@camstack/types 1.2.259 → 1.2.260

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-DtomDrRW.js");
+const require_sleep = require("./sleep-BDYxE1ax.js");
 const require_event_category = require("./event-category-BVfsrBYA.js");
 const require_canonical_hash = require("./canonical-hash-CSE4ioRi.js");
 const require_enums = require("./enums.js");
@@ -5046,7 +5046,7 @@ var ModelFormatEntrySchema = zod.z.object({
 	/** Multi-file payload (directory members or sibling files). */
 	files: zod.z.array(zod.z.string()).readonly().optional(),
 	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: zod.z.array(zod.z.enum(["node", "python"])).readonly().optional()
+	runtimes: zod.z.array(zod.z.enum(["python"])).readonly().optional()
 });
 /**
 * Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
@@ -17407,6 +17407,25 @@ var NcScheduleSchema = zod.z.object({
 	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
 	invert: zod.z.boolean().optional()
 });
+/**
+* How a system-event rule of the `device-events` or `system` family speaks
+* (D647): at once, per event (`instant`, the only behaviour before D647), or
+* as a STATE SUMMARY at the end of each window of `schedule`.
+*/
+var NcSystemEventDeliveryModeSchema = zod.z.enum(["instant", "summary"]);
+/**
+* `summary`: the rule sends NOTHING per event. When a window of `schedule`
+* CLOSES, it sends one notification with the current state of its kinds
+* (low batteries, consumables to replace, devices offline, updates
+* available, ...), after its own filters. Nothing to report sends nothing.
+* The schedule is the ordinary `NcSchedule` (weekly windows, IANA timezone,
+* midnight crossing); the send time is each window's END. Refused on the
+* `alarm` family, which stays instant (`systemEventDeliveryProblems`).
+*/
+var NcSystemEventDeliverySchema = zod.z.discriminatedUnion("mode", [zod.z.object({ mode: zod.z.literal("instant") }), zod.z.object({
+	mode: zod.z.literal("summary"),
+	schedule: NcScheduleSchema
+})]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = zod.z.object({
 	/**
@@ -18161,6 +18180,16 @@ var NcRuleInputSchema = zod.z.object({
 	delivery: NcDeliverySchema,
 	conditions: NcConditionsSchema.default({}),
 	schedule: NcScheduleSchema.optional(),
+	/**
+	* A `device-events` / `system` rule's delivery (D647): absent or `instant`
+	* is a notification per event; `summary` is one state summary per closed
+	* window of its schedule. `.optional()` and never defaulted: absent must
+	* keep meaning what every rule authored before D647 meant, with no
+	* migration. Top-level rather than inside `conditions.systemEvent`, so a
+	* client that does not know it (an older viewer re-sending `conditions`
+	* whole) leaves it standing through the store's patch merge.
+	*/
+	systemEventDelivery: NcSystemEventDeliverySchema.optional(),
 	/** May be empty when `targetUsers` addresses at least one user — the
 	*  "at least one addressee" invariant is enforced by the provider, because
 	*  a cross-field refine here would break `NcRulePatchSchema.partial()`. */
@@ -18400,6 +18429,28 @@ var NcRuleSchema = NcRuleInputSchema.extend({
 	*/
 	disabledTargetIds: zod.z.array(zod.z.string()).default([])
 });
+/** One section of a previewed state summary. `unavailable` = its state could not be read. */
+var NcStateSummaryPreviewSectionSchema = zod.z.object({
+	id: zod.z.string(),
+	status: zod.z.enum(["read", "unavailable"]),
+	items: zod.z.number().int().nonnegative(),
+	reason: zod.z.string().optional()
+});
+/**
+* The summary a rule would send now. `empty` = nothing to report and every
+* section read: such a summary is NOT sent. `dropped` counts the open states
+* the rule's own filters (or a camera mute) left out, by reason.
+* `excludedGroups` names the kind groups selected that have no state to report
+* (backups & exports).
+*/
+var NcStateSummaryPreviewSchema = zod.z.object({
+	empty: zod.z.boolean(),
+	count: zod.z.number().int().nonnegative(),
+	text: zod.z.string(),
+	sections: zod.z.array(NcStateSummaryPreviewSectionSchema),
+	dropped: zod.z.record(zod.z.string(), zod.z.number().int().nonnegative()),
+	excludedGroups: zod.z.array(zod.z.string())
+});
 var NcTestResultSchema = zod.z.object({
 	recordId: zod.z.string(),
 	recordKind: zod.z.enum([
@@ -18491,6 +18542,13 @@ var NcTemplateVarDescriptorSchema = zod.z.object({
 	kinds: zod.z.array(NcTemplateVarKindSchema).optional(),
 	deliveries: zod.z.array(NcDeliverySchema).optional(),
 	systemEventKinds: zod.z.array(NcSystemEventKindSchema).optional(),
+	/**
+	* Which system-event DELIVERY has a value for it (D647). Absent = an
+	* instant row only when the descriptor names `systemEventKinds` (a
+	* per-event fact: a summary row has no single device), and both otherwise.
+	* `['summary']` marks the state-summary vocabulary (`{{summaryText}}`, ...).
+	*/
+	systemEventDeliveries: zod.z.array(NcSystemEventDeliveryModeSchema).optional(),
 	dynamic: zod.z.object({
 		prefix: zod.z.literal("count_"),
 		from: zod.z.literal("classes")
@@ -18502,7 +18560,9 @@ var NcTemplateVarContextSchema = zod.z.object({
 	field: NcTemplateFieldSchema,
 	kind: NcRuleKindSchema.optional(),
 	delivery: NcDeliverySchema.optional(),
-	systemEventKinds: zod.z.array(NcSystemEventKindSchema).optional()
+	systemEventKinds: zod.z.array(NcSystemEventKindSchema).optional(),
+	/** The rule's system-event delivery (D647); absent = instant. */
+	systemEventDelivery: NcSystemEventDeliveryModeSchema.optional()
 });
 /** Input to `previewTemplate` — the editor's own context, plus the draft text. */
 var NcTemplatePreviewInputSchema = zod.z.object({
@@ -19676,6 +19736,17 @@ var notificationRulesCapability = {
 			auth: "admin"
 		}),
 		/**
+		* The STATE SUMMARY a system rule would send now (D647) — for a saved rule
+		* or an unsaved draft. Pure: sends nothing, stamps nothing. A MUTATION
+		* only for transport (a whole rule does not belong in a GET URL). Admin,
+		* like `testRule`: it names devices and nodes across the installation.
+		*/
+		previewStateSummary: require_sleep.method(zod.z.object({ rule: NcRuleInputSchema }), NcStateSummaryPreviewSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "view"
+		}),
+		/**
 		* The machine-readable condition surface a rule editor renders from, plus
 		* the picker VOCABULARY those conditions draw on.
 		*
@@ -20140,1049 +20211,214 @@ var oauthIntegrationCapability = {
 getDescriptor: require_sleep.method(zod.z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 //#endregion
-//#region src/capabilities/pipeline-executor.cap.ts
+//#region src/capabilities/pipeline-analytics.cap.ts
 /**
-* Reference to the frame's retained NATIVE surface + the parent crop's placement
-* within the frame, so the executor can re-cut a leaf child ROI at native
-* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+* pipeline-analytics — device-scoped wrapper cap. Refines raw
+* per-frame detections emitted by the pipeline runner into tracked
+* objects, per-kind event collections (motion / object / audio), and
+* persisted media. Owns the post-detection domain end-to-end:
+*
+*   runner emits PipelineInferenceResult
+*     ↓ (event bus)
+*   pipeline-analytics subscriber
+*     ↓ SORT tracker + zone engine + state analyzer + event emitter
+*   → three DB collections (one per kind), one FS media tree, one
+*     unified event emitter (FrameTracked + TrackStarted/Ended +
+*     DetectionEvent on bus)
+*
+* Pure subscriber model. No `processFrame` cap method — the runner
+* already publishes the raw frame on the bus. The cap surface is
+* only QUERIES + per-device settings, bound on/off via
+* `device-manager.setWrapperActive`. `defaultActive: true` because
+* every camera with a detection pipeline wants its raw detections
+* refined; operators opt out per-device via BindingsTab when needed.
+*
+* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
+* (per-device surface) and `track-trail` caps — see P11 cleanup.
 */
-var NativeCropRefSchema = zod.z.object({
-	/** Handle keying the retained native surface (node-pinned to its owner). */
-	handle: require_sleep.FrameHandleSchema,
-	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-	cropFrameSpace: zod.z.object({
-		x: zod.z.number(),
-		y: zod.z.number(),
-		w: zod.z.number(),
-		h: zod.z.number()
-	})
-});
-zod.z.object({
-	crop: zod.z.object({
-		left: zod.z.number(),
-		top: zod.z.number(),
-		width: zod.z.number().positive(),
-		height: zod.z.number().positive()
-	}).optional(),
-	content: zod.z.object({
-		width: zod.z.number().int().positive(),
-		height: zod.z.number().int().positive()
-	}),
-	fit: zod.z.enum(["stretch", "contain"]),
-	format: zod.z.enum([
-		"rgb",
-		"gray",
-		"jpeg"
-	])
-});
+var TrackStateSchema = zod.z.enum([
+	"new",
+	"entered",
+	"left",
+	"moving",
+	"idle"
+]);
+var EventKindSchema = zod.z.enum([
+	"motion",
+	"object",
+	"audio"
+]);
 /**
-* Process-local frame identity. It is serializable so it can ride an in-process
-* capability call, but `registryId` deliberately prevents resolution in any
-* other process or execution group.
+* Spatial filter for `listTracks` — the rect + polygon variants of the shared
+* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
+* of the camera frame (top-left origin), matching the drawing-plane editor.
 */
-var FrameRefSchema = zod.z.object({
-	registryId: zod.z.string().min(1),
-	id: zod.z.string().min(1),
-	width: zod.z.number().int().positive(),
-	height: zod.z.number().int().positive(),
-	format: zod.z.enum(["rgb", "gray"]),
-	timestamp: zod.z.number(),
-	capturedAt: zod.z.number().optional()
-});
-var ModelFormatSchema$1 = zod.z.enum([
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
+var TrackZoneFilterSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
+/** Closed icon vocabulary so clients render a known glyph per kind. */
+var EventKindIconSchema = zod.z.enum([
+	"motion",
+	"audio",
+	"person",
+	"vehicle",
+	"animal",
+	"door",
+	"pir",
+	"smoke",
+	"water",
+	"button",
+	"package",
+	"generic"
 ]);
-var PipelineSlotSchema = zod.z.enum([
-	"detector",
-	"cropper",
-	"classifier",
-	"refiner",
-	"audio-classifier"
+var EventKindCategorySchema = zod.z.enum([
+	"motion",
+	"audio",
+	"detection",
+	"sensor",
+	"control",
+	"custom",
+	"package"
 ]);
-var PipelineEngineChoiceSchema = zod.z.object({
-	runtime: zod.z.enum(["node", "python"]),
-	backend: zod.z.string(),
-	format: ModelFormatSchema$1,
-	device: zod.z.string().optional()
-});
-var EngineDeviceInfoSchema = zod.z.object({
-	id: zod.z.string(),
+/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
+var EventKindLevelSchema = zod.z.enum(["macro", "sub"]);
+var EventKindDescriptorSchema = zod.z.object({
+	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
+	kind: zod.z.string(),
+	/** i18n key resolved on the UI side; `label` is the English fallback. */
+	labelKey: zod.z.string(),
+	/** English fallback label (kept for clients that don't translate). */
 	label: zod.z.string(),
-	description: zod.z.string().optional()
-});
-var AvailableEngineSchema = zod.z.object({
-	engine: PipelineEngineChoiceSchema,
-	devices: zod.z.array(EngineDeviceInfoSchema).readonly(),
-	defaultDevice: zod.z.string()
-});
-var PipelineDefaultStepSchema = zod.z.lazy(() => zod.z.object({
-	addonId: zod.z.string(),
-	addonName: zod.z.string(),
-	slot: PipelineSlotSchema,
-	inputClasses: zod.z.array(zod.z.string()).readonly(),
-	outputClasses: zod.z.array(zod.z.string()).readonly(),
-	enabled: zod.z.boolean(),
-	modelId: zod.z.string(),
-	children: zod.z.array(PipelineDefaultStepSchema).readonly(),
-	group: zod.z.string().optional(),
-	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-}));
-var PipelineTemplateStepSchema = zod.z.lazy(() => zod.z.object({
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	modelId: zod.z.string(),
-	children: zod.z.array(PipelineTemplateStepSchema).readonly(),
-	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	createdAt: zod.z.string(),
-	updatedAt: zod.z.string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: zod.z.array(PipelineTemplateStepSchema).readonly()
+	/** Hex color for timeline/legend rendering. */
+	color: zod.z.string(),
+	/** Dictionary id → lucide component on the UI side. */
+	iconId: zod.z.string(),
+	/** Legacy closed-vocab glyph — fallback for `iconId`. */
+	icon: EventKindIconSchema,
+	category: EventKindCategorySchema,
+	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+	parentKind: zod.z.string().nullable(),
+	/** Derived from `parentKind`, explicit for the client tree. */
+	level: EventKindLevelSchema,
+	/** Which cap + device contributes this kind. For built-ins the camera
+	*  itself; for sensor kinds the LINKED source device. */
+	source: zod.z.object({
+		capName: zod.z.string(),
+		deviceId: zod.z.number()
+	})
 });
-var PipelineModelOptionSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	formats: zod.z.record(zod.z.string(), zod.z.object({
-		downloaded: zod.z.boolean(),
-		sizeMB: zod.z.number()
-	})),
-	group: ModelVariantGroupSchema.optional(),
-	legacy: zod.z.boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	kinds: zod.z.array(EventKindDescriptorSchema).readonly()
 });
-var ConfigFieldBridge = zod.z.custom();
-var PipelineAddonSchemaSchema = zod.z.object({
+var SensorEventSchema = zod.z.object({
 	id: zod.z.string(),
-	name: zod.z.string(),
-	slot: PipelineSlotSchema,
-	inputClasses: zod.z.array(zod.z.string()).readonly(),
-	outputClasses: zod.z.array(zod.z.string()).readonly(),
-	childSlots: zod.z.array(PipelineSlotSchema).readonly(),
-	models: zod.z.array(PipelineModelOptionSchema).readonly(),
-	defaultModelId: zod.z.string(),
-	defaultModelIdByFormat: zod.z.record(zod.z.string(), zod.z.string()).optional(),
-	enabledByDefault: zod.z.boolean().optional(),
-	backfillIntoExistingOverrides: zod.z.boolean().optional(),
-	defaultConfidence: zod.z.number(),
-	group: zod.z.string().optional(),
-	configSchema: zod.z.array(ConfigFieldBridge).readonly().optional()
-});
-var PipelineSlotSchemaSchema = zod.z.object({
-	id: PipelineSlotSchema,
-	label: zod.z.string(),
-	priority: zod.z.number(),
-	parentSlot: PipelineSlotSchema.nullable(),
-	addons: zod.z.array(PipelineAddonSchemaSchema).readonly()
-});
-var PipelineSchemaSchema = zod.z.object({
-	availableEngines: zod.z.array(AvailableEngineSchema).readonly(),
-	selectedEngine: PipelineEngineChoiceSchema,
-	slots: zod.z.array(PipelineSlotSchemaSchema).readonly()
-});
-var EngineProvisioningSchema = zod.z.object({
-	runtimeId: zod.z.enum([
-		"onnx",
-		"openvino",
-		"coreml",
-		"edgetpu"
-	]).nullable(),
-	device: zod.z.string().nullable(),
-	state: zod.z.enum([
-		"idle",
-		"installing",
-		"verifying",
-		"ready",
-		"failed"
-	]),
-	progress: zod.z.number().optional(),
-	error: zod.z.string().optional(),
-	nextRetryAt: zod.z.number().optional(),
-	/**
-	* Gate A (config-correctness gate at engine change): human-readable
-	* config issues surfaced EAGERLY when the node's engine changes — model
-	* substitutions ("chose X, running Y") and zero-build steps ("no model
-	* has a <format> build"). Additive/optional: informational only, never
-	* enforced here — `assertEngineReady` (readiness) still gates inference.
-	* Absent/empty when the node-default tree resolves cleanly.
-	*/
-	configIssues: zod.z.array(zod.z.string()).optional()
-});
-var PipelineStepInputSchema = zod.z.lazy(() => zod.z.object({
-	addonId: zod.z.string(),
-	modelId: zod.z.string().optional(),
-	enabled: zod.z.boolean().default(true),
-	children: zod.z.array(PipelineStepInputSchema).optional(),
-	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	jumpDeviceKey: zod.z.string().optional()
-}));
-var ModelSubstitutionSchema = zod.z.object({
-	addonId: zod.z.string(),
-	chosen: zod.z.string(),
-	running: zod.z.string(),
-	format: zod.z.string()
-});
-var PipelineValidationIssueSchema = zod.z.object({
-	addonId: zod.z.string(),
-	kind: zod.z.enum(["unknown-addon", "no-format-build"]),
-	detail: zod.z.string()
-});
-var PipelineValidationResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	issues: zod.z.array(PipelineValidationIssueSchema).readonly(),
-	substitutions: zod.z.array(ModelSubstitutionSchema).readonly(),
-	/** The node's `currentEngine.format` this validation ran against. */
-	format: zod.z.string()
-});
-var ReferenceImageEntrySchema = zod.z.object({
-	filename: zod.z.string(),
-	stepIds: zod.z.array(zod.z.string()).readonly().optional()
-});
-var ReferenceImageBodySchema = zod.z.object({
-	base64: zod.z.string(),
-	filename: zod.z.string()
-});
-var ReferenceAudioEntrySchema = zod.z.object({
-	filename: zod.z.string(),
-	sizeKb: zod.z.number()
+	/** The CAMERA the event is attributed to (a sensor linked to N cameras
+	*  yields N rows, one per camera). */
+	deviceId: zod.z.number(),
+	/** The linked sensor device whose state changed. */
+	sourceDeviceId: zod.z.number(),
+	/** Event kind id — matches an `EventKindDescriptor.kind`. */
+	kind: zod.z.string(),
+	/** Snapshot of the sensor cap's runtime-state slice at the change. */
+	value: zod.z.record(zod.z.string(), zod.z.unknown()).nullable(),
+	timestamp: zod.z.number()
 });
-var ReferenceAudioBodySchema = zod.z.object({ base64: zod.z.string() });
-var AudioBackendSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	description: zod.z.string(),
-	available: zod.z.boolean(),
+/**
+* One stored sighting on a track's trajectory.
+*
+* The array these live in is returned in TIME order (D399) — it is APPENDED in
+* arrival order, and the two detector passes interleave, so a consumer must not
+* assume the two are the same on a row written by an older build.
+*/
+var TrackPositionSchema = zod.z.object({
+	x: zod.z.number(),
+	y: zod.z.number(),
+	timestamp: zod.z.number(),
+	bbox: BoundingBoxSchema,
 	/**
-	* Raw classifier labels this backend can emit (e.g. YAMNet's
-	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
-	* the benchmark UI to populate the `enabledMicroClasses` filter
-	* specific to the selected backend without a separate fetch.
+	* Which detector pass measured this box (D399): `frame` is the full-frame
+	* pass on the analysis raster, `recovery` is the native-resolution
+	* small-subject second pass (D377/D378). Both write into one array, and until
+	* this field existed the only way to tell them apart was that full-frame boxes
+	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
+	* Absent on rows written before D399.
 	*/
-	rawLabels: zod.z.array(zod.z.string()).readonly().optional()
+	source: zod.z.enum(["frame", "recovery"]).optional(),
+	/** Detection score of this box, so a position can be weighed and not only
+	*  plotted. Absent on rows written before D399. */
+	score: zod.z.number().optional()
 });
-var AudioCapabilitiesSchema = zod.z.object({
-	activeBackend: zod.z.string(),
-	availableBackends: zod.z.array(AudioBackendSchema).readonly(),
-	sampleRate: zod.z.number(),
-	chunkDurationMs: zod.z.number()
+var TrackSnapshotSchema = zod.z.object({
+	timestamp: zod.z.number(),
+	position: TrackPositionSchema,
+	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
+	mediaId: zod.z.number().int()
 });
-var DownloadModelResultSchema = zod.z.object({
-	filePath: zod.z.string(),
-	sizeMB: zod.z.number(),
-	durationMs: zod.z.number()
+/**
+* Normalized 0..1 trajectory envelope (min/max over every position bbox,
+* divided by the track's detection-frame dims), computed at persist time.
+* Absent when the frame dims were unknown when the track was persisted
+* (legacy rows / dims-less sources) and on active (in-RAM) tracks.
+*/
+var TrackEnvelopeSchema = zod.z.object({
+	minX: zod.z.number(),
+	minY: zod.z.number(),
+	maxX: zod.z.number(),
+	maxY: zod.z.number()
 });
 /**
-* Wrapper carrying a single test run's result. Replaces the legacy
-* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
-* canonical `AudioResult` from the Phase 6 output rework: one
-* `AudioDetection` per class above `minScore`, top-N candidates in
-* `debug.alternateLabels['audio-classifier']`, per-source timings in
-* `debug.stepTimings`. The outer `success`/`error` fields stay so the
-* benchmark UI can still report a clean failure when the classifier
-* cap isn't available.
+* Row projection for track list queries. `full` (default) returns the
+* complete Track including the frame-rate `positions[]` history and the
+* `snapshots[]` references — megabytes across a page of tracks. `slim`
+* keeps every scalar the list surfaces actually render (ids, class(es),
+* label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
+* zonesVisited, bestEventId, envelope, hasFace, hasEmbeddedFace, hasRider) and returns `positions` /
+* `snapshots` as EMPTY arrays — detail views re-fetch the full row via
+* `getTrack`. Mirrors the event-store `projection` convention
+* (`getObjectEvents` et al.).
 */
-var AudioTestResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	frame: zod.z.custom().optional()
+var TrackProjectionSchema = zod.z.enum(["full", "slim"]);
+/**
+* One audio-classification label heard on the track's camera while the
+* track was alive, aggregated per label. An "episode" is one persisted
+* audio event (the confident-classification path: score ≥ the device's
+* `classificationMinScore`, class-change-or-heartbeat coalesced) — NOT
+* one 32 ms inference chunk, so counts stay human-scaled.
+*/
+var TrackAudioLabelSchema = zod.z.object({
+	label: zod.z.string(),
+	/** Highest classification score observed across the label's episodes. */
+	peakScore: zod.z.number(),
+	/** Number of coalesced audio-event episodes carrying this label. */
+	count: zod.z.number(),
+	firstAt: zod.z.number(),
+	lastAt: zod.z.number()
 });
-var PipelineConfigBridge = zod.z.custom();
-var ConfigUISchemaBridge = zod.z.custom();
-var ConfigUISchemaNullableBridge = zod.z.custom();
-var InferenceCapabilitiesBridge = zod.z.custom();
-var ModelAvailabilityListBridge = zod.z.custom();
-var PipelineRunResultBridge = zod.z.custom();
 /**
-* Pipeline executor — detection engine + configuration + inference API.
+* How a track was produced. `pipeline` (default / absent) = the spatial
+* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
+* no positions, a single snapshot, and no bbox trajectory at all:
 *
-* Merged from: pipeline-executor, pipeline-config, inference, detection-config.
-* Implemented by the detection-pipeline addon.
+*  - `sensor` — a linked sensor/control device state change.
+*  - `audio` — an audio event on the camera itself that was anomalous for
+*    THAT camera, loud, and heard while nothing visual was happening (D62).
 *
-* Per-device surface (DeviceSettingsContribution + the "is detection
-* enabled for this camera?" toggle) lives on the paired
-* `detection-pipeline` cap (device-scoped, singleton, wrapper
-* defaultActive) — same split pattern used by stream-broker /
-* camera-streams and audio-analyzer / audio-analysis.
-*/
-var pipelineExecutorCapability = {
-	name: "pipeline-executor",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		getAvailableEngines: require_sleep.method(zod.z.void(), zod.z.array(PipelineEngineChoiceSchema)),
-		getSelectedEngine: require_sleep.method(zod.z.void(), PipelineEngineChoiceSchema),
-		getDefaultSteps: require_sleep.method(PipelineEngineChoiceSchema, zod.z.array(PipelineDefaultStepSchema)),
-		/**
-		* Per-node detection-engine provisioning snapshot. Returns the live
-		* state of the lazy runtime-provisioning machine on `nodeId`
-		* (idle / installing / verifying / ready / failed). The UI pairs this
-		* one-shot query with the `pipeline.engine-provisioning` live event
-		* (emitted on every transition) to drive a per-node "engine ready?"
-		* indicator without polling. Phase 2.
-		*/
-		getEngineProvisioning: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), EngineProvisioningSchema),
-		getVideoPipelineSteps: require_sleep.method(zod.z.void(), zod.z.record(zod.z.string(), zod.z.object({
-			modelId: zod.z.string(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
-		}))),
-		setVideoPipelineSteps: require_sleep.method(zod.z.object({ steps: zod.z.record(zod.z.string(), zod.z.object({
-			modelId: zod.z.string(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
-		})) }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Clear THIS node's executor-side PER-DEVICE settings stores (the
-		* per-camera step overrides the object-detection root reads via
-		* `applyDeviceOverridesToTree`). `nodeId` is the ROUTING key — the
-		* generated cap-router strips it (default `nodeIdMode: 'routing'`) and
-		* dispatches to that node, so the provider method runs ON the target
-		* node and receives no `nodeId`.
-		*
-		* This is the slimmed executor leg of the orchestrator's
-		* `resetNodePipelineDefaults` flow (which owns the real reset: node
-		* addonDefaults pins + per-camera orchestrator overrides). The legacy
-		* `resetToDefault` — which reset a persisted global step-tree seed
-		* nothing in the live per-camera path read — was removed together with
-		* that seed.
-		*/
-		clearDeviceOverrides: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.object({
-			success: zod.z.literal(true),
-			clearedDevices: zod.z.number()
-		}), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Which of THIS node's inference devices the executor currently refuses,
-		* and why. `nodeId` is the ROUTING key (stripped by the generated router).
-		*
-		* The channel that did not exist. Pool health was known only inside the
-		* detection addon and was an input to no routing decision anywhere: the
-		* per-dispatch capability gate is keyed on model FORMAT and so can never
-		* separate `openvino:gpu` from `openvino:npu`, and the orchestrator's live
-		* eligibility probe (`platformProbe.getCapabilities`) answers about
-		* HARDWARE — which was present throughout. So when the hub's `openvino:gpu`
-		* Python worker was SIGABRT'd by the Intel GPU plugin on 2026-08-25, the
-		* balancer went on handing that dead pool cameras by rotation for 31 hours:
-		* ~370 000 `PoolWorker[w0]: not initialized` lines, every frame lost.
-		*
-		* Read semantics the caller depends on, and which the provider guarantees:
-		* this is a synchronous read of in-memory state. It never probes hardware,
-		* never spawns a pool and never throws — an EMPTY `unhealthy` means "asked,
-		* nothing is refused", which is what re-admits a device. A read that FAILS
-		* (node offline, version skew) must therefore be distinguishable from an
-		* empty answer, and it is: it rejects.
-		*/
-		getInferenceDeviceHealth: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.object({ unhealthy: zod.z.array(zod.z.object({
-			/** `<backend>:<device>`, e.g. `openvino:gpu`. */
-			deviceKey: zod.z.string(),
-			/**
-			* `failed` — the per-device restart budget is exhausted; no pool
-			* will be spawned until an operator re-arms it or the runner
-			* respawns. `backoff` — under budget, waiting out the backoff (or
-			* a cached pool observed dead and not yet condemned).
-			*/
-			state: zod.z.enum(["failed", "backoff"]),
-			/** Epoch ms of the death that produced this state. */
-			since: zod.z.number(),
-			/** Pool deaths inside the current window. */
-			deaths: zod.z.number(),
-			/** The last death's message. */
-			lastError: zod.z.string()
-		})).readonly() })),
-		/**
-		* Re-arm a terminally `failed` inference device on `nodeId`: forget its
-		* restart budget so the next dispatch builds a fresh pool.
-		*
-		* The terminal state is deliberate (the abort it bounds is deterministic —
-		* an automatic probation would just respawn Python forever, more slowly),
-		* and a terminal state an operator cannot leave is a silent fault. This is
-		* the way out. `rearmed:false` means there was nothing to forget.
-		*/
-		rearmInferenceDevice: require_sleep.method(zod.z.object({
-			nodeId: zod.z.string(),
-			deviceKey: zod.z.string()
-		}), zod.z.object({ rearmed: zod.z.boolean() }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getSchema: require_sleep.method(zod.z.void(), PipelineSchemaSchema),
-		getGlobalSteps: require_sleep.method(zod.z.void(), zod.z.array(PipelineDefaultStepSchema).readonly().nullable()),
-		getGlobalPipelineConfig: require_sleep.method(zod.z.void(), PipelineConfigBridge),
-		getOrchestratorConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaBridge),
-		/**
-		* Gate B (pre-init config-correctness gate). PURE COMPUTE against this
-		* node's `currentEngine.format` — resolves `steps` the same way the
-		* runtime dispatch path would, and reports what WOULD happen without
-		* touching any node-global state. Called by the orchestrator at attach
-		* time (`attachOn`), node-pinned to the TARGET node, so config problems
-		* surface BEFORE `pipelineRunner.attachCamera` rather than at the first
-		* per-frame resolve. `ok` is false iff `issues` is non-empty (both
-		* `unknown-addon` and `no-format-build` are HARD issues); `substitutions`
-		* is informational (a degraded-but-loadable model swap) and never
-		* affects `ok`. Never throws.
-		*/
-		validatePipeline: require_sleep.method(zod.z.object({ steps: zod.z.array(PipelineStepInputSchema) }), PipelineValidationResultSchema),
-		listTemplates: require_sleep.method(zod.z.void(), zod.z.array(PipelineTemplateSchema$1).readonly()),
-		saveTemplate: require_sleep.method(zod.z.object({
-			name: zod.z.string(),
-			steps: zod.z.array(PipelineTemplateStepSchema).readonly(),
-			engine: PipelineEngineChoiceSchema
-		}), PipelineTemplateSchema$1, { kind: "mutation" }),
-		updateTemplate: require_sleep.method(zod.z.object({
-			id: zod.z.string(),
-			name: zod.z.string().optional(),
-			steps: zod.z.array(PipelineTemplateStepSchema).readonly().optional()
-		}), PipelineTemplateSchema$1, { kind: "mutation" }),
-		deleteTemplate: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
-		getCapabilities: require_sleep.method(zod.z.void(), InferenceCapabilitiesBridge),
-		getAddonModels: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), ModelAvailabilityListBridge),
-		downloadModel: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			modelId: zod.z.string(),
-			format: ModelFormatSchema$1
-		}), DownloadModelResultSchema, { kind: "mutation" }),
-		deleteModel: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			modelId: zod.z.string(),
-			format: ModelFormatSchema$1
-		}), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }),
-		/**
-		* Stateless single-frame execution. Callers (runner, benchmark) pass
-		* the complete `engine` + `steps` tree; the executor holds no state
-		* about cameras or saved pipelines.
-		*
-		* `engine` is optional during the migration window to preserve the
-		* legacy call shape used by existing benchmark code; once all
-		* callers pass it explicitly we make it required.
-		*
-		* Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
-		* `referenceImage` must be provided:
-		*  - `frame`: runtime dispatch path (runner → decoded broker frame).
-		*    Carries the raw buffer, dimensions, and format; the executor
-		*    uses it directly without base64 round-tripping.
-		*  - `frameHandle` (CB5): a zero-pixel shm `FrameHandle` for the SAME
-		*    decoded frame. Both runner and executor are hub-local processes
-		*    sharing `/dev/shm`, so the executor maps the named segment and
-		*    reads the pixels back zero-copy — eliminating the ~1.2MB
-		*    re-serialisation over UDS/MsgPack the `frame` path pays per call.
-		*    High-risk: the FrameRing is a latest-wins seqlock with no
-		*    refcount, so a recycled slot yields a null read; the executor
-		*    then degrades to an empty result and the runner ships pixels via
-		*    `frame` as the fallback (queue-depth gated on the runner side).
-		*  - `imageBase64`: one-shot test path (benchmark ImageTab).
-		*  - `referenceImage`: named file from the reference-image store.
-		*/
-		runPipeline: require_sleep.method(zod.z.object({
-			engine: PipelineEngineChoiceSchema.optional(),
-			steps: zod.z.array(PipelineStepInputSchema).min(1),
-			frame: FrameInputSchema.optional(),
-			/**
-			* Process-local lazy frame. Valid only when caller and provider resolve
-			* in the same execution-group process; split/cross-node callers use
-			* `frame`/`image` inline compatibility instead.
-			*/
-			frameRef: FrameRefSchema.optional(),
-			/**
-			* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-			* the decoded pixels live in. One more member of the one-of
-			* frame/frameHandle/image/imageBase64/referenceImage group.
-			*/
-			frameHandle: require_sleep.FrameHandleSchema.optional(),
-			imageBase64: zod.z.string().optional(),
-			/**
-			* Binary JPEG bytes — preferred over `imageBase64` on internal
-			* hops (hub → forked worker via Moleculer MsgPack) because it
-			* skips the 33% base64 overhead + the per-call base64 decode on
-			* the detection-pipeline worker. Callers can pass either; exactly
-			* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-			*/
-			image: zod.z.instanceof(Uint8Array).optional(),
-			referenceImage: zod.z.string().optional(),
-			deviceId: zod.z.number().optional(),
-			sessionId: zod.z.string().optional(),
-			/**
-			* Execution plane. 'full' (default) runs the whole tree — benchmark,
-			* reference-image, and detail-subtree calls. 'frame' is the live
-			* per-frame dispatch: ONLY root-plane steps run; crop children
-			* (inputClasses ≠ null) are skipped and served per-track via
-			* pipelineRunner.runDetailSubtree (two-plane design).
-			*/
-			plane: zod.z.enum(["full", "frame"]).optional(),
-			/**
-			* Inference-device selector (Phase 2 multi-device). Format
-			* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-			* Omitted ⇒ the runner's default device (current single-engine
-			* behaviour). Selects WHICH device pool of the node runs the call.
-			*/
-			deviceKey: zod.z.string().optional(),
-			/**
-			* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-			* when the parent crop was resolved from the frame's retained NATIVE
-			* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-			* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-			* resolution from that surface — the SAME quality path faces already
-			* had — instead of the downscaled parent tile. `handle` keys the native
-			* surface (node-pinned to its owner); `cropFrameSpace` is the parent
-			* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-			* the executor's crop-normalized child ROI back into frame-normalized
-			* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-			* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-			* (today's behaviour on the fallback path).
-			*/
-			nativeCropRef: NativeCropRefSchema.optional()
-		}), PipelineRunResultBridge, { kind: "mutation" }),
-		/**
-		* Batched run — N raw frames packed into one cap call. The provider
-		* routes the batch through `SharedInferencePool.inferBatch`
-		* (`MSG_INFER_BATCH = 0x03`) so the IPC framing and JSON response
-		* envelope cost is amortised N:1 vs N concurrent `runPipeline`
-		* calls. Single root step + uniform model assumed; trees with crop
-		* children fall back to sequential execution.
-		*
-		* Used by `scripts/bench-batch-style.mts` for batch benchmarking —
-		* N frames in one call to amortise per-call IPC overhead.
-		*/
-		runPipelineBatch: require_sleep.method(zod.z.object({
-			engine: PipelineEngineChoiceSchema.optional(),
-			steps: zod.z.array(PipelineStepInputSchema).min(1),
-			frames: zod.z.array(FrameInputSchema).min(1).max(255),
-			deviceId: zod.z.number().optional(),
-			sessionId: zod.z.string().optional(),
-			/**
-			* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-			* the batch to the Python pool's bench preprocess cache
-			* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-			* preprocessed ONCE and every later inference is a pure-inference cache
-			* hit — the sustained-throughput run measures inference, not
-			* decode+preprocess+infer. Omitted/0 for live frames (all different →
-			* full preprocess every call, correct). Fresh per sustained run;
-			* released via `uncacheFrame`.
-			*/
-			frameId: zod.z.number().int().nonnegative().optional(),
-			/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-			deviceKey: zod.z.string().optional()
-		}), zod.z.object({ results: zod.z.array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
-		/**
-		* Cache a raw frame inside the Python inference pool's memory.
-		* Returns a numeric `frameId` that `inferCached` references —
-		* subsequent calls send only 5 bytes through the pipe instead of
-		* 1.2MB raw data, eliminating the pipe transfer bottleneck.
-		*/
-		cacheFrameInPool: require_sleep.method(zod.z.object({
-			data: zod.z.instanceof(Uint8Array),
-			width: zod.z.number().int().positive(),
-			height: zod.z.number().int().positive(),
-			format: zod.z.enum([
-				"rgb",
-				"bgr",
-				"gray"
-			])
-		}), zod.z.object({
-			frameId: zod.z.number(),
-			width: zod.z.number(),
-			height: zod.z.number()
-		}), { kind: "mutation" }),
-		/**
-		* Run inference on a previously cached frame. Sends only 5 bytes
-		* (model_idx + frameId) through the IPC pipe — eliminates the
-		* ~35ms per-call overhead of transferring 1.2MB raw data.
-		*/
-		inferCached: require_sleep.method(zod.z.object({
-			stepId: zod.z.string(),
-			frameId: zod.z.number().int()
-		}), zod.z.record(zod.z.string(), zod.z.unknown()), { kind: "mutation" }),
-		/**
-		* Release a cached frame from the Python pool's memory.
-		*/
-		uncacheFrame: require_sleep.method(zod.z.object({ frameId: zod.z.number().int() }), zod.z.void(), { kind: "mutation" }),
-		/** Returns the effective pool tuning (resolved from user overrides + backend defaults). */
-		getEffectiveTuning: require_sleep.method(zod.z.void(), zod.z.object({
-			batchMode: zod.z.string(),
-			windowMs: zod.z.number(),
-			maxBatchSize: zod.z.number(),
-			concurrency: zod.z.number()
-		})),
-		/**
-		* List every EngineFactory currently loaded in this executor's RAM,
-		* with the models resident and a coarse "in use" marker derived from
-		* ongoing inference activity. Used by the Pipeline page Engines tab.
-		*/
-		listLoadedEngines: require_sleep.method(zod.z.void(), zod.z.array(zod.z.object({
-			engineKey: zod.z.string(),
-			engine: PipelineEngineChoiceSchema,
-			modelsLoaded: zod.z.array(zod.z.string()).readonly(),
-			inUseByCameras: zod.z.array(zod.z.number()).readonly(),
-			/**
-			* Origin of this resident factory.
-			*  - `runtime`       — main camera-serving engine (no idle TTL).
-			*  - `warm-override` — benchmark/test override held in the warm
-			*                      cache; auto-disposed after the idle TTL.
-			*  - `device-pool`   — a concurrent per-device pool (Phase 2
-			*                      multi-device, keyed by `deviceKey`) resolved
-			*                      via `resolveDeviceFactory`. Runs alongside the
-			*                      `runtime` engine on a DIFFERENT accelerator
-			*                      (NPU / iGPU / Coral) — this is how the
-			*                      Engines tab shows all pools running at once.
-			*/
-			kind: zod.z.enum([
-				"runtime",
-				"warm-override",
-				"device-pool"
-			]),
-			/** Native pid of the underlying Python pool (null when no pool). */
-			poolPid: zod.z.number().nullable(),
-			/** ms since this factory was last used (null when not warm-tracked). */
-			idleMs: zod.z.number().nullable(),
-			/** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-			idleTtlMs: zod.z.number().nullable()
-		})).readonly()),
-		/** Warm up an engine without running a frame. No-op if already loaded. */
-		spinEngine: require_sleep.method(zod.z.object({ engine: PipelineEngineChoiceSchema }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Unload an engine from RAM. `force:true` unloads even when cameras
-		* are actively using it (they re-spin on next frame). Default is
-		* gated — returns `{success:false, reason}` when in use.
-		*/
-		killEngine: require_sleep.method(zod.z.object({
-			engine: PipelineEngineChoiceSchema,
-			force: zod.z.boolean().optional()
-		}), zod.z.object({
-			success: zod.z.boolean(),
-			reason: zod.z.string().optional()
-		}), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		listReferenceImages: require_sleep.method(zod.z.void(), zod.z.array(ReferenceImageEntrySchema).readonly()),
-		getReferenceImage: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceImageBodySchema.nullable()),
-		getReferenceAudioFiles: require_sleep.method(zod.z.void(), zod.z.array(ReferenceAudioEntrySchema).readonly()),
-		getReferenceAudio: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceAudioBodySchema.nullable()),
-		getAudioCapabilities: require_sleep.method(zod.z.void(), AudioCapabilitiesSchema),
-		runAudioTest: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			modelId: zod.z.string(),
-			filename: zod.z.string().optional(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-		}), AudioTestResultSchema, { kind: "mutation" }),
-		getDetectionConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaNullableBridge)
-	}
-};
-//#endregion
-//#region src/capabilities/schemas/zone-rule.ts
-/**
-* Per-stage gating mode applied to the zones a rule references.
-*
-* - `include`: the rule contributes to a **whitelist** for its stage.
-*   When at least one `include` rule fires for a stage, only entities
-*   inside one of those zones pass that stage.
-* - `exclude`: the rule contributes to a **blacklist** for its stage.
-*   Entities inside one of those zones are dropped at that stage.
-*
-* `monitor`-style observation (count without filtering) is not a rule
-* mode — zones without any matching rule are observed naturally by
-* `zone-analytics` (live snapshot + history), so an "I just want to
-* count, not filter" use case needs no rule at all.
-*/
-var ZoneRuleModeEnum = zod.z.enum(["include", "exclude"]);
-/**
-* Per-consumer rule that references existing zones (geometry) and
-* defines how a specific pipeline stage should treat them. Each
-* consumer addon owns its own `ZoneRule[]` array in its per-device
-* settings:
-*
-* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
-* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
-* - future: notification rules, audio gating, etc.
-*
-* One rule applies to N zones (`zoneIds[]`) so the operator can
-* express "ignore motion in ALL of {garden, street}" with a single
-* rule. `classFilter` narrows the rule to specific object classes —
-* "drop person detections in the street, but keep cars" is one
-* `exclude` rule with `classFilter: ['person']`.
-*
-* `enabled` is a soft toggle — the operator can keep the rule
-* configured but inert without deleting it.
-*/
-var ZoneRuleSchema = zod.z.object({
-	/** Stable rule id — survives edits, used by the UI for diffing. */
-	id: zod.z.string(),
-	/** Optional human-readable label rendered in the rule editor. */
-	name: zod.z.string().optional(),
-	/** Zones this rule targets. The rule's `mode` applies to ALL
-	*  listed zones (OR-set: a detection in any one of them counts).
-	*  At least one zone id required — a rule with no targets is a
-	*  configuration mistake and the form validator rejects it. */
-	zoneIds: zod.z.array(zod.z.string()).min(1).readonly(),
-	mode: ZoneRuleModeEnum,
-	/**
-	* Class names this rule applies to. Empty / undefined ⇒ rule
-	* applies to every class. Class strings match the `macroClass`
-	* field on detections (e.g. `person`, `car`, `dog`).
-	*/
-	classFilter: zod.z.array(zod.z.string()).readonly().optional(),
-	/**
-	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
-	* required to consider an entity "in the zone". Defaults to the
-	* consumer's stage default when omitted. Kept for back-compat with
-	* existing per-rule overrides; new operators pick the value via
-	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-	* set, the lower-level engine reads it as a 0–1 fraction.
-	*/
-	overlapThreshold: zod.z.number().min(0).max(1).optional(),
-	/**
-	* Operator-friendly version of `overlapThreshold` — the percentage
-	* of the detection's bbox that must lie inside the zone for the
-	* rule to match. Documented default is 85%; the engine substitutes
-	* that when the field is omitted (kept optional so existing rules
-	* stored without it stay valid).
-	*
-	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-	* rule, the engine prefers `bboxInclusionPct` because it's the
-	* field exposed in the UI. Internally both feed the same gate.
-	*/
-	bboxInclusionPct: zod.z.number().min(0).max(100).optional(),
-	/**
-	* When `true` and a detection has a segmentation mask, use the
-	* mask for overlap instead of the bbox. Detection-stage only;
-	* motion rules ignore this field.
-	*/
-	preferMask: zod.z.boolean().optional(),
-	/**
-	* Soft-toggle: `false` disables the rule without deleting it.
-	* Defaults to `true` so operators creating a rule via the UI
-	* see it active immediately.
-	*/
-	enabled: zod.z.boolean().default(true)
-});
-/**
-* Convenience array schema — used by addon device-settings
-* contributions and runtime payloads (e.g. `RunnerCameraConfig`).
-*/
-var ZoneRulesArraySchema = zod.z.array(ZoneRuleSchema).readonly();
-//#endregion
-//#region src/capabilities/zones.cap.ts
-/**
-* Zone — pure geometry + identity. NO filtering behaviour.
-*
-* Zones describe **where** in the frame the operator wants to flag
-* something; consumer-owned {@link ZoneRule} arrays describe **how**
-* each pipeline stage uses them. Splitting the two means a single
-* polygon "Driveway" can simultaneously back a motion-exclude rule,
-* a detection-include rule on `['car']`, and an occupancy aggregate
-* — without three duplicated polygons.
-*
-* Owned by the orchestrator addon (provider) and mirrored into the
-* `zones` device-state slice on every mutation. Consumers
-* (motion-wasm, pipeline-executor, analytics, admin UI) read either
-* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
-* mirror with `onChanged`).
-*
-* Coordinates are normalised fractions of the frame (0–1) so zones
-* survive resolution changes and stream profile switches.
-*
-* `kind` discriminates between full polygons (closed regions used
-* for intrusion / occupancy filters) and tripwires (open 2-point
-* line segments used for cross events). Onboard / firmware-reported
-* zones (Reolink, ONVIF) are out of scope for now — see the deferred
-* task list.
-*/
-var ZoneKindEnum = zod.z.enum(["polygon", "tripwire"]);
-/** Polygon vertex in fraction-of-frame coordinates (0–1). */
-var PolygonPointSchema = zod.z.object({
-	x: zod.z.number(),
-	y: zod.z.number()
-});
-/** A camera detection zone — pure geometry/identity. */
-var ZoneSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: zod.z.array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: zod.z.string().default("#3b82f6")
-});
-/**
-* Zones capability — per-camera CRUD over polygon detection zones.
-*
-* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
-* to per-device settings and mirrors into the `zones` device-state
-* slice on every mutation, so downstream consumers can subscribe via
-* `dev.state.zones.onChanged`.
-*
-* The cap surface only handles geometry + identity; filtering
-* behaviour (per-class, include/exclude, threshold) lives in the
-* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
-* `capabilities/schemas/zone-rule.js`.
-*/
-var zonesCapability = {
-	name: "zones",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [require_sleep.DeviceType.Camera],
-	methods: {
-		listZones: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(ZoneSchema).readonly()),
-		addZone: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			zone: ZoneSchema
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		removeZone: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			zoneId: zod.z.string()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		updateZone: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			zone: ZoneSchema
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	/**
-	* Runtime-state slice — the live zone catalogue mirrored by the
-	* orchestrator on every CRUD mutation. Consumers read via
-	* `device.state.zones.value` / `.watch(...)` without round-tripping
-	* the cap, and the codegen DeviceProxy auto-wires the reactive
-	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
-	* (e.g. zone groupings) can sit alongside the polygon list.
-	*/
-	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
-	/**
-	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-//#endregion
-//#region src/capabilities/pipeline-analytics.cap.ts
-/**
-* pipeline-analytics — device-scoped wrapper cap. Refines raw
-* per-frame detections emitted by the pipeline runner into tracked
-* objects, per-kind event collections (motion / object / audio), and
-* persisted media. Owns the post-detection domain end-to-end:
-*
-*   runner emits PipelineInferenceResult
-*     ↓ (event bus)
-*   pipeline-analytics subscriber
-*     ↓ SORT tracker + zone engine + state analyzer + event emitter
-*   → three DB collections (one per kind), one FS media tree, one
-*     unified event emitter (FrameTracked + TrackStarted/Ended +
-*     DetectionEvent on bus)
-*
-* Pure subscriber model. No `processFrame` cap method — the runner
-* already publishes the raw frame on the bus. The cap surface is
-* only QUERIES + per-device settings, bound on/off via
-* `device-manager.setWrapperActive`. `defaultActive: true` because
-* every camera with a detection pipeline wants its raw detections
-* refined; operators opt out per-device via BindingsTab when needed.
-*
-* Replaces the legacy `analysis-pipeline`, `analysis-data-persistence`
-* (per-device surface) and `track-trail` caps — see P11 cleanup.
-*/
-var TrackStateSchema = zod.z.enum([
-	"new",
-	"entered",
-	"left",
-	"moving",
-	"idle"
-]);
-var EventKindSchema = zod.z.enum([
-	"motion",
-	"object",
-	"audio"
-]);
-/**
-* Spatial filter for `listTracks` — the rect + polygon variants of the shared
-* MaskShape vocabulary (see `mask-shape.ts`). Coordinates are NORMALIZED 0..1
-* of the camera frame (top-left origin), matching the drawing-plane editor.
-*/
-var TrackZoneFilterSchema = zod.z.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
-/** Closed icon vocabulary so clients render a known glyph per kind. */
-var EventKindIconSchema = zod.z.enum([
-	"motion",
-	"audio",
-	"person",
-	"vehicle",
-	"animal",
-	"door",
-	"pir",
-	"smoke",
-	"water",
-	"button",
-	"package",
-	"generic"
-]);
-var EventKindCategorySchema = zod.z.enum([
-	"motion",
-	"audio",
-	"detection",
-	"sensor",
-	"control",
-	"custom",
-	"package"
-]);
-/** Taxonomy level — macro (timeline lane) vs sub (events-page leaf). */
-var EventKindLevelSchema = zod.z.enum(["macro", "sub"]);
-var EventKindDescriptorSchema = zod.z.object({
-	/** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
-	kind: zod.z.string(),
-	/** i18n key resolved on the UI side; `label` is the English fallback. */
-	labelKey: zod.z.string(),
-	/** English fallback label (kept for clients that don't translate). */
-	label: zod.z.string(),
-	/** Hex color for timeline/legend rendering. */
-	color: zod.z.string(),
-	/** Dictionary id → lucide component on the UI side. */
-	iconId: zod.z.string(),
-	/** Legacy closed-vocab glyph — fallback for `iconId`. */
-	icon: EventKindIconSchema,
-	category: EventKindCategorySchema,
-	/** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
-	parentKind: zod.z.string().nullable(),
-	/** Derived from `parentKind`, explicit for the client tree. */
-	level: EventKindLevelSchema,
-	/** Which cap + device contributes this kind. For built-ins the camera
-	*  itself; for sensor kinds the LINKED source device. */
-	source: zod.z.object({
-		capName: zod.z.string(),
-		deviceId: zod.z.number()
-	})
-});
-/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
-var EventKindsForDeviceSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	kinds: zod.z.array(EventKindDescriptorSchema).readonly()
-});
-var SensorEventSchema = zod.z.object({
-	id: zod.z.string(),
-	/** The CAMERA the event is attributed to (a sensor linked to N cameras
-	*  yields N rows, one per camera). */
-	deviceId: zod.z.number(),
-	/** The linked sensor device whose state changed. */
-	sourceDeviceId: zod.z.number(),
-	/** Event kind id — matches an `EventKindDescriptor.kind`. */
-	kind: zod.z.string(),
-	/** Snapshot of the sensor cap's runtime-state slice at the change. */
-	value: zod.z.record(zod.z.string(), zod.z.unknown()).nullable(),
-	timestamp: zod.z.number()
-});
-/**
-* One stored sighting on a track's trajectory.
-*
-* The array these live in is returned in TIME order (D399) — it is APPENDED in
-* arrival order, and the two detector passes interleave, so a consumer must not
-* assume the two are the same on a row written by an older build.
-*/
-var TrackPositionSchema = zod.z.object({
-	x: zod.z.number(),
-	y: zod.z.number(),
-	timestamp: zod.z.number(),
-	bbox: BoundingBoxSchema,
-	/**
-	* Which detector pass measured this box (D399): `frame` is the full-frame
-	* pass on the analysis raster, `recovery` is the native-resolution
-	* small-subject second pass (D377/D378). Both write into one array, and until
-	* this field existed the only way to tell them apart was that full-frame boxes
-	* are exact multiples of 1.2 while recovery boxes are full-precision floats.
-	* Absent on rows written before D399.
-	*/
-	source: zod.z.enum(["frame", "recovery"]).optional(),
-	/** Detection score of this box, so a position can be weighed and not only
-	*  plotted. Absent on rows written before D399. */
-	score: zod.z.number().optional()
-});
-var TrackSnapshotSchema = zod.z.object({
-	timestamp: zod.z.number(),
-	position: TrackPositionSchema,
-	/** The snapshot's media row id (D482); resolve via `listTrackMedia({ trackId })`. */
-	mediaId: zod.z.number().int()
-});
-/**
-* Normalized 0..1 trajectory envelope (min/max over every position bbox,
-* divided by the track's detection-frame dims), computed at persist time.
-* Absent when the frame dims were unknown when the track was persisted
-* (legacy rows / dims-less sources) and on active (in-RAM) tracks.
-*/
-var TrackEnvelopeSchema = zod.z.object({
-	minX: zod.z.number(),
-	minY: zod.z.number(),
-	maxX: zod.z.number(),
-	maxY: zod.z.number()
-});
-/**
-* Row projection for track list queries. `full` (default) returns the
-* complete Track including the frame-rate `positions[]` history and the
-* `snapshots[]` references — megabytes across a page of tracks. `slim`
-* keeps every scalar the list surfaces actually render (ids, class(es),
-* label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope, hasFace, hasEmbeddedFace, hasRider) and returns `positions` /
-* `snapshots` as EMPTY arrays — detail views re-fetch the full row via
-* `getTrack`. Mirrors the event-store `projection` convention
-* (`getObjectEvents` et al.).
-*/
-var TrackProjectionSchema = zod.z.enum(["full", "slim"]);
-/**
-* One audio-classification label heard on the track's camera while the
-* track was alive, aggregated per label. An "episode" is one persisted
-* audio event (the confident-classification path: score ≥ the device's
-* `classificationMinScore`, class-change-or-heartbeat coalesced) — NOT
-* one 32 ms inference chunk, so counts stay human-scaled.
-*/
-var TrackAudioLabelSchema = zod.z.object({
-	label: zod.z.string(),
-	/** Highest classification score observed across the label's episodes. */
-	peakScore: zod.z.number(),
-	/** Number of coalesced audio-event episodes carrying this label. */
-	count: zod.z.number(),
-	firstAt: zod.z.number(),
-	lastAt: zod.z.number()
-});
-/**
-* How a track was produced. `pipeline` (default / absent) = the spatial
-* detection+tracking pipeline. Every OTHER value is a SYNTHETIC projection —
-* no positions, a single snapshot, and no bbox trajectory at all:
-*
-*  - `sensor` — a linked sensor/control device state change.
-*  - `audio` — an audio event on the camera itself that was anomalous for
-*    THAT camera, loud, and heard while nothing visual was happening (D62).
-*
-*  - `onboard` — the CAMERA's own firmware, paired with a decoded frame in
-*    that frame's pixel space. A real root detector and a SPATIAL one: its
-*    boxes are the same kind of fact `pipeline`'s are, produced by a different
-*    detector.
-*
-* `onboard` was missing here while `DetectionSourceSchema` already had it, so
-* a persisted onboard track failed `safeParse` on read and came back with NO
-* source at all — which `isSpatialTrack` then admitted by accident, through the
-* `undefined` arm rather than by anybody's decision, and which `excludeSources`
-* could not name.
-*
-* The spatial subsystems (tracker association, occupancy count, re-id /
-* embedding, resurrection) MUST skip every synthetic source. Test for that
-* with `isSpatialTrack`, which allow-lists the spatial sources explicitly — a
-* `!== 'sensor'` check silently readmits every source added after it was
-* written.
+*  - `onboard` — the CAMERA's own firmware, paired with a decoded frame in
+*    that frame's pixel space. A real root detector and a SPATIAL one: its
+*    boxes are the same kind of fact `pipeline`'s are, produced by a different
+*    detector.
+*
+* `onboard` was missing here while `DetectionSourceSchema` already had it, so
+* a persisted onboard track failed `safeParse` on read and came back with NO
+* source at all — which `isSpatialTrack` then admitted by accident, through the
+* `undefined` arm rather than by anybody's decision, and which `excludeSources`
+* could not name.
+*
+* The spatial subsystems (tracker association, occupancy count, re-id /
+* embedding, resurrection) MUST skip every synthetic source. Test for that
+* with `isSpatialTrack`, which allow-lists the spatial sources explicitly — a
+* `!== 'sensor'` check silently readmits every source added after it was
+* written.
 */
 var TrackSourceSchema = zod.z.enum([
 	"pipeline",
@@ -21574,6 +20810,22 @@ var TrackSchema = zod.z.object({
 	* omit it. Render nothing when absent.
 	*/
 	previewMissReason: zod.z.string().optional(),
+	/**
+	* The ROOT model that produced this track — the `FrameResult.rootModelId` of
+	* the frame it was BORN on (D646). What a later replay compares against, so
+	* "the original model" is named rather than assumed. A birth fact: never
+	* rewritten by a later frame. **Absent ≠ unknown-model**: a row from before
+	* the column, and a track the camera's own detector produced, carry none.
+	*/
+	modelId: zod.z.string().optional(),
+	/**
+	* Size (px) of the detection frame this track's `positions[].bbox` live in —
+	* the frame it was born on, else the camera's latest analysis frame at
+	* persist time. Divide a position by these to normalise it. Absent when the
+	* size was never known.
+	*/
+	frameWidth: zod.z.number().optional(),
+	frameHeight: zod.z.number().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -22625,25 +21877,6 @@ var MediaReclaimStatusSchema = zod.z.object({
 	finishedAtMs: zod.z.number().nullable(),
 	error: zod.z.string().nullable()
 });
-var ReplayFrameInputSchema = zod.z.object({
-	timestamp: zod.z.number(),
-	frame: PipelineRunResultBridge
-});
-var ReplayTrackSchema = zod.z.object({
-	className: zod.z.string(),
-	firstSeenMs: zod.z.number(),
-	lastSeenMs: zod.z.number(),
-	/** Bbox of the track's FIRST matched detection, pixel-space in the clip's
-	*  frame — a representative box for the diff's `(className, window, IoU)`
-	*  pairing (`replay-diff.ts`). A replay does not need the full per-frame
-	*  trajectory production's `Track.positions` keeps. */
-	bbox: BoundingBoxSchema,
-	/** How many of the input frames this track matched a real detection on
-	*  (never a coasted/extrapolated frame) — the replay's own signal for "how
-	*  solid is this track", cheaper than re-deriving it from a trajectory. */
-	framesMatched: zod.z.number().int()
-});
-var RunReplayFrameProcessorResultSchema = zod.z.object({ tracks: zod.z.array(ReplayTrackSchema).readonly() });
 /**
 * The long-term series a camera produces. A closed union so a typo cannot
 * invent one, and the ONE declaration of it — the addon's `AnalyticsLtsSeries`
@@ -23338,320 +22571,965 @@ var pipelineAnalyticsCapability = {
 		deselectRetrainFrame: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
 			trackId: zod.z.string(),
-			frameId: zod.z.string()
-		}), zod.z.object({
-			removed: zod.z.boolean(),
-			removedAnnotations: zod.z.number().int()
-		}), {
-			kind: "mutation",
-			auth: "admin"
-		}),
+			frameId: zod.z.string()
+		}), zod.z.object({
+			removed: zod.z.boolean(),
+			removedAnnotations: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The pixels of ONE copied frame, base64.
+		*
+		* Through the cap rather than a data plane because it is genuinely one
+		* frame at a time, on demand, at human speed — the shape D9/D18 permit
+		* (what they forbid is frames crossing a boundary at frame RATE). The
+		* annotation canvas needs the image and its exact dimensions in the same
+		* answer: a canvas that places a normalised box against a size it guessed
+		* draws every box in the wrong place.
+		*/
+		getRetrainFrameImage: require_sleep.method(zod.z.object({ frameId: zod.z.string() }), zod.z.object({
+			base64: zod.z.string(),
+			width: zod.z.number().int(),
+			height: zod.z.number().int()
+		}), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Ask the pipeline what it sees, as a PROPOSAL.
+		*
+		* Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
+		* every box comes back as a draft with `source: 'assist'` plus the model and
+		* score that produced it. The operator confirms, edits, adds and deletes;
+		* nothing is stored until `saveRetrainAnnotations`.
+		*
+		* For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
+		* never the whole frame, where a package detector at that threshold proposes
+		* furniture. A package request with no zone is REFUSED rather than widened,
+		* because the silent widening would look like a bad model for as long as
+		* nobody checked which rectangle it ran on.
+		*/
+		proposeRetrainAnnotations: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			subject: RetrainAssistSubjectSchema,
+			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+			nodeId: zod.z.string().optional()
+		}), RetrainAssistResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every annotation on a track, oldest first. */
+		listRetrainAnnotations: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Replace EVERY annotation on one frame with the supplied set.
+		*
+		* Whole-frame replacement, not per-box upsert: the unit of ground truth is
+		* the frame, and "the operator deleted a box" must be the same durable
+		* outcome as "the operator never drew it". A per-box patch would let a frame
+		* keep a box the operator removed on a surface that only knew about the
+		* boxes it sent.
+		*
+		* Refuses a macro class typed into `label` or `subLabel` — the tiers are
+		* separate and the guard is at the WRITE, because a mixed taxonomy cannot
+		* be un-mixed by reading it.
+		*/
+		saveRetrainAnnotations: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			annotations: zod.z.array(RetrainAnnotationDraftSchema)
+		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Finish with a track: `staging → trained`. **The only writer of that
+		* state** — D81 shipped the column with it deliberately unreachable.
+		*
+		* Refuses a track the dataset holds no copies from. `trained` un-pins the
+		* track's media, so completing without a copy is a delete order for material
+		* nothing ever extracted anything from; that refusal IS the safety argument
+		* of D81, expressed as a precondition.
+		*/
+		completeRetrainTrack: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The deliberate return: `trained → staging`, for the rare case.
+		*
+		* The generic `setTrackFlags` toggle refuses this in both directions by
+		* design (D81) — re-staging from a checkbox is how the same material gets
+		* annotated twice under two ground truths. Doing it here means the operator
+		* is looking at the annotations that already exist while they decide, and
+		* those annotations are LEFT ALONE: "put this back" must not be a
+		* destructive act wearing a navigational name.
+		*/
+		restageRetrainTrack: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Where to download the ANNOTATED dataset.
+		*
+		* The sibling of `getTrainingExportUrl` and deliberately not the same
+		* archive: that one streams a marked track's stored media verbatim, this one
+		* streams the retrain COPIES plus an `annotations.json` carrying, for every
+		* subject, the canonical full-frame box AND the geometry derived for each
+		* model shape (letterboxed root / zone-cropped package / subject-cropped
+		* classifier). Derived at export, never stored — one box in, three shapes
+		* out, so two crops of the same subject can never end up in one feature
+		* space (D52).
+		*/
+		getRetrainExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* The media an EVENT owns.
+		*
+		* `ownerType` is REQUIRED, and that is the whole correction (D482). An
+		* event is a row in ONE of three tables, and since D474 each numbers from
+		* 1 independently: `motion:101314` and `object:101314` both exist. This
+		* method took a bare `eventId` and the provider probed motion → object →
+		* audio, stopping at the first hit — so on the live hub, where object
+		* events own no media of their own and 299 883 of 300 559 media rows are
+		* motion-owned, EVERY object event resolved to its motion namesake. A
+		* track from 17:34 on camera 615 was served a snapshot from 22:35 eleven
+		* days earlier, silently.
+		*
+		* D476 had already disambiguated the KEY (`motion:` vs `object:`); this is
+		* the API catching up to it. Naming the table is not a "qualification" of
+		* the ambiguity — a listing BY OWNER has no address to make surrogate: the
+		* owner IS (table, id), and half of it is not a question.
+		*/
+		getEventMedia: require_sleep.method(zod.z.object({
+			/** Which of the three event tables owns the row. */
+			ownerType: EventOwnerTypeSchema,
+			/** The event's rowid in that table (D474: an event id is a number). */
+			eventId: zod.z.number().int(),
+			kind: MediaFileKindEnum.optional(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileSchema).readonly()),
+		/** All media rows owned by a track. `kinds` narrows to a kind subset so a
+		*  client can fetch the SMALL display variants on open and pull the
+		*  multi-MB native variants only on demand (mirrors `getEventMedia.kind`).
+		*  Absent ⇒ every kind (back-compat). */
+		getTrackMedia: require_sleep.method(zod.z.object({
+			trackId: zod.z.string(),
+			kinds: zod.z.array(MediaFileKindEnum).optional(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileSchema).readonly()),
+		/**
+		* What media a track HAS, without any of it.
+		*
+		* The detail view needs the shape of a track's media to build its strip —
+		* which kinds exist, in what order, at what size — and then wants each tile
+		* fetched as an image, not as base64 inside this response. Measured: the
+		* full `getTrackMedia` is 5.3-7.7 MB and blocks the view; this manifest is
+		* ~2 KB.
+		*
+		* It also restores a fact a `kinds` filter destroys: filtering
+		* `getTrackMedia` drops whole ROWS, taking `kind` and `sizeBytes` with
+		* them, so a client that fetched only the small variants could no longer
+		* tell a full-resolution variant existed — and the affordance that opens it
+		* would silently disappear.
+		*/
+		listTrackMedia: require_sleep.method(zod.z.object({
+			trackId: zod.z.string(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileInfoSchema).readonly()),
 		/**
-		* The pixels of ONE copied frame, base64.
+		* What media an EVENT has, without any of it — the twin `getEventMedia`
+		* never had.
 		*
-		* Through the cap rather than a data plane because it is genuinely one
-		* frame at a time, on demand, at human speed — the shape D9/D18 permit
-		* (what they forbid is frames crossing a boundary at frame RATE). The
-		* annotation canvas needs the image and its exact dimensions in the same
-		* answer: a canvas that places a normalised box against a size it guessed
-		* draws every box in the wrong place.
+		* `listTrackMedia` above got this treatment because a track's media is
+		* 5-8 MB. An event's is worse per row, not better: an old-style event owns
+		* a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
+		* modal — the one surface that legitimately shows the big kinds — unions
+		* both listings to build its filmstrip. It then renders every tile from
+		* the `event-media` plane by key and throws the bytes away. Measured on
+		* the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
+		* ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
+		*
+		* Same `deviceId` authorization subject as `getEventMedia`, the same
+		* REQUIRED `ownerType` (read that method's docblock for the night-time
+		* thumbnail this closes — D482), and the same rows: this is a projection
+		* of that method, never a different question.
 		*/
-		getRetrainFrameImage: require_sleep.method(zod.z.object({ frameId: zod.z.string() }), zod.z.object({
-			base64: zod.z.string(),
-			width: zod.z.number().int(),
-			height: zod.z.number().int()
-		}), {
-			kind: "query",
-			auth: "admin"
-		}),
+		listEventMedia: require_sleep.method(zod.z.object({
+			ownerType: EventOwnerTypeSchema,
+			eventId: zod.z.number().int(),
+			deviceId: zod.z.number()
+		}), zod.z.array(MediaFileInfoSchema).readonly()),
 		/**
-		* Ask the pipeline what it sees, as a PROPOSAL.
+		* Which of `ownerIds` hold at least ONE media row — an INDEX read, never a
+		* blob read, and the LICENCE `videoclips` needs to publish a `thumbnail`.
 		*
-		* Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
-		* every box comes back as a draft with `source: 'assist'` plus the model and
-		* score that produced it. The operator confirms, edits, adds and deletes;
-		* nothing is stored until `saveRetrainAnnotations`.
+		* The event-media URL is stamped from a template for every event in the
+		* system, so "the plane is up" was being served as "there are bytes": 64 of
+		* one camera's 179 clips pointed at a 404 (device 3836, 2026-08-17). This
+		* is the question that turns the stamp into a claim.
 		*
-		* For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
-		* never the whole frame, where a package detector at that threshold proposes
-		* furniture. A package request with no zone is REFUSED rather than widened,
-		* because the silent widening would look like a bad model for as long as
-		* nobody checked which rectangle it ran on.
+		* It is on the WIRE because the clip source is registered by the addon that
+		* owns the FOOTAGE, not by this one (D560) — the probe used to be an
+		* in-process `MediaStore` read. One call per OWNER KIND, never one per
+		* owner: that N+1 is what `MediaStore.ownersWithMedia` was written to
+		* prevent, and crossing a process boundary makes it worse, not better.
+		* `ownerIds` is bounded at the same 5 000 the annotation fetch is bounded
+		* at, so one pathological camera-day cannot mint an unbounded request.
+		*
+		* THROWS rather than answering partially. A probe that quietly
+		* under-reports reads as "these owners have nothing" and the caller drops
+		* thumbnails that exist — the opposite failure to the one above, and
+		* equally invisible.
+		*
+		* `deviceId` is the authorization subject, exactly as on `getEventMedia`.
 		*/
-		proposeRetrainAnnotations: require_sleep.method(zod.z.object({
+		ownersWithMedia: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			frameId: zod.z.string(),
-			subject: RetrainAssistSubjectSchema,
-			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
-			nodeId: zod.z.string().optional()
-		}), RetrainAssistResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
+			ownerKind: MediaPresenceOwnerKindSchema,
+			ownerIds: zod.z.array(zod.z.string()).max(5e3)
+		}), zod.z.array(zod.z.string()).readonly()),
 		/**
-		* The FrameProcessor pass of a replay run — see the `Replay` section
-		* above this capability's definition for why this is not the
-		* `processFrame` method this file's header says pipeline-analytics does
-		* not have.
-		*
-		* Constructs a FRESH `FrameProcessor` for `(deviceId, source)`, feeds it
-		* `frames` IN THE ORDER GIVEN (the caller is responsible for time
-		* ordering — this method does not sort), and returns the tracks it
-		* produced. Zero persistence: no `TrackStore`, no event bus, no media
-		* capture. `zones` / `detectionRules` are the run's OWN zone set —
-		* typically the camera's real zones plus an ephemeral overlay
-		* (`addon-benchmark`'s `replay-plan.ts`), never read from or written to
-		* the `zones` capability by this method itself.
+		* Search object events by text query using CLIP cosine similarity.
+		* Encodes `text` via the `embedding-encoder` cap, queries the
+		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
+		* embeddings by cosine similarity, and joins winners to their
+		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
+		* `minScore`, sorted descending by score.
 		*/
-		runReplayFrameProcessor: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			source: DetectionSourceSchema,
-			zones: zod.z.array(ZoneSchema).readonly().optional(),
-			detectionRules: zod.z.array(ZoneRuleSchema).readonly().optional(),
-			zoneMembershipMinOverlap: zod.z.number().min(0).max(1).optional(),
-			frames: zod.z.array(ReplayFrameInputSchema).min(1)
-		}), RunReplayFrameProcessorResultSchema, {
+		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly()),
+		wipeObjectEmbeddings: require_sleep.method(zod.z.object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Every annotation on a track, oldest first. */
-		listRetrainAnnotations: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
-			kind: "query",
+		rebuildObjectEmbeddings: require_sleep.method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+			kind: "mutation",
 			auth: "admin"
 		}),
+		getObjectEmbeddingRebuildStatus: require_sleep.method(zod.z.object({}), RebuildStatusSchema)
+	},
+	events: {
 		/**
-		* Replace EVERY annotation on one frame with the supplied set.
-		*
-		* Whole-frame replacement, not per-box upsert: the unit of ground truth is
-		* the frame, and "the operator deleted a box" must be the same durable
-		* outcome as "the operator never drew it". A per-box patch would let a frame
-		* keep a box the operator removed on a surface that only knew about the
-		* boxes it sent.
-		*
-		* Refuses a macro class typed into `label` or `subLabel` — the tiers are
-		* separate and the guard is at the WRITE, because a mixed taxonomy cannot
-		* be un-mixed by reading it.
+		* Enriched frame emitted after refinement — the live-overlay source of
+		* truth (two-plane re-injection). Carries the frame's detections in the
+		* `ObjectDetection` wire shape: first-level roots (with track info +
+		* enrichment labels) plus synthesized `kind:'detail'` face/plate entries
+		* re-projected from per-track detail state, so stream overlays render
+		* boxes + recognized names without querying full Track state.
 		*/
-		saveRetrainAnnotations: require_sleep.method(zod.z.object({
+		onFrameTracked: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			timestamp: zod.z.number(),
+			frameWidth: zod.z.number(),
+			frameHeight: zod.z.number(),
+			detections: zod.z.array(OverlayDetectionSchema).readonly()
+		}) },
+		/** Track entered active state (first-seen). */
+		onTrackStarted: { data: zod.z.object({
 			deviceId: zod.z.number(),
 			trackId: zod.z.string(),
-			frameId: zod.z.string(),
-			annotations: zod.z.array(RetrainAnnotationDraftSchema)
-		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			className: zod.z.string()
+		}) },
+		/** Track expired (TTL reached after last detection). */
+		onTrackEnded: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			className: zod.z.string(),
+			durationMs: zod.z.number()
+		}) },
+		/** Canonical "something happened at device X" event, per-kind. */
+		onDetectionEvent: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			kind: EventKindSchema,
+			eventId: zod.z.string(),
+			timestamp: zod.z.number()
+		}) }
+	}
+};
+//#endregion
+//#region src/capabilities/pipeline-executor.cap.ts
+/**
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+*/
+var NativeCropRefSchema = zod.z.object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: require_sleep.FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: zod.z.object({
+		x: zod.z.number(),
+		y: zod.z.number(),
+		w: zod.z.number(),
+		h: zod.z.number()
+	})
+});
+zod.z.object({
+	crop: zod.z.object({
+		left: zod.z.number(),
+		top: zod.z.number(),
+		width: zod.z.number().positive(),
+		height: zod.z.number().positive()
+	}).optional(),
+	content: zod.z.object({
+		width: zod.z.number().int().positive(),
+		height: zod.z.number().int().positive()
+	}),
+	fit: zod.z.enum(["stretch", "contain"]),
+	format: zod.z.enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
+var FrameRefSchema = zod.z.object({
+	registryId: zod.z.string().min(1),
+	id: zod.z.string().min(1),
+	width: zod.z.number().int().positive(),
+	height: zod.z.number().int().positive(),
+	format: zod.z.enum(["rgb", "gray"]),
+	timestamp: zod.z.number(),
+	capturedAt: zod.z.number().optional()
+});
+var ModelFormatSchema$1 = zod.z.enum([
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+]);
+var PipelineSlotSchema = zod.z.enum([
+	"detector",
+	"cropper",
+	"classifier",
+	"refiner",
+	"audio-classifier"
+]);
+var PipelineEngineChoiceSchema = zod.z.object({
+	runtime: zod.z.literal("python"),
+	backend: zod.z.string(),
+	format: ModelFormatSchema$1,
+	device: zod.z.string().optional()
+});
+/**
+* One pool's resolved provisioning (`getEffectiveTuning`). `numWorkers` is the
+* knob that lifts a saturated pool (`inference-devices.md`); `concurrency` is
+* per-worker in-flight requests. `deviceKey` echoes the pool asked about —
+* `null` for the node-default pool.
+*/
+var EffectiveTuningSchema = zod.z.object({
+	deviceKey: zod.z.string().nullable(),
+	runtime: zod.z.string(),
+	batchMode: zod.z.string(),
+	windowMs: zod.z.number(),
+	maxBatchSize: zod.z.number(),
+	concurrency: zod.z.number(),
+	numWorkers: zod.z.number()
+});
+var EngineDeviceInfoSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	description: zod.z.string().optional()
+});
+var AvailableEngineSchema = zod.z.object({
+	engine: PipelineEngineChoiceSchema,
+	devices: zod.z.array(EngineDeviceInfoSchema).readonly(),
+	defaultDevice: zod.z.string()
+});
+var PipelineDefaultStepSchema = zod.z.lazy(() => zod.z.object({
+	addonId: zod.z.string(),
+	addonName: zod.z.string(),
+	slot: PipelineSlotSchema,
+	inputClasses: zod.z.array(zod.z.string()).readonly(),
+	outputClasses: zod.z.array(zod.z.string()).readonly(),
+	enabled: zod.z.boolean(),
+	modelId: zod.z.string(),
+	children: zod.z.array(PipelineDefaultStepSchema).readonly(),
+	group: zod.z.string().optional(),
+	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+}));
+var PipelineTemplateStepSchema = zod.z.lazy(() => zod.z.object({
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	modelId: zod.z.string(),
+	children: zod.z.array(PipelineTemplateStepSchema).readonly(),
+	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	createdAt: zod.z.string(),
+	updatedAt: zod.z.string(),
+	engine: PipelineEngineChoiceSchema,
+	steps: zod.z.array(PipelineTemplateStepSchema).readonly()
+});
+var PipelineModelOptionSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	formats: zod.z.record(zod.z.string(), zod.z.object({
+		downloaded: zod.z.boolean(),
+		sizeMB: zod.z.number()
+	})),
+	group: ModelVariantGroupSchema.optional(),
+	legacy: zod.z.boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
+});
+var ConfigFieldBridge = zod.z.custom();
+var PipelineAddonSchemaSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	slot: PipelineSlotSchema,
+	inputClasses: zod.z.array(zod.z.string()).readonly(),
+	outputClasses: zod.z.array(zod.z.string()).readonly(),
+	childSlots: zod.z.array(PipelineSlotSchema).readonly(),
+	models: zod.z.array(PipelineModelOptionSchema).readonly(),
+	defaultModelId: zod.z.string(),
+	defaultModelIdByFormat: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+	enabledByDefault: zod.z.boolean().optional(),
+	backfillIntoExistingOverrides: zod.z.boolean().optional(),
+	defaultConfidence: zod.z.number(),
+	group: zod.z.string().optional(),
+	configSchema: zod.z.array(ConfigFieldBridge).readonly().optional()
+});
+var PipelineSlotSchemaSchema = zod.z.object({
+	id: PipelineSlotSchema,
+	label: zod.z.string(),
+	priority: zod.z.number(),
+	parentSlot: PipelineSlotSchema.nullable(),
+	addons: zod.z.array(PipelineAddonSchemaSchema).readonly()
+});
+var PipelineSchemaSchema = zod.z.object({
+	availableEngines: zod.z.array(AvailableEngineSchema).readonly(),
+	selectedEngine: PipelineEngineChoiceSchema,
+	slots: zod.z.array(PipelineSlotSchemaSchema).readonly()
+});
+var EngineProvisioningSchema = zod.z.object({
+	runtimeId: zod.z.enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"edgetpu"
+	]).nullable(),
+	device: zod.z.string().nullable(),
+	state: zod.z.enum([
+		"idle",
+		"installing",
+		"verifying",
+		"ready",
+		"failed"
+	]),
+	progress: zod.z.number().optional(),
+	error: zod.z.string().optional(),
+	nextRetryAt: zod.z.number().optional(),
+	/**
+	* Gate A (config-correctness gate at engine change): human-readable
+	* config issues surfaced EAGERLY when the node's engine changes — model
+	* substitutions ("chose X, running Y") and zero-build steps ("no model
+	* has a <format> build"). Additive/optional: informational only, never
+	* enforced here — `assertEngineReady` (readiness) still gates inference.
+	* Absent/empty when the node-default tree resolves cleanly.
+	*/
+	configIssues: zod.z.array(zod.z.string()).optional()
+});
+var PipelineStepInputSchema = zod.z.lazy(() => zod.z.object({
+	addonId: zod.z.string(),
+	modelId: zod.z.string().optional(),
+	enabled: zod.z.boolean().default(true),
+	children: zod.z.array(PipelineStepInputSchema).optional(),
+	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	jumpDeviceKey: zod.z.string().optional()
+}));
+var ModelSubstitutionSchema = zod.z.object({
+	addonId: zod.z.string(),
+	chosen: zod.z.string(),
+	running: zod.z.string(),
+	format: zod.z.string()
+});
+var PipelineValidationIssueSchema = zod.z.object({
+	addonId: zod.z.string(),
+	kind: zod.z.enum([
+		"unknown-addon",
+		"no-format-build",
+		"unknown-device"
+	]),
+	detail: zod.z.string()
+});
+var PipelineValidationResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	issues: zod.z.array(PipelineValidationIssueSchema).readonly(),
+	substitutions: zod.z.array(ModelSubstitutionSchema).readonly(),
+	/** The node's `currentEngine.format` this validation ran against. */
+	format: zod.z.string()
+});
+var ReferenceImageEntrySchema = zod.z.object({
+	filename: zod.z.string(),
+	stepIds: zod.z.array(zod.z.string()).readonly().optional()
+});
+var ReferenceImageBodySchema = zod.z.object({
+	base64: zod.z.string(),
+	filename: zod.z.string()
+});
+var ReferenceAudioEntrySchema = zod.z.object({
+	filename: zod.z.string(),
+	sizeKb: zod.z.number()
+});
+var ReferenceAudioBodySchema = zod.z.object({ base64: zod.z.string() });
+var AudioBackendSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	description: zod.z.string(),
+	available: zod.z.boolean(),
+	/**
+	* Raw classifier labels this backend can emit (e.g. YAMNet's
+	* 521-class set or Apple SoundAnalysis's 303-class set). Used by
+	* the benchmark UI to populate the `enabledMicroClasses` filter
+	* specific to the selected backend without a separate fetch.
+	*/
+	rawLabels: zod.z.array(zod.z.string()).readonly().optional()
+});
+var AudioCapabilitiesSchema = zod.z.object({
+	activeBackend: zod.z.string(),
+	availableBackends: zod.z.array(AudioBackendSchema).readonly(),
+	sampleRate: zod.z.number(),
+	chunkDurationMs: zod.z.number()
+});
+var DownloadModelResultSchema = zod.z.object({
+	filePath: zod.z.string(),
+	sizeMB: zod.z.number(),
+	durationMs: zod.z.number()
+});
+/**
+* Wrapper carrying a single test run's result. Replaces the legacy
+* ad-hoc `{labels: [{className, originalClass, score}]}` shape with the
+* canonical `AudioResult` from the Phase 6 output rework: one
+* `AudioDetection` per class above `minScore`, top-N candidates in
+* `debug.alternateLabels['audio-classifier']`, per-source timings in
+* `debug.stepTimings`. The outer `success`/`error` fields stay so the
+* benchmark UI can still report a clean failure when the classifier
+* cap isn't available.
+*/
+var AudioTestResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	error: zod.z.string().optional(),
+	frame: zod.z.custom().optional()
+});
+var PipelineConfigBridge = zod.z.custom();
+var ConfigUISchemaBridge = zod.z.custom();
+var ConfigUISchemaNullableBridge = zod.z.custom();
+var InferenceCapabilitiesBridge = zod.z.custom();
+var ModelAvailabilityListBridge = zod.z.custom();
+var PipelineRunResultBridge = zod.z.custom();
+/**
+* Pipeline executor — detection engine + configuration + inference API.
+*
+* Merged from: pipeline-executor, pipeline-config, inference, detection-config.
+* Implemented by the detection-pipeline addon.
+*
+* Per-device surface (DeviceSettingsContribution + the "is detection
+* enabled for this camera?" toggle) lives on the paired
+* `detection-pipeline` cap (device-scoped, singleton, wrapper
+* defaultActive) — same split pattern used by stream-broker /
+* camera-streams and audio-analyzer / audio-analysis.
+*/
+var pipelineExecutorCapability = {
+	name: "pipeline-executor",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		getAvailableEngines: require_sleep.method(zod.z.void(), zod.z.array(PipelineEngineChoiceSchema)),
+		getSelectedEngine: require_sleep.method(zod.z.void(), PipelineEngineChoiceSchema),
+		getDefaultSteps: require_sleep.method(PipelineEngineChoiceSchema, zod.z.array(PipelineDefaultStepSchema)),
+		/**
+		* Per-node detection-engine provisioning snapshot. Returns the live
+		* state of the lazy runtime-provisioning machine on `nodeId`
+		* (idle / installing / verifying / ready / failed). The UI pairs this
+		* one-shot query with the `pipeline.engine-provisioning` live event
+		* (emitted on every transition) to drive a per-node "engine ready?"
+		* indicator without polling. Phase 2.
+		*/
+		getEngineProvisioning: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), EngineProvisioningSchema),
+		getVideoPipelineSteps: require_sleep.method(zod.z.void(), zod.z.record(zod.z.string(), zod.z.object({
+			modelId: zod.z.string(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
+		}))),
+		setVideoPipelineSteps: require_sleep.method(zod.z.object({ steps: zod.z.record(zod.z.string(), zod.z.object({
+			modelId: zod.z.string(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly()
+		})) }), zod.z.object({ success: zod.z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Finish with a track: `staging → trained`. **The only writer of that
-		* state** — D81 shipped the column with it deliberately unreachable.
+		* Clear THIS node's executor-side PER-DEVICE settings stores (the
+		* per-camera step overrides the object-detection root reads via
+		* `applyDeviceOverridesToTree`). `nodeId` is the ROUTING key — the
+		* generated cap-router strips it (default `nodeIdMode: 'routing'`) and
+		* dispatches to that node, so the provider method runs ON the target
+		* node and receives no `nodeId`.
 		*
-		* Refuses a track the dataset holds no copies from. `trained` un-pins the
-		* track's media, so completing without a copy is a delete order for material
-		* nothing ever extracted anything from; that refusal IS the safety argument
-		* of D81, expressed as a precondition.
+		* This is the slimmed executor leg of the orchestrator's
+		* `resetNodePipelineDefaults` flow (which owns the real reset: node
+		* addonDefaults pins + per-camera orchestrator overrides). The legacy
+		* `resetToDefault` — which reset a persisted global step-tree seed
+		* nothing in the live per-camera path read — was removed together with
+		* that seed.
 		*/
-		completeRetrainTrack: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string()
-		}), RetrainTransitionResultSchema, {
+		clearDeviceOverrides: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.object({
+			success: zod.z.literal(true),
+			clearedDevices: zod.z.number()
+		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* The deliberate return: `trained → staging`, for the rare case.
+		* Which of THIS node's inference devices the executor currently refuses,
+		* and why. `nodeId` is the ROUTING key (stripped by the generated router).
+		*
+		* The channel that did not exist. Pool health was known only inside the
+		* detection addon and was an input to no routing decision anywhere: the
+		* per-dispatch capability gate is keyed on model FORMAT and so can never
+		* separate `openvino:gpu` from `openvino:npu`, and the orchestrator's live
+		* eligibility probe (`platformProbe.getCapabilities`) answers about
+		* HARDWARE — which was present throughout. So when the hub's `openvino:gpu`
+		* Python worker was SIGABRT'd by the Intel GPU plugin on 2026-08-25, the
+		* balancer went on handing that dead pool cameras by rotation for 31 hours:
+		* ~370 000 `PoolWorker[w0]: not initialized` lines, every frame lost.
+		*
+		* Read semantics the caller depends on, and which the provider guarantees:
+		* this is a synchronous read of in-memory state. It never probes hardware,
+		* never spawns a pool and never throws — an EMPTY `unhealthy` means "asked,
+		* nothing is refused", which is what re-admits a device. A read that FAILS
+		* (node offline, version skew) must therefore be distinguishable from an
+		* empty answer, and it is: it rejects.
+		*/
+		getInferenceDeviceHealth: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.object({ unhealthy: zod.z.array(zod.z.object({
+			/** `<backend>:<device>`, e.g. `openvino:gpu`. */
+			deviceKey: zod.z.string(),
+			/**
+			* `failed` — the per-device restart budget is exhausted; no pool
+			* will be spawned until an operator re-arms it or the runner
+			* respawns. `backoff` — under budget, waiting out the backoff (or
+			* a cached pool observed dead and not yet condemned).
+			*/
+			state: zod.z.enum(["failed", "backoff"]),
+			/** Epoch ms of the death that produced this state. */
+			since: zod.z.number(),
+			/** Pool deaths inside the current window. */
+			deaths: zod.z.number(),
+			/** The last death's message. */
+			lastError: zod.z.string()
+		})).readonly() })),
+		/**
+		* Re-arm a terminally `failed` inference device on `nodeId`: forget its
+		* restart budget so the next dispatch builds a fresh pool.
 		*
-		* The generic `setTrackFlags` toggle refuses this in both directions by
-		* design (D81) — re-staging from a checkbox is how the same material gets
-		* annotated twice under two ground truths. Doing it here means the operator
-		* is looking at the annotations that already exist while they decide, and
-		* those annotations are LEFT ALONE: "put this back" must not be a
-		* destructive act wearing a navigational name.
+		* The terminal state is deliberate (the abort it bounds is deterministic —
+		* an automatic probation would just respawn Python forever, more slowly),
+		* and a terminal state an operator cannot leave is a silent fault. This is
+		* the way out. `rearmed:false` means there was nothing to forget.
 		*/
-		restageRetrainTrack: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string()
-		}), RetrainTransitionResultSchema, {
+		rearmInferenceDevice: require_sleep.method(zod.z.object({
+			nodeId: zod.z.string(),
+			deviceKey: zod.z.string()
+		}), zod.z.object({ rearmed: zod.z.boolean() }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		getSchema: require_sleep.method(zod.z.void(), PipelineSchemaSchema),
+		getGlobalSteps: require_sleep.method(zod.z.void(), zod.z.array(PipelineDefaultStepSchema).readonly().nullable()),
+		getGlobalPipelineConfig: require_sleep.method(zod.z.void(), PipelineConfigBridge),
+		getOrchestratorConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaBridge),
 		/**
-		* Where to download the ANNOTATED dataset.
+		* Gate B (pre-init config-correctness gate). PURE COMPUTE against this
+		* node's `currentEngine.format` — resolves `steps` the same way the
+		* runtime dispatch path would, and reports what WOULD happen without
+		* touching any node-global state. Called by the orchestrator at attach
+		* time (`attachOn`), node-pinned to the TARGET node, so config problems
+		* surface BEFORE `pipelineRunner.attachCamera` rather than at the first
+		* per-frame resolve. `ok` is false iff `issues` is non-empty (both
+		* `unknown-addon` and `no-format-build` are HARD issues); `substitutions`
+		* is informational (a degraded-but-loadable model swap) and never
+		* affects `ok`. Never throws.
 		*
-		* The sibling of `getTrainingExportUrl` and deliberately not the same
-		* archive: that one streams a marked track's stored media verbatim, this one
-		* streams the retrain COPIES plus an `annotations.json` carrying, for every
-		* subject, the canonical full-frame box AND the geometry derived for each
-		* model shape (letterboxed root / zone-cropped package / subject-cropped
-		* classifier). Derived at export, never stored — one box in, three shapes
-		* out, so two crops of the same subject can never end up in one feature
-		* space (D52).
+		* `deviceKey` validates against THAT device pool's format instead of the
+		* node default (D646) — the cheap question a pinned replay asks before it
+		* reads any media: can this (node, deviceKey) run exactly this model?
 		*/
-		getRetrainExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
-			kind: "query",
-			auth: "admin"
-		}),
+		validatePipeline: require_sleep.method(zod.z.object({
+			steps: zod.z.array(PipelineStepInputSchema),
+			deviceKey: zod.z.string().optional()
+		}), PipelineValidationResultSchema),
+		listTemplates: require_sleep.method(zod.z.void(), zod.z.array(PipelineTemplateSchema$1).readonly()),
+		saveTemplate: require_sleep.method(zod.z.object({
+			name: zod.z.string(),
+			steps: zod.z.array(PipelineTemplateStepSchema).readonly(),
+			engine: PipelineEngineChoiceSchema
+		}), PipelineTemplateSchema$1, { kind: "mutation" }),
+		updateTemplate: require_sleep.method(zod.z.object({
+			id: zod.z.string(),
+			name: zod.z.string().optional(),
+			steps: zod.z.array(PipelineTemplateStepSchema).readonly().optional()
+		}), PipelineTemplateSchema$1, { kind: "mutation" }),
+		deleteTemplate: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
+		getCapabilities: require_sleep.method(zod.z.void(), InferenceCapabilitiesBridge),
+		getAddonModels: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), ModelAvailabilityListBridge),
+		downloadModel: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			modelId: zod.z.string(),
+			format: ModelFormatSchema$1
+		}), DownloadModelResultSchema, { kind: "mutation" }),
+		deleteModel: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			modelId: zod.z.string(),
+			format: ModelFormatSchema$1
+		}), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }),
 		/**
-		* The media an EVENT owns.
+		* Stateless single-frame execution. Callers (runner, benchmark) pass
+		* the complete `steps` tree; the executor holds no state about cameras
+		* or saved pipelines. WHICH pool answers is the node's own engine, or the
+		* `deviceKey` pool when one is named.
 		*
-		* `ownerType` is REQUIRED, and that is the whole correction (D482). An
-		* event is a row in ONE of three tables, and since D474 each numbers from
-		* 1 independently: `motion:101314` and `object:101314` both exist. This
-		* method took a bare `eventId` and the provider probed motion → object →
-		* audio, stopping at the first hit — so on the live hub, where object
-		* events own no media of their own and 299 883 of 300 559 media rows are
-		* motion-owned, EVERY object event resolved to its motion namesake. A
-		* track from 17:34 on camera 615 was served a snapshot from 22:35 eleven
-		* days earlier, silently.
+		* There is no `engine` field (D646). It existed for the benchmark and was
+		* honoured by swapping the SHARED provider's engine, factory and executor
+		* for the duration of the call, on a node serving live cameras. A caller
+		* that still sends the key has it stripped here and changes nothing.
 		*
-		* D476 had already disambiguated the KEY (`motion:` vs `object:`); this is
-		* the API catching up to it. Naming the table is not a "qualification" of
-		* the ambiguity — a listing BY OWNER has no address to make surrogate: the
-		* owner IS (table, id), and half of it is not a question.
+		* Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
+		* `referenceImage` must be provided:
+		*  - `frame`: runtime dispatch path (runner → decoded broker frame).
+		*    Carries the raw buffer, dimensions, and format; the executor
+		*    uses it directly without base64 round-tripping.
+		*  - `frameHandle` (CB5): a zero-pixel shm `FrameHandle` for the SAME
+		*    decoded frame. Both runner and executor are hub-local processes
+		*    sharing `/dev/shm`, so the executor maps the named segment and
+		*    reads the pixels back zero-copy — eliminating the ~1.2MB
+		*    re-serialisation over UDS/MsgPack the `frame` path pays per call.
+		*    High-risk: the FrameRing is a latest-wins seqlock with no
+		*    refcount, so a recycled slot yields a null read; the executor
+		*    then degrades to an empty result and the runner ships pixels via
+		*    `frame` as the fallback (queue-depth gated on the runner side).
+		*  - `imageBase64`: one-shot test path (benchmark ImageTab).
+		*  - `referenceImage`: named file from the reference-image store.
 		*/
-		getEventMedia: require_sleep.method(zod.z.object({
-			/** Which of the three event tables owns the row. */
-			ownerType: EventOwnerTypeSchema,
-			/** The event's rowid in that table (D474: an event id is a number). */
-			eventId: zod.z.number().int(),
-			kind: MediaFileKindEnum.optional(),
-			deviceId: zod.z.number()
-		}), zod.z.array(MediaFileSchema).readonly()),
-		/** All media rows owned by a track. `kinds` narrows to a kind subset so a
-		*  client can fetch the SMALL display variants on open and pull the
-		*  multi-MB native variants only on demand (mirrors `getEventMedia.kind`).
-		*  Absent ⇒ every kind (back-compat). */
-		getTrackMedia: require_sleep.method(zod.z.object({
-			trackId: zod.z.string(),
-			kinds: zod.z.array(MediaFileKindEnum).optional(),
-			deviceId: zod.z.number()
-		}), zod.z.array(MediaFileSchema).readonly()),
+		runPipeline: require_sleep.method(zod.z.object({
+			steps: zod.z.array(PipelineStepInputSchema).min(1),
+			frame: FrameInputSchema.optional(),
+			/**
+			* Process-local lazy frame. Valid only when caller and provider resolve
+			* in the same execution-group process; split/cross-node callers use
+			* `frame`/`image` inline compatibility instead.
+			*/
+			frameRef: FrameRefSchema.optional(),
+			/**
+			* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+			* the decoded pixels live in. One more member of the one-of
+			* frame/frameHandle/image/imageBase64/referenceImage group.
+			*/
+			frameHandle: require_sleep.FrameHandleSchema.optional(),
+			imageBase64: zod.z.string().optional(),
+			/**
+			* Binary JPEG bytes — preferred over `imageBase64` on internal
+			* hops (hub → forked worker via Moleculer MsgPack) because it
+			* skips the 33% base64 overhead + the per-call base64 decode on
+			* the detection-pipeline worker. Callers can pass either; exactly
+			* one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
+			*/
+			image: zod.z.instanceof(Uint8Array).optional(),
+			referenceImage: zod.z.string().optional(),
+			deviceId: zod.z.number().optional(),
+			sessionId: zod.z.string().optional(),
+			/**
+			* Execution plane. 'full' (default) runs the whole tree — benchmark,
+			* reference-image, and detail-subtree calls. 'frame' is the live
+			* per-frame dispatch: ONLY root-plane steps run; crop children
+			* (inputClasses ≠ null) are skipped and served per-track via
+			* pipelineRunner.runDetailSubtree (two-plane design).
+			*/
+			plane: zod.z.enum(["full", "frame"]).optional(),
+			/**
+			* Inference-device selector (Phase 2 multi-device). Format
+			* `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+			* Omitted ⇒ the runner's default device (current single-engine
+			* behaviour). Selects WHICH device pool of the node runs the call.
+			*/
+			deviceKey: zod.z.string().optional(),
+			/**
+			* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+			* when the parent crop was resolved from the frame's retained NATIVE
+			* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+			* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+			* resolution from that surface — the SAME quality path faces already
+			* had — instead of the downscaled parent tile. `handle` keys the native
+			* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+			* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+			* the executor's crop-normalized child ROI back into frame-normalized
+			* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+			* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+			* (today's behaviour on the fallback path).
+			*/
+			nativeCropRef: NativeCropRefSchema.optional(),
+			/**
+			* Offline REPLAY of stored media for `deviceId` (D56, D646): the
+			* camera's zone gate and overrides apply as live, every executing
+			* step runs EXACTLY the model it names on the `deviceKey` pool it
+			* names or the call refuses (`model-not-servable` /
+			* `device-not-servable`), and nothing reaches the camera's live
+			* trace stream. Absent ⇒ unchanged behaviour.
+			*/
+			replay: zod.z.literal(true).optional()
+		}), PipelineRunResultBridge, { kind: "mutation" }),
 		/**
-		* What media a track HAS, without any of it.
-		*
-		* The detail view needs the shape of a track's media to build its strip —
-		* which kinds exist, in what order, at what size — and then wants each tile
-		* fetched as an image, not as base64 inside this response. Measured: the
-		* full `getTrackMedia` is 5.3-7.7 MB and blocks the view; this manifest is
-		* ~2 KB.
+		* Batched run — N raw frames packed into one cap call. The provider
+		* routes the batch through `SharedInferencePool.inferBatch`
+		* (`MSG_INFER_BATCH = 0x03`) so the IPC framing and JSON response
+		* envelope cost is amortised N:1 vs N concurrent `runPipeline`
+		* calls. Single root step + uniform model assumed; trees with crop
+		* children fall back to sequential execution.
 		*
-		* It also restores a fact a `kinds` filter destroys: filtering
-		* `getTrackMedia` drops whole ROWS, taking `kind` and `sizeBytes` with
-		* them, so a client that fetched only the small variants could no longer
-		* tell a full-resolution variant existed — and the affordance that opens it
-		* would silently disappear.
+		* Used by `scripts/bench-batch-style.mts` for batch benchmarking —
+		* N frames in one call to amortise per-call IPC overhead.
 		*/
-		listTrackMedia: require_sleep.method(zod.z.object({
-			trackId: zod.z.string(),
-			deviceId: zod.z.number()
-		}), zod.z.array(MediaFileInfoSchema).readonly()),
+		runPipelineBatch: require_sleep.method(zod.z.object({
+			steps: zod.z.array(PipelineStepInputSchema).min(1),
+			frames: zod.z.array(FrameInputSchema).min(1).max(255),
+			deviceId: zod.z.number().optional(),
+			sessionId: zod.z.string().optional(),
+			/**
+			* Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+			* the batch to the Python pool's bench preprocess cache
+			* (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+			* preprocessed ONCE and every later inference is a pure-inference cache
+			* hit — the sustained-throughput run measures inference, not
+			* decode+preprocess+infer. Omitted/0 for live frames (all different →
+			* full preprocess every call, correct). Fresh per sustained run;
+			* released via `uncacheFrame`.
+			*/
+			frameId: zod.z.number().int().nonnegative().optional(),
+			/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+			deviceKey: zod.z.string().optional()
+		}), zod.z.object({ results: zod.z.array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
 		/**
-		* What media an EVENT has, without any of it — the twin `getEventMedia`
-		* never had.
-		*
-		* `listTrackMedia` above got this treatment because a track's media is
-		* 5-8 MB. An event's is worse per row, not better: an old-style event owns
-		* a `crop` AND a native-resolution `fullFrameBoxed`, and the track DETAIL
-		* modal — the one surface that legitimately shows the big kinds — unions
-		* both listings to build its filmstrip. It then renders every tile from
-		* the `event-media` plane by key and throws the bytes away. Measured on
-		* the live hub: one event's `fullFrameBoxed` is 2 824 077 B, base64'd to
-		* ~3.8 MB, allocated whole in hub-main's heap, for a list of keys.
-		*
-		* Same `deviceId` authorization subject as `getEventMedia`, the same
-		* REQUIRED `ownerType` (read that method's docblock for the night-time
-		* thumbnail this closes — D482), and the same rows: this is a projection
-		* of that method, never a different question.
+		* Cache a raw frame inside the Python inference pool's memory.
+		* Returns a numeric `frameId` that `inferCached` references —
+		* subsequent calls send only 5 bytes through the pipe instead of
+		* 1.2MB raw data, eliminating the pipe transfer bottleneck.
 		*/
-		listEventMedia: require_sleep.method(zod.z.object({
-			ownerType: EventOwnerTypeSchema,
-			eventId: zod.z.number().int(),
-			deviceId: zod.z.number()
-		}), zod.z.array(MediaFileInfoSchema).readonly()),
+		cacheFrameInPool: require_sleep.method(zod.z.object({
+			data: zod.z.instanceof(Uint8Array),
+			width: zod.z.number().int().positive(),
+			height: zod.z.number().int().positive(),
+			format: zod.z.enum([
+				"rgb",
+				"bgr",
+				"gray"
+			])
+		}), zod.z.object({
+			frameId: zod.z.number(),
+			width: zod.z.number(),
+			height: zod.z.number()
+		}), { kind: "mutation" }),
 		/**
-		* Which of `ownerIds` hold at least ONE media row — an INDEX read, never a
-		* blob read, and the LICENCE `videoclips` needs to publish a `thumbnail`.
-		*
-		* The event-media URL is stamped from a template for every event in the
-		* system, so "the plane is up" was being served as "there are bytes": 64 of
-		* one camera's 179 clips pointed at a 404 (device 3836, 2026-08-17). This
-		* is the question that turns the stamp into a claim.
-		*
-		* It is on the WIRE because the clip source is registered by the addon that
-		* owns the FOOTAGE, not by this one (D560) — the probe used to be an
-		* in-process `MediaStore` read. One call per OWNER KIND, never one per
-		* owner: that N+1 is what `MediaStore.ownersWithMedia` was written to
-		* prevent, and crossing a process boundary makes it worse, not better.
-		* `ownerIds` is bounded at the same 5 000 the annotation fetch is bounded
-		* at, so one pathological camera-day cannot mint an unbounded request.
-		*
-		* THROWS rather than answering partially. A probe that quietly
-		* under-reports reads as "these owners have nothing" and the caller drops
-		* thumbnails that exist — the opposite failure to the one above, and
-		* equally invisible.
-		*
-		* `deviceId` is the authorization subject, exactly as on `getEventMedia`.
+		* Run inference on a previously cached frame. Sends only 5 bytes
+		* (model_idx + frameId) through the IPC pipe — eliminates the
+		* ~35ms per-call overhead of transferring 1.2MB raw data.
 		*/
-		ownersWithMedia: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			ownerKind: MediaPresenceOwnerKindSchema,
-			ownerIds: zod.z.array(zod.z.string()).max(5e3)
-		}), zod.z.array(zod.z.string()).readonly()),
+		inferCached: require_sleep.method(zod.z.object({
+			stepId: zod.z.string(),
+			frameId: zod.z.number().int()
+		}), zod.z.record(zod.z.string(), zod.z.unknown()), { kind: "mutation" }),
 		/**
-		* Search object events by text query using CLIP cosine similarity.
-		* Encodes `text` via the `embedding-encoder` cap, queries the
-		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
-		* embeddings by cosine similarity, and joins winners to their
-		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
-		* `minScore`, sorted descending by score.
+		* Release a cached frame from the Python pool's memory.
 		*/
-		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly()),
-		wipeObjectEmbeddings: require_sleep.method(zod.z.object({}), WipeObjectEmbeddingsResultSchema, {
+		uncacheFrame: require_sleep.method(zod.z.object({ frameId: zod.z.number().int() }), zod.z.void(), { kind: "mutation" }),
+		/**
+		* The effective provisioning of ONE pool of this node (operator override →
+		* the pool's own runtime row). `deviceKey` names the device pool; absent is
+		* the node-default pool. It answered only for the node default until
+		* D646, so a benchmark on `openvino:npu` recorded the onnx pool's tuning
+		* beside an NPU measurement.
+		*/
+		getEffectiveTuning: require_sleep.method(zod.z.object({ deviceKey: zod.z.string().optional() }), EffectiveTuningSchema),
+		/**
+		* List every EngineFactory currently loaded in this executor's RAM,
+		* with the models resident and a coarse "in use" marker derived from
+		* ongoing inference activity. Used by the Pipeline page Engines tab.
+		*/
+		listLoadedEngines: require_sleep.method(zod.z.void(), zod.z.array(zod.z.object({
+			engineKey: zod.z.string(),
+			engine: PipelineEngineChoiceSchema,
+			modelsLoaded: zod.z.array(zod.z.string()).readonly(),
+			inUseByCameras: zod.z.array(zod.z.number()).readonly(),
+			/**
+			* Origin of this resident factory.
+			*  - `runtime`       — main camera-serving engine (no idle TTL).
+			*  - `device-pool`   — a concurrent per-device pool (Phase 2
+			*                      multi-device, keyed by `deviceKey`) resolved
+			*                      via `resolveDeviceFactory`. Runs alongside the
+			*                      `runtime` engine on a DIFFERENT accelerator
+			*                      (NPU / iGPU / Coral) — this is how the
+			*                      Engines tab shows all pools running at once.
+			*/
+			kind: zod.z.enum(["runtime", "device-pool"]),
+			/** Native pid of the underlying Python pool (null when no pool). */
+			poolPid: zod.z.number().nullable(),
+			/** ms since this factory was last used (null when not warm-tracked). */
+			idleMs: zod.z.number().nullable(),
+			/** Idle TTL after which the factory self-evicts (null when not applicable). */
+			idleTtlMs: zod.z.number().nullable()
+		})).readonly()),
+		/** Warm up an engine without running a frame. No-op if already loaded. */
+		spinEngine: require_sleep.method(zod.z.object({ engine: PipelineEngineChoiceSchema }), zod.z.object({ success: zod.z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		rebuildObjectEmbeddings: require_sleep.method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+		/**
+		* Unload an engine from RAM. `force:true` unloads even when cameras
+		* are actively using it (they re-spin on next frame). Default is
+		* gated — returns `{success:false, reason}` when in use.
+		*/
+		killEngine: require_sleep.method(zod.z.object({
+			engine: PipelineEngineChoiceSchema,
+			force: zod.z.boolean().optional()
+		}), zod.z.object({
+			success: zod.z.boolean(),
+			reason: zod.z.string().optional()
+		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		getObjectEmbeddingRebuildStatus: require_sleep.method(zod.z.object({}), RebuildStatusSchema)
-	},
-	events: {
-		/**
-		* Enriched frame emitted after refinement — the live-overlay source of
-		* truth (two-plane re-injection). Carries the frame's detections in the
-		* `ObjectDetection` wire shape: first-level roots (with track info +
-		* enrichment labels) plus synthesized `kind:'detail'` face/plate entries
-		* re-projected from per-track detail state, so stream overlays render
-		* boxes + recognized names without querying full Track state.
-		*/
-		onFrameTracked: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			timestamp: zod.z.number(),
-			frameWidth: zod.z.number(),
-			frameHeight: zod.z.number(),
-			detections: zod.z.array(OverlayDetectionSchema).readonly()
-		}) },
-		/** Track entered active state (first-seen). */
-		onTrackStarted: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			className: zod.z.string()
-		}) },
-		/** Track expired (TTL reached after last detection). */
-		onTrackEnded: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			className: zod.z.string(),
-			durationMs: zod.z.number()
-		}) },
-		/** Canonical "something happened at device X" event, per-kind. */
-		onDetectionEvent: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			kind: EventKindSchema,
-			eventId: zod.z.string(),
-			timestamp: zod.z.number()
-		}) }
+		listReferenceImages: require_sleep.method(zod.z.void(), zod.z.array(ReferenceImageEntrySchema).readonly()),
+		getReferenceImage: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceImageBodySchema.nullable()),
+		getReferenceAudioFiles: require_sleep.method(zod.z.void(), zod.z.array(ReferenceAudioEntrySchema).readonly()),
+		getReferenceAudio: require_sleep.method(zod.z.object({ filename: zod.z.string() }), ReferenceAudioBodySchema.nullable()),
+		getAudioCapabilities: require_sleep.method(zod.z.void(), AudioCapabilitiesSchema),
+		runAudioTest: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			modelId: zod.z.string(),
+			filename: zod.z.string().optional(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		}), AudioTestResultSchema, { kind: "mutation" }),
+		getDetectionConfigSchema: require_sleep.method(zod.z.void(), ConfigUISchemaNullableBridge)
 	}
 };
 //#endregion
@@ -23682,6 +23560,108 @@ var CameraMetricsSchema = zod.z.object({
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: zod.z.number() });
 //#endregion
+//#region src/capabilities/zones.cap.ts
+/**
+* Zone — pure geometry + identity. NO filtering behaviour.
+*
+* Zones describe **where** in the frame the operator wants to flag
+* something; consumer-owned {@link ZoneRule} arrays describe **how**
+* each pipeline stage uses them. Splitting the two means a single
+* polygon "Driveway" can simultaneously back a motion-exclude rule,
+* a detection-include rule on `['car']`, and an occupancy aggregate
+* — without three duplicated polygons.
+*
+* Owned by the orchestrator addon (provider) and mirrored into the
+* `zones` device-state slice on every mutation. Consumers
+* (motion-wasm, pipeline-executor, analytics, admin UI) read either
+* via `api.zones.listZones` (one-shot) or via `dev.state.zones` (live
+* mirror with `onChanged`).
+*
+* Coordinates are normalised fractions of the frame (0–1) so zones
+* survive resolution changes and stream profile switches.
+*
+* `kind` discriminates between full polygons (closed regions used
+* for intrusion / occupancy filters) and tripwires (open 2-point
+* line segments used for cross events). Onboard / firmware-reported
+* zones (Reolink, ONVIF) are out of scope for now — see the deferred
+* task list.
+*/
+var ZoneKindEnum = zod.z.enum(["polygon", "tripwire"]);
+/** Polygon vertex in fraction-of-frame coordinates (0–1). */
+var PolygonPointSchema = zod.z.object({
+	x: zod.z.number(),
+	y: zod.z.number()
+});
+/** A camera detection zone — pure geometry/identity. */
+var ZoneSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: zod.z.array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: zod.z.string().default("#3b82f6")
+});
+/**
+* Zones capability — per-camera CRUD over polygon detection zones.
+*
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
+*/
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [require_sleep.DeviceType.Camera],
+	methods: {
+		listZones: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(ZoneSchema).readonly()),
+		addZone: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			zone: ZoneSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			zoneId: zod.z.string()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			zone: ZoneSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: zod.z.object({ zones: zod.z.array(ZoneSchema).readonly() }),
+	/**
+	* Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+//#endregion
 //#region src/capabilities/pipeline-runner.cap.ts
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
@@ -37124,7 +37104,7 @@ var HardwareInfoSchema = zod.z.object({
 	coral: CoralInfoSchema.nullable().optional()
 });
 var PlatformScoreSchema = zod.z.object({
-	runtime: zod.z.enum(["node", "python"]),
+	runtime: zod.z.literal("python"),
 	backend: zod.z.string(),
 	format: zod.z.enum([
 		"onnx",
@@ -37161,7 +37141,7 @@ var ModelRequirementSchema = zod.z.object({
 });
 var ResolvedInferenceConfigSchema = zod.z.object({
 	modelId: zod.z.string(),
-	runtime: zod.z.enum(["node", "python"]),
+	runtime: zod.z.literal("python"),
 	backend: zod.z.string(),
 	format: ModelFormatSchema,
 	reason: zod.z.string()
@@ -40819,6 +40799,98 @@ var sceneMonitorCapability = {
 	durability: "session"
 };
 //#endregion
+//#region src/capabilities/schemas/zone-rule.ts
+/**
+* Per-stage gating mode applied to the zones a rule references.
+*
+* - `include`: the rule contributes to a **whitelist** for its stage.
+*   When at least one `include` rule fires for a stage, only entities
+*   inside one of those zones pass that stage.
+* - `exclude`: the rule contributes to a **blacklist** for its stage.
+*   Entities inside one of those zones are dropped at that stage.
+*
+* `monitor`-style observation (count without filtering) is not a rule
+* mode — zones without any matching rule are observed naturally by
+* `zone-analytics` (live snapshot + history), so an "I just want to
+* count, not filter" use case needs no rule at all.
+*/
+var ZoneRuleModeEnum = zod.z.enum(["include", "exclude"]);
+/**
+* Per-consumer rule that references existing zones (geometry) and
+* defines how a specific pipeline stage should treat them. Each
+* consumer addon owns its own `ZoneRule[]` array in its per-device
+* settings:
+*
+* - `addon-motion-wasm` → `motionZoneRules: ZoneRule[]` (motion stage)
+* - `addon-detection-pipeline` → `detectionZoneRules: ZoneRule[]` (detection stage)
+* - future: notification rules, audio gating, etc.
+*
+* One rule applies to N zones (`zoneIds[]`) so the operator can
+* express "ignore motion in ALL of {garden, street}" with a single
+* rule. `classFilter` narrows the rule to specific object classes —
+* "drop person detections in the street, but keep cars" is one
+* `exclude` rule with `classFilter: ['person']`.
+*
+* `enabled` is a soft toggle — the operator can keep the rule
+* configured but inert without deleting it.
+*/
+var ZoneRuleSchema = zod.z.object({
+	/** Stable rule id — survives edits, used by the UI for diffing. */
+	id: zod.z.string(),
+	/** Optional human-readable label rendered in the rule editor. */
+	name: zod.z.string().optional(),
+	/** Zones this rule targets. The rule's `mode` applies to ALL
+	*  listed zones (OR-set: a detection in any one of them counts).
+	*  At least one zone id required — a rule with no targets is a
+	*  configuration mistake and the form validator rejects it. */
+	zoneIds: zod.z.array(zod.z.string()).min(1).readonly(),
+	mode: ZoneRuleModeEnum,
+	/**
+	* Class names this rule applies to. Empty / undefined ⇒ rule
+	* applies to every class. Class strings match the `macroClass`
+	* field on detections (e.g. `person`, `car`, `dog`).
+	*/
+	classFilter: zod.z.array(zod.z.string()).readonly().optional(),
+	/**
+	* Minimum bbox/mask overlap (0–1) with any of the rule's zones
+	* required to consider an entity "in the zone". Defaults to the
+	* consumer's stage default when omitted. Kept for back-compat with
+	* existing per-rule overrides; new operators pick the value via
+	* `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+	* set, the lower-level engine reads it as a 0–1 fraction.
+	*/
+	overlapThreshold: zod.z.number().min(0).max(1).optional(),
+	/**
+	* Operator-friendly version of `overlapThreshold` — the percentage
+	* of the detection's bbox that must lie inside the zone for the
+	* rule to match. Documented default is 85%; the engine substitutes
+	* that when the field is omitted (kept optional so existing rules
+	* stored without it stay valid).
+	*
+	* When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+	* rule, the engine prefers `bboxInclusionPct` because it's the
+	* field exposed in the UI. Internally both feed the same gate.
+	*/
+	bboxInclusionPct: zod.z.number().min(0).max(100).optional(),
+	/**
+	* When `true` and a detection has a segmentation mask, use the
+	* mask for overlap instead of the bbox. Detection-stage only;
+	* motion rules ignore this field.
+	*/
+	preferMask: zod.z.boolean().optional(),
+	/**
+	* Soft-toggle: `false` disables the rule without deleting it.
+	* Defaults to `true` so operators creating a rule via the UI
+	* see it active immediately.
+	*/
+	enabled: zod.z.boolean().default(true)
+});
+/**
+* Convenience array schema — used by addon device-settings
+* contributions and runtime payloads (e.g. `RunnerCameraConfig`).
+*/
+var ZoneRulesArraySchema = zod.z.array(ZoneRuleSchema).readonly();
+//#endregion
 //#region src/capabilities/script-runner.cap.ts
 /**
 * Script-runner cap. Models HA `script.*` entities on
@@ -53106,6 +53178,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewStateSummary": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.previewTemplate": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -53682,12 +53760,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.runReplayFrameProcessor": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineAnalytics.saveRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -58116,11 +58188,6 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"pipelineAnalytics.runReplayFrameProcessor": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"pipelineAnalytics.saveRetrainAnnotations": [{
 		name: "deviceId",
 		form: "single",
@@ -61728,18 +61795,38 @@ var WEEKDAY_TO_DAY = {
 	Fri: 5,
 	Sat: 6
 };
-/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
-*  An invalid/unknown IANA name falls back to the host timezone. */
-function localDayMinute(atMs, timezone) {
-	const d = new Date(atMs);
-	if (timezone !== void 0) try {
-		const parts = new Intl.DateTimeFormat("en-US", {
+/**
+* One formatter per timezone, built once (D647 review I4). Constructing an
+* `Intl.DateTimeFormat` is the expensive part of this function, and a caller
+* that asks about many instants — a window scan — used to build one per
+* instant. `null` = an invalid IANA name (the host timezone is used).
+*/
+var FORMATTERS = /* @__PURE__ */ new Map();
+function formatterFor(timezone) {
+	const held = FORMATTERS.get(timezone);
+	if (held !== void 0) return held;
+	let made;
+	try {
+		made = new Intl.DateTimeFormat("en-US", {
 			timeZone: timezone,
 			weekday: "short",
 			hour: "numeric",
 			minute: "numeric",
 			hourCycle: "h23"
-		}).formatToParts(d);
+		});
+	} catch {
+		made = null;
+	}
+	FORMATTERS.set(timezone, made);
+	return made;
+}
+/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
+*  An invalid/unknown IANA name falls back to the host timezone. */
+function localDayMinute(atMs, timezone) {
+	const d = new Date(atMs);
+	const formatter = timezone !== void 0 ? formatterFor(timezone) : null;
+	if (formatter !== null) try {
+		const parts = formatter.formatToParts(d);
 		let weekday;
 		let hour;
 		let minute;
@@ -61926,6 +62013,119 @@ var DEVICE_EVENTS = [
 	"detection-blind",
 	...ALARM
 ];
+/** Every kind a summary may speak about — the two summarisable families. */
+var SUMMARISABLE = [...systemEventKindsOfFamily("device-events"), ...systemEventKindsOfFamily("system")];
+/** One per summary SECTION (`NC_STATE_SUMMARY_SECTIONS` in the notification
+*  centre): the section's lines, offered when one of its kinds is selected. */
+var STATE_SUMMARY_SECTION_VARS = [
+	{
+		name: "summaryDevices",
+		label: "Summary: devices offline / switched off",
+		example: "Garage — offline since 07:12",
+		kinds: [
+			"device-offline",
+			"device-online",
+			"device-disabled",
+			"device-enabled"
+		]
+	},
+	{
+		name: "summaryStreams",
+		label: "Summary: streams offline",
+		example: "Ingresso (high) — since 06:40",
+		kinds: ["stream-offline", "stream-online"]
+	},
+	{
+		name: "summaryBattery",
+		label: "Summary: low batteries",
+		example: "Sensore porta — 8 %",
+		kinds: BATTERY
+	},
+	{
+		name: "summaryConsumables",
+		label: "Summary: consumables",
+		example: "Robot — filter 10 %",
+		kinds: CONSUMABLE
+	},
+	{
+		name: "summaryTanks",
+		label: "Summary: tanks",
+		example: "Robot — clean water low",
+		kinds: TANK
+	},
+	{
+		name: "summaryDetection",
+		label: "Summary: cameras detecting nothing",
+		example: "Ingresso — since 05:10",
+		kinds: ["detection-blind"]
+	},
+	{
+		name: "summaryNodes",
+		label: "Summary: nodes",
+		example: "little-unraid — offline since 03:00",
+		kinds: [
+			"node-offline",
+			"node-online",
+			"node-inference-unavailable"
+		]
+	},
+	{
+		name: "summaryAddons",
+		label: "Summary: addons",
+		example: "@camstack/addon-recorder 1.2.3 → 1.2.4",
+		kinds: [
+			"addon-crash-loop",
+			"addon-update-available",
+			"addon-updated"
+		]
+	},
+	{
+		name: "summaryUpdates",
+		label: "Summary: server & container updates",
+		example: "server 1.2.377 → 1.2.378",
+		kinds: [
+			"server-update-available",
+			"server-updated",
+			"wrapper-update-available"
+		]
+	}
+];
+var STATE_SUMMARY_VARS = [
+	{
+		name: "summaryText",
+		label: "Summary: every section",
+		description: "One block per section with something to report, one line per item.",
+		example: "Batterie scariche: Sensore porta — 8 %",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	{
+		name: "summaryCount",
+		label: "Summary: items reported",
+		example: "3",
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...SUMMARISABLE],
+		systemEventDeliveries: ["summary"]
+	},
+	...STATE_SUMMARY_SECTION_VARS.map((v) => ({
+		name: v.name,
+		label: v.label,
+		example: v.example,
+		group: "system",
+		families: ["rule"],
+		fields: [...RULE_TEXT],
+		kinds: ["system"],
+		systemEventKinds: [...v.kinds],
+		systemEventDeliveries: ["summary"]
+	}))
+];
 var NC_TEMPLATE_VARS = [
 	{
 		name: "camera",
@@ -62176,7 +62376,8 @@ var NC_TEMPLATE_VARS = [
 		group: "system",
 		families: ["rule"],
 		fields: [...RULE_TEXT],
-		kinds: ["system"]
+		kinds: ["system"],
+		systemEventDeliveries: ["instant"]
 	},
 	{
 		name: "deviceName",
@@ -62619,7 +62820,8 @@ var NC_TEMPLATE_VARS = [
 		group: "digest",
 		families: ["summary"],
 		fields: [...RULE_TEXT]
-	}
+	},
+	...STATE_SUMMARY_VARS
 ];
 /**
 * System-event kinds the SERVED catalog holds back (D642): the kinds the hub
@@ -62648,11 +62850,32 @@ var NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS = [
 * rule an installed viewer can author, which is exactly true.
 */
 function servedTemplateVars() {
-	return NC_TEMPLATE_VARS.map((d) => d.systemEventKinds === void 0 ? d : {
+	return NC_TEMPLATE_VARS.filter((d) => !isHeldBackTemplateVar(d)).map((d) => d.systemEventKinds === void 0 ? d : {
 		...d,
 		systemEventKinds: d.systemEventKinds.filter((kind) => !NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS.includes(kind))
 	});
 }
+/**
+* Is this descriptor held back from the SERVED catalog as a whole (D647)?
+* A summary-only variable is: an installed viewer does not read the delivery
+* axis, and would offer it on every instant system rule. The admin, built
+* from the workspace, restores it from its own `NC_TEMPLATE_VARS`.
+*/
+function isHeldBackTemplateVar(d) {
+	return d.systemEventDeliveries !== void 0 && !d.systemEventDeliveries.includes("instant");
+}
+/**
+* Does a descriptor have a value on a system rule of this DELIVERY (D647)?
+* Read only for a system rule kind. An absent axis is `instant` for a
+* descriptor that names `systemEventKinds` (a per-event fact: a summary row
+* has no one device, node or package) and BOTH for one that does not
+* (`{{rule}}`, `{{time}}`).
+*/
+function templateVarDeliveryApplies(d, ctx) {
+	if (!isSystemRuleKind(ctx.kind)) return true;
+	const mode = ctx.systemEventDelivery ?? "instant";
+	return (d.systemEventDeliveries ?? (d.systemEventKinds !== void 0 ? ["instant"] : [mode])).includes(mode);
+}
 /** The caption fields see a fixed, smaller vocabulary (`timelapsePreviewText`,
 *  `summaryCaptionText`). Declared here rather than as `fields` on every
 *  descriptor so the whole rule stays in one line of code. */
@@ -62717,13 +62940,122 @@ function templateVarsFor(ctx) {
 		const allowed = CAPTION_VARS[ctx.field];
 		return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && allowed.includes(d.name) && d.dynamic === void 0);
 	}
-	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx));
+	return NC_TEMPLATE_VARS.filter((d) => d.families.includes(ctx.family) && onAxis(d.fields, ctx.field) && templateVarKindApplies(d.kinds, ctx.kind) && onAxis(d.deliveries, ctx.delivery) && templateVarSystemEventApplies(d, ctx) && templateVarDeliveryApplies(d, ctx));
 }
 /** True when `name` is supplied in `ctx`, dynamic families (`count_<class>`) included. */
 function isKnownTemplateVar(name, ctx) {
 	return templateVarsFor(ctx).some((d) => d.dynamic !== void 0 ? name.startsWith(d.dynamic.prefix) && name.length > d.dynamic.prefix.length : d.name === name);
 }
 //#endregion
+//#region src/notification/system-event-summary.ts
+/** The families a rule may summarise. The alarm is not one of them. */
+var NC_SYSTEM_EVENT_SUMMARY_FAMILIES = ["device-events", "system"];
+/** The summary's schedule, or `null` for any rule that is not a summary system rule. */
+function systemEventSummaryScheduleOf(rule) {
+	if (!isSystemDelivery(rule.delivery)) return null;
+	const delivery = rule.systemEventDelivery;
+	return delivery?.mode === "summary" ? delivery.schedule : null;
+}
+/** Absent and `instant` are the same answer: a notification per event. */
+function isSystemEventSummaryRule(rule) {
+	return systemEventSummaryScheduleOf(rule) !== null;
+}
+function actionsAreSet(actions) {
+	return (actions?.onTrigger?.length ?? 0) > 0 || (actions?.buttons?.length ?? 0) > 0;
+}
+/**
+* Why the hub refuses this rule's delivery. Empty = accepted. An instant rule
+* (absent or `{ mode: 'instant' }`) is never refused here.
+*
+* Beside a summary, two fields are refused because they would do nothing:
+* the rule's own `schedule` (the summary's schedule is the send time; a second
+* active-hours gate would silently empty it) and `actions` (a summary is not a
+* match, so nothing would ever run them).
+*/
+function systemEventDeliveryProblems(rule) {
+	if (rule.systemEventDelivery?.mode !== "summary") return [];
+	if (!isSystemDelivery(rule.delivery)) return [{
+		code: "not-a-system-rule",
+		delivery: rule.delivery
+	}];
+	const problems = [];
+	const verdict = systemEventFamilyOf(rule.conditions.systemEvent?.kinds ?? []);
+	const family = verdict.kind === "family" ? verdict.family : "mixed";
+	if (family === "mixed" || !NC_SYSTEM_EVENT_SUMMARY_FAMILIES.includes(family)) problems.push({
+		code: "family-not-summarisable",
+		family
+	});
+	const windows = rule.systemEventDelivery.schedule.windows;
+	if (windows.length === 0) problems.push({ code: "empty-schedule" });
+	windows.forEach((window, index) => {
+		if (window.days.length === 0 || window.startMinute === window.endMinute) problems.push({
+			code: "degenerate-window",
+			index
+		});
+	});
+	if (rule.schedule !== void 0) problems.push({ code: "schedule-beside-summary" });
+	if (actionsAreSet(rule.actions)) problems.push({ code: "actions-beside-summary" });
+	return problems;
+}
+function describeSystemEventDeliveryProblem(problem) {
+	switch (problem.code) {
+		case "not-a-system-rule": return `a '${problem.delivery}' rule has no summary delivery — only device-events and system rules do`;
+		case "family-not-summarisable": return problem.family === "alarm" ? "an alarm rule cannot be a scheduled summary — the alarm stays instant" : `a ${problem.family} rule cannot be a scheduled summary — only device-events and system rules`;
+		case "degenerate-window": return `send time ${String(problem.index + 1)} has no day, or starts and ends on the same minute — it never closes, so nothing would be sent`;
+		case "empty-schedule": return "a summary rule needs at least one send time — its schedule has no window";
+		case "schedule-beside-summary": return "a summary rule is sent on its summary schedule — remove the active-hours schedule";
+		case "actions-beside-summary": return "a summary rule never matches an event, so its actions would never run — remove them";
+	}
+}
+var DAY_MINUTES = 1440;
+/**
+* A send time is a ONE-MINUTE window that closes at that minute: the summary is
+* sent when a window ends. Midnight starts the window at 23:59 of the day
+* BEFORE, because a window's `days` are the days it STARTS on.
+*/
+function scheduleForSendTimes(times, timezone) {
+	return {
+		windows: times.map((time) => {
+			const startMinute = (time.minute + DAY_MINUTES - 1) % DAY_MINUTES;
+			return {
+				days: (time.minute === 0 ? time.days.map((day) => (day + 6) % 7) : [...time.days]).toSorted((a, b) => a - b),
+				startMinute,
+				endMinute: time.minute
+			};
+		}),
+		...timezone !== void 0 ? { timezone } : {}
+	};
+}
+/**
+* The send times a schedule stands for, or `null` when it is not a list of
+* one-minute windows (an inverted or a longer window): the editor then shows
+* the raw windows and says the summary is sent when each one ENDS.
+*/
+function sendTimesOfSchedule(schedule) {
+	if (schedule.invert === true) return null;
+	const times = [];
+	for (const window of schedule.windows) {
+		if ((window.endMinute - window.startMinute + DAY_MINUTES) % DAY_MINUTES !== 1) return null;
+		const days = window.endMinute === 0 ? window.days.map((day) => (day + 1) % 7) : window.days;
+		times.push({
+			days: days.toSorted((a, b) => a - b),
+			minute: window.endMinute
+		});
+	}
+	return times;
+}
+var SUMMARY_CONTENT_VAR = /\{\{\s*summary(?:Text|Devices|Streams|Battery|Consumables|Tanks|Detection|Nodes|Addons|Updates)\s*\}\}/;
+/**
+* Does a custom BODY carry the summary's content (`{{summaryText}}` or a
+* section variable)? A body that does not would send a summary with nothing
+* in it; the hub then appends `{{summaryText}}` and the admin warns (review
+* M3). An absent or blank body uses the hub's own wording, which does.
+*/
+function templateCarriesSummary(body) {
+	if (body === void 0 || body.trim().length === 0) return true;
+	return SUMMARY_CONTENT_VAR.test(body);
+}
+//#endregion
 //#region src/notification/scope-picker-items.ts
 function nodePickerItems(nodes) {
 	return nodes.map((node) => ({
@@ -64535,6 +64867,112 @@ function isSameAddonId(a, b) {
 	return bareAddonId(a) === bareAddonId(b);
 }
 //#endregion
+//#region src/utils/background-run-registry.ts
+function snapshot(run) {
+	return {
+		runId: run.runId,
+		state: run.state,
+		startedAtMs: run.startedAtMs,
+		finishedAtMs: run.finishedAtMs,
+		progress: run.progress,
+		result: run.result,
+		error: run.error
+	};
+}
+var BackgroundRunRegistry = class {
+	opts;
+	runs = /* @__PURE__ */ new Map();
+	now;
+	constructor(opts) {
+		this.opts = opts;
+		this.now = opts.now ?? Date.now;
+	}
+	/** Runs still going. */
+	get runningCount() {
+		let n = 0;
+		for (const run of this.runs.values()) if (run.state === "running") n += 1;
+		return n;
+	}
+	/**
+	* Register and start `work`. Returns the `running` receipt immediately.
+	* Throws only for a refusal the caller must see (duplicate id, busy) — a
+	* failure of the work itself lands in `status`, never here.
+	*/
+	start(runId, work) {
+		const existing = this.runs.get(runId);
+		if (existing !== void 0 && existing.state === "running") throw new Error(`run '${runId}' is already running`);
+		if (this.runningCount >= this.opts.maxConcurrent) throw new Error(`busy: ${this.runningCount}/${this.opts.maxConcurrent} run(s) already in progress — wait for one to finish or abort it`);
+		const run = {
+			runId,
+			state: "running",
+			startedAtMs: this.now(),
+			finishedAtMs: null,
+			progress: null,
+			result: null,
+			error: null,
+			controller: new AbortController()
+		};
+		this.runs.delete(runId);
+		this.runs.set(runId, run);
+		const ctx = {
+			signal: run.controller.signal,
+			report: (progress) => {
+				run.progress = progress;
+			}
+		};
+		const settle = (patch) => {
+			if (patch.error !== void 0) {
+				run.state = "failed";
+				run.error = patch.error;
+			} else {
+				run.state = run.controller.signal.aborted ? "aborted" : "done";
+				run.result = patch.result ?? null;
+			}
+			run.finishedAtMs = this.now();
+			this.prune();
+			this.opts.onSettled?.(snapshot(run));
+		};
+		let pending;
+		try {
+			pending = work(ctx);
+		} catch (err) {
+			pending = Promise.reject(err);
+		}
+		pending.then((result) => settle({ result }), (err) => settle({ error: err instanceof Error ? err.message : String(err) }));
+		return snapshot(run);
+	}
+	status(runId) {
+		const run = this.runs.get(runId);
+		return run === void 0 ? null : snapshot(run);
+	}
+	/** Running runs first (newest start first), then finished ones (newest finish first). */
+	list() {
+		const all = [...this.runs.values()];
+		const running = all.filter((r) => r.state === "running").toSorted((a, b) => b.startedAtMs - a.startedAtMs);
+		const finished = all.filter((r) => r.state !== "running").toSorted((a, b) => (b.finishedAtMs ?? 0) - (a.finishedAtMs ?? 0));
+		return [...running, ...finished].map(snapshot);
+	}
+	/** Signal a running run to stop. `false` for an unknown or already finished run. */
+	abort(runId) {
+		const run = this.runs.get(runId);
+		if (run === void 0 || run.state !== "running") return false;
+		run.controller.abort();
+		return true;
+	}
+	/** Abort every running run (shutdown). */
+	abortAll() {
+		for (const run of this.runs.values()) if (run.state === "running") run.controller.abort();
+	}
+	prune() {
+		const finished = [...this.runs.values()].filter((r) => r.state !== "running").toSorted((a, b) => (a.finishedAtMs ?? 0) - (b.finishedAtMs ?? 0));
+		const excess = finished.length - this.opts.keepFinished;
+		for (let i = 0; i < excess; i++) {
+			const victim = finished[i];
+			if (victim !== void 0) this.runs.delete(victim.runId);
+		}
+	}
+};
+//#endregion
 //#region src/utils/cosine-similarity.ts
 /** Cosine similarity between two embedding vectors */
 function cosineSimilarity(a, b) {
@@ -65209,27 +65647,10 @@ function withTimeout(promise, ms) {
 //#endregion
 //#region src/utils/runtime-mapping.ts
 /**
-* Map a backend ID to the model format it requires.
-*
-* Node.js backends (cpu, coreml, cuda, tensorrt) all use ONNX format
-* because onnxruntime-node loads .onnx and uses execution providers internally.
-*
-* Python backends use their native format.
-*/
-var BACKEND_TO_FORMAT = {
-	cpu: "onnx",
-	coreml: "onnx",
-	cuda: "onnx",
-	tensorrt: "onnx",
-	"onnx-py": "onnx",
-	pytorch: "pt",
-	openvino: "openvino"
-};
-/**
 * DEVICE-POOL backend → model format — the SSOT for the multi-device inference
-* DESCRIPTOR path (Python per-device pools), distinct from {@link BACKEND_TO_FORMAT}
-* above which is the legacy NODE runtime map (where `coreml → onnx` because
-* onnxruntime-node's CoreML EP loads `.onnx`). Here a device pool runs the
+* DESCRIPTOR path (Python per-device pools),  distinct from the former BACKEND_TO_FORMAT,
+* which was the removed NODE runtime map (where `coreml → onnx` because
+* onnxruntime-node's CoreML EP loaded `.onnx`). A device pool runs the
 * backend NATIVELY, so `coreml → coreml` and `edgetpu → tflite`. Consumed by
 * `resolveDeviceEngine` (addon-pipeline) and the orchestrator's
 * `parseDeviceKey`/`getNodeInferenceDevices` — the previously-duplicated
@@ -65270,69 +65691,6 @@ var PYTHON_SCRIPT = {
 	openvino: "openvino_inference.py"
 };
 /**
-* Resolve pipeline config (runtime + backend) to a DetectionRuntime.
-*
-* Pipeline config uses two levels:
-*   runtime: 'node' | 'python'
-*   backend: 'cpu' | 'coreml' | 'cuda' | 'openvino' | 'pytorch' | ...
-*
-* Addons expect a DetectionRuntime:
-*   'onnx' | 'coreml' | 'pytorch' | 'openvino' | 'tflite'
-*
-* Mapping rules:
-*   node + any backend   → 'onnx' (onnxruntime-node handles backend via EP)
-*   python + coreml      → 'coreml' (native .mlpackage via coremltools)
-*   python + openvino    → 'openvino'
-*   python + pytorch     → 'pytorch'
-*   python + onnx-py     → 'onnx'
-*   python + <other>     → backend as-is
-*/
-function resolveDetectionRuntime(pipelineRuntime, backend) {
-	if (pipelineRuntime === "node") return "onnx";
-	return {
-		coreml: "coreml",
-		openvino: "openvino",
-		pytorch: "pytorch",
-		"onnx-py": "onnx",
-		cpu: "onnx"
-	}[backend] ?? backend;
-}
-/**
-* Resolve pipeline config (runtime + backend) to a ModelFormat.
-*
-* Determines which model file format is needed (.onnx, .mlpackage, etc.)
-*/
-function resolveModelFormat(pipelineRuntime, backend) {
-	if (pipelineRuntime === "node") return BACKEND_TO_FORMAT[backend] ?? "onnx";
-	return {
-		coreml: "coreml",
-		openvino: "openvino",
-		pytorch: "pt",
-		"onnx-py": "onnx",
-		cpu: "onnx"
-	}[backend] ?? "onnx";
-}
-/**
-* Resolve pipeline runtime string to 'auto' | DetectionRuntime for addon consumption.
-* Used when building addon addonConfig from pipeline step config.
-*
-*   'python' + 'coreml'   → 'coreml'
-*   'node'   + 'coreml'   → 'onnx'
-*   'node'   + 'cpu'      → 'onnx'
-*   'auto'                → 'auto'
-*/
-function resolveAddonRuntime(pipelineRuntime, backend) {
-	if (!pipelineRuntime || pipelineRuntime === "auto") return "auto";
-	return resolveDetectionRuntime(pipelineRuntime, backend ?? "cpu");
-}
-/**
-* Get the model format needed for a given backend.
-* Convenience wrapper for backend-only lookup (e.g., UI components).
-*/
-function formatForBackend(backend) {
-	return BACKEND_TO_FORMAT[backend] ?? "onnx";
-}
-/**
 * Get the model format for a given DetectionRuntime.
 */
 function formatForRuntime(runtime) {
@@ -65802,12 +66160,12 @@ exports.AutomationControlStatusSchema = AutomationControlStatusSchema;
 exports.AutomationRecipeSchema = AutomationRecipeSchema;
 exports.AutomationTriggerSchema = AutomationTriggerSchema;
 exports.AvailableIntegrationTypeSchema = AvailableIntegrationTypeSchema;
-exports.BACKEND_TO_FORMAT = BACKEND_TO_FORMAT;
 exports.BASE_LIVE_EGRESS_PROFILE = BASE_LIVE_EGRESS_PROFILE;
 exports.BATTERY_DEVICE_PROFILE = BATTERY_DEVICE_PROFILE;
 exports.BATTERY_UNREACHABLE_AFTER_MS = BATTERY_UNREACHABLE_AFTER_MS;
 exports.BIRTH_DECISION_DEFAULT_LIMIT = BIRTH_DECISION_DEFAULT_LIMIT;
 exports.BOOT_RECOVERY_BACKOFF_MS = require_sleep.BOOT_RECOVERY_BACKOFF_MS;
+exports.BackgroundRunRegistry = BackgroundRunRegistry;
 exports.BacklightModeSchema = BacklightModeSchema;
 exports.BackupDestinationInfoSchema = BackupDestinationInfoSchema;
 exports.BackupEntrySchema = BackupEntrySchema;
@@ -66066,6 +66424,7 @@ exports.EXPRESSION_BUILTIN_NAMES = EXPRESSION_BUILTIN_NAMES;
 exports.EXPRESSION_COMPILE_CACHE_CAPACITY = EXPRESSION_COMPILE_CACHE_CAPACITY;
 exports.EXPRESSION_IDENTIFIER_RE = EXPRESSION_IDENTIFIER_RE;
 exports.EXPRESSION_INJECTED_NOW = EXPRESSION_INJECTED_NOW;
+exports.EffectiveTuningSchema = EffectiveTuningSchema;
 exports.EgressEncodeSchema = EgressEncodeSchema;
 exports.EgressRateControlSchema = EgressRateControlSchema;
 exports.EgressTranscodeRequestSchema = EgressTranscodeRequestSchema;
@@ -66397,6 +66756,7 @@ exports.NC_SYSTEM_EVENT_FAMILY = NC_SYSTEM_EVENT_FAMILY;
 exports.NC_SYSTEM_EVENT_FAMILY_FILTERS = NC_SYSTEM_EVENT_FAMILY_FILTERS;
 exports.NC_SYSTEM_EVENT_FILTER_KEYS = NC_SYSTEM_EVENT_FILTER_KEYS;
 exports.NC_SYSTEM_EVENT_KIND_GROUP_SPECS = NC_SYSTEM_EVENT_KIND_GROUP_SPECS;
+exports.NC_SYSTEM_EVENT_SUMMARY_FAMILIES = NC_SYSTEM_EVENT_SUMMARY_FAMILIES;
 exports.NC_SYSTEM_RULE_KINDS = NC_SYSTEM_RULE_KINDS;
 exports.NC_TANK_SYSTEM_EVENT_KINDS = NC_TANK_SYSTEM_EVENT_KINDS;
 exports.NC_TAXONOMY = NC_TAXONOMY;
@@ -66474,7 +66834,11 @@ exports.NcSnoozeInputSchema = NcSnoozeInputSchema;
 exports.NcSnoozeSchema = NcSnoozeSchema;
 exports.NcSnoozeScopeSchema = NcSnoozeScopeSchema;
 exports.NcSnoozeSuppressedSchema = NcSnoozeSuppressedSchema;
+exports.NcStateSummaryPreviewSchema = NcStateSummaryPreviewSchema;
+exports.NcStateSummaryPreviewSectionSchema = NcStateSummaryPreviewSectionSchema;
 exports.NcSystemEventConditionSchema = NcSystemEventConditionSchema;
+exports.NcSystemEventDeliveryModeSchema = NcSystemEventDeliveryModeSchema;
+exports.NcSystemEventDeliverySchema = NcSystemEventDeliverySchema;
 exports.NcSystemEventKindSchema = NcSystemEventKindSchema;
 exports.NcTaxonomyEntrySchema = NcTaxonomyEntrySchema;
 exports.NcTaxonomySchema = NcTaxonomySchema;
@@ -67092,6 +67456,7 @@ exports.describeCustomActions = require_sleep.describeCustomActions;
 exports.describeModelVariant = describeModelVariant;
 exports.describeOnboardClamp = describeOnboardClamp;
 exports.describeOnboardRefusal = describeOnboardRefusal;
+exports.describeSystemEventDeliveryProblem = describeSystemEventDeliveryProblem;
 exports.describeSystemEventFamilyProblem = describeSystemEventFamilyProblem;
 exports.detectAccessRole = detectAccessRole;
 exports.detectionPipelineCapability = detectionPipelineCapability;
@@ -67149,7 +67514,6 @@ exports.filesystemBrowseCapability = filesystemBrowseCapability;
 exports.findTimezone = findTimezone;
 exports.floodCapability = floodCapability;
 exports.foldSnapshotByFunction = foldSnapshotByFunction;
-exports.formatForBackend = formatForBackend;
 exports.formatForRuntime = formatForRuntime;
 exports.formatMediaOwnerKey = formatMediaOwnerKey;
 exports.formatMinutes = formatMinutes;
@@ -67192,6 +67556,7 @@ exports.isDisplayIconKey = isDisplayIconKey;
 exports.isEvent = require_sleep.isEvent;
 exports.isEventOwnerType = isEventOwnerType;
 exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
+exports.isHeldBackTemplateVar = isHeldBackTemplateVar;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isKnownTemplateVar = isKnownTemplateVar;
 exports.isLocationEnabled = isLocationEnabled;
@@ -67208,6 +67573,7 @@ exports.isSourceCap = isSourceCap;
 exports.isStorageLocationMode = isStorageLocationMode;
 exports.isSystemDelivery = isSystemDelivery;
 exports.isSystemEventFamily = isSystemEventFamily;
+exports.isSystemEventSummaryRule = isSystemEventSummaryRule;
 exports.isSystemRuleKind = isSystemRuleKind;
 exports.isVoidInput = isVoidInput;
 exports.ituDbfsFromPreEpoch = ituDbfsFromPreEpoch;
@@ -67349,13 +67715,11 @@ exports.resetPoolBaseline = resetPoolBaseline;
 exports.resolveAddonExecution = resolveAddonExecution;
 exports.resolveAddonGroup = resolveAddonGroup;
 exports.resolveAddonPlacement = resolveAddonPlacement;
-exports.resolveAddonRuntime = resolveAddonRuntime;
 exports.resolveBucketMs = resolveBucketMs;
 exports.resolveCapMount = require_sleep.resolveCapMount;
 exports.resolveClusterStepModelId = resolveClusterStepModelId;
 exports.resolveContainerPrimaryChild = resolveContainerPrimaryChild;
 exports.resolveCreateExportSubject = resolveCreateExportSubject;
-exports.resolveDetectionRuntime = resolveDetectionRuntime;
 exports.resolveDeviceControlKind = resolveDeviceControlKind;
 exports.resolveDeviceProfile = resolveDeviceProfile;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
@@ -67365,7 +67729,6 @@ exports.resolveHydratedFieldValue = require_sleep.resolveHydratedFieldValue;
 exports.resolveLocationIcon = resolveLocationIcon;
 exports.resolveLocationMode = resolveLocationMode;
 exports.resolveMethodAuth = resolveMethodAuth;
-exports.resolveModelFormat = resolveModelFormat;
 exports.resolveMutate = resolveMutate;
 exports.resolvePoolMemoryPolicy = resolvePoolMemoryPolicy;
 exports.resolveRecordingProfiles = resolveRecordingProfiles;
@@ -67386,6 +67749,7 @@ exports.runInferenceStep = runInferenceStep;
 exports.runtimeDevices = runtimeDevices;
 exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
 exports.sceneMonitorCapability = sceneMonitorCapability;
+exports.scheduleForSendTimes = scheduleForSendTimes;
 exports.schemaDeclaresAnyField = schemaDeclaresAnyField;
 exports.scopeInherits = scopeInherits;
 exports.scopeKey = require_sleep.scopeKey;
@@ -67395,6 +67759,7 @@ exports.scoreRuntimes = scoreRuntimes;
 exports.scriptRunnerCapability = scriptRunnerCapability;
 exports.searchDisplayIcons = searchDisplayIcons;
 exports.selectAssignedProfileSlots = require_sleep.selectAssignedProfileSlots;
+exports.sendTimesOfSchedule = sendTimesOfSchedule;
 exports.sensorRaisedOf = sensorRaisedOf;
 exports.sensorTransitionNeverFires = sensorTransitionNeverFires;
 exports.sensorTransitionOffered = sensorTransitionOffered;
@@ -67436,12 +67801,14 @@ exports.switchCapability = switchCapability;
 exports.switchedOffIds = switchedOffIds;
 exports.synthesizeSourceInfo = synthesizeSourceInfo;
 exports.systemCapability = systemCapability;
+exports.systemEventDeliveryProblems = systemEventDeliveryProblems;
 exports.systemEventFamilyOf = systemEventFamilyOf;
 exports.systemEventFamilyProblems = systemEventFamilyProblems;
 exports.systemEventFilterApplies = systemEventFilterApplies;
 exports.systemEventFilterAppliesToAnyKind = systemEventFilterAppliesToAnyKind;
 exports.systemEventKindNamesOf = systemEventKindNamesOf;
 exports.systemEventKindsOfFamily = systemEventKindsOfFamily;
+exports.systemEventSummaryScheduleOf = systemEventSummaryScheduleOf;
 exports.systemFamilyOfKind = systemFamilyOfKind;
 exports.systemRuleKindOf = systemRuleKindOf;
 exports.tamperCapability = tamperCapability;
@@ -67449,6 +67816,8 @@ exports.taskLogEntrySchema = taskLogEntrySchema;
 exports.taskPhaseSchema = taskPhaseSchema;
 exports.taskTargetSchema = taskTargetSchema;
 exports.temperatureSensorCapability = temperatureSensorCapability;
+exports.templateCarriesSummary = templateCarriesSummary;
+exports.templateVarDeliveryApplies = templateVarDeliveryApplies;
 exports.templateVarKindApplies = templateVarKindApplies;
 exports.templateVarSystemEventApplies = templateVarSystemEventApplies;
 exports.templateVarsFor = templateVarsFor;