camstack 1.2.44 → 1.2.46

package/dist/{chunk-PBBUVCZE.js → chunk-HAO7UL6U.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-swxwnJmL.mjs
+// ../types/dist/sleep-CdbM8ge4.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -23694,7 +23694,23 @@ var NcHistoryEntrySchema = external_exports.object({
   updatedAt: external_exports.number(),
   /** Failure detail — present on a `dead` row. */
   error: external_exports.string().optional(),
-  subject: NcHistorySubjectSchema
+  subject: NcHistorySubjectSchema,
+  /**
+  * Ids of the artefacts (still, then gif, then clip) this row's successful
+  * delivery indexed in the artefact library — a REFERENCE, never the bytes
+  * (an artefact is often megabytes; this row is durable JSON rewritten on
+  * every delivery attempt). Absent on a row still pending/dead, a row
+  * delivered before this field shipped, or a wiring with no artefact index.
+  *
+  * Resolve one to a fetchable URL with `resolveArtifactUrl` — an id
+  * outlives any one URL's TTL, so a caller mints a fresh link on demand
+  * rather than trusting one frozen at delivery time. `resolveArtifactUrl`
+  * also answers `null` for an id whose artefact has since expired past the
+  * retained shelf's own age bound — the degrade a caller (the Home
+  * Assistant export) must render as "no image right now", never as a
+  * broken link.
+  */
+  artifactIds: external_exports.array(external_exports.string().min(1)).optional()
 });
 var NcHistoryFilterSchema = external_exports.object({
   ruleId: external_exports.string().optional(),
@@ -23940,6 +23956,20 @@ var notificationRulesCapability = {
     */
     getHistory: method(external_exports.object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), external_exports.object({ entries: external_exports.array(NcHistoryEntrySchema) }), { auth: "admin" }),
     /**
+    * Mint a fresh, externally-reachable URL for one artefact a history row
+    * named in {@link NcHistoryEntrySchema.shape.artifactIds} — the SAME
+    * signed-link mechanism the dispatcher uses to attach media to an
+    * outgoing notification (one derivation; this never re-implements it).
+    *
+    * `url: null` on THREE causes a caller must treat identically ("no image
+    * right now", never a broken link): the id is unknown, its artefact has
+    * expired past the retained shelf's own age bound, or this install has no
+    * externally-reachable base URL. A caller that received a URL on a
+    * previous call and now gets `null` must stop showing it — a link that
+    * worked five minutes ago is not proof it works now.
+    */
+    resolveArtifactUrl: method(external_exports.object({ artifactId: external_exports.string().min(1) }), external_exports.object({ url: external_exports.string().nullable() }), { auth: "admin" }),
+    /**
     * Snooze windows currently in effect, plus any whose digest has not yet
     * gone out. `caller: 'required'`: a user sees their OWN windows and the
     * global ones that silence them, never another person's private silence.
@@ -24179,2033 +24209,2245 @@ var oauthIntegrationCapability = {
     getDescriptor: method(external_exports.void(), OauthIntegrationDescriptorSchema, { auth: "admin" })
   }
 };
-var TrackStateSchema = external_exports.enum([
-  "new",
-  "entered",
-  "left",
-  "moving",
-  "idle"
-]);
-var EventKindSchema = external_exports.enum([
-  "motion",
-  "object",
-  "audio"
-]);
-var TrackZoneFilterSchema = external_exports.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
-var EventKindIconSchema = external_exports.enum([
-  "motion",
-  "audio",
-  "person",
-  "vehicle",
-  "animal",
-  "door",
-  "pir",
-  "smoke",
-  "water",
-  "button",
-  "package",
-  "generic"
+var NativeCropRefSchema = external_exports.object({
+  /** Handle keying the retained native surface (node-pinned to its owner). */
+  handle: FrameHandleSchema,
+  /** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+  cropFrameSpace: external_exports.object({
+    x: external_exports.number(),
+    y: external_exports.number(),
+    w: external_exports.number(),
+    h: external_exports.number()
+  })
+});
+external_exports.object({
+  crop: external_exports.object({
+    left: external_exports.number(),
+    top: external_exports.number(),
+    width: external_exports.number().positive(),
+    height: external_exports.number().positive()
+  }).optional(),
+  content: external_exports.object({
+    width: external_exports.number().int().positive(),
+    height: external_exports.number().int().positive()
+  }),
+  fit: external_exports.enum(["stretch", "contain"]),
+  format: external_exports.enum([
+    "rgb",
+    "gray",
+    "jpeg"
+  ])
+});
+var FrameRefSchema = external_exports.object({
+  registryId: external_exports.string().min(1),
+  id: external_exports.string().min(1),
+  width: external_exports.number().int().positive(),
+  height: external_exports.number().int().positive(),
+  format: external_exports.enum(["rgb", "gray"]),
+  timestamp: external_exports.number(),
+  capturedAt: external_exports.number().optional()
+});
+var ModelFormatSchema$1 = external_exports.enum([
+  "onnx",
+  "coreml",
+  "openvino",
+  "tflite",
+  "pt",
+  "gguf"
 ]);
-var EventKindCategorySchema = external_exports.enum([
-  "motion",
-  "audio",
-  "detection",
-  "sensor",
-  "control",
-  "custom",
-  "package"
+var PipelineSlotSchema = external_exports.enum([
+  "detector",
+  "cropper",
+  "classifier",
+  "refiner",
+  "audio-classifier"
 ]);
-var EventKindLevelSchema = external_exports.enum(["macro", "sub"]);
-var EventKindDescriptorSchema = external_exports.object({
-  /** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
-  kind: external_exports.string(),
-  /** i18n key resolved on the UI side; `label` is the English fallback. */
-  labelKey: external_exports.string(),
-  /** English fallback label (kept for clients that don't translate). */
+var PipelineEngineChoiceSchema = external_exports.object({
+  runtime: external_exports.enum(["node", "python"]),
+  backend: external_exports.string(),
+  format: ModelFormatSchema$1,
+  device: external_exports.string().optional()
+});
+var EngineDeviceInfoSchema = external_exports.object({
+  id: external_exports.string(),
   label: external_exports.string(),
-  /** Hex color for timeline/legend rendering. */
-  color: external_exports.string(),
-  /** Dictionary id → lucide component on the UI side. */
-  iconId: external_exports.string(),
-  /** Legacy closed-vocab glyph — fallback for `iconId`. */
-  icon: EventKindIconSchema,
-  category: EventKindCategorySchema,
-  /** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
-  parentKind: external_exports.string().nullable(),
-  /** Derived from `parentKind`, explicit for the client tree. */
-  level: EventKindLevelSchema,
-  /** Which cap + device contributes this kind. For built-ins the camera
-  *  itself; for sensor kinds the LINKED source device. */
-  source: external_exports.object({
-    capName: external_exports.string(),
-    deviceId: external_exports.number()
-  })
+  description: external_exports.string().optional()
 });
-var EventKindsForDeviceSchema = external_exports.object({
-  deviceId: external_exports.number(),
-  kinds: external_exports.array(EventKindDescriptorSchema).readonly()
+var AvailableEngineSchema = external_exports.object({
+  engine: PipelineEngineChoiceSchema,
+  devices: external_exports.array(EngineDeviceInfoSchema).readonly(),
+  defaultDevice: external_exports.string()
 });
-var SensorEventSchema = external_exports.object({
+var PipelineDefaultStepSchema = external_exports.lazy(() => external_exports.object({
+  addonId: external_exports.string(),
+  addonName: external_exports.string(),
+  slot: PipelineSlotSchema,
+  inputClasses: external_exports.array(external_exports.string()).readonly(),
+  outputClasses: external_exports.array(external_exports.string()).readonly(),
+  enabled: external_exports.boolean(),
+  modelId: external_exports.string(),
+  children: external_exports.array(PipelineDefaultStepSchema).readonly(),
+  group: external_exports.string().optional(),
+  settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}));
+var PipelineTemplateStepSchema = external_exports.lazy(() => external_exports.object({
+  addonId: external_exports.string(),
+  enabled: external_exports.boolean(),
+  modelId: external_exports.string(),
+  children: external_exports.array(PipelineTemplateStepSchema).readonly(),
+  settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}));
+var PipelineTemplateSchema$1 = external_exports.object({
   id: external_exports.string(),
-  /** The CAMERA the event is attributed to (a sensor linked to N cameras
-  *  yields N rows, one per camera). */
-  deviceId: external_exports.number(),
-  /** The linked sensor device whose state changed. */
-  sourceDeviceId: external_exports.number(),
-  /** Event kind id — matches an `EventKindDescriptor.kind`. */
-  kind: external_exports.string(),
-  /** Snapshot of the sensor cap's runtime-state slice at the change. */
-  value: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
-  timestamp: external_exports.number()
-});
-var TrackPositionSchema = external_exports.object({
-  x: external_exports.number(),
-  y: external_exports.number(),
-  timestamp: external_exports.number(),
-  bbox: BoundingBoxSchema
+  name: external_exports.string(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string(),
+  engine: PipelineEngineChoiceSchema,
+  steps: external_exports.array(PipelineTemplateStepSchema).readonly()
 });
-var TrackSnapshotSchema = external_exports.object({
-  timestamp: external_exports.number(),
-  position: TrackPositionSchema,
-  /** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
-  mediaKey: external_exports.string()
+var PipelineModelOptionSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  formats: external_exports.record(external_exports.string(), external_exports.object({
+    downloaded: external_exports.boolean(),
+    sizeMB: external_exports.number()
+  })),
+  group: ModelVariantGroupSchema.optional(),
+  legacy: external_exports.boolean().optional(),
+  provider: ModelProviderIdSchema.optional()
 });
-var TrackEnvelopeSchema = external_exports.object({
-  minX: external_exports.number(),
-  minY: external_exports.number(),
-  maxX: external_exports.number(),
-  maxY: external_exports.number()
+var ConfigFieldBridge = external_exports.custom();
+var PipelineAddonSchemaSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  slot: PipelineSlotSchema,
+  inputClasses: external_exports.array(external_exports.string()).readonly(),
+  outputClasses: external_exports.array(external_exports.string()).readonly(),
+  childSlots: external_exports.array(PipelineSlotSchema).readonly(),
+  models: external_exports.array(PipelineModelOptionSchema).readonly(),
+  defaultModelId: external_exports.string(),
+  defaultModelIdByFormat: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  enabledByDefault: external_exports.boolean().optional(),
+  backfillIntoExistingOverrides: external_exports.boolean().optional(),
+  defaultConfidence: external_exports.number(),
+  group: external_exports.string().optional(),
+  configSchema: external_exports.array(ConfigFieldBridge).readonly().optional()
 });
-var TrackProjectionSchema = external_exports.enum(["full", "slim"]);
-var TrackAudioLabelSchema = external_exports.object({
+var PipelineSlotSchemaSchema = external_exports.object({
+  id: PipelineSlotSchema,
   label: external_exports.string(),
-  /** Highest classification score observed across the label's episodes. */
-  peakScore: external_exports.number(),
-  /** Number of coalesced audio-event episodes carrying this label. */
-  count: external_exports.number(),
-  firstAt: external_exports.number(),
-  lastAt: external_exports.number()
-});
-var TrackSourceSchema = external_exports.enum([
-  "pipeline",
-  "sensor",
-  "audio"
-]);
-var RetrainStatusSchema = external_exports.enum([
-  "none",
-  "staging",
-  "trained"
-]);
-var TrackFlagFields = {
-  /** Operator marked this track as training material — i.e. `retrainStatus` is
-  *  `'staging'`. */
-  markForTrain: external_exports.boolean().optional(),
-  /** Operator marked this track for diagnostic attention. */
-  debug: external_exports.boolean().optional(),
-  /** Operator favourited this track. Pins it against pruning. */
-  favourited: external_exports.boolean().optional()
-};
-var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
-var TrackFlagsPatchSchema = external_exports.object(TrackFlagFields);
-var TrackFlagsSchema = external_exports.object({
-  trackId: external_exports.string(),
-  markForTrain: external_exports.boolean(),
-  debug: external_exports.boolean(),
-  favourited: external_exports.boolean(),
-  /** The lifecycle state the boolean was derived from. Required here (unlike on
-  *  a track row) because this shape is only ever produced by the write body,
-  *  which always knows it — and a surface that has just written needs to render
-  *  `trained` without a re-fetch. */
-  retrainStatus: RetrainStatusSchema
+  priority: external_exports.number(),
+  parentSlot: PipelineSlotSchema.nullable(),
+  addons: external_exports.array(PipelineAddonSchemaSchema).readonly()
 });
-var LabelTierSchema = external_exports.union([external_exports.literal(1), external_exports.literal(2)]);
-var LabelAttributionSchema = external_exports.object({
-  stepId: external_exports.string(),
-  modelId: external_exports.string().optional(),
-  decidedAt: external_exports.number(),
+var PipelineSchemaSchema = external_exports.object({
+  availableEngines: external_exports.array(AvailableEngineSchema).readonly(),
+  selectedEngine: PipelineEngineChoiceSchema,
+  slots: external_exports.array(PipelineSlotSchemaSchema).readonly()
+});
+var EngineProvisioningSchema = external_exports.object({
+  runtimeId: external_exports.enum([
+    "onnx",
+    "openvino",
+    "coreml",
+    "edgetpu"
+  ]).nullable(),
+  device: external_exports.string().nullable(),
+  state: external_exports.enum([
+    "idle",
+    "installing",
+    "verifying",
+    "ready",
+    "failed"
+  ]),
+  progress: external_exports.number().optional(),
+  error: external_exports.string().optional(),
+  nextRetryAt: external_exports.number().optional(),
   /**
-  * The GALLERY id behind a recognised tier-2 label — a face-gallery
-  * `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
-  *
-  * The text alone is a DISPLAY NAME, and a display name is renameable: a
-  * notification rule authored on "Gianluca" stopped matching the moment the
-  * operator fixed the spelling in the gallery, and nothing said so. The id is
-  * the thing that does not move, so it is what a rule matches on
-  * (`NcConditions.identities`) and the text is what a human is shown.
-  *
-  * Absent when the label names no gallery row — a plate the OCR read but no
-  * vehicle claims, a sub-class, a species, any tier-1 value.
+  * Gate A (config-correctness gate at engine change): human-readable
+  * config issues surfaced EAGERLY when the node's engine changes — model
+  * substitutions ("chose X, running Y") and zero-build steps ("no model
+  * has a <format> build"). Additive/optional: informational only, never
+  * enforced here — `assertEngineReady` (readiness) still gates inference.
+  * Absent/empty when the node-default tree resolves cleanly.
   */
-  identityId: external_exports.string().optional()
+  configIssues: external_exports.array(external_exports.string()).optional()
 });
-var TieredLabelFields = {
-  /** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
-  label: external_exports.string().optional(),
-  /** Confidence of the tier-1 value, as reported by the deciding step. */
-  labelScore: external_exports.number().optional(),
-  /** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
-  labelMeta: LabelAttributionSchema.optional(),
-  /** Tier 2 — the instance. See {@link LabelTierSchema}. */
-  subLabel: external_exports.string().optional(),
-  /** Confidence of the tier-2 value, as reported by the deciding step. */
-  subLabelScore: external_exports.number().optional(),
-  /** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
-  subLabelMeta: LabelAttributionSchema.optional()
-};
-var TrainingExportDeviceTotalsSchema = external_exports.object({
-  deviceId: external_exports.number(),
-  tracks: external_exports.number().int(),
-  files: external_exports.number().int(),
-  bytes: external_exports.number().int()
+var PipelineStepInputSchema = external_exports.lazy(() => external_exports.object({
+  addonId: external_exports.string(),
+  modelId: external_exports.string().optional(),
+  enabled: external_exports.boolean().default(true),
+  children: external_exports.array(PipelineStepInputSchema).optional(),
+  settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  jumpDeviceKey: external_exports.string().optional()
+}));
+var ModelSubstitutionSchema = external_exports.object({
+  addonId: external_exports.string(),
+  chosen: external_exports.string(),
+  running: external_exports.string(),
+  format: external_exports.string()
 });
-var TrainingExportSummarySchema = external_exports.object({
-  generatedAt: external_exports.number(),
-  trackCount: external_exports.number().int(),
-  fileCount: external_exports.number().int(),
-  byteCount: external_exports.number().int(),
-  /** More marked tracks exist than a single pass carries. */
-  truncated: external_exports.boolean(),
-  devices: external_exports.array(TrainingExportDeviceTotalsSchema).readonly()
+var PipelineValidationIssueSchema = external_exports.object({
+  addonId: external_exports.string(),
+  kind: external_exports.enum(["unknown-addon", "no-format-build"]),
+  detail: external_exports.string()
 });
-var TrackSchema = external_exports.object({
-  trackId: external_exports.string(),
-  deviceId: external_exports.number(),
-  className: external_exports.string(),
-  ...TieredLabelFields,
-  producingDeviceName: external_exports.string().optional(),
-  /** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
-  source: TrackSourceSchema.optional(),
-  firstSeen: external_exports.number(),
-  lastSeen: external_exports.number(),
-  /** Frame-rate position history (subject to maxPositionHistory cap). */
-  positions: external_exports.array(TrackPositionSchema).readonly(),
-  /** Periodic snapshots at snapshotIntervalMs cadence (subject to
-  *  saveThumbnails policy). */
-  snapshots: external_exports.array(TrackSnapshotSchema).readonly(),
-  /** Deduplicated zones the track has entered at least once. Zone IDS. */
-  zonesVisited: external_exports.array(external_exports.string()).readonly(),
-  /**
-  * Human NAMES for {@link zonesVisited}, resolved at READ time against the
-  * `zones` capability.
-  *
-  * `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
-  * and no card can render — so every free-text search surface was structurally
-  * unable to answer "show me the tracks in Uscio", and did not fail loudly, it
-  * just returned nothing. Resolving here rather than in each client keeps ONE
-  * derivation and costs the clients no extra call (the `zones` cap is
-  * per-device, so a client-side resolve would be a per-camera fan-out on a
-  * surface built to avoid exactly that).
-  *
-  * Resolved, never invented: a zone deleted since the track was written has no
-  * name and is DROPPED, so this array can be shorter than `zonesVisited` — the
-  * two are not positionally aligned. Absent when the track visited no zone, or
-  * when the zone catalogue could not be read.
-  */
-  zoneNames: external_exports.array(external_exports.string()).readonly().optional(),
-  /** Deduplicated set of detector classes observed for this track over its
-  *  life (a track may be reclassified, e.g. person→vehicle). Absent on
-  *  legacy rows written before class accumulation shipped. */
-  classes: external_exports.array(external_exports.string()).readonly().optional(),
-  /** Cumulative normalized distance travelled (0..1 units = full frame width). */
-  totalDistance: external_exports.number(),
-  state: TrackStateSchema,
-  active: external_exports.boolean(),
-  /** Deterministic key-event importance score in [0,1] (server-computed at
-  *  track expiry, recomputed on late label). Absent on legacy rows written
-  *  before scoring shipped — consumers degrade to absence / compute-on-read. */
-  importance: external_exports.number().optional(),
-  /** Id of the track's highest-confidence ObjectEvent (its representative
-  *  "best" frame). Absent when the track produced no object events. */
-  bestEventId: external_exports.string().optional(),
-  /** Tag of the importance sub-signal that dominated the score
-  *  (identity|dwell|proximity|class|confidence|travel|zone). */
-  importanceReason: external_exports.string().optional(),
-  /** Audio-classification labels heard on the camera during the track's
-  *  life (score ≥ device `classificationMinScore`), aggregated per label.
-  *  Absent on legacy rows / tracks with no confident audio. */
-  audioLabels: external_exports.array(TrackAudioLabelSchema).readonly().optional(),
-  /** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
-  *  Populated from the persisted envelope columns on historical reads;
-  *  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
-  envelope: TrackEnvelopeSchema.optional(),
-  /**
-  * A face DETECTOR found a face on this track — nothing more. It says the
-  * detail plane produced a `face` detail; it does NOT say the face was
-  * embedded, matched, above `minFacePx`, or that the recognizer was even
-  * enabled. Set once and never cleared.
-  *
-  * **This exists so "face present but not recognised" is expressible.** A
-  * recognised identity lands in `subLabel` (attributed to the face chain via
-  * `subLabelMeta.stepId`), so before this field a track with an unmatched face
-  * and a track with no face at all were byte-identical on the wire and no
-  * surface could tell them apart. The read is `hasFace === true && subLabel
-  * === undefined`.
-  *
-  * **Absent ≠ false.** Every row written before the column existed omits it,
-  * and so does every server that predates the field — a consumer must test
-  * `=== true` and render nothing otherwise, never infer "no face".
-  */
-  hasFace: external_exports.boolean().optional(),
-  /**
-  * This track has a face row IN THE GALLERY: a crop **and** an embedding — a
-  * face an operator could ASSIGN to an identity.
-  *
-  * The STRICT twin of {@link hasFace}, and the pair only earns its keep
-  * because the two disagree. `hasFace` is stamped at the TOP of the face
-  * branch, before every gate, and means no more than "a face detector produced
-  * a face detail". This one is stamped at the single moment the gallery row
-  * LANDS — after `FaceRecognizer.onTrackEnd` successfully persists it, i.e.
-  * past the embedding-magnitude verdict, the `minFacePx` detection gate, the
-  * candidate gate, the imageless-track drop (no crop was ever captured) and
-  * the crop-store drop. Everything between the detector and that insert can
-  * legitimately refuse the face, so a flag written any earlier promises the
-  * operator something to assign and delivers nothing.
-  *
-  * **Independent of recognition.** A face collected but never auto-matched is
-  * still assignable — it is in fact the face an operator most wants to reach —
-  * so this is NOT gated on `recognizedIdentityId`. Recognition lands in
-  * `subLabel`; this says only that the raw material exists.
-  *
-  * **Set once, never cleared.** A track that produced a gallery row produced
-  * one; deleting the row later is the gallery's business, not this flag's.
-  *
-  * **Absent ≠ false**, the same rule as {@link hasFace}: every row written
-  * before the column omits it, and so does every server that predates the
-  * field. A consumer must test `=== true` and render nothing otherwise —
-  * never infer "no assignable face".
-  */
-  hasEmbeddedFace: external_exports.boolean().optional(),
+var PipelineValidationResultSchema = external_exports.object({
+  ok: external_exports.boolean(),
+  issues: external_exports.array(PipelineValidationIssueSchema).readonly(),
+  substitutions: external_exports.array(ModelSubstitutionSchema).readonly(),
+  /** The node's `currentEngine.format` this validation ran against. */
+  format: external_exports.string()
+});
+var ReferenceImageEntrySchema = external_exports.object({
+  filename: external_exports.string(),
+  stepIds: external_exports.array(external_exports.string()).readonly().optional()
+});
+var ReferenceImageBodySchema = external_exports.object({
+  base64: external_exports.string(),
+  filename: external_exports.string()
+});
+var ReferenceAudioEntrySchema = external_exports.object({
+  filename: external_exports.string(),
+  sizeKb: external_exports.number()
+});
+var ReferenceAudioBodySchema = external_exports.object({ base64: external_exports.string() });
+var AudioBackendSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  description: external_exports.string(),
+  available: external_exports.boolean(),
   /**
-  * This subject CONTAINS a folded rider — a person the rider-pairing step
-  * ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
-  * so the passage is tracked once and as a VEHICLE.
-  *
-  * It exists because the fold's record was dishonest. D34 and the code both
-  * said "the person is not lost — it is reported so both entities stay on the
-  * record"; in fact the pair went into a per-processor RAM field behind an
-  * accessor nobody called, and every durable surface said `vehicle`, full
-  * stop. This is the composition note that makes the row true.
-  *
-  * A COMPOSITION, never a class and never a label. "This vehicle contains a
-  * person" is not an answer to "what is this" — both label tiers would refuse
-  * a macro token anyway (D89), and correctly. Nothing here changes what the
-  * subject IS: a cyclist stays one vehicle track, occupancy still counts one,
-  * and a `person` rule still does not fire for someone cycling past.
-  *
-  * **Absent ≠ false**, exactly like {@link hasFace}: every row written before
-  * the column, and every hub that predates the field, omits it. Test
-  * `=== true` and render nothing otherwise — never infer "no rider".
+  * Raw classifier labels this backend can emit (e.g. YAMNet's
+  * 521-class set or Apple SoundAnalysis's 303-class set). Used by
+  * the benchmark UI to populate the `enabledMicroClasses` filter
+  * specific to the selected backend without a separate fetch.
   */
-  hasRider: external_exports.boolean().optional(),
-  ...TrackFlagFields,
-  ...TrackRetrainFields
+  rawLabels: external_exports.array(external_exports.string()).readonly().optional()
 });
-var BaseEventFields = {
-  id: external_exports.string(),
-  deviceId: external_exports.number(),
-  timestamp: external_exports.number()
-};
-var MotionEventSchema = external_exports.object({
-  ...BaseEventFields,
-  kind: external_exports.literal("motion"),
-  regionCount: external_exports.number(),
-  /** Heavy JSON array — omitted in slim projection. */
-  regions: external_exports.array(external_exports.object({
-    bbox: BoundingBoxSchema,
-    pixelCount: external_exports.number(),
-    intensity: external_exports.number()
-  })).readonly().optional(),
-  /** Omitted in slim projection. */
-  frameWidth: external_exports.number().optional(),
-  /** Omitted in slim projection. */
-  frameHeight: external_exports.number().optional(),
-  /** Populated by B5 (recording playback URL for this event). */
-  mediaUrl: external_exports.string().optional()
-});
-var DetectionSourceSchema = external_exports.enum(["pipeline", "onboard"]);
-var ZoneCrossingDirectionSchema = external_exports.enum(["enter", "exit"]);
-var ZoneCrossingSchema = external_exports.object({
-  direction: ZoneCrossingDirectionSchema,
-  /** Admin zone id crossed. */
-  zoneId: external_exports.string(),
-  /** Zone display name at crossing time (falls back to the id). */
-  zoneName: external_exports.string().optional()
-});
-var ObjectEventSchema = external_exports.object({
-  ...BaseEventFields,
-  kind: external_exports.literal("object"),
-  /** Detection source. Optional for backward-compat; absent ⇒ `pipeline`. */
-  source: DetectionSourceSchema.optional(),
-  /**
-  * Inference-frame id shared by every object event emitted from the SAME frame
-  * — the "scene/parent" key. Lets a consumer group co-occurring detections (e.g.
-  * 2 people + 1 dog) under one full frame, and link a track's frames over time
-  * (group by `trackId`, pick a representative `frameId` as the parent frame).
-  * Optional for backward-compat with pre-existing rows / the slim projection
-  * includes it (it is light). Absent on rows written before this field.
-  */
-  frameId: external_exports.string().optional(),
-  /** Omitted in slim projection. */
-  trackId: external_exports.string().optional(),
-  className: external_exports.string(),
-  ...TieredLabelFields,
-  /** Omitted in slim projection. */
-  confidence: external_exports.number().optional(),
-  /** Heavy JSON — omitted in slim projection. */
-  bbox: BoundingBoxSchema.optional(),
-  /** Heavy JSON — omitted in slim projection. */
-  zones: external_exports.array(external_exports.string()).readonly().optional(),
-  /** Omitted in slim projection. */
-  state: TrackStateSchema.optional(),
-  /**
-  * The zone crossing this event IS, when it is one. Absent on every other
-  * event kind (movement state, appearance, package) — see
-  * {@link ZoneCrossingSchema}. Omitted in slim projection.
-  */
-  zoneCrossing: ZoneCrossingSchema.optional(),
-  /** Detection-frame dimensions in pixels — let consumers normalize the
-  *  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
-  frameWidth: external_exports.number().optional(),
-  frameHeight: external_exports.number().optional(),
-  /** MediaStore key for the crop attached to this event (if any). */
-  mediaKey: external_exports.string().optional(),
-  /** Design B: MediaStore key of the track's native-resolution key frame (the
-  *  best-detection full frame). Resolve via the event-media data-plane
-  *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
-  *  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
-  *  sources — consumers fall back to `mediaKey` (the tight crop). */
-  keyFrameMediaKey: external_exports.string().optional(),
-  /** Populated by B5 (recording playback URL for this event). */
-  mediaUrl: external_exports.string().optional(),
-  /** The parent track's key-event importance [0,1], propagated to every object
-  *  event of the track (so an event row can be sorted by importance without a
-  *  track join). Absent on legacy rows / before the track was scored. */
-  importance: external_exports.number().optional()
-});
-var AudioEventSchema = external_exports.object({
-  ...BaseEventFields,
-  kind: external_exports.literal("audio"),
-  rms: external_exports.number(),
-  dbfs: external_exports.number(),
-  classification: external_exports.object({
-    className: external_exports.string(),
-    originalClass: external_exports.string().optional(),
-    score: external_exports.number()
-  }).optional(),
-  /** Populated by B5 (recording playback URL for this event). */
-  mediaUrl: external_exports.string().optional()
-});
-var MediaFileKindEnum = external_exports.enum([
-  "crop",
-  "thumbnail",
-  "snapshot",
-  "firstFrame",
-  "lastFrame",
-  "fullFrame",
-  "fullFrameBoxed",
-  "faceCrop",
-  "plateCrop",
-  "keyFrame",
-  "keyFrameSmall",
-  "thumbnailSmall"
-]);
-var MediaFileSchema = external_exports.object({
-  key: external_exports.string(),
-  kind: MediaFileKindEnum,
-  base64: external_exports.string(),
-  sizeBytes: external_exports.number(),
-  timestamp: external_exports.number()
-});
-var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
-var RetrainMacroClassSchema = external_exports.enum([
-  "person",
-  "vehicle",
-  "animal",
-  "package",
-  "face",
-  "plate"
-]);
-var RetrainAnnotationKindSchema = external_exports.enum(["subject", "model_error"]);
-var RetrainAnnotationSourceSchema = external_exports.enum(["operator", "assist"]);
-var RetrainBboxSchema = external_exports.object({
-  x: external_exports.number(),
-  y: external_exports.number(),
-  w: external_exports.number(),
-  h: external_exports.number()
-});
-var RetrainAnnotationSchema = external_exports.object({
-  id: external_exports.string(),
-  trackId: external_exports.string(),
-  deviceId: external_exports.number(),
-  /** The COPY in retrain storage — never the source track's media key. */
-  mediaKey: external_exports.string(),
-  bbox: RetrainBboxSchema,
-  macroClass: RetrainMacroClassSchema,
-  label: external_exports.string().optional(),
-  subLabel: external_exports.string().optional(),
-  kind: RetrainAnnotationKindSchema,
-  source: RetrainAnnotationSourceSchema,
-  /** Which model proposed this box — or, on a `model_error`, drew the phantom. */
-  assistModelId: external_exports.string().optional(),
-  assistScore: external_exports.number().optional(),
-  exportedInBatch: external_exports.string().optional(),
-  createdAt: external_exports.number()
-});
-var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
-  id: true,
-  trackId: true,
-  deviceId: true,
-  mediaKey: true,
-  createdAt: true,
-  exportedInBatch: true
-});
-var RetrainTrackSchema = external_exports.object({
-  trackId: external_exports.string(),
-  deviceId: external_exports.number(),
-  className: external_exports.string(),
-  label: external_exports.string().optional(),
-  firstSeen: external_exports.number(),
-  lastSeen: external_exports.number(),
-  /** How many frames the dataset already holds from this track. */
-  frameCount: external_exports.number().int(),
-  /** How many subjects have been annotated on those frames. `0` with
-  *  `frameCount: 0` is exactly "staging, still to work". */
-  annotationCount: external_exports.number().int()
-});
-var RetrainFrameCandidateSchema = external_exports.object({
-  mediaKey: external_exports.string(),
-  kind: MediaFileKindEnum,
-  timestamp: external_exports.number(),
-  sizeBytes: external_exports.number().int(),
-  /** A copy of this original already exists — selecting it is free and cannot
-  *  fail, whatever became of the original. */
-  copied: external_exports.boolean()
-});
-var RetrainFrameSchema = external_exports.object({
-  frameId: external_exports.string(),
-  deviceId: external_exports.number(),
-  trackId: external_exports.string(),
-  /** Provenance only. It may already point at nothing — that is expected. */
-  sourceMediaKey: external_exports.string(),
-  sourceKind: MediaFileKindEnum,
-  sizeBytes: external_exports.number().int(),
-  width: external_exports.number().int(),
-  height: external_exports.number().int(),
-  copiedAt: external_exports.number()
-});
-var RetrainCopyRefusalSchema = external_exports.enum([
-  "source-missing",
-  "unreadable-image",
-  "write-failed"
-]);
-var RetrainFrameSelectionSchema = external_exports.object({
-  copied: external_exports.array(RetrainFrameSchema).readonly(),
-  refused: external_exports.array(external_exports.object({
-    sourceMediaKey: external_exports.string(),
-    reason: RetrainCopyRefusalSchema
-  })).readonly()
+var AudioCapabilitiesSchema = external_exports.object({
+  activeBackend: external_exports.string(),
+  availableBackends: external_exports.array(AudioBackendSchema).readonly(),
+  sampleRate: external_exports.number(),
+  chunkDurationMs: external_exports.number()
 });
-var RetrainFrameListSchema = external_exports.object({
-  candidates: external_exports.array(RetrainFrameCandidateSchema).readonly(),
-  copies: external_exports.array(RetrainFrameSchema).readonly(),
-  /** What the page pre-selects — the native key frame when one survives. */
-  autoPickMediaKey: external_exports.string().optional()
+var DownloadModelResultSchema = external_exports.object({
+  filePath: external_exports.string(),
+  sizeMB: external_exports.number(),
+  durationMs: external_exports.number()
 });
-var RetrainAssistSubjectSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
-  kind: external_exports.literal("package"),
-  zone: RetrainBboxSchema.optional()
-}), external_exports.object({
-  kind: external_exports.literal("objects"),
-  modelId: external_exports.string(),
-  minScore: external_exports.number().optional()
-})]);
-var RetrainAssistResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
-  kind: external_exports.literal("proposed"),
-  modelId: external_exports.string(),
-  stepId: external_exports.string(),
-  minScore: external_exports.number(),
-  /** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
-  proposals: external_exports.array(RetrainAnnotationDraftSchema).readonly(),
-  /** Returned by the runner but removed by the threshold. */
-  belowThreshold: external_exports.number().int()
-}), external_exports.object({
-  kind: external_exports.literal("refused"),
-  /** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
-  reason: external_exports.string(),
-  detail: external_exports.string().optional()
-})]);
-var RetrainTransitionResultSchema = external_exports.object({
-  trackId: external_exports.string(),
-  /** Where the track ended up, whatever happened. */
-  retrainStatus: RetrainStatusSchema,
-  /** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
-  changed: external_exports.boolean(),
-  reason: external_exports.enum([
-    "unknown-track",
-    "no-frames-copied",
-    "not-staging",
-    "not-trained",
-    "unchanged"
-  ]).optional()
+var AudioTestResultSchema = external_exports.object({
+  success: external_exports.boolean(),
+  error: external_exports.string().optional(),
+  frame: external_exports.custom().optional()
 });
-var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
-var MAX_EVENT_QUERY_LIMIT = 5e3;
-var DeviceEventQueryInput = external_exports.object({
-  deviceId: external_exports.number(),
-  since: external_exports.number().optional(),
-  until: external_exports.number().optional(),
-  limit: external_exports.number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT),
-  /** `slim` drops heavy JSON fields (regions/bbox/zones) and carries an
-  *  optional `mediaUrl` (populated by B5). `full` (default) keeps today's
-  *  exact behaviour. Callers may omit this field — the store defaults to
-  *  `full` when not provided. */
-  projection: external_exports.enum(["full", "slim"]).optional()
-});
-var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: external_exports.string().optional() });
-var RecentTracksQueryInput = external_exports.object({
-  /** Devices to merge. An empty array yields `{ tracks: [], nextCursor: null }`. */
-  deviceIds: external_exports.array(external_exports.number()),
-  /** Window lower bound on `lastSeen` (inclusive). */
-  since: external_exports.number().optional(),
-  /** Window upper bound on `lastSeen` (inclusive). */
-  until: external_exports.number().optional(),
-  /** Page size. Default 200, max 1000. */
-  limit: external_exports.number().int().min(1).max(1e3).default(200),
-  /** Opaque continuation cursor from a previous page's `nextCursor`.
-  *  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
-  cursor: external_exports.string().optional(),
-  /** See {@link TrackProjectionSchema}. Default `full`. */
-  projection: TrackProjectionSchema.optional(),
-  /** Include stationary-promoted rows (parked objects). Default false: the
-  *  feed lists passages; parking records live on the stationary registry. */
-  includeStationary: external_exports.boolean().optional()
-});
-var RecentTracksPageSchema = external_exports.object({
-  /** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
-  tracks: external_exports.array(TrackSchema).readonly(),
-  /** Cursor for the next page, or null when this page is the last. */
-  nextCursor: external_exports.string().nullable()
-});
-var LIST_GROUPS_DEFAULT_LIMIT = 40;
-var LIST_GROUPS_MAX_LIMIT = 100;
-var AnalyticsGroupRecordSchema = external_exports.object({
-  id: external_exports.string(),
-  deviceId: external_exports.number().int(),
-  openedAt: external_exports.number().int(),
-  closedAt: external_exports.number().int(),
-  timestamp: external_exports.number().int(),
-  memberCount: external_exports.number().int(),
-  memberTrackIds: external_exports.array(external_exports.string()).readonly(),
-  className: external_exports.string(),
-  classes: external_exports.array(external_exports.string()).readonly(),
-  /** Relative event-media path, or null when the group has no picture yet. */
-  mediaUrl: external_exports.string().nullable(),
-  singleton: external_exports.boolean()
-});
-var AnalyticsGroupMemberSchema = external_exports.object({
-  trackId: external_exports.string(),
-  deviceId: external_exports.number().int(),
-  className: external_exports.string(),
-  firstSeen: external_exports.number().int(),
-  lastSeen: external_exports.number().int(),
-  mediaUrl: external_exports.string().nullable()
-});
-var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: external_exports.array(AnalyticsGroupMemberSchema).readonly() });
-var ListGroupsQueryInput = external_exports.object({
-  /** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
-  deviceIds: external_exports.array(external_exports.number()),
-  /** Window lower bound on `closedAt` (inclusive). */
-  since: external_exports.number().optional(),
-  /** Window upper bound on `openedAt` (inclusive). */
-  until: external_exports.number().optional(),
-  limit: external_exports.number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
-  /** Opaque continuation cursor from a previous page's `nextCursor`. */
-  cursor: external_exports.string().optional()
-});
-var ListGroupsPageSchema = external_exports.object({
-  groups: external_exports.array(AnalyticsGroupRecordSchema).readonly(),
-  nextCursor: external_exports.string().nullable()
-});
-var KeyEventQueryInput = external_exports.object({
-  deviceId: external_exports.number(),
-  /** Window lower bound (track firstSeen ≥ since). */
-  since: external_exports.number(),
-  /** Window upper bound (track firstSeen ≤ until). */
-  until: external_exports.number(),
-  limit: external_exports.number().int().min(1).max(200).default(50),
-  /** Drop tracks scoring below this importance. */
-  minImportance: external_exports.number().min(0).max(1).optional(),
-  /** Restrict to a single class (e.g. 'person'). */
-  classFilter: external_exports.string().optional()
-});
-var KeyEventSchema = external_exports.object({
-  /** The representative event id (the track's best ObjectEvent, else its trackId). */
-  id: external_exports.string(),
-  trackId: external_exports.string(),
-  /** Track start time (firstSeen). */
-  timestamp: external_exports.number(),
-  className: external_exports.string(),
-  ...TieredLabelFields,
-  importance: external_exports.number(),
-  /** Highest-confidence ObjectEvent id for the track (empty when none). */
-  bestEventId: external_exports.string(),
-  /** Track lifetime in ms (lastSeen - firstSeen). */
-  windowMs: external_exports.number().optional(),
-  ...TrackFlagFields,
-  ...TrackRetrainFields
-});
-var TrackedDetectionSchema = external_exports.object({
-  trackId: external_exports.string(),
-  className: external_exports.string(),
-  confidence: external_exports.number(),
-  bbox: BoundingBoxSchema,
-  zones: external_exports.array(external_exports.string()).readonly(),
-  state: TrackStateSchema
-});
-var OverlayDetectionSchema = external_exports.looseObject({
-  id: external_exports.string(),
-  kind: external_exports.enum(["first-level", "detail"]),
-  macroClass: external_exports.string(),
-  score: external_exports.number(),
-  bbox: external_exports.object({
-    x: external_exports.number(),
-    y: external_exports.number(),
-    width: external_exports.number(),
-    height: external_exports.number()
-  }),
-  labels: external_exports.array(external_exports.looseObject({
-    label: external_exports.string(),
-    score: external_exports.number()
-  })).readonly(),
-  parentId: external_exports.string().optional()
-});
-var ScoredObjectEventSchema = ObjectEventSchema.extend({ score: external_exports.number() });
-var SearchObjectEventsInput = external_exports.object({
-  text: external_exports.string(),
-  deviceId: external_exports.number().optional(),
-  since: external_exports.number().optional(),
-  until: external_exports.number().optional(),
-  classFilter: external_exports.string().optional(),
-  limit: external_exports.number().default(50),
-  minScore: external_exports.number().min(0).max(1).default(0.2)
-});
-var TrackCascadeCountsSchema = external_exports.object({
-  /** Persisted track roots deleted (authoritative). */
-  tracks: external_exports.number().int(),
-  /** Object events removed with their tracks (best-effort; see note above). */
-  events: external_exports.number().int(),
-  /** Track/face/plate-owned media removed (best-effort). Never identity media. */
-  media: external_exports.number().int(),
-  /** Unassigned (non-enrolled) face reads removed (best-effort). */
-  faces: external_exports.number().int(),
-  /** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
-  plates: external_exports.number().int(),
-  /** Per-track CLIP search vectors removed (best-effort). */
-  embeddings: external_exports.number().int(),
-  /** Group membership + group rows removed with their last member (best-effort). */
-  groups: external_exports.number().int()
-});
-var DiskReconcileCountsSchema = external_exports.object({
-  mediaDropped: external_exports.number().int(),
-  tracks: external_exports.number().int(),
-  events: external_exports.number().int()
-});
-var EventStoreDeviceFootprintSchema = external_exports.object({
-  deviceId: external_exports.number(),
-  /** Persisted event rows (motion + object + audio) for the camera. */
-  rows: external_exports.number().int(),
-  /** Event-owned media bytes on disk for the camera. */
-  bytes: external_exports.number().int()
-});
-var EventStoreFootprintSchema = external_exports.object({
-  totalRows: external_exports.number().int(),
-  totalBytes: external_exports.number().int(),
-  devices: external_exports.array(EventStoreDeviceFootprintSchema).readonly()
-});
-var EventPruneCountsSchema = external_exports.object({
-  motion: external_exports.number().int(),
-  object: external_exports.number().int(),
-  audio: external_exports.number().int()
-});
-var RebuildObjectEmbeddingsInput = external_exports.object({
-  /** Restrict to one camera. Omit for the whole fleet. */
-  deviceId: external_exports.number().optional(),
-  since: external_exports.number().optional(),
-  until: external_exports.number().optional(),
-  /** Stop after this many tracks; the result reports whether more remain. */
-  maxTracks: external_exports.number().int().positive().optional(),
-  /**
-  * Run every embedding on THIS node instead of round-robining the fleet.
-  *
-  * Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
-  * field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
-  * calling it that would pin the rebuild REQUEST itself to that node — the
-  * rebuild orchestration lives on the hub, and only the per-track step runs
-  * remotely. This field is data; the per-track pin is applied inside.
-  *
-  * Absent ⇒ round-robin over every online node whose runner can serve the
-  * pinned model.
-  */
-  executeOnNodeId: external_exports.string().optional(),
-  /**
-  * Milliseconds to wait between tracks; omit for the built-in default, `0` to
-  * run flat out.
-  *
-  * A rebuild is bulk maintenance on hub-main's single thread. Measured
-  * 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
-  * pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
-  * force is logged at start and finish so a deliberately slow pass reads
-  * differently from a stalled one.
-  */
-  pacingMs: external_exports.number().int().nonnegative().optional()
-});
-var WipeObjectEmbeddingsResultSchema = external_exports.object({ deleted: external_exports.number() });
-var RebuildObjectEmbeddingsResultSchema = external_exports.object({
-  started: external_exports.boolean(),
-  /** True when a pass was already running; the new request is ignored. */
-  alreadyRunning: external_exports.boolean()
-});
-var RebuildStatusSchema = external_exports.object({
-  running: external_exports.boolean(),
-  scanned: external_exports.number(),
-  rebuilt: external_exports.number(),
-  /** Tracks whose key frame is gone — nothing to re-embed from. */
-  missingKeyFrame: external_exports.number(),
-  /** Tracks with no usable detection box. */
-  missingBbox: external_exports.number(),
-  /**
-  * Tracks an executing node REFUSED rather than broke on — an unreadable key
-  * frame, a step that threw. Separate from `failed` because the remedy is
-  * different, and because a whole camera silently contributing zero vectors
-  * is the shape of failure a rebuild must never hide.
-  */
-  notRunnable: external_exports.number(),
-  /**
-  * The pass stopped because NO node could serve the pinned model.
-  *
-  * Distinct from `notRunnable` on purpose: that one says "this track was
-  * refused", this one says "the cluster cannot do this work at all" — every
-  * candidate node either lacks the `clip-embedding` step, lacks a build of the
-  * pinned model for its engine format, or dropped out. The remedy is a model /
-  * engine change, not a per-camera one. Non-zero here always comes with
-  * `complete: false`.
-  */
-  noCapableNode: external_exports.number(),
-  failed: external_exports.number(),
-  /** Set once a pass ends: true only when EVERYTHING was covered. */
-  complete: external_exports.boolean().nullable(),
-  startedAtMs: external_exports.number().nullable(),
-  finishedAtMs: external_exports.number().nullable(),
-  /** Present when the pass ended by throwing. */
-  error: external_exports.string().nullable()
-});
-var pipelineAnalyticsCapability = {
-  name: "pipeline-analytics",
-  scope: "device",
-  mode: "singleton",
-  kind: "wrapper",
-  defaultActive: true,
-  deviceTypes: [DeviceType.Camera],
-  exposesDeviceSettings: true,
-  methods: {
-    getActiveTracks: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.array(TrackSchema).readonly()),
-    getTrack: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string()
-    }), TrackSchema.nullable()),
-    /** Historical completed tracks for a device. Queried from the
-    *  persisted `pipeline-analytics:tracks` collection; active tracks
-    *  still in RAM are not included. */
-    listTracks: method(external_exports.object({
-      deviceId: external_exports.number(),
-      since: external_exports.number().optional(),
-      until: external_exports.number().optional(),
-      limit: external_exports.number().optional(),
-      /** Spatial filter — only tracks whose trajectory intersects the zone
-      *  (normalized 0..1 rect or polygon). SQL-prefiltered on the persisted
-      *  envelope columns, then precisely tested per position. Tracks with
-      *  an unknown envelope (no frame dims at persist time) always match. */
-      zone: TrackZoneFilterSchema.optional(),
-      /** See {@link TrackProjectionSchema}. Default `full` (backward
-      *  compatible — omitting the field keeps today's exact behaviour). */
-      projection: TrackProjectionSchema.optional(),
-      /** Include stationary-promoted rows (parked objects handed to the
-      *  stationary registry). Default false: the timeline lists passages,
-      *  not parking records (operator decision, 2026-08-15). */
-      includeStationary: external_exports.boolean().optional()
-    }), external_exports.array(TrackSchema).readonly()),
-    /**
-    * Batched cluster-wide track listing — ONE call for the events page /
-    * reel first paint instead of a per-camera `listTracks` fan-out. Merges
-    * the persisted completed tracks of every requested device, sorted by
-    * `lastSeen` DESC with a stable (lastSeen, trackId) cursor. Per-device
-    * indexed pages (`idx_tracks_device_lastSeen`) are k-way merged
-    * provider-side; `projection: 'slim'` drops the heavy `positions[]` /
-    * `snapshots[]` JSON (returned as empty arrays). Active in-RAM tracks
-    * are not included (same contract as `listTracks`).
-    */
-    listRecentTracks: method(RecentTracksQueryInput, RecentTracksPageSchema),
-    /**
-    * Batched co-moving group listing — the Groups feed. Same merge/cursor
-    * contract as {@link listRecentTracks}. A group is a sealed partition of
-    * one session; `getGroup` is the detail with members.
-    */
-    listGroups: method(ListGroupsQueryInput, ListGroupsPageSchema),
-    getGroup: method(external_exports.object({
-      deviceId: external_exports.number(),
-      groupId: external_exports.string().min(1)
-    }), AnalyticsGroupDetailSchema.nullable()),
-    clearTracks: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.void(), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    getMotionEvents: method(DeviceEventQueryInput, external_exports.array(MotionEventSchema).readonly()),
-    getObjectEvents: method(ObjectEventQueryInput, external_exports.array(ObjectEventSchema).readonly()),
-    getAudioEvents: method(DeviceEventQueryInput, external_exports.array(AudioEventSchema).readonly()),
-    /**
-    * Every event kind the device can produce: built-ins (motion + audio),
-    * detection classes actually observed for the device (from the track
-    * history), and sensor kinds contributed by LINKED devices (resolved via
-    * `device-manager.getLinkedDevices`, mapped through `EVENT_KIND_BY_CAP`).
-    */
-    listEventKinds: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.array(EventKindDescriptorSchema).readonly()),
-    /**
-    * The same answer for many cameras in ONE call.
-    *
-    * `listEventKinds` is the slowest per-device query on the hub — measured
-    * at ~100 ms against 6-11 ms for its neighbours — because composing it
-    * costs a `getCameraStatus`, a `getLinkedDevices` and one `getBindings`
-    * per linked device. The viewer asks for it once per camera at first
-    * paint, so twelve cameras paid twelve of those round-trips on top of the
-    * per-camera cost.
-    *
-    * Batched, the camera statuses come from ONE `getCameraStatuses` instead
-    * of N, and the per-device composition runs concurrently.
-    *
-    * Per-device rather than pre-merged on purpose: a caller that renders one
-    * camera's lanes needs to know WHICH camera a kind came from, and merging
-    * is three lines the caller can do. `listEventKinds` stays for
-    * single-device callers.
-    */
-    listEventKindsBatch: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).min(1).max(200) }), external_exports.array(EventKindsForDeviceSchema).readonly()),
-    /**
-    * Sensor-event history for a camera: state changes of LINKED sensor
-    * devices, attributed to the camera at ingest time (one row per linked
-    * camera). Mirrors `getAudioEvents` query semantics; `kinds` narrows to
-    * a kind subset.
-    */
-    getSensorEvents: method(external_exports.object({
-      deviceId: external_exports.number(),
-      since: external_exports.number().optional(),
-      until: external_exports.number().optional(),
-      kinds: external_exports.array(external_exports.string()).optional(),
-      limit: external_exports.number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT)
-    }), external_exports.array(SensorEventSchema).readonly()),
-    /**
-    * Importance-ranked highlights for a device+window. Queries completed
-    * tracks by (deviceId, firstSeen ∈ [since,until]), scores each (or reuses
-    * the persisted score), filters by minImportance/classFilter, orders by
-    * importance desc, and returns up to `limit` compact key events mapped to
-    * each track's best event. Legacy tracks lacking a persisted score are
-    * scored on-read (no write). Degrades to `[]` on error.
-    */
-    getKeyEvents: method(KeyEventQueryInput, external_exports.array(KeyEventSchema).readonly()),
-    /** Server-side bucketed event counts for the 24-hour timeline.
-    *  Returns one entry per non-empty bucket; empty buckets are omitted. */
-    getEventDensity: method(external_exports.object({
-      deviceId: external_exports.number(),
-      since: external_exports.number(),
-      until: external_exports.number(),
-      bucketMs: external_exports.number().int().positive()
-    }), external_exports.array(external_exports.object({
-      bucketStart: external_exports.number(),
-      motion: external_exports.number().int(),
-      object: external_exports.number().int(),
-      audio: external_exports.number().int()
-    })).readonly()),
-    /**
-    * @deprecated Prefer `pruneTracksBefore` — the track is the ROOT of the
-    * analytics model and retention must cascade from it (design §5.1). This
-    * event-only prune leaves orphaned tracks/faces/plates/embeddings behind.
-    * Retained as a compat shim for the Phase-B3 recorder orchestration caller,
-    * which prunes events to keep history aligned with available footage and
-    * reads the per-kind counts. Delete all events (motion + object + audio)
-    * for the given device older than `cutoffMs` (exclusive) + their thumbnails
-    * in lockstep; returns per-kind deleted counts.
-    */
-    pruneEventsBefore: method(external_exports.object({
-      deviceId: external_exports.number(),
-      cutoffMs: external_exports.number()
-    }), external_exports.object({
-      motion: external_exports.number().int(),
-      object: external_exports.number().int(),
-      audio: external_exports.number().int()
-    }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /**
-    * Track-centric retention entry point (design §5.1). Selects every
-    * persisted track for the device whose `lastSeen < cutoffMs` (paged) and
-    * runs the extensible whole-track deletion cascade (design §3): object
-    * events + their media, track/face/plate-owned media, unassigned face
-    * reads, per-track CLIP embeddings, then the track root LAST. ENROLLED
-    * (assigned) faces/plates and `ownerKind:'identity'` media are exempt —
-    * the durable matching gallery always persists. Fires the per-track
-    * live-state cleanup so a pruned track can't linger in dispatch/overlay
-    * state. Returns per-family deleted counts (`tracks` authoritative).
-    *
-    * Replaces `pruneEventsBefore` as the correct time-based retention prune.
-    */
-    pruneTracksBefore: method(external_exports.object({
-      deviceId: external_exports.number(),
-      cutoffMs: external_exports.number()
-    }), TrackCascadeCountsSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /**
-    * Operator "clean slate" for a device (design §5.3): prune EVERY track for
-    * the device via the same cascade as `pruneTracksBefore` with `cutoffMs =
-    * now`. One call per device — no client-side track enumeration. Enrolled
-    * gallery + identity media are exempt (design §4). Returns per-family
-    * deleted counts.
-    */
-    wipeAllAnalytics: method(external_exports.object({ deviceId: external_exports.number() }), TrackCascadeCountsSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /**
-    * Disk-wins reconcile for one camera. Drops media index rows whose blobs
-    * are gone, then cascades tracks (including favourited and staging) that
-    * have no remaining files. Enrolled identity/vehicle/scene media is never
-    * probed. Trackless motion/audio events with no remaining file are dropped,
-    * including snapshot-less rows.
-    */
-    reconcileFromDisk: method(external_exports.object({ deviceId: external_exports.number() }), DiskReconcileCountsSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /**
-    * Delete whole tracks (object events) by id for the given device,
-    * cascading their media in lockstep. Returns the number of tracks
-    * actually deleted plus the ids that could not be removed.
-    *
-    * Operator-driven from the DI Events page (batch delete). Routes through
-    * the same widened track-deletion cascade (design §5.2).
-    */
-    deleteTracks: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackIds: external_exports.array(external_exports.string()).min(1)
-    }), external_exports.object({
-      deleted: external_exports.number().int(),
-      failed: external_exports.array(external_exports.string()).readonly()
-    }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /**
-    * Set the per-track operator flags (`markForTrain`, `debug`, `favourited`) on ONE track.
-    * The patch is PARTIAL — an omitted key is left untouched — because the
-    * three surfaces that write it (admin Events grid, viewer track detail,
-    * viewer cluster detail) each own one toggle and must not clobber the other.
-    *
-    * Writes the track ROW: `markForTrain`/`debug` are per-TRACK state, so they
-    * live where `label` and `importance` live, not in any per-device settings
-    * store. Updates the in-RAM active track too, so a flag set on a live track
-    * survives its expiry-time persist.
-    *
-    * `auth: 'protected'` (the default), NOT `admin`: the viewer is an
-    * authenticated non-admin surface and two of the three call sites are
-    * there. The note that used to sit here said to revisit this the day a flag
-    * gained an effect that costs storage, and D81 is that day — `markForTrain`
-    * now pins. It STAYS protected, and the reason is that the alternative
-    * makes the feature pointless: marking a track is something you do while
-    * looking at it, on the surface you were already looking at it on, and that
-    * surface is the viewer. What the storage cost gets instead is a BOUND — a
-    * per-device pin budget enforced in the body, refusing a new pin past the
-    * limit while always allowing un-marking. `deleteTracks` next door is still
-    * admin, because destroying evidence and preserving it are not symmetric.
-    *
-    * `markForTrain` writes the retrain LIFECYCLE, not a boolean column: `true`
-    * is `none → staging`, `false` is `staging → none`. A track already
-    * `trained` refuses BOTH — its frames are copies inside the retrain dataset
-    * and re-staging it from a generic toggle is how the same material gets
-    * annotated twice under two ground truths. Returning a trained track to
-    * staging is a deliberate action of the retrain page, which is also the only
-    * thing that produces `trained` in the first place.
-    *
-    * Returns the RESOLVED state of both flags (absent → `false`) plus the
-    * `retrainStatus` they were derived from, so a caller can drive its toggle
-    * — and render a `trained` badge — without a re-fetch. Rejects an unknown
-    * track, a new staging mark on a device already holding its full budget, and
-    * any `markForTrain` write against a trained track.
-    */
-    setTrackFlags: method(external_exports.object({
-      /** Log/audit scope only — the trackId is globally unique on its own. */
-      deviceId: external_exports.number(),
-      trackId: external_exports.string(),
-      flags: TrackFlagsPatchSchema
-    }), TrackFlagsSchema, { kind: "mutation" }),
-    /**
-    * Durable event-store footprint for the management UI: event rows
-    * (motion + object + audio) counted per camera + total, plus the
-    * event-owned media bytes on disk per camera + total. Stat/count-based,
-    * computed on demand.
-    */
-    getEventStoreFootprint: method(external_exports.object({}), EventStoreFootprintSchema, {
-      kind: "query",
-      auth: "admin"
-    }),
-    /**
-    * Cluster-wide prune of events older than `olderThanMs` (exclusive) across
-    * every camera, deleting each event's media in lockstep. Logged to the
-    * events ops-log with `reason` (default `'retention'`). Returns the summed
-    * per-kind deleted counts.
-    */
-    pruneEvents: method(external_exports.object({
-      olderThanMs: external_exports.number(),
-      reason: OpsLogReasonSchema.optional()
-    }), EventPruneCountsSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
+var PipelineConfigBridge = external_exports.custom();
+var ConfigUISchemaBridge = external_exports.custom();
+var ConfigUISchemaNullableBridge = external_exports.custom();
+var InferenceCapabilitiesBridge = external_exports.custom();
+var ModelAvailabilityListBridge = external_exports.custom();
+var PipelineRunResultBridge = external_exports.custom();
+var pipelineExecutorCapability = {
+  name: "pipeline-executor",
+  scope: "system",
+  mode: "singleton",
+  methods: {
+    getAvailableEngines: method(external_exports.void(), external_exports.array(PipelineEngineChoiceSchema)),
+    getSelectedEngine: method(external_exports.void(), PipelineEngineChoiceSchema),
+    getDefaultSteps: method(PipelineEngineChoiceSchema, external_exports.array(PipelineDefaultStepSchema)),
     /**
-    * Manually delete EVERY event (motion + object + audio) for one camera and
-    * its event-owned media in lockstep. Logged to the events ops-log as
-    * `op:'manual-delete', reason:'manual'`. Destructive — the admin UI guards
-    * it behind a confirm.
+    * Per-node detection-engine provisioning snapshot. Returns the live
+    * state of the lazy runtime-provisioning machine on `nodeId`
+    * (idle / installing / verifying / ready / failed). The UI pairs this
+    * one-shot query with the `pipeline.engine-provisioning` live event
+    * (emitted on every transition) to drive a per-node "engine ready?"
+    * indicator without polling. Phase 2.
     */
-    deleteDeviceEvents: method(external_exports.object({ deviceId: external_exports.number() }), EventPruneCountsSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /** The events ops-log rows (newest-first), optionally scoped to one camera.
-    *  Backed by a declared pipeline-analytics SQLite collection. */
-    /** Internal migration-participant lease. It drains active MediaStore
-    * writes and refuses new ones without changing analytics bindings. */
-    pauseForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ paused: external_exports.literal(true) }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    resumeForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ resumed: external_exports.literal(true) }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /** Drops cached location roots after the storage coordinator repoints a
-    * default so future event-media writes use the new root. */
-    refreshStorageLocationsForMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ refreshed: external_exports.literal(true) }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    startStorageMigrationMove: method(StorageMigrationMediaMoveInputSchema, external_exports.object({ jobId: external_exports.string() }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    getStorageMigrationMoveStatus: method(external_exports.object({ jobId: external_exports.string() }), RelocateJobSchema.nullable(), { auth: "admin" }),
-    cancelStorageMigrationMove: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+    getEngineProvisioning: method(external_exports.object({ nodeId: external_exports.string() }), EngineProvisioningSchema),
+    getVideoPipelineSteps: method(external_exports.void(), external_exports.record(external_exports.string(), external_exports.object({
+      modelId: external_exports.string(),
+      settings: external_exports.record(external_exports.string(), external_exports.unknown()).readonly()
+    }))),
+    setVideoPipelineSteps: method(external_exports.object({ steps: external_exports.record(external_exports.string(), external_exports.object({
+      modelId: external_exports.string(),
+      settings: external_exports.record(external_exports.string(), external_exports.unknown()).readonly()
+    })) }), external_exports.object({ success: external_exports.literal(true) }), {
       kind: "mutation",
       auth: "admin"
     }),
     /**
-    * Moves event media between locations — the OPERATOR's mover, without the
-    * coordinator's lease. Twin of `recording.relocateFootage`: the same
-    * engine the lease-gated coordinated migration uses
-    * (`startStorageMigrationMove`), armable in the background and WITHOUT
-    * pausing anything. Exists because `eventMedia` was the only storage
-    * class whose only move path went through the recorder's global pause.
+    * Clear THIS node's executor-side PER-DEVICE settings stores (the
+    * per-camera step overrides the object-detection root reads via
+    * `applyDeviceOverridesToTree`). `nodeId` is the ROUTING key — the
+    * generated cap-router strips it (default `nodeIdMode: 'routing'`) and
+    * dispatches to that node, so the provider method runs ON the target
+    * node and receives no `nodeId`.
+    *
+    * This is the slimmed executor leg of the orchestrator's
+    * `resetNodePipelineDefaults` flow (which owns the real reset: node
+    * addonDefaults pins + per-camera orchestrator overrides). The legacy
+    * `resetToDefault` — which reset a persisted global step-tree seed
+    * nothing in the live per-camera path read — was removed together with
+    * that seed.
     */
-    relocateMedia: method(RelocateMediaInputSchema, external_exports.object({ jobId: external_exports.string() }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /** Every relocate job this addon knows about, newest first (in RAM: the
-    *  move is resumable, so a lost list costs nothing but the display). */
-    listRelocateMediaJobs: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
-      kind: "query",
-      auth: "admin"
-    }),
-    /** Cancel a running or queued relocate job. */
-    cancelRelocateMedia: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+    clearDeviceOverrides: method(external_exports.object({ nodeId: external_exports.string() }), external_exports.object({
+      success: external_exports.literal(true),
+      clearedDevices: external_exports.number()
+    }), {
       kind: "mutation",
       auth: "admin"
     }),
-    listOpsLog: method(OpsLogQueryInputSchema, external_exports.array(OpsLogEntrySchema).readonly(), {
-      kind: "query",
-      auth: "admin"
-    }),
     /**
-    * The CHEAP QUESTION, asked before any media moves: how big is the dataset
-    * the marked (`markForTrain`) tracks would produce?
+    * Which of THIS node's inference devices the executor currently refuses,
+    * and why. `nodeId` is the ROUTING key (stripped by the generated router).
     *
-    * Answered from media INDEX rows only — key, kind, size, timestamp — so it
-    * costs ~2 KB of reads per track and no blob reads at all. The measured harm
-    * behind D56 was a bulk pass that read and base64'd every blob a track owned
-    * before deciding anything, taking hub-main to 82 s busy out of 120; an
-    * export is that same I/O shape, so it inherits the same discipline: know
-    * the size, then decide.
+    * The channel that did not exist. Pool health was known only inside the
+    * detection addon and was an input to no routing decision anywhere: the
+    * per-dispatch capability gate is keyed on model FORMAT and so can never
+    * separate `openvino:gpu` from `openvino:npu`, and the orchestrator's live
+    * eligibility probe (`platformProbe.getCapabilities`) answers about
+    * HARDWARE — which was present throughout. So when the hub's `openvino:gpu`
+    * Python worker was SIGABRT'd by the Intel GPU plugin on 2026-08-25, the
+    * balancer went on handing that dead pool cameras by rotation for 31 hours:
+    * ~370 000 `PoolWorker[w0]: not initialized` lines, every frame lost.
     *
-    * `truncated` reports that more marked tracks exist than one pass carries.
-    * Empty `deviceIds` ⇒ every device that has marked tracks.
+    * Read semantics the caller depends on, and which the provider guarantees:
+    * this is a synchronous read of in-memory state. It never probes hardware,
+    * never spawns a pool and never throws — an EMPTY `unhealthy` means "asked,
+    * nothing is refused", which is what re-admits a device. A read that FAILS
+    * (node offline, version skew) must therefore be distinguishable from an
+    * empty answer, and it is: it rejects.
     */
-    getTrainingExportSummary: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).optional() }), TrainingExportSummarySchema, {
-      kind: "query",
-      auth: "admin"
-    }),
+    getInferenceDeviceHealth: method(external_exports.object({ nodeId: external_exports.string() }), external_exports.object({ unhealthy: external_exports.array(external_exports.object({
+      /** `<backend>:<device>`, e.g. `openvino:gpu`. */
+      deviceKey: external_exports.string(),
+      /**
+      * `failed` — the per-device restart budget is exhausted; no pool
+      * will be spawned until an operator re-arms it or the runner
+      * respawns. `backoff` — under budget, waiting out the backoff (or
+      * a cached pool observed dead and not yet condemned).
+      */
+      state: external_exports.enum(["failed", "backoff"]),
+      /** Epoch ms of the death that produced this state. */
+      since: external_exports.number(),
+      /** Pool deaths inside the current window. */
+      deaths: external_exports.number(),
+      /** The last death's message. */
+      lastError: external_exports.string()
+    })).readonly() })),
     /**
-    * Where to download the dataset archive.
-    *
-    * The BYTES do not come back through this cap — they come from the returned
-    * data-plane URL, which streams a tar built entry by entry. A multi-gigabyte
-    * archive base64'd through a unary RPC envelope would be held whole in
-    * memory twice on a hub this repo has already OOM'd once (D9/D18 are the
-    * same lesson about frames). `getDownloadUrl` on `recordingExport` is the
-    * precedent, and this follows it deliberately.
+    * Re-arm a terminally `failed` inference device on `nodeId`: forget its
+    * restart budget so the next dispatch builds a fresh pool.
     *
-    * The archive contains a `manifest.json` FIRST, then the stored media
-    * VERBATIM under `tracks/<deviceId>/<trackId>/…`. No crop is derived and no
-    * model is run: a training set's pixels must be the pixels the pipeline saw.
+    * The terminal state is deliberate (the abort it bounds is deterministic —
+    * an automatic probation would just respawn Python forever, more slowly),
+    * and a terminal state an operator cannot leave is a silent fault. This is
+    * the way out. `rearmed:false` means there was nothing to forget.
     */
-    getTrainingExportUrl: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).optional() }), external_exports.object({ url: external_exports.string() }), {
-      kind: "query",
+    rearmInferenceDevice: method(external_exports.object({
+      nodeId: external_exports.string(),
+      deviceKey: external_exports.string()
+    }), external_exports.object({ rearmed: external_exports.boolean() }), {
+      kind: "mutation",
       auth: "admin"
     }),
+    getSchema: method(external_exports.void(), PipelineSchemaSchema),
+    getGlobalSteps: method(external_exports.void(), external_exports.array(PipelineDefaultStepSchema).readonly().nullable()),
+    getGlobalPipelineConfig: method(external_exports.void(), PipelineConfigBridge),
+    getOrchestratorConfigSchema: method(external_exports.void(), ConfigUISchemaBridge),
     /**
-    * The staging worklist for one camera, or for every camera that has one.
+    * Gate B (pre-init config-correctness gate). PURE COMPUTE against this
+    * node's `currentEngine.format` — resolves `steps` the same way the
+    * runtime dispatch path would, and reports what WOULD happen without
+    * touching any node-global state. Called by the orchestrator at attach
+    * time (`attachOn`), node-pinned to the TARGET node, so config problems
+    * surface BEFORE `pipelineRunner.attachCamera` rather than at the first
+    * per-frame resolve. `ok` is false iff `issues` is non-empty (both
+    * `unknown-addon` and `no-format-build` are HARD issues); `substitutions`
+    * is informational (a degraded-but-loadable model swap) and never
+    * affects `ok`. Never throws.
+    */
+    validatePipeline: method(external_exports.object({ steps: external_exports.array(PipelineStepInputSchema) }), PipelineValidationResultSchema),
+    listTemplates: method(external_exports.void(), external_exports.array(PipelineTemplateSchema$1).readonly()),
+    saveTemplate: method(external_exports.object({
+      name: external_exports.string(),
+      steps: external_exports.array(PipelineTemplateStepSchema).readonly(),
+      engine: PipelineEngineChoiceSchema
+    }), PipelineTemplateSchema$1, { kind: "mutation" }),
+    updateTemplate: method(external_exports.object({
+      id: external_exports.string(),
+      name: external_exports.string().optional(),
+      steps: external_exports.array(PipelineTemplateStepSchema).readonly().optional()
+    }), PipelineTemplateSchema$1, { kind: "mutation" }),
+    deleteTemplate: method(external_exports.object({ id: external_exports.string() }), external_exports.void(), { kind: "mutation" }),
+    getCapabilities: method(external_exports.void(), InferenceCapabilitiesBridge),
+    getAddonModels: method(external_exports.object({ addonId: external_exports.string() }), ModelAvailabilityListBridge),
+    downloadModel: method(external_exports.object({
+      addonId: external_exports.string(),
+      modelId: external_exports.string(),
+      format: ModelFormatSchema$1
+    }), DownloadModelResultSchema, { kind: "mutation" }),
+    deleteModel: method(external_exports.object({
+      addonId: external_exports.string(),
+      modelId: external_exports.string(),
+      format: ModelFormatSchema$1
+    }), external_exports.object({ success: external_exports.literal(true) }), { kind: "mutation" }),
+    /**
+    * Stateless single-frame execution. Callers (runner, benchmark) pass
+    * the complete `engine` + `steps` tree; the executor holds no state
+    * about cameras or saved pipelines.
     *
-    * Fetched ON DEMAND, over the staging set only — the page never scans
-    * history, because making the working set small is the entire purpose of
-    * the mark. Each row carries how many frames the dataset already holds from
-    * the track and how many subjects were annotated on them, so
-    * `frameCount: 0` reads as "still to work" without a second call per track.
+    * `engine` is optional during the migration window to preserve the
+    * legacy call shape used by existing benchmark code; once all
+    * callers pass it explicitly we make it required.
     *
-    * `auth: 'admin'`, unlike the viewer-level mark itself: marking a track is
-    * curation you do while looking at it, but building the training set the
-    * fleet's models are fine-tuned on is not.
+    * Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
+    * `referenceImage` must be provided:
+    *  - `frame`: runtime dispatch path (runner → decoded broker frame).
+    *    Carries the raw buffer, dimensions, and format; the executor
+    *    uses it directly without base64 round-tripping.
+    *  - `frameHandle` (CB5): a zero-pixel shm `FrameHandle` for the SAME
+    *    decoded frame. Both runner and executor are hub-local processes
+    *    sharing `/dev/shm`, so the executor maps the named segment and
+    *    reads the pixels back zero-copy — eliminating the ~1.2MB
+    *    re-serialisation over UDS/MsgPack the `frame` path pays per call.
+    *    High-risk: the FrameRing is a latest-wins seqlock with no
+    *    refcount, so a recycled slot yields a null read; the executor
+    *    then degrades to an empty result and the runner ships pixels via
+    *    `frame` as the fallback (queue-depth gated on the runner side).
+    *  - `imageBase64`: one-shot test path (benchmark ImageTab).
+    *  - `referenceImage`: named file from the reference-image store.
     */
-    listRetrainStaging: method(external_exports.object({
-      /** Empty ⇒ every camera that has staging tracks. A LIST, not a single
-      *  `deviceId`, deliberately: `deviceId` would make this device-bound and
-      *  route it at one camera's owner, and "every camera" would stop being
-      *  expressible at all. */
-      deviceIds: external_exports.array(external_exports.number()).optional(),
-      limit: external_exports.number().int().min(1).max(500).optional()
-    }), external_exports.array(RetrainTrackSchema).readonly(), {
-      kind: "query",
-      auth: "admin"
-    }),
+    runPipeline: method(external_exports.object({
+      engine: PipelineEngineChoiceSchema.optional(),
+      steps: external_exports.array(PipelineStepInputSchema).min(1),
+      frame: FrameInputSchema.optional(),
+      /**
+      * Process-local lazy frame. Valid only when caller and provider resolve
+      * in the same execution-group process; split/cross-node callers use
+      * `frame`/`image` inline compatibility instead.
+      */
+      frameRef: FrameRefSchema.optional(),
+      /**
+      * CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+      * the decoded pixels live in. One more member of the one-of
+      * frame/frameHandle/image/imageBase64/referenceImage group.
+      */
+      frameHandle: FrameHandleSchema.optional(),
+      imageBase64: external_exports.string().optional(),
+      /**
+      * Binary JPEG bytes — preferred over `imageBase64` on internal
+      * hops (hub → forked worker via Moleculer MsgPack) because it
+      * skips the 33% base64 overhead + the per-call base64 decode on
+      * the detection-pipeline worker. Callers can pass either; exactly
+      * one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
+      */
+      image: external_exports.instanceof(Uint8Array).optional(),
+      referenceImage: external_exports.string().optional(),
+      deviceId: external_exports.number().optional(),
+      sessionId: external_exports.string().optional(),
+      /**
+      * Execution plane. 'full' (default) runs the whole tree — benchmark,
+      * reference-image, and detail-subtree calls. 'frame' is the live
+      * per-frame dispatch: ONLY root-plane steps run; crop children
+      * (inputClasses ≠ null) are skipped and served per-track via
+      * pipelineRunner.runDetailSubtree (two-plane design).
+      */
+      plane: external_exports.enum(["full", "frame"]).optional(),
+      /**
+      * Inference-device selector (Phase 2 multi-device). Format
+      * `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
+      * Omitted ⇒ the runner's default device (current single-engine
+      * behaviour). Selects WHICH device pool of the node runs the call.
+      */
+      deviceKey: external_exports.string().optional(),
+      /**
+      * Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+      * when the parent crop was resolved from the frame's retained NATIVE
+      * surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+      * child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+      * resolution from that surface — the SAME quality path faces already
+      * had — instead of the downscaled parent tile. `handle` keys the native
+      * surface (node-pinned to its owner); `cropFrameSpace` is the parent
+      * crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+      * the executor's crop-normalized child ROI back into frame-normalized
+      * coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+      * of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+      * (today's behaviour on the fallback path).
+      */
+      nativeCropRef: NativeCropRefSchema.optional()
+    }), PipelineRunResultBridge, { kind: "mutation" }),
     /**
-    * What a track can contribute, and what it already has.
-    *
-    * `candidates` are the track's whole, unannotated frames — index rows only,
-    * so this is cheap. `copies` are the frames already inside the dataset, and
-    * a candidate whose copy exists is marked `copied: true`: selecting it again
-    * is free and CANNOT fail, whatever became of the original.
+    * Batched run — N raw frames packed into one cap call. The provider
+    * routes the batch through `SharedInferencePool.inferBatch`
+    * (`MSG_INFER_BATCH = 0x03`) so the IPC framing and JSON response
+    * envelope cost is amortised N:1 vs N concurrent `runPipeline`
+    * calls. Single root step + uniform model assumed; trees with crop
+    * children fall back to sequential execution.
     *
-    * A crop, a thumbnail and `fullFrameBoxed` are never candidates. The last
-    * one matters most: it has the model's own rectangle burned into the pixels,
-    * and a detector trained on it learns to find a green line.
+    * Used by `scripts/bench-batch-style.mts` for batch benchmarking —
+    * N frames in one call to amortise per-call IPC overhead.
     */
-    listRetrainFrames: method(external_exports.object({ trackId: external_exports.string() }), RetrainFrameListSchema, {
-      kind: "query",
-      auth: "admin"
-    }),
+    runPipelineBatch: method(external_exports.object({
+      engine: PipelineEngineChoiceSchema.optional(),
+      steps: external_exports.array(PipelineStepInputSchema).min(1),
+      frames: external_exports.array(FrameInputSchema).min(1).max(255),
+      deviceId: external_exports.number().optional(),
+      sessionId: external_exports.string().optional(),
+      /**
+      * Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
+      * the batch to the Python pool's bench preprocess cache
+      * (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
+      * preprocessed ONCE and every later inference is a pure-inference cache
+      * hit — the sustained-throughput run measures inference, not
+      * decode+preprocess+infer. Omitted/0 for live frames (all different →
+      * full preprocess every call, correct). Fresh per sustained run;
+      * released via `uncacheFrame`.
+      */
+      frameId: external_exports.number().int().nonnegative().optional(),
+      /** Inference-device selector (Phase 2 multi-device); see runPipeline. */
+      deviceKey: external_exports.string().optional()
+    }), external_exports.object({ results: external_exports.array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
     /**
-    * COPY-ON-SELECT — the write that makes `trained` safe to evict.
-    *
-    * Selecting a frame copies its bytes into retrain storage immediately: not
-    * a reference, not a lease. Once the copy exists the dataset no longer
-    * depends on the track's media, which is exactly what lets D81 hand a
-    * `trained` track back to retention.
-    *
-    * The order inside is load-bearing and is pinned by a test: an EXISTING
-    * copy is returned without touching the source, so an original that
-    * evaporated blocks the selection of THAT ORIGINAL and never the copy
-    * already taken. Every refusal comes back named — a dropped selection is
-    * never silent, on the wire or in the log.
+    * Cache a raw frame inside the Python inference pool's memory.
+    * Returns a numeric `frameId` that `inferCached` references —
+    * subsequent calls send only 5 bytes through the pipe instead of
+    * 1.2MB raw data, eliminating the pipe transfer bottleneck.
     */
-    selectRetrainFrames: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string(),
-      mediaKeys: external_exports.array(external_exports.string()).min(1)
-    }), RetrainFrameSelectionSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /** Un-select a frame: its annotations go first, then the copy and its blob.
-    *  Deliberately destructive and deliberately explicit — it is the only way
-    *  a frame leaves the dataset before export. */
-    deselectRetrainFrame: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string(),
-      frameId: external_exports.string()
+    cacheFrameInPool: method(external_exports.object({
+      data: external_exports.instanceof(Uint8Array),
+      width: external_exports.number().int().positive(),
+      height: external_exports.number().int().positive(),
+      format: external_exports.enum([
+        "rgb",
+        "bgr",
+        "gray"
+      ])
     }), external_exports.object({
-      removed: external_exports.boolean(),
-      removedAnnotations: external_exports.number().int()
-    }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /**
-    * The pixels of ONE copied frame, base64.
-    *
-    * Through the cap rather than a data plane because it is genuinely one
-    * frame at a time, on demand, at human speed — the shape D9/D18 permit
-    * (what they forbid is frames crossing a boundary at frame RATE). The
-    * annotation canvas needs the image and its exact dimensions in the same
-    * answer: a canvas that places a normalised box against a size it guessed
-    * draws every box in the wrong place.
-    */
-    getRetrainFrameImage: method(external_exports.object({ frameId: external_exports.string() }), external_exports.object({
-      base64: external_exports.string(),
-      width: external_exports.number().int(),
-      height: external_exports.number().int()
-    }), {
-      kind: "query",
-      auth: "admin"
-    }),
+      frameId: external_exports.number(),
+      width: external_exports.number(),
+      height: external_exports.number()
+    }), { kind: "mutation" }),
     /**
-    * Ask the pipeline what it sees, as a PROPOSAL.
-    *
-    * Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
-    * every box comes back as a draft with `source: 'assist'` plus the model and
-    * score that produced it. The operator confirms, edits, adds and deletes;
-    * nothing is stored until `saveRetrainAnnotations`.
-    *
-    * For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
-    * never the whole frame, where a package detector at that threshold proposes
-    * furniture. A package request with no zone is REFUSED rather than widened,
-    * because the silent widening would look like a bad model for as long as
-    * nobody checked which rectangle it ran on.
+    * Run inference on a previously cached frame. Sends only 5 bytes
+    * (model_idx + frameId) through the IPC pipe — eliminates the
+    * ~35ms per-call overhead of transferring 1.2MB raw data.
     */
-    proposeRetrainAnnotations: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string(),
-      frameId: external_exports.string(),
-      subject: RetrainAssistSubjectSchema,
-      /** Which node runs it. Absent ⇒ wherever an unowned call lands. */
-      nodeId: external_exports.string().optional()
-    }), RetrainAssistResultSchema, {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /** Every annotation on a track, oldest first. */
-    listRetrainAnnotations: method(external_exports.object({ trackId: external_exports.string() }), external_exports.array(RetrainAnnotationSchema).readonly(), {
-      kind: "query",
-      auth: "admin"
-    }),
+    inferCached: method(external_exports.object({
+      stepId: external_exports.string(),
+      frameId: external_exports.number().int()
+    }), external_exports.record(external_exports.string(), external_exports.unknown()), { kind: "mutation" }),
     /**
-    * Replace EVERY annotation on one frame with the supplied set.
-    *
-    * Whole-frame replacement, not per-box upsert: the unit of ground truth is
-    * the frame, and "the operator deleted a box" must be the same durable
-    * outcome as "the operator never drew it". A per-box patch would let a frame
-    * keep a box the operator removed on a surface that only knew about the
-    * boxes it sent.
-    *
-    * Refuses a macro class typed into `label` or `subLabel` — the tiers are
-    * separate and the guard is at the WRITE, because a mixed taxonomy cannot
-    * be un-mixed by reading it.
+    * Release a cached frame from the Python pool's memory.
     */
-    saveRetrainAnnotations: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string(),
-      frameId: external_exports.string(),
-      annotations: external_exports.array(RetrainAnnotationDraftSchema)
-    }), external_exports.array(RetrainAnnotationSchema).readonly(), {
-      kind: "mutation",
-      auth: "admin"
-    }),
+    uncacheFrame: method(external_exports.object({ frameId: external_exports.number().int() }), external_exports.void(), { kind: "mutation" }),
+    /** Returns the effective pool tuning (resolved from user overrides + backend defaults). */
+    getEffectiveTuning: method(external_exports.void(), external_exports.object({
+      batchMode: external_exports.string(),
+      windowMs: external_exports.number(),
+      maxBatchSize: external_exports.number(),
+      concurrency: external_exports.number()
+    })),
     /**
-    * Finish with a track: `staging → trained`. **The only writer of that
-    * state** — D81 shipped the column with it deliberately unreachable.
-    *
-    * Refuses a track the dataset holds no copies from. `trained` un-pins the
-    * track's media, so completing without a copy is a delete order for material
-    * nothing ever extracted anything from; that refusal IS the safety argument
-    * of D81, expressed as a precondition.
+    * List every EngineFactory currently loaded in this executor's RAM,
+    * with the models resident and a coarse "in use" marker derived from
+    * ongoing inference activity. Used by the Pipeline page Engines tab.
     */
-    completeRetrainTrack: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string()
-    }), RetrainTransitionResultSchema, {
+    listLoadedEngines: method(external_exports.void(), external_exports.array(external_exports.object({
+      engineKey: external_exports.string(),
+      engine: PipelineEngineChoiceSchema,
+      modelsLoaded: external_exports.array(external_exports.string()).readonly(),
+      inUseByCameras: external_exports.array(external_exports.number()).readonly(),
+      /**
+      * Origin of this resident factory.
+      *  - `runtime`       — main camera-serving engine (no idle TTL).
+      *  - `warm-override` — benchmark/test override held in the warm
+      *                      cache; auto-disposed after the idle TTL.
+      *  - `device-pool`   — a concurrent per-device pool (Phase 2
+      *                      multi-device, keyed by `deviceKey`) resolved
+      *                      via `resolveDeviceFactory`. Runs alongside the
+      *                      `runtime` engine on a DIFFERENT accelerator
+      *                      (NPU / iGPU / Coral) — this is how the
+      *                      Engines tab shows all pools running at once.
+      */
+      kind: external_exports.enum([
+        "runtime",
+        "warm-override",
+        "device-pool"
+      ]),
+      /** Native pid of the underlying Python pool (null when no pool). */
+      poolPid: external_exports.number().nullable(),
+      /** ms since this factory was last used (null when not warm-tracked). */
+      idleMs: external_exports.number().nullable(),
+      /** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
+      idleTtlMs: external_exports.number().nullable()
+    })).readonly()),
+    /** Warm up an engine without running a frame. No-op if already loaded. */
+    spinEngine: method(external_exports.object({ engine: PipelineEngineChoiceSchema }), external_exports.object({ success: external_exports.literal(true) }), {
       kind: "mutation",
       auth: "admin"
     }),
     /**
-    * The deliberate return: `trained → staging`, for the rare case.
-    *
-    * The generic `setTrackFlags` toggle refuses this in both directions by
-    * design (D81) — re-staging from a checkbox is how the same material gets
-    * annotated twice under two ground truths. Doing it here means the operator
-    * is looking at the annotations that already exist while they decide, and
-    * those annotations are LEFT ALONE: "put this back" must not be a
-    * destructive act wearing a navigational name.
+    * Unload an engine from RAM. `force:true` unloads even when cameras
+    * are actively using it (they re-spin on next frame). Default is
+    * gated — returns `{success:false, reason}` when in use.
     */
-    restageRetrainTrack: method(external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string()
-    }), RetrainTransitionResultSchema, {
+    killEngine: method(external_exports.object({
+      engine: PipelineEngineChoiceSchema,
+      force: external_exports.boolean().optional()
+    }), external_exports.object({
+      success: external_exports.boolean(),
+      reason: external_exports.string().optional()
+    }), {
       kind: "mutation",
       auth: "admin"
     }),
-    /**
-    * Where to download the ANNOTATED dataset.
-    *
-    * The sibling of `getTrainingExportUrl` and deliberately not the same
-    * archive: that one streams a marked track's stored media verbatim, this one
-    * streams the retrain COPIES plus an `annotations.json` carrying, for every
-    * subject, the canonical full-frame box AND the geometry derived for each
-    * model shape (letterboxed root / zone-cropped package / subject-cropped
-    * classifier). Derived at export, never stored — one box in, three shapes
-    * out, so two crops of the same subject can never end up in one feature
-    * space (D52).
-    */
-    getRetrainExportUrl: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).optional() }), external_exports.object({ url: external_exports.string() }), {
-      kind: "query",
+    listReferenceImages: method(external_exports.void(), external_exports.array(ReferenceImageEntrySchema).readonly()),
+    getReferenceImage: method(external_exports.object({ filename: external_exports.string() }), ReferenceImageBodySchema.nullable()),
+    getReferenceAudioFiles: method(external_exports.void(), external_exports.array(ReferenceAudioEntrySchema).readonly()),
+    getReferenceAudio: method(external_exports.object({ filename: external_exports.string() }), ReferenceAudioBodySchema.nullable()),
+    getAudioCapabilities: method(external_exports.void(), AudioCapabilitiesSchema),
+    runAudioTest: method(external_exports.object({
+      addonId: external_exports.string(),
+      modelId: external_exports.string(),
+      filename: external_exports.string().optional(),
+      settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+    }), AudioTestResultSchema, { kind: "mutation" }),
+    getDetectionConfigSchema: method(external_exports.void(), ConfigUISchemaNullableBridge)
+  }
+};
+var ZoneRuleModeEnum = external_exports.enum(["include", "exclude"]);
+var ZoneRuleSchema = external_exports.object({
+  /** Stable rule id — survives edits, used by the UI for diffing. */
+  id: external_exports.string(),
+  /** Optional human-readable label rendered in the rule editor. */
+  name: external_exports.string().optional(),
+  /** Zones this rule targets. The rule's `mode` applies to ALL
+  *  listed zones (OR-set: a detection in any one of them counts).
+  *  At least one zone id required — a rule with no targets is a
+  *  configuration mistake and the form validator rejects it. */
+  zoneIds: external_exports.array(external_exports.string()).min(1).readonly(),
+  mode: ZoneRuleModeEnum,
+  /**
+  * Class names this rule applies to. Empty / undefined ⇒ rule
+  * applies to every class. Class strings match the `macroClass`
+  * field on detections (e.g. `person`, `car`, `dog`).
+  */
+  classFilter: external_exports.array(external_exports.string()).readonly().optional(),
+  /**
+  * Minimum bbox/mask overlap (0–1) with any of the rule's zones
+  * required to consider an entity "in the zone". Defaults to the
+  * consumer's stage default when omitted. Kept for back-compat with
+  * existing per-rule overrides; new operators pick the value via
+  * `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
+  * set, the lower-level engine reads it as a 0–1 fraction.
+  */
+  overlapThreshold: external_exports.number().min(0).max(1).optional(),
+  /**
+  * Operator-friendly version of `overlapThreshold` — the percentage
+  * of the detection's bbox that must lie inside the zone for the
+  * rule to match. Documented default is 85%; the engine substitutes
+  * that when the field is omitted (kept optional so existing rules
+  * stored without it stay valid).
+  *
+  * When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
+  * rule, the engine prefers `bboxInclusionPct` because it's the
+  * field exposed in the UI. Internally both feed the same gate.
+  */
+  bboxInclusionPct: external_exports.number().min(0).max(100).optional(),
+  /**
+  * When `true` and a detection has a segmentation mask, use the
+  * mask for overlap instead of the bbox. Detection-stage only;
+  * motion rules ignore this field.
+  */
+  preferMask: external_exports.boolean().optional(),
+  /**
+  * Soft-toggle: `false` disables the rule without deleting it.
+  * Defaults to `true` so operators creating a rule via the UI
+  * see it active immediately.
+  */
+  enabled: external_exports.boolean().default(true)
+});
+var ZoneRulesArraySchema = external_exports.array(ZoneRuleSchema).readonly();
+var ZoneKindEnum = external_exports.enum(["polygon", "tripwire"]);
+var PolygonPointSchema = external_exports.object({
+  x: external_exports.number(),
+  y: external_exports.number()
+});
+var ZoneSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  kind: ZoneKindEnum.default("polygon"),
+  /** Polygon vertices, fraction of frame (0–1). */
+  polygon: external_exports.array(PolygonPointSchema).readonly(),
+  /** Visual color for UI rendering. */
+  color: external_exports.string().default("#3b82f6")
+});
+var zonesCapability = {
+  name: "zones",
+  scope: "device",
+  mode: "singleton",
+  deviceTypes: [DeviceType.Camera],
+  methods: {
+    listZones: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.array(ZoneSchema).readonly()),
+    addZone: method(external_exports.object({
+      deviceId: external_exports.number(),
+      zone: ZoneSchema
+    }), external_exports.void(), {
+      kind: "mutation",
       auth: "admin"
     }),
-    getEventMedia: method(external_exports.object({
-      eventId: external_exports.string(),
-      kind: MediaFileKindEnum.optional(),
-      deviceId: external_exports.number()
-    }), external_exports.array(MediaFileSchema).readonly()),
-    /** All media rows owned by a track. `kinds` narrows to a kind subset so a
-    *  client can fetch the SMALL display variants on open and pull the
-    *  multi-MB native variants only on demand (mirrors `getEventMedia.kind`).
-    *  Absent ⇒ every kind (back-compat). */
-    getTrackMedia: method(external_exports.object({
-      trackId: external_exports.string(),
-      kinds: external_exports.array(MediaFileKindEnum).optional(),
-      deviceId: external_exports.number()
-    }), external_exports.array(MediaFileSchema).readonly()),
-    /**
-    * What media a track HAS, without any of it.
-    *
-    * The detail view needs the shape of a track's media to build its strip —
-    * which kinds exist, in what order, at what size — and then wants each tile
-    * fetched as an image, not as base64 inside this response. Measured: the
-    * full `getTrackMedia` is 5.3-7.7 MB and blocks the view; this manifest is
-    * ~2 KB.
-    *
-    * It also restores a fact a `kinds` filter destroys: filtering
-    * `getTrackMedia` drops whole ROWS, taking `kind` and `sizeBytes` with
-    * them, so a client that fetched only the small variants could no longer
-    * tell a full-resolution variant existed — and the affordance that opens it
-    * would silently disappear.
-    */
-    listTrackMedia: method(external_exports.object({
-      trackId: external_exports.string(),
-      deviceId: external_exports.number()
-    }), external_exports.array(MediaFileInfoSchema).readonly()),
-    /**
-    * Search object events by text query using CLIP cosine similarity.
-    * Encodes `text` via the `embedding-encoder` cap, queries the
-    * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
-    * embeddings by cosine similarity, and joins winners to their
-    * ObjectEvents by trackId. Returns up to `limit` events scored ≥
-    * `minScore`, sorted descending by score.
-    */
-    searchObjectEvents: method(SearchObjectEventsInput, external_exports.array(ScoredObjectEventSchema).readonly()),
-    wipeObjectEmbeddings: method(external_exports.object({}), WipeObjectEmbeddingsResultSchema, {
+    removeZone: method(external_exports.object({
+      deviceId: external_exports.number(),
+      zoneId: external_exports.string()
+    }), external_exports.void(), {
       kind: "mutation",
       auth: "admin"
     }),
-    rebuildObjectEmbeddings: method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+    updateZone: method(external_exports.object({
+      deviceId: external_exports.number(),
+      zone: ZoneSchema
+    }), external_exports.void(), {
       kind: "mutation",
       auth: "admin"
-    }),
-    getObjectEmbeddingRebuildStatus: method(external_exports.object({}), RebuildStatusSchema)
+    })
   },
-  events: {
-    /**
-    * Enriched frame emitted after refinement — the live-overlay source of
-    * truth (two-plane re-injection). Carries the frame's detections in the
-    * `ObjectDetection` wire shape: first-level roots (with track info +
-    * enrichment labels) plus synthesized `kind:'detail'` face/plate entries
-    * re-projected from per-track detail state, so stream overlays render
-    * boxes + recognized names without querying full Track state.
-    */
-    onFrameTracked: { data: external_exports.object({
-      deviceId: external_exports.number(),
-      timestamp: external_exports.number(),
-      frameWidth: external_exports.number(),
-      frameHeight: external_exports.number(),
-      detections: external_exports.array(OverlayDetectionSchema).readonly()
-    }) },
-    /** Track entered active state (first-seen). */
-    onTrackStarted: { data: external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string(),
-      className: external_exports.string()
-    }) },
-    /** Track expired (TTL reached after last detection). */
-    onTrackEnded: { data: external_exports.object({
-      deviceId: external_exports.number(),
-      trackId: external_exports.string(),
-      className: external_exports.string(),
-      durationMs: external_exports.number()
-    }) },
-    /** Canonical "something happened at device X" event, per-kind. */
-    onDetectionEvent: { data: external_exports.object({
-      deviceId: external_exports.number(),
-      kind: EventKindSchema,
-      eventId: external_exports.string(),
-      timestamp: external_exports.number()
-    }) }
-  }
+  /**
+  * Runtime-state slice — the live zone catalogue mirrored by the
+  * orchestrator on every CRUD mutation. Consumers read via
+  * `device.state.zones.value` / `.watch(...)` without round-tripping
+  * the cap, and the codegen DeviceProxy auto-wires the reactive
+  * handle. Slice shape is `{ zones: Zone[] }` so future extensions
+  * (e.g. zone groupings) can sit alongside the polygon list.
+  */
+  runtimeState: external_exports.object({ zones: external_exports.array(ZoneSchema).readonly() }),
+  /**
+  * Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
+  *
+  * See `RuntimeStateDurability`. Enforced by
+  * `scripts/check-runtime-state-durability.ts`.
+  */
+  durability: "restored"
+};
+var TrackStateSchema = external_exports.enum([
+  "new",
+  "entered",
+  "left",
+  "moving",
+  "idle"
+]);
+var EventKindSchema = external_exports.enum([
+  "motion",
+  "object",
+  "audio"
+]);
+var TrackZoneFilterSchema = external_exports.discriminatedUnion("kind", [MaskRectShapeSchema, MaskPolygonShapeSchema]);
+var EventKindIconSchema = external_exports.enum([
+  "motion",
+  "audio",
+  "person",
+  "vehicle",
+  "animal",
+  "door",
+  "pir",
+  "smoke",
+  "water",
+  "button",
+  "package",
+  "generic"
+]);
+var EventKindCategorySchema = external_exports.enum([
+  "motion",
+  "audio",
+  "detection",
+  "sensor",
+  "control",
+  "custom",
+  "package"
+]);
+var EventKindLevelSchema = external_exports.enum(["macro", "sub"]);
+var EventKindDescriptorSchema = external_exports.object({
+  /** Stable kind id (e.g. 'motion', 'vehicle', 'car', 'lock'). */
+  kind: external_exports.string(),
+  /** i18n key resolved on the UI side; `label` is the English fallback. */
+  labelKey: external_exports.string(),
+  /** English fallback label (kept for clients that don't translate). */
+  label: external_exports.string(),
+  /** Hex color for timeline/legend rendering. */
+  color: external_exports.string(),
+  /** Dictionary id → lucide component on the UI side. */
+  iconId: external_exports.string(),
+  /** Legacy closed-vocab glyph — fallback for `iconId`. */
+  icon: EventKindIconSchema,
+  category: EventKindCategorySchema,
+  /** Macro parent for this kind ('car' → 'vehicle'); null for a macro. */
+  parentKind: external_exports.string().nullable(),
+  /** Derived from `parentKind`, explicit for the client tree. */
+  level: EventKindLevelSchema,
+  /** Which cap + device contributes this kind. For built-ins the camera
+  *  itself; for sensor kinds the LINKED source device. */
+  source: external_exports.object({
+    capName: external_exports.string(),
+    deviceId: external_exports.number()
+  })
+});
+var EventKindsForDeviceSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  kinds: external_exports.array(EventKindDescriptorSchema).readonly()
+});
+var SensorEventSchema = external_exports.object({
+  id: external_exports.string(),
+  /** The CAMERA the event is attributed to (a sensor linked to N cameras
+  *  yields N rows, one per camera). */
+  deviceId: external_exports.number(),
+  /** The linked sensor device whose state changed. */
+  sourceDeviceId: external_exports.number(),
+  /** Event kind id — matches an `EventKindDescriptor.kind`. */
+  kind: external_exports.string(),
+  /** Snapshot of the sensor cap's runtime-state slice at the change. */
+  value: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
+  timestamp: external_exports.number()
+});
+var TrackPositionSchema = external_exports.object({
+  x: external_exports.number(),
+  y: external_exports.number(),
+  timestamp: external_exports.number(),
+  bbox: BoundingBoxSchema
+});
+var TrackSnapshotSchema = external_exports.object({
+  timestamp: external_exports.number(),
+  position: TrackPositionSchema,
+  /** MediaStore key; resolve via `getTrackMedia({ trackId })`. */
+  mediaKey: external_exports.string()
+});
+var TrackEnvelopeSchema = external_exports.object({
+  minX: external_exports.number(),
+  minY: external_exports.number(),
+  maxX: external_exports.number(),
+  maxY: external_exports.number()
+});
+var TrackProjectionSchema = external_exports.enum(["full", "slim"]);
+var TrackAudioLabelSchema = external_exports.object({
+  label: external_exports.string(),
+  /** Highest classification score observed across the label's episodes. */
+  peakScore: external_exports.number(),
+  /** Number of coalesced audio-event episodes carrying this label. */
+  count: external_exports.number(),
+  firstAt: external_exports.number(),
+  lastAt: external_exports.number()
+});
+var TrackSourceSchema = external_exports.enum([
+  "pipeline",
+  "sensor",
+  "audio"
+]);
+var RetrainStatusSchema = external_exports.enum([
+  "none",
+  "staging",
+  "trained"
+]);
+var TrackFlagFields = {
+  /** Operator marked this track as training material — i.e. `retrainStatus` is
+  *  `'staging'`. */
+  markForTrain: external_exports.boolean().optional(),
+  /** Operator marked this track for diagnostic attention. */
+  debug: external_exports.boolean().optional(),
+  /** Operator favourited this track. Pins it against pruning. */
+  favourited: external_exports.boolean().optional()
+};
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+var TrackFlagsPatchSchema = external_exports.object(TrackFlagFields);
+var TrackFlagsSchema = external_exports.object({
+  trackId: external_exports.string(),
+  markForTrain: external_exports.boolean(),
+  debug: external_exports.boolean(),
+  favourited: external_exports.boolean(),
+  /** The lifecycle state the boolean was derived from. Required here (unlike on
+  *  a track row) because this shape is only ever produced by the write body,
+  *  which always knows it — and a surface that has just written needs to render
+  *  `trained` without a re-fetch. */
+  retrainStatus: RetrainStatusSchema
+});
+var LabelTierSchema = external_exports.union([external_exports.literal(1), external_exports.literal(2)]);
+var LabelAttributionSchema = external_exports.object({
+  stepId: external_exports.string(),
+  modelId: external_exports.string().optional(),
+  decidedAt: external_exports.number(),
+  /**
+  * The GALLERY id behind a recognised tier-2 label — a face-gallery
+  * `Identity.id` or a plate-gallery `Vehicle.id` (both `randomUUID`).
+  *
+  * The text alone is a DISPLAY NAME, and a display name is renameable: a
+  * notification rule authored on "Gianluca" stopped matching the moment the
+  * operator fixed the spelling in the gallery, and nothing said so. The id is
+  * the thing that does not move, so it is what a rule matches on
+  * (`NcConditions.identities`) and the text is what a human is shown.
+  *
+  * Absent when the label names no gallery row — a plate the OCR read but no
+  * vehicle claims, a sub-class, a species, any tier-1 value.
+  */
+  identityId: external_exports.string().optional()
+});
+var TieredLabelFields = {
+  /** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
+  label: external_exports.string().optional(),
+  /** Confidence of the tier-1 value, as reported by the deciding step. */
+  labelScore: external_exports.number().optional(),
+  /** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
+  labelMeta: LabelAttributionSchema.optional(),
+  /** Tier 2 — the instance. See {@link LabelTierSchema}. */
+  subLabel: external_exports.string().optional(),
+  /** Confidence of the tier-2 value, as reported by the deciding step. */
+  subLabelScore: external_exports.number().optional(),
+  /** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
+  subLabelMeta: LabelAttributionSchema.optional()
+};
+var TrainingExportDeviceTotalsSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  tracks: external_exports.number().int(),
+  files: external_exports.number().int(),
+  bytes: external_exports.number().int()
+});
+var TrainingExportSummarySchema = external_exports.object({
+  generatedAt: external_exports.number(),
+  trackCount: external_exports.number().int(),
+  fileCount: external_exports.number().int(),
+  byteCount: external_exports.number().int(),
+  /** More marked tracks exist than a single pass carries. */
+  truncated: external_exports.boolean(),
+  devices: external_exports.array(TrainingExportDeviceTotalsSchema).readonly()
+});
+var TrackSchema = external_exports.object({
+  trackId: external_exports.string(),
+  deviceId: external_exports.number(),
+  className: external_exports.string(),
+  ...TieredLabelFields,
+  producingDeviceName: external_exports.string().optional(),
+  /** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
+  source: TrackSourceSchema.optional(),
+  firstSeen: external_exports.number(),
+  lastSeen: external_exports.number(),
+  /** Frame-rate position history (subject to maxPositionHistory cap). */
+  positions: external_exports.array(TrackPositionSchema).readonly(),
+  /** Periodic snapshots at snapshotIntervalMs cadence (subject to
+  *  saveThumbnails policy). */
+  snapshots: external_exports.array(TrackSnapshotSchema).readonly(),
+  /** Deduplicated zones the track has entered at least once. Zone IDS. */
+  zonesVisited: external_exports.array(external_exports.string()).readonly(),
+  /**
+  * Human NAMES for {@link zonesVisited}, resolved at READ time against the
+  * `zones` capability.
+  *
+  * `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
+  * and no card can render — so every free-text search surface was structurally
+  * unable to answer "show me the tracks in Uscio", and did not fail loudly, it
+  * just returned nothing. Resolving here rather than in each client keeps ONE
+  * derivation and costs the clients no extra call (the `zones` cap is
+  * per-device, so a client-side resolve would be a per-camera fan-out on a
+  * surface built to avoid exactly that).
+  *
+  * Resolved, never invented: a zone deleted since the track was written has no
+  * name and is DROPPED, so this array can be shorter than `zonesVisited` — the
+  * two are not positionally aligned. Absent when the track visited no zone, or
+  * when the zone catalogue could not be read.
+  */
+  zoneNames: external_exports.array(external_exports.string()).readonly().optional(),
+  /** Deduplicated set of detector classes observed for this track over its
+  *  life (a track may be reclassified, e.g. person→vehicle). Absent on
+  *  legacy rows written before class accumulation shipped. */
+  classes: external_exports.array(external_exports.string()).readonly().optional(),
+  /** Cumulative normalized distance travelled (0..1 units = full frame width). */
+  totalDistance: external_exports.number(),
+  state: TrackStateSchema,
+  active: external_exports.boolean(),
+  /** Deterministic key-event importance score in [0,1] (server-computed at
+  *  track expiry, recomputed on late label). Absent on legacy rows written
+  *  before scoring shipped — consumers degrade to absence / compute-on-read. */
+  importance: external_exports.number().optional(),
+  /** Id of the track's highest-confidence ObjectEvent (its representative
+  *  "best" frame). Absent when the track produced no object events. */
+  bestEventId: external_exports.string().optional(),
+  /** Tag of the importance sub-signal that dominated the score
+  *  (identity|dwell|proximity|class|confidence|travel|zone). */
+  importanceReason: external_exports.string().optional(),
+  /** Audio-classification labels heard on the camera during the track's
+  *  life (score ≥ device `classificationMinScore`), aggregated per label.
+  *  Absent on legacy rows / tracks with no confident audio. */
+  audioLabels: external_exports.array(TrackAudioLabelSchema).readonly().optional(),
+  /** Normalized 0..1 trajectory envelope (see {@link TrackEnvelopeSchema}).
+  *  Populated from the persisted envelope columns on historical reads;
+  *  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
+  envelope: TrackEnvelopeSchema.optional(),
+  /**
+  * A face DETECTOR found a face on this track — nothing more. It says the
+  * detail plane produced a `face` detail; it does NOT say the face was
+  * embedded, matched, above `minFacePx`, or that the recognizer was even
+  * enabled. Set once and never cleared.
+  *
+  * **This exists so "face present but not recognised" is expressible.** A
+  * recognised identity lands in `subLabel` (attributed to the face chain via
+  * `subLabelMeta.stepId`), so before this field a track with an unmatched face
+  * and a track with no face at all were byte-identical on the wire and no
+  * surface could tell them apart. The read is `hasFace === true && subLabel
+  * === undefined`.
+  *
+  * **Absent ≠ false.** Every row written before the column existed omits it,
+  * and so does every server that predates the field — a consumer must test
+  * `=== true` and render nothing otherwise, never infer "no face".
+  */
+  hasFace: external_exports.boolean().optional(),
+  /**
+  * This track has a face row IN THE GALLERY: a crop **and** an embedding — a
+  * face an operator could ASSIGN to an identity.
+  *
+  * The STRICT twin of {@link hasFace}, and the pair only earns its keep
+  * because the two disagree. `hasFace` is stamped at the TOP of the face
+  * branch, before every gate, and means no more than "a face detector produced
+  * a face detail". This one is stamped at the single moment the gallery row
+  * LANDS — after `FaceRecognizer.onTrackEnd` successfully persists it, i.e.
+  * past the embedding-magnitude verdict, the `minFacePx` detection gate, the
+  * candidate gate, the imageless-track drop (no crop was ever captured) and
+  * the crop-store drop. Everything between the detector and that insert can
+  * legitimately refuse the face, so a flag written any earlier promises the
+  * operator something to assign and delivers nothing.
+  *
+  * **Independent of recognition.** A face collected but never auto-matched is
+  * still assignable — it is in fact the face an operator most wants to reach —
+  * so this is NOT gated on `recognizedIdentityId`. Recognition lands in
+  * `subLabel`; this says only that the raw material exists.
+  *
+  * **Set once, never cleared.** A track that produced a gallery row produced
+  * one; deleting the row later is the gallery's business, not this flag's.
+  *
+  * **Absent ≠ false**, the same rule as {@link hasFace}: every row written
+  * before the column omits it, and so does every server that predates the
+  * field. A consumer must test `=== true` and render nothing otherwise —
+  * never infer "no assignable face".
+  */
+  hasEmbeddedFace: external_exports.boolean().optional(),
+  /**
+  * This subject CONTAINS a folded rider — a person the rider-pairing step
+  * ([D34](../decisions/adr-0034.md)) removed from the frame BEFORE the tracker,
+  * so the passage is tracked once and as a VEHICLE.
+  *
+  * It exists because the fold's record was dishonest. D34 and the code both
+  * said "the person is not lost — it is reported so both entities stay on the
+  * record"; in fact the pair went into a per-processor RAM field behind an
+  * accessor nobody called, and every durable surface said `vehicle`, full
+  * stop. This is the composition note that makes the row true.
+  *
+  * A COMPOSITION, never a class and never a label. "This vehicle contains a
+  * person" is not an answer to "what is this" — both label tiers would refuse
+  * a macro token anyway (D89), and correctly. Nothing here changes what the
+  * subject IS: a cyclist stays one vehicle track, occupancy still counts one,
+  * and a `person` rule still does not fire for someone cycling past.
+  *
+  * **Absent ≠ false**, exactly like {@link hasFace}: every row written before
+  * the column, and every hub that predates the field, omits it. Test
+  * `=== true` and render nothing otherwise — never infer "no rider".
+  */
+  hasRider: external_exports.boolean().optional(),
+  ...TrackFlagFields,
+  ...TrackRetrainFields
+});
+var BaseEventFields = {
+  id: external_exports.string(),
+  deviceId: external_exports.number(),
+  timestamp: external_exports.number()
 };
-var NativeCropRefSchema = external_exports.object({
-  /** Handle keying the retained native surface (node-pinned to its owner). */
-  handle: FrameHandleSchema,
-  /** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
-  cropFrameSpace: external_exports.object({
-    x: external_exports.number(),
-    y: external_exports.number(),
-    w: external_exports.number(),
-    h: external_exports.number()
-  })
+var MotionEventSchema = external_exports.object({
+  ...BaseEventFields,
+  kind: external_exports.literal("motion"),
+  regionCount: external_exports.number(),
+  /** Heavy JSON array — omitted in slim projection. */
+  regions: external_exports.array(external_exports.object({
+    bbox: BoundingBoxSchema,
+    pixelCount: external_exports.number(),
+    intensity: external_exports.number()
+  })).readonly().optional(),
+  /** Omitted in slim projection. */
+  frameWidth: external_exports.number().optional(),
+  /** Omitted in slim projection. */
+  frameHeight: external_exports.number().optional(),
+  /** Populated by B5 (recording playback URL for this event). */
+  mediaUrl: external_exports.string().optional()
 });
-external_exports.object({
-  crop: external_exports.object({
-    left: external_exports.number(),
-    top: external_exports.number(),
-    width: external_exports.number().positive(),
-    height: external_exports.number().positive()
+var DetectionSourceSchema = external_exports.enum(["pipeline", "onboard"]);
+var ZoneCrossingDirectionSchema = external_exports.enum(["enter", "exit"]);
+var ZoneCrossingSchema = external_exports.object({
+  direction: ZoneCrossingDirectionSchema,
+  /** Admin zone id crossed. */
+  zoneId: external_exports.string(),
+  /** Zone display name at crossing time (falls back to the id). */
+  zoneName: external_exports.string().optional()
+});
+var ObjectEventSchema = external_exports.object({
+  ...BaseEventFields,
+  kind: external_exports.literal("object"),
+  /** Detection source. Optional for backward-compat; absent ⇒ `pipeline`. */
+  source: DetectionSourceSchema.optional(),
+  /**
+  * Inference-frame id shared by every object event emitted from the SAME frame
+  * — the "scene/parent" key. Lets a consumer group co-occurring detections (e.g.
+  * 2 people + 1 dog) under one full frame, and link a track's frames over time
+  * (group by `trackId`, pick a representative `frameId` as the parent frame).
+  * Optional for backward-compat with pre-existing rows / the slim projection
+  * includes it (it is light). Absent on rows written before this field.
+  */
+  frameId: external_exports.string().optional(),
+  /** Omitted in slim projection. */
+  trackId: external_exports.string().optional(),
+  className: external_exports.string(),
+  ...TieredLabelFields,
+  /** Omitted in slim projection. */
+  confidence: external_exports.number().optional(),
+  /** Heavy JSON — omitted in slim projection. */
+  bbox: BoundingBoxSchema.optional(),
+  /** Heavy JSON — omitted in slim projection. */
+  zones: external_exports.array(external_exports.string()).readonly().optional(),
+  /** Omitted in slim projection. */
+  state: TrackStateSchema.optional(),
+  /**
+  * The zone crossing this event IS, when it is one. Absent on every other
+  * event kind (movement state, appearance, package) — see
+  * {@link ZoneCrossingSchema}. Omitted in slim projection.
+  */
+  zoneCrossing: ZoneCrossingSchema.optional(),
+  /** Detection-frame dimensions in pixels — let consumers normalize the
+  *  pixel-space `bbox` onto a displayed image. Omitted in slim projection. */
+  frameWidth: external_exports.number().optional(),
+  frameHeight: external_exports.number().optional(),
+  /** MediaStore key for the crop attached to this event (if any). */
+  mediaKey: external_exports.string().optional(),
+  /** Design B: MediaStore key of the track's native-resolution key frame (the
+  *  best-detection full frame). Resolve via the event-media data-plane
+  *  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`) for a detail view that
+  *  draws `bbox` over the native frame. Absent on legacy rows / non-decoded
+  *  sources — consumers fall back to `mediaKey` (the tight crop). */
+  keyFrameMediaKey: external_exports.string().optional(),
+  /** Populated by B5 (recording playback URL for this event). */
+  mediaUrl: external_exports.string().optional(),
+  /** The parent track's key-event importance [0,1], propagated to every object
+  *  event of the track (so an event row can be sorted by importance without a
+  *  track join). Absent on legacy rows / before the track was scored. */
+  importance: external_exports.number().optional()
+});
+var AudioEventSchema = external_exports.object({
+  ...BaseEventFields,
+  kind: external_exports.literal("audio"),
+  rms: external_exports.number(),
+  dbfs: external_exports.number(),
+  classification: external_exports.object({
+    className: external_exports.string(),
+    originalClass: external_exports.string().optional(),
+    score: external_exports.number()
   }).optional(),
-  content: external_exports.object({
-    width: external_exports.number().int().positive(),
-    height: external_exports.number().int().positive()
-  }),
-  fit: external_exports.enum(["stretch", "contain"]),
-  format: external_exports.enum([
-    "rgb",
-    "gray",
-    "jpeg"
-  ])
+  /** Populated by B5 (recording playback URL for this event). */
+  mediaUrl: external_exports.string().optional()
 });
-var FrameRefSchema = external_exports.object({
-  registryId: external_exports.string().min(1),
-  id: external_exports.string().min(1),
-  width: external_exports.number().int().positive(),
-  height: external_exports.number().int().positive(),
-  format: external_exports.enum(["rgb", "gray"]),
+var MediaFileKindEnum = external_exports.enum([
+  "crop",
+  "thumbnail",
+  "snapshot",
+  "firstFrame",
+  "lastFrame",
+  "fullFrame",
+  "fullFrameBoxed",
+  "faceCrop",
+  "plateCrop",
+  "keyFrame",
+  "keyFrameSmall",
+  "thumbnailSmall"
+]);
+var MediaFileSchema = external_exports.object({
+  key: external_exports.string(),
+  kind: MediaFileKindEnum,
+  base64: external_exports.string(),
+  sizeBytes: external_exports.number(),
+  timestamp: external_exports.number()
+});
+var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
+var RetrainMacroClassSchema = external_exports.enum([
+  "person",
+  "vehicle",
+  "animal",
+  "package",
+  "face",
+  "plate"
+]);
+var RetrainAnnotationKindSchema = external_exports.enum(["subject", "model_error"]);
+var RetrainAnnotationSourceSchema = external_exports.enum(["operator", "assist"]);
+var RetrainBboxSchema = external_exports.object({
+  x: external_exports.number(),
+  y: external_exports.number(),
+  w: external_exports.number(),
+  h: external_exports.number()
+});
+var RetrainAnnotationSchema = external_exports.object({
+  id: external_exports.string(),
+  trackId: external_exports.string(),
+  deviceId: external_exports.number(),
+  /** The COPY in retrain storage — never the source track's media key. */
+  mediaKey: external_exports.string(),
+  bbox: RetrainBboxSchema,
+  macroClass: RetrainMacroClassSchema,
+  label: external_exports.string().optional(),
+  subLabel: external_exports.string().optional(),
+  kind: RetrainAnnotationKindSchema,
+  source: RetrainAnnotationSourceSchema,
+  /** Which model proposed this box — or, on a `model_error`, drew the phantom. */
+  assistModelId: external_exports.string().optional(),
+  assistScore: external_exports.number().optional(),
+  exportedInBatch: external_exports.string().optional(),
+  createdAt: external_exports.number()
+});
+var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
+  id: true,
+  trackId: true,
+  deviceId: true,
+  mediaKey: true,
+  createdAt: true,
+  exportedInBatch: true
+});
+var RetrainTrackSchema = external_exports.object({
+  trackId: external_exports.string(),
+  deviceId: external_exports.number(),
+  className: external_exports.string(),
+  label: external_exports.string().optional(),
+  firstSeen: external_exports.number(),
+  lastSeen: external_exports.number(),
+  /** How many frames the dataset already holds from this track. */
+  frameCount: external_exports.number().int(),
+  /** How many subjects have been annotated on those frames. `0` with
+  *  `frameCount: 0` is exactly "staging, still to work". */
+  annotationCount: external_exports.number().int()
+});
+var RetrainFrameCandidateSchema = external_exports.object({
+  mediaKey: external_exports.string(),
+  kind: MediaFileKindEnum,
   timestamp: external_exports.number(),
-  capturedAt: external_exports.number().optional()
+  sizeBytes: external_exports.number().int(),
+  /** A copy of this original already exists — selecting it is free and cannot
+  *  fail, whatever became of the original. */
+  copied: external_exports.boolean()
 });
-var ModelFormatSchema$1 = external_exports.enum([
-  "onnx",
-  "coreml",
-  "openvino",
-  "tflite",
-  "pt",
-  "gguf"
-]);
-var PipelineSlotSchema = external_exports.enum([
-  "detector",
-  "cropper",
-  "classifier",
-  "refiner",
-  "audio-classifier"
-]);
-var PipelineEngineChoiceSchema = external_exports.object({
-  runtime: external_exports.enum(["node", "python"]),
-  backend: external_exports.string(),
-  format: ModelFormatSchema$1,
-  device: external_exports.string().optional()
+var RetrainFrameSchema = external_exports.object({
+  frameId: external_exports.string(),
+  deviceId: external_exports.number(),
+  trackId: external_exports.string(),
+  /** Provenance only. It may already point at nothing — that is expected. */
+  sourceMediaKey: external_exports.string(),
+  sourceKind: MediaFileKindEnum,
+  sizeBytes: external_exports.number().int(),
+  width: external_exports.number().int(),
+  height: external_exports.number().int(),
+  copiedAt: external_exports.number()
 });
-var EngineDeviceInfoSchema = external_exports.object({
-  id: external_exports.string(),
-  label: external_exports.string(),
-  description: external_exports.string().optional()
+var RetrainCopyRefusalSchema = external_exports.enum([
+  "source-missing",
+  "unreadable-image",
+  "write-failed"
+]);
+var RetrainFrameSelectionSchema = external_exports.object({
+  copied: external_exports.array(RetrainFrameSchema).readonly(),
+  refused: external_exports.array(external_exports.object({
+    sourceMediaKey: external_exports.string(),
+    reason: RetrainCopyRefusalSchema
+  })).readonly()
 });
-var AvailableEngineSchema = external_exports.object({
-  engine: PipelineEngineChoiceSchema,
-  devices: external_exports.array(EngineDeviceInfoSchema).readonly(),
-  defaultDevice: external_exports.string()
+var RetrainFrameListSchema = external_exports.object({
+  candidates: external_exports.array(RetrainFrameCandidateSchema).readonly(),
+  copies: external_exports.array(RetrainFrameSchema).readonly(),
+  /** What the page pre-selects — the native key frame when one survives. */
+  autoPickMediaKey: external_exports.string().optional()
 });
-var PipelineDefaultStepSchema = external_exports.lazy(() => external_exports.object({
-  addonId: external_exports.string(),
-  addonName: external_exports.string(),
-  slot: PipelineSlotSchema,
-  inputClasses: external_exports.array(external_exports.string()).readonly(),
-  outputClasses: external_exports.array(external_exports.string()).readonly(),
-  enabled: external_exports.boolean(),
+var RetrainAssistSubjectSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
+  kind: external_exports.literal("package"),
+  zone: RetrainBboxSchema.optional()
+}), external_exports.object({
+  kind: external_exports.literal("objects"),
   modelId: external_exports.string(),
-  children: external_exports.array(PipelineDefaultStepSchema).readonly(),
-  group: external_exports.string().optional(),
-  settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-}));
-var PipelineTemplateStepSchema = external_exports.lazy(() => external_exports.object({
-  addonId: external_exports.string(),
-  enabled: external_exports.boolean(),
+  minScore: external_exports.number().optional()
+})]);
+var RetrainAssistResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
+  kind: external_exports.literal("proposed"),
   modelId: external_exports.string(),
-  children: external_exports.array(PipelineTemplateStepSchema).readonly(),
-  settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  createdAt: external_exports.string(),
-  updatedAt: external_exports.string(),
-  engine: PipelineEngineChoiceSchema,
-  steps: external_exports.array(PipelineTemplateStepSchema).readonly()
+  stepId: external_exports.string(),
+  minScore: external_exports.number(),
+  /** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
+  proposals: external_exports.array(RetrainAnnotationDraftSchema).readonly(),
+  /** Returned by the runner but removed by the threshold. */
+  belowThreshold: external_exports.number().int()
+}), external_exports.object({
+  kind: external_exports.literal("refused"),
+  /** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
+  reason: external_exports.string(),
+  detail: external_exports.string().optional()
+})]);
+var RetrainTransitionResultSchema = external_exports.object({
+  trackId: external_exports.string(),
+  /** Where the track ended up, whatever happened. */
+  retrainStatus: RetrainStatusSchema,
+  /** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
+  changed: external_exports.boolean(),
+  reason: external_exports.enum([
+    "unknown-track",
+    "no-frames-copied",
+    "not-staging",
+    "not-trained",
+    "unchanged"
+  ]).optional()
 });
-var PipelineModelOptionSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  formats: external_exports.record(external_exports.string(), external_exports.object({
-    downloaded: external_exports.boolean(),
-    sizeMB: external_exports.number()
-  })),
-  group: ModelVariantGroupSchema.optional(),
-  legacy: external_exports.boolean().optional(),
-  provider: ModelProviderIdSchema.optional()
+var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
+var MAX_EVENT_QUERY_LIMIT = 5e3;
+var DeviceEventQueryInput = external_exports.object({
+  deviceId: external_exports.number(),
+  since: external_exports.number().optional(),
+  until: external_exports.number().optional(),
+  limit: external_exports.number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT),
+  /** `slim` drops heavy JSON fields (regions/bbox/zones) and carries an
+  *  optional `mediaUrl` (populated by B5). `full` (default) keeps today's
+  *  exact behaviour. Callers may omit this field — the store defaults to
+  *  `full` when not provided. */
+  projection: external_exports.enum(["full", "slim"]).optional()
 });
-var ConfigFieldBridge = external_exports.custom();
-var PipelineAddonSchemaSchema = external_exports.object({
+var ObjectEventQueryInput = DeviceEventQueryInput.extend({ classFilter: external_exports.string().optional() });
+var RecentTracksQueryInput = external_exports.object({
+  /** Devices to merge. An empty array yields `{ tracks: [], nextCursor: null }`. */
+  deviceIds: external_exports.array(external_exports.number()),
+  /** Window lower bound on `lastSeen` (inclusive). */
+  since: external_exports.number().optional(),
+  /** Window upper bound on `lastSeen` (inclusive). */
+  until: external_exports.number().optional(),
+  /** Page size. Default 200, max 1000. */
+  limit: external_exports.number().int().min(1).max(1e3).default(200),
+  /** Opaque continuation cursor from a previous page's `nextCursor`.
+  *  Encodes the (lastSeen, trackId) sort position — treat as opaque. */
+  cursor: external_exports.string().optional(),
+  /** See {@link TrackProjectionSchema}. Default `full`. */
+  projection: TrackProjectionSchema.optional(),
+  /** Include stationary-promoted rows (parked objects). Default false: the
+  *  feed lists passages; parking records live on the stationary registry. */
+  includeStationary: external_exports.boolean().optional()
+});
+var RecentTracksPageSchema = external_exports.object({
+  /** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
+  tracks: external_exports.array(TrackSchema).readonly(),
+  /** Cursor for the next page, or null when this page is the last. */
+  nextCursor: external_exports.string().nullable()
+});
+var LIST_GROUPS_DEFAULT_LIMIT = 40;
+var LIST_GROUPS_MAX_LIMIT = 100;
+var AnalyticsGroupRecordSchema = external_exports.object({
   id: external_exports.string(),
-  name: external_exports.string(),
-  slot: PipelineSlotSchema,
-  inputClasses: external_exports.array(external_exports.string()).readonly(),
-  outputClasses: external_exports.array(external_exports.string()).readonly(),
-  childSlots: external_exports.array(PipelineSlotSchema).readonly(),
-  models: external_exports.array(PipelineModelOptionSchema).readonly(),
-  defaultModelId: external_exports.string(),
-  defaultModelIdByFormat: external_exports.record(external_exports.string(), external_exports.string()).optional(),
-  enabledByDefault: external_exports.boolean().optional(),
-  backfillIntoExistingOverrides: external_exports.boolean().optional(),
-  defaultConfidence: external_exports.number(),
-  group: external_exports.string().optional(),
-  configSchema: external_exports.array(ConfigFieldBridge).readonly().optional()
+  deviceId: external_exports.number().int(),
+  openedAt: external_exports.number().int(),
+  closedAt: external_exports.number().int(),
+  timestamp: external_exports.number().int(),
+  memberCount: external_exports.number().int(),
+  memberTrackIds: external_exports.array(external_exports.string()).readonly(),
+  className: external_exports.string(),
+  classes: external_exports.array(external_exports.string()).readonly(),
+  /** Relative event-media path, or null when the group has no picture yet. */
+  mediaUrl: external_exports.string().nullable(),
+  singleton: external_exports.boolean()
 });
-var PipelineSlotSchemaSchema = external_exports.object({
-  id: PipelineSlotSchema,
-  label: external_exports.string(),
-  priority: external_exports.number(),
-  parentSlot: PipelineSlotSchema.nullable(),
-  addons: external_exports.array(PipelineAddonSchemaSchema).readonly()
+var AnalyticsGroupMemberSchema = external_exports.object({
+  trackId: external_exports.string(),
+  deviceId: external_exports.number().int(),
+  className: external_exports.string(),
+  firstSeen: external_exports.number().int(),
+  lastSeen: external_exports.number().int(),
+  mediaUrl: external_exports.string().nullable()
 });
-var PipelineSchemaSchema = external_exports.object({
-  availableEngines: external_exports.array(AvailableEngineSchema).readonly(),
-  selectedEngine: PipelineEngineChoiceSchema,
-  slots: external_exports.array(PipelineSlotSchemaSchema).readonly()
+var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: external_exports.array(AnalyticsGroupMemberSchema).readonly() });
+var ListGroupsQueryInput = external_exports.object({
+  /** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+  deviceIds: external_exports.array(external_exports.number()),
+  /** Window lower bound on `closedAt` (inclusive). */
+  since: external_exports.number().optional(),
+  /** Window upper bound on `openedAt` (inclusive). */
+  until: external_exports.number().optional(),
+  limit: external_exports.number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+  /** Opaque continuation cursor from a previous page's `nextCursor`. */
+  cursor: external_exports.string().optional()
+});
+var ListGroupsPageSchema = external_exports.object({
+  groups: external_exports.array(AnalyticsGroupRecordSchema).readonly(),
+  nextCursor: external_exports.string().nullable()
+});
+var KeyEventQueryInput = external_exports.object({
+  deviceId: external_exports.number(),
+  /** Window lower bound (track firstSeen ≥ since). */
+  since: external_exports.number(),
+  /** Window upper bound (track firstSeen ≤ until). */
+  until: external_exports.number(),
+  limit: external_exports.number().int().min(1).max(200).default(50),
+  /** Drop tracks scoring below this importance. */
+  minImportance: external_exports.number().min(0).max(1).optional(),
+  /** Restrict to a single class (e.g. 'person'). */
+  classFilter: external_exports.string().optional()
+});
+var KeyEventSchema = external_exports.object({
+  /** The representative event id (the track's best ObjectEvent, else its trackId). */
+  id: external_exports.string(),
+  trackId: external_exports.string(),
+  /** Track start time (firstSeen). */
+  timestamp: external_exports.number(),
+  className: external_exports.string(),
+  ...TieredLabelFields,
+  importance: external_exports.number(),
+  /** Highest-confidence ObjectEvent id for the track (empty when none). */
+  bestEventId: external_exports.string(),
+  /** Track lifetime in ms (lastSeen - firstSeen). */
+  windowMs: external_exports.number().optional(),
+  ...TrackFlagFields,
+  ...TrackRetrainFields
+});
+var TrackedDetectionSchema = external_exports.object({
+  trackId: external_exports.string(),
+  className: external_exports.string(),
+  confidence: external_exports.number(),
+  bbox: BoundingBoxSchema,
+  zones: external_exports.array(external_exports.string()).readonly(),
+  state: TrackStateSchema
 });
-var EngineProvisioningSchema = external_exports.object({
-  runtimeId: external_exports.enum([
-    "onnx",
-    "openvino",
-    "coreml",
-    "edgetpu"
-  ]).nullable(),
-  device: external_exports.string().nullable(),
-  state: external_exports.enum([
-    "idle",
-    "installing",
-    "verifying",
-    "ready",
-    "failed"
-  ]),
-  progress: external_exports.number().optional(),
-  error: external_exports.string().optional(),
-  nextRetryAt: external_exports.number().optional(),
-  /**
-  * Gate A (config-correctness gate at engine change): human-readable
-  * config issues surfaced EAGERLY when the node's engine changes — model
-  * substitutions ("chose X, running Y") and zero-build steps ("no model
-  * has a <format> build"). Additive/optional: informational only, never
-  * enforced here — `assertEngineReady` (readiness) still gates inference.
-  * Absent/empty when the node-default tree resolves cleanly.
-  */
-  configIssues: external_exports.array(external_exports.string()).optional()
+var OverlayDetectionSchema = external_exports.looseObject({
+  id: external_exports.string(),
+  kind: external_exports.enum(["first-level", "detail"]),
+  macroClass: external_exports.string(),
+  score: external_exports.number(),
+  bbox: external_exports.object({
+    x: external_exports.number(),
+    y: external_exports.number(),
+    width: external_exports.number(),
+    height: external_exports.number()
+  }),
+  labels: external_exports.array(external_exports.looseObject({
+    label: external_exports.string(),
+    score: external_exports.number()
+  })).readonly(),
+  parentId: external_exports.string().optional()
 });
-var PipelineStepInputSchema = external_exports.lazy(() => external_exports.object({
-  addonId: external_exports.string(),
-  modelId: external_exports.string().optional(),
-  enabled: external_exports.boolean().default(true),
-  children: external_exports.array(PipelineStepInputSchema).optional(),
-  settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  jumpDeviceKey: external_exports.string().optional()
-}));
-var ModelSubstitutionSchema = external_exports.object({
-  addonId: external_exports.string(),
-  chosen: external_exports.string(),
-  running: external_exports.string(),
-  format: external_exports.string()
+var ScoredObjectEventSchema = ObjectEventSchema.extend({ score: external_exports.number() });
+var SearchObjectEventsInput = external_exports.object({
+  text: external_exports.string(),
+  deviceId: external_exports.number().optional(),
+  since: external_exports.number().optional(),
+  until: external_exports.number().optional(),
+  classFilter: external_exports.string().optional(),
+  limit: external_exports.number().default(50),
+  minScore: external_exports.number().min(0).max(1).default(0.2)
 });
-var PipelineValidationIssueSchema = external_exports.object({
-  addonId: external_exports.string(),
-  kind: external_exports.enum(["unknown-addon", "no-format-build"]),
-  detail: external_exports.string()
+var TrackCascadeCountsSchema = external_exports.object({
+  /** Persisted track roots deleted (authoritative). */
+  tracks: external_exports.number().int(),
+  /** Object events removed with their tracks (best-effort; see note above). */
+  events: external_exports.number().int(),
+  /** Track/face/plate-owned media removed (best-effort). Never identity media. */
+  media: external_exports.number().int(),
+  /** Unassigned (non-enrolled) face reads removed (best-effort). */
+  faces: external_exports.number().int(),
+  /** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
+  plates: external_exports.number().int(),
+  /** Per-track CLIP search vectors removed (best-effort). */
+  embeddings: external_exports.number().int(),
+  /** Group membership + group rows removed with their last member (best-effort). */
+  groups: external_exports.number().int()
 });
-var PipelineValidationResultSchema = external_exports.object({
-  ok: external_exports.boolean(),
-  issues: external_exports.array(PipelineValidationIssueSchema).readonly(),
-  substitutions: external_exports.array(ModelSubstitutionSchema).readonly(),
-  /** The node's `currentEngine.format` this validation ran against. */
-  format: external_exports.string()
+var DiskReconcileCountsSchema = external_exports.object({
+  mediaDropped: external_exports.number().int(),
+  tracks: external_exports.number().int(),
+  events: external_exports.number().int()
 });
-var ReferenceImageEntrySchema = external_exports.object({
-  filename: external_exports.string(),
-  stepIds: external_exports.array(external_exports.string()).readonly().optional()
+var EventStoreDeviceFootprintSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  /** Persisted event rows (motion + object + audio) for the camera. */
+  rows: external_exports.number().int(),
+  /** Event-owned media bytes on disk for the camera. */
+  bytes: external_exports.number().int()
 });
-var ReferenceImageBodySchema = external_exports.object({
-  base64: external_exports.string(),
-  filename: external_exports.string()
+var EventStoreFootprintSchema = external_exports.object({
+  totalRows: external_exports.number().int(),
+  totalBytes: external_exports.number().int(),
+  devices: external_exports.array(EventStoreDeviceFootprintSchema).readonly()
 });
-var ReferenceAudioEntrySchema = external_exports.object({
-  filename: external_exports.string(),
-  sizeKb: external_exports.number()
+var EventPruneCountsSchema = external_exports.object({
+  motion: external_exports.number().int(),
+  object: external_exports.number().int(),
+  audio: external_exports.number().int()
 });
-var ReferenceAudioBodySchema = external_exports.object({ base64: external_exports.string() });
-var AudioBackendSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  description: external_exports.string(),
-  available: external_exports.boolean(),
+var RebuildObjectEmbeddingsInput = external_exports.object({
+  /** Restrict to one camera. Omit for the whole fleet. */
+  deviceId: external_exports.number().optional(),
+  since: external_exports.number().optional(),
+  until: external_exports.number().optional(),
+  /** Stop after this many tracks; the result reports whether more remain. */
+  maxTracks: external_exports.number().int().positive().optional(),
   /**
-  * Raw classifier labels this backend can emit (e.g. YAMNet's
-  * 521-class set or Apple SoundAnalysis's 303-class set). Used by
-  * the benchmark UI to populate the `enabledMicroClasses` filter
-  * specific to the selected backend without a separate fetch.
+  * Run every embedding on THIS node instead of round-robining the fleet.
+  *
+  * Named `executeOnNodeId` and not `nodeId` on purpose: an inline `nodeId`
+  * field in cap args is read by `parent-unowned-call.ts` as a ROUTING PIN, so
+  * calling it that would pin the rebuild REQUEST itself to that node — the
+  * rebuild orchestration lives on the hub, and only the per-track step runs
+  * remotely. This field is data; the per-track pin is applied inside.
+  *
+  * Absent ⇒ round-robin over every online node whose runner can serve the
+  * pinned model.
   */
-  rawLabels: external_exports.array(external_exports.string()).readonly().optional()
+  executeOnNodeId: external_exports.string().optional(),
+  /**
+  * Milliseconds to wait between tracks; omit for the built-in default, `0` to
+  * run flat out.
+  *
+  * A rebuild is bulk maintenance on hub-main's single thread. Measured
+  * 2026-08-06, an unpaced pass held that thread busy 82.2 s out of 120 and
+  * pushed `nodes.topology` from 0.25 s to 26 s for 43 minutes. The value in
+  * force is logged at start and finish so a deliberately slow pass reads
+  * differently from a stalled one.
+  */
+  pacingMs: external_exports.number().int().nonnegative().optional()
 });
-var AudioCapabilitiesSchema = external_exports.object({
-  activeBackend: external_exports.string(),
-  availableBackends: external_exports.array(AudioBackendSchema).readonly(),
-  sampleRate: external_exports.number(),
-  chunkDurationMs: external_exports.number()
+var WipeObjectEmbeddingsResultSchema = external_exports.object({ deleted: external_exports.number() });
+var RebuildObjectEmbeddingsResultSchema = external_exports.object({
+  started: external_exports.boolean(),
+  /** True when a pass was already running; the new request is ignored. */
+  alreadyRunning: external_exports.boolean()
 });
-var DownloadModelResultSchema = external_exports.object({
-  filePath: external_exports.string(),
-  sizeMB: external_exports.number(),
-  durationMs: external_exports.number()
+var RebuildStatusSchema = external_exports.object({
+  running: external_exports.boolean(),
+  scanned: external_exports.number(),
+  rebuilt: external_exports.number(),
+  /** Tracks whose key frame is gone — nothing to re-embed from. */
+  missingKeyFrame: external_exports.number(),
+  /** Tracks with no usable detection box. */
+  missingBbox: external_exports.number(),
+  /**
+  * Tracks an executing node REFUSED rather than broke on — an unreadable key
+  * frame, a step that threw. Separate from `failed` because the remedy is
+  * different, and because a whole camera silently contributing zero vectors
+  * is the shape of failure a rebuild must never hide.
+  */
+  notRunnable: external_exports.number(),
+  /**
+  * The pass stopped because NO node could serve the pinned model.
+  *
+  * Distinct from `notRunnable` on purpose: that one says "this track was
+  * refused", this one says "the cluster cannot do this work at all" — every
+  * candidate node either lacks the `clip-embedding` step, lacks a build of the
+  * pinned model for its engine format, or dropped out. The remedy is a model /
+  * engine change, not a per-camera one. Non-zero here always comes with
+  * `complete: false`.
+  */
+  noCapableNode: external_exports.number(),
+  failed: external_exports.number(),
+  /** Set once a pass ends: true only when EVERYTHING was covered. */
+  complete: external_exports.boolean().nullable(),
+  startedAtMs: external_exports.number().nullable(),
+  finishedAtMs: external_exports.number().nullable(),
+  /** Present when the pass ended by throwing. */
+  error: external_exports.string().nullable()
 });
-var AudioTestResultSchema = external_exports.object({
-  success: external_exports.boolean(),
-  error: external_exports.string().optional(),
-  frame: external_exports.custom().optional()
+var ReplayFrameInputSchema = external_exports.object({
+  timestamp: external_exports.number(),
+  frame: PipelineRunResultBridge
 });
-var PipelineConfigBridge = external_exports.custom();
-var ConfigUISchemaBridge = external_exports.custom();
-var ConfigUISchemaNullableBridge = external_exports.custom();
-var InferenceCapabilitiesBridge = external_exports.custom();
-var ModelAvailabilityListBridge = external_exports.custom();
-var PipelineRunResultBridge = external_exports.custom();
-var pipelineExecutorCapability = {
-  name: "pipeline-executor",
-  scope: "system",
+var ReplayTrackSchema = external_exports.object({
+  className: external_exports.string(),
+  firstSeenMs: external_exports.number(),
+  lastSeenMs: external_exports.number(),
+  /** Bbox of the track's FIRST matched detection, pixel-space in the clip's
+  *  frame — a representative box for the diff's `(className, window, IoU)`
+  *  pairing (`replay-diff.ts`). A replay does not need the full per-frame
+  *  trajectory production's `Track.positions` keeps. */
+  bbox: BoundingBoxSchema,
+  /** How many of the input frames this track matched a real detection on
+  *  (never a coasted/extrapolated frame) — the replay's own signal for "how
+  *  solid is this track", cheaper than re-deriving it from a trajectory. */
+  framesMatched: external_exports.number().int()
+});
+var RunReplayFrameProcessorResultSchema = external_exports.object({ tracks: external_exports.array(ReplayTrackSchema).readonly() });
+var pipelineAnalyticsCapability = {
+  name: "pipeline-analytics",
+  scope: "device",
   mode: "singleton",
+  kind: "wrapper",
+  defaultActive: true,
+  deviceTypes: [DeviceType.Camera],
+  exposesDeviceSettings: true,
   methods: {
-    getAvailableEngines: method(external_exports.void(), external_exports.array(PipelineEngineChoiceSchema)),
-    getSelectedEngine: method(external_exports.void(), PipelineEngineChoiceSchema),
-    getDefaultSteps: method(PipelineEngineChoiceSchema, external_exports.array(PipelineDefaultStepSchema)),
+    getActiveTracks: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.array(TrackSchema).readonly()),
+    getTrack: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string()
+    }), TrackSchema.nullable()),
+    /** Historical completed tracks for a device. Queried from the
+    *  persisted `pipeline-analytics:tracks` collection; active tracks
+    *  still in RAM are not included. */
+    listTracks: method(external_exports.object({
+      deviceId: external_exports.number(),
+      since: external_exports.number().optional(),
+      until: external_exports.number().optional(),
+      limit: external_exports.number().optional(),
+      /** Spatial filter — only tracks whose trajectory intersects the zone
+      *  (normalized 0..1 rect or polygon). SQL-prefiltered on the persisted
+      *  envelope columns, then precisely tested per position. Tracks with
+      *  an unknown envelope (no frame dims at persist time) always match. */
+      zone: TrackZoneFilterSchema.optional(),
+      /** See {@link TrackProjectionSchema}. Default `full` (backward
+      *  compatible — omitting the field keeps today's exact behaviour). */
+      projection: TrackProjectionSchema.optional(),
+      /** Include stationary-promoted rows (parked objects handed to the
+      *  stationary registry). Default false: the timeline lists passages,
+      *  not parking records (operator decision, 2026-08-15). */
+      includeStationary: external_exports.boolean().optional()
+    }), external_exports.array(TrackSchema).readonly()),
+    /**
+    * Batched cluster-wide track listing — ONE call for the events page /
+    * reel first paint instead of a per-camera `listTracks` fan-out. Merges
+    * the persisted completed tracks of every requested device, sorted by
+    * `lastSeen` DESC with a stable (lastSeen, trackId) cursor. Per-device
+    * indexed pages (`idx_tracks_device_lastSeen`) are k-way merged
+    * provider-side; `projection: 'slim'` drops the heavy `positions[]` /
+    * `snapshots[]` JSON (returned as empty arrays). Active in-RAM tracks
+    * are not included (same contract as `listTracks`).
+    */
+    listRecentTracks: method(RecentTracksQueryInput, RecentTracksPageSchema),
+    /**
+    * Batched co-moving group listing — the Groups feed. Same merge/cursor
+    * contract as {@link listRecentTracks}. A group is a sealed partition of
+    * one session; `getGroup` is the detail with members.
+    */
+    listGroups: method(ListGroupsQueryInput, ListGroupsPageSchema),
+    getGroup: method(external_exports.object({
+      deviceId: external_exports.number(),
+      groupId: external_exports.string().min(1)
+    }), AnalyticsGroupDetailSchema.nullable()),
+    clearTracks: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    getMotionEvents: method(DeviceEventQueryInput, external_exports.array(MotionEventSchema).readonly()),
+    getObjectEvents: method(ObjectEventQueryInput, external_exports.array(ObjectEventSchema).readonly()),
+    getAudioEvents: method(DeviceEventQueryInput, external_exports.array(AudioEventSchema).readonly()),
+    /**
+    * Every event kind the device can produce: built-ins (motion + audio),
+    * detection classes actually observed for the device (from the track
+    * history), and sensor kinds contributed by LINKED devices (resolved via
+    * `device-manager.getLinkedDevices`, mapped through `EVENT_KIND_BY_CAP`).
+    */
+    listEventKinds: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.array(EventKindDescriptorSchema).readonly()),
+    /**
+    * The same answer for many cameras in ONE call.
+    *
+    * `listEventKinds` is the slowest per-device query on the hub — measured
+    * at ~100 ms against 6-11 ms for its neighbours — because composing it
+    * costs a `getCameraStatus`, a `getLinkedDevices` and one `getBindings`
+    * per linked device. The viewer asks for it once per camera at first
+    * paint, so twelve cameras paid twelve of those round-trips on top of the
+    * per-camera cost.
+    *
+    * Batched, the camera statuses come from ONE `getCameraStatuses` instead
+    * of N, and the per-device composition runs concurrently.
+    *
+    * Per-device rather than pre-merged on purpose: a caller that renders one
+    * camera's lanes needs to know WHICH camera a kind came from, and merging
+    * is three lines the caller can do. `listEventKinds` stays for
+    * single-device callers.
+    */
+    listEventKindsBatch: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).min(1).max(200) }), external_exports.array(EventKindsForDeviceSchema).readonly()),
+    /**
+    * Sensor-event history for a camera: state changes of LINKED sensor
+    * devices, attributed to the camera at ingest time (one row per linked
+    * camera). Mirrors `getAudioEvents` query semantics; `kinds` narrows to
+    * a kind subset.
+    */
+    getSensorEvents: method(external_exports.object({
+      deviceId: external_exports.number(),
+      since: external_exports.number().optional(),
+      until: external_exports.number().optional(),
+      kinds: external_exports.array(external_exports.string()).optional(),
+      limit: external_exports.number().int().min(1).max(MAX_EVENT_QUERY_LIMIT).default(DEFAULT_EVENT_QUERY_LIMIT)
+    }), external_exports.array(SensorEventSchema).readonly()),
+    /**
+    * Importance-ranked highlights for a device+window. Queries completed
+    * tracks by (deviceId, firstSeen ∈ [since,until]), scores each (or reuses
+    * the persisted score), filters by minImportance/classFilter, orders by
+    * importance desc, and returns up to `limit` compact key events mapped to
+    * each track's best event. Legacy tracks lacking a persisted score are
+    * scored on-read (no write). Degrades to `[]` on error.
+    */
+    getKeyEvents: method(KeyEventQueryInput, external_exports.array(KeyEventSchema).readonly()),
+    /** Server-side bucketed event counts for the 24-hour timeline.
+    *  Returns one entry per non-empty bucket; empty buckets are omitted. */
+    getEventDensity: method(external_exports.object({
+      deviceId: external_exports.number(),
+      since: external_exports.number(),
+      until: external_exports.number(),
+      bucketMs: external_exports.number().int().positive()
+    }), external_exports.array(external_exports.object({
+      bucketStart: external_exports.number(),
+      motion: external_exports.number().int(),
+      object: external_exports.number().int(),
+      audio: external_exports.number().int()
+    })).readonly()),
+    /**
+    * @deprecated Prefer `pruneTracksBefore` — the track is the ROOT of the
+    * analytics model and retention must cascade from it (design §5.1). This
+    * event-only prune leaves orphaned tracks/faces/plates/embeddings behind.
+    * Retained as a compat shim for the Phase-B3 recorder orchestration caller,
+    * which prunes events to keep history aligned with available footage and
+    * reads the per-kind counts. Delete all events (motion + object + audio)
+    * for the given device older than `cutoffMs` (exclusive) + their thumbnails
+    * in lockstep; returns per-kind deleted counts.
+    */
+    pruneEventsBefore: method(external_exports.object({
+      deviceId: external_exports.number(),
+      cutoffMs: external_exports.number()
+    }), external_exports.object({
+      motion: external_exports.number().int(),
+      object: external_exports.number().int(),
+      audio: external_exports.number().int()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Track-centric retention entry point (design §5.1). Selects every
+    * persisted track for the device whose `lastSeen < cutoffMs` (paged) and
+    * runs the extensible whole-track deletion cascade (design §3): object
+    * events + their media, track/face/plate-owned media, unassigned face
+    * reads, per-track CLIP embeddings, then the track root LAST. ENROLLED
+    * (assigned) faces/plates and `ownerKind:'identity'` media are exempt —
+    * the durable matching gallery always persists. Fires the per-track
+    * live-state cleanup so a pruned track can't linger in dispatch/overlay
+    * state. Returns per-family deleted counts (`tracks` authoritative).
+    *
+    * Replaces `pruneEventsBefore` as the correct time-based retention prune.
+    */
+    pruneTracksBefore: method(external_exports.object({
+      deviceId: external_exports.number(),
+      cutoffMs: external_exports.number()
+    }), TrackCascadeCountsSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Operator "clean slate" for a device (design §5.3): prune EVERY track for
+    * the device via the same cascade as `pruneTracksBefore` with `cutoffMs =
+    * now`. One call per device — no client-side track enumeration. Enrolled
+    * gallery + identity media are exempt (design §4). Returns per-family
+    * deleted counts.
+    */
+    wipeAllAnalytics: method(external_exports.object({ deviceId: external_exports.number() }), TrackCascadeCountsSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Disk-wins reconcile for one camera. Drops media index rows whose blobs
+    * are gone, then cascades tracks (including favourited and staging) that
+    * have no remaining files. Enrolled identity/vehicle/scene media is never
+    * probed. Trackless motion/audio events with no remaining file are dropped,
+    * including snapshot-less rows.
+    */
+    reconcileFromDisk: method(external_exports.object({ deviceId: external_exports.number() }), DiskReconcileCountsSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Delete whole tracks (object events) by id for the given device,
+    * cascading their media in lockstep. Returns the number of tracks
+    * actually deleted plus the ids that could not be removed.
+    *
+    * Operator-driven from the DI Events page (batch delete). Routes through
+    * the same widened track-deletion cascade (design §5.2).
+    */
+    deleteTracks: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackIds: external_exports.array(external_exports.string()).min(1)
+    }), external_exports.object({
+      deleted: external_exports.number().int(),
+      failed: external_exports.array(external_exports.string()).readonly()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Set the per-track operator flags (`markForTrain`, `debug`, `favourited`) on ONE track.
+    * The patch is PARTIAL — an omitted key is left untouched — because the
+    * three surfaces that write it (admin Events grid, viewer track detail,
+    * viewer cluster detail) each own one toggle and must not clobber the other.
+    *
+    * Writes the track ROW: `markForTrain`/`debug` are per-TRACK state, so they
+    * live where `label` and `importance` live, not in any per-device settings
+    * store. Updates the in-RAM active track too, so a flag set on a live track
+    * survives its expiry-time persist.
+    *
+    * `auth: 'protected'` (the default), NOT `admin`: the viewer is an
+    * authenticated non-admin surface and two of the three call sites are
+    * there. The note that used to sit here said to revisit this the day a flag
+    * gained an effect that costs storage, and D81 is that day — `markForTrain`
+    * now pins. It STAYS protected, and the reason is that the alternative
+    * makes the feature pointless: marking a track is something you do while
+    * looking at it, on the surface you were already looking at it on, and that
+    * surface is the viewer. What the storage cost gets instead is a BOUND — a
+    * per-device pin budget enforced in the body, refusing a new pin past the
+    * limit while always allowing un-marking. `deleteTracks` next door is still
+    * admin, because destroying evidence and preserving it are not symmetric.
+    *
+    * `markForTrain` writes the retrain LIFECYCLE, not a boolean column: `true`
+    * is `none → staging`, `false` is `staging → none`. A track already
+    * `trained` refuses BOTH — its frames are copies inside the retrain dataset
+    * and re-staging it from a generic toggle is how the same material gets
+    * annotated twice under two ground truths. Returning a trained track to
+    * staging is a deliberate action of the retrain page, which is also the only
+    * thing that produces `trained` in the first place.
+    *
+    * Returns the RESOLVED state of both flags (absent → `false`) plus the
+    * `retrainStatus` they were derived from, so a caller can drive its toggle
+    * — and render a `trained` badge — without a re-fetch. Rejects an unknown
+    * track, a new staging mark on a device already holding its full budget, and
+    * any `markForTrain` write against a trained track.
+    */
+    setTrackFlags: method(external_exports.object({
+      /** Log/audit scope only — the trackId is globally unique on its own. */
+      deviceId: external_exports.number(),
+      trackId: external_exports.string(),
+      flags: TrackFlagsPatchSchema
+    }), TrackFlagsSchema, { kind: "mutation" }),
+    /**
+    * Durable event-store footprint for the management UI: event rows
+    * (motion + object + audio) counted per camera + total, plus the
+    * event-owned media bytes on disk per camera + total. Stat/count-based,
+    * computed on demand.
+    */
+    getEventStoreFootprint: method(external_exports.object({}), EventStoreFootprintSchema, {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * Cluster-wide prune of events older than `olderThanMs` (exclusive) across
+    * every camera, deleting each event's media in lockstep. Logged to the
+    * events ops-log with `reason` (default `'retention'`). Returns the summed
+    * per-kind deleted counts.
+    */
+    pruneEvents: method(external_exports.object({
+      olderThanMs: external_exports.number(),
+      reason: OpsLogReasonSchema.optional()
+    }), EventPruneCountsSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Manually delete EVERY event (motion + object + audio) for one camera and
+    * its event-owned media in lockstep. Logged to the events ops-log as
+    * `op:'manual-delete', reason:'manual'`. Destructive — the admin UI guards
+    * it behind a confirm.
+    */
+    deleteDeviceEvents: method(external_exports.object({ deviceId: external_exports.number() }), EventPruneCountsSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** The events ops-log rows (newest-first), optionally scoped to one camera.
+    *  Backed by a declared pipeline-analytics SQLite collection. */
+    /** Internal migration-participant lease. It drains active MediaStore
+    * writes and refuses new ones without changing analytics bindings. */
+    pauseForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ paused: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    resumeForStorageMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ resumed: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Drops cached location roots after the storage coordinator repoints a
+    * default so future event-media writes use the new root. */
+    refreshStorageLocationsForMigration: method(StorageMigrationLeaseInputSchema, external_exports.object({ refreshed: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    startStorageMigrationMove: method(StorageMigrationMediaMoveInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    getStorageMigrationMoveStatus: method(external_exports.object({ jobId: external_exports.string() }), RelocateJobSchema.nullable(), { auth: "admin" }),
+    cancelStorageMigrationMove: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /**
-    * Per-node detection-engine provisioning snapshot. Returns the live
-    * state of the lazy runtime-provisioning machine on `nodeId`
-    * (idle / installing / verifying / ready / failed). The UI pairs this
-    * one-shot query with the `pipeline.engine-provisioning` live event
-    * (emitted on every transition) to drive a per-node "engine ready?"
-    * indicator without polling. Phase 2.
+    * Moves event media between locations — the OPERATOR's mover, without the
+    * coordinator's lease. Twin of `recording.relocateFootage`: the same
+    * engine the lease-gated coordinated migration uses
+    * (`startStorageMigrationMove`), armable in the background and WITHOUT
+    * pausing anything. Exists because `eventMedia` was the only storage
+    * class whose only move path went through the recorder's global pause.
     */
-    getEngineProvisioning: method(external_exports.object({ nodeId: external_exports.string() }), EngineProvisioningSchema),
-    getVideoPipelineSteps: method(external_exports.void(), external_exports.record(external_exports.string(), external_exports.object({
-      modelId: external_exports.string(),
-      settings: external_exports.record(external_exports.string(), external_exports.unknown()).readonly()
-    }))),
-    setVideoPipelineSteps: method(external_exports.object({ steps: external_exports.record(external_exports.string(), external_exports.object({
-      modelId: external_exports.string(),
-      settings: external_exports.record(external_exports.string(), external_exports.unknown()).readonly()
-    })) }), external_exports.object({ success: external_exports.literal(true) }), {
+    relocateMedia: method(RelocateMediaInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Every relocate job this addon knows about, newest first (in RAM: the
+    *  move is resumable, so a lost list costs nothing but the display). */
+    listRelocateMediaJobs: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /** Cancel a running or queued relocate job. */
+    cancelRelocateMedia: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
       kind: "mutation",
       auth: "admin"
     }),
+    listOpsLog: method(OpsLogQueryInputSchema, external_exports.array(OpsLogEntrySchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
     /**
-    * Clear THIS node's executor-side PER-DEVICE settings stores (the
-    * per-camera step overrides the object-detection root reads via
-    * `applyDeviceOverridesToTree`). `nodeId` is the ROUTING key — the
-    * generated cap-router strips it (default `nodeIdMode: 'routing'`) and
-    * dispatches to that node, so the provider method runs ON the target
-    * node and receives no `nodeId`.
+    * The CHEAP QUESTION, asked before any media moves: how big is the dataset
+    * the marked (`markForTrain`) tracks would produce?
     *
-    * This is the slimmed executor leg of the orchestrator's
-    * `resetNodePipelineDefaults` flow (which owns the real reset: node
-    * addonDefaults pins + per-camera orchestrator overrides). The legacy
-    * `resetToDefault` — which reset a persisted global step-tree seed
-    * nothing in the live per-camera path read — was removed together with
-    * that seed.
+    * Answered from media INDEX rows only — key, kind, size, timestamp — so it
+    * costs ~2 KB of reads per track and no blob reads at all. The measured harm
+    * behind D56 was a bulk pass that read and base64'd every blob a track owned
+    * before deciding anything, taking hub-main to 82 s busy out of 120; an
+    * export is that same I/O shape, so it inherits the same discipline: know
+    * the size, then decide.
+    *
+    * `truncated` reports that more marked tracks exist than one pass carries.
+    * Empty `deviceIds` ⇒ every device that has marked tracks.
     */
-    clearDeviceOverrides: method(external_exports.object({ nodeId: external_exports.string() }), external_exports.object({
-      success: external_exports.literal(true),
-      clearedDevices: external_exports.number()
+    getTrainingExportSummary: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).optional() }), TrainingExportSummarySchema, {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * Where to download the dataset archive.
+    *
+    * The BYTES do not come back through this cap — they come from the returned
+    * data-plane URL, which streams a tar built entry by entry. A multi-gigabyte
+    * archive base64'd through a unary RPC envelope would be held whole in
+    * memory twice on a hub this repo has already OOM'd once (D9/D18 are the
+    * same lesson about frames). `getDownloadUrl` on `recordingExport` is the
+    * precedent, and this follows it deliberately.
+    *
+    * The archive contains a `manifest.json` FIRST, then the stored media
+    * VERBATIM under `tracks/<deviceId>/<trackId>/…`. No crop is derived and no
+    * model is run: a training set's pixels must be the pixels the pipeline saw.
+    */
+    getTrainingExportUrl: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).optional() }), external_exports.object({ url: external_exports.string() }), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * The staging worklist for one camera, or for every camera that has one.
+    *
+    * Fetched ON DEMAND, over the staging set only — the page never scans
+    * history, because making the working set small is the entire purpose of
+    * the mark. Each row carries how many frames the dataset already holds from
+    * the track and how many subjects were annotated on them, so
+    * `frameCount: 0` reads as "still to work" without a second call per track.
+    *
+    * `auth: 'admin'`, unlike the viewer-level mark itself: marking a track is
+    * curation you do while looking at it, but building the training set the
+    * fleet's models are fine-tuned on is not.
+    */
+    listRetrainStaging: method(external_exports.object({
+      /** Empty ⇒ every camera that has staging tracks. A LIST, not a single
+      *  `deviceId`, deliberately: `deviceId` would make this device-bound and
+      *  route it at one camera's owner, and "every camera" would stop being
+      *  expressible at all. */
+      deviceIds: external_exports.array(external_exports.number()).optional(),
+      limit: external_exports.number().int().min(1).max(500).optional()
+    }), external_exports.array(RetrainTrackSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * What a track can contribute, and what it already has.
+    *
+    * `candidates` are the track's whole, unannotated frames — index rows only,
+    * so this is cheap. `copies` are the frames already inside the dataset, and
+    * a candidate whose copy exists is marked `copied: true`: selecting it again
+    * is free and CANNOT fail, whatever became of the original.
+    *
+    * A crop, a thumbnail and `fullFrameBoxed` are never candidates. The last
+    * one matters most: it has the model's own rectangle burned into the pixels,
+    * and a detector trained on it learns to find a green line.
+    */
+    listRetrainFrames: method(external_exports.object({ trackId: external_exports.string() }), RetrainFrameListSchema, {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * COPY-ON-SELECT — the write that makes `trained` safe to evict.
+    *
+    * Selecting a frame copies its bytes into retrain storage immediately: not
+    * a reference, not a lease. Once the copy exists the dataset no longer
+    * depends on the track's media, which is exactly what lets D81 hand a
+    * `trained` track back to retention.
+    *
+    * The order inside is load-bearing and is pinned by a test: an EXISTING
+    * copy is returned without touching the source, so an original that
+    * evaporated blocks the selection of THAT ORIGINAL and never the copy
+    * already taken. Every refusal comes back named — a dropped selection is
+    * never silent, on the wire or in the log.
+    */
+    selectRetrainFrames: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string(),
+      mediaKeys: external_exports.array(external_exports.string()).min(1)
+    }), RetrainFrameSelectionSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Un-select a frame: its annotations go first, then the copy and its blob.
+    *  Deliberately destructive and deliberately explicit — it is the only way
+    *  a frame leaves the dataset before export. */
+    deselectRetrainFrame: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string(),
+      frameId: external_exports.string()
+    }), external_exports.object({
+      removed: external_exports.boolean(),
+      removedAnnotations: external_exports.number().int()
     }), {
       kind: "mutation",
       auth: "admin"
     }),
-    getSchema: method(external_exports.void(), PipelineSchemaSchema),
-    getGlobalSteps: method(external_exports.void(), external_exports.array(PipelineDefaultStepSchema).readonly().nullable()),
-    getGlobalPipelineConfig: method(external_exports.void(), PipelineConfigBridge),
-    getOrchestratorConfigSchema: method(external_exports.void(), ConfigUISchemaBridge),
     /**
-    * Gate B (pre-init config-correctness gate). PURE COMPUTE against this
-    * node's `currentEngine.format` — resolves `steps` the same way the
-    * runtime dispatch path would, and reports what WOULD happen without
-    * touching any node-global state. Called by the orchestrator at attach
-    * time (`attachOn`), node-pinned to the TARGET node, so config problems
-    * surface BEFORE `pipelineRunner.attachCamera` rather than at the first
-    * per-frame resolve. `ok` is false iff `issues` is non-empty (both
-    * `unknown-addon` and `no-format-build` are HARD issues); `substitutions`
-    * is informational (a degraded-but-loadable model swap) and never
-    * affects `ok`. Never throws.
+    * The pixels of ONE copied frame, base64.
+    *
+    * Through the cap rather than a data plane because it is genuinely one
+    * frame at a time, on demand, at human speed — the shape D9/D18 permit
+    * (what they forbid is frames crossing a boundary at frame RATE). The
+    * annotation canvas needs the image and its exact dimensions in the same
+    * answer: a canvas that places a normalised box against a size it guessed
+    * draws every box in the wrong place.
     */
-    validatePipeline: method(external_exports.object({ steps: external_exports.array(PipelineStepInputSchema) }), PipelineValidationResultSchema),
-    listTemplates: method(external_exports.void(), external_exports.array(PipelineTemplateSchema$1).readonly()),
-    saveTemplate: method(external_exports.object({
-      name: external_exports.string(),
-      steps: external_exports.array(PipelineTemplateStepSchema).readonly(),
-      engine: PipelineEngineChoiceSchema
-    }), PipelineTemplateSchema$1, { kind: "mutation" }),
-    updateTemplate: method(external_exports.object({
-      id: external_exports.string(),
-      name: external_exports.string().optional(),
-      steps: external_exports.array(PipelineTemplateStepSchema).readonly().optional()
-    }), PipelineTemplateSchema$1, { kind: "mutation" }),
-    deleteTemplate: method(external_exports.object({ id: external_exports.string() }), external_exports.void(), { kind: "mutation" }),
-    getCapabilities: method(external_exports.void(), InferenceCapabilitiesBridge),
-    getAddonModels: method(external_exports.object({ addonId: external_exports.string() }), ModelAvailabilityListBridge),
-    downloadModel: method(external_exports.object({
-      addonId: external_exports.string(),
-      modelId: external_exports.string(),
-      format: ModelFormatSchema$1
-    }), DownloadModelResultSchema, { kind: "mutation" }),
-    deleteModel: method(external_exports.object({
-      addonId: external_exports.string(),
-      modelId: external_exports.string(),
-      format: ModelFormatSchema$1
-    }), external_exports.object({ success: external_exports.literal(true) }), { kind: "mutation" }),
+    getRetrainFrameImage: method(external_exports.object({ frameId: external_exports.string() }), external_exports.object({
+      base64: external_exports.string(),
+      width: external_exports.number().int(),
+      height: external_exports.number().int()
+    }), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * Ask the pipeline what it sees, as a PROPOSAL.
+    *
+    * Runs through `pipelineRunner.runStatelessStep` on the COPIED frame, and
+    * every box comes back as a draft with `source: 'assist'` plus the model and
+    * score that produced it. The operator confirms, edits, adds and deletes;
+    * nothing is stored until `saveRetrainAnnotations`.
+    *
+    * For packages the request is `rfdetr-package` on the ZONE CROP at 0.35 —
+    * never the whole frame, where a package detector at that threshold proposes
+    * furniture. A package request with no zone is REFUSED rather than widened,
+    * because the silent widening would look like a bad model for as long as
+    * nobody checked which rectangle it ran on.
+    */
+    proposeRetrainAnnotations: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string(),
+      frameId: external_exports.string(),
+      subject: RetrainAssistSubjectSchema,
+      /** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+      nodeId: external_exports.string().optional()
+    }), RetrainAssistResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /**
-    * Stateless single-frame execution. Callers (runner, benchmark) pass
-    * the complete `engine` + `steps` tree; the executor holds no state
-    * about cameras or saved pipelines.
+    * The FrameProcessor pass of a replay run — see the `Replay` section
+    * above this capability's definition for why this is not the
+    * `processFrame` method this file's header says pipeline-analytics does
+    * not have.
     *
-    * `engine` is optional during the migration window to preserve the
-    * legacy call shape used by existing benchmark code; once all
-    * callers pass it explicitly we make it required.
+    * Constructs a FRESH `FrameProcessor` for `(deviceId, source)`, feeds it
+    * `frames` IN THE ORDER GIVEN (the caller is responsible for time
+    * ordering — this method does not sort), and returns the tracks it
+    * produced. Zero persistence: no `TrackStore`, no event bus, no media
+    * capture. `zones` / `detectionRules` are the run's OWN zone set —
+    * typically the camera's real zones plus an ephemeral overlay
+    * (`addon-benchmark`'s `replay-plan.ts`), never read from or written to
+    * the `zones` capability by this method itself.
+    */
+    runReplayFrameProcessor: method(external_exports.object({
+      deviceId: external_exports.number(),
+      source: DetectionSourceSchema,
+      zones: external_exports.array(ZoneSchema).readonly().optional(),
+      detectionRules: external_exports.array(ZoneRuleSchema).readonly().optional(),
+      zoneMembershipMinOverlap: external_exports.number().min(0).max(1).optional(),
+      frames: external_exports.array(ReplayFrameInputSchema).min(1)
+    }), RunReplayFrameProcessorResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Every annotation on a track, oldest first. */
+    listRetrainAnnotations: method(external_exports.object({ trackId: external_exports.string() }), external_exports.array(RetrainAnnotationSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * Replace EVERY annotation on one frame with the supplied set.
     *
-    * Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
-    * `referenceImage` must be provided:
-    *  - `frame`: runtime dispatch path (runner → decoded broker frame).
-    *    Carries the raw buffer, dimensions, and format; the executor
-    *    uses it directly without base64 round-tripping.
-    *  - `frameHandle` (CB5): a zero-pixel shm `FrameHandle` for the SAME
-    *    decoded frame. Both runner and executor are hub-local processes
-    *    sharing `/dev/shm`, so the executor maps the named segment and
-    *    reads the pixels back zero-copy — eliminating the ~1.2MB
-    *    re-serialisation over UDS/MsgPack the `frame` path pays per call.
-    *    High-risk: the FrameRing is a latest-wins seqlock with no
-    *    refcount, so a recycled slot yields a null read; the executor
-    *    then degrades to an empty result and the runner ships pixels via
-    *    `frame` as the fallback (queue-depth gated on the runner side).
-    *  - `imageBase64`: one-shot test path (benchmark ImageTab).
-    *  - `referenceImage`: named file from the reference-image store.
+    * Whole-frame replacement, not per-box upsert: the unit of ground truth is
+    * the frame, and "the operator deleted a box" must be the same durable
+    * outcome as "the operator never drew it". A per-box patch would let a frame
+    * keep a box the operator removed on a surface that only knew about the
+    * boxes it sent.
+    *
+    * Refuses a macro class typed into `label` or `subLabel` — the tiers are
+    * separate and the guard is at the WRITE, because a mixed taxonomy cannot
+    * be un-mixed by reading it.
     */
-    runPipeline: method(external_exports.object({
-      engine: PipelineEngineChoiceSchema.optional(),
-      steps: external_exports.array(PipelineStepInputSchema).min(1),
-      frame: FrameInputSchema.optional(),
-      /**
-      * Process-local lazy frame. Valid only when caller and provider resolve
-      * in the same execution-group process; split/cross-node callers use
-      * `frame`/`image` inline compatibility instead.
-      */
-      frameRef: FrameRefSchema.optional(),
-      /**
-      * CB5 shm passthrough — a `FrameHandle` naming the same ring slot
-      * the decoded pixels live in. One more member of the one-of
-      * frame/frameHandle/image/imageBase64/referenceImage group.
-      */
-      frameHandle: FrameHandleSchema.optional(),
-      imageBase64: external_exports.string().optional(),
-      /**
-      * Binary JPEG bytes — preferred over `imageBase64` on internal
-      * hops (hub → forked worker via Moleculer MsgPack) because it
-      * skips the 33% base64 overhead + the per-call base64 decode on
-      * the detection-pipeline worker. Callers can pass either; exactly
-      * one of `frame`/`image`/`imageBase64`/`referenceImage` is required.
-      */
-      image: external_exports.instanceof(Uint8Array).optional(),
-      referenceImage: external_exports.string().optional(),
-      deviceId: external_exports.number().optional(),
-      sessionId: external_exports.string().optional(),
-      /**
-      * Execution plane. 'full' (default) runs the whole tree — benchmark,
-      * reference-image, and detail-subtree calls. 'frame' is the live
-      * per-frame dispatch: ONLY root-plane steps run; crop children
-      * (inputClasses ≠ null) are skipped and served per-track via
-      * pipelineRunner.runDetailSubtree (two-plane design).
-      */
-      plane: external_exports.enum(["full", "frame"]).optional(),
-      /**
-      * Inference-device selector (Phase 2 multi-device). Format
-      * `<backend>:<device>` (e.g. `openvino:gpu`, `edgetpu:usb`, `cpu`).
-      * Omitted ⇒ the runner's default device (current single-engine
-      * behaviour). Selects WHICH device pool of the node runs the call.
-      */
-      deviceKey: external_exports.string().optional(),
-      /**
-      * Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
-      * when the parent crop was resolved from the frame's retained NATIVE
-      * surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
-      * child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
-      * resolution from that surface — the SAME quality path faces already
-      * had — instead of the downscaled parent tile. `handle` keys the native
-      * surface (node-pinned to its owner); `cropFrameSpace` is the parent
-      * crop's padded/clamped rectangle in FRAME-space pixels, used to compose
-      * the executor's crop-normalized child ROI back into frame-normalized
-      * coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
-      * of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
-      * (today's behaviour on the fallback path).
-      */
-      nativeCropRef: NativeCropRefSchema.optional()
-    }), PipelineRunResultBridge, { kind: "mutation" }),
+    saveRetrainAnnotations: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string(),
+      frameId: external_exports.string(),
+      annotations: external_exports.array(RetrainAnnotationDraftSchema)
+    }), external_exports.array(RetrainAnnotationSchema).readonly(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /**
-    * Batched run — N raw frames packed into one cap call. The provider
-    * routes the batch through `SharedInferencePool.inferBatch`
-    * (`MSG_INFER_BATCH = 0x03`) so the IPC framing and JSON response
-    * envelope cost is amortised N:1 vs N concurrent `runPipeline`
-    * calls. Single root step + uniform model assumed; trees with crop
-    * children fall back to sequential execution.
+    * Finish with a track: `staging → trained`. **The only writer of that
+    * state** — D81 shipped the column with it deliberately unreachable.
     *
-    * Used by `scripts/bench-batch-style.mts` for batch benchmarking —
-    * N frames in one call to amortise per-call IPC overhead.
+    * Refuses a track the dataset holds no copies from. `trained` un-pins the
+    * track's media, so completing without a copy is a delete order for material
+    * nothing ever extracted anything from; that refusal IS the safety argument
+    * of D81, expressed as a precondition.
     */
-    runPipelineBatch: method(external_exports.object({
-      engine: PipelineEngineChoiceSchema.optional(),
-      steps: external_exports.array(PipelineStepInputSchema).min(1),
-      frames: external_exports.array(FrameInputSchema).min(1).max(255),
-      deviceId: external_exports.number().optional(),
-      sessionId: external_exports.string().optional(),
-      /**
-      * Pure-inference benchmark hint. A NONZERO uint32 pins every frame in
-      * the batch to the Python pool's bench preprocess cache
-      * (`_bench_frame_id`) so a REPEATED benchmark frame is decoded +
-      * preprocessed ONCE and every later inference is a pure-inference cache
-      * hit — the sustained-throughput run measures inference, not
-      * decode+preprocess+infer. Omitted/0 for live frames (all different →
-      * full preprocess every call, correct). Fresh per sustained run;
-      * released via `uncacheFrame`.
-      */
-      frameId: external_exports.number().int().nonnegative().optional(),
-      /** Inference-device selector (Phase 2 multi-device); see runPipeline. */
-      deviceKey: external_exports.string().optional()
-    }), external_exports.object({ results: external_exports.array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
+    completeRetrainTrack: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string()
+    }), RetrainTransitionResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /**
-    * Cache a raw frame inside the Python inference pool's memory.
-    * Returns a numeric `frameId` that `inferCached` references —
-    * subsequent calls send only 5 bytes through the pipe instead of
-    * 1.2MB raw data, eliminating the pipe transfer bottleneck.
+    * The deliberate return: `trained → staging`, for the rare case.
+    *
+    * The generic `setTrackFlags` toggle refuses this in both directions by
+    * design (D81) — re-staging from a checkbox is how the same material gets
+    * annotated twice under two ground truths. Doing it here means the operator
+    * is looking at the annotations that already exist while they decide, and
+    * those annotations are LEFT ALONE: "put this back" must not be a
+    * destructive act wearing a navigational name.
     */
-    cacheFrameInPool: method(external_exports.object({
-      data: external_exports.instanceof(Uint8Array),
-      width: external_exports.number().int().positive(),
-      height: external_exports.number().int().positive(),
-      format: external_exports.enum([
-        "rgb",
-        "bgr",
-        "gray"
-      ])
-    }), external_exports.object({
-      frameId: external_exports.number(),
-      width: external_exports.number(),
-      height: external_exports.number()
-    }), { kind: "mutation" }),
+    restageRetrainTrack: method(external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string()
+    }), RetrainTransitionResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /**
-    * Run inference on a previously cached frame. Sends only 5 bytes
-    * (model_idx + frameId) through the IPC pipe — eliminates the
-    * ~35ms per-call overhead of transferring 1.2MB raw data.
+    * Where to download the ANNOTATED dataset.
+    *
+    * The sibling of `getTrainingExportUrl` and deliberately not the same
+    * archive: that one streams a marked track's stored media verbatim, this one
+    * streams the retrain COPIES plus an `annotations.json` carrying, for every
+    * subject, the canonical full-frame box AND the geometry derived for each
+    * model shape (letterboxed root / zone-cropped package / subject-cropped
+    * classifier). Derived at export, never stored — one box in, three shapes
+    * out, so two crops of the same subject can never end up in one feature
+    * space (D52).
     */
-    inferCached: method(external_exports.object({
-      stepId: external_exports.string(),
-      frameId: external_exports.number().int()
-    }), external_exports.record(external_exports.string(), external_exports.unknown()), { kind: "mutation" }),
+    getRetrainExportUrl: method(external_exports.object({ deviceIds: external_exports.array(external_exports.number()).optional() }), external_exports.object({ url: external_exports.string() }), {
+      kind: "query",
+      auth: "admin"
+    }),
+    getEventMedia: method(external_exports.object({
+      eventId: external_exports.string(),
+      kind: MediaFileKindEnum.optional(),
+      deviceId: external_exports.number()
+    }), external_exports.array(MediaFileSchema).readonly()),
+    /** All media rows owned by a track. `kinds` narrows to a kind subset so a
+    *  client can fetch the SMALL display variants on open and pull the
+    *  multi-MB native variants only on demand (mirrors `getEventMedia.kind`).
+    *  Absent ⇒ every kind (back-compat). */
+    getTrackMedia: method(external_exports.object({
+      trackId: external_exports.string(),
+      kinds: external_exports.array(MediaFileKindEnum).optional(),
+      deviceId: external_exports.number()
+    }), external_exports.array(MediaFileSchema).readonly()),
     /**
-    * Release a cached frame from the Python pool's memory.
+    * What media a track HAS, without any of it.
+    *
+    * The detail view needs the shape of a track's media to build its strip —
+    * which kinds exist, in what order, at what size — and then wants each tile
+    * fetched as an image, not as base64 inside this response. Measured: the
+    * full `getTrackMedia` is 5.3-7.7 MB and blocks the view; this manifest is
+    * ~2 KB.
+    *
+    * It also restores a fact a `kinds` filter destroys: filtering
+    * `getTrackMedia` drops whole ROWS, taking `kind` and `sizeBytes` with
+    * them, so a client that fetched only the small variants could no longer
+    * tell a full-resolution variant existed — and the affordance that opens it
+    * would silently disappear.
     */
-    uncacheFrame: method(external_exports.object({ frameId: external_exports.number().int() }), external_exports.void(), { kind: "mutation" }),
-    /** Returns the effective pool tuning (resolved from user overrides + backend defaults). */
-    getEffectiveTuning: method(external_exports.void(), external_exports.object({
-      batchMode: external_exports.string(),
-      windowMs: external_exports.number(),
-      maxBatchSize: external_exports.number(),
-      concurrency: external_exports.number()
-    })),
+    listTrackMedia: method(external_exports.object({
+      trackId: external_exports.string(),
+      deviceId: external_exports.number()
+    }), external_exports.array(MediaFileInfoSchema).readonly()),
     /**
-    * List every EngineFactory currently loaded in this executor's RAM,
-    * with the models resident and a coarse "in use" marker derived from
-    * ongoing inference activity. Used by the Pipeline page Engines tab.
+    * Search object events by text query using CLIP cosine similarity.
+    * Encodes `text` via the `embedding-encoder` cap, queries the
+    * `ObjectEmbeddingStore` with optional prefilters, ranks all matching
+    * embeddings by cosine similarity, and joins winners to their
+    * ObjectEvents by trackId. Returns up to `limit` events scored ≥
+    * `minScore`, sorted descending by score.
     */
-    listLoadedEngines: method(external_exports.void(), external_exports.array(external_exports.object({
-      engineKey: external_exports.string(),
-      engine: PipelineEngineChoiceSchema,
-      modelsLoaded: external_exports.array(external_exports.string()).readonly(),
-      inUseByCameras: external_exports.array(external_exports.number()).readonly(),
-      /**
-      * Origin of this resident factory.
-      *  - `runtime`       — main camera-serving engine (no idle TTL).
-      *  - `warm-override` — benchmark/test override held in the warm
-      *                      cache; auto-disposed after the idle TTL.
-      *  - `device-pool`   — a concurrent per-device pool (Phase 2
-      *                      multi-device, keyed by `deviceKey`) resolved
-      *                      via `resolveDeviceFactory`. Runs alongside the
-      *                      `runtime` engine on a DIFFERENT accelerator
-      *                      (NPU / iGPU / Coral) — this is how the
-      *                      Engines tab shows all pools running at once.
-      */
-      kind: external_exports.enum([
-        "runtime",
-        "warm-override",
-        "device-pool"
-      ]),
-      /** Native pid of the underlying Python pool (null when no pool). */
-      poolPid: external_exports.number().nullable(),
-      /** ms since this factory was last used (null when not warm-tracked). */
-      idleMs: external_exports.number().nullable(),
-      /** Idle TTL after which `warm-override` factories self-evict (null when not applicable). */
-      idleTtlMs: external_exports.number().nullable()
-    })).readonly()),
-    /** Warm up an engine without running a frame. No-op if already loaded. */
-    spinEngine: method(external_exports.object({ engine: PipelineEngineChoiceSchema }), external_exports.object({ success: external_exports.literal(true) }), {
+    searchObjectEvents: method(SearchObjectEventsInput, external_exports.array(ScoredObjectEventSchema).readonly()),
+    wipeObjectEmbeddings: method(external_exports.object({}), WipeObjectEmbeddingsResultSchema, {
       kind: "mutation",
       auth: "admin"
     }),
-    /**
-    * Unload an engine from RAM. `force:true` unloads even when cameras
-    * are actively using it (they re-spin on next frame). Default is
-    * gated — returns `{success:false, reason}` when in use.
-    */
-    killEngine: method(external_exports.object({
-      engine: PipelineEngineChoiceSchema,
-      force: external_exports.boolean().optional()
-    }), external_exports.object({
-      success: external_exports.boolean(),
-      reason: external_exports.string().optional()
-    }), {
+    rebuildObjectEmbeddings: method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
       kind: "mutation",
       auth: "admin"
     }),
-    listReferenceImages: method(external_exports.void(), external_exports.array(ReferenceImageEntrySchema).readonly()),
-    getReferenceImage: method(external_exports.object({ filename: external_exports.string() }), ReferenceImageBodySchema.nullable()),
-    getReferenceAudioFiles: method(external_exports.void(), external_exports.array(ReferenceAudioEntrySchema).readonly()),
-    getReferenceAudio: method(external_exports.object({ filename: external_exports.string() }), ReferenceAudioBodySchema.nullable()),
-    getAudioCapabilities: method(external_exports.void(), AudioCapabilitiesSchema),
-    runAudioTest: method(external_exports.object({
-      addonId: external_exports.string(),
-      modelId: external_exports.string(),
-      filename: external_exports.string().optional(),
-      settings: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-    }), AudioTestResultSchema, { kind: "mutation" }),
-    getDetectionConfigSchema: method(external_exports.void(), ConfigUISchemaNullableBridge)
+    getObjectEmbeddingRebuildStatus: method(external_exports.object({}), RebuildStatusSchema)
+  },
+  events: {
+    /**
+    * Enriched frame emitted after refinement — the live-overlay source of
+    * truth (two-plane re-injection). Carries the frame's detections in the
+    * `ObjectDetection` wire shape: first-level roots (with track info +
+    * enrichment labels) plus synthesized `kind:'detail'` face/plate entries
+    * re-projected from per-track detail state, so stream overlays render
+    * boxes + recognized names without querying full Track state.
+    */
+    onFrameTracked: { data: external_exports.object({
+      deviceId: external_exports.number(),
+      timestamp: external_exports.number(),
+      frameWidth: external_exports.number(),
+      frameHeight: external_exports.number(),
+      detections: external_exports.array(OverlayDetectionSchema).readonly()
+    }) },
+    /** Track entered active state (first-seen). */
+    onTrackStarted: { data: external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string(),
+      className: external_exports.string()
+    }) },
+    /** Track expired (TTL reached after last detection). */
+    onTrackEnded: { data: external_exports.object({
+      deviceId: external_exports.number(),
+      trackId: external_exports.string(),
+      className: external_exports.string(),
+      durationMs: external_exports.number()
+    }) },
+    /** Canonical "something happened at device X" event, per-kind. */
+    onDetectionEvent: { data: external_exports.object({
+      deviceId: external_exports.number(),
+      kind: EventKindSchema,
+      eventId: external_exports.string(),
+      timestamp: external_exports.number()
+    }) }
   }
 };
 var OrchestratorMetricsSchema = external_exports.object({
@@ -26232,66 +26474,6 @@ var CameraMetricsSchema = external_exports.object({
   ])
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: external_exports.number() });
-var ZoneKindEnum = external_exports.enum(["polygon", "tripwire"]);
-var PolygonPointSchema = external_exports.object({
-  x: external_exports.number(),
-  y: external_exports.number()
-});
-var ZoneSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  kind: ZoneKindEnum.default("polygon"),
-  /** Polygon vertices, fraction of frame (0–1). */
-  polygon: external_exports.array(PolygonPointSchema).readonly(),
-  /** Visual color for UI rendering. */
-  color: external_exports.string().default("#3b82f6")
-});
-var zonesCapability = {
-  name: "zones",
-  scope: "device",
-  mode: "singleton",
-  deviceTypes: [DeviceType.Camera],
-  methods: {
-    listZones: method(external_exports.object({ deviceId: external_exports.number() }), external_exports.array(ZoneSchema).readonly()),
-    addZone: method(external_exports.object({
-      deviceId: external_exports.number(),
-      zone: ZoneSchema
-    }), external_exports.void(), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    removeZone: method(external_exports.object({
-      deviceId: external_exports.number(),
-      zoneId: external_exports.string()
-    }), external_exports.void(), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    updateZone: method(external_exports.object({
-      deviceId: external_exports.number(),
-      zone: ZoneSchema
-    }), external_exports.void(), {
-      kind: "mutation",
-      auth: "admin"
-    })
-  },
-  /**
-  * Runtime-state slice — the live zone catalogue mirrored by the
-  * orchestrator on every CRUD mutation. Consumers read via
-  * `device.state.zones.value` / `.watch(...)` without round-tripping
-  * the cap, and the codegen DeviceProxy auto-wires the reactive
-  * handle. Slice shape is `{ zones: Zone[] }` so future extensions
-  * (e.g. zone groupings) can sit alongside the polygon list.
-  */
-  runtimeState: external_exports.object({ zones: external_exports.array(ZoneSchema).readonly() }),
-  /**
-  * Runtime-state durability: **restored** — written only on operator mutation, so a camera that never had one has nothing to re-derive from. This is the slice `zone-mirror-hydration.ts` exists to paper over.
-  *
-  * See `RuntimeStateDurability`. Enforced by
-  * `scripts/check-runtime-state-durability.ts`.
-  */
-  durability: "restored"
-};
 var NativeCropBboxSchema = external_exports.object({
   x: external_exports.number(),
   y: external_exports.number(),
@@ -35229,6 +35411,23 @@ var ReadGopBytesResultSchema = external_exports.object({
   /** Media ms the returned fragment covers. */
   gopDurMs: external_exports.number()
 });
+var ReadWindowBytesResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
+  kind: external_exports.literal("ok"),
+  data: external_exports.instanceof(Uint8Array),
+  /** Absolute epoch ms of the returned bytes' first sample — at or before
+  *  the requested `fromMs` (anchored on the nearest keyframe). */
+  gopStartMs: external_exports.number(),
+  /** Media ms the returned bytes cover, from `gopStartMs`. */
+  gopDurMs: external_exports.number(),
+  /** `false` ⇒ the safety byte cap cut the read short before it reached
+  *  the requested `toMs`; the caller got fewer frames than asked for. */
+  reachesRequestedEnd: external_exports.boolean()
+}), external_exports.object({
+  kind: external_exports.literal("spans-multiple-segments"),
+  /** Where the covering segment's own footage runs out — informational,
+  *  not a retry hint (retrying the same window would refuse again). */
+  segmentEndMs: external_exports.number()
+})]);
 var recordingCapability = {
   name: "recording",
   scope: "system",
@@ -35308,6 +35507,21 @@ var recordingCapability = {
       kind: "query",
       auth: "admin"
     }),
+    /** Read a WINDOW `[fromMs, toMs)` of segment `startMs`, by mfra byte
+    *  range — the multi-GOP twin of `readGopBytes`. Refuses (does not
+    *  degrade) when the window runs past the covering segment. Used by the
+    *  replay clip's `recording` source to fetch several seconds of native
+    *  footage for its single ffmpeg decode pass. */
+    readWindowBytes: method(external_exports.object({
+      deviceId: external_exports.number(),
+      profile: external_exports.string(),
+      startMs: external_exports.number(),
+      fromMs: external_exports.number(),
+      toMs: external_exports.number()
+    }), ReadWindowBytesResultSchema, {
+      kind: "query",
+      auth: "admin"
+    }),
     setDeviceConfig: method(external_exports.object({
       deviceId: external_exports.number(),
       config: RecordingConfigSchema
@@ -35872,59 +36086,6 @@ var sceneMonitorCapability = {
   */
   durability: "session"
 };
-var ZoneRuleModeEnum = external_exports.enum(["include", "exclude"]);
-var ZoneRuleSchema = external_exports.object({
-  /** Stable rule id — survives edits, used by the UI for diffing. */
-  id: external_exports.string(),
-  /** Optional human-readable label rendered in the rule editor. */
-  name: external_exports.string().optional(),
-  /** Zones this rule targets. The rule's `mode` applies to ALL
-  *  listed zones (OR-set: a detection in any one of them counts).
-  *  At least one zone id required — a rule with no targets is a
-  *  configuration mistake and the form validator rejects it. */
-  zoneIds: external_exports.array(external_exports.string()).min(1).readonly(),
-  mode: ZoneRuleModeEnum,
-  /**
-  * Class names this rule applies to. Empty / undefined ⇒ rule
-  * applies to every class. Class strings match the `macroClass`
-  * field on detections (e.g. `person`, `car`, `dog`).
-  */
-  classFilter: external_exports.array(external_exports.string()).readonly().optional(),
-  /**
-  * Minimum bbox/mask overlap (0–1) with any of the rule's zones
-  * required to consider an entity "in the zone". Defaults to the
-  * consumer's stage default when omitted. Kept for back-compat with
-  * existing per-rule overrides; new operators pick the value via
-  * `bboxInclusionPct` (operator-friendly 0–100). Whichever field is
-  * set, the lower-level engine reads it as a 0–1 fraction.
-  */
-  overlapThreshold: external_exports.number().min(0).max(1).optional(),
-  /**
-  * Operator-friendly version of `overlapThreshold` — the percentage
-  * of the detection's bbox that must lie inside the zone for the
-  * rule to match. Documented default is 85%; the engine substitutes
-  * that when the field is omitted (kept optional so existing rules
-  * stored without it stay valid).
-  *
-  * When BOTH `overlapThreshold` and `bboxInclusionPct` are set on a
-  * rule, the engine prefers `bboxInclusionPct` because it's the
-  * field exposed in the UI. Internally both feed the same gate.
-  */
-  bboxInclusionPct: external_exports.number().min(0).max(100).optional(),
-  /**
-  * When `true` and a detection has a segmentation mask, use the
-  * mask for overlap instead of the bbox. Detection-stage only;
-  * motion rules ignore this field.
-  */
-  preferMask: external_exports.boolean().optional(),
-  /**
-  * Soft-toggle: `false` disables the rule without deleting it.
-  * Defaults to `true` so operators creating a rule via the UI
-  * see it active immediately.
-  */
-  enabled: external_exports.boolean().default(true)
-});
-var ZoneRulesArraySchema = external_exports.array(ZoneRuleSchema).readonly();
 var ScriptRunnerStatusSchema = external_exports.object({
   /** Whether the script is currently executing. */
   isRunning: external_exports.boolean(),
@@ -40179,6 +40340,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "notificationRules.resolveArtifactUrl": {
+    capName: "notification-rules",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "notificationRules.setAlarmConfig": {
     capName: "notification-rules",
     capScope: "system",
@@ -40623,6 +40790,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.runReplayFrameProcessor": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.saveRetrainAnnotations": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -40755,6 +40928,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineExecutor.getInferenceDeviceHealth": {
+    capName: "pipeline-executor",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "pipelineExecutor.getOrchestratorConfigSchema": {
     capName: "pipeline-executor",
     capScope: "system",
@@ -40827,6 +41006,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineExecutor.rearmInferenceDevice": {
+    capName: "pipeline-executor",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "pipelineExecutor.runAudioTest": {
     capName: "pipeline-executor",
     capScope: "system",
@@ -41565,6 +41750,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "recording.readWindowBytes": {
+    capName: "recording",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "recording.refreshStorageLocationsForMigration": {
     capName: "recording",
     capScope: "system",
@@ -44075,6 +44266,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "pipelineAnalytics.runReplayFrameProcessor": [{
+    name: "deviceId",
+    form: "single",
+    optional: false
+  }],
   "pipelineAnalytics.saveRetrainAnnotations": [{
     name: "deviceId",
     form: "single",
@@ -44390,6 +44586,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "recording.readWindowBytes": [{
+    name: "deviceId",
+    form: "single",
+    optional: false
+  }],
   "recording.relocateFootage": [{
     name: "deviceId",
     form: "single",