@camstack/types 1.2.161 → 1.2.163

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_event_category = require("./event-category-b8kBSOTT.js");
-const require_sleep = require("./sleep-DDIFZGbc.js");
+const require_event_category = require("./event-category-BVo6ta6_.js");
+const require_sleep = require("./sleep-BZtO-eFY.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -1432,378 +1432,6 @@ function logLevelAtMost(level, threshold) {
 	return LOG_LEVEL_RANK[level] <= LOG_LEVEL_RANK[threshold];
 }
 //#endregion
-//#region src/logging/log-channel.ts
-/**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = zod.z.enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = zod.z.object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: zod.z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: zod.z.string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: zod.z.boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = zod.z.object({
-	channel: zod.z.string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: zod.z.number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
-});
-/**
-* The gate a hot path holds.
-*
-* Obtain it ONCE — at module scope or in a constructor — and keep the
-* reference. Looking a channel up by name per line would put a Map lookup on
-* the path this class exists to keep free.
-*/
-var LogChannelGate = class {
-	descriptor;
-	/**
-	* HOT PATH GUARD. A plain data FIELD, and it must stay one.
-	*
-	* `log-channel.spec.ts` asserts the property descriptor has no getter and
-	* booby-traps the device set, so turning this into an accessor — or reading
-	* anything before it — fails the spec instead of taxing every line the
-	* process emits.
-	*/
-	on = false;
-	/** `null` while armed for every camera. Never read while `on` is false. */
-	devices = null;
-	level;
-	closesAtMs = 0;
-	constructor(descriptor) {
-		this.descriptor = descriptor;
-		this.level = descriptor.defaultLevel;
-	}
-	/** Epoch ms this channel disarms itself at. 0 when disarmed. */
-	get armedUntilMs() {
-		return this.on ? this.closesAtMs : 0;
-	}
-	/**
-	* Does this channel want a line about `deviceId`?
-	*
-	* Call it only behind `gate.on &&`. On its own it is still correct — the
-	* guard is repeated inside — but the point of the prefix is that a disarmed
-	* channel must not pay the call at all.
-	*/
-	wants(deviceId) {
-		if (!this.on) return false;
-		return this.devices === null || this.devices.has(deviceId);
-	}
-	/**
-	* Emit one line on this channel, at the channel's declared level.
-	*
-	* The channel name is added as `tags.logChannel` so LogQL can select the
-	* channel without matching on the message text, and whatever `tags` the
-	* caller passed — `deviceId` above all — is preserved.
-	*/
-	log(logger, message, extras) {
-		if (!this.on) return;
-		const tags = {
-			...extras.tags,
-			logChannel: this.descriptor.name
-		};
-		const line = {
-			...extras,
-			tags
-		};
-		if (this.level === "error") logger.error(message, line);
-		else if (this.level === "warn") logger.warn(message, line);
-		else logger.info(message, line);
-	}
-	/**
-	* Arm (or RE-arm, restarting) this channel. Off the hot path only.
-	*
-	* An empty `deviceIds` list is treated as "every camera" rather than "no
-	* camera": a window that matches nothing is indistinguishable from a
-	* disarmed one, and the operator who asked for it would wait for lines that
-	* can never come.
-	*/
-	arm(window) {
-		const ids = window.deviceIds;
-		this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
-		this.closesAtMs = window.armedUntilMs;
-		this.on = true;
-	}
-	/** Disarm. Off the hot path only. */
-	disarm() {
-		this.on = false;
-		this.devices = null;
-		this.closesAtMs = 0;
-	}
-};
-/**
-* Every channel this PROCESS declares, and the mirror of what is armed on it.
-*
-* One per process. A forked runner has its own, and it is refreshed through
-* the `log-channels` capability by the hub that owns the document — the
-* registry never reaches for a value itself.
-*/
-var LogChannelRegistry = class {
-	gates = /* @__PURE__ */ new Map();
-	/**
-	* Declare a channel and get its gate.
-	*
-	* A duplicate name throws. Two declarations of one name is a programming
-	* error, not a merge: the operator would arm one and the other would stay
-	* dark, which is the dead-knob shape (D62) with an extra step.
-	*/
-	declare(descriptor) {
-		const parsed = LogChannelDescriptorSchema.parse(descriptor);
-		if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process — two declarations of one name is a programming error, not a merge`);
-		const gate = new LogChannelGate(parsed);
-		this.gates.set(parsed.name, gate);
-		return gate;
-	}
-	/** The declarations, sorted by name so a list is stable to read and diff. */
-	list() {
-		return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
-	}
-	/** The gate for a declared channel, or `undefined`. */
-	gate(name) {
-		return this.gates.get(name);
-	}
-	/**
-	* Apply the FULL set of armed windows. Off the hot path.
-	*
-	* Full, not incremental, and that is the whole design: the document is the
-	* authority, so a channel the document does not name is disarmed here. An
-	* incremental apply would let a disarm get lost in transit and leave a
-	* channel running that nobody can see is running.
-	*
-	* A window already past its deadline is ignored rather than armed — a
-	* restore that re-armed an expired window would make a forgotten diagnostic
-	* immortal across restarts.
-	*
-	* Returns the names it could not place, so the caller can log them: a
-	* channel named in the document that this process does not declare is
-	* either a typo or an addon that has not booted yet, and both deserve a
-	* line rather than silence.
-	*/
-	apply(windows, nowMs) {
-		const wanted = /* @__PURE__ */ new Map();
-		const unknown = [];
-		for (const window of windows) {
-			if (window.armedUntilMs <= nowMs) continue;
-			if (!this.gates.has(window.channel)) {
-				unknown.push(window.channel);
-				continue;
-			}
-			wanted.set(window.channel, window);
-		}
-		for (const [name, gate] of this.gates) {
-			const window = wanted.get(name);
-			if (window === void 0) gate.disarm();
-			else gate.arm(window);
-		}
-		return unknown;
-	}
-	/**
-	* Disarm whatever has run out. Called on a timer, NEVER from a log path — a
-	* diagnostic that adds a `Date.now()` to the path it is measuring measures
-	* itself.
-	*
-	* Returns the names it closed, so the caller can write the one line that
-	* says a window ended and stops "it went quiet" from reading as "the branch
-	* was not taken".
-	*/
-	tick(nowMs) {
-		const closed = [];
-		for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
-			gate.disarm();
-			closed.push(name);
-		}
-		return closed;
-	}
-	/** The channels armed right now, as the document would describe them. */
-	armed() {
-		const out = [];
-		for (const [name, gate] of this.gates) if (gate.on) out.push({
-			channel: name,
-			armedUntilMs: gate.armedUntilMs,
-			deviceIds: null
-		});
-		return out;
-	}
-};
-//#endregion
-//#region src/logging/log-channel.singleton.ts
-/**
-* Process-wide holder for the {@link LogChannelRegistry}.
-*
-* Three call sites that never meet need the SAME instance: the hot paths that
-* declare a gate at module scope, the `log-channels` provider that enumerates
-* the declarations for the hub, and the same provider applying the windows the
-* document hands down. A registry built inside any one of them would be
-* refreshed and collected — the shape of a knob that never does anything.
-*
-* Same idiom as `logging-gate.singleton.ts` and
-* `http-request-census.singleton.ts`.
-*/
-var instance = null;
-/** The process-wide log channel registry. Created empty on first use. */
-function getLogChannelRegistry() {
-	instance ??= new LogChannelRegistry();
-	return instance;
-}
-/**
-* Declare a channel on the process-wide registry and get its gate.
-*
-* The one call an addon makes. Keep the returned gate in a module-scope
-* `const`: looking a channel up by name per line would put a Map lookup on
-* exactly the path this mechanism exists to keep free.
-*
-* `scripts/check-log-channel-gated.ts` reads these call sites. It pairs the
-* declared name with the binding it is assigned to and refuses to let a
-* channel ship that no `<binding>.on` anywhere consults — a declared channel
-* nobody reads is a knob the operator turns with nothing happening, forever,
-* and without a line. That is D62, and this repo has now shipped it three
-* times (`audioThresholdDbfs`, the HA entities with no source, the second
-* per-camera switch that wrote a store nobody read).
-*/
-function declareLogChannel(descriptor) {
-	return getLogChannelRegistry().declare(descriptor);
-}
-/** Test-only: drop the instance so a spec starts from an empty registry. */
-function __resetLogChannelRegistryForTests() {
-	instance = null;
-}
-//#endregion
-//#region src/logging/log-channel-provider.ts
-/**
-* How often expiry is noticed. Coarse on purpose: the cost of a channel
-* running a few seconds past its deadline is a few extra lines, and the cost
-* of a tight timer in every addon process is paid forever.
-*/
-var LOG_CHANNEL_TICK_MS = 5e3;
-/**
-* Build the `log-channels` provider for this process.
-*
-* `logger` is used ONLY off the hot path — for the arm/expiry lines — so a
-* channel that is never armed costs this module nothing but a timer.
-*/
-function createLogChannelsProvider(logger, options = {}) {
-	const registry = getLogChannelRegistry();
-	const now = options.now ?? Date.now;
-	const tickMs = options.tickMs ?? 5e3;
-	const timer = setInterval(() => {
-		const closed = registry.tick(now());
-		for (const name of closed) logger.info("log channel window closed", {
-			tags: { logChannel: name },
-			meta: { channel: name }
-		});
-	}, tickMs);
-	timer.unref?.();
-	return {
-		list: () => registry.list(),
-		apply: (input) => {
-			const unknown = registry.apply(input.windows, now());
-			const armed = registry.armed();
-			logger.info("log channels applied", { meta: {
-				armed: armed.map((window) => window.channel),
-				unknown,
-				declared: registry.list().length
-			} });
-			return {
-				armed: armed.length,
-				unknown
-			};
-		},
-		stop: () => {
-			clearInterval(timer);
-		}
-	};
-}
-//#endregion
 //#region src/interfaces/ops-log.ts
 /**
 * Ops-log — the durable, append-only operations audit shared by the
@@ -3015,6 +2643,158 @@ var RECOGNITION_TYPES = [
 	"custom"
 ];
 //#endregion
+//#region src/interfaces/storage-location-mode.ts
+/**
+* The storage-location STATE MODEL (D385) — one typed state, one policy module.
+*
+* A location's state used to be split across two authorities: the typed
+* `enabled` field (THE write switch since D383) and an untyped `config.readOnly`
+* key. They did not mean the same thing — `enabled: false` was still evicted
+* under disk pressure while `config.readOnly` was deliberately excluded — and
+* neither name said which. Every consumer re-derived the difference, and the
+* three questions that actually matter were answered in six places.
+*
+* This module is the ONLY place in the repo allowed to interpret the state. It
+* answers three questions and nothing else:
+*
+*   - may this location be WRITTEN to?   {@link modeMayWrite}
+*   - may this location be READ?          {@link modeMayRead}
+*   - what is its eviction policy?        {@link evictionPolicyForMode}
+*
+* | mode       | write | read | eviction                       |
+* | ---------- | ----- | ---- | ------------------------------ |
+* | `active`   | yes   | yes  | `normal` (pressure + usage cap) |
+* | `readonly` | no    | yes  | `never`                        |
+* | `drain`    | no    | yes  | `drain` (paced, until empty)   |
+* | `disabled` | no    | no   | `never`                        |
+*
+* `scripts/check-storage-location-mode-single-owner.ts` fails the build when
+* anything outside this module reads `config['readOnly']` or compares `enabled`
+* directly. A rule nothing checks has already been broken somewhere.
+*/
+var STORAGE_LOCATION_MODES = [
+	"active",
+	"readonly",
+	"drain",
+	"disabled"
+];
+/**
+* The one typed state of a storage location. Authoritative Zod schema — the TS
+* alias below is `z.infer<>` of it, never a second spelling.
+*/
+var StorageLocationModeSchema = zod.z.enum(STORAGE_LOCATION_MODES);
+/**
+* What disk-pressure and usage-cap relief may do to a location.
+*
+* - `normal` — the existing behaviour: free-percent guard plus `maxUsedGb`.
+* - `never`  — excluded entirely. A retiring disk the operator is copying off
+*              must not race the relocate mover, and a disabled one is not the
+*              system's to erase.
+* - `drain`  — a monotonically descending effective usage cap, paced to what
+*              the ACTIVE locations of the same class gained (D386). This is
+*              the only policy that shrinks a location the system is not
+*              writing to.
+*/
+var StorageEvictionPolicySchema = zod.z.enum([
+	"normal",
+	"never",
+	"drain"
+]);
+/**
+* The legacy untyped drain key. Named ONCE, here, so the guard has exactly one
+* sanctioned reader and the string never appears anywhere else.
+*/
+var LEGACY_READ_ONLY_CONFIG_KEY = "readOnly";
+/** Is this mode a write target? Only `active` is. */
+function modeMayWrite(mode) {
+	return mode === "active";
+}
+/** May this mode be read (playback, timeline, scrub, relocate source)? */
+function modeMayRead(mode) {
+	return mode !== "disabled";
+}
+/** What eviction may do here. See {@link StorageEvictionPolicy}. */
+function evictionPolicyForMode(mode) {
+	switch (mode) {
+		case "active": return "normal";
+		case "drain": return "drain";
+		case "readonly":
+		case "disabled": return "never";
+	}
+}
+/**
+* The mode a LEGACY row implies, or `null` when it implies nothing — the row is
+* already stamped, or it carried neither flag.
+*
+* Both legacy flags fold to `readonly`, which is the CONSERVATIVE direction: a
+* state change must never start deleting footage on its own, and it must never
+* make footage that was still being served disappear. `enabled: false` used to
+* leave the location evictable under pressure; folding it to `readonly` stops
+* that, which is a strictly safer answer than the one it replaces.
+*/
+function legacyModeOf(location) {
+	if (location.mode !== void 0) return null;
+	if (location.config["readOnly"] === true) return "readonly";
+	if (location.enabled === false) return "readonly";
+	return null;
+}
+/**
+* The state of a location, stamped or folded. THE one interpretation: a row
+* that predates D385 is never ambiguous, and a stamped `mode` always wins over
+* whatever the legacy pair still says.
+*/
+function resolveLocationMode(location) {
+	return (isStorageLocationMode(location.mode) ? location.mode : void 0) ?? legacyModeOf(location) ?? "active";
+}
+/** Is this one of the four states? The stamped value crosses a wire, and a
+*  value nobody defined must not be rendered as if it were a state. */
+function isStorageLocationMode(value) {
+	return STORAGE_LOCATION_MODES.some((mode) => mode === value);
+}
+/** May this location be written to? */
+function mayWriteToLocation(location) {
+	return modeMayWrite(resolveLocationMode(location));
+}
+/** May this location be read? A `disabled` one may not — and that is an
+*  operator CHOICE, which callers must report as unavailable rather than as an
+*  unknown-location fault. */
+function mayReadLocation(location) {
+	return modeMayRead(resolveLocationMode(location));
+}
+/** What eviction may do to this location. */
+function evictionPolicyOfLocation(location) {
+	return evictionPolicyForMode(resolveLocationMode(location));
+}
+/**
+* The config blob with the retired drain key removed. Returns the SAME object
+* when there was nothing to strip, so a caller can tell "changed" from
+* "unchanged" by identity and skip a pointless persist.
+*/
+function strippedOfLegacyReadOnly(config) {
+	if (!("readOnly" in config)) return config;
+	const next = { ...config };
+	delete next[LEGACY_READ_ONLY_CONFIG_KEY];
+	return next;
+}
+/**
+* Set a location's mode, and with it everything that must agree with it.
+*
+* `enabled` stays readable for one release as a DERIVED value (`mode ===
+* 'active'`) so consumers that have not moved yet keep working, and the legacy
+* `config.readOnly` key is DELETED. This function is the only way to write
+* either, which is what makes it impossible for the two to disagree.
+*
+* Returns a new object — the input is never mutated.
+*/
+function withLocationMode(location, mode) {
+	return {
+		...location,
+		mode,
+		enabled: modeMayWrite(mode),
+		config: strippedOfLegacyReadOnly(location.config)
+	};
+}
+//#endregion
 //#region src/interfaces/storage-location.ts
 /**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
@@ -3041,8 +2821,11 @@ var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -3063,23 +2846,37 @@ var StorageLocationSchema = zod.z.object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: zod.z.string().optional(),
-	isDefault: zod.z.boolean().default(false),
 	isSystem: zod.z.boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: zod.z.boolean().optional(),
+	/**
+	* THE state of this location (D385), and the only authority on what may be
+	* written, read or evicted here. Interpreted in exactly one place —
+	* `storage-location-mode.ts` — which also folds the legacy
+	* `enabled` / `config.readOnly` pair into a mode so an old row is never
+	* ambiguous.
+	*
+	* OPTIONAL only for the wire and for rows written before D385: absence is
+	* resolved by `resolveLocationMode`, and the orchestrator stamps every
+	* unstamped row ONCE at hydrate so absence stops existing rather than being
+	* re-derived on every read. `enabled` survives one release as a DERIVED
+	* mirror (`mode === 'active'`); `withLocationMode` is the only writer of
+	* either, so the two cannot disagree.
+	*/
+	mode: StorageLocationModeSchema.optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
 	*  for node-local locations it can reach) — never persisted, absent when the
 	*  volume is remote/unreachable. The single capacity truth every UI reads. */
@@ -3087,13 +2884,83 @@ var StorageLocationSchema = zod.z.object({
 		totalBytes: zod.z.number(),
 		availableBytes: zod.z.number()
 	}).nullable().optional(),
+	/**
+	* How much of that volume CamStack ITSELF holds on this location (D388) —
+	* COMPUTED at read time from the `storage-occupancy` providers' own figures,
+	* never persisted, never a filesystem walk.
+	*
+	* **ABSENT MEANS UNKNOWN, never zero.** No provider has reported for this
+	* location yet — nobody stores here, the owning addon is down, or the first
+	* refresh has not completed. A UI must omit the segment rather than draw it
+	* at zero, which would claim we occupy nothing (D315). It is an OBJECT and
+	* not a bare number precisely so that a `?? 0` on the consuming side has to
+	* be spelled out loud instead of appearing by accident.
+	*
+	* `measuredAtMs` is the OLDEST contributing measurement, so it is honest
+	* about the whole figure rather than about its freshest part.
+	*/
+	owned: zod.z.object({
+		bytes: zod.z.number().int().nonnegative(),
+		measuredAtMs: zod.z.number().int().nonnegative()
+	}).optional(),
 	createdAt: zod.z.number(),
 	updatedAt: zod.z.number()
 });
 /**
+* The retired `isDefault` key, DECLARED rather than dropped.
+*
+* A key removed from a non-strict `z.object` is stripped in silence (D380,
+* D381): a reader that still needs the old value gets `undefined` and cannot
+* tell "absent" from "never sent". The one reader that legitimately needs it —
+* the location store's boot migration, which turns the old default flag into
+* the `enabled` write set — parses THIS schema against the raw row instead, so
+* the migration is explicit and the live schema stays clean. Nothing else in
+* the repo may read it; `scripts/check-no-storage-default.ts` enforces that.
+*/
+var LegacyStorageLocationDefaultSchema = zod.z.object({ isDefault: zod.z.boolean().optional() });
+function isLocationEnabled(location) {
+	return mayWriteToLocation({
+		...location,
+		config: location.config ?? {}
+	});
+}
+/**
+* Bytes in one GB, for every storage figure an operator types.
+*
+* BINARY (1024³), everywhere. The repo had both: the orchestrator's
+* `maxUsedGb` → bytes conversion used 1024³ while the recorder's placement
+* headroom used 10⁹ for the SAME stored key, so a location with a cap set was
+* silently 7.4% off depending on which side of the pipe asked. The persisted
+* values were entered against the binary unit and the admin UI reads it, so
+* that is the one that stays. Every GB knob — `maxUsedGb`, `minFreeGb` —
+* converts through {@link gbToBytes} and nowhere else.
+*/
+var STORAGE_BYTES_PER_GB = 1024 ** 3;
+/** GB → bytes, binary. Fractional GB is admitted and floored. */
+function gbToBytes(gb) {
+	return Math.floor(gb * STORAGE_BYTES_PER_GB);
+}
+/**
+* How far a `drain` has got (D386) — the read a UI renders, and nothing more.
+*
+* `estimatedEmptyAtMs` is derived from the growth the ratchet has actually
+* OBSERVED and is `null` when it has observed none. Never a fabricated date: a
+* drain with no observed growth has no honest ETA, and inventing one is how an
+* operator learns not to believe the screen.
+*/
+var StorageDrainProgressSchema = zod.z.object({
+	locationId: zod.z.string(),
+	startedAtMs: zod.z.number(),
+	startBytes: zod.z.number(),
+	bytesRemaining: zod.z.number(),
+	drained: zod.z.boolean(),
+	estimatedEmptyAtMs: zod.z.number().nullable()
+});
+/**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -3457,358 +3324,535 @@ function findTimezone(id) {
 	return TIMEZONES.find((tz) => tz.id === id);
 }
 //#endregion
-//#region src/stream-selection.ts
-function pickPreferredRtspEntry(entries, pref, deviceId, options = {}) {
-	if (entries.length === 0) return null;
-	const prefix = `${deviceId}/`;
-	const toPicked = (e) => ({
-		brokerId: e.brokerId,
-		profileId: e.brokerId.startsWith(prefix) ? e.brokerId.slice(prefix.length) : e.brokerId,
-		url: e.url,
-		mutedUrl: e.mutedUrl,
-		enabled: e.enabled,
-		...e.codec !== void 0 ? { codec: e.codec } : {},
-		...e.resolution !== void 0 ? { resolution: e.resolution } : {}
-	});
-	if (pref !== "auto") {
-		const match = entries.find((e) => e.enabled && e.url.length > 0 && (e.profile === pref || e.brokerId === `${prefix}${pref}`));
-		if (match) return toPicked(match);
-	}
-	const eligible = entries.filter((e) => e.enabled && e.url.length > 0);
-	if (eligible.length === 0) return null;
-	const target = options.targetResolution;
-	if (target) {
-		const withRes = eligible.filter((e) => e.resolution !== void 0);
-		if (withRes.length > 0) {
-			const picked = pickClosestResolution(withRes, target);
-			if (picked) return toPicked(picked);
-		}
-	}
-	return toPicked(eligible[0]);
-}
-/**
-* Pick the entry whose `resolution` is closest to `target`. Prefer
-* entries ≥ target (downscale is cheap at the consumer; upscale is
-* lossy). Among the rest pick the LARGEST still ≤ target so the
-* consumer gets the best feasible quality. "Closeness" is the
-* `width × height` pixel delta.
-*/
-function pickClosestResolution(entries, target) {
-	const targetPixels = target.width * target.height;
-	let bestAbove;
-	let bestBelow;
-	for (const e of entries) {
-		if (e.resolution === void 0) continue;
-		const pixels = e.resolution.width * e.resolution.height;
-		if (pixels >= targetPixels) {
-			if (!bestAbove || pixels < bestAbove.pixels) bestAbove = {
-				entry: e,
-				pixels
-			};
-		} else if (!bestBelow || pixels > bestBelow.pixels) bestBelow = {
-			entry: e,
-			pixels
-		};
-	}
-	return bestAbove?.entry ?? bestBelow?.entry;
-}
-//#endregion
-//#region src/metrics/load-series-fold.ts
-/** Bucket key for rows no addon owns. Stable, so its series is continuous. */
-var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
-var ROOT_BUCKET_KEY = "__root__";
-function bucketFor(row) {
-	if (row.addonId !== null) return {
-		key: row.addonId,
-		kind: "addon"
-	};
-	if (row.classification === "root") return {
-		key: ROOT_BUCKET_KEY,
-		kind: "root"
-	};
-	return {
-		key: UNATTRIBUTED_BUCKET_KEY,
-		kind: "unattributed"
-	};
-}
-/** Round to one decimal — the precision both producers already emit at. */
-function deci(value) {
-	return Math.round(value * 10) / 10;
-}
-/**
-* Fold one snapshot into one point per function.
-*
-* Produces a ONE-SAMPLE point: `min === max` on every field, `samples === 1`.
-* That is what lets a live event and a reduced server bucket sit in the same
-* series without the consumer knowing which is which.
-*/
-function foldSnapshotByFunction(rows, atMs) {
-	const acc = /* @__PURE__ */ new Map();
-	for (const row of rows) {
-		const { key, kind } = bucketFor(row);
-		const cur = acc.get(key) ?? {
-			kind,
-			main: 0,
-			gc: 0,
-			lifetime: 0,
-			memory: 0,
-			count: 0,
-			splitKnown: true
-		};
-		const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
-		acc.set(key, {
-			kind: cur.kind,
-			main: cur.main + (row.cpuMainPercent ?? 0),
-			gc: cur.gc + (row.cpuGcPercent ?? 0),
-			lifetime: cur.lifetime + row.cpuPercent,
-			memory: cur.memory + row.memoryRssBytes,
-			count: cur.count + 1,
-			splitKnown: cur.splitKnown && known
-		});
-	}
-	return [...acc.entries()].map(([key, a]) => {
-		const main = a.splitKnown ? deci(a.main) : null;
-		const gc = a.splitKnown ? deci(a.gc) : null;
-		const lifetime = deci(a.lifetime);
-		return {
-			key,
-			kind: a.kind,
-			point: {
-				atMs,
-				samples: 1,
-				cpuMainPercent: main,
-				cpuMainPercentMin: main,
-				cpuGcPercent: gc,
-				cpuGcPercentMin: gc,
-				cpuLifetimePercent: lifetime,
-				cpuLifetimePercentMin: lifetime,
-				memoryRssBytes: a.memory,
-				memoryRssBytesMin: a.memory,
-				processCount: a.count,
-				processCountMin: a.count
-			}
-		};
-	});
-}
-/** The narrower of two bounds, treating `null` (UNKNOWN) as absorbing. */
-function minNullable(a, b) {
-	if (a === null || b === null) return null;
-	return a < b ? a : b;
-}
-function maxNullable(a, b) {
-	if (a === null || b === null) return null;
-	return a > b ? a : b;
-}
-/** Merge `next` into `held`, keeping the widest [min, max] of each field. */
-function mergePoints(held, next, atMs) {
-	return {
-		atMs,
-		samples: held.samples + next.samples,
-		cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
-		cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
-		cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
-		cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
-		cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
-		cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
-		memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
-		memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
-		processCount: Math.max(held.processCount, next.processCount),
-		processCountMin: Math.min(held.processCountMin, next.processCountMin)
-	};
-}
-/**
-* The bucket width that brings `spanMs` down to at most `maxPoints` points,
-* snapped up to a whole multiple of the sampling cadence.
-*
-* Returns `cadenceMs` (no reduction) when the span already fits. A caller that
-* asks for a `maxPoints` of 0 or less gets no reduction rather than an
-* infinite bucket — a nonsensical request must not produce a plausible chart.
-*/
-function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
-	if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
-	const wanted = spanMs / maxPoints;
-	if (wanted <= cadenceMs) return cadenceMs;
-	return Math.ceil(wanted / cadenceMs) * cadenceMs;
-}
-/**
-* Reduce one function's points into buckets of `bucketMs`, preserving the
-* extremes.
-*
-* Points are expected oldest-first and are returned oldest-first. A bucket
-* with no samples is ABSENT — not zero, not interpolated, not the previous
-* value held over.
-*/
-function reducePoints(points, bucketMs, origin) {
-	if (bucketMs <= 0 || points.length === 0) return points;
-	const buckets = /* @__PURE__ */ new Map();
-	for (const point of points) {
-		const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
-		const held = buckets.get(start);
-		buckets.set(start, held === void 0 ? {
-			...point,
-			atMs: start
-		} : mergePoints(held, point, start));
-	}
-	return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
-}
-//#endregion
-//#region src/metrics/failure-counters.ts
+//#region src/logging/log-channel.ts
 /**
-* `FailureCounters` — the per-camera counter every "how often does this camera
-* lose work, and why" question is answered from.
-*
-* ## Why a primitive and not four counters
-*
-* Four open failure modes were being triaged on 2026-08-28 and every one of
-* them was measured the same way: grep a log line, count it, and then guess at
-* the denominator. The guess is the defect. `enrichment crop native miss` read
-* as "35x worse than yesterday" and turned out to be **flat all day** the
-* moment it was divided by the successes on the same path — 0.25 misses per
-* landed capture, 0.08–0.33 across twelve hours, no trend. The count moved
-* because the traffic moved.
-*
-* So the unit here is not a counter. It is a **ratio with its denominator
-* attached**: {@link FailureCounterSample.attempts} is incremented on every
-* try, {@link FailureCounterSample.succeeded} on the ones that landed, and the
-* reasons partition the rest. A consumer can always divide; it can never
-* un-divide a bare count.
-*
-* ## Per camera, always
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
 *
-* The key is the numeric `deviceId` — the same value every log line in this
-* repo carries as `tags.deviceId`. There is no fleet-total mode and no
-* device-less bucket, because the question is always "why is 617 worse than
-* 615?" and a fleet total cannot answer it. A caller that cannot name the
-* camera must not note anything: an unnamed per-camera count is
-* indistinguishable from a shared one, which is how one camera's failures
-* quietly become everybody's.
+* ## Two axes, deliberately separated
 *
-* ## Cumulative, never drained
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
 *
-* A read NEVER resets anything. `load-contribution.cap.ts` already argued this
-* for CPU seconds and the argument carries over verbatim: *"a rate needs a
-* window, a window needs a sampler, and a new per-node sampler is the defect
-* half of `docs/architecture/load-ledger.md` documents. A counter can be
-* differenced by whoever already keeps a history; a rate cannot be
-* un-averaged."* A draining read has a second failure this surface cannot
-* afford — two consumers polling it would each destroy half of the other's
-* numbers, silently.
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
 *
-* {@link FailureCounterSample.sinceMs} is the incarnation marker: it is when
-* this counter started, and a consumer differencing two reads must drop the
-* interval when it changes, because the counter restarted from zero in a new
-* process.
+* ## The canonical call shape
 *
-* ## Bounded, and the bound is the point
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
 *
-* This lives in the memory of a process that is already the subject of an RSS
-* budget, so both dimensions are capped: {@link MAX_KEYS} counters and
-* {@link MAX_REASONS_PER_KEY} distinct reasons within one. Past the reason cap
-* the counts are folded into {@link OVERFLOW_REASON} rather than dropped —
-* losing them would make `attempts - succeeded` stop equalling the reason
-* total, and the ratio the whole surface exists to publish would quietly stop
-* adding up. Past the key cap a new key is refused and
-* {@link FailureCounters.keysRefused} says so, so the omission is visible
-* instead of silent.
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
 *
-* ## No timers, no IO, no logging
+* ## Why a channel emits at `info`
 *
-* Pure. It is read on whatever beat the caller already has. A telemetry
-* primitive that schedules its own work is a second sampler, and this repo has
-* paid for one of those already (`docs/architecture/load-ledger.md`).
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
 */
-/** Distinct reason strings kept per counter before folding. */
-var MAX_REASONS_PER_KEY = 16;
 /**
-* Distinct (device, family, variant) counters one instance will hold.
+* The level a channel writes at once armed.
 *
-* A large fleet x the handful of families any single addon reports, with
-* slack. At ~200 B per counter this is a ~100 KB ceiling on a process that
-* already declares an RSS budget in the gigabytes.
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
 */
-var MAX_KEYS = 1024;
+var LogChannelLevelSchema = zod.z.enum([
+	"info",
+	"warn",
+	"error"
+]);
 /**
-* Where reasons past {@link MAX_REASONS_PER_KEY} go.
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = zod.z.object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: zod.z.string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: zod.z.string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: zod.z.boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
 *
-* They are FOLDED, never dropped: `attempts - succeeded` must always equal the
-* sum of the reason counts, or the ratio stops adding up.
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
 */
-var OVERFLOW_REASON = "other";
-/** `deviceId` + `family` + optional `variant`, flattened into the map key. */
-function counterKey(deviceId, family, variant) {
-	return variant === void 0 ? `${deviceId}${family}` : `${deviceId}${family}${variant}`;
-}
+var LogChannelWindowSchema = zod.z.object({
+	channel: zod.z.string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: zod.z.number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: zod.z.array(zod.z.number().int()).readonly().nullable()
+});
 /**
-* A bounded set of per-camera, cumulative failure counters.
+* The gate a hot path holds.
 *
-* One instance per contributing subsystem. `note` is O(1) and allocation-free
-* on the steady path; `snapshot` reads without mutating anything.
+* Obtain it ONCE — at module scope or in a constructor — and keep the
+* reference. Looking a channel up by name per line would put a Map lookup on
+* the path this class exists to keep free.
 */
-var FailureCounters = class {
-	maxKeys;
-	maxReasons;
-	counters = /* @__PURE__ */ new Map();
-	refused = 0;
-	constructor(maxKeys = MAX_KEYS, maxReasons = 16) {
-		this.maxKeys = maxKeys;
-		this.maxReasons = maxReasons;
-	}
+var LogChannelGate = class {
+	descriptor;
 	/**
-	* Counters refused because {@link MAX_KEYS} was already held.
+	* HOT PATH GUARD. A plain data FIELD, and it must stay one.
 	*
-	* Cumulative for the life of the instance: a bound that bit is a fact about
-	* the deployment, and a surface that hid it would under-report a fleet
-	* precisely when the fleet got large enough to matter.
+	* `log-channel.spec.ts` asserts the property descriptor has no getter and
+	* booby-traps the device set, so turning this into an accessor — or reading
+	* anything before it — fails the spec instead of taxing every line the
+	* process emits.
 	*/
-	get keysRefused() {
-		return this.refused;
+	on = false;
+	/** `null` while armed for every camera. Never read while `on` is false. */
+	devices = null;
+	level;
+	closesAtMs = 0;
+	constructor(descriptor) {
+		this.descriptor = descriptor;
+		this.level = descriptor.defaultLevel;
 	}
-	/** Counters currently held. */
-	get size() {
-		return this.counters.size;
+	/** Epoch ms this channel disarms itself at. 0 when disarmed. */
+	get armedUntilMs() {
+		return this.on ? this.closesAtMs : 0;
 	}
 	/**
-	* Fold one observation in.
+	* Does this channel want a line about `deviceId`?
 	*
-	* A non-positive or non-integer `deviceId` is REFUSED rather than bucketed:
-	* see the module docblock — an entry that cannot name its camera is worse
-	* than no entry.
+	* Call it only behind `gate.on &&`. On its own it is still correct — the
+	* guard is repeated inside — but the point of the prefix is that a disarmed
+	* channel must not pay the call at all.
 	*/
-	note(observation, nowMs) {
-		if (!Number.isInteger(observation.deviceId) || observation.deviceId <= 0) return;
-		const key = counterKey(observation.deviceId, observation.family, observation.variant);
-		let counter = this.counters.get(key);
-		if (counter === void 0) {
-			if (this.counters.size >= this.maxKeys) {
-				this.refused += 1;
-				return;
-			}
-			counter = {
-				deviceId: observation.deviceId,
-				family: observation.family,
-				variant: observation.variant,
-				sinceMs: nowMs,
-				attempts: 0,
-				succeeded: 0,
-				reasons: /* @__PURE__ */ new Map()
-			};
-			this.counters.set(key, counter);
-		}
-		counter.attempts += 1;
-		if (observation.reason === void 0) {
-			counter.succeeded += 1;
-			return;
-		}
-		const reason = counter.reasons.has(observation.reason) || counter.reasons.size < this.maxReasons ? observation.reason : OVERFLOW_REASON;
-		counter.reasons.set(reason, (counter.reasons.get(reason) ?? 0) + 1);
+	wants(deviceId) {
+		if (!this.on) return false;
+		return this.devices === null || this.devices.has(deviceId);
 	}
-	/** Read every counter. Never mutates — see the module docblock. */
-	snapshot(nowMs) {
-		const out = [];
-		for (const counter of this.counters.values()) out.push({
-			deviceId: counter.deviceId,
-			family: counter.family,
-			...counter.variant !== void 0 ? { variant: counter.variant } : {},
+	/**
+	* Emit one line on this channel, at the channel's declared level.
+	*
+	* The channel name is added as `tags.logChannel` so LogQL can select the
+	* channel without matching on the message text, and whatever `tags` the
+	* caller passed — `deviceId` above all — is preserved.
+	*/
+	log(logger, message, extras) {
+		if (!this.on) return;
+		const tags = {
+			...extras.tags,
+			logChannel: this.descriptor.name
+		};
+		const line = {
+			...extras,
+			tags
+		};
+		if (this.level === "error") logger.error(message, line);
+		else if (this.level === "warn") logger.warn(message, line);
+		else logger.info(message, line);
+	}
+	/**
+	* Arm (or RE-arm, restarting) this channel. Off the hot path only.
+	*
+	* An empty `deviceIds` list is treated as "every camera" rather than "no
+	* camera": a window that matches nothing is indistinguishable from a
+	* disarmed one, and the operator who asked for it would wait for lines that
+	* can never come.
+	*/
+	arm(window) {
+		const ids = window.deviceIds;
+		this.devices = ids === null || ids.length === 0 ? null : new Set(ids);
+		this.closesAtMs = window.armedUntilMs;
+		this.on = true;
+	}
+	/** Disarm. Off the hot path only. */
+	disarm() {
+		this.on = false;
+		this.devices = null;
+		this.closesAtMs = 0;
+	}
+};
+/**
+* Every channel this PROCESS declares, and the mirror of what is armed on it.
+*
+* One per process. A forked runner has its own, and it is refreshed through
+* the `log-channels` capability by the hub that owns the document — the
+* registry never reaches for a value itself.
+*/
+var LogChannelRegistry = class {
+	gates = /* @__PURE__ */ new Map();
+	/**
+	* Declare a channel and get its gate.
+	*
+	* A duplicate name throws. Two declarations of one name is a programming
+	* error, not a merge: the operator would arm one and the other would stay
+	* dark, which is the dead-knob shape (D62) with an extra step.
+	*/
+	declare(descriptor) {
+		const parsed = LogChannelDescriptorSchema.parse(descriptor);
+		if (this.gates.get(parsed.name) !== void 0) throw new Error(`log channel "${parsed.name}" is already declared in this process — two declarations of one name is a programming error, not a merge`);
+		const gate = new LogChannelGate(parsed);
+		this.gates.set(parsed.name, gate);
+		return gate;
+	}
+	/** The declarations, sorted by name so a list is stable to read and diff. */
+	list() {
+		return [...this.gates.values()].map((gate) => gate.descriptor).sort((a, b) => a.name.localeCompare(b.name));
+	}
+	/** The gate for a declared channel, or `undefined`. */
+	gate(name) {
+		return this.gates.get(name);
+	}
+	/**
+	* Apply the FULL set of armed windows. Off the hot path.
+	*
+	* Full, not incremental, and that is the whole design: the document is the
+	* authority, so a channel the document does not name is disarmed here. An
+	* incremental apply would let a disarm get lost in transit and leave a
+	* channel running that nobody can see is running.
+	*
+	* A window already past its deadline is ignored rather than armed — a
+	* restore that re-armed an expired window would make a forgotten diagnostic
+	* immortal across restarts.
+	*
+	* Returns the names it could not place, so the caller can log them: a
+	* channel named in the document that this process does not declare is
+	* either a typo or an addon that has not booted yet, and both deserve a
+	* line rather than silence.
+	*/
+	apply(windows, nowMs) {
+		const wanted = /* @__PURE__ */ new Map();
+		const unknown = [];
+		for (const window of windows) {
+			if (window.armedUntilMs <= nowMs) continue;
+			if (!this.gates.has(window.channel)) {
+				unknown.push(window.channel);
+				continue;
+			}
+			wanted.set(window.channel, window);
+		}
+		for (const [name, gate] of this.gates) {
+			const window = wanted.get(name);
+			if (window === void 0) gate.disarm();
+			else gate.arm(window);
+		}
+		return unknown;
+	}
+	/**
+	* Disarm whatever has run out. Called on a timer, NEVER from a log path — a
+	* diagnostic that adds a `Date.now()` to the path it is measuring measures
+	* itself.
+	*
+	* Returns the names it closed, so the caller can write the one line that
+	* says a window ended and stops "it went quiet" from reading as "the branch
+	* was not taken".
+	*/
+	tick(nowMs) {
+		const closed = [];
+		for (const [name, gate] of this.gates) if (gate.on && gate.armedUntilMs <= nowMs) {
+			gate.disarm();
+			closed.push(name);
+		}
+		return closed;
+	}
+	/** The channels armed right now, as the document would describe them. */
+	armed() {
+		const out = [];
+		for (const [name, gate] of this.gates) if (gate.on) out.push({
+			channel: name,
+			armedUntilMs: gate.armedUntilMs,
+			deviceIds: null
+		});
+		return out;
+	}
+};
+//#endregion
+//#region src/logging/log-channel.singleton.ts
+/**
+* Process-wide holder for the {@link LogChannelRegistry}.
+*
+* Three call sites that never meet need the SAME instance: the hot paths that
+* declare a gate at module scope, the `log-channels` provider that enumerates
+* the declarations for the hub, and the same provider applying the windows the
+* document hands down. A registry built inside any one of them would be
+* refreshed and collected — the shape of a knob that never does anything.
+*
+* Same idiom as `logging-gate.singleton.ts` and
+* `http-request-census.singleton.ts`.
+*/
+var instance = null;
+/** The process-wide log channel registry. Created empty on first use. */
+function getLogChannelRegistry() {
+	instance ??= new LogChannelRegistry();
+	return instance;
+}
+/**
+* Declare a channel on the process-wide registry and get its gate.
+*
+* The one call an addon makes. Keep the returned gate in a module-scope
+* `const`: looking a channel up by name per line would put a Map lookup on
+* exactly the path this mechanism exists to keep free.
+*
+* `scripts/check-log-channel-gated.ts` reads these call sites. It pairs the
+* declared name with the binding it is assigned to and refuses to let a
+* channel ship that no `<binding>.on` anywhere consults — a declared channel
+* nobody reads is a knob the operator turns with nothing happening, forever,
+* and without a line. That is D62, and this repo has now shipped it three
+* times (`audioThresholdDbfs`, the HA entities with no source, the second
+* per-camera switch that wrote a store nobody read).
+*/
+function declareLogChannel(descriptor) {
+	return getLogChannelRegistry().declare(descriptor);
+}
+/** Test-only: drop the instance so a spec starts from an empty registry. */
+function __resetLogChannelRegistryForTests() {
+	instance = null;
+}
+//#endregion
+//#region src/logging/log-channel-provider.ts
+/**
+* How often expiry is noticed. Coarse on purpose: the cost of a channel
+* running a few seconds past its deadline is a few extra lines, and the cost
+* of a tight timer in every addon process is paid forever.
+*/
+var LOG_CHANNEL_TICK_MS = 5e3;
+/**
+* Build the `log-channels` provider for this process.
+*
+* `logger` is used ONLY off the hot path — for the arm/expiry lines — so a
+* channel that is never armed costs this module nothing but a timer.
+*/
+function createLogChannelsProvider(logger, options = {}) {
+	const registry = getLogChannelRegistry();
+	const now = options.now ?? Date.now;
+	const tickMs = options.tickMs ?? 5e3;
+	const timer = setInterval(() => {
+		const closed = registry.tick(now());
+		for (const name of closed) logger.info("log channel window closed", {
+			tags: { logChannel: name },
+			meta: { channel: name }
+		});
+	}, tickMs);
+	timer.unref?.();
+	return {
+		list: () => registry.list(),
+		apply: (input) => {
+			const unknown = registry.apply(input.windows, now());
+			const armed = registry.armed();
+			logger.info("log channels applied", { meta: {
+				armed: armed.map((window) => window.channel),
+				unknown,
+				declared: registry.list().length
+			} });
+			return {
+				armed: armed.length,
+				unknown
+			};
+		},
+		stop: () => {
+			clearInterval(timer);
+		}
+	};
+}
+//#endregion
+//#region src/metrics/failure-counters.ts
+/**
+* `FailureCounters` — the per-camera counter every "how often does this camera
+* lose work, and why" question is answered from.
+*
+* ## Why a primitive and not four counters
+*
+* Four open failure modes were being triaged on 2026-08-28 and every one of
+* them was measured the same way: grep a log line, count it, and then guess at
+* the denominator. The guess is the defect. `enrichment crop native miss` read
+* as "35x worse than yesterday" and turned out to be **flat all day** the
+* moment it was divided by the successes on the same path — 0.25 misses per
+* landed capture, 0.08–0.33 across twelve hours, no trend. The count moved
+* because the traffic moved.
+*
+* So the unit here is not a counter. It is a **ratio with its denominator
+* attached**: {@link FailureCounterSample.attempts} is incremented on every
+* try, {@link FailureCounterSample.succeeded} on the ones that landed, and the
+* reasons partition the rest. A consumer can always divide; it can never
+* un-divide a bare count.
+*
+* ## Per camera, always
+*
+* The key is the numeric `deviceId` — the same value every log line in this
+* repo carries as `tags.deviceId`. There is no fleet-total mode and no
+* device-less bucket, because the question is always "why is 617 worse than
+* 615?" and a fleet total cannot answer it. A caller that cannot name the
+* camera must not note anything: an unnamed per-camera count is
+* indistinguishable from a shared one, which is how one camera's failures
+* quietly become everybody's.
+*
+* ## Cumulative, never drained
+*
+* A read NEVER resets anything. `load-contribution.cap.ts` already argued this
+* for CPU seconds and the argument carries over verbatim: *"a rate needs a
+* window, a window needs a sampler, and a new per-node sampler is the defect
+* half of `docs/architecture/load-ledger.md` documents. A counter can be
+* differenced by whoever already keeps a history; a rate cannot be
+* un-averaged."* A draining read has a second failure this surface cannot
+* afford — two consumers polling it would each destroy half of the other's
+* numbers, silently.
+*
+* {@link FailureCounterSample.sinceMs} is the incarnation marker: it is when
+* this counter started, and a consumer differencing two reads must drop the
+* interval when it changes, because the counter restarted from zero in a new
+* process.
+*
+* ## Bounded, and the bound is the point
+*
+* This lives in the memory of a process that is already the subject of an RSS
+* budget, so both dimensions are capped: {@link MAX_KEYS} counters and
+* {@link MAX_REASONS_PER_KEY} distinct reasons within one. Past the reason cap
+* the counts are folded into {@link OVERFLOW_REASON} rather than dropped —
+* losing them would make `attempts - succeeded` stop equalling the reason
+* total, and the ratio the whole surface exists to publish would quietly stop
+* adding up. Past the key cap a new key is refused and
+* {@link FailureCounters.keysRefused} says so, so the omission is visible
+* instead of silent.
+*
+* ## No timers, no IO, no logging
+*
+* Pure. It is read on whatever beat the caller already has. A telemetry
+* primitive that schedules its own work is a second sampler, and this repo has
+* paid for one of those already (`docs/architecture/load-ledger.md`).
+*/
+/** Distinct reason strings kept per counter before folding. */
+var MAX_REASONS_PER_KEY = 16;
+/**
+* Distinct (device, family, variant) counters one instance will hold.
+*
+* A large fleet x the handful of families any single addon reports, with
+* slack. At ~200 B per counter this is a ~100 KB ceiling on a process that
+* already declares an RSS budget in the gigabytes.
+*/
+var MAX_KEYS = 1024;
+/**
+* Where reasons past {@link MAX_REASONS_PER_KEY} go.
+*
+* They are FOLDED, never dropped: `attempts - succeeded` must always equal the
+* sum of the reason counts, or the ratio stops adding up.
+*/
+var OVERFLOW_REASON = "other";
+/** `deviceId` + `family` + optional `variant`, flattened into the map key. */
+function counterKey(deviceId, family, variant) {
+	return variant === void 0 ? `${deviceId}${family}` : `${deviceId}${family}${variant}`;
+}
+/**
+* A bounded set of per-camera, cumulative failure counters.
+*
+* One instance per contributing subsystem. `note` is O(1) and allocation-free
+* on the steady path; `snapshot` reads without mutating anything.
+*/
+var FailureCounters = class {
+	maxKeys;
+	maxReasons;
+	counters = /* @__PURE__ */ new Map();
+	refused = 0;
+	constructor(maxKeys = MAX_KEYS, maxReasons = 16) {
+		this.maxKeys = maxKeys;
+		this.maxReasons = maxReasons;
+	}
+	/**
+	* Counters refused because {@link MAX_KEYS} was already held.
+	*
+	* Cumulative for the life of the instance: a bound that bit is a fact about
+	* the deployment, and a surface that hid it would under-report a fleet
+	* precisely when the fleet got large enough to matter.
+	*/
+	get keysRefused() {
+		return this.refused;
+	}
+	/** Counters currently held. */
+	get size() {
+		return this.counters.size;
+	}
+	/**
+	* Fold one observation in.
+	*
+	* A non-positive or non-integer `deviceId` is REFUSED rather than bucketed:
+	* see the module docblock — an entry that cannot name its camera is worse
+	* than no entry.
+	*/
+	note(observation, nowMs) {
+		if (!Number.isInteger(observation.deviceId) || observation.deviceId <= 0) return;
+		const key = counterKey(observation.deviceId, observation.family, observation.variant);
+		let counter = this.counters.get(key);
+		if (counter === void 0) {
+			if (this.counters.size >= this.maxKeys) {
+				this.refused += 1;
+				return;
+			}
+			counter = {
+				deviceId: observation.deviceId,
+				family: observation.family,
+				variant: observation.variant,
+				sinceMs: nowMs,
+				attempts: 0,
+				succeeded: 0,
+				reasons: /* @__PURE__ */ new Map()
+			};
+			this.counters.set(key, counter);
+		}
+		counter.attempts += 1;
+		if (observation.reason === void 0) {
+			counter.succeeded += 1;
+			return;
+		}
+		const reason = counter.reasons.has(observation.reason) || counter.reasons.size < this.maxReasons ? observation.reason : OVERFLOW_REASON;
+		counter.reasons.set(reason, (counter.reasons.get(reason) ?? 0) + 1);
+	}
+	/** Read every counter. Never mutates — see the module docblock. */
+	snapshot(nowMs) {
+		const out = [];
+		for (const counter of this.counters.values()) out.push({
+			deviceId: counter.deviceId,
+			family: counter.family,
+			...counter.variant !== void 0 ? { variant: counter.variant } : {},
 			sinceMs: counter.sinceMs,
 			atMs: nowMs,
 			attempts: counter.attempts,
@@ -3836,64 +3880,259 @@ function failureRate(sample) {
 	return (sample.attempts - sample.succeeded) / sample.attempts;
 }
 //#endregion
-//#region src/types/model-variant-groups.ts
-var FORMAT_KEYS = [
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt"
-];
-/**
-* Display spelling of a family. Uppercasing the id is wrong for any family
-* whose name is not all-caps — it rendered `yolov9` as "YOLOV9", a word the
-* product uses nowhere else (the catalog, the docs and the model files all say
-* "YOLOv9").
-*/
-var FAMILY_LABEL = {
-	yolo26: "YOLO26",
-	yolov9: "YOLOv9"
-};
-function familyLabel(family) {
-	return FAMILY_LABEL[family] ?? family.toUpperCase();
+//#region src/metrics/load-series-fold.ts
+/** Bucket key for rows no addon owns. Stable, so its series is continuous. */
+var UNATTRIBUTED_BUCKET_KEY = "__unattributed__";
+var ROOT_BUCKET_KEY = "__root__";
+function bucketFor(row) {
+	if (row.addonId !== null) return {
+		key: row.addonId,
+		kind: "addon"
+	};
+	if (row.classification === "root") return {
+		key: ROOT_BUCKET_KEY,
+		kind: "root"
+	};
+	return {
+		key: UNATTRIBUTED_BUCKET_KEY,
+		kind: "unattributed"
+	};
+}
+/** Round to one decimal — the precision both producers already emit at. */
+function deci(value) {
+	return Math.round(value * 10) / 10;
 }
-/** `@640`, `@320×320`, `@ 256` — a resolution stated inside a model name. */
-var RESOLUTION_IN_NAME = /\s*@\s*\d+\s*(?:[x×]\s*\d+)?/gi;
 /**
-* Strip a leading family label AND any stated resolution from a base model name
-* → clean tier label.
+* Fold one snapshot into one point per function.
 *
-* The resolution strip is not cosmetic. The tier is chosen BEFORE the
-* resolution chip, and a family whose builds all state their input (our yolov9
-* ships only 320 and 640, no resolution-less build) made the tier inherit its
-* base entry's name verbatim: the ladder read "Tiny @640 / Small @640 / …" and
-* kept saying 640 while the operator had 320 selected below it.
+* Produces a ONE-SAMPLE point: `min === max` on every field, `samples === 1`.
+* That is what lets a live event and a reduced server bucket sit in the same
+* series without the consumer knowing which is which.
 */
-function tierLabel(family, baseName) {
-	const fl = familyLabel(family);
-	const stripped = baseName.replace(new RegExp(`^${fl}\\s+`, "i"), "").replace(RESOLUTION_IN_NAME, "").trim();
-	return stripped.length > 0 ? stripped : baseName;
-}
-function variantLabel(precision, optimization) {
-	const parts = [];
-	if (optimization === "fast") parts.push("Fast");
-	parts.push(precision === "int8" ? "Int8" : "Standard");
-	return parts.join(" · ");
+function foldSnapshotByFunction(rows, atMs) {
+	const acc = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const { key, kind } = bucketFor(row);
+		const cur = acc.get(key) ?? {
+			kind,
+			main: 0,
+			gc: 0,
+			lifetime: 0,
+			memory: 0,
+			count: 0,
+			splitKnown: true
+		};
+		const known = row.cpuMainPercent !== null && row.cpuGcPercent !== null;
+		acc.set(key, {
+			kind: cur.kind,
+			main: cur.main + (row.cpuMainPercent ?? 0),
+			gc: cur.gc + (row.cpuGcPercent ?? 0),
+			lifetime: cur.lifetime + row.cpuPercent,
+			memory: cur.memory + row.memoryRssBytes,
+			count: cur.count + 1,
+			splitKnown: cur.splitKnown && known
+		});
+	}
+	return [...acc.entries()].map(([key, a]) => {
+		const main = a.splitKnown ? deci(a.main) : null;
+		const gc = a.splitKnown ? deci(a.gc) : null;
+		const lifetime = deci(a.lifetime);
+		return {
+			key,
+			kind: a.kind,
+			point: {
+				atMs,
+				samples: 1,
+				cpuMainPercent: main,
+				cpuMainPercentMin: main,
+				cpuGcPercent: gc,
+				cpuGcPercentMin: gc,
+				cpuLifetimePercent: lifetime,
+				cpuLifetimePercentMin: lifetime,
+				memoryRssBytes: a.memory,
+				memoryRssBytesMin: a.memory,
+				processCount: a.count,
+				processCountMin: a.count
+			}
+		};
+	});
 }
-function entryFormats(entry) {
-	return FORMAT_KEYS.filter((f) => entry.formats[f] !== void 0);
+/** The narrower of two bounds, treating `null` (UNKNOWN) as absorbing. */
+function minNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a < b ? a : b;
 }
-function smallestSizeMB(entry) {
-	const sizes = FORMAT_KEYS.map((f) => entry.formats[f]?.sizeMB).filter((n) => typeof n === "number");
-	return sizes.length > 0 ? Math.min(...sizes) : 0;
+function maxNullable(a, b) {
+	if (a === null || b === null) return null;
+	return a > b ? a : b;
 }
-var TIER_ORDER = [
-	"t",
-	"n",
-	"s",
-	"m",
-	"c",
-	"l",
+/** Merge `next` into `held`, keeping the widest [min, max] of each field. */
+function mergePoints(held, next, atMs) {
+	return {
+		atMs,
+		samples: held.samples + next.samples,
+		cpuMainPercent: maxNullable(held.cpuMainPercent, next.cpuMainPercent),
+		cpuMainPercentMin: minNullable(held.cpuMainPercentMin, next.cpuMainPercentMin),
+		cpuGcPercent: maxNullable(held.cpuGcPercent, next.cpuGcPercent),
+		cpuGcPercentMin: minNullable(held.cpuGcPercentMin, next.cpuGcPercentMin),
+		cpuLifetimePercent: Math.max(held.cpuLifetimePercent, next.cpuLifetimePercent),
+		cpuLifetimePercentMin: Math.min(held.cpuLifetimePercentMin, next.cpuLifetimePercentMin),
+		memoryRssBytes: Math.max(held.memoryRssBytes, next.memoryRssBytes),
+		memoryRssBytesMin: Math.min(held.memoryRssBytesMin, next.memoryRssBytesMin),
+		processCount: Math.max(held.processCount, next.processCount),
+		processCountMin: Math.min(held.processCountMin, next.processCountMin)
+	};
+}
+/**
+* The bucket width that brings `spanMs` down to at most `maxPoints` points,
+* snapped up to a whole multiple of the sampling cadence.
+*
+* Returns `cadenceMs` (no reduction) when the span already fits. A caller that
+* asks for a `maxPoints` of 0 or less gets no reduction rather than an
+* infinite bucket — a nonsensical request must not produce a plausible chart.
+*/
+function resolveBucketMs(spanMs, cadenceMs, maxPoints) {
+	if (maxPoints <= 0 || cadenceMs <= 0 || spanMs <= 0) return Math.max(cadenceMs, 1);
+	const wanted = spanMs / maxPoints;
+	if (wanted <= cadenceMs) return cadenceMs;
+	return Math.ceil(wanted / cadenceMs) * cadenceMs;
+}
+/**
+* Reduce one function's points into buckets of `bucketMs`, preserving the
+* extremes.
+*
+* Points are expected oldest-first and are returned oldest-first. A bucket
+* with no samples is ABSENT — not zero, not interpolated, not the previous
+* value held over.
+*/
+function reducePoints(points, bucketMs, origin) {
+	if (bucketMs <= 0 || points.length === 0) return points;
+	const buckets = /* @__PURE__ */ new Map();
+	for (const point of points) {
+		const start = origin + Math.floor((point.atMs - origin) / bucketMs) * bucketMs;
+		const held = buckets.get(start);
+		buckets.set(start, held === void 0 ? {
+			...point,
+			atMs: start
+		} : mergePoints(held, point, start));
+	}
+	return [...buckets.values()].toSorted((a, b) => a.atMs - b.atMs);
+}
+//#endregion
+//#region src/stream-selection.ts
+function pickPreferredRtspEntry(entries, pref, deviceId, options = {}) {
+	if (entries.length === 0) return null;
+	const prefix = `${deviceId}/`;
+	const toPicked = (e) => ({
+		brokerId: e.brokerId,
+		profileId: e.brokerId.startsWith(prefix) ? e.brokerId.slice(prefix.length) : e.brokerId,
+		url: e.url,
+		mutedUrl: e.mutedUrl,
+		enabled: e.enabled,
+		...e.codec !== void 0 ? { codec: e.codec } : {},
+		...e.resolution !== void 0 ? { resolution: e.resolution } : {}
+	});
+	if (pref !== "auto") {
+		const match = entries.find((e) => e.enabled && e.url.length > 0 && (e.profile === pref || e.brokerId === `${prefix}${pref}`));
+		if (match) return toPicked(match);
+	}
+	const eligible = entries.filter((e) => e.enabled && e.url.length > 0);
+	if (eligible.length === 0) return null;
+	const target = options.targetResolution;
+	if (target) {
+		const withRes = eligible.filter((e) => e.resolution !== void 0);
+		if (withRes.length > 0) {
+			const picked = pickClosestResolution(withRes, target);
+			if (picked) return toPicked(picked);
+		}
+	}
+	return toPicked(eligible[0]);
+}
+/**
+* Pick the entry whose `resolution` is closest to `target`. Prefer
+* entries ≥ target (downscale is cheap at the consumer; upscale is
+* lossy). Among the rest pick the LARGEST still ≤ target so the
+* consumer gets the best feasible quality. "Closeness" is the
+* `width × height` pixel delta.
+*/
+function pickClosestResolution(entries, target) {
+	const targetPixels = target.width * target.height;
+	let bestAbove;
+	let bestBelow;
+	for (const e of entries) {
+		if (e.resolution === void 0) continue;
+		const pixels = e.resolution.width * e.resolution.height;
+		if (pixels >= targetPixels) {
+			if (!bestAbove || pixels < bestAbove.pixels) bestAbove = {
+				entry: e,
+				pixels
+			};
+		} else if (!bestBelow || pixels > bestBelow.pixels) bestBelow = {
+			entry: e,
+			pixels
+		};
+	}
+	return bestAbove?.entry ?? bestBelow?.entry;
+}
+//#endregion
+//#region src/types/model-variant-groups.ts
+var FORMAT_KEYS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt"
+];
+/**
+* Display spelling of a family. Uppercasing the id is wrong for any family
+* whose name is not all-caps — it rendered `yolov9` as "YOLOV9", a word the
+* product uses nowhere else (the catalog, the docs and the model files all say
+* "YOLOv9").
+*/
+var FAMILY_LABEL = {
+	yolo26: "YOLO26",
+	yolov9: "YOLOv9"
+};
+function familyLabel(family) {
+	return FAMILY_LABEL[family] ?? family.toUpperCase();
+}
+/** `@640`, `@320×320`, `@ 256` — a resolution stated inside a model name. */
+var RESOLUTION_IN_NAME = /\s*@\s*\d+\s*(?:[x×]\s*\d+)?/gi;
+/**
+* Strip a leading family label AND any stated resolution from a base model name
+* → clean tier label.
+*
+* The resolution strip is not cosmetic. The tier is chosen BEFORE the
+* resolution chip, and a family whose builds all state their input (our yolov9
+* ships only 320 and 640, no resolution-less build) made the tier inherit its
+* base entry's name verbatim: the ladder read "Tiny @640 / Small @640 / …" and
+* kept saying 640 while the operator had 320 selected below it.
+*/
+function tierLabel(family, baseName) {
+	const fl = familyLabel(family);
+	const stripped = baseName.replace(new RegExp(`^${fl}\\s+`, "i"), "").replace(RESOLUTION_IN_NAME, "").trim();
+	return stripped.length > 0 ? stripped : baseName;
+}
+function variantLabel(precision, optimization) {
+	const parts = [];
+	if (optimization === "fast") parts.push("Fast");
+	parts.push(precision === "int8" ? "Int8" : "Standard");
+	return parts.join(" · ");
+}
+function entryFormats(entry) {
+	return FORMAT_KEYS.filter((f) => entry.formats[f] !== void 0);
+}
+function smallestSizeMB(entry) {
+	const sizes = FORMAT_KEYS.map((f) => entry.formats[f]?.sizeMB).filter((n) => typeof n === "number");
+	return sizes.length > 0 ? Math.min(...sizes) : 0;
+}
+var TIER_ORDER = [
+	"t",
+	"n",
+	"s",
+	"m",
+	"c",
+	"l",
 	"x"
 ];
 var PRECISION_ORDER = ["fp32", "int8"];
@@ -23148,7 +23387,6 @@ var storageCapability = {
 		}), zod.z.instanceof(Uint8Array)),
 		endDownload: require_sleep.method(zod.z.object({ downloadId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
 		listLocations: require_sleep.method(zod.z.object({ type: StorageLocationTypeSchema.optional() }), zod.z.array(StorageLocationSchema).readonly()),
-		getDefaultLocation: require_sleep.method(zod.z.object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()),
 		listLocationDeclarations: require_sleep.method(zod.z.void(), zod.z.array(StorageLocationDeclarationSchema).readonly()),
 		upsertLocation: require_sleep.method(StorageLocationSchema.omit({
 			createdAt: true,
@@ -23178,6 +23416,12 @@ var storageCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* How far each draining location has got (D386). A pure READ of what the
+		* last pressure sweep computed — it starts no work, and a location that is
+		* not draining simply does not appear.
+		*/
+		listDrainProgress: require_sleep.method(zod.z.void(), zod.z.array(StorageDrainProgressSchema).readonly()),
 		testLocation: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({
 			ok: zod.z.boolean(),
 			error: zod.z.string().optional()
@@ -23330,6 +23574,73 @@ var storageMigrationCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/storage-occupancy.cap.ts
+/**
+* `storage-occupancy` — how many bytes an addon actually HOLDS on a storage
+* location (D388).
+*
+* ## Why this is not `storage-evictable`
+*
+* `storage-evictable.getEvictableUsage` looks like the same question and is
+* not, in two ways that both matter and both bite hardest on the locations an
+* operator most wants a figure for:
+*
+*  - it reports the whole eviction DOMAIN, not the location. `recordings:default`
+*    and `recordingsLow:default` deliberately share one root and evict as one
+*    oldest-first pool, so both answer with the SAME combined total. As an
+*    occupancy figure that double-counts the disk.
+*  - it reports ZERO for a location whose eviction policy is `never` (D385) —
+*    a `readonly` or `disabled` disk. Those are exactly the disks an operator
+*    is retiring and staring at.
+*
+* So this is its own contract with its own quantity, and the quantity is
+* OCCUPIED: every byte the addon holds on that location, whether or not it
+* would ever be willing to delete it. A provider that can only answer
+* "evictable" must not register here — a number that silently means different
+* things per class is worse than no number.
+*
+* ## Absence is an answer
+*
+* A location nobody reports for is UNKNOWN, never zero (D315). The orchestrator
+* stamps `StorageLocation.owned` only for locations it has a report for, and
+* the field is an OBJECT rather than a bare number so that a `?? 0` on the
+* consuming side has to be written out loud instead of appearing by accident.
+*
+* `internal: true` — consumed by the orchestrator's `listLocations` stamp, never
+* a public client surface. Clients read the stamped `StorageLocation.owned`.
+*/
+/** One provider's occupancy answer for one location. */
+var StorageOccupancyReportSchema = zod.z.object({
+	locationId: zod.z.string(),
+	/** Bytes this provider holds on THAT location — not its eviction domain, and
+	*  not net of what it is willing to delete. */
+	ownedBytes: zod.z.number().int().nonnegative(),
+	/** When the provider last actually measured this. The orchestrator carries it
+	*  through so a UI can say how old the figure is instead of implying "now". */
+	measuredAtMs: zod.z.number().int().nonnegative()
+});
+var storageOccupancyCapability = {
+	name: "storage-occupancy",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* Occupancy for the given locations, in ONE round trip.
+	*
+	* A provider answers only for the locations it actually holds bytes on and
+	* OMITS the rest — an omitted location is "I hold nothing measurable here",
+	* which the orchestrator merges as a contribution of nothing rather than as
+	* a claim that the location is empty. Only a location no provider reports
+	* at all stays unknown.
+	*
+	* This must be CHEAP and must never walk a filesystem: it is on the admin
+	* UI's `listLocations` path. The owner keeps its own figure fresh (D224) and
+	* answers from what it already has.
+	*/
+getOccupancy: require_sleep.method(zod.z.object({ locationIds: zod.z.array(zod.z.string()).readonly() }), zod.z.array(StorageOccupancyReportSchema).readonly(), { auth: "admin" }) }
+};
+//#endregion
 //#region src/capabilities/storage-provider.cap.ts
 var ProviderInfoSchema = zod.z.discriminatedUnion("shouldSaveDiskSpace", [zod.z.object({
 	providerId: zod.z.string().min(1),
@@ -25746,125 +26057,6 @@ onStatusChanged: { data: zod.z.object({
 	volatileStateFields: ["lastUpdated"]
 };
 //#endregion
-//#region src/capabilities/network-link.cap.ts
-/**
-* How a device reaches the network, and how well.
-*
-* NOT `connectivity`: that cap is an UPSTREAM system's binary view of whether
-* an entity is reachable (a Home Assistant `binary_sensor` with
-* `device_class: connectivity`). This one is the device's OWN link — the
-* medium it is on and the signal it sees — the way `battery` is the device's
-* own charge.
-*
-* `'wifi'`, `'ethernet'` and `'cellular'` are links the firmware actually
-* reported. `'unknown'` is the ABSENCE of an answer — the provider has
-* registered the capability but has not read the link yet (D315: unknown is
-* not empty). Consumers skip it rather than draw a wire or a bar.
-*/
-var NETWORK_LINK_TYPES = [
-	"wifi",
-	"ethernet",
-	"cellular",
-	"unknown"
-];
-/**
-* Network-link snapshot. Same shape for every provider (a Reolink wifi
-* camera, a Home Assistant device with a signal-strength sensor, a Tapo
-* plug): one slice under `device.runtimeState['network-link']`, one badge,
-* one Home Assistant projection.
-*/
-var NetworkLinkStatusSchema = zod.z.object({
-	/** The link the device is on. `'unknown'` = not read yet, not "no link". */
-	type: zod.z.enum(NETWORK_LINK_TYPES),
-	/**
-	* Link quality, 0..100 inclusive, normalised by the provider from whatever
-	* the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
-	* KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
-	* one whose reading has not landed must not be drawn at 0 %. Consumers
-	* SKIP a null rather than coerce it.
-	*/
-	signalPercent: zod.z.number().min(0).max(100).nullable(),
-	/** Raw received signal strength in dBm, when the firmware reports one. */
-	rssiDbm: zod.z.number().optional(),
-	/** Network name of a wireless link, when the firmware reports it. */
-	ssid: zod.z.string().optional(),
-	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
-	lastUpdated: zod.z.number()
-});
-/** The slice a provider seeds before its first read: nothing is known yet. */
-var NETWORK_LINK_UNKNOWN = {
-	type: "unknown",
-	signalPercent: null,
-	lastUpdated: 0
-};
-/**
-* Normalise a signal the firmware reports as BARS (0..`maxBars`) to 0..100.
-* Out-of-range or non-finite input is not a reading: `null`.
-*/
-function signalPercentFromBars(bars, maxBars) {
-	if (bars === void 0 || !Number.isFinite(bars) || maxBars <= 0) return null;
-	if (bars < 0 || bars > maxBars) return null;
-	return Math.round(bars / maxBars * 100);
-}
-/**
-* Normalise an RSSI in dBm to 0..100 on the usual wifi scale: -100 dBm and
-* below is 0 %, -50 dBm and above is 100 %, linear between. Non-finite or
-* positive input is not an RSSI: `null`.
-*/
-function signalPercentFromRssi(rssiDbm) {
-	if (rssiDbm === void 0 || !Number.isFinite(rssiDbm) || rssiDbm > 0) return null;
-	return Math.round((Math.min(-50, Math.max(-100, rssiDbm)) + 100) * 2);
-}
-var networkLinkCapability = {
-	name: "network-link",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [
-		require_sleep.DeviceType.Camera,
-		require_sleep.DeviceType.Sensor,
-		require_sleep.DeviceType.Button,
-		require_sleep.DeviceType.Switch,
-		require_sleep.DeviceType.Light,
-		require_sleep.DeviceType.Lock,
-		require_sleep.DeviceType.Siren
-	],
-	methods: {},
-	events: { 
-	/**
-	* Emitted whenever the cached status changes (a link switch, a signal
-	* reading that moved). Mirrored on the parent chain by the
-	* DeviceEventPropagator like `battery.onStatusChanged`.
-	*/
-onStatusChanged: { data: zod.z.object({
-		deviceId: zod.z.number(),
-		status: NetworkLinkStatusSchema
-	}) } },
-	status: {
-		schema: NetworkLinkStatusSchema,
-		kind: "push",
-		empty: NETWORK_LINK_UNKNOWN
-	},
-	/**
-	* Runtime-state slice — every provider stores the same shape under
-	* `device.runtimeState['network-link']`, read once by the badge and the
-	* Home Assistant projector regardless of the driver.
-	*/
-	runtimeState: NetworkLinkStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a link reading is slow to
-	* change and a sleeping battery camera may not report for hours; the
-	* restored slice is what the badge shows until the next read.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored",
-	/** Clock fields: written, but excluded from the compare that decides
-	*  whether persisting is worth a SQLite commit. */
-	volatileStateFields: ["lastUpdated"]
-};
-//#endregion
 //#region src/capabilities/binary.cap.ts
 /**
 * Generic boolean sensor — last-resort fallback when no domain-
@@ -29562,308 +29754,852 @@ var MotionStatusSchema = zod.z.object({
 	autoClearAfterMs: zod.z.number().nullable()
 });
 /**
-* Payload of `motion.onMotionChanged` event + the corresponding bus
-* event `EventCategory.MotionOnMotionChanged`. Single source of truth
-* — both the cap event surface and the bus payload type alias to this
-* schema.
+* Payload of `motion.onMotionChanged` event + the corresponding bus
+* event `EventCategory.MotionOnMotionChanged`. Single source of truth
+* — both the cap event surface and the bus payload type alias to this
+* schema.
+*/
+var MotionOnMotionChangedDataSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	detected: zod.z.boolean(),
+	timestamp: zod.z.number(),
+	source: MotionSourceEnum,
+	regions: zod.z.array(MotionRegionSchema).readonly().optional()
+});
+var motionCapability = {
+	name: "motion",
+	scope: "device",
+	mode: "singleton",
+	/**
+	* Providers register per-device natives via `ctx.registerNativeCap`
+	* (Hikvision/Reolink/Amcrest/Wyze/HA/Homematic/Alexa/Matter) — there is
+	* NO system singleton provider. Without this flag `resolveCapMount`
+	* derived `{ kind: 'singleton' }`, so `motion.getStatus`/`isDetected`
+	* resolved via `registry.getSingleton('motion')` (always null) and every
+	* call 412'd "provider not available" while bindings listed a live
+	* `motion` native (2026-08-02). The flag routes the router through
+	* `requireDeviceScoped` → `getProviderForDevice`, like `motion-trigger`,
+	* `snapshot` and every other per-device native cap.
+	*/
+	deviceNative: true,
+	deviceTypes: [require_sleep.DeviceType.Camera, require_sleep.DeviceType.Sensor],
+	methods: { 
+	/**
+	* Pull the current motion state synchronously. Convenience shortcut
+	* for consumers that don't need the full status object; equivalent
+	* to `getStatus()?.detected ?? false`. Will likely be folded into
+	* `getStatus` once the auto-injected status surface lands in every
+	* consumer.
+	*/
+isDetected: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.boolean()) },
+	events: { 
+	/**
+	* Fires every time the runner transitions a camera between
+	* `watching` and `active` phases. `source` carries which motion
+	* path drove the transition; `regions` is populated only for
+	* `source: 'analyzer'` (frame-diff regions from the ML motion
+	* detector) — onboard sources don't carry per-frame regions
+	* here (camera-provided zones / AI metadata live in dedicated
+	* channels: `detection.camera-native`, future zone capability).
+	*
+	* Consumers that want all motion pushes (even with `detected`
+	* unchanged) should subscribe to the status subscription via
+	* `device-manager.subscribeDeviceStatusAggregate` instead.
+	*/
+onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
+	status: {
+		schema: MotionStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — the last observed motion snapshot, mirrored
+	* by the kernel and readable cross-process via
+	* `device.state.motion.value`. Reads never invoke the provider, so
+	* UIs and other addons can poll the cached state safely.
+	*/
+	runtimeState: MotionStatusSchema,
+	/**
+	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
+};
+//#endregion
+//#region src/capabilities/motion-trigger.cap.ts
+/**
+* Motion-trigger toggle for accessory devices.
+*
+* "Motion trigger" means: when the parent camera detects motion, the
+* accessory activates automatically. The cap exposes a single boolean
+* — `enabled` — that drivers map to the vendor-specific firmware
+* action (Reolink: `setSirenOnMotion`, `setFloodlightOnMotion`; ONVIF
+* relay: schedule binding; …).
+*
+* The accessory still has its own `switch` cap for direct on/off; this
+* cap is independent. Toggling motion-trigger on does NOT necessarily
+* toggle the switch on — it just instructs the firmware to flip the
+* switch when motion fires.
+*
+* Driver-specific knobs (motion duration window, brightness while
+* triggered, schedule windows) live in the device's
+* `getSettingsUISchema()` instead of bloating this cap — same
+* principle as `switch` and `brightness` keeping their surface
+* minimal.
+*/
+var MotionTriggerStatusSchema = zod.z.object({
+	enabled: zod.z.boolean(),
+	/** Ms epoch of the last operator-driven change. */
+	lastChangedAt: zod.z.number()
+});
+/**
+* Persistent slice mirrored across restarts. The provider writes here
+* on every successful firmware fetch / setMotionTrigger push; the cap
+* router and admin-ui hero read straight from this snapshot via
+* `device.state.motionTrigger.value` instead of re-issuing a firmware
+* round-trip on every UI mount. `lastFetchedAt` lets the framework
+* helper (`createRuntimeStateBridge`) stale-check before deciding
+* whether to refresh from the camera.
+*/
+var MotionTriggerRuntimeStateSchema = MotionTriggerStatusSchema.extend({ 
+/** Ms epoch of the last successful camera fetch (0 = never). */
+lastFetchedAt: zod.z.number() });
+var motionTriggerCapability = {
+	name: "motion-trigger",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [
+		require_sleep.DeviceType.Light,
+		require_sleep.DeviceType.Siren,
+		require_sleep.DeviceType.Switch
+	],
+	methods: { setMotionTrigger: require_sleep.method(zod.z.object({
+		deviceId: zod.z.number().int().nonnegative(),
+		enabled: zod.z.boolean()
+	}), zod.z.void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	events: { onMotionTriggerChanged: { data: zod.z.object({
+		deviceId: zod.z.number(),
+		enabled: zod.z.boolean(),
+		lastChangedAt: zod.z.number()
+	}) } },
+	status: {
+		schema: MotionTriggerStatusSchema,
+		kind: "command-driven"
+	},
+	runtimeState: MotionTriggerRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session"
+};
+//#endregion
+//#region src/capabilities/motion-zones.cap.ts
+/**
+* Motion-zones share the same MaskShape vocabulary as privacy-mask — the
+* on-camera motion-detection mask is a single `grid` region (a row-major
+* boolean cell lattice the camera's onboard VMD evaluates). Composing it as
+* a region keeps one drawing-plane model across all geometry caps.
+*/
+/** A motion-zone region — exactly one boolean cell grid today. */
+var MotionZoneRegionSchema = zod.z.object({
+	id: zod.z.number(),
+	enabled: zod.z.boolean(),
+	shape: MaskGridShapeSchema
+});
+/** Current on-camera motion-detection state — master enable + sensitivity +
+*  the grid region(s). */
+var MotionZoneStatusSchema = zod.z.object({
+	enabled: zod.z.boolean(),
+	sensitivity: zod.z.number(),
+	/** Grid region(s). Today exactly one `grid` shape. */
+	regions: zod.z.array(MotionZoneRegionSchema),
+	lastFetchedAt: zod.z.number()
+});
+/** Per-camera availability — grid dims are fixed per camera model; the UI
+*  sizes its editor from `grid`. */
+var MotionZoneOptionsSchema = zod.z.object({
+	maxRegions: zod.z.number(),
+	supportedShapes: zod.z.array(MaskShapeKindSchema),
+	grid: MaskGridDimsSchema,
+	sensitivity: zod.z.object({
+		min: zod.z.number(),
+		max: zod.z.number(),
+		step: zod.z.number()
+	})
+});
+/** Partial change — every field optional. */
+var MotionZonePatchSchema = zod.z.object({
+	enabled: zod.z.boolean().optional(),
+	sensitivity: zod.z.number().optional(),
+	regions: zod.z.array(MotionZoneRegionSchema).optional()
+});
+var motionZonesCapability = {
+	name: "motion-zones",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [require_sleep.DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/motion-zones-grid",
+		tab: "motion",
+		label: "Motion Zones"
+	} },
+	methods: {
+		getOptions: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), MotionZoneOptionsSchema),
+		setZone: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			patch: MotionZonePatchSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: MotionZoneStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: MotionZoneStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
+};
+//#endregion
+//#region src/capabilities/native-object-detection.cap.ts
+/**
+* On-camera AI object detection cap. Surfaces per-device the classes
+* the firmware can detect and the last-seen instance of each. The
+* provider also fan-outs these to the global `detection.camera-native`
+* event bus with `source: 'onboard'` so cross-cutting system services
+* (alert-center, advanced-notifier, recording-engine) can subscribe
+* once and receive events from every camera.
+*
+* Distinct from `motion-detection` (ML pipeline) and `motion` (hardware
+* PIR or firmware motion pulse): this cap is specifically the AI
+* classifier output coming FROM the camera, not the local pipeline.
+*/
+var NativeObjectClassEnum = zod.z.enum([
+	"person",
+	"vehicle",
+	"animal",
+	"face",
+	"package",
+	"other"
+]);
+var NativeDetectionSchema = zod.z.object({
+	class: NativeObjectClassEnum,
+	timestamp: zod.z.number(),
+	/** Firmware-provided confidence [0..1]. Reolink pushes don't carry it → undefined. */
+	confidence: zod.z.number().min(0).max(1).optional()
+});
+var NativeObjectDetectionStatusSchema = zod.z.object({
+	/**
+	* Last observed instance per class. Missing entries mean the class
+	* is supported but nothing has been seen since the provider started.
+	*
+	* MUST be a partial record: providers seed an empty `{}` on cold-start
+	* and write one class at a time as detections arrive. In Zod 4
+	* `z.record(enum, …)` is EXHAUSTIVE (requires every enum key), so a
+	* partial write throws "expected object, received undefined" for every
+	* unseen class. `z.partialRecord` keeps the enum-key narrowing while
+	* allowing the sparse shape the providers actually write.
+	*/
+	lastByClass: zod.z.partialRecord(NativeObjectClassEnum, NativeDetectionSchema.nullable()),
+	/** Classes the firmware is capable of detecting — enumerated at device register. */
+	supportedClasses: zod.z.array(NativeObjectClassEnum).readonly(),
+	/**
+	* Whether forwarding of onboard AI detections is enabled for this device.
+	* Default FALSE (opt-in, cold-start) — onboard AI pushes are noisy/sparse and
+	* churn the tracker, so forwarding stays off until the operator enables it.
+	*/
+	enabled: zod.z.boolean()
+});
+var NativeObjectDetectionRuntimeStateSchema = NativeObjectDetectionStatusSchema.extend({ 
+/** Required by createRuntimeStateBridge — epoch ms of last refresh. */
+lastFetchedAt: zod.z.number() });
+var nativeObjectDetectionCapability = {
+	name: "native-object-detection",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [require_sleep.DeviceType.Camera],
+	methods: { setEnabled: require_sleep.method(zod.z.object({
+		deviceId: zod.z.number(),
+		enabled: zod.z.boolean()
+	}), zod.z.void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	events: { onDetected: { data: zod.z.object({
+		deviceId: zod.z.number(),
+		detection: NativeDetectionSchema
+	}) } },
+	status: {
+		schema: NativeObjectDetectionStatusSchema,
+		kind: "push"
+	},
+	runtimeState: NativeObjectDetectionRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	/** Clock fields: written, but excluded from the compare that decides
+	*  whether persisting is worth a SQLite commit. */
+	volatileStateFields: ["lastFetchedAt"]
+};
+//#endregion
+//#region src/capabilities/navigation.cap.ts
+/**
+* `navigation` — a device-scoped capability that natively expresses the FULL
+* navigation / action surface of a robot that DRIVES ITSELF and carries an
+* on-board camera (the Dreame robot-vacuum camera is the first provider).
+*
+* Why a NEW cap rather than overloading `ptz`:
+*   - `ptz` moves a *gimbal* on a fixed camera (pan/tilt/zoom of the lens). A
+*     robot vacuum has no gimbal — the whole chassis drives, turns and spins.
+*     The two are different physical models: PTZ is absolute-position + presets,
+*     navigation is momentary drive nudges + discrete robot ACTIONS
+*     (dock / spot-clean / follow-pet / go-to-point / …).
+*   - This cap is the SOURCE OF TRUTH. Two consumers adapt from it rather than
+*     the reverse:
+*       1. a native CamStack navigation panel (data-driven from `listActions`
+*          / `getOptions`), and
+*       2. the PTZ surface — a thin adapter mimics `ptz` from `navigation` so a
+*          robot camera shows up in the existing PTZ control path without every
+*          PTZ provider learning about robots. The mapping lives in the adapter,
+*          not here (see the addon design note):
+*            ptz.continuousMove({pan,tilt}) → navigation.move({pan,tilt})
+*            ptz.stop()                      → navigation.stop()
+*            ptz.goHome()                    → navigation.runAction('goHome')
+*            ptz.getPresets()                → navigation.listActions()  (id→preset)
+*            ptz.goToPreset(id)              → navigation.runAction(id)
+*
+* ## Continuous drive
+*
+* `move` is MOMENTARY. Fluid navigation comes from the UI (or the PTZ adapter)
+* sending `move({pan,tilt})` REPEATEDLY at ~1 Hz while a direction is held, and
+* one `stop()` on release — exactly like the robot app's remote-drive joystick.
+* The provider forwards EACH `move` to one drive write; it must NOT debounce or
+* coalesce them. The UI owns the cadence.
+*
+* ## The action dictionary
+*
+* The discrete controls (dock / locate / spot-clean / follow / flash / sounds)
+* are a DATA-DRIVEN dictionary the cap exposes via `listActions()`. Each entry
+* carries `{ id, kind, label, icon }` (plus `soundId` for sound entries) so the
+* native panel AND the PTZ mimic render buttons WITHOUT hardcoding a
+* vendor-specific list. `kind: 'action'` entries are triggered with
+* `runAction({ actionId })`; `kind: 'sound'` entries with `playSound({ soundId })`
+* (the entry carries the `soundId` to pass). The general primitives — `move`,
+* `stop`, `goToPoint` — stay as first-class methods, not dictionary entries.
+*
+* NOTE (provider wiring): the first provider (Dreame) drives this with the RAW
+* `callAction(siid,aiid,in)` / `setProperty({siid,piid,value})` MIoT primitives
+* that the currently-published `@apocaliss92/nodedreame` already exposes on
+* every device handle. A future nodedreame publish adds a typed
+* `DreameCameraController` (drive / playPetSound / spotClean / findPet / …); the
+* provider can then swap the raw calls for the typed methods with no change to
+* THIS contract.
+*/
+/**
+* A momentary drive nudge. The robot MOVES (no gimbal) for as long as the caller
+* keeps sending nudges (~1 Hz); an explicit `stop` (or letting the nudges lapse)
+* halts it.
+*
+*   - `pan`   — turn: negative = left, positive = right, 0 = straight.
+*   - `tilt`  — throttle: positive = forward, negative = spin / turn-around.
+*   - `speed` — optional intensity hint [0, 1]; the provider may scale the drive
+*               vector by it (drivers without proportional drive ignore it).
+*
+* `pan` / `tilt` are normalized [-1, 1]. Both optional so a caller can nudge one
+* axis alone; an all-undefined nudge is a no-op.
+*/
+var NavigationMoveCommandSchema = zod.z.object({
+	pan: zod.z.number().min(-1).max(1).optional(),
+	tilt: zod.z.number().min(-1).max(1).optional(),
+	speed: zod.z.number().min(0).max(1).optional()
+});
+/**
+* The enumerated discrete actions a navigation-capable robot can perform via
+* `runAction`. This is the CLOSED vocabulary; a given device advertises the
+* subset it supports through `listActions`. Sounds are NOT here — they go through
+* `playSound` (see the `sound` dictionary entries).
+*/
+var NavigationActionIdSchema = zod.z.enum([
+	"goHome",
+	"locate",
+	"spotClean",
+	"findPet",
+	"personFollow",
+	"stop",
+	"startClean",
+	"pauseClean",
+	"dockWash",
+	"autoEmpty",
+	"flashOn",
+	"flashOff"
+]);
+/** Whether a dictionary entry is a `runAction` action or a `playSound` sound. */
+var NavigationEntryKindSchema = zod.z.enum(["action", "sound"]);
+/**
+* One entry in the navigation action dictionary — the DATA-DRIVEN unit both the
+* native panel and the PTZ mimic render as a button.
+*
+*   - `id`      — stable id. For `kind:'action'` it is a {@link NavigationActionId}
+*                 (pass to `runAction`); for `kind:'sound'` it is a namespaced id
+*                 (`sound:meow`) whose `soundId` is passed to `playSound`.
+*   - `icon`    — icon HINT (lucide-style name; the UI maps it to its own set).
+*   - `label`   — operator-facing English label.
+*   - `soundId` — wire sound id, present only on `kind:'sound'` entries.
+*   - `enabled` — per-device FEATURE FLAG. `listActions` reports it so the UI /
+*                 PTZ render ONLY enabled entries. Data-driven: the provider
+*                 flips it from config, never by editing code.
+*/
+var NavigationActionEntrySchema = zod.z.object({
+	id: zod.z.string(),
+	kind: NavigationEntryKindSchema,
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	/** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
+	soundId: zod.z.number().int().optional(),
+	/** Per-device feature flag — render this entry only when true. */
+	enabled: zod.z.boolean()
+});
+/**
+* Canonical dictionary of every navigation control (discrete actions + sounds)
+* with its default label + icon hint. A provider filters this to the subset a
+* device supports (and may override a label). Exported so the provider AND the
+* UI share ONE list instead of re-deriving labels / ids independently.
+*
+* Icons are lucide-style hints; the viewer maps them to its own icon set. Every
+* catalog default is `enabled: true`; a provider overrides per-device from
+* config (data-driven — enabling / disabling one later is a config change, not a
+* code change).
+*/
+var NAVIGATION_ACTION_CATALOG = [
+	{
+		id: "startClean",
+		kind: "action",
+		label: "Start cleaning",
+		icon: "play",
+		enabled: true
+	},
+	{
+		id: "pauseClean",
+		kind: "action",
+		label: "Pause cleaning",
+		icon: "pause",
+		enabled: true
+	},
+	{
+		id: "stop",
+		kind: "action",
+		label: "Stop",
+		icon: "hand",
+		enabled: true
+	},
+	{
+		id: "goHome",
+		kind: "action",
+		label: "Return to dock",
+		icon: "home",
+		enabled: true
+	},
+	{
+		id: "locate",
+		kind: "action",
+		label: "Locate",
+		icon: "bell",
+		enabled: true
+	},
+	{
+		id: "spotClean",
+		kind: "action",
+		label: "Spot clean here",
+		icon: "crosshair",
+		enabled: true
+	},
+	{
+		id: "findPet",
+		kind: "action",
+		label: "Find pet",
+		icon: "paw-print",
+		enabled: true
+	},
+	{
+		id: "personFollow",
+		kind: "action",
+		label: "Follow me",
+		icon: "footprints",
+		enabled: true
+	},
+	{
+		id: "dockWash",
+		kind: "action",
+		label: "Wash mop",
+		icon: "droplets",
+		enabled: true
+	},
+	{
+		id: "autoEmpty",
+		kind: "action",
+		label: "Empty dustbin",
+		icon: "trash-2",
+		enabled: true
+	},
+	{
+		id: "flashOn",
+		kind: "action",
+		label: "Flash on",
+		icon: "flashlight",
+		enabled: true
+	},
+	{
+		id: "flashOff",
+		kind: "action",
+		label: "Flash off",
+		icon: "flashlight-off",
+		enabled: true
+	},
+	{
+		id: "sound:meow",
+		kind: "sound",
+		label: "Meow",
+		icon: "cat",
+		soundId: 684,
+		enabled: true
+	},
+	{
+		id: "sound:bark",
+		kind: "sound",
+		label: "Woof",
+		icon: "dog",
+		soundId: 685,
+		enabled: true
+	},
+	{
+		id: "sound:footsteps",
+		kind: "sound",
+		label: "Footsteps",
+		icon: "footprints",
+		soundId: 686,
+		enabled: true
+	},
+	{
+		id: "sound:purring",
+		kind: "sound",
+		label: "Purring",
+		icon: "cat",
+		soundId: 687,
+		enabled: true
+	},
+	{
+		id: "sound:tickTock",
+		kind: "sound",
+		label: "Tick-tock",
+		icon: "clock",
+		soundId: 688,
+		enabled: true
+	}
+];
+/** Coordinates for `goToPoint` — a point on the robot's live map. */
+var NavigationPointSchema = zod.z.object({
+	x: zod.z.number(),
+	y: zod.z.number()
+});
+/**
+* Per-device FEATURE-FLAG report for the general (non-dictionary) primitives.
+* The cap reports which are enabled so the UI / PTZ render only the controls
+* that are turned on for THIS device. Data-driven: the provider derives these
+* from config + probe, never hardcoded in the UI. The per-DICTIONARY-entry flags
+* live on {@link NavigationActionEntrySchema.enabled}; these gate the primitives
+* that are not dictionary entries.
+*
+*   - `move` / `stop`   — the momentary drive joystick.
+*   - `goToPoint`       — send-to-map-coordinate. Ships OFF on Dreame until the
+*                         map-coordinate plumbing is wired.
+*   - `runAction`       — the discrete action buttons (dictionary `kind:'action'`).
+*   - `playSound`       — the sound buttons (dictionary `kind:'sound'`).
+*   - `light`           — the on/off fill-light toggle (works anytime).
+*   - `lightMode`       — the auto/manual selector + manual level slider (a
+*                         camera-service control; needs an active stream).
 */
-var MotionOnMotionChangedDataSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	detected: zod.z.boolean(),
-	timestamp: zod.z.number(),
-	source: MotionSourceEnum,
-	regions: zod.z.array(MotionRegionSchema).readonly().optional()
+var NavigationFeaturesSchema = zod.z.object({
+	move: zod.z.boolean(),
+	stop: zod.z.boolean(),
+	goToPoint: zod.z.boolean(),
+	runAction: zod.z.boolean(),
+	playSound: zod.z.boolean(),
+	light: zod.z.boolean(),
+	lightMode: zod.z.boolean()
 });
-var motionCapability = {
-	name: "motion",
-	scope: "device",
-	mode: "singleton",
-	/**
-	* Providers register per-device natives via `ctx.registerNativeCap`
-	* (Hikvision/Reolink/Amcrest/Wyze/HA/Homematic/Alexa/Matter) — there is
-	* NO system singleton provider. Without this flag `resolveCapMount`
-	* derived `{ kind: 'singleton' }`, so `motion.getStatus`/`isDetected`
-	* resolved via `registry.getSingleton('motion')` (always null) and every
-	* call 412'd "provider not available" while bindings listed a live
-	* `motion` native (2026-08-02). The flag routes the router through
-	* `requireDeviceScoped` → `getProviderForDevice`, like `motion-trigger`,
-	* `snapshot` and every other per-device native cap.
-	*/
-	deviceNative: true,
-	deviceTypes: [require_sleep.DeviceType.Camera, require_sleep.DeviceType.Sensor],
-	methods: { 
-	/**
-	* Pull the current motion state synchronously. Convenience shortcut
-	* for consumers that don't need the full status object; equivalent
-	* to `getStatus()?.detected ?? false`. Will likely be folded into
-	* `getStatus` once the auto-injected status surface lands in every
-	* consumer.
-	*/
-isDetected: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.boolean()) },
-	events: { 
-	/**
-	* Fires every time the runner transitions a camera between
-	* `watching` and `active` phases. `source` carries which motion
-	* path drove the transition; `regions` is populated only for
-	* `source: 'analyzer'` (frame-diff regions from the ML motion
-	* detector) — onboard sources don't carry per-frame regions
-	* here (camera-provided zones / AI metadata live in dedicated
-	* channels: `detection.camera-native`, future zone capability).
-	*
-	* Consumers that want all motion pushes (even with `detected`
-	* unchanged) should subscribe to the status subscription via
-	* `device-manager.subscribeDeviceStatusAggregate` instead.
-	*/
-onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
-	status: {
-		schema: MotionStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — the last observed motion snapshot, mirrored
-	* by the kernel and readable cross-process via
-	* `device.state.motion.value`. Reads never invoke the provider, so
-	* UIs and other addons can poll the cached state safely.
-	*/
-	runtimeState: MotionStatusSchema,
-	/**
-	* Runtime-state durability: **session** — self-clearing by construction (`autoClearAfterMs`); a restored `detected: true` is a frozen event, and the next frame re-publishes the real one.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-//#endregion
-//#region src/capabilities/motion-trigger.cap.ts
+/** Light mode: `auto` lets the camera choose brightness; `manual` uses `level`. */
+var NavigationLightModeSchema = zod.z.enum(["auto", "manual"]);
+/** Manual fill-light level bounds (the camera-service accepts 40..100). */
+var NAVIGATION_LIGHT_LEVEL_MIN = 40;
+var NAVIGATION_LIGHT_LEVEL_MAX = 100;
+/** Coarse work mode the robot reports — drives the UI's active-state chips. */
+var NavigationModeSchema = zod.z.enum([
+	"idle",
+	"cleaning",
+	"spot",
+	"following",
+	"goto",
+	"returning",
+	"paused",
+	"unknown"
+]);
 /**
-* Motion-trigger toggle for accessory devices.
-*
-* "Motion trigger" means: when the parent camera detects motion, the
-* accessory activates automatically. The cap exposes a single boolean
-* — `enabled` — that drivers map to the vendor-specific firmware
-* action (Reolink: `setSirenOnMotion`, `setFloodlightOnMotion`; ONVIF
-* relay: schedule binding; …).
-*
-* The accessory still has its own `switch` cap for direct on/off; this
-* cap is independent. Toggling motion-trigger on does NOT necessarily
-* toggle the switch on — it just instructs the firmware to flip the
-* switch when motion fires.
-*
-* Driver-specific knobs (motion duration window, brightness while
-* triggered, schedule windows) live in the device's
-* `getSettingsUISchema()` instead of bloating this cap — same
-* principle as `switch` and `brightness` keeping their surface
-* minimal.
+* Live navigation state so the UI can reflect what the robot is doing:
+*   - `mode`       — coarse activity (idle / cleaning / following / …).
+*   - `following`  — person/pet follow is currently armed.
+*   - `flash`      — the on-camera fill light is on.
+*   - `lightMode`  — auto vs manual fill-light mode.
+*   - `lightLevel` — manual fill-light level (40..100); meaningful when
+*                    `lightMode === 'manual'`.
 */
-var MotionTriggerStatusSchema = zod.z.object({
-	enabled: zod.z.boolean(),
-	/** Ms epoch of the last operator-driven change. */
+var NavigationStatusSchema = zod.z.object({
+	mode: NavigationModeSchema,
+	following: zod.z.boolean(),
+	flash: zod.z.boolean(),
+	lightMode: NavigationLightModeSchema,
+	lightLevel: zod.z.number().min(40).max(100),
+	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: zod.z.number()
 });
 /**
-* Persistent slice mirrored across restarts. The provider writes here
-* on every successful firmware fetch / setMotionTrigger push; the cap
-* router and admin-ui hero read straight from this snapshot via
-* `device.state.motionTrigger.value` instead of re-issuing a firmware
-* round-trip on every UI mount. `lastFetchedAt` lets the framework
-* helper (`createRuntimeStateBridge`) stale-check before deciding
-* whether to refresh from the camera.
-*/
-var MotionTriggerRuntimeStateSchema = MotionTriggerStatusSchema.extend({ 
-/** Ms epoch of the last successful camera fetch (0 = never). */
-lastFetchedAt: zod.z.number() });
-var motionTriggerCapability = {
-	name: "motion-trigger",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [
-		require_sleep.DeviceType.Light,
-		require_sleep.DeviceType.Siren,
-		require_sleep.DeviceType.Switch
-	],
-	methods: { setMotionTrigger: require_sleep.method(zod.z.object({
-		deviceId: zod.z.number().int().nonnegative(),
-		enabled: zod.z.boolean()
-	}), zod.z.void(), {
-		kind: "mutation",
-		auth: "admin"
-	}) },
-	events: { onMotionTriggerChanged: { data: zod.z.object({
-		deviceId: zod.z.number(),
-		enabled: zod.z.boolean(),
-		lastChangedAt: zod.z.number()
-	}) } },
-	status: {
-		schema: MotionTriggerStatusSchema,
-		kind: "command-driven"
-	},
-	runtimeState: MotionTriggerRuntimeStateSchema,
-	/**
-	* Runtime-state durability: **session** — the authority for motion-trigger enablement is the provider's own config; the slice is a mirror of it, re-published on connect.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-//#endregion
-//#region src/capabilities/motion-zones.cap.ts
-/**
-* Motion-zones share the same MaskShape vocabulary as privacy-mask — the
-* on-camera motion-detection mask is a single `grid` region (a row-major
-* boolean cell lattice the camera's onboard VMD evaluates). Composing it as
-* a region keeps one drawing-plane model across all geometry caps.
+* Runtime-state slice owned by this cap (kernel-managed: validated, mirrored,
+* observable). Adds `lastFetchedAt` on top of the status shape per the
+* convention.
 */
-/** A motion-zone region — exactly one boolean cell grid today. */
-var MotionZoneRegionSchema = zod.z.object({
-	id: zod.z.number(),
-	enabled: zod.z.boolean(),
-	shape: MaskGridShapeSchema
-});
-/** Current on-camera motion-detection state — master enable + sensitivity +
-*  the grid region(s). */
-var MotionZoneStatusSchema = zod.z.object({
-	enabled: zod.z.boolean(),
-	sensitivity: zod.z.number(),
-	/** Grid region(s). Today exactly one `grid` shape. */
-	regions: zod.z.array(MotionZoneRegionSchema),
-	lastFetchedAt: zod.z.number()
-});
-/** Per-camera availability — grid dims are fixed per camera model; the UI
-*  sizes its editor from `grid`. */
-var MotionZoneOptionsSchema = zod.z.object({
-	maxRegions: zod.z.number(),
-	supportedShapes: zod.z.array(MaskShapeKindSchema),
-	grid: MaskGridDimsSchema,
-	sensitivity: zod.z.object({
-		min: zod.z.number(),
-		max: zod.z.number(),
-		step: zod.z.number()
-	})
-});
-/** Partial change — every field optional. */
-var MotionZonePatchSchema = zod.z.object({
-	enabled: zod.z.boolean().optional(),
-	sensitivity: zod.z.number().optional(),
-	regions: zod.z.array(MotionZoneRegionSchema).optional()
-});
-var motionZonesCapability = {
-	name: "motion-zones",
+var NavigationRuntimeStateSchema = NavigationStatusSchema.extend({ lastFetchedAt: zod.z.number() });
+var navigationCapability = {
+	name: "navigation",
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [require_sleep.DeviceType.Camera],
 	deviceConfig: { ui: {
 		kind: "widget",
-		widgetId: "host/motion-zones-grid",
-		tab: "motion",
-		label: "Motion Zones"
+		widgetId: "host/navigation-panel",
+		tab: "navigation",
+		topTab: true,
+		label: "Navigation",
+		order: 0
 	} },
 	methods: {
-		getOptions: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), MotionZoneOptionsSchema),
-		setZone: require_sleep.method(zod.z.object({
+		/**
+		* Momentary drive nudge (the robot moves). `protected` — mirrors
+		* `ptz.continuousMove` so the Viewer navigation panel (and the PTZ-mimic
+		* path) works for any authenticated user, not admin-only. The UI sends
+		* these at ~1 Hz while a control is held; the provider forwards each one to
+		* a single drive write WITHOUT debouncing.
+		*/
+		move: require_sleep.method(NavigationMoveCommandSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+		/** Halt all motion immediately (zero drive vector). */
+		stop: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+		/** Send the robot to a point on its live map. */
+		goToPoint: require_sleep.method(NavigationPointSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Enumerate the discrete controls THIS device supports (data-driven UI +
+		* PTZ mimic). Camera-probed subset of {@link NAVIGATION_ACTION_CATALOG}.
+		*/
+		listActions: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(NavigationActionEntrySchema)),
+		/**
+		* Run one discrete action (a `kind:'action'` dictionary entry). Invalid /
+		* unsupported action ids are rejected by the provider.
+		*/
+		runAction: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
-			patch: MotionZonePatchSchema
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
+			actionId: NavigationActionIdSchema
+		}), zod.z.void(), { kind: "mutation" }),
+		/** Play a sound by its wire id (the `soundId` of a `kind:'sound'` entry). */
+		playSound: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			soundId: zod.z.number().int()
+		}), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Turn the on-camera fill light on / off (the `OpenFullLight` control —
+		* works anytime, no active stream required).
+		*/
+		setLightOn: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			on: zod.z.boolean()
+		}), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Set the fill-light mode (auto vs manual). `manual` optionally carries the
+		* initial `level`. The auto/manual + level control is a CAMERA-service
+		* action that generally needs an active camera stream/monitor session — the
+		* UI shows the manual level slider ONLY when `mode === 'manual'`.
+		*/
+		setLightMode: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			mode: NavigationLightModeSchema,
+			level: zod.z.number().min(40).max(100).optional()
+		}), zod.z.void(), { kind: "mutation" }),
+		/** Set the MANUAL fill-light level (40..100). Implies `manual` mode. */
+		setLightLevel: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			level: zod.z.number().min(40).max(100)
+		}), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Per-device FEATURE-FLAG report for the general primitives — drives which
+		* controls the UI shows (the per-entry flags for the dictionary come back on
+		* `listActions`).
+		*/
+		getFeatures: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), NavigationFeaturesSchema)
 	},
+	events: { onStatusChanged: { data: zod.z.object({
+		deviceId: zod.z.number(),
+		status: NavigationStatusSchema
+	}) } },
 	status: {
-		schema: MotionZoneStatusSchema,
-		kind: "poll"
+		schema: NavigationStatusSchema,
+		kind: "push"
 	},
-	runtimeState: MotionZoneStatusSchema,
 	/**
-	* Runtime-state durability: **restored** — the 14 KB polygon list is the single largest slice on the fleet and has not changed since the operator drew it. Highest value per byte in the table.
+	* Runtime-state slice mirrored by the kernel. The navigation panel watches it
+	* for live mode / follow / flash changes.
+	*/
+	runtimeState: NavigationRuntimeStateSchema,
+	/**
+	* Runtime-state durability: **session** — like `vacuum-control`, a restored
+	* `mode: cleaning` / `following: true` is a robot that is not actually doing
+	* that. The live handle re-publishes on connect.
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
 	*/
-	durability: "restored",
-	/** Clock fields: written, but excluded from the compare that decides
-	*  whether persisting is worth a SQLite commit. */
-	volatileStateFields: ["lastFetchedAt"]
+	durability: "session"
 };
 //#endregion
-//#region src/capabilities/native-object-detection.cap.ts
+//#region src/capabilities/network-link.cap.ts
 /**
-* On-camera AI object detection cap. Surfaces per-device the classes
-* the firmware can detect and the last-seen instance of each. The
-* provider also fan-outs these to the global `detection.camera-native`
-* event bus with `source: 'onboard'` so cross-cutting system services
-* (alert-center, advanced-notifier, recording-engine) can subscribe
-* once and receive events from every camera.
+* How a device reaches the network, and how well.
 *
-* Distinct from `motion-detection` (ML pipeline) and `motion` (hardware
-* PIR or firmware motion pulse): this cap is specifically the AI
-* classifier output coming FROM the camera, not the local pipeline.
+* NOT `connectivity`: that cap is an UPSTREAM system's binary view of whether
+* an entity is reachable (a Home Assistant `binary_sensor` with
+* `device_class: connectivity`). This one is the device's OWN link — the
+* medium it is on and the signal it sees — the way `battery` is the device's
+* own charge.
+*
+* `'wifi'`, `'ethernet'` and `'cellular'` are links the firmware actually
+* reported. `'unknown'` is the ABSENCE of an answer — the provider has
+* registered the capability but has not read the link yet (D315: unknown is
+* not empty). Consumers skip it rather than draw a wire or a bar.
 */
-var NativeObjectClassEnum = zod.z.enum([
-	"person",
-	"vehicle",
-	"animal",
-	"face",
-	"package",
-	"other"
-]);
-var NativeDetectionSchema = zod.z.object({
-	class: NativeObjectClassEnum,
-	timestamp: zod.z.number(),
-	/** Firmware-provided confidence [0..1]. Reolink pushes don't carry it → undefined. */
-	confidence: zod.z.number().min(0).max(1).optional()
-});
-var NativeObjectDetectionStatusSchema = zod.z.object({
-	/**
-	* Last observed instance per class. Missing entries mean the class
-	* is supported but nothing has been seen since the provider started.
-	*
-	* MUST be a partial record: providers seed an empty `{}` on cold-start
-	* and write one class at a time as detections arrive. In Zod 4
-	* `z.record(enum, …)` is EXHAUSTIVE (requires every enum key), so a
-	* partial write throws "expected object, received undefined" for every
-	* unseen class. `z.partialRecord` keeps the enum-key narrowing while
-	* allowing the sparse shape the providers actually write.
-	*/
-	lastByClass: zod.z.partialRecord(NativeObjectClassEnum, NativeDetectionSchema.nullable()),
-	/** Classes the firmware is capable of detecting — enumerated at device register. */
-	supportedClasses: zod.z.array(NativeObjectClassEnum).readonly(),
+var NETWORK_LINK_TYPES = [
+	"wifi",
+	"ethernet",
+	"cellular",
+	"unknown"
+];
+/**
+* Network-link snapshot. Same shape for every provider (a Reolink wifi
+* camera, a Home Assistant device with a signal-strength sensor, a Tapo
+* plug): one slice under `device.runtimeState['network-link']`, one badge,
+* one Home Assistant projection.
+*/
+var NetworkLinkStatusSchema = zod.z.object({
+	/** The link the device is on. `'unknown'` = not read yet, not "no link". */
+	type: zod.z.enum(NETWORK_LINK_TYPES),
 	/**
-	* Whether forwarding of onboard AI detections is enabled for this device.
-	* Default FALSE (opt-in, cold-start) — onboard AI pushes are noisy/sparse and
-	* churn the tracker, so forwarding stays off until the operator enables it.
+	* Link quality, 0..100 inclusive, normalised by the provider from whatever
+	* the firmware reports (bars, RSSI, a vendor scale). **`null` means NOT
+	* KNOWN or NOT APPLICABLE** — a wired link has no signal, and a wireless
+	* one whose reading has not landed must not be drawn at 0 %. Consumers
+	* SKIP a null rather than coerce it.
 	*/
-	enabled: zod.z.boolean()
+	signalPercent: zod.z.number().min(0).max(100).nullable(),
+	/** Raw received signal strength in dBm, when the firmware reports one. */
+	rssiDbm: zod.z.number().optional(),
+	/** Network name of a wireless link, when the firmware reports it. */
+	ssid: zod.z.string().optional(),
+	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
+	lastUpdated: zod.z.number()
 });
-var NativeObjectDetectionRuntimeStateSchema = NativeObjectDetectionStatusSchema.extend({ 
-/** Required by createRuntimeStateBridge — epoch ms of last refresh. */
-lastFetchedAt: zod.z.number() });
-var nativeObjectDetectionCapability = {
-	name: "native-object-detection",
+/** The slice a provider seeds before its first read: nothing is known yet. */
+var NETWORK_LINK_UNKNOWN = {
+	type: "unknown",
+	signalPercent: null,
+	lastUpdated: 0
+};
+/**
+* Normalise a signal the firmware reports as BARS (0..`maxBars`) to 0..100.
+* Out-of-range or non-finite input is not a reading: `null`.
+*/
+function signalPercentFromBars(bars, maxBars) {
+	if (bars === void 0 || !Number.isFinite(bars) || maxBars <= 0) return null;
+	if (bars < 0 || bars > maxBars) return null;
+	return Math.round(bars / maxBars * 100);
+}
+/**
+* Normalise an RSSI in dBm to 0..100 on the usual wifi scale: -100 dBm and
+* below is 0 %, -50 dBm and above is 100 %, linear between. Non-finite or
+* positive input is not an RSSI: `null`.
+*/
+function signalPercentFromRssi(rssiDbm) {
+	if (rssiDbm === void 0 || !Number.isFinite(rssiDbm) || rssiDbm > 0) return null;
+	return Math.round((Math.min(-50, Math.max(-100, rssiDbm)) + 100) * 2);
+}
+var networkLinkCapability = {
+	name: "network-link",
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [require_sleep.DeviceType.Camera],
-	methods: { setEnabled: require_sleep.method(zod.z.object({
-		deviceId: zod.z.number(),
-		enabled: zod.z.boolean()
-	}), zod.z.void(), {
-		kind: "mutation",
-		auth: "admin"
-	}) },
-	events: { onDetected: { data: zod.z.object({
+	deviceTypes: [
+		require_sleep.DeviceType.Camera,
+		require_sleep.DeviceType.Sensor,
+		require_sleep.DeviceType.Button,
+		require_sleep.DeviceType.Switch,
+		require_sleep.DeviceType.Light,
+		require_sleep.DeviceType.Lock,
+		require_sleep.DeviceType.Siren
+	],
+	methods: {},
+	events: { 
+	/**
+	* Emitted whenever the cached status changes (a link switch, a signal
+	* reading that moved). Mirrored on the parent chain by the
+	* DeviceEventPropagator like `battery.onStatusChanged`.
+	*/
+onStatusChanged: { data: zod.z.object({
 		deviceId: zod.z.number(),
-		detection: NativeDetectionSchema
+		status: NetworkLinkStatusSchema
 	}) } },
 	status: {
-		schema: NativeObjectDetectionStatusSchema,
-		kind: "push"
+		schema: NetworkLinkStatusSchema,
+		kind: "push",
+		empty: NETWORK_LINK_UNKNOWN
 	},
-	runtimeState: NativeObjectDetectionRuntimeStateSchema,
 	/**
-	* Runtime-state durability: **restored** — `enabled` is an operator toggle on a camera whose refresh is a no-op and whose staleMs is Infinity. There is no hardware value to re-read — losing it loses the setting.
+	* Runtime-state slice — every provider stores the same shape under
+	* `device.runtimeState['network-link']`, read once by the badge and the
+	* Home Assistant projector regardless of the driver.
+	*/
+	runtimeState: NetworkLinkStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a link reading is slow to
+	* change and a sleeping battery camera may not report for hours; the
+	* restored slice is what the badge shows until the next read.
 	*
 	* See `RuntimeStateDurability`. Enforced by
 	* `scripts/check-runtime-state-durability.ts`.
@@ -29871,7 +30607,7 @@ var nativeObjectDetectionCapability = {
 	durability: "restored",
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
-	volatileStateFields: ["lastFetchedAt"]
+	volatileStateFields: ["lastUpdated"]
 };
 //#endregion
 //#region src/capabilities/network-quality.cap.ts
@@ -31806,431 +32542,6 @@ var ptzAutotrackCapability = {
 	durability: "session"
 };
 //#endregion
-//#region src/capabilities/navigation.cap.ts
-/**
-* `navigation` — a device-scoped capability that natively expresses the FULL
-* navigation / action surface of a robot that DRIVES ITSELF and carries an
-* on-board camera (the Dreame robot-vacuum camera is the first provider).
-*
-* Why a NEW cap rather than overloading `ptz`:
-*   - `ptz` moves a *gimbal* on a fixed camera (pan/tilt/zoom of the lens). A
-*     robot vacuum has no gimbal — the whole chassis drives, turns and spins.
-*     The two are different physical models: PTZ is absolute-position + presets,
-*     navigation is momentary drive nudges + discrete robot ACTIONS
-*     (dock / spot-clean / follow-pet / go-to-point / …).
-*   - This cap is the SOURCE OF TRUTH. Two consumers adapt from it rather than
-*     the reverse:
-*       1. a native CamStack navigation panel (data-driven from `listActions`
-*          / `getOptions`), and
-*       2. the PTZ surface — a thin adapter mimics `ptz` from `navigation` so a
-*          robot camera shows up in the existing PTZ control path without every
-*          PTZ provider learning about robots. The mapping lives in the adapter,
-*          not here (see the addon design note):
-*            ptz.continuousMove({pan,tilt}) → navigation.move({pan,tilt})
-*            ptz.stop()                      → navigation.stop()
-*            ptz.goHome()                    → navigation.runAction('goHome')
-*            ptz.getPresets()                → navigation.listActions()  (id→preset)
-*            ptz.goToPreset(id)              → navigation.runAction(id)
-*
-* ## Continuous drive
-*
-* `move` is MOMENTARY. Fluid navigation comes from the UI (or the PTZ adapter)
-* sending `move({pan,tilt})` REPEATEDLY at ~1 Hz while a direction is held, and
-* one `stop()` on release — exactly like the robot app's remote-drive joystick.
-* The provider forwards EACH `move` to one drive write; it must NOT debounce or
-* coalesce them. The UI owns the cadence.
-*
-* ## The action dictionary
-*
-* The discrete controls (dock / locate / spot-clean / follow / flash / sounds)
-* are a DATA-DRIVEN dictionary the cap exposes via `listActions()`. Each entry
-* carries `{ id, kind, label, icon }` (plus `soundId` for sound entries) so the
-* native panel AND the PTZ mimic render buttons WITHOUT hardcoding a
-* vendor-specific list. `kind: 'action'` entries are triggered with
-* `runAction({ actionId })`; `kind: 'sound'` entries with `playSound({ soundId })`
-* (the entry carries the `soundId` to pass). The general primitives — `move`,
-* `stop`, `goToPoint` — stay as first-class methods, not dictionary entries.
-*
-* NOTE (provider wiring): the first provider (Dreame) drives this with the RAW
-* `callAction(siid,aiid,in)` / `setProperty({siid,piid,value})` MIoT primitives
-* that the currently-published `@apocaliss92/nodedreame` already exposes on
-* every device handle. A future nodedreame publish adds a typed
-* `DreameCameraController` (drive / playPetSound / spotClean / findPet / …); the
-* provider can then swap the raw calls for the typed methods with no change to
-* THIS contract.
-*/
-/**
-* A momentary drive nudge. The robot MOVES (no gimbal) for as long as the caller
-* keeps sending nudges (~1 Hz); an explicit `stop` (or letting the nudges lapse)
-* halts it.
-*
-*   - `pan`   — turn: negative = left, positive = right, 0 = straight.
-*   - `tilt`  — throttle: positive = forward, negative = spin / turn-around.
-*   - `speed` — optional intensity hint [0, 1]; the provider may scale the drive
-*               vector by it (drivers without proportional drive ignore it).
-*
-* `pan` / `tilt` are normalized [-1, 1]. Both optional so a caller can nudge one
-* axis alone; an all-undefined nudge is a no-op.
-*/
-var NavigationMoveCommandSchema = zod.z.object({
-	pan: zod.z.number().min(-1).max(1).optional(),
-	tilt: zod.z.number().min(-1).max(1).optional(),
-	speed: zod.z.number().min(0).max(1).optional()
-});
-/**
-* The enumerated discrete actions a navigation-capable robot can perform via
-* `runAction`. This is the CLOSED vocabulary; a given device advertises the
-* subset it supports through `listActions`. Sounds are NOT here — they go through
-* `playSound` (see the `sound` dictionary entries).
-*/
-var NavigationActionIdSchema = zod.z.enum([
-	"goHome",
-	"locate",
-	"spotClean",
-	"findPet",
-	"personFollow",
-	"stop",
-	"startClean",
-	"pauseClean",
-	"dockWash",
-	"autoEmpty",
-	"flashOn",
-	"flashOff"
-]);
-/** Whether a dictionary entry is a `runAction` action or a `playSound` sound. */
-var NavigationEntryKindSchema = zod.z.enum(["action", "sound"]);
-/**
-* One entry in the navigation action dictionary — the DATA-DRIVEN unit both the
-* native panel and the PTZ mimic render as a button.
-*
-*   - `id`      — stable id. For `kind:'action'` it is a {@link NavigationActionId}
-*                 (pass to `runAction`); for `kind:'sound'` it is a namespaced id
-*                 (`sound:meow`) whose `soundId` is passed to `playSound`.
-*   - `icon`    — icon HINT (lucide-style name; the UI maps it to its own set).
-*   - `label`   — operator-facing English label.
-*   - `soundId` — wire sound id, present only on `kind:'sound'` entries.
-*   - `enabled` — per-device FEATURE FLAG. `listActions` reports it so the UI /
-*                 PTZ render ONLY enabled entries. Data-driven: the provider
-*                 flips it from config, never by editing code.
-*/
-var NavigationActionEntrySchema = zod.z.object({
-	id: zod.z.string(),
-	kind: NavigationEntryKindSchema,
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	/** Present only on `kind:'sound'` entries — the id to pass to `playSound`. */
-	soundId: zod.z.number().int().optional(),
-	/** Per-device feature flag — render this entry only when true. */
-	enabled: zod.z.boolean()
-});
-/**
-* Canonical dictionary of every navigation control (discrete actions + sounds)
-* with its default label + icon hint. A provider filters this to the subset a
-* device supports (and may override a label). Exported so the provider AND the
-* UI share ONE list instead of re-deriving labels / ids independently.
-*
-* Icons are lucide-style hints; the viewer maps them to its own icon set. Every
-* catalog default is `enabled: true`; a provider overrides per-device from
-* config (data-driven — enabling / disabling one later is a config change, not a
-* code change).
-*/
-var NAVIGATION_ACTION_CATALOG = [
-	{
-		id: "startClean",
-		kind: "action",
-		label: "Start cleaning",
-		icon: "play",
-		enabled: true
-	},
-	{
-		id: "pauseClean",
-		kind: "action",
-		label: "Pause cleaning",
-		icon: "pause",
-		enabled: true
-	},
-	{
-		id: "stop",
-		kind: "action",
-		label: "Stop",
-		icon: "hand",
-		enabled: true
-	},
-	{
-		id: "goHome",
-		kind: "action",
-		label: "Return to dock",
-		icon: "home",
-		enabled: true
-	},
-	{
-		id: "locate",
-		kind: "action",
-		label: "Locate",
-		icon: "bell",
-		enabled: true
-	},
-	{
-		id: "spotClean",
-		kind: "action",
-		label: "Spot clean here",
-		icon: "crosshair",
-		enabled: true
-	},
-	{
-		id: "findPet",
-		kind: "action",
-		label: "Find pet",
-		icon: "paw-print",
-		enabled: true
-	},
-	{
-		id: "personFollow",
-		kind: "action",
-		label: "Follow me",
-		icon: "footprints",
-		enabled: true
-	},
-	{
-		id: "dockWash",
-		kind: "action",
-		label: "Wash mop",
-		icon: "droplets",
-		enabled: true
-	},
-	{
-		id: "autoEmpty",
-		kind: "action",
-		label: "Empty dustbin",
-		icon: "trash-2",
-		enabled: true
-	},
-	{
-		id: "flashOn",
-		kind: "action",
-		label: "Flash on",
-		icon: "flashlight",
-		enabled: true
-	},
-	{
-		id: "flashOff",
-		kind: "action",
-		label: "Flash off",
-		icon: "flashlight-off",
-		enabled: true
-	},
-	{
-		id: "sound:meow",
-		kind: "sound",
-		label: "Meow",
-		icon: "cat",
-		soundId: 684,
-		enabled: true
-	},
-	{
-		id: "sound:bark",
-		kind: "sound",
-		label: "Woof",
-		icon: "dog",
-		soundId: 685,
-		enabled: true
-	},
-	{
-		id: "sound:footsteps",
-		kind: "sound",
-		label: "Footsteps",
-		icon: "footprints",
-		soundId: 686,
-		enabled: true
-	},
-	{
-		id: "sound:purring",
-		kind: "sound",
-		label: "Purring",
-		icon: "cat",
-		soundId: 687,
-		enabled: true
-	},
-	{
-		id: "sound:tickTock",
-		kind: "sound",
-		label: "Tick-tock",
-		icon: "clock",
-		soundId: 688,
-		enabled: true
-	}
-];
-/** Coordinates for `goToPoint` — a point on the robot's live map. */
-var NavigationPointSchema = zod.z.object({
-	x: zod.z.number(),
-	y: zod.z.number()
-});
-/**
-* Per-device FEATURE-FLAG report for the general (non-dictionary) primitives.
-* The cap reports which are enabled so the UI / PTZ render only the controls
-* that are turned on for THIS device. Data-driven: the provider derives these
-* from config + probe, never hardcoded in the UI. The per-DICTIONARY-entry flags
-* live on {@link NavigationActionEntrySchema.enabled}; these gate the primitives
-* that are not dictionary entries.
-*
-*   - `move` / `stop`   — the momentary drive joystick.
-*   - `goToPoint`       — send-to-map-coordinate. Ships OFF on Dreame until the
-*                         map-coordinate plumbing is wired.
-*   - `runAction`       — the discrete action buttons (dictionary `kind:'action'`).
-*   - `playSound`       — the sound buttons (dictionary `kind:'sound'`).
-*   - `light`           — the on/off fill-light toggle (works anytime).
-*   - `lightMode`       — the auto/manual selector + manual level slider (a
-*                         camera-service control; needs an active stream).
-*/
-var NavigationFeaturesSchema = zod.z.object({
-	move: zod.z.boolean(),
-	stop: zod.z.boolean(),
-	goToPoint: zod.z.boolean(),
-	runAction: zod.z.boolean(),
-	playSound: zod.z.boolean(),
-	light: zod.z.boolean(),
-	lightMode: zod.z.boolean()
-});
-/** Light mode: `auto` lets the camera choose brightness; `manual` uses `level`. */
-var NavigationLightModeSchema = zod.z.enum(["auto", "manual"]);
-/** Manual fill-light level bounds (the camera-service accepts 40..100). */
-var NAVIGATION_LIGHT_LEVEL_MIN = 40;
-var NAVIGATION_LIGHT_LEVEL_MAX = 100;
-/** Coarse work mode the robot reports — drives the UI's active-state chips. */
-var NavigationModeSchema = zod.z.enum([
-	"idle",
-	"cleaning",
-	"spot",
-	"following",
-	"goto",
-	"returning",
-	"paused",
-	"unknown"
-]);
-/**
-* Live navigation state so the UI can reflect what the robot is doing:
-*   - `mode`       — coarse activity (idle / cleaning / following / …).
-*   - `following`  — person/pet follow is currently armed.
-*   - `flash`      — the on-camera fill light is on.
-*   - `lightMode`  — auto vs manual fill-light mode.
-*   - `lightLevel` — manual fill-light level (40..100); meaningful when
-*                    `lightMode === 'manual'`.
-*/
-var NavigationStatusSchema = zod.z.object({
-	mode: NavigationModeSchema,
-	following: zod.z.boolean(),
-	flash: zod.z.boolean(),
-	lightMode: NavigationLightModeSchema,
-	lightLevel: zod.z.number().min(40).max(100),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: zod.z.number()
-});
-/**
-* Runtime-state slice owned by this cap (kernel-managed: validated, mirrored,
-* observable). Adds `lastFetchedAt` on top of the status shape per the
-* convention.
-*/
-var NavigationRuntimeStateSchema = NavigationStatusSchema.extend({ lastFetchedAt: zod.z.number() });
-var navigationCapability = {
-	name: "navigation",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [require_sleep.DeviceType.Camera],
-	deviceConfig: { ui: {
-		kind: "widget",
-		widgetId: "host/navigation-panel",
-		tab: "navigation",
-		topTab: true,
-		label: "Navigation",
-		order: 0
-	} },
-	methods: {
-		/**
-		* Momentary drive nudge (the robot moves). `protected` — mirrors
-		* `ptz.continuousMove` so the Viewer navigation panel (and the PTZ-mimic
-		* path) works for any authenticated user, not admin-only. The UI sends
-		* these at ~1 Hz while a control is held; the provider forwards each one to
-		* a single drive write WITHOUT debouncing.
-		*/
-		move: require_sleep.method(NavigationMoveCommandSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-		/** Halt all motion immediately (zero drive vector). */
-		stop: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-		/** Send the robot to a point on its live map. */
-		goToPoint: require_sleep.method(NavigationPointSchema.extend({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-		/**
-		* Enumerate the discrete controls THIS device supports (data-driven UI +
-		* PTZ mimic). Camera-probed subset of {@link NAVIGATION_ACTION_CATALOG}.
-		*/
-		listActions: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(NavigationActionEntrySchema)),
-		/**
-		* Run one discrete action (a `kind:'action'` dictionary entry). Invalid /
-		* unsupported action ids are rejected by the provider.
-		*/
-		runAction: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			actionId: NavigationActionIdSchema
-		}), zod.z.void(), { kind: "mutation" }),
-		/** Play a sound by its wire id (the `soundId` of a `kind:'sound'` entry). */
-		playSound: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			soundId: zod.z.number().int()
-		}), zod.z.void(), { kind: "mutation" }),
-		/**
-		* Turn the on-camera fill light on / off (the `OpenFullLight` control —
-		* works anytime, no active stream required).
-		*/
-		setLightOn: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			on: zod.z.boolean()
-		}), zod.z.void(), { kind: "mutation" }),
-		/**
-		* Set the fill-light mode (auto vs manual). `manual` optionally carries the
-		* initial `level`. The auto/manual + level control is a CAMERA-service
-		* action that generally needs an active camera stream/monitor session — the
-		* UI shows the manual level slider ONLY when `mode === 'manual'`.
-		*/
-		setLightMode: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			mode: NavigationLightModeSchema,
-			level: zod.z.number().min(40).max(100).optional()
-		}), zod.z.void(), { kind: "mutation" }),
-		/** Set the MANUAL fill-light level (40..100). Implies `manual` mode. */
-		setLightLevel: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			level: zod.z.number().min(40).max(100)
-		}), zod.z.void(), { kind: "mutation" }),
-		/**
-		* Per-device FEATURE-FLAG report for the general primitives — drives which
-		* controls the UI shows (the per-entry flags for the dictionary come back on
-		* `listActions`).
-		*/
-		getFeatures: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), NavigationFeaturesSchema)
-	},
-	events: { onStatusChanged: { data: zod.z.object({
-		deviceId: zod.z.number(),
-		status: NavigationStatusSchema
-	}) } },
-	status: {
-		schema: NavigationStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice mirrored by the kernel. The navigation panel watches it
-	* for live mode / follow / flash changes.
-	*/
-	runtimeState: NavigationRuntimeStateSchema,
-	/**
-	* Runtime-state durability: **session** — like `vacuum-control`, a restored
-	* `mode: cleaning` / `following: true` is a robot that is not actually doing
-	* that. The live handle re-publishes on connect.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session"
-};
-//#endregion
 //#region src/capabilities/reboot.cap.ts
 /**
 * reboot — device-scoped capability for "soft" device reboots (firmware
@@ -36369,134 +36680,6 @@ var RUNTIME_DEFAULTS = {
 	"auth.tokenExpiry": "30d"
 };
 //#endregion
-//#region src/device/container-primary-child.ts
-/**
-* WHICH child a container stands for — one definition, for every consumer.
-*
-* A CONTAINER device has no controllable surface of its own: it groups entity
-* children (a Gree air-conditioner grouping a climate child plus light, x-fan
-* and health switches). Everything that has to show or act on a container has
-* to answer the same question — which child IS the container — and until now
-* three places answered it separately:
-*
-*   - `ui-library/device-controls/primary-child.ts`   (admin-ui rendering)
-*   - `addon-provider-homeassistant` PARENT_TYPE_PRIORITY (adoption)
-*   - the viewer's own `container-primary.ts`         (linked-devices panel)
-*
-* Each carried the same list and a comment asking the others to stay in sync.
-* This is that list, in the one package all of them already depend on.
-*
-* `ui-library` and the server's linked-devices expansion IMPORT it. Two
-* consumers cannot, and keep a checked copy instead: the viewer resolves
-* `@camstack/types` from its own `node_modules` (an installed release, where a
-* newly added export simply is not there), and the Home Assistant provider
-* expresses the same precedence over the `DeviceType` enum because it answers
-* a different question from the same ordering. `scripts/check-container-
-* priority-in-sync.ts` fails the build when either drifts — the comment that
-* used to ask for this could not.
-*
-* The rule has two halves and the ORDER matters: an operator's explicit pick
-* wins outright, and only in its absence does type priority decide. The pick is
-* keyed on the child's re-sync-stable `entityId`, not its numeric id, so it
-* survives a re-sync that reallocates ids.
-*/
-/**
-* Type priority, most→least "primary". An actuator (climate / lock / cover / …)
-* outranks a bare `switch` so a container's defining child wins over its
-* auxiliary switches. Unknown or absent types sort after every entry.
-*
-* NB: `siren` deliberately sits BELOW `switch` — it is a switch-family
-* actuator, and a camera's siren must not out-rank the thing the container is.
-*
-* These strings are matched against a child's `DeviceType` VALUE, so they must
-* equal the enum's string values.
-*/
-var CONTAINER_CHILD_PRIORITY = [
-	"media-player",
-	"alarm-panel",
-	"thermostat",
-	"climate",
-	"humidifier",
-	"water-heater",
-	"lock",
-	"cover",
-	"valve",
-	"fan",
-	"vacuum",
-	"lawn-mower",
-	"light",
-	"switch",
-	"siren",
-	"button",
-	"control",
-	"notifier",
-	"script",
-	"automation",
-	"update",
-	"presence",
-	"weather",
-	"image",
-	"sensor"
-];
-/**
-* Roles that say what a container IS, most→least defining. Consulted BEFORE
-* type priority, because `DeviceType` cannot tell them apart: Home Assistant
-* maps a door contact, a battery level, a temperature reading and a "last seen"
-* timestamp all to `DeviceType.Sensor`. Measured on container 4127 — children
-* `battery-sensor`, `temperature-sensor`, `datetime-sensor`, `contact-sensor`
-* and a role-less `button` — the type list ranked `button` above `sensor` and
-* the container stood for its "Identifica" button instead of the door contact
-* it is named after.
-*
-* Only STATE-DEFINING roles belong here. A diagnostic reading (battery,
-* temperature, humidity, signal, last-seen) is never what a container is, so
-* they are deliberately absent and fall through to type priority.
-*/
-var CONTAINER_CHILD_ROLE_PRIORITY = [
-	"contact-sensor",
-	"motion-sensor",
-	"occupancy-sensor",
-	"smoke-sensor",
-	"co-sensor",
-	"gas-sensor",
-	"leak-sensor",
-	"vibration-sensor",
-	"tamper-sensor",
-	"sound-sensor"
-];
-/**
-* NOT in the list, deliberately: `binary-sensor` and `binary-helper`. They are
-* GENERIC — they say "this reports a boolean", not what the container is — and
-* ranking them above type priority is a live regression, not a hypothetical:
-* container 1837 holds a real `lock` (features `['lock-open']`) alongside a
-* child named "Actuator" whose only role is `binary-sensor`, and the generic
-* role beat the lock. A role earns a place here by naming a SUBJECT (a contact,
-* a leak, smoke), never by naming a datatype.
-*/
-function roleRank(role) {
-	if (role === void 0) return CONTAINER_CHILD_ROLE_PRIORITY.length;
-	const i = CONTAINER_CHILD_ROLE_PRIORITY.indexOf(role);
-	return i === -1 ? CONTAINER_CHILD_ROLE_PRIORITY.length : i;
-}
-function rank(type) {
-	const i = CONTAINER_CHILD_PRIORITY.indexOf(type);
-	return i === -1 ? CONTAINER_CHILD_PRIORITY.length : i;
-}
-/**
-* The child a container stands for: the operator's pick when it still exists,
-* else the highest-priority type. `null` for a childless container — a caller
-* must decide what an empty container means for it, rather than being handed a
-* child that is not there.
-*/
-function resolveContainerPrimaryChild(children, overrideEntityId, containerName) {
-	if (overrideEntityId !== void 0 && overrideEntityId !== null) {
-		const picked = children.find((c) => c.stableId === overrideEntityId) ?? children.find((c) => c.entityId !== void 0 && c.entityId === overrideEntityId);
-		if (picked !== void 0) return picked;
-	}
-	const namesake = (c) => containerName !== void 0 && containerName.length > 0 && c.name !== void 0 && c.name.toLowerCase() === containerName.toLowerCase() ? 0 : 1;
-	return [...children].toSorted((a, b) => roleRank(a.role) - roleRank(b.role) || namesake(a) - namesake(b) || rank(a.type) - rank(b.type))[0] ?? null;
-}
-//#endregion
 //#region src/device/accessory.ts
 /**
 * Accessory device helpers — shared across drivers.
@@ -38082,6 +38265,134 @@ function isBatteryPresenceFault(presence) {
 	return presence === "unreachable";
 }
 //#endregion
+//#region src/device/container-primary-child.ts
+/**
+* WHICH child a container stands for — one definition, for every consumer.
+*
+* A CONTAINER device has no controllable surface of its own: it groups entity
+* children (a Gree air-conditioner grouping a climate child plus light, x-fan
+* and health switches). Everything that has to show or act on a container has
+* to answer the same question — which child IS the container — and until now
+* three places answered it separately:
+*
+*   - `ui-library/device-controls/primary-child.ts`   (admin-ui rendering)
+*   - `addon-provider-homeassistant` PARENT_TYPE_PRIORITY (adoption)
+*   - the viewer's own `container-primary.ts`         (linked-devices panel)
+*
+* Each carried the same list and a comment asking the others to stay in sync.
+* This is that list, in the one package all of them already depend on.
+*
+* `ui-library` and the server's linked-devices expansion IMPORT it. Two
+* consumers cannot, and keep a checked copy instead: the viewer resolves
+* `@camstack/types` from its own `node_modules` (an installed release, where a
+* newly added export simply is not there), and the Home Assistant provider
+* expresses the same precedence over the `DeviceType` enum because it answers
+* a different question from the same ordering. `scripts/check-container-
+* priority-in-sync.ts` fails the build when either drifts — the comment that
+* used to ask for this could not.
+*
+* The rule has two halves and the ORDER matters: an operator's explicit pick
+* wins outright, and only in its absence does type priority decide. The pick is
+* keyed on the child's re-sync-stable `entityId`, not its numeric id, so it
+* survives a re-sync that reallocates ids.
+*/
+/**
+* Type priority, most→least "primary". An actuator (climate / lock / cover / …)
+* outranks a bare `switch` so a container's defining child wins over its
+* auxiliary switches. Unknown or absent types sort after every entry.
+*
+* NB: `siren` deliberately sits BELOW `switch` — it is a switch-family
+* actuator, and a camera's siren must not out-rank the thing the container is.
+*
+* These strings are matched against a child's `DeviceType` VALUE, so they must
+* equal the enum's string values.
+*/
+var CONTAINER_CHILD_PRIORITY = [
+	"media-player",
+	"alarm-panel",
+	"thermostat",
+	"climate",
+	"humidifier",
+	"water-heater",
+	"lock",
+	"cover",
+	"valve",
+	"fan",
+	"vacuum",
+	"lawn-mower",
+	"light",
+	"switch",
+	"siren",
+	"button",
+	"control",
+	"notifier",
+	"script",
+	"automation",
+	"update",
+	"presence",
+	"weather",
+	"image",
+	"sensor"
+];
+/**
+* Roles that say what a container IS, most→least defining. Consulted BEFORE
+* type priority, because `DeviceType` cannot tell them apart: Home Assistant
+* maps a door contact, a battery level, a temperature reading and a "last seen"
+* timestamp all to `DeviceType.Sensor`. Measured on container 4127 — children
+* `battery-sensor`, `temperature-sensor`, `datetime-sensor`, `contact-sensor`
+* and a role-less `button` — the type list ranked `button` above `sensor` and
+* the container stood for its "Identifica" button instead of the door contact
+* it is named after.
+*
+* Only STATE-DEFINING roles belong here. A diagnostic reading (battery,
+* temperature, humidity, signal, last-seen) is never what a container is, so
+* they are deliberately absent and fall through to type priority.
+*/
+var CONTAINER_CHILD_ROLE_PRIORITY = [
+	"contact-sensor",
+	"motion-sensor",
+	"occupancy-sensor",
+	"smoke-sensor",
+	"co-sensor",
+	"gas-sensor",
+	"leak-sensor",
+	"vibration-sensor",
+	"tamper-sensor",
+	"sound-sensor"
+];
+/**
+* NOT in the list, deliberately: `binary-sensor` and `binary-helper`. They are
+* GENERIC — they say "this reports a boolean", not what the container is — and
+* ranking them above type priority is a live regression, not a hypothetical:
+* container 1837 holds a real `lock` (features `['lock-open']`) alongside a
+* child named "Actuator" whose only role is `binary-sensor`, and the generic
+* role beat the lock. A role earns a place here by naming a SUBJECT (a contact,
+* a leak, smoke), never by naming a datatype.
+*/
+function roleRank(role) {
+	if (role === void 0) return CONTAINER_CHILD_ROLE_PRIORITY.length;
+	const i = CONTAINER_CHILD_ROLE_PRIORITY.indexOf(role);
+	return i === -1 ? CONTAINER_CHILD_ROLE_PRIORITY.length : i;
+}
+function rank(type) {
+	const i = CONTAINER_CHILD_PRIORITY.indexOf(type);
+	return i === -1 ? CONTAINER_CHILD_PRIORITY.length : i;
+}
+/**
+* The child a container stands for: the operator's pick when it still exists,
+* else the highest-priority type. `null` for a childless container — a caller
+* must decide what an empty container means for it, rather than being handed a
+* child that is not there.
+*/
+function resolveContainerPrimaryChild(children, overrideEntityId, containerName) {
+	if (overrideEntityId !== void 0 && overrideEntityId !== null) {
+		const picked = children.find((c) => c.stableId === overrideEntityId) ?? children.find((c) => c.entityId !== void 0 && c.entityId === overrideEntityId);
+		if (picked !== void 0) return picked;
+	}
+	const namesake = (c) => containerName !== void 0 && containerName.length > 0 && c.name !== void 0 && c.name.toLowerCase() === containerName.toLowerCase() ? 0 : 1;
+	return [...children].toSorted((a, b) => roleRank(a.role) - roleRank(b.role) || namesake(a) - namesake(b) || rank(a.type) - rank(b.type))[0] ?? null;
+}
+//#endregion
 //#region src/device/declared-device.ts
 /** Marker written to a declared integration's `info`. */
 var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
@@ -39891,6 +40202,7 @@ var CAPABILITY_NAMES = {
 	storage: "storage",
 	storageEvictable: "storage-evictable",
 	storageMigration: "storage-migration",
+	storageOccupancy: "storage-occupancy",
 	storageProvider: "storage-provider",
 	streamBroker: "stream-broker",
 	streamCatalog: "stream-catalog",
@@ -40436,6 +40748,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "storageMigration",
 		name: "storage-migration"
 	},
+	{
+		key: "storageOccupancy",
+		name: "storage-occupancy"
+	},
 	{
 		key: "storageProvider",
 		name: "storage-provider"
@@ -40680,6 +40996,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	storageCapability,
 	storageEvictableCapability,
 	storageMigrationCapability,
+	storageOccupancyCapability,
 	storageProviderCapability,
 	streamBrokerCapability,
 	streamCatalogCapability,
@@ -45648,13 +45965,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
+	"storage.list": {
 		capName: "storage",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"storage.list": {
+	"storage.listDrainProgress": {
 		capName: "storage",
 		capScope: "system",
 		addonId: null,
@@ -45804,6 +46121,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storageOccupancy.getOccupancy": {
+		capName: "storage-occupancy",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageProvider.abortUpload": {
 		capName: "storage-provider",
 		capScope: "system",
@@ -46939,6 +47262,7 @@ var KNOWN_CAP_NAMES = [
 	"storage",
 	"storage-evictable",
 	"storage-migration",
+	"storage-occupancy",
 	"storage-provider",
 	"stream-broker",
 	"stream-catalog",
@@ -47085,6 +47409,7 @@ var SYSTEM_CAP_NAMES = [
 	"storage",
 	"storage-evictable",
 	"storage-migration",
+	"storage-occupancy",
 	"storage-provider",
 	"stream-broker",
 	"system",
@@ -50081,10 +50406,10 @@ function createSystemProxy(api) {
 			readChunk: (input) => dispatch("storage", "readChunk", "query", input),
 			endDownload: (input) => dispatch("storage", "endDownload", "mutation", input),
 			listLocations: (input) => dispatch("storage", "listLocations", "query", input),
-			getDefaultLocation: (input) => dispatch("storage", "getDefaultLocation", "query", input),
 			listLocationDeclarations: (input) => dispatch("storage", "listLocationDeclarations", "query", input),
 			upsertLocation: (input) => dispatch("storage", "upsertLocation", "mutation", input),
 			deleteLocation: (input) => dispatch("storage", "deleteLocation", "mutation", input),
+			listDrainProgress: (input) => dispatch("storage", "listDrainProgress", "query", input),
 			testLocation: (input) => dispatch("storage", "testLocation", "query", input),
 			listProviders: (input) => dispatch("storage", "listProviders", "query", input),
 			testConfig: (input) => dispatch("storage", "testConfig", "query", input)
@@ -54534,6 +54859,7 @@ exports.IntercomAbilitySchema = IntercomAbilitySchema;
 exports.IntercomStatusSchema = IntercomStatusSchema;
 exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
 exports.KeyEventSchema = KeyEventSchema;
+exports.LEGACY_READ_ONLY_CONFIG_KEY = LEGACY_READ_ONLY_CONFIG_KEY;
 exports.LOAD_CONTRIBUTION_ATTRIBUTIONS = LOAD_CONTRIBUTION_ATTRIBUTIONS;
 exports.LOAD_CONTRIBUTION_ROLES = LOAD_CONTRIBUTION_ROLES;
 exports.LOG_CHANNEL_TICK_MS = LOG_CHANNEL_TICK_MS;
@@ -54549,6 +54875,7 @@ exports.LedgerWalkRefusalSchema = LedgerWalkRefusalSchema;
 exports.LedgerWalkReportSchema = LedgerWalkReportSchema;
 exports.LedgerWalkSkipCountsSchema = LedgerWalkSkipCountsSchema;
 exports.LedgerWalkSkipReasonSchema = LedgerWalkSkipReasonSchema;
+exports.LegacyStorageLocationDefaultSchema = LegacyStorageLocationDefaultSchema;
 exports.LinkedDeviceSchema = LinkedDeviceSchema;
 exports.LinkedDevicesModeSchema = LinkedDevicesModeSchema;
 exports.LlmDefaultSchema = LlmDefaultSchema;
@@ -54984,6 +55311,8 @@ exports.SOURCE_CAP_CHANGED_AT_FIELD = SOURCE_CAP_CHANGED_AT_FIELD;
 exports.SOURCE_DEVICE_TYPES = SOURCE_DEVICE_TYPES;
 exports.SOURCE_INFO_METADATA_KEY = SOURCE_INFO_METADATA_KEY;
 exports.STORAGE_ACCESS_FALLBACK = STORAGE_ACCESS_FALLBACK;
+exports.STORAGE_BYTES_PER_GB = STORAGE_BYTES_PER_GB;
+exports.STORAGE_LOCATION_MODES = STORAGE_LOCATION_MODES;
 exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
 exports.STREAM_QUALITY_LABELS = STREAM_QUALITY_LABELS;
 exports.SUB_DETECTION_TYPES = SUB_DETECTION_TYPES;
@@ -55045,9 +55374,12 @@ exports.StorageCleanupInputSchema = StorageCleanupInputSchema;
 exports.StorageCleanupJobSchema = StorageCleanupJobSchema;
 exports.StorageCleanupPhaseSchema = StorageCleanupPhaseSchema;
 exports.StorageCleanupStatusInputSchema = StorageCleanupStatusInputSchema;
+exports.StorageDrainProgressSchema = StorageDrainProgressSchema;
 exports.StorageEndDownloadInputSchema = EndDownloadInputSchema;
+exports.StorageEvictionPolicySchema = StorageEvictionPolicySchema;
 exports.StorageFinalizeUploadInputSchema = FinalizeUploadInputSchema;
 exports.StorageLocationDeclarationSchema = StorageLocationDeclarationSchema;
+exports.StorageLocationModeSchema = StorageLocationModeSchema;
 exports.StorageLocationRefSchema = StorageLocationRefSchema;
 exports.StorageLocationSchema = StorageLocationSchema;
 exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
@@ -55071,6 +55403,7 @@ exports.StorageMigrationPhaseSchema = StorageMigrationPhaseSchema;
 exports.StorageMigrationPlanSchema = StorageMigrationPlanSchema;
 exports.StorageMigrationResidueSchema = StorageMigrationResidueSchema;
 exports.StorageMigrationSourcesSchema = StorageMigrationSourcesSchema;
+exports.StorageOccupancyReportSchema = StorageOccupancyReportSchema;
 exports.StorageProviderInfoSchema = ProviderInfoSchema;
 exports.StorageReadChunkInputSchema = ReadChunkInputSchema;
 exports.StorageTestLocationResultSchema = TestLocationResultSchema;
@@ -55352,6 +55685,8 @@ exports.evaluateZoneRules = evaluateZoneRules;
 exports.event = require_sleep.event;
 exports.eventEmitterCapability = eventEmitterCapability;
 exports.eventsCapability = eventsCapability;
+exports.evictionPolicyForMode = evictionPolicyForMode;
+exports.evictionPolicyOfLocation = evictionPolicyOfLocation;
 exports.expandCapMethods = require_sleep.expandCapMethods;
 exports.extractNestedAddonId = extractNestedAddonId;
 exports.extractSourceInfoFromMetadata = extractSourceInfoFromMetadata;
@@ -55367,6 +55702,7 @@ exports.foldSnapshotByFunction = foldSnapshotByFunction;
 exports.formatForBackend = formatForBackend;
 exports.formatForRuntime = formatForRuntime;
 exports.gasCapability = gasCapability;
+exports.gbToBytes = gbToBytes;
 exports.generateAutomationBlock = generateAutomationBlock;
 exports.getAudioMacroClassIds = getAudioMacroClassIds;
 exports.getByPath = getByPath;
@@ -55401,6 +55737,7 @@ exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
 exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
+exports.isLocationEnabled = isLocationEnabled;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
 exports.isOccupancyRule = isOccupancyRule;
@@ -55410,12 +55747,14 @@ exports.isScheduleActive = isScheduleActive;
 exports.isSecretConfigField = isSecretConfigField;
 exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
 exports.isSourceCap = isSourceCap;
+exports.isStorageLocationMode = isStorageLocationMode;
 exports.isSystemDelivery = isSystemDelivery;
 exports.isVoidInput = isVoidInput;
 exports.jobKindSchema = jobKindSchema;
 exports.kebabToCamel = kebabToCamel;
 exports.knownValues = knownValues;
 exports.lawnMowerControlCapability = lawnMowerControlCapability;
+exports.legacyModeOf = legacyModeOf;
 exports.lifecycleJobSchema = lifecycleJobSchema;
 exports.lifecycleJobScopeSchema = lifecycleJobScopeSchema;
 exports.lifecycleJobStateSchema = lifecycleJobStateSchema;
@@ -55438,6 +55777,8 @@ exports.mapAudioLabelToMacro = mapAudioLabelToMacro;
 exports.markdownToHtmlLite = markdownToHtmlLite;
 exports.markdownToText = markdownToText;
 exports.maskUrlCredentials = maskUrlCredentials;
+exports.mayReadLocation = mayReadLocation;
+exports.mayWriteToLocation = mayWriteToLocation;
 exports.mediaPlayerCapability = mediaPlayerCapability;
 exports.mergeSourceInfo = mergeSourceInfo;
 exports.meshNetworkCapability = meshNetworkCapability;
@@ -55445,6 +55786,8 @@ exports.method = require_sleep.method;
 exports.methodAccessForHttpMethod = methodAccessForHttpMethod;
 exports.metricsProviderCapability = metricsProviderCapability;
 exports.migrateLegacyDeviceSignalConfig = migrateLegacyDeviceSignalConfig;
+exports.modeMayRead = modeMayRead;
+exports.modeMayWrite = modeMayWrite;
 exports.modelConvertCapability = modelConvertCapability;
 exports.modelDistributorCapability = modelDistributorCapability;
 exports.modelFormatForRuntime = modelFormatForRuntime;
@@ -55540,6 +55883,7 @@ exports.resolveDeviceProfile = resolveDeviceProfile;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveFormat = resolveFormat;
 exports.resolveHydratedFieldValue = require_sleep.resolveHydratedFieldValue;
+exports.resolveLocationMode = resolveLocationMode;
 exports.resolveMethodAuth = resolveMethodAuth;
 exports.resolveModelFormat = resolveModelFormat;
 exports.resolveMutate = resolveMutate;
@@ -55586,6 +55930,7 @@ exports.stateVocabularyFor = stateVocabularyFor;
 exports.storageCapability = storageCapability;
 exports.storageEvictableCapability = storageEvictableCapability;
 exports.storageMigrationCapability = storageMigrationCapability;
+exports.storageOccupancyCapability = storageOccupancyCapability;
 exports.storageProviderCapability = storageProviderCapability;
 exports.streamBrokerCapability = streamBrokerCapability;
 exports.streamCatalogCapability = streamCatalogCapability;
@@ -55593,6 +55938,7 @@ exports.streamParamsCapability = streamParamsCapability;
 exports.streamPixels = streamPixels;
 exports.streamQualityLabel = streamQualityLabel;
 exports.stripRetiredBandPreBufferSec = stripRetiredBandPreBufferSec;
+exports.strippedOfLegacyReadOnly = strippedOfLegacyReadOnly;
 exports.subKindsOf = subKindsOf;
 exports.summarisePrivacyAudio = summarisePrivacyAudio;
 exports.summarizeEffectiveScope = summarizeEffectiveScope;
@@ -55643,6 +55989,7 @@ exports.wiringHealthSnapshotSchema = wiringHealthSnapshotSchema;
 exports.wiringNodeHealthSchema = wiringNodeHealthSchema;
 exports.wiringProbeKindSchema = wiringProbeKindSchema;
 exports.wiringProbeResultSchema = wiringProbeResultSchema;
+exports.withLocationMode = withLocationMode;
 exports.zodEntriesToConfigUI = zodEntriesToConfigUI;
 exports.zoneAnalyticsCapability = zoneAnalyticsCapability;
 exports.zoneRulesCapability = zoneRulesCapability;