@camstack/types 1.2.274 → 1.2.276

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_sleep = require("./sleep-WOeeZ4FU.js");
 const require_event_category = require("./event-category-MbnB-6AN.js");
-const require_composition = require("./composition-BRxAnxtU.js");
+const require_composition = require("./composition-DG4jVTfB.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 const require_enums = require("./enums.js");
 let zod = require("zod");
@@ -833,6 +833,28 @@ function egressTranscodeSharingKey(request, delivery = egressTransportFromReques
 	return `egress:${require_composition.canonicalHash(canonicalEgressPlan(request, delivery))}`;
 }
 //#endregion
+//#region src/ffmpeg/pinned-binary.ts
+/**
+* Memoize `ensure` on SUCCESS only.
+*
+* A failure is not remembered: the next caller asks again, so a node whose
+* first download failed (no network at boot) recovers on the next spawn that
+* needs it — with no timer and no retry loop, because the ask is driven by
+* work that actually wants the binary.
+*/
+function memoizePinnedFfmpeg(ensure) {
+	let pending = null;
+	return () => {
+		if (pending !== null) return pending;
+		const attempt = ensure();
+		pending = attempt;
+		attempt.catch(() => {
+			if (pending === attempt) pending = null;
+		});
+		return attempt;
+	};
+}
+//#endregion
 //#region src/health/wiring-health.ts
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
@@ -9768,269 +9790,1198 @@ var CompositionBlockStateSchema = zod.z.object({
 	fields: zod.z.array(CompositionFieldStateSchema)
 });
 //#endregion
-//#region src/capabilities/core-blocks.cap.ts
-/**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
-/**
-* Prefix for a block's generated addon id AND its runner id — one addon, one
-* process, so the two are the same string (D2).
-*
-* It lives on the CONTRACT rather than beside the code that materialises the
-* package, because it is not an implementation detail: the operator surface
-* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
-* with no cap and no store of its own. Two copies of this string is one copy
-* too many — a drift would show as a logs pane that is simply always empty.
-*/
-var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+//#region src/composition/plan-result.ts
+function problem(code, path, message) {
+	return {
+		code,
+		path,
+		message
+	};
+}
+function refused(...problems) {
+	return {
+		problems,
+		fields: [],
+		features: [],
+		events: []
+	};
+}
+/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
+function compositionFieldAt(field) {
+	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
+	return `features[${field.featureIndex}].${inner}.${field.path}`;
+}
+//#endregion
+//#region src/composition/expression-kinds.ts
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
+var BUILTIN_RESULT_KINDS = Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	rose: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	count: NUMBER
+});
+var KindInferenceError = class extends Error {};
+function kindOfValue(value) {
+	if (value === null) return "null";
+	if (typeof value === "number") return "number";
+	if (typeof value === "string") return "string";
+	return "boolean";
+}
+function only(kind) {
+	return new Set([kind]);
+}
+function union(...sets) {
+	return new Set(sets.flatMap((s) => [...s]));
+}
+function withoutNull(set) {
+	return new Set([...set].filter((k) => k !== "null"));
+}
+function binaryKinds(op, left, right) {
+	if (op === "+") {
+		const all = [...left, ...right];
+		if (all.every((k) => k === "string")) return only("string");
+		if (all.every((k) => k === "number")) return only("number");
+		return new Set(["number", "string"]);
+	}
+	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
+	return only("boolean");
+}
+/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
+function arityRange(builtin) {
+	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
+	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
+	return `${builtin.minArgs}–${builtin.maxArgs}`;
+}
+function callKinds(callee, args) {
+	const builtin = require_composition.EXPRESSION_BUILTINS[callee];
+	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
+	const rule = BUILTIN_RESULT_KINDS[callee];
+	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
+	if (rule.kind === "fixed") return new Set(rule.result);
+	const nonNull = union(...args.map(withoutNull));
+	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
+}
+function kindsOf(node, bindings) {
+	switch (node.kind) {
+		case "literal": return only(kindOfValue(node.value));
+		case "identifier": {
+			if (node.name === "now") return only("number");
+			const bound = bindings.get(node.name);
+			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
+			return bound;
+		}
+		case "unary": return only(node.op === "!" ? "boolean" : "number");
+		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
+		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
+		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
+	}
+}
+function nodeContainsCall(node, callee) {
+	switch (node.kind) {
+		case "literal":
+		case "identifier": return false;
+		case "unary": return nodeContainsCall(node.operand, callee);
+		case "binary":
+		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
+		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
+		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
+	}
+}
+function expressionContainsBuiltinCall(expr, callee) {
+	const compiled = require_composition.compileExpressionSafe(expr);
+	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
+}
+function inferExpressionKinds(input) {
+	const compiled = require_composition.compileExpressionSafe(input.expr);
+	if (!compiled.ok) return {
+		ok: false,
+		error: compiled.error
+	};
+	try {
+		return {
+			ok: true,
+			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
+		};
+	} catch (err) {
+		if (err instanceof KindInferenceError) return {
+			ok: false,
+			error: err.message
+		};
+		throw err;
+	}
+}
+//#endregion
+//#region src/composition/field-kinds.ts
 /**
-* The builtin's own addon id — and, because of that, the OWNER of the
-* integration every block's devices hang from.
-*
-* A block cannot own one. Every integration read is gated on the installed-addon
-* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
-* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
-* null forever while the write succeeds — one invisible, undeletable row per
-* start. `core-blocks` IS installed, so it reconciles one shared integration and
-* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
-*
-* Exported from the contract, next to the runner prefix and for the same reason:
-* a block reads it as
-* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
-* so a second copy of the string is a block that silently declares into nowhere.
+* The kind half of planning a composition field (D659): which kinds a source
+* can produce, whether they fit a target field, and the field's role.
+* Shared by the top-level planner (`validate-composition.ts`) and the item
+* planner (`composition-items.ts`). Internal to the composition module — NOT
+* in the barrel: these are planner internals, not a published contract.
 */
-var CORE_BLOCKS_ADDON_ID = "core-blocks";
-/** The addon/runner id a block's process runs under. */
-function coreBlockAddonId(blockId) {
-	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+function readKinds(read, lookupCap) {
+	const def = lookupCap(read.cap);
+	const schema = def?.runtimeState ?? def?.status?.schema;
+	if (def === null || schema === void 0) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `no capability \`${read.cap}\` with state to read`
+	};
+	const field = describeStateField(schema, read.fieldPath);
+	if (field === null) return {
+		ok: false,
+		code: "source-field-unknown",
+		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
+	};
+	const base = field.kind === "enum" ? "string" : field.kind;
+	return {
+		ok: true,
+		kinds: new Set(field.nullable ? [base, "null"] : [base])
+	};
 }
-/** The block id behind a generated addon/runner id, or null when the id belongs
-*  to something else. The inverse of {@link coreBlockAddonId}. */
-function coreBlockIdFromAddonId(addonId) {
-	if (!addonId.startsWith("core-block-")) return null;
-	const rest = addonId.slice(11);
-	return rest.length > 0 ? rest : null;
+function sourceKinds(source, lookupCap) {
+	if (source.kind === "from") return readKinds(source, lookupCap);
+	if (source.kind === "code") return {
+		ok: false,
+		code: "reserved-variant",
+		message: "code fields arrive in slice 4"
+	};
+	const bindingKinds = /* @__PURE__ */ new Map();
+	for (const [name, binding] of Object.entries(source.bindings)) {
+		if (binding.kind === "literal") {
+			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
+			continue;
+		}
+		const kinds = readKinds(binding, lookupCap);
+		if (!kinds.ok) return {
+			...kinds,
+			message: `binding \`${name}\`: ${kinds.message}`
+		};
+		bindingKinds.set(name, kinds.kinds);
+	}
+	const inferred = inferExpressionKinds({
+		expr: source.expr,
+		bindingKinds
+	});
+	return inferred.ok ? {
+		ok: true,
+		kinds: inferred.kinds
+	} : {
+		ok: false,
+		code: "expression-invalid",
+		message: inferred.error
+	};
+}
+function compatibility(cap, target, kinds, at) {
+	const allowed = target.kind === "enum" ? "string" : target.kind;
+	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
+	const problems = [];
+	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
+	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
+	return problems;
 }
-/** Where a block runs. The operator chooses — a block driving a device on an
-*  agent is the reason placement is not fixed to the hub. */
-var CoreBlockPlacementSchema = zod.z.union([zod.z.literal("hub"), zod.z.string().min(1)]);
-/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. `degraded` is a
-*  composition on an existing device with a field handed back to the native
-*  provider while its source is unavailable (S1b, D663); the error names it. */
-var CoreBlockStatusSchema = zod.z.enum([
-	"stopped",
-	"starting",
-	"running",
-	"degraded",
-	"failed"
-]);
-/** Client-authored fields. */
-var CoreBlockInputSchema = zod.z.object({
-	name: zod.z.string().min(1).max(120),
-	/** TypeScript source. Compiled server-side before it is ever stored — a
-	*  block that does not compile is a fork failure the operator would meet
-	*  minutes later, in a log, instead of in the editor. */
-	code: zod.z.string().max(2e5),
-	enabled: zod.z.boolean(),
-	placement: CoreBlockPlacementSchema,
-	/**
-	* Integration the block's devices hang from. Absent = the system integration
-	* blocks share. A block may declare its own instead.
-	*/
-	integrationId: zod.z.string().optional()
-});
 /**
-* What a block IS (D659). Absent means `code` — every row stored before this
-* union keeps working unchanged.
-*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
-*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
-*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+* A string a source produces WITHOUT reading any device — a field-level
+* `expression` source whose compiled AST is a bare string literal (`"red"`,
+* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
+* the kind level (a `from` read of an enum-typed source field, a computed
+* expression) is NOT checked against the target's `enumValues` here: the
+* kind inference already collapsed it to the coarse `'string'` kind, losing
+* whichever enum it actually came from, so membership can only be judged at
+* write time against the runtime-state schema. Known limitation — see the
+* fix report for Task 6 round 1.
 */
-var CoreBlockSourceSchema = zod.z.discriminatedUnion("kind", [
-	zod.z.object({ kind: zod.z.literal("code") }),
-	zod.z.object({
-		kind: zod.z.literal("recipe"),
-		recipe: AutomationRecipeSchema
-	}),
-	zod.z.object({
-		kind: zod.z.literal("composition"),
-		composition: require_composition.CompositionSchema
-	})
-]);
+function literalStringValue(source) {
+	if (source.kind !== "expression") return null;
+	const compiled = require_composition.compileExpressionSafe(source.expr);
+	if (!compiled.ok) return null;
+	const ast = compiled.parsed.ast;
+	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
+}
 /**
-* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
-*
-* `name`: REQUIRED for a `new` target — the block's name IS the device's name
-* (D659). ABSENT for an `existing` target — a customization has no name of its
-* own; the server derives one (`customizationBlockName`, D663) and refuses a
-* client-sent name by name.
+* An enum target whose source is a save-time-KNOWN string literal outside its
+* `enumValues` is refused now rather than left to fail the write later. A
+* dynamic source (a `from` read, a non-literal expression) is left to
+* runtime — see {@link literalStringValue}.
 */
-var CompositionBlockInputSchema = zod.z.object({
-	name: zod.z.string().min(1).max(120).optional(),
-	enabled: zod.z.boolean(),
-	composition: require_composition.CompositionSchema
-});
-/** A stored block. */
-var CoreBlockSchema = CoreBlockInputSchema.extend({
-	id: zod.z.string(),
-	createdAt: zod.z.number(),
-	updatedAt: zod.z.number(),
-	/** Server-stamped author. */
-	createdBy: zod.z.string(),
-	status: CoreBlockStatusSchema,
-	/**
-	* Why the block is not running, when it is not. The operator's ONLY window
-	* into a block that failed at load — a block that is silently absent is the
-	* failure mode this whole feature has to avoid.
-	*/
-	lastError: zod.z.string().optional(),
-	/** Ms epoch of the last state change. */
-	lastChangedAt: zod.z.number(),
-	/** What the block is. Absent means `code` (D659). */
-	source: CoreBlockSourceSchema.optional()
-});
-function coreBlockSourceKind(block) {
-	return block.source?.kind ?? "code";
+function enumLiteralProblem(cap, target, source, at) {
+	if (target.kind !== "enum" || target.enumValues === void 0) return null;
+	const value = literalStringValue(source);
+	if (value === null || target.enumValues.includes(value)) return null;
+	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
+	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
 }
-function coreBlockComposition(block) {
-	return block.source?.kind === "composition" ? block.source.composition : null;
+function roleOf(source) {
+	if (source.kind !== "expression") return "derived";
+	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
+	if (require_composition.fieldReads(source).length > 0) return "derived";
+	const compiled = require_composition.compileExpressionSafe(source.expr);
+	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
 }
-/** What the composer said, or that it could not be asked. Unknown never looks like absent (D315). */
-var CompositionStateReadSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
-	kind: zod.z.literal("answered"),
-	state: CompositionBlockStateSchema.nullable()
-}), zod.z.object({
-	kind: zod.z.literal("unreachable"),
-	error: zod.z.string()
-})]);
-/** A stored composition block and what the composer says about it. */
-var CompositionViewSchema = zod.z.object({
-	block: CoreBlockSchema,
-	state: CompositionStateReadSchema
-});
 /**
-* A read of the stored compositions. `not-loaded` while the `core_blocks`
-* table has not been READ: an empty answer then would make "not yet known"
-* look like "none", and invite the operator to recreate what exists (D315).
+* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
+* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
+* own offline, and D393 forbids a stale number, so on an existing target a
+* field that READS a source never gets `offline`.
 */
-var CompositionsNotLoadedSchema = zod.z.object({
-	state: zod.z.literal("not-loaded"),
-	reason: zod.z.string()
-});
-var CompositionListReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
-	state: zod.z.literal("loaded"),
-	views: zod.z.array(CompositionViewSchema)
-}), CompositionsNotLoadedSchema]);
-var CompositionGetReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
-	state: zod.z.literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
-var CompositionCustomizationReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
-	state: zod.z.literal("loaded"),
-	view: CompositionViewSchema.nullable()
-}), CompositionsNotLoadedSchema]);
-/** What a compile attempt produced. */
-var CoreBlockCompileResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	/** Present when `ok` is false — the first error, in the author's words. */
-	error: zod.z.string().optional(),
-	line: zod.z.number().optional(),
-	column: zod.z.number().optional()
-});
-var coreBlocksCapability = {
-	name: "core-blocks",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		list: require_sleep.method(zod.z.object({}), zod.z.object({ blocks: zod.z.array(CoreBlockSchema) }), { auth: "admin" }),
-		get: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
-		/**
-		* Create a block. The code is COMPILED first: storing source that does not
-		* compile turns an editor error into a fork failure the operator meets
-		* minutes later in a log.
-		*/
-		create: require_sleep.method(zod.z.object({ block: CoreBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		update: require_sleep.method(zod.z.object({
-			blockId: zod.z.string(),
-			block: CoreBlockInputSchema.partial()
-		}), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		delete: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setEnabled: require_sleep.method(zod.z.object({
-			blockId: zod.z.string(),
-			enabled: zod.z.boolean()
-		}), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Stop this block's runner and let the supervisor bring it back.
-		*
-		* **It stores nothing.** There is no "restart requested" flag and no second
-		* lifecycle field: the supervisor already stops and respawns a runner when
-		* the code hash changes, and this exposes that same path deliberately
-		* (D62 — a switch writes the authority that already owned the function).
-		* The next reconcile pass remains the authority, so a restart that lost a
-		* race is corrected within one pass rather than leaving a stale flag behind.
-		*
-		* Refused for a DISABLED block: nothing would come back, and a button that
-		* silently does nothing is worse than one that says why.
-		*/
-		restart: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Type-check without saving — what the editor calls as the author types, so
-		* the compiler's verdict is the same one the server will reach.
-		*/
-		compile: require_sleep.method(zod.z.object({ code: zod.z.string() }), CoreBlockCompileResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* The declaration files the editor type-checks against.
-		*
-		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
-		* bundling it would roughly double the admin remote. Served rather than
-		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
-		* would drift and the editor would confidently autocomplete methods that
-		* do not exist.
-		*/
-		getTypeDefs: require_sleep.method(zod.z.object({}), zod.z.object({ libs: zod.z.array(zod.z.object({
-			filePath: zod.z.string(),
-			content: zod.z.string()
-		})) }), { auth: "admin" }),
-		/**
-		* Create a composition block (D659). VALIDATED first against the live
+function unavailableFor(tf, role, mode, cap, at) {
+	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
+		ok: true,
+		unavailable: "release"
+	};
+	if (mode === "new" || role !== "derived") return {
+		ok: true,
+		unavailable: tf.nullable ? "null" : "offline"
+	};
+	if (tf.nullable) return {
+		ok: true,
+		unavailable: "null"
+	};
+	if (tf.enumValues?.includes("unknown") === true) return {
+		ok: true,
+		unavailable: "unknown"
+	};
+	return {
+		ok: false,
+		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
+	};
+}
+//#endregion
+//#region src/composition/composition-items.ts
+/** Item fields the composer writes itself, with the value it writes. */
+var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
+function reservedItemFields(itemArray) {
+	return new Set([
+		itemArray.keyField,
+		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
+		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
+	]);
+}
+/** A required leaf under an optional parent is required only once something writes that parent. */
+function leafRequired(itemArray, path, written) {
+	const described = describeStateField(itemArray.itemSchema, path);
+	if (described === null || !described.required) return false;
+	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
+}
+function missingLeaves({ capName, itemArray, reserved }, item, at) {
+	const written = Object.keys(item.fields);
+	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
+		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
+		if (!leafRequired(itemArray, leaf.path, written)) return [];
+		const described = describeStateField(itemArray.itemSchema, leaf.path);
+		if (described === null || described.nullable) return [];
+		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
+	});
+}
+function planItemField(ctx, leaf) {
+	const { capName, itemArray, featureIndex, lookupCap } = ctx;
+	const { key, label, path, source } = leaf;
+	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
+	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
+	const tf = describeStateField(itemArray.itemSchema, path);
+	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: capName,
+		path,
+		item: {
+			arrayPath: itemArray.path,
+			key,
+			label
+		},
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...require_composition.fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(capName, tf, source, at);
+	return {
+		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
+	const at = `features[${featureIndex}].items`;
+	const itemArray = def.status?.itemArray;
+	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
+	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${require_composition.COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
+	const ctx = {
+		capName: def.name,
+		itemArray,
+		reserved: reservedItemFields(itemArray),
+		featureIndex,
+		lookupCap,
+		mode
+	};
+	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
+		problems: missingLeaves(ctx, item, `${at}.${key}`),
+		fields: [],
+		features: [],
+		events: []
+	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
+		key,
+		label: item.label,
+		path,
+		source
+	}))]);
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: [],
+		events: []
+	};
+}
+//#endregion
+//#region src/composition/composition-graph.ts
+/**
+* The field graph across every composition, and the cycles in it (D659).
+*
+* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
+* edge points from a composed field to each field it reads. A cycle, direct or
+* through another composition, is refused at save by name (spec §2).
+*
+* The graph is built for ONE save: the CANDIDATE composition (the one being
+* validated) plus every STORED composition. The candidate replaces its own old
+* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
+* introduces or removes a cycle must never depend on array order. A DIFFERENT
+* block targeting the candidate's device is refused by name: one composition
+* per device (D663). Two different stored peers that (wrongly) target the same
+* device are corrupted state, not a cycle to resolve by picking one silently;
+* that is refused by name too (D391).
+*
+* A customization of an EXISTING device reads that device's NATIVE value for a
+* field it replaces or does not write ("Invert state" reads the `on` it
+* replaces): such a self-read is no edge, so it is never a cycle (D663).
+* Another composition reading that field reads the customizer's output.
+*
+* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
+* marks a node `done` after its first expansion) — not every elementary cycle
+* through a shared node, so the path it names may AVOID the candidate while
+* one through it goes unreported. What a save refuses is therefore decided per
+* strongly connected component (`findCandidateCycles`, C-1). A dotted
+* `fieldPath` is matched only as an exact string: a write to `state.value` and
+* a read of `state` would not connect (no nested field writes exist yet).
+*
+* An item leaf is its own node, `…#consumables.items[desiccant].status`
+* (`featureFieldEntries`), so two items sharing an inner path never merge. No
+* READ can name an array element (`describeStateField` never describes one),
+* so an item node is write-only: its edges to sources are what the check needs.
+*/
+/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
+var CompositionGraphError = class extends Error {};
+/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
+function writtenFields(peer) {
+	return new Set(peer.composition.features.flatMap((feature) => !require_composition.compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : require_composition.featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
+}
+/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
+function readsComposedValue(peer, written, read) {
+	if (require_composition.compositionSourceKey(read.source) !== require_composition.compositionSourceKey(peer.target)) return true;
+	const field = `${read.cap}.${read.fieldPath}`;
+	return written.has(field) && peer.replaced?.has(field) !== true;
+}
+function peerEdges(peer) {
+	const written = writtenFields(peer);
+	return peer.composition.features.flatMap((feature) => !require_composition.compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : require_composition.featureFieldEntries(feature).map(({ fieldPath, source }) => [require_composition.compositionReadKey({
+		source: peer.target,
+		cap: feature.cap,
+		fieldPath
+	}), require_composition.fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(require_composition.compositionReadKey)]));
+}
+/**
+* Every peer that actually takes part in the graph: each stored peer minus the
+* candidate's own old version (same block id — the drop happens before any
+* edge is built, so its old edges never enter the map), plus the candidate
+* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
+* block targets the candidate's device, or two stored peers share a device.
+*/
+function resolvedPeers(candidate, stored) {
+	const candidateKey = require_composition.compositionSourceKey(candidate.target);
+	const survivors = /* @__PURE__ */ new Map();
+	for (const peer of stored) {
+		if (peer.blockId === candidate.blockId) continue;
+		const key = require_composition.compositionSourceKey(peer.target);
+		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
+		const clash = survivors.get(key);
+		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
+		survivors.set(key, peer);
+	}
+	return [...survivors.values(), candidate];
+}
+function compositionEdges(candidate, stored) {
+	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
+	return new Map(edges);
+}
+function findCompositionCycles(candidate, stored) {
+	const edges = compositionEdges(candidate, stored);
+	const marks = /* @__PURE__ */ new Map();
+	const found = /* @__PURE__ */ new Map();
+	const visit = (node, stack) => {
+		const mark = marks.get(node);
+		if (mark === "done") return;
+		if (mark === "visiting") {
+			const path = [...stack.slice(stack.indexOf(node)), node];
+			const id = [...new Set(path)].toSorted().join("|");
+			if (!found.has(id)) found.set(id, { path });
+			return;
+		}
+		marks.set(node, "visiting");
+		for (const next of edges.get(node) ?? []) visit(next, [...stack, node]);
+		marks.set(node, "done");
+	};
+	for (const node of edges.keys()) visit(node, []);
+	return [...found.values()];
+}
+/** Tarjan's strongly connected components over every node of the graph (sources included). */
+function stronglyConnected(edges) {
+	const index = /* @__PURE__ */ new Map();
+	const low = /* @__PURE__ */ new Map();
+	const onStack = /* @__PURE__ */ new Set();
+	const stack = [];
+	const components = [];
+	const connect = (node) => {
+		index.set(node, index.size);
+		low.set(node, index.get(node) ?? 0);
+		stack.push(node);
+		onStack.add(node);
+		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
+			connect(next);
+			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
+		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
+		if (low.get(node) !== index.get(node)) return;
+		const component = [];
+		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
+			onStack.delete(member);
+			component.push(member);
+			if (member === node) break;
+		}
+		components.push(component);
+	};
+	for (const node of edges.keys()) if (!index.has(node)) connect(node);
+	return components;
+}
+/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
+function cycleThrough(start, component, edges) {
+	const parent = /* @__PURE__ */ new Map();
+	const queue = [start];
+	for (let head = 0; head < queue.length; head += 1) {
+		const node = queue[head];
+		if (node === void 0) break;
+		for (const next of edges.get(node) ?? []) {
+			if (next === start) {
+				const chain = [];
+				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
+				return [
+					start,
+					...chain.reverse(),
+					start
+				];
+			}
+			if (!component.has(next) || parent.has(next)) continue;
+			parent.set(next, node);
+			queue.push(next);
+		}
+	}
+	return [start, start];
+}
+/**
+* The cycles THIS save closes, decided per strongly connected component — never
+* per reported DFS path, which names one back-edge per revisit and can report a
+* component's cycle by a path that avoids the candidate while the one through it
+* goes unreported. A component refuses when it holds a candidate node and a
+* cycle (more than one node, or a self-loop). Components without a candidate
+* node are not this save's cycles.
+*/
+function findCandidateCycles(candidate, stored) {
+	const edges = compositionEdges(candidate, stored);
+	const prefix = `${require_composition.compositionSourceKey(candidate.target)}#`;
+	return stronglyConnected(edges).flatMap((members) => {
+		const start = members.find((n) => n.startsWith(prefix));
+		if (start === void 0) return [];
+		const component = new Set(members);
+		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
+		if (members.length === 1 && !selfLoop) return [];
+		return [{
+			path: cycleThrough(start, component, edges),
+			component
+		}];
+	});
+}
+//#endregion
+//#region src/composition/validate-composition.ts
+function buildCapabilityLookup(defs) {
+	const byName = new Map(defs.map((d) => [d.name, d]));
+	return (capName) => byName.get(capName) ?? null;
+}
+/** Caps every `BaseDevice` registers on itself; a second registration throws. */
+var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
+var PENDING_SELF = {
+	addonId: require_composition.COMPOSER_ADDON_ID,
+	stableId: `${require_composition.COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
+};
+/** The candidate's block id before its first save. Stored block ids are `randomUUID()`, so none can carry it. */
+var PENDING_BLOCK_ID = "(unsaved)";
+function composableCap(feature, at, lookupCap) {
+	const def = lookupCap(feature.cap);
+	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
+	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
+	return {
+		def,
+		state,
+		fields: describeTopLevelStateFields(state)
+	};
+}
+/**
+* A capability BUILT by the composition (a new device, or one ADDED to an
+* existing device) must fit the device type, serve no command, and have every
+* required field. A REPLACE needs none of it: the cap is bound (a fact), the
+* native keeps serving its methods, and only the named fields are owned (D663).
+*/
+function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
+	const problems = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
+	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
+	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
+	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
+	for (const key of requiredTopLevelKeys(state)) {
+		if (key === itemArrayPath) continue;
+		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
+		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
+	}
+	return problems;
+}
+function planTopLevelField({ def, fields }, field, mode, lookupCap) {
+	const { featureIndex, path, source } = field;
+	const fieldAt = `features[${featureIndex}].fields.${path}`;
+	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
+	const tf = fields.get(path);
+	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
+	const kinds = sourceKinds(source, lookupCap);
+	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
+	const role = roleOf(source);
+	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
+	if (!unavailable.ok) return refused(unavailable.problem);
+	const plan = {
+		cap: def.name,
+		path,
+		featureIndex,
+		kind: tf.kind,
+		nullable: tf.nullable,
+		required: tf.required,
+		unavailable: unavailable.unavailable,
+		role,
+		source,
+		reads: [...require_composition.fieldReads(source)]
+	};
+	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
+	return {
+		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
+		fields: [plan],
+		features: [],
+		events: []
+	};
+}
+function planFeature(feature, featureIndex, target, lookupCap) {
+	const at = `features[${featureIndex}]`;
+	const cap = composableCap(feature, at, lookupCap);
+	if ("code" in cap) return refused(cap);
+	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
+	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
+	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
+		featureIndex,
+		path,
+		source
+	}, target.mode, lookupCap));
+	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
+	const all = [...perField, ...items];
+	const fields = all.flatMap((result) => result.fields);
+	const featurePlan = {
+		featureIndex,
+		cap: cap.def.name,
+		mode: target.mode
+	};
+	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
+	return {
+		problems: [
+			...capProblems,
+			...all.flatMap((r) => r.problems),
+			...eventPlan.problems
+		],
+		fields,
+		features: [featurePlan],
+		events: eventPlan.events
+	};
+}
+/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
+function isNativeCap(target, cap) {
+	const owner = target.nativeCaps.get(cap);
+	return owner !== void 0 && owner !== "composer";
+}
+/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
+function planTargetOf(composition, target) {
+	if (composition.target.kind === "new") return {
+		kind: "new",
+		type: composition.target.type
+	};
+	const key = require_composition.compositionSourceKey(composition.target.device);
+	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
+	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
+	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
+	return {
+		kind: "existing",
+		found: target
+	};
+}
+function featureTargetOf(target, cap) {
+	if (target.kind === "new") return {
+		mode: "new",
+		deviceType: target.type
+	};
+	return {
+		mode: isNativeCap(target.found, cap) ? "replace" : "add",
+		deviceType: target.found.type
+	};
+}
+/**
+* The static plan. `target` describes an EXISTING target device (one read);
+* it is ignored for a new one. On an existing target each feature REPLACES a
+* cap the device has natively, else ADDS it (D663).
+*/
+function planComposition(composition, lookupCap, target) {
+	const planTarget = planTargetOf(composition, target);
+	if ("code" in planTarget) return refused(planTarget);
+	const results = composition.features.map((feature, index) => {
+		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
+		return require_composition.compositionFeatureEnabled(feature) ? result : {
+			problems: result.problems,
+			fields: [],
+			features: [],
+			events: []
+		};
+	});
+	return {
+		problems: results.flatMap((r) => r.problems),
+		fields: results.flatMap((r) => r.fields),
+		features: results.flatMap((r) => r.features),
+		events: results.flatMap((r) => r.events)
+	};
+}
+function compositionSourceRefs(composition) {
+	const refs = composition.features.flatMap((f) => require_composition.compositionFeatureEnabled(f) && f.kind === "fields" ? require_composition.featureSources(f).flatMap(require_composition.fieldReads).map((r) => r.source) : []);
+	return [...new Map(refs.map((r) => [require_composition.compositionSourceKey(r), r])).values()];
+}
+/**
+* The candidate's device: the existing target itself, else `self`, else a
+* placeholder that cannot collide with a stored target. An existing target is
+* known even on create, so a second customization of it is refused on create too.
+*/
+function candidateSelf(composition, ctx, plan) {
+	return {
+		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
+		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
+		replaced: replacedFieldKeys(plan)
+	};
+}
+/**
+* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
+* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
+* derivation, so the graph reads both the same way.
+*/
+function replacedFieldKeys(plan) {
+	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
+	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
+}
+/**
+* A read of the candidate's own device. Its own composed output (a new device's
+* field, an ADDED field) is the slice-1 own-field rule; on an existing target
+* every other field — replaced, or not composed at all — is the NATIVE value,
+* valid when the device serves that cap natively (D663, rule 5).
+*/
+function selfReadProblems(read, at, fields, self) {
+	const readKey = `${read.cap}.${read.fieldPath}`;
+	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
+	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
+	if (isNativeCap(self.native, read.cap)) return [];
+	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
+}
+function sourceProblems(fields, ctx, self) {
+	const selfKey = require_composition.compositionSourceKey(self.ref);
+	return fields.flatMap((field) => field.reads.flatMap((read) => {
+		const at = compositionFieldAt(field);
+		const key = require_composition.compositionSourceKey(read.source);
+		if (key === selfKey) return selfReadProblems(read, at, fields, self);
+		const desc = ctx.sources.get(key);
+		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
+		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
+		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
+		return [];
+	}));
+}
+/**
+* A cycle's node keys are `compositionReadKey` strings:
+* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
+* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
+* back out so the refusal can point at that exact field, matching the
+* documented `features[N].fields.<path>` convention. A cap name has no `.`,
+* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
+* (`items[desiccant].status`) is matched through `compositionFieldKey`.
+*/
+function candidateFieldOfNode(nodeKey, candidateKey) {
+	const prefix = `${candidateKey}#`;
+	if (!nodeKey.startsWith(prefix)) return null;
+	const rest = nodeKey.slice(prefix.length);
+	const dot = rest.indexOf(".");
+	if (dot === -1) return null;
+	return {
+		cap: rest.slice(0, dot),
+		fieldPath: rest.slice(dot + 1)
+	};
+}
+/** The first node of a cycle's path that is one of THIS composition's own
+*  planned fields, as a documented-convention path; `'features'` when the
+*  cycle runs entirely through other stored compositions. */
+function cyclePath(nodePath, candidateKey, fields) {
+	for (const nodeKey of nodePath) {
+		const hit = candidateFieldOfNode(nodeKey, candidateKey);
+		if (hit === null) continue;
+		const hitKey = `${hit.cap}.${hit.fieldPath}`;
+		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
+		if (field !== void 0) return compositionFieldAt(field);
+	}
+	return "features";
+}
+/** The first unread device any of `nodes` belongs to; null when none does. */
+function unreadDeviceOf(nodes, unread) {
+	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
+		key,
+		error
+	};
+	return null;
+}
+/**
+* Cycle check runs against the CANDIDATE (this composition, as block
+* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
+* decided per strongly connected component (`findCandidateCycles`): a cyclic
+* component holding a candidate node refuses, with one representative cycle
+* through it; one without is not this save's cycle. A
+* stored composition of the same block is its old version; another block on
+* the same device, or two stored peers sharing a device, make
+* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
+* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
+*/
+function cycleProblems(composition, ctx, fields, self) {
+	const candidate = {
+		blockId: ctx.blockId ?? "(unsaved)",
+		target: self.ref,
+		composition,
+		replaced: self.replaced
+	};
+	const candidateKey = require_composition.compositionSourceKey(candidate.target);
+	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
+	try {
+		return findCandidateCycles(candidate, ctx.peers).map((c) => {
+			const at = cyclePath(c.path, candidateKey, fields);
+			const through = unreadDeviceOf([...c.component], unread);
+			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
+		});
+	} catch (err) {
+		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
+		throw err;
+	}
+}
+function validateComposition(composition, ctx) {
+	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
+	const self = candidateSelf(composition, ctx, plan);
+	const cycles = cycleProblems(composition, ctx, plan.fields, self);
+	const problems = [
+		...plan.problems,
+		...sourceProblems(plan.fields, ctx, self),
+		...cycles
+	];
+	return {
+		ok: problems.length === 0,
+		problems,
+		fields: [...plan.fields],
+		features: [...plan.features],
+		events: [...plan.events]
+	};
+}
+//#endregion
+//#region src/composition/composable-caps.ts
+/**
+* What a composition may BUILD on a device type (G2, D676): the caps a new
+* device of that type, or an existing one that lacks them, can be given. The
+* blockers are the validator's own refusal codes, and a spec compares this
+* listing with `planComposition` for every capability — the editor can never
+* offer a feature the save would refuse for the same reason.
+*/
+var ComposableFieldSchema = zod.z.object({
+	path: zod.z.string(),
+	kind: CompositionFieldKindSchema,
+	nullable: zod.z.boolean(),
+	required: zod.z.boolean(),
+	enumValues: zod.z.array(zod.z.string()).optional()
+});
+var ComposableCapabilitySchema = zod.z.object({
+	cap: zod.z.string(),
+	fields: zod.z.array(ComposableFieldSchema),
+	/** Present for an item-array cap (`consumables.items`). */
+	itemArray: zod.z.object({
+		path: zod.z.string(),
+		keyField: zod.z.string()
+	}).optional()
+});
+var ComposableCapabilitiesSchema = zod.z.object({ caps: zod.z.array(ComposableCapabilitySchema) });
+/** Why a cap cannot be BUILT (new device, or added to an existing one) on `deviceType`; [] = it can. */
+function builtCapabilityBlockers(def, deviceType) {
+	if (BASE_DEVICE_CAPS.has(def.name)) return ["not-composable"];
+	const state = def.runtimeState;
+	if (def.scope !== "device" || state === void 0) return ["not-composable"];
+	const blockers = [];
+	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) blockers.push("wrong-device-type");
+	if (Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).length > 0) blockers.push("has-commands");
+	const fields = describeTopLevelStateFields(state);
+	const itemArrayPath = def.status?.itemArray?.path ?? null;
+	if (requiredTopLevelKeys(state).some((key) => key !== itemArrayPath && !fields.has(key))) blockers.push("not-composable");
+	if (planCompositionEvents(def, {
+		featureIndex: 0,
+		cap: def.name,
+		mode: "new"
+	}, []).problems.some((p) => p.code === "not-composable") && !blockers.includes("not-composable")) blockers.push("not-composable");
+	return blockers;
+}
+/** Every cap with no blocker, sorted by name. */
+function describeComposableCaps(defs, deviceType) {
+	return defs.filter((def) => builtCapabilityBlockers(def, deviceType).length === 0).map((def) => {
+		const state = def.runtimeState;
+		const fields = state === void 0 ? [] : [...describeTopLevelStateFields(state).values()];
+		const itemArray = def.status?.itemArray;
+		return {
+			cap: def.name,
+			fields: fields.map((f) => ({
+				path: f.path,
+				kind: f.kind,
+				nullable: f.nullable,
+				required: f.required,
+				...f.enumValues === void 0 ? {} : { enumValues: [...f.enumValues] }
+			})),
+			...itemArray === void 0 ? {} : { itemArray: {
+				path: itemArray.path,
+				keyField: itemArray.keyField
+			} }
+		};
+	}).toSorted((a, b) => a.cap.localeCompare(b.cap));
+}
+//#endregion
+//#region src/capabilities/core-blocks.cap.ts
+/**
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/**
+* Prefix for a block's generated addon id AND its runner id — one addon, one
+* process, so the two are the same string (D2).
+*
+* It lives on the CONTRACT rather than beside the code that materialises the
+* package, because it is not an implementation detail: the operator surface
+* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
+* with no cap and no store of its own. Two copies of this string is one copy
+* too many — a drift would show as a logs pane that is simply always empty.
+*/
+var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/**
+* The builtin's own addon id — and, because of that, the OWNER of the
+* integration every block's devices hang from.
+*
+* A block cannot own one. Every integration read is gated on the installed-addon
+* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
+* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
+* null forever while the write succeeds — one invisible, undeletable row per
+* start. `core-blocks` IS installed, so it reconciles one shared integration and
+* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
+*
+* Exported from the contract, next to the runner prefix and for the same reason:
+* a block reads it as
+* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
+* so a second copy of the string is a block that silently declares into nowhere.
+*/
+var CORE_BLOCKS_ADDON_ID = "core-blocks";
+/** The addon/runner id a block's process runs under. */
+function coreBlockAddonId(blockId) {
+	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+}
+/** The block id behind a generated addon/runner id, or null when the id belongs
+*  to something else. The inverse of {@link coreBlockAddonId}. */
+function coreBlockIdFromAddonId(addonId) {
+	if (!addonId.startsWith("core-block-")) return null;
+	const rest = addonId.slice(11);
+	return rest.length > 0 ? rest : null;
+}
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = zod.z.union([zod.z.literal("hub"), zod.z.string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
+var CoreBlockStatusSchema = zod.z.enum([
+	"stopped",
+	"starting",
+	"running",
+	"degraded",
+	"failed"
+]);
+/** Client-authored fields. */
+var CoreBlockInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: zod.z.string().max(2e5),
+	enabled: zod.z.boolean(),
+	placement: CoreBlockPlacementSchema,
+	/**
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
+	*/
+	integrationId: zod.z.string().optional()
+});
+/**
+* What a block IS (D659). Absent means `code` — every row stored before this
+* union keeps working unchanged.
+*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
+*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
+*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+*/
+var CoreBlockSourceSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({ kind: zod.z.literal("code") }),
+	zod.z.object({
+		kind: zod.z.literal("recipe"),
+		recipe: AutomationRecipeSchema
+	}),
+	zod.z.object({
+		kind: zod.z.literal("composition"),
+		composition: require_composition.CompositionSchema
+	})
+]);
+/**
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
+*
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
+*/
+var CompositionBlockInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(120).optional(),
+	enabled: zod.z.boolean(),
+	composition: require_composition.CompositionSchema
+});
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
+	id: zod.z.string(),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number(),
+	/** Server-stamped author. */
+	createdBy: zod.z.string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: zod.z.string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: zod.z.number(),
+	/** What the block is. Absent means `code` (D659). */
+	source: CoreBlockSourceSchema.optional()
+});
+function coreBlockSourceKind(block) {
+	return block.source?.kind ?? "code";
+}
+function coreBlockComposition(block) {
+	return block.source?.kind === "composition" ? block.source.composition : null;
+}
+/** What the composer said, or that it could not be asked. Unknown never looks like absent (D315). */
+var CompositionStateReadSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("answered"),
+	state: CompositionBlockStateSchema.nullable()
+}), zod.z.object({
+	kind: zod.z.literal("unreachable"),
+	error: zod.z.string()
+})]);
+/** A stored composition block and what the composer says about it. */
+var CompositionViewSchema = zod.z.object({
+	block: CoreBlockSchema,
+	state: CompositionStateReadSchema
+});
+/**
+* A read of the stored compositions. `not-loaded` while the `core_blocks`
+* table has not been READ: an empty answer then would make "not yet known"
+* look like "none", and invite the operator to recreate what exists (D315).
+*/
+var CompositionsNotLoadedSchema = zod.z.object({
+	state: zod.z.literal("not-loaded"),
+	reason: zod.z.string()
+});
+var CompositionListReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("loaded"),
+	views: zod.z.array(CompositionViewSchema)
+}), CompositionsNotLoadedSchema]);
+var CompositionGetReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
+	error: zod.z.string().optional(),
+	line: zod.z.number().optional(),
+	column: zod.z.number().optional()
+});
+var coreBlocksCapability = {
+	name: "core-blocks",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		list: require_sleep.method(zod.z.object({}), zod.z.object({ blocks: zod.z.array(CoreBlockSchema) }), { auth: "admin" }),
+		get: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }),
+		/**
+		* Create a block. The code is COMPILED first: storing source that does not
+		* compile turns an editor error into a fork failure the operator meets
+		* minutes later in a log.
+		*/
+		create: require_sleep.method(zod.z.object({ block: CoreBlockInputSchema }), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		update: require_sleep.method(zod.z.object({
+			blockId: zod.z.string(),
+			block: CoreBlockInputSchema.partial()
+		}), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		delete: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setEnabled: require_sleep.method(zod.z.object({
+			blockId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stop this block's runner and let the supervisor bring it back.
+		*
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
+		*
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
+		*/
+		restart: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Type-check without saving — what the editor calls as the author types, so
+		* the compiler's verdict is the same one the server will reach.
+		*/
+		compile: require_sleep.method(zod.z.object({ code: zod.z.string() }), CoreBlockCompileResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The declaration files the editor type-checks against.
+		*
+		* Served rather than bundled: the graph is 3.4 MB across 344 files, and
+		* bundling it would roughly double the admin remote. Served rather than
+		* hand-stubbed: a block runs with the same `ctx` an addon gets, so a stub
+		* would drift and the editor would confidently autocomplete methods that
+		* do not exist.
+		*/
+		getTypeDefs: require_sleep.method(zod.z.object({}), zod.z.object({ libs: zod.z.array(zod.z.object({
+			filePath: zod.z.string(),
+			content: zod.z.string()
+		})) }), { auth: "admin" }),
+		/**
+		* Create a composition block (D659). VALIDATED first against the live
 		* sources and every stored composition; a refusal names every problem by
 		* path and reason (D391) and stores nothing.
 		*/
@@ -10065,6 +11016,14 @@ var coreBlocksCapability = {
 			stableId: zod.z.string().min(1)
 		}), CompositionCustomizationReadSchema, { auth: "admin" }),
 		/**
+		* The capabilities a composition may BUILD on a device of `deviceType`
+		* (a new device, or added to an existing one), with their fields — the
+		* editor's feature list and the presets' availability (G2, D676). Built
+		* from the validator's own blockers; a replace of a BOUND cap is not
+		* listed here (the device's bindings say what it has).
+		*/
+		listComposableCaps: require_sleep.method(zod.z.object({ deviceType: zod.z.enum(require_err_msg.DeviceType) }), ComposableCapabilitiesSchema, { auth: "admin" }),
+		/**
 		* Validate without saving — the same verdict the save reaches. A mutation
 		* for its body size; it writes nothing, so its access is `view`.
 		*/
@@ -26288,6 +27247,16 @@ var NodeInferenceDevicesSchema = zod.z.object({
 * Strictly the control plane: never sees a frame, never calls inference,
 * never drains queues. The runner does that work locally on each agent.
 */
+/**
+* The input of `setCameraSensors` (G5, D676): the ONE typed write path of a
+* camera's attached sensors (D672). `config: null` removes the attachment —
+* the camera reads `not-configured` again, never `unreadable`.
+*/
+var SetCameraSensorsInputSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	/** `null` removes the attachment: the camera goes back to `not-configured`. */
+	config: CameraSensorsConfigSchema.nullable()
+});
 var pipelineOrchestratorCapability = {
 	name: "pipeline-orchestrator",
 	scope: "system",
@@ -26753,6 +27722,18 @@ var pipelineOrchestratorCapability = {
 		*/
 		getCameraStatuses: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.array(CameraStatusSchema).readonly()),
 		/**
+		* Attach sensors to a camera, or detach them with `config: null` (D672
+		* configuration, G5/D676). Written to the orchestrator's per-device store
+		* under the same key `applyDeviceSettingsPatch` writes, and announced as a
+		* settings change so the camera-sensors bridge refreshes. Refused by name
+		* — nothing written — for a device that cannot be read, does not exist,
+		* is not a camera, or names itself as its own sensor.
+		*/
+		setCameraSensors: require_sleep.method(SetCameraSensorsInputSchema, zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Disk-wins fleet reconcile after a recordings wipe. Starts the walk in
 		* the addon process and returns immediately with the job snapshot — the
 		* work outlives the tRPC/UDS 60s timeout. Poll `getReconcileFromDiskStatus`.
@@ -44658,569 +45639,366 @@ function createDeviceExtensionProvider(options) {
 	};
 }
 //#endregion
-//#region src/composition/composition-graph.ts
-/**
-* The field graph across every composition, and the cycles in it (D659).
-*
-* A node is ONE field of ONE device (`<addon>/<stableId>#<cap>.<field>`); an
-* edge points from a composed field to each field it reads. A cycle, direct or
-* through another composition, is refused at save by name (spec §2).
-*
-* The graph is built for ONE save: the CANDIDATE composition (the one being
-* validated) plus every STORED composition. The candidate replaces its own old
-* version, identified BY BLOCK ID wherever it sits in `stored` — whether a save
-* introduces or removes a cycle must never depend on array order. A DIFFERENT
-* block targeting the candidate's device is refused by name: one composition
-* per device (D663). Two different stored peers that (wrongly) target the same
-* device are corrupted state, not a cycle to resolve by picking one silently;
-* that is refused by name too (D391).
-*
-* A customization of an EXISTING device reads that device's NATIVE value for a
-* field it replaces or does not write ("Invert state" reads the `on` it
-* replaces): such a self-read is no edge, so it is never a cycle (D663).
-* Another composition reading that field reads the customizer's output.
-*
-* `findCompositionCycles` reports at least one cycle per cycle-SET (the DFS
-* marks a node `done` after its first expansion) — not every elementary cycle
-* through a shared node, so the path it names may AVOID the candidate while
-* one through it goes unreported. What a save refuses is therefore decided per
-* strongly connected component (`findCandidateCycles`, C-1). A dotted
-* `fieldPath` is matched only as an exact string: a write to `state.value` and
-* a read of `state` would not connect (no nested field writes exist yet).
-*
-* An item leaf is its own node, `…#consumables.items[desiccant].status`
-* (`featureFieldEntries`), so two items sharing an inner path never merge. No
-* READ can name an array element (`describeStateField` never describes one),
-* so an item node is write-only: its edges to sources are what the check needs.
-*/
-/** Two blocks' compositions target the same device — refused by name, never silently resolved. */
-var CompositionGraphError = class extends Error {};
-/** `"cap.field"` of every field a peer writes — the same spelling as `compositionFieldKey`. */
-function writtenFields(peer) {
-	return new Set(peer.composition.features.flatMap((feature) => !require_composition.compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : require_composition.featureFieldEntries(feature).map(({ fieldPath }) => `${feature.cap}.${fieldPath}`)));
-}
-/** A read of the peer's OWN device is an edge only when it reads the peer's own output (rule 5, D663). */
-function readsComposedValue(peer, written, read) {
-	if (require_composition.compositionSourceKey(read.source) !== require_composition.compositionSourceKey(peer.target)) return true;
-	const field = `${read.cap}.${read.fieldPath}`;
-	return written.has(field) && peer.replaced?.has(field) !== true;
-}
-function peerEdges(peer) {
-	const written = writtenFields(peer);
-	return peer.composition.features.flatMap((feature) => !require_composition.compositionFeatureEnabled(feature) || feature.kind !== "fields" ? [] : require_composition.featureFieldEntries(feature).map(({ fieldPath, source }) => [require_composition.compositionReadKey({
-		source: peer.target,
-		cap: feature.cap,
-		fieldPath
-	}), require_composition.fieldReads(source).filter((read) => readsComposedValue(peer, written, read)).map(require_composition.compositionReadKey)]));
-}
-/**
-* Every peer that actually takes part in the graph: each stored peer minus the
-* candidate's own old version (same block id — the drop happens before any
-* edge is built, so its old edges never enter the map), plus the candidate
-* itself, exactly once. Throws {@link CompositionGraphError} when a DIFFERENT
-* block targets the candidate's device, or two stored peers share a device.
-*/
-function resolvedPeers(candidate, stored) {
-	const candidateKey = require_composition.compositionSourceKey(candidate.target);
-	const survivors = /* @__PURE__ */ new Map();
-	for (const peer of stored) {
-		if (peer.blockId === candidate.blockId) continue;
-		const key = require_composition.compositionSourceKey(peer.target);
-		if (key === candidateKey) throw new CompositionGraphError(`block \`${peer.blockId}\` and block \`${candidate.blockId}\` both target device \`${key}\` — one composition per device; delete or edit the existing one`);
-		const clash = survivors.get(key);
-		if (clash !== void 0) throw new CompositionGraphError(`two stored compositions (\`${clash.blockId}\`, \`${peer.blockId}\`) both target device \`${key}\` — refusing to build the field graph`);
-		survivors.set(key, peer);
-	}
-	return [...survivors.values(), candidate];
-}
-function compositionEdges(candidate, stored) {
-	const edges = resolvedPeers(candidate, stored).flatMap(peerEdges);
-	return new Map(edges);
-}
-function findCompositionCycles(candidate, stored) {
-	const edges = compositionEdges(candidate, stored);
-	const marks = /* @__PURE__ */ new Map();
-	const found = /* @__PURE__ */ new Map();
-	const visit = (node, stack) => {
-		const mark = marks.get(node);
-		if (mark === "done") return;
-		if (mark === "visiting") {
-			const path = [...stack.slice(stack.indexOf(node)), node];
-			const id = [...new Set(path)].toSorted().join("|");
-			if (!found.has(id)) found.set(id, { path });
-			return;
-		}
-		marks.set(node, "visiting");
-		for (const next of edges.get(node) ?? []) visit(next, [...stack, node]);
-		marks.set(node, "done");
-	};
-	for (const node of edges.keys()) visit(node, []);
-	return [...found.values()];
-}
-/** Tarjan's strongly connected components over every node of the graph (sources included). */
-function stronglyConnected(edges) {
-	const index = /* @__PURE__ */ new Map();
-	const low = /* @__PURE__ */ new Map();
-	const onStack = /* @__PURE__ */ new Set();
-	const stack = [];
-	const components = [];
-	const connect = (node) => {
-		index.set(node, index.size);
-		low.set(node, index.get(node) ?? 0);
-		stack.push(node);
-		onStack.add(node);
-		for (const next of edges.get(node) ?? []) if (!index.has(next)) {
-			connect(next);
-			low.set(node, Math.min(low.get(node) ?? 0, low.get(next) ?? 0));
-		} else if (onStack.has(next)) low.set(node, Math.min(low.get(node) ?? 0, index.get(next) ?? 0));
-		if (low.get(node) !== index.get(node)) return;
-		const component = [];
-		for (let member = stack.pop(); member !== void 0; member = stack.pop()) {
-			onStack.delete(member);
-			component.push(member);
-			if (member === node) break;
-		}
-		components.push(component);
-	};
-	for (const node of edges.keys()) if (!index.has(node)) connect(node);
-	return components;
-}
-/** The shortest walk from `start` back to itself inside `component` (one exists: the component has a cycle). */
-function cycleThrough(start, component, edges) {
-	const parent = /* @__PURE__ */ new Map();
-	const queue = [start];
-	for (let head = 0; head < queue.length; head += 1) {
-		const node = queue[head];
-		if (node === void 0) break;
-		for (const next of edges.get(node) ?? []) {
-			if (next === start) {
-				const chain = [];
-				for (let at = node; at !== void 0 && at !== start; at = parent.get(at)) chain.push(at);
-				return [
-					start,
-					...chain.reverse(),
-					start
-				];
-			}
-			if (!component.has(next) || parent.has(next)) continue;
-			parent.set(next, node);
-			queue.push(next);
-		}
-	}
-	return [start, start];
-}
+//#region src/units/unit-table.ts
 /**
-* The cycles THIS save closes, decided per strongly connected component — never
-* per reported DFS path, which names one back-edge per revisit and can report a
-* component's cycle by a path that avoids the candidate while the one through it
-* goes unreported. A component refuses when it holds a candidate node and a
-* cycle (more than one node, or a self-loop). Components without a candidate
-* node are not this save's cycles.
+* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
+* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
+* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
+* decimals). K derives from `°C = K − 273.15`.
 */
-function findCandidateCycles(candidate, stored) {
-	const edges = compositionEdges(candidate, stored);
-	const prefix = `${require_composition.compositionSourceKey(candidate.target)}#`;
-	return stronglyConnected(edges).flatMap((members) => {
-		const start = members.find((n) => n.startsWith(prefix));
-		if (start === void 0) return [];
-		const component = new Set(members);
-		const selfLoop = members.length === 1 && (edges.get(start) ?? []).includes(start);
-		if (members.length === 1 && !selfLoop) return [];
-		return [{
-			path: cycleThrough(start, component, edges),
-			component
-		}];
-	});
-}
-//#endregion
-//#region src/composition/plan-result.ts
-function problem(code, path, message) {
-	return {
-		code,
-		path,
-		message
-	};
-}
-function refused(...problems) {
-	return {
-		problems,
-		fields: [],
-		features: [],
-		events: []
-	};
-}
-/** Where a planned field sits in the composition: `features[N].fields.<path>` or `features[N].items.<key>.fields.<path>`. */
-function compositionFieldAt(field) {
-	const inner = field.item === void 0 ? "fields" : `items.${field.item.key}.fields`;
-	return `features[${field.featureIndex}].${inner}.${field.path}`;
-}
-//#endregion
-//#region src/composition/expression-kinds.ts
-var NUMBER = {
-	kind: "fixed",
-	result: ["number"]
-};
-var BOOLEAN = {
-	kind: "fixed",
-	result: ["boolean"]
-};
-/** One rule per builtin. `expression-kinds.spec.ts` fails for a builtin missing here. */
-var BUILTIN_RESULT_KINDS = Object.freeze({
-	min: NUMBER,
-	max: NUMBER,
-	abs: NUMBER,
-	floor: NUMBER,
-	ceil: NUMBER,
-	sqrt: NUMBER,
-	round: NUMBER,
-	pow: NUMBER,
-	clamp: NUMBER,
-	avg: NUMBER,
-	sum: NUMBER,
-	age: NUMBER,
-	convert: NUMBER,
-	coalesce: { kind: "coalesce" },
-	any: BOOLEAN,
-	all: BOOLEAN,
-	within: BOOLEAN,
-	latest: {
-		kind: "fixed",
-		result: ["number", "null"]
+var UNIT_TABLE = {
+	"°C": {
+		dimension: "temperature",
+		factor: 1,
+		offset: 0
+	},
+	"°F": {
+		dimension: "temperature",
+		factor: 5 / 9,
+		offset: -160 / 9
+	},
+	K: {
+		dimension: "temperature",
+		factor: 1,
+		offset: -273.15
+	},
+	hPa: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	kPa: {
+		dimension: "pressure",
+		factor: 10,
+		offset: 0
+	},
+	Pa: {
+		dimension: "pressure",
+		factor: .01,
+		offset: 0
+	},
+	mbar: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	bar: {
+		dimension: "pressure",
+		factor: 1e3,
+		offset: 0
+	},
+	inHg: {
+		dimension: "pressure",
+		factor: 33.8639,
+		offset: 0
+	},
+	mmHg: {
+		dimension: "pressure",
+		factor: 1.33322,
+		offset: 0
+	},
+	psi: {
+		dimension: "pressure",
+		factor: 68.9476,
+		offset: 0
+	},
+	"m/s": {
+		dimension: "speed",
+		factor: 1,
+		offset: 0
+	},
+	"km/h": {
+		dimension: "speed",
+		factor: 1 / 3.6,
+		offset: 0
+	},
+	mph: {
+		dimension: "speed",
+		factor: .44704,
+		offset: 0
+	},
+	kn: {
+		dimension: "speed",
+		factor: .514444,
+		offset: 0
+	},
+	"mm/h": {
+		dimension: "precipitation-rate",
+		factor: 1,
+		offset: 0
+	},
+	"in/h": {
+		dimension: "precipitation-rate",
+		factor: 25.4,
+		offset: 0
+	},
+	m: {
+		dimension: "length",
+		factor: 1,
+		offset: 0
+	},
+	mm: {
+		dimension: "length",
+		factor: .001,
+		offset: 0
+	},
+	cm: {
+		dimension: "length",
+		factor: .01,
+		offset: 0
+	},
+	km: {
+		dimension: "length",
+		factor: 1e3,
+		offset: 0
 	},
-	number: {
-		kind: "fixed",
-		result: ["number", "null"]
+	in: {
+		dimension: "length",
+		factor: .0254,
+		offset: 0
 	},
-	rose: {
-		kind: "fixed",
-		result: ["number", "null"]
+	ft: {
+		dimension: "length",
+		factor: .3048,
+		offset: 0
 	},
-	count: NUMBER
-});
-var KindInferenceError = class extends Error {};
-function kindOfValue(value) {
-	if (value === null) return "null";
-	if (typeof value === "number") return "number";
-	if (typeof value === "string") return "string";
-	return "boolean";
-}
-function only(kind) {
-	return new Set([kind]);
-}
-function union(...sets) {
-	return new Set(sets.flatMap((s) => [...s]));
-}
-function withoutNull(set) {
-	return new Set([...set].filter((k) => k !== "null"));
-}
-function binaryKinds(op, left, right) {
-	if (op === "+") {
-		const all = [...left, ...right];
-		if (all.every((k) => k === "string")) return only("string");
-		if (all.every((k) => k === "number")) return only("number");
-		return new Set(["number", "string"]);
+	mi: {
+		dimension: "length",
+		factor: 1609.344,
+		offset: 0
+	},
+	lx: {
+		dimension: "illuminance",
+		factor: 1,
+		offset: 0
+	},
+	"W/m²": {
+		dimension: "irradiance",
+		factor: 1,
+		offset: 0
+	},
+	W: {
+		dimension: "power",
+		factor: 1,
+		offset: 0
+	},
+	kW: {
+		dimension: "power",
+		factor: 1e3,
+		offset: 0
+	},
+	VA: {
+		dimension: "apparent-power",
+		factor: 1,
+		offset: 0
+	},
+	Wh: {
+		dimension: "energy",
+		factor: 1,
+		offset: 0
+	},
+	kWh: {
+		dimension: "energy",
+		factor: 1e3,
+		offset: 0
+	},
+	MWh: {
+		dimension: "energy",
+		factor: 1e6,
+		offset: 0
+	},
+	V: {
+		dimension: "voltage",
+		factor: 1,
+		offset: 0
+	},
+	mV: {
+		dimension: "voltage",
+		factor: .001,
+		offset: 0
+	},
+	A: {
+		dimension: "current",
+		factor: 1,
+		offset: 0
+	},
+	mA: {
+		dimension: "current",
+		factor: .001,
+		offset: 0
+	},
+	ppm: {
+		dimension: "concentration-volume",
+		factor: 1,
+		offset: 0
+	},
+	ppb: {
+		dimension: "concentration-volume",
+		factor: .001,
+		offset: 0
+	},
+	"µg/m³": {
+		dimension: "concentration-mass",
+		factor: 1,
+		offset: 0
+	},
+	"mg/m³": {
+		dimension: "concentration-mass",
+		factor: 1e3,
+		offset: 0
+	},
+	kg: {
+		dimension: "mass",
+		factor: 1,
+		offset: 0
+	},
+	g: {
+		dimension: "mass",
+		factor: .001,
+		offset: 0
+	},
+	lb: {
+		dimension: "mass",
+		factor: .453592,
+		offset: 0
+	},
+	oz: {
+		dimension: "mass",
+		factor: .0283495,
+		offset: 0
+	},
+	"%": {
+		dimension: "percentage",
+		factor: 1,
+		offset: 0
 	}
-	if (op === "-" || op === "*" || op === "/" || op === "%") return only("number");
-	return only("boolean");
-}
-/** "exactly N" / "at least N" / "N–M", for an arity refusal that says what IS allowed. */
-function arityRange(builtin) {
-	if (builtin.minArgs === builtin.maxArgs) return `exactly ${builtin.minArgs}`;
-	if (builtin.maxArgs === Number.POSITIVE_INFINITY) return `at least ${builtin.minArgs}`;
-	return `${builtin.minArgs}–${builtin.maxArgs}`;
-}
-function callKinds(callee, args) {
-	const builtin = require_composition.EXPRESSION_BUILTINS[callee];
-	if (builtin !== void 0 && (args.length < builtin.minArgs || args.length > builtin.maxArgs)) throw new KindInferenceError(`${callee}: wrong number of arguments (${args.length}); expected ${arityRange(builtin)}`);
-	const rule = BUILTIN_RESULT_KINDS[callee];
-	if (rule === void 0) throw new KindInferenceError(`no result-kind rule for builtin '${callee}'`);
-	if (rule.kind === "fixed") return new Set(rule.result);
-	const nonNull = union(...args.map(withoutNull));
-	return args.every((a) => a.has("null")) ? union(nonNull, only("null")) : nonNull;
-}
-function kindsOf(node, bindings) {
-	switch (node.kind) {
-		case "literal": return only(kindOfValue(node.value));
-		case "identifier": {
-			if (node.name === "now") return only("number");
-			const bound = bindings.get(node.name);
-			if (bound === void 0) throw new KindInferenceError(`unbound identifier '${node.name}'`);
-			return bound;
-		}
-		case "unary": return only(node.op === "!" ? "boolean" : "number");
-		case "binary": return binaryKinds(node.op, kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "logical": return union(kindsOf(node.left, bindings), kindsOf(node.right, bindings));
-		case "conditional": return union(kindsOf(node.consequent, bindings), kindsOf(node.alternate, bindings));
-		case "call": return callKinds(node.callee, node.args.map((a) => kindsOf(a, bindings)));
+};
+//#endregion
+//#region src/units/convert.ts
+/**
+* Pure unit-conversion API over `UNIT_TABLE`. No dependencies, no side effects.
+*
+* Conversion is refused (throws `UnitConversionError`, or returns `undefined`
+* from the `try*` variant) whenever a unit is unknown or the two units belong
+* to different dimensions — cross-dimension conversion is deliberately
+* impossible so a render override can never make the value and its unit label
+* disagree.
+*
+* Callers pass units through `normalizeUnit` (`../device/source-info.ts`) BEFORE
+* calling here — the table keys only canonical spellings.
+*/
+/** Thrown by `convertUnit` when a conversion is refused. Carries the offending
+*  units + a machine-readable `reason` for callers that branch on the cause. */
+var UnitConversionError = class extends Error {
+	from;
+	to;
+	reason;
+	constructor(from, to, reason) {
+		super(`[units] cannot convert '${from}' → '${to}': ${reason}`);
+		this.name = "UnitConversionError";
+		this.from = from;
+		this.to = to;
+		this.reason = reason;
 	}
+};
+/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
+function specFor(unit) {
+	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
 }
-function nodeContainsCall(node, callee) {
-	switch (node.kind) {
-		case "literal":
-		case "identifier": return false;
-		case "unary": return nodeContainsCall(node.operand, callee);
-		case "binary":
-		case "logical": return nodeContainsCall(node.left, callee) || nodeContainsCall(node.right, callee);
-		case "conditional": return nodeContainsCall(node.test, callee) || nodeContainsCall(node.consequent, callee) || nodeContainsCall(node.alternate, callee);
-		case "call": return node.callee === callee || node.args.some((arg) => nodeContainsCall(arg, callee));
-	}
+/** The dimension a unit belongs to, or `undefined` for an unknown unit. */
+function unitDimension(unit) {
+	return specFor(unit)?.dimension;
 }
-function expressionContainsBuiltinCall(expr, callee) {
-	const compiled = require_composition.compileExpressionSafe(expr);
-	return compiled.ok && nodeContainsCall(compiled.parsed.ast, callee);
+/** Value in `spec`'s unit → its dimension's canonical unit. */
+function toCanonical(value, spec) {
+	return value * spec.factor + spec.offset;
 }
-function inferExpressionKinds(input) {
-	const compiled = require_composition.compileExpressionSafe(input.expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	try {
-		return {
-			ok: true,
-			kinds: kindsOf(compiled.parsed.ast, input.bindingKinds)
-		};
-	} catch (err) {
-		if (err instanceof KindInferenceError) return {
-			ok: false,
-			error: err.message
-		};
-		throw err;
-	}
+/** Canonical-unit value → the unit described by `spec`. */
+function fromCanonical(canonical, spec) {
+	return (canonical - spec.offset) / spec.factor;
 }
-//#endregion
-//#region src/composition/field-kinds.ts
 /**
-* The kind half of planning a composition field (D659): which kinds a source
-* can produce, whether they fit a target field, and the field's role.
-* Shared by the top-level planner (`validate-composition.ts`) and the item
-* planner (`composition-items.ts`). Internal to the composition module — NOT
-* in the barrel: these are planner internals, not a published contract.
+* Convert `value` from unit `from` to unit `to`. Identity when `from === to`.
+* Throws `UnitConversionError` when either unit is unknown or the units belong
+* to different dimensions.
 */
-function readKinds(read, lookupCap) {
-	const def = lookupCap(read.cap);
-	const schema = def?.runtimeState ?? def?.status?.schema;
-	if (def === null || schema === void 0) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `no capability \`${read.cap}\` with state to read`
-	};
-	const field = describeStateField(schema, read.fieldPath);
-	if (field === null) return {
-		ok: false,
-		code: "source-field-unknown",
-		message: `\`${read.cap}\` has no field \`${read.fieldPath}\``
-	};
-	const base = field.kind === "enum" ? "string" : field.kind;
-	return {
-		ok: true,
-		kinds: new Set(field.nullable ? [base, "null"] : [base])
-	};
-}
-function sourceKinds(source, lookupCap) {
-	if (source.kind === "from") return readKinds(source, lookupCap);
-	if (source.kind === "code") return {
-		ok: false,
-		code: "reserved-variant",
-		message: "code fields arrive in slice 4"
-	};
-	const bindingKinds = /* @__PURE__ */ new Map();
-	for (const [name, binding] of Object.entries(source.bindings)) {
-		if (binding.kind === "literal") {
-			bindingKinds.set(name, new Set([kindOfValue(binding.value)]));
-			continue;
-		}
-		const kinds = readKinds(binding, lookupCap);
-		if (!kinds.ok) return {
-			...kinds,
-			message: `binding \`${name}\`: ${kinds.message}`
-		};
-		bindingKinds.set(name, kinds.kinds);
-	}
-	const inferred = inferExpressionKinds({
-		expr: source.expr,
-		bindingKinds
-	});
-	return inferred.ok ? {
-		ok: true,
-		kinds: inferred.kinds
-	} : {
-		ok: false,
-		code: "expression-invalid",
-		message: inferred.error
-	};
-}
-function compatibility(cap, target, kinds, at) {
-	const allowed = target.kind === "enum" ? "string" : target.kind;
-	const offending = [...kinds].filter((k) => k !== "null" && k !== allowed);
-	const problems = [];
-	if (offending.length > 0) problems.push(problem("kind-mismatch", at, `\`${cap}.${target.path}\` is a ${target.kind}; this source can produce ${offending.join(" or ")}`));
-	if (kinds.has("null") && !target.nullable) problems.push(problem("may-be-null", at, `\`${cap}.${target.path}\` cannot be null and this source can produce null — wrap it in coalesce(…) or pick a non-null source`));
-	return problems;
+function convertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) throw new UnitConversionError(from, to, "unknown-from");
+	const toSpec = specFor(to);
+	if (!toSpec) throw new UnitConversionError(from, to, "unknown-to");
+	if (fromSpec.dimension !== toSpec.dimension) throw new UnitConversionError(from, to, "cross-dimension");
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
 }
 /**
-* A string a source produces WITHOUT reading any device — a field-level
-* `expression` source whose compiled AST is a bare string literal (`"red"`,
-* never `a` or `a + "x"`). Anything else that can only produce `'string'` at
-* the kind level (a `from` read of an enum-typed source field, a computed
-* expression) is NOT checked against the target's `enumValues` here: the
-* kind inference already collapsed it to the coarse `'string'` kind, losing
-* whichever enum it actually came from, so membership can only be judged at
-* write time against the runtime-state schema. Known limitation — see the
-* fix report for Task 6 round 1.
+* Graceful variant for the render path: returns the converted value, or
+* `undefined` when the conversion is refused (unknown unit / cross-dimension).
+* Never throws — a render caller falls back to the raw value + source unit.
 */
-function literalStringValue(source) {
-	if (source.kind !== "expression") return null;
-	const compiled = require_composition.compileExpressionSafe(source.expr);
-	if (!compiled.ok) return null;
-	const ast = compiled.parsed.ast;
-	return ast.kind === "literal" && typeof ast.value === "string" ? ast.value : null;
+function tryConvertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) return void 0;
+	const toSpec = specFor(to);
+	if (!toSpec) return void 0;
+	if (fromSpec.dimension !== toSpec.dimension) return void 0;
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
 }
 /**
-* An enum target whose source is a save-time-KNOWN string literal outside its
-* `enumValues` is refused now rather than left to fail the write later. A
-* dynamic source (a `from` read, a non-literal expression) is left to
-* runtime — see {@link literalStringValue}.
+* Whether `value` can be converted between `from` and `to` (same dimension,
+* both known). Cheap boolean probe for the UI's same-dimension unit picker and
+* the resolver's convertibility branch — compute ONCE so a unit label and its
+* value math can never disagree.
 */
-function enumLiteralProblem(cap, target, source, at) {
-	if (target.kind !== "enum" || target.enumValues === void 0) return null;
-	const value = literalStringValue(source);
-	if (value === null || target.enumValues.includes(value)) return null;
-	const allowed = target.enumValues.map((v) => `\`${v}\``).join(", ");
-	return problem("kind-mismatch", at, `\`${cap}.${target.path}\` accepts only ${allowed}; this source is the literal \`${value}\``);
-}
-function roleOf(source) {
-	if (source.kind !== "expression") return "derived";
-	if (expressionContainsBuiltinCall(source.expr, "count")) return "accumulator";
-	if (require_composition.fieldReads(source).length > 0) return "derived";
-	const compiled = require_composition.compileExpressionSafe(source.expr);
-	return compiled.ok && compiled.parsed.identifiers.has("now") ? "clock" : "constant";
+function canConvertUnit(from, to) {
+	if (from === to) return true;
+	const fromDim = unitDimension(from);
+	if (fromDim === void 0) return false;
+	return fromDim === unitDimension(to);
 }
 /**
-* How a planned field says "unavailable", per feature mode and AFTER `roleOf`
-* (D393, D663 rulings S1 + S1b). The composer cannot take a device it does not
-* own offline, and D393 forbids a stale number, so on an existing target a
-* field that READS a source never gets `offline`.
+* Every known unit spelling in a dimension (table insertion order — canonical
+* unit first). Powers the UI's same-dimension unit picker.
 */
-function unavailableFor(tf, role, mode, cap, at) {
-	if (mode === "replace" && (role === "derived" || role === "accumulator")) return {
-		ok: true,
-		unavailable: "release"
-	};
-	if (mode === "new" || role !== "derived") return {
-		ok: true,
-		unavailable: tf.nullable ? "null" : "offline"
-	};
-	if (tf.nullable) return {
-		ok: true,
-		unavailable: "null"
-	};
-	if (tf.enumValues?.includes("unknown") === true) return {
-		ok: true,
-		unavailable: "unknown"
-	};
-	return {
-		ok: false,
-		problem: problem("not-replaceable", at, `\`${cap}.${tf.path}\` reads a source but can say neither null nor 'unknown', and an ADDED capability has no native reading to fall back to (D393, D663)`)
-	};
-}
-//#endregion
-//#region src/composition/composition-items.ts
-/** Item fields the composer writes itself, with the value it writes. */
-var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
-function reservedItemFields(itemArray) {
-	return new Set([
-		itemArray.keyField,
-		...itemArray.labelField === void 0 ? [] : [itemArray.labelField],
-		...Object.keys(COMPOSED_ITEM_FIXED_FIELDS)
-	]);
-}
-/** A required leaf under an optional parent is required only once something writes that parent. */
-function leafRequired(itemArray, path, written) {
-	const described = describeStateField(itemArray.itemSchema, path);
-	if (described === null || !described.required) return false;
-	return optionalAncestors(itemArray.itemSchema, path).every((parent) => written.some((w) => w.startsWith(`${parent}.`)));
-}
-function missingLeaves({ capName, itemArray, reserved }, item, at) {
-	const written = Object.keys(item.fields);
-	return enumerateSchemaFields(itemArray.itemSchema).flatMap((leaf) => {
-		if (reserved.has(leaf.path) || leaf.path in item.fields) return [];
-		if (!leafRequired(itemArray, leaf.path, written)) return [];
-		const described = describeStateField(itemArray.itemSchema, leaf.path);
-		if (described === null || described.nullable) return [];
-		return [problem("missing-field", `${at}.fields.${leaf.path}`, `\`${capName}.${itemArray.path}[].${leaf.path}\` is required and has no source`)];
-	});
-}
-function planItemField(ctx, leaf) {
-	const { capName, itemArray, featureIndex, lookupCap } = ctx;
-	const { key, label, path, source } = leaf;
-	const at = `features[${featureIndex}].items.${key}.fields.${path}`;
-	if (ctx.reserved.has(path)) return refused(problem("item-field-reserved", at, `\`${capName}.${itemArray.path}[].${path}\` is set by the composer itself — it takes no source`));
-	const tf = describeStateField(itemArray.itemSchema, path);
-	if (tf === null) return refused(problem("unknown-field", at, `a \`${capName}\` item has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, at, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, ctx.mode, capName, at);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: capName,
-		path,
-		item: {
-			arrayPath: itemArray.path,
-			key,
-			label
-		},
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...require_composition.fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(capName, tf, source, at);
-	return {
-		problems: [...compatibility(capName, tf, kinds.kinds, at), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
-	};
-}
-function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
-	const at = `features[${featureIndex}].items`;
-	const itemArray = def.status?.itemArray;
-	if (itemArray === void 0) return refused(problem("not-item-array", at, `\`${def.name}\` has no item array — it takes no \`items\``));
-	if (itemArray.path !== "items") return refused(problem("not-item-array", at, `\`${def.name}\`'s item array is at \`${itemArray.path}\`, not \`${require_composition.COMPOSITION_ITEM_ARRAY_PATH}\` — not composable yet`));
-	const ctx = {
-		capName: def.name,
-		itemArray,
-		reserved: reservedItemFields(itemArray),
-		featureIndex,
-		lookupCap,
-		mode
-	};
-	const results = Object.entries(feature.items ?? {}).flatMap(([key, item]) => [{
-		problems: missingLeaves(ctx, item, `${at}.${key}`),
-		fields: [],
-		features: [],
-		events: []
-	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
-		key,
-		label: item.label,
-		path,
-		source
-	}))]);
-	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: [],
-		events: []
-	};
+function unitsForDimension(dimension) {
+	const out = [];
+	for (const [unit, spec] of Object.entries(UNIT_TABLE)) if (spec.dimension === dimension) out.push(unit);
+	return out;
 }
 //#endregion
 //#region src/composition/evaluate-field.ts
+/**
+* One composed field, evaluated from what its sources say NOW (D659).
+*
+* Pure. The composer calls it on every source change, and the slice-5 editor
+* will call it for its live preview, so both see the same answer.
+*
+* The rules (spec §2):
+*  - a source that is offline or unreadable keeps its last value and is marked
+*    STALE; the field is stale and keeps computing (D49);
+*  - a source that is GONE makes the field UNAVAILABLE, `fatal`, and never a
+*    plausible number (D393);
+*  - a source that is unavailable but NOT gone (e.g. a cap unregistered at
+*    runtime, R7b) makes the field UNAVAILABLE, non-fatal, `value: null`: it
+*    may come back on its own, no block failure is raised for it;
+*  - an expression that fails on a value makes the field unavailable for that
+*    value, and NOT fatal: the next value may compute.
+*
+* `confirmed` (D663, D49): whether a NON-fatal unavailability is an ANSWER — a
+* cap the provider unregistered and a re-read agreed, a field the source
+* reported without, an expression that failed on a value — or only the
+* absence of one (a failed read, a first or empty read, a source not tracked
+* yet). Only a confirmed unavailability may hand a `release`-mode field back
+* to the native provider; an unconfirmed one holds it on its last value.
+* Absent means NOT confirmed. Fatal is always confirmed.
+*
+* When an expression has more than one unavailable binding, a FATAL one always
+* wins the outcome, regardless of position: every binding is scanned before
+* the field is judged, so an earlier non-fatal binding (e.g. a cap that is
+* momentarily unregistered) can never hide a later fatal one (a deleted
+* source) behind an early return.
+*/
 function describeRead(read) {
 	return `${require_composition.compositionSourceKey(read.source)} ${read.cap}.${read.fieldPath}`;
 }
@@ -45287,7 +46065,10 @@ function expressionOutcome(source, read, now, stateful) {
 	}
 	const deadlines = [];
 	const result = require_composition.evaluateExpressionSource(source.expr, values, now, {
-		hooks: { noteDeadline: (at) => deadlines.push(at) },
+		hooks: {
+			noteDeadline: (at) => deadlines.push(at),
+			convert: (value, from, to) => tryConvertUnit(value, normalizeUnit(from) ?? from, normalizeUnit(to) ?? to) ?? null
+		},
 		...stateful === void 0 ? {} : { invokeStateful: (invocation) => require_composition.evaluateStatefulExpressionCall(stateful.callPathPrefix === void 0 ? invocation : {
 			...invocation,
 			path: `${stateful.callPathPrefix}@${invocation.path}`
@@ -45526,304 +46307,71 @@ function feederCustomizationExample(sources) {
 	});
 }
 //#endregion
-//#region src/composition/validate-composition.ts
-function buildCapabilityLookup(defs) {
-	const byName = new Map(defs.map((d) => [d.name, d]));
-	return (capName) => byName.get(capName) ?? null;
-}
-/** Caps every `BaseDevice` registers on itself; a second registration throws. */
-var BASE_DEVICE_CAPS = new Set(["device-status", "feature-probe"]);
-var PENDING_SELF = {
-	addonId: require_composition.COMPOSER_ADDON_ID,
-	stableId: `${require_composition.COMPOSED_DEVICE_STABLE_ID_PREFIX}(unsaved)`
-};
-/** The candidate's block id before its first save. Stored block ids are `randomUUID()`, so none can carry it. */
-var PENDING_BLOCK_ID = "(unsaved)";
-function composableCap(feature, at, lookupCap) {
-	const def = lookupCap(feature.cap);
-	if (def === null) return problem("unknown-capability", `${at}.cap`, `no capability is named \`${feature.cap}\``);
-	if (BASE_DEVICE_CAPS.has(def.name)) return problem("not-composable", `${at}.cap`, `\`${def.name}\` is registered by every device itself — it cannot be composed`);
-	const state = def.runtimeState;
-	if (def.scope !== "device" || state === void 0) return problem("not-composable", `${at}.cap`, `\`${def.name}\` has no per-device state to compose`);
-	return {
-		def,
-		state,
-		fields: describeTopLevelStateFields(state)
-	};
-}
-/**
-* A capability BUILT by the composition (a new device, or one ADDED to an
-* existing device) must fit the device type, serve no command, and have every
-* required field. A REPLACE needs none of it: the cap is bound (a fact), the
-* native keeps serving its methods, and only the named fields are owned (D663).
-*/
-function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType) {
-	const problems = [];
-	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
-	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
-	if (served.length > 0) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
-	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
-	for (const key of requiredTopLevelKeys(state)) {
-		if (key === itemArrayPath) continue;
-		if (!targetFields.has(key)) problems.push(problem("not-composable", `${at}.fields`, `\`${def.name}.${key}\` is not a scalar — nested fields arrive in a later slice`));
-		else if (!(key in feature.fields)) problems.push(problem("missing-field", `${at}.fields.${key}`, `\`${def.name}.${key}\` is required and has no source`));
-	}
-	return problems;
-}
-function planTopLevelField({ def, fields }, field, mode, lookupCap) {
-	const { featureIndex, path, source } = field;
-	const fieldAt = `features[${featureIndex}].fields.${path}`;
-	if (path.includes(".")) return refused(problem("nested-field", fieldAt, `\`${path}\` is nested — nested fields arrive in a later slice`));
-	const tf = fields.get(path);
-	if (tf === void 0) return refused(problem("unknown-field", fieldAt, `\`${def.name}\` has no field \`${path}\``));
-	const kinds = sourceKinds(source, lookupCap);
-	if (!kinds.ok) return refused(problem(kinds.code, fieldAt, kinds.message));
-	const role = roleOf(source);
-	const unavailable = unavailableFor(tf, role, mode, def.name, fieldAt);
-	if (!unavailable.ok) return refused(unavailable.problem);
-	const plan = {
-		cap: def.name,
-		path,
-		featureIndex,
-		kind: tf.kind,
-		nullable: tf.nullable,
-		required: tf.required,
-		unavailable: unavailable.unavailable,
-		role,
-		source,
-		reads: [...require_composition.fieldReads(source)]
-	};
-	const enumProblem = enumLiteralProblem(def.name, tf, source, fieldAt);
-	return {
-		problems: [...compatibility(def.name, tf, kinds.kinds, fieldAt), ...enumProblem === null ? [] : [enumProblem]],
-		fields: [plan],
-		features: [],
-		events: []
-	};
-}
-function planFeature(feature, featureIndex, target, lookupCap) {
-	const at = `features[${featureIndex}]`;
-	const cap = composableCap(feature, at, lookupCap);
-	if ("code" in cap) return refused(cap);
-	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType)];
-	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
-	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
-		featureIndex,
-		path,
-		source
-	}, target.mode, lookupCap));
-	const items = feature.items === void 0 ? [] : [planItems(cap.def, feature, featureIndex, lookupCap, target.mode)];
-	const all = [...perField, ...items];
-	const fields = all.flatMap((result) => result.fields);
-	const featurePlan = {
-		featureIndex,
-		cap: cap.def.name,
-		mode: target.mode
-	};
-	const eventPlan = planCompositionEvents(cap.def, featurePlan, fields);
-	return {
-		problems: [
-			...capProblems,
-			...all.flatMap((r) => r.problems),
-			...eventPlan.problems
-		],
-		fields,
-		features: [featurePlan],
-		events: eventPlan.events
-	};
-}
-/** A cap the device serves itself; one the composer grafted (an earlier ADD) is not native. */
-function isNativeCap(target, cap) {
-	const owner = target.nativeCaps.get(cap);
-	return owner !== void 0 && owner !== "composer";
-}
-/** The target read, or the refusal that replaces the whole plan when it could not be (D391). */
-function planTargetOf(composition, target) {
-	if (composition.target.kind === "new") return {
-		kind: "new",
-		type: composition.target.type
-	};
-	const key = require_composition.compositionSourceKey(composition.target.device);
-	if (target === void 0) return problem("target-unreadable", "target", `target device \`${key}\` was not read — the save is refused rather than stored unchecked`);
-	if (target.kind === "absent") return problem("target-missing", "target", `target device \`${key}\` does not exist`);
-	if (target.kind === "unreadable") return problem("target-unreadable", "target", `could not read target device \`${key}\` (${target.error}) — the save is refused rather than stored unchecked`);
-	return {
-		kind: "existing",
-		found: target
-	};
-}
-function featureTargetOf(target, cap) {
-	if (target.kind === "new") return {
-		mode: "new",
-		deviceType: target.type
-	};
-	return {
-		mode: isNativeCap(target.found, cap) ? "replace" : "add",
-		deviceType: target.found.type
-	};
+//#region src/composition/presets/doorbell-feature.ts
+/**
+* The doorbell of a camera as a customization (D671). ONE builder: the
+* virtual-doorbell migration and the admin UI's "Use as doorbell" preset both
+* call it, so a preset can never write a shape the migration would refuse as
+* "an unrelated existing block".
+*/
+/** A rise closer than this to the previous one is the same press (D671). */
+var DOORBELL_RISE_DEBOUNCE_MS = 2e3;
+/** Every source cap of `source` that `SOURCE_CAP_ACTIVE_FIELD` knows AND the device has bound. */
+function doorbellFeatureSources(source, boundCaps) {
+	return Object.keys(require_composition.SOURCE_CAP_ACTIVE_FIELD).filter((cap) => Object.hasOwn(require_composition.SOURCE_CAP_CHANGED_AT_FIELD, cap) && boundCaps.includes(cap)).toSorted().flatMap((cap) => {
+		const activeField = require_composition.SOURCE_CAP_ACTIVE_FIELD[cap];
+		const changedAtField = require_composition.SOURCE_CAP_CHANGED_AT_FIELD[cap];
+		return activeField === void 0 || changedAtField === void 0 ? [] : [{
+			source,
+			cap,
+			activeField,
+			changedAtField
+		}];
+	});
 }
-/**
-* The static plan. `target` describes an EXISTING target device (one read);
-* it is ignored for a new one. On an existing target each feature REPLACES a
-* cap the device has natively, else ADDS it (D663).
-*/
-function planComposition(composition, lookupCap, target) {
-	const planTarget = planTargetOf(composition, target);
-	if ("code" in planTarget) return refused(planTarget);
-	const results = composition.features.map((feature, index) => {
-		const result = feature.kind === "passthrough" ? refused(problem("reserved-variant", `features[${index}]`, `whole-capability passthrough of \`${feature.cap}\` arrives in slice 3`)) : planFeature(feature, index, featureTargetOf(planTarget, feature.cap), lookupCap);
-		return require_composition.compositionFeatureEnabled(feature) ? result : {
-			problems: result.problems,
-			fields: [],
-			features: [],
-			events: []
+/** The D671 feature, byte for byte what the migration writes. Throws on zero sources. */
+function buildDoorbellCompositionFeature(input) {
+	const sources = [...input.sources].toSorted((a, b) => `${a.source.addonId}/${a.source.stableId}#${a.cap}`.localeCompare(`${b.source.addonId}/${b.source.stableId}#${b.cap}`));
+	if (sources.length === 0) throw new Error("doorbell composition needs at least one source");
+	const edgeBindings = {};
+	sources.forEach((entry, index) => {
+		edgeBindings[`active${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.activeField
+		};
+		edgeBindings[`changed${index}`] = {
+			kind: "from",
+			source: entry.source,
+			cap: entry.cap,
+			fieldPath: entry.changedAtField
 		};
 	});
 	return {
-		problems: results.flatMap((r) => r.problems),
-		fields: results.flatMap((r) => r.fields),
-		features: results.flatMap((r) => r.features),
-		events: results.flatMap((r) => r.events)
-	};
-}
-function compositionSourceRefs(composition) {
-	const refs = composition.features.flatMap((f) => require_composition.compositionFeatureEnabled(f) && f.kind === "fields" ? require_composition.featureSources(f).flatMap(require_composition.fieldReads).map((r) => r.source) : []);
-	return [...new Map(refs.map((r) => [require_composition.compositionSourceKey(r), r])).values()];
-}
-/**
-* The candidate's device: the existing target itself, else `self`, else a
-* placeholder that cannot collide with a stored target. An existing target is
-* known even on create, so a second customization of it is refused on create too.
-*/
-function candidateSelf(composition, ctx, plan) {
-	return {
-		ref: composition.target.kind === "existing" ? composition.target.device : ctx.self ?? PENDING_SELF,
-		native: composition.target.kind === "existing" && ctx.target?.kind === "found" ? ctx.target : null,
-		replaced: replacedFieldKeys(plan)
-	};
-}
-/**
-* `compositionFieldKey` of every field a REPLACE feature of `plan` owns — the
-* candidate's own, and a stored peer's `CompositionPeer.replaced` (D663): one
-* derivation, so the graph reads both the same way.
-*/
-function replacedFieldKeys(plan) {
-	const replacing = new Set(plan.features.filter((f) => f.mode === "replace").map((f) => f.featureIndex));
-	return new Set(plan.fields.filter((f) => replacing.has(f.featureIndex)).map(compositionFieldKey));
-}
-/**
-* A read of the candidate's own device. Its own composed output (a new device's
-* field, an ADDED field) is the slice-1 own-field rule; on an existing target
-* every other field — replaced, or not composed at all — is the NATIVE value,
-* valid when the device serves that cap natively (D663, rule 5).
-*/
-function selfReadProblems(read, at, fields, self) {
-	const readKey = `${read.cap}.${read.fieldPath}`;
-	if (fields.some((f) => compositionFieldKey(f) === readKey && !self.replaced.has(readKey))) return [];
-	if (self.native === null) return [problem("source-field-unknown", at, `this device has no composed field \`${read.cap}.${read.fieldPath}\``)];
-	if (isNativeCap(self.native, read.cap)) return [];
-	return [problem("source-capability-missing", at, `the target device (device ${self.native.deviceId}) has no native \`${read.cap}\``)];
-}
-function sourceProblems(fields, ctx, self) {
-	const selfKey = require_composition.compositionSourceKey(self.ref);
-	return fields.flatMap((field) => field.reads.flatMap((read) => {
-		const at = compositionFieldAt(field);
-		const key = require_composition.compositionSourceKey(read.source);
-		if (key === selfKey) return selfReadProblems(read, at, fields, self);
-		const desc = ctx.sources.get(key);
-		if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
-		if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
-		if (!desc.caps.has(read.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${read.cap}\``)];
-		return [];
-	}));
-}
-/**
-* A cycle's node keys are `compositionReadKey` strings:
-* `<addonId>/<stableId>#<cap>.<fieldPath>`. When a node belongs to the
-* CANDIDATE itself (this composition being saved), pull its `cap`/`fieldPath`
-* back out so the refusal can point at that exact field, matching the
-* documented `features[N].fields.<path>` convention. A cap name has no `.`,
-* so splitting `rest` on the FIRST `.` is exact; an item leaf's remainder
-* (`items[desiccant].status`) is matched through `compositionFieldKey`.
-*/
-function candidateFieldOfNode(nodeKey, candidateKey) {
-	const prefix = `${candidateKey}#`;
-	if (!nodeKey.startsWith(prefix)) return null;
-	const rest = nodeKey.slice(prefix.length);
-	const dot = rest.indexOf(".");
-	if (dot === -1) return null;
-	return {
-		cap: rest.slice(0, dot),
-		fieldPath: rest.slice(dot + 1)
-	};
-}
-/** The first node of a cycle's path that is one of THIS composition's own
-*  planned fields, as a documented-convention path; `'features'` when the
-*  cycle runs entirely through other stored compositions. */
-function cyclePath(nodePath, candidateKey, fields) {
-	for (const nodeKey of nodePath) {
-		const hit = candidateFieldOfNode(nodeKey, candidateKey);
-		if (hit === null) continue;
-		const hitKey = `${hit.cap}.${hit.fieldPath}`;
-		const field = fields.find((f) => compositionFieldKey(f) === hitKey);
-		if (field !== void 0) return compositionFieldAt(field);
-	}
-	return "features";
-}
-/** The first unread device any of `nodes` belongs to; null when none does. */
-function unreadDeviceOf(nodes, unread) {
-	for (const [key, error] of unread) if (nodes.some((node) => node.startsWith(`${key}#`))) return {
-		key,
-		error
-	};
-	return null;
-}
-/**
-* Cycle check runs against the CANDIDATE (this composition, as block
-* `ctx.blockId`, writing `self.ref`) plus every OTHER stored composition,
-* decided per strongly connected component (`findCandidateCycles`): a cyclic
-* component holding a candidate node refuses, with one representative cycle
-* through it; one without is not this save's cycle. A
-* stored composition of the same block is its old version; another block on
-* the same device, or two stored peers sharing a device, make
-* `compositionEdges` throw `CompositionGraphError` — refused BY NAME as
-* `duplicate-target` (D391, D663) instead of escaping as an uncaught throw.
-*/
-function cycleProblems(composition, ctx, fields, self) {
-	const candidate = {
-		blockId: ctx.blockId ?? "(unsaved)",
-		target: self.ref,
-		composition,
-		replaced: self.replaced
-	};
-	const candidateKey = require_composition.compositionSourceKey(candidate.target);
-	const unread = ctx.unreadTargets ?? /* @__PURE__ */ new Map();
-	try {
-		return findCandidateCycles(candidate, ctx.peers).map((c) => {
-			const at = cyclePath(c.path, candidateKey, fields);
-			const through = unreadDeviceOf([...c.component], unread);
-			return through === null ? problem("cycle", at, `a field reads itself: ${c.path.join(" → ")}`) : problem("cycle", at, `possible cycle through \`${through.key}\` — its state could not be read (${through.error}): ${c.path.join(" → ")}`);
-		});
-	} catch (err) {
-		if (err instanceof CompositionGraphError) return [problem("duplicate-target", "features", err.message)];
-		throw err;
-	}
-}
-function validateComposition(composition, ctx) {
-	const plan = planComposition(composition, ctx.lookupCap, ctx.target ?? void 0);
-	const self = candidateSelf(composition, ctx, plan);
-	const cycles = cycleProblems(composition, ctx, plan.fields, self);
-	const problems = [
-		...plan.problems,
-		...sourceProblems(plan.fields, ctx, self),
-		...cycles
-	];
-	return {
-		ok: problems.length === 0,
-		problems,
-		fields: [...plan.fields],
-		features: [...plan.features],
-		events: [...plan.events]
+		kind: "fields",
+		cap: "doorbell",
+		enabled: input.enabled,
+		fields: {
+			lastPressedAt: {
+				kind: "expression",
+				expr: `latest(${sources.map((_, index) => `rose(active${index}, changed${index}, ${DOORBELL_RISE_DEBOUNCE_MS})`).join(", ")})`,
+				bindings: edgeBindings
+			},
+			pressCountSinceStart: {
+				kind: "expression",
+				expr: "count(lastPressedAt)",
+				bindings: { lastPressedAt: {
+					kind: "from",
+					source: {
+						addonId: input.camera.addonId,
+						stableId: input.camera.stableId
+					},
+					cap: "doorbell",
+					fieldPath: "lastPressedAt"
+				} }
+			}
+		}
 	};
 }
 //#endregion
@@ -45952,7 +46500,6 @@ var RUNTIME_DEFAULTS = {
 		models: "camstack-data/models"
 	},
 	providers: [],
-	"ffmpeg.binaryPath": "ffmpeg",
 	"ffmpeg.hwAccel": "auto",
 	"ffmpeg.threadCount": 0,
 	"auth.tokenExpiry": "30d"
@@ -52950,6 +53497,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listComposableCaps": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.listCompositions": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -56634,6 +57187,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraSensors": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepOverride": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -60679,6 +61238,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraSensors": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepOverride": [{
 		name: "deviceId",
 		form: "single",
@@ -61501,6 +62065,7 @@ var SYSTEM_SCOPE_DEVICE_METHODS = [
 	"pipelineOrchestrator.getPipelineDevicePin",
 	"pipelineOrchestrator.resolvePipeline",
 	"pipelineOrchestrator.setCameraPipelineForAgent",
+	"pipelineOrchestrator.setCameraSensors",
 	"pipelineOrchestrator.setCameraStepOverride",
 	"pipelineOrchestrator.setCameraStepToggle",
 	"pipelineOrchestrator.setCameraSwitch",
@@ -62153,6 +62718,7 @@ function createSystemProxy(api) {
 			getComposition: (input) => dispatch("coreBlocks", "getComposition", "query", input),
 			listCompositions: (input) => dispatch("coreBlocks", "listCompositions", "query", input),
 			getCustomization: (input) => dispatch("coreBlocks", "getCustomization", "query", input),
+			listComposableCaps: (input) => dispatch("coreBlocks", "listComposableCaps", "query", input),
 			validateComposition: (input) => dispatch("coreBlocks", "validateComposition", "mutation", input)
 		},
 		decoder: {
@@ -62484,6 +63050,7 @@ function createSystemProxy(api) {
 			getNodeInferenceDevices: (input) => dispatch("pipelineOrchestrator", "getNodeInferenceDevices", "query", input),
 			resetNodePipelineDefaults: (input) => dispatch("pipelineOrchestrator", "resetNodePipelineDefaults", "mutation", input),
 			getCameraStatuses: (input) => dispatch("pipelineOrchestrator", "getCameraStatuses", "query", input),
+			setCameraSensors: (input) => dispatch("pipelineOrchestrator", "setCameraSensors", "mutation", input),
 			reconcileFromDisk: (input) => dispatch("pipelineOrchestrator", "reconcileFromDisk", "mutation", input),
 			getReconcileFromDiskStatus: (input) => dispatch("pipelineOrchestrator", "getReconcileFromDiskStatus", "query", input),
 			listTemplates: (input) => dispatch("pipelineOrchestrator", "listTemplates", "query", input),
@@ -66678,334 +67245,6 @@ var DEVICE_TYPE_INFO = { ["camera"]: {
 	icon: "camera"
 } };
 //#endregion
-//#region src/units/unit-table.ts
-/**
-* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
-* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
-* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
-* decimals). K derives from `°C = K − 273.15`.
-*/
-var UNIT_TABLE = {
-	"°C": {
-		dimension: "temperature",
-		factor: 1,
-		offset: 0
-	},
-	"°F": {
-		dimension: "temperature",
-		factor: 5 / 9,
-		offset: -160 / 9
-	},
-	K: {
-		dimension: "temperature",
-		factor: 1,
-		offset: -273.15
-	},
-	hPa: {
-		dimension: "pressure",
-		factor: 1,
-		offset: 0
-	},
-	kPa: {
-		dimension: "pressure",
-		factor: 10,
-		offset: 0
-	},
-	Pa: {
-		dimension: "pressure",
-		factor: .01,
-		offset: 0
-	},
-	mbar: {
-		dimension: "pressure",
-		factor: 1,
-		offset: 0
-	},
-	bar: {
-		dimension: "pressure",
-		factor: 1e3,
-		offset: 0
-	},
-	inHg: {
-		dimension: "pressure",
-		factor: 33.8639,
-		offset: 0
-	},
-	mmHg: {
-		dimension: "pressure",
-		factor: 1.33322,
-		offset: 0
-	},
-	psi: {
-		dimension: "pressure",
-		factor: 68.9476,
-		offset: 0
-	},
-	"m/s": {
-		dimension: "speed",
-		factor: 1,
-		offset: 0
-	},
-	"km/h": {
-		dimension: "speed",
-		factor: 1 / 3.6,
-		offset: 0
-	},
-	mph: {
-		dimension: "speed",
-		factor: .44704,
-		offset: 0
-	},
-	kn: {
-		dimension: "speed",
-		factor: .514444,
-		offset: 0
-	},
-	"mm/h": {
-		dimension: "precipitation-rate",
-		factor: 1,
-		offset: 0
-	},
-	"in/h": {
-		dimension: "precipitation-rate",
-		factor: 25.4,
-		offset: 0
-	},
-	m: {
-		dimension: "length",
-		factor: 1,
-		offset: 0
-	},
-	mm: {
-		dimension: "length",
-		factor: .001,
-		offset: 0
-	},
-	cm: {
-		dimension: "length",
-		factor: .01,
-		offset: 0
-	},
-	km: {
-		dimension: "length",
-		factor: 1e3,
-		offset: 0
-	},
-	in: {
-		dimension: "length",
-		factor: .0254,
-		offset: 0
-	},
-	ft: {
-		dimension: "length",
-		factor: .3048,
-		offset: 0
-	},
-	mi: {
-		dimension: "length",
-		factor: 1609.344,
-		offset: 0
-	},
-	lx: {
-		dimension: "illuminance",
-		factor: 1,
-		offset: 0
-	},
-	"W/m²": {
-		dimension: "irradiance",
-		factor: 1,
-		offset: 0
-	},
-	W: {
-		dimension: "power",
-		factor: 1,
-		offset: 0
-	},
-	kW: {
-		dimension: "power",
-		factor: 1e3,
-		offset: 0
-	},
-	VA: {
-		dimension: "apparent-power",
-		factor: 1,
-		offset: 0
-	},
-	Wh: {
-		dimension: "energy",
-		factor: 1,
-		offset: 0
-	},
-	kWh: {
-		dimension: "energy",
-		factor: 1e3,
-		offset: 0
-	},
-	MWh: {
-		dimension: "energy",
-		factor: 1e6,
-		offset: 0
-	},
-	V: {
-		dimension: "voltage",
-		factor: 1,
-		offset: 0
-	},
-	mV: {
-		dimension: "voltage",
-		factor: .001,
-		offset: 0
-	},
-	A: {
-		dimension: "current",
-		factor: 1,
-		offset: 0
-	},
-	mA: {
-		dimension: "current",
-		factor: .001,
-		offset: 0
-	},
-	ppm: {
-		dimension: "concentration-volume",
-		factor: 1,
-		offset: 0
-	},
-	ppb: {
-		dimension: "concentration-volume",
-		factor: .001,
-		offset: 0
-	},
-	"µg/m³": {
-		dimension: "concentration-mass",
-		factor: 1,
-		offset: 0
-	},
-	"mg/m³": {
-		dimension: "concentration-mass",
-		factor: 1e3,
-		offset: 0
-	},
-	kg: {
-		dimension: "mass",
-		factor: 1,
-		offset: 0
-	},
-	g: {
-		dimension: "mass",
-		factor: .001,
-		offset: 0
-	},
-	lb: {
-		dimension: "mass",
-		factor: .453592,
-		offset: 0
-	},
-	oz: {
-		dimension: "mass",
-		factor: .0283495,
-		offset: 0
-	},
-	"%": {
-		dimension: "percentage",
-		factor: 1,
-		offset: 0
-	}
-};
-//#endregion
-//#region src/units/convert.ts
-/**
-* Pure unit-conversion API over `UNIT_TABLE`. No dependencies, no side effects.
-*
-* Conversion is refused (throws `UnitConversionError`, or returns `undefined`
-* from the `try*` variant) whenever a unit is unknown or the two units belong
-* to different dimensions — cross-dimension conversion is deliberately
-* impossible so a render override can never make the value and its unit label
-* disagree.
-*
-* Callers pass units through `normalizeUnit` (`../device/source-info.ts`) BEFORE
-* calling here — the table keys only canonical spellings.
-*/
-/** Thrown by `convertUnit` when a conversion is refused. Carries the offending
-*  units + a machine-readable `reason` for callers that branch on the cause. */
-var UnitConversionError = class extends Error {
-	from;
-	to;
-	reason;
-	constructor(from, to, reason) {
-		super(`[units] cannot convert '${from}' → '${to}': ${reason}`);
-		this.name = "UnitConversionError";
-		this.from = from;
-		this.to = to;
-		this.reason = reason;
-	}
-};
-/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
-function specFor(unit) {
-	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
-}
-/** The dimension a unit belongs to, or `undefined` for an unknown unit. */
-function unitDimension(unit) {
-	return specFor(unit)?.dimension;
-}
-/** Value in `spec`'s unit → its dimension's canonical unit. */
-function toCanonical(value, spec) {
-	return value * spec.factor + spec.offset;
-}
-/** Canonical-unit value → the unit described by `spec`. */
-function fromCanonical(canonical, spec) {
-	return (canonical - spec.offset) / spec.factor;
-}
-/**
-* Convert `value` from unit `from` to unit `to`. Identity when `from === to`.
-* Throws `UnitConversionError` when either unit is unknown or the units belong
-* to different dimensions.
-*/
-function convertUnit(value, from, to) {
-	if (from === to) return value;
-	const fromSpec = specFor(from);
-	if (!fromSpec) throw new UnitConversionError(from, to, "unknown-from");
-	const toSpec = specFor(to);
-	if (!toSpec) throw new UnitConversionError(from, to, "unknown-to");
-	if (fromSpec.dimension !== toSpec.dimension) throw new UnitConversionError(from, to, "cross-dimension");
-	return fromCanonical(toCanonical(value, fromSpec), toSpec);
-}
-/**
-* Graceful variant for the render path: returns the converted value, or
-* `undefined` when the conversion is refused (unknown unit / cross-dimension).
-* Never throws — a render caller falls back to the raw value + source unit.
-*/
-function tryConvertUnit(value, from, to) {
-	if (from === to) return value;
-	const fromSpec = specFor(from);
-	if (!fromSpec) return void 0;
-	const toSpec = specFor(to);
-	if (!toSpec) return void 0;
-	if (fromSpec.dimension !== toSpec.dimension) return void 0;
-	return fromCanonical(toCanonical(value, fromSpec), toSpec);
-}
-/**
-* Whether `value` can be converted between `from` and `to` (same dimension,
-* both known). Cheap boolean probe for the UI's same-dimension unit picker and
-* the resolver's convertibility branch — compute ONCE so a unit label and its
-* value math can never disagree.
-*/
-function canConvertUnit(from, to) {
-	if (from === to) return true;
-	const fromDim = unitDimension(from);
-	if (fromDim === void 0) return false;
-	return fromDim === unitDimension(to);
-}
-/**
-* Every known unit spelling in a dimension (table insertion order — canonical
-* unit first). Powers the UI's same-dimension unit picker.
-*/
-function unitsForDimension(dimension) {
-	const out = [];
-	for (const [unit, spec] of Object.entries(UNIT_TABLE)) if (spec.dimension === dimension) out.push(unit);
-	return out;
-}
-//#endregion
 //#region src/util/location-match.ts
 /**
 * Pure fuzzy matcher for adoption location import. Normalized
@@ -68554,6 +68793,9 @@ exports.ClusterModelChoiceSchema = ClusterModelChoiceSchema;
 exports.CollectionColumnSchema = CollectionColumnSchema;
 exports.CollectionIndexSchema = CollectionIndexSchema;
 exports.ColorStatusSchema = ColorStatusSchema;
+exports.ComposableCapabilitiesSchema = ComposableCapabilitiesSchema;
+exports.ComposableCapabilitySchema = ComposableCapabilitySchema;
+exports.ComposableFieldSchema = ComposableFieldSchema;
 exports.ComposerApplyInputSchema = ComposerApplyInputSchema;
 exports.ComposerApplyResultSchema = ComposerApplyResultSchema;
 exports.ComposerBlockSchema = ComposerBlockSchema;
@@ -68679,6 +68921,7 @@ exports.DISPLAY_ICON_GROUPS = DISPLAY_ICON_GROUPS;
 exports.DISPLAY_ICON_KEYS = DISPLAY_ICON_KEYS;
 exports.DISPLAY_ICON_OFFERED_KEYS = DISPLAY_ICON_OFFERED_KEYS;
 exports.DISPLAY_ICON_VOCABULARY = DISPLAY_ICON_VOCABULARY;
+exports.DOORBELL_RISE_DEBOUNCE_MS = DOORBELL_RISE_DEBOUNCE_MS;
 exports.DOORBELL_SOURCE_SLOT = DOORBELL_SOURCE_SLOT;
 exports.DataStoreEngineInfoSchema = EngineInfoSchema;
 exports.DayNightModeSchema = DayNightModeSchema;
@@ -68816,6 +69059,7 @@ exports.ExtensionSourceHealthSchema = ExtensionSourceHealthSchema;
 exports.ExtensionSourceSchema = ExtensionSourceSchema;
 exports.FEEDER_EXAMPLE_ADDON_ID = FEEDER_EXAMPLE_ADDON_ID;
 exports.FEEDER_EXAMPLE_HA_DEVICE_ID = FEEDER_EXAMPLE_HA_DEVICE_ID;
+exports.FFMPEG_PATH_ENV = require_composition.FFMPEG_PATH_ENV;
 exports.FIRST_LEVEL_MACRO_CLASSES = FIRST_LEVEL_MACRO_CLASSES;
 exports.FULL_IMAGE_BBOX = FULL_IMAGE_BBOX;
 exports.FailureContributionSchema = FailureContributionSchema;
@@ -69484,6 +69728,7 @@ exports.ServerUpdateActionResultSchema = ServerUpdateActionResultSchema;
 exports.ServerUpdateCheckResultSchema = ServerUpdateCheckResultSchema;
 exports.ServerUpdateOutcomeSchema = ServerUpdateOutcomeSchema;
 exports.ServerUpdateStateSchema = ServerUpdateStateSchema;
+exports.SetCameraSensorsInputSchema = SetCameraSensorsInputSchema;
 exports.SetLoggingSettingsInputSchema = SetLoggingSettingsInputSchema;
 exports.SetSiteLocationInputSchema = SetSiteLocationInputSchema;
 exports.SettingsPatchSchema = SettingsPatchSchema;
@@ -69732,6 +69977,7 @@ exports.buildAddonRouteProvider = buildAddonRouteProvider;
 exports.buildAudioArgs = require_composition.buildAudioArgs;
 exports.buildCapabilityLookup = buildCapabilityLookup;
 exports.buildDeviceAdminUrl = buildDeviceAdminUrl;
+exports.buildDoorbellCompositionFeature = buildDoorbellCompositionFeature;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
 exports.buildFfmpegArgs = require_composition.buildFfmpegArgs;
 exports.buildInputArgs = require_composition.buildInputArgs;
@@ -69740,6 +69986,7 @@ exports.buildNcTaxonomy = buildNcTaxonomy;
 exports.buildRoleScopes = buildRoleScopes;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
 exports.buildVideoArgs = require_composition.buildVideoArgs;
+exports.builtCapabilityBlockers = builtCapabilityBlockers;
 exports.buttonCapability = buttonCapability;
 exports.cameraCredentialsCapability = cameraCredentialsCapability;
 exports.cameraGridLayoutCapability = cameraGridLayoutCapability;
@@ -69832,6 +70079,7 @@ exports.deriveBatteryPresence = deriveBatteryPresence;
 exports.deriveCameraSwitches = deriveCameraSwitches;
 exports.deriveDetailCropRect = deriveDetailCropRect;
 exports.deriveRecordingMode = deriveRecordingMode;
+exports.describeComposableCaps = describeComposableCaps;
 exports.describeCustomActions = require_sleep.describeCustomActions;
 exports.describeModelVariant = describeModelVariant;
 exports.describeOnboardClamp = describeOnboardClamp;
@@ -69859,6 +70107,7 @@ exports.deviceStatusCapability = deviceStatusCapability;
 exports.displayIconEntry = displayIconEntry;
 exports.displayIconsInGroup = displayIconsInGroup;
 exports.doorbellCapability = doorbellCapability;
+exports.doorbellFeatureSources = doorbellFeatureSources;
 exports.droppedConditionsForKind = droppedConditionsForKind;
 exports.egressTranscodeSharingKey = egressTranscodeSharingKey;
 exports.egressTransportFromRequest = egressTransportFromRequest;
@@ -70024,6 +70273,7 @@ exports.maskUrlCredentials = maskUrlCredentials;
 exports.mayReadLocation = mayReadLocation;
 exports.mayWriteToLocation = mayWriteToLocation;
 exports.mediaPlayerCapability = mediaPlayerCapability;
+exports.memoizePinnedFfmpeg = memoizePinnedFfmpeg;
 exports.mergeSourceInfo = mergeSourceInfo;
 exports.meshNetworkCapability = meshNetworkCapability;
 exports.method = require_sleep.method;