@homebridge-plugins/homebridge-eufy-security 5.0.0-beta.4 → 5.0.0-beta.40

package/dist/diagnostics.js

@@ -1,5 +1,5 @@
 import { constants, createCipheriv, createHash, publicEncrypt, randomBytes, randomUUID } from 'node:crypto';
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { appendFile, chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
@@ -33,6 +33,47 @@ export function unconfirmedWriteCondition(property) {
         ? undefined
         : { code: 'camera-control-operation-failed', ...named, active: true, reason: 'not-confirmed' };
 }
+/** Why a live session gave its source back: a stop from outside it, or the session ending itself. */
+const LIVE_SESSION_RELEASES = ['requested', 'failed'];
+/**
+ * The SDK event kinds a HomeKit adapter consumes, which are the kinds an unrouted-event record may name.
+ *
+ * Checked against the SDK's event union at build time, so a kind the SDK renames or removes fails the build.
+ */
+const UNROUTED_EVENT_KINDS = [
+    'alarm',
+    'armingModeChanged',
+    'batteryAlert',
+    'cameraEnabledChanged',
+    'contactState',
+    'cryingDetected',
+    'dogDetected',
+    'doorbellPress',
+    'lockState',
+    'motion',
+    'packageDelivered',
+    'packageStranded',
+    'packageTaken',
+    'personDetected',
+    'petDetection',
+    'smartLightState',
+    'soundDetected',
+    'strangerDetected',
+    'vehicleDetected',
+];
+/** What an unrouted event's serial named: none, another device's station, or a serial no adapter holds. */
+const UNROUTED_EVENT_TARGETS = ['none', 'station', 'unattached'];
+/** The claims that contend for a station's one live channel, and the decisions taken over it. */
+const STATION_CLAIMS = ['live', 'recording', 'snapshot'];
+const STATION_CLAIM_ACTIONS = ['held', 'yielded', 'refused', 'released'];
+/**
+ * The widest camera index a station may name as the one it is serving.
+ *
+ * A base fans a bounded number of cameras over one session, and an index beyond that is a value this plugin
+ * did not expect rather than a channel. The index carries no identity: which camera holds it is stated by the
+ * records about that camera.
+ */
+const MAX_STATION_CHANNEL = 63;
 /** The bounded reasons a stream request is refused before it reaches the source. */
 const REFUSAL_REASONS = new Set(['disabled', 'at-capacity', 'cancelled', 'prepare-failed']);
 /**
@@ -46,7 +87,29 @@ const HOMEKIT_LIVE_REQUEST_EVENTS = new Set([
     'live-session-failed',
     'live-session-released',
     'live-session-streaming',
+    'live-talkback-started',
 ]);
+/**
+ * The error identities an SDK record may name, which is all a record carries of one.
+ *
+ * A message is never among them, so an identity absent here is recorded as `Error` and reads as any other
+ * failure.
+ */
+const SDK_ERROR_TYPES = [
+    'DeviceChannelUnresolvedError',
+    'Error',
+    'RangeError',
+    'SessionExpiredError',
+    'StationKeyUnavailableError',
+    'StationUnreachableError',
+    'TypeError',
+];
+/**
+ * The retained fields that stand for a device rather than describing one, which is the privacy class a manifest
+ * declares for them. Each holds a per-case alias: stable within one archive, and resolvable to a device only by
+ * the owner whose console paired it with a name.
+ */
+const PSEUDONYMOUS_FIELDS = new Set(['accessory', 'accessoryAliases']);
 const MAX_SDK_DETAILS = 16;
 const MAX_LOG_RECORD_BYTES = 64 * 1024;
 const MAX_CURRENT_LOG_BYTES = 50 * 1024 * 1024;
@@ -71,7 +134,12 @@ const DIAGNOSTICS_DIRECTORY = 'diagnostics';
 const GUIDED_SESSION_FILE = 'session.json';
 const REPRODUCTION_MARKERS_FILE = 'reproduction-markers.jsonl';
 const UI_EVENTS_FILE = 'ui-events.jsonl';
-const FFMPEG_ENVIRONMENT_FILE = 'ffmpeg.json';
+const HOST_ENVIRONMENT_FILE = 'host.json';
+const FLEET_FILE = 'fleet.json';
+/** The longest device model or adapter key retained, which bounds values this plugin does not choose alone. */
+const MAX_DEVICE_MODEL_LENGTH = 64;
+/** How many HomeKit services one fleet entry names, which is above what any single device is represented by. */
+const MAX_FLEET_SERVICES = 12;
 /** How much of an FFmpeg path or version banner is kept, which is more than either needs. */
 const MAX_FFMPEG_IDENTITY_LENGTH = 256;
 const DEBUG_AUTHORIZATION_MS = 72 * 60 * 60 * 1_000;
@@ -83,6 +151,14 @@ const DEBUG_AUTHORIZATION_MS = 72 * 60 * 60 * 1_000;
  * rather than joining a fixed number of segments because the plugin's own module is a directory deeper once
  * built, and an SDK resolved through a link answers from wherever the link points.
  */
+function loadedBuild(module) {
+    try {
+        return `${PLUGIN_VERSION}+${Math.trunc(statSync(module).mtimeMs)}`;
+    }
+    catch {
+        return PLUGIN_VERSION;
+    }
+}
 function loadedVersion(from) {
     if (from === undefined) {
         return 'unknown';
@@ -124,6 +200,13 @@ function loadedSdkEntry() {
  * between them: after one lands, the runtime keeps answering with the build it started on until it is replaced.
  */
 export const PLUGIN_VERSION = loadedVersion(fileURLToPath(import.meta.url));
+/**
+ * Which build of {@link PLUGIN_VERSION} this process loaded: the version and the time this module was written.
+ *
+ * Every build rewrites the module, so two builds of one version differ here while a published package, whose
+ * files all carry one fixed time, differs only by its version. An unreadable module degrades to the version alone.
+ */
+export const PLUGIN_BUILD = loadedBuild(fileURLToPath(import.meta.url));
 const SDK_VERSION = loadedVersion(loadedSdkEntry());
 const gzip = promisify(gzipCallback);
 const gunzip = promisify(gunzipCallback);
@@ -145,6 +228,9 @@ const SDK_EVENT_KEYS = new Set([
     'observation-invalid',
     'protocol-command',
     'protocol-unhandled',
+    'push-received',
+    'realtime-readiness',
+    'rtc-sign-refused',
     'session-connecting',
     'session-idle',
     'session-resumed',
@@ -153,6 +239,15 @@ const SDK_EVENT_KEYS = new Set([
     'transport-error',
 ]);
 const EN_MESSAGES = JSON.parse(readFileSync(new URL('../i18n/runtime/en.json', import.meta.url), 'utf8'));
+/**
+ * The reporter's answer as a support archive carries it: every device, or how many they named.
+ *
+ * The serials themselves stay on the host. They identify one household's hardware, and no evidence class in an
+ * archive carries a device identity.
+ */
+function countedAffectedDevices(affected) {
+    return affected === 'all' ? 'all' : new Set(affected).size;
+}
 /** The bounded UI events a support session may record, and the only vocabulary the sink accepts. */
 const DIAGNOSTICS_UI_EVENTS = [
     'background-started',
@@ -208,22 +303,31 @@ const BUG_REPORT_FORM = 'https://github.com/homebridge-plugins/homebridge-eufy/i
  *
  * Addresses the committed issue form by filename, and fills the field ids that form declares. A prefill is
  * honoured only against a named template, and only the operational class travels in a query string.
+ *
+ * Every field this process can answer is answered, because a blank one is charged to the reporter: the form's
+ * own triage asks for what the environment block leaves empty, so a line left for the reporter to complete
+ * turns a report made the intended way into an incomplete one. The host version is the host's own public
+ * version and empty where no run has recorded it yet. The support case id is not among them — it sits above
+ * the operational class, and the archive's own filename carries it to the report that attaches one.
+ *
+ * The archive field is left unaddressed, because a query string cannot carry a file. Any text placed there
+ * satisfies the field's own `required` validation, so a prefill would answer it on the reporter's behalf and
+ * the form would accept a report with no archive on it.
  */
-function bugReportUrl(session, missingEvidence) {
+function bugReportUrl(session, missingEvidence, host) {
     const url = new URL(BUG_REPORT_FORM);
     url.searchParams.set('template', 'bug_report.yml');
+    url.searchParams.set('title', `[Diagnostics] ${BUG_REPORT_AREAS[session.profile]}: `);
     url.searchParams.set('environment', [
         `- **Plugin Version**: ${PLUGIN_VERSION}`,
         `- **eufy SDK**: ${SDK_VERSION}`,
         `- **Node.js Version**: ${process.version}`,
-        `- **Homebridge Version**: `,
+        `- **Homebridge Version**: ${host?.homebridge ?? ''}`,
         `- **OS**: ${process.platform} ${process.arch}`,
-        `- **Support Case ID**: `,
-        `- **Diagnostics profile**: ${session.profile} (${session.reproductionMode})`,
+        `- **Diagnostics profile**: ${session.profile}`,
         `- **Missing evidence**: ${missingEvidence.length ? missingEvidence.join(', ') : 'none'}`,
     ].join('\n'));
     url.searchParams.set('area', BUG_REPORT_AREAS[session.profile]);
-    url.searchParams.set('diagnostics', 'Attach the homebridge-eufy-<case-id>.eufysupport.gz file the diagnostics page downloaded.');
     return url.toString();
 }
 const DIAGNOSTICS_PROFILES = {
@@ -233,7 +337,7 @@ const DIAGNOSTICS_PROFILES = {
     'live-media': ['plugin-log', 'sdk-log', 'homekit-log', 'ffmpeg-log'],
     'hksv-recording': ['plugin-log', 'sdk-log', 'ffmpeg-log'],
     'dashboard-ui': ['plugin-log', 'ui-log'],
-    other: ['plugin-log', 'sdk-log', 'homekit-log'],
+    other: ['plugin-log', 'sdk-log', 'homekit-log', 'ffmpeg-log'],
 };
 /** Narrows external profile input against the diagnostics-owned profile registry. */
 export function isDiagnosticsProfile(value) {
@@ -283,6 +387,22 @@ function activeDiagnosticsSession(storageRoot, now) {
     const session = readDiagnosticsSession(storageRoot);
     return session && Date.parse(session.expiresAt) > now ? session : undefined;
 }
+/**
+ * A session as it stands at `now`: a capture still running when its authorization ends is finished at that end.
+ *
+ * A finished capture can be reviewed and exported until the archive retention has elapsed past the end of its
+ * authorization, so a capture that ran out its 72 hours keeps what it captured.
+ */
+function settledDiagnosticsSession(session, now) {
+    const expiresAt = Date.parse(session.expiresAt);
+    const settled = session.reproductionStartedAt && !session.reproductionEndedAt && expiresAt <= now
+        ? { ...session, reproductionEndedAt: session.expiresAt }
+        : session;
+    return {
+        session: settled,
+        exportable: Boolean(settled.reproductionEndedAt) && now < expiresAt + SUPPORT_ARCHIVE_RETENTION_MS,
+    };
+}
 /**
  * Collapses one supplied string to bounded printable text, or nothing where none of it survives.
  *
@@ -299,54 +419,170 @@ function boundedText(value, maximumLength) {
         .trim();
     return printable === '' ? undefined : printable;
 }
-function ffmpegEnvironmentPath(storageRoot) {
-    return join(storageRoot, DIAGNOSTICS_DIRECTORY, FFMPEG_ENVIRONMENT_FILE);
+/** Whether a value is a plain JSON object, which is the only shape a record crossing a process boundary has. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function fleetPath(storageRoot) {
+    return join(storageRoot, DIAGNOSTICS_DIRECTORY, FLEET_FILE);
+}
+/**
+ * Records what the account's devices are and what each becomes, replacing the record whole.
+ *
+ * Written by the process that holds both the inventory and the accessory aliases, because an archive is
+ * assembled by another one. Rewritten on every complete inventory, so a device withdrawn or newly recognised
+ * cannot be reported as still present. A write that fails is dropped: an archive then declares no fleet, which
+ * is honest, whereas failing over a diagnostic file would cost the user their cameras.
+ */
+export function recordFleet(storageRoot, fleet) {
+    try {
+        const path = fleetPath(storageRoot);
+        mkdirSync(dirname(path), { mode: 0o700, recursive: true });
+        writeFileSync(path, `${JSON.stringify({ version: 1, devices: fleet })}\n`, { mode: 0o600 });
+    }
+    catch { }
+}
+/** Reads the recorded fleet, keeping each entry whose own fields narrow and dropping each that does not. */
+function readFleet(storageRoot) {
+    try {
+        const candidate = JSON.parse(readFileSync(fleetPath(storageRoot), 'utf8'));
+        if (candidate.version !== 1 || !Array.isArray(candidate.devices)) {
+            return undefined;
+        }
+        const devices = candidate.devices.flatMap((row) => {
+            if (!isRecord(row))
+                return [];
+            const accessory = opaqueAccessoryAlias(row.accessory);
+            if (accessory === undefined || typeof row.represented !== 'boolean' || typeof row.attached !== 'boolean') {
+                return [];
+            }
+            const model = typeof row.model === 'string' ? boundedText(row.model, MAX_DEVICE_MODEL_LENGTH) : undefined;
+            const services = (Array.isArray(row.services) ? row.services : [])
+                .filter((service) => typeof service === 'string')
+                .slice(0, MAX_FLEET_SERVICES)
+                .flatMap((service) => {
+                const bounded = boundedText(service, MAX_DEVICE_MODEL_LENGTH);
+                return bounded === undefined ? [] : [bounded];
+            });
+            return [
+                {
+                    accessory,
+                    ...(model === undefined ? {} : { model }),
+                    represented: row.represented,
+                    attached: row.attached,
+                    services,
+                },
+            ];
+        });
+        return devices.length === 0 ? undefined : devices.slice(0, MAX_ACCESSORY_ALIASES);
+    }
+    catch {
+        return undefined;
+    }
 }
+function hostEnvironmentPath(storageRoot) {
+    return join(storageRoot, DIAGNOSTICS_DIRECTORY, HOST_ENVIRONMENT_FILE);
+}
+/** The longest host version string retained, which bounds a value this plugin does not choose. */
+const MAX_HOST_VERSION_LENGTH = 64;
 /**
- * Records which FFmpeg this run resolved, so a support archive states the build a failure came from.
+ * Records what this run is hosted by, so a support archive states the host a failure came from.
+ *
+ * It is persisted rather than held in memory because the process that knows these facts is not the one that
+ * assembles an archive, and it is rewritten on every start so a host or binary that changed between runs
+ * cannot be reported as the one in use. Each call replaces the record whole, so a caller states everything it
+ * knows rather than accumulating into a file two writers would race for.
  *
- * It is persisted rather than held in memory because the process that resolves it is not the one that
- * assembles an archive, and it is rewritten on every start so a path or binary that changed between runs
- * cannot be reported as the one in use. A write that fails is dropped: the archive then declares the
- * environment without an FFmpeg identity, which is honest, whereas failing startup over a diagnostic file
- * would cost the user their cameras.
+ * A write that fails is dropped: the archive then declares the environment without these facts, which is
+ * honest, whereas failing startup over a diagnostic file would cost the user their cameras.
  */
-export function recordFfmpegEnvironment(storageRoot, ffmpeg) {
+export function recordHostEnvironment(storageRoot, host) {
     try {
-        const path = ffmpegEnvironmentPath(storageRoot);
+        const path = hostEnvironmentPath(storageRoot);
         mkdirSync(dirname(path), { mode: 0o700, recursive: true });
-        writeFileSync(path, `${JSON.stringify({ version: 1, ffmpeg })}\n`, { mode: 0o600 });
+        writeFileSync(path, `${JSON.stringify({ version: 2, ...host })}\n`, { mode: 0o600 });
     }
     catch { }
 }
 /**
- * Reads the recorded adaptation binary, refusing a record whose own fields do not narrow.
+ * Reads what this run is hosted by, keeping each fact that narrows and dropping each that does not.
  *
- * The path and the banner are kept as written rather than pattern-replaced, because naming the binary is the
- * entire purpose of the record and a redacted one answers nothing. Neither is device or account material: the
- * path is this plugin's own setting or the binary it ships, and the banner is that build's public identity.
+ * The facts are independent, so a malformed binary identity does not withhold a host version, and a record
+ * stating neither is no record at all.
  */
-function readFfmpegEnvironment(storageRoot) {
+function readHostEnvironment(storageRoot) {
     try {
-        const candidate = JSON.parse(readFileSync(ffmpegEnvironmentPath(storageRoot), 'utf8'));
-        const ffmpeg = candidate.ffmpeg;
-        if (candidate.version !== 1 || !ffmpeg || typeof ffmpeg !== 'object' || Array.isArray(ffmpeg)) {
+        const candidate = JSON.parse(readFileSync(hostEnvironmentPath(storageRoot), 'utf8'));
+        if (candidate.version !== 2) {
             return undefined;
         }
-        const recorded = ffmpeg;
-        if (typeof recorded.path !== 'string' || (recorded.source !== 'bundled' && recorded.source !== 'configured')) {
+        const homebridge = typeof candidate.homebridge === 'string' ? boundedText(candidate.homebridge, MAX_HOST_VERSION_LENGTH) : undefined;
+        const ffmpeg = readFfmpegIdentity(candidate.ffmpeg);
+        if (homebridge === undefined && ffmpeg === undefined) {
             return undefined;
         }
-        const path = boundedText(recorded.path, MAX_FFMPEG_IDENTITY_LENGTH);
-        const version = typeof recorded.version === 'string' ? boundedText(recorded.version, MAX_FFMPEG_IDENTITY_LENGTH) : undefined;
-        return path === undefined
-            ? undefined
-            : { path, source: recorded.source, ...(version === undefined ? {} : { version }) };
+        return {
+            ...(homebridge === undefined ? {} : { homebridge }),
+            ...(ffmpeg === undefined ? {} : { ffmpeg }),
+        };
     }
     catch {
         return undefined;
     }
 }
+/**
+ * The recorded adaptation binary, or nothing where the record's own fields do not narrow.
+ *
+ * The path and the banner are kept as written rather than pattern-replaced, because naming the binary is the
+ * entire purpose of the record and a redacted one answers nothing. Neither is device or account material: the
+ * path is this plugin's own setting or the binary it ships, and the banner is that build's public identity.
+ */
+function readFfmpegIdentity(recorded) {
+    if (!isRecord(recorded)) {
+        return undefined;
+    }
+    if (recorded.source !== 'bundled' && recorded.source !== 'configured') {
+        return undefined;
+    }
+    const path = typeof recorded.path === 'string' ? boundedText(recorded.path, MAX_FFMPEG_IDENTITY_LENGTH) : undefined;
+    const version = typeof recorded.version === 'string' ? boundedText(recorded.version, MAX_FFMPEG_IDENTITY_LENGTH) : undefined;
+    const encoders = isRecord(recorded.encoders) ? readEncoderQualification(recorded.encoders) : undefined;
+    return path === undefined
+        ? undefined
+        : {
+            path,
+            source: recorded.source,
+            ...(version === undefined ? {} : { version }),
+            ...(encoders === undefined ? {} : { encoders }),
+        };
+}
+/**
+ * The recorded encoder qualification, keeping only encoder names, `profile@level` selections and outcomes this
+ * build names, so the record is bounded by those three closed sets, and a `bytes` outcome's two integers.
+ */
+function readEncoderQualification(recorded) {
+    return Object.fromEntries(LIVE_VIDEO_ENCODERS.filter((name) => Object.hasOwn(recorded, name)).map((name) => {
+        const outcomes = isRecord(recorded[name]) ? Object.entries(recorded[name]) : [];
+        return [
+            name,
+            Object.fromEntries(outcomes.flatMap(([selection, value]) => {
+                const [profile, level] = selection.split('@');
+                const outcome = Array.isArray(value) &&
+                    value.length === 3 &&
+                    value[0] === 'bytes' &&
+                    value.slice(1).every(Number.isSafeInteger)
+                    ? value
+                    : allowlistedLabel(value, QUALIFICATION_OUTCOMES);
+                return allowlistedLabel(profile, HOMEKIT_LIVE_VIDEO_PROFILES) &&
+                    allowlistedLabel(level, HOMEKIT_LIVE_VIDEO_LEVELS) &&
+                    selection === `${profile}@${level}` &&
+                    outcome
+                    ? [[selection, outcome]]
+                    : [];
+            })),
+        ];
+    }));
+}
 /**
  * The one log evidence class a retained record belongs to.
  *
@@ -440,6 +676,22 @@ export class GuidedDiagnostics {
         await this.ensureMarker(session, 'reproduction-started', session.reproductionStartedAt);
         return this.project(session);
     }
+    /**
+     * Deletes the persisted session without an archive, which also ends the verbose retention it authorized. UI events
+     * already queued are written first and later ones are refused until it is gone, so none lands after the delete.
+     */
+    async cancel() {
+        this.uiEventsClosing = true;
+        try {
+            await this.uiEventWrites;
+            this.pendingSupportArchive = undefined;
+            await rm(diagnosticsSessionPath(this.storageRoot), { force: true });
+            return await this.status();
+        }
+        finally {
+            this.uiEventsClosing = false;
+        }
+    }
     async endReproduction() {
         let session = this.requireAuthorized();
         if (!session.reproductionStartedAt) {
@@ -520,10 +772,16 @@ export class GuidedDiagnostics {
     /** Prepares the exact manifest and evidence snapshot that one subsequent export may encrypt. */
     async reviewSupportArchive() {
         await this.uiEventWrites;
-        const session = readDiagnosticsSession(this.storageRoot);
+        const persisted = readDiagnosticsSession(this.storageRoot);
+        const { session, exportable } = persisted
+            ? settledDiagnosticsSession(persisted, this.now())
+            : { session: undefined, exportable: false };
         if (!session?.reproductionStartedAt || !session.reproductionEndedAt) {
             throw new Error('A completed reproduction is required before archive review');
         }
+        if (!exportable) {
+            throw new Error('Diagnostics authorization is inactive or expired');
+        }
         const collected = await this.collectSupportEvidence(session);
         const reproductionStartedAt = Date.parse(session.reproductionStartedAt);
         const selected = DIAGNOSTICS_PROFILES[session.profile];
@@ -566,7 +824,13 @@ export class GuidedDiagnostics {
         this.pendingSupportArchive = { reviewId, manifest, evidence: collected };
         return { reviewId, manifest };
     }
-    /** Consumes one reviewed snapshot and returns an encrypted envelope without writing plaintext or an archive to disk. */
+    /**
+     * Consumes one reviewed snapshot and returns an encrypted envelope without writing plaintext or an archive to disk.
+     *
+     * The session outlives the export, because nothing here proves the envelope reached the reporter: a fresh review
+     * exports it again until the reporter leaves it with {@link cancel}, another capture replaces it, or the archive
+     * retention ends it.
+     */
     async exportSupportArchive(reviewId) {
         const pending = this.pendingSupportArchive;
         if (!pending || pending.reviewId !== reviewId) {
@@ -612,18 +876,20 @@ export class GuidedDiagnostics {
                 authTag: cipher.getAuthTag().toString('base64'),
                 ciphertext: ciphertext.toString('base64'),
             };
-            return {
+            const exported = {
                 filename: `homebridge-eufy-${pending.manifest.supportCaseId}.eufysupport.gz`,
                 mediaType: 'application/gzip',
                 archive: await gzip(Buffer.from(`${JSON.stringify(envelope)}\n`, 'utf8')),
             };
+            return exported;
         }
         finally {
             contentKey.fill(0);
         }
     }
     async collectSupportEvidence(session) {
-        const ffmpeg = readFfmpegEnvironment(this.storageRoot);
+        const host = readHostEnvironment(this.storageRoot);
+        const fleet = readFleet(this.storageRoot);
         const evidence = [
             ...(session.affectedDevices === undefined
                 ? []
@@ -632,15 +898,34 @@ export class GuidedDiagnostics {
                         evidence: 'reporter-statement',
                         privacyClass: 'diagnostic',
                         contentType: 'application/json',
-                        content: `${JSON.stringify({ version: 1, affectedDevices: session.affectedDevices })}\n`,
+                        content: `${JSON.stringify({ version: 2, affectedDevices: countedAffectedDevices(session.affectedDevices) })}\n`,
                         /**
-                         * What the reporter answered, not what the plugin observed. A serial identifies one household's
-                         * hardware, so the record is classified above the environment it sits beside and stays inside
-                         * the archive.
+                         * What the reporter answered, not what the plugin observed. A serial is a device identity and no
+                         * evidence class carries one, so the answer travels as its scope: every device, or how many were
+                         * named. Which ones is the reporter's to say in their own words.
                          */
                         fields: [
                             { field: 'version', privacyClass: 'operational' },
-                            { field: 'affectedDevices', privacyClass: 'pseudonymous' },
+                            { field: 'affectedDevices', privacyClass: 'operational' },
+                        ],
+                    },
+                ]),
+            ...(fleet === undefined
+                ? []
+                : [
+                    {
+                        evidence: 'fleet',
+                        privacyClass: 'operational',
+                        contentType: 'application/json',
+                        content: `${JSON.stringify({ version: 1, devices: fleet })}\n`,
+                        /**
+                         * What each device is and becomes, against the alias every other record about it carries. A model
+                         * and an admission outcome are product facts rather than device identity; the alias is what makes
+                         * an entry resolvable to a device, and only by the owner whose console paired it with a name.
+                         */
+                        fields: [
+                            { field: 'version', privacyClass: 'operational' },
+                            { field: 'devices', privacyClass: 'pseudonymous' },
                         ],
                     },
                 ]),
@@ -648,18 +933,22 @@ export class GuidedDiagnostics {
                 evidence: 'environment',
                 privacyClass: 'operational',
                 contentType: 'application/json',
-                content: `${JSON.stringify({ version: 2, plugin: PLUGIN_VERSION, sdk: SDK_VERSION, node: process.version, platform: process.platform, arch: process.arch, ...(ffmpeg ? { ffmpeg } : {}) })}\n`,
+                content: `${JSON.stringify({ version: 3, plugin: PLUGIN_VERSION, sdk: SDK_VERSION, node: process.version, ...(host?.homebridge ? { homebridge: host.homebridge } : {}), platform: process.platform, arch: process.arch, ...(host?.ffmpeg ? { ffmpeg: host.ffmpeg } : {}) })}\n`,
                 /**
                  * The record is operational and one field is classified above it: a resolved FFmpeg path is an
                  * environment fact, but it can carry the home directory of the account Homebridge runs as, so it is
                  * declared as diagnostic rather than presented alongside the host's own architecture.
+                 *
+                 * The Homebridge version is operational and load-bearing: this plugin requires Homebridge 2, and a
+                 * host that predates it loads the plugin and then fails in ways a media fault cannot be told from.
                  */
                 fields: [
                     ...['version', 'plugin', 'sdk', 'node', 'platform', 'arch'].map((field) => ({
                         field,
                         privacyClass: 'operational',
                     })),
-                    ...(ffmpeg ? [{ field: 'ffmpeg', privacyClass: 'diagnostic' }] : []),
+                    ...(host?.homebridge ? [{ field: 'homebridge', privacyClass: 'operational' }] : []),
+                    ...(host?.ffmpeg ? [{ field: 'ffmpeg', privacyClass: 'diagnostic' }] : []),
                 ],
             },
         ];
@@ -710,7 +999,11 @@ export class GuidedDiagnostics {
                 ...(carried.retainedFrom === undefined ? {} : { retainedFrom: carried.retainedFrom }),
                 fields: [...new Set(carried.records.flatMap((record) => Object.keys(record)))].sort().map((field) => ({
                     field,
-                    privacyClass: field === 'accessoryAliases' ? 'pseudonymous' : field === 'timestamp' ? 'operational' : 'diagnostic',
+                    privacyClass: PSEUDONYMOUS_FIELDS.has(field)
+                        ? 'pseudonymous'
+                        : field === 'timestamp'
+                            ? 'operational'
+                            : 'diagnostic',
                 })),
             });
         }
@@ -873,16 +1166,17 @@ export class GuidedDiagnostics {
             throw new Error('Diagnostics authorization is inactive or expired');
         return session;
     }
-    async project(session) {
-        if (!session) {
+    async project(persisted) {
+        if (!persisted) {
             return { status: 'inactive', selectedEvidence: [], missingEvidence: [], partialExportAvailable: false };
         }
+        const { session, exportable } = settledDiagnosticsSession(persisted, this.now());
         const selectedEvidence = DIAGNOSTICS_PROFILES[session.profile];
         const collected = session.reproductionStartedAt && session.reproductionEndedAt
             ? await this.collectSupportEvidence(session)
             : undefined;
         const missingEvidence = collected ? missingEvidenceClasses(selectedEvidence, collected) : [];
-        const expired = Date.parse(session.expiresAt) <= this.now();
+        const expired = Date.parse(session.expiresAt) <= this.now() && !exportable;
         const status = expired
             ? 'expired'
             : session.reproductionEndedAt
@@ -901,9 +1195,9 @@ export class GuidedDiagnostics {
             expiresAt: session.expiresAt,
             ...(session.reproductionStartedAt ? { reproductionStartedAt: session.reproductionStartedAt } : {}),
             ...(session.reproductionEndedAt ? { reproductionEndedAt: session.reproductionEndedAt } : {}),
-            partialExportAvailable: Boolean(session.reproductionEndedAt),
+            partialExportAvailable: exportable,
             ...(session.affectedDevices === undefined ? {} : { affectedDevices: session.affectedDevices }),
-            issueUrl: bugReportUrl(session, missingEvidence),
+            issueUrl: bugReportUrl(session, missingEvidence, readHostEnvironment(this.storageRoot)),
         };
     }
     /**
@@ -944,8 +1238,8 @@ export class GuidedDiagnostics {
         await this.replaceOwnedFile(join(directory, REPRODUCTION_MARKERS_FILE), `${retained}${marker}`);
     }
 }
-function formatMessage(catalog, key, parameters = {}) {
-    const template = catalog[key] ?? EN_MESSAGES[key] ?? key;
+function formatMessage(key, parameters = {}) {
+    const template = EN_MESSAGES[key] ?? key;
     return template
         .replace(/\{([a-zA-Z0-9]+)\}/g, (placeholder, name) => parameters[name] === undefined ? placeholder : String(parameters[name]))
         .replace(/\s+/g, ' ')
@@ -953,7 +1247,7 @@ function formatMessage(catalog, key, parameters = {}) {
 }
 function localize(target, key, parameters = {}) {
     const translator = target.localize;
-    return translator?.(key, parameters) ?? formatMessage(EN_MESSAGES, key, parameters);
+    return translator?.(key, parameters) ?? formatMessage(key, parameters);
 }
 class JsonLineLog {
     onError;
@@ -970,11 +1264,8 @@ class JsonLineLog {
         this.directory = join(storageRoot, LOG_DIRECTORY);
         this.path = join(this.directory, LOG_FILE);
     }
-    write(message) {
-        const payload = sanitizeStructuredEvent(message);
-        if (!payload) {
-            return;
-        }
+    /** Queues one record the sanitizer already rebuilt. */
+    write(payload) {
         const record = this.serialize(payload);
         const bytes = Buffer.byteLength(record);
         if (bytes > MAX_LOG_RECORD_BYTES || this.queuedBytes + bytes > MAX_QUEUED_LOG_BYTES) {
@@ -982,21 +1273,12 @@ class JsonLineLog {
             this.droppedRecords += 1;
             return;
         }
-        const droppedRecords = this.droppedRecords;
-        const droppedAt = this.droppedAt;
-        this.droppedRecords = 0;
-        this.droppedAt = undefined;
+        const dropped = this.drainDropped();
         this.queuedBytes += bytes;
         this.pending = this.pending
             .then(async () => {
-            if (droppedRecords > 0) {
-                await this.append(this.serialize({
-                    scope: 'diagnostics',
-                    level: 'warn',
-                    event: 'records-dropped',
-                    droppedRecords,
-                }, droppedAt));
-            }
+            if (dropped)
+                await this.append(dropped);
             await this.append(record);
         })
             .catch(() => this.onError())
@@ -1005,22 +1287,21 @@ class JsonLineLog {
         });
     }
     flush() {
-        const droppedRecords = this.droppedRecords;
-        const droppedAt = this.droppedAt;
-        this.droppedRecords = 0;
-        this.droppedAt = undefined;
-        if (droppedRecords > 0) {
-            this.pending = this.pending
-                .then(() => this.append(this.serialize({
-                scope: 'diagnostics',
-                level: 'warn',
-                event: 'records-dropped',
-                droppedRecords,
-            }, droppedAt)))
-                .catch(() => this.onError());
+        const dropped = this.drainDropped();
+        if (dropped) {
+            this.pending = this.pending.then(() => this.append(dropped)).catch(() => this.onError());
         }
         return this.pending;
     }
+    /** The `records-dropped` record for what was refused since the last one, resetting the tally, or nothing. */
+    drainDropped() {
+        const { droppedRecords, droppedAt } = this;
+        this.droppedRecords = 0;
+        this.droppedAt = undefined;
+        return droppedRecords === 0
+            ? undefined
+            : this.serialize({ scope: 'diagnostics', level: 'warn', event: 'records-dropped', droppedRecords }, droppedAt);
+    }
     serialize(payload, timestamp = new Date(this.now()).toISOString()) {
         return `${JSON.stringify({ ...payload, timestamp })}\n`;
     }
@@ -1079,12 +1360,12 @@ class JsonLineLog {
  * Routes human messages to Homebridge and structured events to the plugin JSONL log.
  * File writes preserve accepted order; records beyond the bounded pending queue are counted and reported.
  */
-export function createDiagnosticLogger(target, storageRoot, catalog = EN_MESSAGES, now = Date.now) {
+export function createDiagnosticLogger(target, storageRoot, now = Date.now) {
     let fileFailureReported = false;
     const reportFileFailure = () => {
         if (!fileFailureReported) {
             fileFailureReported = true;
-            target.warn(`[diagnostic-log-write-failed] ${formatMessage(catalog, 'log.diagnosticFileFailed')}`);
+            target.warn(`[diagnostic-log-write-failed] ${formatMessage('log.diagnosticFileFailed')}`);
         }
     };
     const file = storageRoot ? new JsonLineLog(storageRoot, reportFileFailure, now) : undefined;
@@ -1098,7 +1379,7 @@ export function createDiagnosticLogger(target, storageRoot, catalog = EN_MESSAGE
             if (verbose && (!session || !DIAGNOSTICS_PROFILES[session.profile].includes(evidenceClassOf(event)))) {
                 return;
             }
-            file.write(JSON.stringify(event));
+            file.write(event);
         }
         : undefined;
     return {
@@ -1106,13 +1387,15 @@ export function createDiagnosticLogger(target, storageRoot, catalog = EN_MESSAGE
         error: (message) => target.error(message),
         flush: () => file?.flush() ?? Promise.resolve(),
         info: (message) => target.info(message),
-        localize: (key, parameters) => formatMessage(catalog, key, parameters),
+        localize: (key, parameters) => formatMessage(key, parameters),
         warn: (message) => target.warn(message),
     };
 }
 /** The class an SDK message belongs to, or nothing when its text matches none of them. */
 function classifySdkEvent(message) {
     const normalized = message.toLowerCase();
+    if (normalized.includes('rtc sign for') && normalized.includes('refused'))
+        return 'rtc-sign-refused';
     if (normalized.includes('restored persisted session'))
         return 'session-restored';
     if (normalized.includes('retrying') || normalized.includes('reconnecting'))
@@ -1191,6 +1474,14 @@ function allowlistedLabel(value, allowed) {
  * like any other field that fails its shape.
  */
 const MAX_STARTUP_WINDOW_MS = 60_000;
+/** Why a level-2 wait ended without a key, which is the whole of what such an ending states. */
+const LEVEL2_UNAVAILABLE_REASONS = [
+    'no-cipher-key',
+    'derivation-failed',
+    'not-negotiating',
+    'session-closed',
+    'grace-elapsed',
+];
 /** The three phases whose only field is the action they report, which the union fixes at `start`. */
 const retainedStart = (candidate) => candidate.action === 'start' ? { action: 'start' } : undefined;
 /** A phase whose only field is one bounded integer, retained under the name the SDK declares for it. */
@@ -1236,7 +1527,74 @@ const LIVE_TRACE_PHASES = {
     'sequence-restart': retainedInteger('dataType', 3),
     'level2-wait': retainedInteger('waitMs', MAX_STARTUP_WINDOW_MS),
     'level2-ready': retainedInteger('cipherId', 65535),
-    'level2-absent': retainedInteger('waitedMs', MAX_STARTUP_WINDOW_MS),
+    'level2-set-payload-only': retainedInteger('cipherId', 65535),
+    'session-connect-wait': retainedInteger('waitMs', MAX_STARTUP_WINDOW_MS),
+    'session-connected': retainedInteger('waitedMs', MAX_STARTUP_WINDOW_MS),
+    'session-unreachable': retainedInteger('waitedMs', MAX_STARTUP_WINDOW_MS),
+    /**
+     * Why a level-2 wait ended without a key, and what it had to name.
+     *
+     * The reason is the record: a wait that ran out states how long it waited, and one answered without waiting
+     * states nothing more, because the negotiation is one-shot per connection. Only a reason reached under a
+     * negotiation has a cipher to name, so both durations are optional and each is retained where it is stated.
+     */
+    'level2-unavailable': (c) => {
+        const reason = allowlistedLabel(c.reason, LEVEL2_UNAVAILABLE_REASONS);
+        if (!reason) {
+            return undefined;
+        }
+        const cipherId = boundedInteger(c.cipherId, 65535);
+        const waitedMs = boundedInteger(c.waitedMs, MAX_STARTUP_WINDOW_MS);
+        return {
+            reason,
+            ...(cipherId === undefined ? {} : { cipherId }),
+            ...(waitedMs === undefined ? {} : { waitedMs }),
+        };
+    },
+    /** The cipher a station asked for, beside the one whose material answered it. */
+    'cipher-fallback': (c) => {
+        const cipherId = boundedInteger(c.cipherId, 65535);
+        const answeredCipherId = boundedInteger(c.answeredCipherId, 65535);
+        return cipherId === undefined || answeredCipherId === undefined ? undefined : { cipherId, answeredCipherId };
+    },
+    'level2-negotiating': retainedInteger('cipherId', 65535),
+    /**
+     * What a call resolved a station as, which decides what its failure means.
+     *
+     * An attached camera's media start has no unencrypted form, so the topology is what separates a key that
+     * never arrived from a start that had no form to be sent in. The channel is an index on a base and the
+     * administrator is a relation to the signed-in account: neither is an identity of its own.
+     */
+    /**
+     * Which lookup channels a connection could ask for a station on, before it asked.
+     *
+     * A connect that had one channel failed for that channel's reason alone, and a connect that had neither
+     * could not have succeeded. Both are otherwise indistinguishable from a station that is switched off.
+     * `cloudMissing` names what the cloud channel lacked when it was unavailable.
+     */
+    'lookup-channels': (c) => {
+        if (typeof c.local !== 'boolean' || typeof c.cloud !== 'boolean')
+            return undefined;
+        const cloudMissing = allowlistedLabel(c.cloudMissing, ['dsk-key', 'cloud-addresses']);
+        return { local: c.local, cloud: c.cloud, ...(cloudMissing === undefined ? {} : { cloudMissing }) };
+    },
+    'station-resolved': (c) => {
+        const topology = allowlistedLabel(c.topology, ['attached', 'own']);
+        const stationAdmin = allowlistedLabel(c.stationAdmin, ['self', 'other', 'unstated']);
+        const channel = boundedInteger(c.channel, MAX_STATION_CHANNEL);
+        const stationModel = typeof c.stationModel === 'string' ? boundedText(c.stationModel, MAX_DEVICE_MODEL_LENGTH) : undefined;
+        return topology && stationAdmin && channel !== undefined
+            ? { topology, channel, stationAdmin, ...(stationModel === undefined ? {} : { stationModel }) }
+            : undefined;
+    },
+    /**
+     * Why a device could not be addressed on its station: its record states no channel, or another attached
+     * device states the same one. The call was refused before anything was sent.
+     */
+    'station-channel-unresolved': (c) => {
+        const issue = allowlistedLabel(c.issue, ['missing', 'shared']);
+        return issue ? { issue } : undefined;
+    },
     /**
      * How long a connection's path has answered nothing, which is the station stating the path is gone.
      *
@@ -1244,20 +1602,51 @@ const LIVE_TRACE_PHASES = {
      * silence longer than that belongs to a session nothing is waiting on.
      */
     'path-stale': retainedInteger('silentMs', MAX_STARTUP_WINDOW_MS),
+    /**
+     * How long a camera's own channel delivered nothing, and whether the station was asked to serve it again.
+     *
+     * Both halves are the record: a station re-tasked to a sibling is repaired by the re-assert, and a pull
+     * nothing is attached to declines it so the station is left with the camera someone is watching. A picture
+     * that stopped advancing while no such record exists stopped for a reason the station's attention does not
+     * reach.
+     */
+    'channel-silent': (c) => {
+        const silentMs = boundedInteger(c.silentMs, MAX_STARTUP_WINDOW_MS);
+        const outcome = allowlistedLabel(c.outcome, ['declined', 'reasserted']);
+        return silentMs !== undefined && outcome ? { silentMs, outcome } : undefined;
+    },
     'media-command-unsent': (c) => {
         const reason = allowlistedLabel(c.reason, ['level2-key', 'address']);
         return reason ? { reason } : undefined;
     },
+    /** `errorName` is an upstream class name, so it stays out of the archive; reason and stage say enough. */
+    'start-failed': (c) => {
+        const reason = allowlistedLabel(c.reason, ['warm-timeout', 'source-error', 'source-ended']);
+        const stage = allowlistedLabel(c.stage, ['awaiting-first-frame', 'audio-only', 'awaiting-keyframe']);
+        const attempts = boundedInteger(c.attempts, 1000);
+        return reason && stage && attempts !== undefined ? { reason, stage, attempts } : undefined;
+    },
     warming: (c) => {
         const retryMs = boundedInteger(c.retryMs, MAX_STARTUP_WINDOW_MS);
         const deadlineMs = boundedInteger(c.deadlineMs, MAX_STARTUP_WINDOW_MS);
         return retryMs === undefined || deadlineMs === undefined ? undefined : { retryMs, deadlineMs };
     },
 };
-function sanitizeSdkLiveStartTrace(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
+/**
+ * Narrows one push the SDK received to its wire event type, whether it knew the device, and how many events it
+ * decoded: a push that decoded into none is the code a device sends that the library does not map yet.
+ */
+function sanitizeSdkPush(value) {
+    const eventType = boundedInteger(value.eventType, 0xffff);
+    const device = allowlistedLabel(value.device, ['known', 'unknown', 'none']);
+    const events = boundedInteger(value.events, 64);
+    return eventType === undefined || !device || events === undefined
+        ? undefined
+        : { scope: 'sdk', level: 'debug', subsystem: 'push', event: 'push-received', eventType, device, events };
+}
+function sanitizeSdkLiveStartTrace(candidate) {
+    if (!isRecord(candidate))
         return undefined;
-    const candidate = value;
     const phase = String(candidate.phase);
     if (!Object.hasOwn(LIVE_TRACE_PHASES, phase))
         return undefined;
@@ -1277,6 +1666,51 @@ function sanitizeSdkLiveStartTrace(value) {
 function opaquePullHandle(value) {
     return typeof value === 'string' && /^(?:pull|station)-\d{1,6}(?::\d{1,3})?$/.test(value) ? value : undefined;
 }
+/**
+ * One support-case accessory alias, or nothing where the value is not one.
+ *
+ * Matched against the shape an alias has rather than against what a serial looks like, on the same rule as
+ * {@link opaquePullHandle}: a record carries an alias or it carries no accessory at all.
+ */
+function opaqueAccessoryAlias(value) {
+    return typeof value === 'string' &&
+        /^accessory-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value)
+        ? value
+        : undefined;
+}
+/**
+ * Narrows one realtime startup outcome to its state, the push plane's start counts, and the mqtt and wired P2P
+ * planes' counts nested under their names, or nothing where the state is unknown.
+ *
+ * Read by both halves of the path — {@link reportRealtimeReadiness} builds the record and the file sink rebuilds it.
+ */
+function sanitizeRealtimeReadiness(value) {
+    const state = allowlistedLabel(value.state, ['ready', 'partial', 'disabled', 'superseded', 'timed-out']);
+    if (!state)
+        return undefined;
+    const counts = (plane) => Object.fromEntries(['required', 'ready', 'failed', 'pending'].flatMap((key) => {
+        const count = isRecord(plane) ? nonNegativeInteger(plane[key]) : undefined;
+        return count === undefined ? [] : [[key, count]];
+    }));
+    const planes = Object.fromEntries(['mqtt', 'wiredP2p'].flatMap((plane) => {
+        const planeCounts = counts(value[plane]);
+        return Object.keys(planeCounts).length ? [[plane, planeCounts]] : [];
+    }));
+    return { event: 'realtime-readiness', state, ...counts(value), ...planes };
+}
+/**
+ * Records how the SDK's realtime startup settled, with each plane's start counts, as `sdk-log` evidence.
+ *
+ * Carries the state and the counts alone, which name the plane — push, mqtt or wired P2P — that failed or never
+ * settled behind a `partial` start.
+ */
+export function reportRealtimeReadiness(target, readiness) {
+    const { state, push, mqtt, wiredP2p } = readiness;
+    const record = sanitizeRealtimeReadiness({ ...push, state, mqtt, wiredP2p });
+    if (target?.debug && record) {
+        target.debug(JSON.stringify({ scope: 'sdk', level: 'debug', subsystem: 'push', ...record }));
+    }
+}
 /**
  * Adapts SDK protocol detail to bounded debug output without preserving supplied values.
  *
@@ -1298,6 +1732,9 @@ export function createSdkLogger(target) {
             if (trace)
                 return { scope: 'sdk', subsystem: 'p2p', event: 'live-start-trace', ...trace };
         }
+        const push = /^\[push\] in: eventType=(\d+) device=(\w+) events=(\d+)$/.exec(message);
+        if (push)
+            return sanitizeSdkPush({ eventType: Number(push[1]), device: push[2], events: Number(push[3]) });
         const requestedSubsystem = /^\[([a-z0-9-]+)(?:\s+[^\]]+)?\]/i.exec(message)?.[1]?.toLowerCase();
         if (requestedSubsystem === 'ffmpeg') {
             const stderr = message.slice(message.indexOf(']') + 1).split(/\r?\n/);
@@ -1318,9 +1755,7 @@ export function createSdkLogger(target) {
         const subsystem = SDK_SUBSYSTEMS.has(requestedSubsystem ?? '') ? requestedSubsystem : (aliasedSubsystem ?? 'sdk');
         const details = args.slice(0, MAX_SDK_DETAILS).map((value) => {
             if (value instanceof Error) {
-                const errorType = ['Error', 'RangeError', 'SessionExpiredError', 'TypeError'].includes(value.name)
-                    ? value.name
-                    : 'Error';
+                const errorType = SDK_ERROR_TYPES.includes(value.name) ? value.name : 'Error';
                 return { errorType };
             }
             if (typeof value === 'string') {
@@ -1421,6 +1856,7 @@ const REASONS = new Set([
     'live-failed',
     'live-no-keyframe',
     'live-source-failed',
+    'live-station-unreachable',
     'live-unavailable',
     'live-undecodable-burst',
     'malformed',
@@ -1444,6 +1880,9 @@ const REASONS = new Set([
     'source-input-unstable',
     'source-stopped',
     'source-unavailable',
+    'source-warm-timeout',
+    'station-key-unavailable',
+    'station-unreachable',
     'stored-download-failed',
     'stored-failed',
     'stored-invalid-image',
@@ -1454,6 +1893,7 @@ const REASONS = new Set([
     'unsupported',
     'unsupported-selection',
     'device-audio-failed',
+    'no-controller-audio',
 ]);
 /** Every runtime state, plus the withdrawal a recovered condition reports. */
 const RUNTIME_CONDITION_REASONS = new Set([...RUNTIME_STATES, 'recovered']);
@@ -1462,6 +1902,7 @@ const HOMEKIT_EVENT_ROUTES = {
     'battery.status': new Set(['battery-alert', 'battery-level']),
     'contact.sensor': new Set(['contact-state']),
     'doorbell.press': new Set(['doorbell-press']),
+    'doorbell.package': new Set(['package-presence']),
     'lock.mechanism': new Set(['lock-state']),
     'motion.sensor': new Set(['motion-detection']),
     'arming.security-system': new Set(['arming-mode-changed', 'security-system-alarm']),
@@ -1469,7 +1910,7 @@ const HOMEKIT_EVENT_ROUTES = {
     'camera.streaming': new Set(['camera-enabled-changed']),
     'camera.controls': new Set(['camera-enabled-changed']),
 };
-const HOMEKIT_OBSERVATIONS = new Set(['malformed', 'missing', 'valid']);
+const HOMEKIT_OBSERVATIONS = new Set(['malformed', 'missing', 'valid', 'ignored']);
 /**
  * What announced a change, for an adapter that follows more than one announcement for the same state.
  *
@@ -1477,9 +1918,9 @@ const HOMEKIT_OBSERVATIONS = new Set(['malformed', 'missing', 'valid']);
  * field is omitted where an adapter states no announcement and refused where it states one absent from here.
  */
 const HOMEKIT_ANNOUNCEMENTS = new Set(['write', 'poll']);
-const HOMEKIT_LIVE_VIDEO_OPERATIONS = new Set(['start', 'reconfigure']);
-const HOMEKIT_LIVE_VIDEO_PROFILES = new Set(['baseline', 'main', 'high']);
-const HOMEKIT_LIVE_VIDEO_LEVELS = new Set(['3.1', '3.2', '4.0']);
+const HOMEKIT_LIVE_VIDEO_OPERATIONS = ['start', 'reconfigure'];
+const HOMEKIT_LIVE_VIDEO_PROFILES = ['baseline', 'main', 'high'];
+const HOMEKIT_LIVE_VIDEO_LEVELS = ['3.1', '3.2', '4.0'];
 /**
  * The inclusive bounds a controller-selected live geometry and frame rate are retained within.
  *
@@ -1500,30 +1941,86 @@ const MAX_LIVE_VIDEO_FRAME_RATE = 120;
  */
 const MIN_LIVE_VIDEO_MTU = 0;
 const MAX_LIVE_VIDEO_MTU = 65_535;
+/** The bit rate ceiling a controller negotiated, in kbps, bounded to the unsigned 16-bit field that carries it. */
+const MAX_LIVE_VIDEO_BIT_RATE = 65_535;
 /** The two address families HomeKit negotiates a destination in. */
-const HOMEKIT_LIVE_ADDRESS_VERSIONS = new Set(['ipv4', 'ipv6']);
-const HOMEKIT_LIVE_SESSION_STAGES = new Set([
+const HOMEKIT_LIVE_ADDRESS_VERSIONS = ['ipv4', 'ipv6'];
+const HOMEKIT_LIVE_SESSION_STAGES = [
     'sdk-source-acquisition',
     'first-source-keyframe',
     'first-adapted-output',
     'controller-rtcp',
-]);
+];
+/** The SDK's own stage and reason for a live warm-up that ended without a keyframe. */
+const SDK_LIVE_START_STAGES = ['awaiting-first-frame', 'audio-only', 'awaiting-keyframe'];
+const SDK_LIVE_START_REASONS = ['warm-timeout', 'source-error', 'source-ended'];
 /**
  * Which adaptation process an FFmpeg record came from.
  *
  * A superset of what the media domain can report, because the SDK runs FFmpeg of its own for snapshot
  * decoding and WebRTC containers and forwards its output here under the same evidence class.
  */
-const ADAPTATION_ROLES = new Set(['live-video', 'live-audio', 'return-audio', 'recording', 'sdk']);
+const ADAPTATION_ROLES = new Set([
+    'live-video',
+    'live-audio',
+    'return-audio',
+    'recording',
+    'preview-encode',
+    'preview-decode',
+    'preview-raw',
+    'sdk',
+]);
 /** What that process did. `output` is a process reported for what it wrote rather than for how it ended. */
 const ADAPTATION_EVENTS = new Set([
     'started',
+    'encoder-disqualified',
     'spawn-failed',
     'input-failed',
     'exited-before-output',
     'exited-while-streaming',
     'output',
 ]);
+/** How a settings-page live preview ended. */
+const PREVIEW_OUTCOMES = ['picture', 'unplayable', 'no-video', 'stopped'];
+/** The iPhone asks a live preview codes for, and the live video settings it may try. */
+const PREVIEW_ASKS = ['wifi', 'cellular'];
+const PREVIEW_SETTINGS = [
+    'smallVideoPackets',
+    'liveVideoPassthrough',
+    'hardwareVideoEncoder',
+    'ignoreHomeBitRate',
+];
+/**
+ * Why a process was started, on the record that reports it starting.
+ *
+ * A replacement carries the identity of the stream the previous process was already sending on, so what it
+ * started mid-flight is judged against what that one left. A first adaptation has nothing behind it.
+ */
+const ADAPTATION_CAUSES = ['first', 'controller-selection', 'source-configuration'];
+/** The encoders a live video process may code with, `copy` being none. */
+const LIVE_VIDEO_ENCODERS = [
+    'copy',
+    'libx264',
+    'h264_videotoolbox',
+    'h264_qsv',
+    'h264_nvenc',
+    'h264_amf',
+    'h264_vaapi',
+    'h264_v4l2m2m',
+];
+/** What qualifying a hardware encoder for one selection found, but `bytes`, which is read with its two integers. */
+const QUALIFICATION_OUTCOMES = [
+    'qualified',
+    'budget',
+    'encode',
+    'trace',
+    'profile',
+    'level',
+    'geometry',
+    'frames',
+];
+/** The codec a live video source delivers. */
+const LIVE_VIDEO_SOURCES = ['h264', 'h265', 'av1'];
 /**
  * Which of those events is a failure, and so the ones a record is levelled `warn` for.
  *
@@ -1533,6 +2030,7 @@ const ADAPTATION_EVENTS = new Set([
  * log for every session that succeeded.
  */
 const ADAPTATION_FAILURE_EVENTS = new Set([
+    'encoder-disqualified',
     'spawn-failed',
     'input-failed',
     'exited-before-output',
@@ -1564,74 +2062,32 @@ const ADAPTATION_SIGNALS = new Set([
 const MAX_ADAPTATION_STDERR_LINES = 8;
 const MAX_ADAPTATION_STDERR_LINE_LENGTH = 200;
 /**
- * The media notices this module retains, read by both halves of the path.
+ * The fixed-shape operational notices, each `[level, messageKey, durationMessageKey?]`.
  *
  * Operational rather than verbose, so each is `plugin-log` evidence that every profile declares.
  */
-const MEDIA_NOTICES = {
-    'camera-snapshot-cache-invalid': {
-        level: 'warn',
-        messageKey: 'log.snapshotCacheInvalid',
-    },
-};
 const RUNTIME_NOTICES = {
-    'status-publication-failed': {
-        level: 'warn',
-        messageKey: 'log.notice.statusPublicationFailed',
-    },
-    'ownership-release-not-finalized': {
-        level: 'error',
-        messageKey: 'log.notice.ownershipReleaseNotFinalized',
-    },
-    'ownership-release-failed': {
-        level: 'error',
-        messageKey: 'log.notice.ownershipReleaseFailed',
-    },
-    'shutdown-failed': {
-        level: 'error',
-        messageKey: 'log.notice.shutdownFailed',
-    },
-    'shutdown-timeout': {
-        level: 'warn',
-        messageKey: 'log.notice.shutdownTimeout',
-        durationMessageKey: 'log.notice.shutdownTimeoutWithDuration',
-    },
-    'ownership-acquisition-failed': {
-        level: 'error',
-        messageKey: 'log.notice.ownershipAcquisitionFailed',
-    },
-    'ownership-release-incomplete': {
-        level: 'warn',
-        messageKey: 'log.notice.ownershipReleaseIncomplete',
-    },
-    'registry-subscriber-failed': {
-        level: 'warn',
-        messageKey: 'log.notice.registrySubscriberFailed',
-    },
-    'event-subscriber-failed': {
-        level: 'warn',
-        messageKey: 'log.notice.eventSubscriberFailed',
-    },
-    'state-subscriber-failed': {
-        level: 'warn',
-        messageKey: 'log.notice.stateSubscriberFailed',
-    },
-    'channel-serve-failed': {
-        level: 'warn',
-        messageKey: 'log.notice.channelServeFailed',
-    },
-    'diagnostics-authorization-armed': {
-        level: 'info',
-        messageKey: 'log.notice.diagnosticsAuthorizationArmed',
-    },
-    'stand-down-not-rearmed': {
-        level: 'warn',
-        messageKey: 'log.notice.standDownNotRearmed',
-    },
-    'stand-down-account-replaced': {
-        level: 'warn',
-        messageKey: 'log.notice.standDownAccountReplaced',
-    },
+    'status-publication-failed': ['warn', 'log.notice.statusPublicationFailed'],
+    'ownership-release-not-finalized': ['error', 'log.notice.ownershipReleaseNotFinalized'],
+    'ownership-release-failed': ['error', 'log.notice.ownershipReleaseFailed'],
+    'shutdown-failed': ['error', 'log.notice.shutdownFailed'],
+    'shutdown-timeout': ['warn', 'log.notice.shutdownTimeout', 'log.notice.shutdownTimeoutWithDuration'],
+    'ownership-acquisition-failed': ['error', 'log.notice.ownershipAcquisitionFailed'],
+    'ownership-release-incomplete': ['warn', 'log.notice.ownershipReleaseIncomplete'],
+    'registry-subscriber-failed': ['warn', 'log.notice.registrySubscriberFailed'],
+    'event-subscriber-failed': ['warn', 'log.notice.eventSubscriberFailed'],
+    'state-subscriber-failed': ['warn', 'log.notice.stateSubscriberFailed'],
+    'channel-serve-failed': ['warn', 'log.notice.channelServeFailed'],
+    'diagnostics-authorization-armed': ['info', 'log.notice.diagnosticsAuthorizationArmed'],
+    'stand-down-not-rearmed': ['warn', 'log.notice.standDownNotRearmed'],
+    'stand-down-account-replaced': ['warn', 'log.notice.standDownAccountReplaced'],
+    'camera-snapshot-cache-invalid': ['warn', 'log.snapshotCacheInvalid'],
+    'discarded-v4-settings-unacknowledged': ['warn', 'log.discardedSettings'],
+};
+/** The scope a notice is recorded under where it is not `runtime-notice`. */
+const NOTICE_SCOPES = {
+    'camera-snapshot-cache-invalid': 'media-notice',
+    'discarded-v4-settings-unacknowledged': 'configuration-notice',
 };
 const RUNTIME_CONDITIONS = {
     degraded: {
@@ -1660,7 +2116,7 @@ const RUNTIME_CONDITIONS = {
     },
 };
 const HOMEKIT_CONDITIONS = {
-    'recognized-device-not-represented': ['log.homekit.recognizedNotRepresented', 'log.action.openDashboard'],
+    'recognized-device-not-represented': ['log.homekit.recognizedNotRepresented', 'log.action.notSupportedYet'],
     'battery-capability-unavailable': ['log.homekit.batteryCapabilityUnavailable', 'log.action.waitBattery'],
     'invalid-battery-observation': ['log.homekit.invalidBatteryObservation', 'log.action.waitBatteryObservation'],
     'battery-temperature-alert': ['log.homekit.batteryTemperatureAlert', 'log.action.allowBatteryCooling'],
@@ -1673,7 +2129,7 @@ const HOMEKIT_CONDITIONS = {
     'smart-light-operation-failed': ['log.homekit.lightOperationFailed', 'log.action.retryLight'],
     'smart-light-reconciliation-expired': ['log.homekit.lightReconciliationExpired', 'log.action.checkPhysicalLight'],
     'arming-capability-unavailable': ['log.homekit.armingCapabilityUnavailable', 'log.action.waitArming'],
-    'unsupported-arming-mode': ['log.homekit.unsupportedArmingMode', 'log.action.selectSupportedArmingMode'],
+    'unsupported-arming-mode': ['log.homekit.unsupportedArmingMode', 'log.action.mapArmingMode'],
     'arming-operation-failed': ['log.homekit.armingOperationFailed', 'log.action.retryArming'],
     'arming-reconciliation-expired': ['log.homekit.armingReconciliationExpired', 'log.action.checkPhysicalArmingMode'],
     'lock-capability-unavailable': ['log.homekit.lockCapabilityUnavailable', 'log.action.waitLock'],
@@ -1707,17 +2163,75 @@ const HOMEKIT_CONDITIONS = {
     'camera-talkback-failed': ['log.homekit.cameraTalkbackFailed', 'log.action.retryTalkback'],
     'camera-talkback-capability-unavailable': ['log.homekit.cameraTalkbackUnavailable', 'log.action.waitTalkback'],
 };
+/**
+ * The action a HomeKit condition names for a reason whose remedy is not the condition's own, keyed `code:reason`.
+ *
+ * A camera adapter is missing only where no FFmpeg path resolved, an adaptation fails to spawn only where the path
+ * cannot be run, and a live adaptation that exits before any output is the FFmpeg build refusing this host, so all
+ * three are fixed in the plugin's settings rather than waited out. A control that timed out
+ * will likely time out again, so it points at the Eufy app instead of a retry. A station whose session did not
+ * connect is fixed at that station, not at the camera a viewer opened.
+ */
+const HOMEKIT_REASON_ACTIONS = {
+    'camera-streaming-capability-unavailable:adapter-missing': 'log.action.setFfmpegPath',
+    'camera-recording-unavailable:adapter-missing': 'log.action.setFfmpegPath',
+    'camera-live-session-failed:adaptation-spawn-failed': 'log.action.checkFfmpegPath',
+    'camera-live-session-failed:adaptation-exited-before-output': 'log.action.setFfmpegPath',
+    'lock-operation-failed:timeout': 'log.action.controlTimedOut',
+    'arming-operation-failed:timeout': 'log.action.controlTimedOut',
+    'smart-light-operation-failed:timeout': 'log.action.controlTimedOut',
+    'camera-control-operation-failed:timeout': 'log.action.controlTimedOut',
+    'camera-live-session-failed:station-unreachable': 'log.action.checkStation',
+    'camera-live-session-failed:source-warm-timeout': 'log.action.retryLiveViewNoPicture',
+    'camera-snapshot-unavailable:live-station-unreachable': 'log.action.checkStation',
+    'camera-talkback-failed:no-controller-audio': 'log.action.trySmallVideoPackets',
+};
+/** Projects a value onto an active condition, or nothing where the catalog does not write that code with those keys. */
+export function knownCondition(value) {
+    if (!isRecord(value))
+        return undefined;
+    const { code, summaryKey, actionKey, serials } = value;
+    if (typeof code !== 'string')
+        return undefined;
+    const runtime = Object.values(RUNTIME_CONDITIONS).find((condition) => condition.code === code);
+    const homeKit = Object.hasOwn(HOMEKIT_CONDITIONS, code)
+        ? HOMEKIT_CONDITIONS[code]
+        : undefined;
+    const [summary, ...actions] = runtime
+        ? [runtime.summaryKey, runtime.actionKey]
+        : homeKit
+            ? [
+                ...homeKit,
+                ...Object.entries(HOMEKIT_REASON_ACTIONS)
+                    .filter(([key]) => key.startsWith(`${code}:`))
+                    .map(([, action]) => action),
+            ]
+            : [];
+    const action = allowlistedLabel(actionKey, actions);
+    if (summary === undefined || summaryKey !== summary || action === undefined)
+        return undefined;
+    const named = Array.isArray(serials) ? serials.filter((serial) => typeof serial === 'string') : [];
+    return { code, summaryKey: summary, actionKey: action, ...(named.length === 0 ? {} : { serials: named }) };
+}
+/** HomeKit conditions that state a gap nothing in the user's setup closes, so an active one is not a warning. */
+const INFORMATIONAL_HOMEKIT_CONDITIONS = new Set(['recognized-device-not-represented']);
+/** The level and action one HomeKit condition is written with, decided once for the console and the record. */
+function homeKitConditionPresentation(code, active, reason) {
+    return {
+        level: active && !INFORMATIONAL_HOMEKIT_CONDITIONS.has(code) ? 'warn' : 'info',
+        actionKey: HOMEKIT_REASON_ACTIONS[`${code}:${reason}`] ?? HOMEKIT_CONDITIONS[code][1],
+    };
+}
 function sanitizeStructuredEvent(message) {
     let value;
     try {
-        const parsed = JSON.parse(message);
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-            return undefined;
-        value = parsed;
+        value = JSON.parse(message);
     }
     catch {
         return undefined;
     }
+    if (!isRecord(value))
+        return undefined;
     const level = allowlistedLabel(value.level, ['debug', 'info', 'warn', 'error']);
     if (!level || typeof value.scope !== 'string')
         return undefined;
@@ -1728,6 +2242,13 @@ function sanitizeStructuredEvent(message) {
             !SDK_EVENT_KEYS.has(value.event)) {
             return undefined;
         }
+        if (value.event === 'realtime-readiness') {
+            const readiness = sanitizeRealtimeReadiness(value);
+            return readiness ? { scope: 'sdk', level: 'debug', subsystem: 'push', ...readiness } : undefined;
+        }
+        if (value.event === 'push-received') {
+            return level === 'debug' ? sanitizeSdkPush(value) : undefined;
+        }
         if (value.event === 'live-start-trace') {
             if (level !== 'debug')
                 return undefined;
@@ -1736,23 +2257,17 @@ function sanitizeStructuredEvent(message) {
         }
         const details = [];
         for (const detail of Array.isArray(value.details) ? value.details.slice(0, MAX_SDK_DETAILS) : []) {
-            if (!detail || typeof detail !== 'object' || Array.isArray(detail))
+            if (!isRecord(detail))
                 continue;
-            const candidate = detail;
-            const errorType = allowlistedLabel(candidate.errorType, [
-                'Error',
-                'RangeError',
-                'SessionExpiredError',
-                'TypeError',
-            ]);
+            const errorType = allowlistedLabel(detail.errorType, SDK_ERROR_TYPES);
             if (errorType) {
                 details.push({ errorType });
                 continue;
             }
-            const type = allowlistedLabel(candidate.type, ['boolean', 'number', 'object', 'string', 'undefined']);
+            const type = allowlistedLabel(detail.type, ['boolean', 'number', 'object', 'string', 'undefined']);
             if (!type)
                 continue;
-            const length = nonNegativeInteger(candidate.length);
+            const length = nonNegativeInteger(detail.length);
             details.push({ type, ...(length === undefined ? {} : { length }) });
         }
         return {
@@ -1764,62 +2279,14 @@ function sanitizeStructuredEvent(message) {
             ...(value.detailsTruncated === true ? { detailsTruncated: true } : {}),
         };
     }
-    if (value.scope === 'runtime-notice') {
+    if (value.scope === 'runtime-notice' || value.scope === 'media-notice' || value.scope === 'configuration-notice') {
         if (typeof value.code !== 'string' || !Object.hasOwn(RUNTIME_NOTICES, value.code))
             return undefined;
-        const notice = RUNTIME_NOTICES[value.code];
-        const durationMs = nonNegativeInteger(value.durationMs);
-        const messageKey = durationMs !== undefined && 'durationMessageKey' in notice ? notice.durationMessageKey : notice.messageKey;
-        return {
-            scope: 'runtime-notice',
-            level: notice.level,
-            code: value.code,
-            messageKey,
-            ...(durationMs === undefined ? {} : { durationMs }),
-        };
-    }
-    if (value.scope === 'configuration-notice') {
-        if (value.code !== 'discarded-v4-settings-unacknowledged')
-            return undefined;
-        return {
-            scope: 'configuration-notice',
-            level: 'warn',
-            code: value.code,
-            messageKey: 'log.discardedSettings',
-        };
-    }
-    if (value.scope === 'media-notice') {
-        if (typeof value.code !== 'string' || !Object.hasOwn(MEDIA_NOTICES, value.code))
-            return undefined;
-        const notice = MEDIA_NOTICES[value.code];
-        return { scope: 'media-notice', level: notice.level, code: value.code, messageKey: notice.messageKey };
+        const notice = runtimeNoticeRecord(value.code, nonNegativeInteger(value.durationMs));
+        return notice.scope === value.scope ? notice : undefined;
     }
     if (value.scope === 'homekit') {
-        if (value.adapter === 'camera.streaming' && value.event === 'live-video-selected') {
-            const selection = sanitizeLiveVideoSelection(value);
-            return selection ? { scope: 'homekit', level: 'debug', ...selection } : undefined;
-        }
-        if (value.adapter === 'camera.streaming' && HOMEKIT_LIVE_REQUEST_EVENTS.has(String(value.event))) {
-            const lifecycle = sanitizeLiveSessionTrace(value);
-            return lifecycle ? { scope: 'homekit', level: 'debug', ...lifecycle } : undefined;
-        }
-        if (typeof value.adapter !== 'string' ||
-            typeof value.event !== 'string' ||
-            !HOMEKIT_EVENT_ROUTES[value.adapter]?.has(value.event) ||
-            typeof value.observation !== 'string' ||
-            !HOMEKIT_OBSERVATIONS.has(value.observation)) {
-            return undefined;
-        }
-        return {
-            scope: 'homekit',
-            level: 'debug',
-            adapter: value.adapter,
-            event: value.event,
-            observation: value.observation,
-            ...(typeof value.announcedBy === 'string' && HOMEKIT_ANNOUNCEMENTS.has(value.announcedBy)
-                ? { announcedBy: value.announcedBy }
-                : {}),
-        };
+        return sanitizeHomeKitEvent(value);
     }
     if (value.scope === 'runtime') {
         const event = allowlistedLabel(value.event, ['ready', 'stopped']);
@@ -1830,6 +2297,10 @@ function sanitizeStructuredEvent(message) {
     if (value.scope === 'ffmpeg') {
         return sanitizeAdaptationNotice(value, level);
     }
+    if (value.scope === 'live-preview') {
+        const preview = sanitizeLivePreview(value);
+        return preview ? { scope: 'live-preview', level: 'info', ...preview } : undefined;
+    }
     if (value.scope === 'diagnostic-condition') {
         const homeKitDefinition = typeof value.code === 'string' && Object.hasOwn(HOMEKIT_CONDITIONS, value.code)
             ? HOMEKIT_CONDITIONS[value.code]
@@ -1864,17 +2335,18 @@ function sanitizeStructuredEvent(message) {
         const affectedAccessoryCount = nonNegativeInteger(value.affectedAccessoryCount);
         const accessoryAliases = Array.isArray(value.accessoryAliases)
             ? value.accessoryAliases
-                .filter((alias) => typeof alias === 'string' && /^accessory-[0-9a-f-]{36}$/.test(alias))
+                .filter((alias) => opaqueAccessoryAlias(alias) !== undefined)
                 .slice(0, MAX_ACCESSORY_ALIASES)
             : [];
+        const { level: conditionLevel, actionKey } = homeKitConditionPresentation(value.code, value.active, value.reason);
         return {
             scope: 'diagnostic-condition',
-            level: value.active ? 'warn' : 'info',
+            level: conditionLevel,
             code: value.code,
             active: value.active,
             reason: value.reason,
             summaryKey: homeKitDefinition[0],
-            actionKey: homeKitDefinition[1],
+            actionKey,
             ...(typeof value.capability === 'string' && CAPABILITIES.has(value.capability)
                 ? { capability: value.capability }
                 : {}),
@@ -1886,19 +2358,22 @@ function sanitizeStructuredEvent(message) {
     }
     return undefined;
 }
-/** Emits one fixed-shape operational notice selected by its allowlisted runtime code. */
-export function reportRuntimeNotice(target, code, fields = {}) {
-    const notice = RUNTIME_NOTICES[code];
-    const durationMs = fields.durationMs === undefined ? undefined : Math.max(0, Math.trunc(fields.durationMs));
-    const messageKey = durationMs !== undefined && 'durationMessageKey' in notice ? notice.durationMessageKey : notice.messageKey;
-    target[notice.level]?.(`[${code}] ${localize(target, messageKey, { durationMs: durationMs ?? 0 })}`);
-    target.debug?.(JSON.stringify({
-        scope: 'runtime-notice',
-        level: notice.level,
+/** The record one notice is written as, read by both halves of the path. */
+function runtimeNoticeRecord(code, durationMs) {
+    const [level, messageKey, durationMessageKey] = RUNTIME_NOTICES[code];
+    return {
+        scope: NOTICE_SCOPES[code] ?? 'runtime-notice',
+        level,
         code,
-        messageKey,
+        messageKey: durationMs !== undefined && durationMessageKey ? durationMessageKey : messageKey,
         ...(durationMs === undefined ? {} : { durationMs }),
-    }));
+    };
+}
+/** Emits one fixed-shape operational notice selected by its allowlisted code. */
+export function reportRuntimeNotice(target, code, fields = {}) {
+    const record = runtimeNoticeRecord(code, fields.durationMs === undefined ? undefined : Math.max(0, Math.trunc(fields.durationMs)));
+    target[record.level]?.(`[${code}] ${localize(target, record.messageKey, { durationMs: record.durationMs ?? 0, finishBy: fields.finishBy ?? '' })}`);
+    target.debug?.(JSON.stringify(record));
 }
 /**
  * Picks up an authorization the persisted session file confirms, reporting whether it did.
@@ -1906,68 +2381,124 @@ export function reportRuntimeNotice(target, code, fields = {}) {
  * The file is the authority: the supplied identifier only names which window the caller believes was opened,
  * and a session the file does not hold as active changes nothing and reports nothing. A confirmed pickup emits
  * one operational record, which is the evidence that this process began retaining the window's scopes, taken
- * at the moment it did rather than whenever a later record arrives.
+ * at the moment it did rather than whenever a later record arrives, and its console line names the time the
+ * capture stops on its own.
  */
 export function armDiagnosticsAuthorization(target, storageRoot, supportCaseId, now = Date.now) {
-    if (!isSupportCaseId(supportCaseId) ||
-        activeDiagnosticsSession(storageRoot, now())?.supportCaseId !== supportCaseId) {
+    const session = activeDiagnosticsSession(storageRoot, now());
+    if (!isSupportCaseId(supportCaseId) || session?.supportCaseId !== supportCaseId) {
         return false;
     }
-    reportRuntimeNotice(target, 'diagnostics-authorization-armed');
+    reportRuntimeNotice(target, 'diagnostics-authorization-armed', {
+        finishBy: new Date(session.expiresAt).toLocaleString(),
+    });
     return true;
 }
-/** Emits the startup notice for discarded settings awaiting acknowledgement. */
-export function reportDiscardedV4Settings(target) {
-    const code = 'discarded-v4-settings-unacknowledged';
-    const messageKey = 'log.discardedSettings';
-    target.warn(`[${code}] ${localize(target, messageKey)}`);
-    target.debug?.(JSON.stringify({
-        scope: 'configuration-notice',
-        level: 'warn',
-        code,
-        messageKey,
-    }));
+/** States once which encoders code live video on this host: every qualified hardware encoder, then `libx264`. */
+export function reportLiveVideoEncoders(target, encoders) {
+    const names = [
+        ...LIVE_VIDEO_ENCODERS.filter((name) => Object.values(encoders[name] ?? {}).includes('qualified') && name !== 'libx264'),
+        'libx264',
+    ];
+    target.info(`[live-video-encoders] ${localize(target, 'log.liveVideoEncoders', { encoders: names.join(', ') })}`);
 }
-/** Emits one identity-free warning after an invalid retained camera image is discarded. */
-export function reportInvalidSnapshotCache(target) {
-    const code = 'camera-snapshot-cache-invalid';
-    const { level, messageKey } = MEDIA_NOTICES[code];
-    target[level](`[${code}] ${localize(target, messageKey)}`);
-    target.debug?.(JSON.stringify({ scope: 'media-notice', level, code, messageKey }));
-}
-/** Emits one allowlisted HomeKit event trace only when host debug output is available. */
-export function reportHomeKitEvent(target, trace) {
-    if (trace.event === 'live-video-selected') {
-        const selection = sanitizeLiveVideoSelection(trace);
-        if (target.debug && selection) {
-            target.debug(JSON.stringify({ scope: 'homekit', level: 'debug', ...selection }));
-        }
-        return;
+/**
+ * Narrows one offered station arbitration decision, or nothing where its own labels do not narrow.
+ *
+ * Read by both halves of the path — {@link reportStationClaim} builds the record and the file sink rebuilds
+ * it — because a record only one of them recognises is written to a console nobody is reading and dropped
+ * before it reaches a support archive.
+ */
+function sanitizeStationClaim(value) {
+    const action = allowlistedLabel(value.action, STATION_CLAIM_ACTIONS);
+    const claim = allowlistedLabel(value.claim, STATION_CLAIMS);
+    if (!action || !claim) {
+        return undefined;
     }
-    if (HOMEKIT_LIVE_REQUEST_EVENTS.has(trace.event)) {
-        const lifecycle = sanitizeLiveSessionTrace(trace);
-        if (target.debug && lifecycle) {
-            target.debug(JSON.stringify({ scope: 'homekit', level: 'debug', ...lifecycle }));
-        }
-        return;
+    const against = allowlistedLabel(value.to ?? value.by ?? value.against, STATION_CLAIMS);
+    return { event: 'station-claim', action, claim, ...(against === undefined ? {} : { against }) };
+}
+/**
+ * Narrows one offered unrouted SDK event to its kind and target, or nothing where either is not allowlisted.
+ *
+ * Read by both halves of the path — {@link reportHomeKitEvent} builds the record and the file sink rebuilds it.
+ */
+function sanitizeUnroutedEvent(value) {
+    const kind = allowlistedLabel(value.kind, UNROUTED_EVENT_KINDS);
+    const target = allowlistedLabel(value.target, UNROUTED_EVENT_TARGETS);
+    return kind && target ? { event: 'event-unrouted', kind, target } : undefined;
+}
+/**
+ * Records one arbitration decision over a station's own session as `homekit-log` evidence.
+ *
+ * A still that stood aside produced no picture of its own and no failure, so without this the deferral is
+ * indistinguishable afterwards from a capture that was never asked for. The record carries the claims and the
+ * decision alone: a station identity is a serial, and the camera holding it is already named by the records
+ * about that camera.
+ */
+export function reportStationClaim(target, decision) {
+    const claim = sanitizeStationClaim(decision);
+    if (target.debug && claim) {
+        target.debug(JSON.stringify({ scope: 'homekit', level: 'debug', ...claim }));
     }
-    if (!target.debug ||
-        !('observation' in trace) ||
-        !HOMEKIT_EVENT_ROUTES[trace.adapter]?.has(trace.event) ||
-        typeof trace.observation !== 'string' ||
-        !HOMEKIT_OBSERVATIONS.has(trace.observation)) {
-        return;
+}
+/**
+ * Narrows one offered HomeKit adapter fact to its `homekit` record, or nothing where its route does not narrow.
+ *
+ * Read by both halves of the path: {@link reportHomeKitEvent} builds the record and the file sink rebuilds it.
+ */
+function sanitizeHomeKitEvent(value) {
+    if (value.event === 'event-unrouted') {
+        const unrouted = sanitizeUnroutedEvent(value);
+        return unrouted ? { scope: 'homekit', level: 'debug', ...unrouted } : undefined;
+    }
+    if (value.event === 'station-claim') {
+        const claim = sanitizeStationClaim(value);
+        return claim ? { scope: 'homekit', level: 'debug', ...claim } : undefined;
+    }
+    if (value.adapter === 'camera.streaming' && value.event === 'live-video-selected') {
+        const selection = sanitizeLiveVideoSelection(value);
+        return selection ? { scope: 'homekit', level: 'debug', ...selection } : undefined;
+    }
+    if (value.adapter === 'camera.streaming' && HOMEKIT_LIVE_REQUEST_EVENTS.has(String(value.event))) {
+        const lifecycle = sanitizeLiveSessionTrace(value);
+        return lifecycle ? { scope: 'homekit', level: 'debug', ...lifecycle } : undefined;
+    }
+    if (typeof value.adapter !== 'string' ||
+        typeof value.event !== 'string' ||
+        !HOMEKIT_EVENT_ROUTES[value.adapter]?.has(value.event) ||
+        typeof value.observation !== 'string' ||
+        !HOMEKIT_OBSERVATIONS.has(value.observation)) {
+        return undefined;
     }
-    target.debug(JSON.stringify({
+    const alias = opaqueAccessoryAlias(value.accessory);
+    return {
         scope: 'homekit',
         level: 'debug',
-        adapter: trace.adapter,
-        event: trace.event,
-        observation: trace.observation,
-        ...(typeof trace.announcedBy === 'string' && HOMEKIT_ANNOUNCEMENTS.has(trace.announcedBy)
-            ? { announcedBy: trace.announcedBy }
+        adapter: value.adapter,
+        event: value.event,
+        observation: value.observation,
+        ...(typeof value.announcedBy === 'string' && HOMEKIT_ANNOUNCEMENTS.has(value.announcedBy)
+            ? { announcedBy: value.announcedBy }
             : {}),
-    }));
+        ...(typeof value.code === 'number' && Number.isInteger(value.code) && value.code >= 0 && value.code <= 0xffff
+            ? { code: value.code }
+            : {}),
+        ...(alias === undefined ? {} : { accessory: alias }),
+    };
+}
+/**
+ * Emits one allowlisted HomeKit event trace only when host debug output is available.
+ *
+ * `aliasFor` resolves the trace's device identity to the support-case alias the conditions about that accessory
+ * already carry. The identity itself never reaches the record: an unresolved one is recorded as no accessory.
+ */
+export function reportHomeKitEvent(target, trace, aliasFor) {
+    const alias = 'serial' in trace && typeof trace.serial === 'string' ? aliasFor?.(trace.serial) : undefined;
+    const record = sanitizeHomeKitEvent({ ...trace, accessory: alias });
+    if (target.debug && record) {
+        target.debug(JSON.stringify(record));
+    }
 }
 /**
  * Records one FFmpeg adaptation fact as the `ffmpeg-log` evidence the media support profiles declare.
@@ -1987,19 +2518,8 @@ export function reportAdaptationNotice(target, trace) {
     }
 }
 /**
- * Reduces one FFmpeg stderr line to what a support case may keep, or nothing where nothing is left of it.
- *
- * The line is the only place an encoder-level cause is stated outright, and it is also the only place this
- * plugin's own argument list can be echoed back: the output URL carries base64 SRTP key material, the
- * controller address sits beside it, and an SDK snapshot filename carries a device serial. Each of those is
- * replaced by what it is rather than searched for afterwards, because a redaction that depends on
- * recognising a secret fails on the first message shape nobody predicted.
- *
- * The key material is replaced before the path rules run, and not after. Base64 includes `/`, so a path rule
- * applied first splits a key into sub-runs too short for any length threshold to catch — measured on random
- * 30-byte keys, roughly one line in twenty then kept an eight-character fragment verbatim. The cost of this
- * order is that a long path made only of letters and separators is labelled as redacted rather than as a
- * path, which loses a label and never a secret.
+ * Reduces one FFmpeg stderr line to what a support case may keep, or nothing where nothing is left of it: a
+ * bounded printable line, never a `progress=` one, through {@link redactSensitiveText}.
  */
 function redactAdaptationStderr(line) {
     const printable = boundedText(line, MAX_ADAPTATION_STDERR_LINE_LENGTH);
@@ -2073,73 +2593,154 @@ function sanitizeAdaptationNotice(value, level) {
         .filter((line) => line !== undefined)
         .slice(-MAX_ADAPTATION_STDERR_LINES);
     const sourceFragments = nonNegativeInteger(value.sourceFragments);
+    const sourceWidth = nonNegativeInteger(value.sourceWidth);
+    const sourceHeight = nonNegativeInteger(value.sourceHeight);
+    const cause = allowlistedLabel(value.cause, ADAPTATION_CAUSES);
+    const encoder = allowlistedLabel(value.encoder, LIVE_VIDEO_ENCODERS);
+    const source = allowlistedLabel(value.source, LIVE_VIDEO_SOURCES);
     return {
         scope: 'ffmpeg',
         level,
         role: value.role,
         event: value.event,
+        ...(cause === undefined ? {} : { cause }),
+        ...(encoder === undefined ? {} : { encoder }),
+        ...(source === undefined ? {} : { source }),
+        ...(sourceWidth === undefined || sourceHeight === undefined ? {} : { sourceWidth, sourceHeight }),
         ...(code === undefined ? {} : { code }),
         ...(signal === undefined ? {} : { signal }),
         ...(sourceFragments === undefined ? {} : { sourceFragments }),
         ...(stderr.length ? { stderr } : {}),
     };
 }
+/**
+ * Records how one settings-page live preview ended, as a `live-preview` record kept whether or not a support
+ * window is open: it is not one of the {@link VERBOSE_SCOPES}, because it holds only allowlisted labels and
+ * bounded numbers, one per run a user started.
+ */
+export function reportLivePreview(target, trace) {
+    const { level, ...selection } = trace.selection;
+    const preview = sanitizeLivePreview({ ...trace, ...selection, levelName: level });
+    if (preview)
+        target.debug?.(JSON.stringify({ scope: 'live-preview', level: 'info', ...preview }));
+}
+/**
+ * Narrows one offered live preview run, or nothing where its selection or outcome does not narrow.
+ *
+ * Read by both halves of the path, {@link reportLivePreview} and the file sink, so a record only one of them
+ * recognised could not reach a support archive.
+ */
+function sanitizeLivePreview(value) {
+    const selection = sanitizePreviewSelection(value);
+    const outcome = allowlistedLabel(value.outcome, PREVIEW_OUTCOMES);
+    if (!selection || !outcome)
+        return undefined;
+    const encoder = allowlistedLabel(value.encoder, LIVE_VIDEO_ENCODERS);
+    const source = allowlistedLabel(value.source, LIVE_VIDEO_SOURCES);
+    const kbps = boundedInteger(value.kbps, MAX_LIVE_VIDEO_BIT_RATE);
+    const accessory = opaqueAccessoryAlias(value.accessory);
+    const ask = allowlistedLabel(value.ask, PREVIEW_ASKS);
+    const settings = PREVIEW_SETTINGS.filter((setting) => typeof value[setting] === 'boolean');
+    return {
+        ...selection,
+        ...(encoder === undefined ? {} : { encoder }),
+        ...(source === undefined ? {} : { source }),
+        ...(kbps === undefined ? {} : { kbps }),
+        ...(ask === undefined ? {} : { ask }),
+        ...Object.fromEntries(settings.map((setting) => [setting, value[setting]])),
+        outcome,
+        ...(accessory === undefined ? {} : { accessory }),
+    };
+}
+/** A live preview's selection as flat bounded fields, or nothing where any of them falls outside its allowlist. */
+function sanitizePreviewSelection(candidate) {
+    const fields = {
+        profile: allowlistedLabel(candidate.profile, HOMEKIT_LIVE_VIDEO_PROFILES),
+        levelName: allowlistedLabel(candidate.levelName, HOMEKIT_LIVE_VIDEO_LEVELS),
+        width: boundedInteger(candidate.width, MAX_LIVE_VIDEO_DIMENSION, MIN_LIVE_VIDEO_DIMENSION),
+        height: boundedInteger(candidate.height, MAX_LIVE_VIDEO_DIMENSION, MIN_LIVE_VIDEO_DIMENSION),
+        fps: boundedInteger(candidate.fps, MAX_LIVE_VIDEO_FRAME_RATE, MIN_LIVE_VIDEO_FRAME_RATE),
+        maxBitRate: boundedInteger(candidate.maxBitRate, MAX_LIVE_VIDEO_BIT_RATE),
+    };
+    return Object.values(fields).includes(undefined) ? undefined : fields;
+}
 function sanitizeLiveSessionTrace(value) {
     if (value.adapter !== 'camera.streaming') {
         return undefined;
     }
-    if (value.event === 'live-session-released' || value.event === 'live-session-streaming') {
-        return { adapter: value.adapter, event: value.event };
+    const alias = opaqueAccessoryAlias(value.accessory);
+    const accessory = alias === undefined ? {} : { accessory: alias };
+    if (value.event === 'live-session-released') {
+        const release = allowlistedLabel(value.release, LIVE_SESSION_RELEASES);
+        if (!release) {
+            return undefined;
+        }
+        const reports = nonNegativeInteger(value.reports);
+        const sinceLastReportMs = boundedInteger(value.sinceLastReportMs, MAX_STARTUP_WINDOW_MS);
+        return {
+            adapter: value.adapter,
+            event: value.event,
+            release,
+            ...(reports === undefined ? {} : { reports }),
+            ...(sinceLastReportMs === undefined ? {} : { sinceLastReportMs }),
+            ...(value.stage === 'sdk-source-acquisition' ? { stage: value.stage } : {}),
+            ...accessory,
+        };
+    }
+    if (value.event === 'live-session-streaming' || value.event === 'live-talkback-started') {
+        return { adapter: value.adapter, event: value.event, ...accessory };
     }
     if (value.event === 'live-request-refused') {
         return typeof value.reason === 'string' && REFUSAL_REASONS.has(value.reason)
-            ? { adapter: value.adapter, event: value.event, reason: value.reason }
+            ? { adapter: value.adapter, event: value.event, reason: value.reason, ...accessory }
             : undefined;
     }
     if (value.event === 'live-request-unaccounted') {
         return typeof value.afterMs === 'number' && Number.isFinite(value.afterMs)
-            ? { adapter: value.adapter, event: value.event, afterMs: Math.round(value.afterMs) }
+            ? { adapter: value.adapter, event: value.event, afterMs: Math.round(value.afterMs), ...accessory }
             : undefined;
     }
     if (value.event !== 'live-session-failed' ||
         value.outcome !== 'failed' ||
         typeof value.reason !== 'string' ||
         !REASONS.has(value.reason) ||
-        typeof value.stage !== 'string' ||
-        !HOMEKIT_LIVE_SESSION_STAGES.has(value.stage)) {
+        !allowlistedLabel(value.stage, HOMEKIT_LIVE_SESSION_STAGES)) {
         return undefined;
     }
+    const sourceStage = allowlistedLabel(value.sourceStage, SDK_LIVE_START_STAGES);
+    const sourceReason = allowlistedLabel(value.sourceReason, SDK_LIVE_START_REASONS);
     return {
         adapter: value.adapter,
         event: value.event,
         outcome: value.outcome,
         reason: value.reason,
         stage: value.stage,
+        ...(sourceStage === undefined ? {} : { sourceStage }),
+        ...(sourceReason === undefined ? {} : { sourceReason }),
+        ...accessory,
     };
 }
 function sanitizeLiveVideoSelection(value) {
-    const operation = typeof value.operation === 'string' ? value.operation : undefined;
-    const profile = typeof value.profile === 'string' ? value.profile : undefined;
-    const codecLevel = typeof value.levelName === 'string' ? value.levelName : typeof value.level === 'string' ? value.level : undefined;
+    const operation = allowlistedLabel(value.operation, HOMEKIT_LIVE_VIDEO_OPERATIONS);
+    const profile = allowlistedLabel(value.profile, HOMEKIT_LIVE_VIDEO_PROFILES);
+    const codecLevel = allowlistedLabel(typeof value.levelName === 'string' ? value.levelName : value.level, HOMEKIT_LIVE_VIDEO_LEVELS);
     const width = boundedInteger(value.width, MAX_LIVE_VIDEO_DIMENSION, MIN_LIVE_VIDEO_DIMENSION);
     const height = boundedInteger(value.height, MAX_LIVE_VIDEO_DIMENSION, MIN_LIVE_VIDEO_DIMENSION);
     const fps = boundedInteger(value.fps, MAX_LIVE_VIDEO_FRAME_RATE, MIN_LIVE_VIDEO_FRAME_RATE);
     const mtu = boundedInteger(value.mtu, MAX_LIVE_VIDEO_MTU, MIN_LIVE_VIDEO_MTU);
-    const addressVersion = typeof value.addressVersion === 'string' ? value.addressVersion : undefined;
+    const maxBitRate = boundedInteger(value.maxBitRate, MAX_LIVE_VIDEO_BIT_RATE, 0);
+    const addressVersion = allowlistedLabel(value.addressVersion, HOMEKIT_LIVE_ADDRESS_VERSIONS);
     if (!operation ||
-        !HOMEKIT_LIVE_VIDEO_OPERATIONS.has(operation) ||
         !profile ||
-        !HOMEKIT_LIVE_VIDEO_PROFILES.has(profile) ||
         !codecLevel ||
-        !HOMEKIT_LIVE_VIDEO_LEVELS.has(codecLevel) ||
         width === undefined ||
         height === undefined ||
         fps === undefined ||
         mtu === undefined ||
-        !addressVersion ||
-        !HOMEKIT_LIVE_ADDRESS_VERSIONS.has(addressVersion)) {
+        !addressVersion) {
         return undefined;
     }
+    const alias = opaqueAccessoryAlias(value.accessory);
     return {
         adapter: 'camera.streaming',
         event: 'live-video-selected',
@@ -2150,7 +2751,9 @@ function sanitizeLiveVideoSelection(value) {
         height,
         fps,
         mtu,
+        ...(maxBitRate === undefined ? {} : { maxBitRate }),
         addressVersion,
+        ...(alias === undefined ? {} : { accessory: alias }),
     };
 }
 /** Emits bounded normal-output condition transitions without stable device or account identity. */
@@ -2209,10 +2812,11 @@ export class DiagnosticConditions {
         }
         const uniqueDeviceIds = condition.active ? [...new Set(affectedDeviceIds)].sort() : [];
         const accessoryAliases = uniqueDeviceIds
-            .map((identity) => this.accessoryAlias(identity))
+            .map((identity) => this.aliasFor(identity))
             .filter((alias) => alias !== undefined)
             .sort();
-        this.write(condition.code, condition.active, condition.reason, definition[0], definition[1], condition.active ? 'warn' : 'info', {
+        const { level, actionKey } = homeKitConditionPresentation(condition.code, condition.active, condition.reason);
+        this.write(condition.code, condition.active, condition.reason, definition[0], actionKey, level, {
             ...(condition.capability === undefined ? {} : { capability: condition.capability }),
             ...(condition.member === undefined ? {} : { member: condition.member }),
             affectedAccessoryCount: uniqueDeviceIds.length,
@@ -2224,9 +2828,19 @@ export class DiagnosticConditions {
             const alias = this.aliases.get(serial);
             return name === undefined ? undefined : alias === undefined ? name : `${name} (${alias})`;
         })
-            .filter((named) => named !== undefined));
+            .filter((named) => named !== undefined), uniqueDeviceIds);
     }
-    accessoryAlias(identity) {
+    /** Every condition active now, each held from the transition that raised it to the one that clears it. */
+    current() {
+        return [...this.active.values()].map(({ condition }) => condition);
+    }
+    /**
+     * The support-case alias for one device identity, minted on first use.
+     *
+     * The one place an alias is decided, so every record about a device — a condition, a media trace — carries
+     * the same one, and the owner's console line is what resolves it to a name.
+     */
+    aliasFor(identity) {
         let alias = this.aliases.get(identity);
         if (!alias && this.aliases.size < MAX_ACCESSORY_ALIASES) {
             alias = `accessory-${randomUUID()}`;
@@ -2236,13 +2850,16 @@ export class DiagnosticConditions {
     }
     write(code, active, reason, summaryKey, actionKey, level, fields = {}, conditionKey = code, 
     /** Accessory names for the console line only — never retained, see {@link DiagnosticConditions}. */
-    names) {
-        const fingerprint = JSON.stringify({ active, reason, ...fields });
+    names, serials = []) {
+        const fingerprint = JSON.stringify({ active, reason, ...fields, serials });
         if (active) {
-            if (this.active.get(conditionKey) === fingerprint) {
+            if (this.active.get(conditionKey)?.fingerprint === fingerprint) {
                 return;
             }
-            this.active.set(conditionKey, fingerprint);
+            this.active.set(conditionKey, {
+                fingerprint,
+                condition: { code, summaryKey, actionKey, ...(serials.length === 0 ? {} : { serials: [...serials] }) },
+            });
         }
         else if (!this.active.delete(conditionKey)) {
             return;