@camstack/types 1.2.260 → 1.2.261

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BDYxE1ax.js");
+const require_sleep = require("./sleep-QxyLiUId.js");
 const require_event_category = require("./event-category-BVfsrBYA.js");
 const require_canonical_hash = require("./canonical-hash-CSE4ioRi.js");
 const require_enums = require("./enums.js");
@@ -5017,6 +5017,94 @@ function describeModelVariant(models, modelId) {
 	};
 }
 //#endregion
+//#region src/types/clip-model.ts
+/**
+* A CLIP model's feature-space contract — what every consumer of its vectors
+* must agree on, carried BY THE MODEL rather than re-derived by each consumer.
+*
+* ## Why this lives on the catalog entry
+*
+* Until 2026-09-26 each fact was hard-coded where it was used: the text window
+* (77) and pad id (0) in `text_encoder_inference.py`, the index name
+* (`object-clip`) in the object-embedding store, the "is this a CLIP vector"
+* test as `embeddingModelId.startsWith('mobileclip-')`, the search floor (0.2)
+* in the cap default, and the dimension (512) behind a `getModelMeta` that fell
+* back to MobileCLIP for any id it did not know. Every one of those is wrong for
+* the next model, and each one failed SILENTLY for SigLIP2 in the 2026-09-26
+* spike: vectors dropped before the store with no log, 768-d queries truncated
+* to 512 and ranked as garbage, 97% of true matches under the 0.2 floor (D649).
+*
+* A model now declares its own contract here, and a model with no `clip` block
+* is not a CLIP model to any consumer. That is also the seam Model Studio uses
+* for a user-supplied CLIP model: its registry row carries the same block.
+*/
+/**
+* `object-clip` (the historical MobileCLIP index, 512-d) or
+* `object-clip-<model>`. Lower-case and dash-only so the sqlite-vec table name
+* derived from it (`vec_` + non-word → `_`) cannot collide with another index's.
+*/
+var CLIP_VECTOR_INDEX_PATTERN = /^object-clip(-[a-z0-9][a-z0-9-]*)?$/;
+var ClipModelMetaSchema = zod.z.object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: zod.z.string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: zod.z.number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: zod.z.string().regex(CLIP_VECTOR_INDEX_PATTERN),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: zod.z.string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: zod.z.number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: zod.z.number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: zod.z.number().min(0).max(1)
+});
+/**
+* Model-relative search strictness. The operator picks how picky, the model
+* says what that means in its own cosine band. On MobileCLIP (floor 0.2) these
+* reproduce the admin UI's historical absolute presets 0.20 / 0.25 / 0.30.
+*/
+var CLIP_SEARCH_STRICTNESS = [
+	"loose",
+	"balanced",
+	"strict"
+];
+var ClipSearchStrictnessSchema = zod.z.enum(CLIP_SEARCH_STRICTNESS);
+var CLIP_STRICTNESS_FACTOR = {
+	loose: 1,
+	balanced: 1.25,
+	strict: 1.5
+};
+/**
+* The cosine floor a search runs with.
+*
+* An explicit `minScore` is honoured verbatim: it is a number a caller chose,
+* and silently rescaling it would make the same URL mean different things on
+* two installs. Everything else is relative to the model.
+*/
+function resolveClipSearchMinScore(meta, request) {
+	if (request.minScore !== void 0) return request.minScore;
+	const factor = CLIP_STRICTNESS_FACTOR[request.strictness ?? "loose"];
+	return Math.min(1, Math.round(meta.searchMinScore * factor * 1e3) / 1e3);
+}
+//#endregion
 //#region src/types/models.ts
 var MODEL_FORMATS = [
 	"onnx",
@@ -5241,7 +5329,14 @@ var ModelCatalogEntrySchema = zod.z.object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
 });
 var ConvertTargetSchema = zod.z.discriminatedUnion("format", [zod.z.object({
 	format: zod.z.literal("openvino"),
@@ -12411,6 +12506,28 @@ var LinkedDeviceSchema = zod.z.object({
 	features: zod.z.array(zod.z.string()),
 	producesTrackedEvents: zod.z.boolean().optional()
 });
+/**
+* The `linked-devices` extension slot's editable value (D648): the operator's
+* pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+* in it — they are always linked and are not a pick.
+*/
+var LinkedDevicesSlotValueSchema = zod.z.object({ deviceIds: zod.z.array(zod.z.number().int().positive()) });
+/**
+* The `linked-devices` slot — a camera's companion devices, owned by the
+* device manager over `_linkedDeviceIds` (D648, D356). Any device may be a
+* source except a container (its children are picked in its place) and the
+* camera itself.
+*/
+var LINKED_DEVICES_SLOT = {
+	id: "linked-devices",
+	label: "Linked devices",
+	description: "Companion devices of this camera: their controls appear with it, and the ones you opt in produce tracked events on it.",
+	shape: "association",
+	hostDeviceTypes: [require_sleep.DeviceType.Camera],
+	sourceCaps: "any",
+	cardinality: "many",
+	value: LinkedDevicesSlotValueSchema
+};
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
 *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -12560,6 +12677,7 @@ var deviceManagerCapability = {
 	name: "device-manager",
 	scope: "system",
 	mode: "singleton",
+	extensionSlots: [LINKED_DEVICES_SLOT],
 	exposesDeviceSettings: true,
 	methods: {
 		/** Reserve (or re-resolve) a progressive numeric id for `(addonId, stableId)`.
@@ -13063,11 +13181,12 @@ var deviceManagerCapability = {
 		/**
 		* Resolve the devices LINKED to a camera — the single policy authority
 		* both consumers call (viewer devices panel + pipeline-analytics event
-		* kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
-		* (default) adds every device sharing the camera's non-null `location`,
-		* mode 'manual' adds the persisted manual list instead. Excludes the
-		* camera itself; deduped. Configuration is standard per-device settings
-		* (see the module docblock) — there are no bespoke link mutations.
+		* kinds/ingest). Device-tree children are ALWAYS included, plus the
+		* operator's persisted pick list (`mode` is always `manual` since D356:
+		* same-location devices are suggested by the picker, never linked on
+		* their own). Excludes the camera itself; deduped. The list is written by
+		* the settings section or the `linked-devices` extension slot, both over
+		* `_linkedDeviceIds` (see the module docblock).
 		*/
 		getLinkedDevices: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({
 			mode: LinkedDevicesModeSchema,
@@ -13616,11 +13735,143 @@ var EmbeddingResultSchema = zod.z.object({
 	embedding: zod.z.array(zod.z.number()),
 	inferenceMs: zod.z.number()
 });
+/** The two CLIP towers the encoder runs; a crash budget is kept per tower. */
+var EmbeddingTowerSchema = zod.z.enum(["image", "text"]);
+/**
+* A tower in the terminal `failed` state (D649, D6): it crashed or failed to
+* load `crashes` times within `windowMs`, and is refused by name until an
+* operator `resetFailedModels` or a model change — never on a timer.
+*
+* `nodeId` is the node whose tower failed. The state lives in THAT node's
+* encoder process (in memory — a runner respawn clears it), and one node's
+* answer says nothing about another's.
+*/
+var EmbeddingFailedModelSchema = zod.z.object({
+	modelId: zod.z.string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: zod.z.string(),
+	crashes: zod.z.number(),
+	windowMs: zod.z.number(),
+	sinceMs: zod.z.number(),
+	lastReason: zod.z.string()
+});
+/**
+* A model whose REQUIREMENTS can never be met on this node (D649 round 5):
+* an id the catalog does not know, a model URL answering 404/410, a declared
+* sibling (the tokenizer) that is not there. After `attempts` failed builds
+* it is terminally `requirements-failed`, refused by name until an operator
+* `resetFailedModels` or a model change — the same exits as a crashed tower.
+*/
+var EmbeddingFailedRequirementSchema = zod.z.object({
+	modelId: zod.z.string(),
+	tower: EmbeddingTowerSchema,
+	nodeId: zod.z.string(),
+	attempts: zod.z.number(),
+	sinceMs: zod.z.number(),
+	lastReason: zod.z.string()
+});
 var EmbeddingInfoSchema = zod.z.object({
 	modelId: zod.z.string(),
 	embeddingDim: zod.z.number(),
-	ready: zod.z.boolean()
-});
+	ready: zod.z.boolean(),
+	/**
+	* The node that answered. Absent only from an encoder older than D649's
+	* crash budget — whose `failedModels` is then UNKNOWN (D315), never "none".
+	*/
+	nodeId: zod.z.string().optional(),
+	/**
+	* Towers in `failed` on the answering node, each row naming it. `undefined`
+	* means the node could not say (pre-budget encoder); a node that has the
+	* budget always answers an array, empty included.
+	*/
+	failedModels: zod.z.array(EmbeddingFailedModelSchema).optional(),
+	/** Models terminally `requirements-failed` on the answering node; same reading as above. */
+	failedRequirements: zod.z.array(EmbeddingFailedRequirementSchema).optional()
+});
+/**
+* The THREE codes an encoder refusal can carry (D649, D6). Same shape as
+* `VECTOR_INDEX_DIM_CONFLICT`: the code rides in the MESSAGE, because an
+* Error's own properties do not survive the UDS/tRPC hop and its message does,
+* and both sides go through the helpers below — the encoder builds the
+* refusal, the live detail plane classifies on it to count refusals per
+* camera instead of logging one warning per track. The bracketed token
+* carries the code, the model, the tower and the node so a consumer never
+* parses prose.
+*
+* - `EMBEDDING_MODEL_FAILED`: the tower crashed / failed to load past the crash
+*   budget — terminal until `resetFailedModels` or a model change.
+* - `EMBEDDING_REQUIREMENTS_UNAVAILABLE`: files or runtime not there right now
+*   (a download or Python that failed, or the cooldown after one) — the next
+*   request past the cooldown tries again.
+* - `EMBEDDING_REQUIREMENTS_FAILED`: the requirements can never be met (unknown
+*   id, 404/410, missing sibling) and the bounded attempts are spent —
+*   terminal, same exits as a crashed tower.
+*/
+var EMBEDDING_MODEL_FAILED = "embedding-model-failed";
+var EMBEDDING_REQUIREMENTS_UNAVAILABLE = "embedding-requirements-unavailable";
+var EMBEDDING_REQUIREMENTS_FAILED = "embedding-requirements-failed";
+var EmbeddingRefusalCodeSchema = zod.z.enum([
+	EMBEDDING_MODEL_FAILED,
+	EMBEDDING_REQUIREMENTS_UNAVAILABLE,
+	EMBEDDING_REQUIREMENTS_FAILED
+]);
+function embeddingRefusalToken(code, on) {
+	return `[${code} model=${on.modelId} tower=${on.tower} node=${on.nodeId}]`;
+}
+/** The encoder's refusal for a crashed tower, carrying {@link EMBEDDING_MODEL_FAILED}. */
+function embeddingModelFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_MODEL_FAILED, row)} ${row.modelId} (${row.tower} tower) crashed ${String(row.crashes)} times in ${String(Math.round(row.windowMs / 1e3))}s on ${row.nodeId} — ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+/** The requirements refusal for THIS request, carrying {@link EMBEDDING_REQUIREMENTS_UNAVAILABLE}. */
+function embeddingRequirementsUnavailableError(on, reason) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_UNAVAILABLE, on)} ${on.modelId} (${on.tower} tower) on ${on.nodeId}: ${reason}`);
+}
+/** The terminal requirements refusal, carrying {@link EMBEDDING_REQUIREMENTS_FAILED}. */
+function embeddingRequirementsFailedError(row) {
+	return /* @__PURE__ */ new Error(`${embeddingRefusalToken(EMBEDDING_REQUIREMENTS_FAILED, row)} ${row.modelId} (${row.tower} tower) on ${row.nodeId}: requirements can never be met — ${String(row.attempts)} attempts, last: ${row.lastReason}. Cleared by embeddingEncoder.resetFailedModels({ modelId: "${row.modelId}", nodeId: "${row.nodeId}" }) or a model change.`);
+}
+var EMBEDDING_REFUSAL_TOKEN = new RegExp(`\\[(${EMBEDDING_MODEL_FAILED}|${EMBEDDING_REQUIREMENTS_UNAVAILABLE}|${EMBEDDING_REQUIREMENTS_FAILED}) model=([^\\s\\]]+) tower=(image|text) node=([^\\s\\]]+)\\]`);
+/** The refusal `err` (possibly re-wrapped by a transport) carries, or `null` for any other error. */
+function embeddingRefusalOf(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	const match = EMBEDDING_REFUSAL_TOKEN.exec(message);
+	if (match === null) return null;
+	const code = EmbeddingRefusalCodeSchema.safeParse(match[1]);
+	const tower = EmbeddingTowerSchema.safeParse(match[3]);
+	if (!code.success || !tower.success || match[2] === void 0 || match[4] === void 0) return null;
+	return {
+		code: code.data,
+		modelId: match[2],
+		tower: tower.data,
+		nodeId: match[4]
+	};
+}
+/** True when `err` is the crashed-tower refusal. */
+function isEmbeddingModelFailed(err) {
+	return embeddingModelFailedOf(err) !== null;
+}
+/** The model, tower and node a crashed-tower refusal names, or `null` for any other error. */
+function embeddingModelFailedOf(err) {
+	const refusal = embeddingRefusalOf(err);
+	if (refusal === null || refusal.code !== "embedding-model-failed") return null;
+	const { modelId, tower, nodeId } = refusal;
+	return {
+		modelId,
+		tower,
+		nodeId
+	};
+}
+/**
+* ONE provider per node (`placement: any-node`), addressed like every global
+* collection: the codegen injects a `{ nodeId?, addonId? }` selector on the
+* void methods and lifts a top-level `nodeId` off the object ones. A call
+* that names no node is answered by the HUB's provider — never by a merge
+* across nodes, because no global collection fans out across nodes (only the
+* providers of one node are `concatCollection`-fanned). So a fleet view of
+* `failedModels` is one `getInfo({ nodeId })` per node, and every answer
+* names the node it came from (D649 round 4); a node that cannot be asked is
+* UNKNOWN to the reader, never "no failures" (D315).
+*/
 var embeddingEncoderCapability = {
 	name: "embedding-encoder",
 	scope: "system",
@@ -13639,8 +13890,30 @@ var embeddingEncoderCapability = {
 			width: zod.z.number(),
 			height: zod.z.number()
 		}), EmbeddingResultSchema, { auth: "admin" }),
-		encodeText: require_sleep.method(zod.z.object({ text: zod.z.string() }), EmbeddingResultSchema, { auth: "admin" }),
-		getInfo: require_sleep.method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
+		/**
+		* `modelId` (a CLIP IMAGE model id, whose catalog `clip.textModelId` names
+		* the text tower) encodes in that model's space; absent, the cluster row's
+		* `clip-embedding` model — the space every writer is in (D649).
+		*/
+		encodeText: require_sleep.method(zod.z.object({
+			text: zod.z.string(),
+			modelId: zod.z.string().min(1).optional()
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		/** Answers for ONE node — the `nodeId` selector's, else the hub's. */
+		getInfo: require_sleep.method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" }),
+		/**
+		* The operator's explicit clear of the `failed` state (one model, or all)
+		* on ONE node — pass `nodeId` for an agent; the result names the node it
+		* cleared. The only way out besides a model change: a crashing tower is
+		* not retried on a timer.
+		*/
+		resetFailedModels: require_sleep.method(zod.z.object({ modelId: zod.z.string().min(1).optional() }), zod.z.object({
+			cleared: zod.z.array(zod.z.string()),
+			nodeId: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -18030,6 +18303,24 @@ var NcMediaFrameSchema = zod.z.enum([
 * sensor linked to one camera ships that camera's plain snapshot either way.
 */
 var NcLinkedCameraModeSchema = zod.z.enum(["mosaic", "each"]);
+/**
+* The clip window a rule gets when it stores no `clipPreRollSec` /
+* `clipPostRollSec` (D654): 4 s before the moment, 6 s after.
+*
+* THE one owner. The Notification Center resolves an absent roll to these at
+* dispatch and sizes the broker's clip ring from them (`clip-retention-ask`).
+* The admin editor does not author the roll; the viewer editor still keeps its
+* own 3 / 7 until it imports these (viewer follow-up). A second copy is how the
+* viewer came to display 3 / 7 — copied from a stale comment on the schema
+* below — while the hub cut 4 / 6, and to prune a typed 3 back to "absent",
+* which the hub then read as 4.
+*
+* A product decision of the notification, not the broker's history window
+* (D381/D382): the clip is cut from the broker's per-camera clip ring, which
+* the rules size, not from a pre-roll dial.
+*/
+var NC_CLIP_PRE_ROLL_DEFAULT_SEC = 4;
+var NC_CLIP_POST_ROLL_DEFAULT_SEC = 6;
 var NcMediaPolicySchema = zod.z.object({
 	attach: zod.z.enum([
 		"best",
@@ -18057,7 +18348,12 @@ var NcMediaPolicySchema = zod.z.object({
 	* the degrade engine, which drops the video and keeps the still.
 	*/
 	clip: zod.z.boolean().optional(),
-	/** Seconds of footage BEFORE / AFTER the event instant. Defaults 3 / 7. */
+	/**
+	* Seconds of footage BEFORE / AFTER the event instant. Absent =
+	* {@link NC_CLIP_PRE_ROLL_DEFAULT_SEC} / {@link NC_CLIP_POST_ROLL_DEFAULT_SEC}
+	* (4 / 6), resolved by the Notification Center at dispatch — deliberately not
+	* a Zod default, so a rule that never chose keeps following the hub's.
+	*/
 	clipPreRollSec: zod.z.number().int().min(0).max(30).optional(),
 	clipPostRollSec: zod.z.number().int().min(0).max(30).optional(),
 	/**
@@ -20211,6 +20507,275 @@ var oauthIntegrationCapability = {
 getDescriptor: require_sleep.method(zod.z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 //#endregion
+//#region src/pipeline/cluster-model-scope.ts
+/**
+* A model choice has a SCOPE, and a scope change has a workflow.
+*
+* ## The two scopes
+*
+* Almost every pipeline step's model is a **node** question: which build runs
+* fastest on THIS accelerator. Two nodes may legitimately answer differently —
+* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
+* are compared against nothing. They produce boxes, and a box is a box.
+*
+* Two steps are not like that. `face-embedding` and `clip-embedding` produce
+* **vectors that land in ONE shared index** (`identity_samples`,
+* `vec_object_clip`) and are ranked against each other by cosine similarity.
+* Cosine similarity between two encoders is not a weak signal, it is a
+* meaningless number — and nothing inside a vector can tell you it happened.
+* So for those two steps the model is a **cluster** question with exactly one
+* answer, stored in exactly one row.
+*
+* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
+* for the crop convention (`detail-crop.ts`), one level up: the crop decides
+* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
+* cluster-wide for the same reason and neither may become per-node.
+*
+* ## Why the registry lives here and not in the step catalog
+*
+* The scope itself is declared on the step, in
+* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
+* — that is where a new step declares what kind of choice its model is. But the
+* catalog lives inside `addon-pipeline`, and three packages that must NOT
+* import an addon need to know the set: the orchestrator (which renders and
+* stores the row), post-analysis (which pins the row for a re-embed pass) and
+* admin-ui (which mirrors it). So the set is mirrored here, and
+* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
+* A hand-copied key that stops matching is exactly how a setting silently stops
+* arriving while both sides still look correct.
+*
+* ## The defaults ARE today's behaviour
+*
+* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
+* of both steps. Declaring the scope therefore changes nothing on the day it
+* ships: the cluster row starts out saying what every node was already doing.
+* Changing it is legitimate — that is what the knob is for — but it invalidates
+* the stored vectors of that surface, and must be followed by a re-embed pass
+* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
+*/
+/**
+* Why the orchestrator cannot say which model the operator chose for a
+* cluster-scoped step (D651).
+*/
+var CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = [
+	"owner-not-ready",
+	"store-read-failed",
+	"three-way-read-unavailable",
+	"invalid-stored",
+	"not-cluster-scoped"
+];
+/**
+* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
+* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
+*/
+var CLUSTER_MODEL_SCOPED_STEPS = [{
+	stepId: "face-embedding",
+	label: "Face recognition model",
+	defaultModelId: "auraface-r100",
+	indexName: "the enrolled face gallery",
+	options: [
+		{
+			id: "auraface-r100",
+			label: "AuraFace R100"
+		},
+		{
+			id: "arcface-r100",
+			label: "ArcFace (ResNet34)"
+		},
+		{
+			id: "inception-resnet-v1",
+			label: "Inception ResNet V1"
+		}
+	]
+}, {
+	stepId: "clip-embedding",
+	label: "Semantic search model",
+	defaultModelId: "mobileclip-s1",
+	indexName: "the object semantic-search index",
+	options: [
+		{
+			id: "mobileclip-s1",
+			label: "MobileCLIP S1"
+		},
+		{
+			id: "mobileclip-s2",
+			label: "MobileCLIP S2"
+		},
+		{
+			id: "siglip2-b16-224",
+			label: "SigLIP2 B/16 (Apache-2.0)"
+		}
+	]
+}];
+/**
+* Store identity of the cluster row inside `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings — the same owner, and for the same reason, as the
+* detail-crop convention: hub-resident and neutral between the addons that
+* read it.
+*/
+var CLUSTER_MODEL_SECTION_ID = "cluster-step-models";
+/**
+* The settings key holding one step's cluster model choice.
+*
+* Step-qualified so the keys stay unique across the addon's whole schema, which
+* is what lets {@link pickClusterStepModels} walk every section instead of
+* trusting the section id.
+*/
+function clusterModelSettingKey(stepId) {
+	return `clusterModel:${stepId}`;
+}
+/** True when this step's model is a cluster-wide choice rather than a per-node one. */
+function isClusterScopedStep(stepId) {
+	return CLUSTER_MODEL_SCOPED_STEPS.some((s) => s.stepId === stepId);
+}
+/** The cluster row when nobody has configured one — today's catalog defaults. */
+var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
+function interpretStoredClusterModel(raw) {
+	if (raw === void 0 || raw === null || raw === "") return { kind: "absent" };
+	if (typeof raw === "string") return {
+		kind: "chosen",
+		modelId: raw
+	};
+	return {
+		kind: "invalid",
+		value: raw
+	};
+}
+/**
+* The cluster-scoped steps whose stored value is `invalid` under
+* {@link interpretStoredClusterModel} — for the runtime's log line, so the
+* default it runs on such a row is never run in silence.
+*/
+function invalidClusterStepModelEntries(config) {
+	const out = [];
+	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
+		const read = interpretStoredClusterModel(config[clusterModelSettingKey(step.stepId)]);
+		if (read.kind === "invalid") out.push({
+			stepId: step.stepId,
+			value: read.value
+		});
+	}
+	return out;
+}
+/**
+* Narrow a FLAT settings record to the cluster row.
+*
+* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
+* junk face model must not also discard a valid clip model. An `absent` or
+* `invalid` value ({@link interpretStoredClusterModel}) resolves to the step's
+* catalog default — never to a blank id, because a blank id downstream becomes
+* "substitute the format default", which is precisely the substitution this
+* scope exists to forbid.
+*/
+function readClusterStepModels(config) {
+	const out = {};
+	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
+		const read = interpretStoredClusterModel(config[clusterModelSettingKey(step.stepId)]);
+		out[step.stepId] = read.kind === "chosen" ? read.modelId : step.defaultModelId;
+	}
+	return out;
+}
+function isHydratedField$2(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+/**
+* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) is the defaults.
+*/
+function pickClusterStepModels(view) {
+	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
+	return readClusterStepModels(flattenHydratedView(view, clusterModelKeys()));
+}
+/**
+* The `invalid` stored cluster model values a hydrated view carries — what the
+* runtime logs when it runs a default on a row it could not read as a choice.
+* A `null` view (owner mid-boot) carries nothing to judge.
+*/
+function pickInvalidClusterStepModels(view) {
+	if (view === null) return [];
+	return invalidClusterStepModelEntries(flattenHydratedView(view, clusterModelKeys()));
+}
+function clusterModelKeys() {
+	return new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
+}
+/** The `wanted` keys of a hydrated view as one flat record, every section walked. */
+function flattenHydratedView(view, wanted) {
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
+		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
+	}
+	return flat;
+}
+/**
+* The cluster model for `stepId`, or `null` when the step is node-scoped.
+*
+* `null` is the signal to LEAVE THE CALLER'S RESOLUTION ALONE — it is not "no
+* model". Returning a default here for a node-scoped step would quietly
+* override every per-(node,device) selection in the fleet.
+*/
+function resolveClusterStepModelId(stepId, models) {
+	const step = CLUSTER_MODEL_SCOPED_STEPS.find((s) => s.stepId === stepId);
+	if (step === void 0) return null;
+	const chosen = models[stepId];
+	return chosen !== void 0 && chosen !== "" ? chosen : step.defaultModelId;
+}
+/** Must match `DEFAULT_LANDMARK_PRECISION_FLOOR_PX` in the runner. */
+var DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = 24;
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+function clusterStepSettingFieldsFor(stepId) {
+	return CLUSTER_STEP_SETTING_FIELDS.filter((field) => field.stepId === stepId);
+}
+var ClusterSettingNumberSchema = zod.z.number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+var DEFAULT_CLUSTER_STEP_SETTINGS = readClusterStepSettings({});
+function pickClusterStepSettings(view) {
+	if (view === null) return DEFAULT_CLUSTER_STEP_SETTINGS;
+	return readClusterStepSettings(flattenHydratedView(view, new Set(CLUSTER_STEP_SETTING_FIELDS.map((field) => clusterStepSettingKey(field.stepId, field.key)))));
+}
+/**
+* Cluster knobs win over leftover per-device values. The cluster row is the
+* authority; a device-local copy is a leftover of the old per-node editor.
+*/
+function overlayClusterStepSettings(stepId, deviceSettings, cluster) {
+	const overlay = cluster[stepId];
+	if (overlay === void 0 || Object.keys(overlay).length === 0) return deviceSettings === void 0 ? void 0 : { ...deviceSettings };
+	if (deviceSettings === void 0) return { ...overlay };
+	return {
+		...deviceSettings,
+		...overlay
+	};
+}
+//#endregion
 //#region src/capabilities/pipeline-analytics.cap.ts
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
@@ -21063,7 +21628,8 @@ var MediaFileKindEnum = zod.z.enum([
 	"thumbnailSmall",
 	"confirmationCrop",
 	"debugCrop",
-	"sceneFrame"
+	"sceneFrame",
+	"lastSceneFrame"
 ]);
 /**
 * One media row's IDENTITY and shape, with no representation of its bytes.
@@ -21652,7 +22218,23 @@ var SearchObjectEventsInput = zod.z.object({
 	until: zod.z.number().optional(),
 	classFilter: zod.z.string().optional(),
 	limit: zod.z.number().default(50),
-	minScore: zod.z.number().min(0).max(1).default(.2)
+	/**
+	* An ABSOLUTE cosine floor. Optional since D649: a floor is a property of the
+	* model (0.2 kept 96% of matched pairs on MobileCLIP S1 and 2.7% on SigLIP2),
+	* so an absent one resolves to the searched model's own `searchMinScore`
+	* scaled by `strictness`. A number sent here is honoured verbatim.
+	*/
+	minScore: zod.z.number().min(0).max(1).optional(),
+	/** Model-relative floor — see `resolveClipSearchMinScore`. Default `loose`. */
+	strictness: ClipSearchStrictnessSchema.optional(),
+	/**
+	* Search THIS CLIP model's index instead of the cluster row's. Every index a
+	* model ever wrote stays searchable until it is wiped (the MobileCLIP index
+	* through a SigLIP2 cutover and its rollback window). An id with no CLIP
+	* metadata is refused; an id other than the cluster row's is ADMIN-only
+	* (`model-override-requires-admin`).
+	*/
+	modelId: zod.z.string().min(1).optional()
 });
 var TrackCascadeCountsSchema = zod.z.object({
 	/** Persisted track roots deleted (authoritative). */
@@ -21787,7 +22369,41 @@ var RebuildObjectEmbeddingsInput = zod.z.object({
 * comparable, so wiping and rebuilding is the only way to be sure every vector
 * means the same thing.
 */
-var WipeObjectEmbeddingsResultSchema = zod.z.object({ deleted: zod.z.number() });
+var WipeObjectEmbeddingsResultSchema = zod.z.object({
+	deleted: zod.z.number(),
+	/**
+	* CLIP indexes that could NOT be emptied (unreachable, or refused at their
+	* dimension) — not a clean slate. Additive and optional (D649).
+	*/
+	failedIndexes: zod.z.array(zod.z.string()).optional()
+});
+/**
+* Why a rebuild did not start, BY NAME — ONE vocabulary for both gates in front
+* of a pass (D649 over D651). A bare `started: false` read the same for "the
+* stores are booting" and "the cluster row names a model with no CLIP
+* metadata", which need different fixes.
+*  - `stores-unavailable` — the analytics stores or the API are not up yet.
+*  - the owner's confirmation of the cluster model (D651, `ClusterPinConfirmer`):
+*    a pass that rewrites an index needs two agreeing reads of the OWNER's
+*    answer (`pipelineOrchestrator.getClusterModelChoice`) — a pass that cannot
+*    name its model does not run (D54):
+*    - the owner's own `unreadable` reasons (`owner-not-ready`,
+*      `store-read-failed`, `three-way-read-unavailable`, `invalid-stored`,
+*      `not-cluster-scoped`);
+*    - `method-unavailable` — the orchestrator predates the method;
+*    - `read-failed` — the call failed or answered something unparseable;
+*    - `reads-disagree` — the two reads named different choices.
+*  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
+*    index to fill and no dimension to check against (D649).
+*/
+var RebuildObjectEmbeddingsRefusalSchema = zod.z.enum([
+	"stores-unavailable",
+	...CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS,
+	"method-unavailable",
+	"read-failed",
+	"reads-disagree",
+	"not-a-clip-model"
+]);
 /**
 * Acknowledgement that a rebuild STARTED.
 *
@@ -21800,7 +22416,12 @@ var WipeObjectEmbeddingsResultSchema = zod.z.object({ deleted: zod.z.number() })
 var RebuildObjectEmbeddingsResultSchema = zod.z.object({
 	started: zod.z.boolean(),
 	/** True when a pass was already running; the new request is ignored. */
-	alreadyRunning: zod.z.boolean()
+	alreadyRunning: zod.z.boolean(),
+	/** Present when the pass refused to start — see `RebuildObjectEmbeddingsRefusalSchema`. */
+	refusal: RebuildObjectEmbeddingsRefusalSchema.optional(),
+	/** The CLIP model the pass pinned, and the index it fills (when it started). */
+	modelId: zod.z.string().optional(),
+	index: zod.z.string().optional()
 });
 var RebuildStatusSchema = zod.z.object({
 	running: zod.z.boolean(),
@@ -21834,7 +22455,11 @@ var RebuildStatusSchema = zod.z.object({
 	startedAtMs: zod.z.number().nullable(),
 	finishedAtMs: zod.z.number().nullable(),
 	/** Present when the pass ended by throwing. */
-	error: zod.z.string().nullable()
+	error: zod.z.string().nullable(),
+	/** The CLIP model the current / last pass pinned (D54), `null` before any. */
+	modelId: zod.z.string().nullable(),
+	/** The index that pass fills — `ClipModelMeta.vectorIndex` of `modelId` (D649). */
+	index: zod.z.string().nullable()
 });
 /**
 * Acknowledgement that a debug-media reclaim STARTED.
@@ -22812,7 +23437,7 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly()),
+		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly(), { caller: "required" }),
 		wipeObjectEmbeddings: require_sleep.method(zod.z.object({}), WipeObjectEmbeddingsResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -24115,6 +24740,17 @@ var RunnerFrameSourceSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ k
 	hubHostnameOverride: zod.z.string().optional()
 })]).describe("Per-camera frame-source mode for the runner (P2c)");
 /**
+* What ONE step runs with on ONE roster device for THIS camera (D650): the
+* device's per-(node,device) base with the camera's override for that device
+* on top — the same `override ?? base` merge the orchestrator applies to the
+* elected device (`applyDeviceProvisioning`). Absent `modelId` ⇒ the executor
+* resolves the device format's default, exactly as on the elected device.
+*/
+var RunnerJumpStepProvisioningSchema = zod.z.object({
+	modelId: zod.z.string().optional(),
+	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/**
 * One ENABLED inference device on the runner's node, as the step-tree
 * device-jump resolver sees it (phase 1). The orchestrator populates this
 * roster on the attach payload whenever the camera is elected onto a specific
@@ -24126,7 +24762,16 @@ var RunnerFrameSourceSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ k
 var RunnerInferenceDeviceSchema = zod.z.object({
 	deviceKey: zod.z.string(),
 	weight: zod.z.number().positive().default(1),
-	maxSessions: zod.z.number().int().positive().nullable().default(null)
+	maxSessions: zod.z.number().int().positive().nullable().default(null),
+	/**
+	* Per-step provisioning for this camera on THIS device (D650), keyed by step
+	* id. A step the runner jumps here runs with these fields, never with the
+	* elected device's: `modelId` / `settings` are REPLACED on the jumped subtree
+	* (a step absent from the map runs with neither — the target format default).
+	* Absent field ⇒ an orchestrator that predates D650: the jumped step keeps
+	* the elected device's provisioning, as before.
+	*/
+	steps: zod.z.record(zod.z.string(), RunnerJumpStepProvisioningSchema).optional()
 });
 /**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
@@ -25438,6 +26083,28 @@ var NodeInferenceDeviceSchema = zod.z.object({
 	*/
 	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
+/**
+* The operator's model choice for one cluster-scoped step, answered by the
+* addon that OWNS the `clusterModel:*` settings (D651). Three answers, never
+* folded: a written choice, a key nobody wrote (the cluster runs the default
+* BY ABSENCE), or no answer. A caller that rewrites an index acts only on the
+* first two, read twice and agreeing.
+*/
+var ClusterModelChoiceSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("stored"),
+		modelId: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("absent"),
+		defaultModelId: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("unreadable"),
+		reason: zod.z.enum(CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS),
+		error: zod.z.string().optional()
+	})
+]);
 var NodeInferenceDevicesSchema = zod.z.object({
 	nodeId: zod.z.string(),
 	/** False when the node's platform-probe was unreachable (no live device set). */
@@ -25534,9 +26201,19 @@ var pipelineOrchestratorCapability = {
 		* Trigger a full rebalance pass. Iterates over all assigned cameras,
 		* recomputes the optimal agent for each one based on current load +
 		* hardware affinity, and migrates cameras whose current agent is no
-		* longer optimal. Pinned cameras are never migrated.
+		* longer optimal. Pinned cameras are never migrated. `skipped` names the
+		* cameras the pass wanted to move and could not, with why — a target node
+		* that has not answered its catalog / device health yet, or a device that
+		* cannot run the camera's root (D650).
 		*/
-		rebalance: require_sleep.method(zod.z.void(), zod.z.object({ migrated: zod.z.number() }), {
+		rebalance: require_sleep.method(zod.z.void(), zod.z.object({
+			migrated: zod.z.number(),
+			skipped: zod.z.array(zod.z.object({
+				deviceId: zod.z.number(),
+				targetNodeId: zod.z.string(),
+				reason: zod.z.string()
+			})).default([])
+		}), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -25546,6 +26223,13 @@ var pipelineOrchestratorCapability = {
 		getPipelineAssignment: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), PipelineAssignmentSchema.nullable()),
 		/** Get per-agent load summaries used by the load balancer + dashboards. */
 		getAgentLoad: require_sleep.method(zod.z.void(), zod.z.array(AgentLoadSummarySchema).readonly()),
+		/**
+		* The operator's STORED model choice for one cluster-scoped step (D651).
+		* Read three-way from this addon's own store, only once its boot has
+		* settled. Unlike `addonSettings.getGlobalSettings`, it never answers a
+		* default as though someone chose it.
+		*/
+		getClusterModelChoice: require_sleep.method(zod.z.object({ stepId: zod.z.string() }), ClusterModelChoiceSchema),
 		/** Aggregate global metrics across the whole detection cluster. */
 		getGlobalMetrics: require_sleep.method(zod.z.void(), GlobalMetricsSchema),
 		/**
@@ -28074,6 +28758,24 @@ var VectorScanResultSchema = zod.z.object({
 	*/
 	nextCursor: zod.z.number().int().nonnegative().nullable()
 });
+/**
+* The ONE error code for "this index exists at another dimension; refusing to
+* redeclare it" (D649). It rides in the MESSAGE — an Error's own properties do
+* not survive the UDS/tRPC hop, its message does — and both sides go through
+* the helpers below, never a copied phrase: a consumer that must tell "this
+* index can never hold my vectors" from "the provider is unreachable" (a
+* delete counts the first as nothing-to-delete and the second as still
+* present) otherwise breaks silently the day the wording changes.
+*/
+var VECTOR_INDEX_DIM_CONFLICT = "vector-index-dim-conflict";
+/** The provider's refusal, carrying {@link VECTOR_INDEX_DIM_CONFLICT}. */
+function vectorIndexDimConflictError(index, declaredDim, requestedDim) {
+	return /* @__PURE__ */ new Error(`[${VECTOR_INDEX_DIM_CONFLICT}] vector-store: index "${index}" is declared with dim ${String(declaredDim)}; refusing to redeclare as ${String(requestedDim)}`);
+}
+/** True when `err` (possibly re-wrapped by a transport) is that refusal. */
+function isVectorIndexDimConflict(err) {
+	return (err instanceof Error ? err.message : String(err)).includes(`[${VECTOR_INDEX_DIM_CONFLICT}]`);
+}
 var VectorStatsInputSchema = zod.z.object({ index: zod.z.string() });
 var VectorStatsResultSchema = zod.z.object({
 	/** Provider id, so an operator can tell brute force from an ANN index. */
@@ -29254,6 +29956,487 @@ var CLIP_PLAYBACK_OPTIONS = {
 	}
 };
 //#endregion
+//#region src/catalogs/sensor-active-state.ts
+/**
+* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
+* valutatore puro del suo FRONTE.
+*
+* Viveva dentro il builtin virtual-doorbell
+* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
+* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
+* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
+* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
+* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
+* SPOSTA qui e il doorbell la ri-esporta.
+*
+* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
+* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
+* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
+* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+*/
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
+/**
+* The same caps → the slice field carrying the ms-epoch timestamp of the
+* last transition. Every source cap MUST appear here (guarded by a spec):
+* without a transition timestamp the evaluator cannot tell a genuine rise
+* from a boot-time hydration when the FIRST slice it ever sees is already
+* active, and errs towards silence — swallowing the rise.
+*
+* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
+* provider derives them from `state.last_changed`, so they survive our own
+* restarts and correctly read as "hours ago" for a state that has been
+* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
+*/
+var SOURCE_CAP_CHANGED_AT_FIELD = {
+	contact: "lastChangedAt",
+	binary: "lastChangedAt",
+	switch: "lastChangedAt",
+	motion: "lastDetectedAt",
+	flood: "lastChangedAt",
+	gas: "lastChangedAt",
+	smoke: "lastChangedAt",
+	"carbon-monoxide": "lastChangedAt",
+	vibration: "lastChangedAt",
+	tamper: "lastChangedAt"
+};
+/** Cap names whose presence in a device's bindings qualify it as a source. */
+var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
+/**
+* Device `type` values (from `DeviceType`) that can host a binary/switch
+* source cap. Used by the camera's `device-multiselect` picker as the
+* CLIENT-SIDE filter, alongside `SOURCE_CAPS`.
+*
+* Why types and not caps alone: the shared picker filters
+* `deviceManager.listAll` rows client-side, and those rows carry only the
+* device's advertised `features` — NOT its registered cap list. On the live
+* cluster binary sensors and switches advertise EMPTY features (features
+* mirror only a handful of caps like `motion-trigger`), so a caps-only
+* filter matched against `features` would list nothing (the very bug this
+* replaced, which relied on the now-empty `getAllBindings`). Matching by
+* `type` is the reliable client-side signal; the union with `SOURCE_CAPS`
+* still captures any device that DOES advertise a source-cap feature.
+* `sensor` covers contact/motion/flood/gas/smoke/CO/vibration/tamper,
+* `switch` covers switches, `control` covers generic binary actuators.
+*/
+var SOURCE_DEVICE_TYPES = [
+	"sensor",
+	"switch",
+	"control"
+];
+/** True when a cap is a recognised binary/switch source. */
+function isSourceCap(capName) {
+	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
+}
+/** Extract the "active" boolean a source cap's slice carries, or null when
+*  the cap is unknown or the field is missing / non-boolean. */
+function sliceActiveValue(capName, slice) {
+	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	return typeof raw === "boolean" ? raw : null;
+}
+/** Ms-epoch transition timestamp a source cap's slice carries, or null when
+*  it is absent, non-numeric or the zero "never observed" sentinel. */
+function sliceChangedAt(capName, slice) {
+	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
+	if (field === void 0) return null;
+	const raw = slice[field];
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
+	return raw;
+}
+/**
+* How recent a source's own transition timestamp must be for a FIRST
+* sighting that is already active to count as a genuine rise rather than a
+* hydration of long-standing state.
+*/
+var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
+/**
+* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
+* porta `prior`, `nowMs` e il proprio `startedAtMs`.
+*
+* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
+* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
+* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
+* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
+* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
+* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
+* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
+* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
+*/
+function evaluateSensorEdge(input) {
+	const value = sliceActiveValue(input.capName, input.slice);
+	if (value === null) return {
+		edge: "none",
+		value: null,
+		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
+	};
+	if (input.prior === void 0) {
+		if (!value) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-inactive"
+		};
+		const changedAt = sliceChangedAt(input.capName, input.slice);
+		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
+		if (changedAt === null || changedAt < floor) return {
+			edge: "none",
+			value,
+			reason: "baseline-seeded-stale-active"
+		};
+		return {
+			edge: "rising",
+			value: true
+		};
+	}
+	if (input.prior === value) return {
+		edge: "none",
+		value,
+		reason: "no-change"
+	};
+	if (!value) return {
+		edge: "none",
+		value,
+		reason: "falling-edge"
+	};
+	return {
+		edge: "rising",
+		value: true
+	};
+}
+//#endregion
+//#region src/capabilities/doorbell.cap.ts
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = zod.z.object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: zod.z.number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: zod.z.number()
+});
+var DoorbellPressEventSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	timestamp: zod.z.number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = zod.z.object({ deviceIds: zod.z.array(zod.z.number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [require_sleep.DeviceType.Camera],
+	sourceCaps: SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [require_sleep.DeviceType.Button, require_sleep.DeviceType.Camera],
+	exposesDeviceSettings: true,
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+//#endregion
+//#region src/generated/extension-slots.ts
+/**
+* AUTO-GENERATED by scripts/generate-extension-slots.ts — DO NOT EDIT.
+*
+* Every extension slot declared by a capability (`extensionSlots` in its
+* `*.cap.ts`, D648), folded into one typed table. Imports ONLY the declaring
+* caps' descriptors and value schemas — never the caps barrel — so
+* `device-extension.cap.ts` can import this module without a cycle.
+*
+* Coverage: 2 slot(s).
+*/
+/** Every declared slot id, in table order. */
+var EXTENSION_SLOT_IDS = ["doorbell-source", "linked-devices"];
+var ExtensionSlotIdSchema = zod.z.enum(EXTENSION_SLOT_IDS);
+var EXTENSION_SLOTS = {
+	"doorbell-source": {
+		descriptor: DOORBELL_SOURCE_SLOT,
+		declaringCap: "doorbell",
+		hostDeviceTypes: [require_sleep.DeviceType.Camera]
+	},
+	"linked-devices": {
+		descriptor: LINKED_DEVICES_SLOT,
+		declaringCap: "device-manager",
+		hostDeviceTypes: [require_sleep.DeviceType.Camera]
+	}
+};
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = zod.z.discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: zod.z.literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: zod.z.literal("linked-devices") })]);
+/** Every device type at least one slot is offered on — `device-extension`'s `deviceTypes`. */
+var EXTENSION_HOST_DEVICE_TYPES = [require_sleep.DeviceType.Camera];
+//#endregion
+//#region src/capabilities/device-extension.cap.ts
+/**
+* `device-extension` — ONE place to see and author what a device is extended
+* with by OTHER devices (D648).
+*
+* **A contract, not a store.** Every slot (`linked-devices`,
+* `doorbell-source`, later `consumables-graft`) is declared by the cap that
+* owns the function (`extensionSlots` in its `*.cap.ts`, D4) and SERVED by the
+* addon that already owns its store, over that store and its existing write
+* path. This cap persists nothing and has no config method (guarded by
+* `scripts/check-extension-slots.ts`): D62 applied to the whole feature, and
+* D3 — no shadow registry.
+*
+* **Shape.** A device-scoped wrapper COLLECTION, the D554 shape `videoclips`
+* uses: `resolveCapMount` gives it the `device-scoped` mount and
+* `requireDeviceCollection` dispatches it. Its providers are the slot owners
+* (device-manager, virtual-doorbell, …), and a device's sources are its
+* bindings (step 0 of `getBindings`, derived, persisted nowhere).
+*
+*  - `listSources` — one row per provider, the D554 source-listing convention
+*    that lets a scalar call be routed by the prefix of its `slotRef`.
+*  - `listSlots` — fan-out, concatenated. A provider that throws becomes ONE
+*    `unreachable` row naming it, never an absence (D554.4, D315): "no
+*    extensions" is claimed only from an answer.
+*  - `listCandidates` / `setSlot` — scalar, routed by `slotRef`
+*    (`<source>:<slotId>`). An unclaimed ref is refused by name (D554.5).
+*
+* The slot's value travels as the generated discriminated union
+* (`ExtensionSlotValue`, keyed on `slot`), so a value under the wrong slot is
+* a schema error before it reaches any owner.
+*/
+/** Separator between the source and the slot id in a `slotRef`. It is the
+*  D554 routing separator: the dispatcher matches `<source>:` prefixes. */
+var EXTENSION_SLOT_REF_SEPARATOR = ":";
+/** The contract method whose failure BECOMES a row, like `listSources`'s. */
+var EXTENSION_SLOT_LISTING_METHOD = "listSlots";
+var ExtensionSourceAvailabilitySchema = zod.z.discriminatedUnion("state", [zod.z.object({ state: zod.z.literal("ok") }), zod.z.object({
+	state: zod.z.literal("unreachable"),
+	reason: zod.z.string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = zod.z.object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: zod.z.string(),
+	label: zod.z.string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: zod.z.string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = zod.z.enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: zod.z.string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: zod.z.string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = zod.z.object({
+	state: zod.z.enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: zod.z.string(),
+	detail: zod.z.string().optional()
+});
+/** One slot of one device, as its owner reads it from its own store. */
+var ExtensionSlotStateSchema = zod.z.object({
+	state: zod.z.literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: zod.z.string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: zod.z.string(),
+	/** graft: its switch. association: null — removing every source is "off". */
+	enabled: zod.z.boolean().nullable(),
+	/** graft: the cap registered on the host. association: null. */
+	projects: zod.z.string().nullable(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: zod.z.array(ExtensionSlotSourceSchema)
+});
+/**
+* A provider that could not answer `listSlots` at all. It could not name its
+* own slots, so the row names the ADDON and carries the refusal verbatim.
+* Written by the dispatcher, never by a provider.
+*/
+var ExtensionSlotUnreachableSchema = zod.z.object({
+	state: zod.z.literal("unreachable"),
+	addonId: zod.z.string(),
+	reason: zod.z.string()
+});
+var ExtensionSlotRowSchema = zod.z.discriminatedUnion("state", [ExtensionSlotStateSchema, ExtensionSlotUnreachableSchema]);
+/** The row the dispatcher writes for a provider whose `listSlots` threw. */
+function unreachableExtensionSlotRow(addonId, reason) {
+	return {
+		state: "unreachable",
+		addonId,
+		reason
+	};
+}
+/** One device the slot's editor may offer as a source. */
+var ExtensionCandidateSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	name: zod.z.string(),
+	type: zod.z.string(),
+	location: zod.z.string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: zod.z.string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: zod.z.boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: zod.z.string().nullable()
+});
+var ExtensionCandidatesSchema = zod.z.object({ candidates: zod.z.array(ExtensionCandidateSchema) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+*/
+var ExtensionSetResultSchema = zod.z.object({
+	applied: zod.z.literal(true),
+	reload: zod.z.enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	slotRef: zod.z.string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+var deviceExtensionCapability = {
+	name: "device-extension",
+	scope: "device",
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: EXTENSION_HOST_DEVICE_TYPES,
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/extensions-panel",
+		tab: "general",
+		label: "Extensions",
+		order: 72
+	} },
+	methods: {
+		/** One row per slot owner — the D554 source listing `slotRef` routes by. */
+		listSources: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.array(ExtensionSourceSchema)),
+		/**
+		* Every slot this device is offered, read by each owner from its own
+		* store. A provider that throws is ONE `unreachable` row (D554.4).
+		*/
+		listSlots: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.array(ExtensionSlotRowSchema)),
+		/** The devices the slot's editor may offer, suggestions pre-marked (D356). */
+		listCandidates: require_sleep.method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema),
+		/**
+		* Write one slot through its owner's EXISTING write path. The owner
+		* validates (a container is never a linked device, a camera is never its
+		* own source) and refuses by name before persisting.
+		*/
+		setSlot: require_sleep.method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/webrtc-session.cap.ts
 /**
 * Optional client-side hints sent at session creation to help the provider
@@ -32289,77 +33472,6 @@ onStatusChanged: { data: zod.z.object({
 	volatileStateFields: ["lastChangedAt"]
 };
 //#endregion
-//#region src/capabilities/doorbell.cap.ts
-/**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = zod.z.object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: zod.z.number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: zod.z.number()
-});
-var DoorbellPressEventSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	timestamp: zod.z.number()
-});
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [require_sleep.DeviceType.Button, require_sleep.DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: { data: DoorbellPressEventSchema } },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-//#endregion
 //#region src/capabilities/enum-sensor.cap.ts
 /**
 * Enum-state sensor — a string value picked from a finite option set.
@@ -43396,6 +44508,90 @@ var PIPELINE_OWNER_CAPABILITY_NAMES = [
 	"pipeline-runner"
 ];
 //#endregion
+//#region src/device-extension/slot-provider.ts
+function isValueOf(slot, value) {
+	return value.slot === slot;
+}
+/** Bind slot `slot` to its owner's functions. See the module docblock. */
+function defineExtensionSlotProvider(slot, impl) {
+	return {
+		slot,
+		list: async (deviceId) => {
+			const listing = await impl.list(deviceId);
+			if (listing === null) return null;
+			const value = listing.value;
+			return {
+				...listing,
+				value
+			};
+		},
+		set: async (deviceId, value) => {
+			if (!isValueOf(slot, value)) throw new Error(`device-extension: a "${value.slot}" value was sent to slot "${slot}" — refused`);
+			return await impl.set(deviceId, value);
+		},
+		candidates: (deviceId) => impl.candidates(deviceId)
+	};
+}
+/** `<source>:<slotId>`. */
+function extensionSlotRef(source, slot) {
+	return `${source}:${slot}`;
+}
+/** Build the `device-extension` provider one owner registers. */
+function createDeviceExtensionProvider(options) {
+	const { source, label, slots, hostTypeOf, logger } = options;
+	const offered = (slot, hostType) => hostType !== null && EXTENSION_SLOTS[slot].hostDeviceTypes.some((t) => t === hostType);
+	const resolve = async (deviceId, slotRef) => {
+		const prefix = `${source}:`;
+		const slot = slotRef.startsWith(prefix) ? slots.find((s) => s.slot === slotRef.slice(prefix.length)) : void 0;
+		if (slot === void 0) throw new Error(`device-extension: "${slotRef}" is not a slot of "${source}" — it serves ${slots.map((s) => extensionSlotRef(source, s.slot)).join(", ") || "(none)"}`);
+		const hostType = await hostTypeOf(deviceId);
+		if (!offered(slot.slot, hostType)) throw new Error(`device-extension: slot "${slot.slot}" is not offered on device ${deviceId} (type ${hostType ?? "unknown"}; offered on ${EXTENSION_SLOTS[slot.slot].hostDeviceTypes.join(", ")})`);
+		return slot;
+	};
+	return {
+		listSources: async () => [{
+			source,
+			label,
+			availability: { state: "ok" }
+		}],
+		listSlots: async (input) => {
+			const hostType = await hostTypeOf(input.deviceId);
+			const rows = [];
+			for (const slot of slots) {
+				if (!offered(slot.slot, hostType)) continue;
+				const listing = await slot.list(input.deviceId);
+				if (listing === null) continue;
+				rows.push({
+					state: "ok",
+					slotRef: extensionSlotRef(source, slot.slot),
+					slot: slot.slot,
+					authority: listing.authority,
+					enabled: listing.enabled,
+					projects: EXTENSION_SLOTS[slot.slot].descriptor.projects ?? null,
+					activation: listing.activation,
+					value: listing.value,
+					sources: [...listing.sources]
+				});
+			}
+			return rows;
+		},
+		listCandidates: async (input) => {
+			return { candidates: [...await (await resolve(input.deviceId, input.slotRef)).candidates(input.deviceId)] };
+		},
+		setSlot: async (input) => {
+			const result = await (await resolve(input.deviceId, input.slotRef)).set(input.deviceId, input.value);
+			logger.info("device-extension: slot written", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					slotRef: input.slotRef,
+					reload: result.reload
+				}
+			});
+			return result;
+		}
+	};
+}
+//#endregion
 //#region src/catalogs/device-state-vocabulary.ts
 /**
 * Most specific first. Extending this list is how a new device kind becomes
@@ -43467,172 +44663,6 @@ function stateVocabularyFor(runtimeState, alarmStates = []) {
 	return [];
 }
 //#endregion
-//#region src/catalogs/sensor-active-state.ts
-/**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
-*
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
-*
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-/**
-* The same caps → the slice field carrying the ms-epoch timestamp of the
-* last transition. Every source cap MUST appear here (guarded by a spec):
-* without a transition timestamp the evaluator cannot tell a genuine rise
-* from a boot-time hydration when the FIRST slice it ever sees is already
-* active, and errs towards silence — swallowing the rise.
-*
-* These timestamps are UPSTREAM ones, not ingest ones: the Home Assistant
-* provider derives them from `state.last_changed`, so they survive our own
-* restarts and correctly read as "hours ago" for a state that has been
-* active for hours. `motion` names its rise timestamp `lastDetectedAt`.
-*/
-var SOURCE_CAP_CHANGED_AT_FIELD = {
-	contact: "lastChangedAt",
-	binary: "lastChangedAt",
-	switch: "lastChangedAt",
-	motion: "lastDetectedAt",
-	flood: "lastChangedAt",
-	gas: "lastChangedAt",
-	smoke: "lastChangedAt",
-	"carbon-monoxide": "lastChangedAt",
-	vibration: "lastChangedAt",
-	tamper: "lastChangedAt"
-};
-/** Cap names whose presence in a device's bindings qualify it as a source. */
-var SOURCE_CAPS = Object.keys(SOURCE_CAP_ACTIVE_FIELD);
-/**
-* Device `type` values (from `DeviceType`) that can host a binary/switch
-* source cap. Used by the camera's `device-multiselect` picker as the
-* CLIENT-SIDE filter, alongside `SOURCE_CAPS`.
-*
-* Why types and not caps alone: the shared picker filters
-* `deviceManager.listAll` rows client-side, and those rows carry only the
-* device's advertised `features` — NOT its registered cap list. On the live
-* cluster binary sensors and switches advertise EMPTY features (features
-* mirror only a handful of caps like `motion-trigger`), so a caps-only
-* filter matched against `features` would list nothing (the very bug this
-* replaced, which relied on the now-empty `getAllBindings`). Matching by
-* `type` is the reliable client-side signal; the union with `SOURCE_CAPS`
-* still captures any device that DOES advertise a source-cap feature.
-* `sensor` covers contact/motion/flood/gas/smoke/CO/vibration/tamper,
-* `switch` covers switches, `control` covers generic binary actuators.
-*/
-var SOURCE_DEVICE_TYPES = [
-	"sensor",
-	"switch",
-	"control"
-];
-/** True when a cap is a recognised binary/switch source. */
-function isSourceCap(capName) {
-	return Object.prototype.hasOwnProperty.call(SOURCE_CAP_ACTIVE_FIELD, capName);
-}
-/** Extract the "active" boolean a source cap's slice carries, or null when
-*  the cap is unknown or the field is missing / non-boolean. */
-function sliceActiveValue(capName, slice) {
-	const field = SOURCE_CAP_ACTIVE_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	return typeof raw === "boolean" ? raw : null;
-}
-/** Ms-epoch transition timestamp a source cap's slice carries, or null when
-*  it is absent, non-numeric or the zero "never observed" sentinel. */
-function sliceChangedAt(capName, slice) {
-	const field = SOURCE_CAP_CHANGED_AT_FIELD[capName];
-	if (field === void 0) return null;
-	const raw = slice[field];
-	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return null;
-	return raw;
-}
-/**
-* How recent a source's own transition timestamp must be for a FIRST
-* sighting that is already active to count as a genuine rise rather than a
-* hydration of long-standing state.
-*/
-var DEFAULT_FIRST_SIGHTING_FRESHNESS_MS = 3e4;
-/**
-* IL fronte. Puro: nessun orologio proprio, nessuna memoria — il chiamante
-* porta `prior`, `nowMs` e il proprio `startedAtMs`.
-*
-* Il caso della PRIMA slice già attiva è trattato esplicitamente e vale come
-* fronte solo se il timestamp UPSTREAM della transizione è posteriore a
-* `startedAtMs` **e** entro `firstSightingFreshnessMs`. Entrambe le metà
-* servono: la sola freschezza scatterebbe su un'idratazione al boot di uno
-* stato flippato pochi secondi prima del riavvio, e il solo "dopo che abbiamo
-* iniziato" scatterebbe, su un processo di lunga vita, per una sorgente
-* adottata oggi il cui stato è cambiato ieri. Il caso ambiguo ERRA VERSO IL
-* SILENZIO e lo dichiara (`baseline-seeded-stale-active`).
-*/
-function evaluateSensorEdge(input) {
-	const value = sliceActiveValue(input.capName, input.slice);
-	if (value === null) return {
-		edge: "none",
-		value: null,
-		reason: isSourceCap(input.capName) ? "non-boolean-value" : "unknown-cap"
-	};
-	if (input.prior === void 0) {
-		if (!value) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-inactive"
-		};
-		const changedAt = sliceChangedAt(input.capName, input.slice);
-		const floor = Math.max(input.startedAtMs, input.nowMs - input.firstSightingFreshnessMs);
-		if (changedAt === null || changedAt < floor) return {
-			edge: "none",
-			value,
-			reason: "baseline-seeded-stale-active"
-		};
-		return {
-			edge: "rising",
-			value: true
-		};
-	}
-	if (input.prior === value) return {
-		edge: "none",
-		value,
-		reason: "no-change"
-	};
-	if (!value) return {
-		edge: "none",
-		value,
-		reason: "falling-edge"
-	};
-	return {
-		edge: "rising",
-		value: true
-	};
-}
-//#endregion
 //#region src/constants.ts
 var HF_REPO = "camstack/camstack-models";
 var HF_BASE_URL = `https://huggingface.co/${HF_REPO}/resolve/main`;
@@ -48678,6 +49708,7 @@ var CAPABILITY_NAMES = {
 	deviceAdoption: "device-adoption",
 	deviceDiscovery: "device-discovery",
 	deviceExport: "device-export",
+	deviceExtension: "device-extension",
 	deviceManager: "device-manager",
 	deviceOps: "device-ops",
 	deviceProvider: "device-provider",
@@ -48985,6 +50016,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "deviceExport",
 		name: "device-export"
 	},
+	{
+		key: "deviceExtension",
+		name: "device-extension"
+	},
 	{
 		key: "deviceManager",
 		name: "device-manager"
@@ -49492,6 +50527,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	deviceAdoptionCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
+	deviceExtensionCapability,
 	deviceManagerCapability,
 	require_sleep.deviceOpsCapability,
 	deviceProviderCapability,
@@ -51042,6 +52078,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceExtension.listCandidates": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSlots": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.listSources": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"deviceExtension.setSlot": {
+		capName: "device-extension",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -51792,6 +52852,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"embeddingEncoder.resetFailedModels": {
+		capName: "embedding-encoder",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"enumSensor.getStatus": {
 		capName: "enum-sensor",
 		capScope: "device",
@@ -54126,6 +55192,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getClusterModelChoice": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getDeviceLiveContribution": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56727,6 +57799,7 @@ var KNOWN_CAP_NAMES = [
 	"device-adoption",
 	"device-discovery",
 	"device-export",
+	"device-extension",
 	"device-manager",
 	"device-ops",
 	"device-provider",
@@ -56869,6 +57942,7 @@ var DEVICE_CAP_NAMES = [
 	"detection-pipeline",
 	"device-admin-link",
 	"device-discovery",
+	"device-extension",
 	"device-ops",
 	"device-status",
 	"doorbell",
@@ -57282,6 +58356,26 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceExtension.listCandidates": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSlots": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceExtension.setSlot": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -59843,6 +60937,7 @@ function createSystemProxy(api) {
 			stop: (input) => dispatch("deviceProvider", "stop", "mutation", input),
 			getStatus: (input) => dispatch("deviceProvider", "getStatus", "query", input),
 			getDevices: (input) => dispatch("deviceProvider", "getDevices", "query", input),
+			reloadDevice: (input) => dispatch("deviceProvider", "reloadDevice", "mutation", input),
 			supportsDiscovery: (input) => dispatch("deviceProvider", "supportsDiscovery", "query", input),
 			discoverDevices: (input) => dispatch("deviceProvider", "discoverDevices", "mutation", input),
 			getDiscoveryParamsSchema: (input) => dispatch("deviceProvider", "getDiscoveryParamsSchema", "query", input),
@@ -59988,6 +61083,29 @@ function createSystemProxy(api) {
 			deleteTarget: (input) => dispatch("notificationOutput", "deleteTarget", "mutation", input),
 			setTargetEnabled: (input) => dispatch("notificationOutput", "setTargetEnabled", "mutation", input)
 		},
+		notificationRules: {
+			listRules: (input) => dispatch("notificationRules", "listRules", "query", input),
+			getRule: (input) => dispatch("notificationRules", "getRule", "query", input),
+			createRule: (input) => dispatch("notificationRules", "createRule", "mutation", input),
+			updateRule: (input) => dispatch("notificationRules", "updateRule", "mutation", input),
+			deleteRule: (input) => dispatch("notificationRules", "deleteRule", "mutation", input),
+			setRuleEnabled: (input) => dispatch("notificationRules", "setRuleEnabled", "mutation", input),
+			getClipRetentionAsks: (input) => dispatch("notificationRules", "getClipRetentionAsks", "query", input),
+			listDeviceMutes: (input) => dispatch("notificationRules", "listDeviceMutes", "query", input),
+			testRule: (input) => dispatch("notificationRules", "testRule", "mutation", input),
+			previewStateSummary: (input) => dispatch("notificationRules", "previewStateSummary", "mutation", input),
+			getConditionCatalog: (input) => dispatch("notificationRules", "getConditionCatalog", "query", input),
+			getTemplateCatalog: (input) => dispatch("notificationRules", "getTemplateCatalog", "query", input),
+			previewTemplate: (input) => dispatch("notificationRules", "previewTemplate", "mutation", input),
+			getHistory: (input) => dispatch("notificationRules", "getHistory", "query", input),
+			getRuleLastRuns: (input) => dispatch("notificationRules", "getRuleLastRuns", "query", input),
+			resolveArtifactUrl: (input) => dispatch("notificationRules", "resolveArtifactUrl", "query", input),
+			listSnoozes: (input) => dispatch("notificationRules", "listSnoozes", "query", input),
+			createSnooze: (input) => dispatch("notificationRules", "createSnooze", "mutation", input),
+			cancelSnooze: (input) => dispatch("notificationRules", "cancelSnooze", "mutation", input),
+			getAlarmConfig: (input) => dispatch("notificationRules", "getAlarmConfig", "query", input),
+			setAlarmConfig: (input) => dispatch("notificationRules", "setAlarmConfig", "mutation", input)
+		},
 		osdManager: {
 			getConditionSupport: (input) => dispatch("osdManager", "getConditionSupport", "query", input),
 			copyDeviceConfiguration: (input) => dispatch("osdManager", "copyDeviceConfiguration", "mutation", input)
@@ -60036,11 +61154,13 @@ function createSystemProxy(api) {
 			rebalance: (input) => dispatch("pipelineOrchestrator", "rebalance", "mutation", input),
 			getPipelineAssignments: (input) => dispatch("pipelineOrchestrator", "getPipelineAssignments", "query", input),
 			getAgentLoad: (input) => dispatch("pipelineOrchestrator", "getAgentLoad", "query", input),
+			getClusterModelChoice: (input) => dispatch("pipelineOrchestrator", "getClusterModelChoice", "query", input),
 			getGlobalMetrics: (input) => dispatch("pipelineOrchestrator", "getGlobalMetrics", "query", input),
 			getCapabilityBindings: (input) => dispatch("pipelineOrchestrator", "getCapabilityBindings", "query", input),
 			setCapabilityBinding: (input) => dispatch("pipelineOrchestrator", "setCapabilityBinding", "mutation", input),
 			getIngestOwner: (input) => dispatch("pipelineOrchestrator", "getIngestOwner", "query", input),
 			getAudioNodeLoad: (input) => dispatch("pipelineOrchestrator", "getAudioNodeLoad", "query", input),
+			getAudioAssignments: (input) => dispatch("pipelineOrchestrator", "getAudioAssignments", "query", input),
 			getAgentSettings: (input) => dispatch("pipelineOrchestrator", "getAgentSettings", "query", input),
 			listAgentSettings: (input) => dispatch("pipelineOrchestrator", "listAgentSettings", "query", input),
 			removeAgentSettings: (input) => dispatch("pipelineOrchestrator", "removeAgentSettings", "mutation", input),
@@ -63432,223 +64552,6 @@ function readTimelapseGeneratedAt(rule, deviceId) {
 	return rule.lastGeneratedAt ?? 0;
 }
 //#endregion
-//#region src/pipeline/cluster-model-scope.ts
-/**
-* A model choice has a SCOPE, and a scope change has a workflow.
-*
-* ## The two scopes
-*
-* Almost every pipeline step's model is a **node** question: which build runs
-* fastest on THIS accelerator. Two nodes may legitimately answer differently —
-* a Coral runs the tflite SSD, a Mac runs the coreml YOLO — because the answers
-* are compared against nothing. They produce boxes, and a box is a box.
-*
-* Two steps are not like that. `face-embedding` and `clip-embedding` produce
-* **vectors that land in ONE shared index** (`identity_samples`,
-* `vec_object_clip`) and are ranked against each other by cosine similarity.
-* Cosine similarity between two encoders is not a weak signal, it is a
-* meaningless number — and nothing inside a vector can tell you it happened.
-* So for those two steps the model is a **cluster** question with exactly one
-* answer, stored in exactly one row.
-*
-* That is the same argument [D52](../../../../docs/decisions/adr-0052.md) makes
-* for the crop convention (`detail-crop.ts`), one level up: the crop decides
-* WHAT pixels the encoder sees, this decides WHICH encoder sees them. Both are
-* cluster-wide for the same reason and neither may become per-node.
-*
-* ## Why the registry lives here and not in the step catalog
-*
-* The scope itself is declared on the step, in
-* `detection-pipeline/registry/step-definitions.ts` (`StepDefinition.modelScope`)
-* — that is where a new step declares what kind of choice its model is. But the
-* catalog lives inside `addon-pipeline`, and three packages that must NOT
-* import an addon need to know the set: the orchestrator (which renders and
-* stores the row), post-analysis (which pins the row for a re-embed pass) and
-* admin-ui (which mirrors it). So the set is mirrored here, and
-* `scripts/check-cluster-model-scope.ts` fails the build when the two disagree.
-* A hand-copied key that stops matching is exactly how a setting silently stops
-* arriving while both sides still look correct.
-*
-* ## The defaults ARE today's behaviour
-*
-* {@link DEFAULT_CLUSTER_STEP_MODELS} reproduces the catalog `defaultModelId`
-* of both steps. Declaring the scope therefore changes nothing on the day it
-* ships: the cluster row starts out saying what every node was already doing.
-* Changing it is legitimate — that is what the knob is for — but it invalidates
-* the stored vectors of that surface, and must be followed by a re-embed pass
-* (`face-reembed-pass.ts`, `embedding-rebuild.ts`).
-*/
-/**
-* The cluster-scoped steps. Mirrored from the catalog's `modelScope: 'cluster'`
-* declarations and guarded by `scripts/check-cluster-model-scope.ts`.
-*/
-var CLUSTER_MODEL_SCOPED_STEPS = [{
-	stepId: "face-embedding",
-	label: "Face recognition model",
-	defaultModelId: "arcface-r100",
-	indexName: "the enrolled face gallery",
-	options: [
-		{
-			id: "arcface-r100",
-			label: "ArcFace (ResNet34)"
-		},
-		{
-			id: "auraface-r100",
-			label: "AuraFace R100"
-		},
-		{
-			id: "inception-resnet-v1",
-			label: "Inception ResNet V1"
-		}
-	]
-}, {
-	stepId: "clip-embedding",
-	label: "Semantic search model",
-	defaultModelId: "mobileclip-s1",
-	indexName: "the object semantic-search index",
-	options: [{
-		id: "mobileclip-s1",
-		label: "MobileCLIP S1"
-	}, {
-		id: "mobileclip-s2",
-		label: "MobileCLIP S2"
-	}]
-}];
-/**
-* Store identity of the cluster row inside `pipeline-orchestrator`'s GLOBAL
-* (cluster-wide) settings — the same owner, and for the same reason, as the
-* detail-crop convention: hub-resident and neutral between the addons that
-* read it.
-*/
-var CLUSTER_MODEL_SECTION_ID = "cluster-step-models";
-/**
-* The settings key holding one step's cluster model choice.
-*
-* Step-qualified so the keys stay unique across the addon's whole schema, which
-* is what lets {@link pickClusterStepModels} walk every section instead of
-* trusting the section id.
-*/
-function clusterModelSettingKey(stepId) {
-	return `clusterModel:${stepId}`;
-}
-/** True when this step's model is a cluster-wide choice rather than a per-node one. */
-function isClusterScopedStep(stepId) {
-	return CLUSTER_MODEL_SCOPED_STEPS.some((s) => s.stepId === stepId);
-}
-/** The cluster row when nobody has configured one — today's catalog defaults. */
-var DEFAULT_CLUSTER_STEP_MODELS = Object.freeze(Object.fromEntries(CLUSTER_MODEL_SCOPED_STEPS.map((s) => [s.stepId, s.defaultModelId])));
-/** A stored choice is a non-empty model id, or it is not a choice. */
-var ChosenModelIdSchema = zod.z.string().min(1);
-/**
-* Narrow a FLAT settings record to the cluster row.
-*
-* Per-FIELD fallback, deliberately (same rule as `readDetailCropConvention`): a
-* junk face model must not also discard a valid clip model. An absent, empty or
-* non-string value resolves to the step's catalog default — the historical
-* behaviour — never to a blank id, because a blank id downstream becomes
-* "substitute the format default", which is precisely the substitution this
-* scope exists to forbid.
-*/
-function readClusterStepModels(config) {
-	const out = {};
-	for (const step of CLUSTER_MODEL_SCOPED_STEPS) {
-		const parsed = ChosenModelIdSchema.safeParse(config[clusterModelSettingKey(step.stepId)]);
-		out[step.stepId] = parsed.success ? parsed.data : step.defaultModelId;
-	}
-	return out;
-}
-function isHydratedField$2(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Extract the cluster row from an `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link CLUSTER_MODEL_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the defaults. A `null` payload
-* (addon mid-boot) is the defaults.
-*/
-function pickClusterStepModels(view) {
-	if (view === null) return DEFAULT_CLUSTER_STEP_MODELS;
-	const flat = {};
-	const wanted = new Set(CLUSTER_MODEL_SCOPED_STEPS.map((s) => clusterModelSettingKey(s.stepId)));
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
-		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readClusterStepModels(flat);
-}
-/**
-* The cluster model for `stepId`, or `null` when the step is node-scoped.
-*
-* `null` is the signal to LEAVE THE CALLER'S RESOLUTION ALONE — it is not "no
-* model". Returning a default here for a node-scoped step would quietly
-* override every per-(node,device) selection in the fleet.
-*/
-function resolveClusterStepModelId(stepId, models) {
-	const step = CLUSTER_MODEL_SCOPED_STEPS.find((s) => s.stepId === stepId);
-	if (step === void 0) return null;
-	const chosen = models[stepId];
-	return chosen !== void 0 && chosen !== "" ? chosen : step.defaultModelId;
-}
-/** Must match `DEFAULT_LANDMARK_PRECISION_FLOOR_PX` in the runner. */
-var DEFAULT_MIN_LANDMARK_FACE_SIZE_PX = 24;
-var CLUSTER_STEP_SETTING_FIELDS = [{
-	stepId: "face-embedding",
-	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
-	type: "slider",
-	min: 0,
-	max: 64,
-	step: 2,
-	default: 24
-}];
-function clusterStepSettingKey(stepId, fieldKey) {
-	return `clusterStepSetting:${stepId}:${fieldKey}`;
-}
-function clusterStepSettingFieldsFor(stepId) {
-	return CLUSTER_STEP_SETTING_FIELDS.filter((field) => field.stepId === stepId);
-}
-var ClusterSettingNumberSchema = zod.z.number().finite();
-function readClusterStepSettings(config) {
-	const out = {};
-	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
-		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
-		const value = parsed.success ? parsed.data : field.default;
-		const existing = out[field.stepId] ?? {};
-		out[field.stepId] = {
-			...existing,
-			[field.key]: value
-		};
-	}
-	return out;
-}
-var DEFAULT_CLUSTER_STEP_SETTINGS = readClusterStepSettings({});
-function pickClusterStepSettings(view) {
-	if (view === null) return DEFAULT_CLUSTER_STEP_SETTINGS;
-	const flat = {};
-	const wanted = new Set(CLUSTER_STEP_SETTING_FIELDS.map((field) => clusterStepSettingKey(field.stepId, field.key)));
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$2(entry) || typeof entry.key !== "string") continue;
-		if (wanted.has(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readClusterStepSettings(flat);
-}
-/**
-* Cluster knobs win over leftover per-device values. The cluster row is the
-* authority; a device-local copy is a leftover of the old per-node editor.
-*/
-function overlayClusterStepSettings(stepId, deviceSettings, cluster) {
-	const overlay = cluster[stepId];
-	if (overlay === void 0 || Object.keys(overlay).length === 0) return deviceSettings === void 0 ? void 0 : { ...deviceSettings };
-	if (deviceSettings === void 0) return { ...overlay };
-	return {
-		...deviceSettings,
-		...overlay
-	};
-}
-//#endregion
 //#region src/pipeline/detail-crop.ts
 /**
 * THE detail-crop convention — the single derivation of the rectangle a
@@ -66218,11 +67121,15 @@ exports.CLIP_BROKER_PACED_RATES = CLIP_BROKER_PACED_RATES;
 exports.CLIP_PLAYBACK_OPTIONS = CLIP_PLAYBACK_OPTIONS;
 exports.CLIP_REALTIME_SOURCE_RATES = CLIP_REALTIME_SOURCE_RATES;
 exports.CLIP_REASON_HEADER_MAX = CLIP_REASON_HEADER_MAX;
+exports.CLIP_SEARCH_STRICTNESS = CLIP_SEARCH_STRICTNESS;
 exports.CLIP_STILL_DISPOSITION_HEADER = CLIP_STILL_DISPOSITION_HEADER;
 exports.CLIP_STILL_REASON_CODE_HEADER = CLIP_STILL_REASON_CODE_HEADER;
 exports.CLIP_STILL_REASON_HEADER = CLIP_STILL_REASON_HEADER;
 exports.CLIP_STREAM_SOURCE_RATES = CLIP_STREAM_SOURCE_RATES;
 exports.CLIP_STREAM_TRANSPORT_HEADER = CLIP_STREAM_TRANSPORT_HEADER;
+exports.CLIP_STRICTNESS_FACTOR = CLIP_STRICTNESS_FACTOR;
+exports.CLIP_VECTOR_INDEX_PATTERN = CLIP_VECTOR_INDEX_PATTERN;
+exports.CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS = CLUSTER_MODEL_CHOICE_UNREADABLE_REASONS;
 exports.CLUSTER_MODEL_SCOPED_STEPS = CLUSTER_MODEL_SCOPED_STEPS;
 exports.CLUSTER_MODEL_SECTION_ID = CLUSTER_MODEL_SECTION_ID;
 exports.CLUSTER_STEP_SETTING_FIELDS = CLUSTER_STEP_SETTING_FIELDS;
@@ -66277,9 +67184,11 @@ exports.ClimateControlStatusSchema = ClimateControlStatusSchema;
 exports.ClipBytesOfferSchema = ClipBytesOfferSchema;
 exports.ClipBytesSchema = ClipBytesSchema;
 exports.ClipExportFailureSchema = ClipExportFailureSchema;
+exports.ClipModelMetaSchema = ClipModelMetaSchema;
 exports.ClipPlaybackOptionsSchema = ClipPlaybackOptionsSchema;
 exports.ClipPlaybackSchema = ClipPlaybackSchema;
 exports.ClipSchema = ClipSchema;
+exports.ClipSearchStrictnessSchema = ClipSearchStrictnessSchema;
 exports.ClipSourceAvailabilitySchema = ClipSourceAvailabilitySchema;
 exports.ClipSourceSchema = ClipSourceSchema;
 exports.ClipStillDispositionSchema = ClipStillDispositionSchema;
@@ -66290,6 +67199,7 @@ exports.ClipStreamDialSchema = ClipStreamDialSchema;
 exports.ClipWakeSchema = ClipWakeSchema;
 exports.ClusterAddonNodeDeploymentSchema = ClusterAddonNodeDeploymentSchema;
 exports.ClusterAddonStatusEntrySchema = ClusterAddonStatusEntrySchema;
+exports.ClusterModelChoiceSchema = ClusterModelChoiceSchema;
 exports.CollectionColumnSchema = CollectionColumnSchema;
 exports.CollectionIndexSchema = CollectionIndexSchema;
 exports.ColorStatusSchema = ColorStatusSchema;
@@ -66370,6 +67280,7 @@ exports.DISPLAY_ICON_GROUPS = DISPLAY_ICON_GROUPS;
 exports.DISPLAY_ICON_KEYS = DISPLAY_ICON_KEYS;
 exports.DISPLAY_ICON_OFFERED_KEYS = DISPLAY_ICON_OFFERED_KEYS;
 exports.DISPLAY_ICON_VOCABULARY = DISPLAY_ICON_VOCABULARY;
+exports.DOORBELL_SOURCE_SLOT = DOORBELL_SOURCE_SLOT;
 exports.DataStoreEngineInfoSchema = EngineInfoSchema;
 exports.DayNightModeSchema = DayNightModeSchema;
 exports.DayNightOptionsSchema = DayNightOptionsSchema;
@@ -66411,7 +67322,11 @@ exports.DiscoveredTargetSchema = DiscoveredTargetSchema;
 exports.DiskReconcileJobSchema = DiskReconcileJobSchema;
 exports.DisposerChain = require_sleep.DisposerChain;
 exports.DoorbellPressEventSchema = DoorbellPressEventSchema;
+exports.DoorbellSourceSlotValueSchema = DoorbellSourceSlotValueSchema;
 exports.DoorbellStatusSchema = DoorbellStatusSchema;
+exports.EMBEDDING_MODEL_FAILED = EMBEDDING_MODEL_FAILED;
+exports.EMBEDDING_REQUIREMENTS_FAILED = EMBEDDING_REQUIREMENTS_FAILED;
+exports.EMBEDDING_REQUIREMENTS_UNAVAILABLE = EMBEDDING_REQUIREMENTS_UNAVAILABLE;
 exports.EVENTFUL_CAP_NAMES = EVENTFUL_CAP_NAMES;
 exports.EVENT_DENSITY_BATCH_MAX = EVENT_DENSITY_BATCH_MAX;
 exports.EVENT_KIND_BY_CAP = EVENT_KIND_BY_CAP;
@@ -66424,14 +67339,23 @@ exports.EXPRESSION_BUILTIN_NAMES = EXPRESSION_BUILTIN_NAMES;
 exports.EXPRESSION_COMPILE_CACHE_CAPACITY = EXPRESSION_COMPILE_CACHE_CAPACITY;
 exports.EXPRESSION_IDENTIFIER_RE = EXPRESSION_IDENTIFIER_RE;
 exports.EXPRESSION_INJECTED_NOW = EXPRESSION_INJECTED_NOW;
+exports.EXTENSION_HOST_DEVICE_TYPES = EXTENSION_HOST_DEVICE_TYPES;
+exports.EXTENSION_SLOTS = EXTENSION_SLOTS;
+exports.EXTENSION_SLOT_IDS = EXTENSION_SLOT_IDS;
+exports.EXTENSION_SLOT_LISTING_METHOD = EXTENSION_SLOT_LISTING_METHOD;
+exports.EXTENSION_SLOT_REF_SEPARATOR = EXTENSION_SLOT_REF_SEPARATOR;
 exports.EffectiveTuningSchema = EffectiveTuningSchema;
 exports.EgressEncodeSchema = EgressEncodeSchema;
 exports.EgressRateControlSchema = EgressRateControlSchema;
 exports.EgressTranscodeRequestSchema = EgressTranscodeRequestSchema;
 exports.EgressTranscodeSchema = EgressTranscodeSchema;
 exports.ElementConfigStore = ElementConfigStore;
+exports.EmbeddingFailedModelSchema = EmbeddingFailedModelSchema;
+exports.EmbeddingFailedRequirementSchema = EmbeddingFailedRequirementSchema;
 exports.EmbeddingInfoSchema = EmbeddingInfoSchema;
+exports.EmbeddingRefusalCodeSchema = EmbeddingRefusalCodeSchema;
 exports.EmbeddingResultSchema = EmbeddingResultSchema;
+exports.EmbeddingTowerSchema = EmbeddingTowerSchema;
 exports.EncodeProfileSchema = EncodeProfileSchema;
 exports.EncodedPacketSchema = require_sleep.EncodedPacketSchema;
 exports.EnrichedWidgetMetadataSchema = EnrichedWidgetMetadataSchema;
@@ -66476,6 +67400,21 @@ exports.ExpressionGlobalBindingSchema = ExpressionGlobalBindingSchema;
 exports.ExpressionLiteralBindingSchema = ExpressionLiteralBindingSchema;
 exports.ExpressionParseError = ExpressionParseError;
 exports.ExpressionSourceSchema = ExpressionSourceSchema;
+exports.ExtensionCandidateSchema = ExtensionCandidateSchema;
+exports.ExtensionCandidatesSchema = ExtensionCandidatesSchema;
+exports.ExtensionSetResultSchema = ExtensionSetResultSchema;
+exports.ExtensionSetSlotInputSchema = ExtensionSetSlotInputSchema;
+exports.ExtensionSlotActivationSchema = ExtensionSlotActivationSchema;
+exports.ExtensionSlotIdSchema = ExtensionSlotIdSchema;
+exports.ExtensionSlotRefInputSchema = ExtensionSlotRefInputSchema;
+exports.ExtensionSlotRowSchema = ExtensionSlotRowSchema;
+exports.ExtensionSlotSourceSchema = ExtensionSlotSourceSchema;
+exports.ExtensionSlotStateSchema = ExtensionSlotStateSchema;
+exports.ExtensionSlotUnreachableSchema = ExtensionSlotUnreachableSchema;
+exports.ExtensionSlotValueSchema = ExtensionSlotValueSchema;
+exports.ExtensionSourceAvailabilitySchema = ExtensionSourceAvailabilitySchema;
+exports.ExtensionSourceHealthSchema = ExtensionSourceHealthSchema;
+exports.ExtensionSourceSchema = ExtensionSourceSchema;
 exports.FIRST_LEVEL_MACRO_CLASSES = FIRST_LEVEL_MACRO_CLASSES;
 exports.FULL_IMAGE_BBOX = FULL_IMAGE_BBOX;
 exports.FailureContributionSchema = FailureContributionSchema;
@@ -66532,6 +67471,7 @@ exports.IntercomStatusSchema = IntercomStatusSchema;
 exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
 exports.KeyEventSchema = KeyEventSchema;
 exports.LEGACY_READ_ONLY_CONFIG_KEY = LEGACY_READ_ONLY_CONFIG_KEY;
+exports.LINKED_DEVICES_SLOT = LINKED_DEVICES_SLOT;
 exports.LOAD_CONTRIBUTION_ATTRIBUTIONS = LOAD_CONTRIBUTION_ATTRIBUTIONS;
 exports.LOAD_CONTRIBUTION_ROLES = LOAD_CONTRIBUTION_ROLES;
 exports.LOCATION_DESCRIPTION_MAX = LOCATION_DESCRIPTION_MAX;
@@ -66554,6 +67494,7 @@ exports.LedgerWalkSkipReasonSchema = LedgerWalkSkipReasonSchema;
 exports.LegacyStorageLocationDefaultSchema = LegacyStorageLocationDefaultSchema;
 exports.LinkedDeviceSchema = LinkedDeviceSchema;
 exports.LinkedDevicesModeSchema = LinkedDevicesModeSchema;
+exports.LinkedDevicesSlotValueSchema = LinkedDevicesSlotValueSchema;
 exports.LlmDefaultSchema = LlmDefaultSchema;
 exports.LlmDefaultSelectorSchema = LlmDefaultSelectorSchema;
 exports.LlmDownloadProgressSchema = LlmDownloadProgressSchema;
@@ -66725,6 +67666,8 @@ exports.NC_AUDIO_SEED = NC_AUDIO_SEED;
 exports.NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NC_AUTHORABLE_SYSTEM_EVENT_KINDS;
 exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
 exports.NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS = NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS;
+exports.NC_CLIP_POST_ROLL_DEFAULT_SEC = NC_CLIP_POST_ROLL_DEFAULT_SEC;
+exports.NC_CLIP_PRE_ROLL_DEFAULT_SEC = NC_CLIP_PRE_ROLL_DEFAULT_SEC;
 exports.NC_CLIP_RETENTION_MAX_SEC = NC_CLIP_RETENTION_MAX_SEC;
 exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
 exports.NC_CONFIRM_DEFAULT_MAX_IMAGE_PX = NC_CONFIRM_DEFAULT_MAX_IMAGE_PX;
@@ -66986,6 +67929,7 @@ exports.ReadSegmentBytesResultSchema = ReadSegmentBytesResultSchema;
 exports.ReadWindowBytesResultSchema = ReadWindowBytesResultSchema;
 exports.ReadinessRegistry = require_sleep.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_sleep.ReadinessTimeoutError;
+exports.RebuildObjectEmbeddingsRefusalSchema = RebuildObjectEmbeddingsRefusalSchema;
 exports.RecentTracksPageSchema = RecentTracksPageSchema;
 exports.RecentTracksQueryInput = RecentTracksQueryInput;
 exports.RecordTriggerSchema = RecordTriggerSchema;
@@ -67065,6 +68009,7 @@ exports.RunnerCameraConfigSchema = RunnerCameraConfigSchema;
 exports.RunnerCameraDeviceUIFields = RunnerCameraDeviceUIFields;
 exports.RunnerFrameSourceSchema = RunnerFrameSourceSchema;
 exports.RunnerInferenceDeviceSchema = RunnerInferenceDeviceSchema;
+exports.RunnerJumpStepProvisioningSchema = RunnerJumpStepProvisioningSchema;
 exports.RunnerLocalLoadSchema = RunnerLocalLoadSchema;
 exports.RunnerLocalMetricsSchema = RunnerLocalMetricsSchema;
 exports.SCENE_CONDITIONS = SCENE_CONDITIONS;
@@ -67264,6 +68209,7 @@ exports.UpdateStatusSchema = UpdateStatusSchema;
 exports.UpdateUserInputSchema = UpdateUserInputSchema;
 exports.UserRecordSchema = UserRecordSchema;
 exports.UserSummarySchema = UserSummarySchema;
+exports.VECTOR_INDEX_DIM_CONFLICT = VECTOR_INDEX_DIM_CONFLICT;
 exports.VIDEOCLIPS_MAX_OFFER_BYTES = VIDEOCLIPS_MAX_OFFER_BYTES;
 exports.VIDEOCLIPS_MAX_READ_BYTES = VIDEOCLIPS_MAX_READ_BYTES;
 exports.VISIT_MERGE_GAP_MS = VISIT_MERGE_GAP_MS;
@@ -67424,6 +68370,7 @@ exports.coreBlocksCapability = coreBlocksCapability;
 exports.cosineSimilarity = cosineSimilarity;
 exports.countConditionLeaves = countConditionLeaves;
 exports.coverCapability = coverCapability;
+exports.createDeviceExtensionProvider = createDeviceExtensionProvider;
 exports.createDeviceProxy = require_sleep.createDeviceProxy;
 exports.createDurableState = require_sleep.createDurableState;
 exports.createEvent = require_sleep.createEvent;
@@ -67448,6 +68395,7 @@ exports.decoderCapability = decoderCapability;
 exports.defaultDeliveryForSection = defaultDeliveryForSection;
 exports.defaultDeviceFor = defaultDeviceFor;
 exports.defineCustomActions = require_sleep.defineCustomActions;
+exports.defineExtensionSlotProvider = defineExtensionSlotProvider;
 exports.deriveBatteryPresence = deriveBatteryPresence;
 exports.deriveCameraSwitches = deriveCameraSwitches;
 exports.deriveDetailCropRect = deriveDetailCropRect;
@@ -67466,6 +68414,7 @@ exports.deviceBackendToFormat = deviceBackendToFormat;
 exports.deviceCustomAction = require_sleep.deviceCustomAction;
 exports.deviceDiscoveryCapability = deviceDiscoveryCapability;
 exports.deviceExportCapability = deviceExportCapability;
+exports.deviceExtensionCapability = deviceExtensionCapability;
 exports.deviceManagerCapability = deviceManagerCapability;
 exports.deviceMatchesProfile = deviceMatchesProfile;
 exports.deviceOpsCapability = require_sleep.deviceOpsCapability;
@@ -67480,6 +68429,11 @@ exports.droppedConditionsForKind = droppedConditionsForKind;
 exports.egressTranscodeSharingKey = egressTranscodeSharingKey;
 exports.egressTransportFromRequest = egressTransportFromRequest;
 exports.embeddingEncoderCapability = embeddingEncoderCapability;
+exports.embeddingModelFailedError = embeddingModelFailedError;
+exports.embeddingModelFailedOf = embeddingModelFailedOf;
+exports.embeddingRefusalOf = embeddingRefusalOf;
+exports.embeddingRequirementsFailedError = embeddingRequirementsFailedError;
+exports.embeddingRequirementsUnavailableError = embeddingRequirementsUnavailableError;
 exports.emitDownForOwnedCaps = require_sleep.emitDownForOwnedCaps;
 exports.emitReadiness = require_sleep.emitReadiness;
 exports.emitsCollectionSelector = emitsCollectionSelector;
@@ -67503,6 +68457,7 @@ exports.expandAudioChunkToF32le = require_sleep.expandAudioChunkToF32le;
 exports.expandCapMethods = require_sleep.expandCapMethods;
 exports.expandContainer = expandContainer;
 exports.exportSubjectOf = exportSubjectOf;
+exports.extensionSlotRef = extensionSlotRef;
 exports.extractNestedAddonId = extractNestedAddonId;
 exports.extractSourceInfoFromMetadata = extractSourceInfoFromMetadata;
 exports.faceGalleryCapability = faceGalleryCapability;
@@ -67538,6 +68493,8 @@ exports.inferModelProvider = inferModelProvider;
 exports.initialPoolMemoryState = initialPoolMemoryState;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
+exports.interpretStoredClusterModel = interpretStoredClusterModel;
+exports.invalidClusterStepModelEntries = invalidClusterStepModelEntries;
 exports.invocationFromEncodeProfile = require_canonical_hash.invocationFromEncodeProfile;
 exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
 exports.isArrayOutputSchema = isArrayOutputSchema;
@@ -67553,6 +68510,7 @@ exports.isDetectionMacroClass = isDetectionMacroClass;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
 exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isDisplayIconKey = isDisplayIconKey;
+exports.isEmbeddingModelFailed = isEmbeddingModelFailed;
 exports.isEvent = require_sleep.isEvent;
 exports.isEventOwnerType = isEventOwnerType;
 exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
@@ -67575,6 +68533,7 @@ exports.isSystemDelivery = isSystemDelivery;
 exports.isSystemEventFamily = isSystemEventFamily;
 exports.isSystemEventSummaryRule = isSystemEventSummaryRule;
 exports.isSystemRuleKind = isSystemRuleKind;
+exports.isVectorIndexDimConflict = isVectorIndexDimConflict;
 exports.isVoidInput = isVoidInput;
 exports.ituDbfsFromPreEpoch = ituDbfsFromPreEpoch;
 exports.jobKindSchema = jobKindSchema;
@@ -67637,6 +68596,7 @@ exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeAudioLabel = normalizeAudioLabel;
+exports.normalizeNodeId = require_sleep.normalizeNodeId;
 exports.normalizeTokenScopes = normalizeTokenScopes;
 exports.normalizeUnit = normalizeUnit;
 exports.notificationOutputCapability = notificationOutputCapability;
@@ -67670,6 +68630,7 @@ exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickClusterStepModels = pickClusterStepModels;
 exports.pickClusterStepSettings = pickClusterStepSettings;
 exports.pickDetailCropConvention = pickDetailCropConvention;
+exports.pickInvalidClusterStepModels = pickInvalidClusterStepModels;
 exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
 exports.pickRestartCandidate = pickRestartCandidate;
@@ -67717,6 +68678,7 @@ exports.resolveAddonGroup = resolveAddonGroup;
 exports.resolveAddonPlacement = resolveAddonPlacement;
 exports.resolveBucketMs = resolveBucketMs;
 exports.resolveCapMount = require_sleep.resolveCapMount;
+exports.resolveClipSearchMinScore = resolveClipSearchMinScore;
 exports.resolveClusterStepModelId = resolveClusterStepModelId;
 exports.resolveContainerPrimaryChild = resolveContainerPrimaryChild;
 exports.resolveCreateExportSubject = resolveCreateExportSubject;
@@ -67836,6 +68798,7 @@ exports.tryConvertUnit = tryConvertUnit;
 exports.turnProviderCapability = turnProviderCapability;
 exports.unitDimension = unitDimension;
 exports.unitsForDimension = unitsForDimension;
+exports.unreachableExtensionSlotRow = unreachableExtensionSlotRow;
 exports.updateCapability = updateCapability;
 exports.userManagementCapability = userManagementCapability;
 exports.userPasskeysCapability = userPasskeysCapability;
@@ -67844,6 +68807,7 @@ exports.validateExpressionSource = validateExpressionSource;
 exports.validateRecipeBounds = validateRecipeBounds;
 exports.valveCapability = valveCapability;
 exports.vectorDimFromBase64 = vectorDimFromBase64;
+exports.vectorIndexDimConflictError = vectorIndexDimConflictError;
 exports.vectorStoreCapability = vectorStoreCapability;
 exports.vibrationCapability = vibrationCapability;
 exports.videoclipsCapability = videoclipsCapability;