@trillboards/edge-sdk 0.2.110 → 0.2.111

package/deploy/detector/bench/litert-twin-parity.json

@@ -334,6 +334,31 @@
       "litert_input_layout": "nhwc",
       "measured_at": "2026-08-26",
       "note": "The 22nd twin, added 2026-08-26, and the FIRST whose LiteRT input is NHWC. gh_fall_tonlong had no parity measurement at all until now: upstream ships `Violence` at slot 0 and `violence` at slot 6, normalize_class_name folds them to one name and ModelVocabulary refuses at construction, so neither format could be probed. Both were re-exported from ok.pt (sha256 1e12d89198e28d7c650ba86886c511fecd9f70b9d7f8bf985e76704690e58dd9) with the slots disambiguated by INDEX -- violence_slot0 / violence_slot6 -- which preserves upstream truth and asserts no semantics we have not measured."
+    },
+    {
+      "layout": "anchor_4_plus_nc",
+      "imgsz": 640,
+      "box_abs_max": 1.052759051322937,
+      "units": "normalized",
+      "box_scale_applied": 640.0,
+      "box_residual_px": 0.001220703125,
+      "box_residual_unscaled": 672.7130490541458,
+      "cls_residual": 1.3779020591186963e-07,
+      "pass": true,
+      "reason": "ok",
+      "onnx": "fire_smoke_weslleyskah_11n.onnx",
+      "litert": "fire_smoke_weslleyskah_11n.tflite",
+      "model_id": "fire_smoke_weslleyskah_11n",
+      "box_units": "normalized",
+      "box_scale_to_pixels": 640.0,
+      "litert_input_layout": "nhwc",
+      "litert_sha256": "1511903fece4e163348105cfddb89c657ccc43f1482cde7b090e3f1f7b003c84",
+      "litert_bytes": 9809490,
+      "onnx_sha256": "af8b648caf175edb928eeb3dc6ef73dffc55feaca4097f8133809d8d0ac16419",
+      "onnx_bytes": 10216160,
+      "measured_at": "2026-08-27",
+      "evidence": "twin parity: box residual 0.001221 px after x640, UNSCALED 672.7 px \u2014 the scale is load-bearing, not cosmetic. Class residual 1.38e-07 with no scaling at all. The ONNX half emits PIXELS (max|box| 945.30 over 1,670 real frames, ratio 1.4770) and the LiteRT half NORMALIZED (box_abs_max 1.0528), which is the pair this contract exists for.",
+      "note": "Exported from weslleyskah/fire_smoke_detection_box weights/best.pt (sha256 d2b0be21...) with ultralytics 8.3.201, imgsz 640, opset 19, nms=False. `units` and `box_abs_max` are DERIVED from the LiteRT artifact's own forward pass, not assumed from the layout. Verified twice \u2014 once under the contract at production HEAD and once under PR #13224's derived-units contract \u2014 byte-identical numbers and `pass` under both, because this twin IS normalised, the case the hardcoded x640 already handled. The row does not depend on that PR."
     }
   ]
 }

package/deploy/detector/bench/twin_parity_contract.py

@@ -74,17 +74,51 @@ def classify_layout(shape, output_names) -> str:
     raise ParityError(f"shape {shape} matches no known detector layout")
 
 
-def box_scale_for(layout: str, imgsz: int) -> float:
+def box_scale_for(layout: str, imgsz: int, box_abs_max: "float | None" = None) -> float:
     """The multiplier that puts LiteRT boxes into the ONNX pixel frame.
 
-    Ultralytics wraps a LiteRT export of a `task=detect` / `end2end=False`
-    model in `_NormalizeCoords`, which divides the four BOX channels by (W, H)
-    and leaves the class channels alone. An end2end head is `end2end=True`, so
-    the wrapper never runs and both runtimes emit pixels.
+    UNITS ARE A PROPERTY OF THE CHECKPOINT, NOT OF THE LAYOUT.
 
-    No layout gets a scale by default. A fall-through to 1.0 would be a guess
-    about an artifact nobody measured, and the wrong guess is silent.
+    This returned `imgsz` for every ANCHOR-layout twin, on the reasoning that
+    ultralytics wraps a `task=detect` / `end2end=False` LiteRT export in
+    `_NormalizeCoords`. That reasoning is disproved by a control: two models
+    exported MINUTES APART in one venv, same tool (8.3.201), same flags
+    (opset 19, imgsz 640, `nms=False`), both classified ANCHOR, measured
+
+        0.0024  (normalized)   and   2.8526  (pixels)
+
+    Same exporter, same settings, same run, opposite units. So no function of
+    (layout, imgsz) can be right in general, and the previous signature could
+    not express the truth even when it knew it.
+
+    `box_abs_max` — the largest absolute box value the LiteRT artifact actually
+    produced on a forward pass — is what settles it. Pass it and the units are
+    DERIVED via `classify_box_units`; the layout is then only a sanity check.
+
+    Omitting it is still allowed for the historical rows in
+    `litert-twin-parity.json`, which were recorded before anything measured
+    box_abs_max — those keep the old layout-derived answer, and the ANCHOR case
+    is exactly where that answer may be wrong. It is deliberately NOT the path
+    a new measurement takes: `verify_litert_twin_parity.py` always passes it,
+    and `verdict()` refuses a new ANCHOR row that arrives without one.
+
+    No layout and no measurement gets a scale by default. A fall-through to 1.0
+    would be a guess about an artifact nobody measured, and the wrong guess is
+    silent.
     """
+    if box_abs_max is not None:
+        # Deferred import: the contract module is stdlib-only so the bare
+        # `detector-service` CI lane can import it, and box_units is too.
+        from box_units import classify_box_units  # noqa: PLC0415
+
+        measured = classify_box_units(box_abs_max, imgsz)
+        if measured["scale_to_pixels"] is None:
+            raise ParityError(
+                f"box units are unmeasured for this artifact: {measured['refusal']}. "
+                "Refusing to assume a scale from the layout — that assumption is "
+                "what the 0.0024-vs-2.8526 control disproved."
+            )
+        return float(measured["scale_to_pixels"])
     if layout == ANCHOR:
         return float(imgsz)
     if layout in (END2END, DETS_LABELS):
@@ -95,14 +129,49 @@ def box_scale_for(layout: str, imgsz: int) -> float:
 def verdict(result) -> "tuple[bool, str]":
     """Does this recorded measurement pass, and if not, which assertion failed."""
     layout = result["layout"]
-    # The scale must be LOAD-BEARING on the anchor layout. If scaling and not
-    # scaling both pass, the model is not telling us which one is right and the
-    # tolerance is doing no work — that is the 640x bug passing its own check.
-    if layout == ANCHOR and result["box_residual_unscaled"] <= BOX_TOL_PX:
+    scale = result.get("box_scale_applied")
+    # THE LOAD-BEARING CHECK APPLIES TO A NORMALISED ARTIFACT, NOT TO A LAYOUT.
+    #
+    # This keyed on `layout == ANCHOR` and read an unscaled match as "the layout
+    # is misread". The control disproved the premise: an ANCHOR twin can emit
+    # PIXELS, and for that artifact an unscaled match is the CORRECT result, not
+    # a misread. Keying it on the layout refused a good artifact and is why the
+    # two models published 2026-08-27 shipped ONNX-only.
+    #
+    # Keyed on the applied scale, the assertion says what it always meant: if we
+    # scaled, the scaling has to matter. A scale of 1.0 is the measured answer
+    # for a pixel artifact and asserts nothing about normalisation.
+    if scale is not None and scale > 1.0 and result["box_residual_unscaled"] <= BOX_TOL_PX:
         return False, (
-            "the imgsz scale changed nothing — an anchor-layout twin whose raw boxes "
-            "already match its ONNX source is not normalised, so the layout is misread"
+            f"the x{scale:g} scale changed nothing — a twin whose RAW boxes already match "
+            "its ONNX source is not normalised, so the measured units are wrong"
+        )
+    # THE ROW MUST ESTABLISH ITS UNITS, BY EITHER ROUTE.
+    #
+    # `box_abs_max` settles it directly. But a row recorded before anything
+    # measured that field can still be decisive: if the scaled residual passes
+    # and the UNSCALED one misses by orders of magnitude, the artifact is
+    # demonstrably normalised — the 22 committed rows carry exactly that shape
+    # (e.g. 0.00087 px scaled against 641.03 unscaled). Demanding the field when
+    # the evidence is already present in another form would refuse good rows to
+    # satisfy a schema, so the check asks whether the units are ESTABLISHED, not
+    # whether a particular key exists.
+    #
+    # What it still refuses is the ambiguous row: no measurement, and two
+    # residuals that do not discriminate. That is a twin whose units nobody knows.
+    if result.get("box_abs_max") is None and result.get("units") is None:
+        scaled = result.get("box_residual_px")
+        unscaled = result.get("box_residual_unscaled")
+        decisive = (
+            scaled is not None and unscaled is not None
+            and scaled <= BOX_TOL_PX and unscaled > BOX_TOL_PX * 100
         )
+        if not decisive:
+            return False, (
+                "twin recorded without box_abs_max, and its scaled/unscaled residuals do "
+                "not discriminate — units were assumed from the layout, and layout does "
+                "not determine units (0.0024 vs 2.8526 control, one venv, one exporter)"
+            )
     if result["box_residual_px"] > BOX_TOL_PX:
         return False, (
             f"box residual {result['box_residual_px']:.4g} px exceeds {BOX_TOL_PX} "

package/deploy/detector/bench/venue_adjudication.py

@@ -130,7 +130,13 @@ CLASS_CONTROL = {
     "gloves": ["ppe_full", "wc_glove"], "glove": ["ppe_full", "wc_glove"], "glove_hand": ["wc_glove", "ppe_full"],
     "apron": ["wc_apron"], "Apron": ["wc_apron"], "hairnet": ["n_hairnet"], "Hairnet": ["n_hairnet"],
     "safety cone": ["n_cone"], "safety_cone": ["n_cone"],
-    "fire_extinguisher": ["n_extinguisher"], "ladder": ["n_ladder"],
+    "fire_extinguisher": ["n_extinguisher"],
+    # `ladder_openimages` (22 frames / 22 scenes, `good`) leads because it is the set that
+    # can rate the class: human-verified Open Images boxes, hand-graded on the pixels.
+    # `n_ladder` is KEPT and stays second so its POOR number remains visible in
+    # `per_control` -- the same reason `fire_generic` was kept after it was demoted. A
+    # control that was refused is evidence about the search, and deleting it hides that.
+    "ladder": ["ladder_openimages", "n_ladder"],
     "person": ["helmet", "ppe_full", "n_crowd"], "worker": ["ppe_full", "helmet", "n_crowd"],
     "human": ["helmet", "ppe_full", "n_crowd"], "head": ["helmet", "n_crowd"],
     "forklift": ["forklift"], "forklift-partial": ["forklift"], "Forklift-Partial": ["forklift"], "yoto": ["forklift"],
@@ -209,6 +215,33 @@ def assert_every_control_is_graded(pos_sets, ctlq) -> None:
             "would be treated as able to rate a class." % ", ".join(missing))
 
 
+#: The sellable-capability SHAPE contract, read by this tool and by
+#: `.github/scripts/check-sensing-capability-shape.js`. ONE definition, two consumers --
+#: the same posture as `LIVENESS_ONLY_GRADES` above and for the same reason: a tool and a
+#: guard that each carried their own idea of which capabilities a frame can answer would
+#: let a file through that the other would never emit.
+CAPABILITY_SHAPE_PATH = os.path.join(
+    os.path.dirname(os.path.abspath(__file__)),
+    *([os.pardir] * 6), ".github", "contracts", "sensing-capability-shape.json")
+
+
+def load_capability_shape(path: str = CAPABILITY_SHAPE_PATH) -> dict:
+    """`capability -> row` from the shape contract.
+
+    REFUSES rather than degrading when the contract is missing. An adjudication that could
+    not read it would silently fall back to grading every capability as if a frame answered
+    it, which is exactly the state this file is being changed to end: on 2026-08-26 five
+    capabilities came back UNINFORMATIVE under one sentence -- "no usable positive control
+    exists for this class" -- and for four of them that was a statement about a set somebody
+    sourced and refused, while for `shoplifting / theft` it was a statement about a dict that
+    never had an entry. The reader could not tell, and `cctv-detector-tier.md` s10.7 then
+    told them all five needed "an afternoon of labelling".
+    """
+    with open(path) as fh:
+        doc = json.load(fh)
+    return doc.get("capabilities") or {}
+
+
 def normalise_class(name: str) -> str:
     """`labels.py::normalize_class_name`: lower, and `-`/`_` folded to space.
 
@@ -403,6 +436,10 @@ def main() -> None:
                          "`assert_every_control_is_graded` refuses the run rather than "
                          "adjudicating on a set nobody looked at."
     )
+    ap.add_argument("--capability-shape", default=CAPABILITY_SHAPE_PATH,
+                    help="the sellable-capability SHAPE contract. Defaults to "
+                         ".github/contracts/sensing-capability-shape.json; an override "
+                         "exists for replaying an old run, not for the normal path.")
     ap.add_argument("--out", required=True)
     ap.add_argument("--markdown", help="also write the runbook table here")
     args = ap.parse_args()
@@ -420,6 +457,15 @@ def main() -> None:
         for _k, _v in json.load(open(_q)).items():
             if isinstance(_v, dict) and isinstance(_v.get("grade"), str):
                 ctlq[_k] = _v
+    shape_rows = load_capability_shape(args.capability_shape)
+    missing_shape = sorted(set(CAPS) - set(shape_rows))
+    if missing_shape:
+        raise SystemExit(
+            "capability shape undeclared for: %s. Every sellable capability must say "
+            "whether a FRAME can answer it before a firing rate on it means anything; "
+            "add a row to .github/contracts/sensing-capability-shape.json. The "
+            "`sensing-capability-shape` guard refuses the same state statically."
+            % ", ".join(missing_shape))
     index = json.load(open(os.path.join(args.out_dir, "_index.json")))
 
     meta = combo["meta"]
@@ -779,7 +825,7 @@ def main() -> None:
                 c["per_control"] = {}
                 c["gate"] = None
 
-        now = decide(cap, cands)
+        now = decide(cap, cands, shape_rows)
         was, was_model = PRIOR_VERDICT.get(cap, (None, None))
         rows.append({"capability": cap, "n_candidates": len(cands),
                      "prior_decision_taxi_negatives": was,
@@ -790,6 +836,10 @@ def main() -> None:
     json.dump({
         "schema": "trillboards.venue-adjudication/1",
         "negative_set": "venue-phase3-source-2026-08-26",
+        "capability_shape_contract": os.path.relpath(args.capability_shape, os.path.join(
+            os.path.dirname(os.path.abspath(__file__)), *([os.pardir] * 6))),
+        "inexpressible_capabilities": sorted(
+            k for k, v in shape_rows.items() if v.get("expressible_today") is False),
         "supersedes": "the 1,500-frame `production` negative set of 2026-08-25, "
                       "1,494 of which were taxi_rideshare_tv cabin interiors",
         "bar": {
@@ -892,11 +942,32 @@ def _other_controls_clause(win: dict) -> str:
     return "; the same artifact at that threshold keeps " + ", ".join(parts)
 
 
-def decide(cap: str, cands: list) -> dict:
-    """PUBLISH / NO MODEL CLEARS BAR / NOT SCREENABLE, with the reason.
+def decide(cap: str, cands: list, shape_rows: dict = None) -> dict:
+    """NOT A FRAME QUESTION / PUBLISH / NO MODEL CLEARS BAR / NOT SCREENABLE, with the reason.
+
+    Same ladder as the 2026-08-25 screen below the first rung. Only the negative set differs.
 
-    Same ladder as the 2026-08-25 screen. Only the negative set differs.
+    THE FIRST RUNG IS NEW, and it runs before candidates are considered at all, because
+    whether a frame can answer the question is not a fact about which artifacts were sourced.
+    A capability the shape contract declares inexpressible gets `NOT A FRAME QUESTION` and
+    names the substrate it is blocked on -- never `UNINFORMATIVE`, which in this file means
+    "a control was sourced for this class and its contact-sheet grade refuses it" and is a
+    corpus problem an afternoon of labelling fixes.
     """
+    row = (shape_rows or {}).get(cap) or {}
+    if row.get("expressible_today") is False:
+        return {"decision": "NOT A FRAME QUESTION",
+                "shape": row.get("shape"),
+                "frame_observable": row.get("frame_observable"),
+                "substrate_required": row.get("substrate_required"),
+                "n_candidates_screened": len(cands),
+                "why": "this product cannot express the question, so no positive control "
+                       "would make a firing rate here mean anything. Shape is `%s`; the "
+                       "per-frame observable is %s; blocked on `%s`. See "
+                       ".github/contracts/sensing-capability-shape.json for the evidence and "
+                       "docs/runbooks/sensing-model-library.md s1a for the working."
+                       % (row.get("shape"), row.get("frame_observable"),
+                          row.get("substrate_required"))}
     if not cands:
         return {"decision": "NO CANDIDATE",
                 "why": "no sourced artifact declares a class for this capability"}
@@ -909,9 +980,20 @@ def decide(cap: str, cands: list) -> dict:
     live = [c for c in cands if (c["control_rate_025"] or 0) > 0]
     if not live:
         if all(c["best_control"] is None for c in cands):
+            # NAME the sets, because "no usable positive control exists" reads as a claim
+            # about the world and is a claim about two dicts. A class with a control that was
+            # sourced, rendered on a contact sheet and REFUSED is one afternoon of labelling
+            # from a verdict; a class that was never mapped may be a class no frame answers,
+            # and `NOT A FRAME QUESTION` above is where that ends up. Both used to print here.
+            mapped = sorted({n for c in cands
+                             for n in CLASS_CONTROL_N.get(normalise_class(c["class"]), [])})
+            detail = ("the mapped control set(s) %s were all refused by their contact-sheet "
+                      "grade" % ", ".join("`%s`" % m for m in mapped)) if mapped else (
+                     "no control set is mapped to this class in CLASS_CONTROL at all")
             return {"decision": "UNINFORMATIVE",
+                    "controls_mapped": mapped,
                     "why": "no usable positive control exists for this class, so no firing "
-                           "rate here is a finding"}
+                           "rate here is a finding -- %s" % detail}
         return {"decision": "NO MODEL CLEARS BAR",
                 "why": "no candidate fires on its positive control"}
     retained = [c for c in live if (c["control_rate_at_quiet_t"] or 0) >= RECALL_RETENTION_BAR]

package/deploy/detector/bench/verify_litert_twin_parity.py

@@ -53,6 +53,7 @@ import numpy as np
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 
+from box_units import classify_box_units
 from twin_parity_contract import (  # noqa: E402  (same directory)
     ANCHOR,
     BOX_TOL_PX,
@@ -93,12 +94,19 @@ def compare(onnx_out: np.ndarray, litert_out: np.ndarray, layout: str, imgsz: in
         raise ParityError(f"shape mismatch onnx={onnx_out.shape} litert={litert_out.shape}")
     a = litert_out.astype(np.float64)
     b = onnx_out.astype(np.float64)
-    scale = box_scale_for(layout, imgsz)
     box_l, cls_l = split_channels(a, layout)
     box_o, cls_o = split_channels(b, layout)
+    # MEASURE the units off this artifact's own boxes rather than inferring them
+    # from the layout. Two anchor-layout twins exported minutes apart in one venv
+    # measured 0.0024 and 2.8526 — same tool, same flags, opposite units.
+    box_abs_max = float(np.abs(box_l).max()) if box_l.size else 0.0
+    units = classify_box_units(box_abs_max, imgsz)
+    scale = box_scale_for(layout, imgsz, box_abs_max=box_abs_max)
     return {
         "layout": layout,
         "imgsz": imgsz,
+        "box_abs_max": box_abs_max,
+        "units": units["units"],
         "box_scale_applied": scale,
         "box_residual_px": float(np.abs(box_l * scale - box_o).max()),
         "box_residual_unscaled": float(np.abs(box_l - box_o).max()),
@@ -106,23 +114,19 @@ def compare(onnx_out: np.ndarray, litert_out: np.ndarray, layout: str, imgsz: in
     }
 
 
-def verdict(result: dict) -> tuple[bool, str]:
-    # The scale must be LOAD-BEARING on the anchor layout. If scaling and not
-    # scaling both pass, the model is not telling us which one is right and the
-    # tolerance is doing no work — that is the 640x bug passing its own check.
-    if result["layout"] == ANCHOR and result["box_residual_unscaled"] <= BOX_TOL_PX:
-        return False, (
-            "the imgsz scale changed nothing — an anchor-layout twin whose raw boxes "
-            "already match its ONNX source is not normalised, so the layout is misread"
-        )
-    if result["box_residual_px"] > BOX_TOL_PX:
-        return False, (
-            f"box residual {result['box_residual_px']:.4g} px exceeds {BOX_TOL_PX} "
-            f"under layout {result['layout']} (scale x{result['box_scale_applied']})"
-        )
-    if result["cls_residual"] > CLS_TOL:
-        return False, f"class residual {result['cls_residual']:.4g} exceeds {CLS_TOL}"
-    return True, "ok"
+# `verdict` is NOT redefined here. It lives in `twin_parity_contract` and is
+# imported above.
+#
+# A second copy stood at this exact spot and SHADOWED the import. It was a
+# faithful duplicate when written, so nothing looked wrong — and then the
+# contract's copy was fixed to derive box units from the artifact while this one
+# kept keying on the layout. The verifier went on refusing the pixel-space
+# anchor twin the fix was written to admit, and the contract's own tests passed
+# the whole time, because they exercise the module that is not the one running.
+#
+# Caught by codex on the very PR that introduced the divergence. One rule, one
+# home: everything that decides pass/fail for a twin is in the contract module,
+# which is also the module the stdlib-only CI lane can import without numpy.
 
 
 def main() -> int:

package/deploy/detector/tests/test_box_units_are_measured.py

@@ -0,0 +1,137 @@
+"""Box units are a property of the CHECKPOINT, not of the layout.
+
+`box_scale_for` returned `imgsz` for every anchor-layout twin, reasoning that
+ultralytics wraps a `task=detect` / `end2end=False` LiteRT export in
+`_NormalizeCoords`. A control disproves the premise: two models exported MINUTES
+APART in one venv — same tool 8.3.201, same flags (opset 19, imgsz 640,
+nms=False), both classified anchor — measured
+
+    box residual 0.0024 under the normalized reading, and 2.8526 under the
+    pixel reading — one artifact matches its ONNX twin only when scaled, the
+    other only when not
+
+so no function of (layout, imgsz) can be right in general. (Those two figures are
+RESIDUALS, not box maxima; the maxima below are what `classify_box_units` grades,
+and a normalized artifact's boxes top out near 1.0 while a pixel artifact's
+approach imgsz.) Keying the verdict on
+the layout refused a good artifact, which is why two models published
+2026-08-27 shipped ONNX-only.
+
+Stdlib only, like the rest of this suite, so the bare `detector-service` lane can
+run it with no numpy and no artifact.
+"""
+
+import os
+import sys
+import unittest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "bench"))
+
+from twin_parity_contract import (  # noqa: E402
+    ANCHOR,
+    BOX_TOL_PX,
+    ParityError,
+    box_scale_for,
+    verdict,
+)
+
+
+def row(**kw):
+    base = {
+        "layout": ANCHOR, "imgsz": 640, "cls_residual": 1e-7,
+        "box_scale_applied": 640.0, "box_residual_px": 0.0008,
+        "box_residual_unscaled": 641.0,
+    }
+    base.update(kw)
+    return base
+
+
+class BoxUnitsAreMeasured(unittest.TestCase):
+    def test_pixel_anchor_twin_passes(self):
+        """The artifact the old rule refused. Anchor layout, PIXEL units."""
+        ok, why = verdict(row(box_abs_max=512.0, units="pixels",
+                              box_scale_applied=1.0, box_residual_unscaled=0.0009,
+                              box_residual_px=0.0009))
+        self.assertTrue(ok, why)
+
+    def test_normalised_anchor_twin_passes(self):
+        ok, why = verdict(row(box_abs_max=0.87, units="normalized"))
+        self.assertTrue(ok, why)
+
+    def test_the_640x_bug_is_still_caught(self):
+        """Scaled by 640 and the scale changed nothing — the original defect."""
+        ok, why = verdict(row(box_abs_max=0.87, units="normalized",
+                              box_residual_unscaled=0.0008))
+        self.assertFalse(ok)
+        self.assertIn("changed nothing", why)
+
+    def test_unmeasured_and_undiscriminating_is_refused(self):
+        """No measurement AND residuals that do not separate = units unknown."""
+        ok, _ = verdict({"layout": ANCHOR, "imgsz": 640, "box_scale_applied": 640.0,
+                         "box_residual_px": 0.0009,
+                         "box_residual_unscaled": BOX_TOL_PX * 2, "cls_residual": 1e-7})
+        self.assertFalse(ok)
+
+    def test_historical_rows_establish_units_without_the_field(self):
+        """The 22 committed rows predate box_abs_max and are still decisive.
+
+        Demanding the field when the evidence is present in another form would
+        refuse good rows to satisfy a schema.
+        """
+        ok, why = verdict({"layout": ANCHOR, "imgsz": 640, "box_scale_applied": 640.0,
+                           "box_residual_px": 0.00087, "box_residual_unscaled": 641.03,
+                           "cls_residual": 2e-6})
+        self.assertTrue(ok, why)
+
+    def test_measurement_overrides_the_layout(self):
+        """Same layout, same imgsz, opposite scales — decided by the artifact."""
+        self.assertEqual(box_scale_for(ANCHOR, 640, box_abs_max=0.87), 640.0)
+        self.assertEqual(box_scale_for(ANCHOR, 640, box_abs_max=512.0), 1.0)
+
+    def test_a_useless_measurement_refuses_rather_than_guessing(self):
+        with self.assertRaises(ParityError):
+            box_scale_for(ANCHOR, 640, box_abs_max=0.0)
+
+    def test_layout_route_survives_for_callers_with_no_measurement(self):
+        self.assertEqual(box_scale_for(ANCHOR, 640), 640.0)
+
+
+class TheVerifierUsesTheContractsVerdict(unittest.TestCase):
+    """One rule, one home — the verifier must not carry its own copy.
+
+    A faithful duplicate of `verdict` sat in verify_litert_twin_parity.py and
+    SHADOWED the import. It was identical when written, so nothing looked wrong;
+    then the contract's copy learned to derive box units from the artifact and
+    this one kept keying on the layout. The verifier went on refusing the
+    pixel-space anchor twin the fix existed to admit — and every contract test
+    passed throughout, because they exercise the module that is not the one
+    running. Caught by review on the PR that introduced the divergence.
+
+    Source-level, deliberately: importing the verifier needs numpy, and this
+    suite runs on the bare `detector-service` lane where numpy is absent.
+    """
+
+    def test_verifier_defines_no_verdict_of_its_own(self):
+        path = os.path.join(
+            os.path.dirname(__file__), "..", "bench", "verify_litert_twin_parity.py"
+        )
+        with open(path, encoding="utf-8") as fh:
+            src = fh.read()
+        self.assertNotIn(
+            "\ndef verdict(", src,
+            "verify_litert_twin_parity.py defines its own verdict(), which shadows the "
+            "imported contract copy — the two then drift silently and the tests exercise "
+            "the wrong one",
+        )
+
+    def test_verifier_imports_the_contract_verdict(self):
+        path = os.path.join(
+            os.path.dirname(__file__), "..", "bench", "verify_litert_twin_parity.py"
+        )
+        with open(path, encoding="utf-8") as fh:
+            src = fh.read()
+        self.assertIn("verdict", src.split("from twin_parity_contract import (")[1][:400])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/deploy/detector/trillboards_detector/labels.py

@@ -574,7 +574,29 @@ GH_PPE_VINAYAK_L = ModelVocabulary(
     ),
 )
 
-BUILTIN_VOCABULARIES: "tuple[ModelVocabulary, ...]" = (RFDETR_MEDIUM, GH_FORKLIFT_COMBINE, PPE_VYRA_14CLS_V8M, PPE_CONSTRUCTION_17CLS_V8N, PPE_KILLUMINATI_19CLS_V8S, FALL_1CLS_11X, GH_PPE_VINAYAK_L,)
+#: Fire and Smoke Detector — published 2026-08-27 by
+#: scripts/sensing/publish-sensing-model.js. The class list is the artifact's own
+#: (graph metadata key 'names'); the footprint is MEASURED, 123.7031 MiB after a
+#: probe inference via rusage-maxrss, not an estimate from the file size.
+#: Coordinate space MEASURED, not assumed: max|box channel| = 945.3029 over 1670 real frames; / imgsz 640 = 1.4770. pixels at >= 0.2, normalized at <= 0.02, refused in between.
+FIRE_SMOKE_WESLLEYSKAH_11N_CLASS_NAMES: "MappingProxyType[int, str]" = MappingProxyType({
+    0: "fire",
+    1: "smoke",
+})
+
+FIRE_SMOKE_WESLLEYSKAH_11N = ModelVocabulary(
+    model_name="fire_smoke_weslleyskah_11n",
+    slot_names=FIRE_SMOKE_WESLLEYSKAH_11N_CLASS_NAMES,
+    logit_slots=2,
+    approx_ram_bytes=129712102,
+    onnx_variant=VariantContract(
+        output_layout="anchor_4_plus_nc",
+        box_units="pixels",
+        box_scale_to_pixels=1.0,
+    ),
+)
+
+BUILTIN_VOCABULARIES: "tuple[ModelVocabulary, ...]" = (RFDETR_MEDIUM, GH_FORKLIFT_COMBINE, PPE_VYRA_14CLS_V8M, PPE_CONSTRUCTION_17CLS_V8N, PPE_KILLUMINATI_19CLS_V8S, FALL_1CLS_11X, GH_PPE_VINAYAK_L, FIRE_SMOKE_WESLLEYSKAH_11N,)
 
 
 class ClassIndex:
@@ -668,6 +690,7 @@ class ClassIndex:
 
 
 __all__ = [
+    "FIRE_SMOKE_WESLLEYSKAH_11N",
     "GH_PPE_VINAYAK_L",
     "FALL_1CLS_11X",
     "PPE_KILLUMINATI_19CLS_V8S",

package/deploy/macos/TrillboardsSetupApp.m

@@ -45,12 +45,16 @@ static BOOL acquireSetupInstanceLock(void) {
 @property(nonatomic, strong) NSTextField *metric;
 @property(nonatomic, strong) NSProgressIndicator *progress;
 @property(nonatomic, strong) NSButton *actionButton;
+@property(nonatomic, strong) NSButton *closeButton;
+@property(nonatomic, strong) NSButton *updateButton;
+@property(nonatomic, strong) NSTextField *updateStatus;
 @property(nonatomic, strong) NSArray<NSTextField *> *stepLabels;
 @property(nonatomic, strong) NSTimer *timer;
 @property(nonatomic, assign) pid_t pairProcessIdentifier;
 @property(nonatomic, strong) dispatch_source_t pairProcessSource;
 @property(nonatomic, copy) NSString *lastStage;
 @property(nonatomic, copy) NSString *portalURL;
+@property(nonatomic, copy) NSString *requiredUpdateURL;
 @property(nonatomic, assign) BOOL setupStarted;
 @property(nonatomic, assign) BOOL terminating;
 @end
@@ -88,6 +92,8 @@ static BOOL acquireSetupInstanceLock(void) {
                                                repeats:YES];
   [self.window makeKeyAndOrderFront:nil];
   [NSApp activateIgnoringOtherApps:YES];
+  dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(0.6 * NSEC_PER_SEC)),
+                 dispatch_get_main_queue(), ^{ [self checkForUpdates:NO]; });
 }
 
 - (void)activateSetupWindow:(NSNotification *)notification {
@@ -279,6 +285,21 @@ static BOOL acquireSetupInstanceLock(void) {
   self.progress.maxValue = 100;
   [root addSubview:self.progress];
 
+  self.updateButton = [[NSButton alloc] initWithFrame:NSMakeRect(236, 101, 145, 30)];
+  self.updateButton.title = @"Check for updates";
+  self.updateButton.bezelStyle = NSBezelStyleRounded;
+  self.updateButton.target = self;
+  self.updateButton.action = @selector(checkForUpdatesPressed);
+  [root addSubview:self.updateButton];
+
+  NSString *installedVersion = [NSBundle.mainBundle objectForInfoDictionaryKey:@"CFBundleShortVersionString"] ?: @"0.0.0";
+  self.updateStatus = [self label:[NSString stringWithFormat:@"Connector v%@", installedVersion]
+                              size:12
+                            weight:NSFontWeightRegular
+                             frame:NSMakeRect(393, 104, 308, 24)];
+  self.updateStatus.textColor = NSColor.secondaryLabelColor;
+  [root addSubview:self.updateStatus];
+
   NSTextField *privacy = [self label:@"Camera credentials stay on this computer. Cloud inference is off by default."
                                       size:12
                                     weight:NSFontWeightRegular
@@ -292,6 +313,14 @@ static BOOL acquireSetupInstanceLock(void) {
   self.actionButton.target = self;
   self.actionButton.action = @selector(actionPressed);
   [root addSubview:self.actionButton];
+
+  self.closeButton = [[NSButton alloc] initWithFrame:NSMakeRect(450, 36, 100, 40)];
+  self.closeButton.title = @"Close";
+  self.closeButton.bezelStyle = NSBezelStyleRounded;
+  self.closeButton.target = self;
+  self.closeButton.action = @selector(closePressed);
+  self.closeButton.hidden = YES;
+  [root addSubview:self.closeButton];
 }
 
 - (void)showWelcome {
@@ -304,6 +333,7 @@ static BOOL acquireSetupInstanceLock(void) {
   self.progress.doubleValue = 0;
   self.actionButton.title = @"Start setup";
   self.actionButton.enabled = YES;
+  self.closeButton.hidden = YES;
   [self updateSteps:0];
 }
 
@@ -317,9 +347,109 @@ static BOOL acquireSetupInstanceLock(void) {
   self.progress.doubleValue = 0;
   self.actionButton.title = @"Try again";
   self.actionButton.enabled = YES;
+  self.closeButton.hidden = YES;
+}
+
+- (void)closePressed {
+  [self.window close];
+}
+
+- (void)checkForUpdatesPressed {
+  [self checkForUpdates:YES];
+}
+
+- (void)checkForUpdates:(BOOL)manual {
+  if (!self.updateButton.enabled) return;
+  self.updateButton.enabled = NO;
+  self.updateButton.title = @"Checking...";
+  self.updateStatus.stringValue = @"Checking for connector updates...";
+
+  NSURL *url = [NSURL URLWithString:@"https://screen.trillboards.com/connector/trillboards-connector-macos.version.json"];
+  NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:url
+                                                         cachePolicy:NSURLRequestReloadIgnoringLocalCacheData
+                                                     timeoutInterval:15.0];
+  [request setValue:@"no-cache" forHTTPHeaderField:@"Cache-Control"];
+  NSURLSessionDataTask *task = [NSURLSession.sharedSession dataTaskWithRequest:request
+                                                           completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
+    (void)response;
+    dispatch_async(dispatch_get_main_queue(), ^{
+      self.updateButton.enabled = YES;
+      self.updateButton.title = @"Check for updates";
+      NSDictionary *manifest = data && !error
+          ? [NSJSONSerialization JSONObjectWithData:data options:0 error:nil]
+          : nil;
+      NSString *availableText = [manifest[@"connectorVersion"] isKindOfClass:NSString.class]
+          ? manifest[@"connectorVersion"] : nil;
+      NSString *downloadURL = [manifest[@"downloadUrl"] isKindOfClass:NSString.class]
+          ? manifest[@"downloadUrl"] : nil;
+      NSString *installedText = [NSBundle.mainBundle objectForInfoDictionaryKey:@"CFBundleShortVersionString"] ?: @"0.0.0";
+      if (!availableText || !downloadURL) {
+        self.updateStatus.stringValue = @"Could not check for updates";
+        if (manual) {
+          NSAlert *alert = [[NSAlert alloc] init];
+          alert.messageText = @"Update check unavailable";
+          alert.informativeText = @"The update service could not be reached. Your connector can keep running; try again later.";
+          [alert runModal];
+        }
+        return;
+      }
+
+      NSComparisonResult order = [availableText compare:installedText options:NSNumericSearch];
+      if (order != NSOrderedDescending) {
+        self.updateStatus.stringValue = [NSString stringWithFormat:@"Connector v%@ is up to date", installedText];
+        if (manual) {
+          NSAlert *alert = [[NSAlert alloc] init];
+          alert.messageText = @"No updates available";
+          alert.informativeText = [NSString stringWithFormat:@"Sense Anything Connector v%@ is up to date.", installedText];
+          [alert runModal];
+        }
+        return;
+      }
+
+      NSInteger availableMajor = [availableText componentsSeparatedByString:@"."].firstObject.integerValue;
+      NSInteger installedMajor = [installedText componentsSeparatedByString:@"."].firstObject.integerValue;
+      if (availableMajor > installedMajor) {
+        if (self.setupStarted) {
+          self.setupStarted = NO;
+          [self stopPairProcess];
+        }
+        self.requiredUpdateURL = downloadURL;
+        self.lastStage = @"update_required";
+        self.headline.stringValue = @"Update required before setup can continue";
+        self.detail.stringValue = @"Install the latest Sense Anything Connector, then reopen it to finish camera setup.";
+        self.statusValue.stringValue = [NSString stringWithFormat:@"Version %@", availableText];
+        self.metric.stringValue = @"Camera setup is paused safely until the update is installed.";
+        self.progress.doubleValue = 0;
+        self.closeButton.hidden = YES;
+        self.updateStatus.stringValue = [NSString stringWithFormat:@"Required update v%@ available", availableText];
+        self.actionButton.title = @"Install required update";
+        self.actionButton.enabled = YES;
+        NSAlert *alert = [[NSAlert alloc] init];
+        alert.messageText = @"Required connector update";
+        alert.informativeText = [NSString stringWithFormat:@"Sense Anything Connector v%@ is a required major update. Install it before continuing.", availableText];
+        [alert addButtonWithTitle:@"Install Required Update"];
+        [alert runModal];
+        [self openURL:downloadURL];
+        return;
+      }
+
+      self.updateStatus.stringValue = [NSString stringWithFormat:@"Optional update v%@ available", availableText];
+      NSAlert *alert = [[NSAlert alloc] init];
+      alert.messageText = @"Optional connector update";
+      alert.informativeText = [NSString stringWithFormat:@"Sense Anything Connector v%@ is available. You can install it now or keep this version.", availableText];
+      [alert addButtonWithTitle:@"Install Update"];
+      [alert addButtonWithTitle:@"Not Now"];
+      if ([alert runModal] == NSAlertFirstButtonReturn) [self openURL:downloadURL];
+    });
+  }];
+  [task resume];
 }
 
 - (void)actionPressed {
+  if (self.requiredUpdateURL) {
+    [self openURL:self.requiredUpdateURL];
+    return;
+  }
   if ([self.lastStage isEqualToString:@"waiting_for_account"] ||
       [self.lastStage isEqualToString:@"account_attention"]) {
     [self openURL:self.portalURL];
@@ -435,6 +565,7 @@ static BOOL acquireSetupInstanceLock(void) {
 
   self.progress.doubleValue = [self progressForStage:stage];
   [self updateSteps:[self stepForStage:stage]];
+  self.closeButton.hidden = ![stage isEqualToString:@"ready"];
   if ([stage isEqualToString:@"waiting_for_account"]) {
     self.actionButton.title = @"Open Sense Anything";
     self.actionButton.enabled = YES;
@@ -454,6 +585,10 @@ static BOOL acquireSetupInstanceLock(void) {
     self.actionButton.title = @"Working...";
     self.actionButton.enabled = NO;
   }
+  if (self.requiredUpdateURL) {
+    self.actionButton.title = @"Install required update";
+    self.actionButton.enabled = YES;
+  }
 }
 
 - (NSInteger)stepForStage:(NSString *)stage {

package/deploy/windows/trillboards-setup.ps1

@@ -8,6 +8,7 @@ Set-StrictMode -Version Latest
 
 Add-Type -AssemblyName System.Windows.Forms
 Add-Type -AssemblyName System.Drawing
+Add-Type -AssemblyName System.Net.Http
 [System.Windows.Forms.Application]::EnableVisualStyles()
 
 $BinDir = $PSScriptRoot
@@ -22,6 +23,14 @@ $script:SetupStarted = $false
 $script:PortalUrl = 'https://app.senseanything.com/sense/cameras'
 $script:PairProcess = $null
 $script:SetupMutex = $null
+$script:UpdateTask = $null
+$script:UpdateClient = $null
+$script:UpdateWasManual = $false
+$script:RequiredUpdateUrl = $null
+$UpdateManifestUrl = 'https://screen.trillboards.com/connector/trillboards-connector-windows.version.json'
+$InstalledVersion = try {
+  [string](Get-ItemPropertyValue -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\TrillboardsEdge' -Name DisplayVersion -ErrorAction Stop)
+} catch { '0.0.0' }
 $StepNames = @('Welcome', 'Account', 'Recorder', 'Cameras', 'Local AI', 'Ready')
 $StepLabels = New-Object System.Collections.Generic.List[System.Windows.Forms.Label]
 
@@ -168,6 +177,19 @@ $Progress.Minimum = 0
 $Progress.Maximum = 100
 $Form.Controls.Add($Progress)
 
+$UpdateAction = New-Object System.Windows.Forms.Button
+$UpdateAction.Text = 'Check for updates'
+$UpdateAction.Font = New-Object System.Drawing.Font('Segoe UI', 8.5)
+$UpdateAction.Location = New-Object System.Drawing.Point(236, 414)
+$UpdateAction.Size = New-Object System.Drawing.Size(145, 30)
+$Form.Controls.Add($UpdateAction)
+
+$UpdateStatus = New-Label -Text "Connector v$InstalledVersion" -Size 8.5
+$UpdateStatus.ForeColor = [System.Drawing.Color]::FromArgb(96, 113, 122)
+$UpdateStatus.Location = New-Object System.Drawing.Point(393, 416)
+$UpdateStatus.Size = New-Object System.Drawing.Size(308, 26)
+$Form.Controls.Add($UpdateStatus)
+
 $Privacy = New-Label -Text 'Camera credentials stay on this computer. Cloud inference is off by default.' -Size 8.5
 $Privacy.ForeColor = [System.Drawing.Color]::FromArgb(96, 113, 122)
 $Privacy.Location = New-Object System.Drawing.Point(236, 468)
@@ -185,6 +207,14 @@ $Action.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
 $Action.FlatAppearance.BorderSize = 0
 $Form.Controls.Add($Action)
 
+$CloseAction = New-Object System.Windows.Forms.Button
+$CloseAction.Text = 'Close'
+$CloseAction.Font = New-Object System.Drawing.Font('Segoe UI', 10)
+$CloseAction.Location = New-Object System.Drawing.Point(450, 466)
+$CloseAction.Size = New-Object System.Drawing.Size(100, 42)
+$CloseAction.Visible = $false
+$Form.Controls.Add($CloseAction)
+
 function Show-Welcome {
   $script:LastStage = 'welcome'
   $Headline.Text = 'Set up this computer for CCTV'
@@ -194,6 +224,7 @@ function Show-Welcome {
   $Progress.Value = 0
   $Action.Text = 'Start setup'
   $Action.Enabled = $true
+  $CloseAction.Visible = $false
   Update-Steps 0
 }
 
@@ -206,6 +237,123 @@ function Show-LocalError([string]$Title, [string]$Message) {
   $Progress.Value = 0
   $Action.Text = 'Try again'
   $Action.Enabled = $true
+  $CloseAction.Visible = $false
+}
+
+function Convert-ToVersion([string]$Value) {
+  try { return [version](($Value -split '[-+]', 2)[0]) } catch { return $null }
+}
+
+function Open-ConnectorUpdate([string]$Url) {
+  if ([string]::IsNullOrWhiteSpace($Url)) { return }
+  try { Start-Process $Url } catch {
+    [System.Windows.Forms.MessageBox]::Show(
+      "Open this address to update:`r`n$Url",
+      'Sense Anything Connector update',
+      [System.Windows.Forms.MessageBoxButtons]::OK,
+      [System.Windows.Forms.MessageBoxIcon]::Information
+    ) | Out-Null
+  }
+}
+
+function Start-UpdateCheck([bool]$Manual = $true) {
+  if ($null -ne $script:UpdateTask) { return }
+  $script:UpdateWasManual = $Manual
+  $UpdateAction.Enabled = $false
+  $UpdateAction.Text = 'Checking...'
+  $UpdateStatus.Text = 'Checking for connector updates...'
+  try {
+    $script:UpdateClient = New-Object System.Net.Http.HttpClient
+    $script:UpdateClient.Timeout = [TimeSpan]::FromSeconds(15)
+    $script:UpdateClient.DefaultRequestHeaders.CacheControl = New-Object System.Net.Http.Headers.CacheControlHeaderValue
+    $script:UpdateClient.DefaultRequestHeaders.CacheControl.NoCache = $true
+    $script:UpdateTask = $script:UpdateClient.GetStringAsync($UpdateManifestUrl)
+  } catch {
+    $script:UpdateTask = $null
+    if ($null -ne $script:UpdateClient) { $script:UpdateClient.Dispose(); $script:UpdateClient = $null }
+    $UpdateAction.Enabled = $true
+    $UpdateAction.Text = 'Check for updates'
+    $UpdateStatus.Text = 'Update check unavailable'
+  }
+}
+
+function Complete-UpdateCheck {
+  $task = $script:UpdateTask
+  if ($null -eq $task -or -not $task.IsCompleted) { return }
+  $script:UpdateTask = $null
+  $manual = $script:UpdateWasManual
+  $UpdateAction.Enabled = $true
+  $UpdateAction.Text = 'Check for updates'
+  try {
+    $manifest = ($task.GetAwaiter().GetResult() | ConvertFrom-Json)
+    $availableText = [string]$manifest.connectorVersion
+    $downloadUrl = [string]$manifest.downloadUrl
+    $available = Convert-ToVersion $availableText
+    $installed = Convert-ToVersion $InstalledVersion
+    if ($null -eq $available -or $null -eq $installed -or [string]::IsNullOrWhiteSpace($downloadUrl)) {
+      throw 'The update manifest is incomplete.'
+    }
+    if ($available -le $installed) {
+      $UpdateStatus.Text = "Connector v$InstalledVersion is up to date"
+      if ($manual) {
+        [System.Windows.Forms.MessageBox]::Show(
+          "Sense Anything Connector v$InstalledVersion is up to date.",
+          'No updates available',
+          [System.Windows.Forms.MessageBoxButtons]::OK,
+          [System.Windows.Forms.MessageBoxIcon]::Information
+        ) | Out-Null
+      }
+      return
+    }
+
+    if ($available.Major -gt $installed.Major) {
+      if ($script:SetupStarted) {
+        $script:SetupStarted = $false
+        Stop-SetupProcess
+        Resume-BackgroundSensing
+      }
+      $script:RequiredUpdateUrl = $downloadUrl
+      $script:LastStage = 'update_required'
+      $Headline.Text = 'Update required before setup can continue'
+      $Detail.Text = 'Install the latest Sense Anything Connector, then reopen it to finish camera setup.'
+      $StatusValue.Text = "Version $availableText"
+      $Metric.Text = 'Any existing camera service has been restored while setup is paused.'
+      $Progress.Value = 0
+      $CloseAction.Visible = $false
+      $UpdateStatus.Text = "Required update v$availableText available"
+      $Action.Text = 'Install required update'
+      $Action.Enabled = $true
+      [System.Windows.Forms.MessageBox]::Show(
+        "Sense Anything Connector v$availableText is a required major update. Install it before continuing.",
+        'Required connector update',
+        [System.Windows.Forms.MessageBoxButtons]::OK,
+        [System.Windows.Forms.MessageBoxIcon]::Warning
+      ) | Out-Null
+      Open-ConnectorUpdate $downloadUrl
+      return
+    }
+
+    $UpdateStatus.Text = "Optional update v$availableText available"
+    $choice = [System.Windows.Forms.MessageBox]::Show(
+      "Sense Anything Connector v$availableText is available. Install it now?`r`n`r`nChoose No to keep this version.",
+      'Optional connector update',
+      [System.Windows.Forms.MessageBoxButtons]::YesNo,
+      [System.Windows.Forms.MessageBoxIcon]::Information
+    )
+    if ($choice -eq [System.Windows.Forms.DialogResult]::Yes) { Open-ConnectorUpdate $downloadUrl }
+  } catch {
+    $UpdateStatus.Text = 'Could not check for updates'
+    if ($manual) {
+      [System.Windows.Forms.MessageBox]::Show(
+        'The update service could not be reached. Your connector can keep running; try again later.',
+        'Update check unavailable',
+        [System.Windows.Forms.MessageBoxButtons]::OK,
+        [System.Windows.Forms.MessageBoxIcon]::Information
+      ) | Out-Null
+    }
+  } finally {
+    if ($null -ne $script:UpdateClient) { $script:UpdateClient.Dispose(); $script:UpdateClient = $null }
+  }
 }
 
 function Start-Setup {
@@ -378,6 +526,7 @@ function Render-State($State) {
 
   $Progress.Value = [Math]::Max(0, [Math]::Min(100, (Get-ProgressValue $stage $State)))
   Update-Steps (Get-StepIndex $stage) ($stage -eq 'ready')
+  $CloseAction.Visible = $stage -eq 'ready'
   switch ($stage) {
     'waiting_for_account' { $Action.Text = 'Open Sense Anything'; $Action.Enabled = $true }
     'account_attention' { $Action.Text = 'Switch account'; $Action.Enabled = $true }
@@ -386,9 +535,17 @@ function Render-State($State) {
     'error' { $Action.Text = 'Try again'; $Action.Enabled = $true }
     default { $Action.Text = 'Working...'; $Action.Enabled = $false }
   }
+  if ($null -ne $script:RequiredUpdateUrl) {
+    $Action.Text = 'Install required update'
+    $Action.Enabled = $true
+  }
 }
 
 $Action.Add_Click({
+  if ($null -ne $script:RequiredUpdateUrl) {
+    Open-ConnectorUpdate $script:RequiredUpdateUrl
+    return
+  }
   switch ($script:LastStage) {
     'waiting_for_account' { Start-Process $script:PortalUrl }
     'account_attention' { Start-Process $script:PortalUrl }
@@ -402,6 +559,9 @@ $Action.Add_Click({
   }
 })
 
+$UpdateAction.Add_Click({ Start-UpdateCheck $true })
+$CloseAction.Add_Click({ $Form.Close() })
+
 $Form.Add_FormClosing({
   Stop-SetupProcess
   Resume-BackgroundSensing
@@ -410,11 +570,16 @@ $Form.Add_FormClosing({
     $script:SetupMutex.Dispose()
     $script:SetupMutex = $null
   }
+  if ($null -ne $script:UpdateClient) {
+    $script:UpdateClient.Dispose()
+    $script:UpdateClient = $null
+  }
 })
 
 $Timer = New-Object System.Windows.Forms.Timer
 $Timer.Interval = 500
 $Timer.Add_Tick({
+  Complete-UpdateCheck
   if ($script:SetupStarted -and (Test-Path $StatePath)) {
     try {
       $state = Get-Content -Raw -Path $StatePath | ConvertFrom-Json
@@ -477,5 +642,6 @@ if (-not $createdNew) {
 }
 
 $Timer.Start()
+Start-UpdateCheck $false
 [void]$Form.ShowDialog()
 $Timer.Stop()

package/dist/EdgeAgent.js

@@ -44,7 +44,7 @@ const edge_ads_1 = require("@trillboards/edge-ads");
 const CommandRouter_1 = require("./CommandRouter");
 const config_1 = require("./config");
 const dataDir_1 = require("./dataDir");
-const SDK_VERSION = '0.2.110';
+const SDK_VERSION = '0.2.111';
 class EdgeAgent extends events_1.EventEmitter {
     constructor(config, deps) {
         super();

package/dist/diagnose.d.ts

@@ -31,7 +31,7 @@ export interface DiagnosticReport {
         skipped: number;
     };
 }
-declare const SDK_VERSION = "0.2.110";
+declare const SDK_VERSION = "0.2.111";
 declare function checkNodeVersion(): CheckResult;
 declare function checkPlatform(): CheckResult;
 declare function checkMemory(): CheckResult;

package/dist/diagnose.js

@@ -63,7 +63,7 @@ const localNetworkAccess_1 = require("./localNetworkAccess");
 // ---------------------------------------------------------------------------
 // SDK version — mirrors package.json; kept in sync by CI
 // ---------------------------------------------------------------------------
-const SDK_VERSION = '0.2.110';
+const SDK_VERSION = '0.2.111';
 exports._SDK_VERSION = SDK_VERSION;
 // ---------------------------------------------------------------------------
 // ANSI helpers (no external deps)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trillboards/edge-sdk",
-  "version": "0.2.110",
+  "version": "0.2.111",
   "description": "Composable cross-platform Edge AI SDK for audience sensing on DOOH/CTV devices",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",