			* "every camera". A request for no devices is a request, not an
+			* omission; same contract as `deviceManager.listFleet` and
+			* `pipelineAnalytics.listRecentTracks`.
+			*
+			* Absent (`undefined`) is the omission, and keeps the cluster-wide view.
+			*/
+			deviceIds: zod.z.array(zod.z.number().int()).optional(),
 			limit: zod.z.number().int().positive().optional(),
 			filter: FaceFilterEnum.optional(),
 			/**
-			* Inline the base64 crop on every row. Default `true` — the existing
-			* behaviour, kept so no caller breaks.
+			* Window lower bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+			* Absent means no lower bound.
+			*/
+			since: zod.z.number().int().optional(),
+			/**
+			* Window upper bound on {@link FaceInfo.timestamp}, INCLUSIVE.
+			* Absent means no upper bound.
+			*/
+			until: zod.z.number().int().optional(),
+			/**
+			* Order the page by time or by suggestion certainty. Default
+			* `'timestamp'` — the historical order, unchanged for every caller
+			* that does not ask.
 			*
-			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
-			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
-			* the browser cache the images.
+			* See {@link FaceSortFieldEnum} for what a row with no suggestion
+			* does under `'suggestionConfidence'`.
 			*
-			* **This is an INPUT field, so it does not reach the addon until the
-			* next train.** The hub router validates cap inputs against its own
-			* compiled Zod, which strips a key it does not know — verified today
-			* on the OUTPUT side, where an additive field DOES arrive immediately
-			* (`Track.hasFace`). Until the train ships, sending `false` is
-			* harmless and simply keeps the crops inline.
+			* Cost note: `'timestamp'` is served by the `(deviceId, timestamp)`
+			* index and stops reading as soon as `limit` rows have PASSED the
+			* filter. `'suggestionConfidence'` cannot stop early — the most
+			* certain row may be the oldest — so it walks the window. Narrow it
+			* with {@link since} / {@link until}.
+			*/
+			sortBy: FaceSortFieldEnum.optional(),
+			/** Sort direction for {@link sortBy}. Default `'desc'`. */
+			sortDirection: FaceSortDirectionEnum.optional(),
+			/**
+			* Inline the base64 crop on every row.
+			*
+			* Default `false` since the 2026-08-25 inversion — see
+			* `include-crops-default.ts`, which is the ONE place that resolves
+			* this for every gallery, and which records why the inline shape had
+			* to become the one you ASK for (60 457 ms → UDS timeout at 500 rows).
+			* The doc here used to still say `true`; it was wrong, and a leftover
+			* that describes the old design reads as permission to rely on it.
+			*
+			* Nothing loses its image: the row carries {@link FaceInfo.cropUrl},
+			* which the browser fetches off the `event-media` plane in parallel,
+			* cached and ETagged.
 			*/
 			includeCrops: zod.z.boolean().optional()
 		}).optional(), zod.z.array(FaceInfoSchema).readonly()),
@@ -24185,13 +24347,39 @@ includeCrops: zod.z.boolean().optional() }).optional(), zod.z.array(IdentitySche
 		suggestFaceClusters: require_sleep.method(zod.z.object({
 			threshold: zod.z.number().min(0).max(1).optional(),
 			minClusterSize: zod.z.number().int().min(2).optional(),
-			limit: zod.z.number().int().positive().optional()
-		}).optional(), zod.z.array(zod.z.object({
-			faceIds: zod.z.array(zod.z.string()).readonly(),
-			representativeFaceId: zod.z.string(),
-			size: zod.z.number().int(),
-			cohesion: zod.z.number()
-		})).readonly())
+			/**
+			* Cap on the number of CLUSTERS returned. Renamed from `limit`,
+			* which read as though it bounded the work — it never did.
+			*
+			* Wins over {@link limit} when both are sent.
+			*/
+			maxClusters: zod.z.number().int().positive().optional(),
+			/**
+			* @deprecated Ambiguous name for {@link maxClusters} — it cuts the
+			* RESULT, not the scan. Kept so existing callers keep working; send
+			* `maxClusters` (and, if you care about cost, {@link maxFacesScanned}).
+			*/
+			limit: zod.z.number().int().positive().optional(),
+			/**
+			* Cap on the number of unassigned faces READ AND CLUSTERED — the
+			* POOL, not the result.
+			*
+			* This is the knob {@link maxClusters} was mistaken for. Clustering
+			* used to read every unassigned face on the hub no matter what the
+			* caller asked for, because the only bound cut the finished clusters
+			* afterwards; a UI showing a window of 100 paid for a scan of the
+			* whole corpus, on an addon whose disk is under contention.
+			*
+			* The pool is the NEWEST matching faces first — the same order the
+			* gallery shows — so a bound here shortens the horizon, it does not
+			* sample it randomly.
+			*
+			* Default: 1 000 (`FACE_SWEEP_PAGE`, exactly one store page). Chosen
+			* so the live corpus — 372 face rows — is unaffected while the
+			* unbounded scan can never come back as the table grows.
+			*/
+			maxFacesScanned: zod.z.number().int().positive().optional()
+		}).optional(), zod.z.array(FaceClusterSchema).readonly())
 	}
 };
 //#endregion
@@ -30257,6 +30445,295 @@ var SetSiteLocationInputSchema = zod.z.object({
 	latitude: zod.z.number().min(-90).max(90),
 	longitude: zod.z.number().min(-180).max(180)
 }).nullable();
+/**
+* The TRANSPORT a call arrived on.
+*
+* Every counted call carries exactly one of these, and `unknown` is a PLANE
+* rather than a gap: a plane that cannot attribute a call declares it here, so
+* the call lands in a named bucket instead of vanishing. `planes` summing to
+* `procedureCalls` is what makes "the sum of the planes explains the total"
+* checkable rather than asserted.
+*
+*  - `http`  — the Fastify tRPC plugin (`/trpc/*`), one context per request.
+*  - `ws`    — `applyWSSHandler`, counted per OPERATION rather than per
+*              connection; the viewer talks to the hub over `wsLink`
+*              exclusively, so this is the plane the HTTP census could not see.
+*  - `mesh`  — the in-process `$core-caps` bridge (`createCaller`), which
+*              never touches a socket and therefore never touched a census.
+*  - `unknown` — counted, plane undecidable. No hook produces it today, and
+*    that is exactly what its `0` asserts: every plane the hub has can name
+*    itself. It is an output bucket, never a knob — a call that arrives on a
+*    plane nobody instrumented lands here instead of vanishing from the total.
+*/
+var TransportPlaneSchema = zod.z.enum([
+	"http",
+	"ws",
+	"mesh",
+	"unknown"
+]);
+/**
+* Calls per plane. Every key is always present, `0` included — an absent plane
+* reads as "not instrumented", which is the one thing this census must never
+* make an operator wonder about.
+*/
+var TransportPlaneCountsSchema = zod.z.object({
+	http: zod.z.number(),
+	ws: zod.z.number(),
+	mesh: zod.z.number(),
+	unknown: zod.z.number()
+});
+/**
+* One `(plane, procedure, user-agent, ip, principal)` tuple of the transport
+* census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
+* `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
+* already prints - never a token, never an `Authorization` header.
+*
+* `subscriptions` is counted APART from `calls`: a subscription is opened once
+* and lives for hours, so folding it into a call count makes one long-lived
+* stream look like a storm.
+*/
+var RequestCensusGroupSchema = zod.z.object({
+	plane: TransportPlaneSchema,
+	procedure: zod.z.string(),
+	userAgent: zod.z.string(),
+	ip: zod.z.string(),
+	principal: zod.z.string(),
+	calls: zod.z.number(),
+	subscriptions: zod.z.number(),
+	perMin: zod.z.number()
+});
+/**
+* A procedure's TOTAL over the window, across every caller.
+*
+* This block, not the group list, is what answers "did these calls arrive over
+* HTTP at all". A total far BELOW what a store-side census counted over the
+* same window excludes the HTTP plane, which is a result, not a failure.
+*/
+var RequestCensusProcedureSchema = zod.z.object({
+	procedure: zod.z.string(),
+	calls: zod.z.number(),
+	/**
+	* The same total, split by transport. THIS is the row that answers the
+	* question the census exists for: one look at `deviceManager.listAll` says
+	* which plane carried the 4 960, without joining two log lines by eye.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/** Subscription STARTS on this procedure. Never folded into `calls`. */
+	subscriptions: zod.z.number(),
+	perMin: zod.z.number()
+});
+/** What one armed window measured. Mirrors `TransportCensus.snapshot()`. */
+var RequestCensusSnapshotSchema = zod.z.object({
+	armed: zod.z.boolean(),
+	/** How long the current - or just-closed - window collected, in ms. */
+	elapsedMs: zod.z.number(),
+	/** The window actually armed, after the server clamped the request. */
+	windowMs: zod.z.number(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: zod.z.number(),
+	httpRequests: zod.z.number(),
+	batchedRequests: zod.z.number(),
+	/**
+	* Procedure invocations. Higher than `httpRequests` whenever tRPC batching
+	* is in play (`?batch=1` carries several procedures in one request); this is
+	* the number comparable with a store-side call count.
+	*/
+	procedureCalls: zod.z.number(),
+	/**
+	* `procedureCalls` split by transport. The four keys sum to
+	* `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+	* `planesExplainTotal` is that identity, checked rather than assumed.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/**
+	* True iff `planes` sums to `procedureCalls`. False means a call was counted
+	* on no plane at all - which is a RESULT (a plane is missing from the
+	* instrument), not a failure, and it has to be visible to be read as one.
+	*/
+	planesExplainTotal: zod.z.boolean(),
+	/**
+	* tRPC WebSocket connections opened during the window. NOT calls - the WS
+	* adapter resolves one context per connection - kept because a plane's call
+	* count of zero against 37 open connections says something different from a
+	* plane with no connections at all.
+	*/
+	wsConnections: zod.z.number(),
+	/**
+	* Client frames the WS plane looked at. `wsMessages` far above
+	* `planes.ws + subscriptions` means most traffic is not operations
+	* (keepalives, connection params) - which is itself an answer.
+	*/
+	wsMessages: zod.z.number(),
+	/**
+	* Subscription STARTS across every plane, excluded from `procedureCalls` on
+	* purpose: one live-events stream opened at boot and held for six hours is
+	* one subscription, and counting it as a call would let a quiet plane
+	* masquerade as the storm.
+	*/
+	subscriptions: zod.z.number(),
+	/** `subscription.stop` frames. Starts minus stops is what is still open. */
+	subscriptionStops: zod.z.number(),
+	distinctGroups: zod.z.number(),
+	/**
+	* Operations counted in the totals whose CALLER attribution was shed at the
+	* cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+	* which transport they arrived on, they just lost their group row.
+	*/
+	unattributedCalls: zod.z.number(),
+	procedures: zod.z.array(RequestCensusProcedureSchema).readonly(),
+	groups: zod.z.array(RequestCensusGroupSchema).readonly()
+});
+/**
+* The census as an operator sees it.
+*
+* `persisted` is the honest answer to "will this survive the restart I am
+* about to do": the arm deadline is written to `system-settings` so a window
+* armed now can measure the NEXT boot, and a write that failed must not look
+* like one that succeeded.
+*/
+var RequestCensusStatusSchema = RequestCensusSnapshotSchema.extend({ persisted: zod.z.boolean() });
+/** Severity vocabulary. Mirrors `LogLevel` in `interfaces/logging.ts`. */
+var LogLevelSchema$1 = zod.z.enum([
+	"debug",
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* The diagnostics that can be ARMED for a window. Exactly one today.
+*
+* A diagnostic is anything whose cost is only worth paying while a question is
+* open. It never persists as a boolean: see {@link DiagnosticWindowSchema}.
+*/
+var DiagnosticIdSchema = zod.z.enum(["request-census"]);
+/**
+* The layers of the level hierarchy, general → specific. The most specific
+* layer that carries an explicit value wins.
+*
+* `component` is DECLARED and not yet resolvable: the per-component channels
+* are a later slice of the same plan, and a `levelSource` enum that has to
+* grow later would force every consumer of this document to change with it.
+* Nothing returns `component` today.
+*/
+var LoggingScopeKindSchema = zod.z.enum([
+	"cluster",
+	"node",
+	"component"
+]);
+/** Where an effective level came from. `default` = nothing is set anywhere. */
+var LoggingLevelSourceSchema = zod.z.enum([
+	"default",
+	"cluster",
+	"node",
+	"component"
+]);
+/**
+* One layer of the hierarchy as it actually STANDS.
+*
+* `level: null` is the whole reason this array is returned: it is the
+* difference between "this node is at `info` because I decided it" and
+* "...because it inherits". An operator who clears an override believing they
+* are clearing an inherited value has been handed the same defect as the two
+* contradicting knobs this document exists to remove, moved one floor up.
+*/
+var LoggingLevelLayerSchema = zod.z.object({
+	scope: LoggingScopeKindSchema,
+	/** The node this layer speaks for; `null` on the cluster layer. */
+	nodeId: zod.z.string().nullable(),
+	/** Explicitly set here, or `null` when this layer inherits. */
+	level: LogLevelSchema$1.nullable()
+});
+/** What a line is judged against, and WHICH layer decided it. */
+var LoggingEffectiveSchema = zod.z.object({
+	level: LogLevelSchema$1,
+	levelSource: LoggingLevelSourceSchema
+});
+/** Every layer, general → specific. Never collapsed into the effective value. */
+var LoggingExplicitSchema = zod.z.object({ layers: zod.z.array(LoggingLevelLayerSchema).readonly() });
+/**
+* An armed diagnostic, with its DEADLINE.
+*
+* The shape of ADR-0244: what is stored is a deadline and never a flag, so a
+* diagnostic somebody forgot expires by itself, and a boot-window measurement
+* survives the restart it exists to measure. `remainingMs` is 0 whenever
+* `armed` is false — a window is never reported as slightly expired.
+*/
+var DiagnosticWindowSchema = zod.z.object({
+	id: DiagnosticIdSchema,
+	armed: zod.z.boolean(),
+	/** Epoch ms the window closes at. 0 when disarmed. */
+	armedUntilMs: zod.z.number(),
+	/** Ms left before it expires on its own. 0 when disarmed. */
+	remainingMs: zod.z.number(),
+	/** Whether the stored deadline is the one the live diagnostic is running —
+	*  i.e. whether this window would survive a restart. */
+	persisted: zod.z.boolean()
+});
+/**
+* `armMs: 0` DISARMS. Any positive value arms for that long, clamped by the
+* server — there is no maximum here on purpose: a bound repeated in a schema
+* is a second knob that disagrees with the first the day one of them moves.
+*/
+var DiagnosticWindowPatchSchema = zod.z.object({
+	id: DiagnosticIdSchema,
+	armMs: zod.z.number().int().min(0),
+	/** Cadence of the diagnostic's aggregated report line. Clamped by the server. */
+	reportEveryMs: zod.z.number().int().positive().optional()
+});
+/**
+* A PATCH, and patches MERGE.
+*
+* A field absent from the patch is left exactly as it was — arming a
+* diagnostic never resets a level, and setting a level never disarms a window.
+* The provider must not reconstruct the document as `{ ...snapshot, ...patch }`:
+* `setAll` already merges, and rebuilding the object is how an absent field
+* turns into an erased one.
+*/
+var LoggingSettingsPatchSchema = zod.z.object({
+	/**
+	* Absent leaves the level untouched. `null` CLEARS the explicit value at the
+	* addressed scope so it inherits again. A value sets it.
+	*/
+	level: LogLevelSchema$1.nullable().optional(),
+	/**
+	* Only the diagnostics NAMED here change. An armed window that is not listed
+	* keeps running — a patch is never a full replacement.
+	*/
+	diagnostics: zod.z.array(DiagnosticWindowPatchSchema).readonly().optional()
+});
+/**
+* Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
+*
+* Deliberately NOT called `nodeId`: that key is reserved on every cap method
+* input — the generated router strips it and uses it to resolve the PROVIDER
+* on that node (`resolveProvider(cap, nodeId, …)`). A document about
+* `agent-1` addressed as `nodeId` would be forwarded to agent-1 and answered
+* by an agent that holds no cluster document at all. The hub is the single
+* authority over the whole hierarchy and answers for every layer, so the
+* layer selector needs a name the transport does not already own.
+*/
+var GetLoggingSettingsInputSchema = zod.z.object({ scopeNodeId: zod.z.string().optional() });
+var SetLoggingSettingsInputSchema = zod.z.object({
+	scopeNodeId: zod.z.string().optional(),
+	patch: LoggingSettingsPatchSchema
+});
+/**
+* The whole document, as read and as returned after every write.
+*
+* `persisted: false` means the settings store could not be read or written.
+* The in-memory mirror still governs behaviour and is unchanged by the
+* failure — a read that fails neither switches a level nor disarms a window
+* (D49) — but the operator is told that what they are looking at would not
+* survive a restart.
+*/
+var LoggingSettingsStateSchema = zod.z.object({
+	/** The layer this document was read at. `null` = the cluster layer. */
+	scopeNodeId: zod.z.string().nullable(),
+	effective: LoggingEffectiveSchema,
+	explicit: LoggingExplicitSchema,
+	activeWindows: zod.z.array(DiagnosticWindowSchema).readonly(),
+	persisted: zod.z.boolean()
+});
 var systemCapability = {
 	name: "system",
 	scope: "system",
@@ -30300,6 +30777,38 @@ var systemCapability = {
 		detectSiteLocation: require_sleep.method(zod.z.void(), SiteLocationStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Read the HTTP request census - which caller, from which address, with
+		* which user-agent, invoked which tRPC procedure, and how often.
+		*
+		* Reading NEVER re-arms: re-arming clears the counts, which would throw
+		* away exactly the numbers being asked for. A closed window may be read as
+		* many times as the operator likes and always describes the same window.
+		*
+		* Admin-only: the rows carry source addresses and principal names.
+		*/
+		getRequestCensus: require_sleep.method(zod.z.void(), RequestCensusStatusSchema, { auth: "admin" }),
+		/**
+		* The logging settings document — levels and armed diagnostics — resolved
+		* for `nodeId`, or for the cluster when `nodeId` is absent.
+		*
+		* Returns BOTH `effective` and `explicit`. See
+		* {@link LoggingLevelLayerSchema} for why collapsing them is the defect.
+		*/
+		getLoggingSettings: require_sleep.method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }),
+		/**
+		* Write the logging settings document. The ONLY write authority over log
+		* levels and diagnostic windows — arming the request census went through
+		* `system.setRequestCensus` until 2026-08-27 and no longer does, because
+		* two writes that disagree about the same window is exactly the defect
+		* this document exists to remove (D245).
+		*
+		* The patch MERGES: see {@link LoggingSettingsPatchSchema}.
+		*/
+		setLoggingSettings: require_sleep.method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
+			kind: "mutation",
+			auth: "admin"
 		})
 	},
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -31494,6 +32003,172 @@ function stateVocabularyFor(runtimeState, alarmStates = []) {
 	return [];
 }
 //#endregion
+//#region src/catalogs/sensor-active-state.ts
+/**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/**
+* Device `type` values (from `DeviceType`) that can host a binary/switch
+* source cap. Used by the camera's `device-multiselect` picker as the
+* CLIENT-SIDE filter, alongside `SOURCE_CAPS`.
+*
+* Why types and not caps alone: the shared picker filters
+* `deviceManager.listAll` rows client-side, and those rows carry only the
+* device's advertised `features` — NOT its registered cap list. On the live
+* cluster binary sensors and switches advertise EMPTY features (features
+* mirror only a handful of caps like `motion-trigger`), so a caps-only
+* filter matched against `features` would list nothing (the very bug this
+* replaced, which relied on the now-empty `getAllBindings`). Matching by
+* `type` is the reliable client-side signal; the union with `SOURCE_CAPS`
+* still captures any device that DOES advertise a source-cap feature.
+* `sensor` covers contact/motion/flood/gas/smoke/CO/vibration/tamper,
+* `switch` covers switches, `control` covers generic binary actuators.
+*/
+var SOURCE_DEVICE_TYPES = [
+	"sensor",
+	"switch",
+	"control"
+];
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+//#endregion
 //#region src/constants.ts
 var HF_REPO = "camstack/camstack-models";
 var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
@@ -32655,6 +33330,47 @@ var BaseDeviceProvider = class extends require_sleep.BaseAddon {
 	}
 };
 //#endregion
+//#region src/device/battery-presence.ts
+/**
+* Default silence budget before a sleeping battery camera is called gone.
+*
+* Sized off the mechanism that produces contact, not off taste: a battery cam
+* on this deployment surfaces a firmware push (battery level, sleep/wake, or a
+* motion email) on the order of hours even with no visitors, and the snapshot
+* wrapper's own battery window is 1 hour. Six hours is therefore several
+* missed opportunities, not one — so a single quiet night does not raise a
+* fault, and a genuinely flat camera is named well inside a day.
+*/
+var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
+/**
+* THE derivation. One crop rectangle, one presence verdict — see D52 for why
+* this repo insists a derived value has exactly one implementation.
+*
+* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
+* and the caller decides separately whether it is even battery-operated
+* (`DeviceFeature.BatteryOperated`); this function never answers that
+* question, only what a battery device is doing.
+*/
+function deriveBatteryPresence(input) {
+	const status = input.status;
+	if (!status) return "sleeping";
+	if (status.sleeping !== true) return "awake";
+	const lastContactAt = status.lastContactAt;
+	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
+	const budget = input.unreachableAfterMs ?? 216e5;
+	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
+}
+/**
+* Is this presence a FAULT the operator should be told about?
+*
+* Exists so no surface has to re-decide it — the whole point of the third
+* state is that `sleeping` stops being rendered as breakage, and a caller that
+* writes `presence !== 'awake'` has silently undone that.
+*/
+function isBatteryPresenceFault(presence) {
+	return presence === "unreachable";
+}
+//#endregion
 //#region src/device/declared-device.ts
 /** Marker written to a declared integration's `info`. */
 var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
@@ -33121,47 +33837,6 @@ function resolveDeviceProfile(features) {
 	return null;
 }
 //#endregion
-//#region src/device/battery-presence.ts
-/**
-* Default silence budget before a sleeping battery camera is called gone.
-*
-* Sized off the mechanism that produces contact, not off taste: a battery cam
-* on this deployment surfaces a firmware push (battery level, sleep/wake, or a
-* motion email) on the order of hours even with no visitors, and the snapshot
-* wrapper's own battery window is 1 hour. Six hours is therefore several
-* missed opportunities, not one — so a single quiet night does not raise a
-* fault, and a genuinely flat camera is named well inside a day.
-*/
-var BATTERY_UNREACHABLE_AFTER_MS = 360 * 6e4;
-/**
-* THE derivation. One crop rectangle, one presence verdict — see D52 for why
-* this repo insists a derived value has exactly one implementation.
-*
-* `undefined` status ⇒ `sleeping`. A device with no slice has made no claim,
-* and the caller decides separately whether it is even battery-operated
-* (`DeviceFeature.BatteryOperated`); this function never answers that
-* question, only what a battery device is doing.
-*/
-function deriveBatteryPresence(input) {
-	const status = input.status;
-	if (!status) return "sleeping";
-	if (status.sleeping !== true) return "awake";
-	const lastContactAt = status.lastContactAt;
-	if (typeof lastContactAt !== "number" || lastContactAt <= 0) return "sleeping";
-	const budget = input.unreachableAfterMs ?? 216e5;
-	return input.nowMs - lastContactAt > budget ? "unreachable" : "sleeping";
-}
-/**
-* Is this presence a FAULT the operator should be told about?
-*
-* Exists so no surface has to re-decide it — the whole point of the third
-* state is that `sleeping` stops being rendered as breakage, and a caller that
-* writes `presence !== 'awake'` has silently undone that.
-*/
-function isBatteryPresenceFault(presence) {
-	return presence === "unreachable";
-}
-//#endregion
 //#region src/device/path-util.ts
 /** Returns true when `x` is a non-null, non-array plain object. */
 function isRecord(x) {
@@ -40445,6 +41120,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"system.getLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"system.getRequestCensus": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"system.getRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -40475,6 +41162,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"system.setLoggingSettings": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"system.setRetentionConfig": {
 		capName: "system",
 		capScope: "system",
@@ -41887,6 +42580,10 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		name: "deviceId",
 		form: "single",
 		optional: true
+	}, {
+		name: "deviceIds",
+		form: "array",
+		optional: true
 	}],
 	"fanControl.setDirection": [{
 		name: "deviceId",
@@ -44204,7 +44901,10 @@ function createSystemProxy(api) {
 			forceRetentionCleanup: (input) => dispatch("system", "forceRetentionCleanup", "mutation", input),
 			getSiteLocation: (input) => dispatch("system", "getSiteLocation", "query", input),
 			setSiteLocation: (input) => dispatch("system", "setSiteLocation", "mutation", input),
-			detectSiteLocation: (input) => dispatch("system", "detectSiteLocation", "mutation", input)
+			detectSiteLocation: (input) => dispatch("system", "detectSiteLocation", "mutation", input),
+			getRequestCensus: (input) => dispatch("system", "getRequestCensus", "query", input),
+			getLoggingSettings: (input) => dispatch("system", "getLoggingSettings", "query", input),
+			setLoggingSettings: (input) => dispatch("system", "setLoggingSettings", "mutation", input)
 		},
 		terminalSession: {
 			listProfiles: (input) => dispatch("terminalSession", "listProfiles", "query", input),
@@ -46067,6 +46767,7 @@ var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
 var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
+var NATIVE_LEASE_SCENE_BUDGET_KEY = "nativeSceneBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -46161,7 +46862,38 @@ var NativeLeaseSettingsSchema = zod.z.object({
 	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
 	* reproduce that.
 	*/
-	tileBudgetMb: zod.z.number().int().min(0).max(1024)
+	tileBudgetMb: zod.z.number().int().min(0).max(1024),
+	/**
+	* RAM ceiling per decode worker, in MB, for the SCENE TILES — one
+	* JPEG-encoded copy of the WHOLE native frame, cut in the same instant as the
+	* subject tiles, on frames that detected something.
+	*
+	* It exists because a subject tile cannot answer a FULL-FRAME request:
+	* containment is strict by design, so the native `keyFrame`, the detail
+	* plane's `frameJpeg` rung and the display-crop fallback had no rung at all
+	* below the hold. Measured on the live cluster: 23.3% of key-frame captures
+	* missed, 95.7% of them with `worker-lease-gone` — the raster released one
+	* frame-time after delivery, with the request only p50 367 ms behind it.
+	*
+	* Sizing, and why this is a budget and not a duration: a scene tile is
+	* ~1.5-2.5 MB at 4K (against ~23.75 MB for the raster it was cut from and
+	* ~60-120 KB for a subject tile), and it is cut ~0.4 times a second per busy
+	* camera — only detection-bearing frames get one. 48 MB is therefore ~20-30
+	* frames, i.e. the store's 30 s TTL binds at the steady state and the budget
+	* binds only through a detection burst, where it still covers well past the
+	* measured p90 ask age of 4.3 s. Holding the RASTERS for the same window
+	* would be ~498 MB per camera and ~6 GB at peak concurrency — the OOM this
+	* whole shape exists to avoid.
+	*
+	* A SEPARATE ceiling from `tileBudgetMb` on purpose: a scene tile is ~20× a
+	* subject tile, so one shared budget would let a busy camera's key frames
+	* evict the face/plate tiles the recognisers depend on. Two budgets make that
+	* impossible rather than unlikely. `0` DISABLES scene tiles and restores the
+	* pre-existing behaviour, where a late full-frame request had nothing but the
+	* ≤640 RAM raster — which the `keyFrame` gate rejects, so in practice it had
+	* nothing.
+	*/
+	sceneBudgetMb: zod.z.number().int().min(0).max(1024)
 });
 /**
 * The values in force when the operator has set nothing.
@@ -46177,6 +46909,7 @@ var DEFAULT_NATIVE_LEASE_SETTINGS = {
 	budgetMb: 1024,
 	activityMs: 15e3,
 	tileBudgetMb: 64,
+	sceneBudgetMb: 48,
 	admission: "inferred"
 };
 /** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
@@ -46204,6 +46937,12 @@ var NATIVE_LEASE_TILE_BUDGET_FIELD = {
 	step: 16,
 	default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
 };
+var NATIVE_LEASE_SCENE_BUDGET_FIELD = {
+	min: 0,
+	max: 1024,
+	step: 16,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb
+};
 /** Select options for the admission knob (orchestrator settings UI). */
 var NATIVE_LEASE_ADMISSION_FIELD = {
 	options: [{
@@ -46262,12 +47001,14 @@ function readNativeLeaseOverride(config) {
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
 	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
+	const sceneBudgetMb = readKnob("sceneBudgetMb", config[NATIVE_LEASE_SCENE_BUDGET_KEY]);
 	return {
 		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
 		...admission === null ? {} : { admission },
-		...tileBudgetMb === null ? {} : { tileBudgetMb }
+		...tileBudgetMb === null ? {} : { tileBudgetMb },
+		...sceneBudgetMb === null ? {} : { sceneBudgetMb }
 	};
 }
 function isHydratedField(entry) {
@@ -46278,7 +47019,8 @@ var LEASE_KEYS = [
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
 	NATIVE_LEASE_ADMISSION_KEY,
-	NATIVE_LEASE_TILE_BUDGET_KEY
+	NATIVE_LEASE_TILE_BUDGET_KEY,
+	NATIVE_LEASE_SCENE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an
@@ -48370,6 +49112,7 @@ exports.DEFAULT_DETAIL_CROP_CONVENTION = DEFAULT_DETAIL_CROP_CONVENTION;
 exports.DEFAULT_EVENTS_BAND_BUFFER_SEC = DEFAULT_EVENTS_BAND_BUFFER_SEC;
 exports.DEFAULT_EVENT_COLOR = DEFAULT_EVENT_COLOR;
 exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
+exports.DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = DEFAULT_FIRST_SIGHTING_FRESHNESS_MS;
 exports.DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = DEFAULT_MIN_LANDMARK_FACE_SIZE_PX;
 exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
 exports.DEFAULT_POOL_MEMORY_POLICY = DEFAULT_POOL_MEMORY_POLICY;
@@ -48420,6 +49163,9 @@ exports.DeviceRuntimeState = DeviceRuntimeState;
 exports.DeviceSelectorSchema = DeviceSelectorSchema;
 exports.DeviceStatusSchema = DeviceStatusSchema;
 exports.DeviceType = require_sleep.DeviceType;
+exports.DiagnosticIdSchema = DiagnosticIdSchema;
+exports.DiagnosticWindowPatchSchema = DiagnosticWindowPatchSchema;
+exports.DiagnosticWindowSchema = DiagnosticWindowSchema;
 exports.DiscoveredChildDeviceSchema = DiscoveredChildDeviceSchema;
 exports.DiscoveredChildStatusSchema = DiscoveredChildStatusSchema;
 exports.DiscoveredDeviceSchema = DiscoveredDeviceSchema;
@@ -48484,6 +49230,7 @@ exports.ExpressionGlobalBindingSchema = ExpressionGlobalBindingSchema;
 exports.ExpressionLiteralBindingSchema = ExpressionLiteralBindingSchema;
 exports.ExpressionParseError = ExpressionParseError;
 exports.ExpressionSourceSchema = ExpressionSourceSchema;
+exports.FIRST_LEVEL_MACRO_CLASSES = FIRST_LEVEL_MACRO_CLASSES;
 exports.FULL_IMAGE_BBOX = FULL_IMAGE_BBOX;
 exports.FanControlStatusSchema = FanControlStatusSchema;
 exports.FanDirectionSchema = FanDirectionSchema;
@@ -48497,6 +49244,7 @@ exports.FrameInputSchema = FrameInputSchema;
 exports.FrameLazyCountersSchema = FrameLazyCountersSchema;
 exports.FrameLazyMetricsSchema = FrameLazyMetricsSchema;
 exports.GasStatusSchema = GasStatusSchema;
+exports.GetLoggingSettingsInputSchema = GetLoggingSettingsInputSchema;
 exports.GetStreamWithCodecInputSchema = GetStreamWithCodecInputSchema;
 exports.GlobalMetricsSchema = GlobalMetricsSchema;
 exports.HAP_AUDIO_BASE = HAP_AUDIO_BASE;
@@ -48568,6 +49316,13 @@ exports.LockStateSchema = LockStateSchema;
 exports.LogEntrySchema = LogEntrySchema;
 exports.LogLevelSchema = LogLevelSchema;
 exports.LogStreamEntrySchema = LogStreamEntrySchema;
+exports.LoggingEffectiveSchema = LoggingEffectiveSchema;
+exports.LoggingExplicitSchema = LoggingExplicitSchema;
+exports.LoggingLevelLayerSchema = LoggingLevelLayerSchema;
+exports.LoggingLevelSourceSchema = LoggingLevelSourceSchema;
+exports.LoggingScopeKindSchema = LoggingScopeKindSchema;
+exports.LoggingSettingsPatchSchema = LoggingSettingsPatchSchema;
+exports.LoggingSettingsStateSchema = LoggingSettingsStateSchema;
 exports.LoginMethodContributionSchema = LoginMethodContributionSchema;
 exports.LoginStageEnum = LoginStageEnum;
 exports.MACRO_LABELS = MACRO_LABELS;
@@ -48580,6 +49335,7 @@ exports.MAX_EXPRESSION_BINDINGS = MAX_EXPRESSION_BINDINGS;
 exports.MAX_EXPRESSION_CALL_ARGS = MAX_EXPRESSION_CALL_ARGS;
 exports.MAX_EXPRESSION_EVAL_STEPS = MAX_EXPRESSION_EVAL_STEPS;
 exports.MAX_EXPRESSION_SOURCE_LENGTH = MAX_EXPRESSION_SOURCE_LENGTH;
+exports.MAX_SENSOR_TRIGGER_DEVICES = MAX_SENSOR_TRIGGER_DEVICES;
 exports.METHOD_ACCESS_MAP = METHOD_ACCESS_MAP;
 exports.METHOD_DEVICE_SELECTORS = METHOD_DEVICE_SELECTORS;
 exports.MODEL_FORMATS = MODEL_FORMATS;
@@ -48640,6 +49396,8 @@ exports.NATIVE_LEASE_BUDGET_FIELD = NATIVE_LEASE_BUDGET_FIELD;
 exports.NATIVE_LEASE_BUDGET_KEY = NATIVE_LEASE_BUDGET_KEY;
 exports.NATIVE_LEASE_HOLD_FIELD = NATIVE_LEASE_HOLD_FIELD;
 exports.NATIVE_LEASE_HOLD_KEY = NATIVE_LEASE_HOLD_KEY;
+exports.NATIVE_LEASE_SCENE_BUDGET_FIELD = NATIVE_LEASE_SCENE_BUDGET_FIELD;
+exports.NATIVE_LEASE_SCENE_BUDGET_KEY = NATIVE_LEASE_SCENE_BUDGET_KEY;
 exports.NATIVE_LEASE_SECTION_ID = NATIVE_LEASE_SECTION_ID;
 exports.NATIVE_LEASE_TILE_BUDGET_FIELD = NATIVE_LEASE_TILE_BUDGET_FIELD;
 exports.NATIVE_LEASE_TILE_BUDGET_KEY = NATIVE_LEASE_TILE_BUDGET_KEY;
@@ -48846,6 +49604,7 @@ exports.RecordingDaysSchema = RecordingDaysSchema;
 exports.RecordingDeviceUsageSchema = RecordingDeviceUsageSchema;
 exports.RecordingLocationUsageSchema = RecordingLocationUsageSchema;
 exports.RecordingManifestSchema = RecordingManifestSchema;
+exports.RecordingObjectTriggerClassSchema = RecordingObjectTriggerClassSchema;
 exports.RecordingRangeSchema = RecordingRangeSchema;
 exports.RecordingRebalanceInputSchema = RecordingRebalanceInputSchema;
 exports.RecordingRebalanceMoveSchema = RecordingRebalanceMoveSchema;
@@ -48866,6 +49625,10 @@ exports.RelocateJobStateSchema = RelocateJobStateSchema;
 exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
 exports.RenderedAsSchema = RenderedAsSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
+exports.RequestCensusGroupSchema = RequestCensusGroupSchema;
+exports.RequestCensusProcedureSchema = RequestCensusProcedureSchema;
+exports.RequestCensusSnapshotSchema = RequestCensusSnapshotSchema;
+exports.RequestCensusStatusSchema = RequestCensusStatusSchema;
 exports.RetrainAnnotationDraftSchema = RetrainAnnotationDraftSchema;
 exports.RetrainAnnotationKindSchema = RetrainAnnotationKindSchema;
 exports.RetrainAnnotationSchema = RetrainAnnotationSchema;
@@ -48903,6 +49666,10 @@ exports.SCENE_RESET_RECAPTURES = SCENE_RESET_RECAPTURES;
 exports.SCOPE_PRESETS = SCOPE_PRESETS;
 exports.SENSOR_FEATURES = SENSOR_FEATURES;
 exports.SENSOR_MAP = SENSOR_MAP;
+exports.SOURCE_CAPS = SOURCE_CAPS;
+exports.SOURCE_CAP_ACTIVE_FIELD = SOURCE_CAP_ACTIVE_FIELD;
+exports.SOURCE_CAP_CHANGED_AT_FIELD = SOURCE_CAP_CHANGED_AT_FIELD;
+exports.SOURCE_DEVICE_TYPES = SOURCE_DEVICE_TYPES;
 exports.SOURCE_INFO_METADATA_KEY = SOURCE_INFO_METADATA_KEY;
 exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
 exports.STREAM_QUALITY_LABELS = STREAM_QUALITY_LABELS;
@@ -48934,6 +49701,7 @@ exports.ServerRollbackInfoSchema = ServerRollbackInfoSchema;
 exports.ServerUpdateActionResultSchema = ServerUpdateActionResultSchema;
 exports.ServerUpdateCheckResultSchema = ServerUpdateCheckResultSchema;
 exports.ServerUpdateStateSchema = ServerUpdateStateSchema;
+exports.SetLoggingSettingsInputSchema = SetLoggingSettingsInputSchema;
 exports.SetSiteLocationInputSchema = SetSiteLocationInputSchema;
 exports.SettingsPatchSchema = SettingsPatchSchema;
 exports.SettingsRecordSchema = SettingsRecordSchema;
@@ -49037,6 +49805,8 @@ exports.TrackZoneFilterSchema = TrackZoneFilterSchema;
 exports.TrackedDetectionSchema = TrackedDetectionSchema;
 exports.TrainingExportDeviceTotalsSchema = TrainingExportDeviceTotalsSchema;
 exports.TrainingExportSummarySchema = TrainingExportSummarySchema;
+exports.TransportPlaneCountsSchema = TransportPlaneCountsSchema;
+exports.TransportPlaneSchema = TransportPlaneSchema;
 exports.TurnServerSchema = TurnServerSchema;
 exports.UNIT_TABLE = UNIT_TABLE;
 exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
@@ -49239,6 +50009,7 @@ exports.errMsg = require_err_msg.errMsg;
 exports.evaluateAst = evaluateAst;
 exports.evaluateExpressionSource = evaluateExpressionSource;
 exports.evaluatePoolMemory = evaluatePoolMemory;
+exports.evaluateSensorEdge = evaluateSensorEdge;
 exports.evaluateZoneRules = evaluateZoneRules;
 exports.event = require_sleep.event;
 exports.eventEmitterCapability = eventEmitterCapability;
@@ -49286,6 +50057,7 @@ exports.isDetectionMacroClass = isDetectionMacroClass;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
 exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
+exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
@@ -49294,6 +50066,7 @@ exports.isRestoredCap = isRestoredCap;
 exports.isSameAddonId = isSameAddonId;
 exports.isScheduleActive = isScheduleActive;
 exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
+exports.isSourceCap = isSourceCap;
 exports.isSystemDelivery = isSystemDelivery;
 exports.isVoidInput = isVoidInput;
 exports.jobKindSchema = jobKindSchema;
@@ -49447,6 +50220,8 @@ exports.setByPath = setByPath;
 exports.settingsStoreCapability = settingsStoreCapability;
 exports.sleep = require_sleep.sleep;
 exports.sleepCancellable = require_sleep.sleepCancellable;
+exports.sliceActiveValue = sliceActiveValue;
+exports.sliceChangedAt = sliceChangedAt;
 exports.smokeCapability = smokeCapability;
 exports.smtpProviderCapability = smtpProviderCapability;
 exports.snapshotCapability = snapshotCapability;