@trillboards/edge-sdk 0.2.138 → 0.2.150

package/deploy/setup-guidance.json

@@ -0,0 +1,112 @@
+{
+  "welcome": {
+    "title": "Start on the computer that will stay here.",
+    "body": "Keep this computer powered and connected to the camera network. Have your recorder login ready.",
+    "detail": "A recorder is the box your cameras connect to, often called an NVR or DVR. Internet access alone does not mean this computer can reach it."
+  },
+  "starting": {
+    "title": "Start on the computer that will stay here.",
+    "body": "Keep this computer powered and connected to the camera network. Have your recorder login ready.",
+    "detail": "A recorder is the box your cameras connect to, often called an NVR or DVR. Internet access alone does not mean this computer can reach it."
+  },
+  "onboarding_account": {
+    "title": "Choose email or Google.",
+    "body": "Use your Sense Anything email and password, or continue with Google. New here? Create an account with either option.",
+    "detail": "Your Sense Anything login connects your account. Later, camera setup asks for the separate login for your recorder or camera."
+  },
+  "onboarding_google": {
+    "title": "Finish signing in in the setup browser tab.",
+    "body": "Keep the setup tab open, complete Google sign-in, then return to this window. Your setup stays here.",
+    "detail": "Choose the intended Google account. If the handoff does not complete, use the recovery action in this window instead of reinstalling."
+  },
+  "onboarding_choose_account": {
+    "title": "Check which account will own the cameras.",
+    "body": "Choose the account for this location before continuing. Use an account you are authorized to manage.",
+    "detail": "If you manage several businesses, check the account name. Follow any account-access notice above before proceeding."
+  },
+  "account_attention": {
+    "title": "Check which account will own the cameras.",
+    "body": "Choose the account for this location before continuing. Use an account you are authorized to manage.",
+    "detail": "If you manage several businesses, check the account name. Follow any account-access notice above before proceeding."
+  },
+  "onboarding_terms": {
+    "title": "Review the agreements before continuing.",
+    "body": "Open the agreement links and review the current terms. Accept only when you are authorized to do so.",
+    "detail": "Guiding tips are optional. Turning them off never accepts an agreement or changes a required account step."
+  },
+  "onboarding_plan": {
+    "title": "Choose the plan for this account.",
+    "body": "Check the plan and billing interval before continuing to secure Stripe checkout.",
+    "detail": "Existing subscription access is checked automatically. If payment is needed, complete checkout in the setup browser and return here."
+  },
+  "onboarding_checkout": {
+    "title": "Complete checkout in your browser.",
+    "body": "Keep the setup browser tab open. The Connector continues after subscription access is confirmed.",
+    "detail": "If you cancel checkout, account setup is preserved. Use Back to plans to retry. Avoid a second purchase while payment is still being confirmed."
+  },
+  "onboarding_install": {
+    "title": "Continue in camera setup.",
+    "body": "Keep the Connector running while you connect the recorder and check its channels in the camera setup window.",
+    "detail": "If camera setup asks for a code, use the current code shown in this Connector. An old code belongs to an earlier session."
+  },
+  "waiting_for_account": {
+    "title": "Continue in camera setup.",
+    "body": "Keep the Connector running while you connect the recorder and check its channels in the camera setup window.",
+    "detail": "If camera setup asks for a code, use the current code shown in this Connector. An old code belongs to an earlier session."
+  },
+  "account_connected": {
+    "title": "Continue in camera setup.",
+    "body": "Keep the Connector running while you connect the recorder and check its channels in the camera setup window.",
+    "detail": "If camera setup asks for a code, use the current code shown in this Connector. An old code belongs to an earlier session."
+  },
+  "discovering": {
+    "title": "Keep the recorder within reach.",
+    "body": "The Connector searches the local network. Select your recorder in camera setup and enter that device\u2019s login.",
+    "detail": "If nothing appears, check power and network connections or enter the recorder address manually. Guest Wi-Fi and isolated camera ports can prevent discovery."
+  },
+  "devices_found": {
+    "title": "Keep the recorder within reach.",
+    "body": "The Connector searches the local network. Select your recorder in camera setup and enter that device\u2019s login.",
+    "detail": "If nothing appears, check power and network connections or enter the recorder address manually. Guest Wi-Fi and isolated camera ports can prevent discovery."
+  },
+  "validating": {
+    "title": "Check each camera before adding it.",
+    "body": "Keep setup open while every channel is checked. Only validated feeds can be selected and added.",
+    "detail": "Empty, black or unreadable channels are left out. Check a missing camera\u2019s power, cable, permissions and stream settings, then retry in camera setup."
+  },
+  "cameras_created": {
+    "title": "Keep this computer awake while we finish.",
+    "body": "Camera pairing is saved. Let the local model and sensing service checks finish before closing setup.",
+    "detail": "The local model runs on this computer. If local AI needs attention, retry that step; you do not need to repeat camera pairing."
+  },
+  "local_ai": {
+    "title": "Keep this computer awake while we finish.",
+    "body": "Camera pairing is saved. Let the local model and sensing service checks finish before closing setup.",
+    "detail": "The local model runs on this computer. If local AI needs attention, retry that step; you do not need to repeat camera pairing."
+  },
+  "starting_service": {
+    "title": "Keep this computer awake while we finish.",
+    "body": "Camera pairing is saved. Let the local model and sensing service checks finish before closing setup.",
+    "detail": "The local model runs on this computer. If local AI needs attention, retry that step; you do not need to repeat camera pairing."
+  },
+  "local_ai_error": {
+    "title": "Retry local AI without pairing again.",
+    "body": "Your camera pairing is saved. Use Retry local AI to prepare the local model and service again.",
+    "detail": "Keep the computer powered and check its available disk space. Follow the error above. If the retry fails, contact support with the setup error, without camera credentials."
+  },
+  "ready": {
+    "title": "Leave this computer powered and connected.",
+    "body": "Sense Anything starts automatically when this computer logs in. Use View cameras to check sensing status.",
+    "detail": "Sleep, power loss or a disconnected camera network can interrupt sensing. Reopen Sense Anything Connector to resume or repair setup."
+  },
+  "error": {
+    "title": "Follow the setup notice above.",
+    "body": "Use the recovery action shown in this window. Keep your account and recorder credentials private.",
+    "detail": "If the problem continues, contact support with the visible error. Do not share passwords or camera stream links in screenshots."
+  },
+  "update_required": {
+    "title": "Follow the setup notice above.",
+    "body": "Use the recovery action shown in this window. Keep your account and recorder credentials private.",
+    "detail": "If the problem continues, contact support with the visible error. Do not share passwords or camera stream links in screenshots."
+  }
+}

package/deploy/systemd/setup-detector.sh

@@ -93,7 +93,7 @@ SOURCE="$(find_detector_source)" || { log "ERROR: detector package source not fo
 # re-downloads the pinned ~250 MB onnxruntime wheel on a shop PC every time, for
 # nothing — an exact pin cannot resolve to different bytes.
 log "installing/repairing trillboards-detector from $SOURCE with uv-managed Python $DETECTOR_PYTHON"
-if ! "$UV" tool install --python "$DETECTOR_PYTHON" --managed-python --force --refresh-package trillboards-detector "$SOURCE" >>"$LOG" 2>&1; then
+if ! "$UV" tool install --python "$DETECTOR_PYTHON" --managed-python --force --refresh-package trillboards-detector "${SOURCE}[cpu]" >>"$LOG" 2>&1; then
   log "ERROR: trillboards-detector install failed; the cascade stays off"
   exit 0
 fi
@@ -126,7 +126,7 @@ elif [ "$HAVE_VERSION" != "$WANT_VERSION" ]; then
   # asking it again the same way is not a repair.
   log "WARN: the installed detector reports '$HAVE_VERSION' but the staged package is '$WANT_VERSION' - reinstalling from scratch"
   "$UV" tool uninstall trillboards-detector >>"$LOG" 2>&1 || true
-  "$UV" tool install --python "$DETECTOR_PYTHON" --managed-python --force --refresh-package trillboards-detector "$SOURCE" >>"$LOG" 2>&1 || true
+  "$UV" tool install --python "$DETECTOR_PYTHON" --managed-python --force --refresh-package trillboards-detector "${SOURCE}[cpu]" >>"$LOG" 2>&1 || true
   DETECTOR="$LOCAL_BIN/trillboards-detector"
   [ -x "$DETECTOR" ] || DETECTOR="$(command -v trillboards-detector || echo "$DETECTOR")"
   HAVE_VERSION="$(installed_detector_version)"

package/deploy/systemd/setup-litertlm.sh

@@ -37,6 +37,9 @@ LOG_DIR="${TRILLBOARDS_LOG_DIR:-/var/log/trillboards}"
 LOCAL_BIN="$USER_HOME/.local/bin"
 MODEL_ID="gemma-4-E2B-it.litertlm"
 HF_REPO="litert-community/gemma-4-E2B-it-litert-lm"
+MODEL_REVISION="84b6978eff6e4eea02825bc2ee4ea48579f13109"
+APPROVED_MODEL_SHA256="ab7838cdfc8f77e54d8ca45eadceb20452d9f01e4bfade03e5dce27911b27e42"
+MODEL_URL="https://huggingface.co/$HF_REPO/resolve/$MODEL_REVISION/$MODEL_ID"
 SERVE_PORT="9379"
 SERVE_UNIT="trillboards-litertlm"
 LITERT_PYTHON="${LITERT_LM_PYTHON:-3.12}"
@@ -253,16 +256,29 @@ install_litertlm_shim() {
 # Deliberately NOT a /v1/models check: that answers 200 without ever building an
 # engine, so it cannot tell a working GPU encoder from one that fails on first
 # use.
-verify_litertlm_vision() {
-  _body="$LITERT_DIR/.vision-probe.json"
-  printf '{"model":"%s,gpu","messages":[{"role":"user","content":[{"type":"text","text":"Reply with the single word: ok"},{"type":"image_url","image_url":{"url":"data:image/jpeg;base64,%s"}}]}],"max_completion_tokens":8,"temperature":0}' \
-    "$MODEL_ID" "$LITERTLM_PROBE_JPEG_B64" > "$_body" 2>/dev/null || return 1
-  _code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 180 \
+verify_litertlm_probe() {
+  local requested="$1" body response code tool_dir py verifier candidate valid=1
+  body="$LITERT_DIR/.identity-probe.json"
+  response="$LITERT_DIR/.identity-response.json"
+  printf '{"model":"%s","messages":[{"role":"user","content":[{"type":"text","text":"Reply with the single word: ok"},{"type":"image_url","image_url":{"url":"data:image/jpeg;base64,%s"}}]}],"max_completion_tokens":8,"temperature":0}' \
+    "$requested" "$LITERTLM_PROBE_JPEG_B64" > "$body" 2>/dev/null || return 1
+  code=$(curl -s -o "$response" -w '%{http_code}' --max-time 180 \
     -X POST "http://127.0.0.1:$SERVE_PORT/v1/chat/completions" \
-    -H 'Content-Type: application/json' --data-binary @"$_body" 2>/dev/null)
-  rm -f "$_body" 2>/dev/null || true
-  [ "$_code" = "200" ]
+    -H 'Content-Type: application/json' -H "X-Trillboards-Model-Sha256: $APPROVED_MODEL_SHA256" \
+    --data-binary @"$body" 2>/dev/null)
+  if [ "$code" = "200" ]; then
+    tool_dir="$("${UV:-$LOCAL_BIN/uv}" tool dir 2>/dev/null | tr -d '\r')"
+    py="$tool_dir/litert-lm/bin/python"
+    for candidate in "$SCRIPT_DIR/verify_model_proof.py" "$SCRIPT_DIR/../litertlm/verify_model_proof.py" "$SCRIPT_DIR/../../litertlm/verify_model_proof.py"; do
+      [ -f "$candidate" ] && { verifier="$candidate"; break; }
+    done
+    [ -n "${verifier:-}" ] && [ -x "$py" ] \
+      && "$py" "$verifier" "$response" "$requested" "$APPROVED_MODEL_SHA256" && valid=0
+  fi
+  rm -f "$body" "$response" 2>/dev/null || true
+  return "$valid"
 }
+verify_litertlm_vision() { verify_litertlm_probe "$MODEL_ID,gpu"; }
 
 # The same probe, but asking for NO delegate suffix rather than `,gpu`.
 #
@@ -273,16 +289,7 @@ verify_litertlm_vision() {
 # carries no suffix at all, so a 200 means the box built an engine and ran a real
 # image through it under the config now on disk, which is exactly the claim each
 # rung needs.
-verify_litertlm_plain_inference() {
-  _body="$LITERT_DIR/.plain-probe.json"
-  printf '{"model":"%s","messages":[{"role":"user","content":[{"type":"text","text":"Reply with the single word: ok"},{"type":"image_url","image_url":{"url":"data:image/jpeg;base64,%s"}}]}],"max_completion_tokens":8,"temperature":0}' \
-    "$MODEL_ID" "$LITERTLM_PROBE_JPEG_B64" > "$_body" 2>/dev/null || return 1
-  _code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 180 \
-    -X POST "http://127.0.0.1:$SERVE_PORT/v1/chat/completions" \
-    -H 'Content-Type: application/json' --data-binary @"$_body" 2>/dev/null)
-  rm -f "$_body" 2>/dev/null || true
-  [ "$_code" = "200" ]
-}
+verify_litertlm_plain_inference() { verify_litertlm_probe "$MODEL_ID"; }
 
 local_ai_healthy() {
   curl -fsS --max-time 3 "http://127.0.0.1:$SERVE_PORT/v1/models" 2>/dev/null \
@@ -362,20 +369,37 @@ fi
 
 install_litertlm_shim || true
 
-# 3. Model. Idempotent: skip entirely if litert-lm already has it.
+# 3. Model: a matching name is not a matching artifact. Upgrade from the immutable
+# revision, preserve the old bytes, and verify the installed copy.
 HAVE_MODEL=0
-if "$LITERTLM" list 2>/dev/null | grep -q "$MODEL_ID"; then
-  log "model $MODEL_ID already present — skipping import"
+INSTALLED_SHA="$(sha256sum "$STORE_DIR/model.litertlm" 2>/dev/null | awk '{print $1}')"
+if [ "$INSTALLED_SHA" = "$APPROVED_MODEL_SHA256" ]; then
+  log "approved model $MODEL_ID already present — skipping import"
   HAVE_MODEL=1
 else
   [ "$ALLOW_MODEL_DOWNLOAD" = "1" ] || fail "local AI model is missing and the network import is disabled"
-  log "importing $MODEL_ID from $HF_REPO (~2.4 GB, public repo) — this takes a while"
-  if "$LITERTLM" import --from-huggingface-repo "$HF_REPO" "$MODEL_ID" >>"$LOG" 2>&1; then
-    log "model imported"
-    HAVE_MODEL=1
-  else
-    fail "model import failed — the connector will WAIT (and beacon) until this succeeds"
+  mkdir -p "$STORE_DIR" || fail "model store is unavailable"
+  DOWNLOAD="$(mktemp "$STORE_DIR/approved-model.XXXXXX")" || fail "could not create a model download file"
+  log "downloading approved $MODEL_ID from immutable revision $MODEL_REVISION"
+  if ! curl -fL --retry 3 --output "$DOWNLOAD" "$MODEL_URL" >>"$LOG" 2>&1 \
+    || [ "$(sha256sum "$DOWNLOAD" | awk '{print $1}')" != "$APPROVED_MODEL_SHA256" ]; then
+    rm -f "$DOWNLOAD"
+    fail "approved model download/checksum failed"
+  fi
+  if [ -n "$INSTALLED_SHA" ]; then
+    ROLLBACK="$STORE_DIR/rollback/$INSTALLED_SHA.litertlm"
+    mkdir -p "$STORE_DIR/rollback" || fail "could not preserve previous model"
+    [ -f "$ROLLBACK" ] || cp "$STORE_DIR/model.litertlm" "$ROLLBACK" || fail "could not preserve previous model"
+    [ "$(sha256sum "$ROLLBACK" | awk '{print $1}')" = "$INSTALLED_SHA" ] || fail "previous model backup verification failed"
   fi
+  if ! "$LITERTLM" import "$DOWNLOAD" "$MODEL_ID" >>"$LOG" 2>&1 \
+    || [ "$(sha256sum "$STORE_DIR/model.litertlm" | awk '{print $1}')" != "$APPROVED_MODEL_SHA256" ]; then
+    rm -f "$DOWNLOAD"
+    fail "approved model import verification failed — the connector will WAIT until this succeeds"
+  fi
+  rm -f "$DOWNLOAD"
+  HAVE_MODEL=1
+  log "model imported from verified immutable revision"
 fi
 
 # Record the installed version next to the store model so the connector's

package/deploy/windows/build-windows.ps1

@@ -16,11 +16,11 @@
       bin\trillboards-pair.cmd   first-run claim-code pairing helper
       lib\edge-sdk\dist\cli.js   the connector CLI
       lib\node_modules\...       runtime subset (edge-core + edge-platform-rtsp +
-                                 edge-sdk + transitive deps), WITHOUT the heavy
-                                 local ONNX/sharp/sqlite inference stack.
+                                 edge-sdk + transitive deps, including Sharp for
+                                 focused image masks), WITHOUT local ONNX/sqlite.
 
-  The connector is loaded WITHOUT the heavy ONNX/sharp/sqlite stack (cli.ts
-  lazy-requires EdgeAgent), so the bundle omits onnxruntime-node/sharp/
+  The connector is loaded WITHOUT the heavy ONNX/sqlite stack (cli.ts
+  lazy-requires EdgeAgent), so the bundle omits onnxruntime-node/
   better-sqlite3 — keeping the inner .exe small. The release workflow signs this
   connector installer, then bundle-windows-installer.ps1 wraps it with the
   pinned Gemma model in one customer-facing executable. The inner installer
@@ -107,6 +107,7 @@ Push-Location $WorkspaceRoot; npm run build; if ($LASTEXITCODE -ne 0) { Die "edg
 Log "Staging edge-sdk dist…"
 New-Item -ItemType Directory -Force -Path "$Payload\lib\edge-sdk" | Out-Null
 Copy-Item -Recurse -Force "$PkgRoot\dist" "$Payload\lib\edge-sdk\dist"
+Copy-Item -Recurse -Force "$PkgRoot\retained" "$Payload\lib\edge-sdk\retained"
 Copy-Item -Force "$PkgRoot\package.json" "$Payload\lib\edge-sdk\package.json"
 
 # ─── 3. Runtime node_modules subset (NO heavy native stack) ────────────────────
@@ -123,9 +124,11 @@ Copy-Item -Force "$PkgRoot\package.json" "$Payload\lib\edge-sdk\package.json"
 # the job was killed at its timeout on EVERY release run, so the .exe never
 # published. /MT parallelises the small-file copy; /R:1 /W:1 bound retries so a
 # single transiently-locked file can't trigger robocopy's default 1e6×30s hang.
-Log "Staging runtime node_modules (excluding ONNX/sharp/sqlite/dev)…"
+Log "Staging runtime node_modules (including focused-image masks; excluding ONNX/sqlite/dev)…"
 New-Item -ItemType Directory -Force -Path "$Payload\lib\node_modules" | Out-Null
-$xd = @("onnxruntime-node","sharp","@img","better-sqlite3","ffmpeg-static",".cache",".bin","typescript","jest","jest-cli","@jest","ts-jest","@types")
+# Focused retained reviews use Sharp to mask pixels, not just prompt geometry.
+# Keep its platform-native dependencies; detectors still use the local HTTP service.
+$xd = @("onnxruntime-node","better-sqlite3","ffmpeg-static",".cache",".bin","typescript","jest","jest-cli","@jest","ts-jest","@types")
 $rcArgs = @("$WorkspaceRoot\node_modules", "$Payload\lib\node_modules", "/E", "/XJ", "/MT:16", "/R:1", "/W:1", "/NFL","/NDL","/NJH","/NJS","/NP")
 foreach ($d in $xd) { $rcArgs += @("/XD", $d) }
 robocopy @rcArgs | Out-Null
@@ -141,6 +144,7 @@ foreach ($p in @("edge-core","edge-sensing","edge-ads","edge-federated","edge-cl
   if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
   New-Item -ItemType Directory -Force -Path $dest | Out-Null
   if (Test-Path "$src\dist") { Copy-Item -Recurse -Force "$src\dist" "$dest\dist" }
+  if ($p -eq 'edge-sdk') { Copy-Item -Recurse -Force "$src\retained" "$dest\retained" }
   Copy-Item -Force "$src\package.json" "$dest\package.json"
 }
 
@@ -193,6 +197,7 @@ Log "Bundled ffmpeg OK"
 # PATH=bin first so the connector's default ffmpeg='ffmpeg' resolves to OURS.
 Copy-Item -Force "$Here\trillboards-edge.cmd" "$Payload\bin\trillboards-edge.cmd"
 Copy-Item -Force "$Here\trillboards-pair.cmd" "$Payload\bin\trillboards-pair.cmd"
+Copy-Item -Force "$Here\..\setup-guidance.json" "$Payload\bin\setup-guidance.json"
 Copy-Item -Force "$Here\trillboards-setup.ps1" "$Payload\bin\trillboards-setup.ps1"
 Copy-Item -Force "$Here\trillboards-setup.vbs" "$Payload\bin\trillboards-setup.vbs"
 Copy-Item -Force "$Here\trillboards-edge-task.vbs" "$Payload\bin\trillboards-edge-task.vbs"

package/deploy/windows/bundle-windows-installer.ps1

@@ -15,8 +15,8 @@ param(
   [Parameter(Mandatory = $true)][string]$InnerInstaller,
   [string]$OutputPath = "",
   [string]$ModelPath = "",
-  [string]$ModelUrl = "https://huggingface.co/litert-community/gemma-4-E2B-it-litert-lm/resolve/main/gemma-4-E2B-it.litertlm",
-  [string]$ModelSha256 = "181938105e0eefd105961417e8da75903eacda102c4fce9ce90f50b97139a63c",
+  [string]$ModelUrl = "https://huggingface.co/litert-community/gemma-4-E2B-it-litert-lm/resolve/84b6978eff6e4eea02825bc2ee4ea48579f13109/gemma-4-E2B-it.litertlm",
+  [string]$ModelSha256 = "ab7838cdfc8f77e54d8ca45eadceb20452d9f01e4bfade03e5dce27911b27e42",
   [string]$SevenZipSdkUrl = "https://www.7-zip.org/a/lzma2602.7z",
   [string]$SevenZipSdkSha256 = "2878c85f5f43a4a4e0952b1fd4e5fe097c1c143997a8047c7e1e788892aa9357",
   [string]$IconPath = ""
@@ -87,7 +87,7 @@ if (-not $sfxModule) { Fail "official 7zSD.sfx installer module was not found" }
 # Brand the executable module before appending the config and archive. This
 # keeps the SFX overlay byte-for-byte intact and the final Authenticode signing
 # step covers both the application icon and the customer payload.
-& (Join-Path $Here "set-executable-icon.ps1") -ExecutablePath $sfxModule.FullName -IconPath $IconPath
+& (Join-Path $Here "set-executable-icon.ps1") -ExecutablePath $sfxModule.FullName -IconPath $IconPath -EnsurePerUserExecution
 
 $innerName = "TrillboardsEdgeSetup-core.exe"
 Copy-Item -LiteralPath $InnerInstaller -Destination (Join-Path $Stage $innerName) -Force

package/deploy/windows/e2e/test-local-sense.ps1

@@ -12,11 +12,12 @@
   wiring (DEFAULT, runs on EVERY CI event incl. PRs):
     Builds the connector, then runs the cross-platform Node wiring runner
     (scripts/run-local-sense-wiring-e2e.mjs) which drives the REAL built
-    `cli.js local-sense` against a STUB :9379 VLM (returns a fixed valid Gemma
-    JSON, person_count>=1) + a STUB ingest API, feeding the committed person
-    fixture through the connector's real RTSP/ffmpeg path. Proves the
-    connector → serve → preAnalyzed → assert plumbing WITHOUT the ~2.4 GB model.
-    This is a STUB-VLM proof — NOT a real-model proof.
+    `cli.js local-sense` against STUB local VLM/detector services and an
+    authenticated retained capability/profile/ingest API, feeding the committed
+    fixture through real RTSP/ffmpeg. Checks declared field ownership, pinned
+    requests and original evidence/hash/capture time with the genuine retained
+    protocol parser/acknowledgement, WITHOUT downloading the real models.
+    This is a STUB-MODEL wiring proof — NOT an inference-accuracy proof.
 
   bench (workflow_dispatch only):
     Provisions exactly as 'real' does, then runs scripts/bench-local-vlm.mjs

package/deploy/windows/install-update.ps1

@@ -56,12 +56,10 @@ function Register-Connector([string]$Root) {
   2026-08-19 Windows BOM incident, and it is why this is here rather than left
   to the repair path.
 
-  RE-REGISTER, NOT RE-PROVISION. `setup-detector.ps1` runs `uv tool install
-  --force`, which rebuilds a venv and needs the network; putting that inside an
-  update transaction would give the upgrade a new way to be slow and a new way
-  to fail. Re-registering the task is the whole of what has to change, and
-  register-detector-task.ps1 already stops the running service, replaces the
-  action and starts it again - so this both migrates and restarts it.
+  Re-register when the runtime source stamp matches. When it differs, run the
+  owned provisioner so a healthy old CPU-only service cannot survive a GPU
+  update indefinitely. The provisioner serializes replacement, verifies its
+  installed stamp and chooses one CPU/CUDA dependency set. Pairings stay intact.
 
   BEST EFFORT, ALWAYS. The detector is a cost optimisation: without it every
   frame goes to the VLM exactly as it does today. It must never be able to fail
@@ -77,6 +75,47 @@ function Update-DetectorTask([string]$Root) {
     # register-task.ps1 states for its own repair.
     $exe = ($task.Actions | Select-Object -First 1).Execute
     if (-not $exe) { return }
+    # Older updater array-splatting bound the text '-DetectorPath' positionally
+    # as the executable, shifting the real path into --port. Recover ONLY this
+    # known shape, under the current user's SID and exact local tool path.
+    if ($exe -eq '-DetectorPath') {
+      $taskUser = [string]$task.Principal.UserId
+      $taskSid = if ($taskUser -match '^S-1-') { $taskUser } else {
+        (New-Object System.Security.Principal.NTAccount($taskUser)).Translate([System.Security.Principal.SecurityIdentifier]).Value
+      }
+      $currentSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+      $oldArgs = [string]($task.Actions | Select-Object -First 1).Arguments
+      $ownTool = Join-Path $env:USERPROFILE '.local\bin\trillboards-detector.exe'
+      if ($taskSid -ne $currentSid -or $oldArgs -notmatch '^serve --host 127\.0\.0\.1 --port (.+?) --log-file "-RamBudgetMb" --ram-budget-mb \d+$') {
+        throw 'Cannot verify ownership of the malformed detector task'
+      }
+      $recovered = $Matches[1]
+      if ([IO.Path]::GetFullPath($recovered) -ine [IO.Path]::GetFullPath($ownTool) -or -not (Test-Path -LiteralPath $ownTool)) {
+        throw 'Malformed detector task does not identify this user installation'
+      }
+      $exe = $ownTool
+    }
+
+    $detectorSource = Join-Path $Root 'bin\detector'
+    $project = Join-Path $detectorSource 'pyproject.toml'
+    $setup = Join-Path $Root 'bin\setup-detector.ps1'
+    if ((Test-Path -LiteralPath $project) -and (Test-Path -LiteralPath $setup)) {
+      $versionLine = @(Get-Content -LiteralPath $project | Where-Object { $_ -match '^version\s*=\s*"([^"]+)"\s*$' })
+      if ($versionLine.Count -ne 1 -or $versionLine[0] -notmatch '^version\s*=\s*"([^"]+)"\s*$') {
+        throw 'Cannot resolve the staged detector source version'
+      }
+      $stagedDetectorVersion = $Matches[1]
+      $installedDetectorVersion = ((& $exe --version 2>$null | Out-String).Trim() -split '\s+')[-1]
+      if ($LASTEXITCODE -ne 0 -or $installedDetectorVersion -ne $stagedDetectorVersion) {
+        Write-Host "Updating the managed detector runtime to $stagedDetectorVersion."
+        & $setup -SourcePath $detectorSource
+        $verifiedDetectorVersion = ((& $exe --version 2>$null | Out-String).Trim() -split '\s+')[-1]
+        if ($LASTEXITCODE -ne 0 -or $verifiedDetectorVersion -ne $stagedDetectorVersion) {
+          throw 'Detector runtime update did not verify; pairing preserved, local detector needs repair'
+        }
+        return # the owned provisioner already registered and restarted the task
+      }
+    }
 
     $register = Join-Path $Root "bin\register-detector-task.ps1"
     if (-not (Test-Path -LiteralPath $register)) { return }
@@ -93,12 +132,16 @@ function Update-DetectorTask([string]$Root) {
       if ($LASTEXITCODE -eq 0 -and $derived -match '^\d+$') { $budget = $derived }
     }
 
-    $registerArgs = @('-DetectorPath', $exe)
-    if ($budget) { $registerArgs += @('-RamBudgetMb', $budget) }
+    # A PowerShell SCRIPT takes named parameters from a hashtable. An array of
+    # flag strings is positional; it creates Execute='-DetectorPath' while
+    # reporting registration success. Native powershell.exe argument arrays
+    # elsewhere are a different boundary and must not be changed with this.
+    $registerArgs = @{ DetectorPath = $exe }
+    if ($budget) { $registerArgs.RamBudgetMb = $budget }
     & $register @registerArgs | Out-Null
     Write-Host "Detector task migrated$(if ($budget) { " (RAM ceiling $budget MiB)" })."
   } catch {
-    Write-Warning "Could not migrate the detector task: $($_.Exception.Message). Sensing is unaffected; every frame keeps going to the VLM."
+    Write-Warning "Could not migrate the detector task: $($_.Exception.Message). Detector-backed profiles need the local detector repaired; camera pairing is preserved."
   }
 }
 

package/deploy/windows/set-executable-icon.ps1

@@ -1,16 +1,19 @@
 <#
 .SYNOPSIS
-  Replaces every application icon group in a Windows executable.
+  Updates installer icons and optionally declares per-user execution.
 
 .DESCRIPTION
   The customer installer uses the official 7-Zip SFX module, whose generic
   icon would otherwise become the icon customers see in Explorer. This helper
   updates that module before the installer payload is appended and signed.
+  EnsurePerUserExecution adds an asInvoker manifest to avoid Windows installer
+  heuristics requesting elevation for this per-user connector wrapper.
 #>
 [CmdletBinding()]
 param(
   [Parameter(Mandatory = $true)][string]$ExecutablePath,
-  [Parameter(Mandatory = $true)][string]$IconPath
+  [Parameter(Mandatory = $true)][string]$IconPath,
+  [switch]$EnsurePerUserExecution
 )
 
 $ErrorActionPreference = "Stop"
@@ -28,6 +31,7 @@ using System.Collections.Generic;
 using System.ComponentModel;
 using System.IO;
 using System.Runtime.InteropServices;
+using System.Text;
 
 namespace SenseAnything.Build
 {
@@ -140,7 +144,7 @@ namespace SenseAnything.Build
             IntPtr update,
             [MarshalAs(UnmanagedType.Bool)] bool discard);
 
-        public static void Replace(string executablePath, string iconPath)
+        public static void Replace(string executablePath, string iconPath, bool ensurePerUserExecution)
         {
             List<IconImage> images = ReadIcon(iconPath);
             List<ResourceGroup> groups = ReadIconGroups(executablePath);
@@ -210,7 +214,22 @@ namespace SenseAnything.Build
                     }
                 }
 
-                Require(EndUpdateResourceW(update, false), "Could not commit the executable icon");
+                if (ensurePerUserExecution)
+                {
+                    // The official SFX module has no execution-level manifest.
+                    // Declare the same per-user level as the inner NSIS package;
+                    // do not let installer heuristics request elevation instead.
+                    byte[] manifest = Encoding.UTF8.GetBytes(@"<?xml version=""1.0"" encoding=""UTF-8""?>
+<assembly xmlns=""urn:schemas-microsoft-com:asm.v1"" manifestVersion=""1.0"">
+  <assemblyIdentity name=""Trillboards.SenseAnything.Connector"" version=""1.0.0.0"" type=""win32""/>
+  <trustInfo xmlns=""urn:schemas-microsoft-com:asm.v3""><security><requestedPrivileges>
+    <requestedExecutionLevel level=""asInvoker"" uiAccess=""false""/>
+  </requestedPrivileges></security></trustInfo>
+</assembly>");
+                    Require(UpdateResourceById(update, MakeResource(24), MakeResource(1), 0,
+                        manifest, (uint)manifest.Length), "Could not write the per-user execution manifest");
+                }
+                Require(EndUpdateResourceW(update, false), "Could not commit the executable resources");
                 committed = true;
             }
             finally
@@ -350,5 +369,5 @@ namespace SenseAnything.Build
 }
 '@
 
-[SenseAnything.Build.ExecutableIcon]::Replace($ExecutablePath, $IconPath)
+[SenseAnything.Build.ExecutableIcon]::Replace($ExecutablePath, $IconPath, $EnsurePerUserExecution.IsPresent)
 Write-Host "[icon] applied Sense Anything icon to $ExecutablePath" -ForegroundColor Green