@camstack/types 1.2.63 → 1.2.65

package/dist/index.js

@@ -584,6 +584,19 @@ function resolveRunnerId(decl, addonId) {
 function resolveAddonPlacement(decl) {
 	return resolveAddonExecution(decl).placement;
 }
+/**
+* True when a `@camstack/system` builtin opted out of the in-process rule and
+* must be planned as a forked runner (`execution.isolate`).
+*
+* ONE predicate, because the hub asks this question in three places that must
+* agree: the runner plan (`buildAddonGroupPlan`), the "does this boot
+* in-process" filter, and `isForkedAddonEntry` (which decides route mounts,
+* data-plane mounts, restart and uninstall). They diverged once before for
+* `auth-oidc` and the addon's routes were mounted against an async UDS proxy.
+*/
+function isIsolatedBuiltin(decl) {
+	return decl.execution?.isolate === true;
+}
 //#endregion
 //#region src/interfaces/adoption-job.ts
 /**
@@ -1675,7 +1688,15 @@ function deriveRecordingMode(config) {
 * Each completed/failed run also lands one durable ops-log row on its owning
 * addon surface.
 */
+/**
+* `queued` exists because the recorder mover is SINGLE-FLIGHT and an operator
+* rebalance enqueues one job per (camera, profile). Refusing the second job —
+* what the engine did before — turned a fifteen-camera rebalance into fifteen
+* manual retries. Queued jobs run FIFO; a queued job that is cancelled never
+* runs at all.
+*/
 var RelocateJobStateSchema = zod.z.enum([
+	"queued",
 	"running",
 	"done",
 	"failed",
@@ -1710,6 +1731,15 @@ var RelocateFootageInputSchema = zod.z.object({
 	/** Limits relocation to the logical profile class. Omit only for the
 	* pre-orchestration compatibility path. */
 	footageClass: RelocateFootageClassSchema.optional(),
+	/** Scope the move to ONE camera. Absent = every camera on the source, which
+	*  is what a whole-disk drain means. The rebalance path always sets it: its
+	*  unit is a (camera, profile) pile, not a disk. */
+	deviceId: zod.z.number().int().optional(),
+	/** Scope the move to specific segment profiles (`high` / `mid` / `low`).
+	*  Finer than `footageClass`, which cannot separate high from mid — and the
+	*  placement plan assigns those two independently, so a rebalance that could
+	*  only say "recordings" would move footage the plan never asked to move. */
+	profiles: zod.z.array(zod.z.string()).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: zod.z.number().min(1).max(1e3).optional()
@@ -11810,6 +11840,13 @@ var MaskGridDimsSchema = zod.z.object({
 * `package-event` are pure trigger kinds (no urgency dimension). Extending
 * this one field keeps the schema additive — a rule still declares exactly
 * one trigger.
+*
+* AUDIO rules add no member here, for the reason occupancy added none: the
+* enum is mirrored by hand in the viewer (`scripts/check-viewer-condition-
+* mirror.ts` fails the build on a member the app cannot render) and every
+* member costs a release train. A sustained-sound rule is therefore an
+* `immediate` rule carrying {@link NcConditions.audio} — the condition is the
+* trigger discriminator, exactly as `occupancy` is on `device-event`.
 */
 var NcDeliverySchema = zod.z.enum([
 	"immediate",
@@ -11824,16 +11861,51 @@ var NcDeliverySchema = zod.z.enum([
 * depend on a provider's raw event name or payload shape.
 */
 var NcSystemEventKindSchema = zod.z.enum([
-	"camera-online",
-	"camera-offline",
+	"device-online",
+	"device-offline",
+	"device-disabled",
+	"device-enabled",
 	"stream-online",
 	"stream-offline",
 	"node-online",
 	"node-offline",
 	"addon-update-available",
-	"server-update-available"
+	"server-update-available",
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed",
+	"camera-online",
+	"camera-offline",
+	"camera-disabled",
+	"camera-enabled"
+]);
+/** The legacy tail of {@link NcSystemEventKindSchema} — see its docblock. */
+var NC_LEGACY_SYSTEM_EVENT_KINDS = new Set([
+	"camera-online",
+	"camera-offline",
+	"camera-disabled",
+	"camera-enabled"
 ]);
 /**
+* The kinds a rule may be AUTHORED with — every schema member except the
+* legacy tail. Editors render THIS list; the schema still parses the tail so a
+* durable row (and an unmigrated rule) survives being read.
+*/
+var NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NcSystemEventKindSchema.options.filter((kind) => !NC_LEGACY_SYSTEM_EVENT_KINDS.has(kind));
+/**
+* The panel's three transitions, as ONE list.
+*
+* Named here rather than spelled out at each of the four sites that need them
+* (the emitter, the intake, the editor group, the combined-notification gate),
+* because a fourth transition added to the enum and forgotten at one of them is
+* an alarm state nobody can be notified about.
+*/
+var NC_ALARM_SYSTEM_EVENT_KINDS = [
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed"
+];
+/**
 * One coherent system-event condition. `kinds` is the required opt-in safety
 * gate; the remaining lists are optional narrowing filters relevant to the
 * selected kinds.
@@ -11841,6 +11913,18 @@ var NcSystemEventKindSchema = zod.z.enum([
 var NcSystemEventConditionSchema = zod.z.object({
 	kinds: zod.z.array(NcSystemEventKindSchema).min(1),
 	deviceIds: zod.z.array(zod.z.number().int()).min(1).optional(),
+	/**
+	* Narrow a `device-*` kind to these device TYPES (`DeviceType` values —
+	* `camera`, `switch`, `sensor`, `container`, …). Absent = every type, which
+	* is what a liveness rule means when nobody said otherwise.
+	*
+	* This is where "only my cameras" is expressed, and it lives on the rule for
+	* one reason: the intake cannot know which devices this household cares
+	* about, and a producer-side filter is one no operator can change. Fails
+	* CLOSED — a subject whose device type is unknown (an id the device mirror
+	* does not carry) matches no `deviceTypes` list.
+	*/
+	deviceTypes: zod.z.array(zod.z.string().min(1)).min(1).optional(),
 	nodeIds: zod.z.array(zod.z.string().min(1)).min(1).optional(),
 	packageNames: zod.z.array(zod.z.string().min(1)).min(1).optional()
 });
@@ -11899,6 +11983,59 @@ var NcOccupancyConditionSchema = zod.z.object({
 	sustainSeconds: zod.z.number().int().min(0).max(3600).default(15)
 });
 /**
+* The dBFS floor the analyzer reports on digital silence
+* (`audio-analyzer-provider.ts`: `dbfs = rms > 0 ? 20*log10(rms) : -96`).
+*
+* It is the lower bound of {@link NcAudioConditionSchema.shape.dbThreshold} for
+* one reason worth stating out loud: **the scale is dBFS and it is
+* NEGATIVE-GOING** — `0` is full scale and silence reads as a large negative
+* number. An operator (or a UI) that writes `60` meaning "60 decibels, quite
+* loud" would author a threshold NO sample can ever reach, and the rule would
+* look broken rather than mis-configured. The schema range rejects it instead.
+*/
+var NC_AUDIO_DBFS_FLOOR = -96;
+/**
+* Audio condition (IMMEDIATE trigger) — a rule on SOUND, not on a picture.
+*
+* Operator-approved vocabulary (2026-08-12, option A — the same one the
+* reference notifier uses, so an operator moving between them re-uses what
+* they already know): a rule matches when, over a sampling window of
+* `samplingSeconds`, at least `hitPercent`% of the audio samples in that
+* window are HITS. A sample is a hit when it satisfies BOTH present filters:
+*
+*  - `dbThreshold` — its level is at or above this many dBFS (see
+*    {@link NC_AUDIO_DBFS_FLOOR}: negative-going, `0` = full scale);
+*  - `labels` — the classifier put at least one of these labels on it.
+*
+* Both are OPTIONAL and independent, which is the point of the shape: a
+* loudness rule ("something loud at 3am") needs no model to be right, and a
+* label rule ("a dog barked") needs no threshold. **Fail-closed when NEITHER
+* is given** — a window in which every sample is trivially a hit would fire on
+* silence, so the engine refuses such a condition rather than notifying on
+* nothing (the schema cannot express "at least one of" without becoming a
+* ZodEffects the cap path would have to special-case).
+*
+* `hitPercent` is over the samples the window actually HOLDS, and the window
+* must be FULL before it can match — a window that has been open for two
+* seconds of its ten is 100% of nothing, and firing on it would make
+* `samplingSeconds` decorative.
+*
+* Labels are the audio macro classes (`AUDIO_MACRO_LABELS` / the NC taxonomy's
+* `audio-*` ids). Both spellings are accepted — the matcher normalizes the
+* `audio-` prefix away on both sides, so a picker that offers taxonomy ids and
+* an operator who typed `dog` mean the same thing.
+*/
+var NcAudioConditionSchema = zod.z.object({
+	/** Audio macro labels; absent = any sound (level-only rule). */
+	labels: zod.z.array(zod.z.string().min(1)).min(1).optional(),
+	/** Level floor in dBFS (negative-going, `0` = full scale); absent = any level. */
+	dbThreshold: zod.z.number().min(-96).max(0).optional(),
+	/** Percentage of the window's samples that must be hits (1–100). */
+	hitPercent: zod.z.number().int().min(1).max(100).default(60),
+	/** Length of the sampling window in seconds. */
+	samplingSeconds: zod.z.number().int().min(1).max(300).default(10)
+});
+/**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
 *
 * The values are not symmetric, and deliberately so — the absent value has to
@@ -12182,7 +12319,33 @@ var NcConditionsSchema = zod.z.object({
 	* threshold and holds for `sustainSeconds`. Fail-closed on missing
 	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
 	*/
-	occupancy: NcOccupancyConditionSchema.optional()
+	occupancy: NcOccupancyConditionSchema.optional(),
+	/**
+	* IMMEDIATE only. Sustained-sound matcher — `hitPercent` of the samples in a
+	* `samplingSeconds` window clear the optional `dbThreshold` and carry one of
+	* the optional `labels`. Fail-closed on missing substrate (no audio samples,
+	* a window that is not full yet, neither filter given). See
+	* {@link NcAudioCondition}.
+	*
+	* Presence of this key is what makes a rule an AUDIO rule: the engine fires
+	* it ONLY on a confirmed audio window, and a rule carrying it never fires on
+	* a detection, a track or a device event (the same fail-closed pairing
+	* `occupancy` has with the `device-event` trigger). That is how audio labels
+	* leave `classes`: an audio rule names its sounds HERE, and the legacy path
+	* (an `immediate` rule naming an `audio-*` class, one notification per
+	* classified sample) stays exactly as it was for rules that already use it.
+	*
+	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
+	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
+	* (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* condition fields it does not know when a rule is saved from the phone.
+	* Publishing an editor for a condition the app cannot round-trip is how an
+	* operator loses a rule's conditions by opening it — so the descriptor, the
+	* admin widget and the viewer mirror land together (P2 + P3), and only then
+	* does an audio rule become authorable.
+	*/
+	audio: NcAudioConditionSchema.optional()
 });
 /** One delivery target: a `notification-output` Target ref + passthrough params. */
 var NcRuleTargetSchema = zod.z.object({
@@ -12296,6 +12459,74 @@ var NcThrottleSchema = zod.z.object({
 	*/
 	granularity: NcThrottleGranularitySchema.optional()
 });
+/**
+* How long the confirm gate may hold ONE notification, and how big the picture
+* it judges may be.
+*
+* The clamp is the product decision, not a coincidence of the model: p50 was
+* 4.9 s warm and 15.3 s cold against qwen3-vl-8b, and a notification that
+* arrives after the visitor has gone is not a notification. 448 px was enough
+* to score 16/16 on the operator's parking scenario — bigger costs latency and
+* tokens for pixels the model pools away.
+*/
+var NC_CONFIRM_MIN_TIMEOUT_MS = 1e3;
+var NC_CONFIRM_MAX_TIMEOUT_MS = 2e4;
+var NC_CONFIRM_DEFAULT_TIMEOUT_MS = 8e3;
+var NC_CONFIRM_DEFAULT_MAX_IMAGE_PX = 448;
+/** Comparison the model's COUNT must satisfy for the notification to fire. */
+var NcConfirmExpectSchema = zod.z.object({
+	op: zod.z.enum([
+		">=",
+		">",
+		"<=",
+		"<",
+		"=="
+	]),
+	count: zod.z.number().int().min(0).max(1e3)
+});
+/**
+* AI CONFIRM — a vision model looks at the picture this notification is about
+* to ship and says whether it agrees with the rule.
+*
+* It runs AFTER the attachments resolve, deliberately: the crop JUDGED is the
+* crop SHIPPED (D52). A verdict about a different pixel rectangle than the one
+* on the operator's phone is not a verdict about this notification.
+*
+* FAIL-OPEN is the only safe default. A gate that cannot reach its model, or
+* whose model is cold, must not silence a camera — so `onTimeout: 'fire'` is
+* the default and every fail-open is COUNTED, because a gate that always fails
+* open looks in the log exactly like a gate that works.
+*
+* Every field is `.optional()` rather than relied on as a Zod default at the
+* runtime seam: a Zod default does NOT run on the addon→addon cap path (three
+* production failures in one day), so the gate reads absent as the constant
+* above rather than trusting a parse it may never have seen.
+*/
+var NcConfirmSchema = zod.z.object({
+	/** Off unless asked for. An absent `confirm` and `enabled:false` are the
+	*  same thing, and both mean "deliver exactly as before". */
+	enabled: zod.z.boolean().default(false),
+	/** Explicit vision profile; absent = the `purpose:'vision'` cluster default. */
+	profileId: zod.z.string().optional(),
+	/**
+	* The operator's question, in his own words. Absent = a question derived
+	* from the rule (its class and its expectation).
+	*
+	* NEVER composed with text READ OUT OF THE FRAME. The model reads OSD
+	* banners, signage and plates as instructions if you let them reach the
+	* prompt — proven live — so the authoritative contract stays in the system
+	* turn and only rule-authored words land here.
+	*/
+	prompt: zod.z.string().max(1e3).optional(),
+	/** Fire only when the model's count satisfies this. Absent = the model's
+	*  own boolean verdict decides. */
+	expect: NcConfirmExpectSchema.optional(),
+	timeoutMs: zod.z.number().int().min(NC_CONFIRM_MIN_TIMEOUT_MS).max(NC_CONFIRM_MAX_TIMEOUT_MS).default(NC_CONFIRM_DEFAULT_TIMEOUT_MS),
+	/** What a timeout / unreachable model MEANS. `fire` (default) = fail-open. */
+	onTimeout: zod.z.enum(["fire", "suppress"]).default("fire"),
+	/** Longest edge the judged image is downscaled to before it is sent. */
+	maxImagePx: zod.z.number().int().min(64).max(2048).default(448)
+});
 /** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
 var NcRuleInputSchema = zod.z.object({
 	name: zod.z.string().min(1).max(200),
@@ -12356,7 +12587,13 @@ var NcRuleInputSchema = zod.z.object({
 	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
 	* shape as every other actuation.
 	*/
-	actions: NcRuleActionsSchema.optional()
+	actions: NcRuleActionsSchema.optional(),
+	/**
+	* AI CONFIRM — see {@link NcConfirmSchema}. `.optional()`, never defaulted:
+	* a rule that predates the gate must keep delivering byte-for-byte as it
+	* did, and absent is the only way to say that without a migration.
+	*/
+	confirm: NcConfirmSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -12367,7 +12604,37 @@ var NcRuleInputSchema = zod.z.object({
 * still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
 * `updateRule` patch.
 */
-var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: zod.z.array(zod.z.string()).optional() });
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
+	disabledTargetIds: zod.z.array(zod.z.string()).optional(),
+	/**
+	* `.partial()` DOES NOT REMOVE A FIELD'S `.default()`.
+	*
+	* It makes the key optional to SUPPLY; the parse still materialises the
+	* default when the key is absent. And `NcRuleStore.update` merges with
+	* `{ ...existing, ...patch }`, so a materialised key OVERWRITES the stored
+	* one — which made every partial edit destructive:
+	*
+	*   nc.updateRule({ throttle })         → conditions reset to `{}`
+	*   nc.setRuleTargetEnabled(...)        → conditions reset to `{}`
+	*   setEnabled(ruleId, false)           → conditions reset to `{}`
+	*
+	* A rule scoped to one camera and one zone silently became a rule that
+	* matches EVERY event on EVERY camera, and lost its `media` policy
+	* (zoneCrop / gif / clip / frame) and its `priority` at the same time. Seen
+	* live on 2026-08-12: a rule scoped to device 617 fired on 590 and 615
+	* within a minute of a two-field patch.
+	*
+	* So every defaulted field is re-declared here WITHOUT its default. The
+	* inner defaults still apply when the caller DOES send the key — `{}` for
+	* conditions remains a real instruction ("clear them") — and only the
+	* absent key is now genuinely absent.
+	*/
+	enabled: zod.z.boolean().optional(),
+	conditions: NcConditionsSchema.optional(),
+	media: NcMediaPolicySchema.optional(),
+	throttle: NcThrottleSchema.optional(),
+	priority: zod.z.number().int().min(1).max(5).optional()
+});
 /** A persisted rule. */
 var NcRuleSchema = NcRuleInputSchema.extend({
 	id: zod.z.string(),
@@ -12480,12 +12747,20 @@ var NC_CONDITION_CATALOG = [
 		valueType: "systemEvent",
 		options: [
 			{
-				value: "camera-online",
-				label: "Camera online"
+				value: "device-online",
+				label: "Device online"
+			},
+			{
+				value: "device-offline",
+				label: "Device offline"
 			},
 			{
-				value: "camera-offline",
-				label: "Camera offline"
+				value: "device-disabled",
+				label: "Device switched off"
+			},
+			{
+				value: "device-enabled",
+				label: "Device switched on"
 			},
 			{
 				value: "stream-online",
@@ -12510,12 +12785,24 @@ var NC_CONDITION_CATALOG = [
 			{
 				value: "server-update-available",
 				label: "Server update available"
+			},
+			{
+				value: "alarm-triggered",
+				label: "Alarm triggered"
+			},
+			{
+				value: "alarm-armed",
+				label: "Alarm armed"
+			},
+			{
+				value: "alarm-disarmed",
+				label: "Alarm disarmed"
 			}
 		],
 		operator: "in",
 		appliesTo: ["system-event"],
 		phase: "P1",
-		description: "Infrastructure and update events. Optionally narrow camera/stream events by device, node events by node id, and addon updates by package name."
+		description: "Infrastructure and update events. Device liveness covers EVERY device type — narrow it by device type (cameras only, say) and/or by device, node events by node id, and addon updates by package name."
 	},
 	{
 		id: "devices",
@@ -13045,6 +13332,25 @@ var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
 * copy would lie the first time a rule is disabled.
 */
+/**
+* Why a device a mode NAMES is nonetheless not armed by it.
+*
+* Each value is an existing authority, never a new flag (D62): `muted` is the
+* per-camera notification switch the Notification Center already owns,
+* `detection-off` is the device's own detection binding being inactive, and
+* `offline` is the device manager's liveness. A fourth reason would mean a
+* fourth authority, and inventing one here is how a panel starts disagreeing
+* with the switches the operator actually used.
+*/
+var NcAlarmSkipReasonSchema = zod.z.enum([
+	"muted",
+	"detection-off",
+	"offline"
+]);
+var NcAlarmSkippedDeviceSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	reason: NcAlarmSkipReasonSchema
+});
 var NcAlarmModeCoverageSchema = zod.z.object({
 	mode: AlarmArmModeSchema,
 	/** Enabled rules gated on `armed_<mode>`. Zero means the mode does nothing. */
@@ -13052,7 +13358,18 @@ var NcAlarmModeCoverageSchema = zod.z.object({
 	/** At least one covering rule has no device scope, so the mode covers all. */
 	allDevices: zod.z.boolean(),
 	/** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
-	deviceIds: zod.z.array(zod.z.number().int())
+	deviceIds: zod.z.array(zod.z.number().int()),
+	/**
+	* Devices this mode NAMES but cannot actually arm, each with the switch that
+	* excludes it.
+	*
+	* "Away armed — 12 cameras" is a promise, and a muted camera among those
+	* twelve makes it false in exactly the way nobody notices until an incident.
+	* Defaulted to `[]` so a coverage answer computed before this field existed
+	* still parses as "nothing known to be skipped" rather than failing the whole
+	* alarm tab.
+	*/
+	skippedDevices: zod.z.array(NcAlarmSkippedDeviceSchema).default([])
 });
 var NcAlarmConfigSchema = zod.z.object({
 	/**
@@ -25621,7 +25938,19 @@ var RecordingManifestSchema = zod.z.object({
 *  profiles/subtrees/locations on this node). */
 var RecordingDeviceUsageSchema = zod.z.object({
 	deviceId: zod.z.number(),
-	usedBytes: zod.z.number()
+	usedBytes: zod.z.number(),
+	/**
+	* Start of this camera's OLDEST indexed segment, across every profile and
+	* location — the "Oldest footage" column in Recordings → Storage, and the
+	* only honest answer to "is retention actually holding?" per camera.
+	*
+	* `null` = the camera has no footage. OPTIONAL because a recorder that
+	* predates this field omits it entirely, and a hub whose types carry the
+	* field must keep validating that older provider's payload: the framework
+	* (types) and the addon ship on different trains, and the addon is usually
+	* the later of the two.
+	*/
+	oldestMs: zod.z.number().nullable().optional()
 });
 /** Recording storage usage + capacity for one storage location. */
 var RecordingLocationUsageSchema = zod.z.object({
@@ -25649,6 +25978,57 @@ var RecordingStorageUsageSchema = zod.z.object({
 	locations: zod.z.array(RecordingLocationUsageSchema)
 });
 /**
+* The OPERATOR-ARMED half of multi-location recordings (D116).
+*
+* The placement plan decides where NEW writes go and moves nothing. A rebalance
+* is the operator asking for the EXISTING archive to be brought into line with
+* that plan: one relocate job per (camera, profile) pile that sits on the wrong
+* location, run FIFO behind the single-flight mover.
+*
+* `plan…` and `start…` return the SAME shape deliberately — what the operator
+* confirms is exactly what gets enqueued, and `jobIds` is the only difference
+* (empty on the plan).
+*/
+var RecordingRebalanceMoveSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	profile: zod.z.string(),
+	fromLocationId: zod.z.string(),
+	toLocationId: zod.z.string(),
+	bytes: zod.z.number(),
+	files: zod.z.number().int()
+});
+/** Why a pile that is out of place is staying there. Every refusal is
+*  reported: a rebalance that silently drops a camera reads exactly like one
+*  that had nothing to do. */
+var RecordingRebalanceSkipReasonSchema = zod.z.enum([
+	"unassigned",
+	"target-not-writable",
+	"below-threshold",
+	"no-headroom"
+]);
+var RecordingRebalanceSkipSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	profile: zod.z.string(),
+	fromLocationId: zod.z.string(),
+	/** The location the plan wants; null when the camera has no assignment. */
+	toLocationId: zod.z.string().nullable(),
+	bytes: zod.z.number(),
+	reason: RecordingRebalanceSkipReasonSchema
+});
+var RecordingRebalancePlanSchema = zod.z.object({
+	moves: zod.z.array(RecordingRebalanceMoveSchema),
+	skipped: zod.z.array(RecordingRebalanceSkipSchema),
+	bytesToMove: zod.z.number(),
+	/** Relocate job ids enqueued. Always empty for the plan (dry-run) call. */
+	jobIds: zod.z.array(zod.z.string())
+});
+var RecordingRebalanceInputSchema = zod.z.object({
+	/** Copy throttle in MB/s (default 40) — a rebalance is a background chore. */
+	throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+	/** Ignore piles smaller than this (default 1 GB). */
+	minMoveGb: zod.z.number().min(0).optional()
+});
+/**
 * Result of locating footage at a wall-clock instant for one device/profile.
 * `segment` carries the covering segment's window; `gap` reports the forward
 * nearest covered edge (`null` past the end of footage / when none exists)
@@ -25892,6 +26272,36 @@ var recordingCapability = {
 		cancelStorageMigrationMove: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		/**
+		* Move footage between locations — the OPERATOR's mover, scoped to one
+		* camera (and optionally to specific profiles) rather than a whole disk.
+		* Queued FIFO behind the single-flight engine, so arming several is safe.
+		*/
+		relocateFootage: require_sleep.method(RelocateFootageInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every relocate job this recorder knows about, newest first (in RAM: the
+		*  move is resumable, so a lost list costs nothing but the display). */
+		listRelocateJobs: require_sleep.method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Cancel a running or queued relocate job. A queued job never runs. */
+		cancelRelocateJob: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** What a rebalance WOULD move, and what it would refuse. Moves nothing. */
+		planStorageRebalance: require_sleep.method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Arm the rebalance: enqueue one relocate job per planned move. */
+		startStorageRebalance: require_sleep.method(RecordingRebalanceInputSchema, RecordingRebalancePlanSchema, {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -25914,13 +26324,24 @@ var recordingCapability = {
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = zod.z.number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = zod.z.object({
 	fromSec: zod.z.number().nonnegative(),
@@ -35839,6 +36260,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.cancelRelocateJob": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.cancelStorageMigrationMove": {
 		capName: "recording",
 		capScope: "system",
@@ -35893,6 +36320,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"recording.listRelocateJobs": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.locateSegment": {
 		capName: "recording",
 		capScope: "system",
@@ -35905,6 +36338,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.planStorageRebalance": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"recording.pruneFootage": {
 		capName: "recording",
 		capScope: "system",
@@ -35929,6 +36368,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.relocateFootage": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recording.renderClip": {
 		capName: "recording",
 		capScope: "system",
@@ -35965,6 +36410,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"recording.startStorageRebalance": {
+		capName: "recording",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"recordingExport.cancelExport": {
 		capName: "recording-export",
 		capScope: "system",
@@ -38132,7 +38583,12 @@ function createSystemProxy(api) {
 			refreshStorageLocationsForMigration: (input) => dispatch("recording", "refreshStorageLocationsForMigration", "mutation", input),
 			startStorageMigrationMove: (input) => dispatch("recording", "startStorageMigrationMove", "mutation", input),
 			getStorageMigrationMoveStatus: (input) => dispatch("recording", "getStorageMigrationMoveStatus", "query", input),
-			cancelStorageMigrationMove: (input) => dispatch("recording", "cancelStorageMigrationMove", "mutation", input)
+			cancelStorageMigrationMove: (input) => dispatch("recording", "cancelStorageMigrationMove", "mutation", input),
+			relocateFootage: (input) => dispatch("recording", "relocateFootage", "mutation", input),
+			listRelocateJobs: (input) => dispatch("recording", "listRelocateJobs", "query", input),
+			cancelRelocateJob: (input) => dispatch("recording", "cancelRelocateJob", "mutation", input),
+			planStorageRebalance: (input) => dispatch("recording", "planStorageRebalance", "query", input),
+			startStorageRebalance: (input) => dispatch("recording", "startStorageRebalance", "mutation", input)
 		},
 		recordingExport: {
 			getExport: (input) => dispatch("recordingExport", "getExport", "query", input),
@@ -38694,6 +39150,111 @@ var FramerateField = zod.z.number().int().min(1).max(60);
 var TargetsField = zod.z.array(NcRuleTargetSchema).min(1);
 var PriorityField = zod.z.number().int().min(1).max(5);
 /**
+* Floor on any dense cadence, seconds — the recording's own frame interval.
+*
+* Declared here because it bounds BOTH the rule field and the renderer's
+* derivation, and two copies of a floor are two floors that can drift.
+*/
+var TIMELAPSE_DENSE_FLOOR_SEC = .1;
+/**
+* Explicit override of the DENSE sampling cadence, seconds.
+*
+* Absent ⇒ derived as `max(1s, cadenceSec / 30)` — a 30 s base samples every
+* 1 s inside a detection range. (It was `base / 10` until 2026-08-12, which
+* made that same base 3 s and rendered a person pass as two frames.)
+*
+* THE ARITHMETIC. A detection range of `rangeSec` seconds sampled every
+* `denseCadenceSec` and played at `framerate` occupies
+*
+*     outputSeconds = (rangeSec / denseCadenceSec) / framerate
+*
+* so a 7 s pass at 1 s / 12 fps is 0.58 s of video, and at 0.5 s it is 1.17 s.
+* Halving this field doubles the frames INSIDE ranges only — the base cadence,
+* and therefore the length of a quiet night, does not move.
+*
+* Floored at {@link TIMELAPSE_DENSE_FLOOR_SEC}: asking for frames faster than
+* the recording has them returns the same frames, requested twice. Must be
+* STRICTLY smaller than `cadenceSec` — a dense rate that is not denser renders
+* a uniform video the operator believes is two-rate — and upsert refuses it
+* rather than letting the export cap reject the render hours after the window.
+*/
+var DenseCadenceSecField = zod.z.number().min(TIMELAPSE_DENSE_FLOOR_SEC).max(3600);
+/**
+* Minimum seconds of OUTPUT video each detection range must occupy.
+*
+* The operator-facing form of the arithmetic above: instead of solving for a
+* cadence, state the dwell and let the renderer solve. `minDwellSec: 1` on a
+* 30 s base at 12 fps turns a 7 s pass into a full second of video by sampling
+* that range every ~583 ms.
+*
+* ONE CADENCE SERVES EVERY RANGE. `ExportDenseSchema.everyMs` is global — the
+* ranges are terms of a single ffmpeg `select` expression that cannot vary rate
+* per term — so the MOST DEMANDING (shortest) range sets the rate and longer
+* ranges are sampled denser than they need. Per-range cadences require a cap
+* schema change and are the tracked follow-up.
+*
+* A range too short to reach the dwell even at {@link TIMELAPSE_DENSE_FLOOR_SEC}
+* is rendered with every frame that EXISTS and no more: the guarantee is capped
+* by real footage, never met by duplicating frames into motion that never
+* happened.
+*/
+var MinDwellSecField = zod.z.number().min(0).max(60);
+/**
+* Caption burned into the notification's preview frame.
+*
+* Same `{{var}}` vocabulary as {@link TimelapseTemplateSchema} (`camera`,
+* `rule`, `from`, `to`) and rendered by the SAME renderer — a second
+* templating dialect for one field would be a second thing to explain.
+*
+* Absent ⇒ {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}. An EMPTY STRING is the
+* operator saying "the frame, no caption" — a distinct, reachable answer, and
+* the reason this is not `.min(1)`.
+*/
+var PreviewTextField = zod.z.string().max(200);
+/**
+* Whether the notification's preview is a STILL or a short animation.
+*
+* The operator's ask, verbatim: *"inviato come gif o video (come per le altre
+* rule)"* — his Scrypted advanced-notifier has a `gifRule`, and a ten-hour
+* night reads better as three seconds of motion than as one frame of it. Both
+* modes get the SAME treatment (blurred frame, large centred title); `'gif'`
+* simply applies it to a dozen frames sampled across the render and assembles
+* them.
+*
+* `'image'` is the default and stays the default: a GIF costs a dozen ffmpeg
+* seeks and a palette pass, and no rule that never asked for one should start
+* paying that on the deploy that shipped it.
+*
+* A GIF that cannot be assembled DEGRADES to the still — never to nothing.
+*/
+var PreviewModeField = zod.z.enum(["image", "gif"]);
+/**
+* Which detection classes the notification reports counts for.
+*
+* The counts come from the tracks the render ALREADY fetched for its dense-range
+* plan — no second query — aggregated per class. Absent or empty means "every
+* class the window actually contained", which is what an operator who never
+* opened the field wants; a list narrows it (`['person']` on a driveway that
+* counts cars all night).
+*
+* Class names are the tracker's own (`person`, `vehicle`, `animal`, `package`,
+* …). An unknown name simply never matches and reports nothing — it is not an
+* error, because a rule may legitimately name a class this camera's model does
+* not emit.
+*
+* The counts are exposed to {@link TimelapseTemplateSchema} as:
+*  - `{{detections}}` — total over the reported classes
+*  - `{{detectionSummary}}` — `2 persone, 1 veicolo`
+*  - `{{count_person}}` / `{{count_vehicle}}` / `{{count_animal}}` / … —
+*    one per class, `count_` + the class name
+*
+* With NO custom body template the summary is appended to the derived body, and
+* only when the total is non-zero: a nightly `0 rilevamenti` is a line nobody
+* reads. With a custom template the operator owns every word — nothing is
+* appended, so `{{detectionSummary}}` is how he asks for it.
+*/
+var ReportClassesField = zod.z.array(zod.z.string().min(1).max(40)).max(20);
+/**
 * Client-supplied timelapse-rule fields. The server stamps id / createdBy /
 * createdAt / updatedAt / ownerUserId / lastGeneratedAt — none of them appear
 * here (see the ownership note above).
@@ -38713,13 +39274,42 @@ var TimelapseRuleInputSchema = zod.z.object({
 	cadenceSec: CadenceSecField.default(15),
 	/** Output frames per second of the assembled mp4 (predecessor parity). */
 	framerate: FramerateField.default(10),
+	/**
+	* Explicit dense cadence — see {@link DenseCadenceSecField}. Absent ⇒ derived
+	* as `max(1s, cadenceSec / 30)`, which is what every rule written before this
+	* field gets.
+	*/
+	denseCadenceSec: DenseCadenceSecField.optional(),
+	/** Output-seconds guarantee per detection range — see {@link MinDwellSecField}. */
+	minDwellSec: MinDwellSecField.optional(),
 	/** `notification-output` targets the finished video/thumbnail is sent to. */
 	targets: TargetsField,
 	template: TimelapseTemplateSchema.optional(),
+	/**
+	* Caption on the notification's PREVIEW FRAME — see {@link PreviewTextField}
+	* and {@link DEFAULT_TIMELAPSE_PREVIEW_TEXT}.
+	*
+	* Deliberately NOT part of {@link TimelapseTemplateSchema}: that object is
+	* the notification's title/body, and clearing it (`template: null`) must not
+	* silently clear the caption too.
+	*/
+	previewText: PreviewTextField.optional(),
+	/** Still or animation — see {@link PreviewModeField}. */
+	previewMode: PreviewModeField.default("image"),
+	/** Classes the notification counts — see {@link ReportClassesField}. */
+	reportClasses: ReportClassesField.optional(),
 	/** Canonical notification priority ordinal (1..5); per-target overridable. */
 	priority: PriorityField.default(3)
 });
 /**
+* The caption a rule that never set one gets.
+*
+* Rendered through the ordinary `{{var}}` pass at delivery, so a rule created
+* before this field existed still reads "Timelapse Videocamera ingresso" and
+* not the literal braces.
+*/
+var DEFAULT_TIMELAPSE_PREVIEW_TEXT = "Timelapse {{camera}}";
+/**
 * Partial patch for an update — any subset of the INPUT fields, with NO
 * defaults (an absent key means "leave unchanged", never "reset to default").
 * Provenance and ownership are absent by construction: a patch can rename or
@@ -38742,8 +39332,13 @@ var TimelapseRulePatchSchema = zod.z.object({
 	schedule: NcScheduleSchema.optional(),
 	cadenceSec: CadenceSecField.optional(),
 	framerate: FramerateField.optional(),
+	denseCadenceSec: DenseCadenceSecField.optional(),
+	minDwellSec: MinDwellSecField.optional(),
 	targets: TargetsField.optional(),
 	template: TimelapseTemplateSchema.nullable().optional(),
+	previewText: PreviewTextField.optional(),
+	previewMode: PreviewModeField.optional(),
+	reportClasses: ReportClassesField.optional(),
 	priority: PriorityField.optional()
 });
 /** A persisted timelapse rule. */
@@ -38784,6 +39379,26 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	updatedAt: zod.z.number()
 });
 /**
+* Refuse a dense cadence that is not denser than the base.
+*
+* Called at UPSERT, on the MERGED rule — a patch that lowers `cadenceSec`
+* alone can invalidate a `denseCadenceSec` set months earlier, so checking the
+* patch in isolation would let the bad pair through.
+*
+* Refusing here and not at render time is the whole point: `ExportTimelapseSchema`
+* also rejects the pair, but it does so when the window has already closed and
+* the footage is being cut — the operator learns at 06:05 that last night was
+* never going to render, and a closed window does not come back. This turns
+* that into a failed edit he can see and correct.
+*
+* @throws Error naming both numbers, so the message is actionable in a toast.
+*/
+function assertTimelapseCadences(pair) {
+	const dense = pair.denseCadenceSec;
+	if (dense === void 0) return;
+	if (dense >= pair.cadenceSec) throw new Error(`denseCadenceSec (${dense}s) must be strictly smaller than cadenceSec (${pair.cadenceSec}s) — a dense cadence that is not denser renders a uniform timelapse`);
+}
+/**
 * The last successful generation for ONE camera of a rule, epoch-ms.
 *
 * The per-device map wins; a rule with no map falls back to the rule-wide
@@ -38999,8 +39614,8 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 //#endregion
 //#region src/pipeline/native-lease.ts
 /**
-* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
-* decode worker's native-resolution frame retention.
+* THE native-frame **lease** knobs — hold depth, RAM budget, demand window and
+* subject-tile budget for the decode worker's native-resolution retention.
 *
 * ## Why they live here and not in the addon that reads them
 *
@@ -39016,20 +39631,25 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 * The lease is a per-decode-worker RAM window. Its purpose — the late
 * cross-process native crop landing on a full-resolution frame rather than the
 * ≤640 detection fallback — is a property of the PIPELINE, not of a node's
-* hardware: a per-node TTL would mean the same camera produces different crop
+* hardware: a per-node window would mean the same camera produces different crop
 * quality depending on which node the balancer placed it on, and nobody could
 * tell that from the stored media. Node-level RAM pressure is already handled
 * by the per-session budget ceiling, which is itself one of these knobs.
 *
 * ## What each knob costs
 *
-* A retained frame is a full NATIVE-resolution copy in system RAM. With the
+* A HELD frame is a full NATIVE-resolution copy in system RAM. With the
 * default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
 * 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
 * for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
-* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
-* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
-* admission" for what actually gets admitted.
+* resident RAM for ONE busy camera is now `frameBytes × holdFrames`, clamped by
+* the budget ceiling — bounded by a COUNT because a held frame is waiting for
+* one specific event (its own detection result), not for a clock.
+*
+* A TILE is one subject at native resolution, JPEG-encoded: ~60-120 KB on 4K,
+* and nothing at all on a frame that detected nothing. That is the asymmetry
+* this whole shape exists for — see
+* `docs/design/2026-08-13-native-lease-two-tier-redesign.md`.
 */
 /**
 * Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
@@ -39037,10 +39657,11 @@ function slideInsideFrame(rect, frameWidth, frameHeight) {
 * the reader can walk every section instead of trusting the section id.
 */
 var NATIVE_LEASE_SECTION_ID = "native-lease";
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_HOLD_KEY = "nativeLeaseHoldFrames";
 var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
 var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
 var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+var NATIVE_LEASE_TILE_BUDGET_KEY = "nativeTileBudgetMb";
 /**
 * WHICH delivered frames the decode worker retains a native copy of.
 *
@@ -39067,25 +39688,32 @@ var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
 */
 var NativeLeaseSettingsSchema = zod.z.object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
+	*
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: zod.z.number().int().min(250).max(1e4),
+	holdFrames: zod.z.number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -39111,25 +39739,47 @@ var NativeLeaseSettingsSchema = zod.z.object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: zod.z.number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
 /** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
-var NATIVE_LEASE_TTL_FIELD = {
-	min: 250,
-	max: 1e4,
-	step: 50,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+var NATIVE_LEASE_HOLD_FIELD = {
+	min: 1,
+	max: 64,
+	step: 1,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames
 };
 var NATIVE_LEASE_BUDGET_FIELD = {
 	min: 0,
@@ -39143,6 +39793,12 @@ var NATIVE_LEASE_ACTIVITY_FIELD = {
 	step: 1e3,
 	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
 };
+var NATIVE_LEASE_TILE_BUDGET_FIELD = {
+	min: 0,
+	max: 1024,
+	step: 16,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb
+};
 /** Select options for the admission knob (orchestrator settings UI). */
 var NATIVE_LEASE_ADMISSION_FIELD = {
 	options: [{
@@ -39162,7 +39818,7 @@ var NATIVE_LEASE_ADMISSION_FIELD = {
 * precedence being true and being a lie. `addon-settings.getGlobalSettings`
 * returns a HYDRATED payload, and `hydrateField` fills an unstored field with
 * the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* opened the form still reports `nativeLeaseHoldFrames = 8`). A reader that took
 * that at face value would report all three knobs as "set" on every cluster on
 * the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
 * emergency override that the precedence promises. There is no raw-store read on
@@ -39196,25 +39852,28 @@ function readAdmissionKnob(raw) {
 * {@link readKnob} for why the default counts as unset.
 */
 function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const holdFrames = readKnob("holdFrames", config[NATIVE_LEASE_HOLD_KEY]);
 	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
 	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
 	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	const tileBudgetMb = readKnob("tileBudgetMb", config[NATIVE_LEASE_TILE_BUDGET_KEY]);
 	return {
-		...ttlMs === null ? {} : { ttlMs },
+		...holdFrames === null ? {} : { holdFrames },
 		...budgetMb === null ? {} : { budgetMb },
 		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
+		...admission === null ? {} : { admission },
+		...tileBudgetMb === null ? {} : { tileBudgetMb }
 	};
 }
 function isHydratedField(entry) {
 	return typeof entry === "object" && entry !== null && "key" in entry;
 }
 var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_HOLD_KEY,
 	NATIVE_LEASE_BUDGET_KEY,
 	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
+	NATIVE_LEASE_ADMISSION_KEY,
+	NATIVE_LEASE_TILE_BUDGET_KEY
 ];
 /**
 * Extract the operator's lease overrides from an
@@ -40752,6 +41411,7 @@ exports.DEFAULT_FEATURES = DEFAULT_FEATURES;
 exports.DEFAULT_NATIVE_LEASE_SETTINGS = DEFAULT_NATIVE_LEASE_SETTINGS;
 exports.DEFAULT_RETENTION = DEFAULT_RETENTION;
 exports.DEFAULT_SCRUB_THUMBNAIL_PRESET = DEFAULT_SCRUB_THUMBNAIL_PRESET;
+exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
 exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
 exports.DETAIL_CROP_SECTION_ID = DETAIL_CROP_SECTION_ID;
@@ -40992,11 +41652,20 @@ exports.NATIVE_LEASE_ADMISSION_FIELD = NATIVE_LEASE_ADMISSION_FIELD;
 exports.NATIVE_LEASE_ADMISSION_KEY = NATIVE_LEASE_ADMISSION_KEY;
 exports.NATIVE_LEASE_BUDGET_FIELD = NATIVE_LEASE_BUDGET_FIELD;
 exports.NATIVE_LEASE_BUDGET_KEY = NATIVE_LEASE_BUDGET_KEY;
+exports.NATIVE_LEASE_HOLD_FIELD = NATIVE_LEASE_HOLD_FIELD;
+exports.NATIVE_LEASE_HOLD_KEY = NATIVE_LEASE_HOLD_KEY;
 exports.NATIVE_LEASE_SECTION_ID = NATIVE_LEASE_SECTION_ID;
-exports.NATIVE_LEASE_TTL_FIELD = NATIVE_LEASE_TTL_FIELD;
-exports.NATIVE_LEASE_TTL_KEY = NATIVE_LEASE_TTL_KEY;
+exports.NATIVE_LEASE_TILE_BUDGET_FIELD = NATIVE_LEASE_TILE_BUDGET_FIELD;
+exports.NATIVE_LEASE_TILE_BUDGET_KEY = NATIVE_LEASE_TILE_BUDGET_KEY;
+exports.NC_ALARM_SYSTEM_EVENT_KINDS = NC_ALARM_SYSTEM_EVENT_KINDS;
+exports.NC_AUDIO_DBFS_FLOOR = NC_AUDIO_DBFS_FLOOR;
+exports.NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NC_AUTHORABLE_SYSTEM_EVENT_KINDS;
 exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
 exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
+exports.NC_CONFIRM_DEFAULT_MAX_IMAGE_PX = NC_CONFIRM_DEFAULT_MAX_IMAGE_PX;
+exports.NC_CONFIRM_DEFAULT_TIMEOUT_MS = NC_CONFIRM_DEFAULT_TIMEOUT_MS;
+exports.NC_CONFIRM_MAX_TIMEOUT_MS = NC_CONFIRM_MAX_TIMEOUT_MS;
+exports.NC_CONFIRM_MIN_TIMEOUT_MS = NC_CONFIRM_MIN_TIMEOUT_MS;
 exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
 exports.NC_HISTORY_LIMIT_MAX = NC_HISTORY_LIMIT_MAX;
 exports.NC_MAX_PER_TRACK_IMMEDIATE = NC_MAX_PER_TRACK_IMMEDIATE;
@@ -41015,8 +41684,13 @@ exports.NcAlarmConfigSchema = NcAlarmConfigSchema;
 exports.NcAlarmModeCoverageSchema = NcAlarmModeCoverageSchema;
 exports.NcAlarmSettingsPatchSchema = NcAlarmSettingsPatchSchema;
 exports.NcAlarmSettingsSchema = NcAlarmSettingsSchema;
+exports.NcAlarmSkipReasonSchema = NcAlarmSkipReasonSchema;
+exports.NcAlarmSkippedDeviceSchema = NcAlarmSkippedDeviceSchema;
+exports.NcAudioConditionSchema = NcAudioConditionSchema;
 exports.NcConditionDescriptorSchema = NcConditionDescriptorSchema;
 exports.NcConditionsSchema = NcConditionsSchema;
+exports.NcConfirmExpectSchema = NcConfirmExpectSchema;
+exports.NcConfirmSchema = NcConfirmSchema;
 exports.NcCrossingSchema = NcCrossingSchema;
 exports.NcDeliverySchema = NcDeliverySchema;
 exports.NcDeviceStateConditionSchema = NcDeviceStateConditionSchema;
@@ -41157,6 +41831,11 @@ exports.RecordingDeviceUsageSchema = RecordingDeviceUsageSchema;
 exports.RecordingLocationUsageSchema = RecordingLocationUsageSchema;
 exports.RecordingManifestSchema = RecordingManifestSchema;
 exports.RecordingRangeSchema = RecordingRangeSchema;
+exports.RecordingRebalanceInputSchema = RecordingRebalanceInputSchema;
+exports.RecordingRebalanceMoveSchema = RecordingRebalanceMoveSchema;
+exports.RecordingRebalancePlanSchema = RecordingRebalancePlanSchema;
+exports.RecordingRebalanceSkipReasonSchema = RecordingRebalanceSkipReasonSchema;
+exports.RecordingRebalanceSkipSchema = RecordingRebalanceSkipSchema;
 exports.RecordingRetentionSchema = RecordingRetentionSchema;
 exports.RecordingStatusSchema = RecordingStatusSchema;
 exports.RecordingStorageModeSchema = RecordingStorageModeSchema;
@@ -41286,6 +41965,7 @@ exports.SwitchStatusSchema = SwitchStatusSchema;
 exports.SystemMetricsSchema = SystemMetricsSchema;
 exports.SystemMirror = SystemMirror;
 exports.TAXONOMY_COLORS = TAXONOMY_COLORS;
+exports.TIMELAPSE_DENSE_FLOOR_SEC = TIMELAPSE_DENSE_FLOOR_SEC;
 exports.TIMEZONES = TIMEZONES;
 exports.TRANSCODE_DOWN_MAX_BITRATE_KBPS = TRANSCODE_DOWN_MAX_BITRATE_KBPS;
 exports.TRANSCODE_DOWN_MAX_HEIGHT = TRANSCODE_DOWN_MAX_HEIGHT;
@@ -41400,6 +42080,7 @@ exports.asJsonArray = require_sleep.asJsonArray;
 exports.asJsonObject = require_sleep.asJsonObject;
 exports.asNumber = require_sleep.asNumber;
 exports.asString = require_sleep.asString;
+exports.assertTimelapseCadences = assertTimelapseCadences;
 exports.audioAnalysisCapability = audioAnalysisCapability;
 exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
@@ -41547,6 +42228,7 @@ exports.isDeployableToAgent = isDeployableToAgent;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
 exports.isDeviceScopedCap = require_sleep.isDeviceScopedCap;
 exports.isEvent = require_sleep.isEvent;
+exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
 exports.isSameAddonId = isSameAddonId;