@camstack/types 1.2.43 → 1.2.45

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BE4PDZ_3.js");
-const require_sleep = require("./sleep-Bx9IIoT0.js");
-const require_canonical_hash = require("./canonical-hash-BcZHRHIx.js");
+const require_sleep = require("./sleep-BOI-sVEA.js");
+const require_fmp4_box_splitter = require("./fmp4-box-splitter-BkWH7O3L.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 let zod = require("zod");
@@ -231,383 +231,6 @@ function encodeProfileFromStreamShape(stream) {
 	};
 }
 //#endregion
-//#region src/ffmpeg/invocation.ts
-var AUDIO_ENCODER_BY_CODEC = {
-	opus: "libopus",
-	aac: "aac",
-	pcmu: "pcm_mulaw",
-	pcma: "pcm_alaw"
-};
-/**
-* Camera-microphone audio, per codec. Lives HERE rather than in
-* `encode-defaults.ts` only to avoid an import cycle (`encode-defaults` depends
-* on these types); it is re-exported from there, which is where to read it.
-*
-* Every source in this repo is a mono camera mic. The former broker preset
-* encoded Opus at `channels: 2`, spending bitrate duplicating one channel —
-* that is the value this consolidation changed.
-*/
-var AUDIO_PRESETS = {
-	aac: {
-		kind: "encode",
-		codec: "aac",
-		bitrateKbps: 128,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	opus: {
-		kind: "encode",
-		codec: "opus",
-		bitrateKbps: 64,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	pcmu: {
-		kind: "encode",
-		codec: "pcmu",
-		sampleRateHz: 8e3,
-		channels: 1
-	}
-};
-/** `-hide_banner -loglevel <level>` — every ffmpeg site opens with this. */
-function logBannerArgs(level) {
-	return [
-		"-hide_banner",
-		"-loglevel",
-		level
-	];
-}
-/** `true` when the resolved value means "decode in software" (⇒ no `-hwaccel`). */
-function isSoftwareDecode(decodeHwAccel) {
-	return !decodeHwAccel || decodeHwAccel === "none" || decodeHwAccel === "copy";
-}
-/**
-* Every INPUT option, in order, terminated by `-i <url>`. Nothing may be
-* appended to this list by a caller — that is the whole point of the function.
-*/
-function buildInputArgs(input, decodeHwAccel) {
-	const args = [];
-	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
-	if (input.extraArgs?.length) args.push(...input.extraArgs);
-	if (input.analyzeDurationUs !== void 0) args.push("-analyzeduration", String(input.analyzeDurationUs));
-	if (input.probeSizeBytes !== void 0) args.push("-probesize", String(input.probeSizeBytes));
-	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
-	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
-	args.push("-i", input.url);
-	return args;
-}
-/** The `-vf` filter args, or `[]` when a consumer `-vf` already claims the slot. */
-function buildVideoFilterArgs(scale, outputArgs) {
-	if (!scale) return [];
-	if (outputArgs.some((a) => a === "-vf")) return [];
-	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}`];
-	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2`];
-}
-/** Rate-control args for an encode plan. */
-function buildRateControlArgs(video) {
-	const kbps = video.bitrateKbps;
-	if (kbps === void 0) return [];
-	const rc = video.rateControl ?? {
-		kind: "cap",
-		vbvSeconds: 2
-	};
-	const bufsize = Math.max(1, Math.round(kbps * rc.vbvSeconds));
-	return [
-		...rc.kind === "cbr" ? ["-b:v", `${kbps}k`] : [],
-		"-maxrate",
-		`${kbps}k`,
-		"-bufsize",
-		`${bufsize}k`
-	];
-}
-/** The whole video block (`-vf` … `-c:v` … knobs), after `-i`. */
-function buildVideoArgs(video, outputArgs) {
-	if (video.kind === "copy") return [
-		"-c:v",
-		"copy",
-		...video.bitstreamFilter ? ["-bsf:v", video.bitstreamFilter] : []
-	];
-	const args = [
-		...buildVideoFilterArgs(video.scale, outputArgs),
-		"-c:v",
-		video.encoder
-	];
-	if (video.preset !== void 0) args.push("-preset", video.preset);
-	if (video.tune !== void 0) args.push("-tune", video.tune);
-	if (video.profile !== void 0) args.push("-profile:v", video.profile);
-	if (video.level !== void 0) args.push("-level", video.level);
-	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
-	if (video.fps !== void 0) args.push("-r", String(video.fps));
-	if (video.gopFrames !== void 0) args.push("-g", String(video.gopFrames));
-	if (video.forceKeyFramesSeconds !== void 0) args.push("-force_key_frames", `expr:gte(t,n_forced*${video.forceKeyFramesSeconds})`);
-	if (video.bf !== void 0) args.push("-bf", String(video.bf));
-	args.push(...buildRateControlArgs(video));
-	if (video.bitstreamFilter !== void 0) args.push("-bsf:v", video.bitstreamFilter);
-	return args;
-}
-/** The whole audio block, after `-i`. */
-function buildAudioArgs(audio) {
-	if (audio.kind === "none") return ["-an"];
-	if (audio.kind === "copy") return ["-c:a", "copy"];
-	const args = [];
-	if (audio.filter !== void 0) args.push("-af", audio.filter);
-	args.push("-c:a", AUDIO_ENCODER_BY_CODEC[audio.codec]);
-	if (audio.application !== void 0) args.push("-application", audio.application);
-	if (audio.frameDurationMs !== void 0) args.push("-frame_duration", String(audio.frameDurationMs));
-	if (audio.globalHeader === true) args.push("-flags", "+global_header");
-	if (audio.sampleRateHz !== void 0) args.push("-ar", String(audio.sampleRateHz));
-	if (audio.bitrateKbps !== void 0) args.push("-b:a", `${audio.bitrateKbps}k`);
-	if (audio.vbvBufferKbits !== void 0) args.push("-bufsize", `${audio.vbvBufferKbits}k`);
-	if (audio.channels !== void 0) args.push("-ac", String(audio.channels));
-	return args;
-}
-/** RTP output-leg args (`-payload_type`, `-ssrc`, `-sdp_file`, `-f rtp <url>`). */
-function buildRtpOutputArgs(out) {
-	const args = [];
-	if (out.payloadType !== void 0) args.push("-payload_type", String(out.payloadType));
-	if (out.ssrc !== void 0) args.push("-ssrc", String(out.ssrc));
-	if (out.sdpFile !== void 0) args.push("-sdp_file", out.sdpFile);
-	args.push("-f", "rtp", out.url);
-	return args;
-}
-/** `true` when the sink is a raw elementary bytestream that cannot mux audio. */
-function isElementaryVideoSink(sink) {
-	return sink.kind === "stdout" && (sink.container === "h264" || sink.container === "hevc");
-}
-/**
-* The fragmented-MP4 muxer flags, in the order the recorder has proven them
-* (`recorder/addon/ffmpeg-args.ts` passes the same `movflags` string through
-* `-segment_format_options`, across every vendor in the fleet):
-*
-* - `frag_keyframe` — cut a fragment at each key frame, so every fragment
-*   opens on a sync sample. HKSV's whole requirement.
-* - `empty_moov` — write `ftyp`+`moov` up front with no samples in it, which
-*   is what makes the head a standalone INITIALISATION segment.
-* - `default_base_moof` — fragment offsets are self-relative, so a fragment is
-*   demuxable without the bytes that preceded it. D31's byte-range read path
-*   depends on exactly this property of the recorder's segments.
-*/
-var FMP4_MOVFLAGS = "+frag_keyframe+empty_moov+default_base_moof";
-/**
-* The terminal sink args for every non-`rtp-outputs` sink. Exhaustive over the
-* union so a new member cannot fall through to `['-f', container, 'pipe:1']`,
-* which is what a plain `container` read would have done for `mp4` — a valid
-* argv that writes a NON-fragmented, unseekable-to-a-pipe MP4 and produces one
-* unusable byte stream.
-*/
-function buildStdoutOrRtspSinkArgs(sink) {
-	if (sink.kind === "rtsp-listen") return [
-		"-f",
-		"rtsp",
-		"-rtsp_transport",
-		"tcp",
-		"-rtsp_flags",
-		"listen",
-		sink.url
-	];
-	if (sink.kind === "rtp-outputs") return [];
-	return sink.container === "mp4" ? buildFmp4SinkArgs(sink) : [
-		"-f",
-		sink.container,
-		"pipe:1"
-	];
-}
-/** `-movflags … -min_frag_duration <us> -f mp4 pipe:1`. */
-function buildFmp4SinkArgs(sink) {
-	return [
-		"-movflags",
-		FMP4_MOVFLAGS,
-		"-min_frag_duration",
-		String(Math.max(0, Math.round(sink.fragmentMs * 1e3))),
-		"-f",
-		"mp4",
-		"pipe:1"
-	];
-}
-/**
-* A second output mapping source audio to RTP-over-UDP. `0:a:0?` makes the
-* audio optional so a source with no audio skips it instead of failing the
-* whole invocation.
-*/
-function buildAudioSidecarArgs(sidecar) {
-	return [
-		"-map",
-		"0:a:0?",
-		...buildAudioArgs(sidecar.codec === "pcma" ? {
-			kind: "encode",
-			codec: "pcma",
-			sampleRateHz: 8e3,
-			channels: 1
-		} : AUDIO_PRESETS[sidecar.codec]),
-		...buildRtpOutputArgs({
-			url: sidecar.rtpUrl,
-			sdpFile: sidecar.sdpFile
-		})
-	];
-}
-/**
-* Assemble the full ffmpeg argument list. Layout:
-*
-*   -hide_banner -loglevel <level>
-*   [-hwaccel <backend|auto>]        ─┐ INPUT options — strictly before -i.
-*   [<input.extraArgs>]               │
-*   [-fflags <flag>…]                 │
-*   [-rtsp_transport tcp]             │
-*   -i <url>                         ─┘
-*   <video block>  <threads>  <audio block>   ─┐ OUTPUT options.
-*   <consumer outputArgs verbatim>             │
-*   <sink>                                    ─┘ terminal
-*/
-function buildFfmpegArgs(inv) {
-	const head = [...logBannerArgs(inv.logLevel), ...buildInputArgs(inv.input, inv.decodeHwAccel)];
-	const threadArgs = inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [];
-	if (inv.sink.kind === "rtp-outputs") {
-		const videoLeg = inv.sink.video ? [
-			"-an",
-			"-map",
-			"0:v:0",
-			...buildVideoArgs(inv.video, inv.outputArgs),
-			...threadArgs,
-			...inv.outputArgs,
-			...buildRtpOutputArgs(inv.sink.video)
-		] : [];
-		const audioLeg = inv.sink.audio ? [
-			"-vn",
-			"-map",
-			"0:a:0?",
-			...buildAudioArgs(inv.audio),
-			...buildRtpOutputArgs(inv.sink.audio)
-		] : [];
-		return [
-			...head,
-			...videoLeg,
-			...audioLeg
-		];
-	}
-	const audioArgs = isElementaryVideoSink(inv.sink) ? ["-an"] : buildAudioArgs(inv.audio);
-	const sinkArgs = buildStdoutOrRtspSinkArgs(inv.sink);
-	return [
-		...head,
-		...buildVideoArgs(inv.video, inv.outputArgs),
-		...threadArgs,
-		...audioArgs,
-		...inv.outputArgs,
-		...sinkArgs,
-		...inv.audioSidecar ? buildAudioSidecarArgs(inv.audioSidecar) : []
-	];
-}
-/**
-* Hardware ENCODER ids per decode-hwaccel backend — a static, deterministic
-* map (the same shape the reference NVR uses: platform → encoder, no probe).
-*/
-var ENCODER_IDS_BY_BACKEND = {
-	videotoolbox: {
-		h264: "h264_videotoolbox",
-		h265: "hevc_videotoolbox"
-	},
-	vaapi: {
-		h264: "h264_vaapi",
-		h265: "hevc_vaapi"
-	},
-	qsv: {
-		h264: "h264_qsv",
-		h265: "hevc_qsv"
-	},
-	cuda: {
-		h264: "h264_nvenc",
-		h265: "hevc_nvenc"
-	},
-	nvdec: {
-		h264: "h264_nvenc",
-		h265: "hevc_nvenc"
-	},
-	amf: {
-		h264: "h264_amf",
-		h265: "hevc_amf"
-	}
-};
-/**
-* The hardware encoder for a target codec on `backend`, or the software one.
-* `'auto'` is NOT a backend identity (it is an instruction to ffmpeg), so it
-* maps to software encoding.
-*/
-function pickVideoEncoder(target, backend, useHardware) {
-	const software = target === "h264" ? "libx264" : "libx265";
-	if (!useHardware || backend === null || isSoftwareDecode(backend) || backend === "auto") return software;
-	const ids = ENCODER_IDS_BY_BACKEND[backend.toLowerCase()];
-	if (!ids) return software;
-	return target === "h264" ? ids.h264 : ids.h265;
-}
-/** Map an `EncodeProfile.audio` to an audio plan. */
-function audioPlanFromEncodeProfile(audio) {
-	if (audio === "passthrough") return { kind: "none" };
-	if (audio.codec === "copy") return { kind: "copy" };
-	return {
-		kind: "encode",
-		codec: audio.codec,
-		...audio.bitrateKbps !== void 0 ? { bitrateKbps: audio.bitrateKbps } : {},
-		...audio.sampleRateHz !== void 0 ? { sampleRateHz: audio.sampleRateHz } : {},
-		...audio.channels !== void 0 ? { channels: audio.channels } : {}
-	};
-}
-/**
-* Adapt an `EncodeProfile` (the operator/consumer-facing shape) into an
-* {@link FfmpegInvocation}. This is the ONLY bridge between the two models —
-* a second one is how the repo grew two argv builders that disagreed about
-* hardware.
-*
-* Smart video copy: when the source already speaks the requested codec the
-* encode block is elided entirely and ffmpeg runs as a re-muxer on the video
-* plane. Width / height / fps / bitrate in the profile are a downstream BUDGET,
-* not a forced rescale.
-*/
-function invocationFromEncodeProfile(input) {
-	const v = input.profile.video;
-	const shouldCopy = v.codec === "copy" || input.forceReencode !== true && v.codec === input.sourceCodec;
-	const scale = v.width !== void 0 && v.height !== void 0 ? {
-		mode: "fit",
-		width: v.width,
-		height: v.height
-	} : null;
-	const target = v.codec === "h265" ? "h265" : "h264";
-	const video = shouldCopy ? {
-		kind: "copy",
-		...input.bitstreamFilter !== void 0 ? { bitstreamFilter: input.bitstreamFilter } : {}
-	} : {
-		kind: "encode",
-		encoder: pickVideoEncoder(target, input.decodeHwAccel, input.hardwareEncoders === true),
-		scale,
-		...v.preset !== void 0 ? { preset: v.preset } : {},
-		...v.tune !== void 0 ? { tune: v.tune } : {},
-		...v.profile !== void 0 ? { profile: v.profile } : {},
-		...v.level !== void 0 ? { level: v.level } : {},
-		...input.pixelFormat !== void 0 ? { pixelFormat: input.pixelFormat } : {},
-		...v.fps !== void 0 ? { fps: v.fps } : {},
-		...v.gopFrames !== void 0 ? { gopFrames: v.gopFrames } : {},
-		...input.forceKeyFramesSeconds !== void 0 ? { forceKeyFramesSeconds: input.forceKeyFramesSeconds } : {},
-		...v.bf !== void 0 ? { bf: v.bf } : {},
-		...v.bitrateKbps !== void 0 ? { bitrateKbps: v.bitrateKbps } : {},
-		...input.rateControl !== void 0 ? { rateControl: input.rateControl } : {},
-		...input.bitstreamFilter !== void 0 ? { bitstreamFilter: input.bitstreamFilter } : {}
-	};
-	return {
-		logLevel: input.logLevel ?? "error",
-		decodeHwAccel: input.decodeHwAccel,
-		input: {
-			url: input.sourceUrl,
-			rtspTransport: "tcp",
-			fflags: ["+discardcorrupt"],
-			...input.profile.inputArgs?.length ? { extraArgs: input.profile.inputArgs } : {}
-		},
-		video,
-		audio: audioPlanFromEncodeProfile(input.profile.audio),
-		threadCount: input.threadCount ?? 0,
-		outputArgs: input.profile.outputArgs ?? [],
-		sink: input.sink,
-		...input.audioSidecar !== void 0 ? { audioSidecar: input.audioSidecar } : {}
-	};
-}
-//#endregion
 //#region src/ffmpeg/encode-defaults.ts
 /**
 * The shape every live egress starts from: H.264 Baseline 3.1 at 720p25.
@@ -858,7 +481,7 @@ function canonicalEgressPlan(request, delivery = egressTransportFromRequest(requ
 * every other consumer to 360p.
 */
 function egressTranscodeSharingKey(request, delivery = egressTransportFromRequest(request)) {
-	return `egress:${require_canonical_hash.canonicalHash(canonicalEgressPlan(request, delivery))}`;
+	return `egress:${require_fmp4_box_splitter.canonicalHash(canonicalEgressPlan(request, delivery))}`;
 }
 //#endregion
 //#region src/health/wiring-health.ts
@@ -991,6 +614,19 @@ var DEFAULT_RETENTION = {
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
 * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
 * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+* | `broker-audio` | `streamBroker.setDeviceAudioMute` → `DeviceOverride.audioMuted` | `StreamBroker.setAudioMuted` drops the audio plane at the source: no `type:'audio'` packet leaves `fanOutEncoded`, no RTP reaches the restreamer, and the restreamer serves the video-only SDP |
+*
+* ## `device-audio` and `broker-audio` are two functions, not two knobs
+*
+* They look adjacent and they are not the same control ([D83](../../../../docs/decisions/adr-0083.md)):
+* `device-audio` writes the CAMERA, so it is hardware privacy — the microphone
+* genuinely stops, it survives CamStack entirely, and it costs a multi-second
+* encoder restart on every flip. `broker-audio` writes THIS server, so it is
+* instant, vendor-independent and reversible without touching the camera, and
+* a camera that ignores or lacks the ISAPI/Reolink control is still silenced.
+* D62 forbids a second switch that *disagrees* with the first; these two
+* cannot disagree, because neither reads the other's store — the camera holds
+* one, the broker holds the other, and each reports its own fact.
 *
 * ## The two switches whose authority is not on this server
 *
@@ -1052,6 +688,7 @@ var CameraSwitchIdSchema = zod.z.enum([
 	"object-detection",
 	"privacy-mask",
 	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -1067,12 +704,17 @@ var CameraSwitchIdSchema = zod.z.enum([
 * `object-detection` despite feeding it: a mask blanks REGIONS, so its blast
 * radius is partial, and the "broadest first" rule does not rank a partial
 * control above a whole-function one.
+*
+* `broker-audio` sits directly BELOW `device-audio` by the same source-first
+* rule: the camera's microphone feeds the broker, so silencing the camera
+* leaves the broker's mute with nothing to suppress; the reverse is not true.
 */
 var CAMERA_SWITCH_ORDER = [
 	"stream-broker",
 	"object-detection",
 	"privacy-mask",
 	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -1098,7 +740,8 @@ var CameraSwitchAuthoritySchema = zod.z.discriminatedUnion("kind", [
 	zod.z.object({
 		kind: zod.z.literal("camera-mask"),
 		capName: zod.z.string()
-	})
+	}),
+	zod.z.object({ kind: zod.z.literal("broker-audio-mute") })
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
@@ -1197,6 +840,13 @@ var CAMERA_SWITCH_CATALOG = {
 		},
 		countsAsSwitchedOff: true
 	},
+	"broker-audio": {
+		id: "broker-audio",
+		label: "Audio distribution",
+		costWhenOff: "Off: this server distributes no sound for this camera — live view is silent and everything recorded while it is off is silent FOREVER, even after you turn it back on. Audio detection and classification also have nothing to analyse. The camera keeps capturing sound, so nothing about the camera changes and turning this back on is instant, with no interruption to the picture.",
+		authority: { kind: "broker-audio-mute" },
+		countsAsSwitchedOff: true
+	},
 	"audio-analysis": {
 		id: "audio-analysis",
 		label: "Audio detection & classification",
@@ -1315,6 +965,18 @@ function resolveState(descriptor, input) {
 				enabled: mask.enabled
 			};
 		}
+		case "broker-audio-mute": {
+			const broker = input.brokerAudio;
+			if (broker === null) return {
+				available: false,
+				enabled: true,
+				unavailableReason: "source-unreachable"
+			};
+			return {
+				available: true,
+				enabled: !broker.muted
+			};
+		}
 	}
 }
 /**
@@ -4756,7 +4418,44 @@ var streamBrokerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		isRtspEnabled: require_sleep.method(zod.z.object({ brokerId: zod.z.string() }), zod.z.boolean())
+		isRtspEnabled: require_sleep.method(zod.z.object({ brokerId: zod.z.string() }), zod.z.boolean()),
+		/**
+		* ── Per-device audio-plane policy (D83) ───────────────────────────
+		*
+		* The BROKER-side mute: while `muted`, this node distributes none of
+		* the device's audio, on any plane it serves — live (WebRTC / encoded
+		* subscribers) AND recording (the RTSP restreamer the recorder pulls,
+		* which additionally serves the video-only SDP so the recorder's ffmpeg
+		* never declares an audio stream it will not receive).
+		*
+		* Keyed by `deviceId`, not `brokerId`: every one of a camera's streams
+		* carries the same microphone, and a per-stream answer would let main
+		* and sub disagree about whether the camera is silent.
+		*
+		* The state lives in the broker's existing `DeviceOverride` blob — no
+		* new store — and the mute is applied to a fresh broker at creation, so
+		* a restart, a re-dial or a catalog republish never un-mutes a camera.
+		*/
+		getDeviceAudioMute: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({
+			muted: zod.z.boolean(),
+			/**
+			* How many live non-derived brokers currently hold the mute. Purely
+			* diagnostic: `muted` is the policy and is authoritative on its own
+			* (it applies to brokers that do not exist yet), while this says
+			* whether anything is presently being silenced.
+			*/
+			appliedBrokers: zod.z.number().int().nonnegative()
+		})),
+		setDeviceAudioMute: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			muted: zod.z.boolean()
+		}), zod.z.object({
+			muted: zod.z.boolean(),
+			appliedBrokers: zod.z.number().int().nonnegative()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	events: {
 		onCamStreamDemand: require_sleep.event(zod.z.object({
@@ -12603,6 +12302,30 @@ var TrackSourceSchema = zod.z.enum([
 	"audio"
 ]);
 /**
+* Where a track sits in the RETRAIN lifecycle (D81).
+*
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = zod.z.enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
 * Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
 * by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
 * so the two surfaces cannot drift.
@@ -12612,18 +12335,31 @@ var TrackSourceSchema = zod.z.enum([
 * columns existed read as absent, and a consumer that needs a boolean should say
 * `flag === true`, not `flag !== false`.
 *
-* What the flags DO is deliberately UNDEFINED at the time of writing: they are
-* operator curation, and the behaviour they drive will be specified separately.
-* In particular a `markForTrain` track is NOT pinned against retention — see
-* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
 */
 var TrackFlagFields = {
-	/** Operator marked this track as training material. */
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
 	markForTrain: zod.z.boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
 	debug: zod.z.boolean().optional()
 };
 /**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
 * The write half: a PARTIAL patch. An omitted key is left untouched, so setting
 * one flag can never clear the other — the toggles are independent and are
 * driven from three surfaces that do not know about each other.
@@ -12637,13 +12373,108 @@ var TrackFlagsPatchSchema = zod.z.object(TrackFlagFields);
 var TrackFlagsSchema = zod.z.object({
 	trackId: zod.z.string(),
 	markForTrain: zod.z.boolean(),
-	debug: zod.z.boolean()
+	debug: zod.z.boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+/**
+* WHICH tier a label occupies. The slot a label lands in is DECLARED by the
+* step that produced it (`StepDefinition.labelTier`), never inferred from the
+* text or the step's name.
+*
+*  - `1` — a SUB-CLASS: finer than the macro class, still a taxonomy token.
+*    `animal-type` (`dog`, `bird`), `vehicle-type` (`van`), and the root
+*    detector's own raw class when it is finer than the macro it maps to.
+*  - `2` — an INSTANCE: the finest thing said about this subject.
+*    `species` (`Turdus migratorius`), `identity` (`Alice`), `plate-text`.
+*
+* The macro class itself (`person`, `vehicle`, `animal`, `package`, `face`,
+* `plate`, `audio`) is NOT a tier — it is `className`, and a macro token
+* offered for either label slot is refused (2026-08-07 rule; the refusal is
+* logged as `label tier collapse refused`).
+*/
+var LabelTierSchema = zod.z.union([zod.z.literal(1), zod.z.literal(2)]);
+/**
+* WHO decided a label, and when. Carried per tier so a value can be traced to
+* the step and model that produced it — which is what makes the write rule
+* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
+* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
+*
+* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
+* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
+* `migration:4g` for a value the 4g migration moved from the single-slot era —
+* that value has no provenance, and the write rule lets ANY properly-attributed
+* write of the same tier replace it regardless of score.
+*/
+var LabelAttributionSchema = zod.z.object({
+	stepId: zod.z.string(),
+	modelId: zod.z.string().optional(),
+	decidedAt: zod.z.number()
+});
+/**
+* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
+* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
+* track and its events always answer the same question the same way.
+*
+* Two scalar columns, not an array: every consumer wants "the coarse one" or
+* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
+* is tier 2, and each carries its own score + attribution.
+*
+* **Reading it.** What a human should be shown is `subLabel ?? label` — the
+* finest thing known. Before 4g the single `label` column held the finest
+* value, so a consumer that has not been updated reads the tier-1 slot and
+* shows nothing on a species-only row; that is why the migration puts every
+* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
+* and why the read surfaces were changed in the same train.
+*
+* **Writing it.** The slots are independent, which is the whole point: a
+* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
+* migratorius`), so fineness cannot regress by construction. Within a tier the
+* higher score wins. One rule, one implementation — see
+* `pipeline/label-tier.ts` in addon-post-analysis.
+*/
+var TieredLabelFields = {
+	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
+	label: zod.z.string().optional(),
+	/** Confidence of the tier-1 value, as reported by the deciding step. */
+	labelScore: zod.z.number().optional(),
+	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
+	labelMeta: LabelAttributionSchema.optional(),
+	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
+	subLabel: zod.z.string().optional(),
+	/** Confidence of the tier-2 value, as reported by the deciding step. */
+	subLabelScore: zod.z.number().optional(),
+	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
+	subLabelMeta: LabelAttributionSchema.optional()
+};
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	tracks: zod.z.number().int(),
+	files: zod.z.number().int(),
+	bytes: zod.z.number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = zod.z.object({
+	generatedAt: zod.z.number(),
+	trackCount: zod.z.number().int(),
+	fileCount: zod.z.number().int(),
+	byteCount: zod.z.number().int(),
+	/** More marked tracks exist than a single pass carries. */
+	truncated: zod.z.boolean(),
+	devices: zod.z.array(TrainingExportDeviceTotalsSchema).readonly()
 });
 var TrackSchema = zod.z.object({
 	trackId: zod.z.string(),
 	deviceId: zod.z.number(),
 	className: zod.z.string(),
-	label: zod.z.string().optional(),
+	...TieredLabelFields,
 	producingDeviceName: zod.z.string().optional(),
 	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
 	source: TrackSourceSchema.optional(),
@@ -12682,7 +12513,8 @@ var TrackSchema = zod.z.object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var BaseEventFields = {
 	id: zod.z.string(),
@@ -12763,7 +12595,7 @@ var ObjectEventSchema = zod.z.object({
 	/** Omitted in slim projection. */
 	trackId: zod.z.string().optional(),
 	className: zod.z.string(),
-	label: zod.z.string().optional(),
+	...TieredLabelFields,
 	/** Omitted in slim projection. */
 	confidence: zod.z.number().optional(),
 	/** Heavy JSON — omitted in slim projection. */
@@ -12844,6 +12676,173 @@ var MediaFileSchema = zod.z.object({
 * stored blob and a `?variant=thumb` rendering without fetching either.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
+/**
+* The MACRO tier of an annotation — a CLOSED set.
+*
+* This is what the exported detector predicts, so a typo here is a new class
+* with one example in it. `label` and `subLabel` are open strings by contrast:
+* the whole point of the page is teaching the model things it does not know
+* yet, and constraining that vocabulary would make it useless.
+*
+* A macro class is NEVER a label. The provider refuses a write whose `label` or
+* `subLabel` is one of these values, in any casing, because once `person`
+* exists in both tiers "every person box" stops being answerable without
+* knowing every string anyone ever typed — and the damage is retroactive.
+*/
+var RetrainMacroClassSchema = zod.z.enum([
+	"person",
+	"vehicle",
+	"animal",
+	"package",
+	"face",
+	"plate"
+]);
+/** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
+var RetrainAnnotationKindSchema = zod.z.enum(["subject", "model_error"]);
+/** Did a human draw this box, or did the assist propose it? */
+var RetrainAnnotationSourceSchema = zod.z.enum(["operator", "assist"]);
+/** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
+var RetrainBboxSchema = zod.z.object({
+	x: zod.z.number(),
+	y: zod.z.number(),
+	w: zod.z.number(),
+	h: zod.z.number()
+});
+/**
+* One annotated subject.
+*
+* `bbox` is normalised against the full frame, ALWAYS. The per-model shapes
+* (letterboxed root / zone-cropped package / subject-cropped classifier) are
+* derived from it at export and never stored — storing them is how one feature
+* space ends up holding two crops of the same subject (D52).
+*/
+var RetrainAnnotationSchema = zod.z.object({
+	id: zod.z.string(),
+	trackId: zod.z.string(),
+	deviceId: zod.z.number(),
+	/** The COPY in retrain storage — never the source track's media key. */
+	mediaKey: zod.z.string(),
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: zod.z.string().optional(),
+	subLabel: zod.z.string().optional(),
+	kind: RetrainAnnotationKindSchema,
+	source: RetrainAnnotationSourceSchema,
+	/** Which model proposed this box — or, on a `model_error`, drew the phantom. */
+	assistModelId: zod.z.string().optional(),
+	assistScore: zod.z.number().optional(),
+	exportedInBatch: zod.z.string().optional(),
+	createdAt: zod.z.number()
+});
+/** The write form — the server owns `id`, `createdAt` and the frame binding. */
+var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
+	id: true,
+	trackId: true,
+	deviceId: true,
+	mediaKey: true,
+	createdAt: true,
+	exportedInBatch: true
+});
+/** A track sitting in `staging`, with everything the worklist needs to rank it. */
+var RetrainTrackSchema = zod.z.object({
+	trackId: zod.z.string(),
+	deviceId: zod.z.number(),
+	className: zod.z.string(),
+	label: zod.z.string().optional(),
+	firstSeen: zod.z.number(),
+	lastSeen: zod.z.number(),
+	/** How many frames the dataset already holds from this track. */
+	frameCount: zod.z.number().int(),
+	/** How many subjects have been annotated on those frames. `0` with
+	*  `frameCount: 0` is exactly "staging, still to work". */
+	annotationCount: zod.z.number().int()
+});
+/** A frame the picker may offer — an index row, no blob was read to produce it. */
+var RetrainFrameCandidateSchema = zod.z.object({
+	mediaKey: zod.z.string(),
+	kind: MediaFileKindEnum,
+	timestamp: zod.z.number(),
+	sizeBytes: zod.z.number().int(),
+	/** A copy of this original already exists — selecting it is free and cannot
+	*  fail, whatever became of the original. */
+	copied: zod.z.boolean()
+});
+/** A frame the dataset OWNS: bytes copied at selection time. */
+var RetrainFrameSchema = zod.z.object({
+	frameId: zod.z.string(),
+	deviceId: zod.z.number(),
+	trackId: zod.z.string(),
+	/** Provenance only. It may already point at nothing — that is expected. */
+	sourceMediaKey: zod.z.string(),
+	sourceKind: MediaFileKindEnum,
+	sizeBytes: zod.z.number().int(),
+	width: zod.z.number().int(),
+	height: zod.z.number().int(),
+	copiedAt: zod.z.number()
+});
+/** Why a copy-on-select could not be honoured — named, never a silent skip. */
+var RetrainCopyRefusalSchema = zod.z.enum([
+	"source-missing",
+	"unreadable-image",
+	"write-failed"
+]);
+var RetrainFrameSelectionSchema = zod.z.object({
+	copied: zod.z.array(RetrainFrameSchema).readonly(),
+	refused: zod.z.array(zod.z.object({
+		sourceMediaKey: zod.z.string(),
+		reason: RetrainCopyRefusalSchema
+	})).readonly()
+});
+var RetrainFrameListSchema = zod.z.object({
+	candidates: zod.z.array(RetrainFrameCandidateSchema).readonly(),
+	copies: zod.z.array(RetrainFrameSchema).readonly(),
+	/** What the page pre-selects — the native key frame when one survives. */
+	autoPickMediaKey: zod.z.string().optional()
+});
+/** What the operator asked the assist to look for. */
+var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("package"),
+	zone: RetrainBboxSchema.optional()
+}), zod.z.object({
+	kind: zod.z.literal("objects"),
+	modelId: zod.z.string(),
+	minScore: zod.z.number().optional()
+})]);
+/**
+* The assist's answer — a discriminated union, because "the model saw nothing"
+* and "this node cannot run that model" lead to different next moves and a
+* nullable result cannot tell them apart.
+*/
+var RetrainAssistResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("proposed"),
+	modelId: zod.z.string(),
+	stepId: zod.z.string(),
+	minScore: zod.z.number(),
+	/** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
+	proposals: zod.z.array(RetrainAnnotationDraftSchema).readonly(),
+	/** Returned by the runner but removed by the threshold. */
+	belowThreshold: zod.z.number().int()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	/** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
+	reason: zod.z.string(),
+	detail: zod.z.string().optional()
+})]);
+/** The outcome of a lifecycle move owned by the retrain page. */
+var RetrainTransitionResultSchema = zod.z.object({
+	trackId: zod.z.string(),
+	/** Where the track ended up, whatever happened. */
+	retrainStatus: RetrainStatusSchema,
+	/** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
+	changed: zod.z.boolean(),
+	reason: zod.z.enum([
+		"unknown-track",
+		"no-frames-copied",
+		"not-staging",
+		"not-trained",
+		"unchanged"
+	]).optional()
+});
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = zod.z.object({
@@ -12898,13 +12897,14 @@ var KeyEventSchema = zod.z.object({
 	/** Track start time (firstSeen). */
 	timestamp: zod.z.number(),
 	className: zod.z.string(),
-	label: zod.z.string().optional(),
+	...TieredLabelFields,
 	importance: zod.z.number(),
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: zod.z.string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
 	windowMs: zod.z.number().optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var TrackedDetectionSchema = zod.z.object({
 	trackId: zod.z.string(),
@@ -13266,11 +13266,29 @@ var pipelineAnalyticsCapability = {
 		*
 		* `auth: 'protected'` (the default), NOT `admin`: the viewer is an
 		* authenticated non-admin surface and two of the three call sites are
-		* there. Revisit if a flag ever gains an effect that costs storage —
-		* `deleteTracks` next door is admin for exactly that reason.
+		* there. The note that used to sit here said to revisit this the day a flag
+		* gained an effect that costs storage, and D81 is that day — `markForTrain`
+		* now pins. It STAYS protected, and the reason is that the alternative
+		* makes the feature pointless: marking a track is something you do while
+		* looking at it, on the surface you were already looking at it on, and that
+		* surface is the viewer. What the storage cost gets instead is a BOUND — a
+		* per-device pin budget enforced in the body, refusing a new pin past the
+		* limit while always allowing un-marking. `deleteTracks` next door is still
+		* admin, because destroying evidence and preserving it are not symmetric.
 		*
-		* Returns the RESOLVED state of both flags (absent → `false`) so a caller
-		* can drive its toggle without a re-fetch. Rejects an unknown track.
+		* `markForTrain` writes the retrain LIFECYCLE, not a boolean column: `true`
+		* is `none → staging`, `false` is `staging → none`. A track already
+		* `trained` refuses BOTH — its frames are copies inside the retrain dataset
+		* and re-staging it from a generic toggle is how the same material gets
+		* annotated twice under two ground truths. Returning a trained track to
+		* staging is a deliberate action of the retrain page, which is also the only
+		* thing that produces `trained` in the first place.
+		*
+		* Returns the RESOLVED state of both flags (absent → `false`) plus the
+		* `retrainStatus` they were derived from, so a caller can drive its toggle
+		* — and render a `trained` badge — without a re-fetch. Rejects an unknown
+		* track, a new staging mark on a device already holding its full budget, and
+		* any `markForTrain` write against a trained track.
 		*/
 		setTrackFlags: require_sleep.method(zod.z.object({
 			/** Log/audit scope only — the trackId is globally unique on its own. */
@@ -13334,6 +13352,237 @@ var pipelineAnalyticsCapability = {
 			kind: "query",
 			auth: "admin"
 		}),
+		/**
+		* The CHEAP QUESTION, asked before any media moves: how big is the dataset
+		* the marked (`markForTrain`) tracks would produce?
+		*
+		* Answered from media INDEX rows only — key, kind, size, timestamp — so it
+		* costs ~2 KB of reads per track and no blob reads at all. The measured harm
+		* behind D56 was a bulk pass that read and base64'd every blob a track owned
+		* before deciding anything, taking hub-main to 82 s busy out of 120; an
+		* export is that same I/O shape, so it inherits the same discipline: know
+		* the size, then decide.
+		*
+		* `truncated` reports that more marked tracks exist than one pass carries.
+		* Empty `deviceIds` ⇒ every device that has marked tracks.
+		*/
+		getTrainingExportSummary: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), TrainingExportSummarySchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Where to download the dataset archive.
+		*
+		* The BYTES do not come back through this cap — they come from the returned
+		* data-plane URL, which streams a tar built entry by entry. A multi-gigabyte
+		* archive base64'd through a unary RPC envelope would be held whole in
+		* memory twice on a hub this repo has already OOM'd once (D9/D18 are the
+		* same lesson about frames). `getDownloadUrl` on `recordingExport` is the
+		* precedent, and this follows it deliberately.
+		*
+		* The archive contains a `manifest.json` FIRST, then the stored media
+		* VERBATIM under `tracks/<deviceId>/<trackId>/…`. No crop is derived and no
+		* model is run: a training set's pixels must be the pixels the pipeline saw.
+		*/
+		getTrainingExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* The staging worklist for one camera, or for every camera that has one.
+		*
+		* Fetched ON DEMAND, over the staging set only — the page never scans
+		* history, because making the working set small is the entire purpose of
+		* the mark. Each row carries how many frames the dataset already holds from
+		* the track and how many subjects were annotated on them, so
+		* `frameCount: 0` reads as "still to work" without a second call per track.
+		*
+		* `auth: 'admin'`, unlike the viewer-level mark itself: marking a track is
+		* curation you do while looking at it, but building the training set the
+		* fleet's models are fine-tuned on is not.
+		*/
+		listRetrainStaging: require_sleep.method(zod.z.object({
+			/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
+			*  `deviceId`, deliberately: `deviceId` would make this device-bound and
+			*  route it at one camera's owner, and "every camera" would stop being
+			*  expressible at all. */
+			deviceIds: zod.z.array(zod.z.number()).optional(),
+			limit: zod.z.number().int().min(1).max(500).optional()
+		}), zod.z.array(RetrainTrackSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* What a track can contribute, and what it already has.
+		*
+		* `candidates` are the track's whole, unannotated frames — index rows only,
+		* so this is cheap. `copies` are the frames already inside the dataset, and
+		* a candidate whose copy exists is marked `copied: true`: selecting it again
+		* is free and CANNOT fail, whatever became of the original.
+		*
+		* A crop, a thumbnail and `fullFrameBoxed` are never candidates. The last
+		* one matters most: it has the model's own rectangle burned into the pixels,
+		* and a detector trained on it learns to find a green line.
+		*/
+		listRetrainFrames: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), RetrainFrameListSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* COPY-ON-SELECT — the write that makes `trained` safe to evict.
+		*
+		* Selecting a frame copies its bytes into retrain storage immediately: not
+		* a reference, not a lease. Once the copy exists the dataset no longer
+		* depends on the track's media, which is exactly what lets D81 hand a
+		* `trained` track back to retention.
+		*
+		* The order inside is load-bearing and is pinned by a test: an EXISTING
+		* copy is returned without touching the source, so an original that
+		* evaporated blocks the selection of THAT ORIGINAL and never the copy
+		* already taken. Every refusal comes back named — a dropped selection is
+		* never silent, on the wire or in the log.
+		*/
+		selectRetrainFrames: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			mediaKeys: zod.z.array(zod.z.string()).min(1)
+		}), RetrainFrameSelectionSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Un-select a frame: its annotations go first, then the copy and its blob.
+		*  Deliberately destructive and deliberately explicit — it is the only way
+		*  a frame leaves the dataset before export. */
+		deselectRetrainFrame: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string()
+		}), zod.z.object({
+			removed: zod.z.boolean(),
+			removedAnnotations: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The pixels of ONE copied frame, base64.
+		*
+		* Through the cap rather than a data plane because it is genuinely one
+		* frame at a time, on demand, at human speed — the shape D9/D18 permit
+		* (what they forbid is frames crossing a boundary at frame RATE). The
+		* annotation canvas needs the image and its exact dimensions in the same
+		* answer: a canvas that places a normalised box against a size it guessed
+		* draws every box in the wrong place.
+		*/
+		getRetrainFrameImage: require_sleep.method(zod.z.object({ frameId: zod.z.string() }), zod.z.object({
+			base64: zod.z.string(),
+			width: zod.z.number().int(),
+			height: zod.z.number().int()
+		}), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Ask the pipeline what it sees, as a PROPOSAL.
+		*
+		* Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
+		* every box comes back as a draft with `source: 'assist'` plus the model and
+		* score that produced it. The operator confirms, edits, adds and deletes;
+		* nothing is stored until `saveRetrainAnnotations`.
+		*
+		* For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
+		* never the whole frame, where a package detector at that threshold proposes
+		* furniture. A package request with no zone is REFUSED rather than widened,
+		* because the silent widening would look like a bad model for as long as
+		* nobody checked which rectangle it ran on.
+		*/
+		proposeRetrainAnnotations: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			subject: RetrainAssistSubjectSchema,
+			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+			nodeId: zod.z.string().optional()
+		}), RetrainAssistResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every annotation on a track, oldest first. */
+		listRetrainAnnotations: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Replace EVERY annotation on one frame with the supplied set.
+		*
+		* Whole-frame replacement, not per-box upsert: the unit of ground truth is
+		* the frame, and "the operator deleted a box" must be the same durable
+		* outcome as "the operator never drew it". A per-box patch would let a frame
+		* keep a box the operator removed on a surface that only knew about the
+		* boxes it sent.
+		*
+		* Refuses a macro class typed into `label` or `subLabel` — the tiers are
+		* separate and the guard is at the WRITE, because a mixed taxonomy cannot
+		* be un-mixed by reading it.
+		*/
+		saveRetrainAnnotations: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			frameId: zod.z.string(),
+			annotations: zod.z.array(RetrainAnnotationDraftSchema)
+		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Finish with a track: `staging → trained`. **The only writer of that
+		* state** — D81 shipped the column with it deliberately unreachable.
+		*
+		* Refuses a track the dataset holds no copies from. `trained` un-pins the
+		* track's media, so completing without a copy is a delete order for material
+		* nothing ever extracted anything from; that refusal IS the safety argument
+		* of D81, expressed as a precondition.
+		*/
+		completeRetrainTrack: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* The deliberate return: `trained → staging`, for the rare case.
+		*
+		* The generic `setTrackFlags` toggle refuses this in both directions by
+		* design (D81) — re-staging from a checkbox is how the same material gets
+		* annotated twice under two ground truths. Doing it here means the operator
+		* is looking at the annotations that already exist while they decide, and
+		* those annotations are LEFT ALONE: "put this back" must not be a
+		* destructive act wearing a navigational name.
+		*/
+		restageRetrainTrack: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string()
+		}), RetrainTransitionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Where to download the ANNOTATED dataset.
+		*
+		* The sibling of `getTrainingExportUrl` and deliberately not the same
+		* archive: that one streams a marked track's stored media verbatim, this one
+		* streams the retrain COPIES plus an `annotations.json` carrying, for every
+		* subject, the canonical full-frame box AND the geometry derived for each
+		* model shape (letterboxed root / zone-cropped package / subject-cropped
+		* classifier). Derived at export, never stored — one box in, three shapes
+		* out, so two crops of the same subject can never end up in one feature
+		* space (D52).
+		*/
+		getRetrainExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
 		getEventMedia: require_sleep.method(zod.z.object({
 			eventId: zod.z.string(),
 			kind: MediaFileKindEnum.optional()
@@ -14160,6 +14409,22 @@ var DetailResultSchema = zod.z.object({
 	bbox: NativeCropBboxSchema.optional(),
 	embedding: zod.z.string().optional(),
 	label: zod.z.string().optional(),
+	/**
+	* The tier `label` occupies, copied VERBATIM from the producing step's
+	* `StepDefinition.labelTier` (roadmap 4g). Present only when `label` is.
+	*
+	* It rides the wire rather than being resolved by the consumer because the
+	* declaration lives with the step definition, which only the executing node
+	* has: post-analysis holds no step registry, and re-deriving the tier from
+	* `className` there would be exactly the inference this model exists to
+	* forbid. A `label` that arrives WITHOUT this field is refused by the write
+	* rule and logged (`label tier undeclared`) — an older runner therefore
+	* stops enriching rather than guessing, which is why addon-pipeline is
+	* deployed BEFORE addon-post-analysis.
+	*/
+	labelTier: zod.z.union([zod.z.literal(1), zod.z.literal(2)]).optional(),
+	/** Model that produced `label` — carried into the tier's attribution. */
+	labelModelId: zod.z.string().optional(),
 	alignedCropJpeg: zod.z.string().optional(),
 	/** Face short side (px) measured on the NATIVE crop surface. The `bbox`
 	*  above is detection-frame px (≈6× smaller on a 4K camera) — min-face-size
@@ -22098,6 +22363,216 @@ setOverlay: require_sleep.method(zod.z.object({
 	}] }
 };
 //#endregion
+//#region src/capabilities/osd-manager.cap.ts
+/**
+* `osd-manager` — the ORCHESTRATOR over the device-scope `osd` cap.
+*
+* The `osd` cap is the firmware contract: it probes a camera's overlay
+* SLOTS and writes literal text into one. It has no idea WHERE that text
+* comes from, and it must not — a driver that grew a "show the temperature
+* here" feature would grow it once per vendor.
+*
+* This cap owns the other half: a per-(camera, slot) BINDING that says
+* which value feeds the slot, how it is formatted, and under which
+* conditions it is shown at all. One addon renders every binding on every
+* camera, so a new source costs zero driver code.
+*
+* Three deliberate choices, each with a rejected alternative:
+*
+*  1. A source is `(capName, valuePath)` over the kernel's device
+*     runtime-state mirror — NOT a closed enum of source kinds. Every
+*     cap-keyed slice a device publishes is bindable the day the cap
+*     ships. The rejected alternative (one enum member per source, with
+*     a resolver branch each) is what makes "add the humidity too" a
+*     code change.
+*  2. The display gate reuses `NcConditionsSchema` verbatim — the
+*     notification centre's condition vocabulary — rather than a parallel
+*     model. An operator who has learned one condition editor has learned
+*     both.
+*  3. Because the renderer's facts are device STATE and not a detection
+*     record, only a SUBSET of that vocabulary can be answered here.
+*     `setSlotBinding` REJECTS the rest at write time (see
+*     `getConditionSupport`). It does not accept-then-fail-closed: a
+*     condition that can never be true renders a permanently blank
+*     overlay, and a blank overlay looks exactly like a broken camera.
+*/
+/** Where a slot's value comes from. */
+var OsdSourceSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("static"),
+		text: zod.z.string().max(64)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("clock"),
+		/** Token pattern: `YYYY MM DD HH mm ss`. Everything else is literal. */
+		pattern: zod.z.string().min(1).max(32).default("HH:mm"),
+		/** IANA zone. Omitted = the server's zone. */
+		timezone: zod.z.string().min(1).max(64).optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("device-state"),
+		deviceId: zod.z.number().int().optional(),
+		capName: zod.z.string().min(1).max(64),
+		/** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
+		valuePath: zod.z.string().min(1).max(64)
+	})
+]);
+var OsdSlotBindingSchema = zod.z.object({
+	/** Off = the manager stops driving this slot. It does NOT clear it. */
+	enabled: zod.z.boolean().default(true),
+	source: OsdSourceSchema,
+	/** `${value}` and `${unit}` are substituted; every occurrence. */
+	template: zod.z.string().max(96).default("${value}"),
+	/** Truncate with an ellipsis past this length. Absent = no limit. */
+	maxCharacters: zod.z.number().int().min(4).max(64).optional(),
+	/**
+	* Decimal places for a numeric value. `0` yields an integer — the
+	* documented workaround for firmwares that reject `.` in overlay text.
+	*/
+	maxDecimals: zod.z.number().int().min(0).max(4).default(1),
+	/** Appended via `${unit}`. The state mirror does not carry units. */
+	unitLabel: zod.z.string().max(8).optional(),
+	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
+	valueMap: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+	/** Time windows in which the slot is shown. Absent = always. */
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* Display gate, in the notification centre's condition vocabulary.
+	* Only the keys reported by `getConditionSupport` are accepted.
+	*/
+	conditions: NcConditionsSchema.optional(),
+	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
+	fallbackText: zod.z.string().max(64).default("")
+});
+/** One camera slot, as the operator sees it: firmware truth + our binding. */
+var OsdSlotViewSchema = zod.z.object({
+	slotId: zod.z.string(),
+	kind: OsdOverlayKindEnum,
+	/** Firmware refuses text edits (a timestamp, the channel name). */
+	readOnly: zod.z.boolean(),
+	cameraEnabled: zod.z.boolean(),
+	cameraText: zod.z.string().optional(),
+	binding: OsdSlotBindingSchema.nullable()
+});
+/**
+* What happened to one slot on one render pass. `unchanged` exists so the
+* operator can tell "we are driving this and the value is steady" from
+* "we never got there" — and so the loop can prove it is not rewriting
+* identical text to the camera every tick.
+*/
+var OsdRenderOutcomeEnum = zod.z.enum([
+	"written",
+	"unchanged",
+	"gated",
+	"unreadable",
+	"disabled",
+	"unbound",
+	"failed"
+]);
+var OsdRenderResultSchema = zod.z.object({
+	slotId: zod.z.string(),
+	outcome: OsdRenderOutcomeEnum,
+	/** The text the slot should carry. Empty = the slot is switched off. */
+	text: zod.z.string(),
+	/** Why, whenever the outcome is not a plain write. Never silent. */
+	reason: zod.z.string().optional()
+});
+var OsdSourceValueTypeEnum = zod.z.enum([
+	"number",
+	"boolean",
+	"string",
+	"enum"
+]);
+/**
+* One bindable value, derived from a cap's `runtimeState` schema — never
+* hand-listed. The editor renders from this, so a cap that ships a new
+* state field becomes bindable with no UI change.
+*/
+var OsdSourceOptionSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	deviceName: zod.z.string(),
+	capName: zod.z.string(),
+	valuePath: zod.z.string(),
+	label: zod.z.string(),
+	valueType: OsdSourceValueTypeEnum,
+	/** Present for `enum`; the editor offers these as `valueMap` keys. */
+	enumValues: zod.z.array(zod.z.string()).readonly().optional()
+});
+var osdManagerCapability = {
+	name: "osd-manager",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* The camera's slots, each with its binding. `supported: false` when
+		* the camera publishes no `osd` cap — the page then says so instead
+		* of rendering an empty list that reads as "no overlays configured".
+		*/
+		getDeviceOsd: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({
+			supported: zod.z.boolean(),
+			slots: zod.z.array(OsdSlotViewSchema)
+		}), { auth: "admin" }),
+		/**
+		* Every value bindable on this camera: its own state leaves first,
+		* then every other device's. Derived from the cap definitions, so it
+		* cannot drift from what the resolver can actually read.
+		*/
+		getSourceCatalog: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({ sources: zod.z.array(OsdSourceOptionSchema) }), { auth: "admin" }),
+		/**
+		* The condition ids this gate can answer, alongside the FULL notification
+		* condition catalog. Both, in one call, on purpose: an editor that showed
+		* the catalog without the supported set would offer conditions that
+		* `setSlotBinding` then rejects.
+		*/
+		getConditionSupport: require_sleep.method(zod.z.object({}), zod.z.object({
+			supported: zod.z.array(zod.z.string()),
+			catalog: zod.z.array(NcConditionDescriptorSchema)
+		}), { auth: "admin" }),
+		/**
+		* Persist a binding and render it immediately, returning the slot as
+		* it now stands. Throws when the binding names an unsupported
+		* condition, an unknown cap, or a value path that cap does not have.
+		*/
+		setSlotBinding: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			slotId: zod.z.string().min(1),
+			binding: OsdSlotBindingSchema
+		}), zod.z.object({
+			slot: OsdSlotViewSchema,
+			render: OsdRenderResultSchema
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Forget the binding. The slot keeps whatever text it last carried. */
+		clearSlotBinding: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			slotId: zod.z.string().min(1)
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Render without writing. `binding` overrides the stored one so an
+		* editor can preview an unsaved change. Mutation kind only to carry
+		* the binding object safely; no side effects.
+		*/
+		previewSlot: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number().int(),
+			slotId: zod.z.string().min(1),
+			binding: OsdSlotBindingSchema.optional()
+		}), OsdRenderResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Force a render pass over one camera now, instead of at the next tick. */
+		renderDevice: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.object({ results: zod.z.array(OsdRenderResultSchema) }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/pet-feeder.cap.ts
 /**
 * PetKit pet-feeder cap. Models the control + telemetry surface of a
@@ -28185,6 +28660,7 @@ var CAPABILITY_NAMES = {
 	numericSensor: "numeric-sensor",
 	oauthIntegration: "oauth-integration",
 	osd: "osd",
+	osdManager: "osd-manager",
 	petFeeder: "pet-feeder",
 	pipelineAnalytics: "pipeline-analytics",
 	pipelineExecutor: "pipeline-executor",
@@ -28616,6 +29092,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "osd",
 		name: "osd"
 	},
+	{
+		key: "osdManager",
+		name: "osd-manager"
+	},
 	{
 		key: "petFeeder",
 		name: "pet-feeder"
@@ -28929,6 +29409,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	numericSensorCapability,
 	oauthIntegrationCapability,
 	osdCapability,
+	osdManagerCapability,
 	petFeederCapability,
 	pipelineAnalyticsCapability,
 	pipelineExecutorCapability,
@@ -31847,6 +32328,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"osdManager.clearSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"osdManager.getConditionSupport": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getDeviceOsd": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getSourceCatalog": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.previewSlot": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.renderDevice": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.setSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"petFeeder.callPet": {
 		capName: "pet-feeder",
 		capScope: "device",
@@ -31919,6 +32442,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.completeRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -31931,6 +32460,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deselectRetrainFrame": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.getActiveTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -31991,6 +32526,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getRetrainExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getRetrainFrameImage": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getSensorEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32009,6 +32556,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getTrainingExportSummary": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getTrainingExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listEventKinds": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32033,6 +32592,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainStaging": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTrackMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32045,6 +32622,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32075,12 +32658,30 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.restageRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.saveRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.selectRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33485,6 +34086,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -33605,6 +34212,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.setDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.setPreBufferDuration": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -34320,6 +34933,7 @@ var KNOWN_CAP_NAMES = [
 	"notifier",
 	"oauth-integration",
 	"osd",
+	"osd-manager",
 	"pet-feeder",
 	"pipeline-analytics",
 	"pipeline-executor",
@@ -34467,6 +35081,7 @@ var SYSTEM_CAP_NAMES = [
 	"notification-output",
 	"notification-rules",
 	"oauth-integration",
+	"osd-manager",
 	"pipeline-executor",
 	"pipeline-orchestrator",
 	"pipeline-runner",
@@ -34925,6 +35540,7 @@ function createSystemProxy(api) {
 			deleteTarget: (input) => dispatch("notificationOutput", "deleteTarget", "mutation", input),
 			setTargetEnabled: (input) => dispatch("notificationOutput", "setTargetEnabled", "mutation", input)
 		},
+		osdManager: { getConditionSupport: (input) => dispatch("osdManager", "getConditionSupport", "query", input) },
 		pipelineExecutor: {
 			getAvailableEngines: (input) => dispatch("pipelineExecutor", "getAvailableEngines", "query", input),
 			getSelectedEngine: (input) => dispatch("pipelineExecutor", "getSelectedEngine", "query", input),
@@ -35466,6 +36082,68 @@ function prepareNotification(caps, n) {
 	};
 }
 //#endregion
+//#region src/notification/schedule.ts
+var WEEKDAY_TO_DAY = {
+	Sun: 0,
+	Mon: 1,
+	Tue: 2,
+	Wed: 3,
+	Thu: 4,
+	Fri: 5,
+	Sat: 6
+};
+/** Resolve (weekday, minute-of-day) of `atMs` in the schedule's timezone.
+*  An invalid/unknown IANA name falls back to the host timezone. */
+function localDayMinute(atMs, timezone) {
+	const d = new Date(atMs);
+	if (timezone !== void 0) try {
+		const parts = new Intl.DateTimeFormat("en-US", {
+			timeZone: timezone,
+			weekday: "short",
+			hour: "numeric",
+			minute: "numeric",
+			hourCycle: "h23"
+		}).formatToParts(d);
+		let weekday;
+		let hour;
+		let minute;
+		for (const p of parts) if (p.type === "weekday") weekday = p.value;
+		else if (p.type === "hour") hour = Number(p.value);
+		else if (p.type === "minute") minute = Number(p.value);
+		const day = weekday !== void 0 ? WEEKDAY_TO_DAY[weekday] : void 0;
+		if (day !== void 0 && hour !== void 0 && minute !== void 0) return {
+			day,
+			minute: hour * 60 + minute
+		};
+	} catch {}
+	return {
+		day: d.getDay(),
+		minute: d.getHours() * 60 + d.getMinutes()
+	};
+}
+/**
+* Is the schedule active at `atMs`? No schedule = always active. Windows
+* are OR'd; a window with `startMinute > endMinute` crosses midnight (it
+* starts on a listed day and spills into the next). `invert` flips the
+* result (active OUTSIDE the windows).
+*/
+function isScheduleActive(schedule, atMs) {
+	if (schedule === void 0) return true;
+	const { day, minute } = localDayMinute(atMs, schedule.timezone);
+	const prevDay = (day + 6) % 7;
+	let inside = false;
+	for (const w of schedule.windows) if (w.startMinute <= w.endMinute) {
+		if (w.days.includes(day) && minute >= w.startMinute && minute < w.endMinute) {
+			inside = true;
+			break;
+		}
+	} else if (w.days.includes(day) && minute >= w.startMinute || w.days.includes(prevDay) && minute < w.endMinute) {
+		inside = true;
+		break;
+	}
+	return schedule.invert === true ? !inside : inside;
+}
+//#endregion
 //#region src/notification/timelapse-rule.ts
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
@@ -37326,7 +38004,7 @@ exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
 exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
 exports.AUDIO_MACRO_LABELS = AUDIO_MACRO_LABELS;
-exports.AUDIO_PRESETS = AUDIO_PRESETS;
+exports.AUDIO_PRESETS = require_fmp4_box_splitter.AUDIO_PRESETS;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
@@ -37599,6 +38277,7 @@ exports.FanDirectionSchema = FanDirectionSchema;
 exports.FeatureManifestSchema = FeatureManifestSchema;
 exports.FeatureProbeStatusSchema = FeatureProbeStatusSchema;
 exports.FloodStatusSchema = FloodStatusSchema;
+exports.Fmp4BoxSplitter = require_fmp4_box_splitter.Fmp4BoxSplitter;
 exports.FrameHandleFormatSchema = require_sleep.FrameHandleFormatSchema;
 exports.FrameHandleSchema = require_sleep.FrameHandleSchema;
 exports.FrameInputSchema = FrameInputSchema;
@@ -37634,7 +38313,9 @@ exports.IntercomStatusSchema = IntercomStatusSchema;
 exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
 exports.KeyEventSchema = KeyEventSchema;
 exports.LOG_LEVEL_RANK = LOG_LEVEL_RANK;
+exports.LabelAttributionSchema = LabelAttributionSchema;
 exports.LabelDefinitionSchema = LabelDefinitionSchema;
+exports.LabelTierSchema = LabelTierSchema;
 exports.LawnMowerActivitySchema = LawnMowerActivitySchema;
 exports.LawnMowerControlStatusSchema = LawnMowerControlStatusSchema;
 exports.LinkedDeviceSchema = LinkedDeviceSchema;
@@ -37805,6 +38486,13 @@ exports.OsdOverlayKindEnum = OsdOverlayKindEnum;
 exports.OsdOverlayPatchSchema = OsdOverlayPatchSchema;
 exports.OsdOverlaySchema = OsdOverlaySchema;
 exports.OsdPositionEnum = OsdPositionEnum;
+exports.OsdRenderOutcomeEnum = OsdRenderOutcomeEnum;
+exports.OsdRenderResultSchema = OsdRenderResultSchema;
+exports.OsdSlotBindingSchema = OsdSlotBindingSchema;
+exports.OsdSlotViewSchema = OsdSlotViewSchema;
+exports.OsdSourceOptionSchema = OsdSourceOptionSchema;
+exports.OsdSourceSchema = OsdSourceSchema;
+exports.OsdSourceValueTypeEnum = OsdSourceValueTypeEnum;
 exports.OsdStatusSchema = OsdStatusSchema;
 exports.PET_FEEDER_MANUAL_FEED_MAX = PET_FEEDER_MANUAL_FEED_MAX;
 exports.PET_FEEDER_MANUAL_FEED_MIN = PET_FEEDER_MANUAL_FEED_MIN;
@@ -37893,6 +38581,21 @@ exports.RelocateJobStateSchema = RelocateJobStateSchema;
 exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
 exports.RenderedAsSchema = RenderedAsSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
+exports.RetrainAnnotationDraftSchema = RetrainAnnotationDraftSchema;
+exports.RetrainAnnotationKindSchema = RetrainAnnotationKindSchema;
+exports.RetrainAnnotationSchema = RetrainAnnotationSchema;
+exports.RetrainAnnotationSourceSchema = RetrainAnnotationSourceSchema;
+exports.RetrainAssistResultSchema = RetrainAssistResultSchema;
+exports.RetrainAssistSubjectSchema = RetrainAssistSubjectSchema;
+exports.RetrainCopyRefusalSchema = RetrainCopyRefusalSchema;
+exports.RetrainFrameCandidateSchema = RetrainFrameCandidateSchema;
+exports.RetrainFrameListSchema = RetrainFrameListSchema;
+exports.RetrainFrameSchema = RetrainFrameSchema;
+exports.RetrainFrameSelectionSchema = RetrainFrameSelectionSchema;
+exports.RetrainMacroClassSchema = RetrainMacroClassSchema;
+exports.RetrainStatusSchema = RetrainStatusSchema;
+exports.RetrainTrackSchema = RetrainTrackSchema;
+exports.RetrainTransitionResultSchema = RetrainTransitionResultSchema;
 exports.RingBuffer = RingBuffer;
 exports.RtpSourceSchema = RtpSourceSchema;
 exports.RtspRestreamEntrySchema = RtspRestreamEntrySchema;
@@ -38015,6 +38718,8 @@ exports.TrackSourceSchema = TrackSourceSchema;
 exports.TrackStateSchema = TrackStateSchema;
 exports.TrackZoneFilterSchema = TrackZoneFilterSchema;
 exports.TrackedDetectionSchema = TrackedDetectionSchema;
+exports.TrainingExportDeviceTotalsSchema = TrainingExportDeviceTotalsSchema;
+exports.TrainingExportSummarySchema = TrainingExportSummarySchema;
 exports.TurnServerSchema = TurnServerSchema;
 exports.UNIT_TABLE = UNIT_TABLE;
 exports.UnifiedBrokerInfoSchema = BrokerInfoSchema$1;
@@ -38094,7 +38799,7 @@ exports.audioAnalysisCapability = audioAnalysisCapability;
 exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
 exports.audioMetricsCapability = audioMetricsCapability;
-exports.audioPlanFromEncodeProfile = audioPlanFromEncodeProfile;
+exports.audioPlanFromEncodeProfile = require_fmp4_box_splitter.audioPlanFromEncodeProfile;
 exports.authProviderCapability = authProviderCapability;
 exports.autoAssignProfiles = autoAssignProfiles;
 exports.automationControlCapability = automationControlCapability;
@@ -38107,14 +38812,14 @@ exports.bindAddonActions = bindAddonActions;
 exports.brightnessCapability = brightnessCapability;
 exports.brokerCapability = brokerCapability;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
-exports.buildAudioArgs = buildAudioArgs;
+exports.buildAudioArgs = require_fmp4_box_splitter.buildAudioArgs;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
-exports.buildFfmpegArgs = buildFfmpegArgs;
-exports.buildInputArgs = buildInputArgs;
+exports.buildFfmpegArgs = require_fmp4_box_splitter.buildFfmpegArgs;
+exports.buildInputArgs = require_fmp4_box_splitter.buildInputArgs;
 exports.buildModelVariantGroups = buildModelVariantGroups;
 exports.buildNcTaxonomy = buildNcTaxonomy;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
-exports.buildVideoArgs = buildVideoArgs;
+exports.buildVideoArgs = require_fmp4_box_splitter.buildVideoArgs;
 exports.buttonCapability = buttonCapability;
 exports.cameraCredentialsCapability = cameraCredentialsCapability;
 exports.cameraPipelineConfigCapability = cameraPipelineConfigCapability;
@@ -38219,7 +38924,7 @@ exports.imageCapability = imageCapability;
 exports.imageSettingsCapability = imageSettingsCapability;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
-exports.invocationFromEncodeProfile = invocationFromEncodeProfile;
+exports.invocationFromEncodeProfile = require_fmp4_box_splitter.invocationFromEncodeProfile;
 exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
 exports.isArrayOutputSchema = isArrayOutputSchema;
 exports.isBaseConditionKey = isBaseConditionKey;
@@ -38231,7 +38936,8 @@ exports.isEvent = require_sleep.isEvent;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
 exports.isSameAddonId = isSameAddonId;
-exports.isSoftwareDecode = isSoftwareDecode;
+exports.isScheduleActive = isScheduleActive;
+exports.isSoftwareDecode = require_fmp4_box_splitter.isSoftwareDecode;
 exports.isVoidInput = isVoidInput;
 exports.jobKindSchema = jobKindSchema;
 exports.kebabToCamel = kebabToCamel;
@@ -38246,7 +38952,7 @@ exports.llmRuntimeCapability = llmRuntimeCapability;
 exports.localNetworkCapability = localNetworkCapability;
 exports.locationSimilarity = locationSimilarity;
 exports.lockControlCapability = lockControlCapability;
-exports.logBannerArgs = logBannerArgs;
+exports.logBannerArgs = require_fmp4_box_splitter.logBannerArgs;
 exports.logDestinationCapability = logDestinationCapability;
 exports.logLevelAtMost = logLevelAtMost;
 exports.loginMethodCapability = loginMethodCapability;
@@ -38284,6 +38990,7 @@ exports.numericSensorCapability = numericSensorCapability;
 exports.oauthIntegrationCapability = oauthIntegrationCapability;
 exports.objectInputDeclaresAddonId = objectInputDeclaresAddonId;
 exports.osdCapability = osdCapability;
+exports.osdManagerCapability = osdManagerCapability;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
 exports.parseExpression = parseExpression;
 exports.parseJsonArray = require_sleep.parseJsonArray;
@@ -38296,7 +39003,7 @@ exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickDetailCropConvention = pickDetailCropConvention;
 exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
-exports.pickVideoEncoder = pickVideoEncoder;
+exports.pickVideoEncoder = require_fmp4_box_splitter.pickVideoEncoder;
 exports.pickerForCondition = pickerForCondition;
 exports.pipelineAnalyticsCapability = pipelineAnalyticsCapability;
 exports.pipelineExecutorCapability = pipelineExecutorCapability;